Off-nominal Trajectory Computation Applied to

Unmanned Aircraft System Traffic Management

Mauricio Castillo-Effen, Liling Ren, and Han Yu Corey A. Ippolito

GE Global Research Center NASA Ames Research Center

Niskayuna, NY, 12309 Moffet Field, CA, 94305

Abstract—An Unmanned Aircraft System (UAS) Traffic

Management System (UTM) relies significantly on automation, introducing the need for efficient and accurate trajectory computation to enable coordination and

safety. The main objective of this paper is to present

and to organize prior work and relevant concepts with

the goal of developing a framework for UAS trajectory

prediction in the presence of anomalous events. Literature

documenting UAS safety and risk assessment has provided

multiple pointers for identification and characterization of

system failures that cause trajectory deviations or changes

to its associated qualities. A UAS trajectory modeling

framework considering endogenous and exogenous factors

affecting the trajectory is introduced and used in this

exposition. In addition, a general formulation of the

trajectory computation challenge is presented along with

key requirements for potential solution approaches.

I. INTRODUCTION

An Unmanned Aircraft System (UAS) Traffic Management System (UTM) relies significantly on automation, introducing the need for efficient and accurate

trajectory computation to enable coordination and safety.

Computation of UAS trajectories under nominal conditions presents numerous technical challenges, particularly for small UASs (sUAS). Their relatively small

size and weight, relatively slow operating speeds, operations at relatively low altitudes, where wind patterns

are harder to characterize, are a few of the factors that

contribute to the complexity of the problem. Further,

commercial proliferation and a variety of applications

has engendered a large diversity of airframes, diversity

of control and guidance logic, diversity of schemes for

managing contingencies, etc. However, a more peculiar

aspect of the research agenda for trajectory prediction of

UAS is the consideration of anomalous events triggering

off-nominal conditions. UAS represent a relatively new

category of National Airspace System (NAS) users, and

in contrast to Conventionally Piloted Aircraft (CPA),

these systems are still evolving towards maturity in terms

of reliability and safety, as attested by multiple recent

safety-related studies and reports. Hence, the potential

trajectories followed by unmanned aircraft subject to

failures is important not only to manufacturers and

operators, who are preoccupied with design and operational safety, but also to other airspace users, and to

stakeholders on the ground.

The paper starts by introducing a UAS trajectory

modeling framework being developed for NASA’s UTM

project. Next, failure events are studied in the context

of current safety-related reports and hazards analysis.

Finally, the actual trajectory computation problem is

presented and formulated in a general manner. In the

last section, a brief review of current and past relevant

work is also included for interested readership.

II. UAS TRAJECTORY MODELING FRAMEWORK

Figure 1 (extracted from [1]) presents a general approach to UAS trajectory modeling, which is used as

the foundation for the analysis presented in this paper. It

shows at a high level all the factors that affect the UAS

trajectory. Factors inherent to the system (“endogenous”)

are shown in the inner and bottom blocks, including

items such as: flight dynamics, controls, navigation and

guidance, mission planning, etc. These elements represent models of UAS functions. Exogenous factors are

shown on the lateral sides. They include: system failure

hazards—the main concern for this paper, highlighted in

red, and environmental conditions.

Although failure mode analysis literature is focused

on aspects such as safety, regulations, integration of

UAS into the civil airspace, etc., in the context of this

research, it is used to identify key failure modes that

affect the trajectory. The safety perspective is also useful

for prioritization in terms of risk. Hence, modeling of

more common failures would need to be tackled first.

978-1-5386-0365-9/17/$31.00 ©2017 IEEE
System failures may be characterized using the reference

model stack introduced in Figure 1. This stack represents

a functional decomposition of the system model that is

suited to trajectory modeling and prediction.

Although environmental factors may cause the execution of trajectories in off-nominal modes (e.g.: due

to violation of aircraft performance limitations), those

cases are treated separately and are not considered in

this document, whose focus is system failures.

Fig. 1. Stack of factors influencing sUAS trajectory

As shown notionally in the upper portion of Figure 1,

trajectories produced by this process may be classified

into three broad categories depending on their deviation

from a nominal trajectory:

• Trajectories following the nominal trajectory within

prescribed bounds.

