5.10 Electrical Power System Design Tools

Reference Documents

Launch Services Program Level Dispenser and CubeSat Requirements Document [NASA LSP-REQ-317.01]

Electronic systems will be designed with the following safety features. These specifications are applicable to all dispensers.

2.3.1 To prevent CubeSat from activating any powered functions, the CubeSat power system shall be at a power-off state from the time of delivery to the LV through on-orbit deployment.

2.3.1.1 Note: CubeSat powered function includes a variety of subsystems such as C&DH, RF Communication, ADC, deployable mechanism actuation. CubeSat power systems include all battery assemblies and solar cells.

2.3.1.2 Powered-on battery protection circuitry may be permitted per specification 2.3.6.

2.3.2 The CubeSat shall have, at a minimum, one deployment switch, which is actuated while integrated into the dispenser.

2.3.2.1 In the actuated state, the CubeSat deployment switch shall electrically disconnect the power system from the powered functions.

2.3.2.2 The deployment switch shall be in the actuated state at all times while integrated into the dispenser.

2.3.2.3 In the actuated state, the CubeSat deployment switch should be at or below the level of any external surface that interfaces with the dispenser or neighboring CubeSat. This ensures that the switch will not damage or interfere with the contacting surface.

2.3.2.4 If the CubeSat deployment switch toggles from the actuated state and back, the satellite shall reset to a pre-launch state, including reset of transmission and deployable timers.

2.3.3 Real-Time Clocks (RTC) may be permitted if they satisfy requirements 2.3.2.1 through

2.3.3.1 RTC circuits shall be isolated from CubeSat’s main power system.

2.3.3.2 RTC frequencies shall be less than 320 kHz.

2.3.3.3 RTC circuits shall be current that is limited to less than 10 mA.

2.3.4 The RBF pin and all CubeSat umbilical connectors shall be within the designated access port locations if available on the CubeSat’s dispenser. Please contact the manufacturer for specific charging and diagnostic port locations and procedures.

2.3.4.1 Note: Some dispensers do not have access ports, therefore the RBF must be removed before insertion into the dispenser. It is advised that the CubeSat developer takes this possibility into account when designing the power-on and boot-up sequence.

2.3.5 The CubeSat shall include an RBF pin, which cuts all power to the satellite once it is inserted into the satellite.

2.3.5.1 Access to the CubeSat is not guaranteed during or after integration. The RBF pin shall be removed from the CubeSat before integration into the dispenser if the dispenser does not have access ports.

2.3.5.2 The RBF pin shall protrude no more than 6.5 mm from the CubeSat rail surface when it is fully inserted into the satellite.

2.3.6 CubeSats shall incorporate battery circuit protection for charging/discharging to avoid unbalanced cell conditions. Additional manufacturer documentation and/or testing will be required for modified, customized, or non-UL-listed cells.

2.3.7 The CubeSat shall have at least three independent RF inhibits to prohibit inadvertent RF transmission.

2.3.7.1 Note: An inhibit is a physical device between a power source and a hazard.

2.3.7.2 Note: A timer is not considered an independent inhibit.

2.3.7.3 Note: Some launch vehicle providers will only require one or two independent inhibits depending on the CubeSat’s RF power output. However, the use of three independent inhibits is highly recommended and can reduce required documentation and analyses.

2.3.8 The CubeSat shall have at least three independent inhibits to prohibit the inadvertent release of any deployable structures such as antennas or solar panels.

Reference Documents

Electrical Requirements Excerpt from NanoRacks External CubeSat Deployer (NRCSD-E) Interface Definition Document (IDD) [NR-NRCSD-S0004]

CubeSat electronic system designs shall adhere to the following requirements.

4.2.1 Electrical System Design and Inhibits

1) All electrical power storage devices shall be internal to the CubeSat.

2) To minimize hazard potential, the CubeSat shall not operate any system (including RF transmitters, deployment mechanisms or otherwise energize the main power system) for a minimum of 30 minutes after deployment. Satellites shall have a timer (set to a minimum of 30 minutes and requiring appropriate fault tolerance) before satellite operation or deployment of appendages.

