A Multi-Layer Resilient Architecture for Autonomous Quadcopter-Based Bridge Inspection Under Environmental Uncertainties

Highlights

What are the main findings?

• The study introduces a resilient multi-layer autonomy architecture that improves planning and control safety for UAV inspections.
• Extensive simulations, including single- and multi-UAV scenarios, demonstrate high trajectory reliability and reduced deviation under challenging or uncertain conditions.

What are the implications of the main findings?

• Multi-level runtime assurance enables safer and more reliable UAV behavior in windy or cluttered environments, with limited performance degradation.
• The approach supports decentralized multi-UAV operations, reducing inspection time while maintaining data quality and operational safety.

Abstract

This paper presents a multi-layer architecture designed to enhance the reliable autonomous flight of single and multiple quadcopters in simulation. The architecture leverages concepts inspired by the resilient spacecraft executive to hierarchically organize trajectory planning and flight control and integrates an extended Simplex framework that employs multiple candidate algorithms to provide safety assurance at each layer, with a supervisory program that adapts Simplex behavior based on system states and environmental conditions to enable high-level mission management. The approach is evaluated in bridge-inspection simulations under environmental uncertainties, including varying wind conditions and obstacles. Across multiple operating configurations and Monte Carlo simulation runs, the architecture achieves high coverage rates; notably, under high-wind conditions, it reduces average trajectory deviation by 66.2%. The results demonstrate proactive safety through graceful degradation in both trajectory planning and flight control under stress and off-nominal conditions.

1. Introduction

Multi-rotor Unmanned Aerial Vehicles (UAVs) have seen rapid advances in autonomy, enabling capabilities, such as environmental perception [1], trajectory planning [2], flight control [3], and mission-level management [4]. These advances have expanded UAV applications beyond urban navigation to domains, including infrastructure inspection [5,6], precision agriculture [7], and emergency response [8]. Among these, bridge inspection represents a particularly challenging mission. Conventional methods are often labor-intensive and hazardous, whereas UAV-based inspection offers improved safety and efficiency through high-resolution, multi-angle data collection [9,10].

Despite significant progress in subsystem-level algorithms, such as robust flight control [11,12,13,14,15,16,17,18,19,20,21,22,23,24] and trajectory planning [25,26,27,28], deploying autonomous UAVs in long-horizon bridge inspection missions remains difficult. These environments are characterized by uncertainties, including wind disturbances, Global Navigation Satellite System (GNSS)-denied conditions, visual occlusion, and sensor degradation. Over extended missions, deviations from nominal conditions (e.g., reduced sensing fidelity, computational overload, or control degradation) can accumulate, leading to degraded performance or system failure [29,30,31]. Therefore, prioritizing compound safety, rather than relying solely on isolated algorithmic robustness, is critical for executing complex tasks.

Prior research on UAV reliability has largely focused on fault-tolerant control and failure mitigation [32], including fault detection and isolation for inertial measurement units and other onboard sensors [33,34,35,36], actuator fault accommodation [37,38,39,40], and post-failure mitigation strategies, such as ground impact hazard management [41]. While effective for handling component-level failures, these approaches are typically reactive, intervening only after faults or errors occur. In contrast, this work targets proactive safety, aiming to prevent unsafe states before failures happen, particularly under compounded environmental and operational uncertainties.

This paper proposes a multi-layer architecture for autonomous multi-rotor UAVs, specifically designed for bridge inspection missions. The architecture integrates a multi-level Simplex framework with concepts from the Resilient Spacecraft Executive (RSE) [42] to structure the autonomy stack across trajectory-planning and flight-control layers. Each layer incorporates a Simplex component augmented with a compound high-assurance (HA) module, composed of multiple diverse HA algorithms. A runtime evaluation mechanism dynamically selects the most appropriate HA algorithm based on key system states, allowing the architecture to expand its stable operational envelope while maintaining safety. This design supports the safe incorporation of High-Performance (HP) algorithms, including learning-based algorithms [43,44].

While the implemented multi-layer Simplex framework is designed to address a broad range of environmental uncertainties, a mission-level monitoring module is also implemented, providing a cross-layer coordination interface for runtime configuration through pre-defined mediation modes. Serving as the high-level coordination core, this module orchestrates the underlying Simplex layers to maintain an adaptive balance between performance and safety throughout the inspection mission. The proposed mission-level mode-selection capability is evaluated in simulation.

This study substantially extends our prior work [45] by providing a complete formulation of the multi-layer runtime evaluation mechanism and a significantly expanded evaluation. The architecture is validated in high-fidelity simulated bridge inspection scenarios using pre-acquired point cloud data. Results include single- and multi-UAV scenarios under wind disturbances and unknown obstacles, as well as extensive Monte Carlo studies covering a wide range of stochastic uncertainties. The results indicate robust inspection execution and graceful degradation at trajectory planning and flight control levels under stress, suggesting the effectiveness of a multi-layer Simplex-based system architecture for UAV autonomous simulation flight. The study does not quantify the marginal benefit of multi-layer versus single-layer Simplex or compound HA versus single HA.

The main technical contributions of this paper are summarized as follows:

• A proactive safety architecture for trajectory planning and flight control, with independent Simplex components deployed at the planning and control layers.
• Compound HA subsystems for the Simplex components, enabling adaptive selection among multiple HA algorithms to expand the stable operating envelope.
• A mission-level monitoring and coordination module that provides system-level adaptive configuration of the underlying Simplex components, validated via multi-level integration and Software-In-The-Loop (SITL) simulation.

2. Related Work

This section reviews prior work relevant to resilient UAV autonomy in safety-critical tasks. The discussion focuses on robustness in flight control and trajectory planning, Simplex-based runtime safety assurance, and multi-level architectures. Emphasis is placed on identifying limitations of existing approaches under compounded environmental uncertainties, thereby motivating the multi-layer Simplex integration proposed in this work.

2.1. Robustness in Flight Control and Trajectory Planning

Robust flight control has been widely studied to mitigate environmental disturbances, modeling uncertainties, and partial system degradation in UAVs. Classical approaches, such as Sliding Mode Control (SMC) and adaptive control, provide strong disturbance rejection and parameter uncertainty compensation, particularly in wind-disturbed environments [46,47]. Model Predictive Control (MPC) enables constraint-aware control but depends on model accuracy and available computational resources [48].

Advanced nonlinear robustness frameworks have also been explored. Energy-based and passivity-based methods, including Interconnection and Damping Assignment-Passivity Based Control (IDA-PBC) for non-separable port-Hamiltonian systems under time-varying disturbances, offer rigorous stability properties for underactuated or payload-transporting quadrotors [49]. Linear Matrix Inequality (LMI)-based robust and H-infinity control approaches provide systematic synthesis procedures but typically rely on linearized dynamics and offline tuning [50,51].

Observer-based and learning-based techniques further extend robustness under uncertain and time-varying conditions. Extended State Observers (ESOs) estimate lumped disturbances and unmodeled dynamics online, supporting active disturbance rejection in the presence of wind gusts and modeling errors [52]. Neural Network (NN)-based control and compensation methods learn residual dynamics or adapt control laws under payload variation, actuator degradation, or aerodynamic uncertainty [53]. These approaches typically operate within subsystem boundaries and rely on sensing quality and training coverage.

On the planning side, online trajectory generation and replanning methods, such as fast-planner [27] and Euclidean signed distance field-free Gradient-based lOcal (EGO) planner [26], enable navigation in cluttered environments using local map representations. Coverage-oriented planners for bridge and infrastructure inspection incorporate structural geometry and perception feedback to improve inspection completeness [54,55,56].

2.2. Simplex Architecture for Runtime Safety Assurance

The Simplex architecture [57] provides a principled framework for runtime safety by switching from an HP controller to a formally verified HA controller when safety conditions are threatened. In UAV systems, Simplex has been applied primarily at the flight-control level to address actuator faults [58], environmental disturbances [59], or perception failures [60]. Variants incorporating predictive simulation or black-box monitoring enable earlier intervention while retaining performance [61].

Despite these advances, many existing Simplex implementations remain single-layer and static. Safety enforcement is typically confined to either control or planning and relies on a single HA algorithm with binary switching logic. If only a single conservative HA mode is available and diverse off-nominal conditions are mapped to that same fallback, the system can become unnecessarily conservative, leading to avoidable performance degradation. In more complex tasks, environmental uncertainties can simultaneously stress both trajectory planning and flight control, motivating runtime assurance mechanisms that operate across multiple layers of the autonomy stack.

Recent research has introduced compound fallback subsystems, in which multiple certified HA algorithms are maintained and selected online based on key states or environmental context [62]. This approach expands the stable envelope and reduces over-conservatism [63]. However, existing implementations remain largely confined to individual subsystems, and multi-level integration across perception, planning, and control under compounded failures remains less explored [64].

