A quadrotor has exactly as many actuators as it has things to control: one collective thrust and three torques. A hexacopter can route around a damaged propeller; a quadrotor cannot. When one rotor weakens, the vehicle has to notice and compensate before its attitude loop saturates, and when a rotor stops entirely, the only way to stay in the air is to give up control of yaw and let the vehicle spin.
The study models that situation for a 5-inch FPV-class quadrotor, about 0.64 kg with a thrust-to-weight ratio of 3.6, with sensor noise, a 10 ms motion-capture latency, parameter uncertainty and light turbulence. Everything below is simulation; the parameters are assumed, not identified on a real frame.
The hard part is knowing, not steering
The clearest result is the gap between two controllers that differ only in what they know. After a complete loss of one rotor in hover, the nominal controller, never told about the fault, lost the vehicle in all 32 runs, typically by flipping within about 0.3 seconds. A yaw-relaxed controller in the spirit of Mueller and D’Andrea, handed the true fault the instant it happened, recovered every one.
So the control law that survives a rotor loss already exists. What separates a crash from a recovery is information: that a fault happened, which rotor it hit, and how much effectiveness is left, delivered fast enough to act on.
Estimating something no sensor measures
A small quadrotor usually has no direct measurement of how well each rotor is working. The pipeline infers it. The rotational dynamics and the vertical force balance are linear in the four rotor-effectiveness factors once each rotor’s thrust is predicted from the motor commands, so a Kalman filter can track those factors from the gyro, the accelerometer and the velocity estimate.
One detail matters more than it looks: the gyro has to be differentiated to get angular acceleration, and differentiating noise is a bad idea, so it goes through a filter. Every other signal in the regression goes through the same filter, so the equation stays exact for a constant fault instead of being exact for none of its terms.
The healthy vehicle is not the nominal vehicle
The next lesson was about the baseline. A thrust coefficient a few percent off, or a mass error, looks exactly like a few percent of lost effectiveness. A detector that compares the vehicle against its nominal model therefore starts every flight slightly alarmed.
The fix is to learn what healthy looks like on this particular vehicle: the estimate is averaged over the first 2.5 seconds of hover and detection runs against that. With this step removed in an ablation, static mismatch stayed in the residual: one fault-free flight raised a false alarm, and so did one faulty flight before its fault even began.
Deciding fast, and deciding once
Estimation produces a number; detection has to make a decision. The detector uses a bank of CUSUM tests, each designed for a different size of loss: 15, 30 and 60 percent. A single test tuned for small faults roughly doubled the median detection delay, from 30 to 61 ms, because a large fault then accumulates evidence at the rate of the small one it was designed for.
With the bank, all 200 injected losses between 20 and 90 percent were detected (median 30 ms, 95th percentile 58 ms) and isolated to the correct rotor, with no false alarm in 32 minutes of fault-free flight, including aggressive manoeuvres that were not used to set the thresholds. The yaw-relaxed controller then took over complete losses about 60 ms after the failure and held position while the vehicle spun at about 23 rad/s.
What the oracle got wrong
At 70 to 80 percent loss, the estimating pipeline had a smaller peak deviation than the oracle that knew the truth. The oracle idles a weakened rotor the moment it fails; the estimating pipeline keeps using it for the 70 to 90 ms it takes the alarm and the estimate to cross the switching threshold, and that partial thrust helps. An oracle is an upper bound on information, not on the decisions made with it.
Where it breaks
Mapping where it fails is the most useful result. In the robustness sweeps, recovery from a complete loss started to fail at 24 ms of actuator delay (the controller assumes 2 ms), with motors 3.2 times slower than modelled, and at three times the default turbulence. All three act during the spin-up transient, when the relaxed equilibrium leaves little margin and the body tilts by 40 degrees or more.
The limits of the study are just as clear. The noise in the simulation is white and the turbulence a simple random process; the vibration on a real 5-inch frame is narrow-band, much larger and tied to motor speed. The detection numbers describe what the method does when its model is right.
The first step beyond the original simulator is done. Replayed offline on 110 PX4 software-in-the-loop flights of a 2 kg quadrotor in Gazebo, the same diagnoser detected all 40 partial and 16 complete losses, with median delays of 120 and 132 ms, and flagged every complete loss before the vehicle tilted past 90 degrees. PX4’s own failure detector raised nothing for the partial losses and flagged the complete ones only after about 660 ms, once the attitude limit was crossed. Gazebo’s IMU is nearly noise-free, though, so that run says little about false alarms on a real frame. Blackbox logs from a real flight, then a tethered rig, come next.
Losing a rotor is a lesson in estimation. The controller that survives is the one that knows soonest, and how soon it knows depends less on clever control than on an honest model of the healthy machine.