Engineering: the CDR 2026 design review
On 2026-10-27 the project finished a design review against the NASA NPR 7123.1D Critical Design Review criteria, tailored for a Class D CubeSat. This page shows what it found, what it decided, and what it left for hardware and for the principal investigator (PI). Report: SQSO-REV-CDR-002 version B
What the review is, and is not
In the report's own words (§1.2):
- It is an engineering assessment against the CDR entrance and success criteria of NPR 7123.1D Appendix G (Table G-7), tailored for a Class D CubeSat, carried out by AI reviewers (Claude) working on the repository: seven discipline reviewers, five designers and a chair. Every finding is a Review Item Discrepancy (RID) with a recorded disposition and evidence.
- It is not an independent review board. There are no named human reviewers and no signatures. The funding audit flagged the earlier review records for exactly this (FINDINGS_REGISTER PI-03, PI-04); this record does not repair that. The project's independent PDR and CDR are scheduled (
mission/SCHEDULE.md); this review is their input. - The programmatics reviewer found that the project is at pre-PDR maturity by the NPR 7123.1D criteria (no independent SRR or PDR, no engineering model;
docs/project/CDR_CRITERIA_MATRIX.md). The review therefore also did the design work a CDR presumes: schematic capture of the boards with selected parts, a mechanical CAD model and a finite-element model (§5). - An action that needs hardware cannot close by analysis. Each one is a verification item with a test, a pass criterion and a date. An action that needs an outside party (a contract, an agreement, a filing) is a decision point with an owner and a date. Neither is counted as an open review action; both are tracked in the schedule and the verification matrix.
Verdict and maturity
No review action is open. Every one of the 412 findings carries a final disposition. "Closed" means the evidence is recorded in the repository; where only hardware or an outside party can supply it, the finding is closed as a dated verification item or decision point, not as a result. SQSO-REV-CDR-002 §7.1
The report's maturity statement (§7.2):
Judged honestly against Table G-7, SMART-QSO is at the level of a strong PDR with CDR-depth analysis, not past a CDR:
- No independent board has reviewed it. This review is an engineering assessment by AI reviewers (§1.2); the independent PDR is planned for 2027-01-12 and the independent CDR for 2027-09-28.
- No PCB layout and no engineering model exist. The board designs are schematics with selected parts, ERC-clean, with their calculations.
- Every figure is predicted, none measured: mass, power, thermal, structural, RF and attitude. The firmware has not run on hardware and its pin map is provisional.
- Several values rest on vendor statements not yet in hand, each a dated action (SQSO-MFG-003 §12):
- the ISIS AntS cold limits and its temperature command;
- the CR0002 rod rating;
- the RD01MUS3 minimum temperature;
- the CC1200 TX-OFF leakage;
- the fuse I²t data.
What it gives the independent PDR is a design with no known open defect, the evidence for every claim, and the list of what only hardware can show.
Review item discrepancies (RIDs)
412 RIDs were raised: 32 of severity 1 (mission or safety critical), 211 of severity 2 (must close before fabrication), 169 of severity 3 (should fix). Rounds 3 and 4 (independent closure verification) reopened 45 RIDs and raised 106 new findings; 45 of the reopened and 102 of the new are since closed and 4 were dispositioned when raised. Open implementation RIDs: none. SQSO-REV-CDR-002 §6
