Control Strategies for Restricting
the Navigable Airspace of
Commercial Aircraft
Adam Cataldo and
Edward Lee
NASA JUP Meeting
28 March 2003
Stanford, CA
Outline
• Soft Walls Problem
• Solution with Level Set Methods
• Moving Forward
Softwalls
• Carry on-board a 3-D database with
“no-fly-zones”
• Enforce no-fly zones using on-board avionics
(aviation electronics)
• Non-networked, non-hackable
Design Objectives
Maximize Pilot Authority!
Design Objectives
• Apply zero bias when possible
– For all pilot actions, controller can still prevent
entry into the no-fly zone
• Bias pilot’s input with a control input
– Do not attenuate pilot control
– Do not make instantaneous changes in bias
• Give pilot maximum authority
– Can always turn away from the no-fly zone
– Prevent controls from saturating
Unsaturated Control
Even under the maximum control bias,
the pilot can make a sharper turn away
from the no-fly zone
No-fly
zone
Sailing Analogy – Weather Helm
with
straight
rudder
Even with weather helm, the
craft responds to fine-grain
control as expected.
force of
the wind on
the sails
with turned
rudder
turned
rudder
keeps the
trajectory
straight
Discussion
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
Is There Any Aircraft Emergency that
Justifies Trying to Land on Fifth Ave?
Discussion
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
• There is no override
– switch in the cockpit
No-Fly Zone with Harsher Enforcement
There is no
override in the
cockpit that
allows pilots to
fly through
this.
Objections
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
• There is no override
– switch in the cockpit
• Localization technology could fail
– GPS can be jammed
Localization Backup
Inertial navigation provides backup
to GPS. Drift implies that when
GPS fails, aircraft has limited time
to safely approach urban airports.
Objections
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
• There is no override
– switch in the cockpit
• Localization technology could fail
– GPS can be jammed
• Deployment could be costly
– Software certification? Retrofit older aircraft?
Deployment
• Fly-by-wire aircraft
– a software change
• Older aircraft
– autopilot level
• Phase in
– prioritize airports
$4 billion development effort
40-50% system integration & validation cost
Objections
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
• There is no override
– switch in the cockpit
• Localization technology could fail
– GPS can be jammed
• Deployment could be costly
– how to retrofit older aircraft?
• Complexity
– software certification
Not Like Air Traffic Control
This seems entirely
independent of air
traffic control, and
could complement
safety methods
deployed there.
Self-contained on a
single aircraft.
Objections
• Reducing pilot control is dangerous
– reduces ability to respond to emergencies
• There is no override
– switch in the cockpit
• Localization technology could fail
– GPS can be jammed
• Deployment could be costly
– how to retrofit older aircraft?
• Deployment could take too long
– software certification
• Fully automatic flight control is possible
– throw a switch on the ground, take over plane
UAV Technology
Northrop Grumman argues
that the Global Hawk UAV
system can be dropped-in
to passenger airliners.
Potential Problems with Ground Control
• Human-in-the-loop delay on the ground
– authorization for takeover
– delay recognizing the threat
• Security problem on the ground
– hijacking from the ground?
– takeover of entire fleet at once?
– coup d’etat?
• Requires radio communication
– hackable
– jammable
Outline
• Soft Walls Problem
• Solution with Level Set Methods
–
–
–
Backwards Reachable Set in Soft Walls
Finding the Backwards Reachable Set with Level
Set Methods
Control from Implicit Surface Function
• Moving Forward
Backwards Reachable Sets
(Tomlin, Lygeros, Sastry)
• We model the aircraft the dynamics as:
where x is the state, uc is the control input,
and up is the pilot input
• Let X be the set of all possible states
• Let the target set G(0) describe the no-fly
zone, where
Backwards Reachable Sets
(Tomlin, Lygeros, Sastry)
The backwards reachable set is the set of
states for which safety cannot be guaranteed
for all possible disturbances
Reachable set
Target Set
(unsafe states)
Safe States
Backwards Reachable Sets
(Tomlin, Lygeros, Sastry)
• We denote the backwards reachable set G
• The backwards reachable set is the set of
states such that for all controls uc there
exists a disturbance up which drives the state
into the target set
• For any state outside the reachable set, we
can find a control input that can guarantee
the state is kept outside the reachable set
Backwards Reachable Sets
(Tomlin, Lygeros, Sastry)
• The set G(t) represents the set of states such
that for all controls uc there exists a
disturbance up which drives the state into
the target set in time t or less
G = G()
G(t2) G(t1)
0 < t1 < t2 < 
G(0)
Finding the Reachable Set
(Mitchell, Tomlin)
• Given the target set G(0), we create a cost function
g(x)
• g(x) <= 0 if and only if x
 G(0)
g(x)
Go
Finding the Reachable Set
(Mitchell, Tomlin)
• We solve for (x,t) from the Hamilton-Jacobi-Isaacs
PDE
where
• Then (x,t) <= 0 if and only if x in G(t)
Finding the Reachable Set
(Mitchell, Tomlin)
• Solving for (x,) gives us G = G() since (x,t) <= 0
if and only if x in G(t)
• We can solve (x,) numerically using level-set PDE
techniques
Control from Implicit Surface
• Make g(x) so that its magnitude is the distance from
the target set boundary
• Then g(x) is a signed distance function since it is
positive outside the target set and negative inside
the target set
• We can compute (x,) such that it is also a signed
distance function
Control from Implicit Surface
• If (x,) is decreasing, the aircraft is approaching
the reacable set
• We choose a bias such that when (x,) = 0
• We start biasing the aircraft at the first state which
satisfies (x,) = d
• We increase the bias as (x,) approaches 0
Demo
Outline
• Soft Walls Problem
• Solution with Level Set Methods
–
–
–
Backwards Reachable Set in Soft Walls
Finding the Backwards Reachable Set with Level
Set Methods
Control from Implicit Surface Function
• Moving Forward
–
–
–
Dynamics Model
Simulation Interface
Prototype
Dynamics Model
• We used this simple dynamics model,
because the level-set computations work
only for a small dimension
V

pilot input
control input
Dynamics Model
(Menon, Sweriduk, Sridhar)
• A more realistic model
–
–
–
–
–
–
–
–
–
Thrust T
Drag D
Mass m
Flight Path Angle 
Bank Angle 
Fuel Flow Rate Q
Lift L
Load Factor n
Height h
Dynamics Model
(Menon, Sweriduk, Sridhar)
rudder and ailerons
control input
elevator
throttle
pilot input
We are considering control strategies that
scale better to the higher dimensions of
this model
Simulation Interface
• Soft Walls interface for Microsoft Flight
Simulator
• Real-time controller created in Ptolemy II
Prototype
(Richard Murray, in conjunction with SEC)
• Hovercraft with controlled by two fans
• Test bed for Soft Walls algorithm
• Remote driver can steer craft while a control
bias prevents collision with a wall
Acknowledgements
•
•
•
•
•
•
•
Ian Mitchell
Iman Ahmadi
Zhongning Chen
Xiaojun Liu
Steve Neuendorffer
Shankar Sastry
Clair Tomlin