Social
Automated reasoning

A gentle introduction to automated reasoning

Meet Amazon Science’s newest research area.

By Byron Cook
December 1, 2021
18 min read
Share

This week, Amazon Science added automated reasoning to its list of research areas. We made this change because of the impact that automated reasoning is having here at Amazon. For example, Amazon Web Services’ customers now have direct access to automated-reasoning-based features such as IAM Access Analyzer, S3 Block Public Access, or VPC Reachability Analyzer. We also see Amazon development teams integrating automated-reasoning tools into their development processes, raising the bar on the security, durability, availability, and quality of our products.

The goal of this article is to provide a gentle introduction to automated reasoning for the industry professional who knows nothing about the area but is curious to learn more. All you will need to make sense of this article is to be able to read a few small C and Python code fragments. I will refer to a few specialist concepts along the way, but only with the goal of introducing them in an informal manner. I close with links to some of our favorite publicly available tools, videos, books, and articles for those looking to go more in-depth.

Let’s start with a simple example. Consider the following C function:

bool f(unsigned int x, unsigned int y) {
   return (x+y == y+x);
}



        
Take a few moments to answer the question “Could f ever return false?” This is not a trick question: I’ve purposefully used a simple example to make a point.
To check the answer with exhaustive testing, we could try executing the following doubly nested test loop, which calls f on all possible pairs of values of the type unsigned int:

            

    
#include<stdio.h>
#include<stdbool.h>
#include<limits.h>

bool f(unsigned int x, unsigned int y) {
   return (x+y == y+x);
}

void main() {
   for (unsigned int x=0;1;x++) {
      for (unsigned int y=0;1;y++) {
         if (!f(x,y)) printf("Error!\n");
         if (y==UINT_MAX) break;
      }
      if (x==UINT_MAX) break;
   }
}



        
Unfortunately, even on modern hardware, this doubly nested loop will run for a very long time. I compiled it and ran it on a 2.6 GHz Intel processor for over 48 hours before giving up.
Why does testing take so long? Because UINT_MAX is typically 4,294,967,295, there are 18,446,744,065,119,617,025 separate f calls to consider. On my 2.6 GHz machine, the compiled test loop called f approximately 430 million times a second. But to test all 18 quintillion cases at this performance, we would need over 1,360 years.
When we show the above code to industry professionals, they almost immediately work out that f can't return false as long as the underlying compiler/interpreter and hardware are correct. How do they do that? They reason about it. They remember from their school days that x + y can be rewritten as y + x and conclude that f always returns true.

            

    
        






    
    

        
            
Re:Invent 2021 keynote address by Peter DeSantis, senior vice president for utility computing at Amazon Web Services

        
        
            
Skip to 15:49 for a discussion of Amazon Web Services' work on automated reasoning.

        
    



        
An automated reasoning tool does this work for us: it attempts to answer questions about a program (or a logic formula) by using known techniques from mathematics. In this case, the tool would use algebra to deduce that x + y == y + x can be replaced with the simple expression true.
Automated-reasoning tools can be incredibly fast, even when the domains are infinite (e.g., unbounded mathematical integers rather than finite C ints). Unfortunately, the tools may answer “Don’t know” in some instances. We'll see a famous example of that below.
The science of automated reasoning is essentially focused on driving the frequency of these “Don’t know” answers down as far as possible: the less often the tools report "Don't know" (or time out while trying), the more useful they are.
Today’s tools are able to give answers for programs and queries where yesterday’s tools could not. Tomorrow’s tools will be even more powerful. We are seeing rapid progress in this field, which is why at Amazon, we are increasingly getting so much value from it. In fact, we see automated reasoning forming its own Amazon-style virtuous cycle, where more input problems to our tools drive improvements to the tools, which encourages more use of the tools.
A slightly more complex example. Now that we know the rough outlines of what automated reasoning is, the next small example gives a slightly more realistic taste of the sort of complexity that the tools are managing for us.

            

    
void g(int x, int y) {
   if (y > 0)
      while (x > y)
         x = x - y;
}



        
Or, alternatively, consider a similar Python program over unbounded integers:

            

    
def g(x, y):
   assert isinstance(x, int) and isinstance(y, int)
   if y > 0:
      while x > y:
         x = x - y



        
Try to answer this question: “Does g always eventually return control back to its caller?”
When we show this program to industry professionals, they usually figure out the right answer quickly. A few, especially those who are aware of results in theoretical computer science, sometimes mistakenly think that we can't answer this question, with the rationale “This is an example of the halting problem, which has been proved insoluble”. In fact, we can reason about the halting behavior for specific programs, including this one. We’ll talk more about that later.
Here’s the reasoning that most industry professionals use when looking at this problem:
  1. In the case where y is not positive, execution jumps to the end of the function g. That’s the easy case.
  2. If, in every iteration of the loop, the value of the variable x decreases, then eventually, the loop condition x > y will fail, and the end of g will be reached.
  3. The value of x always decreases only if y is always positive, because only then does the update to x (i.e., x = x - y) decrease x. But y’s positivity is established by the conditional expression, so x always decreases.
The experienced programmer will usually worry about underflow in the x = x - y command of the C program but will then notice that x > y before the update to x and thus cannot underflow.
If you carried out the three steps above yourself, you now have a very intuitive view of the type of thinking an automated-reasoning tool is performing on our behalf when reasoning about a computer program. There are many nitty-gritty details that the tools have to face (e.g., heaps, stacks, strings, pointer arithmetic, recursion, concurrency, callbacks, etc.), but there’s also decades of research papers on techniques for handling these and other topics, along with various practical tools that put these ideas to work.