| Disposition | Round 1 | Final |
|---|---|---|
| Closed by analysis | 25 | 31 |
| Closed by design change | 101 | 279 |
| Closed by chair decision | 42 | 35 |
| Verification item | 46 | 33 |
| Decision point (dated) | 15 | 34 |
| Implementation | 183 | 0 |
| Total | 412 | 412 |
Margins at the review
Every margin is a prediction from analysis or simulation; none is measured. The mission simulation (version G) ran the unchanged flight software through 730 days of operations and found 0 anomalies and 0 warnings in 50 checks; a beacon was decoded on 95.9 % of 28,567 simulated passes, and the generated beacon text cost 0.065 Wh per accepted line under assumed inputs. Mission simulation §7
| Quantity | Requirement | Predicted | Margin | Source |
|---|---|---|---|---|
| Mass | ≤ 2.00 kg (design), 2.5 kg Nova | MEV 1.755 kg, CBE 1.520 kg (ballast, harness 85.6 g with the real splices and tabs, cell retention) | +14.0 % (+42.5 % to the Nova) | MASS_BUDGET 3.3 |
| CG, stowed | ±20 mm | (+0.1, −0.3, −1.4) mm CBE (CAD) | > 18 mm | MECHANICAL_DESIGN B |
| Deployed inertia | Iyy ≥ 1.03 × max, axis within 5° of +Y | 1.056 / 1.047 (CBE / MEV, four AntS elements, C-13 ballast, harness), 0.9° / 1.0°; MEV 5th percentile 1.036 at 2 mm placement scatter | Met | MECHANICAL_DESIGN B §5 |
| First mode, stowed | > 40 Hz | 170 Hz CBE / 162 Hz MEV (FE, 2.0 mm EPS, rod on the −X wall) | × 4.0–4.3 | STRUCTURAL_ANALYSIS |
| Strength | MS ≥ 0 (NASA-STD-5001B protoflight factors at MPE + 3 dB) | Lowest +0.97 (+0.86 at MEV masses) | Positive | STRUCTURAL_ANALYSIS |
| PCB fatigue (Steinberg) | MS ≥ 0 | +0.42 to +0.72 at CBE, +0.14 to +0.51 at MEV (2.0 mm EPS and carrier) | Positive | STRUCTURAL_ANALYSIS |
| Wing deployment torque | NASA-STD-5017B torque margin ≥ 0 at end of travel, at −55 °C | +0.08 (one spring out +0.07); release-energy ratio 1.90 with the 10 s burn (C-17) | Positive; resistive torque below −40 °C verified at −55 °C (VI-MECH-01..03) | MECHANISMS_ANALYSIS E |
| Power, EOL, sun-pointed | ≥ 20 % | 3.84 W delivered with the photodiode-and-albedo pointing of C-23 (3.79 W in the worst trial; 3.92 W with +Y held on the Sun) against the bottom-up ACTIVE load 2.60 W with the heater and the transponder | +45 % (+43 % worst trial), PBA method; +70 % on the 2.26 W allocation by the BASELINE method | POWER_BUDGET_ANALYSIS 2.5 §4; ADCS_DESIGN 1.9 §11.6; BASELINE §5 |
| Power, EOL, tumbling | ≥ 20 % | 2.48 W against the bottom-up ACTIVE load 1.91 W with the heater and the transponder | +27 %, PBA method; +33 % on the 1.86 W allocation by the BASELINE method | POWER_BUDGET_ANALYSIS 2.5 §4; BASELINE §5 |
| Depth of discharge | ≤ 10 % per eclipse | ≤ 3.5 % as flown (SIL G, 475 km); 2.8 % worst contingency (PBA 2.2) | × 2.9 | SIL_MISSION_SIMULATION G §7; POWER_BUDGET_ANALYSIS |
| Battery temperature | 0 to +45 °C charging | ≥ +4.4 °C at 14.0 V; +3.6 °C at the 12.0 V floor (0.70 W heater); +1.3 °C with a 0.10 W/K mount at 14.0 V; −1.5 °C with the wings stowed at 0.70 W (charging then inhibited in hardware) | Met in operation; stowed-wing case THM-03 | THERMAL_ANALYSIS 2.6 |
| Beacon link, 5° | ≥ 6 dB (median gain) | +7.9 dB | +1.9 dB | LINK_BUDGET 3.2 |
| Telecommand link, 10° | 6 dB with interference allowance | ≥ +8.4 dB at both variants' minimums (variant A +9.5 dB), receiver as designed, 10th-percentile gain, pointing included (≥ +6.6 dB at 5°) | ≥ +2.4 dB | LINK_BUDGET 3.5 (C-14) |
