The Barycenter runtime.
A mission autonomy runtime that composes specialized autonomy components while preserving five properties across all of them: authority, uncertainty handling, resource feasibility, safety, and evidence.
The runtime is not a planner, not a fault-management system, and not a perception stack. It is the layer that sits above all of them and decides, mission by mission, moment by moment, what is allowed to execute. It compiles authorized intent into formal goals and prohibitions, maintains a mission belief state, reasons jointly over the physical constraints of the vehicle, and issues an execution permit for every action taken. If a permit cannot be issued, nothing runs.
The runtime does not replace the software your mission already depends on. It provides common semantics and control contracts across those components. Flight and mission teams keep the tools they trust.
- Flight controllers and attitude control systems.
- AutoNav, Terrain-Relative Navigation, and other domain-specific autonomy.
- Instrument-side algorithms, including learned perception models.
- Existing mission planning and command sequencing tools.
- Ground software, deep-space link scheduling, and operations tooling.
Each mechanism is small enough to explain in a paragraph.
Intent compiler
Authorized operator intent, expressed as mission objectives, priorities, and prohibitions, is compiled into a formal representation the runtime can reason over. Intent is a first-class artifact with a signature, a version, and a retraction path. It is never an English string parsed at runtime.
Mission belief state
A probabilistic representation of what the vehicle believes about itself and its environment. Every belief carries provenance: which instrument or algorithm produced it, when, and with what estimated error. Provenance is a safety property, not a debugging aid.
Joint reasoner
Plans are constructed against science value, safety envelopes, power and thermal budgets, communication windows, and time, as one problem rather than a cascade of independent optimizers. Coupling makes some things harder and other things possible.
Plan repair
When the world diverges from the plan, the runtime does not restart planning from scratch. It locates the minimum modification that restores feasibility given the current belief state and current intent. Repair beats replan on a radiation-hardened processor.
Coordination
When more than one vehicle is present, a rover with an aerial scout, a constellation of satellites, the runtime carries the coordination as contracts, not as a single planner running centrally. Contracts survive intermittent communications; centralized planners do not.
Operating-domain contracts
Learned components are wrapped in explicit contracts: the input domain they are qualified for, the output range they may produce, and the runtime monitors that detect drift outside those bounds. A learned classifier that leaves its qualified domain loses trust automatically.
Assurance kernel
An independent mechanism, deliberately small and separately verified, that issues execution permits. A permit is granted when goals, constraints, and safety envelopes are simultaneously satisfied. When they are not, nothing runs, and the reason is recorded. The kernel does not plan; it does not interpret. It grants or refuses.
Evidence & replay
Every decision, every input, and every state transition is recorded such that an accident board can replay the sequence exactly. Assurance is a property of the record, not a promise made in a datasheet.
Learned components are bounded services, never the trust boundary.
Machine learning has a role in flight software: perception, anomaly detection, model-based prediction, adaptation. It does not have a role in deciding what may execute. The mechanism that grants a permit is separate from the mechanism that proposes an action, and it is small enough to verify.
The runtime is in research and design. A reference implementation is in progress against a long-duration planetary surface campaign as the driving mission. We are working with a small number of design partners to shape the runtime against real requirements before general availability.