            

    

        
    
        Policy-code.gif
    


        

        
    


    
        
Automated reasoning can be applied to both policies (top) and code (bottom). In both cases, an essential step is reasoning about what's always true.

    


        
The main takeaway is that automated-reasoning tools are usually working through the three steps above on our behalf: Item 1 is reasoning about the program’s control structure. Item 2 is reasoning about what is eventually true within the program. Item 3 is reasoning about what is always true in the program.
Note that configuration artifacts such as AWS resource policies, VPC network descriptions, or even makefiles can be thought of as code. This viewpoint allows us to use the same techniques we use to reason about C or Python code to answer questions about the interpretation of configurations. It’s this insight that gives us tools like IAM Access Analyzer or VPC Reachability Analyzer.
An end to testing?
As we saw above when looking at f and g, automated reasoning can be dramatically faster than exhaustive testing. With tools available today, we can show properties of f or g in milliseconds, rather than waiting lifetimes with exhaustive testing.
Can we throw away our testing tools now and just move to automated reasoning? Not quite. Yes, we can dramatically reduce our dependency on testing, but we will not be completely eliminating it any time soon, if ever. Consider our first example:

            

    
bool f(unsigned int x, unsigned int y) {
   return (x + y == y + x);
}



        
Recall the worry that a buggy compiler or microprocessor could in fact cause an executable program constructed from this source code to return false. We might also need to worry about the language runtime. For example, the C math library or the Python garbage collector might have bugs that cause a program to misbehave.
What’s interesting about testing, and something we often forget, is that it’s doing much more than just telling us about the C or Python source code. It’s also testing the compiler, the runtime, the interpreter, the microprocessor, etc. A test failure could be rooted in any of those tools in the stack.
Automated reasoning, in contrast, is usually applied to just one layer of that stack — the source code itself, or sometimes the compiler or the microprocessor. What we find so valuable about reasoning is it allows us to clearly define both what we do know and what we do not know about the layer under inspection.
Furthermore, the models of the surrounding environment (e.g., the compiler or the procedure calling our procedure) used by the automated-reasoning tool make our assumptions very precise. Separating the layers of the computational stack helps make better use of our time, energy, and money and the capabilities of the tools today and tomorrow.
Unfortunately, we will almost always need to make assumptions about something when using automated reasoning — for example, the principles of physics that govern our silicon chips. Thus, testing will never be fully replaced. We will want to perform end-to-end testing to try and validate our assumptions as best we can.
An impossible program
I previously mentioned that automated-reasoning tools sometimes return “Don’t know” rather than “yes” or “no”. They also sometimes run forever (or time out), thus never returning an answer. Let’s look at the famous "halting problem" program, in which we know tools cannot return “yes” or “no”.
Imagine that we have an automated-reasoning API, called terminates, that returns “yes” if a C function always terminates or “no” when the function could execute forever. As an example, we could build such an API using the tool described here (shameless self-promotion of author’s previous work). To get the idea of what a termination tool can do for us, consider two basic C functions, g (from above),

            

    
void g(int x, int y) {
   if (y > 0)
      while (x > y)
         x = x - y;
}



        
and g2:

            

    
void g2(int x, int y) {
   while (x > y)
      x = x - y;
}



        
For the reasons we have already discussed, the function g always returns control back to its caller, so terminates(g) should return true. Meanwhile, terminates(g2) should return false because, for example, g2(5, 0) will never terminate.
Now comes the difficult function. Consider h:

            

