Space & Astronomy/Space and Astronomy (October 1993).iso/mac/TEXT/SHUTTLE/MPS_INFO.TXT

Text File | 1993-02-06 | 137KB | 2,365 lines

"6_2_3_13_3_2.TXT" (7414 bytes) was created on 12-14-88

MAIN PROPULSION SYSTEM

The main propulsion system, assisted by the two solid rocket boosters
during the initial phases of the ascent trajectory, provides the
velocity increment from lift-off to a predetermined velocity increment
before orbit insertion.  The two SRBs are jettisoned after their fuel
has been expended, but the MPS continues to thrust until the
predetermined velocity is achieved.  At that time, main engine cutoff
is initiated.  The external tank is jettisoned, and the orbital
maneuvering system is ignited to provide the final velocity increment
for orbital insertion.  The magnitude of the velocity increment
supplied by the OMS depends on payload weight, mission trajectory and
system limitations.

Coincident with the start of the OMS thrusting maneuver (which settles
the MPS propellants), the remaining liquid oxygen propellant in the
orbiter feed system and space shuttle main engines is dumped through
the nozzles of the three SSMEs.  At the same time, the remaining
liquid hydrogen propellant in the orbiter feed system and SSMEs is
dumped overboard through the hydrogen fill and drain valves for six
seconds.  Then the hydrogen inboard fill and drain valve is closed,
and the hydrogen recirculation valve is opened, continuing the dump.
The hydrogen flows through the engine hydrogen bleed valves to the
orbiter hydrogen MPS line between the inboard and outboard hydrogen
fill and drain valves, and the remaining hydrogen is dumped through
the outboard fill and drain valve for approximately 120 seconds.

During on-orbit operations, the flight crew vacuum inerts the MPS by
opening the liquid oxygen and liquid hydrogen fill and drain valves,
which allows the remaining propellants to be vented to space.

Before entry, the flight crew repressurizes the MPS propellant lines
with helium to prevent contaminants from being drawn into the lines
during entry and to maintain internal positive pressure.  MPS helium
is also used to purge the spacecraft's aft fuselage.  The last
activity involving the MPS occurs at the end of the landing rollout.
At that time, the helium remaining in onboard helium storage tanks is
released into the MPS to provide an inert atmosphere for safety.

The MPS consists of the following major subsystems: three SSMEs, three
SSME controllers, the external tank, the orbiter MPS propellant
management subsystem and helium subsystem, four ascent thrust vector
control units, and six SSME hydraulic servoactuators.

The main engines are reusable, high-performance, liquid-propellant
rocket engines with variable thrust.  The propellant fuel is liquid
hydrogen and the oxidizer is liquid oxygen.  The propellant is carried
in separate tanks in the external tank and supplied to the main
engines under pressure.  Each engine can be gimbaled plus or minus
10.5 degrees in the yaw axis and plus or minus 10.5 degrees in the
pitch axis for thrust vector control by hydraulically powered gimbal
actuators.

The main engines can be throttled over a range of 65 to 109 percent of
their rated power level in 1-percent increments.  A value of 100
percent corresponds to a thrust level of 375,000 pounds at sea level
and 470,000 pounds in a vacuum.  A value of 104 percent corresponds to
393,800 pounds at sea level and 488,800 pounds in a vacuum; 109
percent corresponds to 417,300 pounds at sea level and 513,250 pounds
in a vacuum.

At sea level, the engine throttling range is reduced due to flow
separation in the nozzle, prohibiting operation of the engine at its
65-percent throttle setting, referred to as minimum power level.  All
three main engines receive the same throttle command at the same time.
Normally, these come automatically from the orbiter general-purpose
computers through the engine controllers.  During certain contingency
situations, manual control of engine throttling is possible through
the speed brake/thrust controller handle.  The throttling ability
reduces vehicle loads during maximum aerodynamic pressure and limits
vehicle acceleration to 3 g's maximum during boost.

Each engine is designed for 7.5 hours of operation over a life span of
55 starts.  Throughout the throttling range, the ratio of the liquid
oxygen-liquid hydrogen mixture is 6-to-1.  Each nozzle area ratio is
77.5-to-1.  The engines are 14 feet long and 7.5 feet in diameter at
the nozzle exit.

The SSME controllers are digital, computer system, electronic packages
mounted on the SSMEs.  They operate in conjunction with engine
sensors, valve actuators and spark igniters to provide a
self-contained system for monitoring engine control, checkout and
status.  Each controller is attached to the forward end of the SSME.

Engine data and status collected by each controller are transmitted to
the engine interface unit, which is mounted in the orbiter.  There is
one EIU for each main engine.  The EIU transmits commands from the
orbiter GPCs to the main engine controller.  When engine data and
status are received by the EIU, the data are held in a buffer until
the EIU receives a request for data from the computers.

Three orbiter hydraulic systems provide hydraulic pressure to position
the SSME servoactuators for thrust vector control during the ascent
phase of the mission in addition to performing other functions in the
main propulsion system.  The three orbiter auxiliary power units
provide mechanical shaft power through a gear train to drive the
hydraulic pumps that provide hydraulic pressure to their respective
hydraulic systems.

The ascent thrust vector control units receive commands from the
orbiter GPCs and send commands to the engine gimbal actuators.  The
units are electronics packages (four in all) mounted in the orbiter's
aft fuselage avionics bays.  Hydraulic isolation commands are directed
to engine gimbal actuators that indicate faulty servovalve position.
In conjunction with this, a servovalve isolation signal is transmitted
to the computers.

The SSME hydraulic servoactuators are used to gimbal the main engine.
There are two actuators per engine, one for pitch motion and one for
yaw motion.  They convert electrical commands received from the
orbiter GPCs and position servovalves, which direct hydraulic pressure
to a piston that converts the pressure into a mechanical force that is
used to gimbal the SSMEs.  The hydraulic pressure status of each
servovalve is transmitted to the ATVC units.

The orbiter MPS propellant management subsystem consists of the
manifolds, distribution lines and valves by which the liquid
propellants pass from the external tank to the main engines and the
gaseous propellants pass from the main engines to the external tank.
The SSMEs' gaseous propellants are used to pressurize the external
tank.  All the valves in the propellant management subsystem are under
direct control of the orbiter GPCs and are either electrically or
pneumatically actuated.

The orbiter MPS helium subsystem consists of a series of helium supply
tanks and regulators, check valves, distribution lines and control
valves.  The subsystem supplies the helium used within the engine to
purge the high-pressure oxidizer turbopump intermediate seal and
preburner oxidizer domes and to actuate valves during emergency
pneumatic shutdown.  The balance of the helium is used to actuate all
the pneumatically operated valves within the propellant management
subsystem and to pressurize the propellant lines before re-entry.


"6_2_3_13_3_3.TXT" (9848 bytes) was created on 12-12-88

ORBITER MAIN PROPULSION SYSTEM HELIUM SUBSYSTEM.

The MPS helium subsystem consists of seven 4.7-cubic-foot helium
supply tanks; three 17.3-cubic-foot helium supply tanks; and
associated regulators, check valves, distribution lines and control
valves.  Four of the 4.7-cubic-foot helium supply tanks are located in
the aft fuselage, and the other three are located below the payload
bay liner in the midfuselage in the area originally reserved for the
cryogenic storage tanks of the power reactant storage and distribution
system.  The three 17.3-cubic-foot helium supply tanks are also
located below the payload bay liner in the midfuselage.

The tanks are composite structures consisting of a titanium liner with
a fiberglass structural overwrap.  The large tanks are 40.3 inches in
diameter and have a dry weight of 272 pounds.  The smaller tanks are
26 inches in diameter and have a dry weight of 73 pounds.  The tanks
are serviced before lift-off to a pressure of 4,500 psi.

Each of the larger supply tanks is plumbed to two of the smaller
supply tanks (one in the midbody, the other in the aft body), forming
three sets of three tanks for the engine helium pneumatic supply
system.  Each set of tanks normally provides helium to only one engine
and is commonly referred to as left, center, or right engine helium,
depending on the engine serviced.  Each set normally provides helium
to its designated engine for in-flight purges and provides pressure
for actuating engine valves during emergency pneumatic shutdown.

The remaining 4.7-cubic-foot helium tank is referred to as the
pneumatic helium supply tank.  It normally provides pressure to
actuate all of the pneumatically operated valves in the propellant
management subsystem.

There are eight helium supply tank isolation valves grouped in pairs.
One pair of valves is connected to each engine helium supply tank
cluster, and one pair is connected to the pneumatic supply tank.  In
the engine helium supply tank system, each pair of isolation valves is
connected in parallel, with each valve in the pair controlling helium
flow through one leg of a dual-redundant helium supply circuit.  Each
helium supply circuit contains two check valves, a filter, an
isolation valve, a regulator and a relief valve.  The two isolation
valves connected to the pneumatic supply tanks are also connected in
parallel; however, the rest of the pneumatic supply system consists of
a filter, the two isolation valves, a regulator, a relief valve and a
single check valve.  Each engine helium supply isolation valve can be
individually controlled by its He isolation A left , ctr , right open
, GPC , close and He isolation B left , ctr , right , open , GPC,
close switches on panel R2.  The two pneumatic helium supply isolation
valves are controlled by a single pneumatic He isol , open, GPC, close
switch on panel R2.

All of the valves in the helium subsystem (with the exception of the
supply tank isolation valves) are spring loaded to one position and
electrically actuated to the other position.  The supply tank
isolation valves are spring loaded to the closed position and
pneumatically actuated to the open position.  Valve position is
controlled via electrical signals from either the onboard GPCs or
manually by the flight crew.  All of the valves can be controlled
automatically by the GPCs, and the flight crew can control some of the
valves.

The helium source pressure of the pneumatic, left, center and right
supply systems can be monitored on the helium , pneu , l (left), c
(center), r (right) meters on panel F7 by positioning the tank, reg
(regulator) switch below the meters to tank .  In addition, the
regulated pressure of the pneumatic, left, center and right systems
can be monitored on the same meters by placing the switch to reg .

Each of the four helium supply systems operates independently until
after main engine cutoff.  Each engine helium supply has two
interconnect (crossover) valves associated with it, and each valve in
the pair of interconnect valves is connected in series with a check
valve.  The check valves allow helium to flow through the interconnect
valves in one direction only.  One check valve associated with one
interconnect valve controls helium flow in one direction, and the
other interconnect valve and its associated check valve permit helium
flow in the opposite direction.  The in interconnect valve controls
helium flow into the associated engine helium distribution system from
the pneumatic helium supply tank.  The out interconnect valve controls
helium flow out of the associated engine helium supply system to the
pneumatic distribution system.

Each pair of interconnect valves is controlled by a single switch on
panel R2.  Each He interconnect , left , ctr , right switch has three
positions- in open/out close , GPC , and in close/out open.  With the
switch in the in open/out close position, the in interconnect valve is
open and the out interconnect valve is closed.  The in close/out open
position does the reverse.  With the switch in GPC, the out
interconnect valve opens automatically at the beginning of the liquid
oxygen dump and closes automatically at the end of the liquid hydrogen
dump.

In a return-to-launch-site abort, the GPC position will cause the in
interconnect valve to open automatically at MECO and close
automatically 20 seconds later.  If an engine was shut down before
MECO, its in interconnect valve will remain closed at MECO.  At any
other time, placing the switch in GPC results in both interconnect
valves being closed.

An additional interconnect valve between the left engine helium supply
and pneumatic helium supply would be used if the pneumatic helium
supply regulator failed.  This crossover valve would be opened and the
pneumatic helium supply tank isolation valves would be closed,
allowing the left engine helium supply system to supply helium to the
pneumatic helium supply.  The crossover helium valve is controlled by
its own three-position switch on panel R2.  The pneumatics l (left)
eng He xovr (crossover) switch positions are open, GPC and close.  The
GPC position allows the valve to be controlled by the flight software
loaded in the GPCs.

Manifold pressurization valves located downstream of the pneumatic
helium pressure regulator are used to control the flow of helium to
propellant manifolds during a nominal propellant dump and manifold
repressurization.  There are four of these valves grouped in pairs.
One pair controls helium pressure to the liquid oxygen propellant
manifolds, and the other pair controls helium pressure to the liquid
hydrogen propellant manifold.

The liquid hydrogen RTLS dump pressurization valves located downstream
of the pneumatic helium pressure regulator are used to control the
pressurization of the liquid hydrogen propellant manifolds during an
RTLS liquid hydrogen dump.  There are two of these valves connected in
series.  Unlike the liquid hydrogen manifold pressurization valves,
the liquid hydrogen RTLS dump pressurization valves cannot be
controlled by flight deck switches.  During an RTLS abort, these
valves are opened and closed automatically by GPC commands.  An
additional difference between the nominal and the RTLS liquid hydrogen
dumps is in the routing of the helium and the place where it enters
the liquid hydrogen feed line manifold.  For the nominal liquid
hydrogen dump, helium passes through the liquid hydrogen manifold
pressurization valves and enters the feed line manifold in the
vicinity of the liquid hydrogen feed line disconnect valve.  For the
liquid hydrogen RTLS dump, helium passes through the RTLS liquid
hydrogen dump pressurization valves and enters the feed line manifold
in the vicinity of the liquid hydrogen inboard fill and drain valve on
the inboard side.  There is no RTLS liquid oxygen dump pressurization
valve since the liquid oxygen manifold is not pressurized during the
RTLS liquid oxygen dump.

Each engine helium supply tank has two pressure regulators operating
in parallel.  Each regulator controls pressure in one leg of a
dual-redundant helium supply circuit and is capable of providing all
of the helium needed by the main engines.

The pressure regulator for the pneumatic helium supply system is not
redundant and is set to provide outlet pressure between 715 to 770
psig.  Downstream of the regulator are two more regulators: the liquid
hydrogen manifold pressure regulator and the liquid oxygen manifold
pressure regulator.  These regulators are used only during MPS
propellant dumps and manifold pressurization.  Both regulators are set
to provide outlet pressure between 20 to 25 psig.  Flow through the
regulators is controlled by the appropriate set of two normally closed
manifold pressurization valves.

