채굴 기술 및 장비

우주 채굴의 독특한 도전

5.1 The Environment as the Primary Design Driver

Terrestrial mining equipment relies on mass, gravity, air, and a nearby repair crew. Space mining has none of these. Every machine described in this chapter is shaped by a handful of environmental facts that hold across the Moon, near-Earth asteroids, and Mars.

• Low or negligible gravity. Excavation force on Earth comes largely from the machine's own weight pressing the tool into the ground. On the Moon, and even more on a small asteroid, a heavy digging reaction can lift the machine off the surface or spin it. Wheeled traction is poor, and on a small body an excavator may need anchoring or a design in which opposing forces cancel.
• Vacuum and thermal extremes. Heat leaves only by radiation and conduction. Lubricants evaporate, bare metal surfaces can cold-weld, and parts swing between sunlit and shadowed temperatures. Permanently shadowed polar regions, where volatile ices may persist, are among the coldest places in the solar system.
• Regolith. Lunar regolith is sharp-edged, abrasive, and electrostatically clinging. It wears seals, bearings, and optical surfaces, and it adheres to radiators and solar arrays. Asteroid surfaces may be loosely bound rubble or monolithic rock, and a surface cannot be assumed to behave like the site last visited.
• Distance and light-time. One-way signal delay to the Moon is on the order of a second, and to Mars it is measured in minutes. Joystick teleoperation is feasible at lunar distances only for slow, forgiving tasks, and it is impractical at Mars distances.
• No local repair infrastructure. A failed actuator is a mission-level event. Reliability and graceful degradation are as central as production rate.

These facts explain why the standard's interface layer is not concerned with a single machine. Its job is to let autonomous or semi-autonomous equipment from different vendors be commanded, observed, and audited across links that are slow, intermittent, and expensive.

5.2 Why the Interface Layer Assumes an Unreliable Link

Phase 2 of the standard defines the API layer on which equipment control is carried. Several of its normative rules read like generic web-service hygiene, but they matter more when the client is a ground operator working through a delayed relay.

• Malformed inputs MUST be rejected with a deterministic error code and MUST NOT be silently coerced. A mining command that a machine "corrects" into something plausible is more dangerous than one it refuses, because a corrected depth, rate, or target is a physical action that cannot be undone.
• Every state-changing operation MUST produce an audit record. Over a delayed link, the audit trail is how a ground team later reconstructs what a machine was actually told and when.
• Cancellation requests MUST be honoured within the timeout window declared for the operation class. An operator who sees a hazard must be able to stop a long task without waiting for it to finish.
• Implementations SHOULD degrade gracefully when an upstream dependency is unavailable, which is the normal condition when a relay satellite is out of line of sight.

The remaining sections in this chapter take each family of mining equipment in turn and show which of these interface behaviours it leans on most.

로봇 채굴 시스템

5.3 Anatomy of a Robotic Mining System

A robotic mining operation is a chain of cooperating machines rather than a single vehicle. A typical chain includes the following elements:

• Prospecting and survey units that locate and characterise a deposit.
• Excavators or drills that break and collect material.
• Haulers that carry material to a processing site.
• Processing plants that separate and refine the material (covered later in this chapter).
• Power sources, storage, and communication relays that keep the rest running.

The four roles defined in Phase 2 map naturally onto this chain.

The same physical machine can be a Producer of telemetry and a Consumer of tasks. The standard asks each side to validate what it receives. This matters in a chain where an excavator trusts a hauler's "ready" message, and a faulty or compromised unit would otherwise propagate a bad state down the line.