    
void h() {
   if terminates(h) while(1){}
}



        
Notice that it's recursive. What’s the right answer for terminates(h)? The answer cannot be "yes". It also cannot be "no". Why?
Imagine that terminates(h) were to return "yes". If you read the code of h, you’ll see that in this case, the function does not terminate because of the conditional statement in the code of h that will execute the infinite loop while(1){}. Thus, in this case, the terminates(h) answer would be wrong, because h is defined recursively, calling terminates on itself.
Similarly, if terminates(h) were to return "no", then h would in fact terminate and return control to its caller, because the if case of the conditional statement is not met, and there is no else branch. Again, the answer would be wrong. This is why the “Don’t know” answer is actually unavoidable in this case.
The program h is a variation of examples given in Turing’s famous 1936 paper on decidability and Gödel’s incompleteness theorems from 1931. These papers tell us that problems like the halting problem cannot be “solved”, if by“solved” we mean that the solution procedure itself always terminates and answers either “yes” or “no” but never “Don’t know”. But that is not the definition of “solved” that many of us have in mind. For many of us, a tool that sometimes times out or occasionally returns “Don’t know” but, when it gives an answer, always gives the right answer is good enough.
This problem is analogous to airline travel: we know it’s not 100% safe, because crashes have happened in the past, and we are sure that they will happen in the future. But when you land safely, you know it worked that time. The goal of the airline industry is to reduce failure as much as possible, even though it’s in principle unavoidable.
To put that in the context of automated reasoning: for some programs, like h, we can never improve the tool enough to replace the "Don't know" answer. But there are many other cases where today's tools answer "Don't know", but future tools may be able to answer "yes" or "no". The modern scientific challenge for automated-reasoning subject-matter experts is to get the practical tools to return “yes” or “no” as often as possible. As an example of current work, check out CMU professor and Amazon Scholar Marijn Heule and his quest to solve the Collatz termination problem.
Another thing to keep in mind is that automated-reasoning tools are regularly trying to solve “intractable” problems, e.g., problems in the NP complexity class. Here, the same thinking applies that we saw in the case of the halting problem: automated-reasoning tools have powerful heuristics that often work around the intractability problem for specific cases, but those heuristics can (and sometimes do) fail, resulting in “Don’t know” answers or impractically long execution time. The science is to improve the heuristics to minimize that problem.
Nomenclature
A host of names are used in the scientific literature to describe interrelated topics, of which automated reasoning is just one. Here’s a quick glossary:
  • A logic is a formal and mechanical system for defining what is true and untrue. Examples: propositional logic or first-order logic.
  • A theorem is a true statement in logic. Example: the four-color theorem.
  • A proof is a valid argument in logic of a theorem. Example: Gonthier's proof of the four-color theorem. 
  • A mechanical theorem prover is a semi-automated-reasoning tool that checks a machine-readable expression of a proof often written down by a human. These tools often require human guidance. Example: HOL-light, from Amazon researcher John Harrison. 
  • Formal verification is the use of theorem proving when applied to models of computer systems to prove desired properties of the systems. Example: the CompCert verified C compiler. 
  • Formal methods is the broadest term, meaning simply the use of logic to reason formally about models of systems. 
  • Automated reasoning focuses on the automation of formal methods. 
  • A semi-automated-reasoning tool is one that requires hints from the user but still finds valid proofs in logic. 
As you can see, we have a choice of monikers when working in this space. At Amazon, we’ve chosen to use automated reasoning, as we think it best captures our ambition for automation and scale. In practice, some of our internal teams use both automated and semi-automated reasoning tools, because the scientists we've hired can often get semi-automated reasoning tools to succeed where the heuristics in fully automated reasoning might fail. For our externally facing customer features, we currently use only fully automated approaches.
Next steps
In this essay, I’ve introduced the idea of automated reasoning, with the smallest of toy programs. I haven’t described how to handle realistic programs, with heap or concurrency. In fact, there are a wide variety of automated-reasoning tools and techniques, solving problems in all kinds of different domains, some of them quite narrow. To describe them all and the many branches and sub-disciplines of the field (e.g. “SMT solving”, “higher-order logic theorem proving”, “separation logic”) would take thousands of blogs posts and books.
Automated reasoning goes back to the early inventors of computers. And logic itself (which automated reasoning attempts to solve) is thousands of years old. In order to keep this post brief, I’ll stop here and suggest further reading. Note that it’s very easy to get lost in the weeds reading depth-first into this area, and you could emerge more confused than when you started. I encourage you to use a bounded depth-first search approach, looking sequentially at a wide variety of tools and techniques in only some detail and then moving on, rather than learning only one aspect deeply.
Suggested books:
International conferences/workshops:
Tool competitions:
Some tools:
Interviews of Amazon staff about their use of automated reasoning:
AWS Lectures aimed at customers and industry:
AWS talks aimed at the automated-reasoning science community:
AWS blog posts and informational videos:
Some course notes by Amazon Scholars who are also university professors:
A fun deep track:
Some algorithms found in the automated theorem provers we use today date as far back as 1959, when Hao Wang used automated reasoning to prove the theorems from Principia Mathematica.

    



                            
                        

                    
                


                
                    

                        

    

    

        Research areas
    


    
        
    



                    

                

                
                    

                        

    

    

        Tags
    


    
        
    



                    

                

                

                
                    
About the Author

                    

                        
                            
    

        

            
                

                    Byron Cook
                

            
            
            
                

                    Amazon vice president and distinguished scientist Byron Cook is a leader in the field of formal verification, known for his contributions to SAT, SMT, and symbolic model checking, with applications to biological systems, computer operating systems, programming languages, and security. Byron’s work on automated reasoning at Amazon has led to higher levels of assurance in the cloud as well as new customer features.
                

            
        

    



                        
                    

                
            

        


        
    

    
    



    

        
Related content

        
    




    
        
    

    



    
    



    

        
Work with us
See more jobs
        
            See more jobs
        
    




    
        

            

                
                    

                        

    

    

        
            

                Data Scientist, CloudTune
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Seattle

            
        


        
    
Amazon's eCommerce Foundation (eCF) organization provides the core technologies that drive and power Amazon's Stores, Digital, and Other (SDO) businesses. Millions of customer page views and orders per day are enabled by the systems eCF builds from the ground up. CloudTune, within eCF, empowers growth and business agility needs by automatically and efficiently managing AWS capacity and business processes needed to safely meet Amazon's customer demand. CloudTune serves its primary customers, internal software teams, through forecast-driven automation of cost controllership, capacity management, and scaling. We predict expected load, and drive procurement and allocation of AWS capacity for new product launches and high-velocity events like Prime Day and Cyber Monday. CloudTune is looking for a Data Scientist to join our forecasting and optimization team. The team develops sophisticated algorithms that combine machine learning-based demand forecasting with mathematical optimization to solve large-scale capacity planning problems under uncertainty. We work with massive datasets — spanning thousands of availability zone and instance family combinations across global regions — to determine optimal resource allocation strategies that balance infrastructure holding costs against service availability requirements. These models directly inform multi-million dollar capacity investment decisions and drive automated procurement, retention, and release policies across Amazon's compute infrastructure. As a Data Scientist in CloudTune, you will work with other scientists, software engineers, data engineers, and product managers on a variety of important research problems in the areas of stochastic optimization, time series modeling, and operations research. You will work on statistical problems with a high level of ambiguity. You will analyze and process large amounts of data, develop new algorithms and improve existing approaches based on statistical models, machine learning algorithms and big data solutions to automatically scale Amazon’s compute infrastructure, optimizing the balance between availability risk and cost efficiency for all of Amazon businesses. Key job responsibilities - Process and analyze large data sets, mining additional data sources as needed - Build statistical models and drive scalable solutions for multi-year capacity demand forecasting horizons - Create, enhance, and maintain technical documentation, and present to other scientists and business leaders - Process and analyze large-scale operational data to identify patterns and inform model development - Create, enhance, and maintain technical documentation, and present research findings to scientists, engineering teams, and senior leadership




