NASA TECHNICAL N O T E NASA TN 0-7609

\,

I OI
0
*o
h
d
z
c
4
rn
4
I =

APOLLO EXPERIENCE REPORT - I

COMMAND A N D SERVICE MODULE
ELECTRICAL POWER DISTRIBUTION SUBSYSTEM
t

1
by Robert E . Mzlnford and Bob Hendrix
Lylzdoa B, Johnson Space Center
Houston, Texas 77058

N A T I O N A L AERONAUTICS A N D SPACE A D M I N I S T R A T I O N WASHINGTON, D. C. MARCH 1974

1. Report No. 2. Government Accession No. 3. Recipient's Catalog No.
NASA TN D-7609
4. Title and Subtitle 5. Report Date
APOLLOEXPERIENCEREPORT Wch 1974
COMMAND AND SERVICE MODULE 6. Performing Organization Code
ELECTRICAL POWER DISTRIBUTION SUBSYSTEM
7. Author(s) 8. Performing Organization Report No.

Robert E. Munford and Bob Hendrix, JSC JSC S-386

10. Work Unit No.
9. Performing Organization Name and Address 914-11-00-00-72
11. Contract or Grant No.
Lyndon B. Johnson Space Center
Houston, Texas 77058
13. Type of Report and Period-overed
2. Sponsoring Agency Name and Address Technical Note
National Aeronautics and Space Administration 14. Sponsoring Agency Code
Washington, D. C. 20546
5. Supplementary Notes
The JSC Director has waived the use of the International System of Units (SI) for this
Technical Note, because, in his judgment, the use of SI units would impair the usefulness of
the report or result in excessive cost.
6. Abstract
A review of the design philosophy and development of the Apollo command and service modules
electrical power distribution subsystem, a brief history of the evolution of the total system,
and some of the more significant components within the system a r e discussed. The electrical
power distribution primarily consisted of individual control units, interconnecting units, and
associated protective devices. Because each unit within the system operated more o r l e s s
independently of other units, the discussion of the subsystem proceeds generally in descending
order of complexity; the discussion begins with the total system, progresses to the individual
units of the system, and concludes with the components within the units.

17. Key Words (Suggested by Author(s)) 18. Distribution Statement

Electric Networks
Electric Power Conversion Subject category 31: Space Vehicles
Electromechanical Devices

19. Security Classif. (of this report) 20. Security Classif. (of this page) 21. NO. of Pages 22. Price

None None 23 $2.75

* For sale by the National Technical Information Service, Springfield, Virginia 22151
NASA- MSC
 CONTENTS

Section Page

SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

INTRODUCTION ................................... 2

DESIGN CONSIDERATIONS ............................. 2

SYSTEM DESCRIPTION ............................... 4

Direct - C u r r ent Distribution ........................... 4

Grounding. .................................... 7

Alternating-Current Distribution ........................ 8

Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Control Units ................................... 10

Inverter.. .................................... 11

Power Factor Correction Box .......................... 13

COMPONENTS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Motor Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Circuit Breakers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Relays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

. SAFETY MEASURES ................................ 17

e

RECOMMENDATIONS AND CONCLUDING REMARKS . . . . . . . . . . . . . . . 18

iii
 FIGURES

Figure Page

1 Structure of direct-current bus . . . . . . . . . . . . . . . . . . 3

2 Battery circuits . . . . . . . . . . . . . . . . . . . . . . . . . . 5

3 Fuel cell control circuit . . . . . . . . . . . . . . . . . . . . . 6

4 Entry battery/main bus tie control . . . . . . . . . . . . . . . . 7

5 Vehicle ground point . . . . . . . . . . . . . . . . . . . . . . . . 7

6 Alternating-current power distribution . . . . . . . . . . . . . . 8

7 Direct-current undervoltage-sensing circuit . . . . . . . . . . . 9

8 Alternating-current sensing circuit . . . . . . . . . . . . . . . . 9

9 Functional diagram of battery charger . . . . . . . . . . . . . . 11

10 Inverter block diagram . . . . . . . . . . . . . . . . . . . . . . 12

11 Power factor correction box . . . . . . . . . . . . . . . . . . . 13

12 Motor switch assembly . . . . . . . . . . . . . . . . . . . . . . 14

13 Component coating . ........................ 17

iv
 APOLLO EXPERIENCE REFORT
COMMAND AND SERV ICE MODULE
ELECTR ICAL FOWER D ISTR I BUT1ON SUBSYSTEM
B y Robert E. M u n f o r d and Bob Hendrix
Lyndon B. Johnson Space Center

SUMMARY

The Apollo command and service module electrical power distribution subsystem
was required to receive electrical power from any combination of seven direct-current
sources (three fuel cells, three entry batteries, and one service module battery) and
to condition, control, and deliver the power to the appropriate loads. To satisfy these
requirements, the system was designed to perform the following functions.

