When Spacecraft Play Chicken: How Covariance Steering Could Make Space Safer

When Spacecraft Play Chicken: A New Way to Land Safely in Space

Three meters per second. That's all that separated the chaser spacecraft from disaster.

In a simulation run, a spacecraft following the traditional approach—a clean trajectory calculated with perfect certainty, tracked by a standard feedback controller—drifted outside its collision boundary during the final approach. The nominal path said it would miss the target's solar panels by a comfortable margin. But reality doesn't run on nominal values. Real spacecraft contend with sensor noise, actuation errors, unmodeled disturbances. In Monte Carlo simulations, thousands of particles of uncertainty spread from that nominal trajectory like ink dropped in water. A statistically significant fraction of them violated the safety constraints.

Now consider the same problem, but with a different kind of optimizer—one that doesn't just plan where the spacecraft should go, but also how uncertainty should flow as it gets there. The nominal trajectory might look similar, maybe even slightly less efficient in pure fuel terms. But the closed-loop behavior is fundamentally different. The optimizer has shaped the covariance itself, steering the spread of possible trajectories away from danger zones, concentrating dispersion where it can't cause harm.

In simulations, this approach—which researchers Fabio D'Onofrio and Renato Zanetti call intrinsic stochastic successive convexification on SE(3)—reduced probabilistic constraint violations by a meaningful margin compared to the conventional method. It's a result that challenges an implicit assumption buried deep in how spacecraft guidance systems are designed: that you can separate the problem of planning from the problem of controlling uncertainty.

The Problem With Playing It Safe (The Wrong Way)

Spacecraft rendezvous—the art of guiding one vehicle to meet another—is one of the hardest problems in aerospace engineering. The International Space Station didn't dock itself. The SpaceX Dragon didn't latch onto the ISS on luck. Every approach, every final proximity operation, every docking maneuver requires a guidance system that can thread a needle while the universe does its best to throw that needle off course.

The challenges compound. A spacecraft approaching a target must satisfy constraints that sound almost contradictory: stay outside a collision sphere to avoid crashing, but enter a docking corridor to actually connect. Keep the target in the camera's field of view so you know where you are, but don't point the thrusters at the target so you don't contaminate it with plume impingement. And all of this must work not just in simulation, but in the real world, where sensors report positions with noise, thrusters fire with imperfect impulse, and the environment tugs at the spacecraft with forces that models never fully capture.

Traditional guidance systems handle this with a kind of divide-and-conquer. First, a trajectory optimizer solves a deterministic problem: given a simple model of how the spacecraft moves, find the sequence of thrusts that gets you from here to there while satisfying constraints. This gives you a reference trajectory—a timeline of where the spacecraft should be, what attitude it should hold, and how fast it should be moving at each moment.

Then, a feedback controller takes over. Its job is to track that reference trajectory despite all the imperfections of reality. If a gust of disturbance pushes the spacecraft off course, the controller applies a corrective thrust to bring it back. If sensor noise makes the estimated position jump around, the controller smooths that out.

This architecture works. It's been used for decades. But it has a fundamental weakness: it treats uncertainty as something that happens after you've planned the trajectory, not something you plan with.

Consider what this means for a collision constraint. The optimizer generates a nominal path that keeps a comfortable distance from the target's solar panels—say, two meters of margin. The controller tracks that path. But the actual spacecraft doesn't follow the nominal path exactly. It follows a distribution of paths, centered on the nominal one but spreading out due to noise and disturbances. If that spread is large enough, some of those paths will clip the solar panels. The constraint, which was supposed to prevent collision, isn't actually satisfied in practice.

One response is to make the constraints more conservative: if you want 99.9% confidence of avoiding collision, plan as if the spacecraft needs three meters of margin instead of two. But this approach has its own problem. When uncertainty is large—because navigation is difficult, or because the dynamics are poorly modeled—you end up with trajectories so conservative they're useless. You're essentially planning for the worst case, even when the worst case is unlikely.

