report

Reliability and Redundancy Policy

Standards basis

Subsystem redundancy and safe state

Subsystem Failure tolerance Redundancy approach Safe state Accepted SPF IDs
optics 0 The primary and secondary mirrors are single-string precision elements; support interfaces are multiply constrained and inspected, but mirror replacement is unavailable on orbit. Preserve thermal control and pointing while suspending science after detected optical-path damage. REL-OPT-001
detector 0 The 2x2 detector mosaic and dual heaters tolerate limited tile or heater loss, while the common focal-plane support and cold interface remain single-string. Isolate detector bias, hold the survival set point, and retain command telemetry. REL-DET-001
structures_and_mechanisms 0 Repeated supports, dual radiator releases, synchronized springs, and retained captures limit local failures; the common metering and bus load path is not on-orbit replaceable. Inhibit further mechanism motion and enter thermally safe coarse-sun hold after a failed release or structural anomaly. REL-MEC-001
thermal_control 0 Redundant detector heaters and sensors provide local fault tolerance, but the shared deployed radiator rejection area and heat-transport path remain common resources. Shed detector and science loads, command survival heaters, and hold the protective pointing envelope. REL-THM-001
power 0 Two battery modules, twenty solar strings, four MPPT channels, and protected load-shed branches tolerate local faults; the regulated distribution enclosure and output bus remain a common function. Shed non-survival loads and maintain one battery, one charge path, S-band commandability, and survival thermal control. REL-PWR-001
propulsion 0 Four thrusters and six latch valves provide branch isolation, while the single diaphragm tank and common pressurant/feed path remain accepted concept-stage critical items. Close all latch valves, inhibit burns, unload momentum magnetically, and retain command telemetry. REL-PRO-001
adcs 1 Paired fine sensors, eight coarse Sun sensors, a four-wheel tetrahedron, and a three-axis magnetorquer set retain safe attitude control after one declared unit loss. Disable reaction wheels when necessary and use coarse Sun sensors, magnetometers, and magnetorquers for detumble and coarse-sun acquisition. none
cdh 1 Cold-redundant flight computers, recorders, and cross-strapped SpaceWire routers preserve command and stored-data functions after one lane loss. Isolate the failed lane, boot the cold spare, protect recorder contents, and enter safe mode pending ground authorization. none
communications 1 Cross-strapped X-band, S-band, and RF distribution pairs plus body-face antenna diversity preserve a command/telemetry path after one declared unit loss. Isolate the failed RF lane and maintain low-rate S-band command and telemetry through the surviving distribution and antenna path. none
flight_software 0 Watchdogs, cold-lane restart, safe-mode transitions, and ground-authorized recovery mitigate hardware-lane faults; a common requirements or flight-image defect can affect both lanes. Enter the minimal safe configuration, reject autonomous safe-mode exit, and await a validated ground recovery image or command sequence. REL-FSW-001

FMEA/FMECA register

Severity is ranked from minor 1 to catastrophic 4; occurrence and detection are ranked from 1 (best) to 5 (worst). RPN is their product.

ID Subsystem Item / failure mode Severity Initial RPN Residual RPN SPF Disposition
REL-OPT-001 optics primary mirror: Fracture or permanent figure loss. critical 12 6 yes accepted_single_point_failure
REL-OPT-002 optics secondary support member: One support or joint loses stiffness. marginal 12 4 no mitigated
REL-DET-001 detector common focal-plane cold interface: Common cold finger, focal support, or shared detector interface loses thermal or structural continuity. critical 12 6 yes accepted_single_point_failure
REL-DET-002 detector detector survival heater: One heater circuit fails open. marginal 12 2 no mitigated
REL-MEC-001 structures_and_mechanisms common metering and bus load path: Common metering structure or spacecraft attachment suffers global fracture or instability. catastrophic 16 8 yes accepted_single_point_failure
REL-MEC-002 structures_and_mechanisms radiator stow release chain: One release puller or latch shoe does not clear. critical 18 3 no mitigated
REL-THM-001 thermal_control common radiator rejection path: Shared radiator area or common heat-transport path becomes unavailable. critical 12 3 yes accepted_single_point_failure
REL-THM-002 thermal_control detector temperature sensor: One sensor drifts or fails out of range. marginal 12 2 no mitigated
REL-PWR-001 power common regulated distribution bus: PCDU output bus or common enclosure suffers a non-isolatable failure. catastrophic 16 8 yes accepted_single_point_failure
REL-PWR-002 power battery module: One battery module loses capacity or is isolated. critical 18 3 no mitigated
REL-PRO-001 propulsion diaphragm propellant tank and common pressurant path: Tank or common pressurant path leaks, ruptures, or cannot supply the manifold. catastrophic 16 8 yes accepted_single_point_failure
REL-PRO-002 propulsion one aft thruster branch: One thruster or branch valve fails closed or is isolated. marginal 12 2 no mitigated
REL-ADCS-001 adcs one reaction wheel: Wheel seizes, loses torque, or produces excessive disturbance. critical 18 3 no mitigated
REL-ADCS-002 adcs one star tracker: Tracker blinds, resets, or produces invalid solutions. marginal 12 2 no mitigated
REL-CDH-001 cdh active flight-computer lane: Processor, memory, or local power lane fails. critical 9 3 no mitigated
REL-CDH-002 cdh active solid-state recorder: Recorder becomes unwritable or corrupts stored data. marginal 12 2 no mitigated
REL-COM-001 communications active S-band transceiver path: Transceiver or RF distribution lane loses command and telemetry transfer. catastrophic 24 4 no mitigated
REL-COM-002 communications active X-band science chain: Transponder or phased-array lane loses science downlink capability. critical 18 3 no mitigated
REL-FSW-001 flight_software common flight-software requirements and image: Common requirements, logic, or uploaded-image defect drives both computer lanes into the same unsafe behavior. catastrophic 36 12 yes accepted_single_point_failure
REL-FSW-002 flight_software one active computer execution lane: Watchdog timeout or local execution corruption. critical 12 3 no mitigated

