NL
A drone flying through a forest with no map, while also having to give way to other aircraft: that is an environment where most existing planning software makes an estimate rather than a promise. Researchers at the Massachusetts Institute of Technology (MIT) have built a planner that delivers a mathematical proof, in exactly that situation, that the aircraft will not hit anything. The system is called SANDO and the results appear in IEEE Transactions on Robotics. The preprint is available on arXiv.
The motivation is practical. Trajectory planners use images and data from onboard cameras and sensors to work out a route to the goal. Most of those planners are designed for unknown but static environments, where obstacles stay where they are. The planners that do handle movement usually steer around obstacles without being able to show that a collision is impossible. In situations where it really matters, such as delivering medical supplies to a remote disaster site, that difference counts. Computing every conceivable crash, however, takes far too long for an aircraft that has to react in flight.
What SANDO does: a guarantee instead of an estimate
SANDO stands for Safe Autonomous Trajectory Planning for Dynamic Unknown Environments. The planner starts by mapping out a safety corridor through the environment: a series of connected regions of three-dimensional space that are known to contain no obstacles. So far that resembles existing approaches. The difference lies in time.
SANDO makes the safety corridor time-varying. A separate module detects, groups and monitors moving objects to estimate where they will go next. Because the planner does not know exactly where an object will end up, it uses that object's maximum velocity to compute how far it could possibly travel within a given timespan. A sphere is placed around the object covering its furthest possible reach in every direction. The safety corridor is then built around those spheres, layer by layer in time. That leaves a route that does not close up the moment something starts moving.
Within that corridor SANDO optimises the trajectory towards the fastest path to the goal. During flight the system recomputes the corridor and the trajectory so the path stays collision-free until the aircraft arrives. A heat map-based planner helps by flagging regions with many obstacles as high-risk and steering the aircraft around them, which in practice produces a more efficient route than simply searching straight ahead.
What the research shows in simulation and test flights
In simulations SANDO reached the goal faster than a number of state-of-the-art systems while completely avoiding collisions in every environment. In the preprint the researchers report a 100 percent success rate across all forest and dynamic benchmark difficulty levels, with no violations of the imposed safety constraints. They also flew twelve test flights with a real UAV, with planning, perception and localisation all running onboard. Every moving obstacle was avoided there too. In six earlier flights in static environments the aircraft likewise stayed safe.
A second result concerns computation time. The trajectory optimisation is formulated as a mixed-integer quadratic programme with hard collision-avoidance constraints, a formulation that is normally slow. Eliminating variables reduces the number of decision variables, and according to the analysis that yields up to 7.4 times faster optimisation. Without that step the approach is not feasible on an onboard computer in dense, dynamic environments.
The authors are Kota Kondo, who completed his doctorate in aeronautics and astronautics at MIT, together with Jesús Tordesillas, Juan Rached, Lili Sun and Yixuan Jia, with Jonathan P. How as senior author. The work was funded in part by the Defense Science and Technology Agency of Singapore. An outside researcher, Fei Gao of Zhejiang University, described the combination of spatiotemporal planning, formal safety analysis and hardware validation as a practical approach to autonomous flight in complex dynamic environments.
The assumptions behind the guarantee
A guarantee is worth only as much as the assumptions it rests on. SANDO's formal safety analysis relies on three explicit conditions: an upper bound on the velocity obstacles can reach, an upper bound on their size, and a bounded error in estimating their position. As long as those bounds hold, the proof stands. Anyone entering an environment with faster or larger objects than assumed has to reconfigure the planner, because the argument no longer applies.
That is not a footnote but the heart of the matter. The guarantee does not cover everything a drone may encounter in the real world, only everything inside a clearly defined envelope. In practice this means the bounds themselves become part of the risk assessment, just as flight parameters and visual line of sight are today.
Video: how a drone using SANDO avoids unknown obstacles
MIT published a video alongside the research showing how the aircraft reacts to obstacles it has not seen before. Watch the moment an object enters the frame and the route adjusts without the drone coming to a stop.
Where this connects to day-to-day operations
For anyone working with drones today, nothing changes about rules, zones or permits. What shifts is the picture of what can be demonstrated technically. In a SORA application an operator currently argues largely from assumptions: these distances are maintained, these procedures are followed, these systems are used. A planner that ships with a formal proof turns part of those assumptions into a technical property of the system.
That touches the human side of operations as well. Our overview of human factors in drone operations shows that a large share of incidents arises from decisions under time pressure rather than from failing technology. Automation that respects an explicit bound in such a moment, instead of estimating a probability, changes the pilot's role: guarding the envelope rather than the last instant.
The link to logistics is interesting too. Research into medical drone flights between Meppel and Zwolle shows that fixed routes over sparsely populated areas already work as long as the environment stays predictable. Once a route runs through airspace where light aircraft, helicopters or other drones may appear, the dynamic variant becomes relevant. SANDO's guarantee applies to the obstacles its sensors actually observe. An object that never enters the field of view falls outside the analysis, which is why keeping visual contact and complying with the Dutch drone map and zone rules remains just as necessary.
For the European framework, the relevant question is not whether SANDO will be certified tomorrow, but whether this type of evidence earns a place in how risk is demonstrated. The European Union Aviation Safety Agency (EASA) is developing rules for beyond visual line of sight and automated operations, and there is room for technical argumentation alongside procedural measures. Our overview of the LVNL and GoDrone questionnaire shows how far current application practice still is from that.
This is fundamental work, not a product. There is no commercial version, no certification and no support, and the next steps the researchers themselves mention concern computing power and combining the planner with language models so a user can give instructions in plain language. Anyone preparing a flight today still needs a qualified pilot, thorough preparation and a realistic risk assessment. What this research adds is a technical answer to a question that has so far been covered mainly by procedures.
Frequently asked questions about SANDO
What does SANDO stand for?
SANDO stands for Safe Autonomous Trajectory Planning for Dynamic Unknown Environments. It is a planner that computes a route on a UAV's onboard computer which is formally proven to stay free of collisions with moving obstacles, even without a map of the area.
What is a time-varying safe flight corridor?
A safe flight corridor is a series of connected regions of airspace known to contain no obstacles. SANDO makes those regions time-dependent: for each time layer an obstacle is inflated only as far as it could travel in that window at its own top speed. That keeps the corridor usable while objects keep moving.
What assumptions does the safety guarantee rely on?
The proof rests on three explicit conditions: an upper bound on obstacle velocity, an upper bound on obstacle size, and a bounded error in position estimation. As long as those bounds hold, the guarantee stands. If an environment is faster, larger or harder to observe than assumed, the proof no longer applies.
Can SANDO be used in commercial drone flights today?
No. SANDO is research software validated in simulation and in twelve test flights with a real UAV, with all computation running onboard. There is no product, no certification and no support. For commercial flights in Europe the SORA methodology from EASA remains the framework in which risks are argued.
Does this change drone flying in the Netherlands?
Rules, zones and permits are unchanged by this research. What may change is the way an operator demonstrates that an aircraft avoids moving obstacles: today mostly through assumptions and procedures, in future possibly with a technical proof alongside them.