Since the previous research note · Earlier expectation not tested
Track continuity
Since the previous research note: How controller memory changes simulated docking and inspection
Previous expectation: Adaptive safety filtering could eventually help spacecraft complete docking and inspection around uncooperative objects while respecting thrust limits and conserving propellant.
What this study adds: The current source examines actuator-fault recovery and sustained pointing, with a runtime shield that allows bounded recovery time before protective intervention. This adds a distinct milestone about coordinating fault adaptation with intervention timing, without testing the earlier proximity-operations forecast.
What changed in this study
A spacecraft controller struggling after an actuator fault presents a difficult decision. It might be learning how to compensate and need a little more time. Or it might be failing, requiring protective control to take over. Intervening immediately can prevent an otherwise capable controller from completing its recovery. Waiting indefinitely is no solution either.
A June 24, 2026 arXiv preprint investigates this decision using AMPLE-GNC, an experimental spacecraft guidance, navigation, and control system. On one six-degree-of-freedom Basilisk simulation testbed, the researchers combine a controller that estimates actuator faults with monitoring that gives recovery a bounded opportunity to succeed. Success means regaining stable pointing and holding it, rather than briefly passing through the desired orientation.
The work connects several different tests of autonomy. Understanding an operator’s instruction, compensating for faulty actuators, and deciding when to intervene each require their own evidence. The system’s strongest recovery results do not make those other questions disappear.
From an instruction to physical control
The architecture divides the work among components with different responsibilities. A small language model, fine-tuned from a pretrained model with 360 million parameters, translates an operator’s instruction into a single action in PDDL+, a formal language used by planning software. A verifier then screens that action against linearized resource and safety constraints and produces a feasibility certificate.
This is a bounded command interface. The paper explicitly leaves planning sequences of actions over time to future work. The demonstrated route converts an instruction into one structured action and checks it before physical control proceeds.
At the control level, the learned component has a different job. A recurrent network estimates the hidden actuator fault from the system’s behavior over time. A fixed analytic control law uses that estimate to supply control. Learning therefore handles the changing relationship between a command and the actuator’s response, while the control calculation retains a prescribed mathematical form.
That division makes the adaptation tangible. The network’s output is an estimate of a physical fault that the control law can use. The researchers train the estimator first on teacher-generated trajectories, then on trajectories visited by the adapting controller itself. This second stage addresses a practical difficulty: an estimator may encounter different states when its own estimates influence what happens next.
Runtime monitoring oversees the operation of these components. Its intervention decision becomes especially important during the period when the controller is still identifying and compensating for a fault.
A valid command can still be the wrong command
The language component illustrates why a single accuracy number would be misleading. Three questions matter. Does the output follow the required format? Can planning software execute the complete action? Does the action express what the operator intended?
The researchers constrain the model’s decoding with a grammar that matches the command schema. Within that deployed decoding arrangement, output validity is guaranteed by construction. The model cannot freely emit text that breaks the prescribed structure. This is a useful guarantee about the form of the command, but an unfamiliar instruction can still produce a well-formed mistake.
Checking executability adds another requirement. On the paper’s shipped test, 84% of outputs were executable by the planner when the full predicted action was checked against a real planning domain. A simpler check that inspected only the action verb would have labeled all of those outputs valid. Arguments and the rest of the action matter; recognizing a permitted verb is insufficient.
Understanding intent proved harder to assess because 37 of the shipped test’s 100 examples were verbatim duplicates of training examples. Such overlap gives the model opportunities to reproduce familiar phrasing, changing what apparent test performance says about generalization.
On the separate evaluation after removing that leakage, performance on novel phrasing was 38% exact match and 51% on the reported action measure. Additional fine-tuning with more varied phrasing raised exact match to 48%. These figures describe a different evaluation condition from the 84% executability result and should not be treated as interchangeable scores.
Together, the tests expose where the command interface succeeds and where interpretation remains difficult. A grammar can enforce a legal output shape. A planner can reject an unusable action. Neither check alone establishes that a usable action conveys the intended instruction.
Recovery means staying pointed
For the controller, the outcome is physical and sustained. The test requires pointing to remain within 0.2 degrees of the target over a final dwell window. A controller that swings through the target and drifts away has not recovered under this criterion. The distinction separates momentary alignment from the ability to hold an orientation.
Within the range of faults represented by training randomization, the fault-adaptive controller recovered in 97.8% of actuator-sign cases and 94.4% of continuous-gain cases. Sign faults change the direction of an actuator’s response; gain faults change its strength. Both alter the relationship the controller must account for when choosing corrective commands.