5.4 Addressing Machines and Issuing Commands

Phase 2 prescribes REST-style resource paths with snake_case segments and canonical UUID identifiers (the encoding comes from Phase 1). Four path shapes are defined:

/v1/{collection}                        # collection
/v1/{collection}/{id}                    # member
/v1/{collection}/{id}:{action}           # custom action (POST)
/v1/{collection}/{id}/{sub_collection}   # nested collection

The shape that matters most for equipment is the custom action, issued as a POST against a specific member. Starting a dig, pausing a drill, or returning a vehicle to base are actions on an identified machine rather than edits to a record. Which actions a deployment exposes is determined by its published interface description, which implementations place at /api/openapi.yaml, /api/protocol.proto, or /api/asyncapi.yaml depending on the style of interface. Any deviation from the canonical surface must be listed as a numbered exception in the conformance report.

Commands over a delayed link are routinely retried, because the operator does not know whether a missing acknowledgement means "never arrived" or "executed, reply lost." Phase 2 handles this with the Idempotency-Key header:

POST /v1/{collection}/{id}:{action}
Idempotency-Key: <client-generated unique value>

Servers MUST cache the response keyed by the pair (principal, key) for at least 24 hours and replay the same response on retry. For a physical machine, this is the difference between a resent "start excavation cycle" command being a harmless repeat and being a second, unintended cycle.

굴착 및 파쇄 기술

5.5 Excavation and Fragmentation Methods

Different targets call for different breaking and collecting methods. The main families follow, with the reason each is chosen.

• Scooping and drum excavation. Rotating bucket drums, and designs with counter-rotating drums whose reaction forces cancel, suit loose regolith in low gravity because they do not depend on vehicle weight for reaction force.
• Bucket-wheel and conveyor systems. These give continuous throughput on larger sites but are heavier and more complex, which makes them harder to launch and keep running.
• Rotary and percussive drilling. Used for coring, subsurface sampling, and reaching volatile-bearing layers. Cuttings removal is an issue in vacuum because no air carries them out, so augers or mechanical removal replace pneumatic methods.
• Thermal extraction. Heating regolith releases bound volatiles, such as water ice, as vapour, which is then captured by condensing it in a cold trap. This avoids moving large masses of material but demands substantial energy.
• Fragmentation of competent rock. Hard rock and metallic asteroid material resist digging. Crushing, grinding, and milling stages reduce particle size ahead of separation. Debris control matters, since in low gravity ejected fragments travel far.
• Anchoring and capture on small bodies. With almost no gravity, the machine must hold itself to the surface with anchors or harpoon-like devices, or the whole body is enclosed and worked on from outside.

Because regolith properties vary, a machine often has to adjust tool parameters from force and torque feedback rather than follow a fixed plan. That capability is the hinge between the equipment described here and the autonomy discussion later in this chapter.

5.6 Excavation as a Long-Running Task

An excavation cycle is neither an instant read nor a quick write. Phase 2 classifies operations and fixes timeouts per class; a deployment's task model should place excavation work into the appropriate one.

Operators MAY tighten these defaults but MUST NOT relax them past the maximums without an explicit waiver from the WIA Working Group. Starting a drill sequence fits the long-running class. Live vibration or torque monitoring during that sequence fits a streaming session. Uploading a day's accumulated logs after a communications gap fits a batch import.

State transitions of long-running tasks MUST be published as events to a durable channel so that downstream consumers can rebuild state. A ground system that was offline when a drill reached "stalled" can replay the event history on reconnect. Cancellation, as noted in 5.2, must be honoured inside the declared window. In practice, the cancel path is the one most worth rehearsing, since a machine stuck against bedrock should stop quickly and predictably.

정제 및 분리 공정

5.7 Beneficiation and Extraction Routes

Raw regolith or asteroid material is rarely the product. Processing separates a valuable fraction and then converts it into something usable, such as oxygen, water, metals, or propellant. Routes commonly discussed for off-world use include:

• Physical beneficiation. Sieving, magnetic separation for iron-bearing particles, and electrostatic separation exploit differences in size, magnetism, and charging behaviour. They need no consumable reagents, which is attractive far from resupply.
• Hydrogen reduction of ilmenite. Heating iron-titanium oxide in hydrogen yields water, which can then be electrolysed to oxygen.
• Carbothermal reduction. A carbon-bearing reductant strips oxygen from silicates at high temperature.
• Molten regolith electrolysis. Electrolysing molten regolith produces oxygen and leaves metal-rich residue. It reaches high temperatures and has hard materials-compatibility problems for the vessel and electrodes.
• Volatile capture and purification. Water released by thermal extraction must be condensed, filtered, and cleaned before use.
• Carbonyl-type processing for nickel-iron material. The Mond process, which forms volatile metal carbonyls and decomposes them to recover pure metal, has been proposed for metallic asteroid material, though it requires careful handling of toxic intermediates.

