CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL 160 safe and functioning, should such an event occur. Generically, the concept of providing backup capabilities is called “redundancy.” Redundancy can be implemented by having multiple systems that perform the same function, such as multiple radios or computers. For less-critical functions, redundancy might mean having one system that can be powered from different sources. When designing the overall redundancy of the ISS, engineers defined the USOS EPS as separated into two domains: the 1/4 domain and the 2/3 domain. The 1/4 domain is made up of power channels 1A, 1B, 4A, and 4B the 2/3 domain consists of power channels 2A, 2B, 3A, and 3B. As noted above, critical ISS systems are split between channels 1A and 1B on the 1/4 domain and channel 2B on the 2/3 domain. However, not only are critical loads split between these domains, so are auxiliary and payload equipment. Two physical features define the power domains: cooling of associated EPS devices by different ETCS loops, and the placement of associated core power channels on opposite sides of the ISS (i.e., port and starboard). The ETCS Loop A, while powered by the 1/4 domain, provides cooling for critical 1/4 domain EPS hardware. Similarly, the ETCS Loop B, while powered by the 2/3 domain, provides cooling for critical 2/3 domain EPS hardware. Placing the core power channels on opposite sides of the ISS eliminates reliance of those channels on the same Solar Alpha Rotary Joint (SARJ) for solar pointing. Failure of a SARJ would greatly degrade the capability to orient half of the power channels for solar pointing, but would only affect the core channels of one power domain. However, redundancy was built into the SARJs themselves, and they can be controlled by either domain (see below). Overall, redundancy of ISS systems is provided by identical redundant equipment (i.e., a prime and a backup) that are separately powered by one of the two power domains. However, some device power supplies were designed to have multiple inputs, meaning the same piece of hardware can be powered by the two different domains so that if one should fail, operation would not be interrupted. Dual power feeds are more common to payload equipment where power redundancy supports mission success for that unique payload hardware, versus separate fully redundant critical systems equipment required for ISS safety. Off-nominal—Power Channel Cross-ties Failure of a power channel can have wide-ranging impacts to both the ISS systems and the payloads. The USOS power system was designed to be able to electrically connect the primary power outputs of the channels, called “cross-tying,” to provide some flexibility in the face of a power channel loss. The channels can be tied together in a specific order using the Main Bus Switching Units (MBSUs), which will be discussed in more detail. Originally, the capability required that a power channel output be removed before another channel could be tied to additional downstream loads to prevent the two power channels from trying to power the same bus, which could potentially cause instability and additional failures. This would require the deactivation of all loads associated with the channel being shut down. Known as a “cold cross- tie,” this capability works well when a channel shutdown/loss is unavoidable or unexpected. However, if a power channel was planned to be shut down, it would be beneficial to allow downstream loads to remain powered and seamlessly move them to a good power channel. The operations and engineering teams developed a process of using software and hardware already on board to perform a seamless power channel handover or “hot cross- tie.” Depending on overall power demands, some loads on either channel may still need to be powered down to prevent overloading the good channel. The voltage set points of the suspect channel would be lowered within the Primary Power System control range by using software and firmware commands. The MBSU cross-tie function would then be used to electrically connect the suspect channel to a good channel—one operating at the nominal Primary Power System voltage—without the loss of all downstream loads. In other words, the solar array output of the suspect channel would be taken off-line and its batteries would be configured to discharge at a lower voltage than the batteries of the good channel. Therefore, when the suspect channel sees the nominal voltage level, its batteries will start charging, and the good channel will supply power to the downstream loads. The Primary Power System portion of the suspect channel can then be gracefully deactivated or configured to a dormant/keep- alive configuration until required maintenance is completed.