NASA — Moon to Mars Architecture White Papers
The Mars Transportation paper keeps several propulsion options in the trade space and provides the frame connecting power and transportation.
MARS BIBLE — REFERENCE DOSSIER
Electrical power for an Earth-Mars spacecraft: generate, store, distribute and survive failures
Power, energy, batteries, solar arrays, distribution, protection, load shedding, heat and end-of-life capability: electricity as a vital spacecraft system.
ESTABLISHED FACTACTIVE ENGINEERINGPROSPECTIVE CHOICE
Why the electrical-power architecture matters
1. Electricity is a chain, not a solar panel
Generating electricity is not enough. The source must be converted and regulated, energy stored, power distributed, branches protected, voltages and currents measured and non-essential loads shed when capacity falls. The power system is a chain from generation to load. A converter or distribution fault can make a healthy source useless. Earth-Mars missions must size that chain across modes and for degraded end-of-life capability.
2. Power in watts and energy in watt-hours
Power is an energy flow rate. One watt is one joule per second. Energy accumulates that flow over time. A 500 W load used for two hours consumes ideally 1,000 Wh, or 1 kWh. This prevents a common mistake: battery storage is sized in energy, while converters and cables must also withstand peak power and current. Both calculations are necessary.
3. Build the electrical budget by mode
Cruise, communications, manoeuvre, sleep and emergency modes do not activate the same loads. A matrix records power and duration for each item. The instantaneous sum gives power demand; integration over time gives energy. Daily average can hide a short impossible peak, while adding every maximum at once can over-size the system. Serious design uses realistic scenarios and explicit margins.
4. Batteries age and depend on temperature
Battery capacity is not constant. Temperature, current, depth of discharge, cycle count and ageing change capacity and internal resistance. A cold battery may deliver less power; a hot battery may age faster. Battery management monitors cells, voltage and temperature. Mars design therefore uses end-of-life capability and partial-storage-failure scenarios, not only new-cell datasheets.
5. Distribution and protection: contain the fault
Each electrical branch should prevent a local short circuit from collapsing the whole spacecraft. Fuses, limiters, electronic switches and bus architecture isolate faults. Critical hardware may have separate feeds, but those feeds are independent only if they do not share a vulnerable common component. Protection selectivity must be tested so the local level trips before an upstream device removes healthy functions.
6. Load shedding is a survival strategy
When generation or storage falls, not everything can remain powered. Priorities must be defined in advance: thermal survival, computers, attitude, life support and emergency communications come before some experiments or comfort loads. Load shedding may be automatic but must remain understandable and reversible. Dependency analysis prevents a seemingly non-critical load from disabling a critical function indirectly.
7. Electrical loss usually becomes thermal load
A 90%-efficient converter delivering 900 W must receive roughly 1,000 W; about 100 W becomes mainly heat. That heat must be conducted and radiated away. Electrical efficiency therefore directly affects thermal sizing. Several converters clustered in a poor thermal location can create a hotspot. Power and thermal budgets must agree; each can look correct separately while the integrated design is wrong.
8. Solar arrays: distance from the Sun changes the problem
Solar flux falls with the square of distance from the Sun, so Mars receives less irradiance than Earth. A solar-powered Earth-Mars vehicle sees changing available sunlight along the trajectory, while temperature, orientation, ageing and contamination further affect output. Design uses a relevant worst case rather than the best condition. Arrays also need pointing, deployment, protection and wiring, coupling mechanisms and GNC to power.
Engineering deep dive — size an electrical system that can lose elements without losing the mission
Replace a power number with an energy budget by scenario
Saying a spacecraft “uses 20 kW” is insufficient. Instantaneous power in watts must be integrated over time to obtain energy. A 5 kW load operating for eight hours uses 40 kWh. The symbol kWh means kilowatt-hour, an energy unit rather than a power unit. The distinction becomes critical whenever storage must bridge a period of insufficient generation.
Assume a survival function needs 5 kW for eight hours, depth of discharge is limited to 80 percent and discharge/conversion efficiency is 90 percent. Nominal battery energy becomes 40 ÷ (0.8 × 0.9) ≈ 55.6 kWh. That is still incomplete: ageing, temperature, peak power, unavailable cells and operational margin must be added. The example simply shows why battery size is not power multiplied by time and nothing else.
Profiles should be built by mode: sleep, EVA, cooking, laboratory work, maneuver, emergency, converter loss and high-power communications. Peak power and total energy size different components. A five-minute high-power event may drive power electronics without consuming much energy; a modest twenty-hour load can dominate storage.
At Mars, sunlight provides less margin than near Earth
Solar flux falls approximately with the square of distance from the Sun. Mars averages about 1.52 astronomical units, so a first-order ratio is 1 ÷ 1.52² ≈ 0.43. That means average available flux is on the order of 43 percent of near-Earth sunlight before array orientation, cell temperature, conversion losses and dust are considered.
A solar-powered transit vehicle therefore sees changing generation along the trajectory. A surface base adds dust, seasons and day-night cycling. Solar architecture needs larger area and storage. Nuclear sources change the profile by offering steadier generation while adding mass, conversion, thermal rejection, safety and deployment constraints.
Hybrid architecture may use different sources for different roles. Diversity can reduce some common-cause risks but increases the number of technologies that must be maintained. The trade should therefore be evaluated over full life cycle rather than nominal source efficiency alone.
Distribution must keep one short circuit from becoming a vehicle failure
The electrical network is hierarchical: sources, buses, converters, protection, wiring, panels and loads. A local fault should be isolated before collapsing an upstream bus. Protection devices therefore need coordination so the closest device acts first while healthy branches remain energized.
This selectivity is difficult in fast power-electronic and DC networks because fault signatures can resemble legitimate inrush current. NASA research on autonomous electrical fault diagnosis combines model-based and knowledge-based methods precisely because deep-space systems cannot depend on continuous ground supervision.
Isolation faults and fire also matter. Protection that trips too easily can remove life-critical service; protection that acts too slowly can overheat wiring. Qualification needs boundary cases and intermittent faults that appear only under particular vibration or temperature conditions.
Load shedding is a survival hierarchy written into the network
When generation is lost, loads have different values. The system should know what can be removed first: experiments, comfort, noncritical manufacturing, some redundant pumps, and only later essential life-support functions. This order should be designed before the event and remain visible to the crew. Automatic shedding that hides what was disconnected creates another anomaly.
Shedding can also be partial. A workshop may reduce power instead of stopping; temperature bands can widen temporarily; computing can be deferred. Flexible loads act like virtual reserve. At settlement scale, demand management becomes as important as adding generation.
Survival modes need long-duration testing. Proving that the system runs for ten minutes on batteries says little if the emergency concept requires eight hours. Converters heat, batteries sag and equipment can behave differently at low bus voltage. The full duration matters.
A Martian town will need a microgrid that can island itself
Four residents may live on one principal bus plus backup. Twenty residents justify separate habitat and workshop feeders. One hundred residents create a distributed microgrid. At one thousand, neighbourhoods and industrial zones may need to island so one fault does not black out the entire settlement.
