Eight ways this vehicle fails, and what happens next in each of them.

What breaks, and does it kill you?

An FMEA whose consequences are computed from the mass statement rather than asserted. Seven of eight are survivable. The eighth is a wiring diagram, not a physics problem, and it is the one worth fixing.

Eight ways this vehicle fails

What happens, how you find out, what you do about it, and whether the design already answers it. The consequences are computed from the same mass statement that sizes the ship, so they move when the ship does.

Modes considered

Survivable as drawn

With the crew aboard and the ship recoverable

Not survivable

Ballast to answer with

2,500kg

Water in the two tanks, droppable in seconds

All 8 modes are survivable: the vehicle stays up, stays controlled and keeps two people alive long enough to reach somewhere.

One gas cell torndegraded
A tear in one of 12 independent cells. The gas leaves through the interstitial space, which is ventilated and open at the top, and rises away.
Consequence
2674 kg of lift, which is 8 percent of the total. The ship becomes 2674 kg heavy against 6695 kg of margin and 2500 kg of dumpable ballast.
Detection
Cell pressure and the trim change. A cell losing gas goes slack before it goes empty, so there are minutes rather than seconds, and the trim wants nose or tail down depending on which cell it is.
What you do
Dump ballast to restore neutral buoyancy, trim with the water tanks against the asymmetry, and fly home heavy. The vehicle lands on water rather than needing a field.
What the design does about it
THIS IS THE ENTIRE ARGUMENT FOR THE RIGID ARCHITECTURE. Every pressure-stabilised alternative has one gas volume, so the same tear costs not 8 percent of the lift but all of it. Semi-rigid comes out about 3.8 tonnes lighter on this model, and the architecture chapter's own uncertainty band on that saving includes zero, so it is a saving that may not exist. What is certain is that it cannot do this.
Two adjacent cells tornserious
One tear crossing a bulkhead, or a fitting that fails and damages both cells either side of it.
Consequence
5349 kg of lift against 9195 kg of margin plus ballast.
Detection
As above, and the trim excursion is roughly twice as large.
What you do
Dump everything. The vehicle descends under control and lands on water, and it does not fly again without a refill.
What the design does about it
The cell count is the lever. At 12 cells a double failure is 17 percent of the lift; at 8 it would be 25 percent. Fewer cells is lighter, because film area counts both faces of every bulkhead, and this is what that mass buys.
One propulsor failsdegraded
One of 4 units stops, whether motor, controller or propeller.
Consequence
18 kW of 72 lost, and NOTHING CHANGES: holding the design wind of 8 m/s takes 13 kW, so the remaining 54 kW still covers it. What is lost is the surplus that buys acceleration, climb and gust rejection.
Detection
Immediate, from the thrust asymmetry and the controller telemetry.
What you do
Trim out the yaw with the opposite unit, and accept the lower wind limit. If the failure is on the mid pair the vehicle loses some of its zero-airspeed yaw authority, which matters at a mooring and nowhere else.
What the design does about it
Four units on four controllers rather than two. Losing one of four is a trim problem; losing one of two is a control problem, and the difference costs about 200 kg.
One DC bus half faultsserious
A short or an arc on one half of the split bus. The tie opens, that half is isolated, and everything fed only from it stops.
Consequence
THIS WAS THE ONLY CATASTROPHIC MODE IN THE ANALYSIS AND IT IS NOT ONE ANY MORE, because the schematic changed rather than because the probability did. On a single bus a fault took out propulsion and the ventilation the hydrogen safety case depends on in the same instant, and no amount of generating capacity upstream could reach a load. Split into halves with a tie, the ship loses 50 percent of its propulsion and keeps all of its ventilation, because every critical load is fed from both halves and the propulsors are two on each.
Detection
Instant on the faulted half, and the tie opening is itself the annunciation.
What you do
Let the tie open, confirm the fault is isolated, and fly on the healthy half. Two propulsors diagonally opposite is a yaw couple the survivors trim out, and the habitat load is small enough that one half carries it with the array alone.
What the design does about it
SEGREGATION ALL THE WAY DOWN TO THE CABLE ROUTING, because two buses in one conduit are one bus with extra contactors. Every source divides between the halves, every critical load is fed from both, and the electrolyzer is the deliberate exception: it hangs on one side because it is the load that gets shed first and misses nothing. Fault energy is bounded at every node for a separate reason, which is that 4.3 kJ is enough to initiate a hydrogen detonation directly and a capacitor bank reaches it.
Engine and generator failserious
The only power source that does not depend on sunlight or stored hydrogen stops.
Consequence
The vehicle is on solar and stored hydrogen alone. A week of overcast becomes an endurance problem rather than an inconvenience, and the weather-escape capability the hydrocarbon reserve exists for is gone.
Detection
Immediate.
What you do
Reduce the habitat load, stop the electrolyzer, drift rather than hold station, and head for somewhere. The vehicle stays up: it is buoyant and it does not need power to fly.
What the design does about it
THE VEHICLE IS FULLY BUOYANT, and this is where that pays. A hybrid-lift vehicle 20 percent heavy needs 231 kW continuously to stay airborne; lose its engines and it comes down. This one loses its ability to go somewhere and keeps its ability to stay up.
Interstitial ventilation stopsserious
The fans that keep the space between the cells and the cover swept with outside air stop.
Consequence
Permeated hydrogen accumulates instead of clearing. The permeation rate alone takes hours to reach a flammable concentration in a still interstitial space, and a chafed cell takes minutes.
Detection
Hydrogen sensors in the interstitial space, and the fan current itself. Both are needed: a sensor without a fan tells you the problem and a fan without a sensor tells you nothing.
What you do
Open the ram-air inlets and fly. Forward speed sweeps the interstitial space without any fan at all, which is why the vehicle has ram inlets as well as blowers.
What the design does about it
RAM AIR AS THE BACKUP, not a second fan. A second fan shares the ducting, the power and the failure modes of the first; forward motion shares none of them. It is also why the hull is open at the top: buoyant hydrogen clears a hull height in seconds if it is allowed to.
Water treatment failsdegraded
Greywater recycling stops. Consumption becomes once-through.
Consequence
Consumption does not change; the NET DRAW ON THE TANK does. At 85 percent recovery the tank sees 15 percent of demand, and losing recycling takes it to all of it, a factor of 6.7 rather than the four this used to claim. Rain catchment still runs at many times consumption, so the loop still closes; it closes on catchment instead of recycling, which makes it weather-dependent.
Detection
Tank level falling faster than the model says it should.
What you do
Ration hygiene water, which is the term that dominates and the one that is a behavioural choice rather than a physical need. Land on water and desalinate if it comes to that.
What the design does about it
Three independent water sources: catchment, recycling and the fuel cell. Plus the sea, which is why the water loop never truly runs out and why marine mode is a resource decision rather than an emergency.
Outer cover torndegraded
A tear in the weatherproof cover, from hail, lightning, abrasion at a fitting, or UV degradation.
Consequence
The cover is not structure and it is not gas-tight, so nothing is immediately lost. What goes is the rain catchment at that station, the local aerodynamic smoothness, and the protection of the cells underneath from UV and abrasion.
Detection
Visual, on the walk down the keel corridor. It may be days before anyone sees it.
What you do
Patch it from inside the keel, in flight. It is a repair, not an emergency.
What the design does about it
The cover being NON-STRUCTURAL is what makes this a repair. On a pressure-stabilised hull the same tear is a structural failure and a gas release at once, which is a different category of event.