Downstream of each pressure regulator, with the exception of the two
manifold repressurization regulators, is a relief valve.  The valve
protects the downstream helium distribution lines from
overpressurization if the associated regulator fails fully open.  The
two relief valves in each engine helium supply are set to relieve at
785 to 850 psig and reseat at 785 psig.  The relief valve in the
pneumatic helium supply circuit also relieves at 785 to 850 psig and
reseats at 785 psig.

There is one pneumatic control assembly on each of the three space
shuttle main engines.  The PCA is essentially a manifold pressurized
by one of the engine helium supply systems and contains solenoid
valves to control and direct pressure to perform various essential
functions.  The valves are energized by discrete on/off commands from
the output electronics of the associated SSME controller.  Functions
controlled by the PCA include the high-pressure oxidizer turbopump
intermediate seal cavity and preburner oxidizer dome purge, pogo
system postcharge and pneumatic shutdown.


"6_2_3_13_3_4.TXT" (9563 bytes) was created on 12-12-88

Enter {V}iew, {X}MODEM, {Y}MODEM, {K}ERMIT, ? for HELP, or {M}enu [V]...


MAIN PROPULSION SYSTEM PROPELLANT MANAGEMENT SUBSYSTEM.

Within the orbiter aft fuselage, liquid hydrogen and liquid oxygen
pass through the manifolds, distribution lines and valves of the
propellant management subsystem.

During prelaunch activities, this subsystem is used to control the
loading of liquid oxygen and liquid hydrogen in the external tank.
During SSME thrusting periods, propellants from the external tank flow
into this subsystem and to the three SSMEs.  The subsystem also
provides a path that allows gases tapped from the three SSMEs to flow
back to the external tank through two gas umbilicals to maintain
pressure in the external tank's liquid oxygen and liquid hydrogen
tanks.  After MECO, this subsystem controls MPS dumps, vacuum inerting
and MPS repressurization for entry.

All the valves in the MPS are either electrically or pneumatically
operated.  Pneumatic valves are used where large loads are
encountered, such as in the control of liquid propellant flows.
Electrical valves are used for lighter loads, such as in the control
of gaseous propellant flows.

The pneumatically actuated valves are divided into two types: those
that require pneumatic pressure to open and close the valve (type 1)
and those that are spring loaded to one position and require pneumatic
pressure to move to the other position (type 2).

Each type 1 valve actuator is equipped with two electrically actuated
solenoid valves.  Each solenoid valve controls helium pressure to an
''open'' or ''close'' port on the actuator.  Energizing the solenoid
valve on the open port allows helium pressure to open the pneumatic
valve.  Energizing the solenoid on the close port allows helium
pressure to close the pneumatic valve.  Removing power from a solenoid
valve removes helium pressure from the corresponding port of the
pneumatic actuator and allows the helium pressure trapped in that side
of the actuator to vent overboard.  Removing power from both solenoids
allows the pneumatic valve to remain in the last commanded position.
This type of valve is used for the liquid oxygen and liquid hydrogen
feed line 17-inch umbilical disconnect valves (two), the liquid oxygen
and liquid hydrogen prevalves (six), the three liquid hydrogen and
liquid oxygen inboard and outboard fill and drain valves (four), and
the liquid hydrogen 4-inch recirculation disconnect valves.

Each type 2 valve is a single electrically actuated solenoid valve
that controls helium pressure to either an open or a close port on the
actuator.  Removing power from the solenoid valve removes helium
pressure from the corresponding port of the pneumatic actuator and
allows helium pressure trapped in that side of the actuator to vent
overboard.  Spring force takes over and drives the valve to the
opposite position.  If the spring force drives the valve to the open
position, the valve is referred to as a normally open valve.  If the
spring force drives the valve to a closed position, the valve is
referred to as a normally closed valve.  This type of valve is used
for the liquid hydrogen RTLS inboard dump valve (NC), the liquid
hydrogen RTLS outboard dump valve (NC), the liquid hydrogen feed line
relief shutoff valve (NO), the liquid oxygen feed line relief shutoff
valve (NO), the three liquid hydrogen engine recirculation valves
(NC), the two liquid oxygen pogo recirculation valves (NO), the liquid
hydrogen topping valve (NC), the liquid hydrogen high-point bleed
valve (NC), and the liquid oxygen overboard bleed valve (NO).

The electrically actuated solenoid valves are spring loaded to one
position and move to the other position when electrical power is
applied.  These valves also are referred to as either normally open or
normally closed, based on their position in the de-energized state.
Electrically actuated solenoid valves are the gaseous hydrogen
pressurization line vent valve (NC), the three gaseous hydrogen
pressurization flow control valves (NO) and the three gaseous oxygen
pressurization flow control valves (NO).

There are two 17-inch-diameter MPS propellant feed line manifolds in
the orbiter aft fuselage, one for liquid oxygen and one for liquid
hydrogen.  Each manifold has an outboard and inboard fill and drain
valve in series that interface with the respective port (left) and
starboard (right) T-0 umbilical.  The port T-0 umbilical is for liquid
hydrogen; the starboard, for liquid oxygen.  In addition, each
manifold connects the orbiter to the external tank in the lower aft
fuselage through a port 17-inch liquid hydrogen disconnect valve
umbilical and a starboard 17-inch liquid oxygen disconnect valve
umbilical.

There are three outlets in both the liquid oxygen and liquid hydrogen
17-inch manifolds between the orbiter-external tank 17-inch umbilical
disconnect valves and the inboard fill and drain valve.  The outlets
in the manifolds provide liquid oxygen and liquid hydrogen to each
SSME in 12-inch-diameter feed lines.

The prevalve in each of the three liquid oxygen and liquid hydrogen
12-inch feed lines to each engine isolates liquid oxygen and liquid
hydrogen from each engine or permits liquid oxygen and liquid hydrogen
to flow to each engine.  Each prevalve is controlled by an LH 2 or LO
2 prevalve , left , ctr , right switch on panel R4.  Each switch has
open, GPC and close positions.

The 8-inch-diameter liquid hydrogen outboard and inboard fill and
drain valves are also controlled by their own switches on panel R4.
Each propellant fill/drain LH 2 , outbd , inbd switch has open, gnd
and close positions, as does each LO2, outbd, inbd switch.

Each 17-inch liquid hydrogen and liquid oxygen manifold has a
1-inch-diameter line that is routed to a feed line relief isolation
valve and feed line relief valve in the respective liquid hydrogen and
liquid oxygen system.  The LO 2 and LH 2 feed line rlf (relief) isol
(isolation) switches on panel R4 have open , GPC and close positions.
When a feed line relief isolation valve is opened, the corresponding
manifold can relieve excessive pressure overboard through its relief
valve.

The liquid hydrogen feed line manifold has another outlet directed to
the two liquid hydrogen RTLS dump valves in series.  Both valves are
controlled by the MPS prplt dump LH 2 valve switch on panel R2, which
has backup LH 2 vlv open , GPC , close positions.  When opened, these
valves enable the liquid hydrogen dump during RTLS aborts or provide a
backup to the normal liquid hydrogen dump after a nominal main engine
cutoff.  In an RTLS abort dump, liquid hydrogen is dumped overboard
through a port at the outer aft fuselage's left side between the
orbital maneuvering system/reaction control system pod and the upper
surface of the wing.

The MPS propellant management subsystem also contains two
2-inch-diameter manifolds, one for gaseous oxygen and one for gaseous
hydrogen.  Each manifold individually permits ground support equipment
servicing with helium through the respective T-0 umbilical and
provides initial pressurization of the external tank's liquid oxygen
and liquid hydrogen orbiter/external tank disconnect umbilicals.
Self-sealing quick disconnects are provided at the T-0 umbilical and
the orbiter/external tank umbilical.

Six 0.63-inch-diameter pressurization lines, three for gaseous oxygen
and three for gaseous hydrogen, are used after SSME start to
pressurize the external tank's liquid oxygen and liquid hydrogen
tanks.

In each SSME, a small portion of liquid oxygen is diverted into the
engine's oxidizer heat exchanger, and the heat generated by the
engine's high-pressure oxidizer turbopump converts the liquid oxygen
into gaseous oxygen and directs it through a check valve to two
orifices and a flow control valve for each engine.  During SSME
thrusting periods, liquid oxygen tank pressure is maintained between
20 and 22 psig by the orifices in the two lines and the action of the
flow control valve from each SSME.  The flow control valve is
controlled by one of three liquid oxygen pressure transducers.  When
tank pressure decreases below 20 psig, the valve opens.  If the tank
pressure is greater than 24 psig, it is relieved through the liquid
oxygen tank's vent and relief valve.

In each SSME, gaseous hydrogen from the low-pressure fuel turbopump is
directed through two check valves to two orifices and a flow control
valve for each engine.  During the main engine thrusting period, the
liquid hydrogen tank's pressure is maintained between 32 and 34 psia
by the orifices and the action of the flow control valve from each
SSME.  The flow control valve is controlled by one of three liquid
hydrogen pressure transducers.  When tank pressure decreases below 32
psia, the valve opens; and when tank pressure increases to 33 psia,
the valve closes.  If the tank pressure is greater than 35 psia, the
pressure is relieved through the liquid hydrogen tank's vent and
relief valve.  If the pressure falls below 32 psia, the LH 2 ullage
press switch on panel R2 is positioned from auto to open , which will
cause all three flow control valves to go to full open and remain in
the full-open position.

The single gaseous hydrogen manifold repressurization line connects to
the hydrogen line vent valve, which is controlled by the H 2 press
line vent switch on panel R4.  This valve is normally closed, and the
switch is positioned to open when vacuum inerting the gaseous hydrogen
pressurization lines after MECO and the liquid hydrogen dump.  The gnd
position allows the launch processing system to control the valve
during ground operations.

====PRESS RETURN TO CONTINUE====


Enter an option number, 'G' for GO TO, ? for HELP, or
  press RETURN to redisplay menu...

Enter an option number, 'G' for GO TO, ? for HELP, or
  press RETURN to redisplay menu...5


"6_2_3_13_3_5.TXT" (8130 bytes) was created on 12-12-88

Enter {V}iew, {X}MODEM, {Y}MODEM, {K}ERMIT, ? for HELP, or {M}enu [V]...



EXTERNAL TANK.

The external tank is attached to the orbiter at one forward and two
aft attach points.  At the two aft attach points are the two external
tank/orbiter umbilicals for the fluid, gas, signal and electrical
power connections between the orbiter and the external tank.  Each
external tank umbilical plate mates with a corresponding umbilical
plate on the orbiter.  The umbilical plates help maintain alignment of
the various connecting components.  The corresponding umbilical plates
are bolted together; and when external tank separation is commanded,
the bolts are severed by pyrotechnics.

At the forward end of each external tank propellant tank is a vent and
relief valve that can be opened by GSE-supplied helium before launch
for venting or by excessive tank pressure for relief.  The vent
function is available only before launch; after lift-off only the
relief function is operable.  The liquid oxygen tank relieves at an
ullage pressure of 25 psig, while the liquid hydrogen tank relieves at
an ullage pressure of 38 psi.  The flight crew has no control over the
position of the vent and relief valves before launch or during ascent.
Normal range of the tank ullage pressure of the liquid hydrogen tank
during ascent is 32 to 39 psia.  During prelaunch activities, the
liquid hydrogen tank is pressurized to 44.1 psi to meet the start
requirement of the main engine LPFT.  The liquid oxygen and liquid
hydrogen tanks' ullage pressures are monitored on the panel F7 eng
manf LO2 and LH2 meters as well as on a cathode ray tube display.

In addition to the vent and relief valve, the liquid oxygen tank has a
tumble vent valve that is opened during the external tank separation
sequence.  The thrust force provided by opening the valve imparts an
angular velocity to the external tank to assist in the separation
maneuver and provide more positive control of the external tank's
re-entry aerodynamics.

There are eight propellant depletion sensors.  Four of them sense fuel
depletion and four sense oxidizer depletion.  The oxidizer depletion
sensors are mounted in the external tank's liquid oxygen feed line
manifold downstream of the tank.  The fuel depletion sensors are
located in the liquid hydrogen tank.  During prelaunch activities, the
launch processing system tests each propellant depletion sensor.  If
any are found to be in a failed condition, the LPS sets a flag in the
computer's SSME operational sequence, sequence logic that will
instruct the computer to ignore the output of the failed sensor or
sensors.  During main engine thrusting, the computer constantly
computes the instantaneous mass of the vehicle, which constantly
decreases due to propellant usage from the external tank.  When the
computed vehicle mass matches a predetermined initialized-loaded
value, the computer arms the propellant depletion sensors.  After this
time, if any two of the good fuel depletion sensors (those not flagged
before launch) or any two of the good oxidizer depletion sensors
indicate a dry condition, the computers command main engine cutoff.
This type of MECO is a backup to the nominal MECO, which is based on
vehicle velocity.  The oxidizer sensors sense propellant depletion
before the fuel sensors to ensure that all depletion cutoffs are
fuel-rich since an oxidizer-rich cutoff can cause burning and severe
erosion of engine components.  To ensure that the oxidizer sensors
sense depletion first, a plus 700-pound bias is included in the amount
of liquid hydrogen loaded in the external tank.  This amount is in
excess of that dictated by the 6-1 ratio of oxidizer to fuel.  The
position of the oxidizer propellant depletion sensors allows the
maximum amount of oxidizer to be consumed in the engines and allows
sufficient time to cut off the engines before the oxidizer turbopumps
cavitate (run dry).

Four ullage pressure transducers are located at the top end of each
propellant tank (liquid oxygen and liquid hydrogen).  One of the four
is considered a spare and is normally off-line.  Before launch, GSE
normally checks out the four transducers; and if one of the three
active transducers is determined to be bad, it can be taken off-line
and the output of the spare transducer selected.  The flight crew can
also perform this operation after lift-off via the computer keyboard;
however, because of the time involved from lift-off to MECO, this
would probably be impractical.  The three active ullage pressure
sensors provide outputs for CRT display and control of ullage pressure
within their particular propellant tanks.  For CRT display, computer
processing selects the middle value output of the three transducers
and displays this single value.  For ullage pressure control, all
three outputs are used.