Islanding requires protection, control and a disciplined restoration sequence. Two segments cannot always be reconnected by closing a switch; voltages and converter states must be compatible. Even a DC-dominated network has stability and control interactions. Recovery after blackout is therefore an engineered operation.
The settlement must also decide which services receive priority. A technical load-shed table becomes public policy: hospital, air, water, communications, housing and industry. Energy architecture ultimately connects to governance because electrical priority becomes priority among human activities.
Making the electrical network a prioritized survival system
Separate instantaneous power from stored energy
Kilowatts, kW, measure power: a rate of energy transfer. Kilowatt-hours, kWh, measure energy. A 5 kW load running for eight hours consumes 40 kWh. If a battery is limited to 80% depth of discharge and the delivery chain is 90% efficient, nominal capacity must be about 40 ÷ (0.8 × 0.9) ≈ 55.6 kWh. A system can therefore have enough kW to start a pump yet insufficient kWh to keep it running through the night.
Sizing also has to include peaks, motor starting currents and load coincidence. A daily average cannot show whether the bus survives when electrolysis, compression and a workshop start together.
Define load shedding before the emergency
When generation falls, loads are not equal. Vital ventilation, thermal control, emergency communications and safety computing should remain powered before deferrable industrial processes. Load shedding needs predefined levels and restoration conditions so that operators do not invent priorities under stress. The network becomes a hierarchy of services rather than a set of cables.
That logic must tolerate bad measurements. An automatic system that sheds loads on one faulty sensor can worsen the event. Critical decisions need cross-validation, suitable delays and local recovery options. NASA work on spacecraft electrical fault detection illustrates why diagnosis matters before reconfiguration.
Evolve from a power plant to a Martian microgrid
For four people, a main source and central storage may be adequate. At one hundred or one thousand residents, concentration becomes a hazard. Multiple sources, sectors and stores can isolate failures and support electrical islands. The grid must manage exchanges, priorities, conversion, synchronization and fault protection, becoming closer to an autonomous industrial microgrid than a spacecraft bus.
Mars solar power also varies with Sun distance, dust and season. Near 1.52 astronomical units, simple inverse-square scaling gives roughly 1 ÷ 1.52² ≈ 0.43 of the flux at one astronomical unit before atmospheric and dust effects. The superscript ² means “squared.” This does not rule out solar power; it drives area, cleaning, storage and complementarity with other sources.
Verification cases and operational margin
Verify the grid with a 24-hour energy-and-power balance
A useful exercise plots generation, demand and state of charge hour by hour. A battery can end the day with the same energy it started with while still crossing a dangerous minimum during the night. Both total energy balance and instantaneous minima therefore matter. Flexible loads such as electrolysis, material processing or some vehicle charging can move toward surplus periods and reduce storage requirements.
At town scale, flexibility becomes an economic tool. Critical services receive guaranteed power while selected industrial processes accept interruption or reduced output. The grid can publish operating states such as normal, low reserve, preventive shedding or emergency, creating a shared protocol between generators, workshops and residents.
9. Nuclear source: different profile, different constraints
Nuclear power can be less dependent on illumination and dust, but brings different mass, thermal, radiation-safety and regulatory constraints. No source is universally superior, and architectures may combine sources. The trade must consider guaranteed power, lifetime, mass, heat rejection, storage, failure consequences and maintenance over the whole mission.
10. Power quality, noise and electromagnetic compatibility
Nominal voltage does not fully describe a power supply. Ripple, transients, inrush current and high-frequency noise can disturb sensors and computers. Motors, converters and radios inject interference. Filtering, grounding, shielding, wiring and startup sequences must therefore be designed and tested in the integrated system. A good laboratory sensor can fail next to a noisy converter.
11. End-of-life, accumulated faults and Mars strategy
The mission must remain viable after array ageing, a branch isolation, battery capacity loss or higher-than-expected heater demand. First-day nominal operation is rarely the most informative case. End-of-life analyses combine plausible degradation and fallback modes. Mars infrastructure will also need to replace cells, converters, switches, cables and sensors, making energy autonomy an industrial-maintenance problem as much as a generation problem.
12. Worked example: from load profile to battery size
Assume an eight-hour low-generation period with 600 W of essential average load. Ideal energy demand is 600 W × 8 h = 4,800 Wh or 4.8 kWh. If usable depth of discharge is limited to 80%, minimum nominal capacity becomes 4.8 ÷ 0.80 = 6 kWh before ageing, losses and project margin. We divide by usable fraction because nominal storage must exceed the energy we actually allow ourselves to remove.
13. Current and voltage: why power alone is not enough
P = V × I links power in watts, voltage in volts and current in amperes. At equal power, higher voltage reduces current. For example, 1,200 W at 120 V requires ideally 10 A, while at 30 V it requires 40 A. Higher current increases I²R resistive losses and conductor requirements, while higher voltage brings insulation and safety constraints. Bus voltage is therefore a system trade.
14. Cable losses: understanding I squared R
A conductor of resistance R dissipates Ploss = I²R. With 0.05 ohm resistance and 20 A current, loss is 20² × 0.05 = 20 W. Doubling current to 40 A does not double loss; it gives 40² × 0.05 = 80 W, four times more. This explains why high-power systems often seek lower current and again links power distribution to thermal load.
15. Emergency energy and survival duration
After loss of the main source, the operational question is how long remains. With 12 kWh usable storage and 800 W survival load, ideal duration is 12 kWh ÷ 0.8 kW = 15 hours. Real temperature, losses and reserve reduce that figure. A time-remaining estimate helps crews decide whether to repair, shed loads or change attitude to restore generation.
16. Insulation faults and fire safety
Damaged wiring, contaminated connectors or local condensation can create electrical faults. In a crewed volume, arcing, overheating and fire are major hazards. Current monitoring, branch protection, material choice, cable separation and emergency procedures therefore converge. Robust power is not only about availability; it must also fail in controlled ways without creating secondary hazards.
17. Mars microgrid: from spacecraft to settlement
A Mars base will have distributed generators, storage and loads. It must isolate damaged branches, restart sectors, prioritise critical loads and add new modules. Spacecraft bus principles become microgrid principles. The difference is scale and maintainability: buried cables, converters, workshops and local sources must be inspectable and repairable for years.
18. Measure to manage: electrical telemetry
Voltage alone is not enough. Current, power, cumulative energy, battery temperature, state of charge, estimated internal resistance and protection events provide a fuller picture. Trends can reveal slow degradation before failure. On Mars, comparing the same indicators across vehicles and habitats can support predictive maintenance and local manufacturing priorities.
19. Size for credible worst cases, not comfortable averages
A reference power system should state its sizing case explicitly. It may be a long eclipse, poor array pointing, maximum heater demand, an aged battery or a credible combination. Engineers build physically plausible scenarios rather than an impossible 'worst of every worst'. Each scenario states available sources, mandatory loads, initial storage, efficiency, duration and margin. The result is not only a power number but a state-of-charge trajectory and proof that limits are not crossed. This prevents both optimistic average sizing and excessive sizing from maxima that cannot occur together. Mars microgrids can use the same method for dust events, source outages and unusual thermal demand.
