AstraHeal: Deterministic Safety Gating for Uncertainty-Aware Autonomous Spacecraft Fault Recovery

Abstract

Autonomous spacecraft operating in Low Earth Orbit (LEO) and deep-space regimes must resolve critical electrical and thermal subsystem anomalies during prolonged communication blackouts. While machine-learning planners and evidential diagnostic engines can generate high-utility recovery recommendations, purely statistical and learning-based architectures cannot offer mathematical safety guarantees: under novel compound anomalies, sensor corruption, or distribution shifts, upstream models can produce overconfident, flawed, or catastrophic actuation proposals. In this paper, we present and evaluate the AstraHeal Deterministic Safety Governor, a fail-closed runtime execution gatekeeper founded on the architectural axiom: "the AI proposes; the deterministic governor disposes." Rather than evaluating static current telemetry, the governor projects the physical consequences of proposed actions across counterfactual digital twin horizons and deterministically evaluates candidate admissibility against five hard physical invariants: battery thermal runaway barrier (T_batt <= 46.0°C), avionics undervoltage floor (V_bus >= 22.0V), PDU overcurrent limit (I_batt <= 40.0A), battery reserve floor (SoC >= 15%), and total power delivery ceiling (P <= 880.0W). Across eight controlled experiments covering 1,519 evaluated unsafe proposals, the system demonstrated: (i) zero executed unsafe actions (0.00% execution rate, Clopper-Pearson 95% upper bound < 0.1970%), significantly outperforming an ungoverned AI baseline (100.0% unsafe execution, McNemar chi^2 = 191.01, p = 1.92e-43, Cohen's h = 3.1416); (ii) 100.0% rejection across 400 adversarial proposals spanning 5 attack vectors despite high upstream AI confidence (>= 0.96); (iii) 100.0% concurrent violation detection recall (800/800 breaches) across multi-fault compound failures without premature short-circuiting; (iv) strictly monotonic step-function transitions across 804 continuous boundary sweep points; (v) strict dominance of hard safety invariants over communication arbitration in both ground contact and blackout; and (vi) 100.0% safe-failure convergence to NO_SAFE_ACTION_AVAILABLE during physical dead-ends. Microsecond profiling across 10,000 evaluations established a mean latency of 2.99 microseconds, establishing deterministic runtime safety assurance with negligible onboard overhead.