PaperlayerView exact revision on arXiv

Source-linked AI summary

Sensor-Driven Mission Synthesis for UAV/UGV Swarms: A TB-CSPN Coordination Architecture with Hardware-Enforced Safety

Uwe M. Borghoff, Paolo Bottoni, Remo Pareschi

arXiv:2608.14306v1cs.AIeess.SY

TL;DR

Contested environments expose the fragility of purely digital swarm autonomy. This paper proposes a sensor-driven TB-CSPN architecture with governed coordination and hardware-enforced actuator safety, demonstrated through a coastal-surveillance case study.

  • Problem

    Purely digital autonomy is fragile in contested environments because software and networks remain part of the attack surface.

  • Method

    The architecture converts heterogeneous sensor observations into semantic tokens, synchronises them through TB-CSPN, and governs actuation with independent analogue safety envelopes.

  • Results

    The coastal-surveillance case study demonstrates gradual mission formation from uncertain asynchronous evidence while unsafe commands are prevented from reaching actuators.

  • Takeaways & Limitations

    Dependable autonomy in contested cyber-physical environments is best achieved by combining semantically governed coordination with independently enforced physical safety.

  • Takeaways & Limitations

    The architecture does not guarantee failure-free deployments, and quantitative validation of specific instantiations remains a separate empirical task.

Abstract

from arXiv · show

This paper presents a coordination architecture for heterogeneous UAV/UGV swarms that synthesises mission actions from uncertain, multi-modal sensor evidence while preserving hardware-enforced safety at the actuation boundary. The approach combines radar, RF, acoustic, and visual observations with Topic-Based Communication Space Petri Net (TB-CSPN) orchestration to support incremental mission formation under partial and evolving information. Consultant agents transform sensor outputs into temporally bounded semantic tokens, while supervisor agents provide authorisation and policy-governed release of mission transitions. This separation between interpretation, coordination, and execution yields auditable decision paths, constrains non-determinism within the coordination layer through guards and synchronisation, and enables bounded-time integration of heterogeneous evidence. To improve resilience in contested environments, including cyber compromise, spoofing, jamming, and communication loss, the digital coordination layer is complemented by independent analogue safety envelopes that clamp or veto unsafe actuator commands issued to individual vehicles. A coastal-surveillance case study illustrates how the proposed architecture enables dependable, governed, and physically safe swarm coordination under operational uncertainty.

1 INTRODUCTION

Guarded Swarms combines software-based, semantically informed coordination with independent analogue safety enforcement at the actuator boundary. The architecture addresses contested environments by separating sensor interpretation and mission coordination from hardware mechanisms that prevent unsafe commands despite software, communication, or adversarial failures.

  • Architecture: Guarded Swarms uses a two-layer assurance model: digital coordination forms mission plans, while analogue enforcement prevents unsafe commands from reaching actuators.The analogue layer operates despite software faults, adversarial interference, and communication failures.
  • Coordination: TB-CSPN separates semantic interpretation from coordination execution, bounding admissible coordination paths through token availability, guards, and temporal constraints.LLMs or specialised AI modules extract topics and intents, while Petri-net coordination logic provides formally analysable execution with constrained non-determinism.
  • Motivation: The architecture targets contested environments where jamming, spoofing, cyber compromise, and communications denial make purely digital autonomy vulnerable.Critical guardrails are shifted into hardware that operates independently of digital computation and communications.
  • Actuation safety: Analogue safety boards validate, clamp, veto, or override low-level motor commands before they reach electronic speed controllers.Once admitted through the safety envelope, execution is deterministic; unsafe commands cannot propagate even when the software stack is degraded or maliciously influenced.
  • Paper scope: The present paper develops the architecture’s upper boundary by addressing multi-modal sensor-evidence acquisition, interpretation, and coordination.It complements prior work focused on the lower boundary between digital coordination and analogue safety at actuation.

2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY

UAV/UGV swarms must coordinate under incomplete, heterogeneous, evolving, and sometimes contradictory sensor evidence, balancing timely action against the risks of premature commitment. The proposed architecture maintains structured operational state and incrementally derives safe, authorised mission actions through semantic coordination and separated, auditable processing layers.

  • 2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY: Multi-modal signals from radar, RF, acoustic, and visual sensors differ in latency, reliability, and ambiguity.These differing profiles complicate evidence integration in operational settings.
  • 2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY: Decisions under tight time constraints must handle partial or contradictory evidence without either premature commitment or excessive hesitation.Premature commitment can produce incorrect mission responses, whereas delay can prevent timely action.
  • 2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY: The operational state preserves competing interpretations, exposes signal compatibility and tension, supports incremental refinement, and enables safe, authorised actions under bounded uncertainty.The goal is structured operational state rather than a single best explanation.
  • 2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY: Heterogeneous detections become semantic tokens synchronised in a TB-CSPN coordination space, allowing mission decisions to emerge as evidence accumulates and authorisation constraints are satisfied.This replaces reliance on a monolithic planner with structured coordination semantics.
  • 2 MOTIVATION: SENSOR-DRIVEN COORDINATION UNDER UNCERTAINTY: Separating signal interpretation, coordination logic, and actuation enforcement supports auditable, time-bounded, dependable operation when evidence remains incomplete or evolving.The separation preserves boundedness and auditability across sensing, decision-making, and actuation.