Critical interfaces and system consequences that are easy to miss
Electrical power: generate, store, distribute and shed loads
Power and energy are not the same
Power is the rate at which energy is produced or consumed; energy is the accumulated amount over time. A 1,000 W load for ten seconds does not require the same battery capacity as a 200 W load for ten hours. Generation, storage and distribution therefore solve related but different problems.
Build budgets by operating mode
A useful power budget lists each load, activity mode, efficiency, duration and priority. It separates average power, transient peak and daily energy. Critical loads must often survive load shedding, so the system needs a planned order for disconnecting non-essential consumers.
A battery is not an ideal tank
Usable capacity depends on temperature, current, state of charge, depth of discharge, ageing and cycle history. Battery management monitors cells and enforces limits. For a long mission, end-of-life capacity is more important than first-day capacity.
Distribution, conversion and protection
Sources rarely provide the exact voltage needed by every load. Converters regulate power but lose energy as heat. Protection devices isolate short circuits, and branch architecture should keep one local fault from collapsing the complete bus.
Power quality and compatibility
A nominal voltage does not describe ripple, noise, inrush current or transients. Motors and switching loads can disturb sensitive sensors, so grounding, filtering, wiring and sequencing are part of system design and must be tested in the integrated configuration.
Direct coupling to thermal control
Most electrical power consumed inside the spacecraft ultimately becomes heat. A more efficient converter therefore saves energy and reduces thermal load at the same time. This is a classic system-level trade rather than an isolated subsystem improvement.
Mars production, storage and survival
Transit and surface operations have different profiles. Solar availability varies with day, season and dust, while nuclear sources have different constraints. The design must distinguish adequate average energy from guaranteed power during the worst credible period.
The electrical network must survive mission changes, not merely a nominal operating point
A crewed Mars spacecraft never draws constant power. Departure, quiet cruise, trajectory correction, maintenance, high-rate communications, arrival preparation and off-nominal attitudes create different electrical states. Credible sizing therefore begins with an energy timeline. Each mode has an average load, a peak load, a duration and a criticality level. Adding instantaneous watts is not enough: power must be integrated over time to obtain energy in kilowatt-hours, while generation, storage and distribution are checked against thermal limits and degraded modes.
NASA describes the electrical power system as the combination of generation, storage and distribution. For a Mars vehicle, the decisive idea is dependency. A solar array does not feed the crew directly: energy passes through cells, regulation, buses, converters, protection and switching. Batteries depend on temperature, state of charge and cycling depth. A converter failure can make a healthy source unusable; loss of cooling may force power reduction long before the cells themselves are electrically limited.
An eight-hour degraded-mode example
Assume vital loads need 5 kW for eight hours while usable solar production falls to 1 kW. The instantaneous deficit is 5 − 1 = 4 kW. Storage must therefore provide 4 kW × 8 h = 32 kWh. If the design limits depth of discharge to 80% and the battery/conversion chain returns 90% of stored energy, minimum nominal capacity becomes 32 ÷ (0.80 × 0.90) ≈ 44.4 kWh. The symbol × means multiplication, ÷ means division, kW means kilowatt and kWh means kilowatt-hour. This is not a detailed battery design; it shows why event duration can dominate the storage requirement.
The same reasoning applies to short, high-power events: pump starts, tank heaters, mechanisms, medical equipment or high-rate transmitters. Peak power sizes some hardware while integrated energy sizes storage. Treating them as the same quantity produces vehicles that look acceptable in a watt table but fail when temporal constraints overlap.
Farther from the Sun, electrical margin becomes an architectural variable
Solar flux varies approximately with the inverse square of distance from the Sun. At 1.52 astronomical units, close to Mars' mean orbital distance, the factor relative to 1 AU is 1 ÷ 1.52² ≈ 0.433. Before accounting for cell temperature, pointing, degradation or contamination, available sunlight is therefore a little over 43% of the Earth-distance value. This does not rule out photovoltaics; Juno demonstrates large solar arrays far beyond Mars. It does mean that array area, mass, articulation, storage and vehicle attitude must be designed together.
Optimal array pointing can conflict with thermal attitude, communications or a maneuver. Flight software therefore needs an estimate of available capability, battery margin and load criticality. Load shedding is not improvised after a failure. Life support, safety avionics and essential communications occupy different priority classes from deferred science or lighting in unused volumes.
Distribution as a barrier against fault propagation
A single bus is simple but concentrates risk. Protected branches, isolated converters, contactors and detailed telemetry can prevent a short circuit or insulation fault from propagating through the vehicle. Restoration also needs sequencing. Reconnecting every load at once can cause a second collapse through inrush current. A recovery sequence stabilizes the bus, restores vital functions, checks temperatures, reintroduces secondary loads and preserves reserve for a second anomaly.
Martian power systems must be maintainable, testable and reconfigurable
The best energy source is not the one with the most attractive specific-power number; it is the one the spacecraft can exploit for years. Battery health, contact resistance, current-sensor drift, converter ageing and array performance must be observable. Electrical telemetry becomes early diagnosis. A slowly rising connector resistance may first appear as a few watts of extra loss before becoming a dangerous hot spot.
NASA reliability and maintainability practice makes repairability part of architecture rather than an afterthought. Modules, cables, protection devices and converters need appropriate access and replacement logic. For Mars, the ability to operate with fewer healthy modules than planned can be more valuable than a small gain in nominal efficiency. The governing question becomes: which functions remain guaranteed after generation, storage or distribution has lost part of its capacity?
Primary references
NASA Small Spacecraft Power, May 2026; NASA Spacecraft Components; and Advanced Space Power Systems, updated June 2026.
Transitions between modes often size the electrical system
The most dangerous condition is not always the highest steady load. Transitions can combine pump starts, solar-array motion, heaters, antenna acquisition, computer reconfiguration and instrument wake-up. A vehicle that is stable in each individual mode can collapse while moving between them. Designers therefore need a transition matrix: initial mode, target mode, loads entering and leaving, overlap time and conditions that inhibit the change.
Loss of generation illustrates the problem. The network first sees falling voltage or available power, then has to distinguish expected geometry from source failure, conversion failure or bad measurement. Shedding too fast may remove equipment whose shutdown creates a thermal or atmospheric consequence; shedding too slowly can collapse the bus. Priority is a cross-disciplinary survival policy implemented in contactors and software.
A 100 kWh battery does not provide 100 kWh of freely planable energy. Reserving 20% to avoid deep discharge and another 10% for emergency margin leaves 100 × (1 − 0.20 − 0.10) = 70 kWh before conversion losses and aging. If usable capacity later falls to 85% of initial, the same nominal battery provides only 85 × 0.70 = 59.5 kWh of planned energy. Aging turns design margin into an operational variable.
Capacity and power capability must also be separated. An aged battery may still contain substantial energy but no longer support a peak current; degraded arrays may run cruise loads but fail during reconfiguration. Health checks therefore need capacity, internal resistance, cell imbalance and transient response, not only state of charge.
Crew displays should explain consequence rather than show opaque codes. “Bus B at 92%” is less useful than “eight hours of life-critical autonomy at current profile; laboratory heat is shedable; next source available in 37 minutes.” Electrical avionics becomes an operational decision tool.
