Neural Network Safety Check

Information

  • Patent Application
  • 20240383621
  • Publication Number
    20240383621
  • Date Filed
    May 15, 2024
    8 months ago
  • Date Published
    November 21, 2024
    a month ago
  • Inventors
    • Ré; Nathan Parrish (Billings, MT, US)
    • Sullivan; Timothy M. (Colorado Springs, CO, US)
    • Popplewell; Matthew D. (Westminster, CO, US)
    • Hanf; Tyler M. (Broomfield, CO, US)
  • Original Assignees
    • Advanced Space, LLC (Westminster, CO, US)
Abstract
A safety check method for checking a neural network output state onboard a spacecraft includes executing a neural network model onboard a spacecraft, which includes calculating a neural network output based on a current navigation state of the spacecraft, propagating the navigation state with the neural network output to a next target epoch to determine a next navigation state of the spacecraft, and evaluating whether the neural network output and the next navigation state are within predetermined bounds. When the neural network output and the next navigation state are within the predetermined bounds, the method is incremented to a next tick. When the neural network output and the next navigation state are determined to be outside the predetermined bounds, a corrective action may be taken.
Description
BACKGROUND
1. Field

Embodiments of the invention relate generally to the field of space navigation systems, and more specifically to systems employing neural networks for optimizing navigation controls in space.


2. Related Art

Space navigation systems are an integral part of both manned and unmanned space flights since the inauguration of space missions in the 1960s. Space navigation requires complicated calculations, taking into account not only the speed, the location, and the inertia of the spacecraft, but also the gravity field and many interspace perturbations from nearby planets and objects.


Multiple methods have been provided for spacecraft navigation using neural networks. For example, United States Patent Application Publication No. 2022/0227503 to Barnhart et al. discloses a system using genetic algorithms for safe swarm trajectory optimization. United States Patent Application Publication No. 2002/0083027 to Biggers et al. discloses a neural network trajectory command controller for controlling trajectory of an object. U.S. Pat. No. 8,880,246 to Karpenko et al. discloses method and apparatus for determining spacecraft maneuvers using a control law or steering law as a path constraint or as a dynamic constraint. Foreign reference CN112114521 to Xu et al. discloses an intelligent prediction control entry guidance method for a spacecraft. Foreign reference CN111498148 to Deng et al. discloses an FDNN-based intelligent spacecraft control method. Foreign reference RU2304549C2 discloses a self-contained onboard control system of “gasad-2a” spacecraft. Foreign reference CN112580819 discloses to Huyan et al. a low-orbit satellite precise orbit determination strategy supported by machine learning. Foreign reference CN114111773 to Liu et al. discloses a combined navigation method, a device, a system and a storage medium. Foreign reference KR102314038 discloses a method of determining a singular area, a method of generating an onboard map, and a method of determining a direction of a lander. Non-patent literature to Garcia et al. discloses an electric propulsion intelligent control (EPIC) toolbox for proximity operations and safety analysis in low-earth orbit (LEO). Non-patent literature to LaFarge et al. discloses a hybrid closed-loop guidance strategy for low-thrust spacecraft enabled by neural networks. Non-patent literature to Mughal et al. discloses a design of deep neural networks for transfer time prediction of spacecraft electric orbit-raising. Non-patent literature to Rubinstein et al. discloses a neural network optimal control in astrodynamics for application to the missed thrust problem.


SUMMARY

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Other aspects and advantages of the invention will be apparent from the following detailed description of the embodiments and the accompanying drawing figures.


In certain aspects, a safety check method for checking a neural network output state onboard a spacecraft includes: providing a neural network model to a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the neural network model onboard the spacecraft; calculating, via the neural network model, a neural network output based on a current navigation state of the spacecraft; propagating the navigation state with the neural network output to a next target epoch to determine a next navigation state of the spacecraft; and evaluating whether the neural network output and the next navigation state are within predetermined bounds.


In certain aspects, a safety check method for checking an output state onboard a spacecraft includes: providing a navigation app, a maneuver design app, and a safety check app to a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the navigation app, the maneuver design app, and the safety check app onboard the spacecraft; receiving navigation state inputs via the navigation app and outputting an updated navigation state estimate based upon the navigation state inputs; receiving, via the maneuver design app, the updated navigation state estimate and outputting a maneuver design; performing a safety check via the safety check app, wherein the safety check app receives the maneuver design and determines whether the maneuver design is within predetermined bounds; when the maneuver design is within the predetermined bounds, executing a spacecraft maneuver; and when the maneuver design is determined to be outside the predetermined bounds, taking a corrective action.


In certain aspects, a control architecture configured for performing a safety check on a maneuver design for navigation of a spacecraft includes: an autonomous control executive, a navigation app, a maneuver design app, and a safety check app stored in a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the autonomous control executive, the navigation app, the maneuver design app, and the safety check app onboard the spacecraft; wherein the autonomous control executive provides dedicated operation scheduling for the navigation app, the maneuver design app, and the safety check app; wherein the navigation app is configured to determine a navigation update based on a navigation state estimate of the spacecraft; wherein the maneuver design app is configured to determine a maneuver design based on the navigation update; and wherein the safety check app is configured to perform a safety check that determines whether the maneuver design is within predetermined bounds.





