发表机构
Mälardalen University（梅拉达伦大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对安全关键操作中无人机集群的认证需求，提出结合SAE ARP4754B方法的混合关键度架构框架，通过硬件隔离的安全监控器实现飞行关键核心与集群管理器解耦，经马尔可夫建模可满足危险故障要求。
AI 中文摘要
对用于安全关键操作的无人机（UAV）集群进行认证需要可验证的设计保证。适航标准要求确定性可靠性，而多智能体协调算法执行非确定性模型。本文提出一种混合关键度架构框架，将SAE ARP4754B方法应用于集群重构。首先，硬件隔离的安全监控器作为运行时保证（RTA）网关，将飞行关键核心与非确定性集群管理器解耦。其次，该监控器基于通过功能危害评估（FHA）系统推导的智能体健康向量，执行形式化安全契约。第三，该框架将这些健康向量传播至集体规划器，触发故障可运行任务重新分配，在不损害飞行关键隔离的前提下实现智能集群行为。马尔可夫可靠性建模表明，若安全监控器满足C_monitor>0.9991（符合DAL B CMD/MON实现要求），在SAIL IV场景下理论上可达到每飞行小时10^-7次危险目标故障的要求。
英文摘要
The certification of Unmanned Aerial Vehicle (UAV) swarms for safety-critical operations requires verifiable design assurance. Airworthiness standards demand deterministic reliability, whereas multi-agent coordination algorithms execute non-deterministic models. This paper proposes a mixed-criticality architectural framework that applies SAE ARP4754B methods to swarm reconfiguration. First, a hardware-isolated Safety Monitor functions as a Run-Time Assurance (RTA) gateway, decoupling the flight-critical core from the non-deterministic Swarm Manager. Second, the monitor enforces formal safety contracts based on agent Health Vectors derived systematically from a Functional Hazard Assessment (FHA). Third, the framework propagates these Health Vectors to the collective planner to trigger fail-operational task reallocation, enabling intelligent swarm behaviors without compromising flight-critical isolation. Markov reliability modeling demonstrates that the $10^{-7}$ failures per flight hour Hazardous target is theoretically achievable for our SAIL IV scenario, provided the Safety Monitor meets $C_{monitor}>0.9991$, consistent with DAL B CMD/MON implementations.
Comments10 pages, 7 figures. Accepted for presentation at the 45th AIAA/IEEE Digital Avionics Systems Conference (DASC), Orlando, FL, USA, 2026. \c{opyright} 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses
