A drone flies into a room it has never seen. It has no map. Obstacles are moving inside, and nobody has told the machine where they will go. An ordinary flight-planning program guesses what comes next, and usually guesses well. Usually. A team at MIT has built a planner that does not guess. The authors say their route avoids collisions, and they back it with a mathematical proof. The proof has one condition, though, and it makes all the difference. More on that in a moment.
The paper "SANDO: Safe Autonomous Trajectory Planning for Dynamic Unknown Environments" appeared in IEEE Transactions on Robotics. It was written by Kota Kondo, Jesús Tordesillas, Juan Rached, Lili Sun, Yixuan Jia and Jonathan P. How. Kondo recently defended his doctorate at MIT and is the first author. Tordesillas now teaches at Comillas Pontifical University in Madrid. How is a professor of aeronautics and astronautics at MIT and the senior author. A preprint was posted earlier on arXiv. MIT described the result on 7 October 2026.
The paradox of certainty without knowledge
Let's start with the problem. A flight planner is a program that turns camera and sensor data into a route to the goal. In a known, static environment this can be done with a strict guarantee. In an unknown, moving one, usually it cannot.
MIT puts it this way: most popular systems offer a formal safety guarantee only when the world stands still or when all obstacles are known in advance. The other planners avoid moving obstacles "loosely". They are fast and usually effective, but nobody has proved they will not hit anything. The authors describe this as a trade-off. Planners with soft constraints compute quickly but do not guarantee a collision-free route. Planners with hard constraints guarantee more but compute for longer.
Kondo says it plainly: in an unknown, dynamic environment, researchers have so far had no way to guarantee mathematically that a trajectory is safe. His team says it has one. The only thing the planner needs is the top speed the obstacles can reach.
That is the condition. The drone does not need to know where an obstacle will go. It needs to know how fast it can go at most. The whole construction rests on that.
A corridor that grows in time
The method can be explained without formulas. First the drone marks out a safe corridor, a chain of connected pieces of space where there are certainly no obstacles. In older methods such a corridor is a snapshot of one moment. The obstacle moves, so a second later the snapshot is out of date.
SANDO makes the corridor depend on time. A dedicated module detects obstacles, groups the points that belong together and tracks them. The planner does not know where an obstacle will be in half a second. It does know how far it could get, because it knows the obstacle's maximum speed. So MIT draws a sphere of reach around the obstacle, covering every place the obstacle could get to. The authors speak of the "worst-case reachable set" at each time layer. The corridor is built around these zones. As long as the drone stays inside the corridor and the obstacle stays inside its zone, they cannot meet.
Kondo puts it like this: in the real world obstacles move, so a corridor drawn at one moment stops being useful once something moves into it. Adding time lets them vouch for safety into the future as well.
There are two more elements. The first is a "heat map". The planner marks regions full of obstacles as hot and steers the drone away from them, which shortens the route around risk zones. The second is optimization. Once the corridor is ready, the program looks for the fastest route to the goal inside it. During flight it recomputes both the corridor and the route on the fly.
Mathematics that leaves no room for cheating
Computing a route under hard constraints is difficult, because consecutive segments of the route must be assigned to consecutive pieces of the corridor. The authors cast this as an optimization problem with integer variables and added a trick that reduces the number of unknowns. According to the paper, this variable elimination speeds up the computation by up to 7.4 times.
As a result the drone recomputes its route on its own onboard computer. In experiments on real hardware, a full replan typically took 18 to 36 milliseconds, which gives roughly 28 to 56 updates per second. That is fast enough for the drone to react to a sudden change.
Kondo admits the mathematics was the hardest part. When you promise safety, the theory has to cover every case, including edge cases. Once the guarantee was ready, he says, flying the drones was easy.
What was tested in simulation and in flight
Simulations came first. The authors compared SANDO with several modern planners. In the test without moving obstacles, the competitors were FASTER and SUPER, designed for static surroundings. In simulated tests in a forest and among moving obstacles, SANDO reached a 100 percent success rate at every difficulty level and broke none of its constraints. In the conclusions the authors note that it was the only planner to do so. The simulations ran on a computer with a 16-core Intel Core i9 processor.
Then the hardware. The platform was a Holybro X500 drone with a Pixhawk flight controller and PX4 software. A Livox Mid-360 lidar was mounted on top. With it the drone worked out the position of obstacles and its own. The planner ran on an Intel NUC computer with an i7 processor. Everything was computed onboard.
