Trustworthy Onboard AI Audit for Space Missions

Why this audit exists

Space missions increasingly use learning systems for guidance, navigation and control, payload autonomy, anomaly detection, and fault management. Performance testing alone may not show how these systems interact with classical control, hardware limits, and human oversight under off-nominal conditions.

Radiation, degraded sensors, incomplete observations, and delayed communications create conditions that are difficult to reproduce on the ground. Programme teams need evidence of how autonomous decisions affect spacecraft state when telemetry, commanding, and human oversight are constrained.

The audit assesses autonomy architecture, critical decisions, plausible failure paths, and gaps in validation evidence. It identifies where monitoring, recovery, and verification need further attention before flight.

Scope can accommodate redacted material, controlled access, NDA terms, and export-control requirements.

Who this is for

The audit is intended for teams responsible for:

• Autonomous in-orbit servicing, debris removal, planetary landers, or cislunar logistics.
• Earth observation or communications spacecraft where AI affects operations or safety margins.
• Ground and mission-control systems where AI can affect spacecraft operations.
• Programmes preparing AI assurance evidence for funders, defence partners, or customers.
• Engineering teams assessing onboard AI, low-power computing, or runtime assurance.

If this matches your mission, you can email me to scope an audit.

What you receive

The review produces three linked technical outputs that engineering, safety, and programme teams can use in design reviews and mission-readiness discussions.

System and autonomy map

• A map of sensing, communications, AI models, classical control, and human oversight.
• Critical data paths, timing constraints, and decisions where AI changes system state.
• Interfaces with limited observability, logging, or override capability.

AI risk and failure register

• Failure and threat paths linked to the mission profile, operating environment, and relevant system components.
• Unsafe edge-case behaviour, model and data integrity risks, and autonomy-control mode confusion.
• Degraded communications, delayed telemetry, and periods when ground oversight is limited or absent.
• Prioritisation by severity, likelihood where assessable, and confidence in the evidence, linked to affected components.

Prioritised engineering recommendations

• Engineering recommendations prioritised by mission risk and feasibility within mass, power, bandwidth, and schedule constraints.
• Runtime assurance measures and enforceable limits at critical decision points.
• Models, pipelines, and interfaces needing further verification or redesign.
• Options for low-power or event-driven computing assessed against documented safety requirements, hardware limits, and available evidence.

How the audit runs

The review normally takes four to six weeks, depending on scope, access, and testing needs.

Phase one scoping and intake

• Remote sessions with autonomy, GNC, software, and safety leads.
• Review of available architecture diagrams, interface documents, FMEAs, hazard analyses, test plans, and datasets.
• Agreement on priority mission scenarios and unacceptable outcomes.

Phase two structural and behavioural analysis

• Construction or refinement of the autonomy and data-flow map, including AI components, interfaces, and dependencies.
• Critical decisions and failure paths across software, hardware, and operations.
• Review of validation evidence, off-nominal coverage, and existing formal analyses.

Phase three targeted stress testing

• Stress scenarios for sensor failures, delayed commands, conflicting objectives, and degraded communications.
• Where access permits, targeted simulation or hardware-in-the-loop experiments to observe how AI-driven decisions respond to off-nominal scenarios.
• Where simulation or test infrastructure is unavailable, structured tabletop analysis with engineering leads using mission-specific failure chains.

Phase four synthesis and briefing

• Report containing the system map, risk register, and recommendations.
• Executive summary for programme boards and oversight teams.
• Briefing on findings, trade-offs, and next steps.

Findings depend on the evidence and access available during the review. The audit does not constitute flight certification or verification of every system component.

Where this fits in your programme

About Sylvester Kaczmarek

My work concerns secure, interpretable, and verifiable AI for autonomous space systems, including hybrid control architectures, onboard computing, and mission assurance.

My research has included UK Space Agency-supported projects. I received an Award of Merit from the European Space Agency and Frontier Development Lab Europe for work on AI for space exploration. I also submitted written evidence to the House of Lords Select Committee on UK Engagement with Space.

Common questions

How long does the audit take?

A single-mission audit normally takes four to six weeks, including working sessions, analysis, and reporting.

What access do you need?

System architecture and software diagrams, relevant interface control documents, hazard analyses and FMEA material where available, plus access to autonomy, GNC, software, and safety leads. Full source-code access is not normally required.

Can you work under security or export control constraints?

Yes, subject to agreed access controls, NDA terms, secure communications, and applicable export-control requirements. We confirm the arrangements during scoping.

Is the audit remote or on site?

Most work is remote. On-site design reviews or briefings can be arranged separately.

What happens after the audit?

You receive the written map, risk register, and prioritised recommendations. Follow-up reviews or advisory support can be scoped separately.

How do we discuss scope and cost?

Email your role, mission context, and target timeline. After a scoping call, I provide the proposed work, fee, and schedule. Engagements are usually fixed-fee.