What remains possible after a failure?
When a complex system loses part of its hardware, its mission is not necessarily over. The harder questions are what it can still do, which information is trustworthy, and whether a change in its behaviour is safe.
The precise research formulation
Survivability Framework — This section assembles the mathematical core of the dissertation into a coherent framework: from the degraded control object and survivability metric to the transformation space, timing constraints and the evolution policy.
When the equipment failed, the objective — and the way to reach it — changed.
After the Apollo 13 accident, landing on the Moon was no longer possible. The lunar module, designed for a different purpose, became a temporary life-support system for the crew. Resources were limited, so less important functions were set aside to protect the overriding priority: bringing people home.
This is a historical case of resource reassignment, not evidence validating our algorithm. It illustrates the question at the heart of the dissertation: how do we determine what is still possible, and how do we choose a safe way forward?
Read the full Apollo 13 case study ↗Four questions instead of “does it work?”
Imagine an autonomous robot losing a drive. That does not automatically make it safe to keep moving, nor does it necessarily erase every remaining capability. The answer requires a sequence of checks.
- 01
What was lost?
Identify failed or weakened resources: drives, sensors, power and computing.
- 02
What can still be trusted?
Check not only hardware but also the models and estimates driving decisions.
- 03
What is still allowed?
Reject options that are physically impossible or violate safety requirements.
- 04
What should happen next?
Choose not only the next operating mode but an admissible sequence of changes with timing limits.
The robot is an explanatory example, not a result from a separate experiment.
We can now quantify this idea.
The dissertation defines a quantitative survivability measure, S(t). It summarizes how much mission-relevant functional capability the system retains in its current configuration, considering both which functions are enabled and the condition of the resources supporting them.
Mathematical model: dissertation §2.6. Model validity: §2.7. Admissible transitions: §2.8. Trajectory planning: §3.6.
Explore the mathematical model ↗This is a normalized capability measure within a defined model — not the probability that the system will survive.
Seven parts of the framework — from the first question to a decision
This is where deeper reading begins. Each part has its own page; their order follows the dissertation, and the technical details can be explored step by step.
After a failure, the system is no longer nominal.
The nominal object P0 becomes Pd after damage. From that point, control and reconfiguration must rely on the real degraded object, not on the design-time idealization.
The four-level hierarchy: resource → service → function → mission.
At the core is a constructive link between resources, services, functions and mission. That is what turns survivability into a computable quantity S(t).
Capability and admissibility are not the same thing.
The framework separates configuration structure Φ(cfg), its nominal ceiling S̄(cfg), and the current survivability S(t). A correct supervisor decision requires all three.
Model validity is a resource, too.
The framework introduces epistemic resources: models, estimators, identifiers and learned policies whose validity must be monitored just like the physical state.
Reconfigurations form a transformation space, not a list of reactions.
Each admissible configuration is a graph vertex, and each allowed transition is an edge. Reconfiguration thus becomes motion over an evolution graph.
Timing constraints are independent: task, reaction, sequence.
The framework must pass three independent timing checks: local task deadlines, the end-to-end response budget, and the minimum dwell time between reconfigurations.
The planner must choose a trajectory, not only the next node.
If the chosen configuration must remain admissible over the whole dwell interval, the problem changes from a one-step choice to selecting an evolution policy.
How to read this section
Built directly from dissertation sections §§2.6–2.8, §3.6, §§4.2, 4.9–4.10.
Fast path
01 → 03 → 06
What changes after failure, how survivability is measured, and which timing conditions cannot be violated.
Theory path
02 → 04 → 05 → 07
Hierarchy, epistemic resources, the evolution graph and trajectory policy.
Implementation path
02 → 06 → Implementation
From abstraction to modules and timing verification.
Expand technical diagrams and earlier model representations
These diagrams remain available to trace the evolution of the research. Some symbols belong to earlier iterations; the current survivability and admissibility definitions are in dissertation sections 2.6–2.8.
Survivability Framework
This section assembles the mathematical core of the dissertation into a coherent framework: from the degraded control object and survivability metric to the transformation space, timing constraints and the evolution policy.
From model to evidence
The framework explains how to reason about survivability. Publications, the monograph and registered research projects show how the research direction developed.