Each route has its own mass balance, energy appetite, and consumables. Hydrogen-based routes, for example, require that the reagent be recycled or resupplied. Plants therefore track not only throughput but also reagent inventory, thermal state, and product purity.

5.8 Keeping Process Data Trustworthy

Processing plants generate large volumes of measurements, and decisions about yield, quality, and ownership of product depend on them. Phase 2 contributes several mechanisms that fit this setting.

• Cursor-based pagination for list endpoints. The default page_size is 50 and the maximum is 500. Servers MUST return next_page_token when results are truncated and an empty string after the final page, so a ground analyst can walk a long record set without gaps or duplicates.
• Field masks (Google AIP-161 style) for partial updates. A mask is a dot-path into the canonical schema, with * wildcards. When an operator adjusts one process setpoint, the mask ensures other configuration fields are not overwritten by stale values from a client's older copy.
• The E_INTEGRITY failure mode. It signals that persisted state diverges from the expected hash. The required action is to quarantine and escalate to incident response. For a plant, a divergence between the ground mirror of a batch record and the onboard record is exactly the situation in which output should not be treated as accepted until reviewed.
• Audit logs that are append-only, signed in batches, and replicated to write-once storage within 60 seconds of generation. These support later reconciliation of how much product was made and under what conditions.

The measurement semantics of purity, yield, and composition belong to the Phase 1 data formats. The interface layer does not define them, but it ensures that whatever is recorded is delivered, versioned, and auditable.

무중력 제조 기술

5.9 Manufacturing Where Nothing Settles

In microgravity, buoyancy-driven convection disappears, liquids and gases do not separate by density, and molten material can be held without a container. This opens possibilities and creates difficulties.

• Additive manufacturing from local feedstock. Regolith can be sintered or melted layer by layer into bricks, pads, and structural parts, and metal powders or wire can be used where processing produces them. The aim is to build in place instead of launching finished parts.
• Containerless and diffusion-dominated processing. With no convection, solidification and mixing are governed by diffusion, which can yield different microstructures. Contact with crucible walls, a major source of contamination, can be avoided with levitation methods.
• Fluid and powder handling. Without gravity feed, powders do not flow into hoppers and liquids do not drain. Designs use rotation, mechanical feeders, or capillary and pressure-driven transfer. Gas-liquid separation in particular needs deliberate engineering.
• Thermal management. Waste heat can only be radiated away, so radiator area and view factor often limit how fast a fabrication or refining step can run.

From an interface perspective, manufacturing jobs are long and data-rich. A build may stream sensor data for its whole duration, which suits the streaming session class (default 30 minutes, maximum 8 hours). Resulting part records can be imported in bulk through the batch class. When a build step must be abandoned, the same cancellation guarantee as for excavation applies, and the event stream records at which step it stopped so a partial part can be flagged rather than accepted.

에너지 시스템

5.10 Power as the Scheduling Constraint

Energy often determines which operations can run at all. Options for off-world mining power include:

• Solar photovoltaics. Mature and light, but dependent on illumination. The lunar night lasts roughly two Earth weeks at most sites, so solar-only operation needs large storage or a pause in activity. Dust deposition on arrays reduces output over time. Some polar locations offer near-continuous sunlight on elevated terrain but adjoin shadowed craters where ice may lie.
• Nuclear fission surface power. Compact reactors have been studied as steady power sources independent of sunlight, at the price of shielding, thermal rejection, and regulatory complexity.
• Radioisotope sources. Reliable and long-lived, but low in power compared with what thermal extraction or smelting require.
• Storage. Batteries and regenerative fuel cells smooth supply and carry the plant through eclipse, with trade-offs in mass and efficiency.

