General Disclaimer

One or more of the Following Statements may affect this Document

This document has been reproduced from the best copy furnished by the 

organizational source. It is being released in the interest of making available as 

much information as possible.

This document may contain data, which exceeds the sheet parameters. It was 

furnished in this condition by the organizational source and is the best copy 

available.

This document may contain tone-on-tone or color graphs, charts and/or pictures, 

which have been reproduced in black and white.

This document is paginated as submitted by the original source.

Portions of this document are not fully legible due to the historical nature of some 

of the material. However, it is the best reproduction available from the original 

submission.

Produced by the NASA Center for Aerospace Information (CASI)
NASA CH

MC q -83 615

Contract NASB-34938

,z - 

(NASA-Ch- 17U y 74) eUk La SUtSYSI Lt. AUTUMATICh S84 - 1768b

STwdI Fival 8epoit (nartiL Marietta

Aerospace) l'81 p HC Ali/.If AU 1 LSCl IUB

Unciaz

uJ/44 Io,8tj

Final

Report November 19133

t

Power

subsystem

C:1 R E^EIVEO ^'

^F Automation

Study
MC R-83-645

Contract NAS8-34938

Final

Report November 1983

POWER SUBSYSTEM

AUTOMATION STUDY

Prepared by:

M. S. Imamura, R. L. Moser, and M. Veatch

for:

National Aeronautics and Space Administration

George C. Marshall Space Flight Center

Marshall Space Flight Center, Alabama 35812

Contract NAS8-34938

MARTIN MARIETTA AEROSPACE

DENVER AEROSPACE

P.O. Box 179

Denver, Colorado 80201

is
f 1p

FOREWORD

This study was conducted by the Power Systems Section of Martin Marietta Deliver Aerospace. The program manager was Mr. Matthew S. Imamura.

Study support personnel and their areas of contribution are:

Robert Moser Power Processing, Subsystem, and Automation

Marty Veatch Power Sources and Power Distribution Devices

Robert Richards Energy Storage

Eric Dietrich Artificial Intelligence and Expert Systems

Matthew Imamura Subsystems, Systems, and Automation

s

_ 

r
ACKNOWLEDGEMENTS

The MFSC Contract Officer Representative for this work was Mr. David

Aichele. His technical guidance to the study, along with discussions

and reviews by the following HQ and MSFC technical personnel, is gratefully acknowlediged;

HQ

Mr. Simon Manson - Project and Technology Review

MSFC

Mr. Walter Frost Program Directions and Artificial Intelligence

Technology

Mr. Jimmy Miller - Power

Mr. Roy Lanier - Power

Mr. James Graves - Power

Mr. Audie Anderson - Software

F 

K

tt

"

_a
ABSTRACT

Martin Marietta Denver. Aerospace undertook a study to develop a method

for analyzing, selecting, and implementing automation functions for

multihundred-kW photovoltaic power systems intended for a manned space

station. The study involved identification of generic power-system 

elements and their potential faults, definition of automation functions

and their resulting benefits, and partitioning of automation functions

between power subsystem, central spacecraft computer, and ground

flight-support personnel. All automation activities were categorized

as data handling, monitoring, routine control, fault handling, planning

and operations, or anomaly handling. Incorporation of all these classes of tasks, except for anomaly handling, in power subsystem hardware

and software was concluded to be mandatory to meet the design and operational requirements of the space station. The key drivers are long

4x

mission lifetime, modular growth, high-performance flexibility, a need

to accommodate different electrical user-load equipment, onorbit assem- 

bly/maintenance/servicing, and potentially large number of power subsystem components. A significant effort in algorithm development and

validation is essential in meeting the 1987 technology readiness date

for the space station. 

Artificial intelligence technology was briefly assessed, specific

with regard to the applicability of expert systems to the automation

functions defined for the power subsystem. Expert-system software 

techniques have the potential of vast improvement over traditional approaches. Possible onboard applications are for electrical consumables

management and battery-operations management, which are system-level

tasks. Potential applications for ground use are in non-real-time

fault diagnosis, anomaly assessment, and mission planning. An indepth

research investigation is desirable to determine the range and domain

of artificial-intelligence technology and the resulting hardware and

software needs for onboard spacecraft use.

iv 
IF

GLOSSARY

ADC Analog-to-Digital Converter

AgZn Silver-Zinc

AI Artificial Intelligence

AMO Air Mass Zero

APSM Automated Power System Management

AU Astronomical Unit

BOL Beginning of Life

CDS Control and Display Subsystem

CMD Command

CPU Central Processing Unit

CPV Common Pressure Vessel

CTS Communication and Tracking Subsystem

CV Charge Voltage

dc-dc Direct Current to Direct Current

dc-ac Direct Current to Alternating Current

DD Detailed Design

DDTE Design, Development, Test, and Evaluation

DMS Data Management Subsystem

DOD Depth of Discharge

DV Discharge Voltage

ECASS Environmental Control/Life-Support Subsystem

EMS Energy Management Subsystem

EOCV End-of-(;harge Voltage

EODV End-of-Discharge Voltage

EODP End-of-Discharge Pressure

EOL End of Life

EPS Electrical Power Subsystem

ESR Equivalent Series Resistance

EVA Extravehicular Activity

GaAs Gallium Arsenide

GEO Geosynchronous Equatorial Orbit

GNCS Guidance, Navigation, and Control Subsystem
GSE Ground Support Equipment

f

GSFC Goddard Space Flight Center

H2 O2 Hydrogen-Oxygeu

I 

Current at Maximum Power Point

IPV Individual Pressure Vessel

Isc Short Circuit Current

IUS Interim Upper Stage

JSC Johnson Space Center

LEO Low Earth Orbit

LiSOC12 Lithium Thionyl-Chloride

MSFC Marshall Space Flight Center

NiCd Nickel-Cadmium

NiH2 Nickel-Hydrogen

P3 Programmable Power Processor

PD Preliminary Design

P Maximum Power

tr

m

PS Propulsion Subsystem

PSAS Power Subsystem Automation Study

r ^; PV Photovoltaic

RF Recharge Fraction

RFC Regenerative Fuel Cell

RPC Remote Power Controller

S/C Spacecraft

SEP Solar Electric Propulsion

SOC State of Charge

SOH State of Health

SCATHA Spacecraft Charging at High Altitude

J Si Silicon

SR Series Regulation ^i 

SW Switch

TCS Thermal Control Subsystem

TM Telemetry 

Voc

Open Circuit Voltage

VO Viking Orbiter 

e

vi

ry
1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.7.1

1.7.2

1.7.3

1.7.4

1.8

Y41

2.0

2.1

2.2

2.3-

3.0

3.1

3.1.1

3.1.2

3.2

3.2.1

3.2.2

CONTENTS

Page

GLOSSARY. . . . . . . . . . . . . . . . . . . . . . . v

EXECUTIVESUkMARY . . . . . . . . . . . . . . . . . . . . . 1-1

Introduction . . . . . . . . . . . . . . . . . . . . 1-J.

Characterization and Classification of Power Subsystem . . . .-3

Definition of Faults and Factors A.f.fectine Power-Subsystem

Performance . . . . . . . . . . . . . . . . . . . . . . . 1-6

Definition of Automation Functions . . . . . 1-9

Partitioning of Automation Functions . . . . . . . . . . 1-1,3

Method for Automation Assessment and Implementation • 1-14,

Artificial Intelligence (AI) and Expert Systems . . . . . 1-16

AI Technology . . . . . . . . . . . . . . . . . 1-16

What Is An Expert System? . . . . . . . . . . 1-17

Natural Language Interface . . . . . . . . . . . . . . 1-18 

Expert System Applicability . . . . . . . . . . . .-. . 1-19 

Conclusions and Recommendations . . . . . . . . . . . . . 1-20 

INTRODUCTION . . • • • • • • • • • • • • 2-1

Objectives and Scope . . . . . . . . . . . . . . . . . . .. . 2-1

Study Guidelines . . 2-1

Background Information . . • • . . . • • • 2-2

TASK 1 — CHARACTERIZATION AND CLASSIFICATION OF POWER

SUBSYSTEM. . . . . . . . . . . . . . . . . . 3-1

System Configuration . . . . . . 3-2

General Classification . . . . . . . . . . . . . . . . 3-2

Specific System Arrangements . . . . . . . . . . 3-8

Photovoltaic Array . . . . . . . . . . . . . . . . . 3-9

SEP Solar Array (Ref 16) . . . . . 3-11

Ultralightweight Solar Array (Ref 17) . . . . . . . . . . . . 3-14

vii

i

An-
{

3.2.3 High Concentration Array - Cassegrainian (Ref 18) . . . . . . 3 -17

3.2.4 Low-Concentration Array- Trough/Pyramidal (Ref 19) . . . . . . 3-20 

3 .3 Energy Storage . . . . . . . . . . . . . . . . . . . . . . . 3-22

3.3_.1 Nickel-Cadmium . . . . . . . . . . . . . . . . . . . . 3-22

3.3.2 IPV and CPV Nickel Hydrogen Battery . . . . . . . . . . . . . 3-26

3.3.3 Bipolar Mickel Hydrogen 'Battery . . . . . . . . . . . 3-30

3.3.4 Regenerative Fuel. Cell (RFC) . . . . . . . . . . . . . . . . 3-33

3.4 Power Conditioning . . . . . . . . . . . . . . . . . . 3-36

3.4.1 Series Resonant Inverter . . . . . . . . . . . . . . . . . . . 3-36

F 3.4.2 Dc-Ac Inverter . . . . . . . . . . . . . . . . . . . 3-38

3.4.3 Switched-Mode Dc-Dc Buck Converter . . . . . . . . . . . . . 3-40

3.4.4 Transformer Coupled Converter . . . . . . . . . . . . . . . 3-44 

k 3.4.5 Partial/Full Shunt Regulator . . . . . . . . . . . . . . 3-47

3 .5 rower Distribution . . . . . . . . . . . . . . . . . 3-49

a

3.5.1 Magnetic Latching Relays . . . . . . . . . . . . . . . . 3-49

3.5.2 Motor-Driven Switches . . . . . . . I . . . . . 3-51

3.5.3 Solid-State Switch--RPC . . . . . . . . . . . o 3-52

3.5.4 Fuses . . . . . . . . . . . . . . . . . . . . . . 3-55

. 3.5.5 Circuit Breaker . . . . . . . . . . . . . . . 3-57 

3.5.6 Cabling . . . . . . . . . . . . . . . . . . . 3-58

3.6 Power Transfer Devices (Gimbals) . . . . . . . . . . . . . 3-62 

A 3.6.1 Slip Rings . . . . . . . . . . . . . 3-62

3.6.2 Roll Ring . .

..

. . . . . . . . . . . . . . . . . . . . 3-64

3.6.3 Rotary Transformer . . . . . . . . . . . . . . . . . 3-66

3.6.4 Flex Cable . . . . . . . . . . . . . . . . . . . . .. 3-68 

3.7 Sensors and Signal Conditioning . . . . . . . 3-69

3.7.1 Ac Voltage and Current Sensors . . . . . . . . . . . . . . . . 3-69

3.7.2 Dc Voltage and Current Sensors . . . . . . . . . . . . . . . . 3-71

3.7.3 Temperature Sensors . . . . . . . . . . 3-73 

:.7.4 Pressure Sensors . . . . . . . . . . . . .'. . 3-74

4.0 TASK 2 - DEFINITION OF FAULTS AND FACTORS AFFECTING

EPS PEAFUH.MANCE . . . . . . . . . . . . . . . . . . . . . . . 4-1

4.1 Photovoltaic Array Failure Modes and Operational Impact . . . 4-8

4.2 Energy Storage Failure bodes and Operationl Impact . . . . 4-10
4.2.1 NiCd Cell and Battery . . . . . . . . . . . . . . . . . . . . 4-10

4.2.2 NiH2 Cell and Battery . . . . . . . . . . . . . . . . . . . 4-13

4.2.3 Regenerative fi2 O2 Fuel Cell . . . . . . . . . . . . . . . 4-14

4.3 Power Conditioning Failure nodes and Operational Impact . 4-18

4.3.1 vrogrammable Power Processor (P3 ), 1='ck he-Dc Converter . . . . 4-16

4.3.2 Transformer-Coupled Converter (TCC), Buck-Derived Dc -Dc

Converter . . . . . . . . . . . . . . . . . . 4-20

4.3.:3 Series Resonant Inverter (SRI) Dc to Ac . . . . . . . . . . . . 4-22

4.3.4 Solar-Array Voltage Controller . . . . . . . . . 4-25

4.3.5 Housekeeping Power Supplies . . . . . . . . . . . . . . . . . 4-29

4.4 Power-Distribution Device Failure nodes and Impact . . . . . . 4-30

4.4.1 Magnetic Latching Relays . . . . . . . . . . . . . . . 4-30

4.4.2 Motor-Driven Switches . . . . . . . . . . . . . . . . . . . . 4-33

4.4.3 Remote Power Controllers . . . . . . . . . . . . . . . 4-35

4.4.4 Fuses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-37

4.4.5 Circuit Breakers . . . . . . . . . . . . 4-38

4.4.6 Cabling . . . . . . . . . . . . . . . . . . . . . . . . 4-39

4.5 Sensors and Signal Conditioning Failure Modes and Operational

Impact . . . . . . . . . . . . . . . . . 4-41

4.6 Power-Transfer-Device Failure Modes and Operational Impact . 4-44

4.7 Auxiliary Power Sources Failure Modes and Operational Impact 4-46

4.7.1 Lithium Thionyl Chloride (LiSOC1 2 ) Battery . . . . . . . . 4-46

4.7.2 Chemical Turbomachinery . . . . . . . . . . . . . . 4-47

4.8 Other Activities and Factors Affecting EPS Performance . . . 4-48

4.8.1 Flexible-Structures and Control-Subsystem Activities . . . . 4-51

4.8.2 Data Management Subsystem kDMS) Activities . . . . . . . . 4-51

4.8.3 EPS/Astronaut Interface . . . . . . . . . . . . . 4-53

4.6.4 EPS/Ground 'Interface . . . . . . . . . . .... . . . . . . . . . 4-54

4.8.5 Modular Buildup . . . . . . . . . . . . . . . . . 4-54

4.8.6 Thermal-Dissipation Management . . . ., . . . . . . . . . . 4-54

5.0 TASK 3 - DEFINITION OF AUTOMATION TASKS . . . . . . 5-1

5.1 Fault-Handling Tasks . . . . . . 5-10

5.2 Monitoring Tasks . . . . . . . . . . . . . . . . . . 5-10

5.3 Control Tasks . . . . . . . 5-10

5.4 Planning and Operations Task . . . . . 5=10

ix
E:

6.0 TASK 4 - PARTITIONING OF AUTOMATION TASKS . . . . t .. . . . . . 6-1

6.1 general Method . . . . . . . . . . . . . . . . . . . . 6-2

6.2 Results of Fault-Handling Automation Partioning .. . . . . . . . 6-9

6.3 Results of Partioning of Other Automation Tasks . . . . . . . . 6-19

,.

TASK 5 METHOD FOR AUTOMATION TASK ASSESSMENT AND

IMPLEMENTATION . . . . . . . . . . . . . . . . .

Generation Method . . . . . . . . . . . . . . . . .

Step 1 - Define Study Area . . . . . . . . . . . . .

Step 2 - Define Inputs . . . . . . . . . . . . . .

Step 3 - Define Faults and Impacts . . . . . . . . . .

Step 4 - Determination Automation Candidates, Benefits,

and Categories . . . . . . . . . . . . . . . . . . .

Step 5 - Partition Automation Based on Level of Autonomy . . .

Method Validation - Example 1 . . . . . . . . . . . .

Step 1 - Define Study Area . . . . . . . . . . . . . .

Step 2 - Define Inputs . . . . . . . . . . . . . . .

Step 3 - Define Faults and Impacts . . . . . . . . . . . .

Step 4 - Define Automation Candidates . . . . . . . .

Step 5 - Partition Automation Task . . . . . . . . . . . . .

Summary of Dc/Dc Converter Automation Assessment . . . . . .

Method Validation - Example 2 . . . . . . . . . . .

Step 1 Define Study Area . . . . . . . . . . . . . . .

Step 2 - Define Inputs . . . . . . . . . .

Step 3 - Define Faults and Impacts, and Analyze Corrective

Actions . . . . . . . . . . . .

Step 4 - Define Automation Candidates and Benefits . . . . .

Step 5 - Automation Partitioning . . .

Summary of Cable Automation Study . . . . . .

7-1

7-4

7-4

7-5

7-9

7-10

7-11

7-11

7-11

7-11

7-12

7-15

7 -17

7-17

7-18

7-18

7-18

7-18

7-20

7-21

7-22

7.0

7.1

7.1.1,

7.1.2

7.1.3

7.1.4

7.1.5

7.2

7.2.1

7.2.2

7.2.3

7.'2.4

7.2.5

7.2.6

7.3

7.3.1

7.3.2

7.3.3

7.3.4

7.3.5

7.3.6

8.0

8.1

6.1..1

8.1.2

8.2

ARTIFICIAL INTELLIGENCE: (AI) TECHNOLOGY AND ITS ROLES . . . .

AITechnology . . . . . . . . . . .

What Is An Expert System? . . . . . . .

Natural Language Interface . . . . . . . .

Criteria for Identifying Expert-System Software Candidates

8-1

8-1

8-2

8-5

8-8
l' 8.3 Potential Roles of the Kt;pert System in Power Subsystem

y,

Automation . . . . . . . . . . . . . . . . 8-8

9.0 CONCLUSIONS AND RECOMMENDATIONS . . . . . . . . . . . . . . 9-1

6

10.0 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . 10-1

APPENDIX A

STATEMENTOF WORK . . . . . . . . . . . . . . . . . . . A-1

F: APPENDIX R

SIMPLIFIED .BLOCK DIAGRAMS UF VARIOUS SPACECRAFT PHOTOVOLTAIC

F

F

POWERSYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . B-1

kA

c; APPENDIX C

0r; 3 LEVELS OF AUT014014Y . . . . . . . . . . . . . . . . . . . . . . C-1

a

r

xi
I R

1.0 EXECUTIVE SUMMARY

This chapter presents an overall summary of the study results. Chapter

2.0 provides the objectives, guidelines, and background information for

this study. Chapters 3.0 through 7.0 follow with detailed results of

the study, arranged in order of the five study tasks. Chapter 8.0 summarizes the artificial intelligence technology and its status, and discusses the potential applicability of the expert system techniques

among the power subsystem automation functions identified.

1.1 INTRODUCTION

A major purpose of the Space Station is to implement new designs, concepts, and methods that will reduce life-cycle costs, extend operational life, and yield improved system performance. The resulting power

subsystems must therefore be flexible, reliable, efficient, controllable, and most of all, employ a high degree of automation in their

operation. To this end, automation technologies are expected to make

signif tzrt and important contributions to the development and affordabl;^ aper'ation of these missions. Therefore, the electrical power subsystem (EPS) must ensure, in the event of a failure, that the onboard

power capability will degrade gracefully while providing for some minimum set of useful services. The ultimate power-subsystem configuration

would be one that protects against failures and reconfigures itself in

the event of a failure so as to continue normal operations.

The primary objective of the NASA-MSFC study undertaken by Martin Marietta Denver Aerospace is to assess and trade off the automation tech- 

nology required to support a multihundred-kW power subsystem in orbit.

This study also is intended to identify the benefits that can be 

achieved by a logical and planned application of automated and autonomous functions. The basic study guidelines are:

1) Generic photovoltaic power system in the 100- to 250-kW range;

2) Manned and unmanned space station operation;
3) 10-year life.

It is intended that the automation concepts identified will significantly reduce the ground and onboard operational burden; accommodate

near-term hardware-technology limitations; and reduce the development,

operations, and resupply costs of the space station.

The following definitions of automation and autonomy apply to this

study:

Automation - The performance of a function independently and in a manner invisible to the human user or operator;

Autonomy - The application of automated functions without external

human intervention for a specified period of time.

There are two basic ways of implementing automation. One is to use

hardwired analog circuits and discrete devices. The other is to use a

programmable controller or computer. The automation of various monitoring and control tasks enables an autonomous operation. As the duration of autonomous period increases, so does the complexity of automation. Autonomy levels of a spacecraft developed by JPL for the Air

Force (Ref 1)* were used in this study for the purpose of demonstrating

a method for automation assessment and implementation. The duration of

autonomy can be described as (1) operating for x days without ground.

intervention and no degradation, or (2) operating for y days without

ground intervention and under a permissible degradation.

The study consisted of the following five tasks:

1) Characterization and classification of power subsystem;

2) Definition of .faults and factors affecting electrical power subsystem (EP5) performance;

*The number in parentheses is the source reference listed in Chapter 10.

1-2

_
3) Definition of automation task candidates;

4) Partitioning of automation functions;

5) Development of automation assessment and implementation method.

The results of each of the above tasks are summarized in the following

sections. Appendix A contains the contractual statement of work for

these study tasks.

1.2 CHARACTERIZATION AND CLASSIFICATION OF POWER SUBSYSTEM

As shown in Figure 1.2-1, a generic photovoltaic power subsystem was

defined by identifying the most promising components under each of the

following major subsystem elements: (1) array, (2) power conditioning,

(3) 1-.atteries, and (4) power distribution. Other elements such as gimbals, auxiliary power sources, and sensors/signal-conditioning circuits

were also included. To provide the basis for definition of EPS faults

and automation candidates, typical subsystem configuration arrangements

were also identified. These arrangements fall into two basic categories, series regulation and direct-energy-transfer types (Fig. 1.2-2

and 1.2-3). The power-subsystem interfaces with all components that

consume electrical power and with subsystems that are involved in monitoring and control functions. Figure 1.2-4 shows these interfaces,

which are defined in terms of the major space-station disciplines.
'" ORIGINAL PAGE IS

OF POOR QUALI

Photovoltaic ,. Power Power..

Array Conditioning istrlbution

- Concentrator - Dc-dc Converter -Mag Latch Relays

- Cassagranian - Series Resonant Batteries -Motor-Driven Switches

- Trough

- SEPS

Converter -Solid State

- Transformer- Coupled - NiH2 Fuses

- CPV) Nonconcentratin g Converter -Fuel Cell, -Circuit Breakers Fuel ell,

Arrays - Partial/Full Shunt -

 Regenerative, Solid-State Power

Regulator - Controllers

- Dc-ac Inverter H2 ^2 °Cabling

- P3 Technology - Copper

- Housekeeping - Aluminum

Power Supplies - Flat and Round

Gimbals

- Slip/Roll Ring Auxiliary

- Flex Cable Power Sources Sensors and

t - Rotary Transformer - AgZn Battery

Signal Conditioning

Circuits

- LiSOC12 Battery

Fuel Cell, 112-02

. - Chemical Turbomachinery

Figure 1.2-1

Generic Photovoltaic Pottier Subsystem for Space Station

Unregulated

(HV do Loads

4

Array HV do Power

Section 1 Distributor Regulated

Main 1iV do Loads

Array Array Power

Distributor do-dc LV do Power

I

28 Vdc Section 2 Power Charger Converter Distributor Loads

c Distributor Requlator )

0

:rray

Sron N Batteries

A

do-ac ac

{nverter

ac Power

Distributor Loads

C D I

Power Control I

Power Subsystem Unit

_— CD Command and Data Handling _ Subsystem
ORIGINAL PACE 13

OF POOR QUALITY Unregulated

IHV dc. toads

I

[Se

y

HV do Power

wn I Distributor fte<julated

Main I HV do toads

Power Array Array Distributor do - ch IV do Power y 28 Vdc Section 2 Power Converter Distributor

Distributor loads

Arra __— do ac _ ac Patter I ac

Section N yI rive rte r [EldIte'ries Distributor I Loads

C IDL

Power Control l

Unit I

Power Subsystem

C D Command and Data Handling

Subsystem

Figure 1.2

Direct Energy—Trans fer Configuration of a High—voltage, Nigh—Power Space

Station Power ModuZe

Attitude Thermal

Control Control - Payloads

Subsystem Subsystem

I 4 —

Power

Subsystem

Command and

Data Handling

Subsystem

Propulsion

Subsystem

Lighting

Subsystem

Pyrotechnic

Devices

Legend:

---- Control and Data Signal

Power

Figure 1.2-4 Porter Subsystem Operation Interfaces

1-5
1.3 DEFINITION OF FAULTS AND FACTORS AFFECTING POWER-SUBSYSTEM PERFORMANCE

The basis for defining the automation function was the identification

of all EPS and non-EPS faults and activities that could affect the FPS

or prevent it from performing its intended functions. All major faults

were identified for each generic subsystem components listed in Figure

1.2-1 except flywheel energy storage and computer-related devices and

circuits. A fault may be defined as the interruption of service at one

or more levels of the space station's functional architecture. Specific levels are:

Piece Part

- .Assembly

- EPS

System

Table 1.3-1 is a summary of the major failure and degradation modes for

each component. A summary of other subsystems and the failure that can

affect the EPS is shown in Table 1.3-2.
s ^

y

w.

R

^O

t • cJ Qww

!nab0

^,.

1rO

•rl

td

•v

cd

>ato A

u

Q) waw

•rl 41

^+ 6

to

>a C: bo

a 

•

r

q

0

ij " •rl

r•i cd

u

•ri

0 s.+

R+c)dwH04 1 I 1 b

cd

w= O

0 u 0

rl

a '>y •4J

cd

o cd 

•ri aJ b0

U)O of

to -H O 41 

a

a u 

H

cou

1-1w

•rl

a a, u

3" 14 0 Ir ca I o

ri

Ltdpaa0a

r-Iu

ri

41w

td

wwI

0LO)s4

cn0

^+ m

IrOw

0

rf M

$1a0a

u co

to

a 

G

H 

•r-I

u 04

rl

41

N O

cd

N

P4 4-4 I aOp

a.Ua

r-I w

>^ou

saa

^/]

iii

riu0

P. a

td bo

J 

mu

w r-1 O o>

O 3 0 0

as1 1

41

riu

cdP. a

Wb0

V 

w

11

w r-4 0 o

. +

N

u) 3 0 0

0-4 1-4 I 1 a

to

aN

,^ •.^

r-I

u

O m

> P. cd

rA 

v

cd

t~ 

w

ri

o

W

N

3 u) 0 o

as( i

5, uGa

•H a

U r-i

•rl a.

w a.

w vi

41I 1

co cad Q U a) 

n r-) p 4z a

UU

OO

Oy

O

a ri

a U) yr

w

o 4-1

0 cna

41

H

a >4

o

0 a)

= a) coa

1

0 GY

U G 

> )-t

0 O Pi 41 td O 1-4

CJ

N

O Si

w b0

O

rl

•ri

O

O

a N a

•

p b x ^.'O 1-I

a r-1 cd •rl td w

r-1 r

♦ 'U f4

0 ri* ri C 

Id W td

O

O i.

j.(. -. 41 co r I to H O I 4-J u

wri 

wri ^(

x r-1N

U a O

G a w a)

N

o r-i

a

m

a r 1 C ri

to CO 1•+ k4 x 

a bn r 1 S.a 7-+ ri H >`! $4

a 0w

p

a

a

0

>

0

a

a

'C7 CJ a 

O

w U r-A cc I r-I

O r-♦ u .r C-0

O N N-- a? 41 r-{ w r-1 a) r-1

O r-I

O

0

o x a 4 4 ro

a v a a 0 W a

a a v a ti

bo O cn

p

w a U IJ cn O U

w U a 

w a 41

a 41

4 :3

0 co r- ca a ca a. W U) a. " 

0

+

-

j

0

1+ isw

G

0 •ri •ri 

u

O a a.

W w 

a O A

N Cy p r-I P a.

o a 00

aa ri to U 5 r-1 o a

a

> a a

aa 0 

•rl

0

r-i a. .a

4 a, a. N N O .o DE

a

0O Cl.

a $4C

> Pw ^ td •Z o

•ri 0 E

O

O xO>¢wH^ rn Ob'x w OO Ocn^Z, ^o

W 11

1

I

I

I

II

I

I

ffI

I

I

I

I 11

^

I

w >~ ai 1> 0 0o t~ I~ G

co

41 b0 ao (3) ca

T H WU

O 14

O0 td

u

^"

1 (1)

A

Q)0 r4 rl

W >a I 9, 1 T I'd

r. '> C4

a r-1 )a r i S + a 

•ri S4

U

O

O 41

0 a s a s ri W a

A

o r 1

1-1 ri Do r-I U tJ

U J..1 ld -i 1J

can

x F3+

m

P4

c

u z^

z

m auaai a+
to

w

•d

O

f~0

.r{

i.1cd

'

10

4

a

A

U

•U H

•ri o,

W G. W •rt

w x

I r

tj

d

u

r1

W

W

w

I

a

r-4

0

w

0O

O

44

O

O a

cd

ri (A

-H04

L

14 b cd o

a co

r

4J

u

Cd

o

U

d

•d u

to co

a0) w

W •rl

u O

O w

r-1c>r

I

u

o u

U

aJ 41co ^'. b usn o

CA CO. W 4

a) O O u

H •r4 rn •r1

u m w b O a o O H x a H

1 1 •0L

„ ^

0)

w

A

Wrl

o

-HLJ

H

ton O

1

Hb H

w

a1

u

W

41

w

O

to

r-4

J

O

p

^

d

0

a

to0O

•,i

u

cd

•r4

u

to O•,i

44 4J

O $4

O r-I

A U

u O

t0j 4J u O

.14o

1

bo

d

W u u O 41 O •r1 w

3 0

a Wrt U

^ u

to w H H A. O rn

> cn •ri w

3 o c

o

a d b u ao) co u $4

a+ 0

w

cd p 44 o CCd 

$W4 o w E q u mu Cd

40+ G0 u

44 V

cd to a (^, , i

1 41 w n. co

oao : ^

r-4 a

•rq to :1 41 14 En .^

v 41 cd w a. o + a ri cd 4.1 41

o" r^i a z i z x

w

w cd

aoi

owo •^ 0 U) cd. o U O U O O a O cd o to o 41 41 $,+ o > ri > A 14 a o to ri rl $4 w

y 1a 19 p

,

r

-

-

I

a co u o^ r o a (L) ^ w Od E-4

H

o

to U>

G

6

° ^+ u 

a a

u O a o

ro b U w o a

to O O 0 O 41 O td o G''

41

+1 a a u O HW H O ri H 0" 41 t0d 0s41

a

0 41 11 0 41 rn •ri H a rn 41 O u •,i f,+ P. w w a. 0 (n ri o r-4$4 r1 r•1 w r- o O C w O u .o w o +^ o o w a 0 ri cd •rl 0 u •ra $4 •ri w w w o cd w o ri

.rj O

o ,Z 

tn cn0H

do

a

o

w

td

H

14 cdato 0ow 1:.O a.n o wow FL+cn0 w u w OA Orn z G4H t9

Cd t r 1 1 i i 1 1 1 v i i r i i i i i 1 i

O 

q

A A 6 O p

U U c0 1a ci A

O A H o N 0^) m 0

(v 41 V

r 7 [-^

41 1-+ + N 0 a)

o P4 sa a 1-1 u 44 r-a H^ W.. 0 JJ. 41 1 a 41 O. 0) .r r-4 to tn. td a. u' W N p to 4J w > w 41 (A a O o w a 0 O W a a) a w a O cd w >, 4j 1.1 to •ri O .,.1

c

0>>

U H

ri a > u 41 o a o C. •1a > O, O r-4tor-q

E 93 to 4.J

O O w o O .0 O N w (1) O O- ^, (1) .0 cd 

U U M U R+ 9 z K P'. U 

(s+ U

cn

U x

1-8

^ r

r
ORIGINAL PAGE

OF POOR QUALITY

Table 1.3-2 Other Subsystems and Activities that Affect EPS Operation

Subsystem Failure/Activity Effects

Structures Modular Buildup Modular EPS Required

Thermal Control Impaired Capacity to ;Manage Haste Reduced Power

Heat

User Loads (All Shorts or Overloads Bus Undervoltage

Subsystems and

Payloads) Large Differences in Day and Night :May Reduce Bus Power;

Power at Buses Excessive Battery DOD

Attitude Control - Gravity Gradient Attitude "lode - Reduced Power

- !'allure to Maintain Required Stable - Reduced Power

Attitude Because of Unknowns in Controlling large, Licxible Structures

Command - Degraded TN Data lran^,-nis%ion - Reduced Information

- Loss of CPU Power - Reduced Automation

Capability

Data Software Maintenance Reduced Power

EPS/Crew Interface Crew Commands, Displays, New Crew, Reduced Power;

Interface Ambiguity, Mistakes Unintended Shutdown

EPS Ground Operations Power Management Configuration Reduced Power

Histor}; Audit Trail or Automated

Activities; Training; Commands/

Displays--

1.4 DEFINITION OF AUTOMATION FUNCTIONS

The ultimate objective is to produce a spacecraft that is fault tolerant and able to perform routine health and maintenance functions without ground intervention. To this end, faults and activities identified

for the generic power subsystem were used as a starting point. Specific fault correction and routine health and maintenance functions were

'. then identified. All specific automations were categorized under following classes: data handling, monitoring, routine control, planning

and operations, and anomaly handling. A generalized list of benefits 

was developed (Tables 1.4-1 and 1.4-2). P An example of the anal Pysis Y 

applied to faults for a do/dc converter is shown in Table 1.4- 3. Table

1.4-4 lists specific examples of automation tasks for monitoring, routine control, and mission operations and planning. 

s,

eu

1-9
ORIGINAL PAGE 18

Table 1.4-1 OF POOR QUALITY

A List of Generic Automation Functions

Data Handling

- Acquisition

- Processing

- Storage

Monitoring

- Operational State 

- State of Health

- Performance Analysis

- Trend Analysis

Fault Handling

- Fault Detection (Caution/Warning/Alarm

Limit Check)

- Fault Isolation

- Fault Correctipa

Control

Planning and Operations

Anomaly Handling

Table 1.4-2

A Generalized List of Potential Benefits from EPS 

Automation

Increased Life

- Increased Reliability, Maintainability, and

Safety

- Improved Performance

Reduced Cost

- Subassembly

- Subsystem

- Spacecraft

- Launch Operations

- Flight Operations

- Inflight Fault Detection, Maintenance, and Servicing

- DDTE (Design, Development, Test, and Evaluation)

- Ground Support Personnel Labor

- Ground Support Equipment (Prelaunch

and Flight Operations)

C&DH Subsystem

Thermal-Control Subsystem

- Life-Support Subsystem

- Crew Training Simulator/C&D Subsystem

— Reduced Maintenance

Able to Overcome Technology Limitations

Reduced Astronaut/Power Subsystem Interaction

- Reduced Number of Ground-Support Personnel

- Reduced New Subsystem Familiarization/

Training Time

- Reduced PV Array Size and Weight

- Reduced Battery Size and Weight

- Reduced Power Conditioning Size and Weight

- Minimized Human Error

- Allows Space Operation without Crew

- Provides Real-Time Short-Response Control

Reduced Software/Hardware Interfaces to C&DH

Subsystem

— Improved Security and Survivability

aft
ORIGINAL PAGE 19 

OF POOR QUALITY

0

N

yJ w

w

>3 N

Cl w

w ro

dJ 'C1 C= W

n z `d o

Li

O

ri ^.1 u u 1J

^i U t^

%-" 0 3

r-1 O O w. 9:

IJ H

r

O .^F.. ..3.

i+. z.'. w ^+fflw 41 0 V

...^ ^.

o > .c 0H Ul o a 0 v (!^

'o x ri w

En Oro W w u -10 pp H • wR u a

O

r q

O ro R1 3 0)n •rl •rl J.l 0. 0 13

u

ro Rl Rl w O

•rl .0 ro r-1 0 4 7-.

ro H

H

tr..0 O .a .0

4.1 •rl Lj W H +^ O v 4J N b0 GJ

ro 0 ro m O W O O D .o ro tr H ro

t00

ON

^ N

.00 rot

00

w W w A. •' 0 m 0

41 C7 \ H 1J W. ro W H O co 0o ro ro •rl u lu P4 W O b u H

c0 co O H H u 0 ro to

O O 0 0 &J 'b •r ( fA cd O 0 w o VA r i o0 ro •r( 0 u Cd 3 .>~ H H' n H 4J 0 cd H 0 w i, O b u GJ O' b H 0. H 9 .. rom .o 0. t~ z -1 w ca " a a+ 0 .3 co PLO H o H O 0 •H cd 0 O H

cd b w b C3

*/ " O r-4 3 a H r-1 v O

D o Gl o 0.0 u 'J 144 w 41 N H W w

a t -H00 .x hU w H 4" 4j H S a^ H -W

ro -W •r♦ 19u 0 rn •rl 'o 0. O u •ri 0 H ••

o u u 0 H H , MC" 0 u w H m o u u H 41 0 a

L' 41 u m O O 'z a P+ ro •ri ro o 7 -1 x •rl H O •rl GL M

i I 1 •rl ^'. •rf u 1-1 0 1r . CO •rl •rl u Ci W •r♦ C,' a 0 01 cu $ 0 H 0 — O W O O r-1 O H cd m O 7 H O 0 co `^ A 0 cn 0. A 'J •rl H H r-1 P+ W .0 O pw F. 0 m

O Cl

•rl -W rn

Cd

co ro

R b

V H

I

H ro

b ri N

H^ to O

i11 ro x x a co

H

0

O H H

.rl o vi

z z .>r a .^-^

3 v w ^ o

d 4 r-7 .^ H .'1." H H

N

rZ3

w

y

v

^ 1 O

_ - j

•

o

F .^

ft

to

d

't3

w,

Q

N

N

.a

r

^

N

'• a

r
i

ORIGINAL PAGE 18

OF POOR QUALITY Table 1.4-4 Examples of Monitoring, Control,

and Mission-Operation Automation Tasks

Monitoring Tasks

Operational State Determination

- Number and Identity of Components Online, Offline, or Failed

Relay Position and Command State

State of Health

- Solar Array, Batteries, Power Conditioning, Bias (Housekeeping) Power Supplies

- Built-in Test and Checkout

Performance and Trend Analyses

Solar Array

- Normalized Peak Power (NPP); Available Average Power/Daytime versus Orbit Number

- NPP and Isc Degradation

- Minimum, Average, and Maximum Temperature

Batteries

SOC, DOD, EODV, and EOCV Limit versus Orbit Number

- Average Temperature during Charge and Discharge versus Orbit Number

Total Number of Cycles above X%, DOD, T% DOD

Number of Cycles Since Last Reconditioning

Battery Recharge Fraction versus Orbit Number

Bus Power Capability (V •rbital Average, Average Power Margin)

Bus Load (Day, Night, and Orbit Average)

Converters and Inverters

- Normalized Efficiency

- Output Impedance

Load Equipment

- Input Impedance

Control Task

Solar Array

- Orientation Control

Voltage Regulation

Batteries

- Charge and Discharge Control

- Spare Module or Cell Management

- Reconditioning

- Redundancy Management

Converters

- Load-Sharing Control

Redundancy Management

Imbedded Controller (e.g., P 3 Converter)

- Mode Control (Voltage Regulator or Battery Charger)

—Internal Fault Detection and Isolation

- Overload Handling

- Output Voltage Programming

Planning and Operations Task

Electrical Consumables Management

- State-of-Health Prediction

- Operational State Determination'

- Energy-Balance Calculation

- Bus Power Capability and Power-Margin Prediction

Load Profile Determination

- Power versus Time

- Day, Night, Orbital Average

- Load Equipment Timeline versus Power Capability Analysis

- Mission Timeline Compatibility Analysis

Load Equipment Sequence-and-Command Generation
1.5 PARTITIONING OF AUTOMATION FUNCTIONS

A

The basic purpose of this task is to develop a method for partitioning

the automation candidate between the system, power subsystem, and

ground_. The partitioning method used is as follows. First, the time

criticality of the function is determined. From this analysis, functions can be separated into time-critical functions that require dedicated hardware, such as bus overvoltage; and functions that do not require the fast response time and are candidates to be performed by a

computer. Next, the location where the task is to be performed and the

resources to do the task are identified. A determination is then made

of the external interface impacts--Are the impacts totally within the

EPS? Or are these impacts outside the EPS? General criteria established for partitioning the automation functions are as follows:

- Dedicated hardware is to be located in the EPS component;

- Fault detection, isolation, and correction can be partitioned to

different levels;

- To be partitioned to the EPS, the fault must originate in the EPS;

the correction resources should be in the EPS; and there should be

no impacts outside the EPS.

Finally, the last step consists of considering each function partitioned to the EPS, the space station system, and the ground, and providing rationale for or against each subsystem's partitioning. Examples of partitioning of automation functions between the onboard and

ground are shown in Table 1.5-1 Note that partitioning can be facilitated in terms of where sensing, analyzing, and acting should best be

t .-

performed.

1-13 
ORIOINAL PAGE 18

Table 1.5-1 Partitioning of Automation Functions OF POOR QUALITY

Partitioning

Automation Function Sense Analyze Act Rationale/Comments

Monitoring

- Operational State EPS EPS EPS

- Performance and Trend

- Solar Array and Batteries EPS EPS EPS

- Power Conditioning EPS EPS EPS Other Subsystems Involved;

- Load Equipment (A) EPS EPS EPS Data Available to SYS

(B) EPS SYS EPS Simplest to Implement

- Bus Power Capability (A) EPS EPS EPS

(B) EPS SYS EPS

(C) EPS Ground EPS

Control

- Solar-Array Orientation (A) ACS ACS EPS Past-Practice Data

(B) SYS SYS EPS Available to SYS;

(C) EPS EPS EPS Requires SYS Concurrence

- Solar-Array Voltage Regulation EPS EPS EPS

- Battery Charge and Discharge EPS EPS EPS

Control

- Battery Reeonditioning (A) EPS EPS EPS Requires $YS Concurrence;

(B) EPS SYS EPS May Require Load Management

(C) EPS Ground EPS Past Practice

- Battery Spare-Cell/Module EPS EPS EPS

Management

- Redundancy Management (A) EPS EPS EPS

(B) EPS SYS EPS Whenever Other Subsystems Are

Affected

- Converter Loadsharing Control EPS EPS EPS

Planning and Operations

- Electrical Consumables Management (A) EPS Ground EPS Past Practice (Skylab);

(B) EPS SYS EPS Other Subsystems Involved

(C) I EPS EPS EPS

Legend: Note:

SYS System (A), (B), (C) Are Options

ACS Attitude-Control Subsystem

EPS Electrical Power Subsystem

1.6 METHOD FOR AUTOMATION ASSESSMENT AND IMPLEMENTATION

The first step is to define a specific study area such as how to automate the correction of overtemperature faults in batteries. Three

basic inputs required for the study are:

1) System-Level Criteria

a) Space station autonomy/automation requirements, including

m 

autonomy level,

b) Reliability, maintenance and safety requirements;

1-14 
2) Subsystem-Level Criteria

a) Functional requirements and description,

b) Subsystem interfaces, 

c) Component functional requirements;

3) Mission Oper,^tions

a) Man-machine interface,

b) Flight-controller functions (i.e., ground crew),

c) Astronaut/subsystem operational criteria and constraints.

The autonomy level is used to prioritize automation candidates and aid

in partitioning automation functions between the ground and the Space

Station. Reliability requirements are used to categorize faults and. to

aid in selecting a fault-correction option. Mission-operations criteria are used to define specific automation functions needed for orbital

operations.

Factors to be analyzed and defined in a detailed assessment of the

automation function are:

1) Impact;
5) Time-criticality;

6) Basic implementation , , hardware or software.

Basic technical elements in NASA's program development usually consist

of Phase A ( planning, conceptual requirements definition, and design),

Phase B ( preliminary requirements definition and design), and Phases C

& D (detailed design, fabrication, and integration; launch operations;

mission operations). It is assumed that Space Station-level autonomy/

automation and reliability requirements will be addressed in each of

these program phases, and their details will increase the program

phases' progress. The method outlined here depends to a large extent

on the system-level requirements available. Therefore, the extent to

which automation assessment can be done at the subsystem level would be

a function of level of details available at the station level. It is

logical then to assume that the designers, especially during Phases B,

C, and D, would have access to top-level specifications and design-criteria documents covering not only autonomy / automation requirements, but

also other high-level functional criteria.

1.7 ARTIFICIAL INTELLIGENCE ( AI) AND EXPERT SYSTEMS

1.7.1 Al Technology

Artificial intelligence is that branch of computer science concerned

with the design and implementation of programs that make complicated

decisions, learn, or become more adept at making decisions, interact

with a man in _a natural was, and, in ge::, eral, behave in a manner typically considered the mark of intelligence.

