Hadal — Hydrothermal Vent Explorer

Chimney formations are fragile and entanglement of the hull is a vehicle-loss risk, so the ConOps requires stand-off survey of the hull; endmember fluid must still be captured at the orifice, which the deployable probe does with its tip contact bounded at 20 N (SUB-SCI-070, ARC-REQ-015).

H-005 is catastrophic for the asset and, on deck, a fire hazard to crew; the compensated pack (SUB-NRG-031) cannot be accessed or vented at depth, so fast electrical isolation is the in-dive mitigation and the deck procedure (SUB-NRG-108) the surface one. Parent of SYS-REQ-009.

Hadal survey ship-time is costly and limited per cruise; ConOps requires multiple dives per operational day, and turnaround duration directly caps total daily science yield. No existing stakeholder requirement captures this operational tempo constraint.

An uncrewed deep vehicle is a high-value single asset with no in-mission recovery if the pressure boundary fails; this need drives SYS-REQ-007, SYS-REQ-016 and the H-001 mitigation.

Vent-field survey dives run up to 8 hours unattended at depth; the support ship crew needs ongoing status, not just an emergency beacon, to make go/no-go decisions mid-dive and to detect a developing fault before it becomes an abort.

Support-ship deployment cycles budget one dive per battery charge; a mid-dive recharge or swap is operationally infeasible at the 6000 m maximum operating depth, so the endurance requirement is a hard stakeholder constraint on the energy subsystem.

Chimney formations are fragile and entanglement of the hull is a vehicle-loss risk, so the ConOps requires stand-off survey of the hull; endmember fluid must still be captured at the orifice, which the deployable probe does with its tip contact bounded at 20 N (SUB-SCI-070, ARC-REQ-015).

Degassing and mineral precipitation on decompression destroy the scientific value of a hydrothermal fluid sample; this is the driving need behind the isobaric sampler capability.

Hadal recovery sites are often in poor sea-state or low-light conditions; HAZ-1 (pressure hull breach) and the emergency-ascent scenario both depend on a non-visual surface locating capability to close the recovery loop.

Hadal-depth ROV/AUV rescue assets are rarely available at short notice; the ConOps assumes support-ship-only recovery, so the vehicle must be self-recovering once it aborts a dive.

System-level parent for the floating-bus, bonding, insulation-monitoring and ground-fault-response requirements (SUB-NRG-078 to SUB-NRG-081), which previously derived from the battery cell-fault requirement.

System-level parent for the floating-bus, bonding, insulation-monitoring and ground-fault-response requirements (SUB-NRG-078 to SUB-NRG-081), which previously derived from the battery cell-fault requirement.

Time-to-surface drives beacon reserve life, ship positioning and STK-REQ-001 recovery planning; 60 kg net positive buoyancy on a nose-up ascent gives about 0.5 m/s (ARC decision ARC-buoyancy).

Recovery had no declared exit and the probe could not tell whether this was intentional. Recovery is the vehicle lifted aboard the support vessel by crane; there is no engineering reason for a further autonomous transition, so it is declared terminal by mission cycle rather than left ambiguous.

Survey/Station-keeping is the highest collision-risk mode (SYS-REQ-004) and must not be a dead end; its fault exit is the SUB-NAV-075 withdrawal and its abort exit covers both commanded and autonomous aborts.

Survey/Station-keeping is the highest collision-risk mode (SYS-REQ-004) and must not be a dead end; its fault exit is the SUB-NAV-075 withdrawal and its abort exit covers both commanded and autonomous aborts.

Enumerates the exits from Transit: normal arrival at a survey station (SYS-REQ-004 standoff), the SUB-NAV-075 navigation-loss response, and abort (commanded or autonomous per SYS-REQ-020).

Enumerates the exits from Transit: normal arrival at a survey station (SYS-REQ-004 standoff), the SUB-NAV-075 navigation-loss response, and abort (commanded or autonomous per SYS-REQ-020).

Enumerates the exits from Transit: normal arrival at a survey station (SYS-REQ-004 standoff), the SUB-NAV-075 navigation-loss response, and abort (commanded or autonomous per SYS-REQ-020).

Navigation fusion must be established before powered Transit begins; the abort path stays independent of fusion state per SYS-REQ-001 and ARC-REQ-001. The descent weight (SUB-HUL-105) is released at the same transition.

Navigation fusion must be established before powered Transit begins; the abort path stays independent of fusion state per SYS-REQ-001 and ARC-REQ-001. The descent weight (SUB-HUL-105) is released at the same transition.

Derives from STK-REQ-002; a 5-minute bound keeps the fix current against surface drift before the support ship begins its search. The satellite path is the Iridium Satellite Beacon Module and the local path the Emergency Surface Beacon (ARC-REQ-017).

System-level parent for the personnel hazards added by the risk assessment (H-009 to H-013); goal-based approach per ARC decision ARC-safety following EN ISO 12100.

Lists the autonomous abort triggers so the mode state machine of SYS-REQ-010 to SYS-REQ-015 is complete and SUB-NAV-103's 'no unspecified transition' property is testable; see ARC decision ARC-abort.

System-level parent for the floating-bus, bonding, insulation-monitoring and ground-fault-response requirements (SUB-NRG-078 to SUB-NRG-081), which previously derived from the battery cell-fault requirement.

Time-to-surface drives beacon reserve life, ship positioning and STK-REQ-001 recovery planning; 60 kg net positive buoyancy on a nose-up ascent gives about 0.5 m/s (ARC decision ARC-buoyancy).

End-to-end acoustic abort latency: 4.7 s one-way propagation at 7 km and 1500 m/s, modem framing and authentication, 200 ms modem-to-computer delivery (IFC-ISI-011) and 200 ms computer-to-release delivery (IFC-ISI-003), with margin. Derived from STK-REQ-001 self-recovery; see ARC decision ARC-timing.

Gives every pressure, standoff and telemetry requirement a stated depth basis; see ARC decision ARC-depth. The hadal threshold (6000 m) is the rated depth; survey target vent fields lie at 5000 m or shallower.

Recovery had no declared exit and the probe could not tell whether this was intentional. Recovery is the vehicle lifted aboard the support vessel by crane; there is no engineering reason for a further autonomous transition, so it is declared terminal by mission cycle rather than left ambiguous.

Emergency Ascent/Abort had no declared exit transition. Directly follows from SYS-REQ-002 (GPS fix within 5 minutes of surfacing), which presupposes this handoff to a tracked Recovery state.

Survey/Station-keeping is the highest collision-risk mode (SYS-REQ-004) and must not be a dead end; its fault exit is the SUB-NAV-075 withdrawal and its abort exit covers both commanded and autonomous aborts.

Enumerates the exits from Transit: normal arrival at a survey station (SYS-REQ-004 standoff), the SUB-NAV-075 navigation-loss response, and abort (commanded or autonomous per SYS-REQ-020).

Navigation fusion must be established before powered Transit begins; the abort path stays independent of fusion state per SYS-REQ-001 and ARC-REQ-001. The descent weight (SUB-HUL-105) is released at the same transition.

The normal mission start trigger; the deck-safe interlock (SUB-HUL-106) and both surface beacons (SUB-COM-040) gate it.

The 500 ms bound applies to the pack-contactor path (SUB-NRG-008) and is measured from detection; with the 10 Hz protection sampling of SUB-NRG-018 the chain is 100 ms sample, 50 ms decision, 100 ms contactor and 50 ms reporting (analysis case AC-06). Derived from STK-REQ-009 (ARC-REQ-016).

Derives from STK-REQ-008 (90-minute dive-to-dive turnaround): opening the primary pressure-hull closure for every turnaround risks seal damage and adds hours to the process, so quick-disconnect external interfaces are the only way to meet the 90-minute turnaround target.

Directly mitigates H-001. The proof factor of 1.25 on maximum operating pressure is the test half of the pressure-boundary basis; the 1.5 collapse factor is shown by analysis in SUB-HUL-104 (ARC-REQ-012). Separating the two stops the proof test being driven to the full design margin.

Derives from the continuous-awareness need (STK-REQ-006). 7 km is the maximum slant range: 6000 m operating depth plus a 3.6 km horizontal offset to the support ship. The link-budget analysis (AC-04) closes 2 kbps at 7 km with 6 dB margin in a 9 to 14 kHz band (ARC-REQ-013).

Derives from the single-charge-endurance stakeholder need (STK-REQ-005); 8 hours is the minimum dive duration to complete one full vent-field survey transect within a single support-ship deployment window.

Derives from the no-chimney-contact stakeholder need (STK-REQ-004) and directly mitigates HAZ-2 (entanglement) and HAZ-3 (350C thermal plume damage); 2m matches the plume dispersion radius at which thermal exposure and entanglement risk are acceptable.

Derives from the sample-integrity stakeholder need (STK-REQ-003); +/-5% is the tolerance below which dissolved-gas and mineral precipitation artefacts become scientifically significant in vent-fluid geochemistry.

Derives from STK-REQ-002; a 5-minute bound keeps the fix current against surface drift before the support ship begins its search. The satellite path is the Iridium Satellite Beacon Module and the local path the Emergency Surface Beacon (ARC-REQ-017).

Derives from STK-REQ-001; the 30 s bound covers Drop-Weight Release actuation and the transit to positive net buoyancy, measured from receipt at the vehicle. Acoustic delivery of a support-ship command is bounded separately by SYS-REQ-017 and the ascent itself by SYS-REQ-018.

Mitigates H-009: a cartridge offloaded by deck crew holds vent fluid at up to 620 bar (SYS-REQ-003); the stored energy is contained by interlocked release and a directed relief.

