Mars is the first off-world destination where a permanent human presence is discussed as a resource problem rather than a delivery problem. Three of its features matter for extraction. The atmosphere is overwhelmingly carbon dioxide, although its pressure is well under one percent of Earth's. Water is present as polar ice, as ice buried at mid-latitudes, and as water bound in minerals. The surface is covered by loose, finely divided regolith. Sunlight is weaker than at Earth but still usable for power. Everything a settlement cannot make locally, such as propellant, breathing oxygen, water, and construction material, has to be launched from Earth through a deep gravity well.
The second constraint is distance. A radio signal needs minutes to cross the Earth–Mars gap, and the delay changes as the planets move. The link can also be interrupted for extended periods when the Sun lies between the two planets. A plant on Mars therefore cannot be run like a data-centre service with an operator waiting on every call. It must act on its own and report what it did. This chapter reads the WIA-SPACE-008 Phase 1 data-format layer with that fact in mind. The layer fixes how quantities, times, identities, and failures are written down so that records produced on Mars remain unambiguous when they are read on Earth, in orbit, or at another site.
Four resource families recur in the sections below:
In-situ resource utilization means making consumables from local material instead of carrying them. In practice it is a chain: prospect, extract, purify, convert, store, and deliver to a user. Each link produces measurements, and each hand-off needs a record that another party can trust. Phase 1 names four roles, and they map onto the chain directly:
| Role | Definition in the standard | Typical Mars-side example |
|---|---|---|
| Producer | Entity that emits payloads or operations | An excavator, an electrolysis unit, or a methane-liquefaction plant reporting output |
| Consumer | Entity that receives or persists payloads | A habitat life-support system, a propellant depot, or an Earth-side planning centre |
| Authority | Entity that issues credentials or attestations | The body that vouches for a plant's identity and revokes it when compromised |
| Operator | Entity that runs the deployment | The crew or remote team responsible for capacity, health, and compliance |
The standard's rule for Producers is to emit only well-formed, signed, and authorised messages. The rule for Consumers is to validate, authorise, and audit every received item. Both matter for resource accounting. A propellant depot that accepts a "tank filled" message without checking its origin could launch a vehicle on a false premise.
Ownership and jurisdiction also shape the data. The 1967 Outer Space Treaty bars national appropriation of celestial bodies, while national laws and the 2020 Artemis Accords take the position that extracting resources does not in itself amount to appropriation. Operators therefore have to document who extracted what, where, and under which authorisation. The standard's glossary defines a sovereignty boundary as the legal or regulatory perimeter beyond which data export is restricted. Extraction records, site coordinates, and survey results can be commercially or legally sensitive, so a multi-party Mars operation should decide in advance which records may cross such a boundary.
Water is the keystone resource because it yields drinking water, oxygen, and hydrogen, and it is a reagent in the chemistry of the next section. Mars holds water in several forms that differ greatly in how hard they are to extract:
| Reservoir | Basis of knowledge | Extraction concern |
|---|---|---|
| Polar ice deposits | Orbital observations of the polar caps | Extreme cold, seasonal carbon dioxide frost, and operations at high latitude |
| Buried mid-latitude ice | Orbital radar sounding, plus ice exposed by the Phoenix lander's digging | Overburden removal, depth uncertainty, and variable ice content |
| Hydrated minerals | Orbital spectroscopy of clays and sulfates | High energy to drive water out of the crystal structure |
| Brines and trace vapour | Lander chemistry and atmospheric measurements | Dissolved salts, low yield, and contamination |
Prospecting is the data-intensive step. A deposit is described by estimates with uncertainty and by the date and instrument of each measurement. Phase 1 supplies the primitives for this. Numeric values default to IEEE 754 binary64 unless a field is explicitly marked fixed-point. Timestamps use RFC 3339 with a timezone offset, so a survey made years ago is not confused with a recent one. Text uses UTF-8. The Phase 1 text does not define a Mars-specific water-grade vocabulary. It supplies the canonical encodings, and a deployment applies them to its own resource descriptions.
