Passive Fault Tolerance through Tension-to-Thrust Feed-Forward: Hybrid Input-to-State Stability for Decentralized Multi-UAV Slung-Load Transport under Abrupt Cable Severance

Technical Summary: Passive Fault Tolerance through Tension-to-Thrust Feed-Forward

Problem Statement
The paper addresses the challenge of abrupt cable severance in cooperative aerial transport, where multiple Unmanned Aerial Vehicles (UAVs) carry a shared payload via flexible cables. In such scenarios, a cable failure instantaneously alters the system's constraint topology and redistributes the load among remaining cables. This event occurs on a timescale (seconds) that is often shorter than the latency required for traditional fault diagnosis, classification, and controller reconfiguration. Existing approaches typically rely on centralized coordination, peer-state exchange, or fixed cable topologies, lacking a certified decentralized recovery mechanism for unannounced severance events. The core problem is to design a decentralized controller that maintains stability and tracking performance using only local information, without requiring explicit fault flags or inter-agent communication.

Methodology
The authors propose a passive control architecture where each UAV maps its measured local cable tension directly into its altitude thrust command as a feed-forward term ($T_{ff}^i = T_i$). This identity allows the controller to react to load redistribution immediately upon severance, as the local tension measurement changes instantaneously.

The control structure for each drone consists of a three-layer cascade:

1. Outer Loop: A Proportional-Derivative (PD) controller with an anti-swing slot shift that dampens payload pendulum motion passively.
2. Middle Layer: A single-step convex Quadratic Program (QP) that projects the target acceleration onto the feasible tilt-and-thrust envelope, incorporating the tension feed-forward term into the vertical bounds.
3. Inner Loop: An attitude PD controller tracking the desired Euler angles.

The system is modeled as a hybrid system with continuous-time dynamics and discrete structural transitions (cable severance). The analysis relies on a reduced-order model where distributed Kelvin-Voigt cable dynamics are approximated by a lumped scalar tension model, valid under bounded slack-excursion and dwell-time assumptions. The stability proof utilizes a conditional hybrid practical Input-to-State Stability (ISS) framework, combining bounded Lyapunov jumps at fault events with exponential decay between faults.

Key Contributions
The paper presents three primary contributions:

1. Local Tension-to-Thrust Feed-Forward: The introduction of the term $T_{ff}^i = T_i$ as a mechanism for cable-severance tolerance. This term maps post-severance tension redistribution into immediate thrust correction using only local measurements, eliminating the need for a fault detection or reconfiguration timeline.
2. Hybrid Practical ISS Certificate: A theoretical proof establishing that the decentralized closed-loop system is hybrid practical ISS under specific actuator, slack-excursion, and dwell-time assumptions. The proof yields an explicit recovery envelope characterized by exponential decay and a per-fault-cycle contraction factor $\rho \in (0, 1)$.
3. High-Fidelity Validation: Extensive simulation results using the Drake multibody simulator with five UAVs, a 10 kg payload, and realistic wind (Dryden model). The study validates recovery from single and dual cable severances within one payload-pendulum period. Crucially, ablation studies demonstrate that disabling the tension feed-forward term increases cruise error by 34–39% and peak post-fault sag by 3.6–4.0 times, identifying the feed-forward term as the dominant recovery mechanism.

Results
The simulation campaign (variants V1–V6) demonstrates the following:

• Tracking Performance: The system achieves a 3-D Root Mean Square Error (RMSE) of 0.312–0.328 m and a peak payload sag of 76.1–95.2 mm under fault conditions.
• Recovery Speed: Recovery from single and dual faults occurs within one payload-pendulum period (approx. 2.24 s). In many cases, the system settles to the new equilibrium in sub-tick time (0.00 s to 0.33 s).
• Robustness: The controller maintains performance under mass mismatches (tested from 2.5 kg to 3.9 kg payload with L1 augmentation) and wind disturbances.
• Ablation Findings: Disabling the $T_{ff}^i = T_i$ identity significantly degrades performance, confirming its role as the primary passive recovery mechanism.
• Extension Layers: Optional layers (L1 adaptive control, MPC tension-ceiling enforcement, and formation reshape) were evaluated. The results indicate that for the tested mission family, these extensions do not materially alter the trajectories, as the baseline feed-forward term dominates the recovery behavior. The MPC and reshape layers remain inactive or non-binding in the canonical regimes tested.

Significance and Claims
The paper claims that the proposed architecture fundamentally changes the approach to fault tolerance in cooperative transport by rendering the "detection-classification-reconfiguration" timeline unnecessary for abrupt structural transitions. By utilizing local force measurements as a direct response channel, the system achieves stability through passivity rather than active reconfiguration.

The authors assert that the tension-to-thrust feed-forward term is sufficient to provide a certified recovery envelope for unannounced cable severances, provided the system operates within the stated assumptions (bounded slack excursions, sufficient dwell time between faults, and actuator margins). The work demonstrates that decentralized control can handle constraint-set cardinality changes without global state synchronization or explicit fault signaling, offering a robust solution for practical aerial transport deployments where communication and computation latency may preclude active fault management.