Spacecraft internal active thermal control systems (ATCSs) typically use water or a water mixture as their working fluid. A gas-charged bellows accumulator pressurizes the system and provides liquid inventory control. If only a single internal ATCS loop is used, the accumulator represents a single-point failure that can result in a loss of crew. To protect against this possibility, the normal practice is to add a second, fully redundant loop. A redundant loop requires duplication of cold plates, heat exchangers, and plumbing, even though these items are themselves highly reliable. Duplicating these reliable piece parts to protect against accumulator failure adds significant mass to the spacecraft.
Simply adding a redundant accumulator to a single-loop ATCS does not sufficiently improve the system reliability because one of the likely accumulator failure modes is a bellows failure. If the bellows fails, pressurant gas will transfer across the bellows to the working fluid side. Normal changes in accumulator liquid inventory can then sweep the gas into the pumped loop, where it would be entrained by the flowing fluid. If a large enough bubble is carried to the pump, it will deprime — possibly irreversibly so that system operation is irretrievably lost.
A method was developed to ensure that a single-loop ATCS remains gas-free in the event of an accumulator bellows failure. This would allow a redundant accumulator to be brought online to maintain normal system operation.
To preclude the possibility of pump depriming after an accumulator bellows failure, a filter can be added between the accumulator and the flow loop. If the filter’s bubble point is higher than the accumulator pressure, it will block bubbles from entering the loop. An internal ATCS using this innovation would include a filter and a normally open isolation valve at the primary accumulator plus a backup accumulator with a normally closed isolation valve. In the event of a bellows failure, the primary accumulator would be valved out of the loop and the backup accumulator would be valved in.
Failure of the primary accumulator could be detected by either of two methods: flat-lining of the bellows position sensor (accumulator quantity reading) owing to the bellows returning to its neutral position, or divergence of the loop pressure from the accumulator pressure once the filter became blocked by bubbles (a bubble blocked filter would act as a check valve, blocking flow out of the accumulator).
This work was done by Eugene K. Ungar of Johnson Space Center. MSC-24552-1