MARS BIBLE — RISK & RESILIENCE
Loss of a power source on Mars: islanding, load shedding, and black start
Installed power does not guarantee survival; what matters is power still available after failure, at the right place and time.
A Mars base may combine solar, storage, fission, or other sources. Diversity helps only when the electrical architecture can isolate failure, redistribute energy, and restart subnetworks without depending on the equipment that just failed.
Islanding: stop local failure from becoming system-wide
Islanding separates part of a grid so it can continue autonomously. A converter, cable, or source fault can be isolated before it destabilizes the whole bus.
Protection must be selective and fast while preserving essential loads. Poor coordination can disconnect the healthy part or allow a fault to drag the network down. Protection settings are therefore part of safety engineering.
Load shedding must be prepared and prioritized
When available power falls, some loads must be reduced. A static list is not enough because priority changes with context. Habitat heating may become life-critical at one time while the same amount of industrial power remains deferrable.
Control needs minimum power, maximum outage time, and restart conditions for each load. Crews must understand and override automation when its priorities no longer match the real situation.
Black start: restart without an already energized grid
After total collapse, generators or converters may need electricity for pumps, controllers, heaters, or excitation. Black start is the ability to bootstrap the system from a protected independent source.
That starting battery or source also needs maintenance. If daily operation drains it routinely, black-start capability becomes fictional. Periodic tests must demonstrate that it can energize the required chain.
Restart is a sequence, not one switch
Restoring all loads at once can create another surge and collapse. Control, communications, cooling, and systems needed for the next level start first; other loads are then added gradually.
Each stage verifies voltage, frequency or equivalent parameters, available power, and thermal stability. Black-start sequences should be timed and exercised under simulated faults to know the real time to minimum life support.
Calculate minimum load shedding after source loss
LEARNING CALCULATION — ASSUMPTIONS ARE EXPLICIT
Exercise: the base consumes 240 kW. A 90 kW source is lost while stable remaining generation is 180 kW. Immediate deficit is 240 − 180 = 60 kW.
To restore instant balance, at least 60 kW must be shed. If operations require a 15% margin on the 180 kW remaining, planned usable power is 180 × 0.85 = 153 kW. Required shedding becomes 240 − 153 = 87 kW.
The factor 0.85 comes from 1 − 0.15. A real grid also includes batteries, efficiency, starting currents, transients, reactive power where relevant, and thermal constraints.
Test the architecture without telling the crew the answer
A realistic drill does not tell operators exactly which component will fail. It injects an anomaly and measures detection, isolation, understanding, load shedding, and recovery. This tests human-machine interaction as well as hardware.
Logs must reconstruct the sequence second by second: which relay opened, what load disappeared, which command failed. Without observability, intermittent failure can return without explanation.
Decision questions specific to this hazard
- Which portion of the grid can continue as an autonomous island after loss of the main bus?
- What load is shed first in the current scenario, and why?
- Is the black-start source protected from the same failure cause as the main grid?
- How many minutes are required to restore minimum ECLSS, communications, and thermal control?
- Did the last black-start test begin from a truly de-energized condition or only simulate commands?