4
$\begingroup$

This is me, having too much free time and deciding to learn how the electrical system of the Space Shuttle worked. So, because I couldn't find any "easy to read" diagram online, I built a high-level diagram of the electrical buses by using the SCOM as a reference:

Electrical Diagram

Full size available here.

So, let's recap what we see in the diagram:

  • 5 possible sources: 3 fuel cells, 1 Ground Support Equipment, 1 power from ISS
  • 23 DC buses: 3 main buses, 9 control buses, 3 essential buses, 6 payload+cabin buses, 2 pre-flight buses
  • 2 DC buses for the 120V payload (OBSS and the ISS payload)
  • 3 AC inverters
  • 5 AC buses (3 output of the inverter + 2 AC payload buses)

Most DC buses have a triple-redundant source (for instance ESS 3AB can be powered by fuel cell 3, main bus A, and main bus B).

As a comparison:

  • An Airbus A380 has only 4 DC buses
  • A Boeing 747 has only 8 DC buses (including 2 APU buses)

What surprises me in the space shuttle is the extreme high number of DC buses. Why nine (9!) triple-redundant control buses? Why 6 different payload buses?

Obviously, one may think "well the Shuttle was complex". Sure it was, but even an A380 or a 747 is very complex and still a safety-critical machine. Moreover, the higher the buses the higher the number of components such as relays, switches, etc., and the higher the design and maintenance costs, increased complexity, weight, ...

It's very difficult to imagine why 9 different control buses, all triple redundant, are needed. Why not just 3? Do NASA engineer supposed more than 2 simultaneous failures? I don't think so (fuel cells and AC buses are just 3 each and still critical...).

Probably there is not a "simple answer", as they have been multiple design choices. But maybe someone have some insights on why more than 20 DC buses rather than 4-5 of other safety-critical aerospace systems (such as aircraft).

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ "why" questions about the orbiter can be very hard to answer. Often the answer is found in complicated studies of fault tolerance. Control buses supplied switch power to controls. If one shorted, losing 1/3 of the cabin switch functionality would probably be unacceptable. This is likely why there were 9. $\endgroup$
    – Organic Marble
    Jan 29, 2022 at 1:27
  • 1
    $\begingroup$ Un sourced speculation: With so many critical systems they wanted to minimise the things that needed to be isolated in event of failure, and history had shown them to always assume multiple failures. $\endgroup$
    – GremlinWranger
    Jan 29, 2022 at 1:39
  • 1
    $\begingroup$ Here's a overall/simplified schematic (excluding the essential buses) that you might find useful i.imgur.com/j9Qjjyh.png The true answer as to why it was so complicated is that it made the sims more fun! :) I'm glad you are interested in the orbiter electrical system and hope you will be asking more operational type questions in the future. $\endgroup$
    – Organic Marble
    Jan 29, 2022 at 2:00
  • $\begingroup$ apparently it is so complicated because the ISS must support both DC and AC vacuum cleaners $\endgroup$
    – uhoh
    Jan 29, 2022 at 2:24

1 Answer 1

Reset to default
3
$\begingroup$

The Shuttle was designed to remain completely benign if one failure happened in a critical system, and tolerant of two separate failures. One failure meant the mission could go on as planned. Two failures might result in loss of mission (the Shuttle had to return early) but the humans aboard the Shuttle would safely be returned to Earth.

A system designed to be single fault tolerant / two fail safe necessarily requires triple redundancy, at a minimum. In fact, there are Byzantine faults where triple redundancy does not suffice even for single fault tolerance. Most vehicle subsystem designers ignore the Byzantine generals problem and merely aim for triple redundancy in the safety critical aspects of their subsystems.

There were a few items on the Shuttle that were designated CRIT-1A (criticality level 1 subcategory A). Those few elements had zero fault tolerance and would likely result in people dying if the element failed. For example, the landing gear and main engine were CRIT-1A, and these received extensive scrutiny. The electrical power system was not CRIT-1A. It had triple redundancy.

Improve this answer
$\endgroup$
7
  • 1
    $\begingroup$ As a side note, and hence a comment, we use MathJax at this site. A lot of the MathJax macros come from LaTeX, which was first created by Leslie Lamport as a set of TeX macros so he could more easily write the canonical textbook on concurrent computing. While Lamport never did get around to wring that textbook, he did write (and continues to write) about concurrent computing, distributed computing, fault tolerant computing, and other topics. Along the way, he created the original version of LaTeX. $\endgroup$
    – David Hammen
    Jan 29, 2022 at 11:12
  • $\begingroup$ I'm not sure it does really answer the question: even aircraft are designed to land with 2 systems non-operational (like 2 hydraulic systems or 2 elec buses), but they still doesn't have 23 DC buses. The question was indeed why the orbiter needed 23 DC buses when other aircraft can deal with failure requirements with 3 or 4 or 5 buses. $\endgroup$
    – ocirocir
    Jan 29, 2022 at 11:59
  • $\begingroup$ @ocirocir My house has 23 circuit breakers (I just counted them), but only one power source. The need for triple redundancy accounts for the vast majority of the complexity of the Shuttle's electrical power system. That the Shuttle received power from ground support equipment is extremely common; even launch vehicles with zero fault tolerance typically receive GSE power until shortly before launch. The same applies to visiting vehicles to the ISS. Supplying power is one of the few gimmies in the ISS Visiting Vehicle Interface Definition document. Most are gotchas. $\endgroup$
    – David Hammen
    Jan 29, 2022 at 12:36
  • $\begingroup$ sorry but I still don't see how it answers the question: what you are saying can be found in any aircraft (including ground power supply and tons of circuit breakers), but none aircraft I know has more than 5 DC buses. Shuttle is complex, yes, as well as many other critical systems like a train or an aircraft... $\endgroup$
    – ocirocir
    Jan 29, 2022 at 14:37
  • 1
    $\begingroup$ we can take other spacecraft then, Apollo CM has "only" 10 buses but they are, at least, quite clear: 2 main buses, 3 battery buses, 3 flight buses, and 2 non-essential buses. This is something I expect to see. Instead it's difficult to understand why 9 control buses or why 6 different payload buses. I completely agree with what you are saying, but I was searching for a more specific answer... $\endgroup$
    – ocirocir
    Jan 29, 2022 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.