A more principled approach is to treat uncertainty explicitly. Instead of asking "what's the worst-case deviation?", you ask "what's the probability that the constraint is violated?" If you can model how uncertainty propagates through the dynamics, you can impose chance constraints: require that the probability of violation be below some threshold, like 0.1%.

This is where D'Onofrio and Zanetti's work enters the picture. Their contribution isn't just applying chance constraints to spacecraft rendezvous—others have done that. It's doing so in a way that captures the coupling between where the spacecraft is and which way it's pointing.

The Geometry of Looking and Moving

Position and attitude are not independent.

This is the kind of statement that sounds obvious until you try to build a guidance system that treats them separately—as many systems do. When a spacecraft points its camera at a target, the direction that camera is looking depends on both where the spacecraft is and how it's rotated. When a spacecraft fires thrusters, the direction of the resulting force depends on both where the thrusters are mounted (a fixed property of the spacecraft) and which way the spacecraft is oriented. When two spacecraft are at risk of collision, whether they actually collide depends on their relative position and their shapes, which are fixed to their respective body frames.

Yet most trajectory optimization methods treat these two aspects as separate problems. Position is optimized in one framework; attitude is optimized in another. The constraints that couple them—field of view, line of sight, plume impingement—are either approximated, enforced conservatively, or handled as afterthoughts.

D'Onofrio and Zanetti argue for a different approach: optimize over the Special Euclidean group SE(3). SE(3) is the mathematical space that describes rigid body pose—the combination of position and orientation that specifies exactly where something is and which way it's pointing. It's not a six-dimensional Euclidean space where you could put position in dimensions one through three and attitude in dimensions four through six. It's a curved, nonlinear manifold where the two are intertwined.

The distinction matters for several reasons. First, SE(3) respects the geometry of rotations. You can't rotate by 400 degrees as easily as by 40 degrees—they're the same rotation, but the Euclidean treatment would treat them as wildly different points. Second, when you linearize the dynamics near a trajectory, working in the tangent space of SE(3) gives you local coordinates that are consistent with the manifold structure. Third, and perhaps most importantly for this work, the uncertainty model stays honest: if you model position and attitude uncertainty separately, you miss the fact that they interact.

Consider a simple example. You point a camera at a target. The pointing error has two sources: the angular uncertainty in the attitude estimate, and the line-of-sight uncertainty due to position error projected onto the camera direction. These aren't additive; they compound in a way that depends on the relative geometry. When the spacecraft is close to the target, a small position error has a large effect on pointing angle. When it's far away, attitude uncertainty dominates. A planner that treats these independently will make different—and potentially worse—decisions than one that accounts for their coupling.

The authors call their formulation "intrinsic" because it stays true to the manifold structure of SE(3) throughout. The nominal trajectory lives on the manifold. The perturbations that the optimizer computes live in the tangent space at each point on the manifold. The uncertainty—the covariance—lives in the tangent space. And when a corrected trajectory is computed, it's mapped back onto the manifold using the geometry-preserving operations of retraction and logarithm. This isn't just mathematical elegance; it's a practical requirement for getting the optimization to converge reliably and for the results to make physical sense.

Convexification: Taming the Nonlinear Beast

Optimal control of nonlinear systems is hard. The math involved—solving for a trajectory that minimizes some cost while satisfying dynamics and constraints—isn't something you can do in closed form. Numerical methods exist, but they come with their own complications: convergence is not guaranteed, local minima are a constant concern, and the computational cost of handling highly nonlinear dynamics can be prohibitive.

One powerful approach is successive convexification, sometimes called Sequential Convex Programming. The idea is to take a nonconvex problem—a problem with constraints that don't form a nice convex shape—and replace it with a sequence of convex approximations.

Think of it like this: a convex problem is one where any local optimum is also a global optimum, and where efficient algorithms exist to solve it. A nonconvex problem might have multiple local optima and can be much harder to solve. But if you zoom in close enough to any point in a nonconvex landscape, it starts to look like a linear or quadratic function. You can take the tangent, the local linear approximation, and solve that convex problem. That gives you a step toward a better solution. Then you zoom in on the new solution, linearize again, solve again, and repeat.

