XX-XXX

# Run Time Assurance for
Autonomous Spacecraft Inspection

Kyle Dunlap AI Scientist, RDT&E Division, Parallax Advanced Research, 4035
Colonel Glenn Hwy, Beavercreek, OH, 45431. David van Wijk Graduate Research
Fellow, Aerospace Engineering, Texas A&M University, Land, Air, and Space
Robotics (LASR) Laboratory, 1188 Nuclear Science Rd, College Station, TX,
77845. and Kerianne L. Hobbs Safe Autonomy Lead, Autonomy Capability Team 3,
Air Force Research Laboratory, 2241 Avionics Circle, Wright-Patterson AFB, OH,
45433.
Approved for Public Release, Case Numbers AFRL-2023-0599. This work was
supported by the Air Force Research Laboratory Infrastructure for Trusted
Satellite Autonomy and Tactical Rapid Anomaly Protection (IT’S A TRAP)
Seedlings for Disruptive Capabilities Program (SDCP). The views expressed are
those of the authors and do not reflect the official guidance or position of
the United States Government, the Department of Defense or of the United
States Air Force.

###### Abstract

As autonomous systems become more prevalent in the real world, it is critical
to ensure they operate safely. One approach is the use of Run Time Assurance
(RTA), which is a real-time safety assurance technique that monitors a primary
controller and intervenes to assure safety when necessary. As these autonomous
systems become more complex, RTA is useful because it can be designed
completely independent of the primary controller. This paper develops several
translational motion safety constraints for a multi-agent autonomous
spacecraft inspection problem, where all of these constraints can be enforced
with RTA. A comparison is made between centralized and decentralized control,
where simulations of the inspection problem then demonstrate that RTA can
assure safety of all constraints. Monte Carlo analysis is then used to show
that no scenarios were found where the centralized RTA cannot assure safety.
While some scenarios were found where decentralized RTA cannot assure safety,
solutions are discussed to mitigate these failures.

##  1 Introduction

In order for autonomy to be used safely on mission-critical systems, assurance
methods must be considered. For space systems in particular, a mistake or
fault could result in damage to multi-million or multi-billion dollar
equipment, as well as potential loss of invaluable data and space-based
services. One method of assuring safety is with the use of Run Time Assurance
(RTA) [1], which is an online safety assurance technique designed to filter
potentially unsafe inputs from a primary controller and intervene to assure
safety of the system when necessary. RTA systems decouple the task of safety
assurance from all other control objectives, allowing it to scale well to
increasingly complex systems. One type of RTA filter is the Active Set
Invariance Filter (ASIF) [2], which utilizes Control Barrier Functions (CBF)
[3] to minimize deviation from the primary controller while still assuring
safety of the system. Additionally, the ASIF approach allows multiple
constraints to be enforced at once, without needing complex switching or
decision logic.

This paper focuses on assuring safety for an autonomous spacecraft inspection
problem, where multiple active deputy spacecraft cooperate to inspect a
passive, stationary chief spacecraft. A group of deputies inspecting a chief
is shown in Figure 1. Several safety constraints on position and velocity are
developed and enforced with RTA. While most of these constraints can be
enforced through ASIF RTA, a specific case is shown where alternate RTA
methods would better assure safety.

Figure 1: Inspection Problem.

CBFs for online safety assurance are becoming increasingly popular, with
applications to autonomous driving [4], segways [5], fixed-wing aircraft [6],
and many more. For spacecraft related problems, CBFs have been used to assure
safety for docking [7], rendezvous [8], proximity operations [9], and attitude
control [10]. The safety constraints in this work are adapted to an ASIF RTA
approach from safety requirements for automatic spacecraft maneuvering. [11,
12]. This work builds upon previous constraints developed for spacecraft
docking [13] and inspection [14].

The main contributions of this paper are developing mathematical constraints
for the spacecraft inspection problem, comparing centralized and decentralized
RTA methods, performing Monte Carlo analysis to show that all constraints can
be enforced simultaneously, and considering the case where ASIF RTA can be
combined with a switching-based RTA approach.

##  2 Run Time Assurance

This paper considers control affine dynamical systems, where a continuous-time
system model is given by a system of ordinary differential equations,

$\boldsymbol{\dot{x}}=f(\boldsymbol{x})+g(\boldsymbol{x})\boldsymbol{u}.$ (1)

Here, $\boldsymbol{x}\in\mathcal{X}\subseteq\mathbb{R}^{n}$ denotes the state
vector, $\boldsymbol{u}\in\mathcal{U}\subseteq\mathbb{R}^{m}$ denotes the
control vector, and $f:\mathcal{X}\rightarrow\mathbb{R}^{n}$ and
$g:\mathcal{X}\rightarrow\mathbb{R}^{n\times m}$ are locally Lipschitz
continuous functions. Additionally, $\mathcal{X}$ is the set of all possible
state values and $\mathcal{U}$ is the admissible control set.

As shown in Figure 2, a feedback control system with RTA is divided into a
performance-focused primary controller and a safety-focused RTA filter. The
primary controller first computes a desired control input,
$\boldsymbol{u}_{\rm des}$, based on the state $\boldsymbol{x}$. The RTA
filter evaluates $\boldsymbol{u}_{\rm des}$ at the current state and modifies
it as necessary to produce a safe control input, $\boldsymbol{u}_{\rm act}$,
which is then passed to the plant. In Figure 2, the primary controller is
highlighted red to indicate low safety confidence, while the RTA filter is
highlighted blue to indicate high safety confidence. This structure allows the
designer to isolate unverified or unsafe components of the control system.

Figure 2: Feedback control system with RTA.