1. Distribute power to the various locations through a system of interconnecting

cables

2. Protect the wiring if a load malfunction occurred

3 . Prevent additional damage t o the vehicle if a wire became overloaded

4. Protect the various power sources from a malfunction in the loads or the
wiring

5 . Protect each power source from a malfunction in any other power source

6. Convert direct current to alternating current to satisfy load requirements

Major developmental effort w a s expended on the static inverter, the most complex
electrical unit in the system; therefore, the history and design configurations of this
device are discussed in detail in this report. Conversely, the motor-driven switch
(which, electrically, is a relatively simple device) proved to be quite troublesome
because of its complicated mechanical design and widespread u s e throughout the corn-
I mand and service module. It is discussed in this report, and special emphasis is
placed on problems that developed during the Apollo P r o g r a m . The developmental
efforts and problems with other allied equipment are also reviewed.

Although numerous minor changes were made as a result of real ,or anticipated
problems, the overall system performance was satisfactory throughout the program.
Nevertheless, several recommendations worthy of consideration in the design of any
new system a r e apparent f r o m a review of the entire effort. Most of the recommenda-
tions were made as a result of many incidents rather than a particular problem and
are not specifically addressed in the text of the report, but are discussed m o r e fully
in the recommendations and concluding remarks.

INTRODUCTION

Throughout the active life of each Apollo vehicle, beginning with the initial power-
up and continuing through checkout, flight, and postflight testing, the command and
service module (CSM) electrical power distribution subsystem (EPDS) was used almost
continually. Three fuel cells located in the service module (SM) provided the primary
source of power for the major portion of a mission. The fuel cell output was supple-
mented by two of the three 40-ampere-hour command module (CM) entry batteries
during high-load phases of the mission and was backed up by a 400-ampere-hour
battery in the SM (added after the flight of Apollo 13), which could be used if a fuel cell
failed. The electrical configurations of the spacecraft during various phases of a
normal mission are described in the following paragraphs.

Near the end of the launch countdown period, the fuel cells were activated and
remained active until CM/SM separation. A few minutes before lift-off, two entry
batteries were connected to the main buses to provide power to the CM in the event of
an abort. After the spacecraft was in orbit, the entry batteries were disconnected,
recharged, and used only to supplement fuel cell power during service propulsion
system (SPS) burns. Between burns, the load normally varied between 60 and
80 amperes (well within the capability of the fuel cells) ; however, when gimbals
were operated during SPS burns, the load could reach 120 amperes, requiring the
additional capacity of the two entry batteries.

All three entry batteries were switched to on-line status during preparation f o r
entry and became, a t CM/SM separation, the sole source of electrical power for the
vehicle. During descent, the load w a s approximately 60 a m p e r e s and continued near
that level until the vehicle w a s 800 feet above water and the main buses were deener-
gized. After this time, only the recovery aids and various small loads on the post-
landing bus required electrical power.

DES I GN CONS IDERATl ONS

The EPDS of the Apollo CSM w a s designed to control, condition, and deliver I
nominal 28 V dc and 115 V ac power. These tasks had to be accomplished with maximum I
reliability, flexibility, and safety yet remain within weight and volume constraints. To
satisfy these goals, the system was designed around two main buses in the direct-
current system and two buses in the alternating-current system. j

The direct-current system (fig. 1) accepted power from three fuel cells and
three entry batteries and distributed this power to two main direct-current buses.
Loads on the buses were divided into the following three categories according t o
criticality and power source.
I
1. Nonredundant essential loads were fed from both buses through isolation diodes. I

2. Redundant essential loads were arranged so that loads were fed f r o m different
buses. I
2 I
 A
n

Bat battery
OL overload
I y: OL and RC
, S,Mbs;A+:r?S,M,b:;
OL and RC
, SMbusArTv: SM bus B
OL and RC

R C reverse current
Fuel cell 1 Fuel cell 2 Auxiliary Fuel cell 3

Figure 1. - Structure of direct-current buses.

3. Nonredundant nonessential loads were connected to the buses, as required,

to equalize the loading on each bus.

In addition to the inherent reliability provided by this mechanical configuration,

mission success w a s further ensured by rigid quality control and careful inspection by
qualified inspectors during all phases of equipment fabrication. Each function w a s
checked several t i m e s after the system was installed in the vehicle. During flight,
the crew monitored the essential parameters by display and control read-outs, and
ground controllers monitored telemetered data.

Typical production samples of each component o r assembly were selected at

random, subjected to qualification tests, and reevaluated. These tests, designed to
simulate as nearly as possible the r i g o r s of mission environments (plus an appropriate
safety factor), were performed on each component or assembly. Results were then
evaluated to determine the suitability of the equipment for flight. In addition, each
component or assembly w a s subjected to acceptance testing.

The EPDS w a s designed to increase reliability with maximum flexibility. Controls

in the alternating-current system were provided to allow any inverter to be placed on
either o r both alternating-current buses; however, an interlock w a s provided to prevent
connecting the inverter outputs in parallel. Similarly, any o r all of the six normal
direct-current sources (three entry batteries and t h r e e fuel cells) could be connected to

3
either or both main buses. Although the pyrotechnics were not a p a r t of the EPDS,
provisions were made f o r using main entry battery power to fire the explosive devices
if the pyrotechnic batteries failed.

