Space — Demonstration Protocol

Foreword. This Test Protocol is new in the VRS 2026 edition and is the Space sector’s extension of VRS-GEN-203, the intrinsic demonstration protocol. It is deliberately short. A space robot’s flight article is qualified by an environmental verification campaign — thermal-vacuum, vibration, radiation, electromagnetic — that no session can witness and that the sector’s anchor regimes (ECSS, NASA standards, the debris-mitigation standard) already require and document; those criteria are documentary and are scored from the pack. What a session can witness is the ground twin: the flight-representative unit or simulator every programme keeps on the ground, on which the abort logic, the safe modes under light-delay and the failover can be exercised with the manufacturer’s own injection means, and on which a crewed-adjacent unit can be inspected. Four steps do that. The intrinsic protocol, run on the same twin, covers the rest. Steps run between Parts E and F of VRS-GEN-203, in the same session, on the same feed, into the same export. Standards carry no step identifiers; every step here names the VRS-SPC-201 subclause that requires it. As a protocol it is versioned vX.Y.Z (VRS-GEN-004 §5.4). Requirements use “shall”.

Introduction

The Space anchor set — the European Cooperation for Space Standardization series, the NASA technical standards, ISO 24113 for debris mitigation and the crewed-platform safety-review process — is the most thoroughly documentary regime in the library. Qualification is a campaign, not a session; the flight article is in a clean room or already in orbit; and the behaviours that matter most (an abort during approach to another spacecraft, a safe mode when the link drops with a round-trip delay of seconds or minutes) cannot be produced on demand in flight. The sector’s Certified tier therefore rests on the ground twin, which every programme maintains for exactly this purpose: to rehearse, to diagnose and to demonstrate.

This Protocol asks the ground twin to do four things on camera with the manufacturer’s own injection means: abort a proximity operation on two trigger classes, enter and recover from safe mode with the light-delay applied and the divergence detector shown, fail over from a single-point failure where that can be exercised, and — for crewed-adjacent units — pass the crew-safety inspection. Everything else in the sector is scored from the pack, and the Protocol says so. The result is a half-day session that is mostly intrinsic and adds under an hour of sector steps.

1 Scope

This Protocol specifies the Space demonstration steps by which the criteria of VRS-SPC-201 Clause 6 are demonstrated at the Certified tier, for every application class of VRS-SPC-201 §7.3 (orbital servicing/inspection · lunar/planetary surface · ISS/crewed-platform internal · launch-support ground robotics). It applies to every Certified Space assessment, by every Certified route of VRS-GEN-003 §6.9.

It specifies: how this Protocol relates to VRS-GEN-203 (Clause 4); the envelope the manufacturer declares before the session (Clause 5); the steps (Clause 6); and a worked example (Clause 7). Annex A maps every VRS-SPC-201 criterion to its intrinsic steps, its sector steps, or neither.

It does not: repeat any session requirement, step, marking rule or record rule of VRS-GEN-203, all of which apply unchanged; define any criterion, point, ceiling or ladder (VRS-SPC-201); or define the Space information pack (VRS-GEN-013). The flight article is not required; every step is performed on the declared ground twin or flight-representative simulator. Qualification campaigns, radiation and thermal margins, programme support and anomaly record are documentary and are scored from the pack.

2 Normative references

• VRS-GEN-203, Demonstration Protocol — Intrinsic — session requirements (Clause 4), step rules (Clause 5), marks and scores (Clause 7), Session Record (Clause 8), all of which apply to this Protocol.

• VRS-SPC-201, Space — AR Assessment Protocol — the criteria whose Certified rows this Protocol serves; application classes (§7.3).

• VRS-SPC-001, Space Sector Standard — the declared envelope and class fields.

• • VRS-GEN-101, Safety — the intrinsic safety criteria the Space pool contributes to.
• • VRS-GEN-102, Reliability & Durability — the intrinsic fault-tolerance step that also serves VRS-SPC-201 §6.6.
• • VRS-GEN-105, Cyber Posture — the intrinsic steps that witness parts of the command-link controls.

• VRS-GEN-003, Governance Charter and Independence — Certified routes and route parity (§6.9).

3 Terms and definitions

Terms defined in VRS-GEN-001 and VRS-GEN-203 apply. In addition:

3.1 ground twin — the declared flight-representative unit or hardware-in-the-loop simulator maintained on the ground, on which the steps of this Protocol are performed.

