“Guaranteed not to crash” is the sort of sentence that makes an engineer reach for the footnotes.

On 7 October 2026, MIT News described a new autonomous drone planner called SANDO as mathematically proven to avoid collisions in unknown environments with moving obstacles. The underlying research is real and unusually rigorous. It is also more specific than a headline can convey.

SANDO does not create a force field around a drone. It computes a collision-free trajectory for a defined planning horizon, under explicit assumptions about how fast obstacles can move, how accurately they are detected, how large they are and how closely the aircraft follows its commanded path. The distinction is not a technical escape clause. It is the difference between a useful safety theorem and a promise about every real flight.

What the researchers built

The open SANDO paper, last revised on 25 September 2026 and published in IEEE Transactions on Robotics, describes a planner for three-dimensional environments that have not been mapped in advance and may contain moving obstacles.

A planned path can become unsafe seconds after it is calculated if a person, vehicle or other object moves into it. SANDO addresses that problem by repeatedly rebuilding a safe corridor through space and time rather than treating free space as permanently free.

The system combines three main elements:

• A heat-map global planner steers the route away from dense or high-risk regions.
• Spatiotemporal safe flight corridors divide the possible route into regions that are free at particular times, accounting for how far a moving obstacle could travel.
• Hard-constrained trajectory optimisation keeps the computed flight path inside those corridors instead of merely adding a soft penalty for getting too close.

The practical difference between a soft and hard constraint is important. A soft constraint tells an optimiser that a collision is very undesirable but may still be traded against other goals. A hard constraint rejects a trajectory that violates the defined safety boundary.

SANDO processes point clouds from LiDAR and/or depth cameras, tracks dynamic obstacles, predicts a bounded region they could reach and replans onboard. In the hardware configuration reported by the researchers, planning, perception and localisation ran on the aircraft using a LiDAR sensor and an Intel NUC computer.

The word “guarantee” has a precise boundary

The paper’s formal result is not simply “the drone will never hit anything.” It states that a trajectory produced by the optimiser is collision-free for the duration of that trajectory, provided the theorem’s assumptions and corridor construction hold.

For tracked moving obstacles, the system expands each obstacle’s estimated region by several buffers: how far it could move within each time layer, a bound for position-estimation error and the physical size of the aircraft. For untracked obstacles, the guarantee additionally depends on unknown-space inflation being enabled and on untracked objects remaining within the region classified as unknown.

That is a genuine guarantee about a mathematical model and its inputs. It is not a guarantee that a camera or LiDAR will always detect every object, that an obstacle will obey the assumed speed limit, or that the controller will perfectly track the planned curve.

Five assumptions do the heavy lifting

The paper’s safety analysis makes the conditions unusually visible.

1. Obstacles have a bounded maximum speed

SANDO does not need to know an obstacle’s exact future route. Instead, it calculates the region the obstacle could reach if it moved anywhere up to a specified speed bound. If the real obstacle can move faster than that bound, the calculated region may be too small.

2. Position error is bounded

The estimated location of a tracked obstacle can be wrong, but the error must remain within a known limit. The corridor is enlarged to absorb that uncertainty. A bound is useful only if it covers the errors the real sensor and tracker can produce.

3. Estimated obstacle size is not too small

The tracker’s bounding box must contain the true obstacle. An underestimated object can protrude into space the planner considers clear.

4. Tracking error is covered

The theorem initially assumes that the aircraft follows the planned trajectory exactly. The authors acknowledge that real controllers do not. They explain that the error buffer can cover combined perception and tracking error if it is set large enough. In their hardware tests, they used a 0.3-metre estimation buffer.

5. Untracked obstacles remain in unknown space

For the guarantee to include an object that is not currently tracked, that object must be wholly inside the region treated as unobserved when planning begins. If the environment representation incorrectly labels occupied space as free, no path planner can repair that false premise by mathematics alone.