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Sr Research Scientist, Battery Algorithms, Energy Storage, Project Jewel
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, CA, Irvine

            
        


        
    
Do you want to write the algorithms that control next-generation batteries, and shape the future of energy storage? This role sits where electrochemistry, data/ML, and control theory meet. You will develop the physics-informed and data-driven methods that estimate state of charge, health, power capability, and remaining life, and validate them against lab and fleet data until they are ready to ship. Your algorithms will decide how hard a battery can be pushed, when it needs attention, and how long it will last, so they shape the safety, warranty, and economics of the whole product. You will work side by side with cell, systems, and software engineers, and as an early hire you will help define how we develop and validate battery algorithms. This role can be based in Boston, Irvine, Sunnyvale, or Seattle, and involves occasional domestic and international travel, up to 10% of the time. Key job responsibilities • Develop and own algorithms for state of charge, state of health, power capability, and remaining useful life, combining physics-based models with data-driven and estimation methods. • Deliver validated reference implementations, test vectors, and accuracy targets that define what production code must achieve. • Design the test plans and data needed to develop and validate algorithms, working with the cell and testing teams to turn lab and field data into model improvements. • Analyze algorithm performance across the deployed fleet, find where models drift or fail, and drive improvements. • Own the accuracy and robustness of battery algorithms, and sign off that production implementations match the validated reference. Provide algorithm evidence for safety certification. A day in the life Your week moves between data, models, and experiments. One day you might be working out why a health estimate drifts on cells that have aged in the field, and the next deciding which model structure holds accuracy at cold temperatures. You could be designing a test with the cell team to expose a behavior your model misses, or reviewing an implementation with an applied scientist to confirm that what ships matches what you validated. You will regularly share results with software, systems, and cell leaders, and your findings will shape decisions well beyond the algorithm itself. About the team We are building Amazon's energy storage capability, providing power for advanced technologies while contributing to a stable grid. Our product is highly connected, yet secure and resilient by design. We own it end to end, from software, ML, and controls through system design to cell selection and supply, and on to a safety-certified product in the field. The organization operates like a startup inside Amazon: small, fast-moving, and accountable for our decisions. We work across hardware, software, and science, with suppliers and partners worldwide, and with Amazon infrastructure, procurement, legal, and finance. The organization is at an early stage and growing quickly. You will be among the first algorithm hires, so you will help shape how we design, build, certify, and ship, with a direct line of sight to the product and business decisions your work informs. This is a dynamic role that will regularly present new challenges as the product and organization evolve.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Data Scientist , Leo Customer Terminal
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Redmond

            
        


        
    
At Amazon, we’re inventing on behalf of customers, and with Amazon Leo, we’re redefining what global connectivity looks like. Our mission is to deliver fast, affordable broadband to unserved and underserved communities around the world through a constellation of low Earth orbit (LEO) satellites. Every system we build helps connect people to education, healthcare, opportunity, and each other. As a Data Scientist, you will be responsible for developing advanced analytics and machine learning solutions for user terminals. You will develop predictive models to proactively identify possible user terminal failures in the field. You will work in a collaborative environment with a multi-disciplinary team, including constellation, RF, antenna, silicon, algorithm, and software engineers. Key job responsibilities As a Data Scientist, you will develop analytic tools for a team developing current and future user terminals. Your responsibilities include: • Develop statistical and analytical tool to enable the regression decision from on-orbit and lab measurement of user terminals • Publish documents and create compelling visualizations and presentations to communicate insights to stakeholders • Create and manage datasets for continued pre-training and supervised fine-tuning of LLMs • Develop scalable visualizations for analysis of user terminal performance • Work closely with constellation, RF, antenna, silicon, algorithm, and software engineers to root-cause the failures using data as the primary tool • Drive consensus on metrics and analysis approaches to support product development strategy Export Control Requirement: Due to applicable export control laws and regulations, candidates must be a U.S. citizen or national, U.S. permanent resident (i.e., current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum. A day in the life As a Data Scientist in the LEO Customer Terminal Team, you will work daily with satellite constellation, algorithm, RF, antenna, silicon, hardware, and software teams in a collaborative environment. Your focus will be using data as an intelligence source to enable design decisions for the team. About the team The LEO Customer Terminal team is responsible for developing both outdoor and indoor devices that enable customers to access internet service via the LEO satellite network. We own the entire process from early prototypes through mass production, including requirements documentation, architecture definition, hardware development, algorithm development, and all integration and verification testing.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Applied Scientist, Superconducting Digital and Cryogenic Control Electronics,Center for Quantum Computing, Physical Design and Simulation, Enabling Technologies
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, CA, San Francisco