This is the backbone of the SCvx algorithm, which D'Onofrio and Zanetti build on. At each iteration, the nonlinear dynamics are linearized around the current trajectory estimate. The constraints—collision avoidance, docking corridor, field of view—are also linearized. The result is a convex subproblem that can be solved efficiently using standard convex optimization solvers.

But there's a catch. When you linearize around a reference trajectory, you can end up in a situation where the convexified problem is infeasible even though the original problem has a perfectly good solution. The linearized constraints might cut off the feasible region in a way that excludes the true solution, or numerical issues might push you into an artificial dead end.

To handle this, SCvx introduces virtual controls: extra optimization variables that act like slack variables, allowing the solver to "stretch" the constraints just enough to find a feasible solution. A penalty term discourages the virtual controls from growing too large, pushing the solution back toward the true feasible region as convergence proceeds. Trust regions—limits on how far any single step can go—further stabilize the process.

D'Onofrio and Zanetti extend this framework in two key ways. First, they apply it on SE(3), which requires expressing the linearization in the Lie algebra of the group—the tangent space that corresponds to small perturbations in position and rotation. The left retraction and inverse retraction operators (⊕ and ⊖) map between the manifold and its tangent space in a way that respects the group structure.

Second, and more importantly, they make the framework stochastic. Instead of planning a single nominal trajectory and trusting a pre-designed controller to handle uncertainty, they optimize both the trajectory and the feedback law and the evolution of the covariance.

Covariance Steering: Not Just Tracking, Shaping

When you fly a spacecraft, you don't just execute open-loop thrusts and hope for the best. Real systems always have some form of feedback: measurements are taken, estimates are updated, corrections are applied. This feedback shapes how uncertainty evolves. A good controller keeps uncertainty from growing too large; a bad one might let it explode.

But traditional trajectory optimization treats the controller as fixed. You optimize the nominal trajectory, then hand it to a controller whose job is to track it. The controller is designed separately, often with different tools and different objectives.

Covariance steering inverts this relationship. Instead of asking "how should I track this trajectory?", it asks "given the dynamics and the constraints, what feedback law will shape the covariance in the best way?" The optimizer designs not just where the spacecraft should go, but how its uncertainty should flow as it goes there.

Mathematically, this means adding the feedback gains as optimization variables. The affine feedback law takes the form:

$$u=u_{\text{nom}}+K(x-x_{\text{nom}})$$

where the gain matrix K is what gets optimized. The covariance dynamics—how uncertainty grows, shrinks, or shifts as the spacecraft moves—are part of the problem. Constraints on the covariance (like terminal covariance bounds) become explicit optimization objectives or constraints, rather than side effects of the chosen controller.

D'Onofrio and Zanetti implement this in an iterative covariance steering framework. At each SCvx iteration, they solve a convex subproblem that includes:

• The mean trajectory (the nominal path)
• The covariance sequence (how uncertainty evolves)
• The feedback gains (how corrections are applied)

All of these are optimized together, subject to linearized dynamics and chance-constrained path and control constraints. The chance constraints are handled by assuming the perturbations are Gaussian in the tangent space—a reasonable approximation when the uncertainty is concentrated—and propagating the mean and covariance through the linearized dynamics.

The result is a trajectory that might look less optimal in terms of the fuel required for the nominal maneuver, but whose closed-loop behavior is superior in terms of constraint satisfaction. The optimizer has "bought insurance" by steering the covariance away from constraint boundaries, accepting a small penalty in nominal performance in exchange for better probabilistic guarantees.

The Hill Frame: A Natural Reference

The rendezvous problem the authors consider is a chaser spacecraft approaching a passive target on a circular orbit. The target's orbital motion defines a rotating reference frame called the Hill frame (also known as the Clohessy-Wiltshire frame), attached to the target and co-rotating with it.