3) The CubeSat electrical system design shall incorporate a minimum of three (3) independent inhibit switches actuated by physical deployment switches as shown in Figure 4.2.1-1. The satellite inhibits scheme shall include a ground leg inhibit (switch D3 in Figure 4.2.1-1) that disconnects the batteries along the power line from the negative terminal to the ground. Note: This requirement considers an inhibit as a power interrupt device, and control for an inhibit (electrical or software) cannot be counted as an inhibitor or a power interrupt device. The requirement for three (3) inhibits is based on the worst-case assumption that the CubeSat contains a potentially catastrophic hazard that exists in the event of an inadvertent power-up while inside the NRCSD-E. However, the electrical system design shall incorporate an appropriate number of inhibits dictated by the hazard potential of the payload. If this requirement cannot be met, a hazard assessment can be conducted by NanoRacks to determine if an exception can be granted and documented in the unique payload ICA.

4) The CubeSat electrical system design shall not permit the ground charge circuit to energize the satellite systems (load), including flight computers (see Figure 4.2.1-1). This restriction applies to all charging methods.

5) The CubeSat shall have a remove before flight (RBF) feature or an application before flight (ABF) feature that keeps the satellite in an unpowered state throughout the ground handling and integration process into the NRCSD-E. Note: The RBF pin is required in addition to the three (3) inhibit switches. See Section 4.1.2 for details on mechanical access while the payload is inside the NRCSD-E.

6) The RBF/ABF feature shall preclude any power from any source operating any satellite functions with the exception of pre-integration battery charging.

4.2.2 Electrical System Interfaces

1. There shall be no electrical or data interfaces between the CubeSat and the NRCSD-E. As outlined in Section 4.2, the CubeSat shall be completely inhibited while inside the NRCSD-E.

4.4.7 Batteries

All cells and batteries on the CubeSat shall adhere to the design and testing requirements for spacecraft flight onboard or near the ISS as derived from the NASA requirement document JSC 20793 Crewed Space Vehicle Battery Safety Requirements. Specific provisions for battery use are designed to ensure that a battery is safe for ground personnel and ISS crew members to handle and operate during all applicable mission phases, particularly in the enclosed environment of a crewed space vehicle. These NASA provisions also ensure that the battery is safe for use in launch vehicles, as well as in unpressurized spaces adjacent to the habitable portion of a space vehicle. The required provisions encompass hazard controls, design evaluation, and verification. Evaluation of the battery system must be completed prior to certification for flight and ground operations. Certain battery cell chemistries and battery configurations may trigger higher scrutiny to protect against thermal runaway propagation.

It is imperative that NanoRacks receive all requested technical data as early as possible to ensure the necessary safety features are present to control the hazards associated with a particular battery design and to identify all necessary verifications and testing required (as documented in the unique payload ICA). Redesign efforts greatly impact the PD both in cost and schedule. Consult with NanoRacks before hardware is manufactured. Cell/battery testing associated with the verification of the safety compliance shall be completed as part of the safety certification of the spacecraft. To comply with the requirements herein, every battery design, along with its safety verification program, its ground and/or on-orbit usage plans, and its post-flight processing shall be evaluated and approved by the appropriate technical review panel in the given program or project and captured in the unique payload ICA.

4.4.7.2 Battery Types

Although any battery may be made safe to fly in the crewed space vehicle environment, there are some batteries that are not practical to make safe. For example, lithium-sulfur dioxide cells have built-in overpressure vents that release SO2 (sulfur dioxide) gas and other electrolyte components that are highly toxic; thus, these are unacceptable in the habitable area of a space vehicle. However, these chemistries have been used safely in the non-pressurized areas of crewed spacecraft. Often the cells used in batteries for crewed space vehicles are commercially available.