            
        


        
    
The Amazon Center for Quantum Computing (CQC) is seeking an Applied Scientist to research and design cryogenic control hardware for large-scale quantum processors, with an emphasis on superconducting digital circuits. Controlling and reading out orders of magnitude more qubits than today's systems demands rethinking where classical control lives and what technology implements it; you will design and model superconducting digital logic (e.g., single-flux-quantum-family circuits) and related cryogenic electronics, evaluate them against the wiring, power, and thermal budgets of a scaled system, and co-design control approaches with the qubit devices they serve. You will carry designs from concept through simulation, layout, design review, and fabrication handoff, and your evaluations will inform which control-electronics directions the organization invests in. Key job responsibilities • Design and simulate superconducting digital circuits and cryogenic control/readout electronics for scalable qubit control • Develop and validate Josephson-junction circuit models, timing and margin analyses, and verification methodology for superconducting digital designs • Quantify system-level trade-offs — wiring count, power dissipation at each cryogenic stage, latency, footprint — across candidate control architectures, and communicate recommendations • Co-design control interfaces with qubit-device colleagues so control electronics and quantum devices are developed as one system • Deliver design artifacts through the organization's design-request and design-review processes, including tapeout-ready layouts and verification reports • Present results internally and, where appropriate, publish in peer-reviewed venues About the team The Enabling Technologies team develops technologies and relationships facilitating scaling, including alternative quantum processor architectures, superconducting qubit device packaging, and cryogenic control device electronics. We work alongside a co-located quantum processor design team focused on current-generation devices; the two teams share design and review processes, and moving ideas between them is an explicit part of our charter.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                 Satellite GNC Engineer, Amazon Leo
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Redmond

            
        


        
    
Amazon Leo is building a constellation of thousands of low Earth orbit satellites. It will bring fast, reliable internet to customers beyond the reach of existing networks. On the Guidance, Navigation and Control (GNC) team, you will design the algorithms, simulations and onboard autonomy that keep every satellite precisely pointed and stable. Your work lets the payload serve customers on the ground, and it keeps the fleet flying safely. This is satellite GNC at constellation scale. The constellation is launching and growing today, so you will see your work go from concept to orbit, and then fly on many satellites. In this role, you will: - Take your GNC algorithms from concept to orbit, and stay with them through integration, test and on-orbit operations. - Write the production C++ flight code for your own algorithms. The code that flies is the code you write. - Solve hard problems in precise pointing, payload cueing and fleet autonomy. - Work across design, simulation, test and flight operations, not a narrow slice of the lifecycle. **Export Control Requirement:** Due to applicable export control laws and regulations, candidates must be a U.S. citizen or national, U.S. permanent resident (i.e., current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum. Key job responsibilities - Design and analyze algorithms for state estimation, attitude determination and control, precise pointing and payload cueing against demanding performance requirements. - Implement these algorithms in production C++ flight software. Our GNC engineers own their algorithms all the way into flight, and partner with our embedded software engineers to integrate and test them. - Write concepts of operations for each phase of a satellite's life, from launch and orbit raising to service and deorbit, including failures and recovery. Balance what the payload needs against momentum, power, thermal and ground-contact limits. - Develop momentum management strategies with reaction wheels and magnetic torquers. Help select, size and place the GNC sensors and actuators for future satellites, and design the algorithms that use them. These include star trackers, magnetometers, sun sensors, IMUs and GNSS receivers. - Develop onboard autonomy, including Fault Detection, Isolation and Recovery (FDIR), so that the fleet operates safely at scale with minimal ground intervention. - Build and validate satellite and constellation models and simulations at several levels of fidelity, including 6-DOF simulation and Monte Carlo analysis. Verify closed-loop performance in hardware-in-the-loop (HITL) tests. - Support component environmental tests, functional and performance checkout, and subsystem and satellite integration in our labs. - Analyze telemetry from the whole fleet. Build the metrics, dashboards and tools that track pointing performance and payload operations time as the constellation grows, and use them to improve the fleet. - Operate the GNC system on orbit and take part in the team's on-call rotation. Review fleet data, support maneuvers, and resolve anomalies when on-orbit behavior differs from the ground model. - Review designs and code with the team, and document your algorithms, analyses and results clearly. A day in the life This role covers a wide range of problems across the spacecraft and the network. You will derive and prototype estimation and control algorithms, and then turn them into production flight code. You will prove them in 6-DOF and Monte Carlo simulation and in hardware-in-the-loop tests in the lab. You will support satellite integration. When a satellite does not behave as the ground model predicted, you will dig into fleet telemetry, find the cause and drive the fix. You will own each problem end to end, with the focus to go deep on it. GNC is at the center of safe flight, so you will work across the whole program. The payload, power, thermal and operations teams all depend on GNC, and you will balance their needs against the pointing and momentum budgets. You will partner closely with avionics, flight software and embedded software engineers to make your algorithms run reliably on the spacecraft. You will help the mechanical teams shape the next generation of satellite hardware, from reaction wheels to star trackers. As satellites move from design through manufacturing into orbit, you will work with systems engineering and Assembly, Integration and Test. The problems are hard: tight pointing requirements, a large constellation to keep flying safely, and the chance to invent capabilities that do not exist yet. Constant work with other teams makes this a place where you keep learning and growing. About the team You will join the Satellite Attitude Determination and Control team. We own GNC for our satellites end to end: algorithm design, flight software, lab integration, and flight operations of our own satellites on orbit. Our engineers bring deep experience from many satellite programs and other flight vehicles, with real strength in both our mission and the core GNC disciplines. We design, prototype, test, iterate and learn together. Because GNC is central to safe flight, we drive the concepts of operations and many of the system-level analyses on the program. We also have a lot of freedom. We trust our engineers to choose their own tools and approaches for the problems they face, and to own the results. If you want the autonomy to solve hard problems your way, with a team of strong engineers, you will feel at home here.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Senior Satellite GNC Engineer, Amazon Leo
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Redmond

