The number that decides everything
Light takes 1.28 seconds to cross the 384,400 km between Earth and the Moon, so a command and its acknowledgement take 2.56 seconds at absolute best. Add ground processing, relay hops and the operator's own reaction time and three to four seconds is realistic.
For a rover moving at a walking pace of 0.5 m/s, that is 1.3 metres travelled between the operator seeing something and the machine responding to it. A boulder that appears at the edge of a camera frame is already under the wheel by the time the stop command lands.
Apollo drove the lunar roving vehicle with a human aboard, which sidesteps this entirely. An uncrewed construction site does not have that option, and the whole point of this base is that machines do the dangerous, repetitive work while the crew do the parts that need judgement.
Where the decisions are made
The safety layer is the lowest and simplest thing in the stack, it is separately verified, and it has exactly one authority: to stop. It cannot be talked out of a stop by a higher layer, and nothing above it can command motion the safety layer has inhibited. Complexity goes upward, authority to move goes downward, and the two never cross.
What runs unsupervised
| Task | Autonomy level | Human role | Why |
|---|---|---|---|
| Regolith excavationrepetitive, bounded | Full | Set the face and the quota | Well defined, low consequence, endlessly repetitive |
| Haulage between pointsknown route | Full | None | Graded roads and a surveyed route. This is the easy case. |
| Laser sinteringthe pad and roads | Full | Approve the plan | Bounded work area, continuous quality feedback from the ultrasonic head |
| Paver placementberms | Supervised | Watch and approve | Placement errors compound, so a human checks each course |
| ISRU plant operationin situ resource utilisation, continuous | Full | Exception only | Steady state process with clear limits |
| Regolith placement over modulesbulk shielding, a later increment | Teleoperated | Direct control | A dropped load on a pressure vessel is unrecoverable |
| Any work near the habitatwithin 15 m | Supervised | Crew present | Consequence, not difficulty |
| Anything near a personextravehicular activity (EVA) in progress | Inhibited | Machine stops | The safety layer, not a policy |
| Overall | 94% of machine hours unsupervised | Design target | No flight precedent yet, see section 06 |
Edge compute
All of this runs on the base rather than in orbit or on Earth, because a decision loop that crosses a radio link is a decision loop that can be interrupted. The compute is modest by terrestrial standards and enormous by spacecraft standards, which is the interesting part. The figures in the table are allocations for the concept, not measured hardware.
| Element | Spec | Power | Note |
|---|---|---|---|
| Perceptionstereo and lidar | 24 TOPS | 78 W | Trillion operations per second (TOPS). Radiation tolerant accelerator, derated from the commercial part |
| Planning and schedulingsite supervisor | 8 core, 32 GB | 42 W | Runs the daily plan and the task queue |
| Safety layerseparate hardware | Lockstep microcontroller (MCU) | 6 W | Formally verified, does one thing |
| Storagelogs and models | 8 TB | 12 W | Everything is logged, because Earth reviews after the fact |
| Total | 138 W | 0.5 percent of the habitat load |
138 watts to remove most of the need for a human to be outside. Against an EVA hour that costs 0.043 mSv of crew dose, the open surface rate the radiation document carries, plus the hours of preparation a conventional airlock adds before every EVA, that is the best trade in the entire architecture.
Failure modes, and the ones that matter
| Failure | Effect | Detection | Response |
|---|---|---|---|
| Perception false negativemisses an obstacle | Collision | Lidar and bumper disagree with the camera | Safety layer stops on any disagreement. Slow, and correct. |
| Planner deadlocktwo machines want the same space | Work stops | Watchdog on task progress | Both stop, the supervisor re sequences. Stopping is always safe. |
| Link loss to Earthexpected daily | No effect | Not needed | The base was never waiting for Earth. Logs queue and forward. |
| Link loss to the basea machine goes out of range | Machine is alone | Heartbeat timeout, 5 s | Safe stop, then autonomous return along the recorded track. |
| Model driftconditions change | Degraded decisions | Earth review of the logs | Models are updated on a weekly cadence, never in real time. |
An autonomous system that changes its own behaviour between reviews is a system nobody can certify. Models are frozen for a week at a time, every decision is logged, and Earth reviews the logs before a new model is uplinked. It is slower than continuous learning and it is the only version of this that is defensible.
What is not yet known
The 94 percent unsupervised figure is a target with no flight precedent. The longest autonomous drives on another world are Perseverance's: 347.7 m in a single Martian day and 699.9 m without human review, on Mars, with a ground team planning each sol. NASA's ISRU Pilot Excavator is designed to dig and deliver 10 tonnes of regolith over 11 days with its own autonomous digging software, and it has not flown. Teleoperation studies show task performance falling sharply between half a second and three seconds of delay, which supports section 01, but nobody has yet run construction machinery on the Moon at a 2.6 second loop to measure how much a human in the cupola can safely take back. The 24 TOPS radiation tolerant accelerator, the lockstep safety controller and the 138 W total are allocations, not parts that have flown. The safety layer's stop authority has to be verified against every actuator on the site before the first autonomous task, and how that is done for a machine whose models change between weekly uploads has not been settled.
Increment plan
Increment 1, teleoperation with local safety
Everything is driven from the cupola console inside the horizon, with the safety layer already in place. No autonomy yet, but the architecture it will sit in is built first.
Increment 2, autonomous haulage
The easy case: known route, graded road, bounded speed. This is where the operational confidence comes from.
Increment 3, autonomous excavation and sintering
The two tasks that consume the most machine hours. Getting these unsupervised is what actually reduces crew EVA time.
Increment 4, multi machine coordination
Excavator, hauler and gantry working the same site simultaneously, sequenced by the base supervisor. This is the step that makes the construction rate anything other than linear.
Sources and further reading
Every figure in this document traces to one of these. Agency documents and peer reviewed work first, reporting only where it is the primary record.