The interest in the maneuverability of drone formations has increased significantly in recent years. The primary driver is the capability of coordinated drone formations to reduce operational costs and effectively replace existing technologies across numerous military and civilian applications. These include, but are not limited to, Synthetic Aperture Radar (SAR) interferometry, surveillance, damage assessment, reconnaissance, monitoring of chemical or biological agents, exploration, vegetation growth analysis, and terrain change assessment. Among these, distributed sensing applications are particularly compelling. The advancement of control system design techniques for large, tight drone formations is thus recognized as playing a crucial role in enabling such sophisticated applications.
Drone formation flight can be viewed as a complex control problem: computing control inputs to pilot multiple vehicles through challenging maneuvers while maintaining desired relative positions and a guaranteed safe distance between each agent. Optimal control has emerged as one of the most successful frameworks for formulating and solving this problem. Various centralized optimal and suboptimal methods have been explored. However, as the number of drones in the formation grows, solving the resulting large-scale, centralized, and often non-convex optimization problem becomes computationally intractable, even with state-of-the-art solvers or simplified linear vehicle dynamics.
To overcome this fundamental limitation, we propose a decentralized optimal control framework. The core of this framework is a Decentralized Receding Horizon Control (DRHC) scheme. Its principle is to decompose the large, centralized RHC problem into smaller, local RHC controllers. Each local controller is associated with a single drone and computes its control inputs based only on its own state and the states of its neighboring drones within a communication or sensing network. In other words, each drone plans its trajectory by predicting the behavior of its neighbors. We utilize graph-theoretic terminology to describe this information exchange topology and the inter-vehicle constraints. The proposed framework for managing a drone formation offers several key advantages:
- Diverse operational objectives, such as formation keeping, formation acquisition, and coordinated flight, can be achieved by appropriately modifying the cost function.
- Individual drones predict the behavior of their neighbors to avoid collisions, enabling cooperative rather than adversarial flight.
- The framework can handle constrained Multi-Input Multi-Output (MIMO) linear models as well as constrained piecewise-linear models of drone dynamics.
- The local optimization problem can be formulated and solved as a small Mixed-Integer Linear Program (MILP), which can subsequently be converted into an equivalent explicit control law for rapid online execution.
Previous implementations of this approach suffered from two main issues: reliance on a time-invariant communication graph, and a lack of robust, guaranteed collision avoidance based on the predictability of neighboring trajectories. Subsequent work introduced a hierarchical design procedure to address feasibility. In this article, we present a modified approach that enhances the framework with the following critical capabilities: (1) handling time-varying interconnection topologies, (2) guaranteeing collision avoidance through the use of an emergency controller and its associated invariant set as a protected zone, activated when local RHC problems become infeasible, and (3) incorporating coordination rules (e.g., “right-of-way”) formulated as binary decision variables within the local controllers. This enhanced framework represents a significant step towards a systematic design procedure for real-time, decentralized, and provably collision-free drone formation flight.
1. Mathematical Model for Drone Control
The drone dynamics model used in this work reflects the simplified outer-loop dynamics of an Organic Aircraft (OAV), a hover-capable ducted fan UAV. While the full OAV dynamics are highly nonlinear, an inner-loop dynamic inversion controller stabilizes the system. The resulting outer-loop behavior can be approximated by a MIMO linear system where the control inputs are accelerations along the x, y, and z axes, and the states are positions and velocities along these axes. We describe the OAV dynamics with the following linear discrete-time model:
$$
\mathbf{x}_{k+1} = f(\mathbf{x}_k, \mathbf{u}_k)
$$
where the state-update function \( f: \mathbb{R}^6 \times \mathbb{R}^3 \rightarrow \mathbb{R}^6 \) is linear in its arguments. Here, \( \mathbf{x}_k \in \mathbb{R}^6 \) and \( \mathbf{u}_k \in \mathbb{R}^3 \) are the vehicle’s state and input vectors at time step \( k \). Specifically,
$$
\mathbf{x}_k = \begin{bmatrix} \mathbf{x}_{k,pos} \\ \mathbf{x}_{k,vel} \end{bmatrix}, \quad \mathbf{u}_k = \begin{bmatrix} a_{x} \\ a_{y} \\ a_{z} \end{bmatrix}
$$
where \( \mathbf{x}_{k,pos} \in \mathbb{R}^3 \) is the vector of x, y, z coordinates and \( \mathbf{x}_{k,vel} \in \mathbb{R}^3 \) is the vector of velocity components. It is important to emphasize that the proposed method is compatible with higher-order, more complex linear or piecewise-linear models that describe drone dynamics with higher fidelity. We consider two types of constraints: “nominal” constraints for standard operation and “emergency” constraints that define the vehicle’s maximum performance envelope, used only during collision avoidance maneuvers.
