The space work is one system, AVA (Advanced Virtual Astronomer): several mother models, plus the instruments, guards and tools around them.
Far from Earth a spacecraft cannot wait for the ground. It has to date what it sees, find its own position, refuse unsafe manoeuvres and catch the damage radiation does to its data and its own software.
Validated in simulation and against published and real reference data.
A supervisor decides which of them apply to the body in question, and a corruption detector screens their inputs first. Missing evidence returns an unmistakable “no information” marker, never a plausible-looking number.
Radiation Dose AgentReads the cosmic-ray and neutron dose a surface has collected, using permanent-shadow features as well.
Shadow Physics AgentWorks from the physics of permanently shadowed regions first, with machine learning only as a fallback.
Crater Chronology AgentInverts the Neukum production function, the standard crater-count-to-age law.
Environmental Correction AgentOutputs a correction factor, not an age, so it is kept out of the age vote.
Stellar Age AgentDates host stars from their rotation, isochrones and chromospheric activity (Barnes 2007; Mamajek & Hillenbrand 2008).
Small Body AgentDates asteroids and small bodies, with the crater production law scaled for distance from the Sun and a space-weathering cross-check.
Supervisor and body classifier. Agents that cannot apply to a body are not run at all, and each exclusion carries a physical reason, for example “craters obliterated by lava resurfacing”.
Training. All six agents are pre-trained on 283 records from 70 peer-reviewed papers (1970–2024). The training scores stored with the models are provenance, not accuracy measured in tests, and they are labelled that way.
Measured. Readiness battery: 10 of 12 gates passed and 1 was informational; malformed input containers are handled by the pipeline’s input guard. Agents excluded for a body were never run, and none ever carried confidence. One full prediction takes about 0.7 s on a desktop.
Takes any crater data: a single summary density, a full size-frequency survey, a raw crater list, binned counts, or crater blobs from imagery.
Rescales the Moon-calibrated law for the target’s gravity, impact speed, material, atmosphere and distance from the Sun, and propagates the uncertainty.
Diagnoses the effects that spoil crater ages: resurfacing, secondary craters and saturation.
Fuses several independent clocks, taking their correlations into account, so the same evidence is never counted twice.
3.24 %median error on 19 real Moon and Mars sites against published ages; 84.2 % within 30 %
0.96 %mean error on surfaces at least 3 billion years old, against radiometric ground truth
0.4900Mars scaling, against Ivanov 2001’s published 0.4926
bit-identicalchronology coefficients against an independent, field-standard package
When agents disagree by more than 2σ, each presents its physics case. No winner takes all, ages outside physical range are refused, and no-information agents are excluded, not averaged in. Disagreement detection: 98.5–100 %, with a 5.5 % false-alarm rate.
A weighted mean can only down-weight an outlier, never reject it. So PhysicsIVW was built: it keeps the physics gates, uses plain inverse-variance weighting, and switches to a robust median-anchored estimate when the agents disagree. With one confidently wrong agent it scored 162 against 1,289, 8× better.
Nova lets a spacecraft find its own position, plan and fly a multi-leg mission, and refuse unsafe manoeuvres without waiting for Earth.
The 4D map. A space-time grid of the universe in which a body sits at the resolution its measurement deserves.
Four navigation agents. Resource (Δv, power, thermal, communications, damage); Obstacle (hazards on the planned path); Goal (the mission’s true goal, with an audit for drift); Position (X-ray pulsar navigation, Sun ranging and star fields).
EDAC-H. Screens uplinked commands for human error: unit, frame or epoch confusion, causality violations, transposed digits, duplicate commands and bad checksums.
Mission sequencer. A mission is a chain of legs, with propellant, time, ageing and position carried from one leg to the next. It halts at the first unsafe leg.
Supporting models. A Lambert orbit solver, real ephemerides (JPL DE440), a catalogue of about 16,000 bodies, a universe store built from Gaia, debris and orbit-insertion models, and a damage forecaster.
