Certificate-Guided Safe Tracking Control for Allocation-Guided Multi-UAV Missions

Highlights

What are the main findings?

• Across 60 randomized crossings, certificate feedback and a tracking-error-bound comparator had no observed safety violation; a plain CBF-QP without feedback violated tube and separation constraints in 44 trials.
• The explicit repair map converged autonomously in every four-UAV trial and escalated an altitude-infeasible six-UAV case to allocation.

What are the implications of the main findings?

• Hard execution constraints, analytical inter-sample margins, and episode-level event calibration prevent diagnostic slack or raw sample counts from being misread as physical permission or independent failures.
• Separate flights establish trackability only; their schedule does not cover the measured tracking-error margin required for simultaneous safety.

Abstract

Hierarchical multi-UAV planning can produce scheduled paths that become unsafe during execution because tracking dynamics, actuator limits, sampling, and communication are not fully represented upstream. We introduce a certificate-guided safe-tracking framework that treats each planned path as a versioned execution contract with explicit tube, separation, timing, uncertainty, communication, and input bounds. A rigid-body-derived translational interface supports a command-producing control Lyapunov function–control barrier function quadratic program with hard safety constraints. When a candidate becomes infeasible, a separate minimum-slack program localizes the conflict without passing its command to the plant, and an explicit repair map converts the resulting witness into timing or vertical-spacing updates, with escalation when local repair fails. Randomized comparisons show that certificate feedback removes the observed tube and separation failures of a plain CBF-QP while maintaining reliable completion and competitive tracking relative to a tracking-error-bound comparator. Disturbance and sensor-noise sweeps characterize robustness, and separate indoor flights confirm single-reference trackability. The framework therefore turns execution infeasibility into actionable planning feedback rather than a terminal controller failure.

1. Introduction

Hierarchical multi-UAV systems typically separate task allocation, cooperative path planning, and tracking control: the allocation layer assigns an ordered task sequence to each UAV, the planner converts that sequence into a scheduled path, and the controller tracks the resulting reference. In this work, the word certificate has a specific computational meaning from the start: it is a versioned, finite-horizon data record that binds a scheduled reference to explicit tube, separation, timing, disturbance, communication, and input assumptions. It is a conditional execution contract and machine-checkable witness, not a legal document, approved trip, flight permit, or permanent authorization. Although the hierarchical architecture is practical, its planning–execution interface remains incomplete because a path deemed feasible by a graph search, safe-interval model, or geometric scheduler may still violate tracking, actuator, or inter-UAV separation.

During quadrotor execution, tracking dynamics, actuator limits, sampling, and communication constraints create additional feasibility requirements. Certificate-feedback planning exposes this mismatch by returning finite-horizon records of path feasibility, risk cost, conflicts, and infeasible segments for the ordered task bundles. These records guide local repair but do not establish dynamic trackability; an execution-layer verifier is therefore needed to prevent a geometrically feasible path from being declared successful when its tracking dynamics are unsafe.

Control barrier functions (CBFs) provide a rigorous mechanism for encoding state constraints in feedback control. Ames et al. formulated CBF-based quadratic programs for safety-critical systems [1], and Wang et al. applied barrier certificates to collision avoidance in multirobot systems [2]. High-order formulations address constraints with high relative degree [3,4], while recent verification and synthesis results cover broader nonlinear and semialgebraic systems [5]. Robust and input-to-state safety analyses show that uncertainty must be represented explicitly rather than absorbed into a nominal invariance claim [6,7]. Sampled-data results extend this caution to finite-rate digital controllers [8,9]. Predictive safety filters offer a complementary perspective by modifying a proposed command only when constraint satisfaction requires intervention [10,11]. These studies support control-layer safety verification, but they generally do not explain how an execution-level failure should inform changes to an upstream path or allocation decision.

Quadrotor planning and tracking research addresses complementary parts of the same problem. Flatness-based methods provide continuous-time safety guarantees and Crazyflie experiments [12]; RAPTOR and GCOPTER generate dynamically informed trajectories under perception and geometric constraints [13,14]; and time-optimal planning couples trajectory timing with dynamic limits [15]. Multi-agent planners such as MADER, Robust MADER, EGO-Swarm, and safe-corridor methods extend these ideas to dynamic environments, communication delay, decentralized operation, and swarm feasibility [16,17,18,19]. Outdoor swarm experiments demonstrate the importance of realistic execution tests [20]. Related stochastic and learning-assisted planners incorporate uncertainty and constrained-control filtering [21,22]. These methods underscore the need for dynamically trackable planning, but they do not directly return a record that the allocation layer can use to explain why a particular task–path bundle failed during execution.

Several planners address the planning–execution gap more directly. FaSTrack computes a tracking-error bound through Hamilton–Jacobi reachability and passes that bound to planning [23]; its returned bound is therefore already an upstream planning interface, not a gap that this paper claims to fill. EGO-Planner supports efficient local replanning without a Euclidean signed distance field [24], and CLF-CBF-constrained planning links dynamically feasible motion generation with feedback control [25].

The narrower distinction pursued here is that, after an execution candidate fails, the verifier returns a labeled constraint witness, a magnitude, a repair variable, and an escalation deadline rather than only a global tracking-error bound. From the task-allocation perspective, decentralized and hierarchical methods increasingly couple task assignment with path feasibility [26,27]. GRSTAPS jointly addresses allocation, planning, and scheduling [28]; multi-objective assignment preserves distinct operational trade-offs [29]; and collaborative multi-UAV planning coordinates motion in confined environments [30]. The unresolved interface addressed here is therefore diagnostic and corrective: execution-layer infeasibility must identify which path variable or local allocation candidate requires modification.

This paper addresses that gap by treating the planner-issued execution certificate as the input to a verifier rather than as a terminal planning output. The verifier either activates the scheduled path under its stated tube, separation, timing, uncertainty, communication, and input bounds or invalidates that version and returns a structured execution-infeasibility witness. The witness identifies the affected constraint class and maps it to a repair target for the path planner or event-triggered allocator.

The contributions are summarized as follows.

• We formulate a finite-horizon execution-certificate interface that converts scheduled multi-UAV paths into dynamically checkable tracking, separation, timing, communication, and input constraints while preserving allocator-selected task ownership and order.
• We derive a bounded-disturbance translational verifier from rigid-body dynamics, keep safety constraints hard in the command-producing CLF-CBF-QP, and use a non-executable minimum-slack witness to drive explicit path repair or deadline-bounded allocation escalation.
• We evaluate the complete loop against plain CBF-QP and FaSTrack-style tracking-error-bound comparators using randomized trials, disturbance/noise and event-threshold sweeps, PyBullet cases, and separate motion-capture flights, with the hardware evidence restricted to single-reference trackability.

2. Materials and Methods

We formulate the problem at the interface between path planning and execution control. Task ownership and order remain fixed, while the planner provides a finite-horizon certificate rather than a geometric curve alone. The controller must determine whether that certificate is executable under tracking, separation, timing, and input-margin constraints. The following subsections define the upstream path certificate, the nominal execution model, and the safety constraints used by the CLF-CBF-QP.

2.1. Path Certificate from the Planning Layer

Let $\mathcal{U}=\{1,\dots ,N\}$ denote the UAV set. Because the execution layer does not modify task ownership, the allocation output is represented by the ordered bundle assigned to each vehicle. For UAV i, this bundle is

$${\pi }_i=(j_{i,1},\dots ,j_{i,m_i}).$$

(1)

For this fixed order, the path planner supplies the differentiable reference required by the tracking verifier over a finite horizon T:

$${\mathcal{P}}_i=\{(r_i\left(t\right),{\dot{r}}_i\left(t\right),{\ddot{r}}_i\left(t\right),t)\mid t\in [0,T]\},$$

(2)

where $r_i\left(t\right)\in {\mathbb{R}}^3$ is the position reference and ${\dot{r}}_i\left(t\right)$ and ${\ddot{r}}_i\left(t\right)$ are its velocity and acceleration. The planner also specifies an execution-tube radius $R_i$, a minimum inter-UAV separation $d_{\min }$, and the time window $[0,T]$.