These conditions do not make the proof weak. They make it auditable. A formal safety claim becomes useful when a reviewer can identify exactly which real-world measurements and failure modes must be controlled for the theorem to apply.

Safe for this horizon is not safe forever

SANDO repeatedly plans short horizons. Each successful replan extends the collision-free trajectory into the future. The paper is explicit, however, that it does not prove recursive feasibility: it cannot guarantee that a new feasible trajectory will exist at every future replanning step.

The current guarantee lasts to the terminal stopping state of the active plan. If a new plan cannot be found, the implementation continues along the previous valid trajectory; if no valid trajectory remains, the aircraft hovers. In a sufficiently constrained or rapidly changing environment, reaching a destination may become impossible even when the current segment remains safe.

This distinction separates collision avoidance from mission completion. A planner can correctly decide that the safe action is to stop rather than continue.

What the experiments showed

The paper reports a broad simulation programme and 18 hardware flights: six in static indoor environments and twelve among dynamic obstacles. Its abstract says SANDO achieved a 100% success rate across the reported forest and dynamic simulation benchmark difficulty levels without constraint violations. The real aircraft completed all 18 reported flights without a collision.

Those results are evidence that the method worked in the tested conditions, not a reliability rate for public deployment. Eighteen flights cannot establish performance across every sensor failure, weather condition, outdoor environment, obstacle type or aircraft.

The hardware section contains an especially important caveat. The researchers write that the formal guarantee did not strictly hold on their real platform because estimation and tracking assumptions were not satisfied exactly. The 0.3-metre buffer, obstacle inflation and continuous replanning still produced collision-free navigation in the experiments, but practical success and formal compliance are not identical claims.

The paper also reports that failed replans became more frequent in denser scenes, reaching 21.5% in one experiment. A failed replan did not immediately create a collision because the aircraft retained its previous valid trajectory. It does show why a safety story must include the fallback behaviour, not just the success of the optimiser.

Why this is not the same as consumer obstacle avoidance

A consumer drone may advertise forward, downward or omnidirectional obstacle sensing. That label describes sensor coverage and product behaviour, not the formal guarantee studied here.

SANDO’s hardware platform used a 360-degree LiDAR, onboard localisation, substantial computing hardware and a planner built around explicit uncertainty and speed bounds. The study does not show that an ordinary camera-equipped drone has acquired the same protection, and it does not convert a manufacturer obstacle-sensing mode into permission for autonomous BVLOS operation.

This is also different from the familiar warning that sensors may miss wires, glass or low-contrast surfaces. That warning concerns whether the world is perceived correctly. SANDO asks the next question: once obstacles and uncertainty have been represented, can the planner construct a continuously collision-free trajectory through a changing environment? Perception and planning are connected, but success in one layer cannot substitute for the other.

How to read the next “provably safe” robotics headline

1. What exactly is guaranteed? A trajectory segment, a controller, an entire mission or a probability threshold?
2. For how long? A fixed planning horizon is different from indefinite safe operation.
3. Under which assumptions? Look for bounds on speed, size, sensing error, tracking error and communication delay.
4. What happens when an assumption fails? Buffers, stopping trajectories, hovering and degraded modes are part of the safety case.
5. What evidence exists outside simulation? Count the physical trials, inspect the environment and identify which conditions were not tested.
6. Does the result apply to the product in front of you? A research platform, sensor suite and computing stack cannot be silently transferred to another aircraft.

A proof is valuable because it has edges

The interesting achievement in SANDO is not that it abolishes uncertainty. It turns several uncertainties into explicit bounds and then proves something useful inside them.

That makes the research more credible, not less. The safest response to a strong claim is neither blind belief nor cynical dismissal. It is to ask where the theorem begins, where it ends and whether the real system keeps every assumption inside the line.

Scope note: This article analyses the SANDO v3 research paper and MIT’s 7 October 2026 report, rechecked on 15 October 2026. It does not report independent flight testing, certify the system or claim that SANDO is available on consumer drones.