BRIEF DESCRIPTION OF THE DRAWING FIGURES

Embodiments of the invention are described in detail below with reference to the attached drawing figures, wherein:



FIG. 1A is a schematic diagram showing a ground-based control architecture for spacecraft navigation;



FIG. 1B is a schematic diagram showing an autonomous neural network control architecture for spacecraft navigation that takes place onboard a spacecraft;



FIG. 2 is a schematic diagram showing steps of an autonomous neural network control method for spacecraft navigation having a safety check;



FIG. 3. is a flow diagram showing steps of a safety check method for autonomous neural network control for spacecraft navigation, in an embodiment;



FIG. 4 shows a software architecture for performing a navigation update, a maneuver design, and a safety check onboard a spacecraft, in an embodiment; and



FIG. 5 shows an exemplary method for spacecraft navigation having a safety check, in an embodiment.





The drawing figures do not limit the invention to the specific embodiments disclosed and described herein. The drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the invention.


DETAILED DESCRIPTION

The following detailed description references the accompanying drawings that illustrate specific embodiments in which the invention can be practiced. The embodiments are intended to describe aspects of the invention in sufficient detail to enable those skilled in the art to practice the invention. Other embodiments can be utilized, and changes can be made without departing from the scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense. The scope of the invention is defined only by the appended claims, along with the full scope of the equivalents to which such claims are entitled.


In this description, references to “one embodiment,” “an embodiment,” or “embodiments” mean that the feature or features being referred to are included in at least one embodiment of the technology. Separate references to “one embodiment,” “an embodiment,” or “embodiments” in this description do not necessarily refer to the same embodiment and are also not mutually exclusive unless so stated and/or except as will be readily apparent to those skilled in the art from the description. For example, a feature, structure, act, etc. described in one embodiment may also be included in other embodiments, but is not necessarily included. Thus, the technology can include a variety of combinations and/or integrations of the embodiments described herein.


Space navigation requires accurately determining a spacecraft's trajectory periodically. Early trajectory determination techniques relied on optical tracking with telescopes. A single observation consists of two angular measurements (right ascension and declination). Therefore, a minimum of three measurements at three different epochs is required to provide six independent quantities required for a trajectory determination. Examples of optical tracking techniques include the method of Laplace, the method of Gauss, and the double r-iteration method.


Modern trajectory determination technologies depend on ground stations to pinpoint the position and movement of spacecraft. The ground stations use mechanisms such as radar, signal doppler, and laser reflectors to acquire orbital mechanics to calculate where the spacecraft is at a specific point in time. The orbital mechanics information is then compiled into an ephemeris table to calculate a precise position of the spacecraft. Other known remote sensing techniques can assist in space navigation by providing information in combination with the Global Navigation Satellite System (GNSS).


Spacecrafts are generally equipped with propulsion systems capable of providing small amounts of thrust for making orbital maneuvers. High thrust systems may operate for short bursts (seconds to minutes), while low thrust systems may operate over longer timeframes (days to weeks). For low thrust systems, small amounts of thrust may be applied over a significant fraction of a mission trajectory, which causes the optimal control problem (OCP) of shifting the spacecraft trajectory to be continuous rather than discrete, typically making the design of trajectories computationally more demanding.


As illustrated in a schematic diagram of FIG. 1A, space missions are currently operated via a ground-based mission control center (MCC) using a ground-based control method 100. The MCC manages spaceflight operations from launch until landing or the end of the mission. A staff of flight controllers and other support personnel monitor all aspects of the mission using telemetry and sending commands to the spacecraft using ground stations. Personnel supporting the mission from an MCC can include representatives of the attitude control system, power, propulsion, thermal, attitude dynamics, orbital operations and other subsystem disciplines.


In a step 110, navigation information for the spacecraft is received at the MCC. In an example of step 110, the MCC receives navigation information about the spacecraft and determines a state (e.g., a position vector and a velocity vector) of the spacecraft.


In a step 120, a navigation update is performed at the MCC. In an example of step 120, the MCC predicts a next state of the spacecraft. For example, a position vector and velocity vector of the spacecraft is predicted for the next contact time with the spacecraft.


In a step 130, instructions for a maneuver are calculated and uploaded to the spacecraft. In an example of step 130, the MCC uploads commands from the ground control station to the spacecraft. The instructions may be for the spacecraft to coast or for the thrusters to execute a maneuver, for example.


In an optional step 140, a status check is performed. In an example of step 140, the ground team may perform periodic status checks on the spacecraft state.


Method 100 occurs over a timeframe 150. Timeframe 150 may be on the order of days to weeks due to the time lag for communicating with a distant spacecraft from the ground control station. The uncertainty of the spacecraft state increases with increasing timeframes.


Method 100 is then repeated by returning to step 110.