Intelligence is to be understood not as a property that, for example,

gifted mathematicians possess, but rather as a property all men and

. 

some animals possess. Intelligence, in this sense, is the ability to

understand and process large amounts of information. It is the ability 

to meet and cope with hovel situations, to comprehend the interrelationships between facts and concepts, and to generate new concepts and

1-16
relationships from those already known (i.e., already in the data

base). The artificiality of the intelligence means merely that the

intelligence is achieved by means of technology.

Scientific research done in AI covers a large area of theoretical topics such as knowledge representation, knowledge acquisition, problem

solving and search, vision, theorem proving, and natural language.

Though each one of these topics can be researched from the human-ability perspective, i.e., by asking how a man represents knowledge, acquires knowledge, solves problems, sees objects, communicateG, etc,

researchers in AI are concerned with implementing the given ability in

computers. AI is not only a theoretical enterprise, it has definite

and robust applications. The primary concern in the applications arena

is the design and implementation of expert systems and natural language

interfaces.

F 1.7.2 What Is An Expert System?

i An expert system is an intelligent computer program that embodies the

.r

knowledge of human experts in a particular domain of expertise. Expert

systems recognize situations, derive conclusions, make decisions based

on what they recognize, and recommend corrective and directive actions. All of this is done with a competence comparable to that of

human experts. Figure 1.7.2-1 illustrates the basic components of an

expert system. It contains a knowledge base, a rule base, and an inference engine. The knowledge base (sometimes called working memory)

stores the information (data) on which the expert system operates. The

a knowledge base is constantly updated as data are added or deleted. The

rule base is the component that gives the expert system its expert competence--that is, the ability to make decisions, recommend actions, etc.
1 ^

Control Knowledge

-

Natural Structure Base

User Language a 10

I (Inference I 

Interface Engine) Rule Set

^

I

1 ^

^.^ -Expert System owl

Figure 1.7.2-1 Basic Components of an Expert System

The inference engine's job is to execute various rules depending on the

contents (data elements) of the knowledge base. Conceptually, the inference engine's algorithm is a search and pattern match. It scans the

rules, efficiently searching for a rule whose antecedent (the IF part)

matches the present state of the world, i.e., the facts in the present

knowledge base. If a match is found, the consequent of the rule (the

THEN part) is executed. The actions can be anything from querying or

advising a human user to performing a real-world action, such as up- 

linking commands to a satellite or moving a robot arm, to manipulating 

z its knowledge base or rule set and modifying the behavior of the expert

system itself. `~ 

1.7.3 Natural Language Interface 

It is usual to have a natural language interface to facilitate the use

of the expert system. A natural language interface is a computer program that allows an end user to interact with an applications program 

using a "natural" language such as English rather than special menus or

special-purpose languages such as FORTRAN for programming, KAMIS for

=-^ data-base queries, or JOVIAL for command and control. A key advantage

to using a natural language interface rather than a more conventional

R-

` interface is ease of learning and use. Because English is used, no

special languages wust be learued. Because its use is an extension of

a person's normal communication skills, a natural language interface

can often be a highly effective way to interact with a computer program.

M

1-18
1.7.4 Expert System Applicability

Four considerations must be taken into account when deciding whether an

activity warrants using an expert system. These four are applicable to

a wide varety of domains and find ready application in the area of

automated power subsystems. The reader is referred to other publications (Ref 2 and 3) for a discussion of expert systems.

A given candidate for automation warrants considering the use of an

expert system if it:

1) Is to be used for possible control applications, for non-real-time

processing, or where very slow response is required;

2) Must process large amounts of information;

3) Requires nonalgorithmic, heuristic problem solving;

4) Requires a high-level, humanlike decision;

5) Is such that the software requires frequent modification as a result of changing performance characteristics, and operating criteria and constraints.

Another discriminator is complexity and how the tasks were performed in

the pasta Simple tasks that are well understood and have algorithmic

solutions are not good candidates for expert-system solution. If the

task is complex enough that in the past it could only be performed by a 

recognized expert, or group of experts, then the task is a good candidate for automation by expert-system software.

The following functions were identified as good candidates for automation by expert-systems software

1-19
1) Battery operations management (as contrasted with routine charge/

discharge control and protection);

2) Electrical consumables management;

3) Trend analysis;

4) Fault analysis (fault detection and diagnosis only and not corrective actions);

5) Anomaly handling.

In the past, the computer has been used to maintain a data base and to

plot data on request, but a man was required to interpret the data and

initiate corrective action. This is an area where expert-system software could be used to replace some of the human experts. Complex

faults that would require tree searching using algorithmic software

could be replaced by the heuristic approach. Consumables management

could be done with algorithmic software, but there may be benefits in

development time and ease of modifications if expert system software

were used because of the dynamic natures of power management and load

management. In the past, an anomaly has occurred when there was no

preprogrammed, algorithmic response to a situation. A group of experts

would be assembled to analyze the data, propose experiments, and dedt

a response. Many types of faults have similar traits. Anomaly handling and some types of faults therefore appear to be a fertile area

for an indepth assessment of expert-system applicability.

CONCLUSIONS AND RECOMMENDATIONS

The significant conclusions and recommendations of the study are as

follows

1) To meet basic station objectives and goals presently defined in 1

NASA Space Station Definition Book, all power subsystem automatic

candidates defined in this study, except for anomaly handling, mi

be implemented to a varying degree of automation.

1-20
2) Specific functions that have immediate high payoffs for onboard

applications are:

a) Data Acquisition, Processing, and Storage,

b) State of Health Monitoring,

c) Built-in Test and Checkout,

d) Fault Detection, Isolation, and Correction,

e) Performance and Trend Analysis,

f) Integrated Array/Battery Controller and Load Management (Space

Station Level),

g) Electrical Consumabl.es Management (Space Station Level).

Automation of any combination of the above functions (a through g)

will have a significant beneficial effect on mission-operations

efforts on the ground. A detailed study is recommended to determine the effects of onboard automation of monitoring functions on

ground activities such as failure detection, consumables managek menu, and crew and flight-controller training.

p3) A key driver in when and what to automate in the subsystem is

spacecraft autonomy level, which must be defined at the program

level.

4) The best way to partition an automated activity between the EPS,

spacecraft system, and ground is to first define each subtask

required to be performed, and then assign each subtask to EPS, system, and ground, in terms of;

a) Sensing,

1-21
k

b) Analyzing,

c) Acting;

5) For real-time control consideration, the principal driver in hardwired-versus-software (i.e., using digital computer) trade is the

speed requirement for implementing that control function. Therefore, in general, all offline or non-real -time tasks such as monitoring, performance analysis, and fault diagnosis that require slow

response and are not in the control loop, can be done with a digital computer.

6) The best onboard-application candidates for expert systems for any

of the power automation functions appear to be for electrical-consumables management and battery-operations management. Potential

ground applications are in non-real-time fault assessment and mission planning. An indepth research investigation is desirable and

highly recommended to determine:

a) The range and domain of its applicability to power-system control functions;

b) Adequacy of AI language for onboard use;

c) Computer hardware ( speed, memory) required to support expertsystem software.

7) 'A significant effort in engineering -algorithm development and validation is essential in meeting the 1987 technology-readiness date.

There are many implementation approaches to each automation function because they are done by software. Thus, future efforts in.

algorithm development must include optimization processes with simplicity and reliability in mind. It should be emphasized that algorithm development also is necessary to permit a detailed design

of any expert-system software such as that for electrical consumables and battery management.
2.0 INTRODUCTION

2.1 OBJECTIVES AND SCOPE

The primary objective of the study was to assess automation technology

required to support a multihundred-kW photovoltaic power subsystem for

space station and platforms. To do this, the following five subtasks

were identified in the statement of work (see Appendix A):

- Task 1 - Characterize and Classify a Generic Power Subsystem

- Task 2 - Define Faults and Activities That Could. Affect .Power Subsystem Operation

- Task 3 - Define CandidateAutomation Tasks

- Task 4 - Partition Automation Tasks between the EPS, Space Station

(Central Computer), and Ground

- Task 5 - Develop Method for Assessing and Implementing Automation

Tasks

A secondary objective of this study was to evaluate artificial intelligence technology and identify its potential role in power subsystem

automations

2.2 STUDY GUIDELINES

The following study guidelines were used:

- Power Subsystem Type: Photovoltaic/Battery

Power Level: Multihundred-kW Range

Modular Design

i

2-1
Lifetime of At Least 10 Years

Use of Space Station and Autonomy/Automation Study Documentation:

- Space Station Systems Definition, Book 5, Nov 82 (Ref 9)

- Autonomous Spacecraft Program Study for the Air Force by Jet

Propulsion Laboratory (JPL) (Ref 10-12)

2.3 BACKGROUND INFORMATION

A major goal of the present Space Station is to implement new designs,

concepts and methods to reduce life-cycle costs, extend operational

life, and yield improved system performance. The resulting power subsystems must be flexible, reliable, efficient, controllable, and most

of all, employ a high degree of automation. To this end, automation

technologies are expected to make significant and important contributions to the development and affordable operation of these missions.

Therefore, the electrical power subsystems must ensure, in the event of

a failure, that the onboard power capability will degrade gracefully

and provide a minimum set of useful services. The ultimate power-subsystem configuration would be the one that protects against failures

and reconfigures itself in the event of a failure so as to continue

normal operations.

This study is concerned with automation of functions within the powersubsystem and also space-station level tasks related to it. The term

°automati'on" has diverse interpretation. It can describe a simple-control of a process by an on-off device as in a thermostatic control. It

is used to describe a complete feedback-control process that includes

sensing, analyzing, and doing a required operation like voltage regulation. Automation has also been used to describe more complex processes

in which the automated system replaces some of the human activities.

G
All automation functions fall basically into two categories: monitoring and control. The monitoring function involves sensing, analyzing,

and displaying solution approaches and simple decisionmaking information for user (i.e., human) disposition. It is not in the control

loop, so monitoringep r se does not affect the reliability of that control circuit. A control function consists of all the elements of an

operation--sensing, analyzing, and effecting. The fundamental problem

of automation, given that the function should be automated, is that of

strengthening the designer's and user's confidence that automated functions will be accomplished effectively and reliably. This requires

confidence in hardware and software reliability, adequate optimization

and validation, and flight experience. Questions such as the following

are of concern to this and future studies involving automation:

What is automation all about? What is the minimum level of automation? What can be automated?

- Why should automation be undertaken? Can it significantly improve

the life and performance of some components? Can it increase the

specific power of the power subsystem? Can it reduce the cost of

the power and other spacecraft subsystems?

- What system-level studies are needed to evaluate the desirability

and identify guidelines for subsystem automation development? What

are the appropriate jobs for the flight crew?

What effect might automation have on the next version of the subsystem design? How can subsystems be designed or modularized to

minimize the consequences of changes? Can software minimize

changes? Is standardization an issue?

To address the question of which activities to automate, it is necessary to examine (1) basic criteria that direct space station (and other

+Y

spacecraft) toward automation, (2) how automation tasks work at the

r

component, subsystem, and system levels to meet their objectives, (3)

R1 ^, problems encountered in past spacecraft, and (4) what has been done in

past automation efforts.

' 2-3 
Table 2.3-1 lists the basic reasons from the system and subsystem

points of view as to why automation is often mandatory in many cases.

The basic approach necessary in achieving an autonomous operation is to

provide adequate sensors, redundant hardware, switching capabilities,

and software. The principal goal of this approach is to prevent loss

of any critical function via timely reconfiguration and graceful

degradation.

Table 2.3-1 Why Autonomy and Automation?

From Mission and Spacecraft Viewpoint:

- Enable Autonomous Spacecraft Operation, Especially during Degraded

Modes

- Enable Rapid Changes in Mission Sequence

- Enable Onorbit Subsystem Checkout, Verification, and Maintenance

Quickly and Precisely

- Decrease Reliance on Ground Stations and Reduce Long-Term Flight

Operations Cost

Decrease Cost of Other Housekeeping Subsystems

From Subsystem Viewpoint:

Reduce Subsystem Size and Weight

- Increase Operational Life and Performance Reliability

- Decrease Subsystem Cost

- Respond Rapidly to Malfunctions

Permit Maximum Use of Capability

- Permit Graceful Degradation

- Overcome Technology Limitations

Accommodate New Technologies

Table 2.3-2 shows the key projects collectively representing the state

of development in spacecraft power subsystem automation. Note that the

more recent efforts by the Air Force are being performed at the spacecraft level. The principal features and results of these major programs (Ref 4 through 8) are summarized in Table 2.3-3. It should be

emphasized that the microprocessor is the key technology that enabled

these development projects to be carried out effectively. However,

several key issues have yet to be addressed and validated. Among these

are processor redundancy configuration and management strategy, processor fault-tolerant criteria and implementation approach, and optimization of application software and long-term validation.

2-4
Table 2.3-2

Major Projects InvoZving Spacecraft Pourer Subsystem Automation

Project Dates

Funding

Source Contractor

ARM14S (Autonomous Redundancy 1982-1986 AF-STC JPL

and Maintenance Management

Subsystem)*

Autonomous Spacecraft* 1981-1986 AF-STC JPL

Power Subsystem Automation 1982-1983 NASA-MSFC Martin Marietta

Study

Energy Management System 1983-1984 NASA-MSFC Martin Marietta

Software Development (Expert

System Demonstration)

MAPS (Miniaturized 1980-1982 Classified Martin Marietta

Autonomous Power System)

AMPS (Autonomously Managed 1978-1982 NASA-MSFC TRW

Power System)

P3 (Programmable Power 1979-1981 NASA-MSFC Martin Marietta

Processor)

aPSM (Automated Power 1978-1979 NASA HQ-JPL Martin Marietta

Subsystem Management)

$BPS (Single-Cell Battery 1975-.1977 NASA-LeRC Martin Marietta

Protection System)

*Spacecraft level, including power subsystem.

A
Table 2.3-3 Principal Features and Results of Major Projects

Project Features Key Results

ARMMS - Add-On Computer-Based Subsystem - Engineering Algorithms

(Continuing) - Interfaces Only with Satellite Defined for DSCS III

(Ref 4) TT&C Satellite

- Receives TM Data, Determines - Communication Interfaces

Maintenance, and Implements and Computer Architecture

Contingency Plans Defined

- Allows for Evolutionary - Functional Requirements

Development Identified

- Test Bed for Ground Validation - Spacecraft Telemetry

- CMOS Processor (16-bit) Simulator Designed

- Emphasis: Algorithms, Architecture, and Proof of Concept

AMPS - 250-kW Design (17 Channels, 16.7 - Detailed System Design

(Continuing) kW Each); Channels Isolated Completed

(Ref 5) - 220-Vdc Nominal - Algorithms Designed

- 150-A-h, 160-Cell, Ni-H2 —Computer Architecture

Battery per Channel and Hardware Defined

- Array Series-String Switching for Voltage Control

- Algorithms: Power Source,

Load Center, and EPS Management

P3 - Charger or Regulator Function - Engineering Prototype

(Completed) via Software Change Designed

(Ref 6) - Single Imbedded Computer - Algorithms Demonstrated

(TI990U) and Validated

- Input/Output:

- Input: 26 to 375 Vdc

- Output: 24 to 160 Vdc

- Algorithms: Array Peak-Power

cracking, Caution and Warning,

Current Limit

APSM - Test Bed Using V075 Power - Test Bed Operational

(Completed) Subsystem Components - Algorithms Functional

(Ref 7) - Distributed Processors with - Distributed-MicroprocCentral (TI9900) and Local essor Concept Demon-

(RCA 1802) strated

- Fault Simulators

- Cell-Level Battery Protection

(One Battery)

- Algorithms: Data Handling,

Monitoring, Control, Resource

Management, Fault Handling

SBPS - Cell-Level Protection, Both Ana- - First Use of Microproces-

(Ref 8) log and Digital Configurations sor Verified on Secondary

- Intel 8008 & 8080 Processors AgZn Battery Protection

- 18-Cell Secondary AgZn Battery - Hardware and Software

Demonstrated

- Battery Cycle-Life

Improvement (AgZn)

e I

2-6
Effective use of automation often implies performance of several tasks

concurrently. This means both subsystem- and system-level tasks should

be identified and evaluated. Successful automation of the space station may, therefore, transcend boundaries created in the past between

disciplines. The classical parochial and dissected view of a spacecraft is likely to be changed. The interaction between the EPS, lifesupport subsystem (LSS), and thermal-control subsystem (TCS), for example, can be so involved that functions like load sequencing and overall

power management can be viewed only at the system level. One attractive system-level automation task is spacecraft energy management.

This involves a carefully coordinated electrical-load management that

satisfies both experimental needs and the functional requirements of

critical subsystems such as LSS and TCS. This activity can significantly reduce the battery mass, which is a substantial fraction of the

overall space-station weight if a conventional approach is used.
3.0 TASK 1 - CHARACTERIZATION AND CLASSIFICATION OF POWER SUBSYSTEMS

OBJECTIVE

The objective of this task was to classify and characterize the photovoltaic power subsystem and its major elements. This task was intended

to provide the basis for subsequent study tasks.

SUMMARY

A generic photovoltaic power subsystem was defined by identifying the

most promising components under each of the following five major

categories:

1) Photovoltaic array,

2) Power conditioning,

3) Batteries,

4) Power distribution,

5) Power control.

Thermal contrc! hardware was not considered in this study. However, it

must be recognized that heat dissipation management presents a significant problem for high-power systems. Other elements such as gimbals,

F sensors, signal conditioning circuits,, and auxiliary power sources were

included. Typical subsystem arrangements were also identified. These

G arrangements fall into two basic classes by the power conditioning 

" strategy used, the series regulation, and direct energy transfer.

The power subsystem interfaces with all electrical components that use

power .and with the spacecraft subsystem involved in data acquisition 

and command functions ( C&DH and control and display subsystems).

'.^' 3­1
The photovoltaic power systems can be classified roughly by:

1) Application or mission type: LEO, medium altitude, GEO, planetary;

2) System arrangement: series regulation (.1: 10 or direct energy transfer (DET);

3) Bus voltage level and type: ac, dc, or combination. ,

A key system performance parameter is the overall specific power'(W/lb)

which is basically a function of the type of solar cell and battery

cell used and the orbit altitude. Typical values estimated by the Air

Force (Ref 16) are depicted in Figure 3.0-1 for several combinations of

these hardware. The specific power fora system is highly dependant on

the battery energy density used.

3.1 SYSTEM CONFIGURATION

F 3.1.1 General Classification

A power subsystem for any spLeecraft comprises the following generic

elements: 

1) Energy source, 

2) Energy storage,

r 

3) Power conversion,

4) Power processing (conditioning),

5) Power distribution, 

6) Power control.

3-2
ORIGINAL PAGE 19

OF POOR QUALITY

4.6% Ip /1 ! PANEL ►I ASMONS

0.1 9 S T RIKTURAL LOADS

14 PLE ^ It C. I AU. AMO IMOLI •ANOG

GALLIUM ARSENIDE

ALLIUM ARSE HIDE

ILICON

I '

^•.0 1111 1910 1910 2000 101

50

USAF DEVL GOALS .• ^!

C

- N

p HEDREI MEORB CEO

•1

•

M

s

i

v ^0

r_

V

M

10

C

4 • O

'

PEDRO

• • • LEO

•.• NIN O A - GEO t:;. 3 .,••r

^Gry NIH _ LEO

NICd CEO

,^^ it

.^'- N.Cd LEO

19110 If90 700

f

)0

J

i

W

u 20

u

^ 10

AO 100

60

Ea 70 a

3

C

T

Q

so C

Ci

0 20 Q

u C

u 40

a

N

10

20

0 0

1970 1975 198C 1965 1990 1995 2000

TECHNOLOGY READINESS DATE

Figure 3.0-1

Specific Power Protection for PhotovoZtaic Power System

3-3
I.

a

Figure 3.1.1-1 shows the relative arrangement of these subsystem elements along with their principal interfaces. In past spacecraft, control and data interfaces from the spacecraft COHS to the power, subsystem components were distributed rather than centralized in the power

control; as depicted in Figure 3.1.1-1. That is, data and control signals were asually routed directly to the power subsystem assembly, such

as the power distribution unit and the battery charger.

Energy Power Power Power

Source Conversion Processing Distribution Loads 

Energy Data Control Storage

Power

control

Data Control

F

Command and Data

Handling Subsystem 

Figure 3.1.1-1 Generic Power Subsystem Elements and Interfaces

The photovoltaic power subsystem was defined to include various components listed under each major subsystem category (Fig. 3.1.1-2). Each

component was characterized by key design features, operating characteristics, state of the art, flight history, and types available. Flywheel energy storage was the only component in Figure 3.1.1-2 that was

not characterized because of its low development state. System-level

options, such as do bus voltage level, ac vs dc, and number of power

s channels, are listed in Figure 3.1.1-3

3-4
ORIGINAL PAGE 19

OF POOR QUALITY.

tArray

- Concentrator

- Cassagranian

Trough

- SEPS

- Nonconcentrating

Arrays

Power r

Conditioning

_^

Libut1on

- Dc-dc Converter -Mag Latch Relays.

- Series Resonant Batteries -Motor-Driven Switches

Converter - NCd -Solid State

- Transformer-Coupled - NiH2 tIP V, CPV) Fuses

Converter - Fuel Cell, -Circuit Breakers

- Partial/Full Shunt Regenerative, -Solid-State Power

Regulator

H2-02 Controllers

- Dc-ac Inverter - Cabling

- P3 Technology - Copper

- Housekeeping - Aluminum

Power Supplies - Flat and Round

- Slip/Roll Ring Auxiliary

- Flex Cable Power Sources Sensors and

- Rotary Transformer Signal Conditioning - AgZn Battery Circuits

- USOC12 Battery

- Fuel Cell, 1­12-02

- Chemical Turbomachinery

Figure 3.1.1-2 Photovoltaic Power Subsystem options

Arrangement: Direct Energy Transfer (DET)

ac dc

Bus Bus

vs Series Regulation (SR)

Number of Power Channels Power

Channel 

--^ ac Loads

do Bus Voltage: Nominal 28 Vdc and do Loads

120 Vdc or 240 Vdc Power 

Channel

ac Voltage, Frequency, and Phases

Power Conditioning & Distribution:

Solar . Power Primary

Centralized vs Distributed Volt age Array _Conditioning PowerRegulation and Power Distributors 9 Distribution 

C D

Power

Batteries Controller

Figure 3.1.1-3 System-Level Options for a Multihundred kW Power Subsystem

3-5
.. The arrangement of the electrical power subsystem connecting the solar

arrays, batteries, power conditioning, and power distribution network

to the user loads is critical to reducing the specific weight and cost

of the subsystem and improving its efficiency. Figure 3.1.1-4 shows

the two basic arrangements that have been used predominantly in spacecraft: one is a direct energy transfer (DET) and the other is a series

regulation (SR) type. These configurations differ basically in their

methods of controlling the solar array output voltage and providing

battery charge/discharge protection.

Configuration I features a do battery charger and peak-power tracker

combination. The peak-power tracker integral to the battery charger

provides maximum solar array energy collection whenever the battery is

not fully charged and can accept the available power.

Configuration II requires no do battery charger but relies on fullshunt regulation to limit battery charge voltage. This arrangement

eliminates the cost of the do charger and the efficiency loss caused by

charger operation. The increase in total system efficiency gained by

deleting the series charger more than offsets nonoptimum solar array

operation off the `peak-power point. The main penalty of this full- 

shunt regulator approach is the need to dissipate a large amount of unusable array power in the regulator.

Configuration III controls the do bus voltage in a manner similar to

II, and is known as a partial shunt regulation system. Its advantages

over II are basically a much lower level of power dissipation (in the

bypass switches) and elimination of the full-shunt regulator hardware.

Its principal drawback is control complexity and related electronics.
R

Configuration I (SR)

Battery

Charger/

Peak Power

Tracker

ORIGINAL PAGR J4

OF POOR QUALITY

Main do

Bus

Solar

Array Battery

Configuration II (DET)

Main

w'

do Bus

F A

[f

Solar I IShunt

Array 1, lRegulator

Battery

Configuration III (DET)

Main do

Bus

Control

ftArray

Array

String BYPass Battery

 • Switch

g;

Note:

1. Main do bus is connected to a load regulator,

inverter, and/or power distributor.

2. The bypass switch in Configuration III can be

r linear partial shunt or digital switch

Figure 3.1.1-4 

Basic PhotouoZtaic Battery.Power Subsystem Arrangements

3-7
A combination of II and III, controlled by a miroprocessor, has been

used very effectively in a large terrestrial system (Ref 14, 15). Its

advantages are:

1) The overall system cost is lowest (comparted to I and II) because

the intermediate power processor is eliminated and the partial subarray on/off switching approach permits the full-shunt regulator to

be sized to only handle a fraction of the total available power

(partial shunt regulator), and thereby minimize thermal dissipation 

management.

2) The partial shunting approach provided a very flexible and effective battery control for four 240-Vdc batteries in parallel.

E.

3.1.2 Specific System Arrangements

The modular nature of a PV/battery system allows this power source to

be used in applications ranging from a few watts to megawatts. For a

multihundred kW system, the key tradeoff issues are the (1) main do bus

voltage level (120 vs 240 Vdc), (2) ac vs do for main power distribution, and (3) the power distribution scheme to meet the redundancy criteria. An example of an arrangement that can provide a combination of 

unregulated (150 to 300 Vdc) and regulated (200 to 300 Vdc) HV, low 

voltage (28 Vdc), and ac power in a DET configuration is shown in Figure 3.1.2-1. This arrangement can serve as a building block to scale

up to the required Space Station power levels while providing redundancies in power channels. The power distribution configuration and 

load control strategy must be carefully designed at the system level to

provide the flexibility required for load management during various 

phases of station growth. Several examples of photovoltaic power sys- 

tem configurations are presented in simplified forms in Appendix B.

3-8 
3-9

ORIGINAL PAGE 19

OF POOR QUALITY

C D

Power Control

Power Subsystem Unit

Cr D Command and Data Handling

Subsystem

Unregulated

119V do Loads

HV do Power

Distributor Regulated

HV do Loads

LV do Power I 28' Vdc

Distributor Loads

ac. Power( ac

Distributor j loads

II

Figure 3.1. 2-1

An Approach to a High-Power System to Provide HV and LV do and ac Power

3.2 PHOTOVOLTAIC ARRAY

An array consists ofa number of solar cell module strings or branches

connected at the do bus. The number of modules in series is determined

by the desired do bus voltage level, and the number of strings by the

total array power required. Key factors affecting the electrical performance of the PV array are: ( 1) solar irradiance; ( 2) solar cell

temperature; ( 3) solar incidence angle; (4) charged particle radiation;

(5) reverse voltage breakdown; ( 6) plasma arcing; and (7) electrical

wiring configuration including line resistances and bypass diodes.

The solar arrays can be classified by how they are mounted to the

spacecraft and oriented to the Sun. The three basic array types are

body mounted, paddle mounted, and panels mounted and Sun-oriented as

shown in Figure 3.2 -1. To reduce the array area, high-power multi-kW

spacecraft would require array articulation capability for Sun'

orientation.
ORIGINAL PAEW ►b

OF POOR QUALITY

Body Mounted

Paddle Mounted

i

,At : i

i

Y

Oriented Panel

Figure 3.2-1 Basic Solar Array Configurations

The types of photovoltaic systems applicable to the space station are

as follows:

1) Planar, nonconcentrating array (SEP and ultralightweight arrays),

2) Concentrating array (cassegranian and trough).

3-10

7
Blanket

I

ORIGINAL PAGE 19

OF POOR QUALITY

The basic features of specific candidate designs of each array type are

summarized in the following subsections.

3.2.1 SEP Solar Array (Ref 16)

Description - The SEP solar array consists of five major components:

array blanket, mast, tensioning mechanisms, containment box, and box

cover (Fig. 3.2.1-1). The solar array wing can extend or retract fully

or partially to a predetermined point. Table 3.2.1-1 lists SEP blanket

physical characteristics.

Store

Array

Preload

Mechanism

Array

Hardness

Intermediate

Tension

Negator

Guide Wire Negator

Containment

Box Cover

4.0 m

(157 1

-Guide Wire

Guide Wire Grommet

-Panel Hinge

Intermediate

Tension

Distribution

Bar

31.6 n

Array (1244

Harness

Array

Storage

Container

^— Extension/

Retraction

Mast

Tension Box Negator

Mast Canister

Figure 3.2.1-1 SEP Solar Array Wing

3-11 
Table 3.2.1-1 SEP Array Blanket Characteristics (One Wing)

No. of Cell Assemblies/Electrical Module 1530

No. of Electrical Modules/Wing 82

No. of Cell Assemblies/Wing 125,460

Single Cell Area 8068 cm2

Total Cell Area 101.47 cm2

Nominal Cell Spacing (On-Array Padding) 1.09 mm (0.043 in.)

Overall Blanket Area 41xl58x29.9 in.* 125 m2 (1345 ft2)

Cell Area Packing Factor (1.19 mm Cell. Spacing) 0.887

Overall Blanket Area Cell Packing Factor 0.812

Printed Circuit Substrate Area Density (No Cells) 0.1358 kg/m2

(0.02776 lb/ft2)

Substrate Plus Cell Assemblies Area Density 1.0132 kg/m2

(0.2072 lb/ft2)

Total Blanket Plus Harness Area Density+ 0.9785 kg/m2

(0.2001 lb/ft2)

*Includes area for array harness, panel stiffening, and panel-to-panel

hinges.

+Includes hinges, panel stiffening, on-array padding, and tension

distribution bars.

The mast is a continuous Longeron lattice structure made from high temperature polyimide resin (See Table 3.2.1-2). The deployment canister

used to extend and retract the mast uses two 27-Vdc motors, is 58-in.

high, 16.24-in. diameter, and weighs 17.3.5 kg (38.17 lb).

Principal Operating Characteristics - Present-technology 25-kW SEP array uses a 12.3% efficiency solar-cell 'having a back-surface reflector. The solar cell also employs a dielectric wraparound contact.

Table 3.2.1-3 lists solar-cell characteristics. The array system is

composed of two wings, each providing 12.5-kW BOL power at 1 AU. The

array sizing assumes the following losses:

Assembly 3%

- Bussing 4.4%

- Diode 0.4%

- Present-Technology Array Design Provides 66 11/kg Using the Minimum

Cell Efficiency
Table 3.2.1-2 Extension Mast Design

Mast Diameter: 37.3 cm (14.7 in.)

Mast Mass: 16.74 kg (36.8 lb)

Longerons:

- Cross-Section: 0.5530.572 cm (0.2180.225 in.), Rectangular, with Corners Rounded to 0.030-in. Radius

- Material-S-Glass/Polyimide Composite Using 20-End-Glass Roving/

PMR15 Polyimide Resin

Battens:

- Cross section: 0.4570.457 cm (0.18x0.18 in.), Square, with

Corners Rounded to 0.030 in. Radius

- Material: Same as Longerons

Diagonals: 3/64-in. Diameter, 3x7-Strand, StainlessSteel Cable

Bay Length: 23.9 cm (9.0 in.)

Mechanical Properties:

- Bending Stiffness: 62.8 kN-m2 (21.96 x 10 6 lb-in.2)

- Bending Strength: 1.64 m-N (1456.3 in.-lb), Minimum Value Associated, with One Longeron In Compression

- Shearing Stiffness: 87.2 kN (19,620 lb)

Shearing Strength: 134.8 N (30.33 1b)

- Torsional Stiffness: 1.453 kN-m2 (5.08 x 10 5 lb-in.2)

- Torsional Strength: 970.7 N (218.4 lb)

r

Table 3.2.1-3 Present TeehnoZogy 25-kW Array Solar CeZZ Design Features
Testing of the full-scale coilable longeron extension mast resmlted 4n

a mass-stiffness measurement of 15.15 x 106 lb-in. 2 compared to the

19.6 x 106 lb-in. 2 requirement. The associated weight increases

along with the achieved cell assembly weights require a cell-efficiency

increase from 11.4% to 12.3% to meet a specific power of 66 W/kg. This

also reduces the number of panels per wing from 41 to 38 (25 -kW array)

and decreases the extension length from 32.0 m to 31.2 m.

Flight History - None; SAFE experiment is scheduled on shuttle orbiter

flight in mid-1984.

Types/Manufacturer - Lockheed Missile and Space Company.

3.2.2 Ultralightweight Solar Array (Ref 17)

Description - Ultralightweight Solar Array is being developed by TRW

for use in applications where existing technology is limited. This

design is directed toward the following goals:

- Retractable, Redeployable

- Low Cost

- Modular/Scalable over 10 to 70 kW (BOL)

- Compatible with Automatic Fabrication/Assembly Processes

The array configuration consists of one or two flatpack foldout Kapton

blankets contained in a graphite-epoxy stowage box attached to a

strongback deployment structure. The blanket and container are integrated with a mast-stowage canister containing a coilable triiongeron

mast for extension and retraction of the solar-cell blankets. Figure

3.2.2-1 shows the full-power two-blanket design. The total weight for

the full-power design, made up of the blanket, blanket box system, and

the blanket extension system combined, is 1262.8 lb (572.7 kg). Table

3.2.2-1 lists physical characteristics.
ORIGINi4. PAGS 19.

OF POOR QVALIT

417

Lid

20.75 193

(Blanket)

IS Leader

1. 

1468 

96 Active

1450 Panels

_T

14.8'

(Panel)

Leader

F,

a

68 

F•

Blanket Box 

(199 L x 18 W x 7 H)

W 23 Astromast 

Note: 

All dimensions are in inches.

Figure 3.2.2-1 

Two-Blanket UZtraUghtweight Solar Array (Ref 17)

Principal Operating Characteristics - The full-power, two-blanket design has a BOL power of 72 kW per spacecraft (68% at 235 nmi, 60° in- F^

clination). End-of-life power (10 years) is approximately 17% less, or

61.7 kW per spacecraft. BOL open-circuit voltage is 425 V derating to 

an EOL voltage of 178 V (peak power at orbit MAX Temp of 80°0. Table

= 3.2.2-2 shows the array's performance analysis.

3-1.5
Table 3.2.2-1 Physical Characteristics, FUZZ Poser, 2 Blanket

Item Value

No. of Wings/Spacecraft 2

No. of Blankets/Wing 2

No. of Active Panels -( with Cells)/Blanket 96

Blanket Panel Size 178 . 3x14.8 in.

Blanket Size ( Including Leader Panels) 178.3x1450 in.

Mast Deployed Length 1=70

Mast Diameter 21 in.

Mast Canister Length 66 in.

Mast Canister Diameter 23 in.

Wing Width 396 in.

No, of Blanket Boxes/Wing 2

Blanket Box Size 180xl8x7 in.

Deployed Wing Natural Frequency 0.04 Hz

No. of Panels/Electrical Module 2 Modules per 3 Panels

No. of Electrical Modules/Wing 128

Cell Type and Size 2 ohm-cm BSR; 4.08x2.35 cm

x8mil

Cover Type and Size Fused Silica, 6 mil

No. of Cells/Panel 174 x 8 = 1392

No. of Cells/Blanket 133,632

No. of Cells/Wing 267,264

Wing Weight 601 kg

State of the Art - Level 5 - 6 is estimated.

Flight History - None

Types/Manufacturer - TRW

F

^s
Table 3.2.2-2 Array Performance Summary

Parameter, BOL

EOL

Factor Temp BOL EOL

Cell Efficiency (2-ohm-cm BSR) -- 28°C 13.3%

At Vmp = 0.49 -- 28°C 490 mV --

Cell Efficiency:

[1-0.0046 (68-28)] 13.3% 0.85 68 0C 10.9% 9.26%

At 490-2.2 (78-28)mV 0.96 68°C 402 mV 386 mV

Cell Output:

8.57 cm2 x 10.85% x 135.3 mW/cm 2 0.85 68°C 126 mW 107 mW

Half-Panel Output: 4p x 104s x 0.126 W 0.85 68°C 52.3 W 44.7 W

At 104s x 0.402 V 0.96 68°C 41.8 V 40.1 V

Module Output: 5 x 0.96 x 52.3W 0.85 68°C 251 W 215 W

At 5 x 0.96 x 41.8V 0.96 68°C 201 V 193 V

Blanket Output (36 Modules, 90 Panels) 0.85 68°C 9.04 kW 7.72 kW

Wing Output (4 Blankets) 0.85 68°C 36.2 kW 30.9 kW

Array Output (2 Wings) 0.85 68°C 72.3 kW 61.8 kW

Cell Size 4.08x.2.10 cm = 8.57 cm2

Temperature Coefficient,

Power: -04.6%/°C

Voltage: -2.2mV/°C

Output Values Rounded to 3

Significant Figures

3.2.3 High Concentration Array - Cassegrainian (Ref 18)

Description - A development program is in progress (AF and NASA) for a

miniaturized Cassegrainian concentrator solar array. The main interest

in this type of array is to develop a multikilowatt solar array at a

lower cost without sacrificing performance of present technology, and

for hardening from weapon threats.

The Cassegrainian concentrator consists of a small solar cell centered

in the base of a parabolic primary reflector with a hyperbolic secondary reflector mounted above the solar cell (Fig. 3.2.3-1). The solar
k°

ORIGINAL PAGE 19

OF POOR QUALITY

cell is surrounded by a light-catching cone to improve performance under off-pointing conditions. Relief from thermal stress on the solar

cell is accomplished by mounting it on a molybdenum base, which is then

mounted to the aluminum radiator. The incident solar radiation is reflected from the primary parabolic reflector to the secondary hyperbolic reflector and finally to the solar cell.

Hyperbolic Reflector

Parabolic

Reflector

Single-Element

Assembly

Cup and Cell

Stack Assembly .Y

Single-Element Assembly

Light

Catcher done Mol ^./ y

Solar InterCell connect

3.17 mm Moly Pad

Aluminum

0.25 mm Top View Radiator

12.7 mm 4 mm

0.25 mm

0.25 52 mm—!.a X5 mm

mm Cross Section I Solar Cell Detail

Baseline Concentrator Element Design

Figure 3.2.3-1

Cassagranan Array Element Assembly (Ref 18)
s,

The concentrator element described above is comparable in thickness to

conventional panels; each element is 52 mm diameter and 13 mm thick.

Several elements can be connected together for high-power use.

Principal Operating Characteristics - The Cassegrainian concentrator is

in its early development stages. More testing needs to be completed

before all the operating parameters are known. Table 3.2.3-1 lists

present characteristics.

Table 3.2.3-1 Operating Characteristics

Miniaturization action of concentrator results in excellent heat

distribution.

- Passive thermal control provides low steady-state solar cell temperature range of 75 0 to 95°C.

- Effective concentrator ratio of 88 to 100.

- Reduction of recurring cost using very small solar cells in conjunction with low-cost optics.

--Primary and secondary reflectors have a common focal point, an

f-number of 0.25, and a rim angle of 90 deg.

Concentrator panel comparable area and performance (W/m 2 and

W/kg) to conventional rigid solar array.

- Typical performance 100 W/m 2 and 20 W/kg with 20%-efficient solar

cells.

Component-misalignment testing showed that performance falls by approximately 25% as the secondary reflector is moved 0.4 mm toward the primary reflector and remains constant as the secondary reflector is moved

away from the primary reflector by as much as 0.5 mm.

State of the Art - Technology Level 4 is estimated. A nine-element

demonstration module has been subjected to functional checkout tests.

It has performed in a manner similar to the single-element module and

is ready for comprehensive performance testing.

d'
This type of array can use advanced high-efficiency cells for greater

array performance. To date, effective concentration ratio is 88, future designs can be from 100 to 130. Future design will also have reduced blockage losses, presently at 21%.

Flight History - None

Types/Manufacturer - TRW

3.2.4 Low-Concentration Array - Trough/pyramidal (Ref 19)

Description - The trough, or pyramidal, concept is based on a concentrator element having a four-sided, truncated pyramid configuration.

Two of the reflector panels fold up with the solar panel for compact

stowage. The element is designed for a geometric-concentration ratio

of six suns, and can be used with silicon (Si) or gallium-arsenide

(GaAs) solar cells.

The array consists of several rectangular modules with a total area of

about 1400 m2 . Each module contains approximately 4400 pyramidal

elements. Modules can be stored as cubes (3.24 m per side) in the

Space Shuttle payload bay. The deployed module is 19.500.00.54 m.

Figure 3.2.4-1 shows the module deployment stages and dimensions.

Three canister-and-mast assemblies extend from each side of the housing

in two directions by connections to the end caps. The concentrator

elements are supported by cables connected between the end caps and

housing. The cables are maintained under constant tension through

negator-cable extension mechanisms

This type of array is expected to generate more than 300 kW of power in

orbit by a single Shuttle launch. The array would comprise up to four

solar-array panels, each having a power output greater than 75 W. 

F^

i

3-20
3-21

ORIOINAI PAGE 19

OF POOR QUA*-iTY

19.5

1-

19.5 m'

r

3.24 m

3.24 m__+''3.24 m

igure 3.2.4-1

Concentrator Array Module Configuration

Principal Operating Characteristics - Two basic solar panel designs

have been baselined corresponding to projected characteristics of silicon and gallium arsenide cells. Table 3.2.4-1 summarizes these

characteristics.

State of the Art - This technology is estimated to be Level 3. Results

to date indicate that a concentrator array module is a practical, lowcost approach for multihundred-kilowatt solar array systems for space

applications. The modularity design concept can be extended to provide

a hardened array configuration with gallium arsenide solar cells used

for application to lower-power-level missions.

Flight History - None

Tpes/Manufacturer - Rockwell International

M

Maw
a

Table 3.2.4-1 Solar PaneZ Characteristics (Ref 19)

Parameter

Solar Cell

Si GaAs

Conversion Efficiency, %

(AMO, 28 0 C) 14 18

Solar Absorptance 0.70 0.75

Low CR Optimized Yes Yes

Back-Surface Reflector Yes N/A

Back-Surface Field No N/A

Thickness, mm 0.25 0.30

Surface Dimensions, mm 50x50 19x19

Cover Type/Thickness, mm Fused Silica, Fused Silica,

0.2 0.2

Substrate Radiator Characteristics:

Thickness, mm 0.6 0.5

AR/Ap 2.0 2.0

Solar Absorptance 0.22 0.22

Emissivity 0.85 0.85

3.3 ENERGY STORAGE

Energy storage devices presented in this subsection are those that can

be used for long-term operation. Included are Ni-Cd, Ni-H 2 , and RFC

systems.

3.3.1 Nickel-Cadmium

Description - The Ni-Cd battery consists of several hermetically sealed

cells connected in series. The number of cells in a series is determined by the do bus voltage. A 28-Vdc system usually has 22 cells, and

a 240-Vdc system would require about 200 cells in series.

3-22
A typical cell is encased in a prismatic stainless steel container. It

has a number of positive and negative plates insulated from each other

and the metal case by separator material. Potassium hydroxide is normally used as the electrolyte. Reference 20 provides a detailed description of design, manufacturing, and operational characteristics of

the Ni-Cd cell.

Principal Operating Characteristics - The operating characteristics of

a nickel-cadmium battery are a function of state of charge, depth of

discharge, number of cycles, the duration of charge/discharge, cycles,

and operating temperature. All these variables are controllable to a

certain extent either directly or indirectly. Because of the large

uncertainty in the performance behavior of Ni-Cd battery (and all

others), battery operation management is one of the best candidates for

automation via computers.

;i Typical charge-discharge voltage profiles are shown in Figure 3.3.1-1

as a function of state of charge. The desired range of charge voltage

limit can vary from 1.40 volts to 1.60 volts, and discharge voltage is

about 1.2-Vdc average per cell.

•^ 

t Figure 3.3.1-2 depicts one set of cycle-life data (Ref 20)available on

an LEO mission. These data, as well as others in open literature, are

,j based on 5-cell to 22-cell bat'Zary pack testing. Thus, a lot of uncertainties exist in projecting the life of a possible 200-cell battery

pack configuration of the space station batteries.