For a dynamical system, safety can be defined by a set of $M$ inequality
constraints $\varphi_{i}(\boldsymbol{x}):\mathcal{X}\to\mathbb{R}$, $\forall
i\in\\{1,...,M\\}$, where $\varphi_{i}(\boldsymbol{x})\geq 0$ when the
constraint is satisfied. The set of states that satisfies all of these
constraints is known as the allowable set $\mathcal{C}_{\rm A}$, and is
defined as,

$\mathcal{C}_{\rm
A}:=\\{\boldsymbol{x}\in\mathcal{X}\,|\,\varphi_{i}(\boldsymbol{x})\geq
0,\forall i\in\\{1,...,M\\}\\}.$ (2)

A state $\boldsymbol{x}(t_{0})$ is then said to be safe if it lies in a
forward invariant subset of $\mathcal{C}_{\rm A}$ known as the safe set
$\mathcal{C}_{\rm S}$, where,

$\boldsymbol{x}(t_{0})\in\mathcal{C}_{\rm
S}\Longrightarrow\boldsymbol{x}(t)\in\mathcal{C}_{\rm S},\forall t\geq t_{0}.$
(3)

Note that the control input $\boldsymbol{u}$ is bounded by the admissible
control set $\mathcal{U}$, and therefore $\mathcal{C}_{\rm S}$ is highly
dependent on the controller. $\mathcal{C}_{\rm S}$ is then said to be control
invariant if there exists a control law $\boldsymbol{u}\in\mathcal{U}$ that
renders $\mathcal{C}_{\rm S}$ forward invariant. $\mathcal{C}_{\rm S}$ can be
defined explicitly by a set of $M$ control invariant inequality constraints,
$h_{i}(\boldsymbol{x}):\mathcal{X}\to\mathbb{R}$, $\forall i\in\\{1,...,M\\}$,
where again $h_{i}(\boldsymbol{x})\geq 0$ when the constraint is satisfied.
$\mathcal{C}_{\rm S}$ is then defined as,

$\mathcal{C}_{\rm
S}:=\\{\boldsymbol{x}\in\mathcal{X}\,|\,h_{i}(\boldsymbol{x})\geq 0,\forall
i\in\\{1,...,M\\}\\}.$ (4)

While there are many approaches to developing an RTA filter,[15, 16] ASIF is
an optimization-based algorithm designed to be minimally invasive towards the
primary controller while still respecting multiple safety constraints. The
ASIF algorithm uses CBFs to define safety, and a Quadratic Program (QP) to
compute a safe control input. The ASIF algorithm used in this paper is defined
as follows.

Active Set Invariance Filter

$\begin{gathered}\boldsymbol{u}_{\rm act}(\boldsymbol{x},\boldsymbol{u}_{\rm
des})=\underset{\boldsymbol{u}\in\mathcal{U}}{\text{argmin}}\left\|\boldsymbol{u}_{\rm
des}-\boldsymbol{u}\right\|_{2}^{2}\\\ \text{s.t.}\quad
BC_{i}(\boldsymbol{x},\boldsymbol{u})\geq 0,\quad\forall
i\in\\{1,...,M\\}\end{gathered}$ (5)

Here, $BC$ represents one of $M$ barrier constraints, which are satisfied when
$BC_{i}(\boldsymbol{x},\boldsymbol{u})\geq 0$. The objective of these barrier
constraints is to render $\mathcal{C}_{\rm S}$ forward invariant under
$\boldsymbol{u}_{\rm act}$. Nagumo’s condition [17] is used to do this, where
the boundary of $\mathcal{C}_{\rm S}$ is examined to ensure
$\dot{h}_{i}(\boldsymbol{x})\geq 0$, thus causing $\boldsymbol{x}$ to never
leave $\mathcal{C}_{\rm S}$. This is written as,

$\dot{h}_{i}(\boldsymbol{x})=\nabla
h(\boldsymbol{x})\dot{\boldsymbol{x}}=L_{f}h_{i}(\boldsymbol{x})+L_{g}h_{i}(\boldsymbol{x})\boldsymbol{u}\geq
0,$ (6)

where $L_{f}$ and $L_{g}$ are Lie derivatives of $h_{i}$ along $f$ and $g$
respectively. Note that this condition should only be enforced along the
boundary of $\mathcal{C}_{\rm S}$, and therefore a strengthening function
$\alpha(x):\mathbb{R}\rightarrow\mathbb{R}$ is introduced to relax the
constraint away from the boundary. $\alpha(x)$ must be a continuous, strictly
increasing class $\kappa$ function and have the condition $\alpha(0)=0$. The
barrier constraint is therefore defined as,

$BC(\boldsymbol{x},\boldsymbol{u}):=\nabla
h(\boldsymbol{x})(f(\boldsymbol{x})+g(\boldsymbol{x})\boldsymbol{u})+\alpha(h(\boldsymbol{x})).$
(7)

##  3 Spacecraft Inspection Problem

This paper focuses on the task of spacecraft inspection, where multiple active
deputy spacecraft are inspecting a passive chief spacecraft. The analysis
takes place in Hill’s frame [18], as shown in Figure 3. The origin of the
frame, $\mathcal{O}_{H}$, is located at the center of mass of the chief, the
unit vector $\hat{x}$ points away from the center of the Earth, $\hat{y}$
points in the direction of motion of the chief, and $\hat{z}$ is normal to
$\hat{x}$ and $\hat{y}$. The linearized relative motion dynamics between a
deputy and the chief are given by the Clohessy-Wiltshire equations [19],

$\dot{\boldsymbol{x}}=A{\boldsymbol{x}}+B\boldsymbol{u},$ (8)

where the state
$\boldsymbol{x}=[x,y,z,\dot{x},\dot{y},\dot{z}]^{T}\in\mathcal{X}=\mathbb{R}^{6}$,
the control $\boldsymbol{u}=[F_{x},F_{y},F_{z}]^{T}\in\mathcal{U}=[-u_{\rm
max},u_{\rm max}]^{3}$, and

$\displaystyle\centering A=\begin{bmatrix}0&0&0&1&0&0\\\ 0&0&0&0&1&0\\\
0&0&0&0&0&1\\\ 3n^{2}&0&0&0&2n&0\\\ 0&0&0&-2n&0&0\\\ 0&0&-n^{2}&0&0&0\\\
\end{bmatrix},B=\begin{bmatrix}0&0&0\\\ 0&0&0\\\ 0&0&0\\\ \frac{1}{m}&0&0\\\
0&\frac{1}{m}&0\\\ 0&0&\frac{1}{m}\\\ \end{bmatrix}.\@add@centering$ (9)

Here, $m$ is the mass of the deputy and $n$ is the mean motion of the chief’s
orbit. Each deputy is independent of all others, where all follow the same
dynamics.

