“Maintenance, spares, qualification and configuration on Mars” addresses maintenance as controlled return to service in which having the right spare is not enough.
The central observables are MTTR, access time, spare stock, tools, metrology, skill, proof-test evidence and hardware/software configuration.
Those omissions are engineering information.
NASA R&M and systems-engineering references connect maintainability, configuration, verification and change control
This evidence is used only for what it demonstrates.
Recompute availability ≈ MTBF/(MTBF+MTTR) when the model assumptions apply with units visible. The result is not accepted in isolation: then check whether the change also modifies MTTR, access time, spare stock, tools, metrology, skill, proof-test evidence and hardware/software configuration.
On Mars, counting spare parts is not a maintenance strategy. Each spare has to be linked to the function it restores, the time available before mission loss, the observed failure rate and the tools actually available for diagnosis and installation. Two parts of equal mass can have very different logistics value if one restores several assets while the other requires a test bench the settlement does not possess. Maintenance consumables—seals, lubricants, connectors, cleaning materials and calibration references—deserve the same inventory discipline as large replaceable units.
Configuration control closes the loop. A mechanically compatible unit can still be unsafe if its software, calibration or hardware revision does not match the installed system. Every intervention therefore produces a verifiable configuration state, a return-to-service test and an inventory update. Over years of operation, local failure data should change the spares policy: the settlement learns which components actually age under dust, thermal cycling and reduced gravity instead of preserving launch-day assumptions forever.
investing in access, diagnostics and documentation to reduce spare mass and downtime
maintenance demonstrations, timing, injected errors, configuration checks and return-to-service testing
Verification asks whether the requirement is met;
On Mars, maintenance cannot begin after the failure. It begins in design: accessible components, test points, documentation, standard parts, non-destructive disassembly and diagnostics that local crews can use without waiting for an Earth video call. NASA exploration-maintainability work has long emphasized the same constraint: as mission duration grows and resupply falls, repair strategy directly affects mass, availability and risk.
Replacing a complete box is fast but consumes a heavy spare. Replacing a board or bearing saves mass but requires tools, diagnosis, qualification and skill. Component-level repair reduces theoretical inventory further while demanding a much more capable workshop. Optimal repair depth therefore depends on criticality, failure frequency, part value, test difficulty and local manufacturing capability.
The settlement should record repair levels for every critical item: level 1 module exchange, level 2 subassembly repair, level 3 workshop repair, level 4 local manufacture. That hierarchy turns a spare-parts list into a support doctrine.
“One of everything” is poor planning. A light, high-use component shared by fifty machines may deserve multiple spares. A heavy, highly reliable component that can be repaired locally may not. NASA spares-logistics studies compare probabilistic approaches because on long missions a small component can immobilize a major function.
Standardization is powerful: common bearings, seals, sensors and connectors allow one stock to protect many systems. Yet commonality can create common-cause failure if the shared component has a design defect. Spares management must therefore capture both standardization benefits and shared-lot risk.
A printed or machined Martian part is not automatically equivalent to its original. Material, geometry, tolerances, surface condition, heat treatment and actual loads matter. A non-critical bracket may be accepted after dimensional checks and a simple proof test; pressure, lifting or life-support hardware may require much stronger evidence.
Metrology therefore belongs next to fabrication. Calipers, gauges, standards, electrical tests, leak tests, microscopy and non-destructive methods are not industrial luxuries. They allow the settlement to decide whether a local repair is trustworthy.
After ten years, the base may contain many versions of the same machine repaired with parts from different generations. Without configuration control, the manual describes hardware that no longer exists. Every change should leave a record: serial number, software version, replaced part, local material, test parameters and return-to-service date.
That technical memory protects the next generation as well. Autonomy is not only making a part; it is understanding why the current machine differs from the original drawing and repairing it without rediscovering ten years of history by accident.
Taking a part from an unavailable machine to save another is a legitimate emergency strategy. Every cannibalization also creates debt: the donor machine becomes incomplete, theoretical inventory diverges from reality and a later repair may discover too late that the expected part is gone. Every such action should therefore update configuration records immediately and create a replenishment task.