Maintainability must finally be physical. Isolation, lockout, verification of de-energized circuits, connector access and module replacement without losing the whole network require suitable layout. In a spacecraft mass, volume and arc/short-circuit risk make this difficult, but long-duration survival demands it.
Power quality, protection and generation choices change the design
Long-duration electrical design cannot stop at kilowatts and kilowatt-hours. Loads care about voltage range, ripple, transients, electromagnetic compatibility and grounding. A converter may deliver the correct average voltage while injecting noise into sensors or communications. High-current motors can create short transients that look insignificant in an energy budget but disturb avionics. The electrical architecture therefore needs limits for voltage quality, filtering, switching frequency, grounding and fault current.
Cable loss shows why distribution voltage matters. Resistive loss is P_loss = I²R, where I is current in amperes and R resistance in ohms. Delivering 10 kW at 100 V ideally requires 100 A; at 400 V it requires 25 A. For the same 0.02 Ω path, losses are 100² × 0.02 = 200 W at 100 V but 25² × 0.02 = 12.5 W at 400 V. Higher voltage can dramatically reduce conductor loss and mass, but raises insulation, switching and arc-management requirements. There is no free voltage increase.
Insulation faults deserve special attention in a crewed spacecraft. A degraded cable can leak current to structure, create localized heating or establish a fault that becomes dangerous only when a second fault occurs. Isolation monitoring, segmentation and fault-current limitation help detect this before it becomes fire or loss of bus. Routing and physical protection matter as much as circuit logic because abrasion, repeated access and maintenance can damage cables over years.
Generation technology changes the failure picture. Solar arrays couple power to distance from the Sun, pointing and deployed geometry. Nuclear systems can provide a steadier profile but introduce reactor, shielding, heat-rejection and separation constraints. Fuel cells or regenerative systems may serve storage or peak functions but depend on reactants and water management. A Mars transport architecture should compare technologies by mission mode, maintainability and fault behavior rather than by one specific-power number.
Power quality also links to communications and science. Switching converters and high-current harnesses can produce electromagnetic interference; sensitive instruments and antennas need zoning, filtering and grounding discipline. A settlement or spacecraft that adds equipment over time must keep these compatibility rules alive. Uncontrolled “just plug it in” growth can quietly consume the electromagnetic margin.
The final design question is therefore not how many watts are available on day one. It is whether the distribution system can continue to deliver clean, prioritized, measurable power after aging, maintenance, software changes and partial loss of generation. That is what makes electrical power infrastructure rather than a collection of sources.
Case study: lose half the generation without losing the spacecraft
Imagine two solar wings normally feeding two interconnected distribution zones. A deployment anomaly followed by converter failure removes half the generation. The first response is not to shut down “half the equipment.” Avionics establishes stable remaining power, battery state and the load profile for the coming hours. Life-critical functions are moved to the healthy zone while science loads and some noncritical heaters are deferred.
Assume 12 kW nominal generation, 6 kW remaining, 8 kW of vital and high-priority load, and 30 kWh of truly usable battery energy. The deficit is 2 kW, giving 30 ÷ 2 = 15 hours under the simplified steady assumptions. This is not “spacecraft autonomy”; it is a decision clock—fifteen hours to restore a source, reduce demand or change attitude to improve generation.
Thermal behavior then changes the answer. Shutting down a laboratory reduces internal heat and can force heaters elsewhere; changing attitude to illuminate arrays may degrade radiator view or communications. The vehicle needs a global configuration, not a local electrical optimum. It may be rational to preserve battery reserve and accept lower solar output in order to protect thermal control.
Repair starts with fault boundaries: healthy wing but failed converter, cable, contactor or command path? The branch is isolated and the remaining bus checked for overload. If a converter is replaceable, access, safe connectors and post-repair test capability have to exist before flight.
Restoration is gradual: stabilize the bus, regain minimum battery reserve, restore vital loads and then secondary loads. The event should update shedding rules. A real power system therefore provides more than watts; it provides time and options that prevent one fault from becoming mission loss.
Emergency electrical design also depends on fire, grounding and repair boundaries
Electrical failures are dangerous partly because they can become ignition sources. High-current connections, damaged insulation and resistive joints create localized heating that may be difficult to see before smoke or odor appears. Protection should therefore coordinate current sensing with temperature, insulation monitoring and compartment detection. A breaker that never trips is not proof that the harness is healthy.
Grounding in a complex spacecraft is another architectural choice. Structure may provide reference and fault-return functions while sensitive instruments need controlled noise paths. Maintenance can accidentally defeat that logic by adding temporary jumpers or replacing equipment with different bonding. Documentation should show not only which wire carries power but why each grounding connection exists.
Emergency power should be geographically distributed where practical. One large battery is efficient but can become a common point of loss through fire, structural damage or isolation. Several protected energy zones can preserve life-critical functions after compartment loss, provided switching and state estimation remain understandable.
Repairability requires safe energy isolation. A crew member opening a converter should know what remains energized, where stored energy resides and how long capacitors need to discharge. Test points and lockout states should be designed into the hardware rather than improvised in orbit. The ability to prove “safe to touch” is part of maintainability.
Electrical fire response also changes load priorities. Ventilation may need to be reconfigured to limit smoke spread while still protecting CO₂ removal. Cutting one power zone can remove pumps or sensors needed to understand the event. Emergency procedures should therefore be validated against real network topology.
Over years, every modification must preserve these boundaries. New equipment, adapters and locally repaired harnesses can consume fault-current or electromagnetic margin. Configuration control keeps the original safety logic alive as the vehicle evolves.
Radiation and long dormant periods also affect stored-energy assumptions. Battery-management electronics, contactors and current sensors need health checks even when the cells themselves remain within capacity limits. A power system that cannot trust its measurements cannot safely exploit its remaining battery margin, so sensor cross-checks and calibration strategy belong in the emergency design.
Growth of the spacecraft configuration should be tested against fault-current limits. Adding a new high-power load changes converter utilization, cable temperature and protection coordination. A breaker selected for the original network may no longer isolate one branch cleanly after later modifications. Reconfiguration therefore needs an electrical impact assessment, not only a connector match.
For crew training, the key skill is understanding energy consequence over time. Operators should practice cases where a load is electrically healthy yet must be shed because battery endurance or thermal capacity is disappearing. That turns the power display from a collection of numbers into a model of future options.
A high-voltage architecture also changes connector and maintenance practice. Creepage, clearance and insulation damage become more important, especially in dusty or humid internal environments. Connectors should be selected for repeated mate cycles where maintenance is expected, and inspection criteria should include discoloration, pitting and mechanical looseness rather than continuity alone.
Power electronics aging can be monitored indirectly through temperature, efficiency and switching behavior. A converter whose losses rise from 4% to 7% at the same load produces extra heat and may be approaching failure even though output voltage remains correct. Trending efficiency therefore links electrical telemetry to predictive maintenance.
Emergency generation options should be evaluated by startup time. A source that can provide 20 kW after one hour does not protect a bus that must recover within seconds. Batteries, capacitors, fuel cells or alternate generators occupy different layers of the response timeline. Resilience comes from combining fast and sustained sources.