• Trajectories associated with degraded performance,

i.e.: trajectory containment bounds may not be

guaranteed.

• Trajectories presenting substantial deviations from

the nominal trajectory.

Since UAS present much more operational flexibility

than CPA, Ren et al. introduce the concept of a patternbased trajectory definition model with two salient features:

• Two 4D (4DT) trajectory constructs: A conventional one—defined by a 3D/4D path using explicit

trajectory objects, and an unconventional one that

incorporates abstract trajectory objects, including

spatial objects (e.g.: 3D volumes) that characterize

possible locations where UAS(s) may operate at a

given time.

• A series of “provisions” that accommodate supplementary information for mission-specific requirements. These information items contain parameters

and constraints that pertain to specific types of

missions and operations, for instance: ratio of vehicles per volume (for multi-UAS a.k.a “swarm” operations), population density for urban operations,

geometry and location of assets being surveilled by

industrial inspection drones, airspace restrictions,

etc. Flexibility conferred by the use of provisions

may be also utilized to embed information and

models necessary for trajectory prediction under

off-nominal conditions. Moreover, these provisions,

make the proposed framework extensible. For instance, it allows for more accurate computations

when higher fidelity models are available, or conversely, for simplified approximations when UASspecific data are limited.

The pattern-based trajectory definition model is shown

notionally in Figure 2

III. UAS FAILURE EVENTS

A. Safety-related Reports

Recent literature was studied to obtain a list of common UAS system failures that impact UAS trajectories. In [2], the authors analyze statistical properties of

UAS accidents and incidents and also a categorization

by occurrence type, phase of flight, and safety issue.

Characterization is performed in a comparative manner,

using CPA statistics as a baseline. Although the number

of cases analyzed is relatively small (152 cases in the

period between 2006 and 2015), the authors identify 20

relevant international databases that may be used as data

sources in future studies. In the absence of occurrence

classifications specific to UAS, those used by the Global

Safety Information Exchange (GSIE–detailed by IATA)

for CPA were applied, namely:

• Controlled Flight Into Terrain (CFIT)

• Loss Of Control–In-flight (LOC–I)

• Runway Safety (RS)

• Ground Safety (GS)

• Operational Damage (OD)

• Medical (MED)

• Unknown (UNK)

UAS flight was assumed to comprise four phases:

takeoff (including climb out), en-route (cruise), approach

(including descent), and landing. Four safety issues were
Fig. 2. Pattern-based trajectory definition model

considered: human factors (HF), organizational issues

(OI), equipment problems (EP), and environmental issues. Results show that the ratio of incidents to accidents,

74% to 26% is analogous to the ratio known for CAT

events. The relative ratios of incidents vs. accidents by

phase of flight is also similar. Discrepancies between

UASs and CPA arise in types of occurrences, where

OD and CFIT are twice as likely, and LOC-I more than

three times as likely. In terms of safety issues, equipment

problems (EP) accounts for 64% of all UAS events, in

contrast to CPA, where HF is the most relevant issue

(75%).

The work by Sharma et al. [3] also examined UASrelated incidents leveraging multiple databases, albeit

restricted to US territory. Sharma’s report focuses on two

types of incidents: Near Mid-Air Collisions (NMAC),

and National Airspace System (NAS) violations, both

hazards resulting from potential trajectory deviations.

Relevant information regarding time distribution and

location of the “sightings” may be obtained from this

report, for example:

• Most UAS-related events occurred between 2015

and 2016, which is consistent with the steady expansion of the UAS market.

• The highest number of reported events took place

in California, followed by New York. This may

coincide with the presence of metroplex areas in

those regions.

• Most events occurred in Class B airspace. The

majority of those incidents happened in the altitude

corridor between 1000 and 2000 feet AGL.

Although the example studies presented previously

provide information about potential consequences of

failures and risks, they do not provide much information

related to the source or cause of the observed deviations.

Hence, it was not possible to derive prioritization to

guide the development of specific models or approaches.