2.3. System-Level Integration and Mission-Aware Interfaces

Resilient autonomy in bridge inspection can benefit from multi-level integration beyond isolated runtime safety switching. Hierarchical architectures, such as RSE, illustrate their potential for fault tolerance and graceful degradation through layered decision-making [42,65]. Several UAV architectures incorporate supervisory health monitoring or mission-state machines to arbitrate behaviors under faults or uncertainty [66,67,68,69]. Multi-layer runtime-assurance architectures that expose mediation interfaces can provide a natural starting point for future extension.

Table 1 summarizes representative approaches using a common set of criteria relevant to safety-critical inspection tasks.

Table 1. Comparison of representative UAV robustness and resilience approaches.

Approach Category	Scope	Formal Safety	Compound Failures	Cross-Layer	Runtime Adaptation
Robust/Adaptive Control (SMC, MPC, ESO, NN, LMI, IDA-PBC)	C	Local	No	No	Limited
Robust Trajectory Planning	P	Local	No	No	Partial
Single-Layer Simplex	C or P	Yes	Limited	No	No
Compound HA (Single Layer)	C or P	Yes	Partial	No	Yes
Mission Supervisory Control	M	No	Partial	Limited	Limited
Proposed Multi-Layer Architecture	M + P + C	Yes	Yes	Yes	Yes

Note: C: Control; P: Planning; M: Mission.

This comparison highlights that existing methods predominantly address robustness at isolated levels, whereas the proposed architecture integrates runtime safety assurance, adaptive fallback selection, and cross-level coordination interfaces. In this paper, planning- and control-level runtime assurance is validated in SITL simulation; mediation-mode selection policy is not evaluated.

3. Proposed Method

This section presents a layered autonomous control architecture inspired by the RSE and Simplex architectures, designed to enhance stability, task completion, and adaptability for multi-rotor UAV (herein, quadcopter) flight in dynamic and complex environments. Inspired by human behavior models, the architecture decomposes the autonomy stack into three functional layers: the Deliberative Layer, the Habitual Layer, and the Reflexive Layer.

As illustrated in Figure 1, the lower layers focus on flight control and trajectory planning, while the upper layer manages mission-level decision-making. The three layers are interconnected via standardized information interfaces and bidirectional data flows. This hierarchical structure enhances modularity and provides clear interfaces between mission-level decision-making, trajectory planning, and flight control.

Figure 1. Overview of the proposed method.

3.1. Deliberative Layer: Mission Monitor

As the cognitive core of the RSE-inspired architecture, the Deliberative Layer is responsible for (i) generating coverage tour plans as mission sub-goals for bridge inspection based on pre-acquired point-cloud data, and (ii) configuring mediation modes for lower-level Simplex components through a mode-selection policy, as illustrated in Figure 2.

Figure 2. Preliminary example of the mediation module at the Deliberative Layer, with dashed lines representing unselected possibilities.

The mode-selection policy evaluates two primary inputs: external time constraints (e.g., deteriorating weather conditions or flight restrictions) and internal system health indicators (e.g., unstable computational resource usage). Based on these inputs, the Deliberative Layer assigns an operational mode to the lower layers. Fast-paced mode restricts controller–planner selection to configurations supporting higher-speed flight while maintaining safety and is used when the mission must be completed early due to approaching adverse weather. Minimum-usage mode restricts selection to computationally lightweight algorithms when system resource availability becomes unstable due to other onboard processes, such as LiDAR–inertial odometry [70].

Both Simplex components include local decision logic that reacts to instantaneous resource-related signals (e.g., per-update computation time and/or deadline misses) to maintain real-time feasibility and safety. In contrast, the mediation policy operates at a slower mission-management timescale and proactively reconfigures the admissible candidate set when sustained resource stress is detected. This separation avoids redundant switching: the Simplex decision logic provides immediate protection, whereas minimum-usage mode reduces the likelihood of repeated deadline violations by restricting the system to more predictable, lightweight candidates.

This state-driven regulation acts as a high-level fault-avoidance mechanism by proactively adjusting system behavior before local safety violations occur. Compared with reactive approaches that trigger switching only after thresholds are breached, this design enables system-level preemptive preparation for both environmental and computational uncertainties.

Mission sub-goals are generated using the coverage planner from [71], which clusters pre-acquired point-cloud data and solves a traveling salesman problem to produce an ordered visitation sequence.

3.2. Habitual Layer: Trajectory Planning

The Habitual Layer generates dynamically feasible, obstacle-aware, and mission-efficient trajectories based on known maps and the coverage tour plan. Trajectory quality directly influences mission success, flight safety, and tracking performance.

To enhance resilience, this layer integrates a Simplex architecture with a compound HA subsystem. Based on comparative evaluation, the EXplore PLanner (EXPL) [71] is selected as the HP planner due to its effectiveness in tracking coverage tours with high coverage rates, despite limited robustness to unknown obstacles. EGO [26], KINOdynamics (KINO) [27], and FAst Likelihood-based COllision avoidance (FALCO) [28] are selected as HA planners to ensure safety under diverse operational conditions.

The Simplex architecture at this level is illustrated in Figure 3, where the fallback behavior corresponds to an emergency hover maneuver.

Figure 3. Simplex at the Habitual Layer, with dashed lines representing unselected possibilities.

Planner availability across mediation modes is summarized in Table 2. According to profiling results in Appendix A, EXPL is disabled in fast-paced mode due to its low replanning frequency, which degrades obstacle avoidance at higher speeds. In minimum-usage mode, both EXPL and EGO are disabled due to replanning rate limitations and susceptibility to runtime jitter under shared-resource contention. KINO and FALCO remain active due to higher replanning rates and predictable runtime behavior. Although FALCO has longer computation times, its bounded planning procedure and lack of grid-map dependency make it suitable as a last-resort fallback.

Table 2. Available trajectory planners in each mediation mode.

Algorithm	Type	Coverage Rate	Obstacle Avoidance	Need Map	CPU Usage	Nominal Mode	Fast-Paced Mode	Min.-Usage Mode
EXPL	HP	High	Low	Yes	Low	Yes	No	No
EGO	HA	Mid	Very High	Yes	Mid	Yes	Yes	No
KINO	HA	Mid	High	Yes	Low	Yes	Yes	Yes
FALCO	HA	Low	High	No	Low	Yes	Yes	Yes

Decision thresholds for Simplex switching are defined in Appendix B, and the runtime evaluation mechanism is illustrated in Figure 4. Planners are prioritized in the order EXPL > EGO > KINO > FALCO, with the highest-priority planner satisfying safety constraints being selected.

Figure 4. Simplex in different mediation modes (Habitual Layer), with dashed lines representing unselected possibilities.

3.3. Reflexive Layer: Flight Control

The Reflexive Layer generates control commands from reference trajectories and state estimates. It integrates a Simplex architecture with a compound HA control subsystem for online controller switching.

Based on comparative evaluation [11,13,14,15,16,17,18,19,20,21,22,23,24,72], Perception-Aware MPC (PAMPC) [11] is selected as the HP controller for its smooth tracking performance. Linearized MPC (LMPC) [21], SMC [22], and Geometric Adaptive Control (GAC) [23] are selected as HA controllers to cover different disturbance regimes.

The Simplex architecture at this layer is shown in Figure 5, where the fallback maneuver is an in-situ hover.

Figure 5. Simplex at Reflexive Layer, with dashed lines representing unselected possibilities.

Controller availability across mediation modes is summarized in Table 3. In fast-paced mode, PAMPC and LMPC are disabled due to limited wind-rejection capability at high speeds. In minimum-usage mode, PAMPC is disabled to reduce the risk of optimization timeouts under unstable computational loads.

Table 3. Available flight controllers in each mediation mode.

Algorithm	Type	Smoothness	Wind Rejection	CPU Usage	Nominal Mode	Fast-Paced Mode	Min.-Usage Mode
PAMPC	HP	Very High	No	High	Yes	No	No
LMPC	HA	High	No	Low	Yes	No	Yes
GAC	HA	Mid	Slow	Low	Yes	Yes	Yes
SMC	HA	Low	Fast	Low	Yes	Yes	Yes

The runtime evaluation mechanism at this level is shown in Figure 6. It evaluates wind speed and type, where wind speed is estimated using an ESO [21], and wind type is inferred from the variance of the estimated wind speed. Decision thresholds are defined in Appendix B. Controllers are prioritized as PAMPC > LMPC > GAC > SMC, and the highest-priority controller satisfying safety constraints is activated.

Figure 6. Simplex in different mediation modes (Reflexive Layer), with dashed lines representing unselected possibilities.

3.4. System Metrics and Safety Constraints

The proposed architecture is evaluated using two categories of metrics: Performance and Assurance. Performance metrics quantify task effectiveness, while assurance metrics quantify safety and stability properties. The primary objective is to preserve performance while ensuring assurance under diverse environmental conditions. Performance metrics include image quality and data completeness; assurance metrics include trajectory tracking fidelity and trajectory validity.