            
        


        
    
Amazon Leo is building a constellation of thousands of low Earth orbit satellites. It will bring fast, reliable internet to customers beyond the reach of existing networks. On the Guidance, Navigation and Control (GNC) team, you will design the algorithms, simulations and onboard autonomy that keep every satellite precisely pointed and stable. Your work lets the payload serve customers on the ground, and it keeps the fleet flying safely. This is satellite GNC at constellation scale. The constellation is launching and growing today, so you will see your work go from concept to orbit, and then fly on many satellites. In this role, you will: - Take your GNC algorithms from concept to orbit, and stay with them through integration, test and on-orbit operations. - Write the production C++ flight code for your own algorithms. The code that flies is the code you write. - Solve hard problems in precise pointing, payload cueing and fleet autonomy. - Work across design, simulation, test and flight operations, not a narrow slice of the lifecycle. **Export Control Requirement:** Due to applicable export control laws and regulations, candidates must be a U.S. citizen or national, U.S. permanent resident (i.e., current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum. Key job responsibilities - Design and analyze algorithms for state estimation, attitude determination and control, precise pointing and payload cueing against demanding performance requirements. - Implement these algorithms in production C++ flight software. Our GNC engineers own their algorithms all the way into flight, and partner with our embedded software engineers to integrate and test them. - Write concepts of operations for each phase of a satellite's life, from launch and orbit raising to service and deorbit, including failures and recovery. Balance what the payload needs against momentum, power, thermal and ground-contact limits. - Develop momentum management strategies with reaction wheels and magnetic torquers. Help select, size and place the GNC sensors and actuators for future satellites, and design the algorithms that use them. These include star trackers, magnetometers, sun sensors, IMUs and GNSS receivers. - Develop onboard autonomy, including Fault Detection, Isolation and Recovery (FDIR), so that the fleet operates safely at scale with minimal ground intervention. - Build and validate satellite and constellation models and simulations at several levels of fidelity, including 6-DOF simulation and Monte Carlo analysis. Verify closed-loop performance in hardware-in-the-loop (HITL) tests. - Support component environmental tests, functional and performance checkout, and subsystem and satellite integration in our labs. - Analyze telemetry from the whole fleet. Build the metrics, dashboards and tools that track pointing performance and payload operations time as the constellation grows, and use them to improve the fleet. - Operate the GNC system on orbit and take part in the team's on-call rotation. Review fleet data, support maneuvers, and resolve anomalies when on-orbit behavior differs from the ground model. - Review designs and code with the team, and document your algorithms, analyses and results clearly. A day in the life This role covers a wide range of problems across the spacecraft and the network. You will derive and prototype estimation and control algorithms, and then turn them into production flight code. You will prove them in 6-DOF and Monte Carlo simulation and in hardware-in-the-loop tests in the lab. You will support satellite integration. When a satellite does not behave as the ground model predicted, you will dig into fleet telemetry, find the cause and drive the fix. You will own each problem end to end, with the focus to go deep on it. GNC is at the center of safe flight, so you will work across the whole program. The payload, power, thermal and operations teams all depend on GNC, and you will balance their needs against the pointing and momentum budgets. You will partner closely with avionics, flight software and embedded software engineers to make your algorithms run reliably on the spacecraft. You will help the mechanical teams shape the next generation of satellite hardware, from reaction wheels to star trackers. As satellites move from design through manufacturing into orbit, you will work with systems engineering and Assembly, Integration and Test. The problems are hard: tight pointing requirements, a large constellation to keep flying safely, and the chance to invent capabilities that do not exist yet. Constant work with other teams makes this a place where you keep learning and growing. About the team You will join the Satellite Attitude Determination and Control team. We own GNC for our satellites end to end: algorithm design, flight software, lab integration, and flight operations of our own satellites on orbit. Our engineers bring deep experience from many satellite programs and other flight vehicles, with real strength in both our mission and the core GNC disciplines. We design, prototype, test, iterate and learn together. Because GNC is central to safe flight, we drive the concepts of operations and many of the system-level analyses on the program. We also have a lot of freedom. We trust our engineers to choose their own tools and approaches for the problems they face, and to own the results. If you want the autonomy to solve hard problems your way, with a team of strong engineers, you will feel at home here.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Applied Science III
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Seattle

            
        


        
    