There is also work related to specific UAS vulnerabilities, as presented in [4], where the authors study

GPS-unavailability. Similarly, the work by Foster and

Hartman [5] studies the vortex ring state (VRS) and loss

of power in rotorcraft, as representative system failures.

B. Hazard Analysis

To understand how faults may affect specific UAS

functions, and ultimately their trajectory, we examined

reports that included safety analyses that connect, deviations with: potential causes, UAS functions, potential

consequences, and risk. Two examples of work that

document the functional decomposition methodology to

UAS are [6] and [7]. In [6], functional decomposition is

utilized in the context of a Functional Hazard Assessment following the Safety Assessment process outlined

in SAE ARP 4761 [8]. A similar methodology was

applied to the stack presented in Figure 1. A summarized

view of this analysis with examples is presented in Table I. Other sources that provided additional information

for the elaboration of a more comprehensive version of

Table I are: [9], [10], and [5].

The goal of this analysis is not to assess safety per

se, but rather, to identify failures causing trajectory

deviations, to categorize them and to categorize the

types of resulting deviations. Thus, categories of faults

correspond to elements of the trajectory prediction stack.

Resulting trajectory deviations may be grouped into three

categories:

A. Degraded execution. The mission can proceed with

some detriment to the ability of the aircraft to follow

the nominal trajectory. This may be interpreted as

a loss of quality or performance, which usually

manifests itself as a loss of accuracy (e.g.: Required

Navigation Performance (RNP)).

B. Fail-safe maneuvering. Detected failures trigger

mitigation measures such as deploying parachutes,

autorotation, emergency landing, etc. Management

of contingencies may be performed by automated
contingency management onboard the aircraft or by

an operator.

C. Uncontrolled flight. Failures cannot be mitigated

directly causing the aircraft to follow an unintended

path.

Downstream risk-related consequences of these deviations, such as violation of geofencing constraints, which

may ultimately lead to violation of airspace restrictions,

etc. are considered outside of the scope of this work.

IV. TRAJECTORY COMPUTATION

As mentioned earlier, computation of UAS trajectories

in off-nominal conditions has important uses, and it may

be deemed as a key capability for the safe operation of

UTM, and ultimately, for the safe integration of UAS into

the NAS. The diversity of aircraft types, the innumerable

system failure sources, and failure modes, make this

problem particularly challenging. A preliminary list of

requirements for trajectory computation is shown below:

• Generality. A wide variety of vehicle configurations,

control characteristics, instrumentation, propulsion,

etc. should be accommodated.

• Scalability. Since trajectory computations may feed

real-time decision support tools, they should be

generated rapidly.

• Extensibility. As more experimental validation data

and more sophisticated models become available, it

should be possible to increase the level of model

fidelity, and thus the accuracy of the trajectory

computation tools.

• Flexibility. Computations should allow for adaptation to multiple uses. Predictions may be used

in conjunction with tools to determine potential

ground risks, to protect other airspace users, or to

take risk mitigation measures.

A. Sample Prior Work

Prior work in this specific area is rather scarce.

One of the exceptions is the work published by Foster

and Hartman ([5]). In [5], the authors take an experimental approach to characterizing a quadrotor and its

components (airframe, propellers) in a wind tunnel. Of

particular interest is the onset of an off-nominal condition applicable to rotorcraft known as vortex ring state

(VRS). Under VRS conditions, a rotorcraft loses thrust

(increased descent rate) and enters an oscillatory state, in

which control inputs do not affect aircraft motion. The

integrated equations of motion in conjunction with the

propulsion and aerodynamic models are used to predict

the trajectory of a quadrotor in three cases: abrupt failure

of all motors, stuck throttle on all four motors, and VRS

encounter during descent.

The paper by Ancel et al. ([11]) studies the problem in

a qualitative manner. After including a list of prior work,

it concludes that the prevalent approach to solving the

problem is the use of point-mass or ballistics methods

applicable primarily to complete power or control failures.

Other examples of prior work addressing off-nominal

conditions for UAS as well as for CAT may be found

in [12], [13], [14], and [15].