Figure 3.3.1-3 shows the mass of the Ni-Cd cell from several suppliers

as a function of rated capacity (36 to 41 gm/Ah),

State of the Art - Sealed nickel-cadmium cell batteries were developed

for space applications. They have served as a reliable energy-storage

system for the majority of spacecraft flown. 

i

3-23
Temp, 100C

1.40

1.60

1.80

State of

Charge

1.0

0.9

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1

0.0

> 1.20

v

cc

m

u

0 1.00

1.4

1.2

1.0

c^o0.8

^n

0 0.6

v 0.4 U

0.2

0

.-r

W 0.80

Discharge Charge

0.60

0.40

-1.000 -0.600 -2.00 0 200

Normalized Current, A/Ali

O.h00 1.000

0.2 0.4 0.6 0.8 1.0 1.2 1 4 1.A

Depth of Discharge, Ali D/Cx

Figure 3.3.1-1

I rpicaZ Charge-Discharge Profiles o ° Ni-Cd Ce Z l

ti

3-24

it
D

4

3

vi

^n

2

',egend :

i

Eagle Picher

0 General Electric

0 SAFT America

1

ORIGINAL PAGE9

OF POOR QU ALITY

60

ro 50 C E

x

w

40 Ni/Cd Data Sources*: A

B

A = Fit to Crane Data, 20-25 °c. Ni/Cd``,

W 30 B = GSFC *lac Design Spec. . _

C - Fono

U D - Elliason

Q 20 E = Est 0-10°C with Special

Controls and Reconditioning I

w

0

10 *From J. B. Trout, "Energy Storage for

a LEO Operations at High Power," AIAA/

NASA Conf, Hampton, VA, May 8-10, 1979

500 1000 5000 10,000 50,000 100,000

Number of Cycles figure 3.3.1- c"

1JiCd Battery ,'zycle Life Pro,jecticn for LEO Application (Ref 13)

i i i i i i

0 20 40 60 80 100

Rated Capacity, A-h

Figure 3.3.1-3 Relationship of bass to Capacity for Spacecraft NiCd Cells

3-25

r 
Recently, the primary advances have been in the areas of

- Seal Improvement for Reliability

- Increased Cell Capacity

- Specific Energy Improvements

- Lightweight Container Designs

Major emphasis for advanced technical development efforts has been on:

(1) reduced weight for geosynchronous and medium-altitude spacecraft,

(2) increased lift capability to more than 10 years at 85% depth of

discharge for GEO, and (3) increased life to more than five years for

LEO applications.

Flight History - Nickel-cadmium batteries have been flown on most

spacecraft requiring long-life operation.

Types/Manufacturer - The primary suppliers of nickel-cadmium cells for

aerospace use are General Electric, Eagle Picher, and SAFT America.

Several sizes, up to 50 Ah, are now available.

3.3.2 IPV and CPV Nickel. Hydrogen Battery

Description - The nickel-hydrogen cell is contained in a hermetically

sealed pressure vessel (Fig. 3.3.2-1). It is a derivative of the Ni-Cd

cell design via substitution of the negative electride (from cadmium to

hydrogen).

Nickel-hydrogen systems, like other batteries, require multiple cells

in series to attain the necessary bus voltage.

Two basic types available are referred to as the individual pressure

vessel (IPV) and common pressure vessel (CPV). The CPV design contains

several cells connected in series within one common pressure vessel.

c
Hydrogen Electrode

(- on Discharge)

-- Separator

Nickel Electrode

(+ on Discharge)

Hydrogen Gas

(100 to 800 {

ORIGINAL PACE. IS

OF POOR QUALITY

r )

Figure 3.3.2-1

Schematic of a Iii-H2

 CeZZ and TypicaZ Battery Arrangement

Lv 3-27
1.7 .

:CELL i^5

1.6 ...... 25 DEG C .... .... . .......

1.5 f.r. i ...... = ,. .PRESSURE

YDLTAGE;

0 

1. 4,.......... r .,........................ ........ 

1.3 ........... / !"' ....... .....

1.2 ..........^ .......... ......... ....... ......... ........ ........

V r ^i t CHARGE' REGIME CONSISTED

.1 .........,...L .. . ...................:.............;...OF A 5 AMP CONSTANT CURRENT.,.

CHARGE FOR 16 HOURS "

1.0 ..........;.., ....... ........:r......, ...

0.9 f ........ ........

........ ......... ......

0 10 20 30 40 50 60 70 80 90 100

Charge Capacity, A-h

3 3.3.2-2 TrypicaZ Charging Characteristics of Ni-H2 CeZZ (Ref 21)

Table 3.3.2 -1 presents the physical characteristics for Yardney 30

and 50-A-h nickel-hydrogen cells. These cells are similar in size and

shape to cells of other vendors.

State of the Art - COMSAT Laboratories initiated the exploratory development of nickel-hydrogen cells in early 1970, followed by the Air

Force in 1972. Since then, primary development occurred in the following areas:

1) Lightweight cells,

2) Basic cell design,

3) Production capability for electrochemically impregnated nickel

electrodes,

4) Common pressure vessel.

3-28

800

700

00

"a 600

500

0 400

^ 300

.-1

Cl

200

1001

0i

Figur,

ORIGINAL PAGE 0

OF POOR QUALITY

Principal Operating Characteristics Figures 3 . 3.2-2 and 3 . 3.2-3 show

charge/discharge curves for a typical Ni-H2 cell. Internal pressure

in a nickel-hydrogen cell varies linearly with state of charge.
8001 1.6

ORIGINAL PAGE iS

OF POOR QUALITY

n

3-29

_ 

C

' Cell 105'

. ., 25-A do

600 `

, Pressure ':' ,^ . .^

t

1.4+ 0-deg C Voltage

25-deg C.

400 - 1.2 Voltage . 1

>

o - .. ' . 0-deg C

300 Pressure

...... ..

a y 25-deg C ,-4200 u 1.0 +... _ ..... 

I

T

800 1.6

Cell 105

^. 45 -A

^ ,...........

do

^... '^ N 600 1.4 r t.., .. ..

Pressure

.. _..

a

' `. 0-deg C ^

1

400 1.2 l 

t Pressure ~ ^^ `^- Voltat,e I

w 25-deg C . ;:..,. s . ..ti . ..^:.... .....:0_ deg C ...

cu N

v 200 1.0^ _ .... .. . .. ,^k..... a

} Voltage

25-deg C .,

0 0.8 i

0 10 20 30 40 50 60 70

Discharge Capacity, A-h

Figure 3.3.2-3 Typical Discharge Characteristics of Ni-H 2 Cell (Ref 21)

Table 3.3.2-1 Physical Characteristics

w

YNH 30-2 YNH 50-3

Weight: 1.96 lb (887 g) 2.79 lb (1270 g)

Volume: 46.4 in. 3 (715 cm3 ) 52.3 in. 3 (857 cm3)

Lengths 8.0 in. (20.3 cm) 9.0 in. (22.9 cm)

Diameter: 3.5 in,, (8.9 cm) 3.5 in. (8.9 cm)
Flight History - Nickel-hydrogen batteries were launched in 1976 on the

Navy NTS-2 satellite and the Air Force flight experiment satellite.

Nickel-hydrogen batteries are planned for the following spacecraft:

1) Intelsat V and VI Communication Satellite;

2) U.S. Air Force SDS Satellite;

3) GTE "G-Start" Satellite;

4) Southern Pacific "Spacenet" Satellite;

5) ESA "L-Sat" Satellite.

Types/Manufacturer - Y <lney Electric Corporation and Eagle Picher Co.

3.3.3 Bipolar Nickel Hydrogen Battery

Description - Bipolar NiH2 cells provide a concept more closely resembling a fuel cell system than a traditional nickel-cadmium battery 

pack. This modular c..oncept with projected energy densities of 44 to 53

W h/kg (20 to 24 W-h/lb) and 700 to 900 W-h/ft 3 , has significant potential improvements in reliability, energy density, cycle life, and

cost (Ref 22, 23). The nickel-hydrogen battery using bipolar construction in a common pressure vessel is shown in Figure 3.3.3-1.

P i i 1 0 r nc pa perm ng ti Ch r ct r a s e 4 t- 4 - The basic s ecifications for a p 

35-kW battery are listed in Figure 3.3.3-2. The weight estimates for

this battery are listed in Table 3.3.3-1.

State of the Art - A preliminary design of a 35-kW nickel-hydrogen bat -

tery featuring bipolar cuhstruction, a common pressure vessel and active cooling is being developed for possible applications requiring

high power energy storage.

3-30
ORIGINAL PAGE M

OF POOR QUALITY

Coolant

Terminal Seal

Case

Cooling Line

_ 1 Leads

Weld Ring

Stack

Subassembly

Endplate

r/ Bipolar Plate

IIII

i.i. t III I Cooling Plate

I II ^ ^^'

IIII ,.

Coolant Manifold

.: 3.3.3-1 Bipolar Ni-H2 CeZZ (Ref 22)

The inherent characteristics of the bipolar concept lends itself to a

high voltage low current operation. Using a common pressure vessel for

the entire battery offers significant improvement in bot:i gravimetric

and coulometric energy densities. In addition, spacecraft/battery

integration is a simpler task when considering that this one 35 kW module (or a modified modular concept) would replace many cells in a series configuration.

Flight History - None

Types/Manufacturer - Hughes Aircraft Co.

3-31

fn.' 
ORIGINAL PAGE IS

OF POOR QUALITY

Battery Specifications

- Power 35 kW

- Load Voltage 275 V

- Current 127 A

- Dicharge Capacity at 76

0.6-h Eclipse

- Depth of Discharge 70%

- Theoretical Capacity 128 A-h

- Series Cells 229 2

- Plate Area 625 in.

- Cell Thickness 0.095 in.

- Stack Dinensions 27 x 27 x 28 in.

- Battery Weight 1583 lb

- Energy Density 19 W-h/lb at

100% DOD

- Volumetric Energy 780 W-h/ft3

Density

- Vessel Configuration TBD

Figure 3.3.3-2 35-kW Bipolar 11i-H 2Battery Specification (Ref 22)

3-32

6—
ORIGINAL PAGE 0

OF POOR QUALITY

I I

Table 3.3.3-1

Estimated Weight Breakdown of a 35-kW Bipolar Ni-H 2 Battery

Component Total Weight % of Total

Nickel Electrodes 508 lb 32.5%

Hydrogen Electrodes 70 4.5

Separators 35 2.0

Electrolyte Reservoir Plates 185 12,0

Recombination Grids 15 1.0

Cooling Plates 180 11.5

Pressure Vessel 200 13.0

Electrolyte 246 16.0

Hardware (Tie Rods, Terminal Cables,

Coolant Lines, Etc) 30 2.0

Foam 10 0.6

Frames 54 3.4

Coolant 20 1.2

End Plates 30 2.0

Total Weight 1585 lb 100.0%

3.3.4 Regenerative Fuel Cell (RFC)

Description - Regenerable fuel cell systems produce electricity by combining reactants by direct electrochemical process to generate electricity and water. The most well-developed system is H 02 2'

The basic elements of a hydrogen-oxygen regenerative fuel-cell system

are shown in Figure 3.3.4-1. The principal parts are the fuel cell and

the electrolysis module.

The fuel-cell module converts H and 0 directly into dc power with 2 2

water as the byproduct. The electrolysis unit essentially splits this

water into gaseous H and thus resulting in a reversible reac- 2 021

tion. Heat exchangers remove waste heat from the electrolysis and

fuel-cell modular water coolant loops, each having temperature-regulating valves. A condenser removes heat from the generated 0 and H 2 2

gases such that the outlet saturation temperature or dew point is below

the temperature of the storage tanks. Similarly, a product-water heat

exchanger reduces the temperature of water discharged by the fuel-cell

3-33
Principal Operating Characteristics - There are approximately ten contributors to energy-storage inefficiency with the RFC system (Ref 24): 

(1) fuel-cell voltage loss; (2) fuel cell faradaic inefficiency; (3)

fuel-cell ancillary power; (4) fuel-cell discharge regulator power

loss; (4) electrolyzes voltage loss; (6) electrolyzes faradaic inefficiency; (7) electrolyzer ancillary power (8) electrolyzer input power

regulator loss; (9) inefficient use of solar-array charging area; and

(10) power consumption for temperature control.

For either a solid polymer electrolyte fuel cell or an alkaline fuel 

:ell, a design energy-storage efficiency for the RFC system of 60% is

.onsidered possible without undue development risk.

1

,E

3-34

ORIGINAL PAGE IS

OF POOR QUALITY

module to a desired value for storage. The process water outlet temperature of the heat exchangers is independently controlled by temperature-regulating valves.

Zd_F

^ I 1

Voltage 

 IFuel

Solar Regulator

ElectrolysisCell Bus

Array luid

IHeat

c I Exchanger Cooling Fluid

Radiator

I Regenerative Fuel Cell

Figure 3.3.4-1 BZoek Diagram of a Regenerative FueZ CeZZ (Ref 24)
One of the findings by United Technologies was that the specific weight

did not change much for 35-kW and 250-kW systems which were 55.1 lb/kW

and 51.1 lb/kW, respectively.

State of the Art - The basic space fuel cell after its emergence as a

primary power source in the early 1960s has had, and continues to have,

a steady and evolutionary technical growth. It very successfully provided the electrical primary power for the Gemini and Apollo programs

and now must be examined as to its role in projected new large space

power systems. It is expected that the large level of effort being

directed to the development of fuel cells for terrestrial applications

will indirectly affect space fuel-cell technology and could possibly

affect itsj pro acted role in future space missions (Ref 25). p

The state-of-the-art fuel cell of today is largely the product of technology-development efforts aimed at meeting particular mission requirements in a particular time frame. Fuel cells were developed in the

early 1960s because of the special requirements of the Apollo vehicle.

After this major step in technology advancement, the fuel cell 'became a

more mature technology and made a steady technology growth toward

lighter weight, higher specific power, lower cost, and longer life.

The specific weight decreased from 89 lb/kW for Apollo to 8 lb/kW for 

the Shuttle Orbiter (Ref 25). The advanced lightweight fuel cell has

potentially greater specific weight reduction to 4 lb/kW. During this

same period in which large reductions in specific weight and specific

cost were achieved, there were corresponding increases in operating

life from 100 to more than 2500 hours.

The fuel cell of today is an operational and reliable electromechanical

power source. It was developed for NASA's manned missions in the 1960s 

because the conventionalbattery systems could not meet the energydensity requirements. Although the role of the fuel cell as a primary

source for space power appears limited, it may have a much larger role

as an energy-storage subsystem when combined with the electrolyzer.

3-35
ORIGINAL PAGE 19

OF POOR QUALITY

' Present studies have shown that the H 2 02 space fuel cell with a

dedicated electrolyzer can be competitive with NiCd and NiH 2 batteries as energy-storage subsystems for large space power-system

applications.

Flight , History - The basic fuel cells successfully provided the electrical primary power for the Gemini and Apollo programs. The RFC has

not been flown.

Types/Manufacturer - GE and United Technology Corp.

3.4 POWER CONDITIONING

3.4.1 Series Resonant Converter

Description - The design of this type of converter is based on the controlled transfer and transformation of electric energy through seriesresonant circuits at frequencies in excess of 10 kHz. Figure 3.4.1-1

is a schematic of a half-bridge converter. The high-Q series-resonant

circuits continuously oscillate and are controlled by adjustment of the

phase angle between the exciting voltage and the resonant current (Ref.

26). This topology is highly efficient because only a small fraction

of the energy transferred to the load is absorbed by the resonant cir

cuits. The system is suited for construction of low-cost, submegawatt, 

single-module converters using available components. 

CR D21 D23

ll C 11 vx

— —

,.___- ----e V

o RL

es XF

C12

L1 Wl

--'^"—

2

^

o

°e1 %

CR12

D24 D22

l

L

Figure 3.4.1-1 Half-Bridge Converter

3-36
CR

22 

ORIGINAL PPIGE 09 

OF POOR QUALITY

Principal Operating Characteristics - Higher energy density and efficiency are expected owing to high-frequency operation (10 to 30 kHz)

than the lower-frequency rectangular-wave converter. High-frequency

operation allows the inductive and capacitive energy-storage devices to

be smaller than those used in lower-frequency converters, a reduction

that results in significant size and weight savings. Higher-frequency

operation in the series resonant converter is possible because a ser -

ies-resonant current, rather than rectangular pulses, is conducted

through the control-semiconductor power switch. The power switches are

controlled so that they switch on and off when the current through the

switch is very close to zero, thus allowing very low switching losses.

Figure 3.4.1-2 shows a simplified schematic of a twin-full-bridge version. Operation and control methods are similar in that the operating

principle is merely an extension from the half-bridge operation.

C1 Lll ~ L12

e s ^ 11

D62 D61

C12

C

o

vo

13

D63 D64

^_ L14

CR CR 112

D53 D54 41 CR

i

D 31 D D D 42 

32 31 41 42 

Figure 3.4.1-2 Vain Full -Bridge Converter Configuration

3-37
A do-ac version and a 3-phase ac-dc version exist as well. Operating

parameters for all these configurations are listed in Table 3.4.1-1.

Table 3.4.1-1

Operating Parameters of Existing Series-Resonant Configurations

Type Vin VOut Power

Half-Bridge Dc-Dc 200-400 V 200, 25 kV 100 kW

Twin Full Bridge 200-400 V 400, 25 kV 200 kW

Dc-Ac 200-400 V 208 Vac 5 kW

Ac-Dc 100-208 V 200, 25 kV 5 kW

Estimated efficiencies for the do-dc types may range as high as 97 to

98% due to the reduced switching losses inherent in this topology.

State of the Art - The basic operating principles are known and have

been demonstrated; however, development and improvement are still needed. Studies are presently underway that focus on developing standardized control and protection circuitry as well as to identify potential

problems with space applications. Hybrid technology and microprocessor

applications for control also are being examined by Martin Marietta

under the AFAPL contract.

Flight History None

Types/Manufacturer — None; under development by AFAPL.

3.4.2 Dc-Ac Inverter

Description - An inverter is a power-conversion device used to transform do power to ac power. Power -conversion circuits consist basically

of some type of " chopper" used to develop a waveshape that is acceptable to a transformer. The switching function in the inverter circuit

is usually performed by high-speed transistors or silicon-controlled

rectifiers ( SCR) connected in series with the primary winding of the

output transformer. Figures 3 . 4.2-1 and 3.4 . 2-2 show two different

types of inverters, push-pull and resonant, respectively.

a:

3-38

T
Vpri

Rfb

ORIGINAL PAGE 1,7

OF POOR QUALITY

SCRL

CRl 1 Cl

RL

II

EzN III

!I L2

T C2

CR2 I

SCR2

Figure 3.4.2-1

Two-Transistor, Two-Transformer

Push-Pull Switching Inverter

Figure 3.4.2-2

Series L-C Resonant Inverter

Transistor and SCR inverters can be made very lightweight and small in

size. They are also highly efficient circuits and have no moving parts.

Principal Operating Characteristics - Dc-ac inverters show promise in

applications involving large space-power systems. A study of the multihundred-kWe space system by General Dynamics (Ref 27) points out that

the first choice for general-purpose, space-platform application; is a

hybrid-ac/dc, centralized, and distributed configuration (Fig.

3.4.2-3). This system's major features are listed in Table 3.4.2-1.

SOLAR ARRAY, I __-0 PLATFORM

ARRAYS S" SBIE

TRANSMISSION A DISTRIBUTION BUSES SINGLE PHASE. REDUNDANT

SWITCHING DC. INTF. PRI I. JESEC SW

A C ONTO SW INVERTEfl SW

250 KW

(10) + (1) SPARE ROTARY X FMR

25 KW MODULES

COMPLEX PRI I'M SIMPLE PRI PRI PRI

135 KW

CHARGE (10) + (1) S►ARE 1 ,FRII, •I ^QQJ

%U (TYPI • + • • • •

IIInLY JI I1511CJI

IISLkJ1 CONTROL 17.5 KW

MAGNETI C ^kJ

^ PAYLOAD

MODULES CONNECTORS

• SEC ` SEC SEC SEC

INTF INTF INTF INTF INTF

SW SW SW SIN \ SW

BATTERIES

15.0 KW AT 28 VD y kT. PC AC•DC IDI + II) SPARE ! „ VOLT HIGH VOLT AC•AC. CONVERTER/ \\ AG•ui 5 0 KW AT 2B vdt

LOW VOLT Ill + (1) SPARE

5 KW MODULES ^' 's:'1W .REGULATORS 5.O KW MODULES

•PIU - PAYLOAD INTERFACE UNIT; 20.0 KW AT 115 VDC 20,0 KW AT VAC 75.0 KW AT 1000 VAC

TEN AEODUIEO. WITH (q + (1) SPARE (q# (1) SPARE 15) + (1) SPARE

OFFERING CAPABILTIES 5 KW MODULES 5.0 KW MODULES 15 KW SW MODULES

INTF SW — INTERFACE SWITCH MODULES

Figure 3.4.2-3 Ac-Dc Hybrid Resonant System (Ref 27)

3-39
h

Table 3.4.2-1 Ac-Dc Hybrid Resonant System Features

- Modular Design and Construction Sized for Minimum Weight/LifeCycle-Cost

- High-Voltage Transmission (1000 Vac RMS)

Medium-Voltage Array (440 Vdc)

Resonant Inversion

- Transformer Rotary Joint

- High-Frequency, Single-Phase Transmission Line (20 kHz)

- Energy Storage on Array Side of Rotary Joint

- Fully Redundant

- 10-Year Life with Minimal Replacement and Repair

- Recurring Life-Cycle Cost - $28 per Pk Watt

State of the Art - The inverters for high-power space application do

not exist.

Flight History - None

Types/Manufacturer - None; potential suppliers include:

- Helionetics, Inc

General Dynamics and Astronautics

- Martin Marietta

- TRW

3.4.3 Switched-Mode Dc-Dc Buck Converter

Description - This type of converter is used often it`s spacecraft applications. Advances have been made toward automating this type of system, the best example being the Programmable Power Processor (P3)

(Ref 6). It is an autonomous, 18-kW power processor for use in large

high-power spacecraft power systems. Operation as a voltage regulator,

battery charger, shunt regulator, or power limiter is achieved by selection of the resident ROM. The P 3 is also flexible in other areas

such as the command and data interface. With selection of the appropriate interface card, a single P3 can operate in different modes and

with almost any spacecraft interface. Table 3.4.3-1 summarizes its

main features.
Yable 3.4.3-1 P3 Functional Capability

ORIGINAL PAGE

OF POOR QUALITY

Battery Control

- Battery Charger

- Peak Power Tracker (Solar Array)

- Caution and Shutdown

Bus Voltage Control

- Voltage Regulator

- Caution and Shutdown

Power Limiter (Shuttle Power Extension Package)

- Peak Power Tracker

- Fuel-Cell Current Limiter

Caution and Shutdown

Power Bus Overvoltage Protection

Shunt Regulator

- Caution Shutdown

Figure 3.4.3-1 shows the functional block diagram of P 3 . The input

and output power are connected through two 4-pin, 50-A connectors. The

78-pin patchplug connectors and 15-pi-n analog measurement connector are

provided. The package weighs 62 lb, and the volume is 1.17 ft3.

Input Power rr= — — 2

Power Stage P Output

Power L

' Power Ease Drive

Bias Pulse Width Internal

Regulator Modulator (PWM) I I/O

I P Control

__ — _: _H44

Processor PROM PC/I

To RIU or FMDM Patch — 

P3 Programmable Power

Plug Processor

P2 Power Processor

PC/I Programmable

Controller 6 Interface

Figure 3.4.3-1

Functional Block Diagram of P3
The power section contains three parallel poser stages, which are controlled with a 100-kHz-pulse width-modulated drive circuit. Output

voltage ripple is minimized by operating the three stages 120 degrees

out of phase with respect to each other.

The microprocessor used in the P 3 is a TTSB9900. This was selected

because it was available in I 2L technology which has low radiation

susceptibility. The 9900 uses a lb-bit data bus and hardware multiplication and division.

Control parameters and caution-and-shutdown parameters can be changed

in flight by ground control using command-adjustable parameters.

Principal Operating Characteristics - High or low power levels may be

achieved with P3 by connecting several P 3 s in parallel without

hardware modification. Ten P 

3 s connected in parallel can produce up

to 28 kW at 28-Vdc output; one P3 may be used if 3 kW or less are

required. Table 3.4.3-2 lists the electrical characteristics of P3.

, Figure 3.4.3-2 shows the efficiency as a :Function of the output current

r

- at several input voltage levels.

State of the Art - The hardware and software for an autonomous 18-kW

programmable power processor have been developed, integrated, and verified at ambient conditions. The power processor has been demonstrated

to be capable of output voltages of 30 to 180 Vdc, at output currents

' of 0 to 10 Adc, and for input voltages up to 375 Vdc. Software for

both the voltage-regulator and battery-charger/battery-management modes

has been successfully tested. Mode selection and telemetry scaling via

patchplug has been accomplished. The P system has been demonstrated

with both an RIU and an FMDM interface. An autonomous operation has

been successfully demonstrated in the areas of automatic state transition, interface initialization, caution-and-shutdown monitoring, telemetry acquisition, processing and display, overload protection, battery 

management and protection, and peak-power tracking. .A complete mechan- 

ical design for the P3 has been developed. An engineering model has

been electrically tested, and environmental testing is underway.

R'

f

- 

i 3-42
ORIGINAL PAGE IS

3 OF POOR QUALITY

Table 3.4.3-2 Summary of P Capabilities (Ref 6)

Parameter Level Notes

Output Voltage, VO 24 Vdc to 180 Vdc Programmable

Output Current, IO 0 to 100 Adc

Input Voltage

Steady State, VIn 26 Vdc to 375 Vdc

Transient Voltage

Limitation 400 Vdc, 20 s

Output Voltage 50% of SL-L-0002A For V0 = 30 Vdc

Ripple Conducted Susceptibility Allowable Ripple

for VO = 30 Vdc Rises Proportionally

Internal Power Dissi- 600 W

pation That bust Be

Acceptable to Mechanical Design

Fast-Response hardware 105 to 115 Adc Limiting Protection Circuit

Overload Protection Occurs within 10 s of Will Override MicroOver4`oad computer

hardware Overvoltage Programmable between Protection Circuit

26 & 200 V Will Override Microcomputer

Maximum Standby Power 140 W

Flight History - None

Types/Manufacturer - Martin Marietta/NASA MSFC
ORIGINAL PAGE 19

OF POOR QUALITY

100

W

ea

so

w 75

1.

W

W

TO

55

so

s5

50 

0 10 20 70 40 50 60 70 W to 100

OUTPUT CURRENT IAMPERESI

Figure 3.4.3-2

P3 Efficiency vs Output Current, Input

Voltage a Parameter

3.4.4 Transformer Coupled Converter

Description - The transformer—coupled converter (TCC) was developed by

LMSC (Ref 31) for use on the Space Shuttle Power Extension program.

This converter meets the weight and efficiency requirements for space 

applications and is capable of converting power from high-voltage solar 

arrays. The converter topology used is the full-bridge transistor- 

transformer-coupled design. The TCC block diagram is shown in Figure

3.4.4-1. The D60T high-voltage transistor is used in the baseline de- 

sign because of its superior ratings.

The complete system consists of two independent bridge-converter modules having their own independent regulator, analog.-control subsystem,

digital-control subsystem, and peak power tracker. The unit dimensions

are 20x2Ox7 in. and the weight is 67 lb.

r
i,

!h Vp.

i,

0117

. VOC I8N

MT

NEN SENSE f

.IV Sf NSL I

.fl ..P

/.M I ♦

i1 EN SENSL 7

MEN SENSE 7

ORIGINAL PAGE 19

OF POOR QUALITY

Figure 3.4.4-1 TCC BZock Diagram (Ref 31)

Principle Operating Characteristics - Ttie basic electrical charact

tics of TCC are listed in Table 3.4.4-1.

Table 3.4.4-1 TCC Specifications 

Requirements Design Goals

Input Voltage: 111 to 234 Vdc 110 to 330 Vdc

PEP-Solar-Array Compatible

Output Power: 5.0 kW 6.5 kW

32.5 Vdc 34.0 Vdc

Efficiency:

- Overall 90% 91+%

- Converter 92% 92+7.

- Peak-Power Tracker 98% 99%
30

> 20

FO

10

N

OF POOR QUALITY

The transistor bridge power converter stage is fully transformer driven

vt,h proportioned base drive. Current sensing is also transformer- l

coupled through current-sense transformers situated in the return-level

emitter circuits. The secondary uses dual parallel rectifier-filters

and the switching frequency is 20 kHz.

The principle feature of the TCC analog control circuitry is the active

control of transformer flux balance through converter phase current

sensing. The pulses of power-transformer primary current are sensed

magnetically for each conduction phase.

Regulation breakup at very low output voltages in current limit mode,

due to finite pulsewidth limitations, is reduced through foldback current limiting derived from the output voltage as shown. The TCC output

I-V characteristic is shown in Figure 3.4.4-2.

50 100 150 200

,OUT. A

Figure 3.4.4-2

TCC V.I output Characteristics

The digital-control subsystem handles common logic functions such as

pulse phasing and enforcing a minimum offtime. This subsystem also

coordinates phase turnon, current-sampling commands, normal phase turnoff, instantaneous phase turnoff, and limiting each phase to a single

turnon event per clock, cycle. 

3-46 
F a

The peak-power tracker maintains maxiwum solar-array output power during system overload conditions. The peak-power tracker used is an analog type based on the principle of steepest descent with gradient estimation by means of input-voltage perturbation.

State-of-the-Art - LNISC has build two complete TCC units and operated

them at full power (Ref 31). The prototype unit is scheduled for delivery to NASA Johnson Space Center for evaluation in their Shuttle

Orbiter power system simulator. The prototype is intended to simulate

the overall physical characteristics of a flight unit.

Flight History - None

Types/Manufacturer - LMSC

3.4.5 Partial/Full Shunt Regulator

Description - Shunt regulators are used to limit solar array and/or bus

voltage at some value under varying spacecraft bus loading and array

power conditions. This is accomplished by applying one or more proportionally controlled shunt elements across the bus as in the case of the

full shunt regulator (Fig. 3.4.5-1A). Partial shunt regulators connect

at an intermediate point on the array string to reduce power dissipation (Fig. 3.4.5-1b). Other types of shunt regulation schemes are

shown in Figure 3.4.5-2 (Ref 30).

Principal Operating Characteristics - The partial shunt regulation

r approach is more relevant to high-power systems due to its lower dissipation. The binary-segmented, partial-shunt regulator, for example,

P

uses both linear anddigital control (Ref 14, 15, 28, 29). One of the

unique features of this type of system is that the solar array is di- 

vided into binary segments that the shunt regulator controls. All

shunt-regulator power stages are either open or saturated except for

the first one. Each of the on-off power stages is driven by one of the

up-down counter outputs. As a result, the bus current will decrease as

the counter decreases. This type of control can be used with equal

segmented arrays as well.

i 

3-47
ORIGINAL PAGE 18

OF POOR QUALITY

Series Switching, Shunt Switching,

Series Array Sections Series Array Sections

Bus Bus

Series

00 Switching,

Se 

00 Switching' ries

Pa ra I r r 

S

Parallel

Array Sections

Retu rn

Shunt Switching,

Parallel Array Sections

ZBus

0

000

Retu rnF Retu rn Retu rn

Note: All Boxes Represent Solar Array Sections

Figure 3.4.5-2 Array VoZtage Regulation via Switching

Solar Array Section

Bus Bus

000

A 000 CMD

000

CMD

*Mounted on Radiator,

Return ETNormally External to S/C Retu rn

a Full Shunt., (b) Linear PartiaZ Shunt

Figure 3.4.5-1 Shunt Regulation Configuration

3-48
State-of-the-Art To date, the shunt approach has been almost exclusively used for GEO and medium-altitude orbits and in low- to moderate- (100-to-2kW) power systems. The shunt regulator can be expanded

so it can handle, higher power levels by switching from a single-stage

system to a multistage system, although growth capability is limited by 

circuit complexity and component limitations.

Flight History - Many spacecraft have used shunt regulators. Some

examples are listed below:

Type Spacecraft

Full Shunt TACSAT', OJO, Pioneer Venus Orbiter, Multiprobe

Bus, GMS , SCATF+:A

Partial Shunt SEASAT, NARISAT, Satellite Business Systems,

AIVIK-C, NTS-2

Types Available Typically custom-designed.

3.5 POWER DISTRIBUTION

3.5.1 Magnetic Latching Relay

Description - Magnetic latch relays are electromechanical power-switching components. They have two coils (A and B in Fig. 3.5.1-1 and

3.5.1-2), one for set and one for reset. They require only pulse power

to transfer and do not require any steady-state coil power. All

space-qualified units are in a nominal 28-Vdc contact rating.

Principal Operating Characteristics - Energizing, Coil B produces a magnetic field opposing the holding flux of the permanent magnet in Circuit B. As this net holding force decreases, the attractive force in

the air gap of Circuit A, which also results from the flux of the 'permanent magnet, 'becomes great enough to break the armature free of Core

B, and snaps it into a closed position against Core A. The armature 

then remains in this position on removal of energy from Coil b,'but

3-4y
ORIGINAL PAGE 10

OF POOR QUALITY

will snap back to position B on energizing Coil A. Because operation

depends on cancellation of a magnetic field, it is necessary to apply

the correct polarity to the relay coil as indicated on the relay schematic (Fig. 3.5.1-2).

Permanent Magnet /Magnetic Circuit A

Magnetic Circuit B 1 /

/// ,Soft Iron Frame

+•

Coil B Coil A

Soft Iron, ,Soft Iron

Core B Core A

r—

Soft Iron Air Gap

Armature Stationary

Contact

Contact

Figure 3.5.1-1 Cross Section of a Mag-Latch Relay

Note:

Numbers represent electrical terminals.
State of the Art - These are mature components with many space -qualified units for 28-Vdc systems. Development is required for 120 -Vdc and

24U-Vdc systems.

Flight History - These devices have flown on wany spacecraft.

Typeshianufacturer - The following types are available for space

applications:

Contact Weight, Size,

Mfg

P/N Vdc Adc

gm in.

Hartman 28 50 224 1.8xl.99xl.51

LEACH ICCL Series 28 25 85 1x1::1

LEACH JA Series 28 10 40 1xlxO.5

LEACH X Series 28 5 15 0 . 4xO.8xO.65

3.5.2 Motor-Driven Switch

Description These components employ a do motor to make and break the

contacts. Contacts are usually DPDT although the user can specify the

form of the contacts.. Motor drive is normally 28 Vdc. Internal limit

switch stops the motor after opening or closing the contacts.

Principal Operating Characteristics - Table 3.5.2-1 summarizes the

electrical performance of a typical motor-driven switch.

Table 3.5.2-1 Motor-Driven Switch EZectricaZ Performance

Parameter Requirement

Contact. Drop: Less Than 100 mV

Dielectric Strength: 1000 V AS for l min, w/o Failure

Operate Time: 100 ms

Motor Current: 8 to 11 A, 32 V

Contact Rating: 28 Vdc, 200 A Continuous

Overloaa: 750 A (Make and Brake)

Rupture: 2000 A

Life: 25UO,cycles at 28 Vdc, 200 A

(y

t

7F 

r

{k

{5

its,
OF POOR QUALITY

State of the Art - Space-qualified components have been used on missiles and spacecraft for years.

Flight History - Flown on most missiles and marLy spacecraft.

Types/Manufacturer - Kinetics Corp., 10-, 20-, 50-, 100-, arid 200-A

ratings.

3.5.3 Solid-State Switch--RPC

Description - Solid-state remote power controllers (RPC) are switching

devices that combine in one unit the capability to perform all the

functions of load switching, overload protection, and direct indication

of load status.

RPCs are designed to be located near the load and communicate control

and status information remotely via low-level signals. Figure 3.5.3-1

is a functional block diagram of RPC in a typical application. The

packages range from 3.8x3.8x2.3 cm, weighing 77 g, to 4.8x4.80.1 cm

weighing 142 g for the 28-Vdc version.

Power Bus 

Power Power

Ground Input

Control In Power

Status Out RPC Output

Cont/Star

Common

Load

in a TypicaZ Application

a

.5L
ORIGINAL PAGE 19

OF POOR QUALITY

Principal Operating Characteristics - Operation of an RPC is relatively

straightforward. Bus voltage must exist at the power input to which

the positive control voltage is applied. The control section is optically coupled to the logic and internal power supply. With the tripand-latch circuit armed, the switch-driver circuit is activated to turn

on the main power switch and energize the load in a controlled manner

(Fig. 3.5.3-2). Once the RPC is activated, it sends back an "on" signal for status indication. In the event of a fault condition, the RPC

will either limit, integrate, or trip, depending on the nature of the

overload. A trip will result in de-energizing of the Load and a trip

indication on the status line. Table 3.5.3-1 lists operating parameters for the 28-V version.

Fail-Saf a Current Power

Power Device Sensor Switch Power

In TErrent Output

mit

Power Compositentrol

Power Supply Time Delay

Ground

Trip & ^AN Switch

Latch Driver Power

Reset F Ground

OR

J

Opto-Coupler 

- j Isolation j - i

ControlIn

i

Cont/Stan

Common

Status Out

Figure 3.5.3-- 2

FunctionaZ Block Diagram of an RPC Showing Each Basic Function

3-53

r
C

"l

4

a

Ik

0

Table 3.5.3-1 Operating Parameters

Operating Voltage: 24 to 34 Vdc

Current Ratings: 3 A, 5 A, 7 A, 10 A, 15 A, 20 A

Current Limiting: 125 to 150% of rated

Overload-Trip Time: 2 to 3 s

Rise-and-Fall Time: 0.3 to b ms

Control Voltage: 5 to 7 V (Off), 9 to 12 V (On)

Control Current: 10 mA max

State of the Art - Space-qualified units are available (see Fig.

3.5.3-3 for typical packaged RPCs).

Flight History - Each Space Shuttle Orbiter contains more than 500 RPCs

in six ratings from 3 to 20 A.

Types/Manufacturer - Typical ratings and types available from Westinghouse are:

28 Vdc, 3 to 20 A

120 Vdc, 5 to 300 A

270/300 Vdc, 4 A, k A

230 vac/400 Hz, 1.5 A

R

ORIGINAL PAGE IS

OF POOR QUALITY
Fin dc, 20-A RPC Used

huttle Orbiter

ig Pin

Electric

Terminal

Cover

Lower

Substrate

Assembly

Heat Sink

Top

Substr-'e

Assemb_,

Circuit

Side Down

ORIGINAL PAGE 19

OF POOR QUALITY

root I Power Switch

(Tvp ) Transistor ('Typical)

Side Rail

Note:

120 V::c; SA, with

Power lit Current Limiting

Control

^

I

• Terminals

I I L i^^ Cover

Power Ground

Power Out

Header

Substrate Assembly

Top Substrate

Assembly Circuit

Side Rail

Mounting

Foo t

!:°e 3.5.3-3

,-;u.taway View of Packaged Remote Power Control:ers

3.5.4 Fuses

Description - A fuse is a device used to protect electrical-s;stem componentb from fault currents. Two conditions exist where a fuse will

open. The first is an overload current, where the current rating is

exceeded by any marginal percentage. The second is in the event of a

3-5L
IK

direct short circuit, in which the fault current, (in the absence of a

protection device), would exceed the rated current by many orders of

magnitude. Tne possibility exists that a component such as a circuit

breaker can be completely destroyed under short-circuit conditions

while the fuse opens and protects the user from the fault current. The

current-limiting capability of the fuse should allow components with

low short-circuit tolerances to be specified.

Principal Operating Characteristics - Fuses are characterized by their

rated current voltage and "let-thru" current values (lief 33). Current

rating is a nominal value expressed in amps to which the fuse can be

loaded based on a controlled set of test conditions. Voltage rating

indicates the value at which the fuse can safely interrupt a fault current. Peak let-thru current is the current value that flows at the

time the fuse blows (Fig. 3.5.4-1).

The area under the curve indicates the amount of short-circuit energy

being dissipated in the circuit.

Magnetic forces and thermal energy are directly proportional to the

square of the current. This implies that the fault current must be

limited to as small a value as possible in as short,a time as possible. Figure 3.5.4-2 shows a typical relation of blow time versus fault

current in percent of rated current.

State-of-the-Art - Fuses are a m,4^v turA technoU-, y;

Flight History - These devices have flown on several spacecraft.

Types Available - A large number of different types exist from several

suppliers.
ORIGINAL 

OF POOR QUALITY

Boo

700

« 600

500

400

Y

r

t 0

° 300

t7J

Peak

c

Let-Thru

a 200

V

100

O

Medium-Acting -+—^

Fuses

(Normal Opening ' "Slo•Blo" Fuses

Fast•Acting Fuses

(Normal Opening)

I

Time 0.001 0.01 0.1 1 .0 10 100 1000 10000

Figure 3. S. 4-1 Blowing Time in Seconds

Typical Current-Limiting Characteristics Figure 3.5.4-2

of Fuses Typical Fuse Blow Time Characteristics

3.5.5 Circuit Breaker

1

1

r

Description - Circuit breakers, like fuses, are a protection device and

function to protect the power wiring. The type used on the Space Shutr

tle Orbiter are thermal circuit breakers. This type of breaker is de- 

pendent on temperature rise in the sensing element for actuation. Tem- f

perature rise in the sensing element is caused from load-current I 2 ; 

heating. This causes deflection of the element (e.g., bimetal), which 

will cause the circuit to open. The size of the thermal element, its

F configuration, physical shape, and electric resistivity, determine the

r 

current capacity of the breaker.

f

Principal Operating Characteristics - The Series-4310 ambient tempera- 

Lure-compensated miniature circuit breaker is a lightweight single

phase breaker. This device is designed to operate under severe environmental conditions. Table 3.5.4-1 lists operational data. 

9

3-57

g

(
Tabte 3.5.4-1 Typicat Circuit-Breaker Characteristics

Minimum Limit of Ultimate Trip: No trip within 1 h at 110% load,

25°C.

Maximum Limit of Ultimate Trip: Trip within 1 h at 145% load, 25°C.

Overload Cycling: Minimum of 100 cycles at 200% rated

Current.

Interrupting Capacity: 1 to 20-A models: 6000 A at 28 Vdc.

Dielectric Strength: 1250 Vac

Insulation Resistance: 100 megohm at 500 Vdc.

Weight: 25 g.

The breaker characterized above was built to Rockwell specifications

for use in the Space Shuttle orbiter. Other types were used as well.

State-of-the-Art - Space-qualified units are available.

Flight History - Circuit breakers have been used on manned missions

(Skylab ana Space Shuttle Orbiter).

Types/Manufacturer - Many types are available; for example, see Mechanical Products, series 4310 and Series 4330, used on Shuttle Orbiter.

3.5.6 Cabling

Description - Cables are insulated conductors used to transmit electrical energy to all the various subsystem components.- The most common

material used is copper because of its high electrical conductivity,

ductility, and resistanceto wear and fatigue. Copper-alloy conductors

are desirable because they permit significant size and weight reduction. Aluminum conductors could represent a great weight savings

(50%); however, they have low tensile strength, poor flexibility, and

crimp poorly to terminals.
ORIGINAL PAGE 19

OF POOR QUALITY

There are many types of insulation available that are suitable for

aerospace applications. The best of these and their properties are

shown in Table 3.5.6-1.

Table 3.5.6-1 Characteristics of Various Insulation Mater als

Polyvinyl

Fluoride

Kynar

FEP

FluoroplasticPolyimide

Kapton Teflon

Polyimide

Nylon 6

Tensile Strength, psi 7000-18,000 2500-3000 25,000 3000 9000-18,000

Elongation, X 115-250 300 70 250-330 250-500

Burst Strength, Mullen 19-70 11 75 11 Elongates

Points, l-mil Thick

Tearing Strength,lb/in. 997-1400 600 1 232 mil 600 1000-120U

Water Absorption, 24 h, 0.5

i

0.01 2.9 Neg 9.5

%-Wt Gained

Temperature Limits, °F

- High 2.20-250 440-525 750 392 200-400

- Low -100 " -425 -450 -112 -100

Dielectric Constant at 8.5 2.0-2.05 3.5 2.1 3,7

103 Hz

Dielectric Constant at 1.6 2.05 3.4 2.05 3.4

109 Hz

Dielectric Strength, 7000 3500 7000 7000 1300-1500

V/mil

Thermal aerating is based on the wire-bundle configuration. The derat- 

ing factor considers the temperature rise due to reduced thermal view

and thermal conductivity of the bundle. For example, flat conductor 

cable requires the least aerating, owing to a greater surface area not

common to the other conductors (Fig. 3.5.6-1).

A cylindrically assembled bundle requires more derating to keep operating temperatures low. 
ORIGINAL PAGE 18

OF POOR QUALITY

1.0

0.9

CC 0.8

O

fU

V 0.7

z

W 0.6

0.5

0.4

FLATLY ASSEMBLED CABLE 000000D

\

CYLINDRICALLY ASSEMBLED CABLE

SUNptED 

CABLE

4

)

0.3

1 5 9 13 17 21 25 29 33 37 41

NUMBER of WIRES IN MULTIPLE WIRE CABLE

Figure 3.,5.6-1 Derating Curves for MuZtiple Cable Assemblies

Principal Operating Characteristics Power conductor parameters are

listed in Table 3.5.6-2 for different materials. Table 3.5.6-3 shows

performance information for these types of materials. 

State-of-the-Art - Copperclad aluminum cables and bus bars are presently used in space programs. Sodium and intercalated carbon fibers rep- 

resent new technology (Level 3). Sodium conductors would be extremely 

lightweight, and intercalated carbon would reduce cost as well as lower 

the weight.

