Defense-in-Depth Power Architecture

Layered sources - utility, Aegis N+1, storage, and load management - ensure no single failure reaches the mission.

Layers, not a single source

Defense in depth means the mission is protected by several independent layers, so that a failure in any one is caught by the next. For installation power, the layers are the outside utility (when present), Aegis in a redundant set, a storage buffer, and load management. Each is designed so its loss is survivable.

The layers

• Utility feed: used opportunistically, never depended on
• Aegis N+1: firm on-site generation with years of fuel
• Storage: bridges transitions and unit trips
• Load management: sheds non-critical demand to protect the core

How the layers cooperate

In normal operation the installation may run on the utility or on Aegis, with the others in reserve. Lose the utility and Aegis forms the island; lose a unit and storage bridges while the standby picks up; exceed available generation and load management sheds deferrable demand. The mission core sits behind all four layers.

Why depth answers the gate

No single layer meets a Tier III target on its own — a single Aegis unit is 0.86–0.995, far from 0.99982. Defense in depth is how independent, imperfect layers combine into high system reliability. The architecture is explicitly built around the gate, not in denial of it.

Described at the architectural level, the point is that independent, individually imperfect layers — utility, redundant generation, storage, and load management — combine into a system reliability that no single layer reaches on its own. The layers are also arranged to fail in a safe order — the least-critical resource is relied on first and shed first — so that the mission core is the last thing exposed as conditions worsen and the first thing restored as they improve.