Each of the three subsystems (O₂ generation via electrolysis, CO₂ scrubbing, water recovery) runs on 1 primary module plus your chosen number of hot-standby backups. Every operating module independently fails at random following a Poisson process with a constant hazard rate — the classic reliability-engineering model for electronics and life-support hardware:
P(module fails in Δt) = 1 - exp(-Δt / MTBF)
System capacity fraction = active modules / total modules
Each tank then follows a mass-balance ODE driven by that capacity fraction versus crew demand (nominal demand is calibrated to a 6-person crew):
dO2/dt = (capacityFrac_O2 - crew/6) · k_O2 [buffer %]
dCO2/dt = (crew/6 - capacityFrac_CO2) · k_CO2 [ppm]
dWater/dt= (capacityFrac_H2O - crew/6) · k_H2O [reserve %]
- Crew size — scales O₂/water demand and CO₂ production linearly.
- Backup modules — more standby units per subsystem raise the capacity fraction that survives any single failure (true redundancy engineering, same principle NASA's ISS ECLSS uses).
- MTBF slider — lower mean-time-between-failures stress-tests the system with a higher random hazard rate.
- Time acceleration — how many simulated hours elapse per real second, so you can watch a multi-day drift play out in seconds or slow it down to inspect a single failure event.
- Trigger Random Failure — forces an immediate failure on a random active module, useful for testing a specific redundancy level.
- Est. time to critical — extrapolates the current net rate of whichever tank is draining fastest to when it would hit empty, exactly as a flight controller would read a trend line.
Real ECLSS on the ISS keeps water recycling above 90% and layers redundant Oxygen Generation Assembly and CDRA (CO₂ removal) units for exactly this reason — a single-string failure must never become a crew-critical event.