Long-distance communication between the ground-based MCCs and spacecraft far from Earth requires large and sensitive scientific telecommunications systems. For example, NASA's Deep Space Network (DSN) consists of three facilities spaced equidistant from each other—approximately 120 degrees apart in longitude—around the world. These sites are at Goldstone, near Barstow, California; near Madrid, Spain; and near Canberra, Australia. The strategic placement of these sites permits constant communication with spacecraft as our planet rotates-before a distant spacecraft sinks below the horizon at one DSN site, another site picks up the signal.


Each of the three DSN sites has multiple large antennas and is designed to enable continuous radio communication between several spacecraft and Earth. All three complexes consist of at least four antenna stations, each equipped with large parabolic dish antennas and ultra-sensitive receiving systems capable of detecting incredibly faint radio signals from distant spacecraft. For example, one of the massive antennas, located at NASA's Goldstone Deep Space Communications Complex in Barstow, California, is the 70-meter (330-foot) DSS-14 antenna. Each complex is situated in semi-mountainous, bowl-shaped terrains to shield against external radio frequency interference. For maintaining an effective long-distance communication, the DSN's large antennas have focusing mechanisms that concentrate power when receiving data and when transmitting commands. The antennas must point very accurately towards the spacecraft in a tiny portion of the sky. To hear the spacecraft's faint signal, the antennas must be equipped with amplifiers. However, there are two challenges. First, the signal becomes degraded by background radio noise, or static, emitted naturally by nearly all objects in the universe, including the sun and earth. The background noise gets amplified along with the signal. Second, the powerful electronic equipment amplifying the signal adds noise of its own. The DSN uses highly sophisticated technology, including cooling the amplifiers to a few degrees above absolute zero, and special techniques to encode signals so the receiving system can distinguish the signal from the unwanted noise. Antenna stations are remotely operated from a signal processing center at each complex. The centers house electronic systems that point and control the antennas, receive and process data, transmit commands and generate spacecraft navigation data.


The antennas of the Deep Space Network are the indispensable link to explorers venturing beyond Earth. Space mission operations teams use the DSN Command System to control the activities of their spacecraft. Commands are sent to robotic probes as coded computer files that the craft execute as a series of actions. The DSN Tracking System provides two-way communication between Earth-based equipment and a spacecraft, making measurements that allow flight controllers to determine the position and velocity of spacecraft with great precision. They provide the crucial connection for commanding our spacecraft and receiving their never-before-seen images and scientific information on Earth, propelling our understanding of the universe, our solar system and ultimately, our place within it. In addition to its vital role as the communications hub for deep space exploration, the DSN is also used as an advanced instrument for scientific research, including radio astronomy and radar mapping of passing asteroids.


As missions voyage further from Earth, it is important to continuously communicate with these spacecrafts and navigate them through space when they are so far from these ground-based control stations. In recent years, advanced spacecrafts have been designed and built to reach further away locations such as the Sun, Mercury, Mars, Jupiter and the Didymos asteroids—a trend that will continue into the years ahead. As such, a new challenge appears in view of this trend.



FIG. 1B illustrates an exemplary autonomous neural network control method 105 for autonomously controlling navigation of a spacecraft. In contrast to using ground-based control, which operates with outdated navigation data, the onboard autonomous control uses the latest navigation data in real-time or near real-time. Compared with ground-based control, onboard autonomous control may provide an immediate course correction. A neural network (NN) model approximates solutions to the optimal control problem with minimal computational overhead, operating as a feedback controller. The NN model is trained with a set of training data. For example, a “training tube” may be established around a nominal path for low-thrust trajectory corrections. In embodiments, the training tube refers to position and velocity errors around the nominal path. The NN model is then trained to respond to the position and velocity errors within the training tube and return the position and velocity values back to the nominal path values within a predetermined time frame Δt. In some embodiments, checkpoints are employed prior to especially sensitive parts of a trajectory (e.g., a flyby or other critical maneuver) to help ensure that the NN model can maintain the spacecraft path within the training tube. In certain embodiments, several NN models are trained, with each NN model being responsible for a section of a nominal transfer, which may produce better results compared to training one NN model over the entire transfer. Outputs of the one or more NN models may be compared to traditional methods (e.g., Monte Carlo simulations) to evaluate performance of the one or more NN models.


In a step 115, an onboard navigation update is performed. In an example of step 115, a computer onboard the spacecraft determines a state of the spacecraft (e.g., position, direction, and velocity of the spacecraft) and calculates navigation updates of the spacecraft state to predict a next state of the spacecraft (e.g., at a target epoch). In embodiments, the spacecraft may receive information for determining the state of the spacecraft from the Global Positioning System (GPS), the optical navigation system, or the Cislunar Autonomous Positioning System (CAPS), for example. In some embodiments, the onboard computer determines the spacecraft state based on an earlier navigation update. Alternatively, the spacecraft state may also be determined based on information from instruments onboard the spacecraft.


In a step 125, instructions for a maneuver are calculated onboard the spacecraft. In an example of step 125, a navigation state estimate is input to a NN model via an onboard computer, and maneuver instructions are output from the NN model.


In optional step 140, a status check is performed. In an example of step 140, the spacecraft onboard computer performs periodic status checks. The status check outcomes may be transmitted to a ground control station for monitoring.


