A check that cannot see the clock

An orbit propagated in universal variables carries its state forward with four numbers. Solve one equation for the universal variable χ, compute the Lagrange coefficients $f$, $g$, $\dot f$ and $\dot g$ from it, and the new position and velocity are linear combinations of the old ones: $\mathbf r = f\mathbf r_0 + g\mathbf v_0$, $\mathbf v = \dot f\mathbf r_0 + \dot g\mathbf v_0$. The four numbers obey an identity, $f\dot g - \dot f g = 1$, which is the conservation of angular momentum written in the coefficients, and a set of coefficients that breaks it is wrong. Better: when the solve for χ is stopped early, the identity breaks by an amount proportional to the error in the position, so a propagator can measure its own accuracy, step by step, without knowing the answer.

That property makes the identity worth computing. It also invites a question that the identity itself cannot answer: is every error a propagation can make an error the identity sees? It is one equation on four numbers. Whatever it constrains, it constrains in one direction of a four-dimensional space and leaves three directions free. The question is which errors lie in those three directions, and whether any of them is an error that happens.

Four ways to spoil a propagation #

The hero figure spoils the same propagation four ways — through 0.37 of a period of an ellipse of eccentricity 0.6, the orbit and step used to show the identity working — at error sizes from $10^{-13}$ to a hundredth, and plots each spoiled propagation by its true position error and by how far its coefficients miss the identity.

Two kinds of error behave as the identity promises. A solve stopped early breaks it in proportion to the damage. Coefficients jostled at random — standing in for arithmetic errors, a corrupted value, a bug that perturbs one coefficient — break it in proportion too. Both lie on a line, and a propagator that computes the identity at every step would catch them.

Two kinds do not break it at all. A propagation carried out for the wrong time step, and one carried out with the wrong gravitational parameter, satisfy the identity to the last digit the arithmetic can hold, whatever the size of the error — up to a hundredth of the position, the largest error drawn. They lie on the floor of the figure, where the identity’s residual is below the resolution of double-precision numbers.

The reason is simple once seen. The identity holds for every exact Kepler map, for any time step and any gravitational parameter, because every Kepler orbit conserves angular momentum. A propagation for the wrong time is an exact Kepler map — for a question nobody asked. So is a propagation with the wrong parameter. The identity checks that the four numbers describe some two-body motion; it cannot check that they describe the motion that was wanted.

The result does not depend on the step. At 0.8 of a period, near the far side of the orbit where errors grow fastest, the same split holds: the two physical inputs are invisible, and the larger the step the larger the errors that can hide.

The same solve, written two ways #

That two of the identity’s blind directions are physical inputs might seem harmless: a propagator is told the time and the gravitational parameter, and if it is told them wrongly that is the caller’s problem. But the time also appears inside the propagation, and a solver can move its own errors into the blind direction without anyone intending it.

The solve for χ is an iteration, stopped at some tolerance, so the χ it returns is slightly wrong. There are then two natural ways to assemble the coefficients. One uses the time step that was asked for in $g$, as the textbook formula does. The other uses the time that the imperfect χ actually corresponds to — computed from χ by Kepler’s equation in universal form, which is the same equation the solve was solving. The second is, if anything, the more self-consistent choice: it makes all four coefficients exactly those of a Kepler map.

The second assembly is more accurate and completely silent. It lands exactly on the true orbit — every coefficient is right for some time — but at a time slightly different from the one requested, and the identity, which checks only that the map is a Kepler map, reports nothing. Its position error is smaller than the first assembly’s because its error is purely along the track, a timing error, while the first assembly’s error is a mixture that also leaves the orbit. But it is an error, and a propagator built this way and checked with the identity would report perfect accuracy at every tolerance, including a tolerance of a hundredth.

That is the uncomfortable part. The identity was recommended as an error meter because it needs no reference solution. A meter that reads zero for one of the two natural implementations of the thing it meters is a meter whose reading depends on an implementation detail the user may not know.

Two checks, five errors #

The identity is not the only check a propagator can make on itself. The orbit’s energy, recomputed from the propagated state, should equal the energy at the start; a step that leaves the orbit changes it.

