We also assume airplane loadable software design is fault-tolerant, e.g. multiple instances of software exist in system to prevent a single point of failure during execution. Moreover, we assume that redundancy checks help prevent installing manipulated software on airplane LRUs. Nevertheless, threats to the service provided by AADS emerge as discussed next.