Case Study: Designing a Comsat to Survive 15 Years — A Reliability Budget

"Reliability is designed in, not tested in — but you had better be able to prove the number." — a working principle of spacecraft systems engineering

Executive Summary

In Case Study 1 we audited an existing design. Here we build one. You are the reliability lead for the Track A geostationary communications satellite that has run through this book's Mission Design Review since Chapter 1. The customer's contract sets a hard requirement: at least an 85% probability that the primary payload is still fully operational at 15 years. Your job is to take a first-cut spacecraft whose bare, single-string reliability falls far short of that, find its single points of failure with an FMEA, and buy the reliability up to target by adding redundancy where each kilogram buys the most — because every kilogram you spend on backups is a kilogram the rocket equation (Chapter 3) charges you for, and your mass budget is finite. This is the risk-assessment increment of your MDR, worked end to end.

Skills applied

• Setting a reliability requirement and building a reliability block diagram (§32.1, §32.2).
• Computing series reliability and identifying single points of failure (§32.2).
• Running an FMEA-lite with a severity × likelihood risk matrix (§32.3).
• Allocating redundancy by reliability-gain-per-kilogram, and accepting residual SPOFs (§32.2, §32.6).

Background

The requirement

Write it the way Chapter 29 taught you — testable, with function, condition, and duration:

REL-1. The spacecraft shall provide a probability of full primary-payload operation of at least 0.85 over a 15-year mission life in the geostationary environment.

That single number is the target every calculation below drives toward. Note what it is not: it is not "be reliable," and it is not 1.0. It is a specific, defensible probability, chosen because the business case needs roughly 15 years of revenue and can tolerate a modest risk of early loss (insurance covers the rest — reliability engineering and space insurance are two sides of the same risk coin).

The first-cut spacecraft (single-string)

Your systems team hands you seven subsystems, each with an estimated single-string (no-redundancy) reliability over 15 years. These are illustrative (Tier 3), but their relative ordering is realistic — the computer and the moving parts (wheels) are the weak links; structure and thermal are robust:

All seven are in series — the mission needs every one of them — so we are about to meet the series trap of §32.2 head-on.

Phase 1: Baseline reliability and the single points of failure

Draw the reliability block diagram: seven blocks in a row, every one required. Multiply:

$$ R_{\text{base}} = 0.99 \times 0.95 \times 0.90 \times 0.92 \times 0.97 \times 0.93 \times 0.98 = 0.6884. $$

The bare spacecraft is only about 68.8% reliable over 15 years — a mission-loss probability near 31%, far worse than the 15% the contract allows. And every one of the seven blocks is a single point of failure: with no redundancy anywhere, the loss of any subsystem ends the mission. That is the honest starting point almost every design begins from, and the reason a risk assessment is not optional.

Sanity check. The product must be below the weakest block (0.90), and it is (0.688). Seven blocks, even with an average reliability of ~0.95, multiply down to ~0.69 — a vivid reminder of §32.2's threshold concept. Reliability is not the average of the parts; it is the product, and products of numbers below 1 shrink fast.

Phase 2: FMEA-lite — where is the risk?

Before spending a gram on redundancy, we find out what fails and how badly. Score each candidate failure mode on severity (1 negligible → 4 catastrophic) and likelihood (1 improbable → 5 frequent), and multiply for a risk index (§32.3). Here are the five highest:

The FMEA does two things at once. It ranks the risks (the computer and the reaction wheels, both scoring 12, are where attention must go first), and it confirms every top risk is detectable — the ground will know what failed, which is what makes an anomaly response and a next-mission fix possible. A catastrophic, undetectable failure would rank higher than its score suggests (§32.3); happily, none here is blind.

Phase 3: Allocate redundancy by gain-per-kilogram

Now the core design decision. Each redundancy improves one block but costs mass. Here are the candidates, with the hardened block reliability and the mass each costs:

Because the subsystems are in series, adding a redundancy multiplies the whole system reliability by the block's relative gain — so gain-per-kilogram (relative gain divided by mass) is the right currency for ranking. We add redundancies greedily, best-value first, until we clear the 0.85 target:

$$ \begin{aligned} \text{Baseline:} &\quad R = 0.6884 \\ +\ \text{dual computer (6 kg):} &\quad R = 0.6884 \times 1.100 = 0.7573 \\ +\ \text{4th reaction wheel (10 kg):} &\quad R = 0.7573 \times 1.078 = 0.8166 \\ +\ \text{redundant power string (8 kg):} &\quad R = 0.8166 \times 1.042 = 0.8509 \quad \ge 0.85\ \checkmark \end{aligned} $$