3 MAIN CONTRIBUTIONS

The paper makes four contributions: TB-CSPN-based sensor-driven mission synthesis, temporally coherent multi-source fusion, governed mission formation, and guarded UAV/UGV swarm autonomy. Its layered architecture separates interpretation, coordination, authorisation, and deterministic execution while independent analogue safety envelopes protect the actuation boundary.

  • C1: Sensor-driven mission synthesis through TB-CSPN coordination: The paper contributes TB-CSPN coordination that bounds admissible mission evolutions through token availability, guards, and temporal constraints.The coordination semantics support structurally bounded alternatives and operationally indifferent choices.
  • C2: Temporal coherence as a coordination contract for sensor fusion: Temporal coordination contracts align asynchronous radar, RF, acoustic, and electro-optical evidence using token time-to-live, provenance, and bounded synchronisation windows.Mission transitions fire only when participating tokens form a temporally consistent evidence set rather than reflecting message arrival order.
  • C3: Structured governance of mission formation: Supervisor agents provide formal authorisation for mission formation by enforcing rules of engagement, mission constraints, and resource availability.Authorisation tokens are required before mission execution, making governance an explicit coordination mechanism.
  • C4: Application to multi-modal sensing and guarded swarm autonomy: A representative radar, RF, and acoustic case study demonstrates incremental signal interpretation leading to mission formation under hardware-level actuation safety.The application targets heterogeneous UAV/UGV swarm responses while remaining consistent with the Guarded Swarms principle.
  • Architecture: The layered architecture separates sensor interpretation, TB-CSPN coordination, supervisory governance, and deterministic vehicle execution.Worker agents translate mission tokens into vehicle-specific instructions but are barred from mission-level reasoning, while analogue envelopes independently clamp or veto unsafe commands.
  • Operational resilience: The design remains effective under asynchronous sensing, partial communication, and stringent security requirements.Typed, timestamped tokens and governed action release support coordination as evidence evolves under operational uncertainty.

4 RELATED WORK

Prior work progressed from blockchain-backed monitoring and trusted coordination toward distributed TB–CSPN orchestration with independent analogue safety enforcement. Related UAV research addresses autonomy, trust, networking, and cyber-defence, but does not jointly integrate formal mission coordination, explicit human authorisation, and hardware-enforced actuation safety under adversarial conditions.

  • Foundations: Earlier work combined digital orchestration with hardware-level safety enforcement, while blockchain-backed monitoring exposed centralised bottlenecks and single-point vulnerabilities.These limitations motivated a shift toward distributed architectures.
  • TB–CSPN coordination: TB–CSPN separates semantic reasoning from coordination logic and constrains non-determinism through coloured Petri nets, supporting autonomous and human-supervised operation.The architecture was developed through broader formulations of distributed coordination using communication spaces, multi-agent systems, and Centaurian systems.
  • Scalability: TB–CSPN provides sublinear coordination overhead through hierarchical token routing and localised concurrency windows, reducing communication load as swarm size increases.These scalability characteristics carry into Guarded Swarms, where digital coordination remains lightweight and analogue enforcement adds only constant overhead.
  • Guarded Swarms: Guarded Swarms combines scalable token-based digital planning with independent analogue circuits that validate or veto motor commands, preserving deterministic physical actuation under cyber compromise or communication loss.The separation supports flexible orchestration while maintaining fast, safety-oriented enforcement at the physical layer.
  • Broader related systems: Related systems span software-defined strike UAVs, centrally directed swarms, autonomous onboard constraints, DRL coordination, trust-based spoofing detection, and UAV cyber-defence and networking.Examples include Helsing’s HX-2, DARPA OFFSET, UK LANCA, DRL-based trajectory generation, SoCoMNNet, and survey taxonomies of UAV attacks and countermeasures.
  • Research gap: Existing cyber-defence and networking work does not jointly integrate formal mission-level coordination, explicit human authorisation, and hardware-enforced actuation safety under adversarial conditions.This gap distinguishes the paper’s combined coordination and physical-safety focus from the surveyed prior work.

5 CASE STUDY

The coastal-surveillance case study demonstrates incremental threat assessment and mission formation from asynchronous, heterogeneous sensor evidence in a UAV/UGV swarm. TB-CSPN guards, authorisation, and coordination-to-execution separation prevent mission release when evidence is stale, conflicting, or unauthorised.

