A Safety-Driven Architectural Framework for Fail-Operational Drone Swarms in Critical Missions

Luiz Giacomossi; Zafer Yigit; Marwan Shakarna; Shoaib Saleemi; Ivan Tomasic; Baran Çurüklü; Håkan Forsberg

eess.SYAug 21, 2026

A Safety-Driven Architectural Framework for Fail-Operational Drone Swarms in Critical Missions

Authors: Luiz Giacomossi, Zafer Yigit, Marwan Shakarna, Shoaib Saleemi, Ivan Tomasic, Baran Çurüklü, Håkan Forsberg

Abstract

The certification of Unmanned Aerial Vehicle (UAV) swarms for safety-critical operations requires verifiable design assurance. Airworthiness standards demand deterministic reliability, whereas multi-agent coordination algorithms execute non-deterministic models. This paper proposes a mixed-criticality architectural framework that applies SAE ARP4754B methods to swarm reconfiguration. First, a hardware-isolated Safety Monitor functions as a Run-Time Assurance (RTA) gateway, decoupling the flight-critical core from the non-deterministic Swarm Manager. Second, the monitor enforces formal safety contracts based on agent Health Vectors derived systematically from a Functional Hazard Assessment (FHA). Third, the framework propagates these Health Vectors to the collective planner to trigger fail-operational task reallocation, enabling intelligent swarm behaviors without compromising flight-critical isolation. Markov reliability modeling demonstrates that the $10^{-7}$ failures per flight hour Hazardous target is theoretically achievable for our SAIL IV scenario, provided the Safety Monitor meets $C_{monitor}>0.9991$ , consistent with DAL B CMD/MON implementations.

Figures & tables

Fig. 1: Data flow of the Verifiable Health-Aware Framework. The architecture acts as a Hardware Isolation Boundary between physical and logical domains. (1) Physical Layer: Component faults (e.g., a propulsion degraded motor failure) are detected by the Safety Monitor. (2) Safety Monitor: The FMU uses a “Lock and Filter” mechanism to constrain control and filter fault data. (3) Swarm Logic: The resulting “Health Vector” (e.g., $\langle\text{NOMINAL},\text{DEGRADED},\text{NOMINAL}\rangle$ , Eq. 1 ) is broadcast to the collective, triggering autonomous reallocation of mission tasks to healthy neighbors (icons show logical transfer).

ID	Hazard Description	Severity	Target Prob.
H-01	Mid-air or terrain collision of multiple drones.	Catastrophic	$<10^{-9}$ /hr
H-02	Uncontrolled crash of a single drone.	Hazardous	$<10^{-7}$ /hr
H-03	Failure to detect the search target (Mission Failure).	Minor	$<10^{-3}$ /hr
H-06	Loss of Command and Control (C2) link.	Major	$<10^{-5}$ /hr
H-07	Unauthorized control of the swarm.	Catastrophic	$<10^{-9}$ /hr

TABLE I: System-Level Hazards (Aligned with JARUS SORA SAIL IV)

Function	Failure Condition	Effect on System/Mission	Severity	Target FDAL
F1: Safety Monitoring (FMU)	Loss of isolation, missed fault detection, or spurious contract enforcement	Uncontained swarm faults propagate to flight core; risk of uncontrolled crash (H-02).	Hazardous	DAL B
F2: Flight & Navigation a	Loss of ability to determine state (position/attitude)	Uncontrolled descent; potential crash (H-02).	Hazardous	DAL B
F3: Target Detection	Failure to detect valid target (False Negative)	Reduced search effectiveness (H-03).	Minor	DAL D
F4: Swarm Coord. Broadcast b	Transmission of corrupted trajectory data	Risk of inter-agent collision (H-01) if not validated.	Hazardous	DAL D (B with monitor)
F5: Power Management	Incorrect State of Charge (SoC) reporting	Unexpected depletion and crash (H-02).	Major	DAL C

TABLE II: Functional Hazard Assessment (FHA) with Calibrated Design Assurance Levels (DAL)

