⚡ electrical engineering

ASSURE-BVLOS: An Assurance-Aware Space–Air–Ground Intelligence Framework for Risk-Adaptive Autonomous Operations

This paper introduces ASSURE-BVLOS, an assurance-aware framework that integrates five dynamic risk dimensions across space-air-ground networks to enable risk-adaptive autonomous operations, demonstrating a 24.6% reduction in simulated hazardous outcomes compared to static baselines through a transparent systems-engineering approach.

Original authors: Nick Barua

Published 2026-07-23

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Nick Barua

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where tiny, flying robots—drones—are our eyes in the sky, zooming over disaster zones to find survivors, checking power lines for cracks, or patrolling the vast, empty ocean. For a long time, these robots had to stay close to their human pilots, who could see them with their own eyes. But as we push them farther away, into the "Beyond-Visual-Line-of-Sight" (BVLOS) zone, the pilot can't see them anymore. Instead, the drone relies on a complex web of invisible threads: satellite signals, cell towers, on-board cameras, and weather data.

Think of this like a high-stakes game of "telephone" played across the globe. The pilot gives an order, but it has to travel through space, bounce off satellites, and survive the wind before reaching the drone. If the signal gets a little fuzzy, or if the drone's camera gets confused by a cloud, the whole mission could go wrong. The big question scientists are asking is: How do we keep these drones safe when they are so far away and so dependent on so many different, sometimes shaky, pieces of technology? We can't just wait for a part to break completely before reacting; we need a system that senses when things are getting "wobbly" and adjusts the rules of the game before a crash happens.

This is exactly what the paper "ASSURE-BVLOS" tackles. The authors, led by Nick Barua, propose a new "brain" for these drones called an assurance-aware framework. Instead of treating the drone's communication, its sensors, and its own health as separate problems, this new system looks at them all together, like a captain checking the wind, the engine, and the map all at once.

The core idea is a "Risk Index." Imagine a dashboard with five different gauges:

The Voice (C2 Integrity): How clear is the connection to the pilot?
The Eyes (Sensing Reliability): How sure is the drone about what it sees?
The Memory (Data Integrity): Is the map or weather report it's using fresh, or is it old news?
The World (Environmental Exposure): Is the weather getting nasty or are there too many other planes nearby?
The Body (Vehicle Health): Is the battery low or is the motor overheating?

The paper introduces a clever way to combine these five gauges into a single "Risk Score." If the score gets too high, the drone doesn't just panic and crash; it smoothly shifts gears. It might slow down, switch to a safer, pre-programmed flight path, or even decide to land early. The authors call this "adaptive autonomy." It's like a car that, instead of waiting for the brakes to fail, gently slows down when it senses the road is getting icy.

To test this idea, the authors didn't fly real drones (yet). Instead, they built a massive digital playground—a computer simulation—where they ran 100,000 different missions. They simulated everything from disaster zones to long ocean patrols, mixing in different types of internet connections (like cell towers and satellites) and throwing in random glitches like signal drops or confusing weather.

The results were promising. When they compared their new "smart" system against a standard, old-school system (which just keeps flying until something breaks), the new system reduced the number of "hazardous outcomes" (bad crashes or dangerous situations) from 12.76% down to 9.62%. That's a 24.6% reduction in danger. Even more importantly, in the specific scenarios where the connection to the pilot was very bad, the old system kept flying blindly 1.67% of the time, while the new system always switched to a safer mode immediately.

However, the paper is very careful not to claim this is a magic fix that is ready for the sky tomorrow. The authors emphasize that this is a simulation. They used made-up numbers to represent real-world problems, and the "Risk Score" thresholds were chosen to show how the math works, not because they are the final, perfect settings for every drone. They explicitly state that this is a "method article"—a blueprint for how to think about safety—rather than a certified control law. They warn that if the data feeding the system is corrupted (like a hacker faking a weather report), the system could make bad decisions.

So, what's the takeaway? The paper suggests that by linking the drone's voice, eyes, memory, and body into one smart, shifting safety net, we can make long-distance drone flights significantly safer than they are today. It's a step toward a future where drones can handle the messy, uncertain real world without needing a human to hold their hand every second. But before we see this in the real sky, the authors say we need to move from computer games to real-world tests, proving that the math holds up when the wind is actually blowing.

Technical Summary: ASSURE-BVLOS

1. Problem Statement

Beyond-visual-line-of-sight (BVLOS) operations for unmanned aircraft systems (UAS) increasingly rely on a complex interdependence of heterogeneous space-air-ground networks, on-board autonomy, remote sensing, and external geospatial data. Current safety assurance approaches typically treat these dependencies in isolation: command-and-control (C2) performance is managed as a communications issue, perception confidence as an autonomy issue, and operational authorization as a pre-flight compliance issue.

This separation creates a critical "assurance gap." Degradation can propagate across system layers (e.g., from a communications link to a perception module) before any single subsystem crosses its conventional failure threshold. Consequently, static, teleoperation-centred baselines may fail to detect contextual residual risks, such as a 150 ms delay being tolerable for open-air inspection but catastrophic for close-proximity flight. The paper argues that safe operation in these environments requires a unified, runtime-aware framework that reasons about service quality and information integrity rather than mere service availability.