This discipline becomes even more important with identical equipment. Without records, a workshop may believe it owns three repairable units while actually possessing two working machines and one shell stripped of critical components.
A highly repairable architecture can still fail if it consumes hundreds of technician hours. Maintenance cost should include diagnosis, access, disassembly, repair, test, documentation and return to service. As population grows, those hours determine staffing and workshop size. Material autonomy without available labor remains theoretical autonomy.
Designing access before promising repairability. This chapter is organized around physical and operational mechanisms specific to “Maintenance, spares, qualification and configuration on Mars”.
Contamination control changes the definition of a successful repair. Opening a fluid loop, oxygen line, optical sensor or sealed electronics enclosure can restore the original component while introducing particles, fibres, incompatible lubricant or moisture into the system. The maintenance plan therefore specifies the cleanliness state before opening, the tools and temporary covers allowed, the inspection method before closure and the proof test after reassembly. A pressure or flow check alone may be insufficient if the new hazard is chemical or particulate. For critical loops, the crew should retain a witness sample or filter inspection when feasible, record which consumables touched the interface and keep the repaired branch isolated until evidence supports reconnection. This is especially important on Mars because the nearest replacement for a contaminated assembly may be months away and because local dust is itself one of the contaminants the procedure must exclude.
A = 2 000/(2 000+40)=98,04 %; avec MTTR=10 h → 99,50 %
With intrinsic reliability unchanged, making equipment four times faster to repair gains more than one percentage point of availability. Physical access and modularity are therefore performance parameters.
H = 12 équipements × 1,5 h × 26 interventions/an = 468 h/an
A seemingly light maintenance task becomes almost five hundred person-hours per year when repeated across twelve units. Frequency and fleet size must therefore appear in design decisions.
Machine 350 kg + matière 150 kg = 500 kg; rechanges importés = 800 kg; gain brut = 300 kg
The 300 kg gross saving is not an automatic argument for local manufacturing. Power, metrology, qualification, waste, machine spares and skills must be included. The calculation opens the full trade rather than closing it.
Planning: preventive, condition-based and corrective maintenance. Repairability of planning: preventive, condition-based and corrective maintenance is often decided long before failure. Access, connectors, tooling, cleanability, lifting points, standardized interfaces, and the ability to test after reassembly determine whether planning is truly maintainable. The maintenance argument must keep interfaces visible: power, calibration, access, software state and logistics can constrain a repair even when the failed component itself is replaceable. The verification plan therefore follows the service through diagnosis, intervention and return-to-service rather than treating the spare as an isolated object. In maintenance, spares, qualification and configuration, this becomes a concrete verification question: qualification must remain observable while unqualified repair has already consumed part of the margin.
At roughly one hundred residents, maintenance begins to require a real stores function, a metrology and test capability, and explicit control of hardware and software configuration. Work orders are no longer rare interruptions: several can compete for the same technician, lifting device or calibration instrument. Planning must therefore expose queues and priorities, while the inventory system records not only how many spares exist but which revision, shelf-life state and qualification evidence belongs to each item. The settlement gains specialization, but it also gains coordination failure modes that did not exist in a four-person outpost.
Reaching a pump requires six hours of disassembly. The pump itself takes thirty minutes to replace, but its location makes MTTR explode. The scenario shows why access, connectors and handling must be evaluated before architecture freeze.
Diagnosis points to the wrong board. The crew replaces a healthy board and consumes a rare spare without fixing the fault. Testability must isolate the failure before substitution. The scenario values test points, logs, simulators and bench testing.
Local repair, no qualification. A repaired part appears to work, but no procedure proves restored life or margin. The scenario requires requalification criteria proportional to criticality rather than a simple “it works.”
As-built configuration drifts from the drawing. After years, cables, software, sensors and local parts no longer exactly match initial documentation. Maintenance planned from an obsolete drawing creates a new failure. The scenario makes configuration management a daily maintenance function.