| Sun pointing (C-23) | Pointing loss ≤ 5 % of sunlit generation and the Sun within 30° of +Y ≥ 95 % of sunlit time, every trial | 2.0 % (3.2 % worst trial) and 100 % with the face photodiodes and Earth albedo; 5.0 % / 96.3 % worst at the 7 mA·m² residual-dipole limit (C-24); one wing at preset 0 ≤ 2.0 % | Met | ADCS_DESIGN 1.9 §11.6 |
| Detumble and capture | ≤ 3 orbits | ≤ 1.8 h, the slowest in-specification trial (tip-off σ 10°/s, up to 30°/s; ≤ 1.2 orbits) | × 2.5 | ADCS_DESIGN 1.9 §11.4 |
| AI beacon energy (D5, C-20) | ≤ 0.1 Wh per accepted beacon line | 0.065 Wh (SIL G mean under assumed inputs; 0.090 Wh at a 30 % filter reject rate) | × 1.5 | SIL_MISSION_SIMULATION G §7; go/no-go VI-02 on the EM |
| Total dose, 2 mm Al | design 10 krad, margin ≥ 2 | 4.69 krad at 475 km, 4.91 at the 485 km cap | × 2.13 (× 2.04 at the cap); ≥ 2.1 mm kept (× 2.17 at the cap) | RADIATION_ANALYSIS F |
| Orbital lifetime | ≤ 5 yr after mission, P ≥ 0.9 | P ≥ 0.997 at 475–485 km (planned-end reading); wings-failed probability 0.29 % | Met; fallback 460 km | ODAR Draft D |
| Casualty risk | ≤ 1:10,000 | No fragment > 15 J (nominal); 1:47,000 worst sensitivity | Met | ODAR Draft D |
| Reliability | (goals 0.95 / 0.80 / 0.60) | 0.75 / 0.61 / 0.51 (L1 / L2 / L3); 0.86 / 0.71 / 0.59 with the burn-in and flatsat programme | PI acceptance (REL-01) | RELIABILITY 2.1 |
| Schedule float | ≥ 9.6 weeks (67 d, GOLD 1.06) to the integrator milestone for 2028-11 | +71 days (10.1 weeks; layout re-estimated, reliability programme and the board firmware tasks included; −20 d with one layout designer) | Met by 0.5 weeks | SCHEDULE Rev E; schedule_cpm.py |
Chair decisions: proposals awaiting the PI
The review chair made 24 decisions (C-1 to C-24). They are proposals by AI reviewers, not decisions of a board, and bind nothing until the PI ratifies or rejects them (action DA-01, due 2027-01-12). SQSO-REV-CDR-002 §7.1 SQSO-SCH-001 §5
The 24 chair decisions (CDR report §4)
| # | Decision | RIDs |
|---|---|---|
| C-1 | Planning launch the last Transporter of 2028 (about 2028-11); June 2028 an opportunity | PM-05, LV-10 |
| C-2 | Deployment altitude 475 km target, 465–485 km band, 485 km cap; 460 km if the FCC counts an early failure as the end of the mission | ODA-01, ODA-05 |
| C-3 | Layout B; AntS 2 m elements along ±X; CR0002 rods; deployed-inertia requirement | STR-01, STR-02, RF-03 |
| C-4 | Spin 8°/s, nutation damping 3·10⁻⁴ (1·10⁻⁴ without gyro); the round-3 gain sweep (ADCS_DESIGN 1.9 §11.4) keeps it on the Iyy/Izz 1.005–1.05 results, and the protection against a degenerate plant is the Iyy ≥ 1.03 × max mass-properties limit, not the gains | GNC-02, P3F-G-04 |
| C-5 | Two resistors per wing on their own 0.8 A drivers, 8 s burns, wings before antennas | SMA-05, EPS-18, REL-03, STR-15, STR-16 |
| C-6 | Three deployment switches DS1–DS3 on three rails | LV-05, SMA-01, EPS-04, RF-14 |
| C-7 | Integration SOC 60 % ± 5 %, separation ≥ 40 %, drain ≤ 20 µA | LV-06, SMA-10, EPS-20 |
| C-8 | Telecommand stations ≥ 1,000 km apart, each able to command alone; agreements by 2027-01-05 | LV-08, GND-01 |
| C-9 | Reliability 0.75 / 0.61 / 0.51 (0.86 / 0.71 / 0.59 with the ≥ 500 h flatsat and ≥ 200 h FM burn-in programme) proposed for acceptance as Class D risk; the acceptance itself is the PI's (DA-02, 2026-12-15) | REL-01 |
| C-10 | transponder.rs and ops_state.rs added to the safety-critical list | FSW-05 |
| C-11 | Heater set points +5/+9 °C; ≈ 207 Ω heater | THM-02, BUILD_VS_BUY §4.5 |
| C-12 | Two centre supports on the EPS, OBC and carrier boards | STR-05, MECHANICAL_DESIGN |
| C-13 | 2 × 10 g non-ferromagnetic ballast on the Z axis at the end frames, so the deployed inertia ratio keeps margin with all four AntS elements | MCAD-09, RFB-11 |