Battery types typically used in spacecraft include:

• Alkaline-manganese primary
• LeClanche (carbon-zinc) primary
• Lead-acid secondary cells having immobilized electrolyte
• Lithium/lithium-ion polymer secondary (including lithium-polymer variation)
• Lithium metal anode primary cells will have the following cathodic (positive) active materials
•  Poly-carbon monofluoride
•  Iodine
•  Manganese dioxide
•  Silver chromate
•  Sulfur dioxide (external to habitable spaces only)
•  Thionyl chloride
•  Thionyl chloride with bromine chloride complex additive (Li-BCX)
•  Iron disulfide
• Lithium-sulfur
• Mercuric oxide-zinc primary
• Nickel-cadmium secondary
• Nickel-metal hydride secondary
• Silver-zinc primary and secondary
• Zinc-air primary
• Sodium-sulfur secondary (external to habitable space)
• Thermal batteries

4.4.7.3 Required Battery Flight Acceptance Testing

•  All flight cells and battery packs shall be subjected to an approved set of acceptance screening tests to ensure the cells are able to perform in the required load and environment without leakage or failure. While the specific test procedures vary depending on the type of battery, the majority of lithium-ion or lithium polymer cells or batteries used can be tested to a statement of work issued by NanoRacks (NR-SRD-139). Some generic battery design requirements are outlined below. Note: The battery test plan and verification approach shall be captured in the payload unique ICA. No testing shall be performed without the approval of NanoRacks.

4.4.7.4 Internal Short

Protection circuitry and safety features shall be implemented at the cell level to prevent an internal short circuit.

• Application of all cells shall be reviewed by NanoRacks.
• Charger circuit and protection circuit schematics shall be reviewed and evaluated for required fault tolerance.

4.4.7.5 External Short

Protection circuitry and safety features shall be implemented at the cell level to prevent an external short circuit.

• Circuit interrupters that are rated well below the battery’s peak current source capability shall be installed in the battery power circuit. Interrupters may be fuses, circuit breakers, thermal switches, positive temperature coefficient (PTC) thermistors, or other effective devices. Circuit interrupters other than fuses shall be rated at a value equal to or lower than the maximum current that the cell is capable of handling without causing venting, smoke, explosion, fire, or thermal runaway.

• The battery case is usually grounded/bonded to the structure; the interrupters should be in the ground (negative) leg of a battery where the negative terminal is connected to the ground. Where the circuit is “floating,” as in plastic battery cases used in portable electronic devices, the circuit interrupters can be placed in either leg. In either case, the circuit interrupters should be placed as close to the cell or battery terminals as the design allows, maximizing the zone of protection.

• All inner surfaces of metal battery enclosures should be anodized and/or coated with a non-electrically conductive electrolyte-resistant paint to prevent a subsequent short hazard (if applicable).

• The surfaces of battery terminals on the outside of the battery case should be protected from accidental bridging.
• Battery terminals that pass through metal battery enclosures should be insulated from the case by an insulating collar or other effective means.

• Wires inside the battery case should be insulated, restrained from contact with cell terminals, protected against chafing and physically constrained from movement due to vibration or shock.

• In battery designs greater than 50 Vdc, corona-induced short circuits (high-voltage induced gas breakdown) shall be prevented.

4.4.7.6 Overvoltage and Undervoltage Protection

• Protection circuitry and safety features shall be implemented at the cell level to prevent overvoltage or undervoltage conditions of the cell.

4.4.7.7 Battery Charging

• It should be verified that the battery charging equipment (if not the dedicated charger) has at least two levels of control that prevent it from causing a hazardous condition on the battery being charged. Note: This does not apply if the CubeSat will not be charged at NanoRacks.

4.4.7.8 Battery Energy Density

• For battery designs greater than 80 Wh energy employing high specific energy cells (greater than 80 watt-hours/kg, for example, lithium-ion chemistries) require additional assessment by NanoRacks due to potential hazard in the event of single-cell, or cell-to-cell thermal runaway. Note: Any system over 80 Wh requires additional design scrutiny and testing (likely including destructive thermal runaway testing). It is possible that this additional testing may be avoided by implementing design features in the system, such as splitting up the cells into distinct battery packs less than 80 Wh and physically isolating them at opposite ends of the CubeSat (so that thermal runaway cannot propagate between packs). Other methods such as reducing the state of charge of the batteries at the time of delivery can be explored with the JSC Battery Safety team to reduce the risk of a thermal runaway event.