For maintenance planning, the useful decomposition is downtime rather than a repeated reliability score. If a repair consumes 20 h, split that interval into fault isolation, access, removal, bench work, installation and proof testing. Cutting hands-on replacement from 8 h to 3 h saves little if diagnosis still consumes 10 h and the post-maintenance test 5 h. This decomposition tells designers whether the next kilogram should be spent on a spare module, a diagnostic sensor, better access or test equipment.
On Mars, MTTR includes diagnosis, access, tooling, configuration restoration and return-to-service testing. A spare in inventory that cannot be qualified does not truly reduce that time.
Each replacement must produce a traceable configuration and measured function test; field data then revise inventory and repair priorities.
Spare mass alone is a poor measure of maintenance resilience. A replacement controller may weigh only a few kilograms yet remain unusable if the crew lacks the correct firmware image, connector tooling, calibration reference or post-repair acceptance test. Stock policy should therefore describe a complete repair package: part, consumables, tools, data, access method and evidence for return to service. This also changes prioritisation: one universal test adapter can unlock many repairs and may deserve more protection than several low-probability components stored without the means to qualify them.
A large spare inventory can coexist with poor availability if diagnosis is slow, access is difficult or a repair cannot be requalified. For a vital function the primary question is the service: how long may it be unavailable, what minimum repair restores it, and what tools, skills, consumables and configuration knowledge are required? This connects reliability and logistics to the physical design of the equipment.
“Two of everything” is neither mass-efficient nor necessarily safe. Some items fail rarely but are impossible to fabricate; others are consumed frequently; still others are common to many systems. Excessive commonality can create a concentration risk if one design defect affects every instance, while well-chosen standard interfaces allow a sensor, bearing or converter family to support many repairs. The spares model needs both common-cause thinking and substitution options.
A machined or additively manufactured replacement must satisfy the functional requirement, not merely match external geometry. Evidence can include material pedigree, process parameters, dimensional inspection, surface condition, heat treatment, nondestructive evaluation, calibration and functional proof. Verification depth should follow consequence: a cabin handle and a pressure-boundary part do not deserve identical acceptance plans.
After a decade of repairs, no habitat will exactly match its launch drawing. Cables will have moved, firmware will differ, locally made parts will exist and sensors will have been substituted. Configuration control links the actual installed item with its software, calibration, limitations, procedures and maintenance history. Without that link an operator can execute the correct procedure for the wrong hardware revision.
A locally available pressure transducer covers the same range but has a slower dynamic response. Control software interprets the lag as a sluggish valve or a leak. Neither the sensor nor the controller is independently broken; the failure is at the configuration interface. Return-to-service testing must therefore include calibration, software parameters and the end-to-end dynamic chain.
Taking a component from a secondary system may preserve life support, but it creates debt. Records should state which donor lost capability, where the part moved, its accumulated life and the plan to restore the donor. Otherwise a settlement gradually fills with partially dismantled equipment and loses emergency options without noticing the trend.
A useful operational metric is time to restore the minimum safe function. A water loop may first return at reduced throughput and only later receive the permanent repair. Designing this intermediate state can turn a long maintenance event into a manageable degradation. It also tells spares planners which temporary hoses, jumpers, adapters, sensors and procedures have disproportionate value.
Recording vibration, current, temperature and leak rate has value when thresholds and trends are connected to inspection or replacement decisions. A Mars maintenance system should avoid producing a huge archive that no one can interpret during an anomaly. Each monitored condition needs ownership, units, expected range, a response to drift and a way to verify that the corrective action actually restored margin.
A spare part has little value if the crew cannot diagnose the fault, reach the failed unit, perform the replacement and prove that the repaired function is safe to return to service. For that reason, spare sizing should be tested against maintenance queues rather than against component counts alone. A single long repair can occupy the only technician with the required skill, block access to adjacent equipment or consume a calibration tool needed elsewhere.
One useful planning method is to assign each maintenance demand a release time, required skill, tools, expected hands-on time and consequence of delay. The resulting queue exposes bottlenecks that a simple MTBF table cannot show. Two statistically independent failures can become operationally coupled if they need the same clean work area or the same electrical test set. Conversely, a modest stock of interchangeable modules can shorten the queue if the design allows rapid swap-out followed by slower bench repair.
