safemode.space
← All techniques
EX-0012.07
ST0004Execution
sub-technique

Propulsion Subsystem

Parent: EX-0012

Description

Propulsion relies on parameters and sensed values that govern burns, pressure management, and safing. Editable items include thruster calibration and minimum impulse bit, valve timing and duty limits, inhibit masks, delta-V tables, plume keep-out constraints, tank pressure/temperature thresholds, leak-detection limits, and momentum-management coupling with attitude control. By modifying these, an adversary can provoke over-correction, waste propellant through repeated trims, bias orbit maintenance, or trigger protective sequences at inopportune times. False pressure or temperature readings can cause autonomous venting or lockouts; tweaked alignment matrices or misapplied gimbal limits can yield off-axis thrust and attitude excursions; altered desaturation rules can induce frequent wheel unloads that sap resources. Because consumables are finite and margins tight, even modest parameter drift can shorten mission life or violate keep-out and conjunction constraints while presenting as “normal” control activity.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(d)
    addresses
    high
    derived

    Authentication obligations bound who can alter propulsion parameters whose tampering produces mission-impact effects.

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    derived

    Integrity protection on propulsion configuration (thruster calibration, valve timing, safing thresholds) is critical safety-related obligation under (2)(f).

  • craAnnex I, Part I, (2)(h)
    addresses
    moderate
    derived

    Availability-after-incident obligation covers propulsion-tampering events that compromise safe operation.

  • eu-space-actArt. 76(2)
    addresses
    moderate
    inferred

    Art. 76(2)(b)'s effective-technical-control obligation is domain-relevant to propulsion-parameter modification, but it names no interdicting mechanism such as authenticated commanding; it governs the control outcome, not the vector.

  • eu-space-actArt. 81(3)
    addresses
    high
    direct

    Propulsion is a critical function — 81(3)(b)'s restrict-access-to-critical-functions clause is foundational for who can edit thruster calibration, valve timing, and inhibit masks.

  • nis2Art. 21(2)(b)
    addresses
    moderate
    derived

    Propellant waste, orbit-maintenance bias, repeated wheel unloads, and unexpected venting/lockouts are detectable from subsystem telemetry; Art. 21(2)(b)'s incident-handling capability must surface those propulsion anomalies.

  • nis2Art. 21(2)(i)
    addresses
    moderate
    direct

    Propulsion calibration values, valve timing limits, inhibit masks, delta-V tables, and momentum-management coupling are access-controlled engineering configuration; Art. 21(2)(i)'s access-control + asset-management obligation governs which roles can modify them.

  • nis2-implAnnex 11.3.1
    addresses
    high
    derived

    Authority to alter propulsion parameters is privileged-account authority; the privileged-account policy bounds the population and applies strong identification.

  • nis2-implAnnex 3.2.1
    addresses
    moderate
    derived

    Monitoring-and-logging procedures must surface parameter modifications to safety-critical subsystems like propulsion before mission-affecting effects materialize.

  • nis2-implAnnex 6.4.1
    addresses
    high
    derived

    Propulsion parameters (thruster calibration, valve timing, safing thresholds) are change-managed configuration; alterations must follow documented procedures and be reviewed for their mission impact.

ENISA controls

  • ENISA-STL-2025-03-sD.20-i02
    addresses
    high

    Criticality analysis identifies propulsion as a mission-critical function and prioritises it for protective controls, governing where integrity and access measures apply rather than itself defending against parameter modification.

  • ENISA-STL-2025-03-sD.24-i07
    addresses
    moderate

    Real-time physics-model verification of inputs to satellite bus and payload flags propulsion commands that violate physical plausibility.

  • ENISA-STL-2025-03-sD.24-i08
    mitigates
    high

    Process-ID whitelisting for satellite-bus commanding restricts the IDs allowed to issue propulsion commands.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, EX-0012.07 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.