Evidence boundary: Terrestrial microgrids can separate from a larger grid, and black-start sequences have been modeled, simulated, and demonstrated with real power hardware. Spacecraft routinely use segmented electrical buses, batteries, protective devices, and load shedding. NASA’s KRUSTY experiment demonstrated a roughly one-kilowatt-electric fission power system on the ground. None of this demonstrates a self-repairing, generation-scale space power network that can repeatedly recover life support and matching heat rejection after decades without an external utility, factory, or specialist supply chain.
Plain-language summary
A generation ship cannot have one power plant and a backup switch. It needs an energy ecosystem that can split into safe islands, keep a small set of survival loads alive, diagnose faults, and rebuild service in controlled steps.
Black start means restoring a de-energized power system without relying on electricity from the system it is restarting or from a healthy external grid. The first watts may have to wake protection relays, controllers, communications, lubrication, pumps, valves, and cooling before a larger generator can start. If those first watts or their heat-rejection path are unavailable, a large reactor or array may be present but unusable.
Terrestrial microgrids show that intentional islanding and local restoration are practical engineering fields. Space missions show that careful power budgeting, isolation, storage, and fault protection work at bounded scales. The unsolved problem is closing that loop for a habitat whose power converters, batteries, conductors, switchgear, controls, coolants, radiators, and skilled operators must themselves be renewed.
Power is a network, not a source
The useful question is not “Which reactor powers the ship?” It is “Which complete path can energize this load, reject the associated heat, survive a fault, and be restored with available people and materials?”
A power path includes:
- An energy source or stored reserve.
- Conversion machinery and its controls.
- Conductors, switching, protection, grounding, and electromagnetic compatibility.
- Power conditioning for different voltage, frequency, and quality needs.
- Cooling loops, heat exchangers, pumps, working fluids, and radiators.
- Sensors, metrology, procedures, software, and trained operators.
- Inspectable interfaces, replacement parts, tooling, and safe access.
- Fuel, lubricants, insulation, seals, semiconductor devices, and other limited-life inputs.
If one shared controller, coolant header, cable tunnel, software image, or radiator manifold can disable every train, several generators do not create several independent power islands. Independence must be tested across physical, electrical, thermal, digital, spatial, and organizational boundaries.
Begin with survival loads
Restoration should follow an explicit load hierarchy. A teaching hierarchy might be:
- Class 0 — passive survival: pressure boundary, insulation, fire separation, natural circulation, and other functions that remain safe without command power for a declared interval.
- Class 1 — immediate survival: atmosphere circulation and monitoring, minimum thermal control, fire detection, emergency lighting, essential medical power, and local communications.
- Class 2 — recovery: pumps, environmental processing, command and data systems, diagnostic benches, machine tools needed for the repair, and limited food-system support.
- Class 3 — stabilization: broader agriculture, water processing, sanitation, computing, and industrial services.
- Class 4 — deferrable activity: propulsion support, elective production, high-performance computing, comfort loads, and nonurgent research.
The labels are provisional. A “nonessential” machine shop may become a survival load if it alone can make a cooling-pump shaft. Every class needs a maximum interruption time, minimum service, restart energy, inrush behavior, heat load, staffing need, and safe shutdown state.
What a black-start sequence must prove
A credible recovery sequence starts from an intentionally harsh initial condition: sections de-energized, telemetry incomplete, one expected component unavailable, and no assumption that Earth can answer.
A representative sequence is:
- Confirm fire, radiation, pressure, chemical, and electrical conditions through independent instruments.
- Establish a small direct-current control island from protected storage or a mechanically independent source.
- Energize protection, local communications, timekeeping, and selected sensors.
- Start the minimum cooling and lubrication path required by the first generator.
- Bring one generation train to a stable isolated state.
- Add loads in measured blocks while watching voltage, frequency, harmonics, temperature, coolant inventory, and protection margins.
- Establish a second independently started island.
- Synchronize islands only through a verified interface—or deliberately leave them separate.
- Restore industrial and ecological loads according to time-to-harm rather than political influence.
- Replenish the storage and consumables spent during recovery, then inspect what the transient damaged.
Terrestrial inverter-based black start illustrates both promise and caution. Grid-forming inverters can establish voltage and frequency without a preexisting grid. Transformers, motors, and pumps can demand high inrush current, however; current-limited inverters may not tolerate the same transients as rotating machines. A successful test is evidence for its topology, controls, and loads—not a universal restart recipe.