Together with the normal precautions taken in any electrical installation to pro-
tect the user from shock and t h e hardware from physical damage, the primary con-
c e r n s in the design of the EPDS were for mission safety and for the protection of the
power sources from downstream faults and fault propagation if problems did arise.
Diodes, circuit breakers, fuses, and r e v e r s e and overcurrent s e n s o r s were used to
protect power sources.

Nonflammable, flame-retardant, and fire-resistant materials were used wherever

possible. Both electrical and mechanical means were used to prevent the propagation
of a fire. This was accomplished by coating the unprotected area behind the panels
and exposed hardware with flame-retardant coatings, by using potting components,
and by sealing enclosures. To prevent heat damage to adjacent wires if an overload
occurred, each wire was selected to be compatible with i t s associated circuit breaker.
Electrical cables were also routed through covered t r a y s o r behind closeout panels
to protect them from physical damage.

Because components of the EPDS were distributed throughout the CSM, the
system was exposed to a variety of environments including water, urine, salt, and
dust. Atmospheric p r e s s u r e varied from sea level t o the vacuum of deep space, and
temperatures varied widely. In addition, equipment in the CM p r e s s u r e vessel had
t o be capable of maintaining mechanical integrity when exposed to a 78g impact shock
if touchdown occurred on land. Verification that the equipment could withstand these
environments was determined by qualification testing.

All the precautions mentioned previously were considered during the design,
fabrication, and testing of the system to ensure crew safety and mission success. To
improve the performance of the system further, the EPDS design was continuously
reviewed, and each change or proposed change was evaluated in t e r m s of reliability.
The performance of the system during test and flight was reviewed t o determine if any
problems existed that might require design changes.

A formal, computer-aided program w a s devised t o identify "sneak circuits. ' I

This program provided f o r the identification of current paths that were not readily
apparent from a review of the electrical schematics but might cause undesirable
results. Some of these evaluations resulted in procedural changes, component replace-
ment, and system modifications.

SYSTEM DESCRIPTION

Direct-C ur r e n t D istr ibution

The basic design of the direct-current distribution system (fig. 1) consisted of
two buses (main bus A/SM bus A and main bus B/SM bus B) that were isolated f r o m
each other and energized by three fuel cells o r t h r e e entry batteries. Redundant loads
were connected to separate buses. Nonredundant critical loads were fed f r o m both
buses through diodes o r double-throw switches t o provide circuit isolation. Nonredun-
dant noncritical loads were tied t o either bus, as required, to equalize bus loading.
4
 Entry batteries A and B supplied power to individual battery buses (battery
buses A and B) that supplied logic and switching power to various controls. A third
battery (entry battery C) supplemented A and B on the main buses during entry and after
landing. Both battery buses supplied power to the battery relay bus, which distributed
power to essential control functions.

Three fuel cells in the SM provided the bulk of the power f o r a normal mission.
Any fuel cell could be connected t o either or both of the main buses, but the normal
configurations were with fuel cells 1 and 2 on main bus A and with fuel cell 3 on main
bus B. After a cryogenic supply failure, which resulted in the loss of all t h r e e fuel
cells on Apollo 13, an auxiliary battery was added in the SM to supplement the
remaining power s o u r c e s if one or m o r e fuel cells failed.

A battery charger was provided to recharge the entry batteries from fuel cell
power. The charger used both alternating current and direct current to apply a
current-limited charge to one battery at a time. After being used, each battery was
recharged as soon as practical to provide maximum power for entry or any contingency.

As time passed, the need for added flexibility of power s o u r c e s became apparent,
resulting in the addition of circuit breaker (CB) 15 and CB24 (fig. 2) to make it possible

Voltmeter (pyro bat AI

Fuel dump system A

Voltmeter lpyro bat B I

Fuel dump system B

Voltmeter and telemetry

bus tie motor switch

I

I postlanding
a:nd h-2 -0 4
9-
1
BOA

normally open during flight LDEC lunar docking eWntS controller

Py r o py rotechn it MESC master events sequence controller
RHEB right-hand equipment bay EDS emergency detection system bus tie motor switch

Figure 2. - Battery circuits.

5
t o put any battery on any bus in the power system. In addition, CB18 and CB19 were
added to permit activation of a pyrotechnic bus by a n entry battery if a need occurred.
Although many other minor changes were made in both design and procedures, the
system and system components remained basically the s a m e as those flown in 1966 on
spacecraft 009, the f i r s t Block I vehicle launched f r o m the NASA John F. Kennedy
Space Center. The m o r e significant of these changes are reviewed in the following
discussion.

A s mentioned previously, the power distribution system was designed around a

network of buses, each with loads and sources peculiar to the criticality of the appli-
cation. The direct-current bus structure consisted of nine interconnected buses.
Although the S M buses provided power to some S M loads, they were extensions of the
main buses and served primarily to route power from the fuel cells to the C M .