The external tank/orbiter aft umbilicals have five propellant
disconnects: two for the liquid oxygen tank and three for the liquid
hydrogen tank.  One of the liquid oxygen propellant umbilicals carries
liquid oxygen and the other carries gaseous oxygen.  The liquid
hydrogen tank has two disconnects that carry liquid hydrogen and one
that carries gaseous hydrogen.  The external tank liquid hydrogen
recirculation disconnect is the smaller of the two disconnects that
carry liquid hydrogen and is used only during the liquid hydrogen
chill-down sequence before launch.

In addition, the external tank/orbiter umbilicals contain two
electrical umbilicals, each made of many smaller electrical cables.
These cables carry electrical power from the orbiter to the external
tank and the two solid rocket boosters and bring telemetry back to the
orbiter from the SRBs and external tank.  The operational
instrumentation telemetry that comes back from the SRBs is
conditioned, digitized and multiplexed in the SRBs themselves.  The
external tank OI measurements that return to the orbiter are raw
transducer outputs and must be processed within the orbiter telemetry
system.

The external tank's liquid oxygen tank is serviced at the launch pad
before prelaunch from ground support equipment through the starboard
T-0 umbilical of the orbiter, the MPS outboard and inboard fill and
drain valves, the MPS 17-inch liquid oxygen line, and the
orbiter/external tank 17-inch umbilical disconnect valves.  Once the
liquid oxygen is loaded and ready for main engine ignition, the liquid
oxygen tank's vent and relief valve is closed, and the tank is
pressurized to 21 psig by GSE-supplied helium.  During SSME thrusting,
liquid oxygen flows out of the external tank through the
orbiter/external tank umbilical into the orbiter MPS and to each SSME.
Pressurization in the tank is maintained by gaseous oxygen tapped from
the three main engines and supplied to the liquid oxygen tank through
the orbiter/external tank gaseous oxygen umbilical.

The external tank's liquid hydrogen tank is serviced before launch
from GSE at the launch pad similarly to the liquid oxygen tank but
through the port T-0 umbilical and port orbiter/external tank
umbilical.  When the liquid hydrogen is loaded and ready for main
engine ignition, the liquid hydrogen tank's vent and relief valve is
closed, and the tank is pressurized to 42.5 psia by GSE-supplied
helium.

Approximately 45 minutes after loading starts, three electrically
powered liquid hydrogen pumps in the orbiter begin to circulate the
liquid hydrogen in the external tank through the three SSMEs and back
to the external tank through a special recirculation umbilical.  This
recirculation chills down the liquid hydrogen lines between the
external tank and the high-pressure fuel turbopump in the SSMEs so
that the path is free of any gaseous hydrogen bubbles and is at the
proper temperature for engine start.  Recirculation ends approximately
six seconds before engine start.  During engine thrusting, liquid
hydrogen flows from the external tank and through the orbiter/external
tank liquid hydrogen umbilical into the orbiter MPS and to the main
engines.  Tank pressurization is maintained by gaseous hydrogen tapped
from the three SSMEs and supplied to the liquid hydrogen tank through
the orbiter/external tank gaseous hydrogen umbilical.

"6_2_3_13_3_6.TXT" (10336 bytes) was created on 12-12-88

Enter {V}iew, {X}MODEM, {Y}MODEM, {K}ERMIT, ? for HELP, or {M}enu [V]...


SPACE SHUTTLE MAIN ENGINES.

Oxidizer from the external tank enters the orbiter at the
orbiter/external tank umbilical disconnect and then the orbiter's main
propulsion system liquid oxygen feed line.  There it branches out into
three parallel paths, one to each engine.  In each branch, a liquid
oxygen prevalve must be opened to permit flow to the low-pressure
oxidizer turbopump.

The LPOT is an axial-flow pump driven by a six-stage turbine powered
by liquid oxygen.  It boosts the liquid oxygen's pressure from 100
psia to 422 psia.  The flow from the LPOT is supplied to the
high-pressure oxidizer turbopump.  During engine operation, the
pressure boost permits the HPOT to operate at high speeds without
cavitating.  The LPOT operates at approximately 5,150 rpm.  The LPOT,
which is approximately 18 by 18 inches, is connected to the vehicle
propellant ducting and supported in a fixed position by the orbiter
structure.

The HPOT consists of two single-stage centrifugal pumps (a main pump
and a preburner pump) mounted on a common shaft and driven by a
two-stage, hot-gas turbine.  The main pump boosts the liquid oxygen's
pressure from 422 psia to 4,300 psia while operating at approximately
28,120 rpm.  The HPOT discharge flow splits into several paths, one of
which is routed to drive the LPOT turbine.  Another path is routed to
and through the main oxidizer valve and enters into the main
combustion chamber.  Another small flow path is tapped off and sent to
the oxidizer heat exchanger.  The liquid oxygen flows through an
anti-flood valve that prevents it from entering the heat exchanger
until sufficient heat is present to convert the liquid oxygen to gas.
The heat exchanger utilizes the heat contained in the discharge gases
from the HPOT turbine to convert the liquid oxygen to gas.  The gas is
sent to a manifold and is then routed to the external tank to
pressurize the liquid oxygen tank.  Another path enters the HPOT
second-stage preburner pump to boost the liquid oxygen's pressure from
4,300 psia to 7,420 psia.  It passes through the oxidizer preburner
oxidizer valve into the oxidizer preburner and through the fuel
preburner oxidizer valve into the fuel preburner.  The HPOT is
approximately 24 by 36 inches.  It is attached by flanges to the
hot-gas manifold.

Fuel enters the orbiter at the liquid hydrogen feed line disconnect
valve, then flows into the orbiter gaseous hydrogen feed line manifold
and branches out into three parallel paths to each engine.  In each
liquid hydrogen branch, a prevalve permits liquid hydrogen to flow to
the low-pressure fuel turbopump when the prevalve is open.

The LPFT is an axial-flow pump driven by a two-stage turbine powered
by gaseous hydrogen.  It boosts the pressure of the liquid hydrogen
from 30 psia to 276 psia and supplies it to the high-pressure fuel
turbopump.  During engine operation, the pressure boost provided by
the LPFT permits the HPFT to operate at high speeds without
cavitating.  The LPFT operates at approximately 16,185 rpm.  The LPFT
is approximately 18 by 24 inches.  It is connected to the vehicle
propellant ducting and is supported in a fixed position by the orbiter
structure 180 degrees from the LPOT.

The HPFT is a three-stage centrifugal pump driven by a two-stage,
hot-gas turbine.  It boosts the pressure of the liquid hydrogen from
276 psia to 6,515 psia.  The HPFT operates at approximately 35,360
rpm.  The discharge flow from the turbopump is routed to and through
the main valve and then splits into three flow paths.  One path is
through the jacket of the main combustion chamber, where the hydrogen
is used to cool the chamber walls.  It is then routed from the main
combustion chamber to the LPFT, where it is used to drive the LPFT
turbine.  A small portion of the flow from the LPFT is then directed
to a common manifold from all three engines to form a single path to
the external tank to maintain liquid hydrogen tank pressurization.
The remaining hydrogen passes between the inner and outer walls to
cool the hot-gas manifold and is discharged into the main combustion
chamber.  The second hydrogen flow path from the main fuel valve is
through the engine nozzle (to cool the nozzle).  It then joins the
third flow path from the chamber coolant valve.  The combined flow is
then directed to the fuel and oxidizer preburners.  The HPFT is
approximately 22 by 44 inches.  It is attached by flanges to the
hot-gas manifold.

The oxidizer and fuel preburners are welded to the hot-gas manifold.
The fuel and oxidizer enter the preburners and are mixed so that
efficient combustion can occur.  The augmented spark igniter is a
small combination chamber located in the center of the injector of
each preburner.  The two dual-redundant spark igniters, which are
activated by the engine controller, are used during the engine start
sequence to initiate combustion in each preburner.  They are turned
off after approximately three seconds because the combustion process
is then self-sustaining.  The preburners produce the fuel-rich hot gas
that passes through the turbines to generate the power to operate the
high-pressure turbopumps.  The oxidizer preburner's outflow drives a
turbine that is connected to the HPOT and the oxidizer preburner pump.
The fuel preburner's outflow drives a turbine that is connected to the
HPFT.

The HPOT turbine and HPOT pumps are mounted on a common shaft.  Mixing
of the fuel-rich hot gas in the turbine section and the liquid oxygen
in the main pump could create a hazard.  To prevent this, the two
sections are separated by a cavity that is continuously purged by the
MPS engine helium supply during engine operation.  Two seals minimize
leakage into the cavity.  One seal is located between the turbine
section and the cavity, and the other is between the pump section and
cavity.  Loss of helium pressure in this cavity results in an
automatic engine shutdown.

The speed of the HPOT and HPFT turbines depends on the position of the
corresponding oxidizer and fuel preburner oxidizer valves.  These
valves are positioned by the engine controller, which uses them to
throttle the flow of liquid oxygen to the preburners and, thus,
control engine thrust.  The oxidizer and fuel preburner oxidizer
valves increase or decrease the liquid oxygen flow, thus increasing or
decreasing preburner chamber pressure, HPOT and HPFT turbine speed,
and liquid oxygen and gaseous hydrogen flow into the main combustion
chamber, which increases or decreases engine thrust, thus throttling
the engine.  The oxidizer and fuel preburner valves operate together
to throttle the engine and maintain a constant 6-1 propellant mixture
ratio.

The main oxidizer valve and the main fuel valve control the flow of
liquid oxygen and liquid hydrogen into the engine and are controlled
by each engine controller.  When an engine is operating, the main
valves are fully open.

A coolant control valve is mounted on the combustion chamber coolant
bypass duct of each engine.  The engine controller regulates the
amount of gaseous hydrogen allowed to bypass the nozzle coolant loop,
thus controlling its temperature.  The chamber coolant valve is 100
percent open before engine start.  During engine operation, it will be
100 percent open for throttle settings of 100 to 109 percent for
minimum cooling.  For throttle settings between 65 to 100 percent, its
position will range from 66.4 to 100 percent open for maximum cooling.

Each engine main combustion chamber receives fuel-rich hot gas from a
hot-gas manifold cooling circuit.  The gaseous hydrogen and liquid
oxygen enter the chamber at the injector, which mixes the propellants.
A small augmented spark igniter chamber is located in the center of
the injector.  The dual-redundant igniter is used during the engine
start sequence to initiate combustion.  The igniters are turned off
after approximately three seconds because the combustion process is
self-sustaining.  The main injector and dome assembly is welded to the
hot-gas manifold.  The main combustion chamber also is bolted to the
hot-gas manifold.

The inner surface of each combustion chamber, as well as the inner
surface of each nozzle, is cooled by gaseous hydrogen flowing through
coolant passages.  The nozzle assembly is a bell-shaped extension
bolted to the main combustion chamber.  The nozzle is 113 inches long,
and the outside diameter of the exit is 94 inches.  A support ring
welded to the forward end of the nozzle is the engine attach point to
the orbiter-supplied heat shield.  Thermal protection for the nozzles
is necessary because of the exposure that portions of the nozzles
experience during the launch, ascent, on-orbit and entry phases of a
mission.  The insulation consists of four layers of metallic batting
covered with a metallic foil and screening.

The five propellant valves on each engine (oxidizer preburner
oxidizer, fuel preburner oxidizer, main oxidizer, main fuel, and
chamber coolant) are hydraulically actuated and controlled by
electrical signals from the engine controller.  They can be fully
closed by using the MPS engine helium supply system as a backup
actuation system.

The low-pressure oxygen and low-pressure fuel turbopumps are mounted
180 degrees apart on the orbiter's aft fuselage thrust structure.  The
lines from the low-pressure turbopumps to the high-pressure turbopumps
contain flexible bellows that enable the low-pressure turbopumps to
remain stationary while the rest of the engine is gimbaled for thrust
vector control.  The liquid hydrogen line from the LPFT to the HPFT is
insulated to prevent the formation of liquid air.

The main oxidizer valve and fuel bleed valve are used after shutdown.
The main oxidizer valve is opened during a propellant dump to allow
residual liquid oxygen to be dumped overboard through the engine, and
the fuel bleed valve is opened to allow residual liquid hydrogen to be
dumped through the liquid hydrogen fill and drain valves overboard.
After the dump is completed, the valves close and remain closed for
the remainder of the mission.

The gimbal bearing is bolted to the main injector and dome assembly
and is the thrust interface between the engine and orbiter.  The
bearing assembly is approximately 11.3 by 14 inches.

Overall, a space shuttle main engine weighs approximately 7,000
pounds.


"6_2_3_13_3_7.TXT" (2012 bytes) was created on 12-12-88

POGO SUPPRESSION SYSTEM.

A pogo suppression system prevents the transmission of low-frequency
flow oscillations into the high-pressure turbopump and, ultimately,
prevents main combustion chamber pressure (engine thrust) oscillation.
Flow oscillations transmitted from the space shuttle vehicle are
suppressed by a partially filled gas accumulator, which is attached by
flanges to the high-pressure oxidizer turbopump's inlet duct.

The system consists of a 0.6-cubic-foot accumulator with an internal
standpipe, helium precharge valve package, gaseous oxygen supply valve
package and two recirculation isolation valves (one located on the
orbiter).

During engine start, the accumulator is charged with helium 2.4
seconds after the start command to provide pogo protection until the
engine heat exchanger is operational and gaseous oxygen is available.

The accumulator is partially chilled by liquid oxygen during the
engine chill-down operation.  It fills to the overflow standpipe line
inlet level, which is sufficient to preclude gas ingestion at engine
start.

During engine operation, the accumulator is charged with a continuous
gaseous oxygen flow maintained at a rate governed by the engine
operation point.