B. System Failure Impact on Trajectory

From the perspective of the aircraft trajectory, system

failures may be modeled using four different mechanisms, as illustrated by the examples shown in Table II.

In practice, mode switch and events may be viewed

as two forms of the same type of mechanism. Figure 3

presents a more detailed view of a section of Figure 1,

illustrating the application of the aforementioned mechanisms.

C. Aircraft Classifications

Aircraft classifications can be used as a computational

artifact for the trajectory prediction process to meet some

of the requirements presented above. In [16], Ren et

al. present a comprehensive categorization effort used in

conjunction with the framework presented in Section II

for nominal conditions. However, for off-nominal conditions, given other sources of complexity, such as nonlinearities, uncertain parameters, hybrid dynamics, noise,

etc., a simplified categorization as proposed in [10] may

suffice. One advantage of this approach is that it could

allow for the trajectory prediction process to be used in

conjunction with risk analyses. In this simplified categorization scheme, three configurations and three weight

categories are considered, respectively: fixed wing (FW),

multirotor (MR), and unmanned helicopter (UH), and

Micro UAS (W≤4.4lbs), Mini UAS (4.4< W≤20 lbs)

and Small UAS (20<W≤55 lbs). The application of simplified categorization schemes while retaining flexibility

and accuracy when needed is an aspect that requires

further investigation.

D. Trajectory Computation Problem Formulation

As shown in Section IV-B, computation of trajectories

under the effect of system failures present multiple

sources of uncertainty, which may be captured by: noise,

uncertain parameters, and mode switches. The result of

interest is in most cases not a trajectory capturing a single

random probable behavior, but rather:
TABLE I

EXAMPLE OF HAZARD ANALYSIS APPLIED TO UAS TP FUNCTIONS

ID Function Deviations (examples) Potential causes (examples)

FH-1 Flight Dynamics Aircraft loss of control Power plant failure

Vortex ring state (VRS)

Foreign object damage (hail, bird strike, undetected obstacle, etc.)

FH-2 Automated Flight Controls Lost/degraded controllability/ observabilityInertial sensor errors

Actuator damage

Autopilot error

FH-3 Flight Performance Lost/degraded controllability Energy depletion

Flight envelope violation

Erroneous determination of energy reserves

FH-4 Navigation and Guidance Lost/degraded navigation capabilityGPS failures / errors

Erroneous waypoints/routes/maneuvers

Erroneous position determination

FH-5 Flight Plan, Intent, & CommandInability to keep separation from

restricted operating zones

Erroneous navigation database entries

Incorrect sequencing of aircraft intent commands

Malformed commands

FH-6 Communications Lost/degraded control/telemetry

link

Electromagnetic interference (EMI)

Malicious jamming

Violation of comm. range limitations

FH-7 Mission Planning & Operations

Control

Lost/degraded mission planning

and execution capability

Operator errors

Mission planning software errors

Erroneous determination of meteorological

conditions

TABLE II

MECHANISMS FOR INCORPORATION OF SYSTEM FAILURES

Mechanism System faults (examples)

Disturbances Erroneous operator commands, inertial sensor errors

Uncertain Parameters Actuator damage, center of gravity shift

Mode Switch Vortex ring state, parachute release, power plant failure

Events Loss of link, energy depletion, single event upset phenomena, GCS

failure

• the set of all possible behaviors,

• a set of representative behaviors,

• a set of “bad” behaviors,

• the “worst-case” behavior,

captured by the evolution of the aircraft state over

time. The aircraft state vector may include continuous

as well as discrete states. Further, the concept of state

may be generalized to account for a probabilistic representation (“belief”) described by a probability density

function over the space of state variables.

When the state vector is viewed as a combined state

of continuous and discrete variables, the system is called

hybrid. Further, when signals are corrupted by noise, the

system may be viewed as stochastic. In addition, when

a set of possible behaviors needs to be computed, the

problem is known as reachability analysis. Hence, in its

most general form, the trajectory computation problem

for off-nominal conditions may be cast as a reachability

analysis of a stochastic hybrid system [17], [18].

To illustrate this formulation, we present a deterministic hybrid system model as presented in [19].