4.4.7.9 Lithium Polymer Cells

• Lithium polymer cells (i.e., “pouch cells”) shall be restrained at all times to prevent inadvertent swelling during storage, cycling, and low pressure or vacuum environments with pressure restraints on the wide faces of the cells to prevent damage due to pouch expansion. Coordinate with NanoRacks for guidance on the specific implementation.

4.4.7.10 Button Cells

• Button cell or coin cell batteries often are used in COTS components to power real-time clocks (RTCs), watch-dog circuits, or secondary systems for navigation, communication, or attitude control. These batteries shall be clearly identified by part number and UL listed or equivalent. Note: Flight acceptance screening testing of these cells typically is not required; only a functional test of the system needs to be reported. NanoRacks confirms requirements upon documentation of all coin cell part numbers in the unique payload ICA.

4.4.7.11 Capacitors Used as Energy Storage Devices

• Capacitors are used throughout today’s modern electronics. Capacitors used as energy storage devices are treated and reviewed like batteries. Hazards associated with leaking electrolytes can be avoided by using solid-state capacitors. Any wet capacitors that utilize liquid electrolytes must be reported to NASA. The capacitor part number and electrolyte must be identified, along with details of how the capacitor is used and any associated schematics. Note: NanoRacks will advise on any required flight acceptance screening testing once the information has been captured in the payload unique ICA.

4.4.9.4 Electrical Bonding

• All spacecraft components shall be electrically bonded per SSP 30245 to ensure the spacecraft is free from electrical shock and static discharge hazards. Typically, spacecraft components may be bonded by either nickel plating or chemical film-treated faying surfaces or dedicated bonding straps.

JSC 20793 Crewed Space Vehicle Battery Safety Requirements

4.2.2 Qualification Testing

This section addresses the qualification testing of the flight battery.

1. Qualification testing shall be performed to the worst-case relevant flight environments with margin. The qualification sample of batteries should be randomly sampled from units from the flight lot that have passed acceptance testing.

2. Environmental tests shall include, at a minimum, extreme temperature exposures, vacuum, and vibration tests. The margin used for qualification tests will be provided by the respective projects or programs or from SSP41172 for ISS environments. Appendix A may be used as a guideline for qualification vibration tests (QVTs) for cells and batteries if there are non-project-provided environments. The margin proposed here should be consistent with the program’s margin policies. In the event, none are provided, as a guideline, 6 db above the maximum expected is typically used. The qualification of the battery should include testing the batteries to environmental and vibration levels that are higher than the mission requirements. The number of flight missions that the batteries will be used for, along with the location of the battery in the spacecraft, should determine the period and level of vibration. As a minimum, the qualification test program should include the following:

• • • Functional baseline test (open-circuit voltage (OCV), mass, capacity or load check, internal resistance, visual inspection).

• • • Vibration to qualification levels.
    • Functional baseline test recheck.

3. Charge/discharge cycles (for rechargeable batteries) or a load test (for primary batteries) at 20 degrees Fahrenheit (°F) margin above and below worst-case hot and worst-case cold, respectively.

4. Functional baseline test recheck.

5. Vacuum (approx. 0.1 psi) or equivalent leak checks.

6. Functional baseline test recheck. For batteries used in a pressurized volume or environment, exposure to a vacuum environment (approximately 0.1 psi) for a minimum of 6 hours should be carried out. For batteries used in an unpressurized volume or environment, thermal vacuum cycles must be performed with the deep vacuum levels below 1 × 10–4 Torr (instead of the 0.1 psi used for habitable volume/pressurized environments). Alternatively, the thermal cycles and vacuum environment tests can be performed independently. If the acceptance test vibration levels and spectra used to screen cells for manufacturing defects are not enveloped by the mission vibration levels, a separate qualification for acceptance vibration test (AVT) should be performed to verify that the screening levels do not degrade cell reliability. The qualification batteries should pass all cell and battery acceptance tests as described in Section 4.2.3 prior to subjecting them to qualification tests. For custom battery designs, safety (abuse) testing performed during engineering evaluation should be repeated at qualification with pass/fail criteria for the qualification tests determined based on information derived during engineering evaluation.