Realises the ARC-REQ-010 monitoring decision: the SUB-SCI-070 barrier depends on a single contact-force sensor, and a stuck-low or failed-quiet sensor is silent. Built-in test with a conservative fail-safe retract to stow mirrors the ARC-REQ-009 sonar precedent and adds no modelled component.

Realises the ARC-REQ-010 monitoring decision: the SUB-SCI-070 barrier depends on a single contact-force sensor, and a stuck-low or failed-quiet sensor is silent. Built-in test with a conservative fail-safe retract to stow mirrors the ARC-REQ-009 sonar precedent and adds no modelled component.

SUB-SCI-094 set a 350C continuous / 440C peak thermal rating for the probe tip and intake, and SUB-SCI-003 already justified its 1Hz reading rate on being 'fast enough to abort a capture before the intake exceeds its thermal design limit', but no requirement stated the trip threshold or the response itself, leaving the over-temperature case with no barrier despite black-smoker endmember fluids commonly running 350-405C. A 2-second continuous-exceedance filter avoids nuisance retraction on brief 1Hz sensor noise while remaining short relative to a capture dwell; the 440C peak is an instantaneous trip with no filter since it is already the probe's absolute design ceiling. Reusing the SUB-SCI-068 retraction sequence (rather than defining a new actuation path) keeps a single stow mechanism and its 15s timeout as the sole probe-retraction realiser, mitigating H-007 sample-loss risk from tip degradation.

SUB-SCI-058 extends a rigid sampling probe at least 2 m beyond the hull to the vent orifice while the hull holds >=2 m standoff (SYS-REQ-004). No requirement sets a contact-force limit or detects probe-tip contact at the orifice, so a navigation or position error while the probe is deployed can drive the tip into the fragile chimney structure (H-008 ecosystem disturbance, major) or damage the probe. The >=2 m standoff protects the hull but not the probe tip, which is at the orifice by design.

SUB-NRG-029 sheds all Science-Payload loads within 5s on a <44V bus, but SUB-SCI-058 holds a rigid probe 2m beyond the hull. Cutting actuator power mid-deployment would strand the probe extended, raising collision H-004 (critical) and ecosystem-disturbance H-008. SUB-NRG-029 already guarantees Nav/Propulsion 30 min at full capability, so a bounded 15s retraction has ample energy headroom; sequencing retraction ahead of feed removal, with the retraction feed shed last, removes the strand-extended failure mode.

SUB-NRG-029 sheds all Science-Payload loads within 5s on a <44V bus, but SUB-SCI-058 holds a rigid probe 2m beyond the hull. Cutting actuator power mid-deployment would strand the probe extended, raising collision H-004 (critical) and ecosystem-disturbance H-008. SUB-NRG-029 already guarantees Nav/Propulsion 30 min at full capability, so a bounded 15s retraction has ample energy headroom; sequencing retraction ahead of feed removal, with the retraction feed shed last, removes the strand-extended failure mode.

No geometry bridged the >=2 m hull standoff (SYS-REQ-004 / SUB-NAV-022) to the sample intake. SYS-REQ-004 scopes the standoff to the hull and chimney structures for entanglement (H-004) and 350C thermal-plume protection of the vehicle; a thin, thermally-rated reach probe lets the intake reach the orifice while the vehicle body stays back. Reach must be >=2 m to bridge the standoff. This also gives SUB-SCI-003 the geometry to read up-to-350C plume temperature at the intake, preserving endmember geochemical value (H-007). Realises the capture leg of SYS-REQ-003.

The externally exposed science hardware sees the acidic, hot, sulphide-rich plume, not the cold chloride seawater SUB-HUL-044 addresses; the design life matches the hull's 2000 dive cycles.

Mitigates H-009: a cartridge offloaded by deck crew holds vent fluid at up to 620 bar (SYS-REQ-003); the stored energy is contained by interlocked release and a directed relief.

Realises the ARC-REQ-010 monitoring decision: the SUB-SCI-070 barrier depends on a single contact-force sensor, and a stuck-low or failed-quiet sensor is silent. Built-in test with a conservative fail-safe retract to stow mirrors the ARC-REQ-009 sonar precedent and adds no modelled component. Treating a lost contact-force reading as contact-present ensures a silent contact-force sensor failure cannot defeat the H-008 chimney-protection barrier (SUB-SCI-070).

SUB-SCI-094 set a 350C continuous / 440C peak thermal rating for the probe tip and intake, and SUB-SCI-003 already justified its 1Hz reading rate on being 'fast enough to abort a capture before the intake exceeds its thermal design limit', but no requirement stated the trip threshold or the response itself, leaving the over-temperature case with no barrier despite black-smoker endmember fluids commonly running 350-405C. A 2-second continuous-exceedance filter avoids nuisance retraction on brief 1Hz sensor noise while remaining short relative to a capture dwell; the 440C peak is an instantaneous trip with no filter since it is already the probe's absolute design ceiling. Reusing the SUB-SCI-068 retraction sequence (rather than defining a new actuation path) keeps a single stow mechanism and its 15s timeout as the sole probe-retraction realiser, mitigating H-007 sample-loss risk from tip degradation. The over-temperature reading is reported by the Chemical Sensor Suite per SUB-SCI-003 against the SUB-SCI-094 ratings; retraction drives the SUB-SCI-058 sampling probe and completes on confirmed stow or its 15-second retraction timeout.

SUB-SCI-058's reach-lance deliberately extends the sampler inlet and Chemical Sensor intake into the vent orifice so the hull can hold the SYS-REQ-004 2 m standoff from the ~350C plume, but nothing bounded the probe tip's own thermal survivability -- the FMEA thermal-degradation failure mode had no mitigating requirement. 350C is the project's established endmember source temperature (SYS-REQ-004 and SUB-SCI-003 rationale); applying the project's existing 25% continuous-duty margin convention (as used for SUB-NRG-087) gives a 440C peak design rating covering transient excursions and measurement latency ahead of SUB-SCI-003's 1Hz temperature-triggered abort.

SUB-SCI-058 extends a rigid sampling probe at least 2 m beyond the hull to the vent orifice while the hull holds >=2 m standoff (SYS-REQ-004). No requirement sets a contact-force limit or detects probe-tip contact at the orifice, so a navigation or position error while the probe is deployed can drive the tip into the fragile chimney structure (H-008 ecosystem disturbance, major) or damage the probe. The >=2 m standoff protects the hull but not the probe tip, which is at the orifice by design.

Defence in depth beyond the SUB-SCI-068 sequenced retraction. If retraction fails or power is lost before stow completes, a spring/over-centre passive return guarantees the probe cannot remain extended, protecting the SYS-REQ-004 2m standoff and mitigating collision H-004 (critical) and recovery risk at the 6000 m maximum operating depth where no ROV intervention is available. A passive mechanism needs no power and is the standard deep-vehicle fail-safe for external appendages.

SUB-NRG-029 sheds all Science-Payload loads within 5s on a <44V bus, but SUB-SCI-058 holds a rigid probe 2m beyond the hull. Cutting actuator power mid-deployment would strand the probe extended, raising collision H-004 (critical) and ecosystem-disturbance H-008. SUB-NRG-029 already guarantees Nav/Propulsion 30 min at full capability, so a bounded 15s retraction has ample energy headroom; sequencing retraction ahead of feed removal, with the retraction feed shed last, removes the strand-extended failure mode.

No geometry bridged the >=2 m hull standoff (SYS-REQ-004 / SUB-NAV-022) to the sample intake. SYS-REQ-004 scopes the standoff to the hull and chimney structures for entanglement (H-004) and 350C thermal-plume protection of the vehicle; a thin, thermally-rated reach probe lets the intake reach the orifice while the vehicle body stays back. Reach must be >=2 m to bridge the standoff. This also gives SUB-SCI-003 the geometry to read up-to-350C plume temperature at the intake, preserving endmember geochemical value (H-007). Realises the capture leg of SYS-REQ-003.

Without accurate geotagging, imagery of chemical/biological features cannot be correlated with the chemical sensor and sample data captured at the same location, undermining the scientific value of the survey.

Derives from SYS-REQ-008: breaking the isobaric seal to offload samples would violate SYS-REQ-003's in-situ pressure retention and add turnaround time incompatible with the 90-minute target.

A single-sample capacity would force one dive per sample, which is incompatible with the 8-hour survey-power budget in SYS-REQ-005; 3 samples per dive is the minimum needed to make efficient use of the available dive endurance.

Mitigates H-008 (vent ecosystem disturbance) by bounding light exposure to vent-adapted fauna during survey operations, based on published photic-stress thresholds for deep-sea chemosynthetic communities.

Mitigates H-007 (sample integrity loss); less than 1% carryover keeps analyte concentrations within the +/-5% in-situ preservation tolerance already required by SYS-REQ-003 for scientifically valid inter-sample comparison.

The Chemical Sensor Suite is functionally autonomous: its chemistry readings condition the timing of capture commands issued to the single-use Vent Fluid Sampler, and a fault or out-of-range reading acted on without a check could waste the one capture opportunity SYS-REQ-003 depends on for sample-pressure handover. Because the vehicle's only uplink is a low-rate acoustic channel (SYS-REQ-006, 2 kbps sustained), a live operator confirmation loop cannot be relied on at the moment of capture, so the safe response has to be an autonomous inhibit rather than a wait-for-confirmation design.

Vent plume temperature can exceed 350C; a 1 Hz reading rate is fast enough for the Mission Autonomy Computer to abort a capture attempt before the intake exceeds its thermal design limit.

