A drone flying through an unmapped building, a forest fire, or a mine tunnel faces a problem that is easy to describe and difficult to solve: the route that was safe a moment ago may become unsafe before the aircraft reaches the next turn. An obstacle can move, a sensor can miss it, and a planner that is fast enough to react may still be relying on a soft preference rather than a hard safety constraint.

A research drone flies through a damaged industrial interior inside a visualized time-dependent safety corridor.

MIT researchers have developed a flight-planning system called SANDO—Safe Autonomous trajectory planning for Dynamic unknOwn environments—that addresses this specific gap. The system is designed for a drone that does not know the map in advance and must account for obstacles whose future motion is also unknown. MIT says SANDO produced collision-free plans in simulation and avoided dynamic obstacles in 12 real-world test flights.

That is a meaningful research result, especially because the work combines formal analysis with onboard hardware tests. It is not, however, a general certificate that a drone is safe in every real environment. SANDO’s guarantee depends on stated assumptions about obstacle speed, perception, estimation error, vehicle dynamics, and the ability to keep replanning. Those conditions are not a footnote. They are the boundary of what the result means.

The useful way to read SANDO is as a safety architecture for one difficult layer of autonomy—not as a replacement for pilots, airspace rules, reliable hardware, or operational judgment.

The problem SANDO is built to solve

Most autonomous drone planners operate somewhere on a spectrum between speed and certainty. A system may be very responsive because it samples possible paths and assigns higher costs to trajectories that pass near obstacles. That can work well in ordinary environments, but a cost is not the same thing as a prohibition. If the shortest route scores better overall, an optimizer can still select a path that comes uncomfortably close to an object.

Other planners use hard constraints. They exclude paths that enter known obstacles and can provide stronger guarantees, but the calculation becomes more difficult as the environment grows more complex or as the system has to reason about time. A static obstacle is already a geometric problem. A moving obstacle is a geometric and temporal problem: the drone must avoid not only where the object is, but also where it could be while the drone is passing through the same space.

The hardest version combines three uncertainties:

  • The drone starts without a complete map.
  • Obstacles may move in ways the planner cannot predict exactly.
  • The vehicle must make decisions quickly enough to fly using its onboard computer.

A route computed in a static map can become invalid as soon as a person, vehicle, aircraft, or piece of debris enters it. A planner that simply reacts after the fact may be too late, particularly in confined spaces or at high speed. SANDO is intended to keep the safety calculation active as the vehicle discovers its surroundings.

MIT’s description of the system says the planner was developed for situations such as search and rescue in collapsed buildings, mine exploration, and delivery through crowded areas. Those are plausible application categories, but they also expose why the problem matters. In a disaster zone, the environment is not merely unknown. It may be changing because of fire, falling material, emergency workers, dust, smoke, or other aircraft.

How the safety corridor works

SANDO divides the task into several connected pieces. It first builds a representation of the environment from the drone’s sensors. The system then creates a global route that favors areas with more available space. MIT describes this as a heat-map-based planner: regions with greater obstacle density receive higher risk costs, encouraging the route to move away from crowded or uncertain areas when alternatives exist.

The more distinctive part is the time-dependent safety corridor. Instead of treating every detected moving obstacle as if it could occupy its worst possible position for the entire planning horizon, SANDO estimates a reachable region for each time interval. The paper calls these time-layered regions spatiotemporal safe flight corridors.

The underlying idea is straightforward. If an obstacle is known to move no faster than a specified maximum speed, then the planner can place a protective volume around it that expands according to the amount of time available for movement. The drone’s planned trajectory must stay outside that volume at the relevant time. As time advances, the corridor can be rebuilt using new sensor observations.

This is more informative than a single static buffer. A very conservative buffer around an obstacle may make a dense environment look impossible to navigate. A time-aware buffer can be smaller when the vehicle will pass quickly and larger when the obstacle has had more time to move. The result is still conservative, but it spends conservatism where it is physically relevant.

The final trajectory optimization uses hard collision-avoidance constraints in a mixed-integer quadratic program. That formulation is computationally demanding, so the researchers introduce a variable-elimination technique intended to reduce the number of decisions the optimizer must handle. The associated research paper reports up to a 7.4-fold speedup in optimization time from that technique.

In practical terms, SANDO is not asking a neural network to guess whether a path looks safe. It is using perception to update a geometric model, then solving a constrained planning problem in which collision avoidance is treated as a requirement. That distinction is important. Learned perception may still be involved in detecting and classifying the world, but the final path is checked against an explicit safety formulation.

What the tests actually demonstrate

The reported evidence has three layers. In simulation, SANDO was compared with other planning systems across static and dynamic environments. MIT says it reached goals faster than several state-of-the-art approaches while avoiding collisions in the tested scenarios. The paper reports the highest success rate across its benchmark conditions without constraint violations.