Three redundancies — dual computer, a fourth reaction wheel, and a backup power string — for a total of 24 kg take the spacecraft from 0.688 to 0.851, just clearing the contract's 0.85. Notice we did not add the redundant TWTAs: at 0.47%/kg they are the worst value, and we hit target without them. (A program might still add them, but for payload availability — keeping channels alive — rather than for the REL-1 number, and that would be a separate, documented trade.) Let us confirm the arithmetic in code, using the reliability.py module this chapter builds:

from reliability import series, redundant   # astrotools, Chapter 32

base = [0.99, 0.95, 0.90, 0.92, 0.97, 0.93, 0.98]  # struct power cdh acs prop comms thermal
print("baseline R:", round(series(base), 4))

hardened = [
    0.99,                 # structure/mechanisms (accepted SPOF)
    0.99,                 # power: redundant string (+8 kg)
    redundant(0.90, 2),   # computer: dual redundant (+6 kg) -> 0.99
    0.992,                # attitude: 4th reaction wheel (+10 kg)
    0.97,                 # propulsion (unchanged)
    0.93,                 # comms (unchanged: worst gain/kg)
    0.98,                 # thermal (unchanged)
]
print("hardened R:", round(series(hardened), 4), "(+24 kg)")
# Expected output:
# baseline R: 0.6884
# hardened R: 0.8509 (+24 kg)

Phase 4: The residual single points of failure

Redundancy did not remove every SPOF, and it never can. Look at what remains unbacked: the structure, the single solar-array drive mechanism that must rotate the arrays to track the Sun, the one antenna boom, the propulsion thrusters. Some of these cannot be practically duplicated — you cannot fly two primary structures, and a second array-drive axis adds mass and its own failure modes. These are the comsat's equivalents of the re-entry heat shield of Chapter 7: catastrophic single points of failure for which the answer is not redundancy but the other tools of this chapter — generous margin (a factor of safety on the structure, per Chapter 23), derating (run the array-drive motor far below its rated torque, the battery far below full depth-of-discharge), and a thorough qualification test campaign (§32.4) that proves each unbacked item has margin against every flight condition. A residual SPOF is not a failure of design; it is a risk you accept, with eyes open, having driven its probability as low as margin and testing can take it — and you write that acceptance into the MDR so the review board sees it and agrees.

Engineering judgment. The 24-kg solution meets REL-1 at 0.851 — but with almost no margin above the 0.85 floor. A wise reliability lead would either add the TWTA redundancy for cushion (accepting the mass), or, better, reduce the uncertainty in the weakest single-string estimates (the 0.90 computer, the 0.92 wheels) with more analysis and test, so the 0.851 is trustworthy rather than a hopeful point estimate. Recall Chapter 29: you buy down margin by buying knowledge — and a reliability of 0.851 quoted to three digits from Tier-3 inputs is exactly the kind of false precision a review board is paid to catch.

Discussion Questions

1. The greedy allocation added the computer, wheels, and power redundancies but not the TWTAs. If the mass budget had room for only one more kilogram of redundancy after the computer, which subsystem would you harden next, and why is "gain per kilogram," not "gain," the right ranking?
2. REL-1 is met at 0.851 — barely. List three things a review board would demand before trusting that number, drawing on Chapters 29 and 32.
3. The array-drive mechanism is a residual SPOF. Explain why adding a redundant drive might actually lower overall reliability, and what you would do instead.
4. Space insurance can cover the ~15% residual mission-loss risk. How should the existence of insurance change (or not change) the reliability engineering? (Careful: this is a values question as much as a math one.)

Your Turn: Extensions

• Option A (your mission). Run this whole process for your track (A/B/C/D). Assign single-string reliabilities to your subsystems, compute the baseline series reliability, run an FMEA-lite, set a target, and allocate redundancy by gain-per-kg to meet it. Record the mass cost. This is your MDR risk assessment.
• Option B (computation). Write a short function that takes a list of (block_R, hardened_R, mass_kg) candidates and a target, and returns the greedy least-mass set of redundancies that meets the target. Reproduce the 24-kg answer above. (Hand-trace; add # Expected output:.)
• Option C (design, harder). A lunar lander (Track B) has a descent phase where the failure of a single throttle valve is catastrophic and there is no time to switch to a backup (the burn is 12 minutes, the fall is committed). Discuss why active redundancy, not standby, is required for time-critical functions, and estimate the reliability of two active-parallel valves at $R = 0.98$ each.

Key Takeaways

1. Start from an honest baseline. Seven series subsystems at ~0.95 average multiply to ~0.69 — the series trap. A risk assessment begins by computing that unwelcome number.
2. FMEA first, redundancy second. Score severity × likelihood to find where the risk is (here, the computer and reaction wheels) before spending mass.
3. Allocate redundancy by gain-per-kilogram. Series coupling means each backup multiplies the whole system reliability; spend on the highest relative-gain-per-kg blocks first. Here 24 kg bought 0.688 → 0.851.
4. Some SPOFs must be accepted. For items you cannot duplicate, reliability comes from margin, derating, and qualification testing — and the acceptance is documented for the review board, not hidden.