11 of 11software gates passed in the revision-6 battery
13 of 13EDAC-H signatures fire, with 0 false positives in 200 clean commands
20,000tracked objects screened linearly in 5.2 s; a decision takes about 11 ms
10–50debris objects: detours planned and re-checked; beyond that it asks for a replan
Real DE440 runs with one 950 kg test spacecraft. Mars, Saturn and Neptune completed. Jupiter was refused, because capture needs more Δv than the spacecraft carries. Uranus was refused, because the simple straight-line demo trajectory’s detour would cost 7.8× the Δv budget, a limit of the demo trajectory, not of the planner.
Radiation flips bits in data and in the software itself. Cally screens both, and keeps a fingerprint of its own code so it can tell whether the thing doing the screening is itself intact.
EDAC-15 and CRC sealingPhysics-plausibility screening of radiation and science values, beside byte-level integrity checks.
DataTreeA verified-clean last-known-good store for slowly changing state. It never substitutes an old value for a live sensor reading.
DataWebThe “sleeping recovery web”: each body’s data is a node, linked by physical consistency relations and anchored to real measurements such as the MSL dose at Gale crater.
Memory scrubberRe-checks the constants that decide things. One bit flip moves the astronomical-unit constant by 0.72 % while the file on disk stays intact; only a memory check sees it.
Integrity baselineA golden fingerprint of the system’s own code and data.
Input guardsMalformed inputs degrade honestly instead of crashing, and leave well-formed results bit-identical.
0bad values admitted by DataTree in 31,985 attack trials
2,000recovery cycles: 100 % exact, no corrupt value served
13 gatespassed in the full-pipeline readiness run, 1 informational, over 51,511 data points
What is ours. Physics-aware screening of science values, paired with CRC integrity checks, and the rule that missing evidence is reported, never filled in.
Admission gateAn agent must vary more than its own noise floor to be admitted. This keeps a near-constant agent from dominating the weight on young terrain.
Geological-unit countingCounts craters inside mapped units (USGS Unified Geologic Map of the Moon) instead of circles.
Host-crater ruleA crater is never counted on its own floor. Of four affected sites, three improved and none got worse.
Spatial randomness testDetects secondaries or older underlying terrain in a count (Michael et al. 2012). Untestable bins are reported, not hidden.
Rock clock and Diviner readerDates young lunar craters from boulder abundance in LRO Diviner data (Ghent et al. 2014; Mazrouei et al. 2019), where crater counting fails.
Requirements trace55 numbered requirements traced in both directions to the tests that ran, as a self-assessment against NASA’s NPR 7150.2D.
A seventh specialist for worlds where crater counting is physically invalid: resurfacing icy moons, gas giants and thick atmospheres. Four clocks: argon-40 outgassing, D/H fractionation by escape, radiolytic colour maturation and a methane photolysis bound. Before any of them run, an anchor-free bracket of hard physical limits is computed, so a wrong calibration cannot push the answer outside what is physically possible.
NavWeb, a navigation graph over real Gaia DR3 stars, where each route carries a clearance and a radiation-dose estimate.
Builds Nova’s universe store from real public catalogues. It is built to stream all 1.81 billion Gaia DR3 sources without storing them raw, checking each file against ESA’s published checksums; bounded runs so far have built stores of 272,471 and 210,354 stars. No star is given a distance its data cannot support. It also places 1.55 million small bodies from the JPL Small-Body Database.
The flight-software-style wrapper that runs everything together. The models load read-only and each is fingerprinted. The mission controller runs boot, register, fly, survey, downlink; if the flight segment aborts, the survey does not run, so an aborted mission cannot produce science that looks real.
Data and science creditedUSGS Astrogeology (Robbins crater databases; Unified Geologic Map of the Moon); NASA Planetary Data System (MSL RAD, LRO Diviner, Dawn, Galileo, Cassini, New Horizons); JPL DE440 ephemerides and the Small-Body Database; ESA Gaia DR3; NASA Exoplanet Archive; NASA DONKI space weather. Neukum, Ivanov & Hartmann 2001; Hartmann 2005; Michael 2013; Holsapple & Housen 2007; Le Feuvre & Wieczorek 2011; Schwadron et al. 2012; Barnes 2007; Mamajek & Hillenbrand 2008; Ghent et al. 2014; Mazrouei et al. 2019.