Configuration control closes the loop. A replacement unit must be compatible not only mechanically but with firmware, calibration constants, connector pinout and the current system baseline. After installation, a defined post-maintenance test should demonstrate the recovered function under representative load before the unit is declared available. The maintenance record then updates future planning: actual removal time, unexpected access difficulties, consumed materials and measured post-repair performance are more useful for the next mission than a generic statement that the repair “succeeded.”
A motor-operated valve in a life-critical loop develops an irregular stroke time. Pressure remains inside the allowable band, yet motor current rises from cycle to cycle. Replacing the valve immediately would hide the diagnosis. Current signature, comparison with the sister valve and a reduced-load functional test can separate mechanical drag, contamination, position-sensor drift and supply faults before the loop is opened.
If the actuator is implicated, the crew may exchange the complete unit, replace the motor-gear stage or repair the mechanism. Those choices spend different things: stock, crew hours, workshop capability and verification effort. A lightweight spare has little value if the settlement cannot prove the resulting assembly. Configuration records therefore have to bind serial number, software revision, torque values, sensor calibration and the leak-test result to the actual hardware that returns to service.
Release is staged rather than binary: leak integrity, unloaded travel, electrical current, performance under pressure, then repeated representative cycles. The acceptance statement is not “the valve moves again.” It is that the required function has recovered its margin, no secondary anomaly appears and the as-maintained configuration is known. That discipline reduces trial-and-error replacement and turns maintenance into controlled evidence.
Fault isolation should spend information before it spends hardware. If a pump loses flow, the candidate causes may include a clogged filter, a valve that does not reach its commanded position, a power-converter limit, an erroneous sensor or the pump itself. Swapping the pump first can make the symptom disappear while leaving the actual cause untouched. A stronger procedure orders tests by the amount of uncertainty they remove and by the risk that the test itself creates.
That logic changes spare policy. High-value line-replaceable units are useful when they shorten an outage, but they should not become diagnostic tokens. The settlement needs portable references, breakout harnesses, pressure and electrical simulators, known-good software images and test adapters because those tools can save many different spares. Supportability is therefore a portfolio of parts, instruments, procedures and skills rather than a warehouse count.
Whole-unit replacement minimizes hands-on time but maximizes stock mass. Board-level repair saves mass yet needs fault localization, clean handling, soldering or connector work, component data and a functional test that proves the repaired board is safe. Mechanical repair may demand pullers, presses, alignment fixtures, lubrication control and dimensional metrology. Component-level repair shifts the burden again toward documentation and technician skill.
The best depth can differ by criticality. A failed entertainment display can tolerate exploratory repair; a pressure regulator in a life-support loop may justify a certified exchange unit until local qualification capability matures. A useful support plan therefore assigns each item a planned repair level, the tooling needed at that level, the acceptance evidence required afterwards and the fallback if the intended depth is impossible.
Removing a controller from a parked rover to restore an oxygen plant can be the correct emergency decision. The danger begins if the donor asset still appears complete in the inventory or if the transplanted controller carries a different software or calibration baseline. Every cannibalization should therefore close three records at once: what function the donor lost, what exact item the receiver gained and what work is now required to restore the donor.
This discipline prevents a classic deep-space failure mode: discovering during the next emergency that the “spare” already exists only on paper. It also creates useful statistics. Repeated cannibalization of the same family of parts is evidence that the formal spare policy is wrong and that the settlement should increase stock, redesign the component or manufacture an equivalent locally.
A machined bracket can look correct and still fail because of material variation, residual stress, surface damage or an incorrect heat treatment. A printed fluid fitting can pass a dimensional check yet leak after thermal cycling. Qualification therefore starts by defining the consequence of failure, then choosing evidence proportional to that consequence: dimensions, material coupons, leak testing, proof load, electrical insulation, non-destructive inspection or repeated environmental cycles.
