Fuel Cell System Controller
RFC Supervisory and Safety Control Subsystem
Dedicated rad-hard embedded controller orchestrating the entire regenerative fuel-cell loop — startup/shutdown sequencing, load following, fault detection, safety interlocks, and coordination with the central L2-ESS-MGMT — using model-predictive control over second-to-minute timescales.
Purpose
Provide autonomous, deterministic, fault-tolerant operation of a complex multi-domain chemical/electrical system without requiring Earth-in-the-loop, while enforcing strict safety interlocks against H2 leak, O2 contamination, and thermal runaway.
Context
Sits beneath L2-ESS-MGMT in the storage-system hierarchy, but specialised to RFC dynamics. Talks to all other L3-ESS-FC-* nodes. Reports up to L1-PDM and L3-CDH-PROC. Runs flight software with safety-critical certification.
Principles
- ▸State-machine architecture: Off → Standby → Charge → Discharge → Idle → Fault — with explicit transition guards
- ▸Model-predictive control (MPC) anticipates demand and pre-conditions stack temperature/humidity for fast load response
- ▸Safety interlocks: hardwired (not software-only) trips for over-pressure, H2 leak, over-temperature, low-coolant-flow
- ▸Differential pressure across membrane monitored continuously for stack cross-leak detection
- ▸Triple-modular-redundant (TMR) FPGA logic for SEU-tolerant safety functions
- ▸Watchdog timer hardware enforces failsafe shutdown if controller hangs
Typical implementations
- ▸NASA cFS (core Flight System) applications for fuel-cell management on lunar lander demonstrators
- ▸Shuttle Orbiter Fuel Cell Power Plant Monitor (FCPM)
- ▸Toyota Mirai Fuel Cell ECU (automotive heritage adapted for spacecraft)
- ▸ESA RFC controllers using ECSS-E-ST-40C software process
- ▸Microchip RTG4 / Xilinx Kintex UltraScale rad-tolerant FPGA platforms for embedded control
Lunar considerations
- ▸Autonomous operation across 336-hour discharge with no Earth intervention; controller must handle every fault scenario locally
- ▸Cold-start sequence must dehumidify stack, pre-heat coolant, slowly pressurize reactants — typical duration 30 minutes
- ▸Hot-swap protocol for replaceable BOP modules requires graceful pressure isolation and resumption
- ▸Triple-modular-redundant logic protects against SEUs during 100-year mission
- ▸Long-term firmware updates over authenticated DTN; must accept updates without disrupting mid-discharge operation
Specifications
Functional
| primary function | Sequence, control, and safety-supervise the RFC system across all operating modes |
| inputs | Telemetry from all L3-ESS-FC-* nodes, Power-demand signal from L1-PDM / L2-ESS-MGMT, Time reference from L3-COM-TIME-DIST, Authenticated commands from L3-CDH-PROC |
| outputs | Control signals to L3-ESS-FC-STACK, L3-ESS-FC-ELEC, L3-ESS-FC-BOP, Setpoints to L3-ESS-FC-H2TK / L3-ESS-FC-O2TK regulators, Status, fault, and predictive-maintenance telemetry to L1-CDH, Safety-trip signals to hardwired contactors |
| control loop rate hz | 100 |
| telemetry rate hz | 10 |
| fault detection time ms max | 50 |
| safety trip time ms max | 10 |
| fpga redundancy | TMR with majority voting |
| watchdog timeout s | 0.5 |
| supported modes | off, standby, charge, discharge, idle, fault, maintenance |
Physical
| mass kg | 1.2 |
| dimensions | 180 × 120 × 30 mm 3U cPCI board |
| materials | Microchip RTG4 FPGA (radiation tolerant), Rad-hard SRAM with EDAC, Polyimide PCB, Aluminum chassis with EMC gasketing |
| operating temperature c | -40, 70 |
| radiation tid krad | 100 |
| seu let threshold mev cm2 per mg | 37 |
Operational
| power consumption w | 8 |
| thermal range c | -40, 70 |
| lifetime years | 25 |
| mtbf hours | 300000 |
| software loc | 50000 |
| verification standard | NASA-STD-8739.8 Class A (safety-critical) |
Interfaces
Provides
- Load setpoint, start/stop, safety state
- Power setpoint, charge profile, safety state
- Valve, pump, humidifier sequencing
- Aggregated RFC status, dispatchable capacity, fault summary
Requires
- Authenticated high-level commands and software updates
- Synchronized time for logging and dispatch
- Always-on 28 V supply for controller
Cite this entry
Lunar Ark Codex. "Fuel Cell System Controller" (L3-ESS-FC-CTRL). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-ESS-FC-CTRL
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.