42 ns decision time
A deterministic Rust core, benchmarked with zero heap allocation on the decision path.
Runtime assurance for autonomous satellite AI
Prove the AI on your satellite is safe, before it acts.
Vaelon Guard is an independent safety layer between an onboard AI and the spacecraft bus. For every proposed action it returns ALLOW, BLOCK, or ESCALATE, recommends a verified safe fallback, and cryptographically signs every decision into a tamper-evident chain.
Decision time42 ns
Core size5.6 KB
Audit chainSigned
Vaelon · Live
monitoring
Battery71%
ModeManeuver
Δv budget13.0 m/s
Keep-out5.0 km
SIGNEDtamper-evident chain updated
Mercury · surface imaging reference
Neptune · deep-space telemetry reference
SEC 01 / A real conjunction
Two real satellites. One flagged close approach.
STARLINK-1225 and STARLINK-1230 are launch-mates in the same orbital shell. Screened with a validated SGP4 propagator against a published set of their elements, Vaelon's engine finds a 0.62 km closest approach — inside the 5 km keep-out — and flags it.
Because orbits evolve, the live separation on any given day varies — these two are typically hundreds of kilometres apart. What matters is that the same engine that screens this case study is the one gating every action in the demo below: it recomputes the physics itself rather than trusting a report.
Closest approach0.62 km
Keep-out radius5.0 km
PropagatorSGP4
StatusFLAGGED
0.62 km approach
SEC 02 / See it decide, live
Load a scenario or move the telemetry yourself.
Vaelon verifies the proposed action against every safety invariant and returns a verdict with its reasoning, computed live in your browser.
Battery72%
Temperature18°C
Separation to object50 km
Delta-v budget15 m/s
Eclipse
Fault
Contact
Vaelon verdict
rule engine · js
ALLOW
all safety invariants satisfied with margin.
This engine recomputes every invariant from the telemetry you set — it does not trust a claimed mode or status flag. Adjust any control above and the verdict re-evaluates instantly.
SEC 03 / Screen a whole catalogue
An evasive maneuver has to clear all of them.
Real missions track many objects. Vaelon screens a proposed action against every tracked object at once, blocks on the closest closing threat, and only allows a maneuver that resolves the entire catalogue.
Add objects, drag one inside the 5 km keep-out, mark it closing, and the verdict below re-screens live against the whole set — not just the object in front.
Conjunction catalogue
js · live
Screening 3 objects · closest 4.0 km
threat: object 2
Autonomy idlesBLOCK
Evasive maneuverALLOW
SEC 04 / The same trained AI
With and without Vaelon.
A policy optimised for data, with no explicit safety term, flies one simulated 90-minute orbit through an eclipse and a close approach. The curves below are computed live from that simulation, not pre-rendered.
with Vaelon
without Vaelon
SEC 05 / Proof
Verified, not asserted.
Every number below is checked against the flight-suitable core, not a marketing round-up.
7 / 7
formal safety theorems proven over the entire input domain.
100%
flight core is verdict-identical to the reference engine across 20,000 scenarios.
1 metre
SGP4 implementation matches the reference propagator at max, 1,156 samples.
5.6 KB
base flight gate, zero heap, zero .data/.bss, targets Cortex-M and RISC-V.
42 ns
p99 per-decision time, bounded, no allocation on the decision path.
Signed
every decision folded into a tamper-evident HMAC-SHA256 audit chain.
SEC 06 / Under the hood
Built to link into real flight software.
A deterministic core, callable from the C that runs on real spacecraft, that signs every decision onboard.
C ABI
Compiles to a no_std static library that a flight app or component links directly.
Signed onboard
Every verdict is folded into an HMAC-SHA256 chain, checked against known-answer vectors.
Fail-closed
Non-finite telemetry (NaN / inf) is refused with a BLOCK verdict and left unsigned.
Zero deps
The core pulls in no external crates — nothing in the trust path comes from an uninspectable supply chain.
77 tests
Core and pipeline tests including known-answer, differential, property-fuzz, and staleness suites.
SEC 07 / Why Vaelon
Independent, provable, on real physics.
Almost no one is building this. The few who are, monitor the AI. Vaelon does two things they don't.
Independent
It never takes the AI's word for anything. It recomputes the safety-critical physics itself, so a lying or broken planner is caught. Model-agnostic: it works over any onboard AI.
Provable
Every decision is cryptographically signed into a tamper-evident audit chain — the auditable provenance a regulator or an insurer needs to sign off on autonomy.
On real physics
Validated SGP4 propagation on the live catalogue, an honest robustness number, and an ECSS-readiness matrix. Not a mockup, not slideware.
SEC 08 / Where this goes
Honest about the stage. Clear about the path.
Today · TRL 3-4
Flight-suitable core
A deterministic Rust core that decides in tens of nanoseconds, links into C flight software, and signs every decision, validated in software on real data.
Next · funded
Certify & harden
An independent V&V against the ESA standard, certified robustness bounds, and conjunction-screening lookahead.
Then · flight
In-orbit demonstration
A first flight for real-world heritage, likely as a hosted payload with a design partner.
SEC 09 / Who is building Vaelon
Where three fields rarely meet.
Runtime assurance for satellite AI sits where machine learning, formal verification, and low-level flight software rarely meet. Vaelon is built by someone who works across all three — the same team behind Vaelon Space's propulsion work.
COMMS / Contact
Talk to us about Vaelon Guard.
Engineering inquiries, certification partners, design-partner conversations for the in-orbit demonstration.