The energy check catches what the identity catches, with different sensitivities, and misses what it misses. Both are checks of the same property: that the step was a Kepler map. Any error that leaves the propagation a Kepler map — for a different time, for a different strength of gravity, or both — passes both. An exact Kepler map that answers a slightly different question is invisible to every test made from the state alone, because the state alone does not say what the question was.

This is a general limit, not a property of these two checks. Any internal consistency test compares parts of the computed state with each other or with conserved quantities. A Kepler orbit for the wrong time or the wrong parameter is perfectly self-consistent. Only a comparison with something outside the propagation — a measured position at a known time — can tell it from the right one.

A drift no internal test detects #

The wrong gravitational parameter matters most, because it is the input whose error is systematic and whose effect accumulates.

A different gravitational parameter is a different orbital period for the same starting state, and a period error accumulates: after each orbit the body is a little further ahead of or behind the real one, in proportion to the number of orbits. Nothing inside the propagation sees it. Every step is a perfect Kepler map, the identity holds to the last digit, and the energy is conserved exactly — for the parameter the propagator believes in.

The size of the error is set by how well the parameter is known, and for the Sun it is known very well. The Sun’s gravitational parameter is measured to about a part in $10^{10}$, far better than the gravitational constant or the Sun’s mass separately, precisely because it is what planetary orbits measure.

For a planet at an astronomical unit, $3\times10^{-7}$ of the semi-major axis is about fifty kilometres, accumulated over forty orbits. That is far below the precision of any ephemeris quoted for most purposes and well above the precision to which the inner planets’ positions are now measured by radar and spacecraft tracking. The drift is real and the internal checks cannot see it. The ephemerides are fits for exactly this reason: the gravitational parameter, like the starting state, is a fitted quantity, adjusted until the propagated positions match the measured ones, and the residuals of that fit — not any property of the propagation — are what constrain it.

The parameter that was always fitted #

The history of the Sun’s gravitational parameter is a history of exactly this blind spot being closed from outside. Kepler’s third law relates a planet’s period to its orbit’s size through the parameter, and periods have been known to many digits for centuries, because they are counted. Sizes were not. Until the 1960s the solar system’s scale was known only through the astronomical unit, measured by parallaxes of nearby asteroids and transits of Venus to a few parts in ten thousand, and the parameter in kilometres was correspondingly uncertain. In units of astronomical units and days it was fixed by definition — Gauss’s constant — and every orbit computed in those units was self-consistent whatever the kilometre value turned out to be.

Radar ranging to Venus in the early 1960s, and later to Mercury and Mars and to spacecraft, measured distances in kilometres by timing echoes, and the parameter in kilometres became a fitted quantity, adjusted with every other parameter of the ephemeris until the computed round-trip times matched the measured ones. The precision went from parts in ten thousand to parts in ten billion. At no point did the propagations themselves become more able to detect an error in the parameter; what changed was the quality of the external clock they were compared against.

That comparison is still the only constraint, and it is not a frozen one. The Sun is losing mass, as light and as wind, at a rate that changes its gravitational parameter by about a part in ten trillion a year — invisible to any internal check, slowly visible in decades of ranging data, and exactly degenerate with a change in the gravitational constant itself. The only thing that can separate them is more measurement from outside.

A timing error is what navigation measures #

Spacecraft navigation lives in the blind spot too, and makes a virtue of it. A spacecraft’s position is never measured directly. What is measured is a round-trip light time and a Doppler shift, both timing quantities, and the navigation filter adjusts the spacecraft’s state, the gravitational parameters of the bodies near it and the times of its manoeuvres until the propagated trajectory reproduces them.

In that setting the errors the internal checks cannot see are precisely the errors the measurements are most sensitive to. An along-track timing error changes the predicted range by its full amount and the predicted Doppler by its rate; a wrong gravitational parameter of the body being orbited changes the predicted period and so the timing of every pass. The checks that the propagation makes on itself — the identity, the energy, the integrator’s own error estimates — establish that it has computed some trajectory correctly. The tracking data establish which trajectory.

This division of labour is worth stating because it is often blurred. A navigation team that sees perfectly consistent propagations and growing range residuals has learned that its timing or its parameters are wrong, not that its propagator is. A team that sees broken internal consistency has learned that its propagator is wrong and that the residuals cannot be trusted until it is fixed. The identity is the instrument for the second diagnosis and silent on the first.