In the Hill frame, the relative dynamics simplify. The target's gravity appears as a set of linear terms—the familiar Hill-Clohessy-Wiltshire (HCW) equations—which describe the motion of a spacecraft relative to a circular orbit. This is a standard model for rendezvous problems, and the authors use it to describe the translational dynamics of the chaser relative to the target.

But here's where the SE(3) formulation pays off: the same Hill frame also provides a natural reference for describing the relative attitude. The rotation matrix from the chaser body frame to the Hill frame, combined with the relative position vector, gives a homogeneous transformation matrix in SE(3) that captures the full relative pose. The pose kinematics—the time derivative of this transformation—are driven by the relative angular velocity (how fast the chaser is rotating relative to the Hill frame's rotation) and the relative velocity (the chaser's velocity in the Hill frame).

This unified description makes it natural to write constraints that depend on the full pose: collision avoidance depends on the relative position; the docking corridor depends on the relative position and orientation together; the field of view depends on where the target appears in the chaser's camera frame, which follows from the relative pose. The SE(3) formulation doesn't require awkward workarounds or approximations to handle these constraints.

The Constraints That Matter

The authors impose several constraint classes that capture the essential safety requirements for rendezvous:

Collision avoidance comes in two forms. First, a spherical keep-out zone: the chaser must stay outside a sphere centered on the target. This is the coarse safety boundary, the "don't hit the target spacecraft" constraint. Second, a solar panel ellipsoid constraint: the target's solar panels are modeled as an ellipsoid in the target body frame, and the chaser must avoid that ellipsoid too. This captures the fact that the target has physical extent—a simple point-mass model would allow the chaser to fly through the solar panels.

Both collision constraints are state-triggered: they're only enforced when the chaser is outside the docking corridor. Once inside the docking corridor (the approach path to the docking port), the chaser is allowed to enter the protected zone for the final approach. The trigger condition uses a cone in the target frame, defined by a vertex, axis direction, and half-angle.

Field of view constraints ensure the target remains visible to the chaser's camera throughout the maneuver. This is a pose-dependent constraint: if the spacecraft points the wrong way, or if its position makes the target fall outside the camera's acceptance cone, the constraint is violated.

Actuator constraints bound the thrust force and torque that the spacecraft can produce. The optimizer must respect these limits in expectation, accounting for the fact that the actual control effort will deviate from the nominal plan due to feedback corrections.

Simulating the Difference

The authors evaluate their approach through numerical simulations of a rendezvous scenario. The setup is a chaser starting at a relative position of about 50 meters behind and below the target, with some initial attitude and velocity errors. The goal is to reach a terminal pose near the docking port, satisfying all constraints along the way.

They compare two approaches:

1. Intrinsic stochastic SCvx on SE(3): the proposed method, which jointly optimizes nominal trajectory, covariance, and feedback gains.

2. Feedback linearization with a deterministic reference: the conventional approach, where a deterministic trajectory is first generated, then tracked by a linearizing controller.

Both methods are tested via Monte Carlo simulation: thousands of trajectories are propagated with randomly sampled initial conditions and disturbance realizations, and the constraint violation rates are recorded.

The results show a clear advantage for the stochastic approach. When the feedback gains are designed with knowledge of how uncertainty will evolve, the closed-loop dispersion is concentrated away from the constraint boundaries. In contrast, the feedback linearization controller was designed without this coupling, and the resulting covariance growth brought more trajectories into violation territory.

The authors visualize this with Monte Carlo trajectory plots. In the open-loop case (feedforward thrusts only, no feedback), the trajectory cloud spreads widely—uncorrected uncertainty accumulates, and many particles violate the safety constraints. Adding the stochastically designed feedback tightens the cloud, but not uniformly: the covariance is steered, with more uncertainty concentrated in directions that don't matter for constraint satisfaction and less in directions that do.

