Spacecraft autonomy will not earn trust from one heroic flight test. The Aerospace Corporation has laid out a validation ladder that carries the same closed-loop behavior through simulation, processor-in-the-loop, hardware-in-the-loop, robotic emulation, and flight. Runtime watchdogs and safety guardrails then keep validation active after deployment.
The structure matters more than any individual test environment. Each rung introduces a new source of physical truth while preserving the behaviors and constraints checked earlier. Teams can trace a failure back to the first environment where it appears instead of debating whether the fault sits in the policy, timing, sensors, actuators, or flight computer. The paper demonstrates the flow on reinforcement-learning attitude control, but the useful artifact is the evidence chain connecting offline maturation to online runtime assurance.
High-consequence autonomy teams should require every safety claim to name the rung that produced its evidence and the watchdog that enforces it in operation. That adds instrumentation and test-harness work early, but it is cheaper than discovering at flight validation that the simulation, embedded target, and safety case describe three different systems.