Figure 3: Hill’s Frame.

For this analysis, the attitude of each deputy is not modeled, and therefore
it is assumed that each deputy is always pointing a sensor towards the chief.
Letting $\boldsymbol{p}$ define the position $[x,y,z]^{T}$ of the deputy in
Hill’s frame, the unit vector defining the orientation of the deputy’s sensor
boresight, $\hat{r}_{b}$, is given by,

$\hat{r}_{b}=-\frac{\boldsymbol{p}}{\|\boldsymbol{p}\|_{2}}.$ (10)

Since the direction of Earth’s center and chief spacecraft location are fixed
in Hill’s reference frame, the Sun is considered to rotate around the
spacecraft. For this analysis, it is assumed that the Sun rotates at a
constant rate in the $x-y$ plane. The unit vector pointing to the Sun,
$\hat{r}_{s}$, is defined as,

$\hat{r}_{s}=[\cos{\theta_{s}},\sin{\theta_{s}},0],$ (11)

where $\theta_{s}$ is the angle of the Sun with respect to the $x$-axis, and
$\dot{\theta}_{s}=-n$. $\hat{r}_{b}$ and $\hat{r}_{s}$ are shown in Figure 4.
This example assumes each deputy is modeled as a 6U CubeSat in Low Earth Orbit
(LEO), where $n=0.001027$ radians per second and $m=12$ kg.

Figure 4: Sensor boresight and Sun vectors.

###  3.1 Safety Constraints

While many safety constraints could be developed for this task, the following
constraints define $\mathcal{C}_{\rm A}$ for this analysis. The constraints
are defined for $N$ deputies, $\forall i\in\mathbb{Z}_{1:N}$, $\forall
j\in\mathbb{Z}_{1:N}$, $i\neq j$.

####  3.1.1 Safe Separation.

Each deputy spacecraft shall not collide with the chief. This constraint is
defined as,

$\varphi_{1}(\boldsymbol{x}):=\|\boldsymbol{p}_{i}\|_{2}-(r_{\rm d}+r_{\rm
c})\geq 0,$ (12)

where $r_{\rm d}$ is the collision radius of the deputy and $r_{\rm c}$ is the
collision radius of the chief. Additionally, each deputy spacecraft shall not
collide with another deputy. This constraint is defined as,

$\varphi_{2}(\boldsymbol{x}):=\|\boldsymbol{p}_{i}-\boldsymbol{p}_{j}\|_{2}-2r_{\rm
d}\geq 0.$ (13)

####  3.1.2 Dynamic Speed Constraint.

The speed of each deputy shall decrease as it moves closer to the chief. This
reduces risk of a high speed collision, as well as risk in the event of a
fault [9]. Additionally, each deputy should be moving slow enough to
appropriately inspect the chief. This constraint is defined as,

$\varphi_{3}(\boldsymbol{x}):=\nu_{0}+\nu_{1}\|\boldsymbol{p}_{i}\|_{2}-\|\boldsymbol{v}_{i}\|_{2}\geq
0,$ (14)

where $\nu_{0}$ is a minimum allowable docking speed, $\nu_{1}$ is a constant
rate at which $\boldsymbol{p}$ shall decrease, and
$\boldsymbol{v}_{i}=[\dot{x},\dot{y},\dot{z}]^{T}$.

####  3.1.3 Keep Out Zone.

Each deputy shall not align its sensor with the Sun. This constraint is
defined as,

$\varphi_{4}(\boldsymbol{x}):=\theta_{b_{i}}-\frac{\alpha_{FOV}}{2}\geq 0,$
(15)

where $\theta_{b_{i}}$ is the angle between the deputy’s sensor boresight and
the Sun, and $\alpha_{FOV}$ is the sensor’s field of view, as shown in Figure
5. $\theta_{b_{i}}$ is found using the dot product,

$\theta_{b_{i}}=\arccos{(\hat{r}_{b_{i}}\cdot\hat{r}_{s})}.$ (16)

Figure 5: Sun keep out zone.

Additionally, each deputy shall not align its sensor with the Sun if it were
to point its sensor at another deputy, in the event that it must change its
inspection target. This constraint is defined as,

$\varphi_{5}(\boldsymbol{x}):=\theta_{b,d_{i}}-\frac{\alpha_{FOV}}{2}\geq 0,$
(17)

where $\theta_{b,d_{i}}$ is defined as,

$\theta_{b,d_{i}}=\arccos{\left(\frac{\boldsymbol{p}_{i}-\boldsymbol{p}_{j}}{\|\boldsymbol{p}_{i}-\boldsymbol{p}_{j}\|_{2}}\cdot\hat{r}_{s}\right)}.$
(18)

####  3.1.4 Keep In Zone.

Each deputy shall not travel too far from the chief, such that they remain in
a specified proximity. This constraint is defined as,

$\varphi_{6}(\boldsymbol{x}):=r_{\rm max}-\boldsymbol{p}_{i}\geq 0,$ (19)

where $r_{\rm max}$ is the maximum relative distance.

