为关键任务无人机群设计安全架构，实现故障容错与飞行核心隔离。
A Safety-Driven Architectural Framework for Fail-Operational Drone Swarms in Critical Missions
- 采用分层硬件隔离的监控模块，确保飞行核心与非确定性集群管理解耦。
- 通过健康向量驱动任务重分配，使系统在故障时仍能保持运行能力。
- 满足每飞行小时10^-7次危险级故障目标，适合高安全性要求场景。
无人机群在关键任务中的认证需要可验证的设计保障。航空适航标准要求确定性可靠性，而多智能体协调算法通常基于非确定性模型。本文提出一种混合关键性架构框架，应用SAE ARP4754B方法进行集群重构。首先，硬件隔离的安全监控器作为运行时保障（RTA）网关，将飞行关键核心与非确定性集群管理器解耦。其次，监控器基于功能危害分析（FHA）系统生成的代理健康向量，强制执行形式化安全合约。第三，健康向量传递至集体规划器，触发故障容错的任务重新分配，实现智能集群行为而不损害飞行关键隔离。马尔可夫可靠性建模表明，在SAIL IV场景下，若安全监控器可靠性高于0.9991，则理论上可达每飞行小时10^-7次危险级故障的目标，符合DAL B级别的CMD/MON实现要求。
原文摘要 · Abstract (English)
The certification of Unmanned Aerial Vehicle (UAV) swarms for safety-critical operations requires verifiable design assurance. Airworthiness standards demand deterministic reliability, whereas multi-agent coordination algorithms execute non-deterministic models. This paper proposes a mixed-criticality architectural framework that applies SAE ARP4754B methods to swarm reconfiguration. First, a hardware-isolated Safety Monitor functions as a Run-Time Assurance (RTA) gateway, decoupling the flight-critical core from the non-deterministic Swarm Manager. Second, the monitor enforces formal safety contracts based on agent Health Vectors derived systematically from a Functional Hazard Assessment (FHA). Third, the framework propagates these Health Vectors to the collective planner to trigger fail-operational task reallocation, enabling intelligent swarm behaviors without compromising flight-critical isolation. Markov reliability modeling demonstrates that the $10^{-7}$ failures per flight hour Hazardous target is theoretically achievable for our SAIL IV scenario, provided the Safety Monitor meets $C_{monitor}>0.9991$, consistent with DAL B CMD/MON implementations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。