The liquid level in the accumulator is controlled by the overflow
standpipe line in the accumulator, which is orificed to regulate the
gaseous oxygen overflow over the engine's operating power level.  The
system is sized to provide sufficient replenishment of gaseous oxygen
at the minimum flow rate and to permit sufficient gaseous oxygen
overflow at the maximum decreasing pressure transient in the
low-pressure oxidizer turbopump discharge duct.  At all other
conditions, excess gaseous and liquid oxygen are recirculated to the
the low-pressure oxidizer turbopump inlet through the engine oxidizer
bleed duct.  The pogo accumulator is charged (pressurized) at engine
shutdown to provide a positive pressure at the HPOT inlet, which
prevents HPOT overspeed in the zero-gravity environment.


"6_2_3_13_3_8.TXT" (15151 bytes) was created on 12-12-88

SPACE SHUTTLE MAIN ENGINE CONTROLLERS.

The controller is an electronics package mounted on each SSME.  It
contains two digital computers and the associated electronics to
control all main engine components and operations.  The controller is
attached to the main combustion chamber by shock-mounted fittings.

Each controller operates in conjunction with engine sensors, valves,
actuators and spark igniters to provide a self-contained system for
engine control, checkout and monitoring.  The controller provides
engine flight readiness verification; engine start and shutdown
sequencing; closed-loop thrust and propellant mixture ratio control;
sensor excitation; valve actuator and spark igniter control signals;
engine performance limit monitoring; onboard engine checkout, response
to vehicle commands and transmission of engine status; and performance
and maintenance data.

Each engine controller receives engine commands transmitted by the
orbiter's general-purpose computers through its own engine interface
unit.  The engine controller provides its own commands to the main
engine components.  Engine data are sent to the engine controller,
where they are stored in a vehicle data table in the controller's
computer memory.  Data on the controller's status compiled by the
engine controller's computer are also added to the vehicle data table.
The vehicle data table is periodically output by the controller to the
EIU for transmission to the orbiter's GPCs.

The engine interface unit is a specialized multiplexer/demultiplexer
that interfaces with the GPCs and with the engine controller.  When
engine commands are received by the EIU, the data are held in a buffer
until the EIU receives a request for data from the GPCs.  The EIU then
sends data to each GPC.  Each EIU is dedicated to one space shuttle
main engine and communicates only with the engine controller that
controls its SSME.  The EIUs have no interface with each other.

The controller provides responsive control of engine thrust and
propellant mixture ratio throughout the digital computer in the
controller, updating the instructions to the engine control elements
50 times per second (every 20 milliseconds).  Engine reliability is
enhanced by a dual-redundant system that allows normal operation after
the first failure and a fail-safe shutdown after a second failure.
High-reliability electronic parts are used throughout the controller.

The digital computer is programmable, allowing engine control
equations and constants to be modified by changing the stored program
(software).  The controller is packaged in a sealed, pressurized
chassis and is cooled by convection heat transfer through pin fins as
part of the main chassis.  The electronics are distributed on
functional modules with special thermal and vibration protection.

The controller is divided into five subsystems: input electronics,
output electronics, computer interface electronics, digital computer
and power supply electronics.  Each subsystem is duplicated to provide
dual-redundant capability.

The input electronics receive data from all engine sensors, condition
the signals and convert them to digital values for processing by the
digital computer.  Engine control sensors are dual-redundant, and
maintenance data sensors are non-redundant.

The output electronics convert computer digital control commands into
voltages suitable for powering the engine spark igniters, the off/on
valves and the engine propellant valve actuators.

The computer interface electronics control the flow of data within the
controller, data input to the computer and computer output commands to
the output electronics.  They also provide the controller interface
with the vehicle engine electronics interface unit for receiving
engine commands that are triple-redundant channels from the vehicle
and for transmitting engine status and data through dual-redundant
channels to the vehicle.  The computer interface electronics include
the watchdog timers that determine which channel of the dual-redundant
mechanization is in control.

The digital computer is an internally stored, general-purpose computer
that provides the computational capability necessary for all engine
control functions.  The memory has a program storage capacity of
16,384 data and instruction words (17-bit words; 16 bits for program
use, one bit for parity).

The power supply electronics convert the 115-volt, three-phase,
400-hertz vehicle ac power to the individual power supply voltage
levels required by the engine control system and monitor the level of
power supply channel operation to ensure it is within satisfactory
limits.

Each orbiter GPC, operating in a redundant set, issues engine commands
to the engine interface units for transmission to their corresponding
engine controllers.  Each orbiter GPC has SSME subsystem operating
program applications software residing in it.  Engine commands are
output over the engine's assigned flight-critical data bus (a total of
four GPCs outputting over four FC data buses).  Therefore, each EIU
will receive four commands.  The nominal ascent configuration has GPCs
1, 2, 3 and 4 outputting on FC data buses 5, 6, 7 and 8, respectively.
Each FC data bus is connected to one multiplexer interface adapter in
each EIU.

The EIU checks the received engine commands for transmission errors.
If there are none, the EIU passes the validated engine commands on to
the controller interface assemblies, which output the validated engine
commands to the engine controller.  An engine command that does not
pass validation is not sent to the controller interface assembly.
Instead, it is dead-ended in the EIU's multiplexer interface adapter.
Commands that come through MIAs 1 and 2 are sent to CIAs 1 and 2,
respectively.  Commands that come to MIAs 3 and 4 pass through a CIA 3
data-select logic.  This logic outputs the command that arrives at the
logic first, from either MIA 3 or 4.  The other command is dead-ended
in the CIA 3 select logic.  The selected command is output through CIA
3.  In this manner, the EIU reduces the four commands sent to the EIU
to three commands output by the EIU.

The engine controller vehicle interface electronics receive the three
engine commands output by its EIU, check for transmission errors
(hardware validation), and send controller hardware-validated engine
commands to the controller A and B electronics.  Normally, channel A
electronics are in control, with channel B electronics active, but not
in control.  If channel A fails, channel B will assume control.  If
channel B subsequently fails, the engine controller will shut down the
engine pneumatically.  If two or three commands pass voting, the
engine controller will issue its own commands to accomplish the
function commanded by the orbiter GPCs.  If command voting fails and
two or all three commands fail, the engine controller will maintain
the last command that passed voting.

The backup flight system computer, GPC 5, contains SSME hardware
interface program applications software.  When the four primary GPCs
(1, 2, 3 and 4) are in control, the BFS GPC does no commanding.  When
GPC 5 is in control, the BFS sends commands to, and requests data
from, the EIU; and in this configuration, the four primary GPCs
neither command nor listen.  The BFS, when engaged, allows GPC 5 to
command FC buses 5, 6, 7 and 8 for main engine control through the
SSME HIP.  The SSME HIP performs the same main engine command
functions as the SSME subsystem operating program.  The command flow
through the EIUs and engine controllers is the same when the BFS is
engaged as for the four-GPC redundant set.

The engine controller provides all the main engine data to the GPCs.
Sensors in the engine supply pressures, temperatures, flow rates,
turbopump speeds, valve position and engine servovalve actuator
positions to the engine controller.  The engine controller assembles
these data into a vehicle data table and adds status data of its own
to the vehicle data table.  The vehicle data tables output channels A
and B to the vehicle interface electronics for transmission to the
EIUs.  The vehicle interface electronics output over both data paths.
The data paths are called primary and secondary.  The channel A
vehicle data table is normally sent over both primary and secondary
control (channel A has failed); then the vehicle interface electronics
output the channel B vehicle data table over both the primary and
secondary data paths.

The vehicle data table is sent by the controller to the EIU.  There
are only two data paths versus three command paths between the engine
controller and the EIU.  The data path that interfaces with CIA 1 is
called primary data.  The path that interfaces with CIA 2 is called
secondary data.  Primary and secondary data are held in buffers until
the GPCs send a data request command to the EIUs.  The GPCs request
both primary and secondary data.  Primary data is output only through
MIA 1 on each EIU.  Secondary data is output only through MIA 4 on
each EIU.

During prelaunch, the orbiter's computers look at both primary and
secondary data.  Loss of either primary or secondary data will result
in data path failure and either an engine ignition inhibit or a launch
pad shutdown of all three main engines.

At T minus zero, the orbiter GPCs request both primary and secondary
data from each EIU.  For no failures, only primary data are looked at.
If there is a loss of primary data (which can occur between the engine
controller channel A electronics and the SSME SOP), the secondary data
are looked at.

There are two primary written engine controller computer software
programs: the flight operational program and the test operational
program.  The flight operational program is an on-line, real-time,
process-control program that processes inputs from engine sensors;
controls the operation of the engine servovalves, actuators, solenoids
and spark igniters; accepts and processes vehicle commands; provides
and transmits data to the vehicle; and provides checkout and
monitoring capabilities.  The test operational program supports engine
testing.  Functionally, it is similar to the flight operational
program but differs with respect to implementation.  The computer
software programs are modular and are defined as computer program
components, which consist of a data base organized into tables and 15
computer program components.  During application of the computer
program components, the programs perform data processing for failure
detection and status to the vehicle.  As system operation progresses
through an operating phase, different combinations of control
functions are operative at different times.  These combinations within
a phase are defined as operating modes.

The checkout phase initiates active control monitoring or checkout.
The standby mode in this phase is a waiting mode of controller
operation while active control sequence operations are in process.
Monitoring functions that do not affect engine hardware status are
continually active during the mode.  Such functions include processing
of vehicle commands, status update and controller self-test.  During
checkout, data and instructions can be loaded into the engine
controller's computer memory.  This permits updating of the software
program and data as necessary to proceed with engine-firing operations
or checkout operations.  Also in this phase, component checkout,
consisting of checkout or engine leak tests, is performed on an
individual engine system component.

The start preparation phase consists of system purges and propellant
conditioning, which are performed in preparation for engine start.
The purge sequence 1 mode is the first purge sequence, including
oxidizer system and intermediate seal purge operation.  The purge
sequence 2 mode is the second purge sequence, including fuel system
purge operation and the continuation of purges initiated during purge
sequence 1.  The purge sequence 3 mode includes propellant
recirculation (bleed valve operation).  The purge sequence 4 mode
includes fuel system purge and the indication engine is ready to enter
the start phase.  The engine-ready mode occurs when proper engine
thermal conditions for start have been attained and other criteria for
start have been satisfied, including a continuation of the purge
sequence 4 mode.

The start phase covers operations involved with starting or firing the
engines, beginning with scheduled open-loop operation of propellant
valves.  The start initiation mode includes all functions before
ignition confirmed and the closing of the thrust control loop.  The
thrust buildup mode detects ignition by monitoring main combustion
chamber pressure and verifying that closed-loop thrust buildup
sequencing is in progress.

The main stage phase is automatically entered upon successful
completion of the start phase.  The normal control mode has initiated
mixture ratio control, and thrust control is operating normally.  In
case of a malfunction, the electrical lock mode will be activated.  In
that mode, engine propellant valves are electrically held in a fixed
configuration, and all control loop communications are suspended.
There is also the hydraulic lockup mode, in which all fail-safe valves
are deactivated to hydraulically hold the propellant valves in a fixed
configuration and all control loop functions are suspended.

The shutdown phase covers operations to reduce main combustion chamber
pressure and drive all valves closed to effect full engine shutdown.
Throttling to minimum power level is the portion of the shutdown in
progress at a programmed shutdown thrust reference level above the
MPL.  The valve schedule throttling mode is the stage in the shutdown
sequence at which the programmed thrust reference has decreased below
the MPL.  Propellant valves closed is the stage in the shutdown
sequence after all liquid propellant valves have been closed, the
shutdown purge has been activated, and verification sequences are in
progress.  The fail-safe pneumatic mode is when the fail-safe
pneumatic shutdown is used.

The post-shutdown phase represents the state of the SSME and engine
controller at the completion of engine firing.  The standby mode is a
waiting mode of controller operations whose functions are identical to
those of standby during checkout.  It is the normal mode that is
entered after completion of the shutdown phase.  The terminate
sequence mode terminates a purge sequence by a command from the
vehicle.  All propellant valves are closed, and all solenoid and
torque motor valves are de-energized.

Each controller utilizes ac power provided by the MPS engine power
left, ctr, right switches on panel R2.

Each controller has internal electrical heaters that provide
environmental temperature control and are powered by main bus power
through a remote power controller.  The RPC is controlled by the main
propulsion system engine cntrl htr left, ctr, right switches on panel
R4.  The heaters are not normally used until after main engine cutoff
and are only turned on if environmental control is required during the
mission.


"6_2_3_13_3_8.TXT" (15151 bytes) was created on 12-12-88

SPACE SHUTTLE MAIN ENGINE CONTROLLERS.

The controller is an electronics package mounted on each SSME.  It
contains two digital computers and the associated electronics to
control all main engine components and operations.  The controller is
attached to the main combustion chamber by shock-mounted fittings.

Each controller operates in conjunction with engine sensors, valves,
actuators and spark igniters to provide a self-contained system for
engine control, checkout and monitoring.  The controller provides
engine flight readiness verification; engine start and shutdown
sequencing; closed-loop thrust and propellant mixture ratio control;
sensor excitation; valve actuator and spark igniter control signals;
engine performance limit monitoring; onboard engine checkout, response
to vehicle commands and transmission of engine status; and performance
and maintenance data.

Each engine controller receives engine commands transmitted by the
orbiter's general-purpose computers through its own engine interface
unit.  The engine controller provides its own commands to the main
engine components.  Engine data are sent to the engine controller,
where they are stored in a vehicle data table in the controller's
computer memory.  Data on the controller's status compiled by the
engine controller's computer are also added to the vehicle data table.
The vehicle data table is periodically output by the controller to the
EIU for transmission to the orbiter's GPCs.

The engine interface unit is a specialized multiplexer/demultiplexer
that interfaces with the GPCs and with the engine controller.  When
engine commands are received by the EIU, the data are held in a buffer
until the EIU receives a request for data from the GPCs.  The EIU then
sends data to each GPC.  Each EIU is dedicated to one space shuttle
main engine and communicates only with the engine controller that
controls its SSME.  The EIUs have no interface with each other.