Definition 1

(Execution certificate). For a fixed allocation result $\Pi ={\left\{{\pi }_i\right\}}_{i=1}^N$, version q, issue time $t_{\mathrm{iss}}$, and expiry time $t_{\exp }=t_{\mathrm{iss}}+T$, the planner passes the finite data structure

$${\mathcal{C}}_p^{\left(q\right)}=\left(q,t_{\mathrm{iss}},t_{\exp },{\left\{{\mathcal{P}}_i\right\}}_{i=1}^N,{\left\{R_i\right\}}_{i=1}^N,d_{\min },\mathcal{B},{\mathcal{M}}_p,s_p\right),$$

(3)

where $\mathcal{B}$ stores the declared disturbance, sampling, packet-age, reference, and input bounds; ${\mathcal{M}}_p$ stores the path cost, risk exposure, segment status, and repair context; and $s_p\in \{\mathit{candidate},\mathit{active},\mathit{completed},\mathit{invalidated}\}$ is the lifecycle state. The term certificate denotes this conditional computational contract, not an immutable document. It is finite-horizon and model-specific.

The execution layer may request local path repair or allocator escalation; however, it preserves the task order encoded by Π and never reassigns tasks directly.

The lifecycle is enforced as follows. A candidate becomes active only after its bounds, time window, tightened sets, and hard safety QP pass verification. It becomes completed when its horizon is reached. If a declared bound is exceeded, a packet becomes older than $\overline{\tau }$, a tightened sampled set is violated, or the hard safety QP is infeasible, the active version is immediately marked invalidated. The command selector then applies the independent backup action, produces an infeasibility witness, and requests repair/reissue or allocator escalation. Reissue creates a new version; an invalidated version never becomes active again.

2.2. Rigid-Body Model and Bounded Translational Interface

For UAV i, let $R_i\in \mathrm{SO}\left(3\right)$ map body coordinates to the inertial frame, ${\mathsf{\Omega }}_i$ be the body angular velocity, $m_i$ and $J_i$ be the mass and inertia matrix, and $f_i$ and ${\tau }_i$ be the total thrust and body torque. The rigid-body dynamics are

$$\begin{array}{cc}\hfill {\dot{p}}_i& =v_i,\hfill \\ \hfill m_i{\dot{v}}_i& =-m_{i}g{e}_3+f_i{R}_i{e}_3+d_i^f,\hfill \\ \hfill {\dot{R}}_i& =R_i{\widehat{\mathsf{\Omega }}}_i,\hfill \\ \hfill J_i{\dot{\mathsf{\Omega }}}_i& ={\tau }_i-{\mathsf{\Omega }}_i\times J_i{\mathsf{\Omega }}_i+d_i^{\tau },\hfill \end{array}$$

(4)

where $d_i^f$ and $d_i^{\tau }$ collect unmodeled force and torque. The outer-loop acceleration $u_i$ defines the desired thrust vector through $f_i^d{R}_i^d{e}_3=m_i(u_i+g{e}_3)$. Substitution into the translational equation gives the exact interface

$${\dot{p}}_i=v_i,{\dot{v}}_i=u_i+w_i,$$

(5)

where

$$w_i={\displaystyle \frac{f_i{R}_i{e}_3-f_i^d{R}_i^d{e}_3+d_i^f}{m_i}}.$$

(6)

Thus, rotational behavior is not assumed to vanish; thrust and attitude tracking errors enter the verifier as a matched translational disturbance. If $|f_i-f_i^d|\le {\overline{f}}_i^e$, the angle between $R_i{e}_3$ and $R_i^d{e}_3$ is at most ${\overline{\theta }}_i$, $f_i^d \le {\overline{f}}_i^d$, and ${\displaystyle \parallel }{d}_i^f\parallel \le {\overline{d}}_i^f$, then

$${\displaystyle \parallel }{w}_i\parallel \le {\displaystyle \frac{{\overline{f}}_i^e+2{\overline{f}}_i^d\sin ({\overline{\theta }}_i/2)+{\overline{d}}_i^f}{m_i}}=:{\overline{w}}_i.$$

(7)

Equation (7) is the contract required from the inner-loop controller; if a vehicle cannot certify these bounds, the robust guarantee below does not apply. Physics-based validation uses the full Crazyflie model in gym-pybullet-drones [31], whereas the online verifier retains the affine acceleration input. Componentwise bounds represent finite outer-loop authority:

$$u_i\in {\mathcal{U}}_i=\{u\in {\mathbb{R}}^3\mid |u_k|\le u_{\max },k=1,2,3\}.$$

(8)

Relative to the timed reference in the path certificate, the position and velocity errors are defined as

$$e_i=p_i-r_i,{\dot{e}}_i=v_i-{\dot{r}}_i.$$

(9)

Combining reference feedforward with proportional–derivative feedback yields the nominal acceleration:

$$u_i^{\mathrm{nom}}={\ddot{r}}_i-k_p{e}_i-k_d{\dot{e}}_i.$$

(10)

The CBF-QP modifies $u_i^{\mathrm{nom}}$ only when the certificate constraints require intervention. During execution, a model-residual monitor supplies a conservative upper estimate ${\widehat{w}}_i^{+}\left(t\right)$. If ${\widehat{w}}_i^{+}\left(t\right)\le {\overline{w}}_i$, the active certificate remains conditional on its other bounds. If the estimate is unavailable or exceeds ${\overline{w}}_i$, the claimed disturbance envelope no longer applies, so the current certificate is invalidated before the next nominal command is selected. The simulation in Section 3.5 implements this monitor explicitly; the retained hardware logs do not contain the force or wind measurements needed to validate it outdoors.

2.3. Safety Constraints

To limit admissible deviation from each reference trajectory, the path certificate defines the tracking tube as

$${\mathcal{T}}_i\left(t\right)=\{p\in {\mathbb{R}}^3\mid \parallel p-r_i\left(t\right)\parallel \le R_i\}.$$

(11)

Tube membership is encoded by the CBF-compatible barrier function

$$h_i^{\mathrm{tube}}(p_i,t)=R_i^2-{\parallel p_i-r_i\left(t\right)\parallel }^2.$$

(12)

Inter-UAV safety requires every pairwise distance to exceed the certified threshold. The corresponding barrier is

$$h_{ij}^{\mathrm{sep}}(p_i,p_j)={\parallel p_i-p_j\parallel }^2-d_{\min }^2,i<j.$$

(13)

Both barriers have relative degree two under (5). We select $k_0^t,k_1^t,k_0^s,k_1^s$ so that the associated second-order polynomials are Hurwitz. Separating the known acceleration from $w_i$ gives the following nominal derivative terms.

For $e_i=p_i-r_i$, the tube-barrier derivatives are

$$\begin{array}{cc}\hfill {\dot{h}}_i^{\mathrm{tube}}& =-2e_i^{\top }{\dot{e}}_i,\hfill \\ \hfill {\ddot{h}}_i^{\mathrm{tube},0}& =-2{\dot{e}}_i^{\top }{\dot{e}}_i-2e_i^{\top }(u_i-{\ddot{r}}_i).\hfill \end{array}$$

(14)

For pairwise safety, define the relative position $p_{ij}=p_i-p_j$ and velocity $v_{ij}=v_i-v_j$. The barrier derivatives are

$$\begin{array}{cc}\hfill {\dot{h}}_{ij}^{\mathrm{sep}}& =2p_{ij}^{\top }{v}_{ij},\hfill \\ \hfill {\ddot{h}}_{ij}^{\mathrm{sep},0}& =2v_{ij}^{\top }{v}_{ij}+2p_{ij}^{\top }(u_i-u_j).\hfill \end{array}$$

(15)

The disturbance terms omitted from these nominal derivatives are $-2e_i^{\top }{w}_i$ and $2p_{ij}^{\top }(w_i-w_j)$. Cauchy–Schwarz therefore yields the robust affine ECBF expressions

$$\begin{array}{cc}\hfill {\mathrm{\Psi }}_i^t& ={\ddot{h}}_i^{\mathrm{tube},0}+k_1^t{\dot{h}}_i^{\mathrm{tube}}+k_0^t{h}_i^{\mathrm{tube}}-2\parallel e_i\parallel {\overline{w}}_i,\hfill \\ \hfill {\mathrm{\Psi }}_{ij}^s& ={\ddot{h}}_{ij}^{\mathrm{sep},0}+k_1^s{\dot{h}}_{ij}^{\mathrm{sep}}+k_0^s{h}_{ij}^{\mathrm{sep}}-2\parallel p_{ij}\parallel ({\overline{w}}_i+{\overline{w}}_j).\hfill \end{array}$$

(16)

Requiring ${\mathrm{\Psi }}_i^t\ge 0$ and ${\mathrm{\Psi }}_{ij}^s\ge 0$ protects against every disturbance satisfying (7); no PyBullet tracking error is used in these worst-case terms.

