A 1000-year uncrewed lunar preservation facility cannot depend on a single “intelligent” computer. It requires a layered autonomous architecture in which deterministic safety controls remain authoritative, AI handles diagnosis and optimization, and every major action is constrained by immutable rules, redundancy, cryptographic authentication, and conservative energy policies.
Mission design basis
The facility should be designed for:
- 1,000 years of operation without continuous human supervision
- Communication outages lasting decades or longer
- Radiation-induced faults, memory corruption, processor degradation, and single-event upsets
- Progressive loss of power-generation and thermal-control capacity
- Hardware obsolescence and component aging
- Unknown future operating conditions
- Eventual human reactivation, potentially by a technologically different civilisation
The key engineering principle is separation of authority:
1. Hard real-time safety layer: deterministic logic; no machine-learning dependence.
2. Supervisory autonomy layer: model-based diagnosis, planning, scheduling, and resource allocation.
3. Advisory AI layer: anomaly detection, predictive maintenance, scientific interpretation, and proposed—not automatically authorized—configuration changes.
4. Human-restoration interface: authenticated command protocols, documentation, simulators, and physical-readable archives.
AI should never have unrestricted authority over life-critical, archive-critical, or irreversible functions.
1. Fault-tolerant computing
### Redundancy architecture
A preservation facility should use at least three computational lanes for critical control:
- Lane A: primary processor and software image
- Lane B: independently powered redundant processor
- Lane C: cold or warm spare activated after disagreement or failure
For critical decisions, use 2-out-of-3 voting. A single corrupted processor cannot command an irreversible action. If all three disagree, the system must enter a predefined safe state rather than select the majority result automatically.
Independence matters more than component count. Redundant processors should differ in:
- Processor implementation
- Memory banks
- Power converters
- Clock sources
- Software builds
- Physical routing
- Radiation exposure where practical
Identical redundant systems can fail identically because of the same software defect, radiation event, or design error.
### Error detection and correction
Memory should use multiple layers:
- ECC RAM correcting single-bit errors and detecting multi-bit errors
- Chipkill-style protection for failures affecting an entire memory device
- Periodic scrubbing that reads, corrects, and rewrites memory
- Cryptographic hashes for every archive block
- Merkle-tree or similar hierarchical integrity structures for rapid verification
- Multiple geographically separated copies within the facility or across lunar sites
A practical archive target is at least 6 independent copies of irreplaceable data, with routine comparison and repair. For a 1-petabyte logical archive, six copies require at least 6 petabytes before additional parity and metadata.
Data should be stored with forward-error correction and erasure coding. A design target of 20–30% parity overhead is reasonable for archival media, with more redundancy for irreplaceable boot software and engineering records.
### Byzantine fault tolerance
Ordinary crash tolerance is insufficient. A processor can remain powered while producing corrupted or malicious-looking outputs. Critical controllers should therefore use:
- Signed state reports
- Monotonic counters
- Independent sensor confirmation
- Time-bounded command validity
- Quorum authorization
- State-machine replication
- Automatic rollback to the last verified configuration
The system must distinguish three conditions:
- Crash fault: no output
- Omission fault: incomplete or delayed output
- Byzantine fault: plausible but incorrect output
A Byzantine processor must be electrically and logically isolated before it can influence the control quorum.
### Checkpointing and rollback
Every autonomous software update, learned model, calibration change, and control-policy modification should create:
- A signed checkpoint
- A complete dependency manifest
- A known-good rollback image
- A test result from a simulated environment
- A recovery deadline
- A record of which subsystems may be affected
No update should be allowed to erase the last three known-good versions. A failed update should automatically revert without requiring Earth intervention.
2. Radiation-hardened processors and electronics
The lunar surface receives a harsh radiation environment because the Moon lacks a substantial atmosphere and global magnetic field. Electronics face:
- Single-event upsets in memory and logic
- Single-event transients
- Single-event latch-up
- Total ionizing dose
- Displacement damage
- Solar-particle events
- Galactic cosmic rays
Radiation tolerance must be treated as a system property, not merely a processor specification.
### Processor strategy
The facility should combine:
- Radiation-hardened processors for safety control
- Radiation-tolerant commercial processors in shielded enclosures for high-performance analytics
- FPGA-based backup controllers
- Simple discrete hardware interlocks
- Nonvolatile boot logic with multiple verified images
NASA’s High-Performance Spaceflight Computing program has targeted much greater performance per watt than legacy radiation-hardened CPUs; NASA material describes HPSC as offering approximately 100 times the performance per watt of older space processors, enabling onboard AI and edge computing for lunar missions.[3] Microchip describes its RH PIC64-HPSC as intended for autonomous lunar tasks such as rover hazard avoidance and long-duration deep-space missions.[5]
That performance is useful for local planning, but it should not eliminate simpler backup controllers. A high-performance processor can fail in complex ways; a low-performance controller can still close a valve, isolate a battery, or shut down a damaged power bus.
### Shielding
Shielding should be layered:
- Lunar regolith overburden for the main facility
- Localized tungsten or tantalum shielding around processors and memory
- Hydrogen-rich materials around sensitive electronics where compatible
- Physical separation between redundant computing lanes
- Radiation monitors at multiple depths
A buried facility should not rely on one nominal depth. It should include at least two independently shielded control vaults, with separate power and data paths. The secondary vault should remain powered at low duty cycle and periodically execute self-tests.
### Fault response to radiation
Radiation monitors should trigger graded responses:
1. Normal mode: full sensing and computation
2. Elevated radiation mode: reduce nonessential processing and increase memory scrubbing