The aircraft dynamics may be modeled by a hybrid

automaton H with discrete state {q1, q2,...,qk}, for instance, representing nominal, off-nominal conditions, or
Input Flight Plan 

Nominal

Plant

Model

Off-nominal

Plant

Models

Failures

Vehicle Plant 

Control Command Conversion 

Nominal

Control

Model

Off-nominal

Control

Models

Failures

Control 

Commands Sensing 

Weather Model 

Events 

Disturbances 

Events

Disturbances

Failures 



Off-nominal

Off-nominal

Aircraft State 

Fig. 3. Simplified off-nominal trajectory computation scheme

different flight modes. Each discrete state has associated

continuous dynamics x ̇ = f(qi, x, v), with x ∈ Rn,

and continuous inputs u and disturbances d, such that

v = (u, d). Then H is a collection

H = (Q, X, Σ,V, Init,f,Inv, R)

where

• Q ∪ X is the set of state variables;

• Σ=Σ1 ∪ Σ2 is a finite collection of discrete

input variables, where Σ1 are control inputs, and

Σ2 disturbances, for example, faults;

• V = U ∪ D are the continuous input variables,

where U are control inputs and D are disturbances;

• Init ⊆ Q × X is a set of initial states

• f : Q × X × V → T X is a vector field describing

the evolution of x for each q ∈ Q;

• Inv ⊆ Q × X × Σ × V is an invariant that

defines combinations of states and inputs for which

continuous evolution is allowed;

• R : Q × X × Σ × V → 2Q×X is a “reset” relation

that encodes discrete transitions.

The reach set R(q, x, t) is the set of all states in Q ×

Rn that can be reached at time t starting in state Init at

time 0. This set may be projected into the 3D space ahead

of the vehicle or into the 2D space on the terrain, thus

allowing for computation of all possible impact points,

as illustrated in Figure 4.

R(q, x, t) → 3D

Fig. 4. Off-nominal trajectory prediction as reach set computation

This problem becomes intractable when treated

naively on realistic systems. However, in recent years,
a rich set of computation techniques has been developed [20]. Significant progress has been made by the

formal methods and verification communities, for whom,

one of their concerns is to obtain formal guarantees that a

system never enters an unsafe region in the system’s state

space. These techniques have been applied to several

domains, such as automotive [21], robotics [22], and

power control [23], to name a few. Now, the key task

that lies ahead is to formulate useful approximations and

heuristics that provide a good balance between the four

requirements presented at the beginning of this section

for a relevant class of faults, for instance, the ones listed

on Table I.

E. Prototype Implementation Efforts

A prototype trajectory prediction tool is being developed to integrate modeling methods and templates developed under this research effort so that their functions

may be simulated and verified, and their effectiveness

validated. The prototype tool will decompose a given

sUAS flight mission scenario into trajectory objects.

These objects serve as the basis for generating predicted

trajectories, which are represented using the trajectory

definition model. Diverse types of sUAS airframe configurations are modeled, including implementation for three

sUAS models representing dynamics, performance, and

automatic flight control logic of a conventional takeoff

and landing (CTOL) fixed wing vehicle, a vertical flight

(powered lift) aircraft, and a VTOL airframe configuration, respectively. Models of atmospheric boundary

layer (ABL) weather dynamics for winds, temperature,

density, and (potentially) precipitation for the mission to

be simulated are also under development. The prototype

tool is expected to model and predict sUAS trajectories

under both nominal and off-nominal (system failures and

hazardous environmental) conditions.

To incorporate the required features, an open system

architecture is being used, where system components can

either be swapped, reconfigured, or re-initialized with

different parameters. This is particularly important to

give UTM ecosystem partners the ability to incorporate

custom models. System components include those that

support the conventional trajectory segment construction

process, unconventional trajectory segment construction

process, and those that provide common capabilities and

system integration functionality.

V. CONCLUSIONS

The problem of computing UAS trajectories in offnominal conditions is still new as these systems are

in the process of being deployed and relevant data

are being collected. Past work focused on commercial

aircraft provides useful pointers, but the scope of the

problem was limited, and hence its applicability to the

UAS domain.

