A deep-space probe loses star tracker lock mid-correction burn. A monolithic neural guidance policy might propose a thrust vector that violates fuel margins or attitude envelopes while attempting recovery. Human operators hours away by light speed cannot approve each command. AMPLE-GNC addresses this reliability asymmetry: let a large foundation model commander propose agile guidance, but route every executable through a model-checked runtime shield and a separate recovery module with statistical certificates. AMPLE GNC spacecraft autonomy (arxiv 2606.25366) documents how modern learned GNC stacks can coexist with formal verification for fault scenarios where autonomy must succeed without ground intervention.
Mission designers, autonomy researchers, and flight software engineers evaluating next-generation deep-space stacks need frameworks that report both capability (how often the commander proposes valid maneuvers) and assurance (how often faults recover within verified bounds). Teams cataloging aerospace AI patterns via AI chatbot documentation should contrast AMPLE-GNC with simpler limit monitors. Related explainers appear on the EliteAI.tools blog index.
What AMPLE-GNC Spacecraft Autonomy Means
AMPLE-GNC is an autonomy architecture that combines a 360-million-parameter foundation model commander for guidance proposals, a runtime shield verified with nine linear temporal logic invariants in Kind2, and a recovery module achieving 97.8% fault recovery with split-conformal certificates covering 94.5% of autonomous recovery cases. The design encodes reliability asymmetry: the learned commander optimizes performance across nominal and off-nominal regimes, while the shield guarantees no proposed command violates verified safety properties, and the recovery module handles faults the commander cannot resolve alone.
Deep-space missions face communication delay, sensor degradation, and actuation faults that terrestrial CubeSat shields also address but at different time scales and energy budgets. AMPLE-GNC targets scenarios where autonomy must run closed-loop for extended periods with formal backing on the safety-critical path.
| Module | Role | Reported metric |
|---|---|---|
| FM commander (360M) | Proposes guidance and mode commands | 84% executable proposals |
| Runtime shield (Kind2) | Filters commands against 9 LTL invariants | Formally verified safety layer |
| RMA recovery controller | Handles faults when commander fails | 97.8% fault recovery rate |
| Split-conformal certificate | Statistical coverage on recovery set | 94.5% autonomous recovery coverage |
How the AMPLE-GNC Architecture Works
AMPLE-GNC processes sensor state through the foundation model commander, which outputs candidate guidance actions; the runtime shield accepts or rejects each candidate against Kind2-verified LTL invariants; if faults persist, the RMA recovery controller takes over with conformal prediction bounds on success. Separation of concerns lets teams upgrade the 360M commander as better foundation models appear without re-verifying the entire stack, as long as the shield interface remains stable.
360M foundation model commander
The AMPLE-GNC commander is a 360-million-parameter foundation model trained on diverse guidance scenarios, producing maneuver proposals that are executable 84% of the time in reported benchmarks. The 16% non-executable rate is expected: the commander explores aggressive recovery strategies that the shield must filter. Capability metrics should never be reported without shield and recovery context, or stakeholders misread 84% as end-to-end mission success.
Kind2-verified runtime shield with nine LTL invariants
Nine linear temporal logic invariants, model checked in Kind2, define the runtime shield's safety envelope for propulsion, attitude, and resource usage during autonomous operations. Kind2 provides inductive proofs over transition systems representing discretized spacecraft dynamics. Verified invariants might include fuel monotonicity bounds, forbidden attitude zones relative to sensitive instruments, and mandatory safe-mode entry conditions when sensor validity drops below thresholds.
RMA recovery controller at 97.8% fault recovery
The Recovery Module for Autonomy (RMA) controller achieves 97.8% fault recovery in simulation suites covering sensor dropouts, actuator degradation, and guidance failures that bypass the commander's nominal training distribution. Recovery sits outside the foundation model path so its simpler control laws can be analyzed and tested independently. The remaining 2.2% failure tail should trigger safe hold or minimal contingency trajectories documented in mission rules.
Split-conformal recovery certificate at 94.5%
Split-conformal prediction wraps recovery decisions with statistical certificates guaranteeing 94.5% coverage of autonomous recovery cases on held-out fault ensembles, bridging formal LTL guarantees with empirical fault diversity. Conformal methods provide finite-sample coverage statements without assuming Gaussian error, useful when fault modes are rare and neural components non-linear. Certificates tell operators: under documented fault distributions, at least 94.5% of cases recover without ground intervention.
| Assurance type | Mechanism | What it guarantees |
|---|---|---|
| Per-command safety | Kind2 LTL shield (9 invariants) | No verified violation on accepted commands |
| Fault recovery rate | RMA controller testing | 97.8% recovery in benchmark faults |
| Statistical coverage | Split-conformal certificate | 94.5% autonomous recovery coverage |
Typical mission integration workflow
- Define autonomy envelope: which phases run closed-loop without ground (coast, approach, safe mode).
- Train or fine-tune FM commander on mission-specific trajectory libraries and fault injections.
- Specify nine LTL invariants with GNC engineers; verify shield in Kind2 against discretized dynamics.
- Implement RMA recovery with explicit fallback control laws for top fault modes.
- Calibrate split-conformal certificates on held-out fault batches; document coverage assumptions.
- Monte Carlo closed-loop sims reporting executable rate, shield reject rate, recovery rate jointly.
- Operational rule: if shield and RMA both fail, enter verified safe mode and await ground.