3.4.1. Performance Metrics

For the inspection task, performance is defined in terms of imagery quality and data completeness. Imagery quality is primarily influenced by the stability of the onboard camera, while data completeness reflects the extent to which the target structure has been scanned.

Image Quality

For vision-based inspection, the severity of motion blur is closely related to the angular velocity of the UAV, as rapid attitude changes cause fast variations in the camera field of view and degrade image sharpness [73]. Directly quantifying motion blur is challenging; therefore, angular velocity is used as a high-fidelity proxy for image quality.

The instantaneous angular-velocity magnitude is computed from the body-frame angular-rate components, roll rate (p), pitch rate (q), and yaw rate (r), as 

$${\omega }_{\mathrm{mag}}\left(t\right)=\sqrt{p{\left(t\right)}^2+q{\left(t\right)}^2+r{\left(t\right)}^2}$$

(1)

To capture overall flight stability, the task-averaged angular velocity is defined as

$${\omega }_{\mathrm{avg}}={\displaystyle \frac{1}{N}}\sum _{k=1}^N{\omega }_{\mathrm{mag}}\left(t_k\right)$$

(2)

where N denotes the total number of discrete samples collected during the task.

Average values may mask short-duration peaks; therefore, a 95th-percentile metric is also reported to capture near-worst-case behavior while excluding extreme outliers. This metric captures the upper bound of nominal behavior, consistent with safety assessment standards [74]. Let ${\omega }_{\mathrm{sorted}}$ denote the angular-velocity magnitudes sorted in ascending order. The 95th percentile angular velocity is defined as

$${\omega }_{95}={\omega }_{\mathrm{sorted}}(\lceil 0.95N\rceil )$$

(3)

where $\lceil ·\rceil$ denotes the ceiling function. Lower values of ${\omega }_{\mathrm{avg}}$ and ${\omega }_{95}$ indicate improved image quality.

Data Completeness

Data completeness is quantified using the point-cloud coverage rate, which measures how thoroughly the target structure is scanned during the task. Since pre-acquired point-cloud data are used to generate the coverage plan, the coverage rate directly reflects task completion. The coverage rate is defined as

$$R_{\mathrm{coverage}}={\displaystyle \frac{N_{\mathrm{scanned}}}{N_{\mathrm{pre-acquired}}}}$$

(4)

where $N_{\mathrm{scanned}}$ is the number of unique points observed during the inspection, and $N_{\mathrm{pre-acquired}}$ is the number of points in the pre-acquired point cloud. Higher values of $R_{\mathrm{coverage}}$ indicate better inspection completeness.

3.4.2. Assurance Metrics

Assurance is assessed through two primary metrics: trajectory tracking fidelity and trajectory validity. These metrics ensure that the UAV not only follows planned trajectories accurately but also that the trajectories themselves remain safe in dynamic environments.

Trajectory Tracking Fidelity

Trajectory tracking fidelity quantifies how accurately the UAV follows the reference trajectory and primarily reflects the controller’s ability to reject external disturbances, such as wind.

The instantaneous trajectory deviation is defined as the Euclidean distance between the actual UAV position (${\mathbf{x}}_{\mathrm{act}}$) and the reference position (${\mathbf{x}}_{\mathrm{ref}}$):

$$D\left(t\right)=\parallel {\mathbf{x}}_{\mathrm{act}}\left(t\right)-{\mathbf{x}}_{\mathrm{ref}}\left(t\right)\parallel$$

(5)

The task-averaged trajectory deviation is computed as

$$D_{\mathrm{avg}}={\displaystyle \frac{1}{N}}\sum _{k=1}^{N}D\left(t_k\right)$$

(6)

To assess near-worst-case tracking performance while mitigating sensitivity to rare outliers, the 95th percentile deviation is defined as

$$D_{95}=D_{\mathrm{sorted}}(\lceil 0.95N\rceil )$$

(7)

where $D_{\mathrm{sorted}}$ is the sorted set of instantaneous deviations in ascending order. Lower values of $D_{\mathrm{avg}}$ and $D_{95}$ correspond to higher tracking fidelity.

Trajectory Validity

Unlike static environments, where a fixed safety margin suffices, our system operates in unknown environments in which the occupancy grid map (${\mathcal{M}}_t$) is incrementally updated via onboard sensors. Consequently, a previously safe trajectory may become invalid if a newly detected obstacle occludes the planned path.

To evaluate the planner’s capability to react to these environmental changes (i.e., timely replanning), one checks whether the reference setpoint (${\mathbf{r}}_t$) at the current time step (t) overlaps with any occupied voxels in the updated map. A valid planning policy must ensure that the reference setpoint remains in the free space (${\mathcal{S}}_{\mathrm{free}}$) at all times. This instantaneous validity constraint is formulated as the setpoint indicator:

$${\mathbb{V}}_{\mathrm{setpoint}}\left(t\right)=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{\mathcal{M}}_t\left({\mathbf{r}}_t\right)\in {\mathcal{S}}_{\mathrm{free}}\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(8)

where ${\mathcal{M}}_t\left({\mathbf{r}}_t\right)$ denotes the occupancy status of the grid cell corresponding to ${\mathbf{r}}_t$.

To quantify the robustness of the autonomous flight, one assesses the trajectory validity rate, defined as the proportion of time steps where the reference setpoint remains in free space relative to the total number of sampling instances (N). The global validity metric is formulated as

$${\mathbb{V}}_{\mathrm{traj}}={\displaystyle \frac{1}{N}}\sum _{k=1}^N{\mathbb{V}}_{\mathrm{setpoint}}\left(t_k\right)$$

(9)

This metric yields a continuous score in the range of $[0,1]$, where a value of 1 indicates a completely collision-free trajectory, and lower values quantify the extent of safety degradation due to delayed replanning or environmental uncertainty.

4. Simulation Evaluation

A series of systematic simulation tests was conducted in a high-fidelity environment to evaluate the proposed multi-layer resilient architecture for complex bridge inspection tasks. The scenarios were designed with progressively increasing environmental severity to assess robustness at both the trajectory-planning and flight-control levels, for single-UAV and multi-UAV inspection operations. The evaluation emphasizes key performance-assurance metrics under a range of disturbances and structural uncertainties. Results indicate that the architecture supports reliable UAV operation across diverse conditions while maintaining safety.

It should be noted that the evaluation focuses on system-level performance: because a single HP planner–controller stack serves as the baseline, the reported results quantify the end-to-end benefit of the integrated architecture rather than isolating the marginal contribution of individual architectural components (e.g., multi-layer vs. single-layer Simplex, or compound HA vs. a single HA fallback).

4.1. Simulation Set-Up

The simulation emulates an autonomous bridge inspection task executed by a quadcopter equipped with an onboard Red-Green-Blue-Depth (RGB-D) camera. RGB images provide structural inspection data, while depth measurements enable three-dimensional (3D) bridge reconstruction and collision avoidance. Since the UAV operates in close proximity to the structure, strict requirements are imposed on tracking accuracy, obstacle avoidance, and flight stability.

Infrastructure inspections are typically periodic, allowing the use of previously acquired point-cloud data for coverage planning. Accordingly, a pre-existing bridge point cloud (Figure 7, previously acquired from simulation) is assumed to be available and is used to generate a coverage tour for the target structure. Battery limitations are neglected, as all simulated tasks are completed within 10 min, well below typical endurance limits.

Figure 7. Pre-acquired point cloud of a bridge.

Figure 8 summarizes the SITL stack. Gazebo Classic (v11.15.1) is used for rigid-body dynamics and wind disturbance modeling via the RotorS wind model [75], publishing simulated state information to Robot Operating System (ROS) Noetic on Ubuntu 20.04. AirSim (Unreal Engine 4.27.2, v1.8.1) serves exclusively as the sensing front-end, rendering synchronized RGB-D observations based on Gazebo odometry. Wind direction is sampled once per run and held constant, while wind magnitude is updated at 1 Hz.

Figure 8. Simulation configuration.

The simulated UAV represents a compact inspection-class quadcopter with a 0.40 m wheelbase and a total mass of 0.70 kg. The rigid-body inertia matrix is set to $\mathrm{diag}(0.007,0.007,0.012)\mathrm{kg}·{\mathrm{m}}^2$, and a conservative maximum thrust of 20 N is enforced.

4.2. Implementation Details

4.2.1. Update Rates and Latency Thresholds

State estimation provides position, velocity, and attitude at 50 Hz, while mapping and obstacle updates are targeted at 10 Hz. The reflexive control loop runs at 50 Hz with a 20 ms deadline, and the planning layer replans at 1 Hz, subject to a 100 ms map-update latency bound. If sensing latency exceeds this bound, the planning-layer Simplex triggers a conservative fallback trajectory, while the control-layer Simplex maintains stability using verified HA controllers. All thresholds are summarized in Appendix B.

