Flight Testing a Swarm: Safety Cases for Twenty Aircraft and One Operator

The Demonstration and the Capability

Public swarm demonstrations — twenty loitering platforms launched by a single operator, self-organising into subgroups, executing a coordinated engagement — are genuinely impressive pieces of engineering. They are also, as tests, close to worthless, because they are flown to succeed.

The engineering question is never whether the swarm works when everything works. It is what the other nineteen aircraft do when one of them fails, and whether a single operator can detect that failure at all. That question requires a different kind of test, and it requires a safety case that most programmes have not built.

Why Single-Vehicle Test Methodology Does Not Scale

Conventional flight test assumes an operator monitoring one aircraft with the authority and attention to intervene. At twenty aircraft, per-vehicle attention is roughly 5% of what a single-vehicle test provides. Failures that a test pilot would catch instantly on one airframe go unnoticed for tens of seconds across twenty.

Worse, the failure modes are new. Single-aircraft testing cannot surface consensus failures — where the coordination algorithm itself misbehaves — because they only exist with multiple participants. Partition behaviour, where the group splits into subgroups that each believe they hold authority, has no single-vehicle analogue at all. Neither does cascade: one aircraft's incorrect position report propagating into the collision-avoidance solution of every neighbour.

Build the Test Around Induced Failure

The useful swarm tests are the ones where you break something deliberately. Inject a stale position report from one aircraft and observe whether neighbours reject it or fuse it. Command one aircraft to hold while the group advances, and confirm the group's behaviour is defined rather than emergent. Sever the link to a subgroup and verify both halves converge on safe, non-conflicting behaviour rather than each assuming primacy.

Every one of these should first be run in simulation at full vehicle count, then flown at reduced count with generous separation, and only then at full scale. Programmes that jump straight to the twenty-aircraft demonstration discover partition behaviour in the air, which is an expensive place to discover it.

Field Example: Nineteen Correct, One Committed

Supporting a multi-vehicle evaluation at eight aircraft, we induced a GPS fault on a single airframe mid-sortie, shifting its reported position 40 m east while its true position was unchanged.

The collision-avoidance layer behaved exactly as designed: seven aircraft manoeuvred to deconflict from a position where nothing was. That was the expected result. The unexpected one was that the faulted aircraft's true position now conflicted with the corrected track of another aircraft, and because both were operating on the shared position picture, neither detected it. Separation closed to 11 m. The single operator, monitoring a display showing eight nominal tracks, had no indication anything was wrong.

The fix was straightforward once identified — cross-checking reported position against an independent range measurement. Finding it required deliberately breaking one aircraft in eight and having someone on the ground watching for exactly that.

What the Safety Case Needs

Geofencing enforced per-aircraft in firmware, not centrally, so a coordination failure cannot disable containment. Independent termination for every airframe, reachable without going through the swarm network. A defined maximum for how many aircraft may be non-nominal before the sortie is aborted. And enough ground observers that per-vehicle attention does not fall to zero — for early testing, that realistically means one observer per two or three aircraft.