Sample-And-Hold and Communication-Delay Margins

Let $t_k=k\Delta$, and let ${\overline{a}}_i$, ${\overline{a}}_i^r$, and $A_i={\overline{a}}_i+{\overline{w}}_i$ bound $\parallel u_i\parallel$, $\parallel {\ddot{r}}_i\parallel$, and $\parallel {\dot{v}}_i\parallel$, respectively. During one zero-order-hold interval, the relative tracking displacement is bounded by

$${\mu }_i^t\left(k\right)=\parallel {\dot{e}}_i\left(t_k\right)\parallel \Delta +{\displaystyle \frac{1}{2}}({\overline{a}}_i+{\overline{a}}_i^r+{\overline{w}}_i){\Delta }^2.$$

(17)

For communication, each packet is time stamped and propagated with its reported velocity. If its age is at most $\overline{\tau }$, the constant-velocity predictor ${\widehat{p}}_i$ satisfies $\parallel p_i-{\widehat{p}}_i\parallel \le A_i{\overline{\tau }}^2/2$. The inter-sample closure and pairwise prediction uncertainty are therefore

$$\begin{array}{cc}\hfill {ϵ}_{ij}^{v,\tau }& =(A_i+A_j)\overline{\tau },\hfill \\ \hfill {\mu }_{ij}^s\left(k\right)& =\left(\parallel {\widehat{v}}_i\left(t_k\right)-{\widehat{v}}_j\left(t_k\right)\parallel +{ϵ}_{ij}^{v,\tau }\right)\Delta +{\displaystyle \frac{1}{2}}(A_i+A_j){\Delta }^2,\hfill \\ \hfill {ϵ}_{ij}^{\tau }& ={\displaystyle \frac{1}{2}}(A_i+A_j){\overline{\tau }}^2.\hfill \end{array}$$

(18)

At sample k, the verifier holds the tightened quantities

$${\tilde{R}}_i\left(k\right)=R_i-{\mu }_i^t\left(k\right),{\tilde{d}}_{ij}\left(k\right)=d_{\min }+{\mu }_{ij}^s\left(k\right)+{ϵ}_{ij}^{\tau }$$

(19)

constant while solving the QP. The tightened barriers are ${\tilde{h}}_i^t={\tilde{R}}_i^2-{\parallel e_i\parallel }^2$ and ${\tilde{h}}_{ij}^s={\parallel {\widehat{p}}_i-{\widehat{p}}_j\parallel }^2-{\tilde{d}}_{ij}^2$; these replace $h_i^{\mathrm{tube}}$ and $h_{ij}^{\mathrm{sep}}$ in (16). A nonpositive ${\tilde{R}}_i$, violation of a tightened set at a sample, or infeasibility of the robust ECBF constraints rejects the certificate. These margins follow directly from the bounded-acceleration displacement inequality and the triangle inequality; they are not tuned from observed collisions.

For clarity, the online validity predicate for version q at sample $t_k$ is

$$\mathrm{Valid}({\mathcal{C}}_p^{\left(q\right)},t_k)=1⟺\left\{\begin{array}{c}{s}_p=\mathrm{active},t_k\in [t_{\mathrm{iss}},t_{\exp }],\hfill \\ {\widehat{w}}_i^{+}\left(t_k\right)\le {\overline{w}}_i,{\tau }_i\left(t_k\right)\le \overline{\tau }\forall i,\hfill \\ {\tilde{R}}_i\left(k\right)>0,{\tilde{h}}_i^t\left(t_k\right)\ge 0\forall i,\hfill \\ {\tilde{h}}_{ij}^s\left(t_k\right)\ge 0\forall i<j,\hfill \\ \mathrm{the}\mathrm{hard}\mathrm{safety}\mathrm{QP}\mathrm{in}\left(25\right)\mathrm{is}\mathrm{feasible}.\hfill \end{array}\right.$$

(20)

Failure of any line sets $s_p\leftarrow \mathrm{invalidated}$. Thus, a disturbance inside the declared envelope does not alter the record, whereas an envelope exceedance revokes the active version; no stale or out-of-bound certificate continues to authorize execution.

2.4. Certificate-Guided Safe Tracking Control

Rather than replacing either upstream module, the verifier treats the execution certificate as a contract for determining whether the planner and allocator outputs can be tracked within the stated constraints. The command-producing CLF-CBF-QP keeps tube invariance and pairwise separation hard. Relaxation is introduced only in a second diagnostic problem after the executable QP has been rejected.

2.4.1. CLF-CBF-QP Execution Verifier

We use a filtered error to combine position and velocity tracking errors. For $\lambda >0$, define

$${\eta }_i={\dot{e}}_i+\lambda e_i,$$

(21)

where $e_i$ and ${\dot{e}}_i$ are defined above. The quadratic CLF candidate penalizes both the filtered error and the position error:

$$V_i={\displaystyle \frac{1}{2}}{\eta }_i^{\top }{\eta }_i+{\displaystyle \frac{c_p}{2}}{e}_i^{\top }{e}_i.$$

(22)

For the nominal verifier, we evaluate the CLF derivative under (5) with $w_i=0$. The robustness assumptions stated later address bounded disturbances. The nominal derivative is

$${\dot{V}}_i={\eta }_i^{\top }(u_i-{\ddot{r}}_i+\lambda {\dot{e}}_i)+c_p{e}_i^{\top }{\dot{e}}_i.$$

(23)

Because strict tracking convergence can conflict with safety during close maneuvers, only the CLF condition is softened:

$${\dot{V}}_i\le -c_v{V}_i+{\delta }_i^{\mathrm{clf}},{\delta }_i^{\mathrm{clf}}\ge 0.$$

(24)

At each control step, the command-producing QP is

$$\begin{array}{cccc}\hfill \underset{{\{u_i,{\delta }_i^{\mathrm{clf}}\}}_{i=1}^N}{\mathrm{minimize}}& {\displaystyle \sum _{i=1}^N}\left(\parallel u_i-u_i^{\mathrm{nom}}{\parallel }^2+{\alpha }_c{\left({\delta }_i^{\mathrm{clf}}\right)}^2+{\alpha }_u{\parallel u_i\parallel }^2\right)\hfill & & \\ \hfill \mathrm{subject}\mathrm{to}& u_i\in {\mathcal{U}}_i,\hfill & \hfill & i=1,\dots ,N,\hfill \\ \hfill & {\dot{V}}_i\le -c_v{V}_i+{\delta }_i^{\mathrm{clf}},\hfill & \hfill & i=1,\dots ,N,\hfill \\ \hfill & {\mathrm{\Psi }}_i^t\ge 0,\hfill & \hfill & i=1,\dots ,N,\hfill \\ \hfill & {\mathrm{\Psi }}_{ij}^s\ge 0,\hfill & \hfill & 1\le i<j\le N,\hfill \\ \hfill & {\delta }_i^{\mathrm{clf}}\ge 0,\hfill & \hfill & i=1,\dots ,N.\hfill \end{array}$$

(25)

The safety constraints in (25) contain no relaxation variables. If the problem is feasible and the validity predicate (20) holds, its command is executed. Otherwise, the certificate is invalidated. Diagnosis then proceeds lexicographically rather than trading safety slack against tracking performance. With positive normalization constants $q_i^t,q_{ij}^s$, the first stage is

$$\begin{array}{cc}\hfill S^{\star }=\underset{\left\{u_i^d\right\},{\delta }^d}{\min }& \sum _i{\left({\displaystyle \frac{{\delta }_i^t}{q_i^t}}\right)}^2+\sum _{i<j}{\left({\displaystyle \frac{{\delta }_{ij}^s}{q_{ij}^s}}\right)}^2\hfill \\ \hfill \mathrm{s}.\mathrm{t}.& u_i^d\in {\mathcal{U}}_i,{\dot{V}}_i^d\le -c_v{V}_i+{\delta }_i^{\mathrm{clf}},\hfill \\ \hfill & {\mathrm{\Psi }}_i^t\left(u_i^d\right)+{\delta }_i^t\ge 0,{\mathrm{\Psi }}_{ij}^s(u_i^d,u_j^d)+{\delta }_{ij}^s\ge 0,\hfill \\ \hfill & {\delta }_i^{\mathrm{clf}},{\delta }_i^t,{\delta }_{ij}^s\ge 0.\hfill \end{array}$$

(26)

The strictly convex objective makes the minimum-norm safety-slack vector ${\delta }^{\star }$ unique. In the second stage, the implementation minimizes $J_{\mathrm{track}}$ subject to the same constraints and $0\le {\delta }_m\le {\delta }_m^{\star }+{ϵ}_{\mathrm{opt}}$ for every labeled safety constraint m. Tracking therefore cannot purchase a larger safety relaxation. The implementation logs $S^{\star }$ and ${\delta }^{\star }$, discards $u^d$, applies the bounded braking/hover action, and halts execution of the invalidated certificate.