4.2.2. Asynchronous Planning and Synchronous Control

All planners are instantiated at initialization but activated on demand to reduce computational load. In contrast, all candidate controllers are evaluated at every control iteration to avoid unsafe latency. HA controllers incur negligible computational overhead at the selected control rate. The adaptive network in the GAC is updated only when that controller is active. If the HP controller fails to return a command before the deadline, the most recent HA output selected by the control-layer Simplex is applied to guarantee real-time actuation.

4.2.3. Wind Type Determination

An ESO estimates wind disturbances. A sliding window of 3 s is used to compute wind-speed variance. Winds with variance exceeding 3 m/s are classified as gusts; otherwise, they are treated as sustained. This threshold reflects the effective operating range of the adaptive controller: GAC provides accurate compensation under low-variance conditions but exhibits phase lag under rapidly varying disturbances, whereas SMC maintains bounded deviations in high-variance regimes. These parameters primarily affect switching timing rather than safety enforcement.

4.2.4. Inter-UAV Trajectory Deconfliction

In multi-UAV scenarios, each UAV maintains a local obstacle map and broadcasts its planned trajectory with timestamps to teammates. The Habitual Layer performs forward spatiotemporal conflict checks against received trajectories. If a conflict is detected, EGO-trajectory replanning is triggered when available; otherwise, an emergency stop is executed to preserve safety.

4.3. Environmental Conditions

To evaluate the performance and adaptability of the proposed architecture in dynamic environments, a cyclical wind profile is designed, as illustrated in Figure 9. This model simulates the complex and fluctuating wind conditions a UAV may encounter, providing a rigorous test of the system’s response mechanisms.

Figure 9. Rotating stages of the cyclical wind condition.

The wind profile consists of three repeating phases: no wind, sustained wind, and wind gust. To enhance stochasticity, the order of the sustained wind and gust phases varies across cycles. Scenario-specific wind-speed ranges are selected with reference to industry guidelines for small-UAV wind operation [76]. The duration of each phase is randomly selected from a uniform distribution between 30 and 90 s at the start of each flight.

The wind generation mechanism is as follows:

• Parameter initialization: At the commencement of each simulation, a random 3D unit vector is generated to define a consistent global wind direction for the entire flight. This direction remains fixed for both sustained and gust phases.
• Sustained wind phase: This phase models steady wind with minor turbulence. A base wind speed is randomly sampled between the minimum and maximum speeds for the selected level (Table 4) as part of the Monte Carlo setup. During the phase, wind speed fluctuates with a small random perturbation of ±0.5 m/s every 3 s, creating a noisy but relatively stable wind condition.
  Table 4. Wind condition summary.

  Type	Condition	Minimum (m/s)	Maximum (m/s)
  Sustained Wind	Low Speed	0	4
  	Mid Speed	4	8
  	High Speed	8	11
  	Very High Speed	11	15
  Type	Condition	Mean (m/s)	Distribution Scale
  Wind Gust	Low Variance	4	1
  	Mid Variance	5	4
  	High Variance	5	7
  	Very High Variance	5	11

• Wind gust phase: This phase simulates highly variable and unpredictable wind. While maintaining the global wind direction, wind speed is resampled every 3 s according to the mean and distribution scale parameters for the gust category (Table 4), producing a more volatile profile than the sustained wind phase.

To trigger the Simplex architecture at the trajectory-planning level, construction vehicle models are placed around the bridge as unknown obstacles. Table 5 and Figure 10 summarize the different obstacle layouts used in the tests.

Table 5. Vehicle obstacle list.

Condition	Obstacle on Top	Obstacle on Side
Sparse Layout	Extended Forklift (1), Mobile Concrete Pump (1)	None
Mid Layout	Extended Forklift (1), Mobile Concrete Pump (1)	Mobile Drill (1), Extended Mobile Crane (1)
Dense Layout	Mobile Concrete Pump (1), Mobile Drill (1)	Extended Mobile Crane (1), Crawler Crane (1), Tower Crane (1), Luffing Crane (1)
Highly Dense Layout	Mobile Concrete Pump (1), Mobile Drill (2)	Extended Mobile Crane (2), Crawler Crane (1), Tower Crane (4), Luffing Crane (2)

Note: Numbers in parentheses indicate the quantity of each obstacle instance included in the simulation.

Figure 10. Simulated bridge environment with different obstacle layouts.

The sparse layout contains only two small vehicles on top of the bridge, which have a low probability of obstructing the quadcopter during the task. The mid layout begins to include larger vehicles on the side of the bridge, where the quadcopter often flies due to the shape of the bridge, resulting in a higher likelihood of overlap with a planned trajectory. The dense layout includes more and larger vehicles, making the environment more complex and more challenging for the HP trajectory planner. In the highly dense layout, in addition to a high concentration of construction machinery that poses a significant challenge even for the HA trajectory planners, a large portion of the bridge structure is also covered with concrete blocks. This specific obstruction is designed to cause the inspection task to eventually stall during the flight.

To systematically evaluate robustness and adaptability, four simulation scenarios are defined: nominal, off-nominal, edge, and malformed. These scenarios represent increasing levels of environmental disturbance and structural uncertainty, ranging from mild environmental conditions to severely compromised layouts that impede task completion. All test cases were initialized with identical task goals, which are to inspect the surface of the target bridge using pre-acquired point cloud data, allowing for direct and controlled comparisons of system performance and adaptive behavior:

• Nominal case: Introduces low-speed sustained wind, low-variance wind gusts, and a sparse obstacle layout. The objective is to assess the system’s capacity to tolerate mild disturbances, where the system is expected to implement the HP algorithms most of the time while minimizing performance degradation.
• Off-nominal case: Simulates mid-level sustained wind, low-variance wind gusts, and a mid layout. This environment is designed to trigger adaptive switching from HP to HA modules (e.g., GAC, SMC, EGO), demonstrating the trade-off between performance and safety when necessary.
• Edge case: Emulates high-speed sustained wind, high-variance wind gusts, and a dense layout. It is intended to test the full operational boundaries of the system and its ability to maintain safety.
• Malformed case: Imposes very high-speed sustained wind, very high-variance wind gusts, and a highly dense layout, resulting in partial task infeasibility due to unreachable portions of the structure. This out-of-distribution setting is included as a stress test to probe robustness and failure modes under extreme conditions rather than to represent typical operating environments. The goal is to evaluate how the system handles task failure, specifically whether it can degrade gracefully without violating safety constraints. In the current implementation, the system persists in its scanning attempts but is configured to terminate the task if the inspection coverage fails to increase over a two-minute window. Note that in practical deployment, this behavior could be adapted to execute alternative strategies, such as exploring the surrounding space or loitering while awaiting human intervention.

4.4. Mediation Policy Implementation

The preliminary mediation policy implemented performs two mediation behaviors: (i) fast-paced mode, which accelerates mission progress when an external deadline is predicted to occur before nominal completion, and (ii) minimum-usage mode, which prepares the system for unstable computation time when sustained runtime stress is detected. Both behaviors are realized by reconfiguring the Simplex components at the planner and controller levels.

4.4.1. Fast-Paced Mode (Deadline-Aware Acceleration)

Fast-paced mode is used when an external process provides a deadline (e.g., a forecasted severe weather or flight restrictions) and the vehicle is unlikely to finish the remaining inspection at the nominal pace. When a deadline message is received, the mediation policy executes the following steps:

• Read the deadline information: The message contains (i) the time at which the message is received and (ii) an externally imposed no-go time after which continued flight is not permitted.
• Estimate the remaining mission time under nominal pacing: The policy uses the remaining length of the coverage tour together with the nominal reference flight speed (to estimate the remaining inspection time. Intuitively, “remaining time” is computed as “remaining distance divided by nominal speed.” This estimate is intentionally simple and conservative, providing a fast feasibility check.
• Compare against the deadline with a return margin: The policy reserves a fixed time margin for return-to-home. Therefore, the effective latest completion time is the external deadline minus this return margin.
• Trigger fast-paced mode if nominal completion is too late: If the estimated nominal completion time (message reception time plus the estimated remaining time) exceeds the effective latest completion time, the policy switches to fast-paced mode.

If triggered, the mediation policy reconfigures the runtime evaluation mechanisms of the Simplex components at both lower levels from nominal mode to fast-paced mode (Figure 4 and Figure 6) and increases the reference flight speed used by the trajectory planners. This mode modifies only the timing of setpoint generation along the same geometric coverage tour and does not alter the tour geometry. The Simplex components continue to enforce feasibility and safety constraints.

If, either at message reception or during subsequent flight in fast-paced mode, the time until the external no-go deadline becomes less than or equal to the required return-to-home time (including the reserved margin), the policy terminates the inspection mission and initiates the return-to-home behavior.