The controller provides responsive control of engine thrust and
propellant mixture ratio throughout the digital computer in the
controller, updating the instructions to the engine control elements
50 times per second (every 20 milliseconds).  Engine reliability is
enhanced by a dual-redundant system that allows normal operation after
the first failure and a fail-safe shutdown after a second failure.
High-reliability electronic parts are used throughout the controller.

The digital computer is programmable, allowing engine control
equations and constants to be modified by changing the stored program
(software).  The controller is packaged in a sealed, pressurized
chassis and is cooled by convection heat transfer through pin fins as
part of the main chassis.  The electronics are distributed on
functional modules with special thermal and vibration protection.

The controller is divided into five subsystems: input electronics,
output electronics, computer interface electronics, digital computer
and power supply electronics.  Each subsystem is duplicated to provide
dual-redundant capability.

The input electronics receive data from all engine sensors, condition
the signals and convert them to digital values for processing by the
digital computer.  Engine control sensors are dual-redundant, and
maintenance data sensors are non-redundant.

The output electronics convert computer digital control commands into
voltages suitable for powering the engine spark igniters, the off/on
valves and the engine propellant valve actuators.

The computer interface electronics control the flow of data within the
controller, data input to the computer and computer output commands to
the output electronics.  They also provide the controller interface
with the vehicle engine electronics interface unit for receiving
engine commands that are triple-redundant channels from the vehicle
and for transmitting engine status and data through dual-redundant
channels to the vehicle.  The computer interface electronics include
the watchdog timers that determine which channel of the dual-redundant
mechanization is in control.

The digital computer is an internally stored, general-purpose computer
that provides the computational capability necessary for all engine
control functions.  The memory has a program storage capacity of
16,384 data and instruction words (17-bit words; 16 bits for program
use, one bit for parity).

The power supply electronics convert the 115-volt, three-phase,
400-hertz vehicle ac power to the individual power supply voltage
levels required by the engine control system and monitor the level of
power supply channel operation to ensure it is within satisfactory
limits.

Each orbiter GPC, operating in a redundant set, issues engine commands
to the engine interface units for transmission to their corresponding
engine controllers.  Each orbiter GPC has SSME subsystem operating
program applications software residing in it.  Engine commands are
output over the engine's assigned flight-critical data bus (a total of
four GPCs outputting over four FC data buses).  Therefore, each EIU
will receive four commands.  The nominal ascent configuration has GPCs
1, 2, 3 and 4 outputting on FC data buses 5, 6, 7 and 8, respectively.
Each FC data bus is connected to one multiplexer interface adapter in
each EIU.

The EIU checks the received engine commands for transmission errors.
If there are none, the EIU passes the validated engine commands on to
the controller interface assemblies, which output the validated engine
commands to the engine controller.  An engine command that does not
pass validation is not sent to the controller interface assembly.
Instead, it is dead-ended in the EIU's multiplexer interface adapter.
Commands that come through MIAs 1 and 2 are sent to CIAs 1 and 2,
respectively.  Commands that come to MIAs 3 and 4 pass through a CIA 3
data-select logic.  This logic outputs the command that arrives at the
logic first, from either MIA 3 or 4.  The other command is dead-ended
in the CIA 3 select logic.  The selected command is output through CIA
3.  In this manner, the EIU reduces the four commands sent to the EIU
to three commands output by the EIU.

The engine controller vehicle interface electronics receive the three
engine commands output by its EIU, check for transmission errors
(hardware validation), and send controller hardware-validated engine
commands to the controller A and B electronics.  Normally, channel A
electronics are in control, with channel B electronics active, but not
in control.  If channel A fails, channel B will assume control.  If
channel B subsequently fails, the engine controller will shut down the
engine pneumatically.  If two or three commands pass voting, the
engine controller will issue its own commands to accomplish the
function commanded by the orbiter GPCs.  If command voting fails and
two or all three commands fail, the engine controller will maintain
the last command that passed voting.

The backup flight system computer, GPC 5, contains SSME hardware
interface program applications software.  When the four primary GPCs
(1, 2, 3 and 4) are in control, the BFS GPC does no commanding.  When
GPC 5 is in control, the BFS sends commands to, and requests data
from, the EIU; and in this configuration, the four primary GPCs
neither command nor listen.  The BFS, when engaged, allows GPC 5 to
command FC buses 5, 6, 7 and 8 for main engine control through the
SSME HIP.  The SSME HIP performs the same main engine command
functions as the SSME subsystem operating program.  The command flow
through the EIUs and engine controllers is the same when the BFS is
engaged as for the four-GPC redundant set.

The engine controller provides all the main engine data to the GPCs.
Sensors in the engine supply pressures, temperatures, flow rates,
turbopump speeds, valve position and engine servovalve actuator
positions to the engine controller.  The engine controller assembles
these data into a vehicle data table and adds status data of its own
to the vehicle data table.  The vehicle data tables output channels A
and B to the vehicle interface electronics for transmission to the
EIUs.  The vehicle interface electronics output over both data paths.
The data paths are called primary and secondary.  The channel A
vehicle data table is normally sent over both primary and secondary
control (channel A has failed); then the vehicle interface electronics
output the channel B vehicle data table over both the primary and
secondary data paths.

The vehicle data table is sent by the controller to the EIU.  There
are only two data paths versus three command paths between the engine
controller and the EIU.  The data path that interfaces with CIA 1 is
called primary data.  The path that interfaces with CIA 2 is called
secondary data.  Primary and secondary data are held in buffers until
the GPCs send a data request command to the EIUs.  The GPCs request
both primary and secondary data.  Primary data is output only through
MIA 1 on each EIU.  Secondary data is output only through MIA 4 on
each EIU.

During prelaunch, the orbiter's computers look at both primary and
secondary data.  Loss of either primary or secondary data will result
in data path failure and either an engine ignition inhibit or a launch
pad shutdown of all three main engines.

At T minus zero, the orbiter GPCs request both primary and secondary
data from each EIU.  For no failures, only primary data are looked at.
If there is a loss of primary data (which can occur between the engine
controller channel A electronics and the SSME SOP), the secondary data
are looked at.

There are two primary written engine controller computer software
programs: the flight operational program and the test operational
program.  The flight operational program is an on-line, real-time,
process-control program that processes inputs from engine sensors;
controls the operation of the engine servovalves, actuators, solenoids
and spark igniters; accepts and processes vehicle commands; provides
and transmits data to the vehicle; and provides checkout and
monitoring capabilities.  The test operational program supports engine
testing.  Functionally, it is similar to the flight operational
program but differs with respect to implementation.  The computer
software programs are modular and are defined as computer program
components, which consist of a data base organized into tables and 15
computer program components.  During application of the computer
program components, the programs perform data processing for failure
detection and status to the vehicle.  As system operation progresses
through an operating phase, different combinations of control
functions are operative at different times.  These combinations within
a phase are defined as operating modes.

The checkout phase initiates active control monitoring or checkout.
The standby mode in this phase is a waiting mode of controller
operation while active control sequence operations are in process.
Monitoring functions that do not affect engine hardware status are
continually active during the mode.  Such functions include processing
of vehicle commands, status update and controller self-test.  During
checkout, data and instructions can be loaded into the engine
controller's computer memory.  This permits updating of the software
program and data as necessary to proceed with engine-firing operations
or checkout operations.  Also in this phase, component checkout,
consisting of checkout or engine leak tests, is performed on an
individual engine system component.

The start preparation phase consists of system purges and propellant
conditioning, which are performed in preparation for engine start.
The purge sequence 1 mode is the first purge sequence, including
oxidizer system and intermediate seal purge operation.  The purge
sequence 2 mode is the second purge sequence, including fuel system
purge operation and the continuation of purges initiated during purge
sequence 1.  The purge sequence 3 mode includes propellant
recirculation (bleed valve operation).  The purge sequence 4 mode
includes fuel system purge and the indication engine is ready to enter
the start phase.  The engine-ready mode occurs when proper engine
thermal conditions for start have been attained and other criteria for
start have been satisfied, including a continuation of the purge
sequence 4 mode.

The start phase covers operations involved with starting or firing the
engines, beginning with scheduled open-loop operation of propellant
valves.  The start initiation mode includes all functions before
ignition confirmed and the closing of the thrust control loop.  The
thrust buildup mode detects ignition by monitoring main combustion
chamber pressure and verifying that closed-loop thrust buildup
sequencing is in progress.

The main stage phase is automatically entered upon successful
completion of the start phase.  The normal control mode has initiated
mixture ratio control, and thrust control is operating normally.  In
case of a malfunction, the electrical lock mode will be activated.  In
that mode, engine propellant valves are electrically held in a fixed
configuration, and all control loop communications are suspended.
There is also the hydraulic lockup mode, in which all fail-safe valves
are deactivated to hydraulically hold the propellant valves in a fixed
configuration and all control loop functions are suspended.

The shutdown phase covers operations to reduce main combustion chamber
pressure and drive all valves closed to effect full engine shutdown.
Throttling to minimum power level is the portion of the shutdown in
progress at a programmed shutdown thrust reference level above the
MPL.  The valve schedule throttling mode is the stage in the shutdown
sequence at which the programmed thrust reference has decreased below
the MPL.  Propellant valves closed is the stage in the shutdown
sequence after all liquid propellant valves have been closed, the
shutdown purge has been activated, and verification sequences are in
progress.  The fail-safe pneumatic mode is when the fail-safe
pneumatic shutdown is used.

The post-shutdown phase represents the state of the SSME and engine
controller at the completion of engine firing.  The standby mode is a
waiting mode of controller operations whose functions are identical to
those of standby during checkout.  It is the normal mode that is
entered after completion of the shutdown phase.  The terminate
sequence mode terminates a purge sequence by a command from the
vehicle.  All propellant valves are closed, and all solenoid and
torque motor valves are de-energized.

Each controller utilizes ac power provided by the MPS engine power
left, ctr, right switches on panel R2.

Each controller has internal electrical heaters that provide
environmental temperature control and are powered by main bus power
through a remote power controller.  The RPC is controlled by the main
propulsion system engine cntrl htr left, ctr, right switches on panel
R4.  The heaters are not normally used until after main engine cutoff
and are only turned on if environmental control is required during the
mission.


"6_2_3_13_3_9.TXT" (6384 bytes) was created on 12-12-88

MALFUNCTION DETECTION.

There are three separate means of detecting malfunctions within the
main propulsion system: the engine controllers, the caution and
warning system and the GPCs.

The engine controller, through its network of sensors, has access to
numerous engine operating parameters.  A group of these parameters has
been designated critical operating parameters, and special limits
defined for these parameters are hard-wired and limit sensed within
the caution and warning system.  If a violation of any limit is
detected, the caution and warning system will illuminate the red MPS
caution and warning light on panel F7.  The light will be illuminated
by an MPS engine liquid oxygen manifold pressure above 249 psia; an
MPS engine liquid hydrogen manifold pressure below 28 psia or above 60
psia; an MPS center, left or right helium pressure below 1,150 psia;
an MPS center, left or right helium regulated pressure above 820 psia;
or an MPS left, center or right helium delta pressure/delta time above
29 psia.  Note that the flight crew can monitor the MPS press helium
pneu, l, c, r meter on panel F7 when the switch is placed in the tank
or reg position.  The MPS press eng manf LO 2 , LH2 meter can also be
monitored on panel F7.  A number of the conditions will require crew
action.  For example, an MPS engine liquid hydrogen manifold pressure
below the minimum setting will require the flight crew to pressurize
the external liquid hydrogen tank by setting the LH2 ullage press
switch on panel R2 to open , and a low helium pressure may require the
flight crew to interconnect the pneumatic helium tank and the engine
helium tanks using the MPS He interconnect valve switches on panel R2
for the engine helium system that is affected.

The engine controller also has a self-test feature that allows it to
detect certain malfunctions involving its own sensors and control
devices.  For each of the three engines, a yellow main engine status
left, ctr, right light (lower half) on panel F7 will be illuminated
when the corresponding engine helium pressure is below 1,150 psia or
regulated helium pressure is above 820 psia.

The lower half of the main engine status left, ctr, right light on
panel F7 may also be illuminated by the SSME SOP (GPC- detected
malfunctions).  The yellow light may be illuminated due to an
electronic hold, hydraulic lockup, loss of two or more command
channels or command reject between the GPC and the SSME controller, or
loss of both data channels from the SSME controller to the GPC of the
corresponding engine.  In an electronic hold for the affected SSME,
loss of data from both pairs of the four fuel flow rate sensors and
the four chamber pressure sensors will result in the propellant valve
actuators being maintained electronically in the positions existing at
the time the second sensor failed.  (To fail both sensors in a pair,
it is only necessary to fail one sensor.) In the case of either the
hydraulic lockup or an electronic hold, all engine-throttling
capability for the affected engine is lost; thus, subsequent
throttling commands to that engine will not change the thrust level.

The red upper half of the main engine status left, ctr, right light on
panel F7 will be illuminated if the corresponding engine's
high-pressure oxidizer turbine's discharge temperature is above 1,760
degrees R, the main combustion chamber's pressure is below 1,000 psia,
the high-pressure oxidizer turbopump's intermediate seal purge
pressure is below 170 or above 650 psia, or the high-pressure oxidizer
turbopump's secondary seal purge pressure is below 5 or above 85 psia.
Because of the rapidity with which it is possible to exceed these
limits, the engine controller has been programmed to sense the limits
and automatically cut off the engine if the limits are exceeded.
Although a shutdown as a result of violating operating limits is
normally automatic, the flight crew can, if necessary, inhibit an
automatic shutdown through the use of the main engine limit shut dn
switch on panel C3.  The switch has three positions: enable, auto and
inhibit.  The enable position allows only the first engine that
violates operating limits to be shut down automatically.  If either of
the two remaining engines subsequently violates operating limits, it
would be inhibited from automatically shutting down.  The inhibit
position inhibits all automatic shutdowns.  The main engine shutdown
left, ctr, right push buttons on panel C3 have spring-loaded covers
(guards).  When the guard is raised and the push button is depressed,
the corresponding engine shuts down immediately.