Remark 1

(Safety meaning of diagnostic feasibility). Diagnostic slacks make (26) feasible for conflict localization, but do not make the rejected path physically executable. No command from either diagnostic stage is passed to the plant. Consequently, a safety relaxation can no longer authorize a collision-prone command.

2.4.2. Execution-Infeasibility Witness

Definition 2

(Execution-infeasibility witness). When an active certificate is invalidated, the verifier stores the relevant state, reference, tightened margin, minimum-slack conflict, and response deadline. At time t, the execution-infeasibility witness is the finite record

$${\mathcal{W}}_u\left(t\right)=\left(i,j,t,x,r,\mathcal{l},\sigma ,\mathcal{A},\mathcal{R},t_d\right),$$

(27)

Here, i and j identify the affected UAV or pair, with $j=Ø$ for a single-UAV tube or input-margin record. The variables x, r, ℓ, and σ denote the current state, active reference, constraint class, and diagnostic relaxation or safety margin, respectively; $\mathcal{A}$ is the active constraint set, $\mathcal{R}$ is the recommended repair target, and $t_d$ is the absolute repair deadline.

Diagnostic relaxations localize tube and separation conflicts after rejection, whereas separately defined input margins report proximity to actuator limits. Define the normalized nominal-control and motor-speed ratios

$${\rho }_i^u={\displaystyle \frac{\parallel u_i{\parallel }_{\infty }}{u_{\max }}},{\rho }_i^{\omega }=\underset{m}{\max }{\displaystyle \frac{{\omega }_{i,m}}{{\omega }_{\max }}},$$

(28)

where m indexes the rotors. The nominal verifier uses ${\rho }_i^u$, and the PyBullet simulation logs ${\rho }_i^{\omega }$. Thresholding the recorded relaxation and input-margin quantities yields

$$\begin{array}{cc}\hfill {\delta }_i^t>{ϵ}_{\delta }& \Rightarrow \mathcal{l}=\mathrm{tube}\mathrm{infeasibility},\hfill \\ \hfill {\delta }_{ij}^s>{ϵ}_{\delta }& \Rightarrow \mathcal{l}=\mathrm{pairwise}\mathrm{safety}\mathrm{infeasibility},\hfill \\ \hfill \left.\begin{array}{cc}\hfill {\rho }_i^u& \ge {\rho }_{\mathrm{warn}},\hfill \\ \hfill {\rho }_i^{\omega }& \ge {\rho }_{\mathrm{warn}}\hfill \end{array}\right\}& \Rightarrow \mathcal{l}=\mathrm{input}\text{-}\mathrm{margin}\mathrm{warning}.\hfill \end{array}$$

(29)

If several conditions occur at one time step, the implementation stores a separate record for each condition with the same timestamp. Each record specifies a local repair target: tube infeasibility prompts path smoothing, tube adjustment, or time-window relaxation; pairwise infeasibility prompts temporal or vertical deconfliction or local task repair; and an input-margin warning prompts lower reference acceleration or a longer execution window.

2.4.3. Feedback to Path Planning and Task Allocation

Because many execution failures can be corrected without changing task ownership, the control layer first gives the path planner one deadline-bounded local-repair attempt. If a repair is returned before $t_d=t+t_{\mathrm{local}}$ and preserves the allocated order, the planner updates the path certificate through

$${\mathcal{C}}_p^{(q+1)}=\mathrm{RepairPath}({\mathcal{C}}_p^{\left(q\right)},{\mathcal{W}}_u).$$

(30)

The repair map is explicit. Let $\overline{e}$ be the declared one-vehicle tracking-error bound and let ${\overline{\mu }}^s$ be the design value of the sample-and-delay margin in (18). The scheduled-reference target is

$$d_{\mathrm{req}}=d_{\min }+2\overline{e}+{\overline{\mu }}^s.$$

(31)

For a pairwise witness, $\mathcal{l}=\mathrm{pairwise}\mathrm{safety}\mathrm{infeasibility}$, define ${\Delta }_s={[d_{\mathrm{req}}-d_{\mathrm{sched}}]}_{+}$. The repair variable is the crossing-lane spacing $s_z$. For centered levels $c_i=i-(N+1)/2$, the two waypoints bracketing the diagnosed crossing are assigned $z_i=z_0+c_i{s}_z+c_0$, where

$$\begin{array}{cc}\hfill s_z^{*}& =\inf \left\{s\ge 0:\underset{i<j,t\in [0,T]}{\min }\parallel r_i(t;s)-r_j(t;s)\parallel \ge d_{\mathrm{req}}\right\},\hfill \\ \hfill c_0^{*}& =\max \left\{0,z_{\min }-\underset{i,k}{\min }{z}_{i,k}\left(s_z^{*}\right)\right\}.\hfill \end{array}$$

(32)

The implementation evaluates the minimum distance on an 801-point time mesh and obtains the smallest feasible $s_z^{*}$ by 24 bisection iterations. The common lift $c_0^{*}$ is therefore determined only by the certified altitude lower bound; the candidate is rejected if its maximum altitude exceeds $z_{\max }$. For a tube or input witness, define ${\Delta }_a={[a_{\mathrm{ref}}^{\max }-a_{\mathrm{avail}}]}_{+}$, where $a_{\mathrm{avail}}$ is the declared reference-acceleration budget. The repair variable is the horizon, updated by

$$T^{+}=\gamma T,\gamma =\max \left\{1,\sqrt{a_{\mathrm{ref}}^{\max }/a_{\mathrm{avail}}}\right\}.$$

(33)

This factor follows from the $T^{-2}$ scaling of the cubic reference acceleration. A tube-radius increase is not used unless a separate tracking-error analysis certifies the larger tube. Thus, the previous fixed $0.20$ m lift and factor-$1.75$ offset are not parameters of $\mathrm{RepairPath}$.

After each update, the candidate is reverified against (31), the altitude interval, the reference-acceleration budget, and the hard QP. Acceptance creates version $q+1$; otherwise, the next witness determines the next variable. If no candidate exists within the certified local domain, the iteration limit is reached, the attempt exceeds $t_d$, or the conservative time to the physical boundary is no greater than $t_{\mathrm{local}}$, the execution manager bypasses further planner retries and directly triggers the event-driven allocator. Let $\mathcal{I}$ denote the allocator-side set of unresolved records. Then,

$${\mathcal{I}}^{+}=\mathcal{I}\cup \left\{{\mathcal{W}}_u\right\}.$$

(34)

The allocator then reconsiders only the affected UAV–task candidates rather than recomputing every bundle. The implementation uses at most three local updates, $t_{\mathrm{local}}=0.10$ s, and includes the expiry action in every rejection record. The execution manager can therefore initiate reassignment without a prolonged multi-layer retry loop, while the allocator retains sole responsibility for changing task ownership.

2.5. Theoretical Properties

The analysis separates the continuous-time robust ECBF claim from the sampled-data geometric claim. Both are conditional on declared bounds; neither is inferred from a successful simulation.

