Richard Stottler, Stottler Henke Associates, Inc.; Evan Finnigan, Stottler Henke Associates, Inc.; Dick Wilkinson, Proof Labs
https://doi.org/10.64861/CCSB1594
Keywords: Autonomy, Space Domain Awareness (SDA), In-Space Software Execution, CyberSecurity, Fault Detection and Diagnosis
Abstract:
This paper will describe the results of an in-space experiment for a complete onboard autonomous satellite software system that performs every function of an SDA-oriented space asset, including self-preservation and mission planning/replanning, autonomously.
The onboard framework is called Total Autonomy and it controls all aspects of spacecraft operations including mission planning and scheduling and rescheduling in real-time based on sensed SDA threats, internal faults, or cyber attack; discerning SDA ground and space-based threats; safing and mitigation for these pop-up threats while rescheduling to safely maintain mission objectives to the degree possible; onboard subsystem (ADCS) fault detection, diagnosis, safing, mitigation, and rescheduling as required; and cyber attack detection, diagnosis, safing, and mitigation.
The Total Autonomy software was uploaded to the satellite and commissioned in July of 2026 and then updated and uploaded in August. For the experiment the satellite’s primary mission is ISR, including discerning threats to space-based assets, including itself. This is an experiment, not a real ISR mission, with different objects playing the role of ground-based threats. Additionally, to gather a good volume of interesting data, faults and threats can be artificially inserted into the data streams. During commissioning, Total Autonomy did autonomously detect an uninjected fault in the ADCS. It was minor, but it was real as was appropriately flagged, logged, and reacted to.
The Total Autonomy framework includes the following modules, which execute independently and onboard:
Autonomous ISR Scheduling/Rescheduling
Autonomous Execution (including autonomous Safing)
Autonomous Execution Oversight
Autonomous Threat Detection/Reaction(Safing)/Recovery/Mitigation of Mission Goals
Autonomous In-Space Image Processing
Autonomous Fault Detection/Diagnosis/Reaction(Safing)/Recovery/Mitigation to maximally recover mission objectives
Autonomous Cyber Attack/Diagnosis/Mitigation
Imager Commanding
Experiment Fault/Threat Injection
These modules primarily interact through the Event Queue. The Autonomous Execution module pops the next event then calls the appropriate module to execute the event. The Autonomous Execution Oversight monitors the events being executed, especially their parameters, number and frequency. It is a small simple piece of code to double check to stop anything dangerous (e.g. pointing the imager too close to the sun) or to prevent anything nonsensical (e.g. way too many threats being autonomously discovered). Its job is to save the space hardware or the space experiment from a mistake in the Total Autonomy modules, since this is the first time they have all flown and they are all executing everything completely autonomously
Autonomous ISR Scheduling/Rescheduling module receives a list of on the ground target locations and time windows and optimally sequences them to capture the most requested images possible. It must also consider limitations imposed by ground-to-space threats (i.e. to not point the imager too close to a threat which may blind it) or imposed by faults in the components of the ADCS. Slewing time between images must also be taking into account. It places the most up-to-date schedule on the Event Queue as a series of ADCS commands to point at the desired locations and Imager commands to take one or several images (in rapid succession). New threats or new faults prompt it to remove the old scheduled events, reschedule, and populate the Event Queue with the new events.
The Autonomous Fault Detection/Diagnosis/Reaction(Safing)/Recovery/Mitigation module monitors the commands to the ADCS and the resulting estimated attitude parameters over time to detect and diagnose anomalies and, when appropriate, can itself cancel queued events and command safing actions. It then performs mitigating actions as required, including providing the ISR Scheduling/Rescheduling module with additional constraints
Similarly, the Autonomous Cyber Attack/Diagnosis/Mitigation module is monitoring spacecraft parameters to detect and diagnose cyberattacks on the vehicle and can take similar safing and commanding actions required to defeat them
When each image or set of images are taking, they are processed by the onboard Autonomous In-Space Image Processing module which determines if a threat exists. If so, this may prompt immediate additional imaging requests as well as immediate safing commands as needed to protect the imager. It will also provide location and/or orbit parameter information and related angle constraints to the ISR Scheduling/Rescheduling to allow it to avoid point the imager too close to the discovered threat
Based on open literature review, we believe that this is the first entirely autonomous satellite system placed in space, given total autonomous control of its satellite and including all of the modules listed and described. The performance of each of these modules in their in-space environment and other results will be presented in the full paper.
Date of Conference: September 15-18, 2026
Track: Space-Based Assets