An earlier realisation finding decided the Independent Thruster Power Interlock (SUB-PRP-074) must not trip an envelope-valid manoeuvre, but no requirement bound the SUB-PRP-014 envelope to admit the nav-degraded withdrawal. Because SUB-NAV-075 commands active thrust with no valid fused-nav solution, an envelope check keyed to a valid navigation solution would classify the withdrawal as envelope-inconsistent thrust and trip the interlock — de-energising the bus and defeating the H-006 nav-loss safe response, letting the vehicle drift into a chimney under 1.0 m/s current. This exclusion is deliberately narrow: it admits ONLY thrust that obeys the SUB-NAV-075 withdrawal geometry (reciprocal bearing away from structure, bounded speed, >=10 m standoff, minimum-thrust hold), so an autonomy fault commanding thrust TOWARD structure is still inhibited per SUB-PRP-014. Verified by fault-injection/HIL: assert nav-loss, confirm the interlock passes a compliant withdrawal and still trips thrust toward structure.

An earlier realisation finding decided the Independent Thruster Power Interlock (SUB-PRP-074) must not trip an envelope-valid manoeuvre, but no requirement bound the SUB-PRP-014 envelope to admit the nav-degraded withdrawal. Because SUB-NAV-075 commands active thrust with no valid fused-nav solution, an envelope check keyed to a valid navigation solution would classify the withdrawal as envelope-inconsistent thrust and trip the interlock — de-energising the bus and defeating the H-006 nav-loss safe response, letting the vehicle drift into a chimney under 1.0 m/s current. This exclusion is deliberately narrow: it admits ONLY thrust that obeys the SUB-NAV-075 withdrawal geometry (reciprocal bearing away from structure, bounded speed, >=10 m standoff, minimum-thrust hold), so an autonomy fault commanding thrust TOWARD structure is still inhibited per SUB-PRP-014. Verified by fault-injection/HIL: assert nav-loss, confirm the interlock passes a compliant withdrawal and still trips thrust toward structure.

SUB-PRP-074 stated a 200 ms trip on heartbeat loss without a loss-declaration criterion; two consecutive missed frames of the shared IFC-ISI-023 heartbeat mirrors the margin logic of the SUB-HUL-059 Abort Watchdog, scaled to the interlock's trip budget, and keeps the 200 ms trip time for the trip action alone.

SUB-PRP-074 stated a 200 ms trip on heartbeat loss without a loss-declaration criterion; two consecutive missed frames of the shared IFC-ISI-023 heartbeat mirrors the margin logic of the SUB-HUL-059 Abort Watchdog, scaled to the interlock's trip budget, and keeps the 200 ms trip time for the trip action alone.

Four independent zero-thrust protections each define a clear condition but no combined re-entry gate existed. The AND-gate with the physically final interlock last prevents premature thrust near structure; an abort is irreversible because the drop weight is already gone (ARC-REQ-022).

Four independent zero-thrust protections each define a clear condition but no combined re-entry gate existed. The AND-gate with the physically final interlock last prevents premature thrust near structure; an abort is irreversible because the drop weight is already gone (ARC-REQ-022).

Four independent zero-thrust protections each define a clear condition but no combined re-entry gate existed. The AND-gate with the physically final interlock last prevents premature thrust near structure; an abort is irreversible because the drop weight is already gone (ARC-REQ-022).

An earlier realisation finding decided the Independent Thruster Power Interlock (SUB-PRP-074) must not trip an envelope-valid manoeuvre, but no requirement bound the SUB-PRP-014 envelope to admit the nav-degraded withdrawal. Because SUB-NAV-075 commands active thrust with no valid fused-nav solution, an envelope check keyed to a valid navigation solution would classify the withdrawal as envelope-inconsistent thrust and trip the interlock — de-energising the bus and defeating the H-006 nav-loss safe response, letting the vehicle drift into a chimney under 1.0 m/s current. This exclusion is deliberately narrow: it admits ONLY thrust that obeys the SUB-NAV-075 withdrawal geometry (reciprocal bearing away from structure, bounded speed, >=10 m standoff, minimum-thrust hold), so an autonomy fault commanding thrust TOWARD structure is still inhibited per SUB-PRP-014. Verified by fault-injection/HIL: assert nav-loss, confirm the interlock passes a compliant withdrawal and still trips thrust toward structure.

SUB-PRP-074 stated a 200 ms trip on heartbeat loss without a loss-declaration criterion; two consecutive missed frames of the shared IFC-ISI-023 heartbeat mirrors the margin logic of the SUB-HUL-059 Abort Watchdog, scaled to the interlock's trip budget, and keeps the 200 ms trip time for the trip action alone.

Four independent zero-thrust protections each define a clear condition but no combined re-entry gate existed. The AND-gate with the physically final interlock last prevents premature thrust near structure; an abort is irreversible because the drop weight is already gone (ARC-REQ-022).

SUB-PRP-014/023/005 are all realised by the single dual-channel TMC (ARC-REQ-004), so a TMC-internal common-mode fault (power stage or logic) could both drive uncommanded thrust and defeat its own inhibit, driving the vehicle into a vent chimney (H-004, critical). An interlock in the power bus upstream of the TMC gives the H-004 safe-state a genuinely TMC-independent realiser; 200 ms matches SUB-PRP-023/005 isolation timing and keeps worst-case uncommanded-thrust displacement inside the SYS-REQ-004 2 m standoff. Verified by fault injection into the TMC power stage and logic.

A 0.3 m/s hysteresis band between the 1.0 m/s SUB-PRP-048 withdrawal trigger and this 0.7 m/s resume threshold, with a 60-second confirmation dwell, prevents chatter between withdrawal and station-keeping when ambient current oscillates near the trigger point; consistent with standard ROV/AUV current-avoidance hysteresis margins of 20-30%.

Unlike the hardware-fault isolations in SUB-PRP-005/023, the SUB-PRP-014 inhibit is a real-time envelope check on an otherwise-valid autonomy command; latching it would strand the vehicle on the next legitimate command and serves no safety purpose once the offending command is superseded.

Latching prevents chatter between isolate and restore on a marginal or intermittent overcurrent, stall, heartbeat-loss, or uncommanded-thrust fault, and requires an autonomy-level decision, informed by diagnostic confirmation, before thrust authority is returned to a channel that has already faulted.

Station-keeping authority is only qualified up to 0.5 m/s (SUB-PRP-007); beyond 1.0 m/s the vehicle can no longer guarantee the 2 m minimum standoff in SYS-REQ-004, so a defined withdrawal threshold and distance prevents an uncontrolled drift into vent chimney structures.

Uncontrolled thruster self-noise can mask the Obstacle Avoidance Sonar and USBL Acoustic Transponder returns during close-proximity station-keeping near vent chimneys, directly threatening the 2 m standoff safety margin in SYS-REQ-004.

Sized from bow-on drag with an effective drag area of 1.2 m2: 303 N at the 0.7 m/s station-keeping limit (SUB-PRP-007) gives a 1.3 margin, and 618 N at the 1.0 m/s withdrawal threshold (SUB-PRP-048) confirms station-keeping cannot be held there (ARC-REQ-021, analysis case AC-07). Ambient pressure is specified because thruster seal drag increases with depth.

Directly mitigates H-004 (uncommanded thrust near structure); 200 ms isolation combined with the vehicle's minimum 2 m standoff (SYS-REQ-004) keeps worst-case uncommanded-thrust displacement below the clearance margin to vent chimneys.

Propulsion & Manoeuvring is classified Functionally Autonomous : the Mission Autonomy Computer makes unsupervised thrust decisions during station-keeping, but SUB-PRP-005/006 only cover electrical faults and explicit abort, leaving no independent check against an autonomy software error commanding an unsafe manoeuvre (e.g. thrust toward vent structure) during normal operation. The inhibit acts independently of, and regardless of, the abort and overcurrent paths in SUB-PRP-005 and SUB-PRP-006.

The single station-keeping requirement (ARC-REQ-021): the tolerances sit inside the SYS-REQ-004 2 m standoff with margin for sensing and control error, and the 0.7 m/s limit meets the SUB-PRP-064 resume threshold so the 0.7 to 1.0 m/s band is covered by the SUB-PRP-048 withdrawal with hysteresis.

Derived from SYS-REQ-001 (positive buoyancy and ascent within 30s of abort): residual thrust from the Main Thruster Pod or Vertical Thruster Pair during an aborted ascent could oppose or destabilise the buoyancy-driven ascent, so propulsion must be neutralised well inside the 30s ascent-start window rather than left to coast down independently.

At the 6000 m maximum operating depth (6000m) there is no diver or ROV intervention available, so a seized or shorted thruster must be electrically isolated by the controller itself rather than relying on an operator command; per-channel isolation prevents a single fault from also disabling the healthy channel needed for station-hold or retreat. Mitigates the Functionally Autonomous propulsion fail-safe gap identified in the safety gap review.

The compensated-pack hazard is compensator over-pressure from cell venting, not rupture of a sealed housing (ARC decision ARC-battery); a relief path sized for one venting cell bounds it.

The H-005 safe state removes the main bus and the hotel feed; bounding supply-removal latency and hold-up makes the Abort Watchdog the explicit trigger: 500 ms contactor, 1 s hold-up, 10 s watchdog and 5 s actuation remain inside the SYS-REQ-001 30 s bound. This pack-open abort is listed in SYS-REQ-020.

On a floating bus the first fault is non-hazardous but removes single-fault tolerance; curtailing to recovery restores it, and continuing to power NAV/PRP preserves the controlled-abort capability. The existing per-feeder overcurrent protection (SUB-NRG-077) already handles the second-fault bus short, so no new isolation hardware is introduced.

