Reliability-Asymmetric Spacecraft Autonomy: Co-Designing a Capable Learned GNC Stack with a Verified, Adaptation-Aware Runtime Shield

Researchers present AMPLE-GNC, an autonomous spacecraft control system that combines learned AI models with formal verification to achieve both capability and safety. The system successfully demonstrates fault-adaptive control recovering from 97.8% of actuator faults while maintaining 94.5% autonomous operation under a verified safety shield.

AMPLE-GNC addresses a critical challenge in deep-space exploration: spacecraft autonomy must function reliably without constant Earth communication while remaining mathematically verifiable for safety-critical missions. The research bridges two traditionally opposed approaches—rule-based systems that are provably safe but inflexible, and learned models that adapt but resist formal verification.

The system's three-tier architecture reflects a pragmatic engineering philosophy. A 360M-parameter foundation model translates natural language commands to formal planning specifications, achieving 84% executable output through grammar-constrained decoding. A fault-adaptive controller using rapid motor adaptation infers actuator failures in real-time, recovering function in scenarios where classical controllers fail completely. Critically, all three layers operate within bounds established by a runtime shield verified using Kind 2 model checker—ensuring safety guarantees persist even if learned components behave unexpectedly.

The research demonstrates substantial performance gains: 97.8% recovery from sign-flip faults and 94.4% from continuous gain faults dwarf traditional baselines scoring 0%. The finding that randomization breadth rather than data volume drives generalization has direct implications for training AI systems in resource-constrained space environments where retraining data is expensive to generate.

For the aerospace and autonomous systems industries, this work validates hybrid approaches where AI handles complexity while formal methods enforce safety bounds. The adaptation-aware engagement mechanism—keeping systems 94.5% autonomous while catching non-recovery—offers a template for deploying learned autonomy in high-stakes settings. Future spacecraft could leverage similar architectures for Mars missions or asteroid operations where communication delays make ground intervention impossible.

• →AMPLE-GNC achieves 97.8% fault recovery in spacecraft actuators by combining learned models with formal verification methods
• →Grammar-constrained decoding guarantees syntactic validity in natural language commands with 84% semantic executability
• →Randomization breadth in training data drives generalization better than data volume for fault-adaptive controllers
• →Runtime shields verified by model checkers can suppress capable controllers while maintaining 94.5% autonomous operation
• →Hybrid AI-classical systems enable deployment of learned autonomy in safety-critical space missions