Autonomy and sense-and-avoid

The wildfire mapping aircraft will fly beyond the pilot's sight, at night, over the tallgrass prairie of the Flint Hills, in airspace shared with water bombers, bird-dog aircraft, firefighting helicopters and, now and then, a Bluestem Air Medical air ambulance. Rachel Oduya puts the problem plainly at the first design review: a crewed aircraft relies on its pilot to see and avoid other traffic, and the drone has no pilot on board to look out of the window. Whatever replaces the pilot's eyes must be shown to work, and the aircraft must behave predictably when something fails. Élise gives Arjun the job of writing the safety requirements for detect and avoid and for the aircraft's automatic behaviors.

Levels of autonomy

Autonomy is not one thing. At the bottom, a remotely piloted aircraft has a stabilizing flight controller, and the pilot flies it with sticks. Most small drones today fly with automated navigation: the pilot sets waypoints and the aircraft flies the route, holds altitude and returns home on command, while the pilot monitors and intervenes. Higher levels add onboard decisions: replanning around a detected obstacle, choosing a landing site after a failure, or managing several aircraft at once with one supervisor. In every civil framework today, a human remains responsible for the flight, whether as remote pilot in command or as an operator supervising several aircraft. Engineering for autonomy is therefore about making the aircraft's automatic behavior safe and predictable, and making the human's role clear.

A useful way to organize the design is the sense, decide, act loop. The aircraft senses its own state with inertial, satellite and air-data sensors, and senses its surroundings with cameras, radar or cooperative signals. It decides, using rules or algorithms, whether its current plan is still safe. It acts through the flight controller. The human may be in the loop (approving each action), on the loop (supervising and able to intervene), or out of the loop for fast reflexes such as attitude control. Detect and avoid usually puts the human on the loop for a remotely piloted aircraft, with automatic avoidance as a backup if the link is lost or the time is too short.

What sense-and-avoid must do

For crewed aircraft under visual rules, the pilot's duty to see and avoid is written into the operating rules. A drone flying beyond visual line of sight needs a detect and avoid capability that does the same job: detect other aircraft, judge whether they are a threat, and maneuver to stay clear. The functions are often split into two layers. Remaining well clear keeps a defined separation, a protective volume around the drone that other aircraft should not enter, by maneuvering early and gently. Collision avoidance is the last-moment action to prevent a near mid-air collision if remaining well clear has failed. For small drones, a commonly used well-clear definition, from an industry consensus standard for small-UAS detect and avoid, is 2000 ft (610 m) horizontally and 250 ft (76 m) vertically. A near mid-air collision is usually defined as closer than 500 ft horizontally and 100 ft vertically.

Intruders come in two kinds. Cooperative aircraft carry transponders or broadcast their position with ADS-B Out, so a receiver on the drone or on the ground can track them at long range. Non-cooperative aircraft carry no such equipment: gliders, balloons, many agricultural aircraft, older light aircraft and some helicopters. They must be detected by radar, cameras or acoustic sensors. The wildfire environment includes both, and firefighting aircraft operating under temporary flight restrictions may not broadcast at all.

The timeline

The core of a detect and avoid requirement is a time budget. From the moment an intruder is first detected, the system must confirm a track, decide whether the intruder is a threat, send or compute the avoidance command, and complete the maneuver before the protected volume is breached. Each step takes time, and the closing speed turns time into distance:

The time to collision on a straight closing course is \(\tau = R/V_{\text{close}}\). Collision avoidance systems on crewed aircraft use a modified version of \(\tau\) as their main trigger, because it measures urgency rather than distance.

# Detect-and-avoid timeline for a small UAS meeting a crewed aircraft: required detection range and time to collision.
import math
kt = 0.5144
V_uas = 15.0                                  # drone ground speed (m/s)
t_track, t_decide, t_link = 4.0, 3.0, 2.0     # confirm a track, decide (automatic or remote pilot), command latency (s)
climb = 3.0                                   # vertical rate the drone can command away from the threat (m/s)
well_clear_h, well_clear_v = 610.0, 76.0      # small UAS well clear: 2000 ft horizontal, 250 ft vertical
def avoid_time(dv):                       # time to open the required vertical gap at the commanded rate
    return dv / climb
print("Head-on encounters (worst case: speeds add)")
print("  intruder              closing m/s   tau to collision at 3 km   range needed to stay well clear")
for name, v in (("Agricultural aircraft 110 kt", 110 * kt), ("Medevac helicopter 140 kt", 140 * kt),
                ("Light fixed-wing 120 kt", 120 * kt), ("Twin turboprop 200 kt", 200 * kt)):
    Vc = v + V_uas
    t_total = t_track + t_decide + t_link + avoid_time(well_clear_v)
    R_req = Vc * t_total + well_clear_h
    print(f"  {name:30s} {Vc:6.1f}         {3000/Vc:6.1f} s                 {R_req/1000:5.2f} km")
print()
print("Sensor declaration ranges against a light fixed-wing aircraft (representative, clear daytime air):")
for name, r in (("ADS-B In receiver (cooperative traffic only)", 20000.0), ("Ground-based radar network", 8000.0),
                ("Airborne radar, small", 2000.0), ("Electro-optical camera", 1500.0), ("Acoustic array", 600.0)):
    Vc = 120 * kt + V_uas
    print(f"  {name:44s} {r/1000:5.1f} km -> warning time {r/Vc:5.1f} s")
print()
# closest point of approach for a crossing geometry
def cpa(p1, v1, p2, v2):
    dp = [p2[i] - p1[i] for i in range(2)]; dv = [v2[i] - v1[i] for i in range(2)]
    t = -(dp[0]*dv[0] + dp[1]*dv[1]) / (dv[0]**2 + dv[1]**2)
    d = math.hypot(dp[0] + dv[0]*t, dp[1] + dv[1]*t)
    return t, d
t, d = cpa((0, 0), (V_uas, 0), (900, -3000), (0, 120 * kt))
print(f"Crossing case: drone east at {V_uas:.0f} m/s, fixed-wing aircraft flying north at 120 kt, starting 0.9 km east and 3 km south")
print(f"  closest approach {d:.0f} m after {t:.1f} s")
print(f"  if detected at 1.5 km the drone has {1500/math.hypot(V_uas, 120*kt) - (t_track + t_decide + t_link):.1f} s left to climb or descend {well_clear_v:.0f} m;")
print(f"  at {climb:.0f} m/s it needs {well_clear_v/climb:.1f} s, so a camera alone cannot keep this encounter well clear")