On a floating bus the first fault is non-hazardous but removes single-fault tolerance; curtailing to recovery restores it, and continuing to power NAV/PRP preserves the controlled-abort capability. The existing per-feeder overcurrent protection (SUB-NRG-077) already handles the second-fault bus short, so no new isolation hardware is introduced.

First-tier response at 60 degrees Celsius (ARC-REQ-016): reducing pack current slows self-heating and may save the dive before the whole pack is dropped. Per-cell bypass isolation in a series string was withdrawn because no component provides it. 2 s remains within the 3 to 5 s cell-to-cell propagation onset.

First-tier response at 60 degrees Celsius (ARC-REQ-016): reducing pack current slows self-heating and may save the dive before the whole pack is dropped. Per-cell bypass isolation in a series string was withdrawn because no component provides it. 2 s remains within the 3 to 5 s cell-to-cell propagation onset.

Directly mitigates H-005: in a compensated pack at depth, runaway cannot be fought by venting or access, so fast electrical isolation is the only mitigation. The pack-open is the escalation tier above the SUB-NRG-017 load reduction and satisfies SYS-REQ-009. The emergency-ascent release is unaffected because it is fed from the SUB-NRG-067 reserve upstream of this contactor.

Directly mitigates H-005: in a compensated pack at depth, runaway cannot be fought by venting or access, so fast electrical isolation is the only mitigation. The pack-open is the escalation tier above the SUB-NRG-017 load reduction and satisfies SYS-REQ-009. The emergency-ascent release is unaffected because it is fed from the SUB-NRG-067 reserve upstream of this contactor.

Mitigates H-010 (thermal runaway or fire during deck charging and exchange): the 90-minute turnaround (STK-REQ-008) puts a 12 kWh lithium pack on deck under charge with crew present; IEC 62619 and UN 38.3 set the cell and transport basis.

The compensated-pack hazard is compensator over-pressure from cell venting, not rupture of a sealed housing (ARC decision ARC-battery); a relief path sized for one venting cell bounds it.

The H-005 safe state removes the main bus and the hotel feed; bounding supply-removal latency and hold-up makes the Abort Watchdog the explicit trigger: 500 ms contactor, 1 s hold-up, 10 s watchdog and 5 s actuation remain inside the SYS-REQ-001 30 s bound. This pack-open abort is listed in SYS-REQ-020. Removing the hotel feed (SUB-NRG-087) and holding no heartbeat-sustaining energy guarantees that the SUB-HUL-059 Abort Watchdog Timer's 10 second heartbeat-loss detection arms and fires emergency ascent after any H-005 pack-open event.

SUB-NRG-077 enumerates per-feeder overcurrent protection for NAV, COM and PRP but omits the Mission Autonomy Computer / hotel feeder, a priority load needed for control and abort. AC-mac-hotel-feeder-01 derives 1.2A/0.75mm^2 from an assumed 45W continuous MAC draw (engineering judgement pending vendor selection) at 48V with the project's established 25% continuous-duty margin, reusing the project's smallest already-validated conductor gauge (0.75mm^2, proven to 2.6A on the COM feeder). Refines SUB-NRG-077 rather than editing it, so the original per-feeder enumeration and its trace history are preserved.

On a floating bus the first fault is non-hazardous but removes single-fault tolerance; curtailing to recovery restores it, and continuing to power NAV/PRP preserves the controlled-abort capability. The existing per-feeder overcurrent protection (SUB-NRG-077) already handles the second-fault bus short, so no new isolation hardware is introduced.

100 kilohm is chosen to detect a first ground fault with wide margin above the low-kilohm region at which a second fault would drive a damaging fault current on the 48 V bus; the 5 s annunciation lets the fault be acted on before a second fault de-energises the priority loads. Derives the concrete detection threshold from the fault-isolation intent of SYS-REQ-009.

A single-point bond stops the hull becoming a parallel return path (galvanic corrosion, stray-current) while still bleeding off static charge, consistent with the floating-bus philosophy.

A floating bus means a single bus-to-hull ground fault produces no fault current and does not de-energise the priority loads (Navigation & Autonomy, Propulsion & Manoeuvring), preserving abort capability; escalation to a bus short requires a second independent fault.

The power ICD needs each main-bus feeder's overcurrent protection, but none is specified for the Navigation & Autonomy, Communications & Recovery or Propulsion & Manoeuvring feeders. Only the Science Payload loads carry per-instrument in-line fuses (realisation decision an earlier realisation finding). SUB-NRG-008 opens the pack contactor on a cell fault (bus-wide, protects the pack) and SUB-NRG-029 sheds Science loads on undervoltage — neither clears a hard short on an individual NAV/PRP/COM feeder. A dead short on one feeder without branch protection can collapse the whole 48 V bus and take down the priority loads. The Independent Thruster Power Interlock (SUB-PRP-074) is a safety de-energisation, not ordinary feeder overcurrent protection.

SUB-NRG-067 provides the dedicated emergency-ascent reserve feeding the Drop-Weight firing circuit, and SUB-HUL-059 has the Abort Watchdog draw on it; without a pre-dive capacity check a depleted or open-circuit reserve is undetected until an abort is attempted, at which point only the slow passive galvanic timeout (SUB-HUL-060) remains (H-002). SUB-COM-040 establishes the same pattern for the beacon reserve.

ARC-REQ-001 and SUB-HUL-059 both require the release to be independently power-fed so it fires with the main bus degraded, yet the firing circuit was once sourced downstream of the pack contactor. A H-005 thermal-runaway pack-open (SUB-NRG-008, within 500 ms) would then de-power both powered emergency-ascent paths, leaving only the slow passive galvanic backstop (SUB-HUL-060) against catastrophic H-002. A dedicated reserve upstream of the contactor makes the independence property real.

Closes the SUB-NRG-029 end-of-reserve gap with a state-of-charge trigger: the 25-minute limit gives a 5-minute margin inside the 30-minute reserve hold and the 10 percent floor bounds a faster-than-expected discharge. Listed in SYS-REQ-020.

Derives from SYS-REQ-008: a battery exchange that requires breaking the primary hull seal cannot meet the 90-minute turnaround target and repeatedly stresses the hull's primary seal, increasing long-term leak risk.

State-of-health tracking lets the mission planner retire a degraded battery bank before a capacity shortfall strands the vehicle mid-survey, closing the loop opened by STK-REQ-005's single-charge mission requirement.

Galvanic isolation prevents shore-power ground faults or surge events from propagating into the vehicle's battery management electronics during recharge between dives.

Post-dive diagnostics are the primary means of detecting cell degradation before it manifests as an in-dive thermal fault; without logged history, capacity fade goes undetected until failure. Verification method updated from Inspection to Test — logging continuity and retention depth are dynamic behaviours over a full dive duration, not static configuration facts, so a run-and-retrieve test is the appropriate method.

A rigid 1 atm vessel for the battery at 620 bar adds substantial mass; pressure compensation is standard deep-sea practice (ARC-REQ-016). Cell venting inside the oil volume is relieved by SUB-NRG-107.

Downstream avionics and thruster controllers are rated to a narrow input tolerance; tight bus regulation prevents brownout-induced resets during peak-thrust current transients.

Undervoltage logic is keyed to reported state-of-charge, not to the regulated bus, which SUB-NRG-030 never lets fall while regulation holds (ARC-REQ-023). The retained set is every load needed to navigate, communicate and withdraw to a safe recovery condition.

Unbalanced cells reduce usable capacity and accelerate the thermal/voltage excursions mitigated by the SUB-NRG-008 contactor-isolation fault path; balancing keeps the full string within monitored safe bounds between dives.

Derives pack sizing from the 8-hour survey duration plus a 20% margin for off-nominal loads such as extended search time or thermal derating at the 6000 m maximum operating depth; undersizing risks a premature low-voltage cutoff mid-survey.

Supports early detection of the signatures that precede thermal runaway (H-005); 10 Hz protection sampling bounds detection latency at 100 ms so the SYS-REQ-009 500 ms isolation chain closes (analysis case AC-06).

First-tier response at 60 degrees Celsius (ARC-REQ-016): reducing pack current slows self-heating and may save the dive before the whole pack is dropped. Per-cell bypass isolation in a series string was withdrawn because no component provides it. 2 s remains within the 3 to 5 s cell-to-cell propagation onset.

Derived from SYS-REQ-005's 8-hour endurance requirement: the mission autonomy computer relies on an accurate state-of-charge figure to decide when a return-to-surface margin must be reserved, so state-of-charge error must be small relative to the reserve margin planned against the 8-hour budget.

Directly mitigates H-005: in a compensated pack at depth, runaway cannot be fought by venting or access, so fast electrical isolation is the only mitigation. The pack-open is the escalation tier above the SUB-NRG-017 load reduction and satisfies SYS-REQ-009. The emergency-ascent release is unaffected because it is fed from the SUB-NRG-067 reserve upstream of this contactor.

SYS-REQ-010 to SYS-REQ-015 and SYS-REQ-020 together define the complete transition table; the Mission Autonomy Computer already holds mission authority (SUB-NAV-056) and aggregates status (SUB-NAV-057), so it owns the mode logic.

The mode-transition triggers are SYS-REQ-010 to SYS-REQ-015 and, after the singularity split, SYS-REQ-024, SYS-REQ-025, SYS-REQ-027, SYS-REQ-028, SYS-REQ-029 and SYS-REQ-030, with the autonomous aborts of SYS-REQ-020; together they are the complete transition table.