The comparisons show why estimating that changed relationship mattered in these experiments. A proportional–derivative controller without fault awareness and an end-to-end reinforcement-learning controller trained from scratch both scored 0% on the reported recovery tests. The strongest tested classical adaptive baseline reached 55% on continuous-gain faults. These results compare the particular implementations and conditions evaluated in the paper; they do not rank every possible conventional or learned controller.
The fault instances used for testing were held out, with tuning confined to a separate training split. That separation gives the recovery results a clearer interpretation than testing on the same instances used to adjust the system. Yet the high percentages still sit within the training randomization envelope—the range of fault conditions the learning process was designed to expose the controller to. A new instance within that range is a different challenge from a fault beyond it.
Giving recovery a deadline
The paper’s intervention experiments return to the opening decision. A latching safe-hold mechanism can take authority away from a controller that would otherwise recover. The researchers address this with an adaptation-aware engagement rule and a statistically calibrated recovery deadline. The controller gets a bounded interval to restore stable behavior, while monitoring continues to check for excursions. If recovery has not arrived by the deadline, protective intervention follows.
The deadline is therefore part of an active monitoring sequence, rather than a period when oversight is suspended. An excursion can trigger protection, and failure to recover cannot extend the waiting period indefinitely. In the evaluated cases, the excursion condition together with the deadline caught every excursive or non-recovering case. The authors report 94.5% autonomy for the controller with the adaptation-aware arrangement.
Two forms of assurance support different parts of this result. The recovery-deadline certificate uses split-conformal calibration, a statistical method applied to recovery behavior. It supplies the bound used to decide how long the controller may retain authority. Its role is to make the waiting decision depend on evaluated recovery behavior rather than an open-ended expectation that adaptation will eventually work.
Separately, the runtime shield includes nine linear-temporal-logic invariants, formal rules describing required behavior over time. The Kind 2 model checker checks the soundness of the shield’s predictor. That machine-checked claim concerns the specified predictor under its modeled assumptions. It does not certify the language model’s interpretation of every instruction or prove unrestricted safety of the whole spacecraft.
Likewise, catching every relevant failure in these evaluations is a result about the evaluated cases. The formal predictor check and the calibrated recovery deadline answer complementary questions, but neither turns the simulation findings into a universal detection guarantee.
What the test environments establish
The main results come from a single instrumented Basilisk testbed, where the components operate together in a closed loop. Its six degrees of freedom represent translation and rotation. Controlled comparisons let the researchers examine what changes when a controller or intervention strategy changes within that environment.
Training exposure is a consequential boundary. The paper reports weaker recovery beyond the training randomization envelope. It also finds that adding four times as much data from within the original regime worsened performance in the examined comparison. More examples of familiar conditions did not substitute for broader exposure to the faults the controller would need to handle.
Sensor conditions add a separate distinction. The headline evaluations use clean state feedback. The researchers also evaluate star-tracker measurement noise applied to the attitude observed by the controller and report little change across the tested noise range. That experiment addresses the specific measurement perturbation they introduced; it should remain distinct from the clean-feedback recovery percentages.
The hardware evidence answers another question again. The researchers export the system to a self-contained C artifact and benchmark it on a Raspberry Pi 5. Executing that artifact on a small computer provides evidence about running the implementation on physical computing hardware. The fault-recovery outcomes, however, remain simulation results. A computing benchmark does not establish flight qualification or demonstrate recovery aboard an operating spacecraft.
These distinctions locate the contribution precisely. The preprint brings integrated simulation, command-language testing, formal predictor checking, statistical calibration, and a hardware execution benchmark into one study. Transfer to flight-representative systems and relevant fault conditions remains the substantive step between these results and dependable mission use.
What this could change
If the recovery and intervention behavior transfer to those systems and conditions, spacecraft teams could gain a way to restore steady scientific pointing onboard after some actuator faults. The fault estimator would identify how actuator response had changed, the analytic controller would compensate, and the sustained-pointing criterion would establish that useful orientation had been regained.
That capability could reduce interruptions to observations and reliance on ground-directed recovery. The practical payoff would be more continuity in scientific work: an affected spacecraft could resume or preserve observations requiring steady pointing after faults it can successfully accommodate, while unresolved failures still lead to protective intervention.
Key Sources
- Primary source: Reliability-Asymmetric Spacecraft Autonomy: Co-Designing a Capable Learned GNC Stack with a Verified, Adaptation-Aware Runtime Shield
arXiv · Preprint · 2026-06-24