非对称可靠性航天器自主性：协同设计有能力的学得制导导航控制系统与经过验证的、适应感知的运行时防护盾
Reliability-Asymmetric Spacecraft Autonomy: Co-Designing a Capable Learned GNC Stack with a Verified, Adaptation-Aware Runtime Shield
AI总结：
提出AMPLE-GNC三层制导导航控制系统，结合学得组件与运行时防护盾，实现深空任务自主性的能力与可认证性；通过边缘指挥官、故障自适应控制器和适应感知恢复证书，在仿真中验证了高自主性与安全性。
摘要：
深空任务需要既具备能力又可通过认证的星载自主性。基于规则的自主性可通过认证但脆弱，而学得自主性能力强但难以验证。我们提出AMPLE-GNC，一个三层制导、导航和控制系统。其能力路径结合了一个将自然语言映射到PDDL+的小型基础模型指挥官、一个约束筛选验证器和一个故障自适应控制器。所有三个组件都被一个运行时防护盾所约束，该防护盾包含九个线性时序逻辑不变量，其预测器合理性由Kind 2模型检查器进行机器验证。在6-DOF Basilisk测试平台上，我们做出三项贡献。首先，我们部署了一个边缘指挥官。通过语法约束解码微调一个预训练的360M模型，给出了硬输出有效性保证和84%的计划器可执行动作。在去泄露测试中，新颖措辞泛化准确率为38%精确和51%动作，经过措辞多样性再微调后升至48%精确；我们将语法有效性与语义准确性分开。其次，我们引入了一个故障自适应控制器。快速运动自适应在线推断潜在致动器故障，并在训练随机化包络内恢复97.8%的致动器符号故障和94.4%的连续增益故障。故障无感知的PD和从头开始的端到端强化学习得分均为0%，而最强的经典自适应基线在连续增益上达到55%。在包络之外，分裂一致再训练得分为57-67%，而增加4倍域内数据反而降低性能，表明随机化广度而非数据量驱动泛化。在星跟踪器噪声高达0.005时鲁棒性平坦。第三，我们表明一个锁存安全保持防护盾可以抑制即使是有能力的控制器。一个具有适应感知接合的分裂一致恢复截止证书调和了安全与恢复，使控制器保持94.5%自主性，同时仍然捕捉非恢复情况。
英文摘要：
Deep-space missions need onboard autonomy that is both capable and certifiable. Rule-based autonomy is certifiable but brittle, while learned autonomy is capable but hard to verify. We present AMPLE-GNC, a three-tier guidance, navigation, and control stack. Its capability path combines a small foundation-model commander that maps natural language to PDDL+, a constraint-screening verifier, and a fault-adaptive controller. All three are bounded by a runtime shield with nine linear-temporal-logic invariants whose predictor soundness is machine-checked by the Kind 2 model checker. On a 6-DOF Basilisk testbed, we make three contributions. First, we deploy an edge commander. Fine-tuning a pretrained 360M model with grammar-constrained decoding gives a hard output-validity guarantee and 84% planner-executable actions. On a de-leaked test, novel-phrasing generalization is 38% exact and 51% action, rising to 48% exact after phrasing-diversity re-finetuning; we separate syntactic validity from semantic accuracy. Second, we introduce a fault-adaptive controller. Rapid Motor Adaptation infers latent actuator faults online and recovers 97.8% of actuator-sign faults and 94.4% of continuous-gain faults within the training randomization envelope. Fault-unaware PD and from-scratch end-to-end RL both score 0%, while the strongest classical-adaptive baseline reaches 55% on continuous gain. Beyond the envelope, a split-conformant retrain scores 57-67%, and adding 4x more in-regime data worsens performance, showing that randomization breadth, not data volume, drives generalization. Robustness is flat under star-tracker noise to 0.005. Third, we show that a latching safe-hold shield can suppress even a capable controller. A split-conformal recovery-deadline certificate with adaptation-aware engagement reconciles safety and recovery, keeping the controller 94.5% autonomous while still catching non-recovery.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