The obstacles were pieces of foam, each on a small wheeled platform. First a single obstacle moved along a straight line, a circle and a figure eight. In the fourth of these flights a person walked in a random manner instead of a cart. Then five carts appeared at once, and finally five carts among additional static obstacles. In the first four experiments a motion-capture camera system served only to assess afterwards how close the drone had actually come. The planner knew nothing about it.
The result: the drone flew all twelve flights among moving obstacles without a collision. In addition there were six flights in a room with static obstacles, at speed limits from 1 to 6 metres per second.
What this work does not promise
Now back to the condition. The guarantee from the theorem holds under assumptions: the speed of the obstacles has a known upper bound, and the error with which the drone estimates their position is also bounded. The authors say openly that measurements from the flights show something inconvenient. On real hardware these assumptions are not met exactly. The sensor makes mistakes, and the drone does not fly exactly along the commanded route. The mathematics holds in the model. The model is close to reality, but it is not reality.
The paper lists three limitations. First, the planner does not guarantee that it will find a feasible route at every subsequent step. Second, the "worst-case reach" zones become too cautious in crowded spaces and leave the drone less room than it really needs. This shows in a simulation in which the obstacles were detected by the sensor alone, with no knowledge of their true position. Third, the assumptions of the theorem are strong: bounded obstacle speed and bounded measurement error.
There is also one detail from the experiments. In one of the flights with five obstacles, the sensor reported an approaching obstacle only just before the closest approach. The authors list such delayed detection among the known ways the system can fail. The drone hit nothing in those flights, but this case shows where a failure could come from.
The experiments were short, small-scale and conducted in controlled conditions. The authors announce further work: reducing the caution by predicting motion with machine-learning methods, accounting for measurement errors in the construction of the corridor itself, adding more drones and testing outdoors, in larger and more complicated environments.
Where it could be useful
MIT points to several uses. A drone flying into the heart of a forest fire, which has to dodge sudden flare-ups and falling branches. Scouting in a collapsed building. Exploring a mine through a network of hidden tunnels. Delivering parcels through a crowded neighbourhood. What these situations share is that the machine does not know the place and cannot afford a mistake.
In Poland the nearest fits are rescue work and mining, and that is my own association, not a conclusion of the authors. Nothing in the paper suggests that anyone in Poland has tested the solution. It is worth knowing, though, that the planner's code has been made available. Teams at other universities, including European ones, can therefore try it on their own drones. That is the shortest path from paper to practice: not a sale, but replication of the result.
Fei Gao of Zhejiang University, who was not involved in the study, judges that the combination of planning in time and space, formal safety analysis and hardware tests gives a practical approach to autonomous flight in complex, changing environments. This is the opinion of an independent researcher, included in MIT's press material.
The research was funded in part by Singapore's Defence Science and Technology Agency (DSTA). About a company or spin-off that would deploy the planner, the available sources say nothing.
Maturity: TRL 4
On the technology readiness scale this is TRL 4. A prototype works in a controlled laboratory environment: a drone with a full onboard setup, twelve flights among moving obstacles, a mathematical proof and code to repeat it. What is missing for TRL 5 and 6 are tests outside a controlled laboratory, in smoke, in wind and with obstacles that move faster than assumed. Also missing is an answer to what happens when the sensor shows an obstacle too late or not at all.
The most important lesson is more modest than the slogan "a route without collisions" suggests. It has been shown that a planner can guarantee safety under openly stated assumptions, and that such a planner computes in real time onboard. This is not a drone that will never crash. It is a drone that says under what conditions it will not crash. In safety engineering, that openness is worth a lot.
Bibliography
- Kondo K., Tordesillas J., Rached J., Sun L., Jia Y., How J. P. SANDO: Safe Autonomous Trajectory Planning for Dynamic Unknown Environments. IEEE Transactions on Robotics (2026). DOI: 10.1109/TRO.2026.3738474
- Kondo K., Tordesillas J., Rached J., Sun L., Jia Y., How J. P. SANDO: Safe Autonomous Trajectory Planning for Dynamic Unknown Environments (preprint). arXiv (2026). DOI: 10.48550/arXiv.2604.07599
- Zewe A. Planning system ensures a robot's flight path will remain collision-free. MIT News, 7 October 2026. news.mit.edu
Comments· 0
No comments yet. Be the first.