Assumption 1

(Certified cascade and reference bounds). For each UAV, the inner loop satisfies the thrust, attitude, and force bounds used in (7); the reference acceleration is bounded by ${\overline{a}}_i^r$; and the outer-loop input implies $\parallel u_i\parallel \le {\overline{a}}_i$. These constants hold over $[0,T]$.

Assumption 2

(Bounded sampling and communication). The QP uses zero-order hold with period Δ. Each neighbor packet is time stamped, has age at most $\overline{\tau }$, and is propagated by the constant-velocity predictor used in (18). Packet loss beyond $\overline{\tau }$ rejects the certificate rather than reusing an arbitrarily old state.

Assumption 3

(Tightened ECBF admissibility). For each active barrier h, choose ${\lambda }_1,{\lambda }_2>0$ and set $k_1={\lambda }_1+{\lambda }_2$, $k_0={\lambda }_1{\lambda }_2$. At the start $t_0$ of an active verification interval, the barrier and first auxiliary state satisfy

$$h\left(t_0\right)\ge 0,b_1\left(t_0\right):=\dot{h}\left(t_0\right)+{\lambda }_{1}h\left(t_0\right)\ge 0.$$

(35)

For sampled execution, the corresponding tightened barriers satisfy these conditions whenever a candidate version is activated; otherwise, that version is not executed.

Lemma 1

(Affine robust CBF constraints). For (5), the robust expressions in (16) are affine in ${\left\{u_i\right\}}_{i=1}^N$.

Proof. 

The tube expression contains the control only through $-2e_i^{\top }{u}_i$, and the pairwise expression only through $2p_{ij}^{\top }(u_i-u_j)$. The worst-case disturbance and tightened-set terms are fixed at each sample.    □

Proposition 1

(Robust continuous-time invariance). Fix any active interval $[t_0,t_1]\subseteq [t_{\mathrm{iss}},t_{\exp }]$. If Assumptions 1 and 3 hold and ${\mathrm{\Psi }}_i^t\left(t\right)\ge 0$, ${\mathrm{\Psi }}_{ij}^s\left(t\right)\ge 0$ for every $t\in [t_0,t_1]$, then, for every measurable disturbance satisfying $\parallel w_i\left(t\right)\parallel \le {\overline{w}}_i$, all tube and separation barriers that are initially admissible remain non-negative on $[t_0,t_1]$.

Proof. 

For a tube barrier, the actual second derivative is ${\ddot{h}}_i^t={\ddot{h}}_i^{t,0}-2e_i^{\top }{w}_i$. Cauchy–Schwarz and $\parallel w_i\parallel \le {\overline{w}}_i$ give

$${\ddot{h}}_i^t+k_1^t{\dot{h}}_i^t+k_0^t{h}_i^t\ge {\mathrm{\Psi }}_i^t\ge 0.$$

(36)

For a pairwise barrier, $2p_{ij}^{\top }(w_i-w_j)\ge -2\parallel p_{ij}\parallel ({\overline{w}}_i+{\overline{w}}_j)$, so the same argument gives ${\ddot{h}}_{ij}^s+k_1^s{\dot{h}}_{ij}^s+k_0^s{h}_{ij}^s\ge 0$. It remains to show that this differential inequality implies invariance. For either barrier, factor the gains as in Assumption 3 and set $b_1=\dot{h}+{\lambda }_{1}h$. Then,

$${\dot{b}}_1+{\lambda }_2{b}_1=\ddot{h}+({\lambda }_1+{\lambda }_2)\dot{h}+{\lambda }_1{\lambda }_{2}h\ge 0.$$

(37)

Multiplication by $e^{{\lambda }_2(t-t_0)}$ and integration yield $b_1\left(t\right)\ge e^{-{\lambda }_2(t-t_0)}{b}_1\left(t_0\right)\ge 0$. Applying the same integrating-factor argument to $\dot{h}+{\lambda }_{1}h=b_1\ge 0$ gives $h\left(t\right)\ge e^{-{\lambda }_1(t-t_0)}h\left(t_0\right)\ge 0$. This holds for every admissible disturbance and for every labeled barrier, proving the claim [6,7].    □

Proposition 2

(Inter-sample and bounded-delay safety). Let $t_{k+1}-t_k\le \Delta$, let packet ages satisfy ${\tau }_i\le \overline{\tau }$, and suppose Assumptions 1–2 hold. If, at sample $t_k$, $\parallel e_i\left(t_k\right)\parallel \le {\tilde{R}}_i\left(k\right)$ and $\parallel {\widehat{p}}_i\left(t_k\right)-{\widehat{p}}_j\left(t_k\right)\parallel \ge {\tilde{d}}_{ij}\left(k\right)$, with margins defined by (17)–(19), then $\parallel e_i\left(t\right)\parallel \le R_i$ and $\parallel p_i\left(t\right)-p_j\left(t\right)\parallel \ge d_{\min }$ for every $t\in [t_k,t_{k+1}]$.

Proof. 

Write $s=t-t_k\in [0,\Delta ]$. Twice integrating the relative tracking dynamics gives

$$e_i\left(t\right)-e_i\left(t_k\right)={\dot{e}}_i\left(t_k\right)s+{\int }_{t_k}^t(t-\xi )\left(u_i\left(\xi \right)+w_i\left(\xi \right)-{\ddot{r}}_i\left(\xi \right)\right)\mathrm{d}\xi .$$

(38)

The certified bounds therefore imply

$$\parallel e_i\left(t\right)-e_i\left(t_k\right)\parallel \le \parallel {\dot{e}}_i\left(t_k\right)\parallel s+\frac{1}{2}({\overline{a}}_i+{\overline{a}}_i^r+{\overline{w}}_i)s^2\le {\mu }_i^t\left(k\right).$$

(39)

Consequently, $\parallel e_i\left(t\right)\parallel \le {\tilde{R}}_i\left(k\right)+{\mu }_i^t\left(k\right)=R_i$.

For a packet of age ${\tau }_i$, constant-velocity propagation and $\parallel {\dot{v}}_i\parallel \le A_i$ give $\parallel p_i\left(t_k\right)-{\widehat{p}}_i\left(t_k\right)\parallel \le A_i{\tau }_i^2/2$ and $\parallel v_i\left(t_k\right)-{\widehat{v}}_i\left(t_k\right)\parallel \le A_i{\tau }_i$. Summing the two vehicles’ errors yields $\parallel p_{ij}\left(t_k\right)-{\widehat{p}}_{ij}\left(t_k\right)\parallel \le {ϵ}_{ij}^{\tau }$ and $\parallel v_{ij}\left(t_k\right)-{\widehat{v}}_{ij}\left(t_k\right)\parallel \le {ϵ}_{ij}^{v,\tau }$. A second integration over $[t_k,t]$ then gives

$$\parallel p_{ij}\left(t\right)-p_{ij}\left(t_k\right)\parallel \le \left(\parallel {\widehat{v}}_{ij}\left(t_k\right)\parallel +{ϵ}_{ij}^{v,\tau }\right)s+\frac{1}{2}(A_i+A_j)s^2\le {\mu }_{ij}^s\left(k\right).$$

(40)

The reverse triangle inequality now yields

$$\parallel p_{ij}\left(t\right)\parallel \ge \parallel {\widehat{p}}_{ij}\left(t_k\right)\parallel -{ϵ}_{ij}^{\tau }-{\mu }_{ij}^s\left(k\right)\ge d_{\min }.$$

(41)

Thus, the claimed bound covers both delayed prediction and every inter-sample instant; it is not a continuous-time inequality evaluated only at 48 Hz [8,9].    □

Proposition 3

(Minimum-slack diagnostic soundness and non-execution). At a tightened-admissible sample, define the hard safety input set

$${\mathcal{F}}_h=\{u\in \mathcal{U}\mid {\mathrm{\Psi }}_i^t\left(u_i\right)\ge 0\forall i,{\mathrm{\Psi }}_{ij}^s(u_i,u_j)\ge 0\forall i<j\}.$$

(42)

Assume $\mathcal{U}$ is nonempty and compact and all normalization constants in (26) are positive. Then, $S^{\star }=0$ if and only if ${\mathcal{F}}_h\ne Ø$; equivalently, $S^{\star }>0$ certifies hard-safety input infeasibility at that sample. A component ${\delta }_m^{\star }>{ϵ}_{\delta }$ identifies the correspondingly labeled inequality relaxed in the unique minimum-norm witness. Neither diagnostic-stage control is executable.