Heat rejection is part of black start
Nearly all electrical energy used inside a habitat ultimately becomes heat unless it leaves in a directed beam, exhaust, exported mass, stored chemical product, or other accounted flow. A black start can therefore fail thermally even while its electrical measurements look healthy.
Cooling creates circular dependencies:
- A reactor or converter may need powered pumps before it can produce electricity.
- Pumps may require a live bus and functional power electronics.
- The bus may need the reactor.
- Radiator deployment, louvers, valves, or heat-pipe geometry may need control power.
- Batteries that provide first power may have strict temperature limits.
The architecture has to break these loops using protected storage, passive decay-heat removal, natural circulation, mechanical governors, local manual control, or other independently verified means. “The radiator is large enough at full power” does not answer whether the system can reject decay and restart heat after coolant loss, fouling, puncture, or a frozen valve.
KRUSTY is an important bounded demonstration: NASA and partner laboratories operated a new small fission concept with a reactor, heat pipes, and Stirling conversion in a ground test. It is not a flight demonstration, a megawatt system, a black-started habitat, or evidence of century-long fuel, converter, control, and radiator replacement.
Fault isolation must include cyber faults
Power control is operational technology: software changes physical conditions. NIST’s OT security guidance emphasizes that security controls must respect safety, availability, timing, and reliability. A ship cannot respond to every suspicious packet by turning off atmosphere circulation.
A defensive architecture should include:
- Physically enforceable protection that does not depend on a network service.
- Separate safety, control, monitoring, and administrative paths.
- Locally operable breakers and valves with unambiguous state indication.
- Signed and reproducible controller software, controlled configuration, and anti-rollback rules.
- Offline recovery images and documented hardware needed to load them.
- One-way or tightly mediated data paths where command is unnecessary.
- Drills that assume compromised credentials, poisoned sensor data, malicious maintenance, and loss of trusted time.
- Privacy limits so equipment monitoring does not become unrestricted monitoring of residents or workers.
An LLM may help retrieve procedures, compare telemetry with prior cases, translate an old manual, or propose diagnostic branches. It must not be the protection relay, sole procedure archive, or final authority for energizing a life-critical bus. NIST identifies confident false output—confabulation—as an intrinsic generative-AI risk. Any AI-supported instruction should point to the controlled procedure, requirements, current configuration, and observed data that justify it. Operators need an AI-off path, and deterministic safety interlocks must remain effective if the model is unavailable or wrong.
Design for maintainable islands
Power independence erodes if every island uses the same irreplaceable semiconductor, bearing, coolant, firmware tool, or calibration artifact. Commonality simplifies training and spares; diversity limits common-cause failure.
Useful design questions include:
- Can one island be opened, inspected, and rebuilt while another carries survival loads?
- Which failures require a dry dock, clean room, hot cell, vacuum operation, or radiation protection?
- Can switchgear be mechanically verified when telemetry disagrees?
- Are cable routes and coolant loops separated against fire, flood, impact, and sabotage?
- Can old and new converter generations interoperate through documented electrical interfaces?
- Can the factory make contacts, insulation, buswork, housings, seals, and cooling components?
- Which power semiconductors, sensors, catalysts, or fuels remain imported “vitamins”?
- Can people with different bodies and abilities safely reach controls and service points?
The restoration plan is part of the hardware. Procedures, simulation models, labels, test adapters, and training rigs must evolve with every modification.
Earth-first test ladder
This work is valuable without a starship:
- Build a terrestrial habitat or critical facility with two genuinely separable microgrids.
- Declare survival loads and their interruption limits.
- Demonstrate black start from protected storage with normal automation unavailable.
- Inject sensor disagreement, controller compromise, pump inrush, coolant loss, and a missing specialist.
- Run one island for an extended period while the other is physically rebuilt.
- Manufacture selected replacement bus, cooling, housing, and control components locally.
- Repeat with unannounced scenarios and independent safety observers.
- Move a bounded version to an isolated terrestrial, underwater, polar, lunar, or orbital testbed.
The same evidence benefits hospitals, disaster shelters, remote communities, data centers, and industrial sites.
Evidence ledger
- L05-01-A — Intentional islanding and black start are demonstrated terrestrial capabilities. Basis: demonstrated. Readiness: operational in bounded utility and microgrid contexts. Confidence: strong. Limit: configurations, loads, protection, staffing, and external support differ from a closed space habitat.
- L05-01-B — Small spacecraft use segmented buses, storage, conversion, protection, and load shedding. Basis: demonstrated. Readiness: operational at current mission scales. Confidence: strong. Limit: most spacecraft are not repaired internally and do not power a complete society.