| C-14 | Telecommand stations radiate ≥ 64 dBm EIRP above 10° elevation: ≥ 100 W PEP into ≥ 15.5 dBic outside the 47 CFR 2.106 US270 areas (variant A), ≤ 50 W PEP at the transmitter output into a ≥ 17.8 dBic stacked pair inside them (variant B); commands only above 10° | RF-23 |
| C-15 | Harness wire under the EPS tied to the deck straps and shear panels; only connector strain-relief ties on the EPS board (EPS Steinberg +0.23, −0.52 otherwise) | MCAD-11 |
| C-16 | Battery-lead shorts: the two positive-leg fuses are diverse by design (F0A MIL-PRF-23419/12 from AEM, F0B MIL-PRF-23419/8 from Littelfuse), with F0N in the negative leg the third, so BSA H3b is 2-fault tolerant without counting two same-part fuses as independent (an earlier wording did; revised after the board FMEA). NRCSD safety-engineer concurrence for the ISS backup path | EPSB-10, P3E-02 |
| C-17 | Burn 10 s per resistor (was 8 s): at the bounding −55 °C the 8 s burn gives a release-energy ratio of only 1.52 against 1.5; 10 s gives 1.90 inside the 12 s hardware one-shot | P3S-01 |
| C-18 | The AntS deploys only when its own reported temperature is ≥ −17 °C (the −20 °C qualified minimum plus 3 °C sensor tolerance), deferring to the next 50-min slot without spending an attempt; after 30 deferrals (about 25 h, which covers the wings-stowed case where it never warms) it releases after 20 min of continuous sun, and after 3 unreadable temperatures it follows the thermal analysis's schedule (the first 20 min of sun from S + 69 min); on ground command it deploys at once. An ungated release after an eclipse separation would be at −44 °C; the gate opens within 177 min in every nominal case, before the first commanding pass (median 6.4 h). The wings still go first at S + 30 min | P3T-09 |
| C-19 | The transmitters stay silent while the AntS deployment is pending (deferred by C-18, or not yet attempted); the downlink starts when the AntS reports deployed or its sequence ends, never before the 45-min RF silence. Keying into stowed elements trips the VSWR protection (SIL-37: two 10-min stops, 1,312 s beacon gap) and stresses the PA, and nothing is lost: the first commanding pass (median 6.4 h) is later than the gate's nominal worst case (177 min); a failed AntS sequence still gets its stowed-antenna beacon. Off the nominal path (a plausible but cold reading held for the whole cap, e.g. a wrong temperature conversion before AV-V7 confirms it) the spacecraft is silent for up to about 25.8 h; the cover is the blind forced DEPLOY_RETRY in the commissioning plan | SIL-37 (P3T-09) |
| C-20 | One Smart Beacon burst definition, the one the design implements: a Jetson power-on of at most 10 min and at most 3.6 kJ at the carrier input, ended early by the energy gate. The go/no-go metric is energy per accepted beacon line ≤ 0.1 Wh (360 J), counted on accepted lines (not per burst), measured on the EM over ≥ 30 bursts (VI-02) and confirmed in commissioning over ≥ 10 bursts (MSC E-02). SYS-512, VI-02 and the D5 960 J figure are revised to match (CR) | P3F-G-03 |
| C-21 | With one wing deployed and the ground unable to say which, the spacecraft uses preset 0 (both wings) rather than guess between presets 1 and 2: the wrong one-wing preset is the case not analysed, preset 0 costs 2–3 % of power. Presets 1 and 2 are used only after the commissioning identification procedure (array current against the sun-sensor angle over a spin) names the wing | P3F-G-06 |
