Helios: The Load-Shedding Order
The order in which a remote station gives things up when power runs short. Compute goes early. Heat goes late. The last thing on the list is not equipment.
- Dated
- November 8, 2004
- Classification
- CONTROLLED
- Directorate
- Directorate I
- Custody
- MERIDIAN
- Status
- PUBLISHED
CONTROLLED. Published with editorial redaction. Withheld passages concern methods or third parties. Absolute capacity figures and the winter fuel reserve for each site are withheld; they would allow inference about occupancy and endurance.
Purpose
Helios governs power at sites where nobody is coming to help. When generation falls below demand, something must be given up. This memorandum fixes the order in advance, because the decision cannot be made well under the conditions in which it becomes necessary.
The order is rehearsed annually at each site, in full, including the stages nobody expects to reach.
The order
Shedding proceeds strictly in sequence. Each stage is reversible and each has a defined re-entry condition.
| Stage | Shed | Rationale |
|---|---|---|
| 1 | Non-essential compute | Recoverable work. Nothing is lost that cannot be recomputed later. |
| 2 | Acquisition to secondary instruments | A gap in the record is survivable and is logged as a gap. |
| 3 | Non-critical heating in unoccupied structures | Fabric tolerates the excursion; contents are inventoried against it. |
| 4 | Acquisition to primary instruments | The station stops being a station and becomes a shelter. |
| 5 | Communications, reduced to scheduled windows | Contact becomes expensive, not absent. |
| 6 | Reference and timing hold | Enters holdover; see SEN-16-007. |
| 7 | — | Occupied-space heat and life safety. Not shed. |
On stage 7
There is no stage 7. The row exists in the table so that the absence is explicit.
Occupied-space heating, lighting, and life-safety systems are not on the shedding list at any capacity level. If generation cannot sustain them, the condition is not a power event; it is an evacuation, and it is handled under a different procedure entirely.
The memorandum records this as a design decision rather than a value statement, because it has an engineering consequence: it sets the floor that all sizing works back from. Every capacity figure in the withheld appendix is derived from the requirement that stage 7 never be reachable.
Why the order is fixed in advance
A load-shedding order decided during a shortage will be decided by whoever is awake, under time pressure, optimising for the thing most salient to them. In 1997, before this memorandum, a site preserved an instrument campaign through two shedding stages that should have taken it offline, and came closer to stage 7 than anyone realised until the review.
Nobody made a bad decision. There was no order, so there was no decision — only a series of local judgements, each defensible.
Rehearsal
The full order is executed annually at each site, to stage 6, with the station occupied. The rehearsal is scheduled but its timing within a window is not announced.
Three rehearsals have failed to reach stage 6 because of a dependency discovered mid-sequence — in 2008, 2015 and 2021. Each was a system that had been added after the order was written and had quietly assumed power that the order gives away at stage 1. This is exactly what the rehearsal is for, and is the same class of finding the reversibility rehearsals produce (SEN-23-041).
Index terms
- helios
- power
- resilience
- operations
- lowfield
Related records
Released by the Disclosure Board under Protocol Sigma. Redactions are applied at the section level and are not reversible from the published copy. Requests for review may be sent to [email protected].