Water quality is a safety matter as well as an accounting matter. Meltwater from regolith-hosted ice can carry dissolved salts, including perchlorates that were detected at the Phoenix landing site. Product water must be treated before human use, so a record of where water came from is useful downstream. When a Producer reports water as delivered, a Consumer should be able to see the processing it went through.
The Sabatier reaction combines carbon dioxide with hydrogen over a catalyst to produce methane and water. It is exothermic and is normally run in a heated reactor with a nickel-type catalyst. Combined with water electrolysis, it gives a closed route to a methane–oxygen propellant pair, which is why it is central to Mars propellant planning. The water produced is split again, and the recovered hydrogen is fed back into the reactor.
Sabatier: CO2 + 4 H2 -> CH4 + 2 H2O
Electrolysis: 2 H2O -> 2 H2 + O2
Net, with water recycled and fresh water supplied:
CO2 + 2 H2O -> CH4 + 2 O2The net line shows that the route still consumes water. The recycle loop returns only part of the hydrogen the reactor needs, so a hydrogen or water source remains a requirement. That is why the previous section's water inventory matters here. Atmospheric carbon dioxide is plentiful, and hydrogen is the limiting input.
A separate approach produces oxygen directly from the atmosphere by electrolysing carbon dioxide in a solid-oxide cell. NASA's MOXIE experiment on the Perseverance rover demonstrated this on the Martian surface. Its significance for standards work is the kind of data it produces: runs with logged operating conditions, oxygen output, and purity checks. This is exactly the telemetry a Producer must report in a form that other parties can compare.
The Phase 1 encoding rules apply directly to process-plant telemetry. Five rules matter most:
The timestamp rule has a practical consequence on Mars. Local time there is counted in sols, but the standard requires an offset-bearing timestamp, so plants record absolute time and leave sol-based scheduling to the presentation layer. Reactor run-times and catalyst-bed ageing belong in ISO 8601 durations, not free text. Round-tripping is mandatory: a value serialised on Mars and parsed on Earth must come back without loss of precision or meaning.
Validators apply checks in a fixed order and stop at the first failure, reporting the rule's ID. This lets a receiving system tell a corrupt message from a policy refusal:
1. syntactic well-formedness (does the message parse?)
2. schema conformance (are types and ranges valid?)
3. cross-field invariants (do related values agree?)
4. external referential integrity (do referenced items exist?)
5. policy / authorization (is the sender allowed?)A reactor report whose declared output exceeds what its own input flows allow would pass the first two steps and fail at step 3. A delivery message that names an unknown tank would fail at step 4.
Regolith is the most abundant Martian resource and the least processed. Its uses fall into three groups. It can be moved and piled, for example over a habitat as radiation and thermal shielding. It can be sintered or bound into bricks, pavers, and landing-pad surfaces. And it can be processed chemically for oxygen, metals, or water. Each of these needs different data, ranging from simple volumes moved to the heat treatment applied and the performance of the resulting product.
The hazard to record is chemical. Phoenix found perchlorate salts in Martian soil. They are toxic to humans, they interfere with thyroid function, and their dust is fine enough to be inhaled or carried into airlocks. Perchlorates also bring benefits, since they lower the freezing point of brines and can be a source of oxygen. A regolith handling record should therefore capture the washing, heating, or other treatment a batch has undergone, so that a Consumer can tell raw material from material cleared for contact with people or plants. Under Phase 1 an implementation that receives an incomplete treatment record must reject it with a deterministic error code. It must not coerce the record into an accepted form, which would hide the problem.
Regolith work also stresses equipment. Fine, abrasive dust wears seals, bearings, and sensors. A fixed audit trail of every state-changing operation helps trace degradation back to specific work cycles, which supports maintenance planning.