Why the identity was worth having anyway #

None of this makes the identity useless. It catches the errors that propagation code actually makes when it is written conventionally: a solve stopped short, a coefficient computed with a bug, an arithmetic catastrophe near the parabola where the Stumpff functions lose digits. It catches them at the cost of two multiplications per step and without any reference solution. That is a great deal, and in a long chain of steps it is what makes the chain auditable at all: a single bad step, anywhere in a century of propagation, shows up as a spike in the identity’s residual at that step and nowhere else.

What the analysis adds is a statement of what the identity is a check of. It checks that a step is a two-body map. It does not check that it is the two-body map for the requested time and the true gravitational parameter, because those two inputs are not visible in the map’s structure. A propagator that wants to check its timing has to compute the time separately — evaluate Kepler’s equation for the χ it used and compare with the time it was asked for — and a propagator that wants to check its gravitational parameter has to compare with observations.

The same split runs through every integration in astronomy. A symplectic integrator is exactly right about the energy and wrong about the phase, for the same structural reason: it solves a nearby problem exactly, and the nearby problem’s error is a timing error. A fitted orbit’s uncertainty collapses onto a line along the track because the poorly determined combination is the period, which is a timing quantity. In each case the shape of the error is set by what the method conserves, and what it conserves is blind to the error’s dominant direction.

Making the clock visible on purpose #

Of the two physical blind directions, one can be closed from inside after all, by asking a different question. The gravitational parameter enters the propagation as a given and nothing inside can test it. The time step enters twice: once as the requested interval, and once implicitly, as the interval that the χ actually used corresponds to. Those two can be compared.

The comparison is Kepler’s equation in universal form, evaluated at the final χ: it returns the time that χ belongs to, and its difference from the requested time is exactly the timing error the second assembly hid. It costs one evaluation of the Stumpff functions, which the step has already computed, and a subtraction. A propagator that reports both numbers — the identity’s residual and the time residual — covers the solve-truncation error whichever way the coefficients were assembled: the first assembly shows it in the identity, the second in the time.

What remains invisible is then exactly one thing: the gravitational parameter, and with it any systematic error in the time scale the caller uses. A propagator cannot know that a second of the time it was given is not a second of the time the orbit keeps — that the caller has mixed up two time scales, say, which differ by parts in a hundred million and drift against each other — any more than it can know the strength of gravity. Those are statements about the world rather than about the computation, and they are the statements the observations exist to make.

That reduction is the practical outcome of the whole analysis. An internal check should be designed to close every blind direction that is a property of the computation, so that whatever it cannot see is a property of the inputs. Then a disagreement with observation, when it comes, can be attributed with confidence: not to the propagator, which has proved its own consistency in every direction it can, but to the clock or the constant it was handed.

Where the analysis stops #

The orbit is planar and two-body. In three dimensions the identity is still one scalar equation on the four coefficients, now applied to three-dimensional vectors, and the same two physical blind directions exist. A perturbed propagation is not a Kepler map at all, and its consistency checks are different.

The jostled coefficients are perturbed independently and uniformly. Real arithmetic errors are correlated in ways that may happen to lie partly in a blind direction; the figure shows that typical errors do not, not that no error could.

The energy check is made with the believed parameter. Made with the true parameter it would of course see a wrong parameter — but a propagator that knew the true parameter would have used it.

Rounding is left out. Double-precision arithmetic sets the floor on the residuals drawn; near the parabola, where closed-form Stumpff functions cancel catastrophically, rounding errors are larger and break the identity in the ordinary way.

Still open: a check for the third direction #

The two physical blind directions account for two of the three that the identity leaves free. The third is a combination of coefficient errors that corresponds to no physical change of input — an error that keeps $f\dot g - \dot f g$ fixed while moving the state off every Kepler orbit with the given starting state. The energy check covers part of it. Whether some combination of cheap internal checks — the identity, the energy, the angular momentum’s direction, the time recomputed from χ — covers every non-physical error, so that the only undetectable errors left are the two physical ones, has not been shown. If it can be, a propagator could guarantee, from the inside, that any error it makes is either caught or is an error of time or of gravity, and those two are exactly what the observations are there to fix.