Page snapshot A practical definition (bus → distribution → proof)

This page focuses on the 28–50 V spacecraft power bus chain as an engineering system that can be specified, protected, measured, and verified: source interfaces (solar array and battery), bus conditioning (filtering and inrush), distribution/isolated channels, rad-hard DC-DC conversion, deterministic sequencing, SEL/latch-up containment, and telemetry that feeds power FDIR. The goal is not “power theory,” but a bus-power architecture that survives radiation effects, recovers from faults in controlled ways, and produces health data that can be audited.

• Rad-hard readiness: design choices are tied to TID/SEE outcomes (drift, transients, latch-up) and how the bus chain is qualified.
• Deterministic sequencing: rails and channels have explicit ordering, timeouts, and retry policy (not “best effort”).
• Fault containment + measurability: SEL/short events are isolated quickly, and V/I/T telemetry supports diagnosis and trend health.

Scope boundaries In-scope vs mention-only vs out-of-scope

What can be verified Concrete outcomes this page enables

• Bus chain contract: a clear boundary from source interfaces to PCDU outputs, including where conditioning, isolation, and telemetry live.
• Fault response logic: a repeatable reaction to overload, short, over-temperature, and suspected SEL (isolate → cool-down → limited retry or latch-off).
• Telemetry for health: which measurements (V/I/T) support anomaly classification, energy budgeting, and trend-based maintenance decisions.
• Qualification evidence: what tests prove the bus-power chain is mission-ready under thermal-vac and radiation-driven fault drills.

Design depth is expressed as decision criteria, protection timing, interface contracts, and verification steps—rather than generic topology tutorials.

Where the bus sits Distribution-layer voltage with explicit contracts

In a spacecraft power tree, 28–50 V is typically a distribution-layer voltage: high enough to reduce harness current (and I²R loss) while still practical for protected switching, isolation, and conversion into load rails. The bus is not “the final rail.” It is the common trunk where protection, segmentation, and measurement are centralized so that a single fault does not collapse the entire power domain.

• Upstream interfaces: source inputs are treated as interfaces (availability, envelope, return path), not taught subsystems.
• Bus layer duties: conditioning, inrush control, distribution segmentation, conversion entry points, telemetry, and fault policy.
• Downstream handoff: bus outputs define what loads can assume (steady-state, transient limits, channel isolation behavior), without teaching load internals.

Regulated vs unregulated bus Decision matrix (engineering trade-offs)

“Regulated” and “unregulated” refer to where tight voltage control is enforced. The choice impacts efficiency, transient behavior, distribution losses, and—critically—fault containment and recovery. The practical goal is to create a bus contract that downstream channels can tolerate and that FDIR can reason about.

A “better” choice is the one that yields a measurable contract: known bus envelope + known isolation behavior + known recovery policy.

PCDU/PPU minimum set The smallest chain that is still mission-proof

The power-control and distribution unit (PCDU/PPU) is best described as a sequence of required functions, not a single box. Each function exists at the bus layer because it reduces the probability that a local fault becomes a system-wide power event.

• Input conditioning: define the bus envelope with filtering, inrush limiting, and transient clamping so converters see predictable stress.
• Distribution segmentation: switchable or protected channels isolate short/overload events to a branch instead of collapsing the bus.
• Conversion entry: rad-hard conversion stages create the “rails family,” with isolation chosen to contain faults and manage noise/returns.
• Sequencing & gating: deterministic ordering and timing prevents ambiguous partially-powered states; timeouts and retry rules avoid oscillatory brownouts.
• SEL/latch-up containment: fast detect-and-cut limits energy during latch-up; controlled cool-down and retry limits repeated stress.
• Telemetry pipeline: voltage/current/temperature measurement turns power into observable health data that FDIR can classify and log.
• Power FDIR policy: fault signatures map to actions (isolate, retry, latch-off, log) with bounded retries and explicit safe states.

The system-level objective is fault containment with traceable evidence: not only “it survived,” but “which channel faulted, how it recovered, and what measurements justify the decision.”