Agriculture links regolith, water, and atmosphere into one system. Raw Martian soil is not a ready growing medium. It lacks organic matter, it holds perchlorates, and only a small fraction of the atmosphere is nitrogen. Light is lower than at Earth, outdoor conditions are too cold and too low in pressure, and radiation reaches the surface with little shielding. Mars agriculture is therefore pressurised, lit, and largely hydroponic, with regolith treated or used as one input among several. Earlier experiments with Mars regolith simulants on Earth and crop growth on the International Space Station show that the biology is workable but demanding. The ISS Veggie unit, for example, has grown lettuce.
A greenhouse produces records that mix biological and engineering data: water use, nutrient dosing, lighting schedules, yields, and contamination checks. The standard's failure classes suit this closed-loop setting because they tell an operator what to do next, wherever the plant is:
| Code | Symptom | Required action | Greenhouse reading |
|---|---|---|---|
| E_INPUT_MALFORMED | Input does not parse against the canonical schema | Reject, do not retry | A garbled sensor message from a nutrient dosing unit |
| E_AUTH_DENIED | Caller lacks authorisation | Reject, log security event | An unknown device tries to change lighting set-points |
| E_DEPENDENCY_DOWN | Upstream resource unavailable | Retry with back-off, surface degraded mode | Water supply interrupted, so the greenhouse switches to stored reserves |
| E_CAPACITY | Resource is saturated | Reject with retry-after; page on-call if persistent | Processing queue full during a harvest |
| E_INTEGRITY | Persisted state diverges from expected hash | Quarantine, escalate to incident response | Stored crop or batch records fail their hash check |
The last row deserves attention. Electronics in space are exposed to radiation, which can corrupt stored data. A hash mismatch should be treated as a reason to quarantine the affected records, not to patch them silently, because food-safety traceability depends on the records being trustworthy.
Beyond the asteroid belt, the resource picture changes. Water ice is not a special find but the main material of many moons. Europa is believed to hold a subsurface ocean beneath its ice shell. Enceladus sends water-rich plumes into space. Titan, a moon of Saturn, has a dense nitrogen atmosphere and lakes of liquid methane and ethane, as shown by the Cassini orbiter and the Huygens probe. These bodies are of interest both as sources of water and hydrocarbons and as potential habitats for life. The latter brings planetary protection obligations that restrict how they can be explored and exploited. Any extraction there would be shaped by those restrictions.
The operating problem is time. One-way signal delay to Jupiter is tens of minutes, and farther out it grows to over an hour. Real-time control is impossible, and even an exchange of one command and one acknowledgement can outlast Phase 1's default timeouts:
| Operation class | Default timeout | Maximum timeout |
|---|---|---|
| Synchronous read | 5 s | 30 s |
| Synchronous write | 10 s | 60 s |
| Long-running task | 5 min | 30 min |
| Streaming session | 30 min | 8 h |
| Batch import | 60 min | 24 h |
Operators may tighten these values but must not relax them beyond the maximums without an explicit waiver from the WIA Working Group. A sensible reading follows. Synchronous calls stay within a local site. Commands to a distant site are issued as long-running tasks or batches, and results come back as batch imports. Tasks also publish events on state changes to a durable channel, so a downstream consumer can rebuild the task's history after a link outage. That is exactly what store-and-forward operation needs.
Ganymede, the largest moon in the Solar System, is a leading target. It has an intrinsic magnetic field, which is unusual for a moon, and evidence from the Galileo spacecraft and from auroral observations indicates a subsurface ocean. Its surface is a mixture of old, dark terrain and younger, grooved terrain, with abundant water ice. ESA's JUICE mission, launched in 2023, is intended to study Ganymede in detail. Callisto is heavily cratered and old, and it may also contain a subsurface ocean. It orbits farther from Jupiter than Ganymede and so receives less of the planet's intense radiation, which is the main reason it is often proposed for a surface outpost.