Simulation and Benchmark Protocol
AMPLE-GNC evaluation reports commander executable rate, shield rejection rate, RMA recovery rate, and conformal coverage jointly on shared fault injection suites rather than isolating each module. Closed-loop Monte Carlo runs perturb star tracker availability, reaction wheel friction, and propellant estimation bias while logging which layer resolved each fault. Publishing only 84% commander executability without shield pass-through misleads stakeholders about end-to-end autonomy reliability.
Split-conformal calibration splits fault batches into training and hold-out conformal sets so coverage statements (94.5%) apply to unseen faults drawn from the same distribution. Teams extending missions to new bodies should re-calibrate when fault physics change (low-thrust ion propulsion vs chemical impulsive burns). Document the fault library version in every autonomy readiness review.
Reliability-Asymmetric Autonomy Design
Reliability-asymmetric design accepts that learned commanders will propose invalid actions but insists the safety path (shield plus recovery) meets higher assurance bars than the performance path (foundation model agility). AMPLE-GNC makes the asymmetry explicit in metrics: 84% executable proposals are fine when 100% of executed commands pass Kind2 invariants and 97.8% of faults recover. Mission success depends on composing modules, not maximizing commander accuracy alone.
Compare to Glass Box on CubeSats: both use runtime shields, but AMPLE-GNC adds a large FM commander and conformal recovery certificates aimed at deep-space fault sets with nine verified invariants rather than six constitutional constraints plus seven LTL rules on a smaller bus.
Limits, Risks, and Verification Gaps
Kind2 proofs hold for abstracted dynamics; sim-to-real gap, unmodeled flex, and propellant slosh can invalidate shields in flight if abstractions are too coarse. Split-conformal 94.5% coverage applies to the fault distribution used during calibration; novel faults outside that ensemble lack guarantees. The 360M commander demands radiation-hardened compute budgets uncommon on small satellites today.
- Executable vs safe: 84% executable does not mean 84% mission-optimal; shield may reject aggressive saves.
- Certificate scope: 94.5% coverage is not 100%; mission rules must handle the tail.
- Compute mass power: Foundation models challenge SWaP on deep-space avionics.
- Invariant drift: Payload or fuel tank changes require re-verification in Kind2.
Who Should Use This and Who Should Wait
Deep-space mission architects planning extended autonomous segments (Mars approach, asteroid proximity operations) should study AMPLE-GNC as a reference architecture for combining FM commanders with verified shields and certificated recovery. LEO CubeSat teams with ample ground contact may adopt lighter Glass Box shields first.
| Audience | Recommendation | Caveat |
|---|---|---|
| Deep-space autonomy team | Prototype AMPLE-GNC module split | Budget SWaP for 360M inference |
| Flight software verifier | Port nine LTL invariants to Kind2 | Validate abstraction fidelity |
| University CubeSat | Start with smaller runtime shields | AMPLE-GNC is heavy for 1U buses |
| Regulator / insurer reviewer | Request joint metrics table | Never accept commander accuracy alone |
Frequently Asked Questions
What does 84% executable mean for the FM commander?
84% of commander proposals pass initial executability checks in AMPLE-GNC benchmarks; the runtime shield may reject additional commands, and RMA handles faults afterward. Report shield pass rate and recovery rate alongside commander metrics.
What do the nine Kind2 LTL invariants cover?
Nine linear temporal logic invariants verified in Kind2 define the runtime shield safety envelope for autonomous guidance; specifics are mission-dependent but the count shows a compact verified rule set in arxiv 2606.25366. Teams adapt templates to propulsion and attitude limits.
How reliable is RMA fault recovery?
RMA achieves 97.8% fault recovery in reported simulation suites; remaining cases should transition to verified safe mode per mission rules. Recovery rates depend on fault library completeness.
What does 94.5% split-conformal recovery coverage mean?
Split-conformal certificates provide statistical guarantees that at least 94.5% of autonomous recovery cases in the calibration fault ensemble succeed without ground intervention. Coverage is distribution-dependent.
How does AMPLE-GNC differ from Glass Box?
Glass Box targets CubeSat runtime constitutional checks with Z3/NuSMV; AMPLE-GNC pairs a 360M foundation model commander with Kind2-verified shields and RMA recovery plus conformal certificates for deep-space faults. Choose architecture by mission class and compute budget.
Can a 360M model fly on current deep-space avionics?
Foundation model inference requires substantial onboard compute; AMPLE-GNC assumes avionics capable of running the commander within control loop deadlines, often via rad-hard accelerators or ground-uploaded model updates during cruise. SWaP analysis is mission-specific.
When does AMPLE-GNC still require ground intervention?
When shield and RMA both fail, or conformal coverage excludes the observed fault, missions should enter verified safe mode and await ground commands despite autonomy investment. Autonomy readiness reviews must document light-time delay and fallback telecom paths for those cases.
Conclusion
AMPLE-GNC explains verified spacecraft autonomy as a composed system: a 360M foundation model commander (84% executable proposals), a Kind2-verified runtime shield with nine LTL invariants, an RMA controller achieving 97.8% fault recovery, and split-conformal certificates at 94.5% autonomous recovery coverage. Reliability-asymmetric design lets missions pursue agile learned guidance without trusting neural networks on the safety-critical path. Architects should publish joint metrics, re-verify invariants when physics change, and treat conformal coverage as bounded assurance, not absolute proof. Capability and verification together define autonomous deep-space GNC.