Atomic Signal	Threshold Condition	Functional State ( $\sigma$ )	Health Vector Component
RPM mismatch	$\|\text{RPM}_{cmd}-\text{RPM}_{meas}\|>\epsilon_{RPM}$	DEGRADED	$\sigma_{prop}$
Battery voltage	$V_{batt}\leq V_{crit}$	DEGRADED	$\sigma_{prop}$
GNSS HDOP	$\text{HDOP}>\text{HDOP}_{max}$	FAILED	$\sigma_{nav}$
Heartbeat timeout	$t-t_{last\_hb}>\tau_{timeout}$	FAILED	$\sigma_{comm}$
SNR	$\text{SNR}<\text{SNR}_{min}$	FAILED	$\sigma_{comm}$

TABLE III: Hierarchical Mapping of Atomic Faults to Health Vector States

Fig. 2: Functional Control Architecture. Logical view of safety hierarchy and DAL boundaries. The FMU is a high-integrity Run-Time Assurance (RTA) gateway (DAL B). To prevent untrusted DAL D Mission Tasks from violating constraints, the FMU applies a “Lock and Filter” mechanism (denoted by the padlock symbol): Supervisory Commands override mission inputs in the FCS if a safety contract breaches. Bidirectional links enable FMU subsystem monitoring and broadcast the aggregated Health Vector to the swarm.

Fig. 3: Conceptual block diagram of the proposed fault-tolerant architecture. The system partitions into a Flight-Critical Core (DAL C) and a Mission and Perception System (DAL D , fail-silent). Redundancy includes dual-channel power and flight computers. The supervisory Safety Monitor (FMU) (DAL B) uses a Command/Monitor (CMD/MON) architecture to enforce safety contracts via the Safety Monitor Interface (SMI) . The SMI is shown at top and bottom for layout clarity; both represent the same logical hardware channel isolating safety traffic from redundant CAN buses.

Fig. 4: Finite State Machine (FSM) for an individual agent. Any fault in a nominal state triggers transition to Fault Handling Logic.

Hazard ID	Mitigating Architectural Features (from Section IV)
H-01 Collision	Layered Defense: Swarm planner (DAL D) provides strategic deconfliction; Reactive OD&CAS (DAL D) provides tactical avoidance; Flight Core (DAL C) enforces geofencing limits.
H-02 Crash	Hardware Isolation: Dual-redundant Flight Core (DAL C); Independent Safety Monitor (FMU, DAL B) prevents SCM from commanding unsafe states via the Safety Contract.
H-03 Mission Fail	Swarm Reconfiguration: Task re-allocation logic (SSR-MSN-02) triggered by Health Vector $H_{i}(t)$ updates via SMI.
H-06 Link Loss	Diversity: Redundant D2D/D2GCS radios. Loss of GCS triggers mesh-based autonomous replanning; Loss of Mesh (D2D) triggers independent ’Return-to-Base’.
H-07 Unauth. Access	Encryption: Authenticated encryption on all SMI and COM links (SSR-SEC-01).

TABLE IV: Traceability of Hazards to Architectural Mitigations

Fig. 5: Qualitative Fault Tree Analysis (FTA) for the ’Mid-Air Collision’ (H-01) swarm-emergent hazard. The tree demonstrates the system’s multi-layered safety architecture for intra-swarm collision, requiring failures in both high-level (cooperative) and low-level (reactive) avoidance layers.

Panel of Figure 10 — Fig. 6: Markov Chain model of the architecture. $S_{0}$ : Nominal operation. $S_{1}$ : Successfully contained fault (Fail-Operational). $S_{Haz}$ : Uncontained failure. System safety depends on Monitor Coverage ( $C_{monitor}$ ). $\lambda_{safe}$ is the secondary failure rate from degraded state $S_{1}$ . During short RTB recovery, this transition is dominated by $\lambda_{FC}$ and bounded as described in the text.

$\lambda_{FC}$ (per flight hour)	Required $C_{monitor}$	Achievable Implementation
$10^{-3}$	$>0.99991$	DAL A CMD/MON architecture
$10^{-4}$	$>0.9991$	DAL B CMD/MON architecture
$10^{-5}$	$>0.991$	DAL C architecture (e.g. lockstep strategy for detecting random faults)
$10^{-6}$	$>0.91$	Software monitor sufficient

TABLE V: Sensitivity of Required Safety Monitor Coverage to Flight Computer Failure Rate