Do you want to make AI provably correct for chip design and verification? We're hiring an Applied Scientist to combine large language models with formal methods such as Lean 4 and turn AI from a helpful assistant into a trusted engineering tool for silicon. Our team builds the formal verification methods behind custom silicon at Amazon scale. As AI agents take on more of chip design and verification, we need people who can make sure their output is checkable, sound and grounded in mathematics. You will research and build systems where LLMs work alongside interactive theorem provers, SMT solvers and model checkers. Engineers write the specifications. AI refines them against RTL, generates proof steps and closes proofs at machine speed. Every result is checked by a formal kernel, not trusted on faith. Work at the frontier of AI reasoning, theorem proving and hardware verification Ship solutions that directly affect real chips running in AWS data centers Publish and help shape how the industry formalizes AI use in hardware engineering Key job responsibilities Design and build LLM-driven systems for formal verification and design tasks, including proof generation, invariant and lemma discovery, spec-to-RTL refinement, and counterexample analysis Develop frameworks in Lean 4 (and related tools such as SMT solvers, model checkers and commercial FV engines) that formally check AI-generated artifacts, so they are correct by construction rather than just plausible Formalize hardware semantics, ISAs and microarchitectural properties in Lean 4 to create machine-checkable foundations for AI agents to reason over Track and evaluate state-of-the-art AI work (LLM agents, autoformalization, neural theorem proving, reinforcement learning from proof feedback) and turn promising research into production tools Build benchmarks and evaluation methods that measure AI soundness, proof success rate and engineering impact on real designs Partner with FV and design engineers to find the highest-leverage problems and deploy solutions into active chip programs Publish research, file patents and represent Amazon in the formal methods and AI communities Mentor engineers and scientists on applying formal AI methods




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Applied Scientist II
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, CA, Pasadena

            
        


        
    
We are seeking Applied Scientists to join Amazon. In this role, you will develop and deploy the science of safe autonomy on highly dynamic robots, advancing the frontier through both foundational research and realization on hardware. You will contribute to achieving safe autonomy across three key areas: control barrier function (CBF) theory for robust and performant safety on hardware; safe reinforcement learning for agile whole-body control; and layered safety filters that interface with learning, perception, and semantic reasoning systems. You will validate your work experimentally on state-of-the-art robotic platforms — removing bottlenecks to deployment and enabling robots to safely operate around humans. You will work with the inventor of CBFs, as well as top scientists and engineers at Amazon developing the next generation of safe autonomy. Key job responsibilities -Advance the science of safe autonomy from formal foundations to the integration with learning and perception to validation on hardware — with particular emphasis on methods that bridge these domains. -Test and validate hardware, with a focus on next generation robotic systems. Including locomotion, manipulation and loco-manipulation. -Leverage the deployments on hardware to validate the underlying science, identifying gaps between theory and practice that drive the next cycle of research. hardware to validate the underlying science, identifying gaps between theory and practice that drive the next cycle of research. -Publish research at top-tier robotics, control, and ML venues, and contribute to Amazon’s scientific reputation in advanced robotics. -Collaborate with SAF Lab and Amazon production teams to move research into robots deployed at Amazon scale. A day in the life Amazon offers a full range of benefits that support you and eligible family members, including domestic partners and their children. Benefits can vary by location, the number of regularly scheduled hours you work, length of employment, and job status such as seasonal or temporary employment. The benefits that generally apply to regular, full-time employees include: -Medical, Dental, and Vision Coverage -Maternity and Parental Leave Options -Paid Time Off (PTO) -401(k) Plan If you are not sure that every qualification on the list above describes you exactly, we’d still love to hear from you! At Amazon, we value people with unique backgrounds, experiences, and skillsets. If you’re passionate about this role and want to make an impact on a global scale, please apply! About the team The Safe Autonomy Frontiers (SAF) Lab is the first industry research lab dedicated to safe autonomy, founded by the inventor of control barrier functions. We are developing a universal safety layer for the next generation of robotic systems: mobile robots, manipulators, quadrupeds, and humanoids. Here you will advance performant safety for highly dynamic robots — CBF theory integrated with perception and learning, evaluated on next-generation platforms — and your work will underpin robots operating alongside people at Amazon’s unprecedented scale.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                2027 Applied Science Internship - Robotics - United States
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, MA, North Reading

            
        


        
    