Proof. 

If ${\mathcal{F}}_h\ne Ø$, choose any $u\in {\mathcal{F}}_h$, set every safety slack to zero, and choose the non-negative CLF slack large enough to satisfy the softened CLF inequalities. This point is feasible for (26) and has objective zero, so $S^{\star }=0$. Conversely, if $S^{\star }=0$, positivity of every $q_m$ and nonnegativity of every slack imply ${\delta }_m^{\star }=0$ for all m. The associated $u^d\in \mathcal{U}$ then satisfies every hard safety inequality, so $u^d\in {\mathcal{F}}_h$. Therefore, $S^{\star }>0$ is equivalent to ${\mathcal{F}}_h=Ø$. Strict convexity in the slack vector makes its minimum-norm vector unique, so a positive labeled component identifies a constraint relaxed in that witness; it is not claimed to be a unique irreducible cause. Finally, the command selector accepts only a solution of the hard QP (25). On invalidation, it selects the independently computed bounded backup action, while both diagnostic controls are discarded. If tightened admissibility itself fails, Equation (20) labels that geometric failure directly rather than misreporting it as input infeasibility.    □

The scope of these propositions is checked explicitly in the experiments. The zero-measurement-noise, $\parallel w_i\parallel \le 0.15$ m/s², 48 Hz acceleration-level trials satisfy the numerical translational, sampling, and delay bounds used by Propositions 1–2. The noisy Monte Carlo trials and PyBullet runs are empirical stress tests because no certified measurement-noise bound or vehicle-specific inner-loop residual bound is available for them. Diagnostic slacks occur only after rejection and are never part of the hypotheses of Proposition 1. Thus, a successful noisy or PyBullet trial is not used as proof of a proposition, and a disturbance amplitude above 0.15 m/s² is reported as outside the certificate domain.

2.6. Validation Protocol and Evaluation Metrics

Validation has seven complementary parts: deterministic hard-QP verification; a 60-seed external-baseline study; PyBullet Crazyflie evaluation; sample-rate, delay, disturbance, and sensor-noise sweeps; an outdoor-oriented gust simulation; mission-pressure and autonomous-escalation cases; and separate motion-capture flights. The gust study is a simulation, not an outdoor flight experiment, and the four hardware trajectories were recorded in separate indoor flight windows; neither validates simultaneous outdoor multi-UAV safety.

The randomized study varies crossing angles, start and goal radii, crossing-center geometry, initial position and velocity offsets, disturbance phase and amplitude, and position and velocity noise. Forty-four seeds contain a congested shared crossing, and 16 contain offset three-dimensional crossings. Every method receives the same realization. The controller runs at 48 Hz for a nominal 8 s horizon with $d_{\min }=0.30$ m, $R=0.12$ m, $\overline{w}=0.15$ m/s², $\overline{\tau }=0.020$ s, and componentwise acceleration limit 4.0 m/s². The initial-position standard deviation is 0.012 m; measurement-position and velocity standard deviations are 0.004 m and 0.010 m/s. At $\Delta =1/48$ s, the declared bounds give a worst-case tube inter-sample margin of 0.00635 m and a pairwise sample-and-delay margin of 0.08530 m. In barrier coordinates, the corresponding worst decreases are $R^2-{(R-{\mu }^t)}^2=0.00148$ m² and ${(d_{\min }+{\mu }^s)}^2-d_{\min }^2=0.05846$ m²; the tightened sample sets reserve exactly these losses before execution. With $\overline{e}=0.060$ m, (31) gives $d_{\mathrm{req}}=0.50530$ m.

Three methods are compared. The plain CBF-QP applies the same hard pairwise safety filter to the unrepaired path but has no certificate feedback, sample/delay tightening, or planner repair. The FaSTrack-style tracking-error-bound (TEB) comparator requires $d_{\mathrm{sched}}\ge d_{\min }+2\overline{e}=0.420$ m and uses the nominal tracker. It reproduces the planning principle relevant to this scenario, but it is not an implementation of FaSTrack’s Hamilton–Jacobi solver and is not labeled as such. The proposed method uses the automatic map (32) and (33), the 0.50530 m target, and the robust hard QP. This design isolates certificate feedback from the underlying pairwise CBF filter without misrepresenting an approximate comparator as the full published algorithm.

Logged outputs differ by validation level. The hard-QP pipeline exports state, tightened margin, command selection, diagnostic slack, rejection, repair trace, and summary records. PyBullet exports tracking, distance, rotor-speed, and event logs. The new study retains every trial, warning signal, threshold result, and escalation record in CSV/JSON form. PyBullet uses gym-pybullet-drones, the Crazyflie CF2X model, and DSLPIDControl at 240 Hz with 48 Hz control. Its older hand-selected candidates are retained only as a historical ablation; they are not outputs of the revised $\mathrm{RepairPath}$ and do not establish robustness. Formal acceptance uses (7)–(19).

For logged time index k, the main metrics are computed as follows, where K denotes the number of logged time samples in each case:

$$\begin{array}{cc}\hfill E_{\mathrm{mean}}& ={\displaystyle \frac{1}{NK}}{\displaystyle \sum _{i=1}^N}{\displaystyle \sum _{k=1}^K}\parallel p_i\left(k\right)-r_i\left(k\right)\parallel ,\hfill \\ \hfill E_{\max }& =\underset{i,k}{\max }\parallel p_i\left(k\right)-r_i\left(k\right)\parallel ,\hfill \\ \hfill N_{\mathrm{tube}}& =\sum _{i,k}\mathbf{1}\{\parallel p_i\left(k\right)-r_i\left(k\right)\parallel >R_i\},\hfill \\ \hfill d_{\min }^{\mathrm{obs}}& =\underset{i<j,k}{\min }\parallel p_i\left(k\right)-p_j\left(k\right)\parallel ,\hfill \\ \hfill N_{\mathrm{sep}}& =\sum _k\mathbf{1}\{\exists i<j:\parallel p_i\left(k\right)-p_j\left(k\right)\parallel <d_{\min }\}.\hfill \end{array}$$

(43)

For the randomized study, each scalar metric is first computed per trial; the manuscript then reports the mean and sample standard deviation across 60 seeds. Constraint results are reported as the fraction of trials with at least one violation, with Wilson 95% intervals, rather than as sample counts alone. For event calibration, let $I_k({ϵ}_{\delta },{\rho }_{\mathrm{warn}})$ indicate a diagnostic-slack or input-margin activation.

We retain the raw activation count for reproducibility but define one episode for each rising edge,

$$N_{\mathrm{ep}}={\displaystyle \sum _{k=1}^K}{I}_k(1-I_{k-1}),r_{\mathrm{ep}}={\displaystyle \frac{N_{\mathrm{ep}}}{NT}},I_0=0.$$

(44)

At the trial level, an episode is a prospective warning only if it precedes the first failure during ignored-warning execution. Precision, recall, and false-alarm rate are then computed from these trial labels. The sensitivity grid uses ${ϵ}_{\delta }\in \{0.001,0.05,0.20,0.50\}$ and ${\rho }_{\mathrm{warn}}\in \{0.80,0.90,0.95,0.98\}$. A record generated after hard rejection remains a post-failure explanation, not a predictor. Simulation conclusions apply only to the stated models, bounds, and crossings. Sensor-noise cases are empirical because the propositions contain no measurement-noise bound; hardware conclusions apply only to the separate indoor flights.

3. Simulation Validation

Simulation proceeds through deterministic hard-QP verification, randomized external-baseline trials with autonomous repair, PyBullet evaluation, robustness and diagnostic sweeps, outdoor-oriented gust cases, and mission-pressure tests.

3.1. Nominal CLF-CBF-QP Verification

The original 6 s certificate and the initial 6 s vertical repair do not satisfy the revised hard verifier. They are rejected at $1.104$ s and $1.146$ s, respectively, before either the physical $0.10$ m tube or $0.30$ m separation boundary is crossed. The two-stage diagnostic QP computes the minimum-norm tube and pairwise conflict witness, but its command is discarded. The revised repair increases the horizon to 8 s, uses the $0.12$ m tube, and adds the larger vertical clearance. It completes all 8 s with zero hard-QP rejection, zero backup steps, zero tube violations, and zero separation violations. Its maximum tracking error is $0.02780$ m, and its minimum pairwise distance is $0.42417$ m.