SUB-NAV-020/093 realised a redundant AHRU but defined no comparison logic, so the redundancy was latent -- an undetected INU attitude fault had no fallback trigger. 2.0 degrees is set against the AHRU's own SUB-NAV-020/VER-ISI-034 0.5 degree (1-sigma) accuracy budget: at 3-sigma (1.5 degrees) plus margin for the higher-grade INU's own noise floor, 2.0 degrees bounds normal dual-sensor noise while still catching a real INU fault; 5 seconds filters transient glitches without materially delaying detection. INU governs by default because it is the primary, higher-grade sensor; on declared divergence the AHRU takes over, which stays within the SUB-NAV-020 0.5 degree design point already sized to keep thruster-vector error inside the propulsion station-keeping tolerance, so no separate speed reduction is needed. A subsequent AHRU failure with the INU fault still open removes all attitude reference, which is folded into the existing SUB-NAV-075 nav-loss withdrawal rather than a new fault tree.

SUB-NAV-020/093 realised a redundant AHRU but defined no comparison logic, so the redundancy was latent -- an undetected INU attitude fault had no fallback trigger. 2.0 degrees is set against the AHRU's own SUB-NAV-020/VER-ISI-034 0.5 degree (1-sigma) accuracy budget: at 3-sigma (1.5 degrees) plus margin for the higher-grade INU's own noise floor, 2.0 degrees bounds normal dual-sensor noise while still catching a real INU fault; 5 seconds filters transient glitches without materially delaying detection. INU governs by default because it is the primary, higher-grade sensor; on declared divergence the AHRU takes over, which stays within the SUB-NAV-020 0.5 degree design point already sized to keep thruster-vector error inside the propulsion station-keeping tolerance, so no separate speed reduction is needed. A subsequent AHRU failure with the INU fault still open removes all attitude reference, which is folded into the existing SUB-NAV-075 nav-loss withdrawal rather than a new fault tree.

SUB-NAV-020/093 realised a redundant AHRU but defined no comparison logic, so the redundancy was latent -- an undetected INU attitude fault had no fallback trigger. 2.0 degrees is set against the AHRU's own SUB-NAV-020/VER-ISI-034 0.5 degree (1-sigma) accuracy budget: at 3-sigma (1.5 degrees) plus margin for the higher-grade INU's own noise floor, 2.0 degrees bounds normal dual-sensor noise while still catching a real INU fault; 5 seconds filters transient glitches without materially delaying detection. INU governs by default because it is the primary, higher-grade sensor; on declared divergence the AHRU takes over, which stays within the SUB-NAV-020 0.5 degree design point already sized to keep thruster-vector error inside the propulsion station-keeping tolerance, so no separate speed reduction is needed. A subsequent AHRU failure with the INU fault still open removes all attitude reference, which is folded into the existing SUB-NAV-075 nav-loss withdrawal rather than a new fault tree.

SUB-NAV-075 (nav-loss) and SUB-NAV-083 (obstacle-detection-loss) specify the same withdrawal manoeuvre but derive the last-known bearing from different sources -- 075 from the dead-reckoned estimate (since the fused solution itself is gone), 083 from the still-valid fused solution (since only the sonar is lost) -- and each runs its own 60s timer, with no merge rule for the case where both fail together. This requirement resolves the ambiguity: SUB-NAV-075 governs because it is the more degraded case (no valid nav solution exists to derive a bearing from at all, so 083's assumption that the fused solution remains available to steer the withdrawal does not hold), and a single shared timer anchored to the earlier loss prevents two independently-running clocks from producing conflicting abort decisions, preserving the intended 60s safety margin against vent-structure collision.

SUB-NAV-075 (nav-loss) and SUB-NAV-083 (obstacle-detection-loss) specify the same withdrawal manoeuvre but derive the last-known bearing from different sources -- 075 from the dead-reckoned estimate (since the fused solution itself is gone), 083 from the still-valid fused solution (since only the sonar is lost) -- and each runs its own 60s timer, with no merge rule for the case where both fail together. This requirement resolves the ambiguity: SUB-NAV-075 governs because it is the more degraded case (no valid nav solution exists to derive a bearing from at all, so 083's assumption that the fused solution remains available to steer the withdrawal does not hold), and a single shared timer anchored to the earlier loss prevents two independently-running clocks from producing conflicting abort decisions, preserving the intended 60s safety margin against vent-structure collision.

A conservative fail-safe (assume obstacle-present and retreat) preserves the 2 m barrier when the sonar can no longer confirm clearance; the 10 m standoff, reciprocal-bearing withdrawal and 60 s abort timeout deliberately reuse the SUB-NAV-075 navigation-loss response so the two loss modes converge on one behaviour. Listed in SYS-REQ-020.

A conservative fail-safe (assume obstacle-present and retreat) preserves the 2 m barrier when the sonar can no longer confirm clearance; the 10 m standoff, reciprocal-bearing withdrawal and 60 s abort timeout deliberately reuse the SUB-NAV-075 navigation-loss response so the two loss modes converge on one behaviour. Listed in SYS-REQ-020.

A conservative fail-safe (assume obstacle-present and retreat) preserves the 2 m barrier when the sonar can no longer confirm clearance; the 10 m standoff, reciprocal-bearing withdrawal and 60 s abort timeout deliberately reuse the SUB-NAV-075 navigation-loss response so the two loss modes converge on one behaviour. Listed in SYS-REQ-020.

A conservative fail-safe (assume obstacle-present and retreat) preserves the 2 m barrier when the sonar can no longer confirm clearance; the 10 m standoff, reciprocal-bearing withdrawal and 60 s abort timeout deliberately reuse the SUB-NAV-075 navigation-loss response so the two loss modes converge on one behaviour. Listed in SYS-REQ-020.

Without self-monitoring a silent no-return or a stuck or false-clear reading is indistinguishable from a genuine clear and defeats the standoff barrier undetected; the 3 s window matches the fused-navigation loss window of SUB-NAV-075 so detection latency is consistent across the collision-avoidance chain.

The single loss-of-navigation response (ARC-REQ-014): under vent-field currents up to 1.0 m/s (SUB-PRP-048) a zero-thrust hold drifts into structure and a 1 m/min active hold is unachievable, so a dead-reckoned withdrawal to the same 10 m standoff SUB-PRP-048 uses is the only response that is both safe near structure and achievable. 3 s matches the DVL reacquisition window; 60 s bounds dead-reckoning drift before committing to the SYS-REQ-001 abort.

The single loss-of-navigation response (ARC-REQ-014): under vent-field currents up to 1.0 m/s (SUB-PRP-048) a zero-thrust hold drifts into structure and a 1 m/min active hold is unachievable, so a dead-reckoned withdrawal to the same 10 m standoff SUB-PRP-048 uses is the only response that is both safe near structure and achievable. 3 s matches the DVL reacquisition window; 60 s bounds dead-reckoning drift before committing to the SYS-REQ-001 abort.

The single loss-of-navigation response (ARC-REQ-014): under vent-field currents up to 1.0 m/s (SUB-PRP-048) a zero-thrust hold drifts into structure and a 1 m/min active hold is unachievable, so a dead-reckoned withdrawal to the same 10 m standoff SUB-PRP-048 uses is the only response that is both safe near structure and achievable. 3 s matches the DVL reacquisition window; 60 s bounds dead-reckoning drift before committing to the SYS-REQ-001 abort.

The Mission Autonomy Computer holds unsupervised authority near active vents and the support ship's recovery operations; bounding it to the approved envelope prevents an unreviewed decision creating a hazard, while the named contingency responses are part of the envelope so that safety responses never wait for a command (ARC-REQ-022).

The Mission Autonomy Computer holds unsupervised authority near active vents and the support ship's recovery operations; bounding it to the approved envelope prevents an unreviewed decision creating a hazard, while the named contingency responses are part of the envelope so that safety responses never wait for a command (ARC-REQ-022).

SYS-REQ-010 to SYS-REQ-015 and SYS-REQ-020 together define the complete transition table; the Mission Autonomy Computer already holds mission authority (SUB-NAV-056) and aggregates status (SUB-NAV-057), so it owns the mode logic.

SUB-NAV-020/093 realised a redundant AHRU but defined no comparison logic, so the redundancy was latent -- an undetected INU attitude fault had no fallback trigger. 2.0 degrees is set against the AHRU's own SUB-NAV-020/VER-ISI-034 0.5 degree (1-sigma) accuracy budget: at 3-sigma (1.5 degrees) plus margin for the higher-grade INU's own noise floor, 2.0 degrees bounds normal dual-sensor noise while still catching a real INU fault; 5 seconds filters transient glitches without materially delaying detection. INU governs by default because it is the primary, higher-grade sensor; on declared divergence the AHRU takes over, which stays within the SUB-NAV-020 0.5 degree design point already sized to keep thruster-vector error inside the propulsion station-keeping tolerance, so no separate speed reduction is needed. A subsequent AHRU failure with the INU fault still open removes all attitude reference, which is folded into the existing SUB-NAV-075 nav-loss withdrawal rather than a new fault tree.

SUB-NAV-020 mandates a redundant attitude reference independent of the primary INU, but no physical device or power feed was ever allocated. The only NAV secondary rail (SUB-NAV-088) feeds the DVL, INU and Obstacle Avoidance Sonar from one shared 24 V rail and converter; placing the redundant reference there would put a single converter/rail fault between both attitude sources, defeating the independence SUB-NAV-020 requires against H-006 uncontrolled drift near vent structures during station-keeping. A dedicated converter fed directly from the 48 V main bus, distinct from SUB-NAV-088's converter, restores genuine hardware-fault independence at the cost of one additional small DC-DC module.

