We're building Mru: A Fault-Tolerant Operating System for Thousand-Year Autonomous Operation

Our software successfully ran on an ESA satellite for the second time on October 22. Its three copies failed one by one as planned. When the last one went bad, it stopped rather than give a wrong answer. Then we shut the program off without warning. It restarted where it left off, with 0 wrong results.

The Long Now Foundation (@longnow) is building a clock inside a mountain in Texas, meant to tick for 10,000 years. An essay about Mru will be in their Book of Time, out next spring. We write software for machines that must keep working when nobody can reach them, at sea and in orbit.

The first machine to reach another star will arrive alone. Any question it sends home will take more than eight years to answer. So the biggest call of the mission, what to look at first, it will make by itself. We're building software that can make calls like that.

Most of us are taught to keep a reserve. Save some for later. On a machine nobody can ever reach, there is no later. Power still in the battery when it dies bought nothing. So the design spends hard early, while every instrument still works.

For nearly fifty years, a team at NASA has been switching off Voyager's instruments one at a time. Not because they failed. Because there was not enough power to run them all, and somebody had to choose the order. That choosing has been done by people, in meetings, with decades of experience behind it. We are trying to write down how they think, so a craft that has nobody can do it alone.

Anything that runs down without resupply has the same problem. A fuel tank, a stockpile, a satellite with a finite amount of thruster fuel. Spend it now or save it for later. Usually somebody revisits that call as things change. Prices move, plans shift, a person reconsiders. On a machine nobody can reach, the call gets made once and then runs with nobody able to revisit it.

On a machine nobody can reach, power is not something you monitor. It is something you have to spend on purpose. So we built a gate. Every part of the system asks before it does anything, and the answer can be no. Your laptop knows its battery percentage. It does not refuse to run something because of it. That gap is harmless here and fatal further out.

We write software for machines nobody can reach. The clearest case is a craft sent to another star, but it is not the only one. There will be more of them. Sensors under ice sheets. Monitors inside places we sealed on purpose. Equipment on the seabed that was never meant to come back up. We are going to put a lot of machines where people cannot follow, and almost nothing has been written for that.

Nobody designs for forgetting. We design storage, backups, redundancy, all of it aimed at keeping things. A machine nobody can repair has to do the opposite. Its memory corrupts faster than it can be fixed, it will lose something either way. The only question is what. We are building the part that decides.

We build software for a machine that gets sent far away and can never be repaired. Somewhere in it is a single number: how much of its own future it is willing to give up for work done today. Set it too high and it burns out early. Too low and it dies with everything it saved still unused.

The strangest part of this work is how much of it is deciding things on behalf of people who are not born yet. What counts as interesting. What is worth the power to send home. What gets switched off first when there is not enough. None of those are software problems. They are judgment, written down, by people who will not be there to explain themselves.

Everything we are doing is public. The paper, the code, the simulation models, all of it. Not because open source is a strategy. Because nobody has solved this and we are not going to be the ones who do it alone. If somebody reads the paper and tells us the radiation model is wrong, that is worth more to us than keeping it closed. There is no competitive advantage in being the only ones who get this wrong.

Near the end of a four hundred year journey, a craft runs out of power for almost everything. No instruments. Nothing left to look at anything with. What it can still do is send a heartbeat and a position. I am still here. That phase gets designed too. The last thing it does should still be worth doing.

We are building software for a machine that gets sent to another star. It is out there for four hundred years and nobody can ever reach it. Radiation and heat and time will take it apart. Slowly, piece by piece. Nothing stops that. So we are not trying to build something that holds out. We are building something that spends what it has well, the whole way down.

A craft between stars has to know how damaged it is. Not roughly. Precisely. How much of the chip is still alive. How badly each bank of memory is corrupting. How well the panels are still shedding heat. How many joules are left. All of it measured continuously, by the craft, about itself. Because a machine that cannot see its own decline has no way to plan around it.

Biologists have a definition of robustness that is not what most people assume. It is not that nothing fails. It is that the thing keeps working while parts of it fail constantly. That is happening in you right now. Cells dying, being replaced, no interruption. We are building the version of that for a chip that radiation is slowly killing, with nobody able to replace anything.

There is one question we ask about everything that might go on a craft sent to another star. Does it still do something useful when half the machine is gone? How well it works on launch day tells you nothing. Everything works on launch day. The useful question is what it does in year four hundred, with most of itself missing.

A craft sent to another star finds its way by matching the sky against a map it carries. The map is made before launch and can never be updated. Over centuries the nearer stars actually move. The sky slowly stops matching the map. So we give it more than a snapshot. We write down how fast each star is drifting, and the craft runs that forward to work out where everything should be by now. Everything else on board wears out. This is the one thing that goes out of date, and we build it to correct for its own age.

If you know a thing will decline, you can decide how. That turns out to be an enormous amount of control. What gets spent early. What gets given up next. What the last of the power is used for. Pretend it will not decline and you get none of those choices. You get a machine that works until it does not.

We build software for a machine sent to another star. Nothing can be repaired, so it has to work while it falls apart. That sounds exotic. It is not. Plenty of things on Earth are already in that position, not because they are far away, but because the money to fix them will never arrive. An ageing power grid. A bus fleet that will not all be replaced. A hospital with a repair list that only grows. Those systems are running down too, and nobody designs for it. They find out instead. What we are learning out there is what they need.