####  3.1.5 Passively Safe Maneuvers.

Each deputy shall not collide with the chief in the event of a fault or loss
of power, where it may not be able to use its thrusters. That is, if
$\boldsymbol{u}=0$ for an extended period of time,
$\varphi_{1}(\boldsymbol{x})$ shall be enforced for the entire time period.
The closed form solution to the Clohessy-Wiltshire equations can be used to
determine $\boldsymbol{p}_{i}$ for any point in time, where,

$\begin{gathered}x(t)=(4-3\cos{nt})x_{0}+\frac{\sin{nt}}{n}\dot{x}_{0}+\frac{2}{n}(1-\cos{nt})\dot{y}_{0},\\\
y(t)=6(\sin{nt}-nt)x_{0}+y_{0}-\frac{2}{n}(1-\cos{nt})\dot{x}_{0}+\frac{4\sin{nt}-3nt}{n}\dot{y}_{0},\\\
z(t)=z_{0}\cos{nt}+\frac{\dot{z}_{0}}{n}\sin{nt}.\end{gathered}$ (20)

This trajectory is known as a Free Flight Trajectory (FFT). Letting
$\boldsymbol{p}_{i}=[x_{0},y_{0},z_{0}]^{T}$ and
$\boldsymbol{p}_{i}(t)=[x(t),y(t),z(t)]^{T}$, the constraint is defined as,

$\varphi_{7}(\boldsymbol{x}):=\inf_{t\in[t_{0},t_{0}+T]}\|\boldsymbol{p}_{i}(t)\|_{2}-(r_{\rm
d}+r_{\rm c})\geq 0,$ (21)

where $T$ is the time period to evaluate over starting at $t_{0}$. Note that
safety is only guaranteed for all time if $T=\infty$, but for practical
implementation $T$ is a finite value. Additionally, each deputy shall not
collide with another deputy during a FFT. This constraint is defined as,

$\varphi_{8}(\boldsymbol{x}):=\inf_{t\in[t_{0},t_{0}+T]}\|\boldsymbol{p}_{i}(t)-\boldsymbol{p}_{j}(t)\|_{2}-2r_{\rm
d}\geq 0.$ (22)

####  3.1.6 Structural Damage Threshold.

Each deputy shall not maneuver aggressively with high velocities. This also
ensures each deputy is moving slow enough to appropriately inspect the chief.
This is defined in terms of three separate constraints,

$\begin{gathered}\varphi_{9}(\boldsymbol{x}):=v_{\rm
max}^{2}-\dot{x}_{i}^{2}\geq 0,\quad\varphi_{10}(\boldsymbol{x}):=v_{\rm
max}^{2}-\dot{y}_{i}^{2}\geq 0,\\\ \varphi_{11}(\boldsymbol{x}):=v_{\rm
max}^{2}-\dot{z}_{i}^{2}\geq 0,\end{gathered}$ (23)

where $v_{\rm max}$ is the maximum allowable velocity. In addition, each
deputy shall remain within the bounds of its actuation limits. This is
enforced through the admissible control set $\mathcal{U}$ such that
$\boldsymbol{u}_{i}\in[-u_{\rm max},u_{\rm max}]^{3}$.

####  3.1.7 Fuel Limit.

The deputy shall adhere to a maximum cumulative fuel use limit, which is
considered in terms of $\Delta v$. This constraint is defined as,

$\varphi_{12}(\boldsymbol{x}):=\Delta v_{\rm max}-\Delta v_{i}\geq 0,$ (24)

where $\Delta v_{\rm max}$ is the maximum $\Delta v$ use, either for the
mission or for the life of the spacecraft. At a given time $t$, $\Delta v_{i}$
is defined as,

$\Delta v_{i}=\int_{t_{0}}^{t}\frac{F_{{\rm total}_{i}}}{m},$ (25)

where $F_{\rm total}=|F_{x}|+|F_{y}|+|F_{z}|$ is the total thrust of the
spacecraft.

####  3.1.8 Values.

The values used for this problem are defined in Table 1.

Table 1: Safety Constraint Values Parameter | Value
---|---
$m$ | 12 kg
$n$ | 0.001027 rad/s
$r_{\rm d}$ | 5 m
$r_{\rm c}$ | 5 m
$\nu_{0}$ | 0.2 m/s
$\nu_{1}$ | 2n rad/s
$\Delta v_{\rm max}$ | 20 m/s
$\alpha_{FOV}$ | 60 degrees
$r_{\rm max}$ | 1000 m
$T$ | 500 s
$v_{\rm max}$ | 1 m/s
$u_{\rm max}$ | 1 N

###  3.2 Control Invariant Constraints

Due to the admissible control set $\mathcal{U}$, the constraints that define
$\mathcal{C}_{\rm A}$ are not all suitable to explicitly define safety.
Instead, control invariant safety constraints must be developed that define
$\mathcal{C}_{\rm S}$. These constraints are defined as follows. Note that the
fuel limit is not considered to be part of $\mathcal{C}_{\rm S}$ because fuel
use is directly tied to actuation, so limiting fuel use would prevent the RTA
from enforcing all other constraints. An alternate solution to enforcing the
fuel limit will be discussed in the next section.