The nominal constraints, which are stricter than the physical limits, are defined for velocity and acceleration:
$$
\begin{aligned}
\mathbf{x}_{k,vel} & \in \mathcal{X}_{vel} = \{ \mathbf{z} \in \mathbb{R}^3 : -\beta \mathbf{v}_{max} \leq z_i \leq \beta \mathbf{v}_{max}, i=1,2,3 \} \\
\mathbf{u}_k & \in \mathcal{U} = \{ \mathbf{z} \in \mathbb{R}^3 : -\alpha \mathbf{a}_{max} \leq z_i \leq \alpha \mathbf{a}_{max}, i=1,2,3 \}
\end{aligned}
$$
where \( 0 < \alpha, \beta < 1 \) are positive constants to limit vehicle usage during normal operation, and \( \mathbf{v}_{max}, \mathbf{a}_{max} \) are the physical limits (e.g., \( \mathbf{v}_{max} = [10, 10, 10]^T \) ft/s, \( \mathbf{a}_{max} = [3, 3, 3]^T \) ft/s²).
The emergency constraints, which allow use of the full vehicle capability, are:
$$
\begin{aligned}
\mathbf{x}_{k,vel} & \in \mathcal{X}_{vel}^{ER} = \{ \mathbf{z} \in \mathbb{R}^3 : -\mathbf{v}_{max} \leq z_i \leq \mathbf{v}_{max}, i=1,2,3 \} \\
\mathbf{u}_k & \in \mathcal{U}^{ER} = \{ \mathbf{z} \in \mathbb{R}^3 : -\mathbf{a}_{max} \leq z_i \leq \mathbf{a}_{max}, i=1,2,3 \}
\end{aligned}
$$
The relationship between these parameter sets is summarized in the following table:
| Constraint Type | Velocity Set | Acceleration Set | Description |
|---|---|---|---|
| Nominal | \(\mathcal{X}_{vel} = \beta \mathcal{X}_{vel}^{ER}\) | \(\mathcal{U} = \alpha \mathcal{U}^{ER}\) | Restrictive for safe planning. |
| Emergency | \(\mathcal{X}_{vel}^{ER}\) | \(\mathcal{U}^{ER}\) | Full physical capability. |
2. Emergency Maneuvers and the Invariant Set Concept
This section details the core principle guaranteeing safety in our drone formation control strategy. Consider a single drone governed by dynamics (1). We design an emergency state-feedback controller:
$$
\mathbf{u}_k = g(\mathbf{x}_k, \mathbf{r}_e)
$$
This controller is tasked with stabilizing the drone to a chosen reference state \( \mathbf{r}_e \) (e.g., coming to a complete stop at its current position) while respecting the emergency constraints (3). Let \( t_e \) denote the instant the emergency maneuver is initiated. The closed-loop drone dynamics under emergency control are:
$$
\mathbf{x}_{k+1} = f_{cl}^{ER}(\mathbf{x}_k) = f(\mathbf{x}_k, g(\mathbf{x}_k, \mathbf{r}_e)) \quad \text{for} \quad k \geq t_e
$$
To ensure collision avoidance, we define an emergency region \( \mathcal{ER}_{pos} \subset \mathbb{R}^3 \) centered at the drone’s position \( \mathbf{x}_{t_e, pos} \) at the start of the maneuver. This region is a polyhedron in position space (x,y,z) that must contain the drone for all future time during the emergency maneuver. We guarantee this property by computing a set \( \Omega \) in the full state-space (position and velocity) that is a positively invariant set for the closed-loop emergency system (5). This means:
$$
\text{If } \mathbf{x}_{t_e} \in \Omega, \text{ then } \mathbf{x}_{k} \in \Omega \subseteq \mathcal{X}_{vel}^{ER} \times \mathcal{ER}_{pos} \quad \text{for all} \quad k \ge t_e
$$
and the control input satisfies \( g(\mathbf{x}_k, \mathbf{r}_e) \in \mathcal{U}^{ER} \). In simpler terms, if the drone starts the emergency maneuver from a state inside \( \Omega \), its subsequent trajectory will forever remain within \( \Omega \), respecting all emergency velocity/acceleration limits and staying inside the spatial emergency region \( \mathcal{ER}_{pos} \). If the emergency controller \( g(\mathbf{x}) \) is a linear state feedback, the invariant set \( \Omega \) can be computed efficiently using polyhedral operations. The emergency region in position space is then the projection of \( \Omega \) onto the position coordinates: \( \mathcal{ER}_{pos} = \text{Proj}_{pos}(\Omega) \).
