Storage System Safety Monitor
Independent Safety Voter with Hardware Interlocks
Independent safety monitor with diversely-redundant logic that watches every storage technology for over-temperature, over-voltage, gas leakage, abnormal aging, and thermal runaway — issuing hardware-enforced trip signals when safety thresholds are violated.
Purpose
Provide an independent path that can shut down storage units before damage propagates, separate from the optimisation/dispatch chain so that a bug or compromise in the main controllers cannot disable safety.
Context
Runs on a separate rad-hard FPGA from the main MGMT software, with its own sensor inputs. Outputs hardwired to L3-ESS-LITH-ISOL contactors, L3-ESS-FC-CTRL emergency stop, L3-ESS-SCAP-CTRL precharge. Compliant with ECSS-Q-ST-30C dependability requirements.
Principles
- ▸Diverse redundancy: separate hardware, different algorithm, independent sensors — protects against common-cause failure
- ▸Hardware interlocks bypass software entirely — direct comparator output to contactor coil drivers
- ▸ECSS-Q-ST-30C (Dependability) and ECSS-Q-ST-40C (Safety) define spacecraft safety standards
- ▸IEC 61508 SIL-3 functional safety analog for spacecraft critical electronics
- ▸Two-out-of-three voting on safety-critical sensor measurements minimizes both false-positive and missed faults
- ▸Latching shutdown: a tripped state requires explicit reset, not automatic recovery
Typical implementations
- ▸ESA Independent Safety Computer (ISC) used on multiple missions
- ▸NASA ARES (Anomaly Resolution and Engineering Support) hardware monitors
- ▸Saft Safety Functions on Saft spacecraft batteries
- ▸Triple Modular Redundant (TMR) FPGA logic for safety
- ▸Industrial safety PLCs (Allen-Bradley GuardLogix, Siemens S7-F)
Lunar considerations
- ▸100-year operation means safety logic must work after many SEUs and component aging — TMR + scrubbing essential
- ▸Lunar dust/contamination on connectors could cause false safety trips — voting logic and de-glitching required
- ▸No human in the loop to clear false alarms; safety logic must be high-confidence and self-resetting under certain conditions
- ▸Cold-soak conditions can confuse sensors (e.g., RTD self-heating) → temperature compensation required
- ▸Cyber-isolation: safety monitor must be unreachable from main command bus to prevent malicious shutdown or bypass
Specifications
Functional
| primary function | Independent safety monitoring and hardware trip generation |
| inputs | Independent sensor reads from each storage technology, Hardware comparators for over-temp, over-voltage, over-pressure, Pressure transducer outputs (H2/O2 leak detection), Smoke / gas sensors in battery vault |
| outputs | Hardwired trip signals to L3-ESS-LITH-ISOL contactors, Emergency stop to L3-ESS-FC-CTRL, Precharge release to L3-ESS-SCAP-CTRL, Trip event log to L1-DVT, Safety status telemetry |
| redundancy architecture | TMR with 2oo3 voting |
| trip response time ms max | 10 |
| false trip rate per year max | 0.1 |
| missed trip probability per event max | 1e-06 |
| diversity | Different sensor sources, separate FPGA logic |
Physical
| mass kg | 1.5 |
| dimensions | 180 × 120 × 30 mm 3U cPCI board |
| materials | Microchip RTG4 FPGA (radiation tolerant) with TMR fabric, Independent power supply, Dedicated sensor wiring (not shared with main MGMT), Conformal-coated rad-hard PCB |
| operating temperature c | -40, 70 |
| radiation tid krad | 100 |
| seu let threshold mev cm2 per mg | 37 |
Operational
| power consumption w | 5 |
| thermal range c | -40, 70 |
| lifetime years | 25 |
| mtbf hours | 500000 |
Interfaces
Provides
- Hardwired trip signals
- Emergency stop signal
- Safety status and trip-event records
Requires
- Independent always-on supply (separate rail from main MGMT)
- Independent sensor reads (not via main BMS bus)
Cite this entry
Lunar Ark Codex. "Storage System Safety Monitor" (L3-ESS-MGMT-SAFE). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-ESS-MGMT-SAFE
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.