Interface contract What downstream loads may assume (without teaching them)

• Envelope: nominal bus range, allowed droop/overshoot limits, and recovery time after a protection event.
• Isolation behavior: whether a branch fault is local (preferred) or can backfeed/propagate (must be prevented).
• Sequencing rules: what must be stable before enabling a rail/channel, and how long “PG” must remain valid.
• Telemetry semantics: how to interpret measured I/V/T (sampling windowing, averaging vs peak capture, and fault counters).

Why this matters Space turns “power design” into proof-based engineering

In spacecraft bus power, constraints are not abstract environment notes—they translate directly into predictable fault signatures and required response behavior. Radiation effects shift parameters over life (TID), inject transients (SET), or trigger sustained overcurrent (SEL). Vacuum and lifetime constraints make temperature the dominant driver of reliability, because heat removal relies on controlled conduction paths and radiation, not airflow. A robust bus-power chain must therefore be designed so that drift is budgeted, transients do not cause false trips, and hard faults are contained quickly.

Event types TID vs SET vs SEL (power-system viewpoint)

• TID (Total Ionizing Dose): cumulative shift of references and device parameters that changes regulation accuracy, thresholds, and efficiency over mission life.
• SET (Single-Event Transient): short disturbances that can appear as droop spikes, PG glitches, or temporary control-loop perturbations.
• SEL (Single-Event Latch-up): sustained parasitic conduction that manifests as a persistent overcurrent condition until energy is removed.

This page focuses on how these events appear in bus-power measurements and how protection and sequencing policies are set to avoid ambiguous or oscillatory behavior.

3-layer impact map Device → module → system (what changes and why)

Soft vs hard faults FDIR must separate “recoverable noise” from “energy-cut events”

A spacecraft bus-power chain must treat events differently based on whether they are soft (temporary, non-damaging, recoverable) or hard (persistent, potentially destructive). The practical separation is: duration + energy. A short droop should not permanently disable a channel, while a sustained overcurrent must be isolated quickly.

• Soft class: short droop or PG glitch → debounce + log + allow continued operation, unless repetition exceeds a threshold.
• Hard class: sustained overcurrent (suspected SEL or short) → isolate, cool down, then controlled retry (bounded count) or latch-off.
• Evidence: store event counters and last-fault signature (which channel, peak current, duration bucket, temperature at trip).

Decision frame Select a topology by input range, power class, and fault containment

For a 28–50 V spacecraft bus, DC-DC conversion is most useful when treated as an interface contract: the chosen topology must tolerate the bus envelope, deliver the required rail family, and behave predictably under overload and radiation-driven events. Practical selection begins with power class and how many outputs must be produced, then checks whether isolation is needed for functional partitioning, noise control, or hard-fault containment.

• Low power / multi-output: Flyback is often favored for compact multi-rail conversion, but requires careful ripple/EMI management.
• Medium power: Forward-derived approaches can offer a stable balance of efficiency, magnetics size, and EMI controllability.
• Higher power: Push-pull or half-bridge can scale efficiently, at the cost of higher drive/magnetics complexity and stricter symmetry/control.

Isolation strategy Functional, noise, and fault isolation (engineering purpose)

Isolation in spacecraft power is not a checkbox—it is a design tool used to define domains, control return paths, and contain faults. Isolation choices must be consistent with the protection philosophy of the bus: a branch fault should remain a branch event, not a system event.

• Functional isolation: separates power domains so an off-nominal condition in one domain does not shift references in another.
• Noise isolation: blocks switching noise and common-mode coupling from returning to the bus or sensitive rails through unintended paths.
• Fault isolation: limits fault energy propagation during overload/SEL, enabling fast isolate-and-recover behavior per channel.

Only power isolation is discussed here. Data-link isolation details are intentionally excluded.

Topology selection table Practical criteria (spacecraft bus-power context)

Engineering knobs Efficiency–EMI–thermal triangle (what can be tuned)

• Synchronous rectification: improves efficiency and reduces heat, but adds drive complexity and verification burden.
• Switching frequency: higher frequency can shrink magnetics and filters, but increases switching loss and may worsen EMI margin.
• Magnetics design: leakage and coupling drive both efficiency and EMI; design must align with isolation goals and thermal paths.
• Output filtering: filters reduce ripple but can slow transient response; selection must match sequencing and PG qualification windows.

