Key takeaways
- The debris environment in low Earth orbit is dense enough that human-in-the-loop conjunction response is no longer operationally viable — the time between a high-confidence conjunction alert and the last viable manoeuvre window is often measured in minutes, not hours.
- Conjunction probability alone is not a sufficient manoeuvre trigger. A system that acts on probability without modelling manoeuvre cost, fuel budget, orbital slot constraints, and downstream conjunction risk produces manoeuvres that create new problems while solving the immediate one.
- Autonomous manoeuvre authority requires a verifiable decision logic the operator can audit after the fact, not a black-box output. The algorithm must produce a human-readable decision record alongside the manoeuvre command.
- Tracking data quality is the dominant uncertainty source in conjunction analysis — the algorithm must propagate catalogue uncertainty explicitly rather than treating TLE-derived positions as ground truth, and must re-evaluate the conjunction picture continuously as updated tracking data arrives.
The challenge: debris density has outpaced human reaction time
Low Earth orbit is not the empty region it was when the first operational collision avoidance procedures were written. The tracked object catalogue in the altitude bands between 400 and 1200 kilometres now contains tens of thousands of objects — active satellites, defunct spacecraft, rocket bodies, and fragmentation debris — and the untracked population of objects too small to catalogue but large enough to be catastrophic at orbital relative velocities is estimated to be orders of magnitude larger. A satellite operating in a busy LEO shell will receive conjunction alerts on a routine basis. Most will not require action. Some will.
The problem is that the time available to evaluate a conjunction and execute a manoeuvre has compressed as orbit-raising has become routine and constellation density has increased. A conjunction that is flagged at T-minus 24 hours with a low probability of collision may, as updated tracking data refines the debris object's state vector, become a high-probability conjunction at T-minus 90 minutes. The window between a reliable conjunction assessment and the last burn opportunity the satellite's propulsion system can execute before closest approach may be 30 to 45 minutes. In that window, a ground team must be reachable, must evaluate the updated assessment, must authorise a manoeuvre, must uplink the command, and must confirm execution. For a single asset with a dedicated operations team, this is marginal. For a constellation operator managing hundreds of satellites, it is not achievable without autonomous authority.
"The window between a reliable conjunction assessment and the last viable manoeuvre opportunity may be 30 minutes. That is not enough time for a human in the loop to be the decision maker."
The deployment context
This case study covers the deployment of the Botron collision avoidance algorithm aboard a constellation of small satellites operating in a 550-kilometre sun-synchronous orbit. The constellation comprises satellites that share an orbital shell with a significant density of both tracked debris and active third-party satellites. Each satellite carries a monopropellant propulsion system with a defined delta-V budget per mission phase, placing hard constraints on manoeuvre magnitude and frequency. The algorithm was required to operate autonomously aboard each satellite, evaluating conjunction data messages received via ground uplink and making manoeuvre go or no-go decisions without real-time ground confirmation, within a defined authority envelope agreed with the operator.
The authority envelope defined the conditions under which the algorithm could execute a manoeuvre without prior ground authorisation: a conjunction probability above a defined threshold, a time to closest approach below a defined limit, and a proposed manoeuvre delta-V within the per-event budget. Outside this envelope — probability below threshold, manoeuvre exceeding budget, or close approach more than the authority time horizon away — the algorithm generates a manoeuvre recommendation for ground review rather than autonomous execution. Every decision, whether autonomous or referred, produces a structured decision record transmitted to the ground at the next contact opportunity.
Conjunction analysis under tracking uncertainty
The primary input to any conjunction assessment is the state vector of the debris object — its position and velocity at a reference epoch, propagated forward to the time of closest approach. In practice, state vectors for uncooperative debris objects are derived from ground-based radar and optical tracking observations processed through orbit determination pipelines that produce Two-Line Element sets or equivalent state representations with associated covariance estimates. The accuracy of these estimates varies significantly with the tracking history of the object, the time since the last observation, and the altitude-dependent atmospheric drag uncertainty that governs how accurately a LEO object's trajectory can be propagated forward.
A conjunction assessment that treats the TLE-derived position as a point estimate and computes a geometric miss distance is not a conjunction assessment — it is a best-case miss distance calculation that ignores the dominant source of uncertainty in the problem. The Botron algorithm propagates the full covariance of both the resident space object's state and the satellite's own state forward to closest approach time, computing a probability of collision that reflects the uncertainty in both trajectories. As updated CDMs arrive with refined state estimates and covariances, the algorithm re-evaluates the conjunction and updates its decision state. A conjunction that appeared low-probability twelve hours out may become high-probability as the debris object's orbit is refined by additional observations — and the algorithm's manoeuvre trigger responds to that evolution, not to the initial assessment.
Why covariance realism matters more than probability threshold
Conjunction probability is only as meaningful as the covariance estimates that produce it. An underestimated covariance produces an underestimated probability — a conjunction that appears safe on paper but is not. An overestimated covariance produces manoeuvre triggers on conjunctions that would never have resulted in a collision, consuming delta-V budget and creating new conjunctions through the manoeuvre itself. The algorithm was validated against a dataset of historical conjunctions with post-event tracking refinements to verify that its probability estimates were calibrated against realised miss distances, not merely internally consistent.
Manoeuvre planning: optimising for more than miss distance
The naive response to a high-probability conjunction is to execute the largest manoeuvre the propulsion budget allows in the direction that maximises miss distance at closest approach. This is the wrong objective function for a constellation operator. A manoeuvre that resolves the immediate conjunction may place the satellite on a trajectory that creates a new conjunction with a different object in the same orbital shell. It may consume delta-V budget that is needed to maintain the satellite's ground track repeat cycle or to execute a planned orbital slot adjustment. It may move the satellite out of its formation station-keeping window, requiring additional fuel to recover position.