Power shortfalls show up at the interface as saturation and dependency failures. Phase 2 reserves two codes that operators can bind to common runbooks:

A deployment may decide, for example, that a request for a power-hungry process step during a low-power period is answered with E_CAPACITY and a retry-after, rather than started and abandoned half-way. The standard does not prescribe that mapping. It guarantees that whatever mapping is chosen will use the shared codes, so tools written for one vendor's plant can interpret another's refusals.

로봇 자율성 레벨

5.11 Autonomy Tiers and the Authority to Act

The material for this standard does not define a numbered autonomy scale, so this section uses the common conceptual ladder from the robotics field rather than a normative one.

• Direct teleoperation. A human commands each motion and sees near-real-time feedback. This is limited by light-time and bandwidth.
• Supervised or shared control. The operator issues goals such as "excavate this area" and the machine handles motion planning and local obstacle avoidance. The operator can interrupt.
• Task-level autonomy. The machine executes sequences, such as dig-haul-dump cycles, and reports exceptions. Humans review outcomes.
• Goal-level autonomy. The machine decides what to do and in what order, within constraints, and may re-plan around faults. Human oversight shifts to policy and audit.

The higher the tier, the more the system depends on the standard's identity and audit provisions. A machine that decides for itself must still act only on authorised intent. Phase 2 therefore requires that inter-service traffic use mutual TLS with certificates rotated at most every 90 days. Identity-bearing tokens must be short-lived (15 minutes or less) and bound to the caller's network identity through a sender-constrained mechanism, either DPoP or mTLS-bound. Sensitive payload fields are encrypted at the application layer with per-tenant keys in an HSM. A stolen command token is a much more serious matter when it can drive a physical machine.

Higher autonomy also changes what operators want from the record. Because every state-changing operation is audited and long-running task transitions are published as events, a human can review not just what a machine did but the sequence of states it passed through, which is the practical basis for trusting a system that acts between contact windows.

장비 신뢰성 및 유지보수

5.12 Reliability, Maintenance, and the Road to the Next Chapter

Mining machines in space fail from abrasion, thermal cycling, dust intrusion, and fatigue, and no technician can walk out to fix them. Established practice includes redundancy for critical functions, modular line-replaceable units that a robot or visiting crew can swap, failure-mode analysis during design, condition monitoring to catch wear before breakdown, and spare-part strategies that weigh launch cost against downtime. Where possible, machines are designed to keep working at reduced capability, for instance by driving on fewer wheels or by running a plant at lower throughput.

The standard's non-functional targets belong to the service layer rather than to hardware, and they should not be confused with equipment reliability. They include availability of at least 99.9 % monthly, mean time to recovery of 15 minutes or less, and 100 % audit completeness for state-changing operations. Their relevance to maintenance is indirect but real: the monitoring plane that reports a failing bearing must itself be available, and its record of the maintenance action must be complete. Observability requirements support this, with Prometheus or OTLP metrics for each operation class, structured JSON logs with W3C Trace Context identifiers, traces tagged with the canonical resource identifier, and durable events for task state changes.

In summary, this chapter described the physical problem and showed how Phase 2 meets it: deterministic rejection of bad input, idempotent commands across lossy links, class-based timeouts with guaranteed cancellation, event-sourced task state, shared failure codes, and complete audit. The chapter also treated excavation, refining, microgravity fabrication, power, and autonomy as the equipment families that exercise these rules in different ways.

Machines that mine, refine, and build are only valuable if the material they produce can be accounted for. The next chapter moves from what the equipment does to what happens to its output, and from the interface that commands the machines to the records that describe the resources they recover.