Method 105 occurs over a timeframe 155. Timeframe 155 is on the order of minutes (e.g., ten minutes) due to the neural network calculations being performed locally on the spacecraft flight computer. Therefore, the spacecraft state remains accurate due to the short timeframe. The short timeframe also enables the spacecraft to make immediate course corrections whenever necessary. For a long duration maneuver (days to weeks), instructions for the next maneuver may be updated repeatedly on a shorter timeframe (e.g., every 5 to 10 minutes) while the maneuver is happening by using the NN model onboard the spacecraft.


Following step 125, method 105 is repeated by returning to step 115. Method 105 may be repeated at a more frequent rate compared with method 100 due to timeframe 155 being much shorter compared to timeframe 150.


Neural networks (NN), also known as artificial neural networks (ANNs) or simulated neural networks (SNNs), are a subset of machine learning algorithms. Their name and structure are inspired by the human brain, mimicking the way that biological neurons signal to one another. Artificial neural networks (ANNs) are comprised of a node of layers, containing an input layer, one or more hidden layers, and an output layer. Each node, or artificial neuron, connects to another and has an associated weight and threshold. If the output of any individual node is above the specified threshold value, that node is activated, sending data to the next layer of the network. Otherwise, no data is passed along to the next layer of the network.


Neural network (NN) control provides a means for on-board maneuver correction without over-simplifying the calculations by learning the relationship between a spacecraft's state and an optimal maneuver to maintain an operational slot. The spacecraft's guidance and navigation system may evaluate the NN control in-flight, resulting in a reduction in operational costs and improvement in maneuver accuracy.


A neural network control for electric propulsion (NNEP) algorithm may be used with the following non-limiting examples: (1) application of NNEP algorithm to maneuver corrections for minimum-fuel transfers; (2): application of NNEP algorithm to GEO station keeping; (3) application of NNEP algorithm to Earth-Moon Halo Orbit station keeping; (4) application of NNEP algorithm to trajectory correction maneuvers for a chemical propulsion interplanetary mission; (5) application of NNEP algorithm to many-revolution spiral transfers; and (6) LEO station keeping. In embodiments, neural networks may also be used for missions with chemical propulsion, for large or small maneuvers, and for a range of dynamical environments including Earth orbit, the cislunar environment, and interplanetary space.


A method 200 is illustrated in FIG. 2 as a schematic diagram showing the steps of an exemplary concept of operations (ConOps) method for Optimal Low Thrust Artificial Intelligence Reoptimization (OLTAIR). The ConOps method for OLTAIR may be modified to suit particular mission constraints. Method 200 is an example of autonomous neural network control method 105 of FIG. 1B used for low-thrust maneuver correction. The ConOps method of OLTAIR comprises software, logically broken-up into two distinct sections: (1) Liboltair, which contains the platform-independent core autonomous trajectory correction logic; and (2) The cFS ecosystem, which contains all platform-specific functionality to use Liboltair in a flight-safe environment. Liboltair further includes a set of user-defined platform-specific interfaces, a generated ‘almanac’ containing a set of time dependent pre-trained neural network models, and the core logic to operate on the almanac and to utilize the interfaces as needed for autonomous trajectory corrections. Liboltair may operate through a single-entry point function known as the ‘tick’ function to avoid a control-loop specific design.


A navigation update 210 comprises a spacecraft computer receiving a navigation update and determines a current spacecraft state (e.g., state x{right arrow over ( )}(t)), as described below in connection with FIG. 3. Navigation update 210 may be provided live by the Global Positioning System (GPS), the optical navigation system, or the Cislunar Autonomous Positioning System (CAPS). Alternatively, navigation update 210 may be a logical calculation based on an earlier live navigation update, or navigation update 210 may be acquired by instruments onboard the spacecraft.


Following navigation update 210, an exemplary neural network safety check method 300 may be performed. For example, an onboard computer may perform the neural network safety check method 300 to evaluate one or more ticks 220, prior to the spacecraft executing any tick function, as further described below in connection with FIG. 3. For example, method 300 may propagate NN model outputs immediately after they are generated and evaluate whether an expected final state is within a predetermined tolerance. If an evaluation by the neural network safety check method 300 passes, then method 200 executes the one or more ticks 220.