The backup caution and warning processing of the orbiter GPCs can
detect certain specified out-of-limit or fault conditions of the MPS.
The backup C/W alarm light on panel F7 is illuminated, a fault message
appears on all CRT displays, and an audio alarm sounds if the MPS
engine liquid oxygen manifold pressure is zero or above 29 psia; the
MPS engine liquid hydrogen manifold pressure is below 30 or above 46
psia; the MPS left, center or right helium pressure is below 1,150
psia; or the MPS regulated left, center or right helium pressure is
below 680 or above 820 psia.  This is identical to the parameter limit
sensed by the caution and warning system; thus, the MPS red light on
panel F7 will also be illuminated.

The SM alert indicator on panel F7 is illuminated, a fault message
appears on all CRT displays, and an audio alarm is sounded when MPS
malfunctions/conditions are detected by the SSME SOP or special
systems-monitoring processing.  The first four conditions are detected
by the SSME SOP and are identical to those that illuminate the yellow
lower light of the respective main engine status light on panel F7 due
to electronic hold, hydraulic lockup, loss of two or more command
channels or command reject between the GPC and the SSME controller, or
loss of both data channels from the SSME controller to the orbiter
GPC.  The last four conditions are special systems-monitoring
processing and illuminate the SM alert light on panel F7, sound an
audio alarm and provide a fault message on all CRTs because of an
external tank liquid hydrogen ullage pressure below 30 psia or above
46 psia or an external tank liquid oxygen ullage pressure of zero or
above 29 psia.  (Note that the main engine status lights on panel F7
will not be illuminated.)


"6_2_3_13_3_10.TXT" (5191 bytes) was created on 12-12-88

ORBITER HYDRAULIC SYSTEMS.

The three orbiter hydraulic systems supply hydraulic pressure to the
main propulsion system for providing thrust vector control and
actuating engine valves on each SSME.

The three hydraulic supply systems are distributed to the MPS TVC
valves.  These valves are controlled by hydraulics MPS/TVC 1, 2, 3
switches on panel R4.  A valve is opened by positioning its respective
switch to open.  The talkback indicator above each switch indicates op
or cl for open and close.

When the three MPS TVC hydraulic isolation valves are opened,
hydraulic pressure actuates the engine main fuel valve, the main
oxidizer valve, the fuel preburner oxidizer valve, the oxidizer
preburner oxidizer valve and the chamber coolant valve.  All
hydraulically actuated engine valves on an engine receive hydraulic
pressure from the same hydraulic system.  The left engine valves are
actuated by hydraulic system 2, the center engine valves are actuated
by hydraulic system 1, and the right engine valves are actuated by
hydraulic system 3.  Each engine valve actuator is controlled by
dual-redundant signals: channel A/engine servovalve 1 and channel
B/engine servovalve 2 from that engine controller electronics.  As a
backup, all of the hydraulically actuated engine valves on an engine
are supplied with helium pressure from the helium subsystem left,
center and right engine helium tank supply system.  In the event of a
hydraulic lockup in an engine, helium pressure is used to actuate the
engine's propellant valves to their fully closed position when the
engine is shut down.

Hydraulic lockup is a condition in which all of the propellant valves
on an engine are hydraulically locked in a fixed position.  This is a
built-in protective response of the MPS propellant valve
actuator/control circuit.  It takes effect any time low hydraulic
pressure or loss of control of one or more propellant valve actuators
renders closed-loop control of engine thrust or propellant mixture
ratio impossible.  Hydraulic lockup allows an engine to continue to
thrust in a safe manner under conditions that normally would require
that the engine be shut down; however, the affected engine will
continue to operate at approximately the throttle level in effect at
the time hydraulic lockup occurred.  Once an engine is in a hydraulic
lockup, any subsequent shutoff commands, whether nominal or premature,
will cause a pneumatic helium shutdown.  Hydraulic lockup does not
affect the capability of the engine controller to monitor critical
operating parameters or issue an automatic shutdown if an operating
limit is out of tolerance; however, the engine shutdown would be
accomplished pneumatically.

The three MPS thrust vector control valves must also be opened to
supply hydraulic pressure to the six main engine TVC actuators.  There
are two servoactuators per SSME: one for yaw and one for pitch.  Each
actuator is fastened to the orbiter thrust structure and to the
powerhead of one of the three SSMEs.  The two actuators per engine
provide attitude control and trajectory shaping by gimbaling the SSMEs
in conjunction with the solid rocket boosters during first-stage
ascent and without the SRBs during second-stage ascent.  Each SSME
servoactuator receives hydraulic pressure from two of the three
orbiter hydraulic systems; one system is the primary system and the
other is a standby system.  Each servoactuator has its own hydraulic
switching valve.  The switching valve receives hydraulic pressure from
two of the three orbiter hydraulic systems and provides a single
source to the actuator.  Normally, the primary hydraulic supply is
directed to the actuator; however, if the primary system were to fail
and lose hydraulic pressure, the switching valve would automatically
switch over to the standby system, and the actuator would continue to
function on the standby system.  The left engine's pitch actuator
utilizes hydraulic system 2 as the primary and hydraulic system 1 as
the standby.  The engine's yaw actuator utilizes hydraulic system 1 as
the primary and hydraulic system 2 as the standby.  The center
engine's pitch actuator utilizes hydraulic system 1 as the primary and
hydraulic system 3 as the standby, and the yaw actuator utilizes
hydraulic system 3 as the primary and hydraulic system 1 as the
standby.  The right engine's pitch actuator utilizes hydraulic system
3 as the primary and hydraulic system 2 as the standby.  Its yaw
actuator utilizes hydraulic system 2 as the primary and hydraulic
system 3 as the standby.

The hydraulic systems are distributed among the actuators and engine
valves to equalize the hydraulic work load among the three systems.

The hydraulic MPS/TVC isol vlv sys1, sys2, sys3 switches on panel R4
are positioned to close during on-orbit operations to protect against
hydraulic leaks downstream of the isolation valves.  In addition,
there is no requirement to gimbal the main engines from the stow
position.  During on-orbit operations when the MPS TVC valves are
closed, the hydraulic pressure supply and return lines within each MPS
TVC component are interconnected to enable hydraulic fluid to
circulate for thermal conditioning.


"6_2_3_13_3_11.TXT" (5092 bytes) was created on 12-12-88

THRUST VECTOR CONTROL.

The space shuttle ascent thrust vector control portion of the flight
control system directs the thrust of the three main engines and two
solid rocket boosters to control attitude and trajectory during
lift-off and first-stage ascent and the main engines alone during
second-stage ascent.

Ascent thrust vector control is provided by avionics hardware packages
that supply gimbal commands and fault detection for each hydraulic
gimbal actuator.  The MPS ATVC packages are located in the three aft
avionics bays in the orbiter aft fuselage and are cooled by cold
plates and the Freon-21 system.  The associated flight aft
multiplexers/demultiplexers are also located in the aft avionics bays.

The MPS TVC command flow starts in the general-purpose computers, in
which the flight control system generates the TVC position commands,
and terminates at the SSME servoactuators, where the actuators gimbal
the SSMEs in response to the commands.  All the MPS TVC position
commands generated by the flight control system are issued to the MPS
TVC command subsystem operating program, which processes and disburses
them to their corresponding flight aft MDMs.  The flight aft MDMs
separate these linear discrete commands and disburse them to ATVC
channels, which generate equivalent command analog voltages for each
command issued.  These voltages are, in turn, sent to the
servoactuators, commanding the SSME hydraulic actuators to extend or
retract, thus gimbaling the main engines to which they are fastened.

Six MPS TVC actuators respond to the command voltages issued by four
ATVC channels.  Each ATVC channel has six MPS drivers and four SRB
drivers.  Each actuator receives four identical command voltages from
four different MPS drivers, each located in different ATVC channels.

Each main engine servoactuator consists of four independent, two-stage
servovalves, which receive signals from the drivers.  Each servovalve
controls one power spool in each actuator, which positions an actuator
ram and the engine to control thrust direction.

The four servovalves in each actuator provide a force-summed majority
voting arrangement to position the power spool.  With four identical
commands to the four servovalves, the actuator's force-sum action
prevents a single erroneous command from affecting power ram motion.
If the erroneous command persists for more than a predetermined time,
differential pressure sensing activates an isolation driver, which
energizes an isolation valve that isolates the defective servovalve
and removes hydraulic pressure, permitting the remaining channels and
servovalves to control the actuator ram spool provided the FCS channel
1, 2, 3, 4 switch on panel C3 is in the auto position.  A second
failure would isolate the defective servovalve and remove hydraulic
pressure in the same manner as the first failure, leaving only two
channels remaining.

Failure monitors are provided for each channel on the CRT and backup
caution and warning light to indicate which channel has been bypassed
for the MPS and/or SRB.  If the FCS channel 1, 2, 3, or 4 switch on
panel C3 is positioned to off, that ATVC channel is isolated from its
servovalve on all MPS and SRB actuators.  The override position of the
FCS channel 1, 2, 3, 4 switch inhibits the isolation valve driver from
energizing the isolation valve for its respective channel and provides
the capability of resetting a failed or bypassed channel.

The ATVC 1, 2, 3, 4 power switch is located on panel O17.  The on
position enables the ATVC channel selected; off disables the channel.

Each actuator ram is equipped with transducers for position feedback
to the TVC system.

The SSME servoactuators change each main engine's thrust vector
direction as needed during the flight sequence.  The three pitch
actuators gimbal the engine up or down a maximum of 10 degrees 30
minutes from the installed null position.  The three yaw actuators
gimbal the engine left or right a maximum of 8 degrees 30 minutes from
the installed position.  The installed null position for the left and
right main engines is 10 degrees up from the X axis in a negative Z
direction and 3 degrees 30 minutes outboard from an engine centerline
parallel to the X axis.  The center engine's installed null position
is 16 degrees above the X axis for pitch and on the X axis for yaw.
When any engine is installed in the null position, the other engines
cannot collide with it.

The minimum gimbal rate is 10 degrees per second; the maximum rate is
20 degrees per second.

There are three actuator sizes for the main engines.  The piston area
of the one upper pitch actuator is 24.8 square inches, its stroke is
10.8 inches, it has a peak flow of 50 gallons per minute, and it
weighs 265 pounds.  The piston area of the two lower pitch actuators
is 20 square inches, their stroke is 10.8 inches, their peak flow is
45 gallons per minute, and they weigh 245 pounds.  All three yaw
actuators have a piston area of 20 square inches, a stroke of 8.8
inches and a peak flow of 45 gallons per minute and weigh 240 pounds.


"6_2_3_13_3_12.TXT" (38943 bytes) was created on 12-12-88

HELIUM, OXIDIZER AND FUEL FLOW SEQUENCE.

At T minus five hours 15 minutes, the fast-fill portion of the liquid
oxygen and liquid hydrogen loading sequence begins under the control
of the launch processing system.

At T minus five hours 50 minutes, the SSME liquid hydrogen chill-down
sequence is initiated by the LPS.  It opens the liquid hydrogen
recirculation valves and starts the liquid hydrogen recirculation
pumps.  As part of the chill-down sequence, the liquid hydrogen
prevalves are closed and remain closed until T minus 9.5 seconds.

At T minus three hours 45 seconds, the fast fill of the liquid
hydrogen tank to 98 percent is complete, and a slow topping off
process that stabilizes to 100 percent begins.  At T minus three hours
30 minutes, the liquid oxygen fast fill is complete.  At T minus three
hours 15 minutes, liquid hydrogen replenishment begins and liquid
oxygen replenishment begins at T minus three hours 10 minutes.

During prelaunch, the pneumatic helium supply provides pressure to
operate the liquid oxygen and hydrogen prevalves and outboard and
inboard fill and drain valves.  The three engine helium supply systems
are used to provide anti-icing purges.

When the flight crew enters the orbiter, all 10 helium supply tanks
are fully pressurized to approximately 4,400 psi.  The filling of the
helium tanks from 2,000 psi to their full pressure begins at T minus
three hours 20 minutes.  This process is gradual to prevent excessive
heat buildup in the supply tank.  Regulated helium pressure is between
715 to 775 psi.  The helium supply tank and regulated pressures are
monitored on the MPS press, pneu, l, c, r meters on panel F7.  The MPS
press tank, reg switch positions on panel F7 select the supply or
regulated pressures to be displayed on the meters.  Engine helium and
regulated pressures are also available on the CRT display.

When the flight crew enters the orbiter, the eight MPS He isolation A
and B switches; the MPS pneumatics l eng to xovr and He isol switches;
and the MPS He interconnect left, ctr, right switches on panel R2 are
in the GPC position.  With the switches in these positions, the eight
helium isolation valves are open, and the left engine crossover and
the six helium interconnect valves are closed.

At T minus 16 minutes, one of the first actions by the flight crew is
to place the six MPS He isolation A and B switches and the MPS
pneumatics He isol switch on panel R2 in the open position.  This will
not change the position of the helium isolation valves, but it
inhibits LPS control of valve position.

During prelaunch, liquid oxygen from ground support equipment is
loaded through the GSE liquid oxygen T-0 umbilical and passes through
the liquid oxygen outboard fill and drain valve, the liquid oxygen
inboard fill and drain valve and the orbiter liquid oxygen feed line
manifold.  The liquid oxygen exits the orbiter at the liquid oxygen
feed line umbilical disconnect and enters the liquid oxygen tank in
the external tank.  During loading, the liquid oxygen tank's vent and
relief valves are open to prevent pressure buildup in the tank due to
liquid oxygen loading; and the main propulsion system propellant
fill/drain LO 2 outbd and inbd switches on panel R4 are in the gnd
(ground) position, which allows the LPS to control the positions of
these valves as required.  When liquid oxygen loading is complete, the
LPS will first command the liquid oxygen inboard fill and drain valve
to close.  The liquid oxygen in the line between the inboard and
outboard fill and drain valves is then allowed to drain back into the
GSE, and the LPS commands the outboard fill and drain valve to close.