3-6U 
ORIOINAL PAGE i,

Table 3.5.6-2 Power Conductor Characteristics OF POOR QUALITY

Parameter Copper* Aluminum' Sodium#

Intercalated

Carbon

Fibers#

Relative Conductivity, 100 (Ref) 61 40 TBD

Volume Resistivity, 1.72 x 10-6 2.82 x 10`6 4.3 x 10`6 3.5 x 10-6

ohm-cm To Date

Density, g/cc 8.89 2.70 0.97 2.7

Temp Coefficient of -0.0393 -0.00410 -O.UO44 TBD

Resistance

Coefficient of Linear 17 x 10-6 23 x 10-6 b2 x 10-6 1 x 10-6

Expansion/°C

Melting Point, °C 1083 659 97.5 N/A

Electrical Resistivity 15.3 x 10-6 7.bl x 10-6 4.17 x 10-6 9.5 x 20-5

Relative Density to 100 50 27 618 To Date

Conductivity Ratio

*Present

+Near-Term

OFar-Term

Flight history

Copper Types Used Extensivel}r 

Sodium None

Intercalated Carbon - None

Types Available - Copper

3-b1 
Parameter Copper CdCrCu Aluminum Sodium

Intercalated

Carbon

Tensile Strength 32,000 68,00 15 , 000 N/A 300-1000

(Also Improved By

Insulation), psi

Flexibility Reference 3X Copper 1/3 Depends TBD

Copper On

Sheath

Crimp Excellent. Very Good. Poor. N/A N/A

Terminability Crimping Greater Crimp- Tends to

Tools De- ing Force Creep,

signed Required Causing

Around Looseness

Copper and

Arcing

Solderability Excellent. Very Good. Very Poor. N/A N/A

Mild Flux Stronger Flux Special

Usually Required Flux

Required with Alloys Required

Stability Fair. Same as Copper, Excellent, Good Excellent.

Prone to Except Alloying Except in Only in

Oxidation Decreases Rate Chloride Space

and of Attack Environ- EnvironChloride ment ment

and Sulfide

Tarnish

Table 3.5.6-3 Power-Conductor Performatnee Information

3.6 POWELt-TRANSFEK DEVICES (GIMBALS) 

3.6.1 Slip Pings

Description - Slip rings are used to transfer electrical power and signals from the solar-array and sun-sensor preamps to a stationary portion of the structure. Under 14ASA contract 11AS3-22266 on power manage- 

ment technology, Poly-Scientific Corp. evaluated the feasibility of

producing a slip-ring capsule assembly (Ref 35). This module design

serves as a good example of present slip-ring technology. 
The slip-ring capsule was designed in 25-kW sections to be combined

into a 100-kW capsule. Table 3.6.1-1 lists physical/mechanical characteristics.

2'able 3.6.1-1 Physical and Mechanical Characteristics

Length: 11 in.

Outside diameter: 5.5 in.

Weight: 13 lb

Rings, Number: 8 Total, 4 +, 4 -

Material: Coin Silver, (9 Ag-10 Cu) or Hard Silver

Electrodeposit

Brushes, Number; 6 per Ring

Material: Silver, Molydisulfide, and Graphite

Life: 5 Years

Current Density: 62.5 A/in. 2 , Normal; 150 A/in. 2 , Emergency

Drive Torque.: 8 in.-1b

Principal Operating Characteristics - The slip-ring capsule assembly

may be used to reliably and efficiently transfer 100-k1: of power in

,t space. Table 3.6.1-2 summarizes the electrical operating parameters.

Table 3.6.1-2 Electrical Parameters

Voltage: 400 Vdc

Current: 62.5 A per Module; 250 A Total

Power: 100-kW, 4 to 25-kW Modules

Contract Drop: 0.090 V

Power Loss: 45 W

State-of-the-Art - Slip rings are a mature technology (Level 8) and are

applicable for 100-kW range.

Flight History - See Table 3.6.1-3.

Types/Manufacturer See Table 3.6.1-3.
ORIGINAL PAGE IS

OF POOR QUALITY

Table 3.6.1-3

Flight History Space Slip Rings and Poly-Twists Preliminary

PoZy-Scientific Data

P/N Application Customer Type

FK1806,7 Nimbus SA TRW Sep

D1836 Tiros BBRC Cap

BQ194b Not Defined Cap Comp

ET2Ul0 OSD BBRC Cap.

EW2U63 Apollo Ant. Dalmo Victor Cap.

F12076 INT IV A HAC Sep

BN2098 Mars Probe GE Cap.

ET2189 Scoop BBRC Cap.

D2255 Skylab Bendix Cap.

FK2334 Viking TRW SW

ET2374 Atm Exp BBRC Cap.

FL2391 OSO HAC Cap.

AS2431 Dom Sat-. RCA Sep

ET2445 CTS BBRC Cap.

FK245U Ft,T SAT. CUM BBRC Sep

FK247U Solar Array TRW Cap.'

DQ2614 Not Defined LMSD SW

DQ2615 Solar Array LMSD Cap.

D2634 ELMS Bendix Cap.

AS2646 TEL SAT. RCA Cap.

JP2650 OTS HSD Sep

AC2737 Not Defined - Cap.

DQ2769 Sea Sat. LMSD Cap.

ET2793 P78-2 BBRC Cap.

KU2832 INT V FACC Sep

FK2857 TDRSS TRW Sep

FL2907 SITS Hughes Sep

ANIK-C,D

Legend:

Cap. - Capsule SW - Switch

P - Pancake Tape - No Contacts, Tape Conducts

3.6.2 Roll Ring

Description - The roll ring is a device for transferring power across a

rotary joint. This approach incorporates a complex structure of mechanical parts (Fig. 3.6.2-1), which significantly reduces friction.

The dimensions of a developed device are 25 in. long, 10-in. diameter,

r and it weighs 30-kg.

3-64
ORIGINAL PAGE 19

kun

Figure 3.6.2-1 Cutaway of 11-Contact RoZZ-Ring Capsule (Ref 34)

Principal Operating Characteristics Table 3.b.2-1 lists roll.-ring

performance characteristics identified in Reference 34. Its design

goals are:

f'

t{

1) Provide transfer of power ranging from 10 kW to 100 kW;

2) Be capable of handling high voltage independent of the environment- 

w

al pressure; a 1000-V criteria was used to force a solution of the 

high-voltage corona problem for high-power systems in vacuum, with 

. potential operation pressures in the critical-pressure zone ;

3) Transfer power with a minimum size and weight; 

f 4) fleet long-life operating requirements ranging from three to 10

°S{ years, with rotation up to 56,000 revolutions;

5) Provide redundancy in the power-transfer lines;

Y

i 3-65

4ry
a a 6) Ensure wearout-failure modes are open-circuit type;

7) Transfer power with unlimited angular rotation.

Table 3.6.2-1 RoLl-Ring Performance Characteristics

Parameter Capability

Rotation Limit $Ailimited

Internal Pressure, mw fig 7bO x 10-8

Voltage Limit 200

Max Current, A 10

Corona Problem Yes

Life Millions ox Rev

Conductor Size and Number Fixed 10 (Bearing Friction)

Angular Rotation X1

State-ot-the-Art - This is a new technology device (Level 4).

Flight history - None

- Types/Manufacturer - Wone

3.6.3 Rotary 'transformer

Description - A rotary transformer designed by CE (Ref 35) consists of 

a primary core with windings and a secondary core with windings in a

cylindrical configuration. The secondary core encloses the primary

core, which has a shaft through the center. The secondary can be supported by a housing that is connected to the spacecraft structure. The

Priwary core/shaft assembly can rotate freely within the secondary

core. This configuration allows energy to be transferred through a 

rotary joint by magnetic induction once power conditioning electronics

are connected to the rotary transformer. The transformer characteristics are listed in Table 3.6.3-1.

This device is being developed for use with a series resonant convert-

' j er. The power per module is based on a 25-kW design, however there are

a no inherent limitations to the power levels, 

-

3-66

_-

-
OF POOR QUALITY

Table 3.6.3-1 Rotar;y Transformer Characteristics (Ref 35)

Core

Outside Diameter 9.0 in.

Air-Gap Diameter 5.35 in.

Inside Diameter 2.0 in.

Air-Gap Length 0.01 in.

Width of pole 0.6 in.

Winding

Primary Resistance, 100°C 0.0053 ohms, do

0.0136 ohms, ac

Secondary Resistance, 100% 0.029 ohms, do

0.120 ohms, ac

Primary Inductance 19 H

Seondary Inductance 51 H

Weight, lb

Copper 7.1

Core 15.7

Losses

12 R 141

Core 89

Efficiency 99%

Thermal

Primary

Sink Temperature 60°C

Cure Temperature 100°C

Coil Temperature 105°C

Secondary

Sink Temperature 60 °C

Core Temperature 63°C

Coil Temperature 66°C

Principal Operating Characteristics - Four 25-kW modules combine to

provide 100-kW capability. A drive module provides a rotational capability from one revolution per day to one revolution every 90 minutes

using a stepper motor, speed reducer; and clutch. Table 3.6.3-2 lists

the basic operatingcharacteristics of the system.

State-of-the-Art - This is a new technology item (Level 3).

Flight History - None

Types/Manufacturer - None
s

Table 3.6.3-2 Operating Characteristics of 100-kW Rotary Transformer

Input from Solar Array

Power 100 kH

Voltage 440 V

Output from Rotary Power Transfer Device

Voltage 1000 V

Frequency 20 kHz

Power Conditioning Electronics

Resonant Circuit (Schwartz)

Rotary Transformer

Power 100 kW

Input Voltage 400 V

Input Current 70 A

Output Voltage 1000 V

Frequency 20 kHz

Inductance 75 H

Configuration Concentric Cylinder

4- to 25-kW Modules

Two Parallel Secondary Windings per Module

Rotational Period 90 minutes to 24 hours

Efficiency Greater than 95%

Environment Shuttle Launch

Temperature

- Nonoperating -200 to H0°C

- Operating 80' Heat Sink, Rotary Transformer

60° Heat Sink, Power Conditioning Electronics

Life 5 years

3.6.4 Flex Cable

Descript.:ion - A simple approach to rotational power transfer, is the

Lockheed designed and developed twist flex unit (Ref 34). This technique permits power transfer through insulated wire bundles from one

rotating disk to a second rotating disk. The disks are mounted on a

shaft (torque tube) that connects to a bulkhead.

-r

3-68
The wire bundle is made up of 40 pairs of 16-gauge wire, 72 pairs of

24-gauge wire, and eight twiny,,s:. The unit is 13-in. diameter, 25-in.

long, and weighs 10 kg.

Principal Operating Characteristics - Table 3.6.4-1 is a list of the

primary characteristics.

Table 3.6.4-1 Twist Flex Characteristics

Parameter Capability

Rotation Limit +205 Deg

Internal Pressure, mm Hg 780 p 10-8

Voltage Limit 400 V

Max Current, A 15 A

Corona Problem None

Life 0.4 x 106 Rev Demonstrated

Particle Generation None

Major Failure Mode Open

Conductor Size Simple to Revise

Angular Rotation X2

State of the Art - The design has been fully developed.

^ 1 tiL f:t^istory - None.

Types/Manufacturer - LMSC.

3.7 SENSORS AND SIGNAL, CONDITIONING

3.7.1 Ac Voltage and Current Sensors

Description - Ac voltage and current sensors are devices (usually magnetic) that provide a calibrated analog signal acceptable to conditioning or control electronics.

Principal Operating Characteristics A common method of sensing alternating current involves a current transformer. The conductor carrying

the current to be measured is taken to be the primary winding. The
OF POOR QUALITY

voltage developed on the secondary is proportional to the primary current. Figure 3.7.1-1 shows 8 a typical current--transformer approach YP

t (Ref 7). 

T2 CR3

I

IT C3 R2 -TM Output

0.25 a 1575T 10 If 511 0-- to 3.0-Vdc 

r 120 .11 1.,2.4-kHz

Currc.nt

Input

r 0 to 5-A nus 1205n 6.,

C R4

't Figure 3.7.1-1 Current Tranformer Approach

True RMS current can be detected using the circuit shown in Figure

3.7.1-2. in this case, current is sensed with a shunt, another common

sensing element. A 3-V p-p signal input to the true RMS converter produces a 3-Vdc output signal.

-15 V 

IN 1

5K 5K 5K 100K 3

14 +15 V 

RSHUNT

1

6 To 

2 (

9

A/D

1 5K 3 _

- 1 4 5

j3A

7 6

4

1

_

+! LM308AH 2 10

100pF 5K LM741AH 7 ANALOG 

E DEVICES

5K AD536 8

TRUE RMS

CONVERTER

A/D RThT

Figure 3.7.1-2 Shunt and True rms Converter 

I

3-70

I
Standard operational amplifiers scale the shunt signal to the appropriate values. Ac voltage monitoring is also sensed magnetically. A

transformer easily scales the voltage down to a small signal that can

be rectified and tiltered.

State of the Art - These devices have been fully developed (Level 8).

Flight Hi.story -

Types/Manufacturer - These devices are custom-made items.

3.7.2 Dc Voltage and Current Sensors

Description - These devices provide a calibrated analog signal to the

conditioning system. Voltage measurement usually involves a resistor

divider and an op amp. Dc-voltage measurement is somewhat simpler than

ac, whereas the opposite is true for dc-current measurement. A current

can easily be transduced with a shunt; however, this method is only

practical at the lower levels. Mag-amps are used for nonintrusive

sensing of high currents and are more complicated.

Principal Operating Characteristics - A do voltage sensor can be made

simple and reliable. Figure 3.7.2-1 is a schematic of a typical voltage transducer. The variable divider. is Rl and R2. Amplifier Al is

used as a difference amplifier; that is, it rejects common-mode voltages when Rl and R2 are at the source. A2 is_a unity-gain inverting

amplifier. For positive input voltages, the output is taken from the

output of A2. For negative input voltage, the output is taken from the

output of Al. The output impedance of this transducer is low because,

for both positive and negative source voltages, the output is an operational_amplifier with a gain of -1. Table 3.7.2-1 shows the principal

features of a do voltage transducer. 
ORIGINAL PAGE 19

Note: 1. Al and A2 LM741-CN

OF POOR QUALITY 2. All R 1%. 1/4 W RN 55

Figure 3.7.2-1 Dc Voltage Transducer, R Divider, and Operational AMPZifier

Table 3.7.2-1

Dc Voltage Transducer Design Details

Source Voltage, Source Voltage, E(Out)

Full Scale Nominal R1 R2 Full Scale

65 56 103 kohm 20 kohm 3 V

40 30 61 kohm 20 kohm 3 V

8 5 8.3 kohm 20 kohm 3 V

+20 15 28.3 kohm 20 kohm 3 V

-20* -15 28.3 kohm 20 kohm 3 V

*For -20 V, delete R7, R6, R8, and A2. Use El as output.

Figure 3.7.2-2 shows the type of mag amp used on the Viking orbiter '75

(Ref 7). Each toroid core (A & B) has an excitation/reset coil that is

connected to the drive circuitry as shown. CR1 and CR2 always steer

the current through coil 6,5 in the same direction, while alternately

resetting the cores on opposite half cycles. Dc load current passes

through the toroids via coil 7,8. The output voltage is determined by

the product of the turns ratio times the load current times the resistance of R3.

3-72
ORIGINAL PAGE 69

OF POOR QUALITY

CAI

700 A

TURNS 1 ° 600 TURNS

6

2 rIc 

50-v °10 V 07 CONTROL

CURRENT

24w:

,Ty RT

o

INPUT

SQUARE 10V 1.2K 6 WAVE nny

4 05

700

TURNS

30

e

CR2

619.12

R3 OUTPUT 301 Q VOLTAGE ±1% IOyF

Figure 3. 7.2-2

Viking Orbiter 1 75 Type of Magnetic AmpZifier Current Transducer

State of the Art - These devices have been fully developed.

Flight History - N/A.

Types/Manufacturer - These devices are custom-made items.

3.7.3 Temperature Sensors

Description - Materials that change resistance by some function c

perature are normally used as temperature transducers Typical c

are platinum wire segments, resistors, and copper.

3-73
OF POOR QUALITY

Principal Operating Characteristics - These devices are commonly used

in a balanced resistive-bridge configuration. Imbalance due to temperature change can be sensed differentially across the bridge. Figure

3.7.3-1 is a schematic of this type of circuit. It is scaled to produce zero output at 32°F and +3V at 150°F. The thermistor Rl, R2, and

R3 form a bridge. Amplifier Al, along with R4, R5, R6, and R7, convert

the common-mode voltages across the thermistor and R3 into a singlecnded voltage. A2 is an adjustable-gain amplifier used to set the

scaling in a precise manner. An amplifier with a guaranteed low offset

voltage is used for Al to preclude trimming of offset voltages and to

achieve minimum error due to Al offset voltage.

R8 R101I^

20k _ look

A2 To A/ D

R9 + LM741

lOk A/D Return

Figure 3.7.3-1 Thermistor-Bridge Temperature Sensor

State of the Art - These devices have been fully developed. 

Flight History - Used on all spacecraft.

Types/Manufacture r - All ranges are available for custom design.

3.7.4 Pressure Sensors

Description - Pressure measurements can be accomplished reliably by

using a metallic strain gauge (Ret 36). Pressure in a container will

induce stress on the solid, constraining material, which can be measured using a strain gauge. Metallic strain gauges are formed from thin

resistance wire or are etched from thin sheets of metal foil. Figure

3.7.4-1 shows a bondable wire-grid strain gauge.

r

3-74

R1 R2

lk lk R6

R4 75k r

I Al

R3 R5 75k LM308

T

0.5k 75k
s

ORIGINAL PAGE

OF POOR QUALITY

(f lI

UU '

(a) (b)

Figure 3.7.4-1

UniaxiaZ Strain Gauge,

(a) Wire, (b) FoiZ (Gould

Inc, Mesaurement Systems

Division)

Many types of material are used to fabricate these devices, such as

Constantan, Nichrom V, and Stabiloy. Typical sizes range from 1/8x1/8

in, to 1x1/2 in.

4

bM ,

. Principal Operating Characteristics - In the usual application, the

strain gauge is cemented to the structure whose strain is to be measured. The adhesive material must hold the gauge firmly to the struc- 

'ture, yet it must have sufficient elasticity to give under strain 

without losing its adhesive properties. The adhesive should also be 

- resistant to temperatures, humidity, and other environmental conditions. 

Connecting tour gauges in a bridge configuration is the most common

method of electrically sensing the changing resistance. Having two

gauges active and two gauges inactive provides a balanced, temperature-compensated bridge circuit. Signal amplification and scaling are

performed in the usual manner. 

sl State of the Art - These devices have been develo ed 

p

and used

ti

extensively. Present development is directed toward' 

tested

microminiature

semiconductor versions. 

Flight History - Intelsat 5 and 6 have used strain gauges for NiH2

battery pressure sensing.

j

3-75
Types/Manufacturer -

- Uniaxial, Wire or Foil

- Tao- and Three-Element Rosettes

- Signal Conditioning Custom Design
4.0 TASK 2 - DEFINITION OF FAULTS AND FACTORS AFFECTING EPS PERFORMANCE

OBJECTIVE AND SCOPE

The objective of this task is to (1) develop a comprehensive list of

electrical power system (EPS) faults, activities in other subsystems,

and other factors that could prevent the power subsystem from functioning properly, and (2) define their operational impact on the EPS.

SUMrLARY

Inputs to this task were the components of a generic EPC developed in

Task 1. A "fault" is defined to include all types of failures and degradation modes.

A summary of the major EPS failure and degradation modes is shown in

Table 4-1. The only EPS failures that could result in catastrophic

loss of the spacecraft are explosion of the NiH2 pressure-vessel and

failure of a series-resonant inverter capacitor. Both of these potential failures must be eliminated by design, worst-case analysis, and

test, and not by automation. Table 4-2 is a list of operational impacts resulting from failures.

A summary list of other subsystems and activities that could affect the

EPS is given in Table 4-3. A summary of unknowns that could affect the

EPS is given in Table 4-4. There are two methods for considering

failures•

1) Undetected and uncorrected; 

2) Timely detection and correction.

4-1
LPS Component Major Failure Modes Degradation Modes

Photovoltaic - Open - Filter, Antireflective

Array - Short Coating

- Arcing

- Power Loss Due to

Plasma Interaction &

Charged-Particle

Radiation

Slip Rings - Short - Particle Generation

from Brushes (1101ajor)

Roll Rings Open - Particle Generation

from Rings (Minor)

Twist Flex - Open

P3 (Dc/Dc - Shorted Series- - Efficiency

Converter) Pass Transistor - Ripple

- Output Overvoltage

Transformer- - Output Overvoltage - Efficiency

Coupled Converter - Ripple

(Dc/Dc Converter)

Series-Resonant - Shorted Semiconductor - Efficiency

Inverter(Dc/Ac Power Switch

Converter) - Shorted Commutating

Diode

- Output Overvoltage

- Input Cap Destruction

By Overvoltage

Photovoltaic - Loss of All - Partial Loss of

Array Voltage Output from an Control & Regulation

Controller Array

Magnetic - Fail to Operate — Increased Contact

Latching - Transfer when Resistance

Relays Not Commanded

Remote - Fail to Transfer - Increased Contact

Power - Spurious Transfer Resistance

Controllers ' — Oscillation - Loss of Status

- Fail to Limit Rise indication

& Fall Time of

Current

- Fail to Limit

Fault Current

I Table 4-1 Major EPS Component FaiZure and Degradation Modes
?'able 4-1 (concZ)

EPS Component Major Failure Modes Degradation Modes

Fuses - Opens at Current

Less Than Spec

- Does not Open at

Spec Current

Cabling - Open - Insulation Life

- Short Degraded Due to

Excessive Temperature

or Voltage

Sensors - No Output Accuracy Out of Spec

- Out of Calibration

Chemical Turbo - Reactant Leakage

Machinery - Turbine Mechanical

Failures

- Generator Electrical

Failures

Regenerative Fuel - H2 in 02 Manifold Separator Electrode

Cell, Electroly- - 0zz in H2 Manifold

sis and Fuel Cell - VII HI/LO

- Absolute Pressure HI/LC

- Excessive H2 and

02P

-Temps Hi/Lo

- Voltage Regulator

Out of Spec

Nickel- - Shorted Cell - Loss of Capacity

Cadmium - Open Cell Low Voltage

Battery - Overpressure Failure

Due to Cell Reversal

Nickel- - Pressure Vessel - Loss of Capacity

Hydrogen Leak Resulting in Low Voltage

Battery Open Cell/Cells

- Overpressure

Failure Due to

Overcharge

Lithium- - Open Cell - Low Final Voltage

Thionyl- - Shorted Cell (Which Loss of Capacity

Chloride Can Cause Other FailPrimary ures, Including

Battery Overpressure)
Table 4-2 List of DperationaZ Impacts

- Catastrophic Loss of the Spacecraft.

- Complete Loss of Mission Functions

- Partial Loss or Degradation of Mission Functions

- Loss or Degradation of a Subsystem Function

- Loss of Fault Management or Maintenance Capability

- No Significant Impact

Note:

Above definitions are from JPL Report SD-TR-82-58, Autonomous Spacecraft Design and Validation Handbook. April 30, 1983.

3

S 
Table 4-3 Other Subsystems and Activities That Can Affect the EPS

-

Subsystem Failure/Activity Effect

Operational

Impact*

Structures Modular Buildup Reduced Power 3,4

Thermal Control Impaired Capacity to Reduced Power 3,4

Jettison Waste Heat

User Loads (All Shorts or Overloads Bus Undervoltage 3,4

Subsystems and

Payloads)

Large Differences in Day May Reduce Bus 3,4

and Night Power at Buses Power Capability;

Excessive Battery

DOD

Attitude Control Gravity Gradient Reduced Power 3,4

Attitude Mode

EPS/Crew Interface Crew Commands, Displays, Reduced Power 3,4

New Crew, Interface Capability; UnAmbiguity, Mistakes intended Shutdown

EPS Ground Opera- Power- Management Config- Reduced Power 3,4

tions Interface uration History; Audit Capability

Trail or Automated

Activities; Training;

Commands/Displays

Attitude Control Failure to Maintain Reduced Power 3,4

Required Stable Attitude Capability

Because of Unknowns in

Controlling Large,

Flexible Structures

Command Degraded TM Data Reduced Infor- 3,4

Transmission mation

Loss of CPU Power Reduced Automa- 3,4

tion Capability

Data Software Maintenance Reduced Power 3,4

Capability
Table 4-4

List of Other Factors That Could Affect EPS Design and Performance

^t

Factors Primary Effects On:

- Urbital Environment Solar Array

and Parameters:

- Charged-Particle Degradation

- Thermal Cycling

- UV bosses

- Solar Flare

- Solar Intensity Variation

- Plasma Interactions

Station Orientation Solar Array

- Station Growth Array, Batteries, Power

Distribution

- Life Solar Array, Batteries

- Onorbit Maintenance, Rendezvous

and Docking Checkout and Diagnostic Abilities

- Assembly and Buildup Solar Array, Batteries

- Mission Operations All Subsystem Elements
The most serious failure is one that is undetected and uncorrected.

This could arise from a lack of redundancy, or a double or triple failure. The operational impact of an undetected and uncorrected failure

can range from complete loss of mission functions to loss of EPS functions. One object of automation is to provide the resources, monitoring, and control to ensure that all admissible failures are detected

and corrected in a timely manner. When there is timely failure detection and correction, the operational impact can be lowered to that of

loss of fault-management capability. The possible impacts of the two

kinds of failures are summarized as follows:

1) Undetected and uncorrected failure impacts,

a) Damage to user loads,

b) Loss of mission capability,

c) Safety hazards,

d) Wiring damage,

e) Schedule, mission operations, and planning,

f) Possible drive of S'S into shut')wn, survival mode,

g) Time required to bring SS back up to operational mode, 

" h) Time required for damage assessment,

Lq

p- 

i) Time for maintenance, resupply, STS future flights,

2) Timely fault detection and correction impacts,

s 

r

a) No damage to user loads,

4-7

LI.. ^.
b) Minimum user-load downtime, loads shifted to backup,

c) Immediate decrease in backup capability,

d) Requirement for maintenance resupply,

e) Possible impact on operations that require more backup capability than exists,

f) Minimized impact on mission by timely fault detection and

correction,

The key conclusion drawn from Task 2 is that automation is essential in

correcting the problems identified and that automation is an enabling

technology.

^a

4.1 PHOTOVOLTAIC ARRAY FAILURE MODES AND OPERATIONAL IMPACT

c

Failure Modes - A photovoltaic array usually consists of a number of

series and parallel strings of solar cells. Each string requires an

isolation diode. For articulating solar arrays, power transfer from

the array to the power-conditioning equipment may require a slip ring,

a roll ring, or a "flex ring,"

A catastrophic, single-point failure is the slip ring. A short or open

in the slip ring causes a loss of all power from the array served by

that slip ring. An open failure of an interconnect wire (or open isolation diode) in a s,erie3 string causes a loss of that string. This

failure results in loss of a fraction of the array power. There are

other long,.-term degradations that result in loss of solar array power,

such as slow degradation of the cover glass or lens by micrometeorites_,

outgassing, or 2rocess failure.

Environmental impacts on the solar array are possible arcing and loss 

:_

of array power owing to parasitic currents set up in the plasma. If

i

4-d

3
Failure Mode Cause Effect

Operational

Impact

Solar Array Section

- Open Broken Interconnect, No Power 2-4

Shadowing

- Short Insulation Breakdown, Arcing No Power 2-4

Cover Slide, Loss of Micrometeorites, Outgassing Reduced 4-6

Transmissivity from S/C, Process Failure Power

Loss of Cover Glass UV Degradation; Cover-Glass Reduced 4-6

Transmissivity Erosion; Plume Deposits Power

Isolation Diodes Open Process Failure, Lack of No Power 2-4

Redundancy

Failure to Track Sun, - CMD Fail Reduced 4-6

Catastrophic - Servo Fail Power

- Motor Fail

Degraded Ability to - Pointing Impairment, Reduced _ 4-6

Track Sun Structure Power

- Servo Oscillation

Slip Ring Open/Short - Lack of Redundancy No Power 2-4

- Inadequate Test

there are gimbals and slip rings on the solar array, this implies a

tracking servo with commands, electronics, and a stepper motor. There

are catastrophic failures, degraded accuracy failure, and failures that

result in oscillation of the servo motor, with premature wear-out associated with the elements of the sun-tracking servo system. Attitude

control and operational mode can affect the solar array by shadowing

the array. Shadowing reduces the output of the array and can lead to

solar-cell failures from excessive heating or reverse-voltage breakdown.

Operational Impact A summary of the solar array and associated components and the operational impact of the failure modes is given in

Table 4.1-1. The operational impacts used are listed in Table 4-2.

Table 4.1-1 Solar Arran Failure Modes and Impacts
4-10

f There are no solar-array failures that will cause a catastrophic loss

of the spacecraft. This assumes there is sufficient redundancy that

loss of a solar-array section or ring can be tolerated. Depending on

the amount of redundancy present, the impact of losing a solar-array

section can range from complete loss of mission functions to loss or

degradation of EPS functions. Degradation of the cover slide or an'.:ireflective coatings can range from degradation of EPS capability to no

significant impact:

4.2 ENERGY STOWAGE FAILURE MODES AND OPERATIONAL IMPACT

4.2.1 NiCd Cell and Battery

Failure Diodes - A summary of failure modes for NiCd cells is given in

Table 4.2.1-1. To be useful, the cells must be assembled in series and

parallel interconnections. Approximately 200 series-connected cells

would be required for a 300-Vdc system, and about 22 cells in series

would be required for a 28-Vdc system.

A 'battery requires operational control and auxiliary systems control.

Operational control consists of the following three categories:

1) Charge Control

2) discharge Control

3) Offline Operations

F Typical charge-control limits cell or battery voltage as a function of

temperature. Amp-hour integration is usually required for depth-of-

,,

discharge determination. Discharge control involves limiting the maximum DOD. For a battery with several hundred cells, individual-cell or

multiple-cell module monitoring may be required to guard against cell

reversal during discharge. Cell reversal can result in gas generation, 

case rupture, and loss of battery.
Table 4.2.1-1 Basic Failure Modes of NickeZ-Cadmium Battery CeUs

Failure Causes Effect

Low discharge Loss of capacity; reduction in Possible Bus undervoltage

Voltage active material within cell. during discharge.

Loss of Redistribution of electrolyte Possible unexpected busCapacity or active material within cell. voltage drop during

overcharge or cell reversal. discharge.

Open Cell Seal failure; break in possible unexpected bus

electrode-terminal voltage drop and electrolyte

connection. or power loss during discharge--whole string of

cells deactivated.

Shorted Cell Electrode bridging by Possible bus undervoltage

conductive active discharge. active material; power loss

Contact between electrodes during charge and discharge.

caused by separator Can cause excessive overdeterioration. charge of the remaining

cells, leading to premature

failure.

Cell Over- Gas generation by overcharge or Possible cell explosion or

pressure cell reversal. rupture.

(Limited to

Sealed Cells)

Offline operations include capacity measurement, reconditioning, and

equalization charging (in the case of several batteries connected to

one bus). thus, it is seen that a N Cd battery has traditionally required extensive operational controls owing largely to uncertainties in

its performance with time. A summary of battery-operational control

failures, their effects, and criticality, is given in Table 4.2.1-2.

When batteries are charged or discharged, they generate heat. If this

heat can not be removed, the battery will overheat. NiCd batteries are 

generally constrained to operate within narrow temperature limits, 

e.g., 5°C to 15°C, to assure mission life. The upper temperature limit

is sometimes controlled by minimizing battery discharge or minimizing

or terminating the overcharge.

r^ E^

4-11

i^

i^

V
Table 4.2.1-2 NiCd Battery OperationaZ C'ontroZ FaiZures

Failure Effect Criticality

Charge Control

- Overcharge Reduction of "Life 4

- Undercharge Undercapacity 5

- DOD Determination Loss of Ability to Accurately 5

Failure Charge

and Discharge

Discharge Control

- Cell Reversal Cell Overpressure Failure 4

- Excessive DOD No Significant Impact if not 6

Repetitive

Repeated, premature battery 5

failure

Offline Operation

- Capacity Measurement Erroneous Information about 5

Error Battery State of Health,

Possible Future Over/Under

Use

- Reconditioning Failure Cells Not Rejuvenated or 5

Equalized

Operational Impact - A summary of generic battery failures for the

three basic operating modes is given in Table 4.2.1-3. Under the assumption that the batteries would not have any function during launch 

or initial orbital assembly, there is no impact from failure here. It 

is possible that loss of battery capacity could causea partial loss or 

degradation of mission functions, depending on the amount of capacity 

safety factor initially used.
t

Table 4.2.1-3 Other Battery Failures

Failure Causes Effect

Complete Battery Loss Cell Failure. Cell Reversal Loss of EPS capability.

Due to Discharge Failure

Battery Capacity Excessive DOD Due to Control Degradation of EPS

Degradation Failure. Insufficient Charge capability (bus power).

Due to Control Failure

Thermal Control Inability to Reduce Loads Degradation of EPS

Failure, High capability.

Temperature

Heater Blanket Broken Electrical Leads Degradation of EPS

capability.

The impact of a single-cell failure will depend on whether there is onboard cell-level* sensing, switching, and replacement available. If

R onboard cell-replacement is not available, then the impact will be loss

of EPS battery capability. There Would be a further schedule, mainten-

^Q ance, and STS flight impact to remove and replace the bad cell. If onboard-cell replacement were available, the bad cell would be automatically replaced and the EPS would have full capability. The impact of

the failure would be loss of fault-management capability in the EPS.

The number of spare cells would have been reduced by one. When all of

the spare cells are switched online, then the next cell failure would

result in a battery loss. This is an example of how active redundancy

management can reduce the severity of a fault impact.

4.2.2 NiH 2 Cell and Battery

Failure Modes - A summary of the failure modes of a NiH 2 cell is given in Table 4.2.2-1. NiH2 has all the generic failure modes of any

battery cell such as open, short, and loss of capacity. NiH 2 batteries

*For a battery string containing 20U cells in series, "cell-level" can be

"module-level, with the module consisting of 10 to 20 cells that can

serve as the lowest replaceable unit. 

4-13
r&

require operational control similar to NiCd batteries and are susceptible to control failures. A unique feature of NiH2 batteries is

that their available capacity is proportional to the internal pressure,

and, therefore, pressure can be used as a control parameter. They require pressure vessels and thus are susceptible to a mechanical failure

that permits H 2 to escape from a given cell. A control failure that

can cause loss of a hiH2 battery is overcharging.. Overcharging

causes a pressure buildup that can cause a pressure -vessel failure and

loss of a battery. Pressure -vessel rupture presents a potential hazard. Worst-case analysis and qualification of the pressure vessel are

mandatory to guarantee that there would not be a safety hazard from an

exploding pressure vessel.

Operational Impact - All failure impact identified for the NiCd battery

applies to the NiH 2 battery also.

Table 4.2.2-1 FaiZure Modes of NiekeZ-Hydrogen Battery'CeZZs

Failure Causes Effect

Open Cell Seal failure; escape of Possible unexpected bushydrogen gas; break of voltage drop and loss of

electrode terminal power during discharge;

connection. loss of battery.

Shorted cell Electrolyte and active Possible bus undervoltage

(Primarily a Common material redistribution. and loss of power during

Pressure Vessel Cell charge and discharge.

Failure).

Pressure Vessel Excessive gas genera- Same as open cell. CellFailure tion due to overcharge, case rupture hazard.

charge-control failure.

^ 4

t?

4.2.3 Regenerative H2 02 Fuel Cell

Failure nodes - A regenerative H2 02 fuel cell consists of an electrolysis module that separates H2 and 02 from H2O; a fuel cell to

generate electrical power from H2 and 0 2 and run auxiliary equipment; a source of power for the electrolysis module ( assumed to be a

4-14 
solar array); storage for H 2O, 02 , and H 2 ; a heat exchanger; a

radiator; pumps; and a voltage regulator for the electrolysis module.

Failures can be grouped in three areas:

1) Electrolysis unit;

2) Fuel-cell unit;

3) Auxiliary equipment.

A potential hazard exists when free oxygen and hydrogen are present in

a system. However, there is general agreement among the fuel-cell manufacturers that a catastrophic failure is highly improbable. By design, they keep the volumes of free hydrogen and oxygen as small as

possible. The electrolysis and fuel-cell units are quite similar,

their main difference being the catalysts used to optimize operation as

an electrolyzer or fuel cell. The major tailure mode in the electrolyzer or fuel cell is a membrane failure that allows 0 2 into the lit

manifold or h2 into the 0 2 manifold. Considering present designs,

the highest unreliability is in auxiliary equipment. Pumps are known

to wear out from mechanical failure. The voltage regulator for the

electrolysis unit is subject to all the standard failure modes of

power-processing electronics.

A summary of the failures that can cause shutdown of the electrolysis

and fuel-cell subsystems is given in Table 4.2.3-1. These failures are

detected by the following types of sensors:

1) Absolute pressure;

differential pressure level;

'emperature;

'oltage and current.

P
Table 4.2.3-1 Regenerative H20 2-FueZ-CeZZ FaiZure Modes

Electrolysis Subsystem Fuel-Cell Subsystem

H2 in 02 Manifold H2 in 02 Manifold

0

2 in H2 Manifold 02 in H2 Manifold

Module Current. High Module Current High

Module Voltage High nodule Voltage Low

Cell Voltage Low/High Cell Voltage Low

H2 Separator Level Low/High Product H2O Level Low/High

02 Separator Level Low/High Module Coolant Pressure Low

02 Separator Level High H2 Outlet Pressure Low/High

H2 O Circulation Low 02 Outlet Pressure Low

Circulating Pump Pressure Low 02 Inlet Pressure High

H2U Resistivity Low (02 Out - H2 Out) Pressure Low

H2 Pressure Low/High (02 In - 0 2 Out) Pressure Low

U2 Pressure Low/High Piston Pressure Low

0

2 /H2 0 Outlet Temp High Pad Pressure Low

H2 Condenser Temp High 112 Temp Low/High

02 Condenser Temp High 02 Temp Low/High

H2O Temp Low

H2 O Pump Pressure Low

Module Coolant Temp High

Operational Impacts - A summary of the regenerative fuel-cell failure

modes and operational impacts is given in Table 4.2.3 -2. The operational impact of the failure is highly dependent on the amount of redundancy available to correct the failure. If there were n units

available and only n-1 were required to satisfy all requirements, then

the impact of the first unit failing would be only a loss of fault-man- 

agement capability. On the other hand, the operational impact of the

second unit failing would be a loss of EPS'capability.

Failure of an electrolysis unit would wean (1) loss of capability to

store solar-array energy, and (2) loss of functional redundancy to pro- 

duce breathable oxygen from water and electrical power. If the electrolysis unit were used to convert wastewater in a closed system, then

there could be a buildup of wastewater. Loss of a fuel cell would re-

-sult in loss of electrical-power capability and loss of ability to pro

duce potable waterfrom hydrogen and oxygen.

4-16 

r

_
Table 4.2.3-2

Regenerative Fuel -CeZZ Failure Modes and Operational . Zmpaets

Failure Mode Cause Effect

Operational

Impact

Electrolysis Unit Membrane Can not convert water 4, 5

Failure Failure into hydrogen & oxygen.

Fuel-Cell Unit Membrane No electrical output. 4, 5

Failure Failure Can not convert hydrogen

and oxygen into

electrical power.

Auxiliary-Equip- Mechanical Degradation or loss 4, 5

ment Pump Failure Failure of water circulation

in electrolysis unit,

loss of ability to store

solar-array energy.

Solar Array Lack of Degradation or loss 4, 5

Voltage- Redundancy of electrical input

Regulator Failure to electrolyzes. Loss

of ability to store

solar array energy.

Thermal Control Lack of Loss of capacity in 4, 5

Not Able to Main- Redundancy electrolysis & fuel-cell

tain Temperatures units. Can not store

energy, can not make

electrical power from

H2 and 02'

Loss of solar-array capability directly affects energy-storage capability. The regenerative fuel subsystem generates waste heat in both the

rj

electrolysis and fuel-cell units. If the thermal-control subsystem can

not dissipate this waste heat, then both the energy storage and electrical power output of the regenerative fuel cell are directly affected, causing a reduction in available bus power.

4-17
4.3 POWER C014DITIONING FAILURE MODES AND OPERATIONAL IMPACT

4.3.1 Programmable Power Processor (P 3 ), Buck De-De Converter

Failure Modes -

1) Shorted pass transistor, P3 in voltage-regulator mode, driven by

voltage source.. A shorted series-pass transistor is an admissible

failure mode for a P 3 . The effect is that the source is connected

to the output. The P 3 design includes a system-level overvoltage

sensor and shunt switch to keep the voltage below unsafe levels and

cause the input fuse to open. If the load bus voltage drives up to

the overvoltage limit, the external shunt switch turns on, and the

input fuse on the P 3 opens. This prevents possible damage to the

user loads.

If there is a double failure, the shorted series-pass transistor

and the overvoltage sense fails, and then the source would be connected to the loads. The input fuse might or might not open. This

double failure may damage the user loads. 

2) Shorted pass transistor, P3 in battery charger mode, driven from a

solar array. In the battery-charger mode, the P 3 would be driven

by a solar array. The effect of the failure would be to connect

the battery across the solar array. The battery would change the

operating point of the solar array and the array voltage would decrease to that of the battery. The P3 can not correct this con.

dition because all it can control is its pass transistor. This

will generally not be a safety problem. Detection and correction

times of minutes probably will be acceptable. The P3 detects a

shorted pass transistor.- This status signal can be used to open a

contactor to remove the P3 from the solar array.

3) Input over voltage or current, output over voltage or current, and

internal over temperature. The effects of any of these failure

modes are:

4-18
a) 1,3 is sent to shutdown state by its internal microprocessor,

b) An external reset is required before P 3 will turn back on,

c) Output overload current is caused by user loads.

The P3 will support an overload for a programmed length of time,

then it will automatically turn off and wait for a programmed

length of time. It will then automatically turn on. If the overload is gone, it will continue normal operation. If the overload

is still present, it will continue cycling on/off/on until it receives an external command. The net effect is that the P3 turns

itself off.

Operational Impacts - A summary of P3 failure modes, causes, effects,

and operational impacts is given in Table 4.3.1-1. The most serious of

these is loss of mission functions owing to an undetected and-uncorrected shorted pass transistor that results in connecting the high

voltage input to the low-voltage output loads. This results in destruction of the user loads. Normally, this fault will be detected and

corrected by a system-level shunt regulator. In this case, the user

loads are not destroyed, and the operational impact is reduced to loss

of fault-management capability.

The operational impact of low output-power can range from degradation 

of mission function to loss of fault-management capability, depending

on the amount of redundancy available. If there were no redundancy,

and the P3 with low output-power could not be replaced, then the impact would range from degradation of mission function to loss of EPS

function. If there were a redundant component that would allow re

placement of the failed P3, then the operational impact of the failure would be reduced to loss offault-management capability.

The other faults shown will generally result in an operational impact 

of a degraded EPS function if there is no standby redundancy in which

to switch. If there is standby redundancy, then the impact would be

lowered to loss of fault-management capability.

4-19

s
Table 4.3.1-1 P3 Failure Modes and Impacts

Failure Mode Cause Effect

Operational

Impact

VOut Hi Shorted Pass Transistor, Damage Loads 2

Failed OV Sensor

Shorted Pass Transistor 5

(Corrected)

Low Output Control Circuit Failure Partial Loss 3,4

Power of Power

Efficiency Filter Capacitor Assembly 4

Leakage, Pass Transis- Overheats

for Switching Loss Increase, Saturation

Voltage Increase

Vinfli System Anomaly Assembly may 4

Pail

IInHi Hi-Leak Input Filter Assembly 4

Capacitor Overheats

High Temp Thermal Subsystem Assembly 4

Failure Overheats

loutOverload Component Degradation, Output 4

Load Faulty or Overload Overheats

4.3.2 Transformer-Coupled Converter (TCC), Buck-Derived Dc/Dc Converter

This type of power converter can be used for main or local (housekeeping supply) power-conversion functions. This configuration has a

transformer to isolate input from output. The configuration can be

that of a buck-derived converter or a Cuk Converter.

Failure Modes

1) Shorted series-pass transistor. This is a major failure mode.

because there is a transformer between the input and output, the

input is not connected to the output. The load voltage does not go 

up; instead, it decays to zero. At the input, there will be a

short across the source and an input fuse must open to clear the

fault. 