####  3.2.1 Safe Separation.

To maintain safe separation, each deputy spacecraft must consider when to
start slowing down to avoid a collision [14]. First, consider the projection
of the deputy’s velocity onto its position vector,

$\boldsymbol{v}_{{pr}_{i}}=\frac{\langle\boldsymbol{v}_{i},\boldsymbol{p}_{i}\rangle}{\|\boldsymbol{p}_{i}\|_{2}}.$
(26)

To avoid a collision, the deputy must slow $\boldsymbol{v}_{{pr}_{i}}$ to
zero. Therefore, the following constraint must be satisfied,

$\|\boldsymbol{p}_{i}\|_{2}+\int_{t_{0}}^{t_{0}+T_{b}}\boldsymbol{v}_{{pr}_{i}}+a_{\rm
max}t\,dt\geq r_{\rm d}+r_{\rm c},$ (27)

where $a_{\rm max}$ is the maximum acceleration of the deputy and
$T_{b}=(0-\boldsymbol{v}_{{pr}_{i}})/a_{\rm max}$ is the time for
$\boldsymbol{v}_{{pr}_{i}}$ to reach zero. $a_{\rm max}$ is found by
considering the worst-case acceleration due to natural motion from the system
dynamics in Eq. (8). This occurs when $\boldsymbol{x}=[-\|{\boldsymbol{r}_{\rm
H}}\|,0,0,-v_{\rm max},-v_{\rm max},-v_{\rm max}]^{T}$, which results in,

$a_{\rm max}=\frac{u_{\rm max}}{m}-3n^{2}\|{\boldsymbol{r}_{\rm H}}\|-2nv_{\rm
max}.$ (28)

By computing the integral in Eq. (27) and noting that the constraint only
needs to be enforced when the deputy is moving towards the chief
($\boldsymbol{v}_{{pr}_{i}}<0$), this becomes,

$h_{1}(\boldsymbol{x}):=\sqrt{2a_{\rm max}[\|\boldsymbol{p}_{i}\|_{2}-(r_{\rm
d}+r_{\rm c})]}+\boldsymbol{v}_{{pr}_{i}}\geq 0.$ (29)

Similarly, each deputy must conisder when to slow down to avoid collision with
another deputy. This constraint is defined as,

$h_{2}(\boldsymbol{x}):=\sqrt{4a_{\rm
max}(\|\boldsymbol{p}_{i}-\boldsymbol{p}_{j}\|_{2}-2r_{\rm
d})}+\boldsymbol{v}_{{pr}_{ij}}\geq 0,$ (30)

where,

$\boldsymbol{v}_{{pr}_{ij}}=\frac{\langle\boldsymbol{v}_{i}-\boldsymbol{v}_{j},\boldsymbol{p}_{i}-\boldsymbol{p}_{j}\rangle}{\|\boldsymbol{p}_{i}-\boldsymbol{p}_{j}\|_{2}}.$
(31)

Note that in Eq. (30), $a_{\rm max}$ is multiplied by 4 because both deputies
can slow down to avoid a collision.

####  3.2.2 Dynamic Speed Constraint.

From Reference 13, it can be shown that $\varphi_{3}$ is control invariant if
$u_{\rm max}$ adheres to the following limit,

$\nu_{1}\sqrt{3}v_{\rm max}+3n^{2}\frac{\sqrt{3}v_{\rm
max}-\nu_{0}}{\nu_{1}}+2nv_{\rm max}\leq\frac{u_{\rm max}}{m}.$ (32)

This limit ensures that at the point of worst-case acceleration, $u_{\rm max}$
is large enough to overcome the natural motion, thus preventing the deputy’s
speed from increasing and violating $\varphi_{3}$. If the constraint holds at
this point, then it will hold for all other points. Given the values from
Table 1, the limit holds and therefore $h_{3}=\varphi_{3}$.

####  3.2.3 Keep Out Zone.

To maintain safe separation from the conical keep out zone, it is considered
in terms of position rather than angles [14]. In this case, the unit vector of
the cone, $\hat{r}_{c}$, is assumed to align with the $-\hat{r}_{s}$ vector
and rotate in the $x-y$ plane at the rate $n$. The vector pointing from
$\boldsymbol{p}$ to its projection on $\hat{r}_{c}$ is given by,

$\boldsymbol{p}_{\hat{r}_{c}}=\boldsymbol{p}-\langle\boldsymbol{p},\hat{r}_{c}\rangle\hat{r}_{c}.$
(33)

The projection of $\boldsymbol{p}$ onto the cone is then,

$\boldsymbol{p}_{c}=\boldsymbol{p}+\sin{\theta}\cos{\theta}\left(\|\boldsymbol{p}_{\hat{r}_{c}}\|_{2}\hat{r}_{c}+\frac{\langle\boldsymbol{p},\hat{r}_{c}\rangle\boldsymbol{p}_{\hat{r}_{c}}}{\|\boldsymbol{p}_{\hat{r}_{c}}\|_{2}}\right)-\cos^{2}{\theta}\boldsymbol{p}_{\hat{r}_{c}}-\sin^{2}{\theta}\langle\boldsymbol{p},\hat{r}_{c}\rangle\hat{r}_{c},$
(34)

where $\theta=\alpha_{FOV}/2$. This defines the closest position on the cone
to the deputy. Similar to the safe separation constraint, the deputy must slow
down to avoid entering the cone. This can be written as,

$h_{KOZ}(\boldsymbol{x}):=\sqrt{2a_{\rm
max}\|\boldsymbol{p}-\boldsymbol{p}_{c}\|_{2}}+\boldsymbol{v}_{pr,c}\geq 0,$
(35)

where
$\boldsymbol{v}_{pr,c}=\langle\boldsymbol{v}-\boldsymbol{v}_{c},\boldsymbol{p}-\boldsymbol{p}_{c}\rangle/\|\boldsymbol{p}-\boldsymbol{p}_{c}\|_{2}$
and $\boldsymbol{v}_{c}=[0,0,n]\times\boldsymbol{p}_{c}$. For the case of each
deputy pointing towards the chief, $h_{4}=h_{KOZ}$ where
$\boldsymbol{p}=\boldsymbol{p}_{i}$ and $\boldsymbol{v}=\boldsymbol{v}_{i}$.
For the multi-agent keep out zone, $h_{5}=h_{KOZ}$ where
$\boldsymbol{p}=\boldsymbol{p}_{i}-\boldsymbol{p}_{j}$ and
$\boldsymbol{v}=\boldsymbol{v}_{i}-\boldsymbol{v}_{j}$ when
$\theta_{b,d_{i}}>\frac{\pi}{2}$, and otherwise
$\boldsymbol{p}=\boldsymbol{p}_{j}-\boldsymbol{p}_{i}$ and
$\boldsymbol{v}=\boldsymbol{v}_{j}-\boldsymbol{v}_{i}$. This sign change
allows each deputy to recognize when one is pointing towards the Sun.