A very general formulation such as reachability analysis of stochastic hybrid systems may make the problem

intractable. However, hybrid systems and formal methods communities have been making rapid progress and

developing tools and scalable techniques that may be

drawn upon. Further, data-driven techniques enhanced

by machine learning, used in combination with the aforementioned tools hold the promise of providing practical

solutions addressing the requirements listed in this work.

The pattern-based trajectory definition model framework introduced in this paper furnishes enough structure

and flexibility to serve as a basis for future work in

UAS trajectory prediction for nominal as well as for

off-nominal conditions. A current implementation of this

framework in the form of a tool is being undertaken by

the authors and used as a basis for refinement.

ACKNOWLEDGMENT

This work is partially supported by NASA under

contract NNA16BE13C. The authors would like to thank

Dr. Parimal Kopardekar and Dr. Jaewoo Jung of NASA

Ames for their support and guidance during this research.

REFERENCES

[1] L. Ren, M. Castillo-Effen, H. Yu, Y. Yoon, T. Nakamura,

E. N. Johnson, and C. A. Ippolito, “Small Unmanned Aircraft

System (sUAS) Trajectory Modeling in Support of UAS Traffic

Management (UTM),” in 17th AIAA Aviation Technology,

Integration, and Operations Conference. American Institute

of Aeronautics and Astronautics, 2017/06/05 2017. [Online].

Available: https://doi.org/10.2514/6.2017-4268

[2] G. Wild, J. Murray, and G. Baxter, “Exploring civil drone

accidents and incidents to help prevent potential air disasters,”

Aerospace, vol. 3, no. 3, p. 22, 2016.

[3] R. S. Sharma, “Investigation into Unmanned Aircraft System

Incidents in the National Airspace System,” International Journal of Aviation, Aeronautics, and Aerospace, vol. 3, no. 4, p. 2,

2016.

[4] D. Gebre-Egziabher and B. Taylor, “White paper: Impact and

mitigation of GPS-unavailability on small UAV navigation,

guidance and control,” University of Minnesota, UAV Laboratory, Tech. Rep., 2012.

[5] J. V. Foster and D. C. Hartman, “High-Fidelity MultiRotor Unmanned Aircraft System Simulation Development for

Trajectory Prediction under Off-Nominal Flight Dynamics,” in

Air Transportation Integration & Operations (ATIO)–Aerospace

Traffic Management (ATM) Conference, 2017. [Online].

Available: https://arc.aiaa.org/doi/pdfplus/10.2514/6.2017-3271
[6] K. J. Hayhurst, J. M. Maddalon, P. S. Miner, G. N. Szatkowski,

M. L. Ulrey, M. P. DeWalt, and C. R. Spitzer, “Preliminary

considerations for classifying hazards of unmanned aircraft

systems,” 2007.

[7] L. H. Mutuel, C. A. Wargo, and J. DiFelici, “Functional

decomposition of Unmanned Aircraft Systems (UAS) for CNS

capabilities in NAS integration,” in 2015 IEEE Aerospace

Conference, Mar. 2015, pp. 1–17.

[8] SAE, “ARP 4761,” Guidelines and Methods for Conducting

the Safety Assessment Process on Civil Airborne Systems and

Equipment, vol. 12, 1996.

[9] S. Jacobson, “Aircraft loss of control causal factors and mitigation challenges,” in AIAA Guidance, navigation, and control

conference, 2010, p. 8007.

[10] L. C. Barr, R. Newman, E. Ancel, C. M. Belcastro, J. V. Foster,

J. Evans, and D. H. Klyde, “Preliminary Risk Assessment for

Small Unmanned Aircraft Systems.” American Institute of

Aeronautics and Astronautics, Jun. 2017. [Online]. Available:

https://arc.aiaa.org/doi/10.2514/6.2017-3272

[11] E. Ancel, F. M. Capristan, J. V. Foster, and R. C. Condotta,

“Real-time Risk Assessment Framework for Unmanned

Aircraft System (UAS) Traffic Management (UTM),” in Air

Transportation Integration & Operations (ATIO)–Aerospace

Traffic Management (ATM) Conference, 2017. [Online].

