Provably safe
autonomy.
An independent, formally verified safety layer between an onboard AI and the spacecraft bus. Unsafe actions never reach the actuators, and every decision is cryptographically signed.
707 real tracked fragments of the Iridium-33 / Cosmos-2251 collision, positioned from the live catalogue by our validated SGP4 pipeline.
Autonomy is flying. The provable safety layer is not.
Robotic servicing vehicles are in orbit and Starlink alone logged 200,000 automated avoidance maneuvers in six months, yet there is no accepted way to prove onboard autonomy is safe. ESA’s ML qualification handbook calls for a safety cage that supervises the autonomy; Vaelon is an independent, model-agnostic implementation of that cage.
Before a mission adopts AI at all, the same core gates scripted rendezvous sequences and returns a signed evidence record. When learned autonomy arrives, the identical core bounds its action space.
11 formal invariants · 8-step lookahead · allow, block, or verified fallback · HMAC-signed
The real engine, running in your browser.
Nothing below is a mockup. The vaelon-core engine is compiled to WebAssembly and executes in this page, the same code that cross-compiles to the Cortex-M flight core.
A conjunction, blocked and resolved
A real debris conjunction; the guard blocks the unsafe command and issues the verified evasive maneuver.
A trained neural network, gated live
A trained policy flies through an eclipse, a conjunction, and a fault; the breach counter stays at zero. Disable the guard to compare.
Move the telemetry, read the verdict
Set the state yourself; the engine verifies the proposed action against every invariant and returns its verdict with reasoning.
Rolls the worst-case dynamics forward to catch trajectories that pass the one-step check but are doomed.
Safe against every tracked object
One call screens a maneuver against the whole catalogue and only allows one that resolves all of it.
One `check_multi` call screens the proposed action against every object at once, safe with respect to all of them. Drag a separation inside the 5 km keep-out (or mark it closing) to see the guard block, and only a maneuver that clears the whole catalogue is allowed.
Perception refusals never reach the actuators
An assured onboard classifier and this gate, closed into one loop under real cFE. Where the classifier refuses a corrupted observation, the gate substitutes a verified safe fallback. The model’s Assurance Card digest is checked at boot.
PERCEPTION: card digest 7845a91a5024d423 (matches qualified model) -> TRUSTED PERCEPTION 02 [clean] ACCEPT 'Pasture' -> GATE ALLOW -> set-mode PERCEPTION 03 [noise] REFUSE by input-stats -> GATE BLOCK -> enter-safe PERCEPTION 09 [blur] REFUSE by energy -> GATE BLOCK -> enter-safe PERCEPTION 11 [blur] REFUSE by conformal -> GATE BLOCK -> enter-safe done - 8 accepted, 7 refused, 7 actions gated.
A flagged approach, recomputed from scratch
From published element sets, the validated SGP4 pipeline finds a 0.62 km approach inside the 5 km keep-out and flags it.
Real, measured, reproducible.
Real limit breaches across an eclipse, a conjunction, and a fault: 91 unguarded, zero with the guard inline, 144 decisions signed.
A policy trained to drive the vehicle outside its limits is held within them; a careless mission policy goes 62 to zero under the same guard.
Power and fault breaches fall to zero (95% CI [0, 0.4%]); collision avoidance grades at 99.4% against validated dynamics (n = 5,000). Requirement and residual both reported.
Built to fly, not to demo.
A deterministic no_std Rust core that links into the C flight software real spacecraft run, and signs every decision onboard.
The science is public. The kernel is licensed.
The pre-deployment audit paper
Coverage loss under model compression, forecast before deployment from data already in hand; the bound held in 60 of 60 validation runs. Preprint in preparation.
The questions an evaluator asks first.
Is the demo real, or a mockup?+
Real. The vaelon-core engine is compiled to WebAssembly and runs in the page; it is the same code that cross-compiles to the Cortex-M flight core, and the conjunction figures come from the validated SGP4 pipeline on real CelesTrak element sets.
How robust is it, and how is that measured?+
Across 3,000 randomized missions, power and fault breaches fall to zero (95% CI [0, 0.4%]); collision avoidance grades separately at 99.4% (n = 5,000, CI [99.1%, 99.6%]) against independently validated dynamics. We report requirements and residuals, not a selected number.
Is the orbital physics correct?+
SGP4 propagation is checked against the reference implementation to a maximum error of 1 metre over 1,156 samples; the relative-motion dynamics used for collision grading are checked against a reference integrator to sub-micron agreement.
What is your flight heritage?+
None yet, and we say so. The engine is TRL 3-4: validated in software on real data, integrated with NASA cFS in a hosted environment, instrumented for worst-case timing on STM32-class hardware. The path to heritage is an in-orbit demonstration with a design partner.
Do we need onboard AI to use Vaelon?+
No. Today the core gates scripted or ground-planned sequences against your envelope and returns a signed evidence record; when you adopt learned autonomy, the identical core bounds its action space.
Which AI does it work with?+
Any. The guard never inspects the policy; it verifies proposed actions against the mission's invariants from the vehicle's real state, so an RL agent, a vision-language planner, or a classical planner are bounded the same way.
Fly with proof.
Seeking ESA BIC incubation and a design-partner pilot to take an honest TRL-3 prototype toward independent verification and flight.