Recent on-orbit mission performance illustrates a pressing need to develop passively safe formation flight trajectories and controllers for multiple satellite proximity operations. A receding horizon control (RHC) approach is formulated that directly relates navigation uncertainty and process noise to non-convex quadratic constraints, which enforce passive safety in the presence of a large class of navigation or propulsion system failures. Several Keplerian simulations are executed to examine increased Â¿v usage incurred by adding passive safety constraints, the corresponding reduction in collision probability, and resulting passively safe formation flight geometries. Results show that modest cross-track motion significantly reduces collision probability, and that once a passively safe relative orbit is achieved, steady-state Â¿v usage rates are comparable to usage rates without passive safety constraints. Navigation uncertainty and process noise are found to be significant Â¿v usage drivers for passively safe proximity operations. Onorbit autonomous RHC control with passive safety constraints applied to proximity operation missions enables trajectory generation and control that reduces collision probability to acceptable levels while minimizing Â¿v usage.