Each tick 220 includes two separate maneuver types: a computer maneuver design 221 and a spacecraft maneuver 222. In embodiments, the computer maneuver design 221 performs the autonomous trajectory correction logic of Liboltair described above. The computer maneuver design 221 includes the following steps: 1) The computer checks the current state and estimates if a maneuver is needed in this step. If the maneuver is not needed in this step, the computer coasts to the next tick evaluation. If the maneuver is needed in this step, the computer performs the next computer maneuver step. 2) The computer identifies the relevant model weights to read from an almanac. The almanac is a collection structure of neural networks, which contains NN models and ancillary information. 3) The computer evaluates NN models to map a state estimate x{right arrow over ( )}(ti) to a maneuver Δv{right arrow over ( )}(ti). 4) The onboard propagator predicts a next state x{right arrow over ( )}(ti+1), assuming the spacecraft executes the commanded maneuver perfectly. 5) The computer increments to the next tick 220. It takes less than a second for the computer to perform the individual steps of the computer maneuver design 221. Executing the spacecraft maneuver 222 may take minutes or longer. Because the computer maneuver design 221 is performed much more quickly than the spacecraft maneuver 222, the neural network safety check method 300 is able to execute a series of steps of the computer maneuver design 221 without performing the spacecraft maneuver 222 and evaluate the spacecraft commands and outcomes much faster than, and prior to, the real-time execution of the spacecraft maneuver 222. Following a successful evaluation by the NN safety check method 300, the spacecraft maneuver 222 may then be executed. Once the spacecraft executes a commanded thrust, it then coasts until the next tick 220. One or more ticks 220 may be performed until the spacecraft computer receives a next set of navigation updates 210. The spacecraft computer then repeats the NN safety check method 300 and one or more ticks 220 in another cycle.


A working example of a neural network model is the application of neural network control for electric propulsion (NNEP) in 3-Body orbits. The reliability of the NN model has been demonstrated at the following three levels: 1) the NN is automatically tested with every code version submitted to a version control system, which verifies that the NN output vector matches expected values when provided with a given set of weight parameters and a given input vector; and, 2) the NN is tested via Monte Carlo trials on ground computers, which includes randomly sampling an expected distribution of spacecraft states for which the NN should be valid, evaluating the NN on each of those states, and propagating the output to the target epoch. Monte Carlo ground testing verifies that the NN training did not overfit the training data and that the NN is accurate for flight operations. If the NN is found to be inaccurate, a smaller NN model may be used, which provides more robust but less precise outputs, and/or more training samples may be generated for the NN model. The testing provides information as to how a spacecraft responds to stressing situations prior to uploading the NN to the spacecraft. (3) The NNEP technology has reliability built into its architecture. For example, the flight software (FSW) propagates the NN outputs immediately after they are generated, evaluating whether the expected final state is within tolerance and whether path constraints (e.g., eclipses or close approaches to other bodies) are met.


Historically, achieving a 2-day navigation and control update loop with human-in-the-loop control has required 24-hr coverage from operations teams and is only practical for short periods of critical operations. In contrast, once a state estimate is available for NNEP, thruster commands may be provided immediately, drastically reducing the time of the navigation and control update loop, while also automating the process. When the thruster is throttled smoothly, the NN model output is virtually indistinguishable from a perfect, ground-generated solution.



FIG. 3 shows an exemplary neural network safety check method 300. The NN safety check method 300 autonomously performs an onboard simulation prior to executing any tick function. In embodiments, the NN model is used to simulate one or more ticks 220 until a predetermined time in the future. For example, the NN model computes a spacecraft maneuver (e.g., a coast, a thrust, a reaction wheel moment, etc.) in a step 320, then the onboard propagator simulates the motion resulting from the spacecraft maneuver in a step 330 without actually executing the maneuver. The NN model outputs are evaluated in a step 340 to determine if any of the propagated spacecraft states have deviated more than expected from a reference path (e.g., if any model constraints have been broken). The result of the safety check method 300 is pass or fail. If the safety check result is “pass” (i.e., no constraints are violated from the onboard simulation's prediction over the next predetermined timeframe), no approval from ground control is needed to proceed, and the spacecraft executes the maneuver one tick at a time. If the safety check result is “fail”, corrective action is taken before proceeding, as described below.


Prior to performing the NN safety check method 300, a navigation update 210 is performed as described above in connection with FIG. 2. For example, a computer onboard the spacecraft receives updated navigation information and determines the current spacecraft state. The spacecraft state x{right arrow over ( )}(t) is for example a position and a direction (i.e., a vector) at the current time. The navigation update may include the spacecraft state x{right arrow over ( )}(t) as well as the current time t. In an example of step 210, live navigation updates may be provided by the Global Positioning System (GPS), the optical navigation system, or the Cislunar Autonomous Positioning System (CAPS). In another example of step 210, the navigation updates are a logical calculation based on an earlier live navigation update. Alternatively, the navigation updates may also be acquired by instruments onboard the spacecraft.


