The Box Was Qualified Against a Spacecraft That Never Flew

Open any ICD on your program and count the obligations. Nearly all of them run one direction: the component shall output this, shall not draw more than that, shall respond inside so many milliseconds. What the spacecraft owes the component is a short table of environmental numbers copied out of a generic standard, and everything past that table is an assumption sitting in a vendor engineer's analysis file.

A component builder delivers a unit with a qualification report, and the report is honest. The unit ran for hundreds of hours. It survived a vibration profile, held accuracy across a thermal cycle, passed conducted emissions. Every one of those tests ran against a stand-in for the spacecraft: a laboratory supply, a shaker playing an envelope, a chamber holding a plate at a setpoint. The stand-in is not the spacecraft. It is a model of the spacecraft, assembled from numbers written before the spacecraft existed, and no one goes back to check the model.

We have watched this from both sides of the seam. The integrator believes the box was tested. The vendor believes the platform will deliver what the spec promised. Both are correct about their own half. The half between them belongs to nobody.

Qualification tests the box against a fiction

Take the power interface, the one every unit on the vehicle shares. A typical unregulated primary bus specification allows 22 to 29 volts, 1.5 volts of ripple on top of that, and a transient peaking near 50 volts. Those are the numbers the vendor designs to. The bench supply the unit is qualified on does none of it. It holds 28 volts flat, with clean regulation, at a source impedance far below anything a real harness and a real power distribution unit will present.

The same substitution happens on every axis. Vibration qualification plays a notched envelope, not the coupled response of this spacecraft with this fuel load. Thermal cycling holds a mount plate at a commanded temperature, not the temperature a radiator reaches when the neighbouring instrument is running its duty cycle. Electromagnetic compatibility gets tested one box at a time in a chamber, then the vehicle is assembled with fourteen of those boxes and a reaction wheel on the same ground plane.

None of this is negligence. It's the only test that can be run at the time it has to be run. The problem is that the industry then treats the result as though the platform side had been verified, when what was verified is the component's behaviour against an idealized host.

The assumptions are real engineering, and they are deleted at delivery

Behind every one of those numbers is a decision somebody made carefully. The vendor sized the input filter against an assumed source impedance. They picked a watchdog timeout against an assumed command cadence. They derated the parts against an assumed total dose for an assumed orbit and mission length. They sized the survival heater against an assumed radiator sink temperature. They set the receive buffer depth against an assumed worst-case burst from the bus controller.

That is a list of requirements on the spacecraft. It exists. It's written down in the vendor's analysis, often in the same document that justifies the design to their own review board. Almost none of it survives into the ICD, because the ICD template has one column and that column is for the component. What ships is the box and a description of what the box does.

The component is qualified against an idealized spacecraft. The spacecraft is qualified against nothing.

The thermal bridge nobody drew

On 22 August 2014 a Soyuz ST-B put the first two Galileo Full Operational Capability satellites, Doresa and Milena, into an orbit of roughly 13,700 by 25,900 kilometres at 49.7 degrees. They were meant to be circular at 55 degrees.

The Fregat upper stage's hydrazine feed line and a cold helium pressurization line had been clamped to the same support structure. That structure carried heat between them. The hydrazine froze, the attitude control system lost the ability to point the stage during the burn, and the satellites were released in the wrong place. The joint inquiry board found the same routing on roughly one in four Fregat stages sitting at the manufacturer, and the design documentation permitted it. Part of the fix was clamps made of a less conductive material. Europe spent the following year burning propellant to reshape two orbits, and both satellites were eventually declared usable.

There is no ICD between a fuel line and a helium line. They do not exchange anything. They were neighbours, and the obligation each owed the other, that neither be a heat path into the other, was not in anyone's requirement set, because requirement sets are written between things that talk. The environment a component operates in is produced by the other components around it, and a document structured as a list of bilateral agreements cannot express that.

Automotive ships the assumptions with the part

A chip vendor building a part without knowing which vehicle it lands in develops it as a Safety Element out of Context. The obligation that comes with that is specific: publish the Assumptions of Use. The integrity level the part assumed. The timing constraints it expects. The diagnostic coverage it is counting on somewhere else in the system. The external safety mechanisms, clock monitors and voltage monitors among them, that the integrator has to supply because the part does not contain them.

At integration the carmaker has to demonstrate that their vehicle actually meets those assumptions. The obligation runs both ways and both ways are auditable. Space buys components out of context on nearly every program, and asks the vendor for a data sheet.

The platform side cannot be tested in hardware

We think the asymmetry survives for a boring reason. At the moment a component is qualified, the spacecraft is a set of drawings and a mass budget. There is nothing to test against. The first hardware verification of the platform's obligations happens at integration, which is the phase everybody was trying to de-risk.

Simulation is the only place the platform side can be exercised before then, and it can only be exercised if the assumptions are written somewhere a simulator can read. That means the interface definition carries both halves:

interface: star_tracker_a
requires:                      # what the unit must do
  quaternion:
    rate_hz: 4
    frame: J2000
    max_latency_ms: 60
provides:                      # what the spacecraft must do
  power:
    voltage_v:      {min: 22.0, max: 29.0, ripple_pp_v: 1.5}
    transient_v:    {peak: 50, max_duration_ms: 10}
    source_impedance_mohm_max: 80
  thermal:
    mount_interface_c: {min: -20, max: 45}
  command:
    max_quiet_s: 8             # watchdog fires past this
verified_against:
  power: bench_supply_v1       # not the flight PCDU model

interface: star_tracker_a
requires:                      # what the unit must do
  quaternion:
    rate_hz: 4
    frame: J2000
    max_latency_ms: 60
provides:                      # what the spacecraft must do
  power:
    voltage_v:      {min: 22.0, max: 29.0, ripple_pp_v: 1.5}
    transient_v:    {peak: 50, max_duration_ms: 10}
    source_impedance_mohm_max: 80
  thermal:
    mount_interface_c: {min: -20, max: 45}
  command:
    max_quiet_s: 8             # watchdog fires past this
verified_against:
  power: bench_supply_v1       # not the flight PCDU model

interface: star_tracker_a
requires:                      # what the unit must do
  quaternion:
    rate_hz: 4
    frame: J2000
    max_latency_ms: 60
provides:                      # what the spacecraft must do
  power:
    voltage_v:      {min: 22.0, max: 29.0, ripple_pp_v: 1.5}
    transient_v:    {peak: 50, max_duration_ms: 10}
    source_impedance_mohm_max: 80
  thermal:
    mount_interface_c: {min: -20, max: 45}
  command:
    max_quiet_s: 8             # watchdog fires past this
verified_against:
  power: bench_supply_v1       # not the flight PCDU model

Written that way, the assumptions become testable objects. The power model of the actual bus can be run against the provides block in simulation the week the PCDU design changes, not eighteen months later on the floor. The verified_against line is the uncomfortable one, and it is the point: it makes the fiction visible instead of implied.

If you accept that an interface has two sides, the ICD template is not incomplete. It is the wrong shape. It needs two sets of obligations and two sets of evidence, and today it has one of each.

The box shows up with a test report proving it works. The spacecraft shows up with nothing. When the two meet and something is wrong, the paperwork points in one direction, and so does everyone in the room.