The state histories show the nominal trajectories—the means of the distribution—plotted against time. The stochastic approach's mean trajectory doesn't look dramatically different from the deterministic approach's reference. The real difference shows up in the covariance ellipses: in the stochastic case, these are part of the solution, shaped by the optimizer to avoid constraint boundaries. In the deterministic case, the covariance is a byproduct of the tracking controller, not a designed quantity.

The constraint satisfaction plots show the story quantitatively. The collision avoidance constraints are evaluated at each time step for each Monte Carlo particle. In the conventional approach, the probability of violation exceeds the target threshold at some phases of the maneuver. In the stochastic approach, the optimizer has explicitly pushed the covariance away from these boundaries, keeping the violation probability within bounds throughout.

The terminal covariance plots show the state distribution at the end of the maneuver. The stochastic approach achieves a tighter final covariance because the feedback gains were designed with the terminal constraint in mind. The deterministic approach's terminal covariance is larger because the controller wasn't optimized for final-state uncertainty—it was tracking a reference.

These aren't just academic niceties. In a real spacecraft rendezvous, a constraint violation isn't a numerical error—it's a collision. The difference between a 0.1% chance of violation and a 1% chance might seem small, but for a billion-dollar space station with astronauts aboard, it's everything.

Why This Changes Things

The aerospace industry is moving toward more autonomous operations. NASA's Orion performed a fully autonomous rendezvous with the ISS. Future missions to the Lunar Gateway, to asteroids, to Mars—these will require guidance systems that can make decisions without human intervention, in environments where communication delays make ground control impossible.

Autonomous rendezvous demands robust guidance. And robustness demands that we stop treating uncertainty as an afterthought.

The traditional architecture—optimize the nominal, then add a controller—emerged from an era when optimization was computationally expensive and stochastic analysis was even more so. The controller was bolted on to handle the mismatch between the simplified model used for planning and the messy reality of implementation. This architecture made sense when the planning and control problems were solved by different teams, using different tools, on different timescales.

But computational progress has changed the calculus. Algorithms like SCvx, which solve trajectory optimization problems in milliseconds on modern hardware, make it feasible to optimize with uncertainty rather than around it. The solver can afford to think about covariance; it's not the bottleneck anymore.

The SE(3) formulation extends this to the full pose. Many existing stochastic rendezvous methods still treat position and attitude separately. They optimize a trajectory for the center of mass, then layer on attitude constraints as post-processing. This loses the coupling between translational and rotational uncertainty, and it can produce plans that are optimistic about what's achievable in practice.

D'Onofrio and Zanetti's method keeps the coupling intact. The constraint gradients—the directions the optimizer uses to improve the solution—are computed with respect to the full pose. The feedback gains operate on the full state. The covariance is a 6×6 matrix (or larger, when velocity is included) with cross-terms between translational and rotational uncertainty. The optimizer sees the full problem, not a decoupled approximation.

The Limits of the Method

No method is perfect, and the authors are careful to acknowledge the limitations of their approach.

The biggest assumption is Gaussianity. The chance constraints are transcribed by assuming that perturbations in the tangent space are normally distributed. This is reasonable when the uncertainty is small—the concentrated Gaussian model is well-justified—but can break down when the distribution spreads far from the nominal trajectory. In practice, the linearization points move as the optimizer converges, so the Gaussian approximation is re-linearized around increasingly accurate means. But if the initial guess is poor, or if the problem is highly nonlinear, the approximation might not hold.

The convexification itself introduces approximation error. The nonlinear dynamics are replaced by linearized dynamics at each iteration; the nonlinear constraints are replaced by linearized constraints. As the optimizer iterates, these approximations become more accurate (the linearization points move closer to the true solution), but they never match the original problem exactly. There's always some gap between what the optimizer thinks it's planning and what the actual spacecraft will do.

The dimensionality of the problem grows with the horizon length and the number of constraints. For long-duration maneuvers or tight constraint sets, the convex subproblem at each iteration can become expensive to solve. The authors mention that dual quaternions could be used as an alternative representation of SE(3), which might offer computational advantages in some implementations, but they don't explore this direction in depth.