Available: https://arc.aiaa.org/doi/pdfplus/10.2514/6.2017-3273

[12] D. W. King, A. Bertapelle, and C. Moses, “UAV failure

rate criteria for equivalent level of safety,” in International

Helicopter Safety Symposium, Montréal, 2005. [Online].

Available: http://www.ihst.org/portals/54/partners/india/4_king.

pdf

[13] J. V. Foster, K. Cunningham, C. M. Fremaux, G. H. Shah, E. C.

Stewart, R. A. Rivers, J. E. Wilborn, and W. Gato, “Dynamics

modeling and simulation of large transport airplanes in upset

conditions,” in AIAA Guidance, Navigation, and Control

Conference and Exhibit, 2005, pp. 15–18. [Online]. Available:

https://arc.aiaa.org/doi/pdfplus/10.2514/6.2005-5933

[14] K. Dalamagkidis, K. P. Valavanis, and L. A. Piegl, “Evaluating

the risk of unmanned aircraft ground impacts,” in 2008 16th

Mediterranean Conference on Control and Automation, June

2008, pp. 709–716.

[15] C. Lum, K. Gauksheim, C. Deseure, J. Vagners, and T. McGeer,

“Assessing and estimating risk of operating unmanned aerial

systems in populated areas,” in 11th AIAA Aviation Technology,

Integration, and Operations (ATIO) Conference, including the

AIAA Balloon Systems Conference and 19th AIAA Lighter-Than,

2011, p. 6918.

[16] L. Ren, M. Castillo-Effen, H. Yu, E. N. Johnson, Y. Yoon, and

C. A. Ippolito, “Small Unmanned Aircraft System (sUAS) Categorization Framework for Low Altitude Traffic Services,” GE

Global Research, Niskayuna, NY, Tech. Rep. NASA Contract

NNA16BE13C, September 2017.

[17] A. Abate, S. Amin, M. Prandini, J. Lygeros, and S. Sastry,

Computational Approaches to Reachability Analysis of

Stochastic Hybrid Systems. Berlin, Heidelberg: Springer

Berlin Heidelberg, 2007, pp. 4–17. [Online]. Available:

https://doi.org/10.1007/978-3-540-71493-4_4

[18] A. Abate, M. Prandini, J. Lygeros, and S. Sastry, “Probabilistic

reachability and safety for controlled discrete time stochastic

hybrid systems,” Automatica, vol. 44, no. 11, pp. 2724 –

2734, 2008. [Online]. Available: http://www.sciencedirect.com/

science/article/pii/S0005109808002677

[19] C. J. Tomlin, S. P. Boyd, I. Mitchell, A. Bayen, M. Johansson,

and L. Xiao, “Computational tools for the verification of hybrid

systems,” in Software-Enabled Control: Information Technology

for Dynamical Systems, T. Samad and G. Balas, Eds. Wiley,

2003, ch. 18, pp. 369–392.

[20] S. Bogomolov, M. Fränzle, K. Makino, and N. Ramdani,

“Symbolic-Numeric Methods for Problem Solving in CPS

(Dagstuhl Seminar 16491),” Dagstuhl Reports, vol. 6, no. 12,

pp. 1–28, 2017. [Online]. Available: http://drops.dagstuhl.de/

opus/volltexte/2017/7108

[21] M. Althoff, “An introduction to cora 2015.” in ARCH@ CPSWeek, 2015, pp. 120–151.

[22] J. H. Gillula, G. M. Hoffmann, H. Huang, M. P. Vitus, and

C. J. Tomlin, “Applications of hybrid reachability analysis to

robotic aerial vehicles,” The International Journal of Robotics

Research, vol. 30, no. 3, pp. 335–354, 2011. [Online].

Available: http://dx.doi.org/10.1177/0278364910387173

[23] M. Althoff, “Formal and compositional analysis of power

systems using reachable sets,” IEEE Transactions on Power

Systems, vol. 29, no. 5, pp. 2270–2280, Sept 2014.