Finally, crewed Mars vehicles should train with realistic partial-information cases. A display may show uncertain battery health, one failed current sensor and an incomplete thermal picture at the same time. Procedures that rely on one perfect number will fail in the situations where they are most needed.
Energy accounting should include converter standby and heater loads that disappear from simplified mission tables. On a multi-year cruise, a seemingly minor continuous load accumulates. One hundred watts operating continuously for a year consumes 0.1 kW × 8,760 h = 876 kWh. Reducing persistent parasitic demand can save more total energy than optimizing a short peak.
Power-system test campaigns should include cold start after prolonged shutdown. Batteries, converters and controllers may behave differently after storage than during normal cycling. A system that can restart only with nominal ground support has not demonstrated deep-space recovery.
The settlement-era lesson is similar: electrical infrastructure should be designed around service continuity, not a single peak-generation figure. Generation, storage, switching, protection, measurement, maintenance and operator understanding together determine the useful power available to life and industry.
Case study — size the battery from the energy deficit
After loss of one source, if vital loads exceed generation by 8 kW for six hours, E = Pt/η with η = 0.90 gives E ≈ 8×6/0.90 = 53.3 kWh. E is required energy, P the power deficit, t duration and η the assumed efficiency.
A nominal 60 kWh capacity does not necessarily provide 60 kWh usable after ageing, temperature and permitted depth of discharge. Switching off a heater can also create a thermal debt that reappears later.
Qualification imposes time histories, a cold battery, a limited converter and loss of one chain, then checks minimum voltage, state of charge and restart capability.
Generate, store, and distribute power during Mars transit
The mission profile drives the electrical system
An interplanetary vehicle does not use power in the same way during departure, cruise, trajectory correction, science operations, high-rate communications, and Mars approach. Sizing should therefore begin with a time-resolved load schedule rather than one peak-power number.
Life-critical loads — life support, avionics, minimum communications, and thermal control — define a floor that must remain powered after multiple failures. Deferrable loads can be shed, while pulse loads need local storage that absorbs peaks without destabilizing the bus.
Distance from the Sun varies substantially along the trajectory. A solar architecture must include irradiance decline, cell temperature, aging, orientation, and periods when spacecraft geometry constrains pointing. Array area at one instant is therefore not enough to guarantee mission-wide energy.
Nuclear architectures change the trade: they reduce dependence on sunlight but add conversion hardware, radiators, radiation separation, mass, and safety constraints. Electrical design is inseparable from thermal control and propulsion when propulsion is electric.
From generated watts to usable watts
Between source and load lie conditioning, voltage conversion, protection, cabling, switches, converters, and software. Each introduces losses, heat, and failure modes. A serious power budget therefore separates gross generation, conversion efficiency, and power actually delivered at the load.
Distribution must prevent a local short circuit from disabling the entire spacecraft. Segmented buses, selective protection, and alternate paths allow life support to continue while a failed branch is isolated. Electrical selectivity thus becomes a survival function.
Batteries do more than bridge loss of the main source. They smooth peaks, support startup, cover transitions, and can power an islanded segment during reconfiguration. State of charge, instantaneous power capability, and aging must be tracked separately.
Black start — recovering from a deep electrical shutdown — deserves a dedicated procedure. Designers must know which source wakes minimum avionics, which contactors can be operated without the main bus, and in what order loads return without causing a second collapse.
Propulsion power and living power are not the same thing
NASA continues to study several Mars transportation families: chemical, nuclear thermal, nuclear electric, and hybrid solar-electric/chemical. In electric options, propulsion can dominate the power budget during thrusting while the habitat needs continuous, far more stable supply.
A high-power electric thruster immediately turns electricity into a thermal problem: part of the energy becomes heat in converters, coils, structure, and auxiliaries. Increasing propulsion power without increasing heat-rejection capability is therefore not an independent choice.
Recent high-power electromagnetic thruster demonstrations are useful technology milestones, not proof that a human Mars vehicle is ready. The book must distinguish component test, integrated propulsion chain, qualification, and long-duration operation.
For the crew, the fundamental requirement is an architecture that can lose one power branch without simultaneously losing ventilation, cooling, critical computing, and communications. Useful redundancy avoids common causes — the same converter, software, or coolant path — rather than merely doubling nominal hardware.
Three calculations that build the right intuition
A first calculation closes the daily balance: if critical loads average 18 kW for 24 h, they consume 432 kWh per day. That energy, not just peak power, sets part of the required storage or continuous generation.
A second calculation covers endurance: with 120 kWh of usable energy and 20 kW of critical loads, theoretical endurance is 120/20 = 6 h before margins and aging. The slash denotes division of energy in kilowatt-hours by power in kilowatts, yielding hours.
Finally, conversion losses must be explicit. A 250 kW chain at 94% efficiency dissipates about 15 kW: 250 × (1 − 0.94) = 15. That heat has to leave the spacecraft; it is not a footnote in the electrical table.
Failures that must be rehearsed before departure
A converter failure during electric thrust forces a trade between propulsion and bus survival. Procedures must specify which loads are shed, how the thruster shuts down, and how the healthy branch is protected from transient overload.
A battery string with abnormal heating creates a different problem: isolation protects against thermal propagation but instantly reduces available energy. The crew must know whether the mission remains compatible with the reduced capacity until maintenance is possible.
A telemetry error can mimic an energy shortage that does not exist. Cross-checking current, voltage, temperature, estimated state of charge, and load behavior avoids decisions based on one sensor.
The hardest case combines electrical failure and thermal degradation. An isolated converter reduces available power while a partially unavailable radiator limits the power that can be dissipated. Degraded operation must respect both boundaries at once.
Reference documents and exact scope
NASA/JPL — lithium-fed high-power thruster test (2026)
The 2026 test documents a high-power electromagnetic propulsion milestone; it is a technology demonstration, not a qualified Mars transportation system.
NASA — Orion spacecraft power and thermal control
Orion provides an operational example of integrated solar generation, distribution, and thermal control, useful as heritage rather than direct Mars sizing.
NASA Moon to Mars — Components
The 2026 taxonomy separates Power, Transportation, Habitation, and other sub-architectures while showing that they must operate as a system of systems.
When power becomes the spacecraft architecture
From kilowatts to megawatts, topology changes
A crewed spacecraft that needs only a few tens of kilowatts can still be conceived as a vehicle in which electrical power serves equipment. Once electric propulsion, high-power radar, optical communications, or large thermal loops enter the design, the logic reverses: the power system begins to dictate geometry, separation distances, cable mass, bus segmentation, and fault strategy. JPL’s 2026 lithium-fed magnetoplasmadynamic thruster campaign illustrates this scale change. The prototype reached 120 kW in a test, while prospective human nuclear-electric propulsion concepts operate at much higher total power. This is not evidence of an operational Mars vehicle; it is evidence that distribution, heat rejection, and very long endurance become mission technologies in their own right.
