Autonomous Recovery vs Ground Control
Pre-define tiered decision boundaries so autonomous systems handle only immediate, reversible stabilisation while ground control retains authority over consequential recovery actions.
CyberTRIZ analysis · Space contradiction RMA010 · one of 8,235 worked contradictions published by CyberTRIZ.AI
Regulations
Business Context
Autonomous recovery allows spacecraft to detect anomalies, protect critical functions, and begin recovery without waiting for ground intervention. This capability is essential when communications are delayed, intermittent, or unavailable. However, greater autonomous authority can increase software complexity and create the possibility that the spacecraft takes inappropriate actions under conditions not anticipated during development.
Space TRIZ Resolution
Recovery authority should be distributed according to urgency and consequence. Spacecraft autonomy should handle immediate stabilization, containment, and reversible protective actions, while consequential or irreversible recovery decisions can remain under ground authority when communications permit. Predefined decision boundaries and safe fallback states allow autonomy and human control to complement one another.
Applicable TRIZ Principles
Principle 1 – Segmentation separates immediate autonomous protection from higher-level recovery decisions.
Principle 10 – Prior Action defines safe states and recovery logic before anomalies occur.
Principle 23 – Feedback uses spacecraft condition and ground analysis to determine subsequent recovery actions.
Expected Outcome
Faster anomaly response
Preserved ground authority
Reduced risk of inappropriate autonomous actions
Improved spacecraft recoverability
Decision Indicators
Early indicators include:
Spacecraft waits for ground commands during time-critical anomalies.
Autonomous recovery is disabled because of concerns about decision authority.
Ground teams routinely perform predictable stabilization actions manually.
Recovery logic permits irreversible actions with insufficient validation.
Communications delays significantly increase anomaly consequences.