The key for safe drone formation flight is to enforce, during normal decentralized RHC planning, that each drone remains in a state from which a safe emergency stop is possible. This is achieved by adding the following constraint to each drone’s nominal planning problem:
$$
\mathbf{x}_{k} \in \bar{\Omega} \quad \text{where} \quad \bar{\Omega} = \{ \mathbf{x} : (\mathbf{x}_{pos} – \mathbf{p}_0, \mathbf{x}_{vel}) \in \Omega \}
$$
Here, \( \mathbf{p}_0 \) is the drone’s current position. The set \( \bar{\Omega} \) is simply a translation of \( \Omega \). This constraint limits the drone’s velocity and position such that it can always execute a feasible, collision-free emergency maneuver. The size of \( \Omega \) (and thus \( \bar{\Omega} \)) is a function of \( \alpha, \beta, \mathbf{v}_{max}, \mathbf{a}_{max} \). There is a direct trade-off: stricter nominal constraints (smaller \( \alpha, \beta \)) result in a smaller \( \Omega \), forcing drones to fly slower to maintain the safety guarantee. Once \( \Omega \) is computed, we design the decentralized RHC controllers to enforce: (i) the nominal constraints and the invariant set constraint \( \mathbf{x}_{k} \in \bar{\Omega} \), (ii) the use of a protected zone larger than \( \mathcal{ER}_{pos} \) for inter-drone spacing, and (iii) an automatic switch to the emergency controller if the local optimization problem becomes infeasible.
3. Decentralized Receding Horizon Control Formulation
Consider a formation of \( N \) drones. Each drone \( i \) solves a local RHC problem at time step \( t \) based on its current state \( \mathbf{x}^i_t \) and the assumed or communicated predicted states of its neighbors \( j \in \mathcal{N}_i(t) \), where \( \mathcal{N}_i(t) \) defines the time-varying neighbor set. The core optimization problem \( P_i \) for drone \( i \) over a prediction horizon \( H \) is:
Minimize a local cost function \( J_i \), typically a quadratic function tracking a formation reference and penalizing control effort:
$$
J_i = \sum_{k=t}^{t+H-1} \left( \| \mathbf{x}^i_{k|t} – \mathbf{x}^{i,ref}_{k|t} \|^2_Q + \| \mathbf{u}^i_{k|t} \|^2_R \right) + \| \mathbf{x}^i_{t+H|t} – \mathbf{x}^{i,ref}_{t+H|t} \|^2_P
$$
Subject to:
- Drone dynamics: \( \mathbf{x}^i_{k+1|t} = f(\mathbf{x}^i_{k|t}, \mathbf{u}^i_{k|t}) \), for \( k = t, \dots, t+H-1 \).
- Nominal and invariant set constraints:
$$ \mathbf{u}^i_{k|t} \in \mathcal{U}, \quad \mathbf{x}^i_{k,vel|t} \in \mathcal{X}_{vel}, \quad \mathbf{x}^i_{k|t} \in \bar{\Omega}^i_k $$
where \( \bar{\Omega}^i_k \) is the translated invariant set centered at the drone’s position at step \( k \). - Collision avoidance constraints with each neighbor \( j \):
$$ \text{dist}(\mathbf{x}^i_{k,pos|t}, \mathbf{x}^{j,pred}_{k,pos|t}) \geq d_{safe} $$
Here, \( \mathbf{x}^{j,pred}_{k,pos|t} \) is the predicted position of neighbor \( j \) communicated to drone \( i \), and \( d_{safe} \) is the radius of the spherical protected zone. For polyhedral protected zones, this constraint becomes a set of linear inequalities.
Only the first control input \( \mathbf{u}^i_{t|t} \) from the solution is applied to drone \( i \). The process repeats at the next time step with updated states and predictions, enabling feedback. The decentralized nature of this drone formation control scheme is summarized below:
| Aspect | Centralized RHC | Decentralized RHC (Proposed) |
|---|---|---|
| Problem Size | Grows with \( N \cdot H \) | Fixed, small size per drone |
| Communication | Global state to central node | Local state to neighbors only |
| Computation | Single, large optimization | \( N \) parallel, small optimizations |
| Scalability | Poor for large \( N \) | Excellent for large \( N \) |
| Robustness | Single point of failure | Inherently robust to single failures |
4. Handling Practical Implementation Issues
To ensure reliable operation of the drone formation, several practical enhancements to the base DRHC formulation are necessary.