| C-22 | The attitude-knowledge requirement is restated as what the control law uses: sun-vector knowledge within ±5° in sunlight from the sun sensors, and rate knowledge from the gyros. A spin-stabilised sun-pointer needs no onboard three-axis estimator, so the EKF/TRIAD of ADCS_DESIGN §4.3 is removed from the flight baseline; the Monte Carlo measures the sun-vector error to verify it | P3F-G-07 |
| C-23 | With the face photodiodes and Earth albedo modelled (ADCS_DESIGN 1.9 §11.6) the spin-stabilised sun-pointer holds 12° mean and 74 % of sunlit time within 15°, and its sun-vector knowledge is 27° (95th percentile): ADCS-P002 and the ±5° of C-22 are not met, while generation falls only 2 % (4.56 against 4.65 W). The pointing requirement exists for power, so it is restated as what the power budget needs: sunlit-averaged generation loss from pointing ≤ 5 % and the Sun within 30° of +Y for ≥ 95 % of sunlit time, both in every Monte Carlo trial with the photodiode-and-albedo model; sun-vector knowledge is not a requirement (C-22's ±5° is withdrawn). The power budget carries the albedo-case generation. An albedo-immune +Y sun sensor is the recorded option if the EM photodiode test (TP-ADCS-003) shows worse than the model | P3F-G-07 (GN&C closure) |
| C-24 | Residual-dipole limit lowered from 10 to 7 mA·m² (design 3 mA·m²): with the photodiode-and-albedo model ADCS-P002 passes in every trial up to 7 mA·m² (worst 5.0 % loss, 96.3 % within 30°) and fails in 6 of 40 at 10 mA·m² (7.7 %, 84.9 %). The limit is a test criterion on the flight unit (ETP Helmholtz-cage measurement); a unit above it is demagnetised or re-harnessed, or gets the albedo-immune +Y sun sensor (the generic model gives 1.8 % / 99.4 % at 10 mA·m²) | P3F-G-07 (C-23 check) |
What remains
| Kind | Count | What remains |
|---|---|---|
| Verification items (VI) | 33 RIDs; 228 items in the generated register (SQSO-VIR-001) | Each with a test, a pass criterion, an event and date, and an owner; most fall on the EM (2027-06 to 2027-07) and the protoflight campaign |
| Decision points (DP) | 34 RIDs; dated actions DA-01 to DA-22 (SCHEDULE §5) | Each with an owner and a date; the PI owns most of them |
| Chair decisions (CH) | 35 RIDs; decisions C-1 to C-24 (§4) | Proposals by AI reviewers, not decisions of a board: they bind nothing until the PI ratifies them (DA-01, by 2027-01-12) |
What the PI must do next
| By | Action |
|---|---|
| 2026-11-06 | Request the NASA DAS usage agreement (DA-06); ISIS AntS RFQ with its ICD (DA-19) |
| 2026-11-15 | Request the FCC Space Bureau consultation with the agenda (DA-11) |
| 2026-12-01 | Name the independent PDR board (DA-03); ratify the board firmware languages (DA-22) |
| 2026-12-15 | Accept or reject the reliability estimates (DA-02, C-9); export counsel (DA-13); engage the layout designers (DA-04); vendor statements V-1, V-2, V-5, V-6 (SQSO-MFG-003 §12) |
| 2026-12-31 | Name the contracting legal entity (DA-05); send the integrator RFQs (DA-07) |
| 2027-01-05 | Telecommand station agreements (DA-10) |
| 2027-01-12 | Ratify or reject chair decisions C-1 to C-24 and CR-2026-007 to -019 (DA-01); the proposed requirement wordings of DA-20; independent PDR |
| 2027-01-15 | EM order, after the procurement data reviews (DA-18) and the parts' vendor actions |
All 22 dated actions with owners and pass criteria (schedule §5)
| ID | Decision or action | Owner | Due | Pass criterion or outcome | Status |
|---|---|---|---|---|---|
| DA-01 | Ratify or reject CR-2026-007 and CR-2026-008 (approved by the review chair only), decide CR-2026-009 to CR-2026-019 (docs/project/CHANGE_REQUEST_LOG.md), and ratify or reject the review chair's decisions C-1 to C-24 (SQSO-REV-CDR-002 §4) | PI | 2027-01-12 | Each CR's CCB decision reads Approved, Approved with conditions or Rejected, dated and signed by the PI; a rejected change is reverted in the documents it touched | Open |
