Where system survivability begins
An intuitive introduction to the research for non-specialist readers.
A system may still operate — but no longer as designed
When a component fails, the mission does not always have to end. But this does not mean the system can safely continue as before. Survivability asks which essential functions remain possible after damage and under which constraints they can be performed.
The story of Apollo 13 is a historical example of rethinking resources and priorities after failure, as discussed in the dissertation. It illustrates the problem; it is not experimental validation of this framework.
Four questions before reconfiguration
- What has been lost? Which resources are unavailable or degraded?
- What can still be trusted? Are the models and estimators still valid for the actual system?
- What is still admissible? Which configurations satisfy function and safety constraints?
- What happens next? Which sequence of decisions preserves the mission rather than only the next instant?
Reading path
Begin with the post-failure object, then explore the resource-to-mission hierarchy and admissible configurations.
The key extension is that a sensor or actuator may be physically healthy while the model underlying the decision is no longer valid.