Figure 1 distinguishes preventive rejection from a realized violation. The original and initial repair stop after approximately one fifth of their horizons; neither is allowed to continue toward the crossing. Only the robust repair reaches the crossing and completes the mission. Thus, diagnostic feasibility is no longer confused with permission to execute.

Figure 1. Hard-QP verification of three path certificates. Red crosses indicate certificates rejected before completing the planned horizon; green circles indicate full-horizon acceptance. Panel (a) gives the verified fraction of each horizon. Panels (b,c) show the physical tube demand and separation observed only while the certificate remained active. Dashed lines mark the physical boundaries. The large early separation ratios in the rejected cases reflect conservative early termination, not full-path clearance.

3.2. External Baselines, Randomized Trials, and Autonomous Repair

Table 1 and Figure 2 summarize the 60-seed study. The plain CBF-QP violates both the tracking tube and physical separation in 44 trials (73.3%; Wilson 95% interval 61.0–82.9%). Its mean minimum separation remains slightly above 0.30 m because that average combines 44 small boundary crossings with 16 nonconflicting three-dimensional trials; the trial-level violation fraction is the relevant safety statistic. The TEB comparator and proposed method both complete all 60 trials with no observed tube or separation violation. For 0/60 observed violations, the Wilson 95% upper bound is 6.0%; the result is evidence for these sampled conditions, not a universal zero-failure claim. The proposed method and TEB comparator have nearly identical tracking error, while the proposed sample/delay-aware repair retains the larger mean minimum separation, 0.502 m versus 0.416 m. Thus, the evidence supports an advantage over a plain no-feedback CBF filter, but it does not support a claim that the proposed method outperforms the TEB comparator on observed violation rate.

Table 1. Sixty randomized crossing trials. Continuous metrics are trial mean ± sample standard deviation. Violation and completion entries are percentages of trials; the violation-count logs remain in the reproducibility package.

Method	Mean Error (m)	Max. Error (m)	Tube-Violation Trials (%)	Min. Distance (m)	Separation-Violation Trials (%)	Completed (%)
Plain CBF-QP, no feedback	$0.096\pm 0.053$	$0.393\pm 0.261$	73.3	$0.311\pm 0.039$	73.3	93.3
FaSTrack-style TEB	$0.020\pm 0.002$	$0.031\pm 0.005$	0.0	$0.416\pm 0.008$	0.0	100
Proposed certificate feedback	$0.020\pm 0.002$	$0.031\pm 0.005$	0.0	$0.502\pm 0.008$	0.0	100

Figure 2. External-baseline distributions and autonomous repair across 60 randomized seeds. Panels (a,b) give the empirical distributions of trial minimum separation and maximum tracking error, respectively. Panel (c) summarizes the 10th–90th percentile range and median scheduled minimum separation before and after autonomous repair. All two-dimensional panels are gridless.

Every four-UAV candidate converges autonomously in one repair iteration. The initial scheduled minima range from 0.001 to 0.383 m; the derived vertical-spacing and common-lift values then raise every planned minimum to at least 0.50530 m without changing task ownership. No fixed altitude increment is used. In the separate six-UAV escalation test, the certified altitude interval is 0.25–2.70 m, so centered levels allow at most 0.49 m spacing. The best local candidate reaches only 0.408 m, below the 0.50530 m target, and the implementation emits an allocator event for the six affected candidates. This test exercises the failure branch of (32) and the allocation update rather than merely describing it.

The diagnostic sweep also confirms why raw counts are unsuitable. At $({ϵ}_{\delta },{\rho }_{\mathrm{warn}})=(0.50,0.95)$, 5368 activated samples collapse to 56 episodes, or 0.0292 episodes per UAV-second. Trial-level precision and recall are both 0.977 and the false-alarm rate is 0.0625. Lowering ${ϵ}_{\delta }$ to 0.001 raises the false-alarm rate to 0.875. No input warning is activated for ${\rho }_{\mathrm{warn}}=0.80$–0.98 in these trajectories, so those four curves coincide. The selected operating point is dataset-calibrated and requires out-of-sample calibration before deployment.

Figure 3 shows that all 20-seed stress runs complete for injected disturbances up to 0.50 m/s², although values above 0.15 m/s² are outside the declared certificate. At 0.75 m/s², only 2 of 20 runs complete and 18 develop tube violations after rejection; no separation violation occurs. Position-noise standard deviations of 0–0.020 m complete all 20 runs at each level, whereas 0.040 m causes rejection and tube failure in all 20 continued stress runs. These transitions locate empirical limits; they do not extend Propositions 1–2 to unmodeled measurement noise or over-bound disturbances.

Figure 3. Robustness stress tests and prospective event calibration. Panels (a,b) show 20-seed disturbance and measurement-noise sweeps. The vertical line in panel (a) marks the declared 0.15 m/s² disturbance bound. Cases to its right and all nonzero measurement-noise cases are empirical stress tests outside the proposition hypotheses. Panel (c) reports precision, recall, and false-alarm rate for the event-threshold sweep. All two-dimensional panels are gridless.

3.3. PyBullet Quadrotor Validation

Using the open-source Crazyflie dynamics model and rotor-speed-level DSLPID control, the older PyBullet ablation tests three historical certificates. The original produces 353 tube-violation and 166 separation-violation steps, with mean error 0.329 m and minimum distance 0.049 m. The first vertical repair removes tube violations but retains 63 separation-violation steps and a 0.235 m minimum. The hand-selected enlarged candidate has mean error 0.038 m, maximum error 0.115 m, minimum separation 0.332 m, and no recorded violation in that deterministic run. These results explain why the old candidate was changed, but they are not an external benchmark and do not validate the automatic repair map.

Figure 4 and Figure 5 provide trajectory-level and constraint-level evidence for this historical ablation. The enlarged candidate removes the recorded PyBullet violations in this scenario, but the observation alone is not used to establish robustness; the guarantee remains conditional on the analytical bounds in Section 2.5.

Figure 4. PyBullet execution of the quadrotor-robust repair certificate. Panel (a) compares the executed trajectories (solid) with their references (dashed); circles and triangles mark the start and goal. Panel (b) shows all six pairwise distances and their pointwise minimum. The horizontal dashed line marks $d_{\min }=0.30$ m.

Figure 5. Normalized PyBullet constraint histories. The definitions of the normalized tube demand and separation margin match Figure 1. The vertical-repair certificate removes the tube violation but crosses the separation boundary. The quadrotor-robust repair remains feasible and generates no certificate events in the tested run.

3.4. Sample-Rate, Delay, and Disturbance Sweeps

The robust repair is tested with one factor varied at a time around the 48 Hz, 20 ms, and $0.15$ m/s² baseline. A run passes only if the hard QP remains executable for the complete 8 s and both physical constraints remain unviolated. As Figure 6 shows, the 24, 48, and 96 Hz cases complete the horizon, as do delay bounds of 0, 20, and 100 ms. Disturbance bounds of 0 and $0.15$ m/s² also complete the horizon. When the bound and injected disturbance are raised to $0.50$ m/s², the verifier rejects the certificate at $2.125$ s. The maximum tracking error before rejection is $0.0854$ m, the minimum separation is $0.6367$ m, and neither physical boundary has been crossed. Thus, an uncertainty level outside the executable envelope causes a safe rejection rather than execution of a relaxed command.

Figure 6. One-factor robustness sweeps. Green circles indicate completion of the full 8 s horizon; the red cross marks safe rejection at the annotated time. All nine cases have zero physical tube and separation violations. The dashed line denotes full-horizon verification.

3.5. Outdoor-Oriented Gust Simulation

Reviewer interest in outdoor operation cannot be answered by relabeling the retained indoor flights. We therefore add a reproducible outdoor-oriented simulation that exercises the certificate lifecycle under a finite-duration gust front while explicitly retaining the absence of outdoor hardware evidence. Both cases use the repaired 8 s certificate, a declared disturbance bound of $0.15$ m/s², the 48 Hz verifier, and the 20 ms delay bound. When the injected gust norm remains within $0.15$ m/s², the certificate completes all 8 s; its maximum tracking error is $0.03396$ m and minimum pairwise distance is $0.42630$ m. In the second case, the gust envelope is configured to rise toward $0.50$ m/s². The residual-bound monitor detects the first exceedance of the declared $0.15$ m/s² envelope and invalidates the active version at $1.750$ s. At invalidation, the maximum tracking error observed so far is $0.01229$ m and the minimum separation is $0.79612$ m; neither physical boundary has been crossed.