A space-ready choice is the one that preserves margin after derating and still demonstrates stable, repeatable protection timing.

What “selection” means A criteria checklist, not a shopping list

Rad-hard power selection is strongest when it is treated as a verifiable contract: input envelope tolerance, end-of-life (EOL) output accuracy, predictable protection behavior, and measurable recovery actions. This section provides a criteria checklist and reading method that stays stable across vendors, parts, and mission programs.

Selection checklist Minimum criteria for a 28–50 V bus converter

How to read datasheets A repeatable “power-first” reading order

• Step 1 — Boundaries: input range, output range, start-up constraints, and any “do not cross” absolute maximums.
• Step 2 — Protection truth: identify how OCP/OVP/OTP/UVLO behave, not just that they exist.
• Step 3 — Efficiency & heat: find efficiency curves and convert them into heat expectations at the baseplate limits.
• Step 4 — Drift sources: temperature drift + long-term drift; treat EOL accuracy as a requirement, not a bonus.
• Step 5 — SEE perspective: classify events as “transient disturbances” vs “sustained current hazards” and plan matching actions.
• Step 6 — Evidence quality: separate guaranteed specifications from characterization; note test conditions and their match to the bus envelope.

Failure modes Common ways space DC-DCs break the system contract

• Margin erosion: output drift plus rising temperature pushes rails into UV/OV windows or reduces load headroom.
• Nuisance trips: SET-driven droops cause PG chatter or UV events when debounce/integration windows are too short.
• Thermal runaway: efficiency degradation increases heat; without derating, protection thresholds become unstable and recovery oscillates.
• Hard current events: SEL or downstream shorts create persistent overcurrent; without fast isolation, bus sag and localized damage become likely.

Margin stack template A compact budget to prove EOL headroom

A practical margin stack answers one question: after worst-case input, EOL efficiency drift, and temperature rise, does output accuracy still meet the system headroom requirement? Use the stack below as a repeatable template.

This template intentionally avoids part numbers. It is designed for consistent review, audit, and verification planning.

Front-end contract Make the bus interface predictable and measurable

The front end from the bus terminal to the converter input defines whether the spacecraft bus behaves like a stable source or a coupled resonant system. A robust conditioning chain limits peak energy, controls conducted emissions, prevents reverse/backfeed, and constrains inrush so that start-up and recovery are repeatable across temperature and bus variations.

Typical chain A practical block order for 28–50 V conditioning

• Clamp / limiter: limits spike energy and protects downstream stages from brief excursions.
• EMI filter (LC/π): reduces conducted noise; the filter Q must be controlled to avoid low-frequency ringing.
• Reverse & backfeed protection: prevents unintended current flow during off-nominal states or channel interactions.
• Inrush limiter / hot-swap stage: controls charging of input capacitance and prevents bus droop during start-up.
• Segmented enable: sequences power-up so that not all branches present peak demand at the same instant.

This section intentionally focuses on power-layer conditioning, not on regulatory compliance text.

Inrush made predictable The minimum model and the tuning knobs

The goal of inrush design is not “zero surge”—it is a bounded and repeatable peak current that does not cause bus droop or protection oscillation. A simple first-order model is often sufficient to set expectations:

• C_in: total effective input capacitance (including distributed capacitance near the converter).
• dV/dt: the controlled rise rate set by soft-start or current-limit control.
• Current limit threshold: sets the peak; pairing it with a time qualifier avoids repetitive “hiccup” cycles.
• Segmenting: splitting large capacitance across stages reduces a single large surge event.

Verification cue: measure I_peak and bus droop at worst-case cold start, minimum bus, and maximum downstream capacitance.

Input filter interaction Prevent coupled oscillation (engineering method)

An EMI filter is a dynamic element. If its resonance interacts with the converter’s input behavior, start-up or load steps can produce low-frequency ringing or repeated protection trips. The practical objective is to keep the input network well-damped.