Robotics Applied Scientist II Intern/Co-op (2027) Are you passionate about robotics and research? Do you want to solve real customer problems through innovative technology? Do you enjoy working on scalable research and projects in a collaborative team environment? Do you want to see your science solutions directly impact millions of customers worldwide? We’re looking for current PhD students with a passion for robotic research and applications to join us in 2027 as Robotics Applied Scientist II Interns/Co-ops to shape the future of robotics and transform automation at Amazon’s scale. By applying to this role, you will be considered for Robotics Applied Scientist II Intern/Co-op (2027) opportunities across various Robotics teams at Amazon with different robotics research focus. Internship positions are available for multiple locations, durations (3 to 6+ months), and year-round start dates (winter, spring, summer, fall). Join us at the forefront of Applied Science, where your contributions will shape the future of Robotics! Key job responsibilities As a Robotics Applied Scientist II Intern/Co-op, you will work alongside global experts to advance the state of the art in robotics and artificial intelligence, tackling innovative problems that bridge the gap between research and real-world robotics implementation to innovate and build solutions on behalf of our customers. We are particularly interested in students with specialization and expertise in one or more of the following research areas: - Robotics - Artificial Intelligence - Robotics Manipulation (e.g., robot arm, grasping, dexterous manipulation, end of arm tools/end effector) - Autonomous Mobile Robots - Mobile Manipulation - Multi-Robot Coordination - Autonomous Navigation - Locomotion - Motion/Path Planning - Controls - Perception - Sensing - Robot Learning - Machine Learning - Computer Vision - Large Language Models (LLM), Vision-Language-Action Models (VLA), Vision-Language-Models (VLM) - World Models - Human-Robot Interaction - Robotics Simulation - Optimization - And related! Key responsibilities may include: - Develop novel, scalable algorithms and/or modeling techniques that advance the state-of-the-art in science areas such as robotics, artificial intelligence, or related - Tackle challenging, innovative research problems within robotics, artificial intelligence, or related that bridge the gap between theoretical advancement and practical robotics implementation - Collaborate with cross-functional teams to solve complex problems, and to communicate research findings clearly, leveraging your expertise in robotics, artificial intelligence, or related - Demonstrate the ability to work independently, thrive in a fast-paced, ever-changing environment - Leverage AI-powered tools where applicable to accelerate research, experimentation, and prototyping. - Critically review and validate outputs from AI tools and automated systems. About the team Explore Robotics Teams at Amazon At Amazon, robotics is where innovative research meets real-world deployment. There are many different specialized robotics teams, including the few highlighted below. Learn more about Robotics at Amazon here: https://www.amazon.science/research-areas/robotics Fulfillment Technologies and Robotics We build dynamic partnerships between people and intelligent machines. This intricate collaboration helps Amazon fulfill orders with unmatched accuracy. Working in symphony with our robotic technology, you’ll have the opportunity to extend your technical capabilities by working alongside some of the industry’s most advanced technologies. This includes our fleet of autonomous mobile robots, sophisticated control software, and technologies like language perception, machine learning, object recognition, and semantic understanding of commands. These technologies help us deliver an ever-improving customer and employee experience, as well as improve the safety of our facilities. Amazon Robotics Amazon Robotics is at the epicenter of robotics innovation. We design, test, and build mobile robots and mechatronic systems. Our offices, labs, test floors, and factories are close together, which means we can design the hardware, write the code, test, build, and watch it all come to life. Our areas of focus include advancements in autonomous mobility, AI, robotic management software, and much more. Fauna Fauna is focused on building capable, safe, and genuinely delightful robots for everyday life. Fauna’s goal is simple: make robots people actually want to live and interact with everyday. Fauna develops tightly integrated hardware and software systems that make it faster, safer, and more intuitive to create real-world robotic products. Fauna’s work spans the full stack: mechanical design, control systems, dynamic modeling, and intelligent software. The focus is not just functionality, but overall experience. Amazon Fulfillment Technologies Amazon Fulfillment Technologies develops tech solutions that create network optimizations for all Amazon sites worldwide. We own network infrastructure and devices in all buildings and labor planning and scheduling technology for fulfillment centers in North America and Europe.




        

        

        

        
    


    



                    

                
                    

                        

    

    

        
            

                Applied Scientist III - AMZ10037670 
            

        

        

            
                
                    

                
            

            

            

            

            
                
US, WA, Seattle

            
        


        
    
MULTIPLE POSITIONS AVAILABLE Employer: AMAZON.COM SERVICES LLC Offered Position: Applied Scientist III Job Location: Seattle, Washington Job Number: AMZ10037670 Position Responsibilities: Participate in the design, development, evaluation, deployment and updating of data-driven models and analytical solutions for machine learning (ML) and/or natural language (NL) applications. Develop and/or apply statistical modeling techniques (e.g. Bayesian models and deep neural networks), optimization methods, and other ML techniques to different applications in business and engineering. Routinely build and deploy ML models on available data, and run and analyze experiments in a production environment. Identify new opportunities for research in order to meet business goals. Research and implement novel ML and statistical approaches to add value to the business. Mentor junior engineers and scientists. Position Requirements: Master’s degree or foreign equivalent degree in Computer Science, Machine Learning, Engineering, or a related field and two years of research or work experience in the job offered, or as a Research Scientist, Research Assistant, Software Engineer, or a related occupation. Employer will accept a Bachelor’s degree or foreign equivalent degree in Computer Science, Machine Learning, Engineering, or a related field and five years of progressive post-baccalaureate research or work experience in the job offered or a related occupation as equivalent to the Master’s degree and two years of research or work experience. Must have one year of research or work experience in the following skill(s): (1) programming in Java, C++, Python, or equivalent programming language; and (2) conducting the analysis and development of various supervised and unsupervised machine learning models for moderately complex projects in business, science, or engineering. Amazon.com is an Equal Opportunity-Affirmative Action Employer – Minority / Female / Disability / Veteran / Gender Identity / Sexual Orientation. 40 hours / week, 8:00am-5:00pm, Salary Range $167,100/year to $226,100/year. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, visit: https://www.aboutamazon.com/workplace/employee-benefits. #0000




        

        

        

        
    


    



                    

                
            

        

    

    

        See more jobs
    






        




    

        
            
        
        

            

                
                    

                        

                    

                
            

            
                

                    

                        

  

      
          

              
                  
    
        View from space of a connected network around planet Earth representing the Internet of Things.
    

              
          

      

      

        

          
              
Get more from Amazon Science

          

          
    
Subscribe to our newsletter



        

        
          
        
      

  



                    

                

            
        

    


    

        

        
            
Amazon.com | Conditions of Use | Privacy | © 1996-2026 Amazon.com, Inc. or its affiliates

        
        
            

    
Social