SUB-NAV-088 feeds DVL, INU and Obstacle Avoidance Sonar from one shared 24V rail and DC-DC converter with no per-load protection, so a short on any one load's wiring would pull down the whole rail. That matters because SUB-NAV-086's dual-timer merge logic is designed around the fused INS+DVL solution and the sonar detection failing independently (SUB-NAV-075 vs SUB-NAV-083/ARC-REQ-009); an unprotected shared rail means a single load-level fault -- not a genuine independent double failure -- would trivially produce the worst-case concurrent-loss abort path every time, defeating the purpose of having distinct single-loss responses. Per-load fuses/breakers restore that independence for load faults. Converter redundancy was considered and rejected: a fault in the shared converter itself is a legitimate trigger for the SUB-NAV-086 concurrent-loss response (that is precisely the failure mode it exists to handle), and duplicating the converter would cost mass/power budget for no isolation benefit beyond what per-load fusing already provides, consistent with the redundancy trade-offs already made in ARC-REQ-002 and ARC-REQ-004. Verified by fault-injection test: short each load branch in turn and confirm only that branch's protection device trips while the other two loads remain powered.

Only the Mission Autonomy Computer is stated to run at 48V direct; the DVL, INU and Obstacle Avoidance Sonar had no specified supply rail or DC-DC conversion, leaving the SYS-REQ-005/SUB-NRG-027 energy budget unable to account for their primary-side draw. AC-nav-secondary-rail-01 derives a shared 24V secondary rail sized to DVL 15W + INU 8W + Sonar 12W (12W fixed by SUB-NAV-012) = 35W secondary-side, at 90% converter efficiency typical of a switched marine-rated DC-DC module, giving 38.9W (~0.81A) primary-side draw against the 12kWh/8h budget.

SUB-NAV-075 (nav-loss) and SUB-NAV-083 (obstacle-detection-loss) specify the same withdrawal manoeuvre but derive the last-known bearing from different sources -- 075 from the dead-reckoned estimate (since the fused solution itself is gone), 083 from the still-valid fused solution (since only the sonar is lost) -- and each runs its own 60s timer, with no merge rule for the case where both fail together. This requirement resolves the ambiguity: SUB-NAV-075 governs because it is the more degraded case (no valid nav solution exists to derive a bearing from at all, so 083's assumption that the fused solution remains available to steer the withdrawal does not hold), and a single shared timer anchored to the earlier loss prevents two independently-running clocks from producing conflicting abort decisions, preserving the intended 60s safety margin against vent-structure collision.

The station-keeping loop was drawable end-to-end from sensor rates and the IFC-ISI-005 100ms command-to-actuation latency bound, but the outer-loop closure rate itself — what actually governs disturbance rejection against the SUB-PRP-007/024 0.5 m/s cross-current — was unspecified. Drift-budget analysis (ac-nav-loop-rate-budget): at 0.5 m/s, one loop period plus the 100ms actuation latency at 5 Hz bounds uncorrected drift to <=0.15 m, half of the tightest 0.3 m SUB-PRP-007 tolerance; 5 Hz also matches the DVL aiding update rate so no cycle recomputes on stale velocity data. Verified by control-loop simulation against the current and latency budget.

A conservative fail-safe (assume obstacle-present and retreat) preserves the 2 m barrier when the sonar can no longer confirm clearance; the 10 m standoff, reciprocal-bearing withdrawal and 60 s abort timeout deliberately reuse the SUB-NAV-075 navigation-loss response so the two loss modes converge on one behaviour. Listed in SYS-REQ-020.

Without self-monitoring a silent no-return or a stuck or false-clear reading is indistinguishable from a genuine clear and defeats the standoff barrier undetected; the 3 s window matches the fused-navigation loss window of SUB-NAV-075 so detection latency is consistent across the collision-avoidance chain.

The single loss-of-navigation response (ARC-REQ-014): under vent-field currents up to 1.0 m/s (SUB-PRP-048) a zero-thrust hold drifts into structure and a 1 m/min active hold is unachievable, so a dead-reckoned withdrawal to the same 10 m standoff SUB-PRP-048 uses is the only response that is both safe near structure and achievable. 3 s matches the DVL reacquisition window; 60 s bounds dead-reckoning drift before committing to the SYS-REQ-001 abort.

States the Fault/Station-hold exit at mode level with the same 60 s timer SUB-NAV-075 runs from the moment of loss, so there is one timer on one condition (ARC-REQ-014).

SYS-REQ-006 requires sustained status telemetry transmission, but no existing requirement specifies where the transmitted content originates; without a defined aggregation point and update rate, the Acoustic Modem's transmission requirements (SUB-COM-023, SUB-COM-039) have no defined payload to carry.

The Mission Autonomy Computer holds unsupervised authority near active vents and the support ship's recovery operations; bounding it to the approved envelope prevents an unreviewed decision creating a hazard, while the named contingency responses are part of the envelope so that safety responses never wait for a command (ARC-REQ-022).

Post-dive reconstruction of vent-proximity events is needed to confirm standoff compliance and investigate any anomaly; this directly supports the mission controller's situational-awareness need in STK-REQ-006.

Both sensors are active acoustic devices operating concurrently during survey; frequency overlap would degrade range accuracy on the sonar used for the 2.5 m chimney standoff trigger in SUB-NAV-002.

The survey profile ranges from close-proximity vent inspection (sub-1 m altitude) to transit (tens of metres); a DVL that loses lock outside this band would force reliance on dead-reckoning during exactly the phases where SUB-NAV-021's 0.1% drift budget matters most.

Bounds fused navigation error so the vehicle can maintain the SYS-REQ-004 2 m standoff over a multi-hour dive with no GPS at depth; the condition is DVL bottom-lock (SUB-NAV-049) because dead-reckoning on the inertial unit alone cannot meet it.

Provides a fallback attitude source so a single INS fault does not remove the attitude information needed for safe station-keeping near vent structures (H-006); 0.5 deg keeps thruster vector errors below the propulsion subsystem's station-keeping tolerance.

SYS-REQ-005 requires 8 hours of continuous survey-power operation from a single battery charge, and the Obstacle Avoidance Sonar per SUB-NAV-002 must ping continuously throughout vent-field survey to maintain the 2.5m standoff trigger — an unbudgeted continuous sonar draw would erode survey endurance margin unpredictably. 12W reflects a typical forward-looking obstacle-avoidance sonar transducer and processing draw at continuous ping rate, allocated against the Energy Storage subsystem's regulated DC bus delivered via IFC-ISI-004.

Provides a 0.5m early-warning margin ahead of the SYS-REQ-004/SYS-REQ-004 2m hard standoff limit, giving the propulsion subsystem time to arrest closing velocity before the limit is reached.

Mitigates H-013 (unintended weight release on deck); a mechanical pin plus electrical inhibit covers both the autonomous and the commanded firing paths while crew work around the vehicle.

Mitigates H-013 (unintended weight release on deck); a mechanical pin plus electrical inhibit covers both the autonomous and the commanded firing paths while crew work around the vehicle.

SUB-HUL-076 makes ingress-triggered drop-weight release the only fast (<=10 s) in-service response to a developing leak, and SUB-NRG-067 already reserve-feeds the firing circuit upstream of the pack contactor so a thermal-runaway pack-open cannot silence it -- but the ingress DETECTION sensors and trip logic had no defined power source. Water ingress is itself a credible cause of a hard bus-to-hull fault, which SUB-NRG-077/081's per-feeder overcurrent protection clears by de-energising that feeder; if the detector sits on a main-bus feeder, the very flood it exists to detect can de-power it before the 10 s response completes, and the passive galvanic backstop (SUB-HUL-060) only fires on a slow maximum-immersion timeout and cannot substitute on this timescale. Feeding the detector from the same reserve as the firing circuit closes that gap with no new hardware class.

H-001 has no active safe state against sudden implosion, but a developing penetrator or seal leak is detectable: autonomous ascent on detection converts that case into a recoverable ascent, with the 10 s detect-to-command bound keeping accumulated ingress small before the SYS-REQ-001 ascent completes.

H-001 has no active safe state against sudden implosion, but a developing penetrator or seal leak is detectable: autonomous ascent on detection converts that case into a recoverable ascent, with the 10 s detect-to-command bound keeping accumulated ingress small before the SYS-REQ-001 ascent completes.

Mitigates H-013 (unintended weight release on deck); a mechanical pin plus electrical inhibit covers both the autonomous and the commanded firing paths while crew work around the vehicle.

Gives the Descent mode its mechanism (ARC decision ARC-buoyancy); a powered descent at no more than 1.0 m/s then needs only steering thrust, saving endurance for the survey.

Design-margin half of the pressure-boundary basis (ARC decision ARC-depth); the proof half is the 775 bar test in SYS-REQ-007. Separating collapse (analysis) from proof (test) removes the earlier confusion of testing to the full design margin.

SUB-HUL-076 committed to autonomous emergency ascent on a 'defined threshold' that was never defined, leaving the moisture sensors with no setpoint despite the threshold trading off a missed developing leak (H-001 catastrophic) against a spurious autonomous ascent that aborts the mission. 80 percent RH is set well above the 40 percent desiccant-maintained baseline typical of sealed pressure-tolerant electronics housings, giving a 40-point false-trip margin against normal internal humidity while still catching a developing leak well before condensation or free water forms; free-water detection is a binary condition so its threshold is presence itself, with a 2-sample (2 s) debounce to reject a single transient condensation droplet on the probe. 5-sample (5 s) humidity debounce filters slow normal humidity drift (e.g. thermal cycling) while remaining small relative to the SUB-HUL-076 10 s detect-to-command budget.