\lambda_{FC}

Criterion	Single-Agent FTC [ 11 ]	Std. RTA (ASTM F3269)	Proposed Architecture
Scope	Single Drone Only	Single Drone Only	Swarm & Agent
Safety Mechanism	Algorithmic Redundancy (Kalman Filters)	Simplex Monitor (Switch to Safe Controller)	Hardware Monitor + Swarm Reconfiguration
Response to Fault	Adjust Control Laws (Local)	Terminate / Loiter (Local)	Propagate Health Vector $H_{i}(t)\rightarrow$ Global Replan
Mixed-Criticality	No (All software is critical)	Yes (Monitor vs. Complex)	Yes (DAL B Monitor / DAL C Flight Core / DAL D Swarm)
SWaP & Scope	Low (any platform)	Low-Medium (any platform)	High - targets $>10$ kg MTOW; excludes micro-UAVs

TABLE VI: Comparative Analysis of Architectures

Fig. 7: Operational Sequence of the Verifiable Health-Aware Framework. ( t0 ) Nominal operation: Swarm executes search under AI control. ( t1 ) Fault Detection: Upon hardware fault detection (e.g., motor loss), the Safety Monitor isolates the Agent $D$ into a safety envelope ( $v\leq v_{safe}$ ) and broadcasts a degraded Health Vector $H_{D}(t)$ . ’Shield’ denotes the enforcement of the Safety Contract by the FMU. ( t2 ) Reconfiguration: The swarm updates the distributed Cost Function (Eq. 7 ), penalizing Agent $D$ and re-allocating its search sectors to healthy neighbors (e.g., Agents $A$ and $C$ ).

Safety-Critical Control

Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.

See all 128 papers

Market-Based Replanning for Safety-Critical UAV Swarms in Search and Rescue Missions
Jun 1, 2026Luiz Giacomossi, Andrea Haglund, Claire Namatovu +6Aerial Robotics Swarm Robotics
Mälardalen University (MDU) Västerås, Sweden
Sensor-Driven Mission Synthesis for UAV/UGV Swarms: A TB-CSPN Coordination Architecture with Hardware-Enforced Safety
Aug 14, 2026Uwe M. Borghoff, Paolo Bottoni, Remo PareschiMulti-Robot Coordination Multi-Robot Systems
Institute for Software Technology, University of the Bundeswehr Munich, 85579 Neubiberg, Germany · Department of Computer Science, Sapienza University of Rome, 00161 Rome, Italy · SofTware And Knowledge Engineering Lab, STAKE lab, 86100 Campobasso, Italy
SwarmFly: A simulation platform for UAV swarm experiment design and validation
Jun 23, 2026Abhishek Phadke, Karthik Kumar Vasudeva, Abhishek JoshiAerial Robotics Swarm Robotics
School of Engineering and Computing, Christopher Newport University · Department of Mathematics and Statistics, Texas Tech University · Department of Computer Science, Texas A&M University-Corpus Christi

Jun 1, 2026J/K move · Enter open · S save

Market-Based Replanning for Safety-Critical UAV Swarms in Search and Rescue Missions

Luiz Giacomossi, Andrea Haglund, Claire Namatovu, Emily Zainali+5

Mälardalen University (MDU) Västerås, Sweden

Aerial Robotics Swarm Robotics Robotics Multi-Robot Coordination Multi-Robot Task Allocation Search-and-Rescue Robotics

Open paper AskPDF arXiv

Reliable autonomous UAV swarms in Search and Rescue (SAR) missions require fault-tolerant coordination capable of sustaining operations despite agent degradation. This paper introduces the Intelligent Replanning Drone Swarm (IRDS), a distributed coordination architecture designed for resource-constrained environments. The proposed framework employs a Reverse-Auction market mechanism where agents bid to service search sectors based on a distance-weighted cost function, coupled with a geometric consensus protocol for target verification. We evaluate the approach through physics-based simulations (N=8 agents, 8x8 grid) subjected to stochastic fault injection. Results indicate that the swarm autonomously reallocates tasks from failed agents with low latency relative to the total mission duration, maintaining a mission success rate of 93% under 25% workforce degradation. The proposed framework demonstrates a robust, empirically tested method for self-healing aerial robotic coordination.

Abstract

Safety-Critical Control

Explore similar work

Market-Based Replanning for Safety-Critical UAV Swarms in Search and Rescue Missions

Sensor-Driven Mission Synthesis for UAV/UGV Swarms: A TB-CSPN Coordination Architecture with Hardware-Enforced Safety

SwarmFly: A simulation platform for UAV swarm experiment design and validation