4.1 Soft Constraints and Coordination Rules: Strict collision avoidance constraints can lead to infeasibility due to small prediction errors between neighbors. We introduce slack variables \( \epsilon^{i,j}_k \) to soften the constraints:
$$
\text{dist}(\mathbf{x}^i_{k,pos|t}, \mathbf{x}^{j,pred}_{k,pos|t}) \geq d_{safe} – \epsilon^{i,j}_k, \quad \epsilon^{i,j}_k \geq 0
$$
and penalize their use heavily in the cost function: \( J_i += \rho \sum \epsilon^{i,j}_k \). This allows temporary, penalized violations to maintain feasibility. Furthermore, coordination rules like “right-of-way” can be encoded using binary decision variables within the MILP framework. For example, a priority rule determining which drone should maneuver first can be formulated, leading to more predictable and cooperative behavior within the drone formation.
4.2 Protected Zone vs. Emergency Region: A critical practical point is that the invariant set \( \Omega \) guarantees the drone will stay within \( \mathcal{ER}_{pos} \) during an emergency stop. However, to guarantee that two drones never collide, the protected zone \( d_{safe} \) used in the RHC constraints must be larger than the spatial footprint of \( \mathcal{ER}_{pos} \). If drones are allowed to plan trajectories that bring their emergency regions \( \mathcal{ER}_{pos}^i \) and \( \mathcal{ER}_{pos}^j \) into contact, a collision is still possible if both initiate emergency stops simultaneously. Therefore, we require:
$$
d_{safe} > \text{diameter}( \mathcal{ER}_{pos} )
$$
This creates a buffer zone between the regions where emergency maneuvers are physically contained.
4.3 Conservatism and Parameter Tuning: The conservatism of the overall drone formation control scheme is governed by the parameters \( \alpha, \beta, \) and \( d_{safe} \). Tighter nominal constraints (small \( \alpha, \beta \)) and a larger \( d_{safe} \) increase safety margins but reduce formation agility and compactness. A practical strategy is to use adaptive parameters: during stable cruising, constraints can be relaxed (\( \alpha, \beta \rightarrow 1 \)) for performance, while during close-proximity maneuvers or formation reconfiguration, stricter parameters are enforced to ensure robust collision avoidance.
4.4 Real-Time Execution via Explicit Control Laws: Solving a MILP online on each drone’s flight computer may be prohibitive. A powerful solution is to compute the explicit Piecewise Affine (PWA) state-feedback law equivalent to the DRHC controller offline. The optimization problem \( P_i \) is solved parametrically for all feasible states \( \mathbf{x}^i_t \) and neighbor predictions. The result is a lookup table that partitions the state space into regions, each associated with a simple affine control law: \( \mathbf{u}^i = K_r \mathbf{x}^i + c_r \). This explicit law offers:
- Guaranteed worst-case computation time (simple region search).
- Certifiable real-time execution on embedded hardware.
- Elimination of online optimization software dependencies.
5. Conclusion
This article has presented a comprehensive decentralized optimal control framework for safe and scalable drone formation flight. The approach synergistically combines a Decentralized Receding Horizon Control (DRHC) scheme for cooperative trajectory planning with a formally verified emergency controller and its associated invariant set for guaranteed collision avoidance. The DRHC enables scalable, cooperative behavior by allowing each drone to plan based on local information, while the invariant set constraint ensures each drone always remains in a “recoverable” state. Practical implementation aspects, including soft constraints for robustness, coordination rules, the design of protected zones, and the use of explicit control laws for real-time execution, were addressed to bridge the gap between theory and application.
The proposed methodology provides a systematic pathway towards deploying large-scale drone formations for complex tasks. By ensuring collision avoidance through a layered approach—optimal cooperative planning backed by a certified safety maneuver—this framework enhances the reliability and autonomy of multi-drone systems. Future work involves extensive flight testing, extending the framework to handle more complex dynamic models and external disturbances, and investigating distributed learning techniques to optimize the coordination policies within the formation. The continuous evolution of these techniques is essential for unlocking the full potential of autonomous drone formations in the national airspace.