A Safety-Driven Architectural Framework for Fail-Operational Drone Swarms in Critical Missions
Abstract
The certification of Unmanned Aerial Vehicle (UAV) swarms for safety-critical operations requires verifiable design assurance. Airworthiness standards demand deterministic reliability, whereas multi-agent coordination algorithms execute non-deterministic models. This paper proposes a mixed-criticality architectural framework that applies SAE ARP4754B methods to swarm reconfiguration. First, a hardware-isolated Safety Monitor functions as a Run-Time Assurance (RTA) gateway, decoupling the flight-critical core from the non-deterministic Swarm Manager. Second, the monitor enforces formal safety contracts based on agent Health Vectors derived systematically from a Functional Hazard Assessment (FHA). Third, the framework propagates these Health Vectors to the collective planner to trigger fail-operational task reallocation, enabling intelligent swarm behaviors without compromising flight-critical isolation. Markov reliability modeling demonstrates that the failures per flight hour Hazardous target is theoretically achievable for our SAIL IV scenario, provided the Safety Monitor meets , consistent with DAL B CMD/MON implementations.
Figures & tables
| ID | Hazard Description | Severity | Target Prob. |
|---|---|---|---|
| H-01 | Mid-air or terrain collision of multiple drones. | Catastrophic | /hr |
| H-02 | Uncontrolled crash of a single drone. | Hazardous | /hr |
| H-03 | Failure to detect the search target (Mission Failure). | Minor | /hr |
| H-06 | Loss of Command and Control (C2) link. | Major | /hr |
| H-07 | Unauthorized control of the swarm. | Catastrophic | /hr |
| Function | Failure Condition | Effect on System/Mission | Severity | Target FDAL |
|---|---|---|---|---|
| F1: Safety Monitoring (FMU) | Loss of isolation, missed fault detection, or spurious contract enforcement | Uncontained swarm faults propagate to flight core; risk of uncontrolled crash (H-02). | Hazardous | DAL B |
| F2: Flight & Navigation a | Loss of ability to determine state (position/attitude) | Uncontrolled descent; potential crash (H-02). | Hazardous | DAL B |
| F3: Target Detection | Failure to detect valid target (False Negative) | Reduced search effectiveness (H-03). | Minor | DAL D |
| F4: Swarm Coord. Broadcast b | Transmission of corrupted trajectory data | Risk of inter-agent collision (H-01) if not validated. | Hazardous | DAL D (B with monitor) |
| F5: Power Management | Incorrect State of Charge (SoC) reporting | Unexpected depletion and crash (H-02). | Major | DAL C |
| Atomic Signal | Threshold Condition | Functional State ( ) | Health Vector Component |
|---|---|---|---|
| RPM mismatch | DEGRADED | ||
| Battery voltage | DEGRADED | ||
| GNSS HDOP | FAILED | ||
| Heartbeat timeout | FAILED | ||
| SNR | FAILED |
| Hazard ID | Mitigating Architectural Features (from Section IV) |
|---|---|
| H-01 Collision | Layered Defense: Swarm planner (DAL D) provides strategic deconfliction; Reactive OD&CAS (DAL D) provides tactical avoidance; Flight Core (DAL C) enforces geofencing limits. |
| H-02 Crash | Hardware Isolation: Dual-redundant Flight Core (DAL C); Independent Safety Monitor (FMU, DAL B) prevents SCM from commanding unsafe states via the Safety Contract. |
| H-03 Mission Fail | Swarm Reconfiguration: Task re-allocation logic (SSR-MSN-02) triggered by Health Vector updates via SMI. |
| H-06 Link Loss | Diversity: Redundant D2D/D2GCS radios. Loss of GCS triggers mesh-based autonomous replanning; Loss of Mesh (D2D) triggers independent ’Return-to-Base’. |
| H-07 Unauth. Access | Encryption: Authenticated encryption on all SMI and COM links (SSR-SEC-01). |
| (per flight hour) | Required | Achievable Implementation |
|---|---|---|
| DAL A CMD/MON architecture | ||
| DAL B CMD/MON architecture | ||
| DAL C architecture (e.g. lockstep strategy for detecting random faults) | ||
| Software monitor sufficient |
| Criterion | Single-Agent FTC [ 11 ] | Std. RTA (ASTM F3269) | Proposed Architecture |
|---|---|---|---|
| Scope | Single Drone Only | Single Drone Only | Swarm & Agent |
| Safety Mechanism | Algorithmic Redundancy (Kalman Filters) | Simplex Monitor (Switch to Safe Controller) | Hardware Monitor + Swarm Reconfiguration |
| Response to Fault | Adjust Control Laws (Local) | Terminate / Loiter (Local) | Propagate Health Vector Global Replan |
| Mixed-Criticality | No (All software is critical) | Yes (Monitor vs. Complex) | Yes (DAL B Monitor / DAL C Flight Core / DAL D Swarm) |
| SWaP & Scope | Low (any platform) | Low-Medium (any platform) | High - targets kg MTOW; excludes micro-UAVs |
Safety-Critical Control
Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.
See all 128 papers