Accepted concept-stage single-point failures

These are not described as eliminated. Each remains in the critical-item register until later design or qualification evidence removes or accepts it at program level.

ID End effect Mitigations Verification Owner and residual rationale
REL-OPT-001 Primary science mission lost. Proof-load and inspection control of the mirror and cell; positive launch-restraint margins and controlled thermal gradients primary-mirror-mount, launch-loads, thermal-gradients, manufacturing-inspection payload chief engineer: A second one-metre primary is outside the concept mass and packaging allocation; acceptance requires later fracture-control and qualification evidence.
REL-DET-001 Primary science mission lost while bus commandability remains. Explicit cold-finger clamps and routed thermal straps; detector temperature and focal-plane interface monitoring detector-subsystem, focal-plane-layout, internal-interface-completeness detector lead: The concept has a single focal station; later design must qualify the common cold interface and determine whether tile-level electrical isolation is sufficient.
REL-MEC-001 Spacecraft or primary mission lost. Positive screened load and modal margins across repeated members; controlled material and joint inspection before launch structural-model, integrated-modal, joint-sizing, manufacturing-inspection mechanical chief engineer: The released concept has no duplicate observatory-scale metering structure; later FEM, proof, vibration, and fracture-control evidence is required.
REL-THM-001 Science mission is suspended and detector survival can be threatened. Temperature guard sensors and autonomous load shedding; deployment capture checks and mission-life thermal robustness margins thermal-sanity, thermal-control, thermal-robustness, deployment-timeline thermal lead: A second independent full-capacity rejection system is not allocated; the concept accepts science loss while preserving a monitored survival response.
REL-PWR-001 Spacecraft commandability and survival functions are lost. Internally dual-fault-tolerant regulation with branch protection and load shedding; independent battery contactors and four isolated MPPT inputs power-policy, fdir-policy, radiation-analysis EPS lead: The current geometry declares one PCDU enclosure and common regulated bus; a later design must allocate physically separated essential-bus feeds to remove this critical item.
REL-PRO-001 Orbit maintenance and planned disposal capability are lost; rupture could threaten the spacecraft. Qualified diaphragm tank and regulated-pressure margin; isolation valves with pressure trending and burn inhibits propulsion-policy, manufacturing-inspection, radiation-analysis propulsion lead: Tank duplication is not carried in the current mass allocation; pressure-vessel qualification and MMOD assessment remain required before flight release.
REL-FSW-001 Spacecraft or mission capability can be lost despite lane switching. Independent software verification with hardware-in-the-loop fault injection; protected recovery image and ground-authorized safe-mode exit fdir-policy, test-plan-policy flight software lead: The repository defines behavior and automated checks but does not yet contain independent flight-software verification or hardware-in-the-loop campaign evidence.

EEE parts assurance and derating

EEE category Stress parameters Maximum stress ratio Minimum temperature margin
microcircuits supply voltage, output current, and junction temperature 0.80 20.0 C
discrete_semiconductors voltage, current, power dissipation, and junction temperature 0.70 25.0 C
capacitors applied voltage, ripple current, and hot-spot temperature 0.50 20.0 C
resistors applied voltage, power dissipation, and hot-spot temperature 0.50 20.0 C
magnetics voltage, current, flux density, and winding temperature 0.70 20.0 C
relays_switches contact current, switched voltage, coil voltage, and temperature 0.50 20.0 C
connectors_wiring contact or conductor current and insulation temperature 0.50 20.0 C
optoelectronics drive current, reverse voltage, optical power, and junction temperature 0.70 25.0 C

Checks

Check Result
reliability_policy_schema_supported PASS
reliability_standards_and_scope_complete PASS
released_subsystem_redundancy_strategies_complete PASS
subsystem_fmeca_complete_and_residual_risk_bounded PASS
single_point_failures_declared_and_mitigated PASS
eee_parts_assurance_and_derating_policy_complete PASS