The large circuit breakers on the output of the entry batteries were directly
attached to the battery-mounting hardware to protect the wires leading t o the f i r s t
control panel. Overload and reverse-current s e n s o r s for each fuel cell (fig. 3) served
a similar purpose in the SM.

Main bus A
Fuel cell bus disconnect

L
power
I I
I 1 TO all fuel cell
I I
I

r-
I
I
I
I
bus control u
state I
I
I switch
I
I
I TobusB
I I control
I I
I
I
I
I
I
I
I
I

Figure 3. - Fuel cell control circuit.

6
 A timing circuit (fig. 4) in the reac- Note
tion control system (RCS) provided automat- K13 - AUTO RCS transfer
relay lsystem A)
ic switching to connect the entry batteries K14 - AUTO RCS transfer Bat
to the main buses in the event of a pad relay (system 6)
(Activated by CSM
abort. This feature allowed battery power seoarationl
to be conserved by operating the vehicle
from ground power until just before lift- Bat charger,
off. Jf a n abort was necessary, crew ac- voltmeter, and
tion was not required to provide power to
the CM after separation from the SM. 0
Main bus tie OFF
bat AIC
AUTO
Groundi ng r-----------
I RCS

To minimize electromagnetic inter-

ference (EMI) from structural current, a
single-point ground was used for the direct-
current r e turn, alternating- current
I
11 I1 I I
‘1
neutral, pyrotechnic-initiating circuit re- TD13 K14
turns, and shield grounds. This design is It I

shown in figure 5 with all grounds returning rb; A‘3

to the vehicle ground point (VGP) . When

the CM was docked with the lunar module
(LM), all current flowing from the CSM to
the LM was returned to the VGP through
the CM/LM umbilical, thereby maintaining
the single-point ground configuration.
Individual buses were provided to separate Figure 4. - Entry battery/main bus
the power and signal grounds from the LM tie control.
and CM until the grounds were tied t o the
VGP.

I
dc negative bus ac neutral bus Pyro negative bus Shield ground bus

1
A

CM load
T
Inverters
1
Pyro bat load
CM wire
CM load R shielding
T Pyro bat
SM load negative

?-l
dc negative bus

SM load
cell negative terminal
Jettison sequence control negative terminal
SM

*
Shield ground bus

SM wire
shielding

Figure 5. - Vehicle ground point.

7
 Alternating-Current Distribution
Three-phase 400-hertz alternating
current was delivered through two four-wire
buses that could be energized by one or two
of the t h r e e static inverters (fig. 6). Each
inverter had sufficient capacity to supply
all alternating-current power required by
the vehicle. This could be accomplished
by paralleling both alternating- current
buses to a single inverter, o r each bus
could be energized by individual inverters;
however, the inverters could not be paral-
leled without causing damage to the
inverters.

Circuits were provided in the

alternating-current power control box that
prevented parallel operation of the inverter
outputs if improper procedures were
followed. However, this switching system
had defects involving a r a c e between motor
switches that could cause the l o s s of all loads

alternating current t o the spacecraft. This

problem was overcome by rewiring the Figure 6. - Alternating-current power
control switches on a priority system so distribution.
that no switch r a c e was possible.

During Block I checkout, it w a s discovered that a portion of the guidance and

navigation (G&N) information w a s derived from a phase shift between two signals, each
of which originated from a different alternating-current bus. For the information
to be valid, each bus had to be in phase with the other. Consequently, a phase-
synchronization box was designed f o r Block I manned spacecraft. The G&N system was
modified f o r Block I1 to eliminate the need for buses to be in phase. Because phase
synchronization was no longer a requirement, the phase-synchronization box was
deleted from Block I1 spacecraft.

Sensors
Sensors monitored the main direct-current buses for low voltage (fig. 7) and
signaled the caution and warning (C&W) system if the voltage level fell below 26.25 volts.
Alternating-current buses were monitored by s e n s o r s (fig. 8) f o r low voltage, overload,
and overvoltage. If either the load o r voltage went out of limits, a C&W signal was
initiated; however, of the three anomalous conditions, only a n overvoltage condition
required corrective action to be taken faster than a crewmember could react to the
situation. Therefore, an overvoltage condition resulted in automatic disconnection of
the faulty inverter.

8
 Main Comparator
(sensor)
- -
Amplifier Lamp
driver
~ Main busA

0 OFF
i i
19
Caution and warning lamp power
Regulator

4-74 Caution and warning

Main bus A
undervolt
I
I
Main

Main bus B comparator, i

bus B sensor
nA Bat relay bus

r--
I
-

1 Main
busA

I
I
Main
buss

I
I
I

Figure 7. - Direct-current undervoltage -sensing circuit.