In step 320, the onboard computer calculates neural network (NN) outputs from the NN model. The NN outputs may be from any NN model, including but not limited to a NN electric propulsion (NNEP) algorithm applied for use with various spacecraft maneuvers such as those described above. In one particular example of step 320 regarding maneuver corrections for minimum-fuel transfers, the onboard neural network control for electric propulsion (NNEP) model is used to calculate and return the minimum-energy solution: minimizing ∫u(t)2dt, where u(t) is the control magnitude at time t. While that provides accurate solutions, real spacecraft operations are typically more concerned with the minimum-fuel solution: minimizing ∫u(t)2dt. The minimum-fuel solution has discontinuities at thrust on/off switching points making it a much more difficult and sensitive optimization problem. The minimum-fuel solution is also discontinuous in the relationship between state x{right arrow over ( )}(t) and costate λ{right arrow over ( )}(t) at time t, making it hard for a NN model to accurately learn the control response to a given state error. To get around the discontinuity problem, NN models are trained on the smoothed-minimum-fuel problem. For the smoothed-minimum-fuel problem, the objective is modified to: ∫(u+∈[ulogu+(1-u) log(1-u)])dt, where u=u(t) and ∈ is a smoothing term. When ∈ is small (˜10−4), the optimal solution is nearly indistinguishable from the true minimum-fuel solution. When ∈ is large (˜0.1), the optimal solution resembles the minimum-energy solution. In embodiments, using ∈=10−2 works well by providing nearly-fuel-optimal solutions while also being smooth enough for NN models to accurately capture the relationship between state x{right arrow over ( )}(t) and costate Δ{right arrow over ( )}(t). For the onboard NNEP model, one or a plurality of NN inputs, including the current time (t*), the perturbed position or δr{right arrow over ( )}, and the perturbed velocity δv{right arrow over ( )}, are calculated and propagated to target epochs. The fixed-time two-point boundary value problem (TPBVP) is solved for the transfer back to the nominal at time t*+Δt, where the time interval Δt is fixed and may be on the order of a few days or tens of days.


In step 330, the NN model output is propagated to the next target epoch (i.e., the next “tick”) to determine a next navigation state of the spacecraft. In an example of step 330 for maneuver corrections for minimum-fuel transfers, the onboard computer propagates the spacecraft state with NN model output control to the next tick epoch.


In step 340, the onboard computer evaluates whether the calculated NN model output and the propagated spacecraft state are within predetermined bounds. In an example of step 340 for maneuver corrections for minimum-fuel transfers, if the calculated control and propagated state pass the evaluation, (e.g., the onboard computer determines that the calculated control and propagated state are within predetermined bounds), then the safety check result is “pass” and method 300 increments to the next tick in step 390. The spacecraft may then begin executing one or more ticks in step 220 until the next navigation update 210, as described above in connection with FIG. 2.


If in step 340 the result of the safety check is “fail”, (e.g., the onboard computer determines that the calculated control and propagated state are not within predetermined bounds), then a corrective action is taken in a step 350 without the spacecraft performing the next tick function. Only if the safety check fails (e.g., one or more constraints are violated) does the spacecraft need input from the ground. For example, a hardware failure may put the spacecraft on a substantially different trajectory than the planned trajectory.


Example parameters that are checked during the safety check method 300 include but are not limited to: a close approach distance to a planet or another spacecraft; a spacecraft attitude (e.g., if a thrust maneuver would cause the spacecraft to slew to an attitude that would expose a sensitive instrument to direct sunlight); a position or velocity deviation that puts the spacecraft outside of an acceptable trajectory range; an amount of propellant used (e.g., to ensure the NN output control will not consume more than the expected range of propellant).


In step 350, corrective action is taken. For example, the corrective action may be to revert to legacy human-in-the-loop operations in a step 380. The corrective action may be mission dependent. For example, a safety maneuver may be executed (e.g., raise altitude), then the spacecraft waits for ground control input; or, the spacecraft may coast while waiting for ground control input. In some embodiments, the onboard computer autonomously reverts to a different NN model in a step 360 before reverting to human-in-the-loop operations in step 380.


In optional step 360, a different NN model is used. In an example of step 360, a smaller NN model is used to provide a more robust but less accurate NN model output. The onboard computer then repeats steps 320, 330, and 340 of NN safety check method 300 based on the smaller NN model. For example, the original NN model may be nominally trained to have dispersion states on the order of 1000-km, while a smaller NN model may be trained with larger dispersion states (e.g., on the order of 10,000-km). The smaller NN model is less accurate but more robust than the original NN model. For certain missions and for certain periods within a mission, the smaller NN model may be used while ground control is notified and human-in-the-loop operations are considered.


In step 380, legacy human-in-the-loop operations may be used. In an example of step 380, a human operator(s) would uplink control commands as a function of time for returning the spacecraft to the reference path within the time interval Δt.


Prior to use of a NN model onboard a spacecraft, extensive Monte Carlo random sampling may be performed on the ground. Expected error sources such as orbit determination inaccuracies, thruster mis-calibration or off-pointing, and temporary forced-coasting periods are randomly sampled in end-to-end simulations of the trajectory or orbit where the NN model will be used.



FIG. 4 shows an exemplary software architecture within which a safety check may be performed for verifying output from one or more models via the spacecraft computer onboard the spacecraft. An autonomous control executive (ACE) 410 is configured for autonomously scheduling activities associated with autonomous control of spacecraft, including but not limited to autonomous neural network control for spacecraft navigation. For example, ACE 410 provides dedicated scheduling of operations for controlling the timing of various functions, including but not limited to functions performed by a navigation app 420, a maneuver design app 430, and a safety check app 440. ACE 410 may be configured to handle all scheduling activities including incrementing of ticks. For example, ACE 410 may schedule ticks 220 of FIG. 2 instead of via the OLTAIR software of the example described above. However, other schedule processes that do not rely upon a tick cadence may be employed via ACE 410 without departing from the scope hereof. The frequency of navigation updates, maneuver designs, execution of designed maneuvers, and safety checks may be tailored via ACE 410 based upon specific mission and vehicle needs.