The second layer uses perception rather than a perfect ground-truth map. That matters because a planner can look impressive when it receives exact obstacle positions from a simulator. A real aircraft has to infer the environment from cameras, depth sensors, lidar, or other onboard measurements, each with limited range and imperfect timing. SANDO’s perception-in-the-loop experiments are therefore more informative than an idealized map-only demonstration.

The third layer is hardware validation. MIT reports 12 test flights with a real UAV in which the system avoided dynamic obstacles. The paper’s abstract describes six safe flights in static environments and ten among dynamic obstacles; the figures differ because the paper and the later MIT summary appear to count test groupings differently. The safe conclusion is that the work included repeated onboard experiments, not that it completed a large operational trial.

The aircraft planned and replanned using its own computer and sensors. That is a useful threshold for robotics research. A system that depends on a powerful external workstation may prove an algorithmic idea without showing that the idea can run on a deployable vehicle. Onboard execution does not make the system production-ready, but it closes an important gap between a simulation and a flight demo.

The tests also need to be read in context. Twelve flights are enough to show that the implementation can work under selected conditions. They are not enough to establish reliability across weather, lighting, smoke, reflective surfaces, sensor degradation, communications loss, battery aging, unusual aircraft behavior, or dense human activity. No short research campaign can cover that entire space.

The guarantee is conditional, not magical

The phrase “collision-free guarantee” can be misunderstood if the assumptions are left out. SANDO’s formal safety analysis depends on bounds that the system must know or estimate. The most important is a maximum obstacle velocity. If a moving object can travel farther or faster than the bound used to inflate the safety region, the corridor may no longer cover every possible future position.

The guarantee also depends on perception and state estimation. A planner can enforce a hard constraint around an obstacle only if the obstacle is detected, represented in the right place, and associated with a sufficiently large uncertainty margin. A camera may fail to see a dark object against a dark background. A lidar return can be sparse or distorted by rain, dust, glass, foliage, or reflective surfaces. A moving person may be partially occluded until there is little room left to maneuver.

There is also a difference between a mathematical model and an aircraft. The analysis can include the drone’s size and motion limits, but the real vehicle has actuator delays, vibration, aerodynamic disturbances, battery limits, temperature effects, and software faults. If the aircraft cannot follow the optimized trajectory closely enough, a safe path in the model may not be a safe path in the world.

The system must also remain recursively feasible: after a new observation arrives, it must still be possible to find a valid continuation. A planner may produce a safe route for the next segment while leaving the aircraft in a position from which no safe route to the final goal exists. SANDO’s time-varying corridor design helps with this problem, but it does not remove the need for fallback behavior. A mature product needs explicit rules for slowing down, hovering, returning, landing, or handing control to a human when no feasible corridor remains.

These limitations make the result more credible, not less. A theorem is useful precisely because it states what must be true. The engineering work begins when operators test whether those conditions can be monitored, enforced, and recovered from during real missions.

Why this matters for disaster response

Search-and-rescue teams often send robots into places where people cannot safely enter. A small drone can inspect a collapsed structure, locate heat signatures, map an underground passage, or carry a lightweight sensor ahead of a response crew. In those environments, GPS may be unavailable, maps may be obsolete, and the vehicle may encounter moving responders or falling debris.

A navigation system that merely “usually avoids obstacles” is a poor fit for that role. The cost of a collision is not limited to replacing the drone. A crash may destroy the only sensor view of a trapped person, block a route, create a battery fire, or force a responder into a dangerous area to retrieve the aircraft. Formal constraints can give mission planners a stronger basis for evaluating risk.

The same logic applies to inspection. A drone moving around industrial equipment, bridges, power infrastructure, or wind turbines may need to operate close to structures while maintaining a safe distance from workers and other machines. A time-aware corridor could help it deal with cranes, vehicles, or personnel that enter the work area unexpectedly. It may be especially valuable when a fixed map cannot capture daily changes.

But rescue and inspection missions also have stricter demands than a laboratory flight. Smoke can degrade perception. Wind can push a vehicle outside its expected dynamics. A responder may move unpredictably because the human priority is not to behave like a bounded obstacle. The operational system would need conservative fallback rules and a clear authority structure: who can stop the drone, how a remote operator takes control, and what happens if communications disappear.

What it does not solve for delivery drones

Package delivery is an obvious commercial use case, but SANDO alone does not make autonomous delivery viable. A delivery operator needs more than local obstacle avoidance. It needs route authorization, airspace coordination, geofencing, identification, weather monitoring, reliable communications, a landing or handoff procedure, and a way to handle people, animals, wires, and unexpected vehicles.