####  3.2.4 Keep In Zone.

Again similar to the safe separation constraint, the deputy must slow down to
avoid reaching $r_{\rm max}$ [14]. This can be written as,

$h_{6}(\boldsymbol{x}):=\sqrt{2a_{\rm max}(r_{\rm
max}-\|\boldsymbol{p}_{i}\|_{2})}-\boldsymbol{v}_{{pr}_{i}}\geq 0.$ (36)

####  3.2.5 Passively Safe Maneuvers.

This constraint was constructed in a way that already considers the trajectory
of the deputy spacecraft. Because of this, safety is guaranteed for all time
if $T=\infty$, and therefore $h_{7}=\varphi_{7}$ and $h_{8}=\varphi_{8}$.

####  3.2.6 Structural Damage Threshold.

From Reference 13, it can be shown that $\varphi_{9}$, $\varphi_{10}$, and
$\varphi_{11}$ are respectively control invariant if $u_{\rm max}$ adheres to
the following limits,

$3n^{2}r_{\rm max}+2nv_{\rm max}\leq\frac{u_{\rm max}}{m},\quad 2nv_{\rm
max}\leq\frac{u_{\rm max}}{m},\quad n^{2}r_{\rm max}\leq\frac{u_{\rm
max}}{m}.$ (37)

These limits again ensure that at the point of worst-case acceleration,
$u_{\rm max}$ is large enough to overcome the natural motion, thus preventing
the deputy’s speed from increasing and violating the constraints. If the
constraints hold at this point, then they will hold for all other points.
Given the values from Table 1, the limits hold and therefore
$h_{9}=\varphi_{9}$, $h_{10}=\varphi_{10}$, and $h_{11}=\varphi_{11}$.

###  3.3 Centralized vs. Decentralized RTA

The control invariant constraints defined in the previous section can be
enforced using ASIF in two different ways. First, the control of all deputies
can be decentralized, where each deputy controls itself and uses a separate
RTA filter. Each deputy has knowledge of the state of all other deputies, but
they do not have knowledge of the control of all others. Decentralized RTA is
beneficial because it allows each agent to operate independently. Second, the
control of all deputies can be centralized, where all deputies are controlled
by a central controller and there is then only one RTA filter. This central
controller has knowledge of the state and control of all deputies. Centralized
RTA is beneficial because it allows all constraints for all agents to be
considered and enforced at the same time.

###  3.4 Switching-Based Fuel Limit

If a deputy violates the fuel limit, the RTA should guide the deputy
spacecraft to a safe state where no fuel can be used. In this case, closed
elliptical Natural Motion Trajectories (eNMT) [20] are used because they are
“parking orbits” where the deputy can orbit the chief without using any fuel.
Closed eNMTs centered at the origin of Hill’s frame satisfy the following,

$\dot{y}(0)=-2nx(0),\quad\dot{x}(0)=\frac{n}{2}y(0).$ (38)

While not all of the constraints in the previous section can be enforced on an
eNMT, the deputy will at minimum be able to maintain safe separation from the
chief. To enforce the fuel limit, the RTA uses a switching-based approach that
switches control to a backup controller when the constraint is violated. This
is sometimes referred to as a latched RTA approach, as the system does not
switch back and forth between the primary and backup controllers, but rather
remains latched to the backup controller until a specified condition is met.
The switching filter used for this analysis can be defined as follows.

Switching Filter

$\begin{array}[]{rl}\boldsymbol{u}_{\rm
act}(\boldsymbol{x})=\begin{cases}\boldsymbol{u}_{\rm
des}(\boldsymbol{x})&{\rm if}\quad\varphi_{12}(\phi^{\boldsymbol{u}_{\rm
b}}(t,\boldsymbol{x}))\geq 0,\quad\forall t\in[t_{0},t_{0}+T]\\\
\boldsymbol{u}_{\rm b}(\boldsymbol{x})&{\rm if}\quad
otherwise\end{cases}\end{array}$ (39)

Here, $\phi^{\boldsymbol{u}_{\rm b}}$ represents a prediction of the state
$\boldsymbol{x}$ at time $t$ under the backup control law $\boldsymbol{u}_{\rm
b}$. Note that for practical implementation, this trajectory is only simulated
for a finite time period $T$. The backup controller used for this analysis is
an LQR tracking controller that guides the deputy to the nearest eNMT. The
backup control law is,

$\boldsymbol{u}_{\rm
b}=-K_{1}\boldsymbol{e}(\boldsymbol{x}-\boldsymbol{x}_{\rm
des})-K_{2}\boldsymbol{z},$ (40)

where $K_{1}$ and $K_{2}$ are LQR gains,
$\boldsymbol{e}=\boldsymbol{x}-\boldsymbol{x}_{\rm des}$ is the error between
the current and desired states, $\boldsymbol{z}$ tracks the integral of the
error over time, and $\boldsymbol{x}_{\rm des}$ is defined as,

$\boldsymbol{x}_{\rm des}=[x,y,z,ny/2,-2nx,\dot{z}]^{T}.$ (41)

Note that a traditional LQR controller cannot be used because
$\boldsymbol{x}_{\rm des}$ is not a stationary point.

##  4 Results

This section presents and discusses simulation results of the centralized and
decentralized ASIF RTA, Monte Carlo simulations, and simulation results of the
switching-based fuel limit RTA.