A megawatt architecture cannot use the same redundancy philosophy as a conventional satellite bus. Duplicating every source would impose prohibitive mass. The more realistic approach is to define survivable electrical islands, transfer paths, load priorities, and reconfiguration states. A primary conversion failure must not propagate a damaging transient into life support; conversely, a short circuit in a secondary payload must not trip protection that removes propulsion or thermal control. The network diagram is therefore also a map of consequences.
Duration matters as much as instantaneous power. A system can deliver 500 kW for minutes yet fail to sustain 200 kW for months if aging, radiator capacity, or switching components were never qualified for that duty. A Mars-transit metric must combine power, time, availability, and repair capability. The load schedule should therefore be tied to mission phases: departure, cruise, trajectory corrections, high-rate communication windows, approach, possible dormant periods, and contingencies.
Documentary anchors used in this chapter
Electrical design must follow time, operating modes, and priorities
An interplanetary spacecraft does not have a single electrical-power number. It moves through operating states in which generators, loads, and margins change. Departure and maneuver phases can combine actuators, communications, computers, and thermal-control loads near their local peaks. Cruise may be quieter, yet life support, navigation, pumps, data handling, and telemetry cannot simply disappear. A trajectory correction, a medical event, or fault diagnosis can add a peak that was not part of the nominal schedule. The useful design artifact is therefore a time-resolved energy ledger rather than an average wattage. For every mode, it lists continuous loads, intermittent loads, duration, available sources, conversion efficiency, and reserve. That ledger identifies the hours when batteries truly carry the vehicle, which tasks can move in time, and which shutdowns would threaten the crew. It also separates two questions that are often confused: supplying 20 kW for a few seconds and supplying 20 kW for eight hours impose very different storage, wiring, thermal, and operational consequences.
Distance from the Sun reshapes that ledger. As a first-order geometric approximation, solar flux varies with the inverse square of heliocentric distance. At 1.52 astronomical units, close to Mars' mean orbital distance, the factor is 1 / 1.52² ≈ 0.433. An identical, equally oriented array therefore intercepts roughly 43 percent of the flux it would receive near one astronomical unit before cell temperature, degradation, pointing, and conversion losses are considered. That is not a Mars-spacecraft sizing rule: the transfer trajectory is not a circle at 1.52 AU, and real arrays can be shadowed, gimbaled, thermally limited, or degraded. It is a powerful intuition. A solar architecture that has generous margin near Earth can become tight late in the transfer. Designers must propagate available flux along the trajectory, couple it to array temperature and end-of-life assumptions, and identify where the margin actually disappears. Operations can then schedule discretionary loads before entering that region instead of discovering the shortage after it begins.
Storage should be derived from a service requirement. Suppose a survival mode needs 5 kW for eight hours while usable solar production is zero. Useful energy is E = P × t = 5 × 8 = 40 kWh. If depth of discharge is limited to 80 percent and the end-to-end efficiency from battery to useful bus is 90 percent, nominal capacity is at least 40 / (0.80 × 0.90) ≈ 55.6 kWh. That value still omits aging, temperature, cell dispersion, and the loss of a module. A credible design adds end-of-life margin, checks peak current and converter limits, and considers physical separation. The point is not to worship 55.6 kWh. It is to show how a requirement stated in hours becomes mass, volume, heat rejection, wiring, and procedures. Changing refuge duration or accepting the shutdown of a non-vital load can therefore move the architecture rather than merely alter a spreadsheet cell.
Distribution is less visible than generation and often more decisive. Two redundant sources do not create a redundant service if both feed one contactor, one cable through the same fire zone, or one controller. The network needs fault-containment zones that can isolate a failure without collapsing every bus. That implies an explicit distinction among vital loads, mission loads, deferrable loads, and loads that may be lost. Protection devices must be coordinated so that a local overcurrent trips the nearest protective element before removing the shared source. For a crewed spacecraft, this must be validated against the actual wiring, connectors, pressure-wall penetrations, fire zones, and maintenance access. The nominal one-line diagram is not enough; engineers should draw the fault path as carefully as the power path and retain a manual isolation option when automation makes the wrong inference.
Power quality deserves a budget of its own. A correct average voltage can hide motor-start dips, switching noise, fast transients, or harmonics that confuse sensors. Vital equipment must tolerate a defined envelope, not just a nominal number. Converters, filters, grounding choices, shielding, and cable impedance then become part of system safety. A useful integrated test starts realistic loads together, injects a controlled fault, and watches computers, pumps, sensors, and radios through the event. An unexpected reboot might demand a software change, a filter, or a different bus topology. Testing in this form prevents the electrical system from becoming an invisible utility that is only noticed after another subsystem fails.
Losing a source without losing the spacecraft
Load shedding must be written before the emergency. A priority list improvised during a power shortage will be inconsistent, particularly when the crew has incomplete information. A practical policy separates functions that immediately protect life, functions that prevent escalation, functions required to regain a stable state, and activities that can wait. The classification changes with mission mode. A transfer pump may be secondary during quiet cruise and vital while a loop is isolated; a high-power transmitter may be delayed for hours but become essential before a critical contact. Energy-management software therefore needs mode-dependent rules and a clear human override. Every automatic action should be explainable: which limit was exceeded, which load was removed, and what condition permits restoration.
Restarting after a power loss can be harder than shutting down. A network may survive reduced generation and then fail when pumps, computers, and heaters all attempt to restart at once. Interplanetary black-start logic should therefore be sequenced. Measurement and control return first, then the loads that stabilize the habitable environment, then navigation and communications, and only afterward the less critical services. Inrush current, preheat time, and stabilization delays belong in the scenario. The network should be able to start from a reduced source, such as a single battery string, without protective logic misclassifying the transient as another fault. A complete black-start test is consequently an architecture test, not a component demonstration.
Common-cause vulnerabilities often hide outside the energy hardware: protection software, a shared voltage sensor, converter cooling, contactor control, connectors, clocks, or configuration data. Two physically separate power chains may still rely on the same firmware or maintenance procedure. For a months-long Mars transfer, the design should permit a failed automation layer to be bypassed, allow operation with simpler fallback logic, and provide independent measurements for diagnosis. Redundancy then becomes diversity in decision paths as well as duplicated hardware. This is especially important in human spaceflight, where degraded operation must remain understandable when nominal sophistication is no longer available.
Electrical maintainability has to shape spacecraft geometry. A converter placed behind structure that cannot be opened, or a bus that cannot be isolated safely, turns a repairable failure into a long-term loss of capability. Critical equipment needs test points, accessible connectors, lockout methods, and a straightforward proof of return to service. Spares include more than major boxes: fuses, relays, current sensors, interface cards, harness sections, and connectors can stop the vehicle. A mature architecture defines replaceable units that match onboard tools, crew time, and test capability. That coherence can be worth more than a few kilograms saved in the original packaging study.
Electrical and thermal design are inseparable because almost every watt consumed ends as heat somewhere in the vehicle. Improving a 20 kW converter from 92 to 96 percent efficiency reduces losses from 1.6 kW to 0.8 kW, removing 800 W from the thermal system. Conversely, adding batteries for eight more hours of autonomy creates mass, thermal limits, and another heat source under high-rate charge or discharge. Electrical trades should therefore carry their thermal consequence explicitly. The best topology is not the one with the highest isolated efficiency; it is the one that closes energy, heat rejection, mass, maintainability, and fault behavior together.