4-20

i 

i

L
2) Control electronic. A second major failure mode is associated with

the control electronics. One type will cause 100% duty-cycle operation and try to drive the output into overvoltage. Whenever the

overvoltage detector works, the TCC will be turned off. If there

is a double failure, the control circuit fails to 100% duty cycle

and the overvoltage fails to operate, and then loads can be destroyed. The cause of this failure is inadequate redundancy. Possible fixes are redundant control circuits, redundant local overvoltage detectors, or a system-level, overvoltage detector combined

with a shunt switch.

The TCCs, as they are known to exist today, do not have the extensive self-protection and local automation features that the P3

has, but they could be added.

Operational Impacts - A summary of the TCC failure modes and operational impact is given in Table 4.3.2-1. An undetected and uncorrected

output overvoltage can result in loss of mission functions. Also, a

failure where no power is provided to the user loads can result in an

operational impactor loss of mission functions. If there are standby

redundancy and timely detection and correction, then the operational

impact of the above two failures can be reduced to loss of fault-management capability. The operational impact of converter-efficiency

degradation can range from degradation of EPS capability to no significant impact. The actual impact will be strongly affected by the degree

of converter overheating and how closely the converter shutdown limits

are approaches.

Table 4.3.2-1 Transfo rmer- Coup Ze d- Converter Failure Modes and Impacts

Failure Mode Cause Effect

Operational

Impact

Out High Control. Fail, Overvoltage Damage Loads 2

Protection Failure

No Output Shorted Pass Transistor No Power to 2

or Open Component Loads

Degraded Filter-Capacitor Leakage Assembly 4,5,6

Efficiency Increase, SW Transistor Overheads

Loss Increase

4-21
There are failure modes where the efficiency or ripple voltage is degraded. For these failure modes, the TCC will function, but will not

result in optimum operation. The heat-rejection requirement will be

increased owing to .lower efficiency. This degraded component can be

relegated to backup status. The longer-term impacts would be schedule,

f rifuintenance, STS flights, and failure analysis to determine the reason

for the degradation.

4.3.3 Series-Resonant Inverter (SRI), Dc to Ac 

Failure Modes -

1) Shorted power semiconductor. This is a major failure mode that

results in a short across the input and a control-circuit failure

that results in an output overvoltage. There are control failures

that result in loss of output. A load fault does not harm the SRI,

because inherently it is a current source and can supply shorts

without damage.

2) Control circuit malfunction resulting in simultaneous conduction of

power switch. The SRI uses power semiconductors as switches in the 

full-wave rectifier bridge. An inherent failure occurs if the control circuitry allows both power semiconductors to conduct at the

same time. When both power switches conduct, they are across the 

power source and can be destroyed. Electronic protection circuits 

for this failure mode are required of all SRI circuits. When a

power switch is shorted due to either a control or switch failure,

there is a .fault across the source. The fault must be cleared by a

fuse. Should the fuse fail to clear the fault when there is a

battery connected to the bus, there is a potential fire hazard due

to wire overheating. If the source is only a solar array and no

battery, then the fault currents would be limited and there would

not be a safety hazard to wires. An external evaluation would be

:_

required to sense the failure, remove the SRI, and switch a backup 

i online

4-22

Y -

3
4-23

3) Commutating diode fail shorted. There are commutating diodes

across each power switch. If one of them were to fail shorted, the

next time the other power switch is turned on, there would be a

short across the source. The impact would be the same as item 2

above.

4) Control circuit failure causing output to be overvoltage or no output. A second major safety failure mode is a control-circuit failure that allows the output to go overvoltage. There are two areas

affected by this failure: first, user loads can be damaged; second, the SRI input capacitors can be driven overvoltage and destroyed. Further work is required to define how the input capacitors fail when they are driven overvoltage. The safing for

shorted-input capacitors is for an input fuse to open.

There are control circuit and wiring failures that will .result in

no output from the SRI. For these failures, external analysis is

required to sense the failure and switch a backup unit online,

Operational Impact - A summary of the SRI failure modes and their operational impact on the mission phases is given in Table 4.3.3-1. A

shorted power semiconductor is a safety hazard if it is not detected

and corrected. The safety hazard occurs when the fault across the

source is not cleared and wiring may be destroyed. An output overvoltage failure is also one that can propagate from the converter to the

wiring and user loads if it is not detected and corrected. The output

overvoltage could cause destruction of the user loads. To assess the

impact of these failures, an assumption about redundancy must be made.

If sufficient redundancy is provided to eliminate single-point failures, the impact would be partial loss or degradation of mission functions. In addition, there would be these impacts:, time to assess the 

damage, delay assembly, immediate decrease in spacecraft capability,

schedule/maintenance, and future STS flights.
r

Table 4.3.3-1 Series-Resonant-Inverter FaiZure Modes and Impacts

Failure Mode Cause Effect

Operational

Impact

Power SCR Short SCR Fail, Control No Output 2

Failure, Fuse Fail

Power SCR Open Control or SCR Fail No Output 2

Commutating Diode Fail, Fuse No Output 2

Diode Shorted 'Pail

Load Short Load Fail No Output Power, 3

SRI Not Harmed

by Short

VOut High Control Fail, OV Damage Loads 3

Protection Fail

No Output Wire Open No Power Output 2,3

Voltage

Degraded Filter-Cap. ESR Assembly 4,5,6

Efficiency Increase Overheats

Resonant Caps. Lack of Redundancy, No Output 2,3

Fail on Lack of Margin

Overvoltage

If there were to be timely detection and correction for a source short

s

kor output overvoltage, then the impact would be lowered to loss of

fault-management capability. The fault would be detected and corrected, and a redundant unit would be brought online. In this case,

mission functions would not be affected. The EPS would function normally. There would be an impact on the reserve capacity of the EPS

rt

owing to the fact that a redundant unit was brought online. There

would be a future impact on schedule/maintenance and STS flight to replace the failed component. Additionally, the loss of reserve capacity

in the EPS could affect future space station operations if there were

rules that required a certain level of reserve capacity. A SRI has a

unique failure mode where a control-electronics failure can cause the

input capacitors to fail on overvoltage. This failure is noted to ensure that (1) a thorough analysis of the overvoltage failure mode of

4-24

. - x424.Xfa:%YC..tt'S..t_Y'a+-: .^..-+. .3^_.^..e ..;.rY x+S'M%3,« ^'^°""'^`.^::.Ya3¢'+v+'..^ .f .
the capacitors used is examined, and the package is sufficient to contain debris from a failure, and (2) there is not a catastrophic loss of

the spacecraft.

An SRI will have multiple piece-part failures that will cause it to

have no output. Assuming some redundancy, the impact of this failure

should be limited to loss of fault-management capability. A decrease

in efficiency of the SRI would result in less-than-optimum operation.

This could result in higher demands on the thermal subsystem. Depending on the degree of efficiency degradation, the SRI would be acceptable for use. A good configuration-management philosophy would require

the degraded SRS be placed on standby and the backup unit used.

4.3.4 Solar-Array Voltage Controller

Failure Modes - There are several design configurations and concepts

for controlling the upper limit of the solar-array bus voltage. The

main ones are Lhe following:

Multiple-Array Segment Switching

- Series-Switch/Series-Array Segments

- Shunt-Switch/Series-Array Segments

- Series-Switch/Parallel-Array Segments

- Shunt-Switch/Parallel-Array Segments 

- Full Analog Shunt Regulator

Partial Shunt Regulator

- Hybrid Shunt Regulator

Table 4.3.4-1 lists the major failure modes, effects, and operational impacts

that are summarized below.
Table 4.3.4-1 Array- VoZtage-ControZ Failure Modes and Impacts

Configuration Failure Mode Effect

Operational

Impact

Series-Switching, Switch Fail Closed + 4

Series Array Switch Fail Open * 6

Series-Switching, Switch Fail Open * 4

Parallel Array Switch Fail Closed +* 6

Shunt-Switching, Switch Fail Closed * 4

Series Array

Switch Fail Open + 6

Shunt-Switching, Switch Fail Closed * 4

Parallel Array Switch Fail Open + 6

Full Shunt Shunt Fail Shorted No Power 2,3,4

Radiator Failure + 3,4

Hybrid Partial/ Failure of One of n

Full Shunt Digitally Controlled

Switches 4

- Closed * 6

- Open +

Failure of One of n + 4

Linear Shunt

Regulators

Series-Switching, Switch Remains in One + 4

Series Array with Position

Full Shunt

Single Component Lose Control 3,4

Failures That Will

Cause Oscillations

Partial Shunt Shunt Fail Shorted Reduced Power, 4

Lose Control

Piec&-, mart Failure + 4

Causing Oscillation

* Partial Loss of Power

+ Partial Loss of Control
4-27

^. 

a. Multiple Array Segment Switching Failures. For the array-switching

configurations, the major failure mode is a switch stuck in one position or stuck in the middle with no contact at all. The switch failure

can be caused by an open or short in the switching element itself, or a

control or interface failure. The cause of all these failures is insufficient redundancy in the switches and control circuits. The effect

of the failure would be loss of a string, or loss of control of a

string. The impact of the failure or array output power would depend

on the number of strings present.

b. Full Analog Shunt Failures. A full shunt can fail by shorting or

opening. If the full shunt shorts, there is no array output voltage.

If the full shunt fails open (shunt switches fail open, or control

failure) the array output voltage is present, but it can not be limited

by the full shunt. A full shunt is required to dissipate the total array power; therefore, it is strongly affected by the thermal-control

subsystem. If the thermal-control subsystem is not able to accept all

the waste heat from the full-shunt regulator, then the EPS output capability would be reduced.

c. Partial-Shunt Regulator. A partial-shunt regulator will be subject

to all the failures of a full shunt except that the thermal-dissipation

control problem will not be as severe. The partial shunt is not required to dissipate the full-array power. Therefore, the demands on

the thermal control subsystem are not as severe as with the full shunt.

d. Hybrid-Shunt Regulator. The hybrid-shunt regulator will contain

both discrete and continuous shunt switches. 'There can be both full

and partial shunt switches.- The array will be partitioned into,different groups of series and parallel solar cells for control. The strings

can either have equal or unequal power. One method is to use binary

weighting of the power.

A generic hybrid system could have binary-weighted parallel strings

with discrete, partial-shunt switches on all but the smallest string.

The smallest string could have a continuous shunt.
The generic hybrid system is not required to dissipate the entire array

power. Because this system contains a number of binary-weighted, discrete, partial-shunt switches, the loss of any one switch will result

in either a loss of control for an open switch, or loss of power from a

parallel branch for a shorted switch. The continuous shunt switch is

used for a fine control. Because it generally will have the smallest

power-handling capability, loss of the continuous switch will result

only in loss of fine-control capability, and not in loss of the array.

02erational Impacts - Failures in the photovoltaic-array switching will

not affect launch because these components are not operational during

launch. These components generally will not have an initial onorbit

assembly function. The impact of a failure during-onorbit assembly

could cause an assembly delay, schedule and maintenance impact, and an

impact on future STS flights. If no single-point failures are assumed,

one failure in an array voltage control unit would result in the loss

of only a fraction of the total array. Therefore, space station operations could be affected by less-than-expected solar-array power. The

impact of the failure during an orbit assembly could be described as

partial loss or degradation of mission functions until the faulty unit

is replaced.

Failures in the switched controllers will result in loss of a fraction

of the array power or some loss of control. The impact will be'a loss

of EPS capability. This should not result in a loss of mission function. A decision will be required as to when to replace and repair.

A real full-shunt regulator would be modular and redundant. A singlepoint failure causing loss of all array power or ability to limit the

array voltage would not be allowed to happen by designing in redundancy. If a second failure causes a full-shunt switch to fail shorted, 

then the array voltage could be held at some low value until the fault

were corrected. In a modular redundant system, an open failure would

result in some loss of capability to limit the array voltage under 

light-load conditions. These failures would probably not affect operations during sunlight or eclipse. A loss of voltage-limit capability 4

4-28

a
can occur during an eclipse-to-sun transition under light-load conditions. The array would be cold coming from eclipse, and its voltage

would go to maximum at the eclipse-to-sun transition. Inability to

limit the maximum voltage of a cold array could possibly cause damage

to loads or require the array to be unloaded until it warmed in the sun

and its open-circuit voltage decreased. It is expected that passive

radiators would be used to get rid of heat from the full shunt. Attitude constraints or abnormal vehicle-orientation modes could restrict

the ability to dissipate waste heat and could affect the EPS. The net

impact of these failures would be classified as loss of EPS capability.

A flight-type hybrid photovoltaic-array voltage controller is also expected to be modular and redundant. A hybrid controller would have a

graceful failure mode, where each failure would result in a specified

loss of control capability or power from the array. If the array parallel strings were binary weighted, loss of the largest branch could be

one half of the array. If n equal branches were used, then loss of one

would result in only loss or l/n of the total array. The impact of

hybrid controller failures on orbital operations is classified as loss

of EPS capability.

4.3.5 housekeeping Power Supplies

Failure Modes - Housekeeping supplies are usually contained within an

EPS component such as an array-control unit or within a power converter. The purpose of these supplies is to provide multiple regulated

voltages to a specific black box. They can be either linear, dissipative devices for onboard regulation, or switched-mode topologies.

These supplies are subject to all the failure modes of switched-mode

converters and linear-dissipative regulators. These supplies are subject to over/undervoltage, oscillations, out-of-specification ripple,

and frequency failures in clock-drive circuitry. The basic causes of

these failures are usually attributed to insufficient redundancy, lack

of worst-case design, and insufficient test.

11

4-29
c.

s

=a'

Operational Impact - The effect of failure of a housekeeping supply

will be the loss or degradation of an EPS black box that it is powering. The ultimate impact of the housekeeping-supply failure will thus

be determined by the impact of losing the EPS black box. The impact of

the failure of a specific housekeeping supply will be limited to loss

of EPS capability, or loss of fault-management capability.

4.4 PUWER-DISTRIBUTION DEVICE FAILURE MODES AND OPERATIONAL IMPACT

4.4.1 Magnetic Latching Relays

Failure Modes - A summary of the generic failure modes of a magnetic

latching relay is shown in '.Cable 4.4.1-1. The failures on a relay must

be considered along with failures of the relay drivers and loads.

Table 4.4.1-1 Magnetic Latching Relay Failure Modes

Failure Mode Cause

Fail to Transfer - Relay Coil Open

- Interface Failure

- Control Electronics Failure

Relay Oscillates - Control Failure That Powers Set and Reset

Coil at the Same Time

Relay Driver Fails - Voltage Suppression Diode across Coil Opens,

Driver Fails on Inductive'Overvoltage the

Next Time It Interrupts Coil Current

Contacts Burnt Open - Excessive Fault Current, Voltage Suppression

or Welded Shut Diode across Inductive Load Opens, then Relay Tries to Interrupt Inductive Current,

Contact Failure due to Inductive Voltage

Transient

Spurious Transfer —Command Failure

- Control Electronics Failure
A major magnetic-latching relay-failure mode is failure to transfer on

command. This can be due to internal relay failure (open coil, mechanIcal contact failure, welded contacts), interface failure, or driverelectronics failure. Another failure mode is relay oscillation. This

can be caused by a control failure that commands the set and reset

coils at the same time. A magnetic latching relay has both set and

reset coils. These coils require parallel diodes to prevent an inductive voltage rise when the current is interrupted. Should a diode

open, it would not be detectable until the driver tried to turn off the

coil current. At this time, the driver would fail owing to the inductive voltage transient. This is an example of a propagating failure.

Contacts can be burnt open or welded shut by fault currents or by interrupting an unprotected inductIve current. Spurious transfer of a

relay can be caused by a command- or control-electronics failure. Relay position can be determined directly by inference. A failure in the

direct position indicator (sense voltage across a spare set of con--

tacts) can cause a good relay to be indicating bad. This failure could

then require the use of inference (conclusion based on indirect sensing) to resolve an anomalous situation.

Operational Impact - Relays have recognized failure modes. It is expected that a space-station-wide criticality classification of loads

and redundancy requirements for relays will be made. For this reason,

the impact of the failure of a relay in a specified redundancy configuration are discussed below.

System-level analysis normally classifies loads and establishes redundancy requirements for each load class. Possible relay redundancy requirements are as follows:

1) Failure of a single relay will not result in more than TBD signal

or power-connection failure. Example--a single relay;

2) Failure of a single relay will not prevent connecting a load. Example--two parallel relays;

44

4-31
Relay

Redundancy

Configuration

Failure

Mode Effect Impact

Single Relay Fail Open Does not connect load. 3-4

Fail Closed Does not remove load. 3-4

Two Relays One Fail Open Does not connect load. 3-4

in Series An open failure always

causes load removal.

One Fail None. 5

Closed

Two Relays in One Fail Open None. 5

Parallel

One Fail Does not remove load. 3-4

Closed

Four Relays, One Relay None, normal 5

Two Parallel Always Closed operation.

in Series with or Open

Two in Parallel

p

r.

3) Failure of a single relay will not prevent disconnecting a load.

Example--two series relays;

4) Failure of a single relay will not prevent normal operation of a

load. Example--four relays, two in parallel in series with two in

parallel.

Table 4.4.1-2 lists the operational impact of a single relay failure in

each of the above relay-redundancy configurations. For a single relay,

a failure can result in not being able to connect or disconnect a

load. For two series relays, a fail-closed mode has no effect; the

load can be removed and an open failure always causes load removal.

For parallel relays, an open failure has no effect other than loss of

redundancy. A closed failure means the load is always connected. For

four relays in series and parallel, a single relay has no operational

effect. Its impact is loss of redundant backup.

Table 4.4.1-2 Relay Failure Impact by Redundancy Configuration

'r
4.4.2 Motor-Driven Switches

Failure Modes The generic failure modes of a motor-d.riven switch are

as follows:

1) Fail to transfer on command (motor failure, control-electronics

failure);

2) Spurious transfer (command or driver-electronics failure);

3) Mechanical damage to unit if both engage/disengage coils are activated simultaneously (control-electronics failure).

A motor-driven switch is an electromechanical device with motors,

gears, and limit switches. Failures associated with a motor are open,

shorted, or partial shorts of the coils. These can result in failure

u

or degraded operations. Gear trains are subject to tooth wear-out,

C particle generation, and bearing failure that can result in the device

failing to transfer. Limit-switch action is essential to turn off

power to the drive coils after the unit has engaged or disengaged.

Limit-switch failure can result in the motor driving too far and mechanical failure of the gear train. The electrical contacts are subject to being burnt open or welded shut by fault currents or interruption of unprotected inductive currents.

Operational Impact - A motor-driven switch performs the same functions

as a relay, except the loads it switches are generally much longer than

relay loads. The remarks for impacts of magnetic-latching-relay failure are applicable to motor-driven switches.

A major use of motor--driven switches is to connect and disconnect

high-current sources (e.g., ground supply and batteries) from buses.

For this type of application, failure of a motor-driven switch to engage would be the same as the loss of a battery. Once a battery is

f^
connected to a bus, the motor-driven switch would not normally be operated. A failure could occur that would prevent the switch from disengaging, but it would not normally be detectable until a disengage command is given.

A scenario for assessing the impact of a motor -driven switch failing to

disengage and remove a battery from a bus during orbital operations is

as follows. Suppose that it were required that a battery should be

removed from a bus, either for maintenance on the battery or on the

load side of the bus. When the switch fails to disengage, the battery

is not removed from the bus. With 27U-Vdc batteries, a safety hazard

would exist when performing maintenance on the load side of the bus.

Depending on the space station safety requirements, maintenance could

be prohibited with this failure. The battery would be composed of a

large number of cell modules. Battery maintenance would consist of

replacing these modules. It is expected that safety requirements would

require that the battery be floating so one side of a ,nodule could be

grounded. When the motor-driven switch fails to open, the battery can

not be isolated from ground. A safety hazard would exist for the removal of modules and the battery. Space station safety requirements

could prohibit maintenance in certain cases.

The impact of a motor-driven switch failing to open and remove a battery from a bus and ground during orbital operations could create a

safety hazard for maintenance. Safety requirements would probably require that there be a manual means of isolating the battery from the

bus and return before maintenance is allowed to proceed.

During maintenance operations when a motor -driven switch is required to

be disengaged, the impact of spurious engaging could create - a safety 

hazard. The impact of a computer command connecting a battery to a bus

while maintenance is in progress is such a serious hazard that design

rules may require a manual disconnect of motor-driven-switch power dur

ing maintenance.^
Description

Failure

Mode Effect

RPC is hi-gain feed Piece-part failure in Output of RPC

feedback circuit. stabilization loop. oscillates. Load may

not operate. Possible

overdissipation in RPC.

Redundant series- Pass transistors short, No measu:ble impact.

pass transistors, emitter fuses open. Nondetectable loss of

individually fused redundancy. Graceful

emitters. failure mode.

Limit rate of cur- Piece-part .tailure, no Bus transient

rent rise (di/dt). rate-of-current-rise undervoltage.

limit. EMI.

Limit rate of cur- Piece-part failure, no Transient voltage rise

rent fall (-di/dt). rate-of-current-fall due to inductance. EMI.

limit. Opening Of a Voltage

Suppression Diode On An

Inductive Load Could

Result in Voltage Rise

Sufficient to Destroy

RPC.

Limit fault cur- Piece-part fail, timer Fault current is

rent forapproxi- does not turn off cur- cleared, but RPC is

mately 3 s. Built- rent. All pass tran- destroyed.

in thermal mass sistors short, all

to absorb heat. internal fuses open.

RPC is mounted on Thermal subsystem Rise in cold-plate

a cold plate to Failure or degradation. temperature can impose

control steady Rise in cold-plate limits on dissipation

temperature. temperature. in RPC.

s°

R

w

4.4.3 Remote Power Controllers

Failure Modes - A remote power controller (RPC) is a solid-state switch

that performs all the functions of a magnetic latching relay plus the

additional functions of circuit breaker, fault current limiter, current-rise-time limiter, and current-fall-time limiter. An RPC is controlled by a logic-level signal. An RPC has all the generic failure

modes of a magnetic latching relay plus several additional failure

modes unique to an RPC. RPCs can be used in redundant configurations

in the manner of magnetic latching relays. A summary of the RPC-unique

failure modes and operational impacts are shown in Table 4.4.3-1.

Table 4.4.3-1 RPC-Unique FaiZure Modes and Impact

4-35
A remote power controller has a high-gain, electronic-feedback circuit

meant to control multiple parallel power transistors. A description of

the unique failure modes of an RPC is shown in Table 4.4.3-1. Because

many of the RPC functions depend on analog circuitry, piece-part failures in the analog circuitry can cause RPC functional failures. The

causes of the piece-part failures are insufficient worst-case design

and analysis, process failure, or lack of redundancy.

An RPC will normally be mounted on a cooling plate to maintain desirable operating temperature. A failure in the thermal-control. subsystem

can affect the EPS by not controlling the plate temperature. An increase in the plate temperature could restrict the dissipation in the

RPC.

Operational Impacts - RPC application is similar to magnetic latching

(mag-larch) relays. Their redundancy requirements and impact of a relay failure _n a redundant configuration is the same as mag-latch

relays.

An RPC has more functions than a mag-latch relay. In addition to having a relay function, it is also used as a circuit breaker, fault current-limiter, and limiter for rate of current rise and fall. The impact of these unique RPC failure modes is shown in Table 4.4.3-1.

There is an undetectable degradation in an RPC. This occurs when one

of the parallel series-pass transistors fails and its emitter fuse

opens. The RPC can function normally, but some margin would be lost.

The operational impact of this failure ranges from a loss of fault-management capability to no significant impact. The operational impact of

other faults owing to piece-part failures will be in the loss-of-EPScapability category. RPC degradation owing to failure of the thermal -

k

control subsystem to maintain the cold-plate temperature for the RPC

will range from loss of EPS capability to no significant impact.
4.4.4 Fuses

Failure Modes - A fuse has three major failure modes. First, it may

fail to open at its specified rating. Second, a fuse may fail by opening at a current less than its specified rating. Third, a fuse may

open owing to mechanical failure.

A limit of a fuse is its fault-clearing capability. If a fuse is used

in an application where the fault current exceeds the fuse-clearing

rating, then the fuse may not clear the fault. Also, fuses have maximum voltages for which they can be used in clearing. If a fuse is used

at a higher than design voltage, it may not clear a fault.

Operational Impact - If no redundancy is provided (i.e., one fuse), the

impact of a premature fuse opening is loss of the user load. The impact will be a partial loss of mission function. This would be an acceptable condition because the decision would have been made to tolerate less of that load because it was classified low priority and was

purposefully not provided with fuse redundancy. Failure of a single

fuse to open at its rated current could result in a possible bus undervoltage. The operational impact could be a degradation of EPS function

and affected user loads.

For series-redundant fuses, the effect of one fuse opening at less than

its rating is to lose a user load. The impact can range from degradation of mission function to loss of EPS function. There is no significant impact from one series-redundant fuse not opening at its rating

because it is assumed the other fuse will open.

For parallel-redundant fuses, there is no significant impact from one

opening prematurely. It is assumed the other fuse will carry the load

current. If one of the parallel redundant fuses fails to open at its

rating, more current would be required from the source to clear the

fuse. If the source were limited, the fuse might not be cleared, and

an overload or'undervoltage condition could result.

.r
Table 4.4.4-1 summarizes the failure modes and impacts for several re

dundancy configurations:

1) One fuse, no redundancy;

2) Two fuses, series redundancy;

3) Two fuses, parallel redundancy.

Table 4.4.4-1 Fuse Failure Modes and Operational Impacts

Redundancy

Configuration

Failure

Mode Effect

Operational

Impact

One Fuse, No Premature Open A user load 3, 4

Redundancy removed.

Fail to Open At Fault or overRating load not cleared.

Possible bus

undervoltage.

Two Fuses in One Premature Lose a user 3, 4

Series Open load.

One Fail to Open None. 5, 6

at Rating

Two Fuses One Premature None. 5, 6

in Parallel Open

One Fail to Open Higher current re- 3, 4

at Rating quired from source

to clear both

fuses. If source

limited, fuses

might not clear.

4.4.5 Circuit Breakers 

Failure Modes - Circuit breakers serve the same basic function as a 

fuse, but they are capable of resetting, either by manual or electrical 

means. Therefore,, circuit breakers have all the failure modes of fuses

plus additional failure modes unique to circuit breakers.
If a circuit breaker has a manual switching capability, then it is susceptible to a man's incorrect operation. If the circuit breaker has an

electrical operation, then it can be affected by command errors, driver-electronics failures, and interface failures. Electromechanical

circuit breakers have limits on the fault currents they clear. Grossly

exceeding these limits can result in explosive destruction of the circuit breaker. Information desired about the operational state of circuit breakers is "open" or "closed." The state can be sensed directly

by using an extra set of contacts as in mag-latch relays. The directsei;sing state indicator is subject to failures. These failures can

give a false indication of the circuit-breaker state.

Operational Impact - Circuit breakers are generally used with fuses and

controlled switches such as mag-latch relays or RPCs. The circuit

breaker is usually an enabling function. The relay is generally used

for repetitive switching. The impact of a circuit-breaker failure is

thus similar to that of a fuse.

The failure of a circuit breaker to open could have a safety impact on

maintenance similar to the failure of a motor-driven switch to open

(see motor-driven switch failure impacts). 

4.4.6 Cabling

Failure Modes - The generic failure mode of cabling and connectors is

conductors or connections opening and insulation failing, with a resulting wire-to-wire or wire-to-structure short. operational environments that cause mechanical damage are not Included here. The principal operational environment that can cause degradation of insulation is

temperature. Overvoltage can cause failure. Overtemperature would not

cause an immediate insulation failure, but it could decrease the useful

life of the insulation and require abnormally_ early maintenance or
For a 250-kW-class space station, power cables may require heat sinking

to structure, or active cooling. For such a configuration, failures or

degradation of the thermal-control subsystem could affect the FPS

through power cabling.

A space station will experience modular buildup over a number of

years. During this expansion, there is the potential for the change in

cable locations that could affect thermal properties of the cable..

Also, attitude-control modes such as gravity gradient have the potential for exposing cables to sunlight or darkness, both of which could

affect cable thermal and insulation properties.

Operational Impacts - A summary of cable failures and other activities

and their operational impacts is given in Table 4.4.6-1. Under the 

space station design requirement to eliminate single-point failures,

the severest impact from a cable failure would be a partial loss of EPS

capabl.ity or mission function. Insulation shorts from wire to wire,

;,r intermittent insulation failures, can cause anomalous operation that

could require partial shutdown for troubleshooting. Intermittent Y 

shorts in cables have the potential for extensive and time-consuming

effort to discover, isolate, and correct. 

Insulation can be degraded, by overtemperature. Monitoring could prevent this failure mode. The immediate operational impact of insulation

degradation is probably not significant. As the degradation progresses

to the point where cable failure occurs, the operational impact will be 

loss of fault-management capability (it is assumed there is sufficient

cable redundancy that a failure can be tolerated).

r

4-4U 
4

w;

R

Table 4.4.8-1 Cab Zing FaiZures/Activities and Impacts

Failure or Activity Effect Cause

Operational

Impact

Cable opens. Lose loads. Insufficient 3, 4

redundancy.

Insulation shorts, Fault currents Insulation 3, 4

wire-to-return. present, fuse or fault.

RPC must open to

clear.

Insulation shorts, Anomaly, a load Insulation 3, 4

wire-to wire. energized spuri- fault.

ously, arcing.

Insulation degrada- None. Lack of 5, 6

tion due to overtemp. monitoring.

Thermal subsystem Increase cable Failure in 4, 6

failure. temperature, another

decrease allowable subsystem.

power tlaru a cable.

Modular buildup, Cable moved or Activity of 4, 6

or attitude-control thermal charac- modular

mode. teristics altered. buildup or

attitude

control.

1

4.5 SENSORS AND SIGNAL CONDITIONING FAILURE MODES AND OPERATIONAL IMPACT

Failure Modes - The primary sensors for the E'PS are to monitor the fundamental or do component of the following parameters:

1) Dc voltage and current;

2) Ac voltage, current, and frequency;
All sensors have catastrophic-failure modes where they fail saturated

or open. Each of the sensors has an error band. A sensor can degrade

when its error exceeds its specified error band.

Sensors in ground-based applications require periodic calibration. If

a periodic calibration requirement is imposed on sensors for the space

station, then a sensor is good as long as its calibration date is valid. Unce a sensor has exceeded its calibration date, then it may be

considered bad and perhaps not useable for a manned application. Thus,

there exists the possibility of sensors affecting the space station

operation simply because of the exceeding of calibration dates or uncertainties about their accuracy.

Some sensors have well-known and predictable drifts due to temperature. This would constitute an accuracy degradation that could be removed by real-time adjustment if correction factors can be accurately

determined.

Signal-conditioning circuits will use electronic piece-parts to convert

the raw analog measurement into a single-ended do voltage of a given

range such as U to +5V, suitable as the input to an analog-to-digital

converter. The signal-conditioning circuits are subject to catastrophic failure, drift, and accuracy degradation. Generally, the signalconditioning circuit will be inseparable from the sensor for calibration and failure analysis.

Sampling circuitry involves multiplexers and analog-to-digital conversion. This signal conversion can fail catastrophically or can degrade.- Signal-conversion circuitry is quite susceptible to grounding

problems that could inject noise into an analog-digital converter.

Sampling implies bandwidth limits on the signal being sampled to ensure

that Shannon's Sampling Theorem is satisfied. This means there maybe

an antialiasing filter in front of the sampler. An antialiasing filter

may be either passive or active. Thus, the EPS can be affected by
failures in an antialiasing filter in the sampling section of the data

system. If an antialiasing filter fails by not restricting the bandwidth of the sampled signal, anomalies in the sampled data can result

by frequencies greater than one half the sampling frequency being present in the input.

The impact of transducer failure will depend on whether the transducer

is active, if its output is being monitored, and what weight is given

to its output. If a transducer is active and its output available,

then its failure woula be loss of information about the EPS. The

failed transducer could present an anomaly.

A summary of transducer failures and the resulting operational impact

are given in Table 4.5-1. There should be sufficient sensor redundancy

built into the space station so that the failure of a single sensor

will have no significant impact. System-level trade studies will be

required to identify how many sensor failures are permissible before

EPS or mission functions are lost or degraded. When the vehicle is

3 operated with failed sensors, it has a reduced fault-management capa

bility. Requirements for fault management may require maintenance 

after a failure of particular sensor. 

Degradation of a sensor by drifting outside of its error band can cause

a lack of confidence in the measurements. The lack of confidence could

cause overly conservative operating safety margins.

A sensor failing by exceeding its calibration due date is an example of 

a planning failure. The impact on orbital operations will depend on

the ,quality control and safety requirements for the space station. If

the philosophy is that an out-of-calibration sensor can not be used,

then EPS capability can be lost or degraded. If a'll sessors­were°to go

out of calibration on the same date, there could well be a requirement

to curtail operations and make sensor calibration the highest-priority

item.

4-43
Table 4.5-1

Sensor and SignaZ Conditioning Failure Modes and Operational Inrpa

Failure Mode Cause Effect

Operational

Impact

One Transducer Lack of Testing; None, If 5

Open Inadequate Worst-Case Redundant

Analysis; Lack of

Process Control

One Transducer Inadequate Operating Decreased 4

Out of Spec, Process Control; Piece- Information

Drift Part Quality Not

Adequate

Sensor Calibra- Inadequate Planning None for 6

tion Time Short Times

Exceeded

ADC* Intermit- Packaging, Manufacturing Decreased 4

tent, Noisy, Test; or Installation Information,

Ground; Error

Antialiasing

Filter Failure

*ADC Analog-to-Digital Computer

4.6 POWER-TRANSFER-DEVICE FAILURE MODES AND OPERATIONAL IMPACT

Failure Modes - The components classified as power-transfer devices are 

slip rings, roll rings, twist flex, and rotary transformer (power electronics based on a series-resonant circuit). The major failure a

"twist flex" of a slip ring, a roll ring, or a "twist flex" is an

open-circuit condition that results in loss or reduction of array power.

The twist flex has a limited angular rotation. Vehicle operations

could potentially affect the twist flex by commanding it beyond its

allowable angular rotation. Assuming normal liatit switches and safety

interlocks, the impact of this operations failure would be to stop the

orientation drive. This would result in degradedoutput from the solar

panel.# 
The rotary transformer includes a series-resonant inverter with control

and protection electronics along with the rotary transformer. This

device will have all of the failure modes associated with a series-resonant inverter discussed in section 4.3.3. Failures associated with

the transformer itself include open and shorted windings.

Operational Impact - A summary of the power-transfer-across-rotaryjoint failure modes and operational impact of the failure modes is given in Table 4.6-1.

Table 4.6-1

Components for Power-Transfer-Across-Rotary-Joints FaiZure Modes and

OperatonaZ Impacts

Failure diode Cause affect

Operational

Impact

Slip Ring Particle-Generation Degraded Power -4

- Noise brush-Plug Wear

Slip Ring Insulation Failure Loss of All Power 5-4

- Short thru Slip Ring

Roll Ring Mechanical Failure Loss of All Power 5-4

- Open thru Roll Ring

Twist Flex Mechanical Failure Degradation of Full 5-4

- Open of Flex Wire Loss of Power thru

Twist Flex

Rotary Electronics Failure Loss of Power from 5-4

Transformer in Series-Resonant an Array Section

- Open Inverter

1

I '

f

c^

t,

k

There are no failure modes that would result in a catastrophic loss of

the spacecraft under the assumption there would be sufficient redundancy to tolerate the loss of power across a rotary joint. The opera-

-C tional impact o no se i generat d' a in a s ip ring w 1' ill pro'k_1,1 result in y .

a degraded EPS capability. There is also the possibility of electromagnetic interference with payloads. The complete failure of a component to transfer power will result in loss of all power from a solarr array section if there is no redundancy in the rotary-joint's powertransfer components. If there is no redundancy, the operational impact

will range from degradation of mission functions to loss or degradation

of EPS function. Assuming power transfer component redundancy is provided, the impact of the loss of power transfer component would be loss

of fault-management capability.

4.7 AUXILIARY POWER SOURCES FAILURE MODES AND OPERATIONAL: IMPACT

4.7.1 Lithium Thionyl Chloride (LiSOCl 2 ) Battery

Failure Modes - A summary of the failure modes is given in Table

4.7.1-1. This primary battery has no function during long-term, normal

operations. Its intended use is that of an auxiliary, or emergency,

power source. A significant shortcoming of this type of battery design

is lack of state-of-health monitoring during the normal-operations period when it is not used.. Should a failure occur during a long standby

period, then the battery could fail or be degraded when it is activated

to supply power. This condition can not be tolerated if the required F

power is for emergency purposes.

Table 4.7.1-1 FaiZure Modes of Lithium Thionyl-ChZoride Battery CeZZs

Failure Causes Effect

Low end of Cell operation at Abnormally early bus voltage

discharge voltage low temperature. drop, possible bus undervoltand/or loss of age following.

capacity.

Low beginning Long dormancy, gen- Possible transient bus voltage

of discharge erally at an above- d*op or power 'delay at the

voltage. normal temperature; beginning of a discharge

cold temperature. period.

Cell shorted. Electrode or Possible bus undervoltage and

terminal bridging. loss of power.

Cell open. Terminal-electrode Possible bus voltage drop and

break. loss of of an entire string

of cells.
Failure

Mode Effect

impact Orbital

Assembly

Operational

Impact

Normal operation, None None, if no addi- 5

failure not tional failure.

detected. Safety hazard if

required.

Normal operation, None None, if no addi- 5

failure detected. tional failure.

Schedule work

arounu when

failure known.

Auxiliary power Switch over Schedule main- 5

active, then to backup. tenance impact.

fail.

Emergency shut- Deplete Operations. Sched- 5

down system,_ battery ule. Future STS

false emergency. capacity. Flights.

4.7.2 Chemical Turbomachinery

Failure Modes - Chemical turbomachinery or, more commonly, auxiliary

power units (APU), can have failures associated with leaks in the reactant reservoirs, clogged tubes preventing reactant flow, pump failures,

turbine mechanical failures (blades, bearings) and all the known failure modes of an electrical generator. A significant degradation of the

energy capacity of chemical turbomachinery can occur by leaks of the

reactants during periods of disuse.

Operational Impact - A summary of the generic failures of an auxiliary

power unit and the operational impact are given in Table 4.7.2-1. If

the state of health of an APU is not monitored during normal operations

and it fails, there is no impact as long as it is not needed. If a

situation arises where the APU is needed but has already failed, the

next level of APU backups will have to be activated.

Table 4.7.2 -1 Auxiliary Power Unit FaiZure Modes and Impact
A most serious impact appears to be an undetected failure during normal

operations. The impact is that fault-management capability has unknowingly been lost. Operating safety margins are not what they seem. If

an APU failure is detected during normal operation, APU not needed,

then operations could be changed to minimize the impac? of the loss of

the APU and timely maintenance repair, or replacement could be scheduled to restore the fault management capability.

If an APU is active and fails, and a backup of APU is activated, the

operational impact oZ the failure is a loss of fault-management

capability.

If limits in the emergency-shutdown system are too tight, or an invalid

emergency is declared and the APU is activated, the reactants can be

consumed. A rapid string of false emergencies and activation of the

APU can result in APU-reactant depletion. The impact of failures in

the emergency-shutdown system (false emergencies) is loss of EPS faultmanagement capability, future STS flight impact, and maintenance time

for APU replacement. There can also be an operational impact by constraints owing to depleted APU' backup capability.

4.8 OTHER ACTIVITIES AND FACTORS AFFECTING EPS PERFORWICE

Table 4.8-1 is a list of basic space station operational

characteristics and impacts on the EPS design, performance, and

operation. A summary of other subsystem faults and activities that

affect the EPS is given in Table 4.8-2. A brief discussion of major

activities is given in the following paragraphs.

A key conclusion that can be made is that EPS automation is mandatory,

in meeting the initial space station's basic requirements.
TaKe 4.8-1

Basic Space Station operationaZ Characteristics and EPS Design

Implications

Activities/ Implications in Power Subsystem Design,

Unknowns Performa ce, and Operation

Tong-Duration - Assure Crew Safety and Reduce Ground Support.

Manned Requirements

Facilities - Incorporate Flexible Fault Detection and Correction

Capabilities

- Replace Battery Modules and Array Sections

Periodically

- Accurately Keep Maintenance Logs and State of Health

of Identifiable Elements or Sections

- Accommodate Old- and New-Technology Components

Build and - Facilitate/Simplify Capability to Add Key Components

Repair in - Be Able to Determine Sate of Health Quickly and

Space Accurately, and Predict Failure (e.g._, Based on

Trend Date)

- Provide a "Turn-Key' Operation Similar to Large

Terrestrial Photovoltaic Power Systems as SolarArray Sections and Batteries Are Installed.

Incremental - Flexibility in Power-Hardware Designs and Additions

Growth in in Orbit

Power - Be Able to Quickly and Accurately Verify Performance

after Assembly and Update Power-Capability

Information

- Be Able to Reconfigure Easily and Operate in Reconfigured Arrangement

Economical - Reduce Power Subsystem Maintenance,

Payload Monitoring, and Other Housekeeping Roles by Flight

Support and Ground Crew to a Minimum

- Accommodate Unproven (on Long Life) or New-Technology Hardware to Reduce Development Cost

- Overcome Technology Limitations (e.g., Lack of

Long-Duration Battery Life Testing and Uncertainties

in Life of High-Voltage Batteries)

- In Situ Learning of Capabilities and Limitations,

e.g., Large Number, of High-Voltage Batteries Operating in Parallel, in Lieu of Extensive Ground Testing

Verify - Need. to Develop Technology fc-r Onorbit Checkout

Performance- Techniques and Analytical Tools for Performance

of Large Caaa- Determination

ponents along - Resort to Analytical Approach in Predicting or

with multiple Calibrating Performance

Components - Solar Array Strings and Battery Strings May Have to

Operating 4,n Operate with Mismatched and New or Old Elements.

Parallel This poses a Special Problem in Performance Optimization and Prediction
Table 4.8-2

other Subsystem FauZts and Activities nat Can Affect EPS Performance

Operational

Subsystem Failure/Activity Effect Impact

Structures Modular Buildup Reduced Power 3,4

Thermal Impaired Capacity to Reduced Power 3,4

Control Dissipate EPS Waste

Heat

User Loads Shorts or Overloads Bus Undervoltage 3,4

(All Subsystems

and Payloads)

Large Differences in May Reduce Bus 3,4

Day and Night Power Power Capability;

at Buses Excessive Battery

DOD

Attitude Gravity Gradient Reduced Power 3,4

Control Attitude Mode with

No Solar Array Articulation; Failure to Reduced Power 3,4

Maintain Required

Stable Attitude

Because of Unknowns

in Controlling Large,

Flexible Structures

Command Degraded TM Data Reduced Informa- 3,4

Transmis5ion tion to Ground

Loss of CPU Power Reduced Autonomy 3,4

and Automation

Data Software Maintenance Reduced Power 3,4

Capability

EPC/Crew Crew Commands, Dis- Reduced Power 3,4

Interface plays,New Crew, Capability;

Interface Ambiguity, Unintended

Mistakes Shutdown

EPS/Ground Power-Management Corr- Reduced Power 3,4

Operations figuration History; Capability;

Interface Audit Trail or Auto- Inefficient

mated Activities; Mission Planning

Training; Commands/

Dieplays

4-50
4.8.1 Flexible-Structures and Control-Subsystem Activities

A space station will contain a large, flexible structure. Knowledge of

the low-frequency dynamics of large, flexible structures will be critical to the design and performance (stability envelope) of the control

system. There is a probability that some in-situ characterization of

the structure dynamics will be required. A significant mass in a space

station will be in the solar panels. Hence, possible impacts on the

EPS from flexible structures and the control system are low-frequency

mechanical oscillations, solar-array pointing-accuracy degradation, and

constraints on solar-panel slew rates.

4.8.2 Data Management Subsystem (DMS) Activities

Assuming that the EPS incorporates a reasonable amount of automation,

it is expected that the EPS will not be highly dependent on the spacestation DMS. Loss of channels or degradation of data rates in the DMS

can result in loss of information about the EPS for ground use. If,

for some reason, sampling times become larger than normal, information

about the state of the EPS decreases. Preprocessing of critical EPS

performance data by the EPS computer would significantly minimize the

impact of DMS failures of this type.

Loss of space-station CPU capacity could result in some high-level EPS

automation software being bumped out by higher-priority flight software. This could mean the PES high-level automation software would

have to be run either in the STS or on the ground, or it would be cancelled and the functions performed by the ground.