Fault containment A branch fault should remain a branch event

The bus-conditioning chain should prevent a downstream short or sustained current event from collapsing the whole bus. Containment relies on two elements: fast energy limitation and clean isolation boundaries.

• Energy limit: current limiting and fast disconnect prevent bus sag and reduce local thermal stress.
• Isolation boundary: per-branch gating allows other branches to remain operational during a fault event.
• Measurable signatures: V/I taps on both sides of the conditioning chain help separate a transient droop from a sustained fault.
• Controlled recovery: cool-down and limited retries avoid oscillation and repeated damage during persistent faults.

Design goal Deterministic start-up, observable faults, recoverable behavior

Sequencing is most useful when it behaves like a repeatable control process rather than a one-time “power-up script”. The contract is: rails rise in a known order and slope, dependencies are enforced (PG/UV/thermal), failure reasons are classified with a code, and retries are controlled to avoid oscillation, repeated stress, or full-bus collapse.

Sequencing axes Order, slope, and dependencies (PG/UV/thermal)

• Order: group rails into primary power, sensitive analog, and interface/aux rails; enforce must-before/must-after constraints.
• Slope: soft-start and dV/dt must avoid both bus droop and internal load stress; slow ramps can cause PG timeout while fast ramps can excite transients.
• Dependencies: PG should represent a qualified “OK” state—voltage in range and stable enough to allow the next rail, reset release, or mode transition.

PG & reset as timing Blanking, debounce, and timeout prevent false decisions

Power-good and reset logic must tolerate switching ripple and brief disturbances without misclassifying them as a failed rail. A timing contract makes this deterministic:

Failure taxonomy Make “why it failed” explicit and actionable

A recoverable system distinguishes transient conditions from persistent faults. A compact taxonomy improves logging, decision making, and retry safety:

• UV / brown-in: rail cannot maintain regulation or collapses during dependency checks.
• PG_timeout: ramp/settling exceeds allowed time (often load anomaly or current limiting).
• OCP_event: current exceeds allowed profile; treat persistent faults differently from short bursts.
• Thermal inhibit: temperature or thermal model indicates unsafe operation; prevents entering RUN.
• External inhibit: upstream command or safety interlock blocks progression (safe hold state).

Safe retry policy Controlled recovery prevents oscillation and cumulative stress

“One-shot success” is not the target. The target is bounded recovery: retry only when conditions are likely to have improved, and stop after a defined count or fault class.

Retry count and cooldown should be explicitly logged as part of the fault record (reason code + counter).

Engineering target Cut energy in milliseconds without false kills

SEL protection is a power-layer safety loop. The purpose is to interrupt energy fast when a sustained abnormal current event appears, while avoiding accidental shutdown during legitimate current bursts (start-up, load steps, switching ripple). A robust design pairs a time-qualified decision with a fast disconnect and a controlled recovery policy.

Protection chain Sense → integrate → trip → disconnect → cooldown → retry/latch

• High-side current sense: produces an observable I_sense that tracks branch energy.
• Threshold + integration window: classifies sustained abnormal current while rejecting short bursts and ripple.
• Trip action: generates a TRIP signal that commands a fast disconnect device (eFuse / switch stage).
• Hold-off: enforces a cooldown interval before attempting recovery.
• Retry logic: allows limited retries and escalates to latch-off with a reason code if repetition is detected.

This section focuses on the protection chain behavior, not on radiation monitor device design or dose modeling.

Avoid false trips Separate “short bursts” from “sustained abnormal current”

False kills usually come from normal peak current (start-up, load steps) being treated as a latch-up. Time qualification is the practical discriminator:

Parameter setting Four knobs that bound risk and improve recoverability

A practical SEL policy is defined by four parameters. Together they bound the maximum energy delivered to a fault and control recovery stability.

Reset strategy Controlled recovery: retry when safe, latch when persistent

• Immediate isolation: once TRIP is declared, disconnect quickly to bound energy.
• Cooldown before retry: allow thermal and electrical settling before reenabling the branch.
• Retry counter: cap repeated attempts; escalation to latch-off prevents indefinite cycling.
• Reason code logging: record “SEL_suspected” (or equivalent) with timing and counter values to support downstream diagnosis.