Safe Landing on Small Celestial Bodies with Gravitational Uncertainty Using Disturbance Estimation and Control Barrier Functions

1. Problem Formulation

The paper addresses the challenge of autonomous soft-landing on Small Celestial Bodies (SCBs), such as asteroids and comets. The primary difficulties stem from:

• Gravitational Uncertainty: SCBs often have irregular shapes and non-uniform density distributions, making high-fidelity gravitational models difficult to obtain. Mass estimation errors can range from 10–15%, and higher-order gravitational effects are often poorly characterized.
• Safety Constraints: The spacecraft must satisfy strict state constraints (e.g., a glideslope angle to avoid crashing into the surface before reaching the landing zone) and input constraints (thrust magnitude limits) throughout the maneuver.
• Limitations of Existing Methods:
  • Robust Control (H∞, Adaptive): Provides disturbance rejection but lacks formal guarantees for satisfying safety constraints.
  • Model Predictive Control (MPC): Can handle constraints but relies on linearized approximations of nonlinear dynamics and requires computationally expensive constraint-tightening mechanisms to guarantee safety under uncertainty.

Objective: Design a control architecture that ensures the spacecraft lands within predefined tolerances (position and velocity) while strictly adhering to state and input safety constraints, despite unknown gravitational disturbances.

2. Methodology

The authors propose a three-stage control architecture that integrates disturbance estimation, trajectory tracking, and safety enforcement.

A. System Dynamics and Modeling

• Dynamics: The spacecraft is modeled with translational motion equations including Coriolis and centrifugal forces due to the rotating asteroid, a nominal gravitational potential ($U_m$), and an unknown disturbance term ($\Delta$) representing gravitational uncertainty.
• Uncertainty Model: The disturbance is treated as a perturbation to the nominal model. The paper assumes the first and second derivatives of the uncertainty are bounded.
• Constraints:
  • State: A glideslope constraint ($\psi(x) \geq 0$) ensures the spacecraft approaches the landing site within a specific cone angle.
  • Input: Thrust magnitude must remain between $T_{min}$ and $T_{max}$.

B. Stage 1: Disturbance Estimation (EHGO)

• An Extended High-Gain Observer (EHGO) is employed to estimate the gravitational disturbance ($w$) online.
• The observer uses an auxiliary variable $\nu$ to reconstruct the disturbance.
• Key Feature: The observer provides a computable, time-varying upper bound ($\sqrt{\bar{w}}$) on the estimation error, which is crucial for the subsequent safety layer to account for uncertainty without being overly conservative.

C. Stage 2: Feedback Linearizing Tracking Control

• A feedback-linearizing controller ($u_d$) is designed to track a pre-computed reference trajectory ($x_r, u_r$).
• This controller cancels the nominal dynamics and the estimated disturbance ($\hat{w}$) from the EHGO.
• Goal: To achieve the landing objective (O1) by driving the tracking error to zero. However, $u_d$ alone does not guarantee safety constraints.

D. Stage 3: Safety Enforcement via Control Barrier Functions (CBFs)

• To satisfy constraints (O2), the paper employs a Control Barrier Function (CBF) framework.
• Handling Input Constraints: Since thrust limits depend explicitly on the control input $u$, the authors introduce control dynamics ($\dot{u} = A_c u + B_c \zeta$). This transforms input constraints into state constraints on an augmented system.
• Handling State Constraints: The glideslope constraint has a relative degree of 3. The authors construct a Higher-Order CBF (HOCBF) hierarchy ($\psi_1, \psi_2$) to handle this.
• Robustness: A "relaxed" CBF ($\bar{\psi}_2$) is constructed using the disturbance estimate and its error bound ($\sqrt{\bar{w}}$) to ensure safety even when the disturbance is not perfectly known.
• Minimum-Intervention Quadratic Program (QP): The final control input $\zeta^*$ is derived by solving a QP that minimizes the deviation from the desired control $u_d$ while satisfying the CBF condition.
  • The solution is given in closed-form, avoiding the need for iterative numerical optimization at every time step, which enhances computational efficiency.

3. Key Contributions

1. Novel Control Architecture: Integration of EHGO, feedback linearization, and CBFs specifically for SCB landing under gravitational uncertainty.
2. Formal Safety Guarantees: The use of CBFs with disturbance bounds provides mathematical guarantees that state and input constraints are satisfied, unlike robust control methods which offer no such guarantees.
3. Computational Efficiency: The derivation of a closed-form solution for the safe control law (via the QP minimizer) makes the approach suitable for real-time, onboard autonomous spacecraft applications, avoiding the high computational cost of MPC.
4. Aggressive Maneuvers: By using a minimum-intervention approach, the controller allows the spacecraft to execute aggressive trajectories (close to the boundary of safety) rather than relying on conservative planning.

4. Simulation Results

The authors validated the approach using numerical simulations with two scenarios:

• Scenario A: Ellipsoidal Asteroid (Uniform Density):
  • The spacecraft successfully landed on an ellipsoidal asteroid with a 25% mass uncertainty.
  • The EHGO accurately bounded the disturbance error.
  • The CBF layer actively modified the control input when the nominal trajectory threatened to violate the glideslope constraint.
• Scenario B: Irregular Asteroid (Non-uniform Density):
  • Modeled as a union of two ellipsoids with different densities.
  • The controller achieved a soft landing with position errors $< 1.5$ m and velocity errors $< 0.2$ m/s.
  • State and input constraints were strictly maintained throughout the 621-second maneuver.

Key Findings from Simulations:

• Direct execution of the reference trajectory or simple feedback control without the CBF layer resulted in constraint violations (either crashing or exceeding thrust limits).
• The proposed method successfully balanced tracking performance with safety, modifying the control input only when necessary to prevent constraint violation.

5. Significance

This work represents a significant step toward fully autonomous planetary landing in uncharted environments.

• Safety-Critical Autonomy: It demonstrates how to mathematically guarantee safety in the presence of significant model uncertainty, a critical requirement for missions where communication delays prevent human intervention.
• Scalability: The computational efficiency of the closed-form CBF solution makes it viable for small satellites or landers with limited onboard processing power.
• Future Missions: The framework is directly applicable to upcoming and future sample return missions (e.g., to asteroids or comets) where high-fidelity gravity models are unavailable prior to landing.

In summary, the paper bridges the gap between robust disturbance estimation and formal safety verification, offering a practical, computationally efficient solution for landing on irregular, uncertain celestial bodies.