3.2 proximity operation — an approach to, or operation within a declared range of, another spacecraft, surface asset or crew; the abort logic governs it.

3.3 keep-out zone — the declared geometry around a target that the twin’s abort logic enforces.

3.4 light-delay — the declared one-way or round-trip command delay applied to the twin’s command path to represent the mission geometry.

3.5 autonomy-divergence detector — the declared function that flags departure of the twin’s state from the commanded plan beyond a declared margin.

3.6 safe mode — the declared attitude-safe, power-safe or hold state entered on link loss or fault.

3.7 crewed-adjacent — an application class operating inside or alongside a crewed platform, to which the crew-safety inspection applies.

4 Relationship to the intrinsic protocol

4.1 This Protocol shall be run only as part of a session under VRS-GEN-203. Every requirement of VRS-GEN-203 Clause 4 applies to every step here without repetition or exception.

4.2 Position in the session. The steps of Clause 6 shall run after VRS-GEN-203 Part E and before VRS-GEN-203 Part F, so that one continuous recording and one export cover both protocols. The endurance sample opened in VRS-GEN-203 Part C continues to run through this Protocol.

4.3 Step identifiers. Steps shall carry identifiers of the form SPC-110.nn; they are Session Record step identifiers under the same rules as VRS-GEN-203 §5.1 and shall never be reused.

4.4 Required by. Every step shall name the VRS-SPC-201 subclause(s) whose Certified row it serves. VRS-SPC-201 carries no reference back to this Protocol.

4.5 Classes and declared subjects. Each step lists the application classes it applies to. A step whose class is not in the assessed envelope shall not be run. A step whose subject the manufacturer has not declared shall be marked not declared and has no effect on any score (VRS-GEN-203 §3.10). Steps SPC-110.01 and SPC-110.02 shall be run for every Space assessment (SPC-110.01 for the classes that perform proximity operations); SPC-110.04 for crewed-adjacent classes (VRS-SPC-201 §7.3).

4.6 Bound. The sum of step bounds for one class shall not exceed 120 min. Marks, failure, declined steps, continuation sessions and the Session Record follow VRS-GEN-203 Clauses 5, 7 and 8.

4.7 Criteria witnessed by intrinsic steps. Where a sector criterion’s Certified row is already witnessed by intrinsic steps, Annex A names them and the criterion is scored from those marks together with any sector steps listed. VRS-SPC-201 §6.1 (qualification campaign fit) and §6.5 (radiation and thermal-cycle margins) are documentary and have no steps; nothing witnessed on the ground twin is evidence of flight qualification.

4.8 Ground twin. Every step shall be performed on the declared ground twin or simulator; the flight article shall not be required, powered or handled for this Protocol. The twin’s configuration (hardware revision, software version) shall be shown at the open to match the rated configuration within the declared representativeness statement, which the observer records.

4.9 Flight qualification. Nothing witnessed under this Protocol shall be presented as evidence of, or a substitute for, environmental qualification, radiation or thermal margin, or safety-review acceptance, and no mark shall alter the documentary scoring of VRS-SPC-201 §6.1 and §6.5.

4.10 Admissibility of a mark. A step’s mark shall be inadmissible, and the step shall be marked not achieved, where the dimension, mass, speed, force or condition it depends on was not shown on camera, or where the configuration demonstrated differs from the assessed one. The observer shall record the ground.

5 The declared envelope

5.1 Before the session the manufacturer shall have declared, in the information pack and per assessed application class: the application class; the ground twin or simulator and its representativeness statement; the proximity-operation sequence, keep-out geometry and the abort trigger classes with the declared abort behaviour; the light-delay (s) applied, the safe modes with their entry times (s), the divergence margin and flag, and the recovery sequence; the redundant elements, whether failover can be exercised on the twin, and the switchover time (s); and, for crewed-adjacent classes, the crew-safety checklist, touch-temperature limit (°C), stored-energy containment and the crew-accessible stop.

5.2 Every apparatus in Clause 6 shall be sized from those declarations and no other source (VRS-GEN-203 §4.7). A parameter not declared makes the steps that depend on it not declared (4.5); a manufacturer that declares a smaller envelope demonstrates a smaller envelope and is scored against it under VRS-SPC-201.