| DA-02 | Accept or reject the Class D reliability estimates (L1/L2/L3 0.75 / 0.61 / 0.51; 0.86 / 0.71 / 0.59 with the reliability programme) and keep or drop the programme (≥ 500 h EM flatsat, ≥ 200 h FM burn-in) | PI | 2026-12-15 | Decision recorded in RELIABILITY_ANALYSIS §5 and MISSION_SUCCESS_CRITERIA §8; if the programme is dropped, FLATSAT_500H and FM_BURNIN leave the schedule and the estimates revert to the allocation case | Open |
| DA-03 | Name the independent PDR board: a chair and at least two reviewers outside the team covering systems, electrical and RF, and flight software; invitations with the 2027-01-12 date | PI | 2026-12-01 | Names, affiliations and conflict-of-interest statements in PROJECT_PLAN §6.2; data package to the board by 2026-12-29 | Open |
| DA-04 | Engage two PCB layout designers (KiCad, IPC-6012 Class 3) for a 2027-01-12 start; decide whether the layout starts at risk on the PDR package | PI | 2026-12-15 | Agreements in place for both designers; with one designer the plan has −20 d float (§3) | Open |
| DA-05 | Contracting legal entity named (DP-1) | PI | 2026-12-31 | An entity able to sign the launch services agreement, cross-waivers, insurance declarations and export agreements | Open |
| DA-06 | NASA DAS: software usage agreement requested by 2026-11-06 and in hand by 2026-12-15; DAS run on the ODAR Draft D cases by 2027-01-08; ODAR Draft E with the DAS output by 2027-01-12, for the early FCC filing (2027-01-19) | Systems engineer | 2027-01-12 | DAS reproduces ODAR Draft D: orbital lifetime ≤ 5 years after the end of the 2-year mission at 485 km and 1.85 kg with P ≥ 0.9 under the conservative solar projection, and re-entry casualty risk ≤ 1:10,000 (NASA-STD-8719.14C). If DAS disagrees, the cap moves by CR to the highest altitude DAS passes, before the contract negotiation starts (2027-02-23) | Open |
| DA-07 | Integrator RFQs to Exolaunch, ISISPACE, SEOPS, D-Orbit and Maverick, each asking for: the mission ICD at the contract; the attenuated EXOpod Nova shock MPE at the CubeSat interface; the dispenser thermal analysis for the assigned flight and slot with the deployment time; the SSCMAN 91-710 and battery failure-tolerance requirements; the coupled-loads approach | PI | 2026-12-31 | Five RFQs sent with these items; replies logged in docs/ORBITAL_ACCESS.md | Open |
| DA-08 | Integrator data with the signed contract: mission ICD, levels, attenuated shock MPE, 91-710 and failure-tolerance requirements | PI (contract signatory) | 2027-06-30 | ICD received; LVR and ETP levels replaced by CR; VI-07 (shock) and EPS-23 (failure tolerance) assessed by 2027-07-14 | Open |
| DA-09 | IARU coordination: request on 2027-01-26 after the early FCC filing; letter | Licensee (KK6GDB) | 2027-05-18 | Coordinated downlink and uplink frequencies frozen in BASELINE §7 by CR; with no letter by 2027-05-18 the licensee asks the IARU Satellite Advisor for status and the contract proceeds on the requested windows | Open |
| DA-10 | Telecommand stations: written agreements with at least two stations at least 1,000 km apart, each able to command alone | Licensee (KK6GDB) | 2027-01-05 | Agreements signed; stations named in the early FCC filing and the IARU request; VI-GND-02 site survey of each | Open |