Figure 7 provides the missing operational answer to a disturbance: a bounded gust leaves the conditional certificate active, while an estimated bound exceedance invalidates it and transfers command authority to the backup controller. It does not establish aerodynamic robustness or outdoor hardware readiness; those claims require the measurements and simultaneous protocol specified in Section 4.

Figure 7. Outdoor-oriented gust simulation; this is not an outdoor hardware experiment. Panel (a) shows the injected gust magnitude and the declared $0.15$ m/s² disturbance bound. The green case remains inside the declared disturbance envelope and completes the certificate. In the red case, execution stops at the first monitored bound exceedance, so the configured gust does not continue toward its $0.50$ m/s² peak. Panels (b,c) show that the tube and separation boundaries remain unviolated at invalidation; panel (d) records the lifecycle transition, where the red cross marks certificate invalidation and the green circle marks full-horizon completion. All two-dimensional panels are gridless.

3.6. Scenario Pressure Tests

Pressure testing examines whether the verifier distinguishes three sources of mission stress: a shorter execution window, a more restrictive separation requirement, and a six-UAV crossing. These tests diagnose active constraints; they do not support a claim of universal robustness.

Figure 8 and Figure 9 show preventive rejection under three mission stresses. The $4.5$ s short-window case is rejected at $0.667$ s, the $6.0$ s higher-separation-threshold case at $1.188$ s, and the $7.0$ s six-UAV case at $3.229$ s. Their maximum pre-rejection tracking errors are $0.0155$, $0.0229$, and $0.0401$ m, respectively; their minimum pre-rejection separations are $1.3226$, $0.9744$, and $0.3850$ m. No physical state violation occurs because execution stops when the hard QP loses feasibility. The diagnostic slacks still distinguish the active tube and pairwise conflicts and therefore specify whether timing, path geometry, or deconfliction must be repaired.

Figure 8. Accepted portions of the pressure-test trajectories before hard-QP rejection. Panels (a–c) show the short-window, higher-separation-threshold, and six-UAV cases. Different colors distinguish different UAVs. Solid curves stop when the current certificate is rejected; dashed curves show the active reference up to the same time. Circles mark the initial states, and crosses mark the rejection states rather than the planned goals.

Figure 9. Pressure-test diagnostics before rejection. In panel (a), values above one would indicate a tube violation; in panel (b), values below one would indicate a separation violation. No physical boundary is crossed, and all plotted histories stop at rejection. Panel (c) reports the number of diagnostic conflict records generated at the rejection sample.

4. Separate-Flight Hardware Trackability Test

The available hardware records contain four non-overlapping flight windows. This section therefore evaluates only whether the indoor platform can track each repaired waypoint reference with bounded horizontal and altitude errors; it is not presented as simultaneous multi-UAV safety validation. A future outdoor simultaneous validation would require vehicles synchronized to a common clock, RTK/GNSS or equivalent common-frame positioning, wind or residual-bound measurements, time-stamped command and communication logs, repeated crossing and forced-rejection trials, and measured pairwise distances and backup responses. Those data are not available in the present study, so no simultaneous or outdoor hardware-safety claim is made.

Motion-Capture Reference Tracking

At a commanded altitude of $1.0$ m, we convert the repaired four-trajectory crossing certificate into planar waypoint references with seven waypoints per trajectory. An onboard position controller tracks these waypoints while the motion-capture system records position and yaw. Pairwise separation computed from the scheduled references is reported only as a planning-level quantity and is not a measured hardware distance.

Figure 10 shows the hardware configuration. Infrared cameras measure the UAV pose inside a protected flight area. A relay computer forwards the measurements to the host computer over the local network, and the host computer sends the repaired waypoint references to the FanciSwarm platform.

Figure 10. Indoor hardware platform. Infrared cameras measure the UAV pose; the motion-capture relay forwards the pose to the host computer; and the host sends waypoint references to the FanciSwarm UAV.

All four trajectories in Figure 11 remain inside the calibrated workspace. The mean horizontal path errors are $2.2$, $2.7$, $2.4$, and $2.3$ cm for UAVs 1–4, respectively. Small loops near several waypoints occur during waypoint convergence and low-level controller settling, but the errors remain within the execution tube. Because the flights were separate, the figure supports reference trackability rather than simultaneous hardware separation.

Figure 11. Separately recorded motion-capture trajectories for UAVs 1–4. Color distinguishes UAV identity: blue, orange, green, and magenta correspond to UAVs 1–4, respectively. Dashed curves show repaired references, solid curves show measured trajectories, and open circles mark certified waypoints. Squares and triangles identify the start and goal, and the polygon outlines the calibrated workspace.

Time histories in Figure 12 show that the agreement is not limited to the endpoints. Across 2171 samples, the mean horizontal path error is $2.37$ cm, the 95th percentile is $6.60$ cm, and the maximum is $8.99$ cm. All three statistics are below the 12 cm execution-tube radius. After the initial approach, the altitude converges to the $1.0$ m command; the mean absolute altitude error is $1.91$ cm, and its 95th percentile is $3.70$ cm. Smoothed speed histories remain bounded during waypoint-to-waypoint motion, while the pale curves show the noise introduced by finite differencing of motion-capture positions.

Figure 12. Time histories from the separate motion-capture flights. Panel (a) shows horizontal path error and the $0.12$ m tube boundary. Panel (b) shows altitude relative to the $1.0$ m command. Panel (c) shows smoothed finite-difference speed; pale curves show the unsmoothed estimates. Time starts at zero for each flight.

The schedule itself does not have enough margin to combine these errors into a simultaneous-safety claim. If each of two vehicles has horizontal error at most e, the reverse triangle inequality gives

$$\parallel p_i-p_j\parallel \ge \parallel r_i-r_j\parallel - 2e,$$

(45)

so a sufficient schedule condition is $d_{\mathrm{sched}}\ge d_{\min }+2e$. With the measured 95th-percentile error $e_{95}=0.066$ m, this requires $d_{\mathrm{sched}}\ge 0.432$ m. The retained schedule has only 0.304 m, a shortfall of 0.128 m. Its former 0.004 m nominal surplus is therefore not presented as a positive safety result, and the old schedule-statistics figure is removed. The time-series errors still support single-reference trackability within the 0.12 m tube, but not simultaneous pairwise safety.

The previously reported 8.84–9.99 cm waypoint-arrival cluster is also withdrawn as an independent validation metric. The retained package lacks the onboard waypoint-acceptance-radius setting and the raw configuration needed to distinguish controller acceptance from tracking accuracy. The time-series path-error statistics above do not depend on that interpretation and are retained.

5. Conclusions

This paper introduced a certificate-guided safe-tracking framework that treats each scheduled multi-UAV path as a finite-horizon execution contract. Rigid-body-derived disturbance bounds together with sampled-data and communication-delay margins define conditional validity; a hard-safety CLF-CBF-QP either executes the certificate or rejects it, after which a non-executable minimum-slack witness directs timing or vertical-spacing repair and escalates infeasible local cases. In 60 randomized crossings, the proposed method and a FaSTrack-style tracking-error-bound comparator completed all trials without observed tube or separation violations, whereas a plain CBF-QP without feedback violated both constraint classes in 44 trials, supporting the value of planner-facing diagnostic repair without claiming superiority to the full FaSTrack algorithm. Disturbance, noise, event-threshold, PyBullet, and pressure tests further characterized robustness and failure modes. The separate indoor flights demonstrated single-reference trackability but not simultaneous multi-UAV safety because the retained schedule did not dominate measured tracking error. The guarantees therefore remain conditional on certified disturbance, sampling, communication, reference, input, and state-estimation bounds, while noisy simulations and higher-fidelity dynamics remain empirical. Synchronized multi-UAV experiments with measured state-estimation bounds and end-to-end escalation latency are the principal next step.