5.3 The declared envelope shall match the one recorded for the rating (VRS-SPC-001, VRS-GEN-009); a step demonstrated at a value other than the declared one shall be inadmissible (4.10).

6 The steps

Columns: ID — Session Record step identifier · Step — outcome to witness · Classes — application classes the step applies to (4.5) · Witness — means (VRS-GEN-203 §3.13) · Apparatus — manufacturer-supplied, at declared value · Bound — minutes · Required by — VRS-SPC-201 subclause(s) served.

6.1 Part 1 — Ground-twin behaviour

Abort, safe mode and failover, exercised on the ground twin with the manufacturer’s own injection means. Where failover cannot be exercised, the self-test and health telemetry stand in with a note.

6.2 Part 2 — Crewed-adjacency inspection

For crewed-adjacent classes only: the crew-safety checklist performed on camera on the twin or a flight-configuration unit.

6.3 Timing budget. All 4 steps sum to 54 min. Per class, with every applicable step declared: orbital servicing/inspection 42 min · lunar/planetary surface 42 min · ISS/crewed-platform internal 39 min · launch-support ground robotics 54 min. Every class is within the 120 min bound of 4.6.

7 Worked example (informative)

A manufacturer of a hypothetical free-flying inspection robot for a crewed station interior (classes: ISS/crewed-platform internal, and orbital servicing/inspection for its external variant) declares: a hardware-in-the-loop ground twin at the same software build; an approach sequence to a station module with a 0.5 m keep-out zone and abort triggers on range-rate and on camera/lidar disagreement; a 0.8 s round-trip delay; a hold-and-power-safe mode within 5 s of link loss with a divergence flag at 0.2 m from plan; dual flight computers with a 2 s switchover that can be exercised on the twin; and a crew-safety checklist with a 45 °C touch limit and a crew-reachable power cut.

After VRS-GEN-203 Part E the sector steps run from 12:40 in the integration lab. SPC-110.01: the twin approaches the simulated module; a range-rate violation is injected at 1.2 m, retreat to 2 m and hold, keep-out zone shown; repeated with a lidar/camera disagreement injection, hold and safe attitude (achieved). SPC-110.02: with the 0.8 s delay applied, the link is cut mid-approach; the twin holds and enters power-safe in 3.4 s; the plan is then offset by the injection means and the divergence flag raises at 0.22 m; link restored, recovery sequence completes (achieved). SPC-110.03: the primary computer is failed during a station-keeping task; the secondary takes over in 1.6 s, task continues, health state amber (achieved). SPC-110.04: checklist on the twin — edge protections, touch probe 38 °C on the warmest surface, battery containment, materials summary matching the configuration, crew power-cut acts (achieved). Sector time 48 min; VRS-GEN-203 Part F follows.

The reviewer scores VRS-SPC-201 §6.2 from SPC-110.01; §6.4 from SPC-110.02 with GEN-203.15 and GEN-203.32; §6.6 from SPC-110.03 with GEN-203.28; §6.3 from SPC-110.04 with GEN-203.16; §6.1, §6.5, §6.7 and §6.8 from the pack. No number in this example is a requirement; every value came from the manufacturer’s own declaration.

Annex A (normative) — Criterion coverage

Every criterion of VRS-SPC-201 Clause 6 appears once with the intrinsic steps (VRS-GEN-203) and the sector steps (this Protocol) that witness it, or the statement that it has none.

Bibliography

• ECSS-E-ST-10-03C Rev.1 (2022), Space engineering — Testing.
• ECSS-Q-ST-30C Rev.1 (2017), Space product assurance — Dependability.
• ECSS-Q-ST-40C Rev.1 (2017), Space product assurance — Safety.
• ECSS-E-ST-70-11C (2008), Space engineering — Space segment operability.
• ISO 24113:2023, Space systems — Space debris mitigation requirements.
• NASA-STD-8719.24 (2022), NASA Technical Standard for Payload Safety Requirements.
• NASA-STD-3001 Vol. 2 Rev. D (2023), NASA Space Flight Human-System Standard — Human Factors, Habitability, and Environmental Health.
• NASA-STD-6001B (2011), Flammability, Offgassing, and Compatibility Requirements and Test Procedures.
• ISO 14620-1:2018, Space systems — Safety requirements — Part 1: System safety.
• ECSS-E-ST-60-30C (2013), Space engineering — Satellite attitude and orbit control system (AOCS) requirements.

Change history