You Verified Your Spacecraft on the Best Day of Its Life
Every number you verified against was measured on the least degraded hardware that will ever exist. The solar cells had absorbed no radiation, the battery had seen a few dozen cycles, the reaction wheel bearings had run for hours instead of years. Then we sign an interface control document full of those numbers and ask the spacecraft to keep that promise for fifteen years.
Power engineers settled this argument decades ago. Nobody sizes a solar array for the day it deploys. It is sized so that after the radiation dose, the thermal cycling, the contamination and the coverglass darkening, the array still just covers the load. Common practice applies an end-of-life to beginning-of-life factor near 0.85 for triple-junction gallium arsenide cells in a friendly orbit, and considerably harsher factors where the belts bite. The array is deliberately oversized on day one so that it is barely adequate on the last one.
Now open the ICD for any box hanging off that bus. It says 28 volts nominal, 22 to 34 volts, and it says it exactly once. Nothing in the document says which year that range describes. The box gets qualified against it. The simulation assumes it. The test rack supplies it. All three are working from a value that is true on the first day of the mission and drifting from that moment forward.
The interface is a curve. The document holds one number.
Almost every interface quantity on a spacecraft is a function of time. Bus voltage under load sags as battery internal resistance climbs and capacity fades. Thruster performance falls through a blowdown, so the delta-v per pulse that the attitude control software assumes depends on how much propellant is left in the tank. Gyro bias drift grows. Star trackers accumulate hot pixels from total ionizing dose, degrading the update rate and accuracy the estimator receives. Downlink margin shrinks as traveling wave tube output falls, so the data rate the ground plans against is a moving number.
Every one of these appears in the ICD as a constant, or at best as a static range. The range is the manufacturing and load spread. It is not the aging law. Those are two different kinds of uncertainty and the document format cannot tell them apart.
The constraint is the format. A table row holds one value per column. When the underlying physics is a curve, the curve gets flattened to whichever point on it the author thought was representative, which is almost always the beginning. The information wasn't lost because someone decided it did not matter. It was lost because the artifact could not carry it.
We size the array for end of life and then verify the spacecraft at beginning of life.
The aged number exists. It belongs to someone else.
None of this degradation is a mystery. It has been calculated, argued over in a review, and written down. It just lives somewhere other than the interface: in the power budget with its BOL and EOL columns, in the radiation analysis with its dose-depth curve, in the propulsion blowdown model, in the bearing life assessment.
Those documents have owners, and none of the owners is the person who writes the ICD. The electrical power analyst produces a table showing the bus at end of life. The interface engineer produces a table showing the bus. They are reviewed by different boards on different dates. And the simulation team, which is the one group that could actually run the aged case, builds its models from the ICD, because the ICD is where interface behavior is supposed to come from.
So the aging analysis and the interface definition sit two folders apart in the same document system and never meet.
Integration runs on the youngest article that will ever fly.
Everything downstream compounds the problem. AIT, thermal vacuum, day-in-the-life, the flight model campaign: all of it runs on hardware fresh out of acceptance. You can't age a spacecraft on the bench. Where a component has life-test data, that data belongs to a qualification article rather than the flight unit. The life test also measured the component on its own, not its behavior against the rest of the system.
The bill arrives on orbit, where fixes are expensive. The ISS solar arrays were built for a fifteen-year service life and are well past it. The original complement produced about 240 kilowatts when new; radiation damage and micrometeoroid strikes brought that down to roughly 160. The answer was to fly six roll-out arrays and have crews install them in front of the legacy wings across a series of spacewalks. That is an interface renegotiation conducted in orbit, in pressure suits, over three years.
Kepler flew a configuration nobody had modeled.
Kepler's photometric precision was a pointing problem before it was an optics problem. Reaction wheel assembly 2 stopped in July 2012. Wheel 4 then began showing elevated and erratic friction and failed in May 2013. On two wheels the spacecraft could no longer hold the attitude the science required, and photometric quality dropped by roughly a factor of four.
Bearing friction rising with age is not an exotic failure mode. What turned it into a mission-ending event is that two-wheel operation was not a configuration anyone had a model for. The recovery, balancing the spacecraft against solar radiation pressure by presenting the arrays to the Sun, was worked out after the fact by Ball and the Kepler team. It succeeded, and it bought several more years of science as K2. It also had to be designed in flight, under time pressure, from a standing start.
Degraded configurations are configurations. They are as legitimate an operating state as the nominal one, and considerably more likely to be the state the spacecraft is in when something else goes wrong.
Voyager treats power as a schedule.
Voyager 1's radioisotope generators lose about four watts every year, and they have been doing it since 1977. The spacecraft launched with ten science instruments and has two left. The cosmic ray subsystem was switched off in February 2025. The low-energy charged particle detector followed on 17 April 2026.
Nobody at JPL was surprised by either shutdown. Voyager's power was never an interface constant. It has always been a schedule: this many watts in this year, therefore these loads, therefore these instruments. The interface between the bus and every instrument is defined against a date. Forty-eight years in, the team is still making those calls on time, because the decaying number is the number they designed against.
Most programs could describe their interfaces the same way. They don't, because the artifact they chose has no place to put the second number.
Accept the argument and the ICD stops being a table of constants. It becomes a set of functions that take a date. That is trivial to express in a schema and impossible to express in a document row, which is the clearest case we know for interfaces that live in code rather than in prose. Once the curve is in the interface, the end-of-life case costs almost nothing to run. Simulating an aged interface does not require aged hardware. It requires the aging law, and someone on the program wrote that down years ago.
The whole verification program proves the spacecraft works on its first day. The mission is graded on its last one. Somewhere between those two dates, every number we signed quietly stopped being true.