Navigation app 220 comprises a software application stored in non-volatile memory of the spacecraft computer configured for providing navigation determinations, including but not limited to navigation update 210 of FIG. 2. ACE 410 provides one or more commands to navigation app 220 (e.g., a command to provide a navigation update). Navigation app 420 receives the one or more commands, performs the requested calculations, and returns an output (e.g., navigation update 210) back to ACE 410. In embodiments, navigation app 220 uses one or more NN models based on training data sets to determine the navigation update.


Similarly, maneuver design app 430 comprises a software application stored in non-volatile memory of the spacecraft computer configured for providing spacecraft maneuver commands, including but not limited to computer maneuver design 221. ACE 410 provides one or more commands to maneuver design app 430 (e.g., a command to determine steps for a certain spacecraft maneuver). Maneuver design app 430 receives the one or more commands, performs the requested calculations to determine a maneuver design output state, and outputs the maneuver design output state (e.g., computer maneuver design 221) back to ACE 410. In embodiments, maneuver design app 430 uses one or more NN models based on training data sets to determine the maneuver design output state.


Lastly, safety check app 440 comprises a software application stored in non-volatile memory of the spacecraft computer configured for performing a safety check of the maneuver design output from the maneuver design app 430. The safety check may include but is not limited to safety check 300 of FIG. 3. ACE 410 provides one or more commands to safety check app 440 (e.g., a command to verify the steps of a spacecraft maneuver design). Safety check app 440 receives the one or more commands, performs the requested functions, and returns a pass/fail output to ACE 410 as to whether the maneuver design is outside predetermined bounds (e.g., to determine if any of the propagated spacecraft states have deviated more than expected from a reference path).


Due to the dedicated scheduling of operations performed by ACE 410, one or more safety checks may be evaluated at any time depending on mission needs. In other words, the order and timing of the steps shown in FIG. 2 may be varied; likewise, the sequence of steps shown in FIG. 3 and described above may also be varied. For example, using ACE 410, safety check 300 may be evaluated after any type of onboard maneuver process, including NN control and other (i.e., non-NN) types of control. Another advantage of using ACE 410 is that additional capabilities may be easily added in the future.



FIG. 5 shows an exemplary ConOps method 500 for autonomous spacecraft navigation. The ConOps method 500 may be configured generally for executing any type of vehicle maneuver process onboard the vehicle, including but not limited to the OLTAIR ConOps method described above in connection with FIG. 2. ConOps method 500 may be used in conjunction with ACE 410 of FIG. 4 or on a tick cadence similar to FIG. 2 or using another scheduling scheme.


For example, ACE 410 may provide a command to navigation app 420 to perform a navigation update. In embodiments, ACE 410 may command navigation app 420 to receive inputs continuously or on a repeating schedule. For example, measurements or other navigation information may be received by navigation app 420 when it becomes available or shortly thereafter. Alternatively, navigation app 420 is configured to listen for inputs and executes the navigation update immediately upon receiving an input.


Navigation app 420 then outputs the navigation update (e.g., a vehicle state estimate) that is received by maneuver design app 430. In embodiments, the navigation app 420 executes a NN model for providing autonomous neural network control for spacecraft navigation. Maneuver design app 430 then determines a maneuver design output state for the vehicle (e.g., a set of commands to the spacecraft propulsion and guidance systems). The maneuver design output state is output from maneuver design app 430 and received by safety check app 440, which then performs a safety check (e.g., as described above in connection with FIG. 3).


If the result of the safety check is “fail”, (e.g., the onboard computer determines that the calculated control and propagated state are not within predetermined bounds), then a corrective action is taken in a step 350 without the spacecraft performing the commanded steps of the maneuver design app 430. The corrective action may include reverting to human-in-the-loop operations 380, as described above in connection with FIG. 3; or the corrective action man include reverting to a different maneuver design 560 (e.g., via maneuver design app 430). The different maneuver design may comprise a simpler model being more robust and less accurate than an original maneuver design. For example, the different maneuver design 560 may include a different NN model as described above in step 360; however, any other type of maneuver design may be determined for taking a corrective action, including but not limited to the use of a non-linear programming solver or an optimization software such as the Sparse Nonlinear OPTimizer (SNOPT) software package.


If the result outputted from safety check app 440 is “pass” (i.e., no constraints are violated from the onboard simulation's prediction over the next predetermined timeframe), no approval from ground control is needed to proceed, and the vehicle executes the maneuver in step 550.


In operation, ConOps method 500 may be used for autonomous spacecraft navigation control during a long interplanetary trajectory where electric propulsion is active for months on end. In another example, ConOps method 500 may be used for autonomous spacecraft navigation control during a lunar landing where the entire process executes on a much shorter time scale (e.g., minutes to days).


Although the invention has been described with reference to the embodiments illustrated in the attached drawing figures, it is noted that equivalents may be employed and substitutions made herein without departing from the scope of the invention as recited in the claims.