Head-on encounters (worst case: speeds add)
  intruder              closing m/s   tau to collision at 3 km   range needed to stay well clear
  Agricultural aircraft 110 kt     71.6           41.9 s                  3.07 km
  Medevac helicopter 140 kt        87.0           34.5 s                  3.60 km
  Light fixed-wing 120 kt          76.7           39.1 s                  3.24 km
  Twin turboprop 200 kt           117.9           25.4 s                  4.66 km

Sensor declaration ranges against a light fixed-wing aircraft (representative, clear daytime air):
  ADS-B In receiver (cooperative traffic only)  20.0 km -> warning time 260.7 s
  Ground-based radar network                     8.0 km -> warning time 104.3 s
  Airborne radar, small                          2.0 km -> warning time  26.1 s
  Electro-optical camera                         1.5 km -> warning time  19.5 s
  Acoustic array                                 0.6 km -> warning time   7.8 s

Crossing case: drone east at 15 m/s, fixed-wing aircraft flying north at 120 kt, starting 0.9 km east and 3 km south
  closest approach 166 m after 49.2 s
  if detected at 1.5 km the drone has 14.6 s left to climb or descend 76 m;
  at 3 m/s it needs 25.3 s, so a camera alone cannot keep this encounter well clear

The first block assumes 4 seconds to confirm a track, 3 seconds to decide, 2 seconds of link and actuation latency, and a climb or descent at 3 m/s to open a vertical gap of 76 m, which takes 25 seconds. Against a light fixed-wing aircraft at 120 knots, the drone needs to detect the intruder 3.2 km away; against a 200-knot turboprop, 4.7 km. These distances are far larger than those a small drone's own sensors can manage against a non-cooperative target. The second block converts sensor ranges into warning time: an onboard camera at 1.5 km gives under 20 seconds, a small radar at 2 km about 26 seconds, while a ground-based radar network or ADS-B reception gives minutes.

The crossing case shows why geometry matters. A fixed-wing aircraft flying north at 120 knots and a drone flying east at 15 m/s would pass 166 m apart in 49 seconds: a near mid-air collision. Detected by a camera at 1.5 km, the drone would have only 14.6 seconds after the processing delays, but needs 25 seconds to climb 76 m. A camera alone cannot keep this encounter well clear. Options include a faster vertical maneuver, a horizontal turn away, earlier detection from a ground radar, or reducing the chance of an encounter in the first place by flying where and when crewed traffic is unlikely.

Sensors and their limits

No single sensor covers everything, so practical systems combine them. A common architecture for beyond-visual-line-of-sight work uses ground-based radar covering the operating area, an ADS-B receiver on the aircraft or the ground, and procedures that keep the drone low, below most crewed traffic, with quick descent as the main avoidance maneuver. A strategic layer comes first: planning routes and times to avoid known traffic, coordinating with air traffic services and with other airspace users, and publishing the operation in notices to airmen. Strategic mitigation reduces the encounter rate; tactical detect and avoid handles the encounters that remain.

Contingencies and failure modes

Autonomy is tested most by failures. The design must define, for every credible failure, what the aircraft does, and the behavior must be predictable to the remote pilot and to air traffic services. Common cases include loss of the command and control link (fly a preset route, often return to a holding point and then land at a planned site), loss of satellite navigation (switch to inertial and visual navigation, climb or hold, and land when position confidence falls below a threshold), low battery (return or land at the nearest safe site), motor or propulsion failure (for a quadplane, glide on the wing to a landing site or deploy a parachute), and fly-away, where the aircraft does not respond correctly to commands (terminate the flight within a defined boundary). A geofence and flight termination system that is independent of the main flight controller gives confidence that the aircraft cannot leave its approved volume even if its main software fails.

Software deserves special attention. The flight control software is safety-critical, and its development assurance must match the hazard: for crewed aircraft, standards such as DO-178C set objectives by software level. Machine-learning components, such as a neural network that detects aircraft in camera images, are harder to assure, because their behavior depends on training data rather than on requirements that can be traced to code. Regulators and industry groups are developing guidance; in the meantime, designers bound such components with simpler monitors, test them against large sets of recorded encounters, and give them limited authority.

Remote identification and traffic management

Other airspace users and authorities also need to know where drones are. Remote identification broadcasts a drone's identity and position, and the position of its control station, so that authorities can tell who is flying. In the United States, broadcast Remote ID has been required for most registered drones since 2023, with enforcement from March 2024. A traffic management system for uncrewed aircraft (UTM) goes further, sharing intended flight plans among operators through service providers so that conflicts are resolved before take-off. Both countries are developing UTM services; the FAA is responsible for drone access to controlled airspace in US drone rules. Lesson 11 covers the rules.