4.4.2. Minimum-Usage Mode (Runtime-Stress Mitigation)

Minimum-usage mode is designed to improve robustness under sustained computational stress. Rather than relying on instantaneous CPU utilization, the mediation policy monitors observed wall-clock runtime behavior of selected autonomy loops. The minimum-usage logic follows a persistent-overload strategy:

• Monitor runtime: At each cycle, the policy measures the wall-clock runtime of a selected planning or control update.
• Detect sustained violations: Measured runtimes are compared against pre-defined thresholds and recorded in a fixed-length sliding window. This allows detection of persistent overload while filtering isolated spikes.
• Enter minimum-usage mode under persistent overload: If the number of threshold exceedances within the window exceeds the pre-defined count, the policy switches to minimum-usage mode.
• Restore nominal mode after stabilization: To prevent chatter, nominal operation is restored only after runtimes remain stable near their pre-triggered levels for a short dwell period.

Upon entering minimum-usage mode, the mediation policy activates the corresponding reconfiguration of the Simplex components, restricting both planning and control layers to lightweight candidate programs to maintain real-time feasibility.

The designed trigger conditions, external deadlines and internally observed runtime stress, do not alter the simulation itself; they only reconfigure the runtime evaluation mechanisms of the Simplex components.

4.5. Injected Trigger Signals for Mediation Policy Evaluation

This section describes how two exogenous signals are injected for evaluation: (i) a mission-level deadline or forecast message for fast-paced mode, and (ii) a synthetic computational stress profile for minimum-usage mode. These signals are controllable, repeatable, and independent of the physical disturbance model, and are extended to multi-UAV evaluation by sampling the trigger timing parameters per vehicle as described below.

4.5.1. Deadline/Forecast Message Injection (For Fast-Paced Mode)

A single external deadline message is generated per run to emulate constraints provided by an operator or service, such as approaching severe weather or temporary flight restrictions. This message specifies the external no-go time and is marked with its time of reception. In the multi-UAV tests, the deadline/forecast message is broadcast once per run and received by all UAVs at the same sampled reception time with the same sampled no-go time (i.e., timing parameters are shared across vehicles).

Message reception is sampled uniformly between 60 s and 200 s post-launch to ensure the vehicle has transitioned from takeoff to active inspection. A “no-go” offset is then sampled between 100 s and 400 s after reception; this produces a variety of scenarios ranging from strongly time-constrained to more flexible windows.

These sampling ranges ensure the deadline is challenging yet feasible. By setting the no-go time after the vehicle has progressed into the mission, but before nominal completion is guaranteed, the system effectively triggers the fast-paced mode. To account for recovery, the mediation policy buffers a 60 s return-to-home margin, calculating the effective deadline as the no-go time minus this reserve. Under these constraints, the policy doubles the nominal reference speed from 1 m/s to 2 m/s while maintaining the original geometric coverage tour.

4.5.2. Synthetic Computational Stress Injection (For Minimum-Usage Mode)

To evaluate robustness under computational stress, a synthetic overload pattern is injected to increase the observed wall-clock runtime of the onboard autonomy pipeline for a limited interval. This injection emulates effects such as CPU contention, thermal throttling, and background processes, which can cause planning or control updates to occasionally miss expected timing deadlines. Each mediation policy run contains one overload interval with the following parameterization (sampled independently per UAV in the multi-UAV tests):

• Start time: The onset of overload is sampled uniformly between 120 s and 300 s after mission start, ensuring that the stress begins while the vehicle is actively executing the inspection task. In the multi-UAV tests, the onset is sampled uniformly between 20–30 s post-launch for each UAV.
• Duration: The overload duration is sampled uniformly between 120 s and 240 s (i.e., 2–4 min), yielding sustained stress while still providing variability across runs. In the multi-UAV tests, the duration is sampled uniformly between 30–60 s for each UAV.
• Severity (two-stage runtime inflation): The magnitude is generated in two stages to capture both run-to-run variability and within-run jitter. At the beginning of the flight, a run-level amplification factor is sampled uniformly between 5 and 15 and held constant. During the overload interval, each affected update (both planning and control) draws an independent random value uniformly between 1 and this run-level amplification factor. The realized wall-clock runtime for that update is the nominal runtime multiplied by this per-update random value, producing cycle-to-cycle jitter while maintaining a consistent run-level intensity. In the multi-UAV tests, the run-level amplification factor is sampled independently for each UAV.

Outside the overload interval, the autonomy stack operates at its nominal timing. The policy maintains a 1 s sliding window of recent update cycles and declares persistent overload if 5 or more runtime overruns occur within that window. Overruns are evaluated using two fixed time thresholds: a control update is considered late if its runtime exceeds 5 ms, and a planning update is considered late if its runtime exceeds 50 ms. When the overload interval ends, the runtime inflation is removed, and the mediation policy returns to nominal mode.

4.6. Testing Results

This section evaluates the proposed multi-layer resilient autonomy architecture through single- and multi-UAV bridge inspection simulations. The evaluation is organized into two stages: (i) an assessment of planning- and control-level Simplex components to quantify mission performance and safety under varying environmental conditions, and (ii) an evaluation of the mission-level mediation policy under external time constraints and injected computational stress.

4.6.1. Single UAV Operation Case

Simplex Components Evaluation

This subsection evaluates three testable claims regarding the proposed architecture relative to the baseline (HP single-stack system) across four environments. To isolate the Simplex components, mediation-policy inputs (exogenous deadlines and injected load) are held inactive:

• Performance fidelity: The proposed approach preserves inspection effectiveness (coverage and angular velocity) at baseline levels under feasible conditions.
• Safety gains: Under adverse conditions, the proposed approach provides superior operational assurance, maintaining $V_{\mathrm{traj}}\approx 100\%$ (Equation (9)) while reducing $D_{\mathrm{avg}}$ and $D_{95}$ (Equations (6) and (7)).
• Controlled degradation: When HA switching is triggered, the system exhibits deliberate, safety-preserving degradation, where ${\omega }_{\mathrm{avg}}$ and ${\omega }_{95}$ may rise modestly but remain reasonable to prioritize collision avoidance.

Here, the baseline denotes the HP single-stack system without the Simplex safety architecture: the HP planner (EXPL) and controller (PAMPC) only, with no runtime switching to HA subsystems.

Table 6 and Table 7 summarize performance and assurance metrics over 100 Monte Carlo runs (mean ± standard deviation). Coverage rate quantifies inspection completeness (higher is better). Angular-velocity metrics (${\omega }_{\mathrm{avg}}$, ${\omega }_{95}$) serve as proxies for image quality, where lower values indicate less motion blur; ${\omega }_{\mathrm{crit}}$ denotes the one-pixel blur threshold. Assurance metrics are measured by trajectory validity $V_{\mathrm{traj}}$ (higher is better; 100% indicates collision-free setpoints) and tracking deviation ($D_{\mathrm{avg}}$, $D_{95}$; lower is better), with ${\tau }_{\mathrm{devi}}$ indicating the deviation safety envelope.

Table 6. Summary of performance metrics.

Scenarios	Data	Coverage Rate (%)	Average Angular Velocity (deg/s)	95th Percentile Angular Velocity (deg/s)	Total Time (s)
Nominal	Proposed	96.25 ± 2.09	26.66 ± 1.98	81.50 ± 4.81	526.58 ± 58.85
	Baseline	95.82 ± 2.17	26.53 ± 1.93	75.76 ± 5.21	480.62 ± 55.72
Off-Nominal	Proposed	95.64 ± 2.38	28.89 ± 2.40	89.38 ± 6.30	530.16 ± 54.74
	Baseline	95.53 ± 2.51	26.03 ± 2.28	82.06 ± 6.83	526.56 ± 61.49
Edge	Proposed	95.12 ± 2.31	31.98 ± 2.76	92.24 ± 5.73	544.78 ± 64.04
	Baseline	95.80 ± 2.68	30.90 ± 3.17	91.51 ± 6.11	526.28 ± 67.92
Malformed	Proposed	63.53 ± 14.59	36.84 ± 8.92	106.10 ± 18.88	471.43 ± 107.06
	Baseline	67.26 ± 16.38	36.01 ± 8.74	92.17 ± 19.63	461.07 ± 114.22

Table 7. Summary of assurance metrics.

