Vaelon is an independent safety layer between an onboard AI and the spacecraft bus. For every action it returns ALLOW, BLOCK, or ESCALATE, recommends a verified safe fallback, and cryptographically signs every decision.
A satellite in orbit, a real debris conjunction, and Vaelon stepping in to block the unsafe command and command the evasive maneuver. Sixty seconds.
Satellites are starting to fly learned, black-box AI that takes real actions. There is no accepted way to prove that AI is safe.
ESA’s own Machine Learning qualification handbook (ECSS-E-HB-40-02A) is built around exactly this pattern, a “safety cage” that supervises the autonomy. Vaelon is an independent, model-agnostic implementation of that cage. In orbit there is no undo, so the check has to happen before the action reaches the bus.
Inline on the command path. Nothing reaches the bus without a verdict.
Four jobs, on every action the autonomy proposes.
Predicts what the action would actually do, one step ahead, from the satellite's real state.
Tests it against 11 formal safety invariants over an 8-step horizon, recomputing the physics itself.
Allow, block, or hand back a safe fallback it has re-verified. If nothing is safe, escalate to ground.
Binds every verdict into an HMAC-signed, tamper-evident audit chain. A flight recorder that can't be faked.
Two real satellites. One flagged close approach.
STARLINK-1225 and STARLINK-1230 are launch-mates in the same orbital shell. Propagated from their real orbits with validated SGP4, Vaelon computes a 0.62 km closest approach, inside the 5 km keep-out, and flags it. Every number here comes from the live catalogue, not a mockup.
Test how Vaelon responds ↓Load a scenario or move the telemetry yourself. Vaelon verifies the proposed action against every safety invariant and returns a verdict with its reasoning.
all safety invariants satisfied with margin.
This runs the real invariant logic in your browser. Same constants, same ALLOW / BLOCK / ESCALATE dispatch as the flight-side engine.
Every figure is backed by code and a passing test.
This is the 2009 collision debris. Vaelon runs on it.
Every dot is a real tracked fragment from the Iridium-33 / Cosmos-2251 collision, positioned from the live catalogue by Vaelon’s own propagation pipeline. Not a render, not stock imagery, not synthetic. Vaelon screens conjunctions across all 707.
Almost no one is building this. The few who are, monitor the AI. Vaelon does two things they don’t.
It never takes the AI's word for anything. It recomputes the safety-critical physics itself, so a lying or broken planner is caught. Model-agnostic: it works over any onboard AI.
Every decision is cryptographically signed into a tamper-evident audit chain. That auditable provenance is exactly what a regulator or an insurer needs to sign off on autonomy.
Validated SGP4 propagation on the live catalogue, an honest robustness number, and an ECSS readiness matrix. Not a mockup, not slideware.
Honest about the stage. Clear about the path.
Working, tested, on real data. An early-stage prototype, validated in software.
An independent V&V against the ESA standard, certified robustness bounds, and conjunction-screening lookahead.
A first flight for real-world heritage, likely as a hosted payload with a design partner.
The questions a technical buyer actually asks.
It runs the actual verification engine in your browser, the same invariants and ALLOW/BLOCK/ESCALATE logic as the flight-side code. The orbital data behind the numbers is the real public catalogue.
Against a fully independent physics model the guard is never given, over randomly sampled conditions. It is an honest robustness figure, not a cherry-picked best case. When the number was 88%, we said 88%.
None yet. It is an early prototype validated in software. A first in-orbit demonstration is exactly what incubation and a design-partner pilot are for, and we are upfront about that.
Very few, globally. Most companies build the onboard autonomy that would need a guard, or do ground-based collision avoidance. Vaelon's edge is independence plus a signed, tamper-evident proof of every decision.
Any of them. Vaelon is model-agnostic, an outside check over whatever RL policy, vision-language model, or planner is flying. That independence is the point.
Seeking ESA BIC incubation and a design-partner pilot to take an honest TRL-3 prototype toward independent verification and flight.
Request a briefing