Emergency Protocols & Priority Preemption

When Safety Can't Wait

On Earth, a "priority interrupt" means reordering a queue. In deep space, it means something more dramatic: an emergency bundle arrives mid-transfer and must physically interrupt an in-progress data stream, transmit via a backup link, and then let the original transfer resume. This is the EmergencyProtocol — the mechanism that ensures a collision-avoidance alert or a spacecraft health telemetry burst reaches Earth even when the primary downlink is fully occupied.

The Preemption Decision

Only EMERGENCY_SAFETY traffic has the preemptive property set to True. When an emergency bundle arrives while another transfer is in progress, the protocol follows this decision tree:

Emergency bundle arrives mid-transfer.
  ├─ Is the in-progress item rank ≤ emergency rank?
  │     → NO PREEMPTION (current item is equally or more urgent)
  ├─ Else:
  │     1. PREEMPT: suspend the current transfer
  │     2. SEND EMERGENCY: via direct-to-Earth backup at 10 kbps
  │     3. RESUME: original item continues after the emergency clears

The rank comparison is crucial: if the in-progress item is already EMERGENCY (rank 0), a new emergency does not preempt it — they are equally urgent, so the first one finishes. Only a lower-priority in-progress item is preempted.

The 10 kbps Direct-to-Earth Backup

The emergency is sent via a dedicated direct-to-Earth backup link at direct_to_earth_rate_bps = 1.0e4 (10 kbps). This is deliberately a thin but reliable path — far below the 30 Mbps optical downlink, but it closes even when the primary link is down (weather, pointing failure, conjunction). The design insight: an emergency alert is small (bytes, not megabytes), so the low rate still meets its seconds-level deadline.

Example: a 50,000-byte collision-avoidance alert at 10 kbps:

tx_time = (50,000 × 8) / 10,000 = 40 seconds

Forty seconds is well within the emergency deadline. Compare this to waiting for the 8 GB panorama to finish on the optical link (minutes), then queueing behind mission-critical data — the delay could be fatal.

Safe-Mode Communications

When the FDIR controller exhausts its recovery budget and drops to SAFE_MODE, the spacecraft's communication profile changes fundamentally:

SAFE_MODE is the fail-safe: the spacecraft ceases autonomous action, transmits a beacon on the S-band (2.3 GHz) TT&C channel, and waits for Earth to diagnose and command recovery. The beacon carries essential health information (power state, last known fault, current time) at minimal power. This is the same approach used by every deep-space mission — Voyager, Mars rovers, Cassini all have a safe-mode beacon.

Buffer Overflow Eviction Policy

When sustained ingress exceeds egress (approaching conjunction, multiple assets transmitting simultaneously), buffers fill. AETHERIX's eviction policy is graduated and strictly priority-ordered:

The congestion_control policy (priority 90 in the policy engine, match_all=True) fires when:

buffer_occupancy > 0.9  AND  bundle.priority >= 3
→ DROP

The eviction order is always: 1. P4 BULK (oldest first) — never mission-critical, re-transmittable 2. P3 HOUSEKEEPING (oldest first) — continuously regenerated telemetry 3. P2 STANDARD (only if buffer > 95%) — reluctantly, unique science data 4. P0/P1 → NEVER EVICTED — protected absolutely

The BundleQueue sorts by (priority, deadline), so the first bundles dropped are always the lowest priority with the furthest deadline. EMERGENCY (rank 0) and HIGH_SCIENCE (rank 1) are never evicted while a lower-priority bundle occupies space.

Buffer Allocation (Starvation Prevention)

To prevent a burst of P0 emergency bundles from starving P2–P4 of storage, each priority class has a guaranteed buffer share:

Plus any unallocated space is fair game for any class. This prevents a P0 flood from consuming the entire buffer while still giving emergency data guaranteed headroom.

Custody Refusal as Back-Pressure

When a node reaches 95% buffer, it sends a Custody Refusal to upstream nodes. The upstream node stops forwarding to the congested destination and seeks alternate paths. This is analogous to IEEE 802.3x pause frames but at the DTN layer — it prevents cascading congestion by creating back-pressure rather than forward-pressure.