1. Soft Walls: Algorithms to Enforce Aviation Security Adam Cataldo Prof. Edward Lee Prof. Shankar Sastry August 24, 2004 Berkeley, CA Center for Hybrid and Embedded Software Systems

2. Outline The Soft Walls system Objections Control system design Current research Conclusions

3. A Deadly Weapon? Project started September 11, 2001

4. Introduction On-board database with “no-fly-zones” Enforce no-fly zones through avionics

5. Dragonfly 3 Dragonfly 2 Ground Station Early Prototype Using Stanford DragonFly UAVs [Claire Tomlin, Jung Soon Jang, Rodney Teo]

6. Flight Test Result Nov 19 th, 2003 Moffett Federal Air Field

7. Another Early Prototype, Demo’d by Honeywell on National TV, Dec., 2003 Based on advanced ground avoidance system Issues a warning when approaching terrain or a no-fly zone Takes over control from the pilot when approach is too close Returns control to the pilot after diverting Demonstrated on ABC World News Tonight Dec. 30, 2003 Honeywell pilot on ABC World News Tonight with Peter Jennings, Dec. 30, 2003.

8. Both Prototypes use Autonomous Control Pilot or Path Planning Controller Aircraft Soft Walls controller

9. Our End Objective is Not Autonomous Control but a Blending Controller Pilot Aircraft Soft Walls + bias pilot control as needed

10. Our End Objective Maximize Pilot Authority, but keep outside forbidden airspace

11. Unsaturated Control No-fly zone Control applied Pilot remains neutral Pilot turns away from no-fly zone Pilot aims for no-fly zone

12. In the News ABC World News Tonight with Peter Jennings –Dec. 30, 2003 Radio Interviews –Voice of America, Dec. 6, 2003. –NPR Marketplace –WTOP, Washington DC, July 14, 2003 –As It Happens, CBC, July 9, 2003 Magazines –New Scientist, July 2, 2003 –Salon, December 13, 2001 –Slashdot, July 3, 2003 –Slashdot, Jan 3, 2004 Newspapers –New York Times, April 11, 2002 –Toronto Globe and Mail –The Washington Times –The Orlando Sentinel –The Straits Times (Singapore) –The Times of India –The Star (South Africa) –The Age (Australia) –Reuters, July 2, 2003 Graphic on ABC World News Tonight with Peter Jennings, Dec. 30, 2003.

14. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies

15. There is No Emergency That Justifies Attempting to Land on Fifth Ave. Flying in certian regions of space is unacceptable Regulatory bodies must not overconstrain the air space A pilot flying over restricted airspace risks the aircraft being shot down

16. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –pilots want a switch in the cockpit

17. No override switch enables transit through here Terrain imposes “hard wall” constraints on airspace Soft Walls impose more gentle contraints on airspace Again, regulatory bodies should not overconstrain the airspace

18. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –pilots want a switch in the cockpit Localization technology can fail –GPS can be jammed

19. Localization Backup Radio beacons Inertial navigation –drift limits accuracy –affects the geometry of no-fly zones

20. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –pilots want a switch in the cockpit Localization technology can fail –GPS can be jammed Deployment could be costly –Software certification? Retrofit older aircraft?

21. Deployment Fly-by-wire aircraft –a software change –which is of course extremely costly Older aircraft –autopilot level? –Honeywell prototype? Phase in –prioritize airports

22. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –pilots want a switch in the cockpit Localization technology could fail –GPS can be jammed Deployment could be costly –how to retrofit older aircraft? Complexity –software certification

23. Not As Complex as Air Traffic Control Self-contained avionics system (not multi- vehicle) Human factors is an issue: –pilot training? –air traffic controller training?

24. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –pilots want a switch in the cockpit Localization technology could fail –GPS can be jammed Deployment could be costly –how to retrofit older aircraft? Deployment could take too long –software certification Fully automatic flight control is possible –throw a switch on the ground, take over plane

25. Potential Problems with Ground Control Human-in-the-loop delay on the ground –authorization for takeover –delay recognizing the threat Security problem on the ground –hijacking from the ground? –takeover of entire fleet at once? Requires radio communication –hackable –jammable

26. Relationship to Flight Envelope Protection With flight envelope protection, the limits on pilot-induced maneuvers are known Knowing these limits enables tighter tolerances, and hence tighter geometries for no-fly zones. see http://softwalls.eecs.berkeley.edu for FAQ

27. Here’s How It Works

28. Safe Control Design No-fly zone Backwards reachable set At some points, the pilot can fly into the no-fly zone even with Soft Walls bias Can prevent aircraft from entering the backwards reachable set: This set is avoidable

29. Control Design Components Make controller push aircraft away from no- fly zone (easy) Find avoidable set containing no-fly zone (hard) Apply control only when aircraft gets near avoidable set No-fly zone Avoidable Set

30. Numerical Aproach (Mitchell, Tomlin, …) No-fly zoneBackwards Reachable Set Approximate the “optimal” backwards reachable set and corresponding controller numerically Store this information in a look-up table Storage requirements are prohibitive

31. Theorem [Computing ]: where is the unique viscosity solution to: The Backwards Reachable Set for the Stanford no-fly Ellipse

32. Analytic Methods (Leitmann, Skowronski, …) No-fly zone Pilot always turns into the no-fly zone Calculate a controller and avoidable set analytically This tends to give simple control laws This is hard when the model is complex Example

33. The Research Goal Find an easy-to-implement method which: –Guarantees safety –Includes the corresponding avoidable set

34. The Soft Walls Goal Increase security of the airspace Maintain as much pilot authority as possible

35. Acknowledgements Ian Mitchell Aaron Ames George Pappas Xiaojun Liu Steve Neuendorffer Claire Tomlin