2. Methodology: The ASSURE-BVLOS Framework

The paper introduces ASSURE-BVLOS, an assurance-aware architecture designed to link communications, sensing, data pipelines, and autonomy within a single operational method. The framework operates through four core mechanisms:

A. Five-Domain Risk Ontology

The system constructs a normalized risk vector $x(t) = [r_{C2}, r_{S}, r_{D}, r_{E}, r_{V}]$ at any given time $t$ , covering:

C2 Integrity: Round-trip time, jitter, packet loss, link age, and authentication status.
Sensing Reliability: Detection confidence, track continuity, sensor disagreement, and GNSS integrity.
Data Integrity: Information age, provenance, calibration status, and processing latency of external data (e.g., satellite imagery, weather).
Environmental Exposure: Weather severity, terrain clearance, airspace density, and population exposure.
Vehicle Health: Energy reserves, propulsion margins, and flight-control status.

B. Risk Aggregation and Uncertainty Penalty

Instead of a simple weighted sum, the method uses a bounded multiplicative risk index ( $R_t$ ) to ensure that concurrent moderate risks are not understated:
$R_t = 1 - \prod_{i=1}^{n} (1 - r_i(t))^{w_i}$
To prevent low-confidence inputs from being hidden by averaging, an explicit uncertainty penalty is applied:
$R^*_t = \min [1, R_t + \lambda_s D_s(t) + \lambda_a A_d(t)]$
where $D_s$ represents sensor disagreement and $A_d$ represents bounded data age.

C. Five-State Operational Authority Policy

Based on the aggregated risk index $R^*_t$ , the system dynamically reallocates operational authority through five states, utilizing hysteresis to prevent rapid switching:

S0 (Nominal): $R^* < 0.25$ . Human supervision or direct command.
S1 (Constrained): $0.25 \le R^* < 0.42$ . Reduced speed, increased separation, and limited maneuvers.
S2 (Protected Autonomy): $0.42 \le R^* < 0.60$ . On-board trajectory holding or verified local planning; remote pilot supervises.
S3 (Contingency): $0.60 \le R^* < 0.76$ . Diversion, holding, or return to predefined safe sites.
S4 (Terminate): $R^* \ge 0.76$ . Execution of approved flight termination or minimum-risk procedures.

D. Digital Safety-Case Evidence Loop

Every state transition is recorded as a time-indexed evidence record, linking claims, monitor outputs, triggers, responses, and outcomes. This creates a "living" digital safety case for post-flight reconstruction and verification.

3. Experimental Evaluation

The framework was evaluated using a reproducible Monte Carlo simulation of 100,000 mission states across three archetypes:

Disaster Response: Characterized by rapidly changing scenes and degraded terrestrial communications.
Linear Infrastructure Inspection: Involving long corridors, proximity to assets, and variable cellular coverage.
Maritime Surveillance: Featuring long endurance, sparse terrestrial coverage, and reliance on SATCOM.

The simulation compared the ASSURE-BVLOS policy against a static, teleoperation-centred baseline that only reacts to declared subsystem failures. Input distributions (e.g., lognormal for delay, beta for packet loss) were synthetic but designed to reproduce observed network skew and boundedness.

4. Key Results

Risk Reduction: The ASSURE-BVLOS policy reduced simulated hazardous outcomes from 12.76% (baseline) to 9.62%, representing a 24.6% relative risk reduction.
High-Risk Handling: Under predefined high-C2-risk conditions where the baseline continued the mission in 1.67% of cases, the ASSURE-BVLOS framework successfully transferred authority to protected autonomy or a more conservative state in 100% of simulated cases.
State Utilization: The system spent the majority of time in the "Constrained" state (64.50%), with "Nominal" operations at 28.11%. Protected autonomy and contingency states were utilized less frequently (7.09% and 0.21%, respectively), indicating the policy effectively manages risk without excessive mission termination.
Robustness: Sensitivity analysis showed that while the absolute intervention rate varied with threshold perturbations ( $\pm 10\%$ ), the relative risk reduction remained consistent. Ablation studies confirmed that omitting any single risk domain (C2, Sensing, Data, Environment, or Vehicle) degraded the system's ability to identify critical states, validating the necessity of the multi-domain approach.

5. Significance and Claims

The paper positions ASSURE-BVLOS not as a certified control law or a regulatory approval, but as a transparent systems-engineering method. Its primary contributions are:

Integration of Domains: It explicitly bridges the gap between communications performance, information integrity (provenance/age), and runtime authority management, treating external data quality as a direct safety factor rather than administrative metadata.
Contextual Risk Management: By using a multiplicative index and uncertainty penalties, the framework addresses the "assurance gap" where degradation propagates across layers before triggering binary failure alarms.
Traceable Evidence: The digital safety-case loop provides a structured mechanism to link runtime decisions to auditable evidence, supporting future hardware-in-the-loop and flight-test validation.
Modest Scope: The authors explicitly state that the results are evidence of model behavior under synthetic conditions, not estimates of real-world accident rates. The weights and thresholds are for methodological demonstration, and the framework requires subsequent validation (analytical, simulation, hardware-in-the-loop, and operational trials) before any regulatory acceptance.

The framework is designed to support the transition from static, teleoperation-centred safety models to dynamic, risk-adaptive autonomy, providing a structured bridge between runtime assurance research and operation-centric risk assessment (e.g., SORA).