The electrical architecture

Two segregated direct current buses joined by a tie that opens on a fault. Every source divides between them and every critical load is fed from both, so no single node in the schematic can isolate the habitat, the ventilation or the propulsors from every source.

Two halves, segregated to the cable routing

The array strings divide between the halves on separate converters and separate runs. The fuel cell and the generator each have two output contactors. The battery is two strings rather than one. The four propulsors are two on each half, diagonally opposite, so losing a half leaves a yaw couple the survivors trim out rather than a pair on one side.

Two buses sharing a conduit are one bus with extra contactors, so the segregation runs all the way down: separate routes, separate penetrations, separate fire zones.

One deliberate exception

The electrolyzer hangs on one half only. It is the largest load and the most interruptible: it exists to turn surplus daylight into hydrogen, so it is the first thing shed and it misses nothing. Duplicating its feed would be mass spent on the one load that does not need it.

Fault energy is bounded at every node for a separate reason. 4.3 kJ is enough to initiate a hydrogen detonation directly rather than a deflagration, and a capacitor bank or an arcing contactor reaches it.

The other pattern worth naming is how much of the survivability is bought with water. The cell tears, the cover tear and the loss of a propulsor are all answered partly by dropping ballast, and the ballast is 2,500 kg of the same water the habitat drinks and the electrolyzer splits. The ship carries 12 gas cells so that no single tear is more than a twelfth of the lift, and the water is what covers the second one.

Nothing here is a probability. This is a consequence analysis: what happens, how you find out, what you do, and whether the design already answers it. Rates would need a fleet, and the fleet is one ship that has not been built.