Scenarios	Data	Trajectory Validity (%)	Average Trajectory Deviation (m)	95th Percentile Trajectory Deviation (m)	Total Time (s)
Nominal	Proposed	100.00 ± 0.03	0.049 ± 0.014	0.115 ± 0.028	526.58 ± 58.85
	Baseline	99.80 ± 0.08	0.046 ± 0.013	0.148 ± 0.031	480.62 ± 52.31
Off-Nominal	Proposed	100.00 ± 0.03	0.043 ± 0.004	0.115 ± 0.021	530.16 ± 54.74
	Baseline	99.80 ± 0.19	0.099 ± 0.021	0.226 ± 0.037	526.56 ± 61.49
Edge	Proposed	99.97 ± 0.09	0.044 ± 0.005	0.123 ± 0.030	544.78 ± 64.04
	Baseline	98.70 ± 0.66	0.130 ± 0.033	0.236 ± 0.041	526.28 ± 67.92
Malformed	Proposed	99.84 ± 0.26	0.0515 ± 0.007	0.143 ± 0.035	471.43 ± 107.06
	Baseline	95.30 ± 1.34	0.236 ± 0.054	0.472 ± 0.087	461.07 ± 114.22

Bar-plot comparisons of the baseline versus the proposed approach across all scenarios are shown in Figure 11 (performance metrics) and Figure 12 (assurance metrics). In both figures, horizontal dashed lines denote the image-blur threshold ${\omega }_{\mathrm{crit}}=88$ deg/s and the deviation envelope ${\tau }_{\mathrm{devi}}=0.2$ m (see Appendix B).

Figure 11. Comparison of performance metrics.

Figure 12. Comparison of assurance metrics.

In the nominal scenario, the proposed system’s performance is comparable to that of the baseline: coverage (96.25% vs. 95.82%) and average angular velocity (26.66 vs. 26.53 deg/s) fall within a similar statistical range under nominal wind conditions and sparse obstacles. Safety remains unaffected: $V_{\mathrm{traj}}\approx 100\%$, and $D_{\mathrm{avg}}$ and $D_{95}$ are comparable. Plausible explanation: the Reflexive Layer operates on the HP controller, and the Habitual Layer uses the HP planner by default; HA is only occasionally triggered, resulting in no noticeable performance penalty.

In the off-nominal scenario, performance remains comparable to the baseline (coverage: 95.64% vs. 95.53%; ${\omega }_{\mathrm{avg}}$: 28.89 vs. 26.03 deg/s) under mid-level wind and mid layout. Critically, safety improves substantially: $D_{\mathrm{avg}}$ decreases from 0.099 m to 0.043 m ($\downarrow 56.6\%$) and $D_{95}$ from 0.226 m to 0.115 m ($\downarrow 49.1\%$), while $V_{\mathrm{traj}}\approx 100\%$. Plausible explanation: wind-speed/type checks trigger HA controllers (GAC/SMC) when needed.

In the edge scenario, coverage remains 95.12% with a small increase in ${\omega }_{\mathrm{avg}}$ to 31.98 deg/s under high wind and dense obstacles. Safety gains are pronounced relative to the baseline: $V_{\mathrm{traj}}$ rises from 98.70% to 99.97% (≈43× fewer violations), $D_{\mathrm{avg}}$ drops from 0.130 m to 0.044 m ($\downarrow 66.2\%$), and $D_{95}$ from 0.236 m to 0.123 m ($\downarrow 47.9\%$). The flight data comparison for the edge scenario is presented as a representative case study, as the frequent activation and switching of the HA controllers in this environment best illustrate the dynamic behavior of the Simplex architecture during task execution. In Figure 13a, under wind disturbances, the baseline frequently exceeds the deviation safety threshold, exhibiting sustained oscillations and repeated crossings due to the HP controller’s limited wind-rejection capability. In contrast, the proposed system shows only short spikes that quickly damp out and then remain within ${\tau }_{\mathrm{devi}}$. In Figure 13b, the proposed system exhibits slightly higher angular velocity than the baseline under wind. This behavior is expected: when SMC is engaged, the controller executes more aggressive maneuvers to eliminate trajectory deviation, leading to a modest increase in $\omega$ while preserving safety. This increase in $\omega$ also impacts perception: higher angular rates generally reduce effective image quality and feature stability, which can degrade depth and mapping updates. Therefore, under windy conditions, the runtime evaluation mechanism selects, among the available HAs, the controller that satisfies safety constraints while minimizing expected degradation in sensing quality.

Figure 13. Comparison with baseline system (edge scenarios).

Together, these results support a cross-scenario observation: safety metrics improve markedly with the proposed system, while the slight increase in ${\omega }_{\mathrm{avg}}/{\omega }_{95}$ reflects an intentional trade-off for robust envelope protection.

In the malformed scenario, the environment contains extensive occlusions and structurally unreachable regions; therefore, full coverage is physically unattainable regardless of control performance. Under the same high-wind and high-density obstacle conditions, the proposed system achieves 63.53% coverage over the reachable portion while preserving safety: $V_{\mathrm{traj}}=99.84\%$, $D_{95}=0.143$ m. Compared with the baseline, $D_{\mathrm{avg}}$ and $D_{95}$ are reduced by ≈78.2% (0.236 → 0.0515 m) and ≈69.7% (0.472 → 0.143 m), respectively, preventing divergence beyond ${\tau }_{\mathrm{devi}}$. Plausible explanation: when HP pipelines face persistent constraint violations, both layers revert to HA, and the task terminates if coverage plateaus for two minutes, prioritizing safety over completeness.

To complement Table 6 and Table 7, Figure 14 visualizes the detailed data distribution across 100 runs. While most data points cluster tightly around the mean, the box plots reveal a small number of outliers that exceed the safety threshold. Additionally, Figure 15 illustrates the UAV’s execution trajectories, showing that it consistently maintains the required stand-off distance from the bridge structure across all scenarios. This spatial consistency indicates that the proposed system can reliably accomplish the tasks under diverse environmental conditions.

Figure 14. Data distributions.

Figure 15. Executed trajectories.

Overall, the proposed architecture (i) preserves performance where feasible, (ii) delivers substantial safety gains in adverse conditions, and (iii) trades a small increase in ${\omega }_{\mathrm{avg}}/{\omega }_{95}$ for envelope protection and near-100% trajectory validity. The bar plots in Figure 11 and Figure 12 make these trends explicit; dashed lines indicate the thresholds derived in Appendix B.

Mediation Policy Evaluation

• Fast-Paced Mode: This subsection evaluates the deadline-aware fast-paced mediation behavior of the mediation policy. The purpose of this test is not to re-evaluate the planning/control Simplex switching itself, but to quantify the mission-level benefit of enabling the mediation policy when an external time constraint is introduced.

All runs used the off-nominal environment (mid-level wind condition and obstacle layout). A Monte Carlo study with 100 runs per configuration was performed as follows:

• Fixed to nominal mode: The Deliberative Layer mediation policy was disabled. The planning- and control-layer Simplex components operated under nominal-mode configuration, and the nominal reference pace remained unchanged throughout the mission.
• Mediation policy on: The mediation policy was enabled. Upon receiving a deadline/forecast message, the policy could activate fast-paced mode according to the specified logic, which (i) increases the reference cruise-speed parameter used by the planner and (ii) reconfigures the available planner/controller candidates according to the fast-paced mode definitions (Figure 4 and Figure 6).

• Importantly, both configurations used the same underlying multi-layer architecture at the planning and control layers; the only difference is whether the Deliberative Layer was allowed to switch to the fast-paced mode.

To summarize mission-level behavior under time constraints, each run is assigned one of the following mutually exclusive outcomes:

• Finished: The inspection is completed before the externally imposed no-go time.
• Interrupted: The externally imposed no-go time occurs while the UAV is still executing the inspection mission, so the mission ends due to the no-go time rather than a policy decision.
• Terminated (mediation policy on only): The mediation policy triggers an early stop to preserve the return-to-home margin, so the mission ends before the externally imposed no-go time by design rather than being cut off by the deadline.

Table 8 summarizes the results. Enabling the mediation policy increases the mean achievable coverage under time constraints (mediation policy on: 88.55% vs. fixed to nominal mode: 72.71%) and increases the number of finished runs (28 vs. 13). The dominant failure mode also changes: with the mode fixed to nominal, most runs are interrupted by the exogenous no-go time, whereas with mediation policy on, most runs are intentionally terminated by the policy to preserve the return-to-home margin.

Table 8. Fast-paced mode evaluation results in the off-nominal scenario (100 Monte Carlo runs each).

Configuration	Coverage Rate (%)	Average Angular Velocity (deg/s)	Trajectory Validity (%)	Average Trajectory Deviation (m)	Finished	Unfinished
Mediation Policy On	88.55 ± 34.89	28.63 ± 2.35	99.99 ± 0.05	0.046 ± 0.004	28	72 (terminated)
Fixed Nominal Mode	72.71 ± 16.88	29.14 ± 2.41	100.00 ± 0.04	0.043 ± 0.005	13	87 (interrupted)

Figure 16 visualizes outcome data for message reception time, no-go time, and realized flight time. The main mechanism is straightforward: once the forecast arrives and the fast-paced mode trigger is satisfied, the policy increases the mission pace, enabling the UAV to traverse more of the fixed coverage tour per unit time and thereby improving the expected coverage achieved before the run ends.

Figure 16. Fast-paced mediation policy evaluation in the off-nominal scenario.