Also during prelaunch, liquid hydrogen supplied through the GSE liquid
hydrogen T-0 umbilical passes through the liquid hydrogen outboard
fill and drain valve, the liquid hydrogen inboard fill and drain valve
and the liquid hydrogen feed line manifold.  The liquid hydrogen then
exits the orbiter at the liquid hydrogen feed line umbilical
disconnect and enters the liquid hydrogen tank in the external tank.
During loading, the liquid hydrogen tank's vent valve is left open to
prevent pressure buildup in the tank due to boiloff.  The main
propulsion system propellant fill/drain LH 2 inbd and outbd switches
on panel R4 are in the gnd position, which allows the LPS to control
the position of these valves as required.

At T minus four minutes, the fuel system purge begins, followed at T
minus three minutes 25 seconds by the beginning of the engine gimbal
tests.  During the tests, each gimbal actuator is operated through a
canned profile of extensions and retractions.  If all actuators
function satisfactorily, the engines are gimbaled to predefined
positions at T minus two minutes 15 seconds.  The engines remain in
these positions until engine ignition.  In the predefined start
positions, the engines are gimbaled in an outward direction (away from
one another) so that the engine start transient will not cause the
engine bells to contact one another during the start sequence.

At T minus two minutes 55 seconds, the LPS closes the liquid oxygen
tank vent valve, and the tank is pressurized to 21 psi with
GSE-supplied helium.  The liquid oxygen tank's pressure can be
monitored on the MPS press eng manf LO 2 meter on panel F7 as well as
on the CRT.  The 21-psi pressure corresponds to a liquid oxygen engine
manifold pressure of 105 psia.

At T minus one minute 57 seconds, the LPS closes the liquid hydrogen
tank's vent valve, and the tank is pressurized to 44 psia with
GSE-supplied helium.  The pressure is monitored on the MPS press eng
manf LH 2 meter on panel F7 as well as on the CRT display.  A liquid
hydrogen tank pressure of 44 psia corresponds to a liquid hydrogen
engine manifold pressure of 44.96 psia.

At T minus 31 seconds, the onboard redundant set launch sequence is
enabled by the LPS.  From this point on, all sequencing is performed
by the orbiter GPCs in the redundant set, based on the onboard clock
time.  The GPCs still respond, however, to hold, resume count and
recycle commands from the LPS.

At T minus 16 seconds, the GPCs begin to issue arming commands for the
SRB ignition pyro initiator controllers, the hold-down release PICs
and the T-0 umbilical release PICs.

At T minus 9.5 seconds, the engine chill-down sequence is complete,
and the GPCs command the liquid hydrogen prevalves to open (the liquid
oxygen prevalves are open during loading to permit engine chill-down).
The main propulsion system LO2 and LH2 prevalve left, ctr, right
switches on panel R4 are in the GPC position.

At T minus 16 seconds, helium flows out of the nine helium supply
tanks through the helium isolation valves, regulators and check valves
and enters the engine at the inlet of the pneumatic control assembly.
The PCA is a manifold containing solenoid valves that control and
direct helium pressure under the control of the engine controller to
perform various essential functions.  The valves are energized by
discrete on/off commands from the output electronics of the engine
controller.  One essential function from T minus 6.6 seconds to main
engine cutoff plus six seconds is the purging of the high-pressure
oxidizer turbopump's intermediate seal cavity.  This cavity is between
two seals, one of which contains the hot, fuel-rich gas in the
oxidizer turbine.  The other seal contains the liquid oxygen in the
oxidizer turbopump.  Leakage through one or both of the seals and
mixing of the propellants could result in a catastrophic explosion.
Continuous overload purging of this area prevents the propellants from
mixing as they are dumped overboard through drain lines.  The PCA also
functions as an emergency backup for closing the engine propellant
valves with helium pressure.  In a normal engine shutdown, the engine
propellant valves are hydraulically actuated.

At T minus 6.6 seconds, the GPCs issue the engine start command, and
the main fuel valve in each engine opens.  Between the opening of the
main fuel valve and MECO, liquid hydrogen flows out of the external
tank/orbiter liquid hydrogen disconnect valves into the liquid
hydrogen feed line manifold.  From this manifold, liquid hydrogen is
distributed to the engines through the three engine liquid hydrogen
feed lines.  In each line, liquid hydrogen passes through the prevalve
and enters the main engine at the inlet to the low-pressure fuel
turbopump.  In the engine, the liquid hydrogen cools various engine
components and in the process is converted to gaseous hydrogen.  The
majority of this gaseous hydrogen is burned in the engine; the smaller
portion is directed back to the external tank to maintain liquid
hydrogen tank pressure.  The flow of gaseous hydrogen back to the
external tank begins at the turbine outlet of the LPFT.  Gaseous
hydrogen tapped from this line first passes through two check valves
and then splits into two paths, each containing a flow control
orifice.  One of these paths also contains a valve normally controlled
by one of three pressure transducers located in the liquid hydrogen
tank.

When the GPCs issue the engine start command, the main oxidizer valve
in each engine also opens.  Between the opening of the main engine
oxidizer valve and MECO, liquid oxygen flows out of the external tank
and through the external tank/orbiter liquid oxygen umbilical
disconnect valves into the liquid oxygen feed line manifold.  From
this manifold, liquid oxygen is distributed to the engines through the
three engine liquid oxygen feed lines.  In each line, liquid oxygen
passes through the prevalve and enters the main engine at the inlet to
the low-pressure oxidizer turbopump.  In the engine, a small portion
of the liquid oxygen is diverted into the oxidizer heat exchanger.  In
the heat exchanger, heat generated by the high-pressure oxidizer
turbopump is used to convert liquid oxygen into gaseous oxygen, which
is directed back to the external tank to maintain oxidizer tank
pressure.  The flow of gaseous oxygen back to the external tank begins
at the outlet of the heat exchanger.  From this point, gaseous oxygen
passes through a check valve and then splits into two paths, each
containing a flow control orifice.  One of these paths also contains a
valve that normally is controlled by one of three pressure transducers
located in the liquid oxygen tank.  Downstream of the two flow control
orifices and the pressure control valves, the gaseous oxygen lines
empty into the orbiter gaseous oxygen pressurization manifold.  This
single line exits the orbiter at the gaseous oxygen pressurization
disconnect and passes through the orbiter/external tank gaseous oxygen
umbilical into the top of the liquid oxygen tank.

At T minus 6.6 seconds, if the PIC voltages are within limits and all
three engine controllers are indicating engine ready, the GPCs issue
the engine start commands to the three main engines.  If the PIC
conditions are not met in four seconds, the engine start commands are
not issued, and the GPCs proceed to a countdown hold.

If all three SSMEs reach 90 percent of their rated thrust by T minus
three seconds, then at T minus zero the GPCs will issue the commands
to fire the SRB ignition PICs, the hold-down release PICs and the T-0
umbilical release PICs.  Lift-off occurs almost immediately because of
the extremely rapid thrust buildup of the SRBs.  The three seconds to
T minus zero allow the vehicle base bending loads to return to minimum
by T minus zero.

If one or more of the three main engines do not reach 90 percent of
their rated thrust at T minus three seconds, all SSMEs are shut down,
the SRBs are not ignited, and a pad abort condition exists.

Beginning at T minus zero, the SSME gimbal actuators, which were
locked in their special preignition positions, are first commanded to
their null positions for SRB start and then allowed to operate as
needed for thrust vector control.

Between lift-off and MECO, as long as the SSMEs perform nominally, all
MPS sequencing and control functions are executed automatically by the
GPCs.  During this period, the flight crew monitors MPS performance;
backs up automatic functions, if required; and provides manual inputs
in the event of MPS malfunctions.

During ascent, the liquid hydrogen tank's pressure is maintained
between 33 and 35 psig by the orifices in the two lines and the action
of the flow control valve.  There are three such systems, one for each
SSME.  When the pressure in the liquid hydrogen tank reaches 35 psig,
the valve closes.  It opens when the pressure drops below 33 psig.
Tank pressure greater than 38 psia will cause the tank to relieve
through the tank vent valve.  If tank pressure falls below 33 psia,
the flight crew positions the MPS LH 2 ullage press switch on panel R2
to open .  This allows the three flow control valves to go to the
full-open position.  Normally, the MPS LH 2 ullage press switch is in
the auto position.  Downstream of the two flow control orifices and
the flow control valves, the gaseous hydrogen line empties into the
gaseous hydrogen pressurization manifold.  This single line then exits
the orbiter at the gaseous hydrogen umbilical and enters the top of
the liquid hydrogen tank.  During ascent, the liquid oxygen tank's
pressure is maintained between 20 and 22 psig by the orifices in the
two lines and the action of the flow control valve.  When the pressure
in the tank reaches 22 psig, the valve closes.  It opens when pressure
drops below 20 psig.  A pressure greater than 25 psig will cause the
tank to relieve through its vent and relief valve.

The SSME thrust level depends on the flight: it may be 100 percent or
104 percent for some missions involving heavy payloads or may require
the maximum thrust setting of 109 percent for emergency situations.
The initial thrust level normally is maintained until approximately 31
seconds into the mission, when the GPCs throttle the engines to a
lower thrust to minimize structural loading while the orbiter is
passing through the region of maximum aerodynamic pressure.  This
normally occurs around 63 seconds, mission elapsed time.  At
approximately 65 seconds, the engines are once again throttled to the
appropriate higher percent and remain at that setting for a normal
mission until 3-g throttling is initiated.

The solid rocket boosters burn out at approximately two minutes,
mission elapsed time, and are separated from the orbiter by a GPC
command sent via the mission events controller and by the SRB
separation PICs.  The flight crew can initiate SRB separation manually
if the automatic sequence fails; however, the manual separation
sequence does not bypass the separation sequence logic circuitry.

Beginning at approximately seven minutes 40 seconds, mission elapsed
time, the engines are throttled back to maintain vehicle acceleration
at 3 g's or less.  Three g's is an operational limit devised to
prevent physical stresses on the flight crew.  Approximately eight
seconds before main engine cutoff, the engines are throttled back to
65 percent.

Although MECO is based on the attainment of a specified velocity, the
engines can also be shut down due to the depletion of liquid oxygen or
liquid hydrogen before the specified velocity of MECO is reached.
Liquid oxygen depletion is sensed by four sensors in the liquid oxygen
feed line manifold.  Liquid hydrogen depletion is sensed by four
sensors in the bottom of the liquid hydrogen tank.  If any two of the
four sensors in either system indicate a dry condition, the GPCs will
issue a MECO command to the engine controller.

Once MECO has been confirmed, the GPCs execute the external tank
separation sequence.  The sequence takes approximately 18 seconds and
includes arming the external tank separation PICs, closing the liquid
oxygen and liquid hydrogen prevalves, firing the external tank tumble
system pyrotechnic, closing the liquid hydrogen and liquid oxygen feed
line 17-inch disconnect valves, gimbaling the SSMEs to the MPS
propellant dump position (full down), turning the external tank signal
conditioners' power off (deadfacing), firing the umbilical unlatch
pyrotechnics, and retracting the umbilical plates hydraulically.

At this point, the computers check for external tank separation
inhibits.  If the vehicle's pitch, roll and yaw rates are not less
than 0.2 degree per second, automatic external tank separation is
inhibited.  If these conditions are met, the GPCs issue the commands
to the external tank separation pyrotechnics.  In crew-initiated
external tank separation or return-to-launch-site aborts, the inhibits
are overriden.

At separation, the orbiter begins a reaction control system minus Z
translation separation maneuver to move it away from the external
tank.  This maneuver takes approximately 13 seconds and results in a
negative Z-delta component of approximately 11 feet per second.

After MECO occurs (whether because the specified velocity is attained
or the liquid oxygen or liquid hydrogen is depleted) and before
external tank separation, the GPCs isolate the orbiter liquid hydrogen
feed line from the external tank by closing the two liquid hydrogen
17-inch disconnect valves (one on each side of the separation
interface) and the two liquid oxygen 17-inch disconnect valves (one on
each side of the separation interface).  At orbiter/external tank
separation, the gaseous oxygen and gaseous hydrogen feed lines are
sealed at the umbilicals by the self-sealing quick disconnects.

The MPS pneumatic control assembly on each main engine provides an
emergency backup method of closing the engine propellant valves
pneumatically using helium pressure.  The normal engine shutdown of
the engine propellant valves is by hydraulic actuation.

At MECO, the GPCs open the liquid oxygen feed line relief isolation
valve, allowing any pressure buildup generated by oxidizer trapped in
the orbiter liquid oxygen feed line manifold to be vented overboard
through the relief valve provided the main propulsion system feedline
rlf isol LH2 switch on panel R4 is in the GPC position.  The GPCs also
open the liquid hydrogen feed line relief isolation valve, and any
pressure buildup from fuel trapped in the orbiter liquid hydrogen feed
line manifold is vented overboard through the relief valve provided
the main propulsion system feedline rlf isol LH 2 switch on panel R4
is in the GPC position.

At MECO, the pneumatic control assembly for each engine performs a
16-second purge of the engine preburner oxidizer domes and a
two-second postcharge of the pogo accumulator.  This purge ensures
that no residual propellant remains in these areas to cause an unsafe
condition and prevents a water hammer effect in the liquid oxygen
manifolds of the main engines.  This helium usage and the purge of the
high-pressure oxidizer turbopump's intermediate seal cavity can be
observed on the MPS helium l, c, r meters on panel F7 and are also
available on the CRT.

Ten seconds after main engine cutoff, the RTLS liquid hydrogen dump
valves are opened for 30 seconds to ensure that the liquid hydrogen
manifold pressure does not result in operation of the liquid hydrogen
feed line relief valve.

After the completion of the 16-second purge, the GPCs interconnect the
pneumatic helium and engine helium supply system by opening the three
out interconnect valves provided the MPS He interconnect left, center,
right switches on panel R2 are in the GPC position.  This connects all
10 helium supply tanks to the common manifold and ensures sufficient
helium is available to perform the liquid oxygen and liquid hydrogen
propellant dumps, which are required after external tank separation.