The extent to which the EPS is automated, especially in handling and

processing raw engin ring performance data and commands, affects the

cost of the data-management subsystem. If the EPS transmits only the

significant engineering data, e.g., power, energy, and average quantities, rather than real-time voltage, current, and temperature, then DMS

support requirements to the EPS will be significantly lower than in
3)

4)

S)

6)

7)

8)

2) Fault diagnosis;

3) Health monitoring;

4) Operational state of commandable

A normal function throughout the life

software maintenance. The lack of so.

Potential causes of software maintenai

1) Inadequate software documentation

2) Temptation to save money by cuttii

documentation;

Inadequate test;

Inadequate quality control;

Inadequate sneak-path analysis;

Many potential interface pitfalls

Many individuals will work on sof

station;

Configuration-control deficiencie

past spacecraft. Also, the local computing and data-storage capability

of the EPS processor will minimize the requirements on the DMS processor in areas such as:

1) Archival data storage;
The ability of the EPS to perform its function in the space station

will be highly dependent on the software--not only the EPS applications

programs, but also the computer executive routines. Maintenance and

documentation of the computer applications and operating software will

be just as significant as changes to EPS wiring.

4.8.3 EPS/Astronaut Interface

The EPS/Astronaut interface will consist of the information display

about the EPS available to the crew via the onboard control-and-display

i

subsystem, and the method for the crew to analyze and control the EPS.

Display options range from a CRT to a .dedicated meter for each parameter. Command input options range from a computerlike keyboard to a

t dedicated switch for each command. Other aspects of the EPS/Crew interface are:

1) Crew command authority;

2) Crew override;

3) Automatic validation of commands;

4) (wick-look problem assessment;

S) Crew training.

Design of the EPS/Crew interface has many wide-ranging impacts. The

first requirement is that the crew be involved in not only the .interface design but also the EPS design. Crew/EPS interface errors can

cause loss 

of 

EPS functions or underuse. For a long-life space station, crew rotation is an operational necessity and crew training will

be a continuing operation. Inadequately trained and certified crews

can affect the EPS. Onboard ability to determine the EPS state of

health quickly and precisely is, therefore, quite essential--especially

on hi h- wer s stems g po Y
As for the DMS, the extent to which the EPS is automated significantly

affects the design and cost of the control and display subsystem.

4.8.4 EPS/Ground Interface

Almost everything said about the EPS/flight-crew interface applies to

the EPS/ground-operations interface. Configuration control is a paramount ground activity that has the potential of getting out of control. Mistakes in configuration control could affect the EPS. During

the life of the space station, there will be new flight-operations personnel every few months or years. Training and certification will be

activities that can affect the EPS, if there are deficiencies. Both

onboard and ground automation has a large effect on the cost of any

ground-support equipment, actual mission operations, and documentation.

4.8.5 Modular Buildup

A space station will be built up in a modular fashion over a period of

years. This implies adding new structures, modular EPS components, and

new loads. As new equipment is brought online, there are many potential problems such as:

1) Interface compatibility;

2) Software growth;

3) Sneak paths (software and hardware);

4) Updating of performance capability.

4.8.6 Thermal-Dissipation Management

The amount of heat dissipated by the EPS components--in particular,

power converters, inverters, and batteries--can exceed the design capability of the thermal-control subsystem. Inadequate temperature con- 

trol or thermal-dissipation capability result in the following forms of .

EPS degradation:

4-54 

OW WaWWWA -..^

" 3
1) Reduced bus-power capability;

2) Reduced battery life;

3) Reduced power-handling capability.

An ability to quickly and precisely assess thermal-control problems,

determine solution approaches, and implement them is mandatory. Because user load and housekeeping-subsystem load control is involved,

thermal-dissipation management and power management must be integrated. This is a system-level automation function that should be implemented by the space station's central computer.
5.0 TASK 3 - DEFINITION OF AUTOMATION TASKS

OBJECTIVE AND SCOPE

The first objective of this task is to develop a candidate list of

automation activities that could minimize or eliminate the impact identified in Task 2 as well as from other activities that affect EPS performance. The second objective of this task is to create a genericbenefits list and identify the range of benefits available from each

automation activity.

SUMMARY

It should be noted that there are basically two ways of automating any

function or operation. One is to use hardwired logic and circuits containing discrete devices. The other is via a digital computer. This

study is oriented toward automation of the second kind, and therefore,

unless otherwise stated, this report generally implies use of a computer where automation is discussed.

Tasks that are generally suitable for automation are: 

- Routine Tasks 

Precision Tasks

J

Sequential and Timed Tasks

.R

Tasks That Must be Done on Compressed or Expanded Timeline

L

Monitoring

Memorization

• 

- Complex Math or Logical Tasks

r

5-1
Table 5-1 presents the definition of the above general tasks.

Table 5-1 Definition of General Automation Tasks

Routine Tasks — Routine tasks by their nature are performed frequently in the same manner. As such, they are prone to generate errors by

the astronauts or ground crew. By reducing astronaut and ground-crew

interaction with the TPS by automating routine tasks, there is the

potential to reduce workload and errors. Examples of routine tasks

are battery-charge and -discharge control.

Precision Tasks - The benefits from automating precision tasks is to

improve performance. An example of a precision task is solar-array

pointing.

Sequential and Timed Tasks - A potential benefit of automating sequential and timed tasks is to eliminate errors. Common errors are

to eliminate steps, perform steps out of sequence, or perform multiple steps. An example of sequential and timed tasks are load

sequencing.

Tasks That Must Be Done on a Compressed 'timeline - Tasks that must be

done on a compressed timeline may cause an excessive workload for the

astronaut or ground crew. The benefit from automating this class of

task is to reduce workload. An example of a compressed timeline

function is correction of a bus undervoltage.

Monitoring -- A space station will have a large number of monitoring

tasks. Routine monitoring may be considered a boring task that humans perform poorly. The benefits from automating monitoring tasks

are a reduction in errors and crew boredom. Examples of monitoring

tasks range from accounting for relay position, battery state of

charge, and user load-status to doing limit checks such as for caution, warning, and alarm.

Memorization - A benefit from automating tasks requiring both short

and long-term memory is task simplification. An example of a memorization task involving detailed knowledge of a component is checkout

of an assembly.

Complex Math or Logical Tasks - Consider automating complex mathematical tasks to improve mission performance. An example of such a task

is prediction of the timewhen a battery will become fully charged

under varying load scenarios.

To standardize the definition of automation tasks, six categories of

generic functions were identified as listed in Table 5-2.

S-2
Table 5-2 Automation Task Categories

1.0 Data Handling 3.0 Fault Handling

1.1 Acquisition 3.1 Fault Detection

1.2 Processing 3.2 Fault Isolation

1.3 Storage 3.3 Fault Correction

2.0 Monitoring 4.0 Control

2.1 Operational State 5.0 Planning and Operations

2.2 State of Health 6.0 Anomaly Handling

2.3 Performance Analysis

2.4 Trend Analysis

Data Handling - Data handling is required in all other automation tasks

because they are dependent on input data. Data handling involves acquisition, processing, and storage of engineering data and commands.,

Data acquisition includes collection of measurements via multiplexing

and analog-to-digital conversion to digitize the data to put it in a

form acceptable for processing by digital computers. Processing involves all of the computational tasks. One of the processing tasks involved'with data acquisition is conversion of the raw-ADC outputs to

engineering units useful to the human users. Storage refers to storing

of basic operating and application software as well as the storage of

raw data and processed data.

Monitoring - Monitoring is defined to include operational state and

state of health determination, performance analysis, and trend analysis. Operational state means the position of all switches, the good/

bad status of all components, and the active/inactive status of all EPS

components. State of health determination deals with determining if a

particular EPS component is operating within its normal envelope.

Thus, limit checking and built-in test and checkout are inherent subfunctions. If it is operating within its normal envelope, it is

healthy. If it is operating outside its normal envelope, it may be

impaired, unhealthy, or it may be in danger of an incipient failure.

Performance analysis deals with measurable indexes of performance, such

as solar-array temperature or battery state of charge. Trend analysis

involves the analysis of a variable as a function of time. Trend analysis may involve the analysis of one or many variables as functions of

time.

sers
Fault Handling - Fault handling includes the automation of fault detection, isolation, and correction. Faults may be true, false, or transient, An important goal of fault-detection automation is to minimize

the number of false faults declared. The strategy for minimizing false

or transient faults is to require a fault condition to exist for a time

greater than a limit time. With hope, the limit time will be greater

than the transient time. Fault isolation or safing consists of actions'

to remove the faulty component or isolate it from the EPS after a fault

is declared. Fault correction requires analysis and action to correct

the fault (switch in a standby redundant unit) or manage it if redundancy is not available, such as priority-load scheduling to reduce battery drain.

Control This function is intended to include all routine housekeeping

and maintenance tasks. Automation of control means mechanization of

processes to effect the required results. An example of a frequent

routine control task is the control of battery charge and discharge.

An example of an infrequent control task is the determination of when

to recondition a battery.

Planning and Operations - The planning and operations function involves

all mission-operations activities. As a result, this is a space-station-level task. Automation of operations management will involve computer software to close the loop by monitoring the plans as they are

implemented, evaluating performance, and taking corrective actions.

Anomaly Handling - Automation of anomaly handling is one of the more

difficult and challenging tasks. An anomaly can be defined as an unforeseen situation or condition, a situation that is not understood, or

a condition that can not be resolved by the existing measurements,

hardware, or computer programs. One characteristic symptom is an occurrence of what appears to be a fault, but the fault is not repetitive

and has no trend. Anomaly handling appears to be a candidate area for

implementation via expert-system approach.

a.

i

,.r

5-4
I A general statement of benefits from EPS automation, which was developed for use in Task 3, is listed in Table 5-3.

Table 5-3 Benefits from EPS Automation

No. Description

1 Increased Life

2 Increased Reliability, Maintainability, and Safety

3 Improved Performance

4 Reduce Cost

4.1 Subassembly (Black Box)

4.2 Subsystem

4.3 Spacecraft

4.4 Launch Operations

4.5 Flight Operations

4.6 Inflight Fault Detection, Maintenance, and Servicing

4.7 Design, Development, Test, Evaluation (DDTE)

4.8 Ground-Support Personnel Labor

4.9 Ground-Support Equipment (Prelaunch & Flight Operations)

4.10 C&DH Subsystem

4.11 Thermal-Control Subsystem

4.iZ Life-Support Subsystem

4.13 Crew Training Simulator / C&D Subsystem

5 Reduced Maintenance

6 Able to Overcome Technology Limitations

7 Reduced Astronaut/Power Subsystem Interaction

8 Reduced Number of Ground-Support Personnel

9 Reduced New-Subsystem Familiarization/ Training Time

10 Reduced PV-Array Size and Weight

11 Reduced Battery Size and Weight

12 Reduced Power-Conditioning Size and Weight

13 Minimized Human Error

14 Allows Space Operation without Crew

15 Provides Real-Time Short-Response Control

16 Reduced Software and Hardware Interfaces to C&DH Subsystem

17 Improved Security and Survivability

18 Enables a Given Task, Operation, or Mission

^i

This benefits list is a compilation of all automation -benefits lists

from present and previous studies involving autonomy and automation.

Note that the benefits can be grouped into one of the following action

categories:
Increase

- Improve

Reduce

Overcome

Minimize

Allow

Provide

Enable

Analysis of the benefits list in Table 5-3 shows that this list consists of a benefit category and a space station parameters column that

is affected by automation. To provide more weight into the range of

benefits potentially available from EPS automation, the space -station

EPS parameter benefiting from automation is given as a function of the

benefit action in Table 5-4.

Table 5-4

Benefit Action and Space Station Parameter Impacted by Automation

Action Benefits

- Increase - Life, Reliability, Maintainability Safety

- Improve - Performance, Security, Survivability

- Reduce - Cost

- Maintenance

- Astronaut/ EPS Interaction

- Number of Ground-Support Personnel

- New Subsystem Training Time

- PV Array Size and Weight

- Battery Size -and Weight

- Power Conditioning Size and Weight

- Minimize - Human Error

- Allow - Operation without Crew

- Provide - Real-Time Short Response Control

An inspection of `fable 5-4 shows that the first result of automation is

to increase, improve, allow, or provide for that which is desirable.

Such space-station attributes as enhanced life and performance, ability
It

OR ul M. PAGE 18

OF POOR QUALITY

to operate without a crew, and real-time short-response control capability are all needed. The effect of BPS automation is to enable these

needs.

The second benefit of automation is to reduce or minimize undesirable

characteristics. It is desirable to reduce or minimize cost, astronaut

BPS interaction, size, weight, and human error. The effect of BPS

automation is to reduce and minimize these undesirable BPS

characteristics.

A matrix of benefits for each generic automation task is given in Table

5-5, and a brief summary of general approach to satisfy each automation

goal is presented in Table 5-6.

Table 5-5 List of Benefits for Generic Automation Task

Automation Task Benefits*

1 2 3 4.1 4.2 4.3 4.4 4.-5 4.6 4,7 4.8 4.9 4.10 4.11 4.;2 4.13 5 6 7 8 9 10 11 12 13 14 15 16 17

1) Data Handling x x x x x x x x x x x x x x x x x x x x x x x

2) Monitoring x x x x x x x x x x x x x x x x x x x x x x

3) Fault Handling x x x x x x x x x x x x x x x x x x x x

4) control x x x x x x r. x x x x x x

5) Planning and x x x

Operations

6) Anomaly x x x x x x. x x x x x x

Handling

*See Table 5 -3

`ce

^ 

,!

Ni

5-7
I` 4 Table 5-6 Benefits from EPS Automation

Automation. Goal General Approach

1.0 Increase life. - Minimize stress on EPS during a

normal operation and allow continuous operation in degraded

mode.

2.0 Increase reliability, - Detect, isolate, and correct

maintainability and safety. faults quickly.

3.0 Improve performance. - Operate EPS close to its limits,

especially during degraded modes.

4.0 Reduce cost.

4.1 Subassembly (black - Replace number of discrete parts.

box).

4.2 Subsystem. - Do via software rather than

hardware, wherever possible.

4.3 Spacecraft. - Automate EPS to reduce other

subsystem costs; automated test

and checkout.

4.4 Launch operations. - Automated test and checkout.

4.5 Flight operations. - Reduce astronaut involvement in

EPS monitoring and control,

astronaut freed for other

activities.

4.6 Inflight fault detec- - Reduce astronaut, ground/EPS

tion, maintenance, and interaction.

servicing.

4.7 DDTE (Design, Develop- - Minimize design freeze via use of

ment, Test, software.

Evaluation).

4.8 Ground-support - Automate EPS monitoring and

personnel labor. control.

4.9 Ground-support - Onboard test and checkout, and

equipment (prelaunch fault handling reduce ground-

& flight operations). support equipment.

4.10 Data-management - Reduce data and command

subsystem. interfaces due to EPS.

4.11 Thermal control - Minimize thermal-dissipation

subsystem management via EPS automation.

4.12 Life-support subsystem. - Do integrated load control

4.13 Crew-training simulator and C&D subsystem.

5.0 Reduce maintenance. - Fault-handling automation will

allow maintenance to be done on

convenient schedule. Automatic

monitoring functions and redundancy management.
Table 5-6 (cont)

6.0 Overcome technology

limitations.

7.0 Reduce astronaut/power

subsystem interaction.

8.0 Reduce number of ground

support personnel.

9.0 Reduce new subsystem familiarization/training time.

10.0 Reduce PV-array size and

weight.

11.0 Reduce Battery size and

weight.

12.0 Reduce power-conditioning

size and weight.

13.0 Minimize human error4

14.0 Allow space operation

without crew.

15.0 Provide real-time short

response control.

16.0 Reduce software/hardware

interfaces to command and

data management subsystems.

17.0 Improve security and ^

P y

survivability.

- Overcome limited component

lifetimes by fault handling and

redundancy.

- Hardware and software automate

fault handling, reducing astronaut-EPS interaction.

- Hardware and software automate

fault handling, reducing need

for ground support.

- Reduces penalty associated with

operator mistake.

- Via automation, optimize use of

available power, and road

management.

(Same as above.)

- (Same as above.)

- Automate sequential, routine,

boring tasks. -

- Automate EPS monitoring control,

and fault handling functions.

- Onboard hardware and software

available in real time.

- Use digital-data interface and

minimize analog-data interface;

transmit processed engineering

parameters (pwr, energy) and

average quantities to minimize

raw-data flow.

- Automation of fault handling'

provides continuous fault handling not interrupted by communications problems, operator

error, or operator distracted to

higher-priority _task.
d) Autonomous operation.

- Reduction of array and battery

weight through EPS and load management, enables certain missions to use photovoltaic system.

- Automation of all critical monitoring and control tasks previously done on ground.

Table 5-6 (concl)

18.0 Enable:

a) Mission.

5.1 FAULT-HANDLING TASKS

The automa'cion tasks identified in Table 5-2 and the benefits.list

identified in Table 5-3 were used to analyze the faults and activities

identified in Task 2. The approach taken was to identify the automation function required to resolve or permit a workaround solution for

each of the failure modes identified for each selected EPS component.

The results of this analysis are shown in Tables 5.1-1 thru 5.1-19 at

the end of this chapter.

5.2 MONITORING TASKS

Monitoring tasks consists of (1) operational state determination, (2)

state-of-health determination, and (3) performance and trend analysis.

Self-test and checkout are included under state of health. Table 5.2-1

(at the end of this chapter) is a list of specific subtasks identified

for the photovoltaic/battery power subsystem.

5.3 CONTROL TASKS

All routine control functions are included in this category. Table

5.3-1 (at the end of this chapter) lists specific examples for several

subsystem components.

5.4 PLANNING AND OPERATIONS TASKS

Planning and operations tasks involve all activities required by the

space station, flight crew, and/or the ground crew to satisfy the mission-operations requirements. The principal task identified is that of
electrical-consumables management or simply energy management. This is

a system-level task because it affects not only various housekeeping

subsystem functions but also the operational ;Sequence of experiments.

The energy management goals are to:

1) Provide the required power under normal and degraded mission modes;

2) Maintain a positive average bus power margin;

3) Extend battery life and minimize battery maintenance.

It is further intended that the above goals should be fully automated

with lesser autonomy initially, but growing into a fully autonomous

oaorbit capability, Achieving these goals will provide benefits such

as reducing ground labor and equipment costs, improving flight crew and

ground-crew productivity, and allowing complex, concurrent operations

with minimal human error.

F 
Table 5.1-1

Solar Array Failure Modes, Automation Candidates and Benefits

Failure

Mode

Automation

Task* Method Benefits**

Lose Power from 1, 2, 3 1) Determine status of all 4.5, 4.6,

Part of Array subarrays via limit 4.8, 7,

checks, and identify 8, 10

Fail to Track 1, 2, 3 failed or degraded

Sun subarrays.

2) Determine total array

Degraded Abil- 1, 2, 3 power available.

ity to Track 3) Calculate total array

Sun power degradation.

4) Determine impact on bus

Plasma 1, 2 load-handling capability.

Interaction 5) Maintain state-of-health

and performance trend

Long Term 1, 2 data.

Degradation 6) Isolate failed subarrays.

Excessive 1, 2

Charged

Particle

Degradation.

*See Table 5.1-2.

**See Table 5.1-3.

Table 5.1-2 Gimbals FaiZure Modes, Automation Candidates and Benefits

Failure

Mode

Automation

Candidate Method Benefits

Slip Ring Short, 1, 2, 3 Periodically calculate 4.6, 4.8,

or Roll Ring- P(IN)''& P(OUT). Archive 7, 8, 15

Twist Flex Open, data, trend-analysis

or Degradation projections. Pinpoint

failure.

Rotary 1, 2, 3 Same as above plus underTransformer Fail voltage management,

or Degrade redundancy switching.
Failure

Mode

Automation

Candidate Method Benefits

Shorted Series 1, 2, 3 Detect overvoltage and 1, 2, 4.5,

Pass Transistor close shunt switch. 4.6, 6, 7, 15

Low VOUT 1, 2, 3 Sense VOUT. When valid

undervoltage, prior and

load sheet and bus test.

Determine P3 good/bad.

Determine VIN good/bad.

If P3 bad, switch-in

backup, priority load

connect. If P3 good,

source overloaded, limit

loads reconnected.

Efficiency 1, 2, 3 Switch baerup online, use 3, 5, 7, 8

Below low-efficiency one as

Acceptable standby.

VIN High 10 2, 3 Monitor VIN . P3 shut- 2, 6, 7, 15

down on VIN Hl. Shift

loads to another P3, or

add loads to one with H2

VIN.

IIN High 1, 2, 3 Priority load shed, then

if still failed, switch

off and briny; on backup.

High Internal 1, 2, 3 Monitor temps, shut down

Temp on overtemp. Bring back

up online. Priority load

add.

IOUT Overload 1, 2, 3 Monitor IOUT, compare

to limit, support for

programmed time, turn off

pause, restart.

I

E.

Table 5.1-3

Dc/Dc Converter, P3 Type FaiZure Modes, Automation Candidates and

Benefits
Table 5.1-4

Battery Charger (P3 ) Failure Modes, Automation Candidates and Benefits

Failure

Mode

Automation

Candidate Method Benefits

Failure Mode, 1, 2, 3 Monitor, limit check, re- 2, 4.6, 4.8,

Batt V, I, or T duce charge V&I; if still 7, 8, 13

Overlimit over limit, turn off.

Battery-Charger 1, 2, 3 Sense V across series- 2, 6, 7, 15

Mode, Solar-Array pass transistor & when

Voltage Collapse less than limit, turn

P3 off, pause until

solar array recovers,

then restart.

Piece-Part Fail- 1, 2, 3 Onboard computer analysis 4, 6, 4.8, 7

ure in Stabiliza- of time response, compare

tion Circuit, or spectrum to nominal,

Output Filter Cap detect failure, use this

Open-Useable, But one as standby.

Increased Ripple

Voltage

Table 5.1-5

Transformer Coup Zed Converter FaiZure Modes, Automation Candidates and

Benefits

Failure

Mode

Automation.

Candidate Method Benefits

Output Over/ 1, 2, 3 Output V sense, limit check 6, 7, 15

Under Voltigo for undervoltage, hardware

over V detect & shunt trip,

priority load removal, reapply, switch backup on line.

Low Efficiency 1, 2, 3 Periodically calculate effi- 6, 7, 15

ciency, switch low unit to

backup status.

Input V, I, T 1, 2, 3 Monitor, limit check, turn 6, 7, 15

Out of Limit off for out of limit, bring

back up online.
Table 5.1-6

Series Resonant Inverter (DclAc) Failure Modes, Automation Candidates

and Benefits

Failure

Mode

Automation

Candidate Method Benefits

Input Cap 1, 2, 3 Input cap over V detect & 2, 4 9

6, 4.8,

Overvoltage shutdown. Bring back up 7

online & priority connect

loads.

Output Over 1, 2, 3 Monitor & limit check out- 2, 4, 4.6, 7

Undervoltage put voltage, turn off on

over V, on under V priority

remove 'toads, find failure

in SRI or source, start

backup and priority load

connect.

Input Fuse 1, 2, 3 Monitor fuse status; if

Open bad,start back up, alert

higher levels that this

SRI is bad.

Table 5.1-7

Solar Arran VoZtage ControZZer F'aiZure Modes, Automation Candidates and

Benefits '

Failure

Mode

Automation

Candidate Method Benefits

Discrete Switch 1, 2, 3 Direct Monitor, extra set 2, 3, 4.69

Failure to of contracts, indirect 4.8, 7, 15

Operate monitor, I & V.

Solar Array 1, 2, 3 Monitor solar array V &

Battery Share Bat I during sun. If Bat

Mode is discharging when it

should be charging, remove

loads on priority basis to

allow array to recover, or

use boost conv to raise

array V.

Control Elec-- 1, 2 3 Compare me4sured to theotronics Failure retical solar bus power,

Causes Solar or use spectrum of bus V,

Oscillations unwanted harmonics mean a

failure.

Closed Loop 1, 2, 3 Monitor error signal, satController urated error signal means

Failure failure, switch-on backup

unit.
Table 5.1-8

NiCd and Ni,H2 Batteries Failure Modes, Automation Candidates and

Benefits

Failure

Mode

Automation

Candidate Method Benefits

Low Discharge 1, 2, 3 1) Compare the EODV with aver- 1, 2, 4.8,

Voltage (DV) age EODV all other cells 7, 8, 11

- Cell or or modules (EODV) within

Module one Battery string.

2) Reestablish EODV caution,

warning, and alarm limits

based on trend data.

3) When alarm limit is

reached, and EODV limit,

try load shedding during

each successive discharge

period, increasing the

amount of load power removed as the EODV

decreases.

- Battery 1, 2, 3 1) Compare the EODV with

those of other batteries

(EODV).

2) Same as 2 above.

3) Same as 3 above.

Cell Short or 1, 2, 3 1) Monitor individual cell 6

Open voltages and verify shorted

cell (check charge, discharge, and open-circuit

voltages of cells and

battery).

2) Bypass shorted cell;

replace with spare cell

following charge -

equalization procedure.

Cell Voltage 1, 2, 3 1) If reverse voltage alarm 1, 2, 4.8,

Reversal limit: 7, 8, 11

during - Bypass that cell, and./or

Discharge. - Reduce load on battery or

- Remove battery until DV

is positive.
Table 5.3-8 (cont)

Failure

Mode

Automation

Candidate Method Benefits

Cell Under- 1, 2, 3 1) Determine if cell(s) has 1, 2, 11

pressure dur- partial short; compare

ing Charge with other cells for excesor Discharge, sive unbalance in pressure.

or Low Battery Capacity

2) Determine if battery was

excessively discharged or

undercharged in previous

cycle.

3) If sufficient recharge

power is available, increase the RF by 0.03 in

subsequent cycles; monitor

battery EODV and average

end of discharge pressure

(EODP).

5) If EODV and/or EODP do not

increase in each cycle,

reduce battery load and/or

remove battery during each

eclipse period, and continue

until EODV and EODP have

attained normal values.

2) During subsequent charge/

discharge cycles;

- Increase recharge

fraction (RF),

- Reduce load on battery or

- Remove battery during

eclipse periods.

3) Determine Goodness/Badness

of cell by comparison with

other cell performance.

Cell 1, 2, 3 1) Determine if cell is being 1, 2, 4, 8,

Overpressure severely overcharged (check 7, 11, 15

during Charge RF, cell temperature,

charge-voltage limits).
Table 5.1-8 (concZ)

Failure

Mode

Automation

Candidate Method Benefits

2) Reduce charge current or

charge voltage, or remove

battery.

3) Check for excessive unbalance in pressure relative

to other cells in battery.

Excessive 1, 2, 3 1) Determine cause(s) of ex- 1, 2, 4, 8,

Battery cessive temperature. 7, 11, 15

Temperature - Excessive overcharging

- Excessive discharge rate

or DOD

- Thermal-control failure

- Spacecraft orientation so

the battery is exposed to

sunlight.

2) If it is due to excessive

overcharging, reduce RF or

charge rate; it caused by

excessive discharge rate,

thermal-control failure, or

spacecraft orientation,

reduce battery load; continue until it attains

normal temperature.

High Charge 1) Determine Cause(s) of 1, 2, ll,

Voltage (CV) liigh CV: 15

- Charge controller failure

(to clamp voltage)

- Temperature sensor failure

2) Reduce battery current

by array section switching.

tre Modes, .Automation Candidates and Benefits

ion 1

to Method Benefits

Direct monitor, limit check, 2

switch to back up if available, report status.
t

Failure Automation

Mode Candidate Method Benefits

Fail to Transfer, 1, 2, 3 Command verification & peri- 2, 4.8, 4

or Spurious 'odic position monitoring

Transfer ( see Mag Latch Relays).

Table 5.1-19 

Magnetic Latching Relay Failure Modes, Automation Candidates and

Benefits

Failure

Mode

Automation

Candidate Method Benefits

Failure to Trans- 1, 2, 3 Verify command executed 2, 4, 6,

fer, Spurious by direct and indirect 4.8, 8

Transfer, Relay determination of relay

Driver Fails, or position. Automatic reContacts Open or entry of a failed command.

Welded Shut Periodically compare relay

commands to position, and

report differences.

Relay oscillates 1, 2, 3 Look for measure of output, 2, 4 9

6,

amplitude harmonics. 4.8, 8

Table 5.1-11

Motor Driven Switch Failure Modes, Automation Candidates and Benefits

Y1
Failure

Mode

Automation

Candidate Method Benefits

Open 1, 2, 3 Determine fuse state good/bad direct 2 9 4.61

or indirect. Direct determination 4.8, 7, 8

by blown fuse indicator, indirect

by input, output current & voltage

sensors. Periodically monitor and

report status. Store time when failure first detected.

Table 5.1-12

Remote Pourer ControZZer Failure Modes, Automation Candidates and

Benefits

Failure

Mode

automation

Candidate Method Benefits

Fail to Transfer, 1, 2, 3 Verify command executed by 2, 4.6,

Spurious Trans- direct and indirect method. 4.8, 7, 8

fer, Relay Driver Automatic reentry of a

Fails, Contacts failed command, report a.

Open or Welded failed command. PeriodiShut. Thermal cally compare relay comFailure Causes mands to position and

RPC Cold Plate report differences.

Temp to Increase

RPC Oscillates or 1, 2, 3 Measure spectrum of outFails to Limit look,look for high-ampliRise of Current tude harmonics.

Fail to Limit Same as above. This can

Current Fall work for small inductance.

(-di/dt) For large inductance, RPC

destroyed after failure.

RPC 3 Second Computer timer monitors

Timer Fails. RPC fault current and trip inCarries Fault dicator on RPC.. When fault

Current until RPC clear-time exceeds RPC

Internal Fuse carry time and no trip

Opens indicator, report as

failed or anomalous RPC.

Table 5.1-13 Fuses FaiZure Modes, Automation Candidates, and Benefits
Failure

Mode

Automation

Candidate Method Benefits

Cable Opens, 1, 2, 3 Monitor source loads, 2, 4.6, 4.8,

Insulation Shorts load switching 7, 8, 13,

Wire-to-Wire or 14, 15, 17

Wire-to-Return

Insulation 1, 2, 3 Monitor cable temp sen- 1, 2, 4.8,

Degrades due to sors & liolt; check. Re- 7, 8, 15,

Overtemperature port stales; to next com- 17

in Cable puter. H'^ her level to

shed loads on priority

basis to decrease cable

temps, or decide to tolerate on a limited, monitored basis. Higherlevel decision required.

Thermal Subsystem 1, 2, 3 Same as above. ( Same as

Failure above)

Modular buildup 1, 2, 3 Same as above. Resource (Same as

or Attitude- protection automated. above)

Control Mode System fault may require

human involvement for

correction.

r" 

k

i

I

Table 5.1-14

Circuit Breakers Failure Modes, Automation Candidates and Benefits

Failure

Mode

Automation

Candidate Method Benefits

Assumed Manual 1, 2, 3 Direct or indirect posi- 2, 4.6,

Breaker. Open tion measurement. Peri- 4.8, 7, 8

When Should. Be odically compare manual

Closed, v; Closed command table to measured

When :It :could position, store time of

Open change and report status.

Table 5.1-15 Cabling Failure Modes, Automation Candidates and Benefits
Table 5.2-16

Sensors and Signal Conversion Failure 1"c'odes, Automation Candidates and

Benefits

Failure

Mode

Automation

Candidate Method Benefits

Catastrophic 1, 2, 3 Limit checks, compare to re- 1, 2, 4.6,

Failure dundant unit, check state of 4.8, 7, 8

user, periodically report

status.

Drift 1, 2 Compare redundant units, sum

V, I, P & check deltas from

zero, trend analysis, periodically report status.

Out of - 1, 2 No practical method now (de- 1, 2, 6

Calibration sirable to develop).

Antialiasing 1, 2, 3 Inject reference signal with 1, 2, 4.6,

Filter or ADC harmonics into filter and 4.8, 7, 8

Ground Open ADC. Observe several samples,

if good, all ADC outputs within limits. Report status.

Table 5.1-17

LiSOCZ 2 Battery Failure Modes, Automation Candidates, and Benefits

Failure

Mode.

Automation

Candidate Method Benefitf

Fail While Not 1,, 2 Monitor bat. & cell V, peri- 1, 2, 4.6,

Operating, odic short-term loading to 4.8, 7, 8

Open-Shorted verify operational & prove

backup capability exists,

trend analysis.

System Failure 1, 2, 3 Monitor Ad our & report: ',r0& s, 2, 4.6,

or False Emer- a'•f..y toe bad:text' "will mast 4.8, 7, 8

gency Causes at pre oent date of discharge.

Battery To Be Also, output time bat. would

Put Online last at other rates of discharge, store all removed

because when emergency over,

bat. fault-management capacity will be lowered.
Table 5.2-2$

ChemicaZ Turbomachinery F°aiZure Bodes, Automation Candidates, and

aE>: fits

Zd 1. Lure

€tau

Automation

Candidate Method Benefits

F jj. While Not 1, 2 Monitor reactant pressure ., 1, 2, 4.6,

Operating amount remaining, critical 4.89 7, 8

temps, periodic short-term

operation to verify backup

to capability trend analysis,,

report status.

Some Failure 1, 2, 3 Monitor rate of reactant use 1 0 

2, 4.6,

Causes Compon- & printout of time remaining 4.8, 7, 8

ent to Turn on at several different rates,

Supply Power Store consumables data because when use over, fault

management capability will be

lowered.
Table 5.1-19

Otehr Subsystems and Activities Failure Modes, Automation Candidates,

and Benefits

Failure

Mode

Automation

Candidate Method Benefits

Flexible Not a

Structures and Candidate

Control,

Oscillations

Data System 1, 2, 3, Automatic scaledown of EPS 1, 2, 4.6,

Degraded; Data computation, shift high -level 4.8 7, 8

Rates; CPU automation to ground.

EPS/Crew/Gnd 1, 2, 3, 6 Real-time validation of all 1, 2, 4.6,

Interface commands, prompting of crew 4.8, 7, 8

- Invalid on consequences overriding

Commands auto function.

- Inadequate 1, 2 Computerized training, con- 4, 13, 9

Training figuration update, prompting

by computer.

Activity, 1, 2 Specialized software tools. 9, 13

Software

Maintenance

Thermal Con- 1, 2, 3 Integrated design of high- 1, 2, 4.6,

trol Can Not level control of thermal & 4.8, 7, 8

Maintain EPS EPS required.

Temperatures

User Loads, 1, 2, 3 Periodically calculates Z, 1, 2, 4.6,

open, Short or limit check, output status,, 4.8, 7, 8

Changed & trend... -

Impedance

For additional SOH information, take time-response

of V&I. Extract spectrum.

Compare spectrum and time

response to nominals stored

in computer.
EAy

r^

i* 4

f1

- Converters and Inverters

- Efficiency

- Output Impedance 

Table S.?'-1 Monitoring Task Examples

Operational State Determination

Number and Identity of Components Online, Offline, or Failed Relay

Position and Command State

State of Health

- Solar Array, Batteries, Power Conditioning, Bias (Housekeeping)

Power Supplies

Built-in Test and Checkout (Limit Checks)

Performance and Trend Analyses

- Solar Array

- Normalized Peak Power ( NPP)y Available Average Power /Daytime vs

Orbit Number

- NPP and ISC Degradation

- Minimum, Average, and Maximum Temperature

- Batteries

SOC, DOD, EODV, and EOCV Limit vs Orbit Number

- Average Temperature during Charge and Discharge vs Orbit Number

- Total Number of Cycles above X% DOD, Y% DOD

- Number of Cycles Since Last Preconditioning

- Battery Recharge Fraction vs Orbit Number

- Bus Power Capability ( Orbital Average, Average Power Margin)

- Bus Load ( Day, Night, and Orbit Average)

Table 5.3-1 Cont2vZ Task Examples
6.0 TASK 4 - PARTITIONING OF AUTOMATION FUNCTIONS

OBJECTIVES AND SCOPE

The objectives of Task 4 Caere to develop a method for partitioning the 

automation activities between the EPS, Space Station System, and the

ground, and to partition all EPS-automation candidates developed in

Task 3.

SUMMARY,

The partitioning method usedwas as follows. First, the time criticality of the function is determined. From this analysis, functions can

be separated into (1) time-critical functions that require dedicated

hardware, such as bus overvoltage, and (2) functions that do not require the fast response time and are candidates to be performed by a

computer. Next, the location where the task is to be performed and the

resources to do the task are identified. A determination is then made

of the external interface impacts--Are the impacts totally within the 

EPS? Or are these impacts outside the EPS? General criteria is established for partitioning the automation functions are as follows:

Dedicated hardware are to be located in the EPS component;

F . Fault detection, isolation, and correction can be partitioned to 

different levels;

To be partitioned to the EPS, the fault must originate in the EPS;

the correction resources should be in the EPS and there should be

no impacts outside the EPS.

"i Finally, the last step consists of considering each function partitioned to the EPS, the space station system, and the ground, and providing rationale for or against each partitioning. Partitioning can be

,E

facilitated in terms of where sensing, analyzing, and actin; should

best be performed.

6-1

NOW
6.1 GENERAL METHOD

6.1.1 Fault-Handling Partitioning of Tasks

The methodology for partitioning is firmly grounded in an analysis of

the time criticality of the fault, a partitioning of the automation

task between hardware or software based on the time criticality, an

identification of where the fault is defined and where the correction

resources are, and an identification of the external impacts of the

fault. One of the study ground rules was that the partitioning would

be to the EPS, Space Station System, or to the ground. General partitioning criteria were developed. Each specific fault was considered

partitioned to each of the three areas, EPS System, and ground, and

recommendations and rationale for each particular partitioning were

given. It was considered dust as significant to give rationale for not

partitioning a function to one area as it was to provide rationale for

partitioning a function to the area of optimal benefit.

The following sections present the detail steps in the automation-partitioning method.

r'

C .f

Identify Fault - The first step in the partitioning process is to iden

tify the fault being studied. The fault is primarily identified by EPS

assembly and the specific fault. _A further identification of the fault 

can be made in terms of its operational impact identified in Task 

Time Criticality - Time criticality is defined as the length of time 

between a fault occurrence and when the fault impact will be experienced by the Space Station if the fault is no_, safed and corrected.

The smaller the time interval between a fault occurrence and the impact, the more time-critical is the fault. The time interval can be 

identified in units of milliseconds, seconds, minutes, fractions of an 

orbit, or multiples of the orbit period. The time criticality is spec- 

ified by the time duration between fault occurrence and impact onset

and a gross evaluation ofYES /NO for time criticality.

6-2

^W . 
The first use made of time criticality is to identify those faults that

are so fast that they require hardware for sensing, safing, and correction as opposed to faults that are slower and could be handled by software. A second use made of time criticality is to aid in partitioning

and assigning a priority to fault handling in the event of simultaneous

fault.

Hardware/Software Partitioning - Time criticality is used to separate

those faults that require dedicated hardware for handling from those

slower faults that could be done by soft-ware. Additionally, there can

be hierarchy of protection levels. For example, say the maximum temperature in an assembly is not to exceed 80 * C. Software could.be used

to monitor a temperature transducer and shut the,assembly down if the

temperature exceeded 74 +2'C. Functional redundancy could be provided

by a bimetallic switch that would disable and protect the assembly if

the temperature were 78 +2'C. In this case, a hardware backup was provided for a primary software system.

Fault Definition Level An identification must be made of where in the

Space-Station functional architecture the fault can be defined. The

lowest identifiable failure level may not b& the same as the lowest

replaceable level. For example, battery cells will be packaged in modules. The lowest identifiable failure level will be the cell level,

but the lowest replaceable level is the module.

Exactly where the lowest identifiable fault-definition leveland replacement level will be is not known now because they will be functions

of packaging and how much redundancy is built into each black box. If

the choice is made for block redundancy at the - black-box level, then

the lowest identifiable and the replacement levels will be the same.

If the decision is made to package standby redundant elements in each

black box, then the lowest identifiable fault level will be below the

black-box level.

6-3
r'

For purposes of this study, faults will be defined at the following

levels:

h

- Lowest Identifiable Level

Lowest Replaceable Level

- EPS Level

- Space-Station-System Level

As previously stated, it is not known now where the lowest identifiable

level will be but is important t_ o .identify this level for input to the

fault-correction process. Examples of black-box-level faults are fuse

k

c>< failure ^ _ relay failure y > RPC failure > nouredundant ppower converter ppackage, or battery-module failure. Some of the more complex failures will

.,K be defined at the EPS level. Examples of EPS level faults are a fail

a±9 _ 

w 

Y .xgto charge batteries due to a sosolar-array voltage collapse , or a user *^

r^

r; bus-undervoltage due to a, power -converter or power-source failure. 

Both of these examples would require EPS-level Information to detect, 

analyze, and correct. Faults defined at the Space Station System are

. those faults that have systemwide impacts as to require system information to define and correct. Examples of system faults are a thermalsubsystem failure that limits the amount of waste heat that can be removed from the EPS, or oscillations in the flexible structure that

affect solar-array pointing. Both of these failures will have systemwide impacts and would require system-level information to detect and

correct.

.r§ Identify Level-of-Correction Resources - It is important to identify

where the correction resources are to help in the partitioning process. For purposes of this study, correction resources are identified 

r at the following levels: 

^E

6-4 
1) Lowest Identifiable Level;

2) EPS Level;

3) Space Station System Level.

The partitioning process is aided by this resource-level identification. If the correction resources are in the EPS, then the decisionmaking authority may be at the EPS level. If the correction resources

are not at the EPS level, but at the Space Station System level, then

it is that the decision making authority can not be concentrated at the

EPS level. Decisions ofthe Space Station System level will be

required.

Identify External Impacts - The purpose of this step is to classify the

faults into two impact categories:

1) No impact outside EPS;

2) Impact outside EPS.

Impacts outside the EPS can, of course, be broken down into various

other categories such as operating-schedule changes, safety-margin impacts,cts spacecraft-operating -mode im acts or a load im acts. Fo

P ► payload p Pur

poses of this study, it was deemed sufficient to use two categories, 

(1) no impact outside EPS, and (2) impact outside the EPS.

External.-impact assessment will be use as an aid in the partitioning

process. Faults that do not have an impact outside the EPS are candidates for handling at the EPS level. If the .fault has an impact outside the EPS', then it is likely some decisionmaking authority will have

to be assigned to the Space Station System.

Partitioning Ground Rules - The ground rules for partitioning the automation functions were established by MSFC. The automations functions

will be partitioned among the following three areas: 

6-5

k 
1) EPS;

2) Space Station System ( Central Computer-assumed);

3) Ground.

The above three areas are the lowest level of detail for functions to

be partitioned. For example, if a function is partitioned to the EPS,

we will not try to assign it to a distributed- or a central -EP$ processor. Further, if a function is partitioned to the ground, we shall

not try to'assign it to - a flight-operations or flight-support center.

Also, we will not affect, make any assumptions about, or drive the computer architecture with any of the partitioning activities.

Criteria for Partitioning - The following is a discussion of general

criteria for partitioning that were developed. All of the criteria are

obtained by application of conservative engineering judgment to the

material developed in the previous steps.

z

Time-critical-hardware functions should be done in the EPS. If a func-

tion is time -critical and requires dedicated hardware to perform, then 

the hardware can not be put on the ground, but must be onboard the 

spacecraft,

Functions that can be performed by either hardware or software ishould 

be analyzed further to point out the advantages and disadvantages of a

hardware or software implementation. The overriding reason for parti 

tionin& a function to hardware is time criticality. Reasons for as- 

signing functions to software are:

1) Flexibility;

2) Reprogrammable;

3) Fast response to changing or unforeseen mission requirements.

6-6
A reason for assigning a protection function to both hardware and software is to achieve functional redundancy. If there were to be a major

failure in one area, say computers, then the functionally redundant

hardware-implemented protection systems could still function independent of the computer.

Software functions can be partitioned to the EPS, Space Station system,

or the ground.

Fault detection, safing, and correction do not all have to be partitioned to the same area. Similarly, the functions of sensing, acting,

and analyzing can be partitioned to different areas. The more ;likely

scenario is that the sense and act functions (signal transducers and

control effectors) will be in the EPS. The analysis and decisionmakng

authority can be shared among the EPS, system, and ground.

For partitioning to the EPS, the following should be true:

1) The fault should be defined in the EPS;

2) The correction resources should be in the EPS;

3) No impacts outside the EPS.

Even though a particular function is partitioned to the EPS, there can

be enables or concurrence to proceed from either the Space Station Sys- 

tem level, the flight crew and the ground, or combinations of the

levels: _ 

For partitioning to the Space Station System, one or more of the 

lowing should be true:

r

4 1) The fault is not defined in the EPS;

F

6-7
2) The correction resources are not in the EPS;

3) There are impacts outside the EPS.