7. Flight cell lot destructive testing shall consume a randomly selected sample size that is, at minimum, 3 percent of the flight lot size or three cells, whichever is greater for each destructive test. The destructive test sample size need not exceed 350 cells. This is to adequately populate the test matrix necessary to confirm critical safety and performance characteristics, especially those features that are critical for mission and crew safety. For COTS batteries, cells can be obtained from the disassembly of a sample from the battery flight lot. To achieve statistically significant results, all initial destructive tests must be populated with a minimum of three cells. The maximum sample size was established to define as a reasonable limit.

8. The operation of cell safety devices, if used as a control at the battery level, shall be verified by a qualification test at the battery level or at a level that accurately simulates the level at which the control is required to confirm the operation of the safety device. The pass/fail criteria for these qualification tests should be established after engineering evaluation tests are completed.

9. To verify cell manufacturing quality does not vary within the lot, cell lot destructive testing shall include a minimum of 3 randomly selected cells (or 3 cells from 1 randomly selected COTS battery) that has passed cell (or battery) acceptance screening. The cell/battery should be downgraded from flight class to uncontrolled class prior to the DPA. Supporting the DPA   with a prior CT scan examination is recommended. The pass/fail criteria for the DPA should be established after the engineering DPAs are completed. Variations of components and methods used in cell construction can be detected by DPA and grounds for lot rejection.

10. Qualification testing shall be performed at the battery level, using flight equivalent builds. Multiple qualification units may be used to run different tests in parallel. Tests may be re-sequenced to accommodate schedule and resource constraints as long as the intent of the test is not compromised. Battery designs deemed non-critical need only provide verification evidence as required to complete the Unique Hazard Report for the subject battery system.

4.2.3 Acceptance Testing

This section addresses the acceptance testing of the flight battery.

1. Cell lots intended for custom flight batteries shall undergo 100-percent acceptance screening that includes, at minimum, visual inspection of bare cell with shrink-wrap removed if present, mass, OCV retention, alternating current (AC), and direct current (DC) resistance. Work Instruction EP-WI-031 provides an example of an OCV retention screen.

2. Batteries intended for the flight shall undergo flight acceptance (nondestructive) testing, which will include an evaluation of OCV, mass, capacity (for rechargeable chemistries) or load check (for primaries), internal resistance, visual inspection, vibration to flight acceptance levels, and thermal/vacuum Testing. As a minimum, the flight acceptance test program should include the following:

3. Functional baseline test (OCV, mass, capacity (for rechargeable chemistries or load check for primaries), internal resistance, and visual inspection).

4. Vibration to flight acceptance levels (see Appendix A for more details).

5. Functional baseline test recheck.

6. Vacuum (approx. 0.1 psi) or equivalent leak checks.

7. Functional baseline test recheck. For batteries used in a pressurized volume or environment, exposure to a vacuum environment (approximately 0.1 psi) for a minimum of 6 hours.

• • • For batteries used in an unpressurized volume or environment, thermal vacuum cycles must be performed with the deep vacuum levels below 1 × 10–4 Torr (instead of the 0.1 psi used for habitable volume/pressurized environments). Alternatively, the thermal cycles and vacuum environment tests can be performed independently. Details of recommended flight acceptance tests are provided under each battery chemistry section in Section 6 with a detailed example in Section 6’s lithium-ion section. For those chemistries not listed in Section 6, early consultation with program technical staff is recommended. Battery designs deemed non-critical need only provide cell verification in the form of UL (or similar) certification data or acceptance test results, battery system functional performance, and verification of hazard control features.