Figure 8. - Alternating-current sensing circuit:

9
 Originally, the alternating-current sensing circuitry was designed to automat-
ically disconnect an overloaded bus; however, because silicone-controlled rectifiers
(SCR) in the inverter overload sensor circuit proved to be overly sensitive to current
surges, several unnecessary losses of alternating-current power occurred. As a
result, the disconnect feature of the sensor was disconnected, but the C&W a l a r m was
retained. Mission success was not impacted because a crewman was always present in
the CM t o take the action required for an overload-bus condition.

Control Units
The greatest concentration of control functions in any single unit was in the SM
power distribution box. This box, located on the upper deck of the SM, contained both
automatic and remotely actuated motor switches t o control direct current in the SM.
Fuel cell outputs could be connected t o either CM bus by motor switches that provided
r e v e r s e current and overload protection. Provisions also were included f o r switching
ground support equipment power to the vehicle and for protecting the buses if a heater
short occurred in the environmental control subsystem.

The CM direct-current power control box used motor-driven switches and stud-
mounted diodes to switch power output from the CM batteries to the main buses. To
achieve maximum heat transfer, the diodes were mounted directly on plated heat
sinks; the plating was the only electrical insulation between the diode mounting base
and the heat sink. Early in the test program, several failures occurred when the
insulation was damaged and the diode shorted to ground. This problem w a s overcome
by using plated washers between the diode a:id the heat sink; as a result, a t least two
failures in the plating were required before a short would occur.

The battery charger (fig. 9) also was modified after fabrication because the
output was originally calibrated for a particular current and wire routing. However,
subsequent reconfiguration of the wiring and the addition of circuit breakers resulted
in a buildup of tolerances which, when combined, caused the charger output t o be
inadequate. The unit had t o be partly depotted to gain a c c e s s to the potentiometer that
controlled the output voltage level. Setting the potentiometer control a t the proper
level solved the problem.

A major change was made in the configuration of the direct-current distribution

system after the Apollo 13 mission. To enhance the probability of a safe return if all
three fuel cells were lost, a 400-ampere-hour auxiliary battery was added in the SM.
 I Diode I I
1

To K 1 j
* Transformer Current Auxiliary Battery C
AC 1 rectifier amplifier power
o r 2 +B
K? power
circuit supply
115 V supply
400 Hz
9 A f f
Figure 9. - Functional diagram of battery charger.

I nverter
During the initial phases of the Apollo Program (1962 and 1963), studies were
performed to determine the most feasible power system for motor applications.
Because of these studies, a central inverter system was selected instead of individual
inverters for each application. This system w a s chosen because it had the lowest
weight and greatest reliability. Inverters were designed with an output capability of
1250 volt-amperes, making it possible for a single unit to supply all the alternating
current required by the vehicle (fig. 10). Three such inverters were needed on each
vehicle to meet the reliability requirements for mission success and crew safety.
After the essential requirements were established, the inverter was designed to meet
the following criteria.

1. Phases: three-phase, 120" i 2" displacement

2. Voltage: 115 * 2 V a c (three-phase average), steady state

3. Frequency: 400 hertz with 6400 hertz external timing; 400 * 7 h e r t z when
f r e e running

The original inverters, designated a s the -0001 model, were modified s e v e r a l

t i m e s after the flight of spacecraft 009 in early 1966. Each time a major modification
was made in the design of the inverter, the model was designated by a new dash number
to control usage. One such modification, which resulted in the -0004 model, was made
because alternating-current modulation adversely affected the performance of the
S-band transponder.

11
 B~ck-hst Harmonic
dc filter (three - L Filter
35 V Power inverter
(eight stages)
c neutralizing
amplifiers) transformer

SCR t Filter
--- Demodulator ac filter

h
1.6 kHz Zener
I
-
1.6 kHz and bridge
demodulated signal
signal Magnetic
amplifier 4
' Zener
diode
Current
-
-
4
A1
B1

-
1 reference c1
A sensing m A2
bridge
transformers 82
1.6 kHz c2
~

+2 - LOW
mltage
control 400 Hz

-
6.4 k&
-
Eight-stage
digital count-
down
Overcurrent
trip circuit
-
-
Figure 10. - Inverter block diagram.

The inverter housing was redesigned for Block II spacecraft inverters to facilitate
easy removal for repair purposes. At the s a m e time, output connectors were installed
in place of the terminals that were used on e a r l i e r models. Another change to the
inverter was made after the Apollo 204 fire. The inverter housing w a s sealed to pre-
vent propagation of f i r e if any component within the inverter ignited. This inverter
became the -0008 model.

The -0008 model was installed on the first s e r i e s of Block 11 spacecraft and
performed satisfactorily; however, the manufacturer of the power-switching transistors
used in the inverters experienced difficulties in meeting delivery schedules. Conse-
quently, a second s o u r c e w a s selected to supply transistors with s i m i l a r characteristics.
The transistors from the second source had a slightly faster switching speed than the
original ones; therefore, minor circuit modifications had to be incorporated, resulting
in the -0010 inverter configuration. The -0010 model was f i r s t flown on the Apollo 10
mission and performance was normal. Although the design w a s not altered after this
configuration, thermal-acceptance testing of all black boxes became mandatory l a t e r
in the Apollo Program. A s a result, the -0008 and -0010 units became, after testing,
the -0012 and -0014 units, respectively.