###  4.1 Simulation Results

To evaluate the ability of the RTA to enforce all constraints, a simulation of
the inspection task with centralized RTA is shown in Figure 6. In this Figure,
safe regions are shaded green and unsafe regions are shaded red. The primary
controller for this simulation is an aggressive LQR controller designed to
violate the safety constraints. Note that the purpose of this primary
controller is not to complete the inspection task, but rather to show that RTA
assures safety of all constraints. The simulation is run with 5 deputies for
3,000 seconds, where for the first 1,000 seconds the primary controller
attempts to move each deputy to the origin, and for the last 2,000 seconds the
primary controller attempts to move each deputy to a distance greater than
$r_{\rm max}$. Figure 6 shows that the centralized RTA assures safety of each
constraint simultaneously.

(a) Chief safe separation, dynamic speed, keep in zone, and velocity limit
constraints. Colored lines represent each deputy.

(b) Deputy safe separation constraint. Colored lines represent the interaction
between two deputies.

(c) Keep out zone constraint. Colored lines represent each deputy.

(d) Multi-agent keep out zone constraint. Colored lines represent the
interaction between two deputies.

(e) Passively safe maneuvers constraint for one deputy. The blue line
represents the actual trajectory, while the cyan lines represent potential
FFTs.

(f) Control limits. Colored lines represent components of the control vector
for each deputy.

Figure 6: Simulation results for centralized ASIF RTA.

The same simulation was run again with decentralized RTA, where the results
are shown in Figure 7. In this case, the decentralized RTA is also able to
assure safety of each constraint simultaneously using a slightly different
behavior.

(a) Chief safe separation, dynamic speed, keep in zone, and velocity limit
constraints. Colored lines represent each deputy.

(b) Deputy safe separation constraint. Colored lines represent the interaction
between two deputies.

(c) Keep out zone constraint. Colored lines represent each deputy.

(d) Multi-agent keep out zone constraint. Colored lines represent the
interaction between two deputies.

(e) Passively safe maneuvers constraint for one deputy. The blue line
represents the actual trajectory, while the cyan lines represent potential
FFTs.

(f) Control limits. Colored lines represent components of the control vector
for each deputy.

Figure 7: Simulation results for decentralized ASIF RTA.

###  4.2 Monte Carlo

In order for human operators to trust an RTA filter, it must be shown to
assure safety for all possible scenarios. One way to achieve this is through
the use of Monte Carlo analysis, which runs a large number of simulations to
cover a substantial amount of the state space. While not every state can be
tested, this does allow the designer to verify that RTA can assure safety for
almost any state. For this analysis, 2,000 simulations with 5 deputies were
run for 500 seconds each. No primary control input was used during these
simulations. Latin hypercube sampling was used to compute initial conditions,
where initial conditions that violated any safety constraint were removed and
resampled. The same set of 2,000 initial conditions was used to simulate the
centralized and decentralized RTA filters.

Figure 8 shows the results of the Monte Carlo simulations for both centralized
and decentralized RTA, where failure refers to any initial condition where RTA
failed to assure safety for at least one deputy or the QP failed to find a
safe control input that satisfied all constraints. Overall, the centralized
RTA was able to assure safety of all constraints for 100% of the points, while
the decentralized RTA was able to assure safety of all constraints for 90.95%
of the points.

(a) Chief safe separation, dynamic speed, keep in zone, and velocity limit
constraints.

(b) Deputy safe separation constraint.

(c) Keep out zone constraint.

(d) Multi-agent keep out zone constraint.

Figure 8: Monte Carlo simulation results. Note that all centralized RTA test
cases were successful so there are no blue or yellow stars in the figures.
90.95% of decentralized cases were successful (both succeeded, in cyan),
leaving 9.05% of stars red.

The points where the decentralized RTA failed were all due to the multi-agent
keep out zone, where each deputy shall not align its sensor with the Sun if it
were to point its sensor at another deputy. These failures were due to the
design of the constraint, where each deputy is assumed to accelerate at the
maximum rate to avoid entering the exclusion zone. In the event that more than
one deputy is attempting to adhere to conflicting constraints at the same
time, it may not be able to accelerate at the maximum rate. For the case of
decentralized RTA, the other deputies are not aware of the conflicting
constraints, causing the RTA to eventually fail. For the case of centralized
RTA, the centralized controller is aware of all constraints, and can adjust
the control of each deputy to avoid this scenario. Multiple failure mitigation
strategies can be used for decentralized RTA, including adjusting the
strengthening function $\alpha(x)$ or removing the multi-agent keep out zone
constraint when necessary. The Monte Carlo simulation was run again using the
same 2,000 initial conditions, but removing the multi-agent keep out zone,
where the decentralized RTA was then able to assure safety of all constraints
for 100% of the points.

###  4.3 Switching-Based Fuel Limit

To evaluate the ability of the switching-based RTA to enforce the fuel limit,
another simulation of the inspection task is shown in Figure 9 with only one
deputy. The primary controller for this simulation is an aggressive LQR
controller designed to use as much fuel as possible. The simulation is run for
7,000 seconds.

(a) The trajectory of the deputy switches from an aggressive LQR controller to
a backup controller maneuvering the deputy to an eNMT, transitioning from cyan
to magenta as time increases.

(b) The RTA switches from an aggressive LQR controller to a backup controller
maneuvering the deputy to an eNMT when the line changes from blue to red.
Potential trajectories under the backup control law are shown in cyan.

(c) Control during the simulation, where the force produced in each direction
goes to zero once the deputy reaches the eNMT.

Figure 9: Simulation results with switching-based fuel limit.