Having thus described various embodiments of the invention, what is claimed as new and desired to be protected by Letters Patent includes the following:

Claims
  • 1. A safety check method for checking a neural network output state onboard a spacecraft, the method comprising: providing a neural network model to a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the neural network model onboard the spacecraft;calculating, via the neural network model, a neural network output based on a current navigation state of the spacecraft;propagating the navigation state with the neural network output to a next target epoch to determine a next navigation state of the spacecraft; andevaluating whether the neural network output and the next navigation state are within predetermined bounds.
  • 2. The method of claim 1, when the neural network output comprises a navigation control for the spacecraft.
  • 3. The method of claim 1, when the neural network output and the next navigation state are within the predetermined bounds, the evaluation passes and the method increments to a next tick.
  • 4. The method of claim 1, when the neural network output and the next navigation state are determined to be outside the predetermined bounds, the evaluation fails and the method does not increment to a next tick.
  • 5. The method of claim 4, comprising taking a corrective action when the evaluation fails.
  • 6. The method of claim 5, wherein taking the corrective action comprises reverting to a different neural network model.
  • 7. The method of claim 6, wherein reverting to a different neural network model comprises providing a smaller neural network model to the disk storage of the spacecraft computer, the smaller neural network model being more robust and less accurate than an original neural network model, then repeating the steps of calculating, propagating, and evaluating.
  • 8. The method of claim 5, wherein taking a corrective action comprises performing a human-in-the-loop operation in which one or more commands are sent to the spacecraft from a ground control station.
  • 9. The method of claim 8, comprising commanding the spacecraft to perform a safety maneuver while waiting for the one or more commands from the ground control station.
  • 10. The method of claim 1, wherein the step of evaluating comprises checking that parameters are within a predetermine range, the parameters comprising one or more of an approach distance, a spacecraft attitude, a position or velocity deviation, and an amount of propellant used.
  • 11. A safety check method for checking a maneuver design output state onboard a spacecraft, the method comprising: providing a navigation app, a maneuver design app, and a safety check app to a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the navigation app, the maneuver design app, and the safety check app onboard the spacecraft;receiving navigation state inputs via the navigation app and outputting an updated navigation state estimate based upon the navigation state inputs;receiving, via the maneuver design app, the updated navigation state estimate and outputting a maneuver design output state;performing a safety check via the safety check app, wherein the safety check app receives the maneuver design output state and determines evaluating whether the maneuver design output state is within predetermined bounds;when the maneuver design output state is within the predetermined bounds, executing a spacecraft maneuver; andwhen the maneuver design output state is determined to be outside the predetermined bounds, taking a corrective action.
  • 12. The method of claim 11, wherein the maneuver design output state comprises a neural network output and a next navigation state.
  • 13. The method of claim 11, wherein taking the corrective action comprises commanding the spacecraft to perform a safety maneuver.
  • 14. The method of claim 13, wherein commanding the spacecraft to perform a safety maneuver comprises raising an altitude of the spacecraft.
  • 15. The method of claim 11, wherein taking the corrective action comprises reverting to a simpler maneuver design being more robust and less accurate than an original maneuver design, then repeating the step of performing the safety check.
  • 16. The method of claim 11, wherein taking a corrective action comprises sending an error message to a ground control station and waiting for a reply message from the ground control station.
  • 17. A control architecture configured for performing a safety check of a maneuver design for navigation of a spacecraft, the control architecture comprising: an autonomous control executive, a navigation app, a maneuver design app, and a safety check app all stored in a disk storage of a spacecraft computer, wherein the spacecraft computer is configured to execute the autonomous control executive, the navigation app, the maneuver design app, and the safety check app onboard the spacecraft;wherein the autonomous control executive provides dedicated operation scheduling for the navigation app, the maneuver design app, and the safety check app;wherein the navigation app is configured to determine a navigation update based on a navigation state estimate of the spacecraft;wherein the maneuver design app is configured to determine a maneuver design based on the navigation update; andwherein the safety check app is configured to perform a safety check that determines whether the maneuver design is within predetermined bounds.
  • 18. The control architecture of claim 17, wherein the dedicated operation scheduling provided by the autonomous control executive comprises determining the frequency of navigation updates, maneuver designs, and safety checks.
  • 19. The control architecture of claim 17, wherein the navigation app comprises a neural network model, and the navigation app is configured to determine a neural network model output based on a current navigation state of the spacecraft.
  • 20. The control architecture of claim 17, wherein: when the maneuver design is determined to be within the predetermined bounds, a spacecraft maneuver is executed; andwhen the maneuver design is determined to be outside the predetermined bounds, a corrective action is taken.
CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of priority of U.S. Provisional Patent Application No. 63/592,787, entitled Incremental Neural Network Model Inference, and filed on Oct. 24, 2023; U.S. Provisional Patent Application No. 63/594,182, entitled Almanac of Neural Network Models, and filed on Oct. 30, 2023; and U.S. Provisional Patent Application No. 63/502,309, entitled Neural Network Safety Check, and filed on May 15, 2023, the disclosures of which are herein incorporated by reference in their entirety.

Provisional Applications (3)
Number Date Country
63502309 May 2023 US
63592787 Oct 2023 US
63594182 Oct 2023 US