The coverage variance is higher with the mediation policy on. This is expected because time-margin enforcement intentionally introduces early stopping in some episodes (e.g., when message reception occurs early and no-go time is tight), producing low-coverage terminated runs that broaden the distribution. In contrast, when the mode is fixed to nominal, the system continues the mission until the no-go time, resulting in a more concentrated distribution and smaller standard deviations.

Finally, in this off-nominal setting, the planning/control Simplex components operate in HA modes due to wind and obstacle stress. As a result, fast-paced mode primarily affects mission progress and episode outcomes (coverage and completion/termination statistics), while safety metrics, such as $V_{\mathrm{traj}}$ and tracking deviation, show limited separation between configurations because runtime assurance is enforced by the lower-layer Simplex logic in both cases.

• Minimum-Usage Mode: This subsection evaluates the runtime-stress mitigation behavior of the mediation policy using the synthetic computational-stress injection. The goal is to quantify whether enabling minimum-usage mode improves real-time feasibility by proactively restricting the admissible candidate set to more predictable, lightweight algorithms during sustained overload.

Similarly, two configurations were implemented under the off-nominal scenario:

• Fixed to nominal Mode: The mediation policy was disabled, and the Simplex components were fixed to nominal mode configuration.
• Mediation policy on: The mediation policy was enabled and could enter minimum-usage mode when persistent overload was detected using sliding-window logic. When activated, the policy reconfigured the available candidate set for both layers, biasing the system toward lightweight candidates during sustained stress.

• Both configurations used the same physical simulation and the same underlying Simplex decision logic at the planning and control layers; the only difference was whether the Deliberative Layer was allowed to apply the minimum-usage reconfiguration.

Figure 17 reports update-time miss versus amplification factor. With the mode fixed to nominal, timing violations are large and widespread across the tested stress range, indicating that allowing the full candidate set under sustained overload leads to frequent real-time infeasibility. With the mediation policy on, update-time miss is substantially reduced and remains clustered near the low-miss region.

Figure 17. Update-time miss versus amplification factor for minimum-usage mode evaluation.

Quantitatively, runs with the mode fixed to nominal yield an average update-time miss of 5474.81 (standard deviation 1906.27), whereas runs with the mediation policy On reduce this to 169.06 (standard deviation 68.26). This reduction supports the intended role of minimum-usage mode: by proactively restricting the system to computationally lightweight and more predictable candidates when sustained stress is detected, the policy reduces repeated deadline violations and improves timing stability at the mission-management timescale.

This test isolates the effect of mission-level reconfiguration rather than the local Simplex reaction logic. The local Simplex logic reacts to instantaneous fluctuations in computational load, whereas minimum-usage mode operates at the mission-management timescale by proactively restricting the available candidates during sustained overload. This reduces the likelihood of repeated timing degradation across extended stress intervals.

4.6.2. Multi-UAV Operating Case

Simplex Components Evaluation

To demonstrate the scalability and collaborative efficiency of the proposed resilient architecture, the bridge inspection task was executed using a decentralized fleet of three quadcopters. In this setup, the global inspection task was partitioned into sub-regions, and each agent independently ran the full stack of the proposed multi-layer architecture. This ensures that safety assurance is enforced locally on each agent, regardless of the behavior of the others. A direct comparison with the baseline system is omitted in this multi-UAV scenario because the baseline HP planner lacks intrinsic deconfliction capabilities, making it unable to perform the necessary trajectory replanning and avoidance with respect to other UAVs’ reference trajectories during simultaneous flight.

The results are presented in Table 9 and Table 10. A comparison with single-agent results reveals a dramatic improvement in inspection efficiency. The total flight time in the nominal scenario is reduced to 95.81 s, representing a substantial efficiency gain compared to single-agent execution. This improvement is primarily due to the spatial decomposition of the task: each UAV is assigned a localized sector, eliminating the extensive transit times and circuitous flight paths inherent in single-agent operations.

Table 9. Summary of performance metrics (multi-UAV).

Scenarios	Data	Coverage Rate (%)	Average Angular Velocity (deg/s)	95th Percentile Angular Velocity (deg/s)	Total Time (s)
Nominal	Proposed	95.53 ± 1.30	26.80 ± 1.92	85.39 ± 1.24	95.81 ± 12.63
Off-Nominal	Proposed	95.86 ± 1.31	29.72 ± 2.80	90.37 ± 2.59	98.03 ± 12.72
Edge	Proposed	96.48 ± 2.32	33.94 ± 2.34	97.95 ± 2.70	96.61 ± 12.43
Malformed	Proposed	76.49 ± 4.69	36.97 ± 7.33	106.79 ± 16.99	191.44 ± 46.43

Table 10. Summary of assurance metrics (multi-UAV).

Scenarios	Data	Trajectory Validity (%)	Average Trajectory Deviation (m)	95th Percentile Trajectory Deviation (m)	Total Time (s)
Nominal	Proposed	100.00 ± 0.03	0.047 ± 0.009	0.120 ± 0.023	95.81 ± 12.63
Off-Nominal	Proposed	99.96 ± 0.16	0.053 ± 0.011	0.130 ± 0.025	98.03 ± 12.72
Edge	Proposed	99.93 ± 0.21	0.055 ± 0.010	0.138 ± 0.026	96.61 ± 12.43
Malformed	Proposed	99.41 ± 0.63	0.066 ± 0.009	0.156 ± 0.069	191.44 ± 46.43

Despite the increased density of aerial traffic, the safety metrics remain consistent with the single-UAV scenarios. As detailed in Table 10, trajectory validity remains above 99.9% across the nominal, off-nominal, and edge scenarios, and the average trajectory deviation is maintained below 0.06 m even in the edge case. The angular velocity metrics in Table 9 show a slight increase in the edge scenario (mean 33.94 deg/s) compared to the nominal case (26.80 deg/s), reflecting the active compensation required for high-speed wind gusts. However, the low standard deviation indicates that the decentralized Simplex architecture suppresses disturbances and prevents unsafe oscillations.

Even under these malformed conditions, the multi-agent team suggests graceful degradation. The system achieves a coverage rate of 76.49%, notably higher than the single-agent result (63.53%) in the same environment. This improvement is primarily driven by the parallel execution capability of the multi-agent system. Unlike the single-agent scenario, where the task stalls when the UAV encounters an occlusion, the multi-UAV configuration allows other agents to continue scanning unobstructed sections of the structure. Importantly, the safety constraints are never compromised, with a trajectory validity of 99.41% and an average deviation of only 0.066 m.

The comparative trends across scenarios are visually summarized in Figure 18 and Figure 19. Consistent with the single-agent behavioral patterns observed in Figure 11 and Figure 12, these metrics show that although environmental severity affects performance efficiency (Figure 18), operational assurance remains strictly enforced (Figure 19).

Figure 18. Comparison of performance metrics (multi-UAV).

Figure 19. Comparison of assurance metrics (multi-UAV).

It is worth noting that the data distribution in the multi-UAV case (Figure 20) exhibits an even tighter interquartile range compared to the single-UAV scenarios. This effect could be isolated and tested in future work to better understand its underlying causes.

Figure 20. Data distribution (multi-UAV).

Figure 21 depicts the resulting trajectories from the multi-UAV scenarios. The traces show clear spatial deconfliction, with agents adhering to their assigned inspection corridors while dynamically avoiding obstacles and compensating for wind disturbances, suggesting the efficacy of the distributed planning and control layers.

Figure 21. Executed trajectories (multi-UAV).

Mediation Policy Evaluation

• Fast-Paced Mode: Table 11 summarizes the multi-UAV fast-paced mode evaluation. Under the shared deadline/forecast message, enabling the mediation policy changes the dominant run outcome from deadline-driven interruption to policy-driven termination. Specifically, with the system fixed to nominal mode, 60 out of 100 runs are interrupted by the exogenous no-go time, and 40 finish successfully. With the mediation policy enabled, 64 runs are intentionally terminated to preserve the return-to-home margin, while 36 still finish before the no-go time.
  Table 11. Multi-UAV fast-paced mode results (100 runs per configuration).

  Configuration	Coverage Rate (%)	Average Angular Velocity (deg/s)	Trajectory Validity (%)	Average Trajectory Deviation (m)	Finished	Unfinished
  Mediation Policy On	54.45 ± 31.28	29.47 ± 2.53	99.98 ± 0.09	0.049 ± 0.010	36	64 (terminated)
  Fixed Nominal Mode	90.10 ± 7.56	30.22 ± 2.72	99.98 ± 0.05	0.051 ± 0.009	40	60 (interrupted)

In terms of task progress, the fixed-nominal configuration attains a higher mean coverage rate (mean 0.9010, standard deviation 0.0756) than the policy-enabled configuration (mean 0.5445, standard deviation 0.3128). This reduction is expected in the multi-UAV setting because the average mission duration is approximately 95 s, while the mediation policy reserves a fixed 60 s return-to-home margin. Consequently, the remaining time available for inspection is often limited, and the shared deadline signal can quickly push the system into a regime where completing the nominal coverage tour is unlikely. In these cases, fast-paced mode and the associated termination logic prioritize safe recovery over continued inspection, leading to earlier mission endings (terminated) and a lower coverage rate, with increased variance across runs. This behavior reflects an explicit trade-off between coverage rate and guaranteed return-to-home feasibility under tight time budgets.

