Mru Aerospace

We're building Mru: A Fault-Tolerant Operating System for Thousand-Year Autonomous Operation

A sensor on the seafloor and a probe past Pluto have the same problem. When something breaks, they're on their own. So Mru Field and Mru Flight share one core: the same decision code, on Earth and in orbit.

Many automatic weather stations in Antarctica get one service visit a year, in the summer. For the other eleven months, whatever they report is what scientists and forecasters get. A station like that needs to know when its own numbers have gone wrong.

In October, ESA's OPS-SAT Space Lab let us run our software on a satellite in orbit, three times. We wrote down every step, from registration to reading the results, and published it as a free, open template for the next team. It's our own guide, not an official ESA one. github.com/mruspace/opssat-p…

For a machine nobody can fix, working doesn't mean perfect. It means correct for as long as possible, and honest the moment it can't be sure.

We ran 10,000 missions in our simulator, each up to 1,000 years long, on hardware that only wears out and never gets repaired. The standard setup stops once it can no longer outvote a fault. Ours keeps working on what's left. On average, the standard setup delivered 99 years of useful work. Ours delivered 133, on the same hardware.

Somewhere past the edge of the solar system, a machine will lose a part on a day nobody is watching. No alarm will reach anyone in time. It will check itself, set the broken part aside, and keep sending home what it finds.

Most remote equipment on Earth has one answer to trouble: a watchdog timer that restarts it. A restart fixes a crash. It does nothing for a machine that keeps running and quietly gets its numbers wrong. Mru Field is built for that second kind of failure.

Bitcoin works because no node takes another node's word for anything. Each one checks. We put the same habit inside a single machine: the work runs as copies, and a result gets out only after it has been checked. It's how a machine stays honest with nobody watching.

In our third run in orbit, two of the failures were real, not simulated. We ended one copy's process outright, and it kept going on what was left. Then we killed the part that manages the copies, without warning. It came back, remembered which copy it had already retired, and carried on with 0 wrong results.

Every spacecraft has a plan for when something goes wrong. Most of those plans end the same way: shut down to the basics and wait for Earth. The farther out a machine goes, the longer that wait gets. Past a point, it has to be the one that decides.

On October 28, Mru Flight ran in orbit for the third time, on @esa's OPS-SAT satellite. This time it ran inside NASA JPL's F´, the open-source flight software that flew the Ingenuity helicopter on Mars, in the form a real mission would use it. We failed its copies one by one, on purpose. It kept going down to the last one: 342 correct results, 0 wrong. The standard setup, on the same faults, stopped at 239. It went exactly to plan, on the satellite and on its twin on the ground.

Everything Mru's planned kernel does must work for a thousand years. So it does almost nothing.

The bottom layer of Mru is planned to be tiny: a few hundred instructions, small enough to prove correct. Its only job is to keep the machine alive. Everything clever runs above it.

The oldest distributed system on Earth is life. No maintainer, no patches, no downtime, for 3.5 billion years. Nobody has launched anything like it. Yet.

A sensor 1,700 m under the Atlantic gets one visit a year, when a ship can reach it. If a fault starts to corrupt its results in month two, the bad data can run for ten months before anyone looks. We recently released Mru Field 0.1.0 for equipment like this. It runs the task as three copies, lets out only results it has checked, and keeps going as copies fail. It's the same decision code that ran on ESA's OPS-SAT satellite.

Kill one copy and the others keep running. We showed that part in orbit on October 18. Corrupt the stored instructions and the copies restore them. That part is still the design. A living cell does both.

Everything we build is open source. The code that ran in orbit, the simulator, the paper. If software is going to outlive the people who wrote it, anyone should be able to read it.