The Autonomous Lunar Logistics Fleet

Abstract

The lunar institution will be built and maintained mostly while no crew is present. I therefore define a fleet of complementary machines rather than one universal rover: scouts map terrain and change, haulers move standardized cargo, excavators handle regolith, manipulators assemble utilities, inspectors create condition evidence, and crew rovers provide protected mobility and rescue. Shared navigation, charging, tools, grasp points, cargo records, geofences, and work authority allow independently built machines to cooperate. Autonomy is allocated by consequence. Routine traverse and handling can proceed locally, while irreversible actions require verified conditions and explicit authority. Every task is represented as a state machine with safe pause, reversal, or recovery. The fleet's productivity is measured at the completed service interface, not in kilometers driven or soil moved. A cargo delivery is complete only when its identity, condition, location, connections, and commissioning evidence are trustworthy.

Machines occupy the institution between crews

A crewed sortie lasts days or weeks. Surface assets must survive months or years. During that interval, dust settles, cables move thermally, batteries age, structures experience impacts, and new cargo arrives. If every inspection, connector, reset, and unloading operation waits for people, the institution remains mission-bound.

I divide robotic territory by function.

Fleet role	Typical work	Key design property
Scout	Mapping, route verification, hazard and change detection	Low mass, endurance, diverse sensing
Hauler	Cargo, regolith, waste, rescue tow	Standard payload restraint and reliable mobility
Excavator	Grading, trenching, berms, feedstock	Reaction management and wear tolerance
Manipulator	Assembly, connectors, tools, recovery	Force control and verified completion
Inspector	Imaging, metrology, thermal and electrical survey	Repeatable pose and traceable measurements
Crew rover	Pressurized mobility and refuge	Life support, redundancy, rescue and manual control

No vehicle needs every capability. Common physical and information interfaces let the fleet combine them. A hauler positions a module. A manipulator connects it. An inspector independently verifies the load path and utilities.

Standardize the work before the robot

Robots struggle when equipment is designed for human intuition. Small unlabeled fasteners, flexible cables, hidden latches, ambiguous connector states, uncontrolled loose items, and force-sensitive operations make autonomous work brittle.

I require external equipment to include machine-readable identity, fiducials, standardized grasp points, captive fasteners, alignment guides, defined tool reactions, guarded connectors, drain and dust behavior, positive mechanical state, and test points. The interface should advertise not just geometry but allowable force, contamination limit, electrical state, and recovery method.

Cargo pallets need the same discipline. Each carries mass, center of gravity, handling points, keep-out zones, thermal limits, hazards, destination, power state, required orientation, and commissioning plan. A vehicle should reject a lift if the observed article does not match the digital record.

Autonomy follows consequence

Communication delay to the Moon is short enough for supervision but not for every traction or manipulator control loop. Local systems must avoid hazards, regulate force, track energy, and stop safely. Earth operators can approve goals and interpret complex faults.

I use four authority bands:

• continuous local control for stability, traction, collision avoidance, and joint safety;
• autonomous execution for surveyed routes and reversible routine tasks;
• supervised autonomy for lifting, connection, excavation near assets, and configuration change;
• explicit human authorization for explosive devices, pressure-boundary changes, reactor controls, crew rescue commitment, and irreversible disposal.

The boundary can move only after evidence. Successful repetitions under varied conditions can expand autonomy. A novel or degraded state moves authority back toward deliberate review.

Every task has entry conditions, allowed transitions, completion evidence, timeout, safe pause, and recovery. A connector task is not complete because motor current peaked. It may require alignment image, insertion depth, latch indication, electrical isolation test, continuity, insulation, and communication handshake.

IdentifyMatch asset and work order PrepareControl energy and worksite ActExecute bounded motion VerifyMeasure physical result ReleaseUpdate authoritative state

Mobility is an energy and terrain service

Range depends on grade, soil, wheel slip, temperature, payload, speed, navigation detours, and reserve. I screen mission energy as

$$E_{mission}=\int\left(P_{drive}+P_{thermal}+P_{compute}+P_{payload}\right)dt.$$

The safe range is not the distance obtained by dividing nameplate battery energy by a flat-course test. The vehicle must preserve energy for an alternate route, communication outage, wheel degradation, cold survival, and recovery tow.

Charging points should publish connector, voltage, alignment, thermal, access, and reservation. Mobile batteries can rescue a stranded machine. A tow interface allows another vehicle to recover an immobilized unit without improvised rigging. Routes receive grades, obstacles, bearing, illumination, communication, traffic class, and current condition.

Dust changes mobility and maintenance. Wheels and tracks disturb it. Electrostatic charging and low gravity can keep particles mobile. Worksite plans separate clean interfaces from excavation traffic and require cleaning before docking or habitat approach.

Mixed fleets need traffic law

Geofences protect landing zones, reactors, science preserves, cables, unstable slopes, and crew areas. They must be versioned and distributed with integrity. A stale map can be worse than no map if a vehicle confidently enters a newly active worksite.

Right-of-way rules should be simple: crew rescue and hazard response first, crew vehicles next, vehicles carrying unstable or suspended loads next, ordinary cargo after that. Machines announce route intent, braking limits, localization quality, and degraded state. A local coordinator can schedule narrow corridors without becoming a single point that prevents emergency stop.

KnowShared maps and work orders

Give every machine the same terrain, asset, hazard, and configuration basis.

MoveRoutes, traffic, and charging

Coordinate mobility through energy-aware corridors and local services.

TouchTools and machine interfaces

Make force, alignment, latching, and recovery states observable.

TrustAuthority and evidence

Records who may act and what proves the physical result.

Productivity ends at commissioning

An excavator that moves tonnes but delivers inconsistent feedstock can starve a process plant. A hauler that reaches a destination but damages a hidden connector has not delivered useful cargo. I measure end-to-end services:

• certified regolith delivered to a process hopper;
• cable route prepared and inspected;
• cargo transferred, connected, tested, and registered;
• degraded unit isolated, exchanged, and returned for analysis;
• crew route surveyed, marked, and maintained;
• landing zone cleared and declared ready.

Fleet availability also depends on maintenance. External modules, wheels, batteries, cameras, joints, and tools should be exchangeable by other machines. A disabled robot should become repair inventory, not a permanent obstacle.

The first uncrewed campaign should deliberately fail vehicles and interrupt tasks. The important demonstration is not perfect autonomy. It is a fleet that notices incomplete work, preserves the site, reassigns resources, recovers hardware, and eventually closes the service without asking a future crew to clean up hidden uncertainty.