| DA-11 | FCC Space Bureau consultation (D3): requested by 2026-11-15 with the agenda (docs/regulatory/REGULATORY_ROADMAP.md Rev D §6): the ITU API path and timing (REG-05), whether an early failure ends the mission (ODA-05), the contact timeouts N and M, and the beacon kept with a failed receiver (REG-11); meeting by 2027-01-05 | Licensee (KK6GDB) | 2027-01-08 | Outcome recorded by 2027-01-08, before the early filing (2027-01-19). ODA-05 fallback: if an early failure counts as the end of the mission, the 460–465 km band of BASELINE §3 is adopted by CR before the contract negotiation | Open |
| DA-12 | Dispenser soak (THM-06, THM-07): the integrator's dispenser thermal analysis for the assigned flight and slot, with the deployment time, requested in the RFQ (DA-07) and delivered at the contract | PI (licensee) with the integrator | 2027-06-30 | Pack ≤ +50 °C and ≥ −15 °C at deployment, boards within their non-operating limits (V-THM-5). Fallback if the hot result exceeds +50 °C, in order: a deployment-time limit in the contract from the integrator's transient; a low-absorptance finish on the pack-facing surfaces (THERMAL_ANALYSIS §6.5); integrator pad conditioning (purge or air conditioning until fairing close); if none brings the pack to ≤ +50 °C, the PI decides between a lower storage SOC and the NRCSD backup | Open |
| DA-13 | Export counsel engaged; export memo Rev B (authentication versus encryption; foreign integrators) | PI | 2026-12-15 | Counsel's written opinion; TAA need decided before the contract negotiation (2027-02-23) | Open |
| DA-14 | Panel vendor RFQ with the body-panel cells offset 1 mm from the hinge edge (wing sweep, MECHANICAL_DESIGN §6.6) | Mechanical lead | 2026-12-31 | RFQ states the offset; the vendor confirms before the panel order (2027-01-15) that the 45° sweep clearance is ≥ 0.35 mm with its tolerances | Open |
| DA-15 | Venting analysis of every enclosed volume from the CAD (VI-LV-12): the gross 1U volume, the battery clamp cavity, the pocket behind the heat spreader; the RF shield cans are done (V/A 3.2–9.4 m, SQSO-RF-BRD-001 D) | Mechanical lead | 2026-12-15 | Each volume / vent area ≤ 50.8 m (CDS §2.1.9); required holes on the drawings in the PDR package | Open |
| DA-16 | SWE-220: measure the cyclomatic complexity of the safety-critical Rust files with a tool and gate it in CI, or tailor by CR | Flight software lead | 2026-12-15 | Every function in the safety-critical components (SDP §3.2) ≤ 15, or a CR listing each exception with its justification; result in docs/software/NPR7150_COMPLIANCE_MATRIX.md item C-4 | Open |
| DA-17 | Flexible 2 m AntS tapes in the ADCS Monte Carlo (ADCS_DESIGN §11.5): element mass, stiffness and damping from the ISIS ICD (with AV-V7); flexible-appendage case; EM measurement of the deployed tape's first mode and damping in the EM tests | ADCS and flight software lead | 2027-02-26 (analysis); EM measurement before the CDR (2027-09-28) | With the tape's first mode and a damping ratio no higher than the measured or 0.5 %, the spin about +Y converges and +Y stays within 15° of the Sun for ≥ 90 % of sunlit time; the measured first mode within ± 20 % of the model's, or the Monte Carlo re-run with it | Open |
| DA-18 | Procurement data reviews before the EM order: V-HAR-3 (vendor drawings, gold part numbers), V-HAR-11 (ASTM E595 per part number), EPSB-09 (FM12 interrupting rating against the 209 A prospective short, 60 °C rerating, termination code; SMF24A leakage), JETB-07 (every carrier BOM line on the manufacturer's data sheet) | EPS designer, harness designer, payload lead | 2027-01-15 | Each data sheet or drawing cited in the BOM "MPN check" column; FM12 interrupting rating ≥ 209 A at ≥ 16.8 VDC and ≥ 5 A at +60 °C; storage drain with the SMF24A's +60 °C leakage ≤ 20 µA; every item without E595 data coded A–E or tested; a failing part changed before the order | Open |