SUB-HUL-076 makes ingress-triggered drop-weight release the only fast (<=10 s) in-service response to a developing leak, and SUB-NRG-067 already reserve-feeds the firing circuit upstream of the pack contactor so a thermal-runaway pack-open cannot silence it -- but the ingress DETECTION sensors and trip logic had no defined power source. Water ingress is itself a credible cause of a hard bus-to-hull fault, which SUB-NRG-077/081's per-feeder overcurrent protection clears by de-energising that feeder; if the detector sits on a main-bus feeder, the very flood it exists to detect can de-power it before the 10 s response completes, and the passive galvanic backstop (SUB-HUL-060) only fires on a slow maximum-immersion timeout and cannot substitute on this timescale. Feeding the detector from the same reserve as the firing circuit closes that gap with no new hardware class.

The junction box is a second pressure boundary outside the hull and carries the same collapse and proof factors as the hull (ARC-REQ-012). A dry enclosure is required because the SUB-HUL-076 ingress detection measures humidity, which has no meaning in an oil-filled volume; an oil-filled box was considered and rejected on that basis.

H-001 has no active safe state against sudden implosion, but a developing penetrator or seal leak is detectable: autonomous ascent on detection converts that case into a recoverable ascent, with the 10 s detect-to-command bound keeping accumulated ingress small before the SYS-REQ-001 ascent completes.

SUB-COM-010 requires USBL position reporting independent of Acoustic Modem availability; a shared feedthrough would be a single flood common-cause defeating tracking, telemetry and the SUB-COM-041 abort uplink together. Physical separation at the pressure boundary gives defence-in-depth for H-003 recovery and the SYS-REQ-001 abort chain.

One penetration schedule covering every wet interface (ARC-REQ-019): the earlier 6-item budget had no feedthrough for the DVL, sonar, beacons or chemistry suite. Dissimilar circuits (acoustic, power, firing) are not bundled in shared connectors.

A near-neutral survey trim keeps the continuous vertical-thrust hold load small (about 100 W) within the SUB-NRG-027 energy budget; descent is 40 kg negative with the descent weight fitted (SUB-HUL-105) and ascent 60 kg positive after jettison (SUB-HUL-043), per ARC-REQ-020.

Defence in depth proportionate to catastrophic H-002 at a depth where no rescue is possible: a dissolving galvanic link needs no power and no logic. The 24 h interval is 2.5 times the longest valid dive including a degraded post-fault loiter (analysis case AC-immersion-timeout-margin) and the tolerance band covers galvanic rate variation with temperature and salinity at depth; production links are soak-tested to it.

ARC-REQ-001 forbids any software-dependent element in the one abort path that must work when everything else has failed, yet SUB-HUL-001 and IFC-ISI-003 route every trigger through the Mission Autonomy Computer, so a computer failure would defeat the sole emergency-ascent mechanism (H-002). A hardware deadman that fires on cessation of the heartbeat restores the independence property: 10 s rides through a watchdog reboot yet fires before uncontrolled drift (H-006) carries the vehicle into a chimney, and 10 s hold-off plus 5 s actuation (SUB-HUL-001) plus buoyant transit remains within the SYS-REQ-001 30 s bound.

Every penetration is a leak path; the schedule in SUB-HUL-066 covers every wet interface the vehicle actually has (ARC-REQ-019) and each penetrator carries the same 1.25 proof factor as the hull (SYS-REQ-007).

Aligns the corrosion life with the 2,000-cycle fatigue life of SUB-HUL-016 so the hull has one design life. Titanium alloys are near-immune to crevice attack at 1 to 4 degrees Celsius, so the hull requirement is a confirmation; the aggressive plume environment seen by externally exposed science parts is covered separately by SUB-SCI-110.

60 kg net positive buoyancy on a nose-up ascent gives the 0.5 m/s mean ascent rate of SYS-REQ-018; the 15 kg margin keeps SYS-REQ-001's ascent-start from being jeopardised by flooding or fouling (analysis case AC-03).

Fatigue is a separate failure mode from collapse (SUB-HUL-104) and is bounded by cycles and a life factor, not by a static yield safety factor; 2,000 cycles covers a multi-year campaign at typical dive cadence, and the same 2,000-dive life is used for corrosion (SUB-HUL-044).

Bounds long-duration seepage that could accumulate to a slow pressure-boundary breach (H-001); 5 mL/hr keeps ingress over an 8-hour dive (SYS-REQ-005) within the hull's internal moisture-tolerance margin.

Allocates a 5s actuation budget out of SYS-REQ-001's 30s total abort-to-ascent bound, leaving the remaining ~25s for buoyant transit to positive net buoyancy; drives the mechanism/actuator selection for the release.

Bounds time-to-recovery (H-003): a 60 s AIS update resolves surface drift to within crane-approach tolerance, the 406 MHz alert gives an independent third-party search-and-rescue path, and 48 hours covers a worst-case weather hold before recovery.

The ARC-REQ-011 electrical-independence decision. SUB-HUL-073 gave the two paths independent pressure penetrations (flood independence) but SUB-NRG-077 treats Communications & Recovery as one feeder, leaving a shared power/board common-cause that defeats SUB-COM-010's independence intent. Branch-level electrical plus board independence closes it; defence-in-depth for the SYS-REQ-001 abort uplink and H-003 recovery.

Independent power sourcing preserves the redundancy intent of the dual recovery path; a shared reserve battery would create a common-mode failure that defeats the purpose of adding the Iridium module.

SYS-REQ-006 covers downlink telemetry only; a separate uplink is required so the support ship retains a positive abort-command path even while the downlink is saturated with telemetry, supporting the 30-second abort response of SYS-REQ-001.

The beacon is the terminal safe state for the H-002/H-003 hazard chain; a latent beacon fault must be caught pre-dive, when it is still recoverable, rather than discovered only after an emergency ascent.

Acoustic links in vent fields are prone to intermittent dropout from thermal plume turbulence and bubble scattering; buffering avoids permanent data loss for short outages and supports STK-REQ-006's continuous situational-awareness need.

Hydrothermal vent surveys are frequently multi-asset operations (support ship sonar, other AUVs); an unaddressed transponder risks position ambiguity or mutual interference.

Acoustic and satellite recovery aids bring the support ship within visual range, but final approach and hook-up in darkness requires a visual aid; this is standard practice for AUV surface recovery.

The Iridium module reports on its own schedule (SYS-REQ-002); the fault flag tells the support ship the local AIS/VHF beacon cannot be relied on for final approach. The 2-minute trigger sits inside the 5-minute system bound.

H-003 (critical) needs two independent paths: a fault in the Emergency Surface Beacon after surfacing would otherwise strand the vehicle. The Iridium module is orbit-diverse, carries its own GNSS receiver and is independently powered (SUB-COM-042).

Bounds time-to-recovery (H-003): a 60 s AIS update resolves surface drift to within crane-approach tolerance, the 406 MHz alert gives an independent third-party search-and-rescue path, and 48 hours covers a worst-case weather hold before recovery.

Bounds unsupervised operation after a communications outage (H-003): 30 minutes exceeds typical multipath dropout in vent-plume turbulence while staying within the endurance margin. The abort is the drop-weight ascent because the vehicle has no variable buoyancy for a partial climb (ARC-REQ-022).

Derived from SYS-REQ-002's 5-minute post-surfacing GPS fix requirement: a single activation path (the mechanical switch alone) is a single point of failure for the recovery beacon at exactly the moment recovery depends on it, so a second, functionally independent trigger path is added without weakening the primary.

A USBL interrogate-reply cycle cannot repeat faster than the two-way acoustic travel time (9.3 s at 7 km); the transponder's own contribution is its reply latency, which is what the vehicle controls (ARC-REQ-013). Tracking independent of the data link lets the support ship call an abort during a capture manoeuvre near a vent (SYS-REQ-004).

The Recovery Hardpoint is the post-mission load path; 1,800 kg is the mass budget's fully flooded recovery mass (analysis case AC-03) and a 2.0 dynamic factor is standard marine lifting practice (DNV-ST-N001) for wave-induced snap loads. A manual latch avoids dependence on powered deck equipment during a degraded recovery.

Cross-subsystem power CONNECTS edges from the Power Management Unit to three Science Payload instruments existed with no declared corridor; an unfused or mis-shed load at this boundary could brown out shared SCI power rails or propagate an instrument fault back into the energy-storage bus, so the interface and its per-instrument protection scheme need an explicit requirement.

The Navigation & Autonomy <-> Communications & Recovery link is Digital/Virtual and carries abort and mission-control commands over an open acoustic channel; an unauthenticated command path would let a spoofed or corrupted acoustic message trigger an unintended abort or manoeuvre, so message authentication is required to close this cybersecurity gap flagged by ontological lint.

Prevents a charging fault from coupling onto the live bus while the vehicle is powered, and prevents inadvertent thrust or navigation activity while the vehicle is docked for charging.

Cross-subsystem CONNECTS between the Mission Autonomy Computer and three Science Payload components existed with no declared corridor; 1 Mbps is sized to carry compressed HD imagery alongside chemistry and capture-control traffic without buffering delay that would risk missing a capture window.

IFC-ISI-026 specified the link margin qualitatively as 'sufficient', which cannot be verified or drawn. 33 dB-Hz C/N0 is the standard minimum carrier-to-noise threshold for reliable GPS position-fix acquisition used by commercial GNSS receivers (e.g. u-blox M8/M10-class), and 3 dB is the typical rated link margin specified for Iridium 9602/9603-class Short Burst Data transceivers to guarantee message delivery against multipath and sea-state fading at the surface. Quantifying both gives the antenna and RF budget a verifiable target and closes the untoleranced-quantity gap.

