A system for controlling an operation of a vehicle to rendezvous the vehicle with a target over a finite time horizon, wherein the vehicle is a spacecraft, the system comprising: a controller having a model of dynamics of the vehicle; a memory having stored passive unsafe regions; a transceiver that accepts data including values of vehicle states and the target states in a multi-object celestial system at a specified time period within the finite time horizon; a processor that, at the specified time period, is configured to access the memory and select a set of passive unsafe regions corresponding to an orbit that the target is located at the specified time period, wherein the set of passive unsafe regions represents regions of space around the target guaranteeing collision trajectories with the target, in an event of total spacecraft thruster failure; formulate the set of passive unsafe regions as passive safety constraints; update the controller having the model of dynamics of the vehicle with the accepted data, and subject the updated controller to the passive safety constraints to generate control commands that produce a collision free rendezvous trajectory which avoids the set of passive unsafe regions, guaranteeing a collision-free trajectory with respect to the target in the event of the total vehicle thruster failure, so that the vehicle does not collide with the target; and output the control commands to activate or not activate one or more thrusters of the vehicle for the specified time period based on the control commands, characterized in that the controller is a model predictive controller and the set of passive unsafe regions is determined by computing backwards reachable sets of a region around the target, wherein the target is one of a spacecraft, a celestial body and orbital debris and wherein the region around the target is one of an approach ellipsoid region, a keep-out sphere region, an approach polytope region and a keep-out polytope region. a controller having a model of dynamics of the vehicle; a memory having stored passive unsafe regions; a transceiver that accepts data including values of vehicle states and the target states in a multi-object celestial system at a specified time period within the finite time horizon; a processor that, at the specified time period, is configured to access the memory and select a set of passive unsafe regions corresponding to an orbit that the target is located at the specified time period, wherein the set of passive unsafe regions represents regions of space around the target guaranteeing collision trajectories with the target, in an event of total spacecraft thruster failure; formulate the set of passive unsafe regions as passive safety constraints; update the controller having the model of dynamics of the vehicle with the accepted data, and subject the updated controller to the passive safety constraints to generate control commands that produce a collision free rendezvous trajectory which avoids the set of passive unsafe regions, guaranteeing a collision-free trajectory with respect to the target in the event of the total vehicle thruster failure, so that the vehicle does not collide with the target; and output the control commands to activate or not activate one or more thrusters of the vehicle for the specified time period based on the control commands, characterized in that the controller is a model predictive controller and the set of passive unsafe regions is determined by computing backwards reachable sets of a region around the target, wherein the target is one of a spacecraft, a celestial body and orbital debris and wherein the region around the target is one of an approach ellipsoid region, a keep-out sphere region, an approach polytope region and a keep-out polytope region. access the memory and select a set of passive unsafe regions corresponding to an orbit that the target is located at the specified time period, wherein the set of passive unsafe regions represents regions of space around the target guaranteeing collision trajectories with the target, in an event of total spacecraft thruster failure; formulate the set of passive unsafe regions as passive safety constraints; update the controller having the model of dynamics of the vehicle with the accepted data, and subject the updated controller to the passive safety constraints to generate control commands that produce a collision free rendezvous trajectory which avoids the set of passive unsafe regions, guaranteeing a collision-free trajectory with respect to the target in the event of the total vehicle thruster failure, so that the vehicle does not collide with the target; and output the control commands to activate or not activate one or more thrusters of the vehicle for the specified time period based on the control commands, characterized in that the controller is a model predictive controller and the set of passive unsafe regions is determined by computing backwards reachable sets of a region around the target, wherein the target is one of a spacecraft, a celestial body and orbital debris and wherein the region around the target is one of an approach ellipsoid region, a keep-out sphere region, an approach polytope region and a keep-out polytope region.