Figure 22 visualizes this behavior: fixed-nominal runs cluster near longer flight times and are frequently interrupted at the no-go boundary, whereas mediation policy-enabled runs shift toward shorter flight times, with a substantial portion ending via termination. Overall, these results indicate that in the multi-UAV case, the fast-paced mode primarily functions as a mission-level risk-management mechanism under shared time constraints, trading off coverage for predictable deadline compliance and preserved return-to-home feasibility.

Figure 22. Fast-paced mode evaluation in the off-nominal scenario.

• Minimum-Usage Mode: The minimum-usage mode is next evaluated under multi-UAV synthetic computational stress injection, where overload timing and severity (including the run-level amplification factor) are sampled independently per UAV. Figure 23 plots update-time miss versus amplification factor for all samples. Each configuration comprises 100 Monte Carlo runs with three UAVs per run, yielding $n=300$ per-UAV samples per configuration, and the plot indicates a clear separation between the two configurations.
  

  Figure 23. Update-time miss versus amplification factor for minimum-usage mode evaluation.

When the system is fixed to nominal mode, timing violations are substantial (mean update-time miss 468.93, standard deviation 153.97). With the mediation policy enabled, update-time miss is reduced by an order of magnitude (mean 39.81, standard deviation 17.39). This improvement is consistent with the intended role of minimum-usage mode: once persistent overload is detected, the Deliberative Layer proactively restricts the available candidate set to lightweight, predictable components, reducing repeated overruns across both planning and control updates during the overload interval. Importantly, this improvement persists across the tested range of amplification factors, suggesting that the policy provides robust timing stabilization under heterogeneous, per-UAV stress conditions.

5. Conclusions

The proposed multi-layer resilience architecture supports both performance and assurance metrics in simulated autonomous bridge inspection as environmental disturbances and planning uncertainty increase. Across 100-run Monte Carlo simulations, the system maintains high trajectory validity while reducing tracking deviation under adverse conditions, with only a modest increase in angular-rate metrics when high-assurance controllers are engaged. This behavior reflects an intentional trade-off between performance and envelope protection. The architecture also demonstrates potential scalability to decentralized multi-UAV scenarios, in which each vehicle executes the full autonomy stack locally. In these settings, the system contributes to reduced flight time and graceful degradation under malformed conditions, achieving increased attainable coverage without significant safety degradation observed in the reported scenarios. This evaluation employs a single high-performance planner-controller stack as the baseline and is limited to simulation with physics-based wind models. Consequently, the reported results primarily characterize the end-to-end benefit of the integrated architecture, rather than providing a component-level comparison against (i) single-layer Simplex architectures at either the trajectory-planning or flight-control level, or (ii) Simplex architectures with a single high-assurance fallback. In addition, simulation-based evaluations of the mission-level mediation policy (fast-paced and minimum-usage modes) demonstrate its ability to reconfigure lower-layer Simplex components to improve deadline compliance and timing stability under injected stress. However, the sim-to-real transition remains an important direction for future work.

Appendix B.1. Tracking and Obstacle Safety Deviations

The trajectory deviation and obstacle safety thresholds are derived from the UAV’s physical dimensions and empirical performance characteristics. Prior work indicates that UAVs used for bridge inspection range from compact platforms, such as the DJI Phantom series (35 cm wheelbase), to mid-sized industrial systems, such as the Matrice series (65 cm wheelbase) [77]. The custom platform considered here has a 40 cm wheelbase, placing it within this standard operational range.

A conservative safety principle is established by defining the UAV’s effective radius as half of the wheelbase (20 cm). The maximum allowable tracking deviation is therefore set to ${\tau }_{\mathrm{devi}}=20$ cm. Deviations exceeding this threshold indicate that the UAV’s center has moved beyond its physical footprint relative to the reference trajectory, signaling a significant control failure. The planner-level obstacle safety clearance is defined as the sum of the UAV’s radius and the maximum permissible deviation, yielding ${\tau }_{\mathrm{safe}}=40$ cm. This formulation ensures that, even under worst-case but acceptable tracking error, a safety buffer equivalent to the UAV’s radius is preserved between the vehicle and nearby obstacles, providing a scalable and physically grounded safety margin.

Appendix B.2. Wind Speed Threshold

The sustained wind-speed threshold of 3 m/s is determined empirically through repeated simulations in a Gazebo environment using a physics-based wind model. This value corresponds to the critical point at which the HP controller (PAMPC [11]) begins to consistently violate ${\tau }_{\mathrm{devi}}=20$ cm. The threshold, therefore, serves as a data-driven, preemptive trigger for switching to a more robust controller, such as SMC [22] or GAC [23], before primary safety constraints are breached.

Appendix B.3. Angular Velocity Threshold

The critical angular velocity (${\omega }_{\mathrm{crit}}$) corresponding to a one-pixel motion blur is derived for the Intel RealSense D435 camera (Intel Corporation, Santa Clara, CA, USA) under bright outdoor lighting conditions. The relevant parameters are:

• $W_{\mathrm{sensor}}$: sensor width (≈3.84 mm, corresponding to a 3.0 μm pixel pitch),
• $W_{\mathrm{pixels}}$: image width (1280 pixels),
• $f_{\mathrm{cam}}$: focal length (≈1.93 mm),
• $t_{\exp }$: exposure time (1.0 ms),
• $p_{\mathrm{blur}}$: blur threshold (1 pixel).

The derivation proceeds as follows:

• Pixel size calculation: The physical size of a single pixel ($d_{\mathrm{pixel}}$) is:

  $$d_{\mathrm{pixel}}={\displaystyle \frac{W_{\mathrm{sensor}}}{W_{\mathrm{pixels}}}}={\displaystyle \frac{3.84\times {10}^{-3}\mathrm{m}}{1280}}=3.0\mathsf{\mu }\mathrm{m}/\mathrm{pixel}$$
• Permissible blur distance: The maximum blur distance on the sensor is

  $$d_{\mathrm{blur}}=p_{\mathrm{blur}}\times d_{\mathrm{pixel}}=1\mathrm{pixel}\times 3.0\mathsf{\mu }\mathrm{m}/\mathrm{pixel}=3.0\mathsf{\mu }\mathrm{m}$$
• Maximum linear velocity on sensor: The corresponding velocity ($v_{\mathrm{sensor,max}}$) is

  $$v_{\mathrm{sensor,max}}={\displaystyle \frac{d_{\mathrm{blur}}}{t_{\exp }}}={\displaystyle \frac{3.0\times {10}^{-6}\mathrm{m}}{1.0\times {10}^{-3}\mathrm{s}}}=3.0\times {10}^{-3}\mathrm{m}/\mathrm{s}$$
• Critical angular velocity: Using the pinhole camera approximation ($v_{\mathrm{sensor}}\approx \omega \times f_{\mathrm{cam}}$), one solves for ${\omega }_{\mathrm{crit}}$:

  $${\omega }_{\mathrm{crit}}={\displaystyle \frac{v_{\mathrm{sensor,max}}}{f_{\mathrm{cam}}}}={\displaystyle \frac{3.0\times {10}^{-3}\mathrm{m}/\mathrm{s}}{1.93\times {10}^{-3}\mathrm{m}}}\approx 1.55\mathrm{rad}/\mathrm{s}\left(\mathrm{or}88.8^{\circ }/\mathrm{s}\right)$$

This derivation provides a physical upper bound of ${\omega }_{\mathrm{crit}}$. To ensure a conservative safety margin, one adopts a practical threshold such that angular velocities exceeding ${\omega }_{\mathrm{crit}}$ are considered to induce significant motion blur.

Appendix B.4. CPU Utilization Threshold

To maintain the response speed, the CPU utilization threshold is set to 80%. Real-time systems theory indicates that schedulability cannot be guaranteed at full utilization [78], particularly on non-hard real-time operating systems, such as Linux-based platforms. As CPU load approaches saturation, task scheduling latency can increase nonlinearly, compromising control-loop determinism [79]. Maintaining a 20% utilization headroom mitigates these effects and accommodates operating system overhead, background processes, and transient load spikes, thereby improving stability and reliability of flight control execution [80].

Additional latency-related safeguards, such as bounds on planner computation time and map update delays, are enforced within the decision logic to prevent unsafe behavior arising from stale environmental information or delayed replanning. These thresholds primarily influence fallback behavior and replanning conservatism rather than serving as standalone operational assurance metrics, and are therefore not reported separately in the evaluation.