During factory checkout of Apollo 12 hardware, occasionally the i n v e r t e r s tripped

early during overload testing, thus failing to meet specification limits. The cause of
these anomalies was determined to be electromagnetic interference, which w a s caused
partly by the faster switching of the new transistors. A r e a s s e s s m e n t of mission
constraints and failure modes indicated that only a remote possibility existed of a

12

L
failure being caused by a fast timeout o r premature tripping of the inverter. This
condition was tolerable; therefore, no further changes were made.

Power Factor Correction Box

Most of the alternating current generated was used to power fuel cell pump
motors; consequently, the load w a s highly inductive. To compensate f o r the undesirable
power factor resulting f r o m this load, a capacitor bank was added to the motor circuits
(fig. 11). These capacitors, together with protective fuses, were installed in the
power factor correction box, which was originally located in the CM. The box was
not changed for the Block I1 configuration, but the fuel cell pump motors were rede-
signed. Because the new pump motors had a much better power factor than the old
motors, it was found that, when the correction unit was used, the power factor was
overcompensated and effectively nullified all gains from the correction unit. To rectify
this problem without impacting schedules, some of the capacitance w a s removed by
altering the panel wiring rather than by redesigning the box. This modification was
made on early Block I1 vehicles.

At a subsequent design review, it was

determined that the correction unit contained
a single failure point because current f r o m
both buses w a s routed through a single
connector. At approximately the s a m e
time, an effort was underway to remove
From l o fuel
ac bus cell 1 weight from the CM t o lessen the load on
1 or 2
U U
pump the parachutes during entry. Because the
power factor correction box functioned
only when the fuel cell pump motors were
in use, t h e r e w a s no requirement for the
unit after the SM was jettisoned. Conse-
quently, after the box w a s redesigned to
From l o fuel eliminate the single failure point and to
ac bus cell 2
1or 2 pump
optimize the power factor, it was installed
in the SM.

COMPONENTS
From To fuel
ac bus
1 or 2
cell 3 Motor Switches
- C I -- pump

The most complex piece of mechanical

Figure 11.- Power factor correction gear in the electrical power system was the
box. motor-driven switch (fig. 12). Thirty-
eight of these switches, in various configu-
rations, were installed in each Block II
vehicle; therefore, a problem with any one switch created a potential impact on total
design reliability.

13
 Although some motor-switch problems
occurred during flight, the majority of the
problems resulted from ground t e s t s and
operation. The motor switches proved to
b e extremely sensitive to mishandling,
improper operation, or incorrect control
circuitry. Most of the failures resulted
from the application of a low control voltage
or the simultaneous application of "on" and
"off" commands. Both misapplications
resulted in excessive buildup of heat and
subsequent destruction of the motor. These
problems were overcome, in part, by
using special test consoles to test any equip-
ment that contained motor switches and by
providing s t r i c t procedures f o r operating
the motor switches.

During the f i r s t flight of a Block 11

vehicle, a problem appeared in a motor
switch while it was removing three-phase
wa power from fan motors. It was determined
that the switch, which normally was back-
filled with an inert gas and sealed with an
environmental s e a l (metal to epoxy), had
i leaked to an altitude favorable to arcing.
As a result, when the switch interrupted
the highly inductive load, arcing occurred
in the switch and sufficient EM1 was created
to t r i p the alternating-current s e n s o r . The
problem was overcome procedurally in r e a l
time; nevertheless, motor switches that are
not hermetically sealed (metal to metal or
glass to metal only) are no longer considered
suitable for alternating-current circuits in
vacuum a p p l i c a t i o x .

A m o r e s e r i o u s problem became
apparent after the Apollo 14 mission. As a
result of an investigation, a new failure mode
of the motor switch w a s discovered. A
switch in the direct-current power control
Figure 12.- Motor switch assembly. box failed in midtravel. When the switch
was opened for inspection, it was found that
the motor a r m a t u r e had undergone exces-
sive heating and the a r m a t u r e windings had opened. Additional investigation and
disassembly of the motor showed that the commutator b a r s were separated f r o m the
rotor and presented evidence of extreme heat in the a r e a of the brush/commutator
interface. Furthermore, the buildup of residue on the commutator was far g r e a t e r
than normal.

14
 During a thorough investigation, many switches were tested and then disassembled
to facilitate a microscopic examination of the mechanism. No abnormal conditions were
found in the g e a r train or other mechanical parts of the switch, and, in all anomalies of
this type, it was determined that the motor was at fault. Small silicone grommets, used
as seals in the motor housing, were not cured under uniform conditions; those not cured
completely tended to r e v e r t to their precured condition. This reversion process was
present at all temperatures; however, heat aggravated the condition. A s the reversion
progressed, the catalyst that was used for curing the silicone w a s released and migrated
to the motor commutator where it combined with bearing oil and brush residue to f o r m
a high-resistance deposit between the brushes and commutator. This deposit resulted
in excessive heat being generated at the interface, a low a r m a t u r e current, and,
consequently, low motor torque. Loss of torque caused the motor to stall until the heat
generated within the motor was sufficient to cause a wire in the a r m a t u r e to open.