| DA-19 | Drawings before the layout: VI-RFB-12 (AntS RF port, coax plating, attenuation, inner conductor; by 2026-11-13, RF lead; ISIS AntS RFQ with the ICD by 2026-11-06); JETB-06 (NVIDIA DG-10931-001 and TDG-11127-001 through a developer account); JETB-12 (Molex drawings) | RF designer; payload lead | 2027-02-01 | VI-RFB-12 pass before the RF layout (2027-02-16); V-JET-2 passes before the carrier layout (2027-03-16); J1 mated height ≤ 13.2 mm and J2 ≤ 7.7 mm from the drawings, else the right-angle J1 fallback | Open |
| DA-20 | Ratify the proposed wordings TBR-MRD-002 to -005 and TBR-SYS-002 to -004 | PI | 2027-01-12 | Each TBR closed in its document (ratified, amended or rejected) | Open |
| DA-21 | Shock (VV-07): decide VI-07 from the integrator's attenuated shock MPE | Test lead | 2027-07-14 | Analysis passes only if the vibration-equivalent SRS (24 / 53 / 85 / 60 g at 100 / 500 / 1000 / 2000 Hz) envelops the MPE below 2000 Hz; otherwise an EM shock test at MPE + 3 dB, 2 actuations per axis, in the EM tests (costed in software/simulation/cdr/pm/test_cost.py) | Open |
| DA-22 | Ratify the board firmware languages: RF board TNC in Rust no_std with the OBC's pinned toolchain (proposed, SQSO-SRS-TNC-001 §7); EPS controller in C11 to MISRA C:2012 with TI MSP430-GCC (recommended, SQSO-SRS-EPSC-001 §7) | PI | 2026-12-01 | Decision recorded in SMART-QSO-SDP-001 §3.4 and each specification's §7 before the firmware designs go into the PDR package; if Rust is chosen for the EPS controller, a CR with the nightly toolchain and its qualification plan (CR-2026-004 covers only the pinned stable toolchain) | Open |
Risks the review accepts
- AntS temperature gate. The gate relies on the ISIS temperature command (assumed until AV-V7 confirms it). Off the nominal path, the spacecraft can be silent for about 26 hours. The cover is a blind forced deployment from the ground (C-18, C-19).
- Pointing. Pointing meets its power-derived requirement (C-23) only up to a 7 mA·m² residual dipole (C-24). There is no margin at that limit, so the flight unit's dipole test is a hard gate.
- Smart Beacon experiment. Its 0.1 Wh go/no-go is met in simulation under assumed inputs (0.065 Wh). Only VI-02 on the EM decides it. The fixed-template beacon is the flight baseline regardless (D5).
- Fuses below rating. The end-of-life fuse F1 and the backup overcharge fuse F3 are below the −40 °C part rule. They are covered by placement, by the firing rules and by flight-lot qualification (V-EPS-8), not by their ratings.
- Bus parts without radiation data. Most bus parts have no radiation data. They are covered by lot testing and screening before the CDR (RAD-V3, RAD-V4); a part that fails is changed before the FM layout.
The documents
- SMART-QSO Design Review against the NPR 7123.1D CDR Criteria (2026-10-27) SQSO-REV-CDR-002 · B
- SMART-QSO CDR Technical Baseline SQSO-CDR-TB-001 · 1.3
- SMART-QSO Critical Design Review (CDR) SQSO-REV-CDR-001
- SMART-QSO Baseline Parameters (Single Source of Truth) SQSO-BL-001 · E
- Integrated Master Schedule SQSO-SCH-001 · E
- Verification Item Register SQSO-VIR-001 · B
- Change Request Log SQSO-CRL-001 · J
- Mission Simulation (Software in the Loop) SQSO-SIL-001 · G
- SMART-QSO Mechanical Design: CAD Model and Structural Finite-Element Model SQSO-MECH-CAD-001 · D
- CDR Governing Framework, Tailoring and Criteria Compliance Matrix SQSO-PM-002 · C
Every design value is governed by the baseline; where another document disagrees, the baseline is right. SQSO-BL-001 §0