In the United States, the FAA’s current Part 107 guidance still includes visual-line-of-sight requirements for ordinary operations, while beyond-visual-line-of-sight flights generally require a waiver or another applicable authorization. The FAA also sets conditions for operations over people and moving vehicles. A better planner can support a future approval case, but it does not itself grant permission to fly.

This distinction is easy to lose in product coverage. “The drone can avoid an unknown moving obstacle” describes a technical capability. “The operator can run an unsupervised delivery route through a neighborhood” describes a complete service, including regulation, maintenance, insurance, public acceptance, and incident response. The first is a research result. The second is a business and safety system that still has to be built.

SANDO could nevertheless become part of that system. A delivery aircraft might use a formal local planner as one layer beneath a route-management service. The route manager would decide where the aircraft is allowed to go; the local planner would keep it inside a safe corridor as conditions changed. That separation resembles how many safety-critical systems are engineered: a high-level mission policy chooses permitted behavior, while a lower-level controller enforces physical constraints.

The operational question is how conservative to be

Safety margins always have a cost. If the assumed maximum speed of an obstacle is high, the reachable safety volume grows quickly. The aircraft may need to take a longer route, slow down, or declare the corridor infeasible. If the bound is too low, the guarantee does not cover the real environment. Choosing the bound is therefore both a technical and operational decision.

A disaster-response team might accept a slow route to protect a valuable sensor. A delivery company may want more efficient paths but have less tolerance for hovering over a populated area. An inspection operator may prefer the drone to retreat whenever a worker enters the work zone. The same algorithm can produce different behavior depending on the consequences of failure and the cost of interruption.

This is where SANDO’s heat-map component is useful conceptually. The planner does not treat every free-space route as equally attractive. It can steer away from crowded regions even when they are technically traversable. In a real deployment, that risk map could incorporate more than obstacle density: uncertainty, human presence, wind exposure, emergency exits, no-fly zones, and the quality of available sensor data.

A good autonomy system should make those tradeoffs visible. Operators should be able to see why a route was rejected, which assumption made it unsafe, and whether the aircraft is approaching a fallback threshold. A black-box “safe” label is less useful than a dashboard showing the current speed bound, sensing confidence, remaining corridor width, and time until the next replanning cycle.

The software may be as important as the aircraft

SANDO also points to a broader shift in robotics. Progress is often measured by the vehicle’s body, its battery, or its model size. In difficult environments, the limiting factor may instead be the software layer that connects perception to action under uncertainty. The aircraft does not need a humanlike body to benefit from better planning. It needs a controller that understands when the world has changed and treats physical constraints as non-negotiable.

The research is potentially valuable because it is presented as an algorithm, a proof, and an implementation. The MIT Aerospace Controls Laboratory publication record lists the work alongside other trajectory-planning research, while the paper provides enough detail for researchers to inspect the assumptions and reproduce parts of the evaluation. That is more useful to the field than a polished flight video with no description of the planner, sensor inputs, or failure cases.

Open research code can extend that value if it remains maintained and if independent teams test it outside the original hardware and environments. The next meaningful evidence would include longer trials, varied sensors, more aggressive disturbances, occlusion, degraded perception, and deliberate failures. It would also help to report near misses, emergency stops, infeasible plans, and operator interventions—not just successful flights.

For commercial robotics, those negative cases are often more informative than the headline success rate. A system that safely stops and requests help is more valuable than one that continues moving until it reaches a fragile edge of its model. The quality of the fallback behavior may determine whether a planner can be certified and operated around people.

What to watch next

SANDO’s immediate contribution is narrow: it shows how a drone can combine time-dependent obstacle modeling, hard trajectory constraints, fast optimization, and onboard replanning in an unknown dynamic environment. That is enough to make it an important result in autonomous flight planning. It is not evidence that general-purpose drones are ready to navigate any public space without supervision.

The next milestones should be concrete. Researchers should show how the system estimates obstacle-speed bounds in the field, how it behaves when those bounds are violated, and how much performance is lost when uncertainty margins are increased. They should test the planner with sensor dropouts, communication delays, wind, low visibility, and obstacles that are not well approximated by simple geometric volumes.

Deployers should ask a different set of questions: Can the system explain a rejected route? Can a human interrupt it immediately? Does it have a safe landing policy? Can its assumptions be audited after an incident? How does it fit the airspace authorization and operational-control framework?

Those questions may sound less dramatic than a claim of guaranteed collision avoidance. They are the questions that determine whether a theorem survives contact with a working mission. SANDO matters because it moves one part of that conversation from vague confidence toward explicit conditions. The practical achievement is not that the drone has become infallible. It is that the safety claim can be inspected, tested, and eventually improved.