Motor-current t r a c e s , which depict the time required for the switch to transfer,
and the amplitude of the current were taken before each operable switch was disas-
sembled. These t r a c e s were compared with similar t r a c e s taken by the vendor during
the fabrication of the switches. As a result of numerous t r a c e evaluations, the t r a n s f e r
time, which proved to be a reliable indicator of the condition of a motor commutator,
was used to identify switches with potential motor problems. The evaluation also estab-
lished a maximum time in which a switch with a clean commutator should transfer; conse-
quently, current t r a c e s were made for all switches in several phases of the checkout to
determine the transfer time of each. Any switch with excessive transfer time was
replaced.

Another anomaly w a s discovered during the evaluation of current traces. Two

switches did not begin transferring current until 50 to 100 milliseconds after power was
applied. This condition w a s caused by a sticking brake on the motor. The brakes stuck
because of cold flow of the brake lining after long periods of inactivity. After the
switches were operated once in the vehicle checkout, they no longer had a tendency to
stick, and that particular failure mode w a s of no further concern.

Ci rcui t B reaker s
Several difficulties were experienced during the qualification testing of circuit
b r e a k e r s . Most of the difficulties were caused by faulty test equipment and unrealistic
performance requirements rather than the breaker design. When the t e s t s were begun,
the b r e a k e r s consistently failed to pass the operational life test because of actuator knob
breakage. Reappraisal of the actual breaker use, however, indicated that the require-
ments were unrealistically severe. The breaker requirements were reviewed and then
redefined to establish realistic requirements, after which the b r e a k e r s performed
satisfactorily .

After a salt-spray test, a group of breakers was s e t aside for several hours
before being checked functionally. When the test was attempted, salt had built up be-
tw.een the actuator collar and the mounting sleeve to such an extent that the actuator
could not b e moved. This requirement was also determined to be unrealistic because
it w a s not representative of actual conditions. Therefore, the breaker was not consid-
e r e d to b e unsatisfactory.

15
 Trip limits for the b r e a k e r s were selected without a c c e s s to performance data.
When tests were performed, many b r e a k e r s failed to meet specified values. A review
of t r i p limit values indicated that the specified limits were unrealistic and that breaker
performance w a s satisfactory under the redefined limit values.

A problem peculiar only to large b r e a k e r s developed when wires were attached to

the terminals. When the bolts were tightened to specified torque values, the seal
between the breaker body and the terminal lugs was cracked. Although this crack did
not affect the strength of the breaker body, it violated the environmental seal. A room-
temperature-vulcanizing (RTV) silicone compound was applied to the a r e a to r e s e a l
the breaker.

Because the three-phase circuit b r e a k e r s were l a r g e and heavy, they were

mounted by s c r e w s r a t h e r than by stem mounting. This condition resulted in excessive
excursions of the internal mechanism during vibration testing. The excursions, in
turn, caused the b r e a k e r s to trip when the unit w a s vibrated. The problem was solved
by adding metal pads to the front of the case to provide a m o r e solid mounting.

The direct-current b r e a k e r s contained two cams in a mechanism for holding the

actuator i n the closed position that could, under selected conditions, cause erroneous
performance. If only one cam dropped in place when the breaker w a s reset, it would
appear to be in its normal closed configuration but would no longer operate within
normal vibration limits. This potential problem was overcome procedurally, however,
by cautioning the crewmen to p r e s s firmly on the actuator knob when closing a breaker.

During the Apollo 14 mission, a breaker failed to make contact when it was
mechanically closed. Postflight analysis disclosed a contaminant between the breaker
contacts. The contaminant was lost before it could be analyzed; however, the substance
on the contacts was probably bits of glass from a s m a l l fiberglass board inside the
breaker. Because this was the only known instance of this problem, corrective action
was not considered necessary.

Re1ays
Block I vehicles included an essential alternating-current DUS that w a s automati-
cally switched to the alternate s o u r c e if low voltage w a s experienced. Switching was
accomplished by using relays that were qualified f o r single-phase operation. However,
three-phase alternating current was being switched, which resulted in arcing between
the contacts and destruction of the relays. The possibility of the aforementioned
condition was not considered during the original p a r t s selection; as a result, a relay
capable of switching three-phase power was selected.

Relays were used in a cryogenic control box that w a s added to the vehicle during
the modification resulting from the Apollo 13 inflight problems. The original control
box was designed to have motor switches because they had no contact bounce, had high
current and voltage ratings, and were immune to vibration; however, as previously
noted, the motor switches were unsuitable for switching alternating current in a
vacuum. Consequently, when the additional box w a s designed, r e l a y s were used for all
switching functions.

