This models the switchover mechanics when a primary scrubber (e.g. a CO2-removal unit) fails — not how likely it is to fail, and not which crisis to triage first. Cabin CO2 follows a simple mass-balance: crew generate it at a constant rate, the active scrubbing hardware removes it in proportion to its capacity fraction.
dCO2/dt = k_gen − k_remove · capacity(t)
capacity(t) = 0 while undetected (primary down, no alarm yet)
= 0 during detection delay
= capacityBackup · t/spinup while backup is spinning up (0→cap)
= capacityBackup once backup is fully online
- Detection delay — how long the sensor/alarm system takes to notice the primary stopped scrubbing. Nothing removes CO2 during this window.
- Backup spin-up time — once a fault is confirmed, the backup unit still needs time to reach operating capacity (fans/catalyst bed ramp-up); capacity rises linearly from 0 during this window.
- Backup capacity — a fully healthy backup restores 100% removal capacity. A degraded/partially-available backup (e.g. 60%) never fully catches up to generation, so CO2 settles at a permanently higher steady state instead of returning to baseline.
- Zero-capacity gap — the combined duration (detection delay + a fault is present with 0 capacity) during which nothing is scrubbing at all — the single biggest driver of the CO2 spike.
Real-world relevance: on ISS and future deep-space vehicles, redundant scrubbers (e.g. dual CDRA units) are sized and alarmed specifically to keep this detection+spin-up gap short, because it is the gap — not the eventual backup capacity — that determines whether crew ever see a dangerous CO2 spike.