The contrast shapes any extraction concept:
Because uncertainty is large, records from these moons should always carry the origin of each estimate. The standard's rule that a Consumer must validate every received item, together with its ordered validation sequence, helps ensure that data from a distant platform is checked on arrival, whatever its source.
A plausible sequence runs from small demonstrations to routine production. First come instruments and technology demonstrations such as MOXIE. Next come pilot plants at a single site, then production sufficient for propellant and life-support consumables, and finally sustained settlement-scale supply. Outer-moon activity would follow the same pattern, beginning with orbiters and landers that characterise the resource before any extraction is attempted. At each stage the data changes. New resource classes are found, estimates are revised, and measurement methods improve.
Phase 1's compatibility classes are designed for this kind of growth:
| Class | Allowed changes | Wire compatibility |
|---|---|---|
| Patch | Documentation fixes, examples, validator tightening within the existing range | Forward and backward |
| Minor | New optional fields, new enum values with default fallback | Forward |
| Major | Field rename, type change, removal, change of meaning | None |
Suppose a new category of deposit is identified. Adding it as a new enumerated value with a default fallback is a minor change, so older Consumers on distant platforms keep working and treat the unknown value as the default. Redefining what an existing quantity means is a major change, and it breaks compatibility with every platform not yet updated. Software on a spacecraft may take years to be updated, if it can be updated at all. Roadmap planners should therefore prefer additive minor changes and treat any major change as a coordinated, long-lead event.
Several of Phase 1's general targets collide with deep-space reality and need careful reading. The availability target of at least 99.9 percent per month, the mean time to recovery of no more than 15 minutes, and the 100 percent audit completeness for state-changing operations were written with ordinary service operations in mind. A fifteen-minute recovery cannot be met by a remote team when the signal delay itself approaches that. A distant deployment must therefore carry local autonomy, such as automatic fail-over and a fall-back to degraded mode, which the standard recommends when an upstream dependency fails, so that recovery does not wait on Earth. Audit completeness can still be met locally by writing the log at the site and replicating it when the link allows.
The telemetry rules help here. Metrics, structured JSON logs with W3C Trace Context correlation identifiers, traces tagged with the resource identifier, and durable events together give a remote operator enough evidence to reconstruct what a plant did while it was out of contact. The security posture matters too, since a compromised plant controller could misreport inventories or damage equipment. Inter-service traffic uses mutual TLS with certificates rotated at most every 90 days, and tokens are short-lived. Sensitive payload fields are encrypted with per-tenant keys held in a hardware security module. A long link delay is awkward for short-lived tokens and frequent certificate rotation, so credentials must be issued, and revocation lists propagated, with the delay budget in mind.
The generic machinery of the standard is applied to this domain without change. The canonical surface is published as an OpenAPI, Protocol Buffers, or AsyncAPI description. Any deviation from it is declared as a numbered exception, and every claim states its conformance level and the version of the standard it was made against. A Mars operator uses these as they are. The domain-specific work lies in the choices described above.
Mars and the outer moons offer water, carbon dioxide, regolith, and energy in very different combinations. On Mars the chain runs from ice and atmosphere through Sabatier chemistry and electrolysis to methane and oxygen, with regolith and greenhouses completing the loop. At Ganymede and Callisto the same logic applies to abundant ice under harsher radiation and longer delay. Across all of these, the Phase 1 data format supplies the shared record: UTF-8 text, binary64 numbers, RFC 3339 timestamps and ISO 8601 durations, UUID identifiers, an ordered validation sequence, reserved failure codes, bounded timeouts, and compatibility classes for evolving knowledge. The chapter's main practical findings are that timeouts must be mapped to light-time, that processing steps must be recorded alongside quantities, and that recovery must be designed around autonomy at the site.
What this chapter has not addressed is how these records are exchanged between systems. Phase 1 fixes the shape of the data only. The next chapter moves from the places where resources are found to the interfaces and exchange mechanisms through which Producers, Consumers, Authorities, and Operators actually put these records to work.