The Recovery Hardpoint is the post-mission load path; 1,800 kg is the mass budget's fully flooded recovery mass (analysis case AC-03) and a 2.0 dynamic factor is standard marine lifting practice (DNV-ST-N001) for wave-induced snap loads. A manual latch avoids dependence on powered deck equipment during a degraded recovery.

The Surface Beacon Antenna EBS_NODE (the RF radiator combining GNSS reception and Iridium transmission) existed with no bound SUB/SYS/IFC requirement; SUB-COM-022 fixes the 60-second GPS transmission cadence but never specifies the RF interface that makes that cadence physically achievable. This closes that gap and grounds SUB-COM-022's cadence in an achievable link budget.

Cross-subsystem power CONNECTS edges from the Power Management Unit to three Science Payload instruments existed with no declared corridor; an unfused or mis-shed load at this boundary could brown out shared SCI power rails or propagate an instrument fault back into the energy-storage bus, so the interface and its per-instrument protection scheme need an explicit requirement.

IFC-ISI-006 set a >=1 Mbps combined imagery+chemistry return rate with no physical bearer specified, and the placeholder 'serial' bearer is two-to-three orders of magnitude too slow. CAN (MAC<->TMC) and RS-422 (DVL/INU<->MAC) are the only precedent bearers on this vehicle and both are unsuitable for this rate. 100BASE-TX Ethernet gives >90x headroom over the 1 Mbps floor for compression-ratio variance and burst telemetry, and Ethernet-over-wet-mate connector is standard practice for HD video downlink on comparable full-ocean-depth ROV/AUV science payloads. Verified by link throughput test at operating pressure.

The deadman triggers only work if the arming signal is heartbeat absence; one source on a dedicated path with two hardware consumers keeps a single interface fault from taking down both the normal abort command and the watchdog arming, and gives the interlock (SUB-PRP-096) its heartbeat (ARC-REQ-024). 5 Hz gives the 10 s watchdog threshold 50 beats of margin.

The firing circuit is fed from the dedicated reserve (SUB-NRG-067) upstream of the pack contactor so that a H-005 pack-open does not de-power the emergency-ascent paths and the SUB-HUL-059 and ARC-REQ-001 independence property holds through the SYS-REQ-001 30 s abort bound.

The Navigation & Autonomy <-> Communications & Recovery link is Digital/Virtual and carries abort and mission-control commands over an open acoustic channel; an unauthenticated command path would let a spoofed or corrupted acoustic message trigger an unintended abort or manoeuvre, so message authentication is required to close this cybersecurity gap flagged by ontological lint.

The Drop-Weight Release is the primary abort actuator (SUB-HUL-001); its firing circuits are fed from the dedicated reserve upstream of the pack contactor (SUB-NRG-067, IFC-ISI-022), not from the Power Management Unit, and a single-circuit interface would be a single point of failure for the SYS-REQ-001 ascent.

Quantifies SUB-PRP-047's broadband limit per receiving band so the interference bound can be measured: the values sit at least 10 dB below the receivers' in-band detection thresholds at the ranges used (analysis case AC-05).

Bounds the Energy Storage contribution to the 90-minute combined turnaround budget of SYS-REQ-008, consistent with SUB-NRG-055's quick-disconnect requirement.

Bounds the Science Payload contribution to the 90-minute combined turnaround budget of SYS-REQ-008, consistent with SUB-SCI-053's quick-disconnect requirement.

Directly enables SUB-SCI-054's geotagging accuracy requirement by bounding the timeliness and accuracy of the navigation data the camera receives.

Excessive relative displacement between the hull and its externally-mounted foam pack would fatigue the mounting hardware over repeated dive cycles and could compromise the 2,000-cycle fatigue life target of SUB-HUL-016.

Station-keeping control loops (SUB-PRP-007) require high-rate attitude feedback; a slow attitude interface would introduce control lag during close-proximity manoeuvring near vent chimneys.

The fused navigation solution's 0.1% drift budget (SUB-NAV-021) depends on timely DVL velocity updates; a slower or higher-latency feed would degrade dead-reckoning accuracy between fixes.

Scopes this interface to the modem-to-computer hop it governs; acoustic propagation and framing belong to the end-to-end abort latency of SYS-REQ-017 (ARC-REQ-013).

The redundant-reporting requirement (10-minute GPS-loss trigger, 5-minute Iridium reporting cadence) depends on the Iridium module receiving timely fault status from the beacon's GPS receiver.

Prevents a charging fault from coupling onto the live bus while the vehicle is powered, and prevents inadvertent thrust or navigation activity while the vehicle is docked for charging.

Fast fault reporting from the BMS to the PMU is required to meet the 500 ms contactor-isolation deadline (SUB-NRG-008) and the 5-second load-shed deadline; the data path must be faster than the response deadlines it feeds.

One power-quality contract with SUB-NRG-030 (ARC-REQ-023): the Thruster Motor Controller is the largest step load on the bus, so the transient allowance is bounded in both depth and duration and the Power Management Unit's sizing and the controller's brownout tolerance are jointly verifiable.

Cross-subsystem CONNECTS between the Mission Autonomy Computer and three Science Payload components existed with no declared corridor; 1 Mbps is sized to carry compressed HD imagery alongside chemistry and capture-control traffic without buffering delay that would risk missing a capture window.

Cross-subsystem control CONNECTS to both thruster components existed with no declared corridor; 100ms keeps the closed-loop station-keeping bandwidth well above the vehicle's dynamic response requirements for holding standoff near vent chimneys.

Cross-subsystem power CONNECTS to the Mission Autonomy Computer existed with no declared corridor; a 10ms interruption ceiling is derived from the autonomy computer's watchdog reset threshold, below which an unplanned dropout would force a mission-aborting reboot.

Cross-subsystem control CONNECTS from the Mission Autonomy Computer to the Drop-Weight Release existed with no declared corridor; the 200ms bound is a small fraction of SUB-HUL-001's 5s actuation budget so command latency does not erode the SYS-REQ-001 abort timeline.

Gives the modem feed the same numeric bus tolerance as SUB-NRG-030; an under- or over-voltage feed at this boundary would silently degrade acoustic transmit power.

Cross-subsystem CONNECTS between the Mission Autonomy Computer and Acoustic Modem existed at component level with no declared subsystem-level corridor; the rate matches SUB-COM's SYS-REQ-006 acoustic link floor so the internal interface is never the bottleneck.

Documentation convention; replaces an earlier record that carried working-session detail and stale counts.

Closes the heartbeat consumer mismatch.

One power-quality contract and a reachable undervoltage trigger.

Makes abort semantics single and testable.

Closes the station-keeping gap and the thrust-versus-drag relation the review found uncomputed.

Gives descent and ascent a mechanism and a budget.

Resolves the penetration budget and the breakdown structure describing different vehicles.

States the safety and standards basis the review found absent.

Names the bearer behind each surface-recovery path so the timings and the hazard argument can be checked.

Resolves the contradictory battery-location statements and the unachievable per-cell isolation chain the review found.

Reconciles the stakeholder no-contact need with the deployable probe concept.

Closes the navigation-loss supersession the review found still live, verified and used as a hazard mitigation.

The review showed the acoustic timing figures ignored propagation delay; this record fixes the slant range and sound-speed basis every acoustic requirement now derives from.

Records the depth basis the review found missing: no requirement stated an operating depth, the only figures were a legacy 600 bar hull number and a 6000 m context note, and 600 bar is below the hydrostatic pressure at 6000 m.

Completes the SUB-HUL-073 physical-independence decision with the electrical independence SUB-COM-010 requires, closing the shared feeder and board common cause on the tracking and abort-uplink paths; defence-in-depth for H-003 recovery and the SYS-REQ-001 abort chain.

The H-008 contact-force barrier's single-point silent failure is detected and mitigated by a conservative fail-safe, proportionate to a major hazard and consistent with the ARC-REQ-009 sonar decision for the same failure class.

The collision-barrier single point of failure is analysed and mitigated by detection plus a conservative fail-safe rather than left silent, proportionate to a mass- and power-constrained vehicle whose worst-case consequence is vehicle loss.

The floating-plus-monitoring scheme gives single-fault tolerance in a conductive-seawater environment where a hull-referenced bus would be hazardous on the first fault.

Documentation convention recorded so the shared prefix is read as intentional and not remapped; superseded in detail by ARC-REQ-025, kept for continuity of the ref.

A dedicated USBL transponder gives the support ship a link-independent real-time position track, supporting SYS-REQ-002 recoverability, without tying tracking to the data channel that may saturate during a capture manoeuvre.

A dedicated Battery Management System keeps SUB-NRG-008's 500 ms response independent of the Power Management Unit's bus-regulation firmware.

A single dual-channel controller with hardware-separated drive stages meets SUB-PRP-005's 200 ms fault-isolation requirement without the penetration and node cost of separate controllers.

Isobaric sampling is the only option that can bound sample pressure to +/-5 percent of in-situ capture pressure per SYS-REQ-003.

Centralised fusion is required to meet SYS-REQ-004's 2 m standoff with no GPS aiding at depth; a distributed alternative risked disagreement on position and dual computers were rejected on mass and power budget for this phase.

Drop-weight release is the sole path that must fire even if the main bus and Mission Autonomy Computer are degraded, enabling SYS-REQ-001's 30 s abort-to-ascent bound; pyrotechnic and variable-buoyancy alternatives were rejected for shipping-regulation and single-point-of-failure reasons.