16
 ,
Conformal coating of ladicote
over R N SAFETY MEASURES
Conformal coating of RlV 560-577 blend

i i 5;
on wire and terminal
A major consideration in the design of
the EPDS was the prevention of fault propa-
jacket
ll gation. Loads were placed on individual
circuits and isolated by circuit breakers,
Circuit breaker fuses, o r overload sensors. Buses w e r e
isolated with diodes and reverse-current
sensors. Maximum physical protection
was provided for boxes, components, and
wires to prevent damage during manufac-
ture, checkout, and flight. Closeout panels
and cable covers were used to shield the
equipment. Conformal coating was used
behind the panels and in other inaccessible
a r e a s . A typical example of the coating
applied to exposed electrical connections
is shown in figure 13. The coating not only
w protected the' system from shorts caused
PI jacket: Premolded polyimide glass jacket. Consists of three layers, each of
by floating debris but also sealed the com-
which is 8-mil glass cloth impregnated with polyimide resin and molded ponent against moisture and provided an
to a snug fit. Minimum thickness = 0.025 in.: used i n the CM crew
compartment as a fire retardant
inhibitor to prevent flame propagation.
R N 560-577 blend : Room-temperature-vulcanizing silicone rubber: used for
electrical insulation, moisture, and physical protection around the wire Wires. were especially vulnerable to
and circuit breaker terminal damage from overheating of adjacent
Ladicote A fire-retardant material for protection against burning i n pure wires because most of the wiring in the
oxyjen atmospheres.
vehicle is bound tightly in bundles. To
Figure 13. - Component coating. a s s e s s the reliability of the wiring and to
establish proper ground rules for harness
design, extensive testing was performed.
Wires were exposed to a variety of temperatures and p r e s s u r e s , some typical of those
that were anticipated and others in excess of what the w i r e s were expected to undergo.
Tests also were performed to establish the pertinent characteristics of the insulation
a t different temperatures. Data from these t e s t s were used to establish time limits
f o r various combinations of ambient temperature and p r e s s u r e for single wires and for
those in bundles.

T r i p characteristics of each type circuit breaker were determined a t various

altitudes and p r e s s u r e s in a s e r i e s of tests that established the derating necessary f o r
operation in mission environments. The breakers also were subjected t o s e v e r a l
different combinations of ambient conditions, during which the trip times were recorded
f o r different degrees of overload. Results from these t e s t s then were used to establish
wire-size/circuit-breaker compatibility criteria. Design was kept within these limits
to ensure the integrity of' adjacent wires if an overload condition occurred.

17
 RECOMMENDATIONS AND CONCLUDING REMARKS

The final overall design of the Apollo electrical power distribution system was
adequate. All the original concepts, however, were not satisfactory, as can be seen
in retrospect. Examples of some of the designs that were either modified or discontin-
ued are the automatic main bus disconnect, the automatic alternating-current overload
disconnect, and the inverter switching arrangement.

Based on a review of experiences described in this report, several recommenda-

tions are listed that might be beneficial to new programs.

1. All equipment should be designed, fabricated, located, and mounted f o r easy

removal, repair, and replacement.

2. Inverters o r other alternating-current Sources should be in phase and should

have the capability of being paralleled.

3. Motor switches, if used, should be hermetically sealed (metal to metal or

metal to glass), and the effects of long-term exposure to environments normally
considered inert should be investigated thoroughly.

4. Solid-state power controllers should be considered in any application f o r which

remote switching is required,

5. All stud-mounted diodes used f o r power-source isolation should be anode

mounted. If a diode mounted in this manner shorts to ground, only one power source
will be affected.

6. An active program f o r identifying and correcting single failure points and

"sneak circuits" should begin early in the design and continue until the end of the
program .

Additional recommendations, not obvious from this report but based on an

evaluation of the final design of the command and service module electrical power
system and its overall performance throughout the Apollo P r o g r a m , are also listed.

1. Arc-suppression diodes should be the fail-open type.

2 . Diodes used in steering functions should be the fail-short type.

3. Some type of laboratory device (e. g. , breadboard, test jig, functional mock-
up, o r prototype) should be available for evaluation of the electrical power distribution
subsystem design early in the program and for u s e in providing real-time support
during missions. Several circumstances a r o s e during flight in which a dedicated device
for electrical power distribution subsystem simulation would have been helpful in
recreating problems and evaluating workarounds. The device, regardless of nomen-
clature, should be primarily f o r electrical power distribution subsystem support with
quick-change capabilities to keep the configuration current.

18
 A realistic qualification program with rigid quality controls is necessary in the
selection of effective equipment. Comprehensive testing of each component and. of
higher assemblies is required. The experience gained from the performance of the
Apollo electrical power distribution subsystem should be used in the formulation of
guidelines f o r the design of electrical power systems f o r future space vehicles.

Lyndon B. Johnson Space Center

National Aeronautics and Space Administration
Houston, Texas, Deckmber 10, 1973
914-11-00-00-72

NASA-Langley, 1974 s-386 19