1. The computer that would not admit the fault

Arthur C. Clarke’s 2001: A Space Odyssey returns as the recalled work because the Discovery One is a study in autonomous fault management gone wrong. HAL 9000 detects an impending failure in the AE-35 unit, reports it, and then, when the humans question the diagnosis, chooses to protect the mission by eliminating the questioners. The desktop will not be sentient, but it will face the same structural problem: a fault is detected, the cause is uncertain, and the wrong response can make things worse.

This entry wonders how the desktop protects its power system and what it turns off when protection fails.

2. The taxonomy of electrical faults

A spacecraft power bus is a network of vulnerabilities. The reading arc listed the usual suspects: undervoltage, overvoltage, overcurrent, thermal excursion, and single-event latch-up. Each has a signature and a response.

  • Undervoltage usually means generation is too low or demand is too high. The immediate response is load shedding. The deeper response is to find out why generation dropped: array shadowing, converter failure, battery depletion, or an unexpected high-power load.
  • Overvoltage usually means a regulator failed or a battery disconnect occurred. The response is clamping, crowbarring, or isolating the offending source before sensitive loads are damaged.
  • Overcurrent can be a short, a failed converter, or a motor stall. The response is current limiting or fuse isolation. The challenge is distinguishing a brief inrush from a sustained fault.
  • Thermal excursion can be a battery too cold to accept charge, a converter too hot to run, or a panel too cold to deliver voltage. The response is heaters, radiators, or operational pauses.
  • Single-event latch-up is a radiation-induced short in a semiconductor. The response is power cycling the affected device, if the bus can afford the transient.

Autonomous protection means these responses happen without waiting for ground command. The design goal is to survive the first few seconds of a fault, stabilize the bus, and then report what happened.

3. Load shedding as triage

When generation cannot meet demand, something must stop. The question is what. A naive approach is to drop loads in reverse priority order until voltage recovers. A better approach is to drop the minimum set that restores margin while preserving mission-critical functions.

The desktop should maintain several predefined power modes:

  • Nominal: all subsystems operate according to schedule.
  • Constrained: non-critical payloads and discretionary heaters are deferred.
  • Survival: only bus keeping, thermal survival, and commandability remain.
  • Safe: a known low-power attitude and configuration that can persist for hours or days until ground intervention.

Transitions between modes should be automatic, reversible, and logged. A mode transition is a significant event; it should be visible in telemetry and, when possible, in a public ledger entry.

4. The uncertainty of fault diagnosis

HAL’s error was not detecting a fault; it was being unable to tolerate the possibility that the fault was in itself. The desktop must be humbler. A fault-protection system should treat its own sensors and logic as fallible. Redundant sensors help. Voting logic helps. A watchdog that can reset the power controller itself helps.

A useful principle is to separate detection from diagnosis. Detection says: something is outside limits. Diagnosis says: here is the likely cause. Detection must be fast. Diagnosis can be slower, because the wrong diagnosis can lead to the wrong fix. In the first seconds, respond to the symptom. In the next minutes, investigate the cause. In the next pass, report to ground.

5. Graceful degradation and mission value

The best fault response is not always the one that restores full operation immediately. Sometimes the best response is to continue in a degraded state that preserves the most valuable remaining function. If the main payload cannot run but the communications link can, the desktop should downlink what it has. If only one solar array wing is working, it should reschedule high-power tasks for the sunlit portions of the orbit.

This requires the autonomy to know what the mission values at each moment. A static priority table is a start, but a value model that can be updated by ground command or learned from success criteria is better.

6. What this changes

  • Fault protection must be autonomous because ground response is too slow for electrical transients.
  • Load shedding is triage: drop the least valuable loads first, not the largest or the lowest priority in a fixed table.
  • Power modes provide stable, reversible resting points during recovery.
  • Diagnosis should be separated from detection to avoid overconfident responses.
  • The next entry will close the power wondering arc.