Metrology is part of the production chain. Calipers without traceable references, a pressure transducer with unknown drift or a torque tool that has not been checked can turn an apparently rigorous procedure into false confidence. A Mars workshop should treat standards, reference artefacts and calibration intervals as consumables of autonomy. The ability to make a part and the ability to know that the part is acceptable are separate capabilities.
At four residents, one technician can temporarily abandon another task to repair a critical pump. At one hundred residents, dozens of simultaneous work orders compete for specialists, benches and test equipment. Queue length then becomes a reliability variable: a repair that requires two hours of hands-on work may keep a service unavailable for days if the required bench or qualified person is already committed.
Planning should therefore track backlog by criticality, expected labor hours, required tools and deadline before service loss. Preventive work can be moved; a pressure leak cannot. The maintenance organization matures when it can forecast those conflicts and reserve scarce test capacity before emergencies occur. This is one reason a growing settlement eventually needs dedicated maintenance planning rather than relying on heroic generalists.
Logistics databases often describe a spare by part number and mass. The actual maintenance promise is larger. A replacement controller may require a particular connector keying, firmware loader, calibration file, mounting adapter and test cable. If any one of those is missing, the part cannot restore the service even though the inventory says it is available. Support planning should therefore represent a spare as a bundle of enabling dependencies rather than an isolated object.
This is especially important after years of local modification. Two nominally identical pumps can diverge because one received a locally manufactured seal, a different sensor revision or a software patch. The inventory system should be able to answer not only “how many pumps exist?” but “which configurations can this spare actually support?” That question connects stores management directly to configuration control.
Vibration, current, leakage and temperature trends are attractive because they promise repair before breakdown. A trend is useful only if it has a demonstrated relationship to degradation. Otherwise a settlement can waste scarce labor chasing harmless variability. The validation task is to correlate sensor history with inspection findings and actual removed-part condition until thresholds have physical meaning.
When a trend is credible, maintenance can move from calendar replacement to remaining-margin management. A bearing that shows stable vibration may stay in service longer; a seal whose leak rate is accelerating can be scheduled before it reaches a life-safety limit. The benefit is not merely fewer failures. It is better use of crew time and a smaller emergency stock because work can be planned while the service still has options.
A procedure can teach which bolts to remove without teaching why the system failed. That is insufficient when an unfamiliar symptom appears or when a local redesign changes the hardware. Training should therefore pair hands-on tasks with fault trees, expected measurements and deliberate anomalies. A technician should be able to explain which observation would disprove the leading hypothesis before touching the component.
The same approach reduces dependence on individual experts. If a specialist is injured or assigned elsewhere, another crew member can follow the reasoning trail rather than merely imitate a memorized sequence. Over decades, this becomes institutional memory: the settlement retains the ability to reconstruct why a maintenance decision was made even after the original team is gone.
A sensor can be perfectly healthy and still mislead the operator if the reference used to calibrate it has drifted. The settlement therefore needs a hierarchy of references, cross-checks and intervals that can reveal when the calibration chain itself is suspect. Critical measurements benefit from independent principles — for example pressure inferred from two technologies — because agreement between identical sensors does not prove that their shared reference is correct.
Calibration tools also age and can fail. Their batteries, seals, reference artefacts, software and environmental limits belong in the support inventory. A maintenance system that can replace every process sensor but cannot verify its standards eventually loses the ability to distinguish a real plant change from a measurement error.
Dust, lubricants, biological material and metal debris do not impose the same cleanliness rules. Some repairs can occur beside a rover; others require a protected bench because a single particle can damage a valve seat, optical surface or fluid connector. Workshop zoning should therefore be tied to failure consequence and process sensitivity rather than to a generic idea of “clean” versus “dirty.”
This affects logistics: bags, caps, filtered enclosures, cleaning agents and inspection lighting can be as important as the replacement part. A repair plan should state the cleanliness state that must be restored before a component is closed and the evidence used to show that contamination has been controlled.
Designing access before promising repairability: the references below are retained because they contribute a result, technology status or verification framework directly useful to this subject.