The Botron manoeuvre planner optimises across a multi-objective function that includes miss distance at closest approach, delta-V cost, post-manoeuvre conjunction screening against the current catalogue, and formation position recovery cost. The planner generates a candidate manoeuvre set, evaluates each candidate against the full objective function, and selects the manoeuvre that resolves the conjunction at minimum total cost to the satellite's mission. The selected manoeuvre, the candidate set it was chosen from, and the objective function scores for each candidate are all recorded in the decision log transmitted to the ground.
| Decision mode | Trigger conditions | Algorithm action | Ground team role |
|---|---|---|---|
| Autonomous execution | Pc above authority threshold, TCA within authority time horizon, manoeuvre delta-V within per-event budget. | Selects and executes optimal manoeuvre. Generates decision record for downlink at next contact. | Post-event review of decision record. No real-time involvement required. |
| Recommended manoeuvre | Pc above alert threshold but below authority threshold, or TCA beyond authority horizon, or manoeuvre exceeds per-event budget. | Generates ranked manoeuvre recommendation with full decision data. Uplinks recommendation at next contact opportunity. | Reviews recommendation, approves or modifies, uplinks authorisation within available window. |
| Monitoring | Pc below alert threshold. Conjunction tracked but not action-worthy at current assessment. | Continues re-evaluation on each CDM update. Escalates to recommended or autonomous mode if Pc rises. | Periodic review of conjunction summary. No immediate action required. |
The authority envelope is not a static configuration. As the mission progresses and the satellite's delta-V budget depletes, the per-event manoeuvre budget tightens. As the operator builds confidence in the algorithm's decision quality from the decision record archive, the authority threshold and time horizon can be adjusted through a signed ground command. The algorithm is designed to be operated with progressively expanded autonomy as operational trust is established, rather than requiring the operator to commit to a fixed authority level at deployment.
Onboard execution within flight software constraints
A collision avoidance algorithm that runs in ground software and requires uplink of the resulting manoeuvre command is subject to the communication latency and contact schedule of the satellite's ground network. For a LEO satellite with a modest ground station network, contact windows may be separated by hours. An algorithm that runs onboard, evaluating CDMs received via uplink and commanding the propulsion system directly, eliminates the ground-link latency from the manoeuvre execution chain. This is what enables the autonomous authority model described above.
Running a conjunction analysis and manoeuvre optimisation algorithm onboard a small satellite places constraints on the implementation that are absent in a ground software context. The algorithm must execute within the compute budget available on the satellite's flight computer — typically a radiation-tolerant processor with a fraction of the capability of a ground workstation — within the power envelope available during the conjunction evaluation window, and with deterministic execution timing so that manoeuvre commands are generated with sufficient advance notice for the propulsion system to prepare. The Botron algorithm is implemented in a resource-bounded form with configurable accuracy-versus-compute tradeoffs, validated on representative flight hardware to confirm that worst-case execution time is within the available window under all conjunction scenarios in the authority envelope.
The decision record: autonomous authority with operator accountability
Autonomous manoeuvre execution without a ground-readable audit trail is not acceptable for a licensed satellite operator. Every decision the algorithm makes — the CDM inputs it received, the conjunction probability it computed, the candidate manoeuvres it generated, the objective function scores it assigned, and the manoeuvre it selected and executed — is written to a structured decision record stored onboard and downlinked at the next contact opportunity. The operator can reconstruct the algorithm's full decision process for any conjunction event after the fact. Autonomous authority does not mean unaccountable authority; it means that the human review happens after the time-critical decision rather than before it.
Results in operational deployment
Over the first six months of operational deployment, the algorithm evaluated 312 conjunction events across the constellation. Of these, 41 crossed the autonomous execution threshold and were handled without ground involvement — manoeuvres planned, commanded, and executed by the onboard algorithm within the authority envelope. The remaining 271 were either resolved by updated CDMs that reduced the conjunction probability below the alert threshold before any action was required, or generated ground recommendations that the operations team reviewed and acted on within the available window.
Retrospective assessment of the 41 autonomous manoeuvre decisions — re-evaluating each conjunction with the full tracking data available after closest approach — found that the algorithm's decisions agreed with the ground team's post-hoc assessment in 40 of 41 cases. The one disagreement was a case where additional tracking data available after the manoeuvre execution, but not before it, would have led the ground team to a no-manoeuvre decision; the algorithm's decision was conservative and within its authority parameters, and the retrospective miss distance with no manoeuvre would have been acceptable. The average time from final CDM receipt to manoeuvre execution across the 41 autonomous events was 23 minutes — within the required authority window and substantially faster than any achievable ground-in-the-loop timeline.
"Autonomous authority does not mean unaccountable authority. The human review happens after the time-critical decision — and every input, calculation, and output is in the downlinked decision record."
What this demonstrates
The debris environment in low Earth orbit has made autonomous collision avoidance not a future capability but a present operational requirement. The architecture described here — onboard conjunction analysis under explicit tracking uncertainty, multi-objective manoeuvre optimisation, a defined and adjustable authority envelope, and a complete decision record for every event — is what makes autonomous authority operationally deployable rather than merely technically feasible. Operators can expand the algorithm's authority as confidence in its decision quality grows, with the decision record providing the evidence base for that confidence.
The collision avoidance algorithm is part of Botron Dynamics' broader autonomous space systems work, drawing on the same trajectory prediction and optimisation foundations that underlie our rendezvous and proximity operations software and our orbital slot management tools. The principles — uncertainty-aware state propagation, constrained multi-objective optimisation, and auditable autonomous decision making — transfer across the range of autonomous manoeuvre problems that LEO constellation operators face as the orbital environment continues to evolve.