Operational data should feed future decisions. Branch currents, battery temperature, cycle count, internal resistance, contactor states, and protection events form the health history of the network. Trends distinguish abrupt faults from slow aging and can reveal a shrinking margin before it becomes operationally critical. They also update models: if a solar wing consistently underperforms at a certain attitude, mission planning can use the measured behavior rather than the preflight prediction. A Mars vehicle should treat its electrical telemetry as a long-duration experiment on its own aging.
NASA's 2026 small-spacecraft power survey, Johnson power-test capabilities, and Orion subsystem descriptions provide useful evidence about conversion, storage, distribution, and verification. They do not demonstrate that a crewed Mars vehicle can copy a SmallSat or Orion architecture. The responsible use of those sources is to extract proven mechanisms—battery management, protection, power quality, integrated testing—then state what a long transit, increasing solar distance, limited rescue options, and onboard repair change. Keeping that boundary visible is what turns a source list into engineering reasoning.
From nameplate power to electrical survival of the spacecraft
An interplanetary electrical architecture is not sized by adding the maximum rating of every device. It is sized by mission states. Nominal cruise, a trajectory correction, eclipse, safe-haven operation, a failed converter and a restart sequence impose different combinations of loads and different margins. The power budget therefore becomes a timeline: which loads must operate together, for how long, and which ones may be shed without losing the vehicle? That question separates a list of watts from an architecture that can actually support a crew.
The first discipline is load classification. Minimum atmosphere control, minimum thermal control, command and data handling, survival communications and fire detection belong to the protected core. Comfort lighting, some experiments, workshop machines and part of the scientific computing can stop. Between them lies a difficult middle tier: redundant pumps, water heating, food preservation, suit charging and secondary networks. Their priority changes with outage duration. A fifteen-minute shedding event and a three-day degraded mode are different design problems.
Size a safe-haven state with an explicit energy budget
Consider a simple teaching case. A transit habitat must preserve a 7 kW survival core for 36 h: 2.5 kW for minimum life support, 1.5 kW for thermal control, 1 kW for avionics and communications, 1 kW for cold storage, and 1 kW of operational margin. Required energy is E = P × t = 7 × 36 = 252 kWh. If the battery-to-load chain delivers only 85% of stored energy as useful output, required storage becomes 252 ÷ 0.85 ≈ 296 kWh. E denotes energy, P power, t time, kW kilowatt and kWh kilowatt-hour. This is not a reference Mars design; it exposes assumptions that a real mission must replace with measured load profiles.
Storage mass then depends on technology and end-of-life margin. A cell advertised at 250 Wh/kg does not automatically provide 250 Wh/kg at installed-system level. Structure, wiring, power electronics, heaters, protection, depth-of-discharge reserve and ageing lower the usable figure. Using cell-level specific energy directly in a vehicle mass estimate would be optimistic. The book therefore distinguishes cell, module, installed battery and energy actually available at the worst mission point.
Distribution is a failure network as much as a power network
A single-line diagram should reveal failure boundaries. Two buses are not truly redundant if one contactor, one software function, one harness route or one compartment can remove both. The architecture must make common causes visible: a bay fire, fluid leak, insulation fault, command error, radiation event, arc or partially mated connector. Useful redundancy is physical, functional and logical separation, not merely two boxes in a diagram.
Converters also become thermal loads. If a converter set delivers 30 kW at 94% efficiency, internal loss is about 30 × (1/0.94 − 1) ≈ 1.9 kW. That heat must be collected and rejected. Improving electrical efficiency can therefore reduce radiator demand and cooling flow at the same time. Electrical and thermal budgets should be closed together, especially during attitudes that constrain radiator view to deep space.
Black start: how do you re-energize a spacecraft that nearly went dark?
A power system is not robust until it has a credible restart path. After a major loss, some controllers, sensors, valves and contactors require power before the primary source can be reconnected. A small independent source, protected from the same common causes, can energize this startup chain. The sequence must be testable: wake control, establish bus condition, isolate the fault, reconnect survival loads, stabilize thermal control, then restore nonessential functions progressively.
Restart is harder when the crew is simultaneously dealing with smoke, decompression or illness. Automation should therefore present an understandable state rather than a wall of alarms. Fault logs, electrical measurements and protection states should answer three questions: what has truly failed, what was isolated only as a precaution, and which action could make the event worse? A good electrical architecture is judged partly by the quality of that explanation.
Primary reference points
NASA Johnson Space Center — Power Subsystems documents power functions for human spaceflight systems. NASA — Orion spacecraft provides an operational example in which generation, storage, distribution, avionics and thermal control are tightly coupled. NASA 2026 State-of-the-Art — Power is useful for component technology in small spacecraft, but it is not direct qualification evidence for a crewed Mars transport.
Case study: survive one lost bus for forty-eight hours
Assume an insulation fault forces one of two main buses open. The problem is not merely whether the second bus has enough power. Survival loads must be reconnectable without crossing the fault, protection must remain selective, surviving converters must accept inrush current, and thermal control must reject their added losses. The scenario also needs energy for diagnosis, communications and the possibility of a second failure.
Suppose the survival core is 6 kW and another 2 kW is needed for eight hours per day for diagnostics, pumping and enhanced communications. Over 48 h, energy is 6 × 48 + 2 × 16 = 320 kWh. Adding 15% operational reserve gives 368 kWh useful. If the storage chain returns only 88% of nominal stored energy, nominal inventory must exceed 368 ÷ 0.88 ≈ 418 kWh. This arithmetic forces continuous load, intermittent load, reserve and efficiency to remain separate.
The case should then be narrated as an operation: detect the fault, open the affected section, confirm arc extinction, reconfigure, shed loads, verify battery balance, rotate nonessential loads if useful, inspect, and only then attempt restoration. If the crew cannot explain that sequence from the schematic and available displays, the architecture is too opaque.
The final margin is decision margin
A battery should not be planned to zero. As state of charge falls, available options shrink: heat a compartment, move fluid, run a workshop, recover an antenna or restart a pump. Threshold policy can preserve a degraded-operations zone, a survival zone and a physically protected reserve used only in emergency. Reserve becomes a risk-governance tool rather than a percentage appended to the spreadsheet.
Electrical power is therefore one of the mission's currencies. Every failure converts energy into time, diagnostic capacity and options. The best system is not simply the one with the most kilowatt-hours; it is the one that preserves enough options for the crew to understand, isolate and recover.
Power management is also crew workload management
Electrical failures do not occur in isolation. A bus fault may happen while the crew is sleeping, performing exercise or preparing a maneuver. The design should therefore minimize the number of immediate actions required to preserve the vehicle. Automatic shedding can protect the survival core, but the logic must remain understandable and reversible. A system that saves power by silently disconnecting equipment can create a second hazard if the crew no longer knows which functions are available.
Displays should separate energy state, source state and load state. “Battery 62%” is not enough. Operators need the predicted endurance of protected loads, expected solar or generation recovery, active shed groups, abnormal currents and the confidence of state-of-charge estimation. The same percentage can mean hours or days depending on load. Endurance is therefore often a more operationally useful quantity than raw state of charge.