Again, even though a function is partitioned to the Space Station -system level, there can be enables or concurrences to proceed from the

flight crew and/or ground.

The following are some criteria for partitioning functions to the

ground. Functions that can not or should not be automated on board

should be partitioned to the ground. Faults having an expected occurrence so low as to not be cost effective in automating their handling

onboard-could be partitioned to the ground.

Activities so complex or beyond the state of the art for automation onboard the Space Station are candidates fdr partitioning to the ground.

6.1.2 Partitioning Other Automation Tasks

Any functional operation can be separated into three activities:

1) Sense: Acquire data or information needed;

2) Analyze: - Process raw data to generate, desired parameters

(e.g., power, energy , etc);

- Analyze data to determine a problem or failure;

If a problem or failure is indicated, determine a 

solution approach;

- Direct the electronics that actually implement the

task, issue command. 

3) Act: Do the function_ requested, implement the command re

ceived (e.g., activation of a switch).

6-8
Sensing involves signal transducers, multiplexing, and signal conversion. Analyzing involves cowrie rting raw ADC outputs to engineering

units, analysis of the data to determine the fault, no fault status,

determination of a solution if a failure is indicated, and the issuing

of corrective-action commands. Acting involves the effectors such as

relays or digital-to-analog converters. The acting activity implements

the command received from the analysis function.

For the non-fault-handing functions, the three activities of sense,

analyze, and act will be partitioned among the EPS, system, and

ground. Rationale for the partitioning will be given.

6.2 RESULTS OF FAULT-HANDLING AUTOMATION PARTITIONING

The results of partitioning the ,fault-handling automation between the

EPS, space station system, and the ground is shown in Tables 6.2-1 thru

6.2-15.

The partitioning of automation functions in this task was performed

without reference to the level of autonomy of the Space Station. The

object was to identify the characteristics of the fault and to perform

the partitioning based on identified fault characteristics.

Faults that require a fast detect -and-safe time ( milliseconds) and dedicated hardware (not computers) such as a do/dc converter output over

voltage, must of necessity have the machine-autonomy automation placed

in the EPS. The fast reaction time makes it impossible to perform the
E ORIGINAL PAGE 19

A OF POOR QUALITY'

Table 6.2-1 Solar Arran FaiZure Xypee and partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Loss of Power Minutes No Yes EPS APS Yes (1),(2),(3), (10),(11) (10),(12)

from Part of (4),(5)

Array; Excessive Power,

Degradation

Failure of Minutes No Yes EFS System/ACS Yes (1),(2),(3), (7), ( 10), (10),(12)

Array to (4),(5) (11)

Track Sun

Arcing on Minutes No Possible EPS System No (1),(2), ( 3), -- (10),(12)

Array from (4),(5)

Kassa Interaction or

Corona

Noteai

(1) Sense Fault ( 5) Calculate Energy Capability (10) Oenerdte New Load Sequence Commands

(2) Effect Load Control As Required ( 6) Isolate Fault (11) Store Failure Diagnostic Data

( 3) Monitor State of Health ( 7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power ( 8) Isolate and Correct Fault ( 13) Bus Power Capability and Demand Analysis

Capability ( 9) Enable Automatic Fault 6 Enable Power Management

Correction by EP$.

Table 6.2-2

N Cd and NiH2 Battery FaiZure Types and Partitioning of Correction Tasks

Fre

h

s,

e

1' 

6-10
ORIGINAL PAGE M

OF POOR QUALITY

dp

Table 6.2-3

Regenerative Fuel Cell Failure Types and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Fuel Cell Seconds No Yes EPS EPS Yes (1),(2),(3), (10), ( 11) (10), (12),

Module (4),(5) (13)

Failure

- Low Voltage

Hign

Internal

Resistance

- Upen or

Short

- Cell

Voltage

Revarrsal

- Pump

- Reactant

Leakage

Electrolysis Minutes No Yes EPS EPS Yes ^ (a`.),(2),(3), (10),(11) (10), ( 12),

Module (4),(5) (13)

Failure

- Pump

- Cell Open

or Short

Reactant Minutes No Yea System System Yes (1), ( 2),(3), (10), ( 11) (10)

Subsystem (4),(5)

- Leakage

Pump

Electrolysis Minutes No Yes EPS EPS No (1),(2), ( 3), (10),(11) (13)

Regu/wtcr (4)x(5),(6)

Notes:

(1) Sense Fault (5) Calculate Energy Capability ( 10) Generate New Load Sequence Commands

(2) Effect Load. Control As Required ( 6) Isolate Fault (11) Store Failure Diagnostic Data

( 3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault 6 Enable Power Management

Correction by EPS

Table 6.2-4

Solar Arran Voltage Controller Failure Types and Partitioning

of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

"• Time Definition Correction External 

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Partial Loss Minutes No Yes EPS EPS No (1),(2),(3), (10),(11) (10),(12)0

r of Power or to Hours (4) (13)

Control

Full Shunt Minutes No Yes EPS EPS No, If (1),(2),(3), (10),(11) (10),(12)

G. Fail Short Cor- (4) (13)

tr (No Power) rected, 

Yes, If 

Not Corrected

x rt 

Notes: 

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands 

(2) Effect Load Control As Required ( 6) Isolate Fault ( 11) Store Failure Diagnostic Data

x (3) Monitor State of Healt). (7) Correct Fault (12) Do Trend and/or Failure Analysis s

f „ (4)'Calculate Total Bus Power Isolate and Correct Fault ( 13) Bus Power Capability and Demand Analysis

Capability ( 9) Enable Automatic Fault & Enable Power Management

Cortection by EPS

d

hu 

6-1
uRIGINAL PAGE 'S

OF POOR Q

Table 6.2-5

P3 (de-de Converter) Failure Types and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction E=ternal

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Output Over Milli- Yes No EPS EPS No (1),(2),(3) (11) (12)

voltage second

Output Under Milli- No Yes EPS EPS No (1),(2),(3), (1),(8), (12),(13)

Voltage seconds to (4) (10)1(11)

Seconds

Efficiency Minutes No Yes EPS EPS,- No (1),(2),(3) (11) (12);(13)

Low to Hours

Out of Limit: Seconds to No Yes EPS EPS No (1),(2),(3), (11) (12),(13)

V(In), I(In) Minutes (g)

Temp

Thermal Minutes No Yes System System Yes (1),(2) (8)1(10) (13)

Control

Failure

Notes:

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect load Control As Required (6) Isolate Fault(11) Store Failure Diagnostic Data

(3) Monitor State of Heslth (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault 6 Enable Power Management

Correction by EPS

Table 6.2-6

Transformer Coupled Converter Failure Types and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Imnicts

sio, If

EPS System Ground

V(Out) High Fraction of Probably Yes EPS EPS (1),(2),(3) (11) (12).(13)

Sec to Seca Not. There In

Slower Block

Failure RedunThan Non dancy

Trans- for Corformer rection

Coupled

Conyerter

No Output Seconds to No Yes EPS EPS Yes, If (1),(2),(3), (10),(11) (10),(12),

Minutes No Redun- (4) (13)

dancy

Efficiency Hours to No Yes EPS EPS No (1),(2),(3), (11) (12).(13)

Degraded Months (4)'

Notes:

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7)` correct Fault (12) Do Trend and/c ,, , 'Failure Analysis

(4) Calculate Total Bus Power (8) Isolate and Correct Fault (13) Bus Power Capa-11ity and Demand Analysis

Capability (9) Enable Automatic Fault d Enable Posner Management

Correction by EPS
OF i 

POOR QUALITY,. 0

Table 6.2-7

Series Resonant Inverter Failure Types and Bartitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Resonant Milli- Yea No EPS EPS No ( 1),(2),(3) (11) ( 12),(13)

Capacitor seconds

Over Voltage

Output Over Milli- Yes Back Up EPS EPS No (1),(2),(3) (10),(11) (12),(13)

Voltage seconds to Hardware

Input Fuse Seconds No Yes EPS EPS No ( 1),(2),(3) (11)

Open

No Output Seconds to No Yes EPS EPS Yes, If ( 1),(2);(3), (10); ( 11) (12),(13)

Minutes No Redun

dancy

Notes:

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor Mate of Health (7) Correct Fault (12) Do Trend and Failure Analysis

(4) Calculate Total Bus Power (6) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis'

Capability (9) Enable Automatic Fault G Enable Power Management

Correction by EPS

F .

Table 6.2-8

Magnetic Latching ReZay, RPC, and Motor Driven Switch Failure Types and

k Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Fail to Seconds to No Yes EPS EPS Yes (1),(2),(3) (11) (12),(13)

Transfer, Minutes

Spurious

Transfer

(Command

Verification)

Output Minutes to No Yes EPS EPS Yes (1),(2),(3) (11) (12),(13)

Oscillaces IHours

Notes:

(1) Sense Fault (5) Calculate Energy Capability ( 10) Generate New Load Sequence Commands

(2) Effect Load Control As Required ( 6) Isolate Fault ( 11) Store Failure Diagnostic Data

(3) Monitor State of Health ( 7) Correct Fault ( 12) Do Trend and/or Failure Analysis

(4) Calculate Total, Bus Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault 6 Enable Power Management

Correction by EPS

e
ORI(IINAL PAGE19

Table 6.2-9

OF POOR QUALITY

ry ReZay Configuration Failure Types and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External Fault Criticality Hardware Software Level Resources Impacts 'EPS System Ground

Lose No No Yes EPS EPS No (1),(2),(3) (10),(11) (12),(13) Redundancy,

Operate

Normal

Single Relay

Fail Open, 2

Series Relays,

One Fail Open

No No Yes EPS System Yes (1),(2),(3) (10),(11) (12).(13)

(Load Can Not

Be Connected)

Single Relay

Fail Closed,

2 Parallel

Relays One.

Fail Closed

(Load Can Not

Be Removed)

No No Yes EPS System Yes (1),(2),(3) (10).(11) (12),(13)

Notes

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Tread end/or Failure Analysis

(4) Calculate Total Bus 'Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis Capability (9) Enable Automatic Fault 6 Enable Power Management

Correction by EPS

2d Partitioning of Correction Tasks

Task Partitioning

Correction External

Resources Impacts EPS System Ground

System: Yes (1),(2),(3) (10),(11) (12),(13)

EPS Yes (1),(2),(3) (10),(11) (12),(13)

System Yes (1),(2),(3) (10),(11) (12),(13)

Capability (10) Generate New Load Sequence Commands

(11) Store Failure Diagnostic Data

(12) Do Trend and/or Failure Analysis -

ct Fault (13) Bus Power Capability and Demand Analysis

Fault 6 Enable Power Management
ORIGINAL PAC;r. IS

OF POOR QUALITY

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

High Temp in Minutes No Yes EPS System Yes (1),(2),(3) (10),(11) (12)

Cable

Insulation Seconds to No Yes EPS EPS Yes (1),(2),(3) (10),(11) (12)

Shorts Wire Minutes

to Wire or

to Return

Modular Minutes No Yes EPS -System Yea (1);(2),(3) (10),(11) (12),(13)

Buildup

Activity

Impacts

Cables

(Overloads

or Overtemps)

Notes:

(1) Sense. Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (6) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault 6 Enable Power Management

Correction by EPS

w}

Table 6.2-11

Fuse Configuration FaiZure Tapes and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Tim, Definition Correction External

Fault Criticality' Hardware Software Level Resources Impacts EPS System Ground

Single Fuse ;o No Yes Fuse System Yes (1),(2),(3) (10),(11) (12),{13)

Open; Series

Fuses One

Open; No

Power Can

Be Applied

to a Load

Two Parallel No No Yes Fuse System No (1),(2),(3) (10),(11) (12),(13)

Fuses, One

Open

Notes

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (B) Isolate and Correct Fault (13) Bus Power Capab.'.1ity and Demand Analysis

Capability (9) Enable Automatic Fault & Enable Power Management

Correction by EPS

a Table 6.2-12 Cabling FaiZure Types and Partitioning of Correction Tasks
ORIGINAL PAGE 19

OF POOR QUAUTY

Table 6.2-13 Gimbal Failure Types and Partitioning of Correction Tasks

Table 6.2-14 Sensor Failure Types and Partitioning of Correction Tasks

I Analysis I Task Partitioning

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Slip Ring Hours No Yes EPS System No (1),(2).(3) (12) Noise

Slip Ring Minutes No Yes EPS EPS, If Yes (1),(2),(3) (11) (12),(13)

Short, Roll Block

Rings Open, Redundant;

Twist Flex System, If

Open, Rotary No Block

Transformer Redundancy

Open

Notes.'

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Co ads

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health

(4) Calculate Total Bus Power

(7)

(8)

correct Fault

Isolate and Correct Fault

(12) Do Trend and/or Failure Analysis

(13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault & Enable Power Management

Correction by EPS

Correction Approach Fault

Time Definition Correction External

.Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Catastrophic Minutes No Yes EPS EPS NO (1),(2),(3) (11) (12),(13)

Failure,

Drift,

Antialiasing

Filter or

ADC Ground

Open

Out of Days NO Yes EPS System Yes (1)

Calibration

Notes:

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (8) Isolate and correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable Automatic Fault & Enable Power Management

Correction by EPS
ORIGINAL PAGE IS

OF POOR QUALITY

Table 6.2-I5

Auxiliary Power Unit Failure Types and Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Tice Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

APU Failure; Minutes No Yes APD EPS Yes (1),(2),(3) (10),(11) (12),(13)

Reactant to Days

Supply

Failure

Emergency Yes Yes Yes EPS EPS Yes (1),(2),(3) (11) (12),(13)

Shutdown

System False

Shutdown

Alarm

Notes:

(1) Sense Fault (S) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effecr_Load Control As Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total Bus Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (4) Enable Automatic. Fault S Enable Power Management

Correction by EPS

R

p

►1

E

F

6-17
It was found that many of the 4el`1-understood faults that had correction times low enough to be compatible with software could technically

be done either in the EPS, the Space Station System, or the ground.

The discriminators used to pick the best area were:

1) Fault Definition Level;

2) Correction Resources Level;

3) External Impacts.

If the fault could be defined and corrected in the EPS without external

impact, then it was recommended that the automation should be done in

the EPS. I'f the fault could not be defined or corrected in the EPS or

there were external impacts,^ 

 then it. was generally found there would be

reason to require some analysis or executive authority at the Space

Station System level. The sense and act functions would be at the EPS, 

n but there would be some analysis at the system level. This executive

authority could be at the Space Station System level or on the ground. 

re 

It was generally not partitioned tothe ground because of the followi

reasons:

1) Not minimum ground involvement.;

3 

2) Not minimum communications overhead; 

3) Lose communications, dose function.

There were some failures that were classed as not practical to automate

r.

onboard early in the program. They included solar-array pointing prob 

lens due to oscillations in a large flexible structure and plasma interaction. The above faults are recommended to be done on the ground.

It is expected that in the initial stages of the space station program,

the above faults would not be automated on the ground, but would be

handled by human experts. As the program matures, these problems could ^.

become candidates to be automated by expert systems software.

^. 

6-18

z.
6.3 RESULTS OF PARTITIONING OF OTHER AUTOMATION TASKS

i

A summary of the partitioning of the non- fault-handling automation candidates is shown in Table 6.3-1. A detailed discussion of several potential automation activities is presented in the following paragraphs.

6.3.1 Battery Reconditioning

Battery reconditioning basically involves deep discharging and recharging at a low current. Reconditioning is not necessary more than once

every six months. The autonomy-level requirements for the Space Station will be a major driver in the partitioning of this function. For

example, if the requirements were for 7-day operation without ground

intervention, then the decision could be placed on the ground. If the

requirement were for 8-month operation without ground intervention,

r

then the decisionmaking would have to be placed onboard the Space

Station.

EPS Partitioning - If the authority to make the decision to recondition

the batteries were placed in the EPS, it is likely the decision to permit reconditioning is still required by the system computer or ground.

Space Station System Partitioning - It is functionally acceptable for

the decisionmaking to recondition a battery to be placed at the Space

Station System level. Because this is an EPS decision, it could logically be assigned to the EPS. The decision as to an exact time to perform the battery reconditioning appears to reside logically at the

space station system level because there may be system-level impact in

taking a battery offline for reconditioning.

s
n

i+

1 

i

i ORIGINAL PAGE 18

Table 6.3-1 OF POOR QUALITY

Other Subsystems and Activities That Can .Impact EPS and

Partitioning of Correction Tasks

Analysis Task Partitioning

Correction Approach Fault

Time Definition Correction External

Fault Criticality Hardware Software Level Resources Impacts EPS System Ground

Flexible Minutes to No Yes System System Yes -- (1)1(8) (12)

Structure Hours

Cacillations;

Degraded

Solar Array

Pointing

Command and Minutes No Yes: System System Yes -- (1)1(8) (12)

Data Subsystam Degraded

Data Rates

Command sod None No Yes System System Yes -- (1)1(8) (12)

Data Subsystem, Loss of

CPU Power

EPS, Crew, None No Yes N/A N/A N/A (1)1(8) (12)

and Ground

Command

Interface

Thermal No, Minutes No Yes System System Yes

Control to Hours

Degradation Because of

or Failure Thermal

Masses

User Load Shorts, You Shorts, For EPS EPS Yes

Short or Fractions Yes;

Overload of a OverSecond. loads,

overloads No

No, Seconds

Notea:

(1) Sense Fault (5) Calculate Energy Capability (10) Generate New Load Sequence Commands

(2) Effect Load Control An Required (6) Isolate Fault (11) Store Failure Diagnostic Data

(3) Monitor State of Health (7) Correct Fault (12) Do Trend and/or Failure Analysis

(4) Calculate Total But Power (8) Isolate and Correct Fault (13) Bus Power Capability and Demand Analysis

Capability (9) Enable. Automatic Fault 6 Enable Power Management

Correction by EPS
Ground Partitioning - Due to the slow response time for this decision,

it is completely acceptable for this decision to be made on the

ground. The range of authority that can be assigned to the ground

ranges from none to the authority to decide when to perform the reconditioning. For the early Space Station, ground should decide the time

for battery reconditioning.

6.3.2 Battery Charge/Discharge Control

Battery charge/discharge control is a routine function that is performed continuously, 24 hours a day. It is a. function that is logically an EPS function. It is a function that is technically acceptable to

perform either at the Space Station System level or on the ground.

Performing the routine function on the ground would not be consistent

with the goal of reducing ground involvement.

6.3.3 Trend Analysis

The principal driver in considering onboard trend analysis is the cost

of nonvolatile, mass storage. As an example, 1000 eight-bit words 

pled every five minutes will require 104 megabytes per year. Once the

decision is made to do onboard trend analysis, there will be a requirement for onboard data-base management, retrieval software, and graphics

software for display.

Another decision is how to use the trend data onboard. If use of the

trend data is to be automated, then software is required. If the trend

data are to be used only manually by the flight crew, there will be a 

training impact to assure that the crew is at a certified level of competence to interpret and use the data. Another possibility is automated analysis of the trend data but concurrence by the crew or ground

before action is taken by the onboard software.

6-21
6.3.4 Caution & Warning

It is assumed that a computer will determine the caution, warning, and

shutdown status and make it available to the astronauts and ground

personnel.

The critical issue is the autonomy level of interpreting the computergenerated status, planning corrective action, and implementing the corrective action. If there is no autonomy, this would mean that a man

(astronaut or ground) would be required to interpret the status, plan

the corrective action, and input corrective-action sequences to the

Space Station.

The next higher level ofautonomy would have a computer interpret the

status, and plan corrective action. The computer would then advise the

man (astronaut or ground) of its analysis and corrective--action plan.

The computer would not take any corrective action. The man would be

required to input corrective-action sequences:to the space station to

implement correction. Different degrees of autonomy can be described

by the language the astronaut or ground controller uses to'command the

space station. The least autonomy would occur if a low-level language

similar to assemblylanguage were used. The next higher level would

occur if a high-level language were used.

Partition to EPS

Detection can beperformed at the EPS level because the measurements

are available at the EPS level. To place the analysis and corrective- 

action planning and implementation in the EPS would require sophisticated computer programs. There would be an increase in front-end pro-

? gram costs and a reduction in downstream operating costs. There would

be an increase in software development and validation costs. There 

would be an impact on computer speed, random-access memory,, and nonvolatile mass memory.

6-22
Partition to Space Station System

The detection function could be done at the system level, but it would

result in a higher communications overhead then performing detection at

the gPS level.

If caution and warning is put at the space station system level, there

are several options as to how to do it. The options are:

1) Astronauts interpret outputs and initiate corrective action; 

2`) Computer analyzes outputs, advises astronaut, astronauts initiate 

corrective action;

3) Computer analyzes outputs, initiates corrective action with astronauts' concurrence or initiate corrective action without astronaut

concurrence, and then inform the astronaut of the results of the

corrective action.

An advantage of completely autonomous operation is that the Space Sta

n

tion can be operated unmanned.

} Partition of the Ground - The detection function could be done on the

ground, but it would have a higher communications overhead than per

forming detection onboard. The different levels of ground autonomy are

the same as for the onboard system level, with astronaut replaced by

ground controller. A disadvantage of performing any of these functions

on the ground is that if communications are lost, the function is

lost. An advantage is that the Space Station can be operated unmanned.

6.3.5 Space Station Modular Buildup 

i

The growth philosophy entails a complex operation that is not understood in detail at present. With respect to partitioning, the-following scenario is postulated for the migration of authority and autonomy 

r

6-23
over the life of the program. In the first stages of the program, the

onboard systems can do automated checkout, but the authority to proceed

Is received from the ground. The ground would be responsible for the

decision to proceed during the validation and early program stages. As

the program matures, it is expected the authority to proceed could migrate from the ground=operations, crew to ground automated systems, then

to the onboard crew, and ultimately, to the onboard automated systems.

It is expected that detail checkout of the EPS assemblies will be partitioned to the EPS even on the initial station., but responsibility for

verifying the checkout and authority to proceed to the next step will

migrate f cri the ground crew, to the flight crew, and ultimately, to

the onboard automated system.
/.0 TASK S METHOD FOR AUTOMATION TASK ASSESSMENT AND IMPLEMENTATION

OBJECTIVE AND SCOPE

The objective of this task is to develop a system to use all of the information resulting from the first four tasks to provide a logical ordering of automation activities and derived benefits. The system

should serve as a logic flow for determining (1) what activ ; ties should

be considered for automation, (2) what is required to implement the

automation, (3) how the options compare, (4) availability of technology, and (5) impact on system performance.

SUMMARY

A study flow plan for automation assessment is shown in Figure 7-1,.

The first step is to define a specific study area such as how to automate the correction of overtemperature faults in batteries. Three basic inputs required for the study tires

1) System-level criteria,

e a) Space station autonomy/automction requirements, including autonomy level,

b) Keliability, maintenance and safety requirements,

„

2) Subsystem-level criteria,

^ 

^k a) Functional requirements and description, 

b) Subsystem interfaces,

pia 

c) Component functional requirements,

i

k

7-1

k

• ^` y .'— ^ ^ w •_ ^rw ^:./ sir.... ^' ^. V' w ,,.g .,. ".F's •
ORIGINAL PAGE 19

3) Mission operations, OF POOR QUALITY

a) Man—machine interface,,

b) Flight-controller functions (i.e., ground crew),

c) Astronaut / subsystem operational criteria and constraints. 

Task 1 Task 2 

Output Output Define

Study

Areas Description Faults and

of Component I mpacts

and Subsystem Definition

S/C Autonomy

Requirements,

or Constraints 

and Assumptions Categorize

Faults Analyze Fault

Reliability Correction

Requirements Options

and Assumptions

Task 3 Task 4 

Output Automation 3 Output Partitioning 

Candidates of Automation 

and Benefits Functions "'-----^ Study

Outputs Prioritize Outp 

Automation --Autonomy Autonomy

Candidates level of level of

SIC SIC

Figure 7-1 Study FZow plan for Automation Assessment 

r

7-2
The autonomy level is used to prioritize automation candidates and aid

in partitioning automation functions between the ground and the space

station. Reliability requirements are used to categorize .faults and to

aid in selecting a fault-correction option. Mission-operations criteria are used to define specific automation functions needed for orbital

operations.

Factors to be analyzed and defined in a detailed assessment of the

automation function are:

1) Impact;

2) Fault category;

3) Fault correction options;

4) Benefits;

5) Time-criticality;

6) Basic implementation, hardware or software.

M Basic technical elements in NASA's program development usually consist

of Phase A (planning, conceptual requirements definition, and design),

Phase B (preliminary requirements definition"and design.), and Phases C

and D (detailed design, fabrication, and integration; launch opera- 

tions; mission operations). It is assumed that Space Station-level

autonomy/automation and reliability requirements will be addressed in

each of these program phases, and their details will increase the pro-

" gram phases' progress. The method outlined here depends to a large extent on the system-level requirements available. Therefore, the extent 

to which automation assessment can be done at the subsystem level is a

function of level of details available at the station level. It is

" logical, then, to assume that the designers, especially during Phases- 

B, C, and D, would have access to top-level specifications and design-

" criteria documents covering not only autonomy/automation requirements, 

but also other high,-level functional criteria.

7-3 
Other inputs to the automation-assessment study are the outputs of

Tasks 1 to 4. The outputs of the automation-assessment study for one

specified area are the following:

1) Description of study area;

2) List of faults and activities from Task 2,

a) Impacts on subsystem and system (i.e., Space Station),

b) 'List of fault-correction options,

3) Automation Candidates trom Task 3,

a) Priority list of automation candidates based on spacecraft

autonomy level,

b) Benefits list,

4) Partitioning of automation candidates between ground and space

station based on station autonomy level:

a) Partition onboard automation between EPS and system based on

I , output of Task 4,

i

b) Time-criticality of function,

c) Basic implementation, hardware or software.

7.1 GENERATION METHOD 

7.1.1 Step 1 - Define Study Area

The first step is to define the study area. The study area should be

defined in terms of the descriptions used in Tasks 1 to 4. Examples of

specific study areas are;

7-4
1) Cable overtemperature;

2) Power converter tailures;

I'

3) Battery charge/discharge. control;

4) Battery operations management.

7.1.2 Step 2 Define Inputs

u

+9 _

The basic autonomy/automation requirements identified in Space Station

Definition Book 5 (Ref 9) are listed in Table 7.1.2-1.

Table 7.1.2-1

Summary List of Space Station Autonomy/Automation Requirements

ac_ ne utonomy S all Be Provided for: 

- Periodic Maintenance--Battery Conditioning' 

Resource Management--Power Management, Battery Energy Account

ing and Control

- Load Sequences Shall Be Autonomously Modifiable in Flight

Load Sequences Shall Be Autonomously Modifiable in Flight 

- Fault-Detection Limits Shall Be Reprogrammable 

- Machine-Autonomous Functions Shall Have Individual Enable/Inhibit

Control 

- Fault-Handling Responses Shall Be Reprogrammable in Flight` 

- General Approach Is to Place Flight Crew in a Supervisory Capacity

and to Program Computers and Machines to Do Most of the Work

7-5 

r

- Implement Autonomy and Automation to Ensure Cost-Effective Operation without Compromising Mission Success or Crew Safety

Space Station Shall Operate Independent from Ground Support for

TBD Time

Near-Term Activity Planning Shall Be Required Ouboard the Manned

Space Station

- Consumables Management Required on Board under Supervisory Control

of Flight Crew

Eliminate, As Far As Practicable, the Need for Real-Time Monitoring of Control of EPS by Flight or Ground Crew. Maximize Machine

Autonomy to Minimize Crew Involvement in Fault`tiandling

- Autonomous Handling of Low Faults. High-Level Unsafe Conditions

Shall Autonomously Initiate Safe State and Hold for Human`

Involvement

M hi A h
The primary driver for the partitioning of automation function between

ground and the spacecraft and for the priority ranking of automation

functions is the level ofautonomy of the spacecraft. For this study,

we have used the following definitions of autonomy based on the JPL

study in the Air Force's Autonomous Spacecraft Project (Ref 10).

Autonomy - The ability of a spacecraft to meet mission-performance 

requirement without human intervention or ground sup- 

$ port for a period of time.

r

Autonomy - Level of spacecraft autonomy; increasing level signifies

Level an increased number of automation functions.

The level of autonomy from Reference 10 is reproduced in Appendix C.

The following observations were made about the ten levels of autonomy

defined by JPL. For level 4 and under, ground intervention is required

for fault correction. For levels 5 to 10, the spacecraft is autonomously fault tolerant. As the autonomy level of the spacecraft increases more capabilityis laced aboardthe spacecraft and less de- p ',

pendence on the ground as the level of autonomy of the spacecraft increases. Figure 7.1.2-1 shows automation functions plotted against 

level of autonomy for levels 4 thru 10. The figure illustrates the

migration of automation functions from the ground to the spacecraft and 

the decreased dependence on the ground as the level of autonomy of the

spacecraft increases. 

System safety, reliability, and maintainability requirements will be

significant drivers in the automation. For the purpose of our method,

the basic reliability requirements from,the Space Station Systems Definition Book 5 (Ref 9) is cited as an example of the level of details

available during Pre-Phase-A and Phase-A periods. The excerpts from

this document are given in Table 7.1.2-2.

Define all basic design, performance, and mission-operations require

meats, including all functional interfaces with other subsystems and

experiments. 

7-6
ORIGINAL PAGE 19

OF POOR QUALITY

Does Task Deduction

and Internal Reorganization

u

cn0

Responds to External

Environment Changes 0 Takes Evasive Action to

>1 Protect from External

Threats

u

w Autonomously Fault-Tolerant

Navigates Autonomously

a

00

G

M

Performs Self-Preserving Actions (Safe-Hold)

0 - Requires Ground Updates for Maintenance Activities ^4

U

H

- Stores and Executes Sequences

- May Have Some Functionally Redundant Elements

Increasing Automation

4

C 1
Table 7.1.2-2 Excerpts from Space Station Book 5 on Reliabilityy

Requirements

The basic reliability requirement for the EPS is redundancy. The redundancy

requirement is that the EPS shall be designed to be fail operational/fail

safe as ;a minimum (except primary structure and pressure vessels) during all

operational phases (except assembly and maintenance or repair, all subsystems shall be designed to be fail safe as a minimum.

Applicable Technology/Readiness Assumptions

The intent here is to discuss reliability technology and assumptions applicable to EPS tradeoffs. Assumptions applicable include: (1) Safe operation of Space Station can be assured by an integrated reliability-maintainability approach, (2) Reliability-maintainability must be an integral part

of the design, development, test, and operation of each subsystem. Technology applicable includes: (1) hardware redundancy (i.e., replication of subsystem and systems), (2) functional redundancy (i.e., nonidentical subsystems and systems which satisfy common functional requiremental, and (3)

higher design margins (i.e., safety factors, high reliability parts).

Tradeoff studies of individual subsystems will address reliability-maintainability and safety requirements in arriving at optimum choices between technical options, costs, and performance.

Issues and Trades

A viable reliability-maintainability design approach for Space Station

through trade studies will be required early in the program. .Limitations on

time to restore equipment and on resupply 'due to failures must be evaluated

from the standpoints of reliability, maintainability, safety, and

performance.

The basic concept of Space Station long life (10 years to indefinite) with

continuous operation has a significant impact on long life technology. Some

conclusions can be drawn form the basic reliability requirements from Book

5. :Redundancy is a basic requirement. Therefore, redundancy management

will be a major automation task. A question, about redundancy is, shall the

redundant unit be operating continuously or shall it be in the ,standby mode

only.' A problem=to be faced in redundancy management is accessing the _I

state--of-health of a nonoperating redundant unit.

When autonomy requirements are added to the redundancy requirements a burden

is placed on the subsystem designer to assure the system's reliability is

increased and not degraded by the addition of redundancy. Redundancy sbould

not be used as an excuse for making the nonredundant element as reliable as

possible.

The reliability requirements will drive significant trade studies in the

automation assessment area. there are questions of how to implement redundancy. Shall redundancy be at the piece part level, and level within an assembly, the assembly (black box level) or at the subsystem level. The implementation of redundancy will set the 'level that faults can be detected

and corrected.
7.1.3 Step 3 Define Faults and Impacts

Obtain Information from Task 2 Output - Use the study area defined in

Step 1 and obtain the list of faults and impacts from Task 2 results.

Analyze Fault-Correction Options - This is the point where the subsystem designer can introduce the reliability requirements to generate a

trade study on the fault-correction options. Table 7.1.3-1 is a list

of reliability and redundancy question to be considered by the subsystem designer.

Table 7.1.3-1 Reliability and Redundancy Questions

Hardware Redundancy

What Level?

Piece-Part

Board Level in Black Box

Assembly

- Subsystem

ai Operating State

- Continuous Operating

Standby Nonoperating

Block Redundancy Implementation

- Block Size

Number of Blocks

- Redefine Impact Assessment for Each Successive Block Failure

Functional Redundancy

Can Nonidentical Assemblies or Subsystems Be Used to Satisfy Common Functional Requirements?

Increase Design Margins

Investigate the Possibility of Increasing Reliability by Increasing Design Margins in the Following Ways:

- ;Increase Component Derating Factors

Decrease Max Allowed Semiconductor Junction Temperatures

.dove Stringent Piece-Part Screening and Burn-In

- More Rigorous Worst-Case Analysis

ey4It is likely that there will be Space Station-Level requirements in the

above areas. It is also unlikely the subsystem designer will be able 

to have much impact in the above areas, but he should be aware of them.

{

L

7-9
Categorize Faults - Two categories can be used for faults:

1) Class I -- Mandatory correction;

2) Class II - Correction not mandatory.

From the need to eliminate single-point failures andthe requirement

for redundancy, one might conclude that it is mandatory to correct all

failures and the correction of, "not mandatory" to "correct" faults is

superfluous; however, there may be low-priority functions that will

only be required to fail safe rather than fail operate. Owing to the

capability of onorbit maintenance and resupply, some types of faults

could assign a fail-safe category, and correction would be by maintenance rather than by redundancy switching. One possible class of failsafe faults could be low-priority user loads that would be provided by

only nonredundant switching and fusing.

This is an area for the subsystem designer to consider--faults where

correction is not mandatory--but it is likely the vast majority of

faults will require mandatory correction.

For the automation-assessment studies, it is recommended all faults be

considered Class I (correction mandatory) unless convincing reasons can

be found to classify a fault as Class-II (correction not mandatory).

7.1.4 Step 4 - Determine Automation Candidates, Benefits, and Categories

Automation Candidates and Benefits - Identify the automation candidates

and benefits from the output of Task 3.

Prioritize Automation Candidates At this point, the level of autonomy

μ= 

of the spacecraft can be introduced to prioritize the automation candidates identified from the output of Task 3. A possible set of priority 

rankings is shown below:

7-1Q
f

1) Machine autonomy required;

E

2) Spme machine autonomy, but human involvement required;

3) Not practical to automate.

The task for the subsystem designer is now to go through the automation

candidates and prioritize them using the level of autonomy from Step 2.

7.1.5 Step 5 Partition Automation Based on Level of Autonomy 

Get Automation Partitioning from Task 4 Output - Use the detail study

area defined in Step 1 to obtain the automation partitioning for that

area from Task-4 output.

Use Level of Autonomy to Partition The subsystem designer can use the

w

_ level of autonomy of the spacecraft to complete the partitioning of

automation functions between the spacecraft and the ground. As an exw ample, if level 4 is the level of autonomy being studied, this would

require fault detection and safing to be on the spacecraft, but fault

correction to be on the ground. If the autonomy level were to be 5, 

the fault correction function would move from the ground to the space- 

s, craft to satisfy the autonomously fault-tolerant requirements for autonomy level 5. 

7.2 METHOD VALIDATION - EXAMPLE 1

7.2.1 Step 1 Define Study Area 

_ 

Fault detection, safing, and correction for do-dc converters (P3 type).

7.2.2 Step 2 - Define Inputs

r ' 1) Autonomy level of spacecraft--autonomy Level 5, the spacecraft is 

to be autonomously fault tolerant;

o

e

7-11
2) Reliability requirements--as an example, use Section 7.8, "System 

Safety, Reliability, and Quality Approach," Space Station Systems

Definition, Book 5 (Ref 9).

3) Define the basic functional requirements of P 3 and LPS.

7.2.3 Step13 Define Faults and Impacts

Identify Faults and Impacts (Table 7.2.3-1) - The subsystem designer

can go to Section 4.3 to obtain the list of P3 failure modes and operational impacts.

Table 7.2.,3-1 P3 (DC/DC Converter) FaZure Modes and Impacts

Failure

Mode Cause Effect

Operational

Impact

VOut Hi Shorted pass transistor, Damage loads. 2

.Failed OV Sensor.

Shorted pass transistor.

5

(Corrected)

Low Output Control circuit failure. Partial Loss of 3,4

Power power.

Efficiency Filter capacitor leakage, Assembly overheats. 4

pass transistor switching

loss increase, saturation

voltage increase.

VIn Hi System anomaly. Assembly may fail. 4

IIn Hi Hi-leak input filter Assembly overheats. 4

capacitor,

Hi Temp Thermal system failure. Assembly overheats. 4

IOut Component degradation, Output overloaded. 4

Overload load fault, or overload.
Analyze Fault Correction Options - In this step, the subsystem designer

can use the reliability requirements being used in the study to generate a fault-correction--options list for each of the faults identified

in Section 4.3. The obvious fault-correction option is to provide

block-redundant do/dc converters. Block-redundant do/dc converters

will be required. The question that may not be answered in this study 

is the number of converters required and the amount of redundancy, unless subsystem and component reliability allocations (e.g., O.965) are

available.

A summary of the fault-correction options is shown in Table 7.2.3-2.

For each do/dc-converter failure mode and cause, there is a list of

fault-correction options. One option that does not show explicitly in

'table 7.2.3-2 is the operational state of the block-.redundant convert-

_- ers. A question that must be resolved by the subsystem designer is,

r,

Shall the redundant units be nonoperating standby, or shall all the

f units be operating? Some of the problems involved in operating-ver-

¢" sus-nonoperating block redundancy are as follows. It is difficult to

determine the state of health of nonoperating units. The control could

r^

be made more complex to force a rotation of units from nonoperating

standby to primary operating to be able to check the state of health 

and its performance trend. An advantage of nonoperating standby is

r

that if there were a fault that propagated and failed all operating

F units, the standby would still be available. The advantage of having

an operating ,redundant unit is minimum response time to correct a 

failed unit._ Disadvantages of operating redundant units are inability

to operation them at maximum efficiency and the possibility of a fault

propagating and failing all the units connected to a do bus. 

Categorize Faults - There are two fault categories:

-1) Mandatory correction (Class I); -

2) Correction not mandatory (Class II)

7-13
Table 7.2.3-2 Fault Correction Options

Failure Mode Cause Fault Correction Options

Vout Shorted series - Series, redundant pass transistors

pass transistor. consider control: complexity increase,

decreased efficiency..

- Shunt regulator required on bus to

detect and blow P3 input fuse.

- Change to transformer-coupled

configuration.

- N-block-redundant do /dc converters.

Low Pout Control-CkT failure. - Selective piece-part redundancy.

Efficiency Switching-transistor - Periodically calculate efficiency

out-of spec loss excessive, and limit check.

low filter-cap leakage. - Switch to standby and use as backup.

VIn High System anomaly. - Detect and safe by turning converter

off.

- Add system-software redundancy to

prevent from happening.

IIn High Filter-cap leakage. - Refer to hardware designers for possible hardware fix.

- Periodically calculate and limit

check. Remove converter on limit

violation.

High Thermal subsystem - Add redundancy to thermal subsystem.

Temperature failure. - Modularizes thermal subsystem to

preclude total failure.

- Ensure that there is sufficient thermal mass in converter to make a slow

failure (seconds to minutes) to have

response time.

- Priority load shedding from overtemperature converter.

- Priority load transfer to a standby

converter.

Iout Load faults, - Fuse all loads.

Overload component - Provide active current limiting for

deg;:adation. each load.

- Monitor load Z and remove high-current load.

- Periodically monitor loads on bus to

ensure that there is adequate margin

from converter for fuse clearing.

- Make converter overload tolerant.
Inspecting the failure modes from the output of Task 2 for the dc/dc

converter, it appears than an efficiency fault could be classified II

(correction not mandatory), provided the heating did not exceed shutdown limit. Operation with nonoptimum efficiency would be possible. A

possible strategy would be to switch the low-efficiency unit to a nonoperating-standby status and then use it only in the event the maim

unit failed. Even though the low-efficiency fault could be classified

II, it is considered mandatory to periodically access the state of

health and check the efficiency.

Except for low efficiency, which can be classified Ii, all other do/dc

connector faults from.the output ' of Task 2 are classified I (mandatory

correction) because if they were not corrected, they would result in

loss of power to user loads.

7.-2.4 Step 4 Define Automation Candidates

y

1) The subsystem design-EP"can go to Section 5.2 to obtain the list of

^ automation candidates and benefits for do-dc converters (see Table 

4

7.2.4-1)•

2) Prioritize automation candidates - classify automation candidates in the following three categories:

a) Machine autonomy; 

h

-b) Some machine autonomy, but 'human involvement may be required;

r_) Not practical to automate.

Inspecting the do-dc-converter automation candidates of Table 7.2.4-1,

they are -all practical to automate; therefore, none are classif

III. Further checking of the automation candidate of Table 7.2.4-1 

leads to the conclusion that human involvement is not required; therefore, none are classified' II. Because categories II and III have been

4

7-15
ruled out, then all of the dc-dc converter automation tasks are classified I. What this means is that machines can be used to perform the

automation tasks of detecting, Bafing, and correcting the faults associated with a dc-dc converter.

Table 7.2.4-1

Dc/De Converter, p3 Type FaiZure Modes, Automation Candidates and

Benefits

0

Failure

Mode

Automation

Candidate Method Benefits

Shorted Series- 1, 2, 3 Detect overvoltage and 1, 2, 4.5,

Pass Transistor close shunt switch. 4,.6, 6, 7,

15

Low Vout 1, 2, 3 Sense Vout • When valid

undervoltage, prior and

load sheet and bus test.

Determine p3 good/bad.

Determine VIn good/bad.

If p3 bad, switch in

backup, priority load

connect. If p3 good,

source overloaded, limit

loads reconnected.

Efficiency 1, 2, 3 Switch backup on line, 3, 5, 7, 8

Below use low-efficiency one

Acceptable as standby.

VIn High 1, 2, 3 Monitor VIn- p 3 2, 6, 7, 15

shutdown On VIn Hi.

Shift loads to another

P3 , or -addiloads to one

with H2 VIn.

IIn High 1, 2, 3 Priority load-shed, then

if still failed, switch

off and bring on backup.

High Internal 1, 2, 3 Monitor temps, shutdown on

Temp overtemp. Bring backup

online. Priority load add.

Iout Overload 1, 2, 3 Monitor Iout , compare to

limit, support for programmed time, turn off

pause, restart.
7.2.5 Step 5 - partition Automation Task

The subsystem designer can go to Section 6.1 and obtain the list of

automation partitioning done without regard to spacecraft level of autonomy. The do converter automation partitioning is given in Table

7.2.5-1.

If a level. of autonomy is defined at the Space-Station level, the partition would be driven by it. For this demonstration, a level of au- 

tonomy of 5 for the spacecraft was chosen in step 1. The primary meaning of a level 5 is that the spacecraft shall be autonomously fault

tolerant and shall do fault correction without ground involvement. To

satisfy the requirement for autonomous fault tolerance and fault correction without ground intervention, all of the converter activities

r must be performed onboard the spacecraft.

7.2.6 Summary of Dc/Dc Converter Automation Assessment 

r 

r

Correction options in addition to block-redundant converters were considered. The low-efficiency fault may notbe mandatory to correct if

shutdown temperatures are not exceeded. All other converter faults are

4

t.

classified "mandatory correction." 

All of the converter automation candidates identified must not require

human intervention and should be done by machine. If station-autonomy--level 5 is used, it can be concluded that all functions should be

dome onboard the space station and not on the ground.- It is still the

s

responsibility of the subsystem designer to decide which fault-correc- 

tion options to implement and to justify the final partitioning between

a' the EFS and system onboard the space-station.

.'. + The partitioning of automation functions between the ground or the 

q spacecraft is a basic system-design decision. This method illustrates

a method of partitioning if a. level of autonomy of the spacecraft is

y

given. Use of the high-level autonomy requirement provides a means of

tracing the automation partitioning as well as the function-automated 

space station system requirements.

ieae

7-17
7.3 METHOD VALIDATION EXAMPLE 2

7.3.1 Step 1 - Define Study Area

Determine a method of extending cable life on a space station through

the application of automation.

7.3.2 Step 2 - Define finputs

1) Autonomy Level of Spacecrafts Level 5

2) Reliability Requirements:

Use Section 7, 8, System Safety, Reliability, and Quality Approach

of the Space Station Systems Definition, Book 5, First Edition,

November 1982;'

3) Define the basic functional requirements of the cable bundle in

question. 