The simulations are numerical, not experimental. The authors demonstrate their method on a representative rendezvous scenario, but they don't validate it against flight data or hardware-in-the-loop experiments. Real spacecraft have imperfections—misaligned thrusters, asymmetric mass properties, calibration errors—that the simulations don't capture. Bridging this gap is an important direction for future work.

Finally, the chance constraint thresholds are chosen by the user. If you want a 0.1% violation probability, you can set the constraint accordingly, but the method doesn't tell you what threshold is appropriate. That judgment requires mission context: how risky is a violation? What are the consequences? What's the regulatory environment? The optimizer handles the math; humans still need to set the goals.

What's Next

The immediate next steps are empirical. Testing this approach on hardware, in a testbed that captures the real dynamics of spacecraft proximity operations, would be the most informative validation. High-fidelity simulators that include detailed thruster models, flexible solar panel dynamics, and realistic sensor noise would stress-test the method's assumptions and reveal failure modes that simple simulations miss.

Another direction is real-time implementation. The current method solves a full trajectory optimization problem offline. For truly autonomous operations, the guidance system would need to replan as new information arrives, reacting to navigation updates and contingency events. This requires fast, reliable convex optimization solvers that can run on spacecraft avionics, and it requires the optimization to be robust to the kinds of computational limitations (time pressure, memory limits, numerical precision) that flight software faces.

The extension to dual quaternions is intriguing. Dual quaternions provide an alternative representation of SE(3) that avoids some of the redundancies of homogeneous matrices. The same derivation D'Onofrio and Zanetti carry out for homogeneous matrices could, in principle, be replicated for dual quaternions. Whether this offers computational or numerical advantages is an open question, but it's a natural direction for further investigation.

More broadly, the idea of covariance-steered trajectory optimization has applications beyond spacecraft rendezvous. Autonomous vehicles—drones, cars, underwater robots—all face similar challenges: they must plan paths that satisfy safety constraints in the presence of uncertainty, with feedback controllers that shape how that uncertainty evolves. The SE(3) formulation is specific to rigid body pose, but the principle of joint optimization of trajectory, covariance, and feedback is general.

The aerospace industry is also moving toward formation flying and distributed systems: multiple spacecraft coordinating with each other, with constraints on their relative positions and orientations. The methods developed here—covariance steering, chance-constrained optimization on manifolds, successive convexification—might extend to these multi-agent scenarios, though the combinatorial complexity would be a challenge.

Finally, there's the question of robustness to model error. The current method assumes that the linearized model is accurate enough for the Gaussian approximation to hold. But what if the model is systematically wrong—biased in some direction, or with error that grows over time? Extensions that incorporate robust optimization or distributionally robust methods could handle these cases, trading some computational complexity for immunity to model misspecification.

A Small Step Toward Safer Space

Spacecraft don't crash because the nominal trajectory is wrong. They crash—or worse, they come dangerously close to crashing—because reality deviates from the plan in ways the plan didn't anticipate. A guidance system that ignores this fact is a guidance system that invites disaster.

D'Onofrio and Zanetti have taken a step toward fixing this. Their method plans with uncertainty, not around it. It treats the spacecraft's pose—its position and orientation together—as a coupled whole, respecting the geometry of how rigid bodies move in space. And it designs the feedback controller as part of the problem, not as an add-on.

The results are promising: tighter constraint satisfaction in Monte Carlo simulations, better-shaped covariance, feedback gains that anticipate rather than react. The method isn't ready for flight yet—more testing, more validation, more understanding of its limits is needed. But the foundation is solid.

Three meters per second of relative velocity. A few centimeters of position uncertainty. A few degrees of attitude uncertainty. In the wrong combination, these can add up to a collision. In the right combination—shaped by an optimizer that sees the coupling, that plans the covariance, that treats the full pose as a unit—they become manageable. The spacecraft arrives safely, every time, with high probability.

That's what this work is aiming for. Not just a better algorithm, but a more reliable spacefaring future.