State-of-charge uncertainty grows into an operational risk
Battery state is estimated, not directly observed. Current integration drifts, capacity changes with temperature and ageing, and cell imbalance may reduce usable energy before the average pack appears empty. A long mission should periodically reconcile estimates with voltage, known loads and calibrated events. Protection needs to account for the weakest module rather than the average cell.
If nominal stored energy is 500 kWh but uncertainty in usable capacity is ±8%, the planning range is roughly 460–540 kWh before other reserves. A survival plan that requires 480 kWh is therefore not comfortably inside the nominal value. Uncertainty has consumed much of the apparent margin. This is why margin should be attached to a model and measurement confidence, not simply a fixed percentage.
Electrical maintenance must be possible without making the vehicle dark
Contactors, converters, batteries and distribution units need isolation boundaries that allow one portion to be removed while the protected core remains powered. Test points and built-in diagnostics should support measurement without exposing the crew to hazardous energy. High-voltage systems add arc, insulation and connector risks that become especially important when work must be performed far from specialized ground support.
Spare strategy should distinguish replaceable modules from components that require depot-level work. Swapping a converter can restore service quickly; repairing its power electronics may require a later workshop period. That two-level maintenance concept reduces crew exposure during an emergency while still preserving the possibility of recovering the failed module.
The architecture should survive bad timing
The hardest electrical case may be a failure immediately before a maneuver, during limited communications or after several days of poor generation. Scenario analysis should deliberately combine events rather than test one fault at a time. The purpose is not to invent improbable disasters but to identify dependencies that make two individually manageable problems dangerous when they overlap.
A robust design therefore preserves options: enough stored energy to defer a nonessential maneuver, alternate paths to power flight computers, and clear shedding rules. Electrical power is not merely a subsystem; it is the infrastructure that gives every other subsystem time to recover.
Energy forecasting should be tested against reality
A long mission will accumulate prediction error unless energy models are periodically compared with measured operation. Every major mode can produce a record of generation, conversion loss, battery change and load consumption. Differences between predicted and measured energy reveal degradation, hidden loads or sensor bias. This turns the power budget from a preflight document into a living model.
For example, if a nominal eight-hour mode is expected to consume 48 kWh but repeated operation measures 52 kWh, the four-kilowatt-hour difference should not simply be absorbed by margin. Engineers should identify whether the load profile changed, a converter lost efficiency, a heater ran longer, or the measurement itself is biased. Repeated unexplained difference is evidence of a model that no longer represents the vehicle.
Power quality matters as well as total energy
Voltage, ripple, transients and electromagnetic compatibility can determine whether equipment survives switching events. A battery may contain ample energy while a converter transient resets a flight computer or corrupts a sensor. Distribution architecture therefore needs protection coordination and acceptance tests for dynamic behavior, not only steady-state current.
Load startup can be a special case. Motors, heaters and capacitive electronics may draw short current peaks far above average consumption. If several are restored simultaneously after an outage, the bus may collapse even though the long-term power budget is adequate. Restart sequencing is therefore part of power design.
The crew needs a clear hierarchy of electrical authority
Automatic protection may isolate hardware faster than humans can react, but the crew needs to know which commands are safe afterward. Some protections should be resettable; others should require stronger evidence because a second closure could create an arc or battery hazard. The interface should distinguish recommendation, automatic action and crew override.
That authority hierarchy also protects against software faults. A high-level application should not be able to defeat every hardware protection. Independent current limiting, fusing or contactor logic creates boundaries between software convenience and physical safety.
The operational conclusion is simple: every power budget should be readable as remaining energy, endurance and preserved options. An isolated electrical value is not enough. Over a journey lasting months, safety comes from coupling generation, storage, distribution, thermal control, maintenance and human understanding of the system.
Design electrical power as a survival timeline, not a nameplate number
Installed generating power does not tell a crew what the spacecraft can survive. Architecture has to describe generation in each mission phase, stored energy, conversion losses, short-duration peaks, loads that cannot be shed and the sequence used when capacity falls. A power system becomes operationally mature when engineers can tell the first minutes, hours and days after a source or bus is lost.
Backup energy: expose every factor in the calculation
Suppose essential loads require P = 6 kW for a target endurance Δt = 12 h. Useful energy is Eu = P × Δt = 72 kWh. If allowable depth of discharge is DOD = 0.80 and useful path efficiency is η = 0.90, nominal stored capacity becomes En = Eu / (DOD × η) = 72 / 0.72 = 100 kWh. DOD is the dimensionless usable fraction of battery capacity; η is dimensionless efficiency. Ageing and temperature should be represented as separate margins rather than silently folded into one percentage.
Black start is an architecture requirement
A black start restores an electrical network without relying on its normal energized state. Sequence matters. A protected battery may first wake power-control avionics, then thermal circulation, then start a main source, and only later restore large loads. If pumps, heaters and transmitters all inrush together, bus voltage can collapse even when total stored energy is ample. Restart logic therefore belongs in power design, software, procedures and integrated test.
Failure case: one bus lost while thermal demand rises
Consider a fault that isolates one distribution branch while vehicle attitude produces a colder thermal condition. Thermal control asks for more heater power at the same moment electrical capacity has fallen. The correct response prioritises life support, avionics, thermal transport and minimum communications, while deferring science, comfort and high-energy maintenance. Mission success is not defined as keeping every load alive; it is preserving the functions needed to diagnose and recover.
Protection must distinguish a short circuit from a legitimate transient
Motors and converters can draw high start current without being faulty. Insulation damage or arcing can create a dangerous event that may not look like a simple overload. Protection coordination therefore considers current magnitude, time, fault direction and network topology. Devices that trip too aggressively can create cascading loss; devices that wait too long can sacrifice cables or converters. Selectivity is part of resilience.
Power management is also crew workload management
An electrical architecture that requires humans to interpret hundreds of breaker states during an emergency is fragile. Automation should present the functional consequences of a reconfiguration—what service is lost, how long backup lasts, which action restores margin—while retaining traceability to the physical bus and protection device. The crew needs an explainable energy picture, not a wall of unexplained alarms.
Maintainability closes the loop
A redundant converter that cannot be isolated, tested or replaced is not useful redundancy on a multi-year mission. Long-duration design includes access, connectors, spares, safe test points, post-repair verification and controlled return to service. Electrical distribution is best understood as a reconfigurable utility whose actual configuration is always known.
Sources and references
- NASA NTRS — Power System Design Trades for a Pressurized Lunar/Mars Rover
- NASA Small Spacecraft Systems Virtual Institute — Power
Primary NASA sources
These references provide documentary guardrails;
- NASA - 2026 State-of-the-Art: Power
- NASA Systems Engineering Handbook
- NASA - 2026 State-of-the-Art of Small Spacecraft Technology
- NASA NTRS — Fault Detection and Diagnosis in Spacecraft Electrical Power Systems — autonomous electrical fault diagnosis
- NASA Moon to Mars — Power Systems — generation, storage, conditioning and distribution