  • Scenario and swarm: The case study uses two UAVs for aerial interception and one shoreline UGV for observation and potential target recovery in a coastal surveillance scenario.The environment includes mixed civilian and operational traffic, intermittent communications, and heterogeneous sensor signals.
  • Sensor evidence: Radar, RF, acoustic, and EO observations arrive asynchronously as partial evidence and are propagated into the coordination architecture as tokens.Observation structures include identity, signal, time, source, confidence, and time-to-live fields.
  • Incremental mission formation: Consultant agents progressively refine semantic tokens, while guarded TB-CSPN transitions combine temporally valid interpretations into CandidateTarget, ConfirmedThreat, and mission tokens.The example combines altitude, telemetry, and EO interpretations when they arrive within the relevant time window and satisfy guard conditions.
  • Mission execution: An authorised InterceptMission is consumed by worker agents, which translate UAVTask and UGVTask directives into vehicle-specific commands while executors perform only platform-level control.This preserves separation between mission interpretation and planning in the coordination layer and deterministic physical execution on platforms.
  • Non-release cases: Stale confirmation prevents threat formation: when EO evidence misses the temporal window, Transition 5⃝ does not fire and no ConfirmedThreat token is generated.The radar and RF tokens may have expired or been consumed before the EO token arrives.
  • Non-release cases: Conflicting interpretations remain visible and unconsumed because Transition 3⃝ requires concordant evidence, while absent supervisor authorisation prevents Transition 6⃝ and mission dispatch.A supervisor may withhold authorisation because rules of engagement prohibit interception or the threat assessment is insufficient.

6 PROTOCOL INTEGRATION IN PRACTICE

The architecture is implemented as layered protocol integration rather than a single end-to-end chain, translating heterogeneous sensor data into TB-CSPN coordination abstractions and executor-specific commands. Protocol choices may vary by deployment while preserving these translation steps and the separation between protocol handling, coordination, and actuation.

  • Protocol-stack assumptions: Layered protocol stacks translate data into and out of TB-CSPN layers, while operational deployments may use proprietary or vendor-specific alternatives.The discussion is abstract and illustrative rather than prescribing one uniform protocol stack.
  • Sensor integration: Radar commonly exports detections or tracks through ASTERIX, while IP-based electro-optical systems commonly use ONVIF Profile S interfaces.These examples apply at the multi-modal sensor observation boundary.
  • Middleware integration: ROS 2 with DDS-style message exchange provides a plausible middleware for transporting heterogeneous observations while separating protocol handling from TB-CSPN coordination logic.In PX4 configurations, XRCE-DDS exposes PX4 UORB messages as ROS 2 messages and types.
  • Semantic and actuation boundaries: The coordination node performs protocol convergence and semantic lifting, transforming sensor-specific data into internal topics, TB-CSPN tokens, and executor-specific UAV or UGV command messages.Aerial actuation may use MAVLINK, while PX4 vehicles may translate through direct MAVLINK channels or the UXRCE-DDS bridge.

7 DISCUSSION

The discussion frames TB-CSPN coordination, structural human authorisation, and hardware-enforced safety as deliberate architectural trade-offs. It distinguishes architectural properties from guarantees about any particular deployment, where failures may still arise but can be localised, detected, and reasoned about.

  • The role of formal coordination in agentic AI: TB-CSPN coordination is presented as a deliberate alternative to direct LLM-mediated agent interaction, including LangGraph, AutoGen, and ReAct-style loops.The paper acknowledges direct agent interaction’s flexibility for rapid prototyping or open-ended task execution while arguing it is unsuited to the present setting.
  • The locus of human authority: Human authorisation is treated as a token within the coordination layer rather than an external veto over an otherwise autonomous loop.This makes authority structural: missions require the appropriate token, and absent authorisation is recorded in the coordination space.
  • The boundaries of architectural reasoning: The claimed properties—bounded non-determinism, temporal coherence of evidence, structural governance, and hardware-enforced actuation safety—belong to the architecture, not a particular instantiation.The architecture offers a structure for localising, detecting, and reasoning about failures rather than guaranteeing that implementation flaws, sensor calibration errors, or supervisor misjudgement will not occur.

8 CONCLUSION

The paper presents an architectural pattern for governing uncertain, asynchronous, multimodal sensor evidence into mission actions while preserving hardware-enforced safety. Its coastal-surveillance case study demonstrates gradual mission formation, while the authors identify empirical validation and formal analysis as future work.

  • Conclusion: The architecture separates sensor interpretation, coordination, and execution, with mission actions governed by formal constraints and hardware-enforced safety.The contribution is explicitly architectural rather than a quantitative sensor-fusion or large-scale hardware-in-the-loop validation programme.
  • Conclusion: The coastal-surveillance case study shows gradual mission shaping from uncertain, asynchronous evidence through CandidateTarget, ConfirmedThreat, and InterceptMission states.TB-CSPN provides an auditable semantic backbone linking sensing, governance, and execution.
  • Conclusion: The study does not provide quantitative benchmarking, formal proof extensions, or large-scale hardware-in-the-loop validation, and its communication mechanisms remain illustrative.Real deployments may use different protocol families across vendors and mission environments.
  • Conclusion: Future work will evaluate degraded communication and adversarial interference, conduct hardware-in-the-loop experiments with UAV/UGV platforms and analogue safety boards, and deepen formal analysis.Planned analysis includes token lifetimes, coordination invariants, and mission-level correctness conditions.
  • Conclusion: The paper’s central insight is that dependable autonomy in contested cyber-physical environments combines semantically governed coordination with independently enforced physical safety.This combination is presented as the basis for strengthening the empirical and formal foundation of Guarded Swarms.
Loading 2608.14306v1…