The trajectory of the deputy is shown to maneuver to an eNMT around the chief
before the fuel limit is violated in Figure 9(a), where the position of the
deputy changes from cyan to magenta as time increases. Figure 9(b) shows the
fuel use constraint, and Figure 9(c) shows the control limits. It can be seen
that before the total $\Delta v$ exceeds the limit, the system switches to the
backup controller, which guides the deputy to the nearest eNMT, where the
deputy orbits the chief and $\Delta v$ does not increase for the remainder of
the simulation.

##  5 Conclusion

This paper developed several safety constraints for an autonomous spacecraft
inspection problem. Most of the constraints were enforced using an ASIF RTA
approach, which is an optimization-based approach that is minimally invasive
towards the primary controller, where individual simulations were used to show
that the ASIF RTA is able to enforce all constraints simultaneously. A
comparison was made between centralized and decentralized control, where Monte
Carlo analysis was used to show that centralized RTA was able to assure safety
for all test points, and decentralized RTA was able to assure safety for most
test points. Failure mitigation strategies were also presented, including
modifying the constraint strengthening function and removing low priority
constraints. While ASIF is a beneficial approach that is able to enforce most
constraints, a scenario was also presented where a switching-based RTA
approach more effectively enforced a fuel constraint. This analysis shows that
as the system and constraint complexity increases, RTA methods can be combined
to achieve the best safety assurance technique.

## References

  * [1] J. D. Schierman, M. D. DeVore, N. D. Richards, and M. A. Clark, “Runtime assurance for autonomous aerospace systems,” Journal of Guidance, Control, and Dynamics, Vol. 43, No. 12, 2020, pp. 2205–2217.
  * [2] T. Gurriet, M. Mote, A. D. Ames, and E. Feron, “An online approach to active set invariance,” 2018 IEEE Conference on Decision and Control (CDC), IEEE, 2018, pp. 3592–3599.
  * [3] A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada, “Control barrier functions: Theory and applications,” 2019 18th European control conference (ECC), IEEE, 2019, pp. 3420–3431.
  * [4] A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada, “Control barrier function based quadratic programs for safety critical systems,” IEEE Transactions on Automatic Control, Vol. 62, No. 8, 2016, pp. 3861–3876.
  * [5] A. Taylor, A. Singletary, Y. Yue, and A. Ames, “Learning for safety-critical control with control barrier functions,” Learning for Dynamics and Control, PMLR, 2020, pp. 708–717.
  * [6] E. Squires, P. Pierpaoli, R. Konda, S. Coogan, and M. Egerstedt, “Composition of safety constraints for fixed-wing collision avoidance amidst limited communications,” Journal of Guidance, Control, and Dynamics, Vol. 45, No. 4, 2022, pp. 714–725.
  * [7] J. Breeden and D. Panagou, “Guaranteed Safe Spacecraft Docking With Control Barrier Functions,” IEEE Control Systems Letters, Vol. 6, 2021, pp. 2000–2005.
  * [8] D. R. Agrawal and D. Panagou, “Safe control synthesis via input constrained control barrier functions,” 2021 60th IEEE Conference on Decision and Control (CDC), IEEE, 2021, pp. 6113–6118.
  * [9] M. L. Mote, C. W. Hays, A. Collins, E. Feron, and K. L. Hobbs, “Natural Motion-based Trajectories for Automatic Spacecraft Collision Avoidance During Proximity Operations,” 2021 IEEE Aerospace Conference (50100), IEEE, 2021, pp. 1–12.
  * [10] Y.-Y. Wu and H.-J. Sun, “Attitude Tracking Control With Constraints for Rigid Spacecraft Based on Control Barrier Lyapunov Functions,” IEEE Transactions on Aerospace and Electronic Systems, Vol. 58, No. 3, 2021, pp. 2053–2062.
  * [11] K. L. Hobbs, A. R. Collins, and E. M. Feron, “Risk-based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering,” AIAA Scitech 2021 Forum, 2021, p. 1122.
  * [12] K. L. Hobbs, Elicitation and Formal Specification of Run Time Assurance Requirements for Aerospace Collision Avoidance Systems.  PhD thesis, Georgia Institute of Technology, 2020.
  * [13] K. Dunlap, M. Hibbard, M. Mote, and K. Hobbs, “Comparing Run Time Assurance Approaches for Safe Spacecraft Docking,” IEEE Control Systems Letters, Vol. 6, 2021, pp. 1849–1854.
  * [14] M. Hibbard, U. Topcu, and K. Hobbs, “Guaranteeing Safety via Active-Set Invariance Filters for Multi-Agent Space Systems with Coupled Dynamics,” 2022 American Control Conference (ACC), IEEE, 2022, pp. 430–436.
  * [15] K. Hobbs, M. Mote, M. Abate, S. Coogan, and E. Feron, “Run Time Assurance for Safety-critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems,” arXiv preprint arXiv:2110.03506, 2021.
  * [16] K. Dunlap, “Run Time Assurance for Intelligent Aerospace Control Systems,” 2022\.
  * [17] M. Nagumo, “Über die lage der integralkurven gewöhnlicher differentialgleichungen,” Proceedings of the Physico-Mathematical Society of Japan. 3rd Series, Vol. 24, 1942, pp. 551–559.
  * [18] G. W. Hill, “Researches in the Lunar Theory,” American journal of Mathematics, Vol. 1, No. 1, 1878, pp. 5–26.
  * [19] W. Clohessy and R. Wiltshire, “Terminal Guidance System for Satellite Rendezvous,” Journal of the Aerospace Sciences, Vol. 27, No. 9, 1960, pp. 653–658.
  * [20] G. R. Frey, C. D. Petersen, F. A. Leve, I. V. Kolmanovsky, and A. R. Girard, “Constrained spacecraft relative motion planning exploiting periodic natural motion trajectories and invariance,” Journal of Guidance, Control, and Dynamics, Vol. 40, No. 12, 2017, pp. 3100–3115.