- L05-01-C — KRUSTY demonstrated a roughly one-kilowatt-electric fission system on the ground. Basis: demonstrated. Readiness: early research for space fission deployment and major scale-up for habitat power. Confidence: strong about the bounded test.
- L05-01-D — A generation-scale power ecosystem must include heat rejection, black start, replacement, and common-cause-failure control. Basis: normative. Readiness: breakthrough-dependent as an integrated system. Confidence: supported as a systems requirement.
- L05-01-E — Generative AI can support diagnosis but cannot be treated as a verified protection system or sole operational authority. Basis: normative. Readiness: early research for safety-critical offline support. Confidence: strong about the need for bounded authority; tentative about future validated implementations.
Linked corpus claims: claim-03-01, claim-03-04, claim-03-06, claim-03-10, and claim-12-03. See the claim registry for each record's current evidence grade and independent-review state.
Assumptions and limits
- No ship power level, source mix, voltage architecture, radiator temperature, or mission duration is selected.
- Terrestrial grid-forming inverter results are not assumed to survive launch, radiation, vacuum, or multigenerational maintenance.
- KRUSTY was a ground technology demonstration, not a flight power plant or generation-scale reactor.
- “Independent island” requires an explicit common-cause analysis; physical separation alone is insufficient.
- Nuclear material control, reactor safety, waste, safeguards, and proliferation governance require separate high-consequence review.
- AI assistance is advisory and evidence-linked; no generic chatbot or autonomous safety authority is proposed.
What would change this conclusion?
An integrated long-duration test would materially improve readiness if it operated multiple isolated generation trains with representative heat rejection, restarted from a de-energized condition, survived injected electrical, thermal, cyber, and staffing failures, and replaced failed conversion and control hardware from a bounded local inventory. Flight demonstrations would change the environmental evidence. Discovery of an unavoidable common-mode dependency, unmanageable nuclear or cyber risk, or inability to preserve passive survival time should force redesign or a do-not-launch gate.
Sources and locators
- S01 — U.S. Department of Energy, Distributed Energy Resources and Microgrids Basics (opens external site in a new tab). Locator: intentional islanding, local generation, load-generation balance, and black-start discussion; accessed 2026-07-25.
- S02 — NREL, Parallel Grid-Forming Inverter-Driven Black Start (opens external site in a new tab). Locator: power-hardware-in-the-loop black start of a modeled 5 MW unbalanced feeder and transformer/motor inrush treatment; NREL/CP-5D00-87257, 2023 conference preprint; current National Laboratory of the Rockies archive accessed 2026-07-25.
- S03 — Poston et al., KRUSTY Reactor Design (opens external site in a new tab). Locator: one-kilowatt-electric prototype purpose, March 2018 nuclear operation, reactor and conversion boundary; *Nuclear Technology* 206 supplement, 2020; NTRS accessed 2026-07-25.
- S04 — NASA Small Spacecraft Systems Virtual Institute, Power Subsystems (opens external site in a new tab). Locator: source, storage, distribution, regulation, protection, and flight-state-of-practice boundaries; accessed 2026-07-25.
- S05 — NASA Small Spacecraft Systems Virtual Institute, Thermal Control (opens external site in a new tab). Locator: passive and active heat transport, rejection, component limits, and scale-specific examples; accessed 2026-07-25.
- S06 — NASA-STD-8729.1A, Reliability and Maintainability Standard (opens external site in a new tab). Locator: program objectives for reliability, maintainability, planning, analysis, verification, and lifecycle evidence; active standard dated 2017-06-13; accessed 2026-07-25.
- S07 — NIST SP 800-82 Revision 3, Guide to Operational Technology Security (opens external site in a new tab). Locator: OT safety, reliability and availability constraints; architectures, threats, segmentation, and security countermeasures; September 2023; accessed 2026-07-25.
- S08 — NIST AI 600-1, Generative AI Profile (opens external site in a new tab). Locator: section 2.2 on confabulation and the recommended risk-management actions for consequential decisions; July 2024; accessed 2026-07-25.
Editorial record
- Prepared by: GShips Project
- Last edited: 2026-07-25
- Status: Substantive editorial draft
- Independent domain review: Pending
- Required review: space power, thermal control, microgrids, nuclear safety, operational-technology cybersecurity, and human factors
- Reviewer: No independent reviewer assigned
- Conflicts: Maintainer intends to explore a commercial venture based on some GShips work; no entity, funding, customer, sponsor, or partner relationship currently exists
- Corrections: Suggest a correction