7.3.3 Step 3 - Define Faults and Impacts, and Analyze Corrective Actions 

Faults and Impacts - The faults and impacts for cable are summarized in

Table 7.3.3-1. Note that insulation can be degraded by overtemperature _ 

condition; cable overtemperature can have numerous causes such as too

insufficient 

many wires in a bundle, excessive power transfer, or

heat-sinking. A contributing cause to not detecting and correcting the

overtemperature problem can be a lack of temperature monitoring inter- 

nal , to a cable-bundle assembly. The impact is a loss of fault-management capability. In the context of this study, there would be other

impacts,_ namely:'

1) Decreased operating power margins;

' 2) STS resupply mission• PP Y , ;

7-18
w

t

3) Onorbit maintenance;

4) Crew safety.

Table 7.3.3 -1 Cab Zing Failures/Activities and Impacts

Failure or Activity Effect Cause

Operational

Impact

Cable Opens Loss of power or Connector 3,4

signal to user Fault

equipment.

Wire-to-Return Loss of power or Insulation 3,4

Shorts signal to user fault.

equipment.

Wire-to-Wire Loss of power or Insulation 3,4

Shorts signal to user fault.

equipment.

Insulation None. Lack of 5,6

Degradation monitoring.

Due to Overtemp

Thermal Subsystem Increase cable temp, Failure in 4,6

Failure decrease allowable another

power through a subsystem.

cable.

Modular Buildup Miswiring open Inadequate 4,6

wires. interface

design or

assembly

procedure.

Analyze Fault-Correction Options - At this stage, the 'subsystem design 

k,

z 

er can

c

_ the reliability so _ Y

Pp

g isTnotfrequired. Ways to q Y 

rcrease reliability are to develop higher-temperature insulation; put

fewer cables in a bundle to limit cable-temperature increases; heatsink the cables; match the sources, loads, and cables to make it physically impossible to drive a cable overtemperature in the worst case';

and increase the reliability of the power-dispatch software to reduce 

the probability of a cable going overtemperature. This option study

provides a formal way for the subsystem designer to perform trade stud- 

ies to increase cable reliability.

7-19
The next option the subsystem designer can study is the use of block'

redundancy by adding cables. Questions to be considered are: How much

redundancy? Should it be operating or nonoperating? Other questions.

relate to redundancy level. Should . the cables, including connectors,

be redundant? Should the insulation be made doubly redundant, or 

should the wires in a cable be made redundant? Are there different

routes for redundant cables? It is necessary to ensure that there is

no mechanism that could damage both the primary and the redundant cable?

The above fault-correction options were included to focus on some of

the reliability studies that the subsystem designer could perform to

lay a foundation for meeting reliability 'requirements. The subsystem

designer could use the above studies to decide if the probability of a

cable overtemperature is high enough to warrant installing and monitoring the temperature detectors in the cable assembly.

Categorize Faults - There are two fault categories:

1) Mandatory correction;

2) Correction not mandatory.

r 

Inspection of the faults in Table 7.3.3-1 leads to the conclusion that

cable overtemperature may be classified as II for temperatures below

immediate failure if decreased cable life is preferred over higher op- 

erating temperatures.- If cables must not operate above a temperature

threshold, all of the faults are classified I (correction mandatory)

because failure to correct would violate the no-single -point-failure

criteria:

7.3.4 Step 4 - Define Automation Candidates and Benefits

The list of cabling failure modes and automation candidates and benefits is given in Table 7.3.4-1. 

The set of automation priority categories is shown below.

7-20
1) Machine autonomy required;

2) Some machine autonomy, but human involvement required;

3) Not practical to automate.

It is practical to automate all cable fault correction, except correction of faults due to station modular buildup. Detection and safing of

cable faults is possible, but correction of the underlying modular

buildup problem is not practical to automate without a definite design.

The thermal subsystem failure could be classified a II (Game machine

autonomy, but human involvement required). The reason is that a

thermal-subsystem failure may be classed as a high -level unsafe condition that will require human involvement, It is expected that machine

autonomy would be provided for cable fault detection, safing, and correction, but human involvement would be required in correcting the underlying thermal subsystem failure.

The cable-open, short, or overtemperature failures are classed as I

(machine autonomy required), because it is practical to have a computer

detect, safe, and correct these faults.

7.3.5 Step 5 Automation Partitioning

Correction tasks for the cable high-temperature and insulation faults 

should be partitioned to the spacecraft and not to the ground. A cable

fault caused by modular buildup of the space station has dual partitioning. Electrical problems associated with the modular buildup, 

fault detection, safing, and correction, are partitioned to the spac

craft. For the early stages of the program, it is thought that correction of the underlying problems associated with modular buildup are not

routing problems. It appears highly probable that human involvement 

will be required to resolve modular buildup problems. One study area

will be to determine where the expertise should be--with the flight

t

7-21
crew or wit

should be (

operations.

7.3.6 Summary of

ground. A possible conclusion is that the expertise

ground to minimize crew training for nonroutine

e Automation Study

E 1) Use of high-temperature insulation; 

2) Fewer cables in a bundle;

3) Heat-sink cables;

4) Match sources, cables, and loads to make it impossible to drive a

cable overtemperature;

` i

5) Load management; 1

6) Block-redundant cables;

7) Double insulation;

8) Multiple wires for cable;

' 9) Different physical routing for redundant cables;

10) Monitor critical cable bundle temperatures and provide appropriate

control.

A cable-overtemperature fault may not bemandatory to correct if it is 

decided to trade cable operating life for cable temperature. Otherwise, all cable faults defined are classified as "correction mandatory."

7-22
Problems arising from modular buildup are considered nonroutine, and

4! their correction activities will likely be partitioned to the ground

'f

early in the program. All other automation activities were partitioned

to the space station.
8.0 ARTIFICIAL INTELLIGENCE (AI) TECHNOLOGY AND ITS ROLES

8.1 AI TECHNOLOGY

Artificial intelligence is that branch of computer science concerned

with the design and implementation of programs that make complicated

decisions, learn, or become more adept at making decisions, interact

with a man in a natural way, and, in general, behave in a manner typically considered the mark of intelligence.

Intelligence is to be understood not as a property that, for example,

gifted mathematicians possess, but rather as a property all men and

some animals possess. Intelligence, in this sense, is the ability to

understand and process large amounts of information. Lt is the ability

to meet and cope with novel situations, to comprehend the Interrelationships between facts and concepts, and to generate new concepts and

relationships from those already known (i.e., already in the data

base). The artificiality of the intelligence means merely that the intelligence is achieved by means of technology. 

Scientific research done in AI covers a large area of theoretical

topics such as knowledge representation, knowledge acquisition, problem

solving and search, vision, theorem proving, and naturallanguage.

Though each one of these topics can be researched from the human-ability perspective, i.e., by asking how a man represents knowledge, acquires knowledge, solves problems, sees objects, communicates, etc,

researchers in Al are concerned with implementing the given ability in

computers. AI is not only a theoretical enterprise, it has definite 

and robust applications. The primary concern in the applications arena

is the design and implementation of expert systems and natural language

interfaces.

Aside from the general scientific curiosity of wondering how to design

and implement a computer program that learns, what advantages might'

obtain from the application of Al? Specific examples cited below are

some rather broad, obvious ones.

8-1

New
t

1) Augmenting our ability as humans to come to grips with the enormous

and increasing amounts of information that we are generating,

Z) Increasing the efficiency in man/machine interfaces (the ability to 

communicate with a computer in English) enables humans to get more 

work done and obviates the need for specialists in those hard-touse formalisms known as modern computer languages and data -base

query languages;

3) Creating systems (such as space vehicles) that can make crucial

decisions on their own when they have to;

4) Decreasing the effect of such human problems as forgetfulness,

fatigue, and emotional turmoil;

5) More rapid problem solving, and strategic and tactical planning, in

a wide variety of domains.

8.1.1 What Is An Expert System?

An expert system is an intelligent computer program that embodies the

knowledge of human experts in a particular domain of expertise. Expert

systems recognize situations, derive conclusions, make decisions based

on what they recognize, and recommend corrective and directive actions. All of this is done with a competence comparable to that of

human experts. Figure 8.1.1-1 illustrates the basic components of an

expert system. It contains a knowledge base, a rule base, and an inference engine. The knowledge base (sometimes called working memory)

stores the information (data);on which the'expert system operates. The

knowledge base is constantly updated as data are added or deleted. The

rule base is the component that gives the expert system its expert competence--that is, the _ability to make decisions, recommend actions, etc.

8-2

.... .rkxz..
I

Use

Control wledge

Natural Structure

FKnoe

Language

 1

i

(inference

Interface

i Engine) Rule Set

10 Expert System

Figure 8.1.3-1 Basic Components of an Expert System

Rules are of the form:

IF conditions A, B, and C are true, THEN perform actions X and Y.

Hence the rules are referred tows condition-action or situation-action

pairs,

x,

s

^'. The inference engine's job is to execute various rules depending on the

contents (data elements) of the knowledge base. Conceptually, the in- 

Terence engine's algorithm is a search and pattern match. It scans the 

rules, efficiently searching for a rule whose antecedent (the IFpart) 

matches the present state of the world, i.e., the facts in the present

knowledge base. If a match is found, the consequent of the rule (the

THEN part) is executed. The actions can be anything from querying or

advising a human user to performing a real-world action, such as uplinking commands to a satellite or moving a robot arm, to manipulating 

its knowledge base or rule set and modifying the behavior of the expert

system -itseif,

The rules of the rule set are obtained by interviewing a human expert.

This is a tricky and involved process because experts cannot just be

debriefed. Une could not, for example, walk up to a physician and say, 

"Tell me how to diagnose and treat a sick person," and hope to produce

an expert system. Human experts often are not quite clear about h

they do the things they do. Rather, the knowledge of their ,field must

be ferreted out by someone who knows (or discovers) what questions to

ask and more Importantly, how to ask them. The experts might be given

8-3
a

R ,

c

problems and asked how they would solve them, with each step in the

solution being fully documented. In fact, a step may require posing

another problem in order to explicate it. Interviewing is frequently a

lengthy process, but this is what forms the basis of the expert -system

technology. Building an expert system is not possible without an

expert.

All of the ability of an expert system stems from its matching antecedents and executing consequents. Almost all of an expert system's power

derives from the depth of understanding and the cleverness of human experts captured in its rules. It is also important, however, to develop

an organizational scheme for the rule set so that efficient searches

can be obtained, and it is important to have the knowledge base organized in a way that allows for rapid access, rapid addition and deletion

of facts, and, most importantly, the capturing of complex relations

between facts that make the knowledge base rich.

The problem of knowledge-base organization is referred to in the artificial intelligence community as knowledge representation. Probably

the most favored basic approach to knowledge representation is the directed graph. But the variations on this theme are numerous, and there

is some controversy as to which variation is "correct." At stake, it

is believed, is not merely an implementational formalism detail, but

the deriving of a representation that gives ( 1) the rightfacts in the

world, and (2) the right relationships between the facts.

►. Expert systems are designed for, and are most useful in, areas that 

r heretofore relied only on the judgment of human experts--that is., in 

areas where the problems to be solved are complex, not easy to delimit,

and require the use of high-level judgments and evaluations of situations. Thus, ;expert systems are not designed, or intended, to replace

all problem-solving software. Many problems require algorithmic solutious, but many do not; those that do not require experts to evaluate

"r and assess situations and then make judgments based on these assessments. Expert systems exist because such evaluations and judgments can

t

8-4
be transformed: into rules and then ikplemented in a programming

language.

Another feature that expert systems exhibit that increases their viability is that the rule set can be thought of as data--that is, as part

of the knowledge base. This enables the expert system to alter the

rules of the rule set in various ways. Under some circumstances, it is

possible to view this alteration of the rule set as learning; some expert systems have this feature and do become more adept at decisionmak

ing. This learning feature is obviously very desirable, and although

the technology involved is not yet commensurate with that for deducing

and inferencing in expert systems, it is only a matter of time before

expert systems incorporate some degree of learning.

8.1.2 Natural Language Interface

It is usual tot have a natural language interface to facilitate the use

of the expert system. A natural language interface is a computer program that allows an end user to interact with an applicationq program

using a "natural" language such as English rather than special menus or

special-purpose languages such as FORTRAN for programming, RAMIS for

data-base queries, or JOVIAL for command and control. A key advantage

to using a natural language interface rather than a more conventional

interface is ease of learning and use. Because English is used, no

special languages must be learned. Because its use is an extension of

a person's normal communication skills, a natural language interface

caft often be a highly effective way to interact with a computer program.

The appropriateness of a natural language interface in a given domain

is a human factors question; Hoer much will such an interface simplify

the activity of the end user? The answer turns on several issues.

Foremost is the range of 'interaction the user will have with the computer program. As noted above, a major difficulty with conventional

interfaces is that they often have highly rigid formats and require

substantial training. The larger the interactions, the longer the

8--5
training period and the more difficult it is to remember the specific

format required for a particular interaction. When there are only a 

few interactions (or types of interactions), the more conventional interface might be more appropriate. 

The more complex the program the user is working with, however, more 

likely is the user to want _greater interface with the computer program. For many automation activities, the program will be an expert

system with a wide variety of capabilities. The wider this variety,

the more desirable a natural language interface. Users do not have to

learn intricate, easy-to-forget aspects of a special -purpose query or

command language. In simply knowing what the system can do, a user can

couch a command or query in English and let the system figure out how

to respond.

This flexibility is quite important. Menu-driven interfaces have_a

certain amount of this flexibility also. A sophisticated, well-designed menu system can sometimes be used by individuals who have no

training for that menu, especially if they have experience with other

menu systems. With no training for a particular menu system, however, ^"

"solving" the menu--determining what commands are in which layer of the 

menu hierarchy--can be tedious and time consuming. Once the menu is

known, the layering of menus can become more of an obstacle than a facilitator. Some menu systems attempt to overcome this obstacle by allowing experienced users to type iu the commands directly without wad- 

ing through the menu. Unfortunately, this solution is really just a

special-purpose interaction language with many of the same problems as'

discussed above. It is, however, better than having only a standard

special-purpose; language because the users can fall back on menus if

the special commands are forgotten.

Natural language interfaces resolve the problems of forgetting and hav- 

ng to "solve" the menu. Users never need to learn a menu or a special

language; with no special training, users can interact with the system 

e with the same English they use for everyday communication. These "ordinary" language skills can be immediately transported from system to 

8-6 
• system as special-purpose language skills cannot. Highly sophisticated

natural language interfaces are also able to train the user in the capabilities of the end system, eliminating the need for highly detailed

knowledge of what the system can do before sitting down to use it.

An occasional argument against natural language interfaces is an alleged loss of efficiency--it takes too long to type complete, grammatical sentences. Once learned, it is claimed, a special--purpose language is much faster and easier. However, the ideal natural language

interface would be able to understand English with all the grammatical

errors, incompleteness, and inaccuracies found in everyday use. A

great deal of work presently is being done in these areas, and significant progress has been made. When continuous speech recognition is

perfected--probably sometime in the next few years--the obstacle of

needing to type will be eliminated. At that point, the utility of natural language interfaces will far outstrip that of more conventional

interfaces for a vast portion of applications.

Expert System Status - Expert systems have existed since 1965 when

_

DENDRAL was ir,t:roduced. DENDRAL infers the molecular structure of compounds from their spectrogram data. In 1974, MACSYMA was built.

MACSYMA is an expert system that does symbolic manipulations of mathematical expressions. Also in 1974, MYCIN was completed. This expert 

system is perhaps the most famous: it provides diagnoses and prescriptive advice to physicians treating patients with blood-related diseases. All of these expert systems (and there are many more) are being

used today either in research tasks designed to test their total capabilities or in narrowly confined aspects of industry. However, an explosion of new applications presently is underway throughout industry

and the universities. Within the next decade, expert systems are expected to move out of the laboratories and become increasingly involved

in human affairs. In fact, in 1981, Rl was installed for commercial

u

use by Digital Equipment Corporation for configuring their VAX-11 computer systems, y

8-7

r
8.2 CRITERIA FOR IDENTIFYING EXPERT-SYSTEM SOFTWARE CANDIDATES

A given candidate for automation warrants considering an expert system

aPiroach if:

1) For potential control application, non-real-time processing or very

slow response is required;

2) Automating the given activity reggires processing large amounts of

information that are available in random fashion;

3) The processing involved requires nonalgorithmic and heuristic procedures. In fact, for some activities, there may be no algorithmic

procedures, at least not to anyone's knowledge;

4) The automation activity needs, or results in, a high-level decision

(e.g., one that affects several spacecraft subsystems);

5) The software responsible for automating the given activity will be

frequently modified as a result of the dynamic influences of its

environment or as a function of time.

Another discriminator to identify automation tasks for expert systems

is complexity and how the tasks have been performed in the past. Simple tasks that are well understood "nd have algorithmic solutions are

not good candidates for expert-system solution. The expert-system solution could be an overkill. If the task ie complex enough that in the

past it could only be performed by a recognized expert, or group of

experts, then the task is a good candidate for automation by expert -

system software. 

8.3 POTENTIAL ROLES OF THE EXPERT SYSTEM IN P014ER`SUBSYSTEM AUTOMATION 

Several power-subsystem and space station system - related functions

appear to be in the domain of the expert system, and thus are good can

^ didates for an indepth evaluation of expert-system software applicability. Table 8.3-1 is a list of these functions. Note the level of 

I

8--8
t

w,.

0

complexity in electrical consumables management and battery-operations-management tasks. It is also emphasized that algorithmic and deterministic software modules are involved, along with expert system

module, in many of the potential applications. This simply means that

even if expert system approach is used, there is a large amount of engineering, algorithm development and validation efforts.

Table 8.3-1 List of Potential Expert System Candidates

Function

Electrical Consumables Management

Power Capability Determination

Load Profile Determination

- Load Shifting and Shedding Analysis

- Energy Balance Calculation

- Load Sequence Control and Load Command Generation

- Power Subsystems Reconfiguration

- Power Subsystem State Determination

Buttery-bperatious Management

- Battery Cell/Module State of Health Determination

- Battery SOC Trend Analysis

Battery Loadsharing Analysis and Control

- Battery Recharge Fraction Adjustment Analysis and Control

- Battery Cycle Life Analysis

Performance Trend Analysis

- All:Major Components

Fault Detection and Diagnosis

- All Major Components

Anomaly Analysis
e

9.0 CONCLUSIONS AND RECOMMENDATIONS

The significant conclusions and recommendations of the study are as

follows:

1) To meet basic station objectives and goals presently defined in the

NASA Space Station Definition Boole, all power subsystem automation

candidates defined in this study, except for anomaly handling, must

be implemented to a varying degree of automation.

2) Specific functions that have immediate high payoffs for onboard

applications are

a) Data Acquisition, Processing, and Storage,

b) State of Health Monitoring,

c) Built-in Test and Checkout,

d) Fault Detection, Isolation, and Correction,

e) Performance and Trend Analysis,

f) Integrated Array/Battery Controller and Load Management (Space 

Station Level),

• g) Electrical Consumables Management (Space Station Level).

Automation of any combination of the above f.unctions (a throughg g)

E will have a-significant beneficial effect on mission-operations

efforts on the ground. A detailed study is recommended to determine the effects of onboard automation of monitoring functions on

ground activities such as failure detection, consumables manage-

' u went, and crew and flight-controller training.

f 

9-1 

IL -
3) A key driver in when and what to automate in the subsystem is

spacecraft autonomy level, which must be defined at the program ^r 

level.

4) The best way to partition an automated activity between the EPS, 

spacecraft system, and ground is to first define each subtask required to be performed, and then assign each subtaak to EPS, system, and ground, in terms of:

a) Sensing, 

b) Analyzing, 

Acting,

5) -.2 real-time control consideration, the principal driver in hard-

wired-versus-software (i.e., using 'digital computer) trade is the

speed requirement for implementing that control function. Therefore, in general, all otfline or non-real-time tasks such as'monitoring, performance analysis, and fault diagnosis that require slow

response and are not in the control loop, can be done with a digital computer.

6) The best onboard-application candidates for expert systems for any

of the power automation functions appear to be for electrical-con- 

sumables management and battery-operations management. Potential

ground applications are in non-real-time fault assessment and mis- 

sion planning. An indepth research investigation is desirable and

' highly recommended to determine:

a) The range and domain of its applicability to power-system control functions;

b) Aaequacy of Al language for onboard use;'

9-2
c) Computer hardware (speed, memory) required to support expertsystem software.

7) A significant effort in engineering-algorithm development and validation is essential in meeting the 1987 technology-readiness date.

There are many implementation approaches to each automation function because they are done by software. Thus, future efforts in

,algorithm development must ,include optimization processes with simplicity and reliability in mind. It should be emphasized that al-
10.0 REFERENCES

1. Autonomous Spacecraft Project: Autonomous Spacecraft Design and

Validation Methodology Handbook. Issue 1, SD-TR-82-58, Jet

Propulsion Laboratory, April 30, 1982.

2. W. B. Gevarter: "Expert Systems: Limited But Powerful." IEEE

Spectrum, August 1983.

t

3. Patrick Winston: Artificial Intelligence. Addison-Wesley

Publishing Co., 1979.

I 4. Autonomous Spacecraft Program--ARMMS Demonstration Project. Report

I No. 7030-8, Jet Propulsion Laboratory, October 18, 1982.

5. 250-kW Autonomously Managed Power System (AMPS): Power Management

Subsystem Phase II Overall Review. Document No. 34579-075, TRW

Defense and Space Systems Group, Redondo Beach, California, October

27, 1981.

6. F. E. Lukens and R. L. Moser: "Programmable Power Processor."

16th IECEC Proceedings, August 1981. 

7. M. S. Imamura, R. L. Moser, and L. Skelly: "Design and Development

of Automated Power System Management," Final Report. MCR -79-540,

Martin Marietta Report,-JPL Contract 954924, July 1979. 

8. M. S. Imamura and R. :Donovan: Development of Single-Cell

Protectors for Sealed Silver-Zinc Cells. NASA CR-135054, ContractNAS3-19432, September 1976.

9. Space Station System Defintion, Book 5. NASA Headquarters, 

November 1982.

}

MM 10-1
14. M. S. Imamura, Dr. B. Khoshaim, and F. Huraib: "470-kW

Photovoltaic Power System for Saudi Arabian Villages." 1980 IECH'C,

Seattle, Washington, August 1980.

15. F. Huraib, et al; " Design, Installation, and Initial Performance

of 350 -kW Photovoltaic Power System for Saudi Arabian Villages."

4th European Solar Energy Conference, Stresa, I -taly, May 1982.

16. Solar Array Technology Development for Solar Electric Propulsion,

Fianl Report. Contract NAS8-31357, LMSC, January 1981.

17. Study of Multikilowatt Solar Arrays for Earth Orbit Applications,

Final Report. 33295-6001-UT-00, Contract NAS8 -32988, TRW,

10. M. H. Marshall: "Goals for Air Force Autonomous Spacecraft." JPL

Internal Document 7030-1, Preliminary Issue, February 1981.

11. Functional Requirements for the Demonstration Systems, Autonomous

Spacecraft Program - ARMMS Demonstration Project. 7030-7, Jet

Propulsion Laboratory, September 1982.

12. Assessment of Autonomous Options for the DSCSIII Satellite System.

SD-TR-81-87, Jet Propulsion Laboratory, August 1981.

13. Military Space Systems Technology Model. Vol III, USAF Space

Technology Center, 1983.

September 1980.

18.,R. E. Patterson, " Cassegranian Concentrator Solar Array Exploratory

Development Module." 17th IECEC, August 1982.

19. Study of Multi-Kilowatt Solar Arrays for Earth Orbit Applications,

Final Report. SSD80-0064, Contract NAS8-32988, Rockwell

International, May 1980.

10-2
20. W. R. Scott and D. W. Rusts: Sealed-Cell Nickel Cadmium. Battery

i

Applications Manual. NASA Reference Publication 1052, 1979.

21. J. K. McDermott: "Status and Evaluation of Air Force/Hughes

Ni-HZ Prototype Cells." Interoffice Memorandum, Martin Marietta

Corporation, September 21, 1982. 

22. Robert L. Cataldo and John J. Smithrick: Design of a 35-Kilowatt

Bipolar Nickel-Hydrogen Battery for Low-Earth Orbit Applications. 

NASA;'Tech Memorandum 82844, NASA Lewis Research Center, Cleveland,

Ohi l , 1.982

23. YUawrence H. Thaller: Nickel-Hydrogen. Bipolar Battery Systems.

/NASA Tech Memorandum 82946, NASA Lewis Research Center, Cleveland,

Ohio, 1982.

L4. Sid Gross: Analysis of Regenerative Fuel Cells, Final, Report.

D180-27160-1, Boeing Aerospace, Co., November 1982.

25. Julian F. Bedu: "The Role of Fuel Cells in NASA's Space Power

Systems." 14th IECEC, August 1979.

26. F. C. Schwartz: ' An Improved Method of Resonant Current Pulse

Modulation for Power Converters." Power Electronics Specialists

Conference Proceedings, 1975., p 19 4 

27. J. W. Mildce: " Power Management for Multi-100-kW Space Systems."

4 

15th IECEC, August 1980. 

' 28. John R. Sheic, Robert E. Corbett, and Michael C. Glass: "Series vs

Shunt Regulators for Power Control in Satellite Power Systems."

k-r, 16th IECEC, August 1982, p 235.

` 29. Willie. A. Magee, Robert M. Martinelli, and Joseph H. Hayden:

^t "Solar Array Power Management." 17th IECEC, August 1982, p 171.

`' __ 10-3 
30. J. Cassinelli: Solar Array Switching Power Management Technology

for Space Power Systems, Final Report. Final Report TRW 37243,

NASA CR-167890, September 1982.

31. M. C. Glass: "A Six-kW Transformer-Coupled Converter for Space

Shuttle Solar Power Systems." 15th IECEC, August 1980, pp'767-772.

32. G. R. Sundberg and W. W. Billings. "The Solid State Remote Power

Controller: Its Status, Use, and Perspective." PESC, June 1977,

p 244.

33. Engineering-Dependable Protection for an Electrical Distribution

System. Part III, Component Protection for Electrical Systems,

Bussmann Manufacturing Division, McGraw-Edison Company, 1975.

34. R. E. Corbett High-Voltage High-Power (HVHP) Solar Power System.

AFWAL-TR-81-2103,, April 198'`x„

35. S. M. Weinberger: Preliminary Design Development of 100-kW Rotary

Power Transfer Device. NASA CR- GE-B15D4215 General Electric

Company, Space Division, Philadelphia, Pennsylvania, Contract

NAS3-22266, March 1981.

36. W. D. Cooper: Electronic Instrumentation and Measurement

Techniques. Prentice. Hall, 1978.

-37. D W. Harris: "The Modular Power Subsystem for the Multimission

Modular Spacecraft." 13th IECEC, August 1978.

38. G. Repucci, I. M. Schulman, and W. Wright: "Flight Performance of

the High Energy Astronomy Observatory (HEAO 1) Power System." 13th

IECEC, August 1978.

39. M. Tasevoli: "OAO-3 End of Mission Power Subsystem Evaluation.

17th IECEC, August 1982.

10-4

-
40. Aerospace Corporation Data, H. Weiner, December 1983.

41. J. Hayden: "An Electrical Power Subsystem for the Defense

Satellite Communication System — Phase III." 13th IECEC, August

1978.

42. R. E. Corbett: "High Voltage High Power System. 13th IECEC,

August 1978.

43. A. Salim: "A Simplified Minimum Power Dissipation Approach to

Regulate the Solar Array Output Power in a Satellite Power

Subsystem." 11th IECEC, August 1976.

44. G. Repucci "FLTSATCOM - A Power Subsystem in Evolution. 18th

IECEC, August 1983.

45. Private Communication with H. Weiner, Aerospace Corporation,

December 1983.

;LL 46. H. N. McKinney and D. C. Briggs: "Electrical Power Subsystem for

the Intelsat-V Satellite." 13th IECEC, August 1978.

47. J. Segrest: "High Voltage DC Power, Systems for Aircraft." 

IEEE-NAECOM, May 1971.

r

c

MNS

10-5-
APPENDIX A

STATEMENT OF WORK

A. The contractor shall provide, the necessary personnel and facilities

to conduct the required studies and perform appropriate assessments and

trade-offs to define and establish the automation technology required

to support a multi-hundred KW electrical power subsystem for a space

platform or space station. This study effort will not rely on a specific reference design but will be more generic in nature. Consequently,

the study must include a broad characterization of subsystem parameters, functions and operational scenarios.

B. Specifically, the contractor shall perform the following tasks:

Task 1. Characterize and classify a generic electrical power subsystem

based on a conceptual system block diagram(s) that includes a definition of the functions, characteristics, voltage types, voltage block

diagram. This task shall be done for each phase in a mission profile

(i.e., pre-launch, launch, orbital operations, on-orbit service/maintenance/resupply, etc.)

Task 2. Using the results of task #1, develop a comprehensive list of

all potential faults and/or activities that could impact the power subsystem and prevent it from performing its intended mission. This will

include such parameters as operational environments, single point fail

ures, insufficient redundancy, human error, over-stressed conditions,

inadequate protection, inaccurate sensors, etc.

Task 3. Based on tasks 1 and 2 above, generate a candidate list of

automation activities that could eliminate and/or minimize the identified impacts as well as those activities not related to impacts that

can provide both a short term and a long term benefit to the power subsystem if incorporated. This would include such activities as redundancy, derating, fault management, shifting burden from man to machines, algorithms for management strategies, partitioning of functions

between the space station and ground, hierarchy control of functions,

etc. Perform an assessment and trade-offs on all automation activities

to determine such aspects as range of benefits to be achieved ( performance, cost, weight, volume, complexity, etc.), timeline for implementation, system performance improvements, reduced operations burden, relaxed critical measurements (i.e., red line values, limitations, etc.),

preprocessing of data, _ flexibility in scheduling, and other similar 

activities that will improve performance, reduce costs, reduce dependence on manual involvement, increase operational life and reduce the

overall life cycle cost of the power subsystem. 

Task 4. Partition the automation activities between the power subsystem, the space station and the ground to maximize the overall configuration in terms of operations management, information flow, controls

distribution and system performance. Establish criteria for the partitioning and generate rationale for the resulting configuration. A comparison of the benefits before and after the partitioning shall be done

to determine the value of the benefits derived.
Task 5, Develop a system for utilizing all of the information and data

resulting from the above tasks to establish a logical ordering of the

automation activities vs. derived benefits. Benefits begin such elements as costs, time, reliability, fault isolation, system protection,

system recovery, self monitoring and reconfiguration, etc. The ^end

product 

of 

this task should bt in a format such that the requirements,

characteristics, constraint-a, values, methods, and other parameters

that describe introduced and proee-,3sed to provide system level engineering approach to the automation of that power subsystem. In essence, the resulting system or plan will serve as a "logic flow" methodology for determining what functions and/or activity sho'lld be considered for automation, what is -required to implement the automation

(options), how do the options compare (cost, complexity, value, etc.)

interactions with other elements and/or activities, availability of the

technology, impact on system performance, etc. Therefore, the developed system will test the application of automation technology, evaluate it, provide directions and quantify benefits. Specific examples

shall be demonstrated to verify the concept.

GUIDELINES, CONSTRAINTS AND INSTRUCTIONS

The following are intended to focus the efforts in conducting the tasks

for this study.

A. The space station electrical power subsystem is targeted at 250 KW

and probably modular,. The space station is.large, in low earth orbit,

unmanned and manned and has a life of greater than 10 years.

B. Inputs involving automation activities at the space station level

will be provided by the COR. JPL is conducting an "Autonomous Spacecraft System Technology" task that will define autonomous system design

requirements, develop system architectures (including partioning of

functions) and identify enabling and enhancing technology needs. MSFC

and JPL will coordinate the respective tasks and all inputs from this

effort (specific partitioning of functions, automation criteria, command and control functions, centralized vs. distribut: ,."d controls, etc.)

will be provided only through the COR.
APPENDIX B

SIMPLIFIED BLOCK DIAGRAMS OF VARIOUS SPACECRAFT PHOTOVOLTAIC POWER

SYSTEMS

This appendix contains simplified block diagrams of selected photovoltaic power systems on LEO, medium altitude, and GEO spacecraft. Representative terrestrial and aircraft systems are also included.
F

olar Series

rray Regulator

URIGINAL PAGE 19

OF POOR QUALITY

Load Loads Control

Charge

Control

Battery

Figure B-1 MMS Power System, LEO Application (Ref 37)

Solar Power

Array - Distributor Loads

Shunt Battery

Regulator Charger

Shunt Battery

Q Radiator

r E Figure B-2 HEAO Power System, LEO Application (Ref 38)

AUXILIARY 

ARRAY

r POWER UNREGULATED

MAIN REGULATOR BUS

i, AHRAVPPI UNIT. ^ 

;. 

? POWER 

CONTROL

UNIT

• REG

.. •

SHUNT ^- BATTERILS f_ 

OsSC—c- —

n

SO WAVE ._._ _ J

BVL

CONTROLLER

I)

IL =

f

ARFjAY -BOARD D/A ^ OFF

V' I

LOON

MPUTER JCONVERTER ENABI F.

ONBOARD

PROCESSOR

Figure B-3 0A0-3 Power System,, LEO Application (Ref 39)

r

B.-2

-..
OR1QINpL PAGE 13

QUALITY 

OF pOOR Q 

Solar

Array _— --► Loads

Shunt Charge Boost

Voltage

Load

Regulator Control Control

Converter

Ion Loads Shunt

Radiator

Battery Engine

Figure 6-4 P80-1 Power S^sterr, Medium OrI?it AppZ eation (Ref 4/I

UpperI' Battery Battery I Power Power Power

Solar I Charger Boost Control Control Control

Array Converter

J

r Dc/Dc Dc/Dc Dc/Dc

4 Converter Converter Converter

T y r l of 3

Lower

FReuSulatorl

itial 

Batter

^

Solar nt

Array

L — ! Loads Loads Loads

'' Figure B-5 DSCS-1II Power System, Medium Orbit AppZicat on (Ref 

SOLAR ARRAY NO. T

IOSV S/A

r

. lOSV^

R"6. BCC t^" I —

.BUS SIRE -

;. lOSV 'LOAD

SECTION 80 CELLS= n 105V CONTROL

RTN BUS

I F L TI

' ISOLATION

28V5/A 2BV

105V

^: NRCL

2BV.

REG:, BCC I BUS. 

SECTION 22 CELLS—' PYRO

4RT 

BUS A

US.

 C

'

ONTROL DEPLOY MOTOR ' Afl INST

'& CONTROL EED% 

.SOLAR ARRAY NO. 2 BOX 

lOSVTS /A I`

REG d BCC :^... •

I

^VE

I

HKLE

105V SPACECRAFT ! BOOSTER 

e ..

SECTION i 105 LOAD i.0AD5 i ADAPTER

CONTROL

E'X

CRETE 1

& FAULT ONTROL 2BV 5/A

REG& BCC - 28V

ISOLATION

EXPERIMENT 

i,i-

SECTION + LOADS I

PYRO

ALL BATTERIES BUS 8 

DEPLOY MOTOR 20 AH L POKER CONTROL 8 DISTRIBUTION UNIT

. i IOSVd2BV5PG ^^^^^'^•^^•^^^

f _ 1 

Figure B-6 SIRE Power System, Medium Orbit Application (Ref 43) 

B-3 _...

" .^ _ .......0 a... .. ♦ s ^.^ • '..rte-^1 i ^

.i. .:
♦27 + 1-V 

Regulated Bus

t

OF POOR QUALITY

P

w 1601ation No load -ol*— Shunt Regulator Operating Sequence W Full Load

+2i-V

Regulated

bus

10 Parall

Strings of

28 Cells

Series

Tap P

10 Parall,

Strings o

56 Ce11S

Serias

r-- -

LS

-

PSRC w 

--- ---

Solar Shunt 

Filter it R^^ ontrolle

' Array Fegulator

-^

'--- ----Jrr

I

Charge Discharge I Charge Discharge

' Regulator 1 Regulator 1 Regulator 2 1

 Regulator 2

a. 

Solar

Array 

t

Nickel-Hydrogen Nickel-Cadmus

i - battery battery

Regulated 

μ ,. Raturn 

Sinlle-Point Ground

Figure B-7 NTS-2 Porter Szystem, Medium Orbit AppZieation (Ref 42)

B-4

^^R 
ORIGINAL PAGE IS

OF POOR QUALITY

Upper

Solar

Array

Load 

Control [-'Loads

Lower Main Battery Dc/Dc 

Solar Solar Charger Converters

Array Array

Load 

Battery Control

Loads

Figure B-8 FLTSATCOM Power Systems, CEO Application (Ref 44)

Upper

w Solar

Array r 

Load

Dc-Dc Control

Charge Converter 

Control

4

-i Loads TWTA 

Converters

" Lower PartialBattery Cell 

Solar Shunt Bypass Comm 

Array Regulator Loads

w 

Figure B-9 INTELSAT-3 Power Sryst.:m, GEO Application (Ref 45)

4

arm B—S
I

Dc/Dc

Converter

____L_

Charge

Control

ORIGINAL PAGE 19

a OF POOR QUALITY

Charge

Solar

Array

I

Uppejr

Solar

Array

Loads

I I I -- I

Lower Partial

Solar Shunt Battery

Array Regulator

Figure B-10 INTELSAT-V Power System., GEO Application (Ref 46)

IN Test

Loads 215 to 300 Vdc Inverter,

1 0 '"'^A 1143.85 kKV =300kV

Auxilia Transformer

Vf 1500 kVA Al Uyaynah/Al Hejrah

Photovoltaic Bat-teries Loads (Bus 2)

AOray

350 kW

Auxiliary

Battery

Charger

UPS

Control Loads rans=er

Data Control I 

=500kVA:] 

Jubaylah

DieselAl

Loads (Bus 1)

Powered

Instrumentation Control & Generators,

& Data Recordi 9 Display I MW

227/480 Vac, 3 Phase,

60 Hz

Features

Integrated Array Bus Voltage and Battery Charge Control via Desk-Top

Computer (HP9845)

Four 120-Cell Lead Acid Batteries, 1.6 MW-h Total

240-Vdc Bus Tied to a Single 300. kVA Inverter

350-kW Point Focus (40X) Silicon Solar Array

Figure B- 1 1

Simplified Block Diagram of 350-kW Photovoltaic Power System

for Saudi Arabian Villages (Ref 14., 15)

B-6
ORIGINAL PAGE 19

OF POOR QUALITY

470 VOLT VC

GlM GLN !=i MA. A.V LIM GTN

1 1 .^, Cl 4 :t

wC. MC TLC CA7 MA. 1 Y 1 MONIIOA HC ^ HC ^ wC

=Vf TI 

LM 710 VOC . M41N Illf C RM 7T0 VDC MAIN AtIS

NC MC NC MC wC MC MC MC MC

.

j

M n •

dl

02

r i

14te SS IC SSLC. I LHILTISSTNTIALAVI I I 0400ISSSNl1ALAUS. I SSLC LUC 

TOAD LOAD LOAD "CI II "C LOAD LOAD

O 0 O

AI DUVDANi I

t

I

) = Tf 7Dt/ .AUf:f 

To AIG11T 1/0 TS$30 TI, YUSES I LMSMSTIu/Ow1R LM OCfOC I AM CK TX ON.STSTIMICiSER

SIDE DATA TIRMIHAL MANAGIMI MT CONVIATIA. I I CONV[fi T IE MAh AGl414T - T[ MINAL

suit{ DATA IAOC IfsOA 0— 11DCISSOR

we MC

Go

..

moil ( L I — I cRlw ^^77//

CONTROL- I. I COMTROLJ ` I lM7t VOC 40 11 YOC EK 1111 NTIAL AVS I LSSLNTIAI iU4

i HC

^, LC tC 

^- L J L—

SSIC INf TRV'Y[NT START/sA ll11 T' - T VoIT ^. 

t%M7 =VS 4T7L' 

INV7M TLR

t 1'. wC

SS

lc

T 

718V lov .DOH=71V. AVU.STIAi

LOAD LOAD LOAD LOAD

Figure B-12

Advanced Aircraft EZectricaZ System, 270-Vdc Bus, Using Solid State

ControZZers (Ref 47)

I

A

B-7
APPENDIX C

LEVELS OF AUTONOMY

(Reproduced directly from Ref 12, pp 125-127.)

In performance of a space mission, four major policy goal categories

have been identified. These are:

(1) Ground interaction reduction.

(2) Spacecraft integrity maintenance.

(3) Autonomous features transparency.

(4) On-board resource management.

The extent to which these goals have been accomplished to date has been

through a mix of functions resident in either the space segment or the

ground segment. Furthermore, the ground segment, as an integral part of the

total system, has been responsible for accomplishing maintenance, navigation

mission control, and payload data processing,. Thus, only spacecraft

autonomy has been needed.

The levels of autonomy described in this appendix are used to define a

step-wise increase in spacecraft autonomous capability. By proceeding

through the levels, autonomous capability is increased in the space segment

and dependency on the ground segment is reduced.

The levels of autonomy are described as follows; 

Level 0. A design without redundant elements which meets all mission

needs by operating without the on-board control of state parameters (such as 

rates and _position). May respond to a prespecified vocabulary of external

commands, but cannot store ,command sequences for future time-or eventdependent execution or validate external commands. (An open-loop, on-board

system controlled from the ground.) 

Level 1. Includes Level U but uses on -board devices to sense and

control state parameters (such as rates andpositions) in order to meet 

performance needs. Is capable of storing and executing a prespecified

command sequence based on mission-critical time tags. Will respond to

prespecified external commands, but cannot validate external commands.

Functionally redundantmodes, may be available for a degraded-performance 

mission.

Level 2. Include Level 1 plus the use of block redundancy. Groundcontrolled switching of spare resources is required. Uses cross-strapping

techniques to minimize effect of critical command link (uplink) failure

modes. Significant ground-operator interaction is required to restore

operations after most faults if spare spacecraft resources are available.

C-1
Requires operator interaction for fault recovery. Is capable of storing and

executing mission-critical events which are sensed on-board and may be

independent of time.

Level 3. Includes Level 2 and is capable of sensing prespecified

mission-critical fault conditions and performing predefined self-preserving

(entering a safe-hold state) switching actions. Is capable of storing

contingency or redundant software programs and being restored to normal

performance (maintaining the command link with a single link fault) in the

event of a failure. Timers may be used to protect resources. Requires

ground operator interaction for fault recovery. In general, the failure to

sense and/or execute the mission-critical event(s) will cause mission

failure or loss of a major mission objective.

Level 4. Includes Level 3 but is also capable of executing

prespecified and stored command sequences based on timing and/or sensing of

mission events. Ground-initiated changes to command sequences may be

checked on-board for syntactical errors (parity, sign, logic, time). Uses

coding or other self-checking techniques to minimize the effects of

internally generated data contamination for prespecified data transfers.

Requires ground-operator interaction for fault recovery. In general,

failure to sense and/or execute the mission event(s) or state-changes

(excluding failure-induced state-changes) will cause.mission failure or loss

of a major mission objective.

Level 5. Includes Level 4 and is also autonomously fault-tolerant. Is

capable of operating in the presence of faults specified a-priori by

employing spare, sys-tem resources, if available, or will maximize mission

performance based upon available capability and/or available expendables

(i.e., self-loading of contingency programs) without ground intervention.

Level 6. Includes Level -5 and is capable of functional commanding with

on-board command-sequence generation and validation prior to execution.

Functional commanding may include a high-level, pseudo-English language,

spacecraft-system/operator communication and control capability.

Level 7. Includes Level 6 and is capable of autonomously responding to

a changing external environment, defined a-priori, so as to preserve mission

capability. The capability to change orbit in order to compensate for

degradation Or to protect the satellite from an external threat is

included.

Level 8. Includes Level 7 and is capable of operating successfully

within the presence of latent design errors which could cause loss of major

mission objectives.

Level 9. Includes Level 8 and is capable of task deduction and 

internal reorganization based upon anticipated changes in the external

environment. This situation is exemplified by multiple satellites operating

in a cooperative mode. In the event of a satellite failure, remaining 

satellites would detect autonomously the condition (task deduction) and may

generate and execute orbit-and spacecraft-reconfiguration commands.

C-2

ti
Level 10. Includes Level 9 and is capable of internal reorganization and

dynamic Las deduction based on unspecified and unknown/unanticipated changes

in external environment. The system will strive to maximize system utility.

Thus, mission objectives should be adaptive and automatically reprogrammable.

System resources should be maximized to preserve task adaptiveness.