1. Softwalls: Preventing Aircraft from Entering Unauthorized Airspace Adam Cataldo Prof. Edward Lee Prof. Ian Mitchell, UBC Prof. Shankar Sastry NASA JUP Sep 26, 2003 Los Angeles, CA

2. Outline Introduction to Softwalls Objections Control system progress Future challenges Conclusions

3. Introduction On-board database with “no-fly-zones” Enforce no-fly zones using on-board avionics Non-networked, non-hackable

4. Autonomous control Pilot Aircraft Autonomous controller

5. Softwalls is not autonomous control Pilot Aircraft Softwalls + bias pilot control

6. Relation to Unmanned Aircraft Not an unmanned strategy –pilot authority Collision avoidance

7. A deadly weapon? Project started September 11, 2001

8. Design Objectives Maximize Pilot Authority!

9. Unsaturated Control No-fly zone Control applied Pilot lets off controls Pilot turns away from no-fly zone Pilot tries to fly into no-fly zone

10. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies

11. There is No Emergency That Justifies Landing Here

12. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –switch in the cockpit

13. Hardwall

14. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –switch in the cockpit Localization technology could fail –GPS can be jammed

15. Localization Backup Inertial navigation Integrator drift limits accuracy range

16. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –switch in the cockpit Localization technology could fail –GPS can be jammed Deployment could be costly –Software certification? Retrofit older aircraft?

17. Deployment Fly-by-wire aircraft –a software change Older aircraft –autopilot level Phase in –prioritize airports

18. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –switch in the cockpit Localization technology could fail –GPS can be jammed Deployment could be costly –how to retrofit older aircraft? Complexity –software certification

19. Not Like Air Traffic Control Much Simpler No need for air traffic controller certification

20. Objections Reducing pilot control is dangerous –reduces ability to respond to emergencies There is no override –switch in the cockpit Localization technology could fail –GPS can be jammed Deployment could be costly –how to retrofit older aircraft? Deployment could take too long –software certification Fully automatic flight control is possible –throw a switch on the ground, take over plane

21. Potential Problems with Ground Control Human-in-the-loop delay on the ground –authorization for takeover –delay recognizing the threat Security problem on the ground –hijacking from the ground? –takeover of entire fleet at once? –coup d’etat? Requires radio communication –hackable –jammable

22. Here’s How It Works

23. Reachable Set starting at a point in the state space set of all points reachable with some control input reachable set

24. Backwards Reachable Set given a final point in the state space set of all states that can reach the final point for some control input backwards reachable set

25. Backwards Reachable Set No-fly zone Backwards reachable set Safe States States that can reach the no-fly zone when control is applied Can prevent aircraft from entering no-fly zone

26. Implicit Surface Functions No-fly zone implicit surface function for no-fly zone Backwards Reachable Set implicit surface function for backwards reachable set

27. Analytic Solution Hamilton-Jacobi-Isaacs PDE no-fly zone implicit surface function dynamics backwards reachable set implicit surface function Tomlin, Lygeros, Sastry v

28. Control from Implicit Surface Function Backwards Reachable Set Safe States Control at boundary Control decreases to zero

29. Numerical Solution Mitchell states 1 234 computations & storage

30. Assumptions for Verification The pilot and control inputs could be any bounded, measurable functions

31. In Fly-By-Wire Aircraft The pilot and control inputs will be piecewise constant, bounded functions which can change only every T milliseconds T

32. Fly-By-Wire Aircraft How do we verify this?

33. In the News ABC News NPR Market Place CBC As It Happens Slashdot Reuters…

34. Conclusions Embedded control system challenge Control theory identified Future challenges identified

35. Acknowledgements Xiaojun Liu Steve Neuendorffer Claire Tomlin

36. Backup Discrete-Time Modified HJI PDE