CONTINUATION OF OPERATIONS ON THE EUROPEAN MODULE 'COLUMBUS' ON ISS AFTER A CRITICAL LOSS OF REDUNDANCY

摘要

Due to the criticality of space operations, a module like Columbus is designed to comply with redundancy requirements. Especially safety related equipment must be designed to guarantee continuity of operations in case of anomalies. This becomes particularly important for human space-flight, where ensuring crew safety at all times is the highest priority. In July 2010, after a pump failure on one of the ISS External Thermal Control System loops, the USOS power consumption had to be diminuished to comply with the degraded heat rejection capability. Moreover, the power conversion units (DDCU) cooled by this loop had to be deactivated to avoid risks of over-temperature, resulting in the deactivation of the related chain of equipment in all USOS modules. In December 2013, another anomaly to the same cooling loop led to the same reconfiguration. For what regards the European scientific module Columbus, one Power Distribution Unit (PDU1), fed by two DDCU in Node2, was powered off, limiting power to only the loads that the "hot-redundant" PDU2 could support. In addition, because of heat rejection prioritization among modules, Columbus power consumption had to be limited to 4.2 kw. Columbus equipment- belonging to the active thermal control system, the life support system and the data management system- were reconfigured to their redundant cores, which allowed maintaining a good environment for crew and the access to Columbus telemetry and telecommanding from ground. Although ideal, a complete redundancy concept on each piece of equipment is very hard to achieve; therefore redundancy of some less critical devices can be implemented on not all possible aspects. For this reason, the loss of redundancy on critical equipment can still have remarkable side effects on non-safety related but still relevant equipment like scientific racks. Nevertheless, Columbus robust design allowed to continue science operations, even if with limited capabilities: some activities had to be de-conflicted since the available power was not enough for parallel science operations. Also, some payloads had to be manually reconfigured to AUX power, thus reducing their maximum power consumption. Finally, some "smaller" payloads had to be physically relocated to different positions in order to receive power from the only active PDU2. The purpose of this paper is to illustrate the redundancy concept on Columbus and its reaction to a major loss of redundancy (in general, and in particular after the loss of redundancy on power distribution system).