After external tank separation, approximately 1,700 pounds of
propellant is still trapped in the SSMEs and an additional 3,700
pounds of propellant remains trapped in the orbiter's MPS feed lines.
This 5,400 pounds of propellant represents an overall
center-of-gravity shift for the orbiter of approximately 7 inches.
Non-nominal center-of-gravity locations can create major guidance
problems during re-entry.  The residual liquid oxygen, by far the
heavier of the two propellants, poses the greatest impact on
center-of-gravity travel.  The greatest hazard from the trapped liquid
hydrogen occurs during re-entry, when any liquid or gaseous hydrogen
remaining in the propellant lines may combine with atmospheric oxygen
to form a potentially explosive mixture.  In addition, if the trapped
propellants are not dumped overboard, they will sporadically outgas
through the orbiter liquid oxygen and liquid hydrogen feed line relief
valves, causing vehicle accelerations of such a low level that they
cannot be sensed by onboard guidance, yet represent a significant
source of navigation error when applied over an entire mission.
Outgassing propellants are also a potential source of contamination of
scientific experiments contained in the payload bay.

Approximately 18 seconds after MECO occurs, the external tank
separates from the orbiter.  Approximately 102 seconds later, at MECO
plus two minutes, the first thrusting period of the orbital
maneuvering system begins.  Coincident with the start of the OMS-1
thrusting, the GPCs automatically initiate the liquid oxygen dump
provided the MPS prplt dump sequence LO2 switch on panel R2 is in the
GPC position.  The computers command the two liquid oxygen manifold
repressurization valves to open (the main propulsion system manf press
LO 2 switch on panel R4 must be in the GPC position), command each
engine controller to open its SSME main oxidizer valve, and command
the three liquid oxygen prevalves to open (the main propulsion system
LO 2 prevalves left, ctr, right switch must be in the GPC position).
The liquid oxygen trapped in the feed line manifolds is expelled under
pressure from the helium subsystem through the nozzles of the SSMEs.
If the main propulsion system manf press LO2 switch on panel R4 is
left in the GPC position, the pressurized liquid oxygen dump continues
for 90 seconds.  At the end of this period, the GPCs automatically
terminate the dump by closing the two liquid oxygen manifold
repressurization valves, wait 30 seconds and then command the engine
controllers to close their SSME main oxidizer valve.  The three liquid
oxygen prevalves remain open.

If necessary, the crew can perform the liquid oxygen dump manually
utilizing the start and stop positions of the MPS prplt dump sequence
LO 2 switch on panel R2.  When the liquid oxygen dump is initiated
manually, all valve opening and closing sequences are still automatic.
Positioning the MPS prplt dump sequence LO 2 switch to start causes
the GPCs to immediately begin commanding all of the required valves to
open automatically and in the proper sequence.  The liquid oxygen dump
will continue as long as the switch is in the start position, but the
pressurized portion with the two liquid oxygen manifold
repressurization valves open is still limited to 90 seconds.  Placing
the switch in the stop position causes the GPCs to begin commanding
all of the required valves to close automatically and in the proper
sequence.  The earliest a manual liquid oxygen dump can be performed
is MECO plus 20 seconds since the SSMEs require a cool-down of at
least 20 seconds after MECO.

The GPC software's MPS dump sequence automatically initiates the
liquid oxygen dump at one time only-the beginning of the OMS-1
thrusting period.  If the MPS prplt dump sequence LO 2 switch on panel
R2 is not in the GPC position at that time, the liquid oxygen dump
must be initiated manually.  In addition, once the liquid oxygen dump
has been initiated and the MPS prplt dump sequence LO 2 switch is
placed in the stop position, the GPCs no longer monitor any of the
positions of this switch.  For this reason, the liquid oxygen dump
cannot be reinitiated, manually or automatically.

Simultaneously with the liquid oxygen dump, the GPCs automatically
initiate the MPS liquid hydrogen dump provided the MPS prplt dump
sequence LH2 switch on panel R2 is in the GPC position.  The GPCs
command each engine controller to command a 10-second helium purge of
its SSME's fuel lines downstream of the main engine fuel valves,
command the liquid hydrogen manifold repressurization valve to open
provided the main propulsion system manf press LH 2 switch on panel R4
is in the GPC position, and command the two liquid hydrogen fill and
drain valves (inboard and outboard) to open.

The liquid hydrogen trapped in the orbiter feed line manifold is
expelled overboard under pressure from the helium subsystem through
the liquid hydrogen fill and drain valves for six seconds.  Then the
inboard fill and drain valve is closed; the three liquid hydrogen
prevalves are opened; and liquid hydrogen flows through the engine
bleed valves into the orbiter MPS, through the topping valve, between
the inboard and outboard fill and drain valves, and overboard through
the outboard fill and drain valve for approximately 88 seconds.  The
GPCs automatically terminate the dump by closing the two liquid
hydrogen manifold repressurization valves and 30 seconds later closing
the liquid hydrogen topping and outboard fill and drain valves.

If necessary, the flight crew can perform the liquid hydrogen dump
manually utilizing the start and stop positions of the MPS prplt dump
sequence LH 2 switch on panel R2.  When the liquid hydrogen dump is
initiated manually, all valve opening and closing sequences are still
automatic.  Placing the MPS prplt dump sequence switch in the start
position causes the GPCs immediately to begin commanding all the
required valves to open automatically and in the proper sequence.  The
liquid hydrogen dump continues as long as the switch is in the start
position, but the pressurized portion of the dump with the two liquid
hydrogen manifold repressurization valves open is still limited to 88
seconds.  Placing the switch in the stop position causes the GPCs to
begin commanding all of the required valves to close automatically and
in the proper sequence.

At the end of the liquid oxygen and liquid hydrogen dumps, the GPCs
close the helium out interconnect valves and all of the supply tank
isolation valves provided the MPS He isolation left ctr, right A and
B; pneumatic He isol; and He interconnect left, ctr, right switches on
panel R2 are in the GPC position.  After the dumps are complete, the
space shuttle main engines are gimbaled to their entry positions with
the engine nozzles moved inward (toward one another) to reduce
aerodynamic heating.

Approximately 19 minutes into the mission and after the MPS liquid
oxygen and liquid hydrogen dumps, the flight crew initiates the
procedure for vacuum inerting the orbiter's liquid oxygen and liquid
hydrogen lines.  Vacuum inerting allows any traces of liquid oxygen or
liquid hydrogen remaining after the propellant dumps to be vented into
space.

The liquid oxygen vacuum inerting is accomplished by opening the
liquid oxygen inboard and the outboard fill and drain valves.  They
are opened by placing the main propulsion system propellant fill/drain
LO 2 outbd, inbd switch on panel R4 to the open position.

For liquid hydrogen vacuum inerting, the liquid hydrogen inboard and
outboard fill and drain valves are opened by placing the main
propulsion system propellant fill/drain LH 2 outbd, inbd switch on
panel R4 to open.  The external tank gaseous hydrogen pressurization
manifold also is vacuum inerted by opening the hydrogen pressurization
line vent valve by placing the main propulsion system H 2 line vent
switch on panel R4 to open.

Helium for actuating the valves is provided by the two pneumatic
helium isolation valves by placing the MPS pneumatic He isol switch on
panel R2 to open.  These isolation valves are closed by the GPCs at
the end of the MPS liquid hydrogen dump.  If additional helium is
required to open and close the fill and drain valves, it can be
obtained by opening the helium out interconnect valves by placing the
MPS He interconnect left, ctr, right switches on panel R2 in the in
close/out open position.  These valves also are closed by the GPCs at
the end of the MPS liquid hydrogen dump.

The liquid oxygen and liquid hydrogen lines are inerted
simultaneously.  Approximately 30 minutes is allowed for vacuum
inerting.  At the end of the 30 minutes, the flight crew closes the
liquid oxygen outboard fill and drain valve by placing the main
propulsion system propellant fill/drain LO2 switch on panel R4 to
close .  The inboard fill and drain valve is left open.  To conserve
electrical power after the completion of the liquid oxygen vacuum
inerting sequence, the main propulsion system propellant fill/drain LO
2 outbd, inbd switch on panel R4 is placed in the gnd position.  This
position removes power from the opening and closing solenoids of the
corresponding valves; and because they are pneumatically actuated, the
valves remain in their last commanded position.  At the end of the
same 30-minute period, the liquid hydrogen outboard fill and drain
valve and the hydrogen pressurization line vent valve are closed by
positioning the main propulsion system propellant fill/drain LH2 outbd
switch and the main propulsion system H 2 press line vent switch on
panel R4 to close .  The liquid hydrogen inboard fill and drain valve
is left open.  The main propulsion system propellant fill/drain LH 2
inbd, outbd and H 2 press line vent switches on panel R4 are
positioned to gnd to conserve power.  The hydrogen pressurization vent
line valve is electrically activated; however, it is normally closed
(spring loaded to the closed position), and removing power from the
valve solenoid leaves the valve closed.

After vacuum inerting, the helium isolation valves and interconnect
valves (if they were used) are closed by placing the MPS He isolation
pneumatics He isol switch on panel R2 to close and the He interconnect
left, ctr, right switches on panel R2 to GPC .  This ensures that the
helium supply tanks are isolated from any leakage in the downstream
lines during orbital operations.

The electrical power to each engine controller and engine interface
unit is turned off by positioning the MPS engine power left, ctr,
right switches on panel R2 to off ; and the engine controller heaters
are turned on by positioning the main propulsion system engine cntlr
htr, left, ctr, right switches on panel R4 to auto .

During the early portion of the entry time line, the propellant feed
line manifolds and the external tank pressurization lines are
repressurized with helium from the helium subsystem.  This prevents
atmospheric contamination from being drawn into the manifolds and feed
lines during entry.  Removing contamination from the manifolds or feed
lines can be a long and costly process since it involves disassembly
of the affected part.  Manifold repressurization is an automatic
sequence performed by the GPCs.

After the orbital maneuvering system engines have been fired for
deorbit and the orbiter begins to sense the presence of atmosphere,
the GPCs start another vacuum inerting sequence.  The liquid oxygen
and liquid hydrogen prevalves that were left open at the end of the
liquid oxygen and liquid hydrogen dump sequences remained open during
the entire mission.  Similarly, the liquid oxygen and liquid hydrogen
inboard fill and drain valves that were left open at the end of the
manual vacuum inerting sequence remained open during the entire
mission.  As re-entry begins, the left engine's helium isolation valve
B and the pneumatic helium isolation valves are opened providing the
MPS He isolation left B and the MPS pneumatic He isol switches on
panel R2 are in the GPC position; the left engine's pneumatic
crossover valve and in interconnect valve are opened; and the center
and right engines' out interconnect valves are opened providing the
MPS pneumatics l eng He xovr and MPS He interconnect left, ctr and
right switches on panel R2 are in the GPC position.  Also, the MPS
liquid hydrogen topping valve, outboard fill and drain valves, and
inboard and outboard RTLS drain valves are opened providing the
propellant fill/drain LO 2 and LH2 outbd and inbd switches are in the
gnd position.  As orbiter re-entry continues, its velocity decreases.
When the velocity drops below 20,000 feet per second, the liquid
oxygen outboard fill and drain valve opens.

This vacuum inerting continues until the orbiter's velocity drops
below 4,500 feet per second (between 110,000 and 130,000 feet altitude
depending on the re-entry trajectory).  Then the MPS liquid oxygen and
liquid hydrogen outboard fill and drain valves, the liquid hydrogen
inboard and outboard RTLS drain valves, and the liquid oxygen
prevalves are closed; the MPS liquid oxygen and liquid hydrogen
manifold repressurization valves and the MPS helium blowdown supply
valves are opened; and a 650-second timer is started.  This provides a
positive pressure in the liquid oxygen and liquid hydrogen manifolds
and in the aft fuselage and the OMS/RCS pods and prevents
contamination.  The 650-second timer runs out approximately one minute
after touchdown.  After the timer expires, the purge of the aft
fuselage and OMS/RCS pods is terminated when the MPS helium supply
blowdown valves are closed.  The manifold repressurization continues
until the ground crews install the throat plugs in the main engine
nozzles.

If MECO is preceded by an RTLS abort, the subsequent MPS liquid oxygen
dump will begin 10 seconds after the external tank separation command
is issued, and the liquid hydrogen dump will begin simultaneously.
The liquid oxygen and liquid hydrogen dumps are initiated and
terminated automatically by the GPCs regardless of the positions of
the MPS prplt dump sequence LO2 and LH2 switches on panel R2.

During an RTLS abort, liquid oxygen initially is dumped through the
SSMEs and 30 seconds later via the liquid oxygen fill and drain
valves.  This dump is performed without helium pressurization and
relies on the self-boiling of the trapped liquid.

In the RTLS liquid oxygen dump, the GPCs terminate the dump whenever
the orbiter's velocity drops below 3,800 feet per second.  The liquid
oxygen is dumped through the nozzles of the main engines; however,
each engine is gimbaled to the entry position rather than the normal
dump position.  The liquid oxygen feed line manifold is not
pressurized in this mode, and the two liquid oxygen manifold
repressurization valves remain closed throughout the entire dump.  The
liquid oxygen system is repres surized when the 3,800-feet-per-second
velocity is attained, and repressurization continues as in a nominal
entry.  The main propulsion system prevalves LO2, left, ctr, right
switches on panel R4 are in the GPC position, and the GPCs command the
engine controllers to open each engine main oxidizer valve for the
dump.

In the RTLS mode, the liquid hydrogen dump is initiated and terminated
automatically by the GPCs simultaneously with the liquid oxygen dump
regardless of the position of the MPS prplt dump sequence LH 2 switch
on panel R2.  The two RTLS dump valves and the two RTLS manifold
repressurization valves are opened, and the liquid hydrogen trapped in
the feed line manifold is expelled under pressure from the helium
subsystem for 80 seconds through a special opening on the port side of
the orbiter between the wing and the OMS/RCS pod.  After 80 seconds,
the liquid hydrogen fill and drain valves are opened, resulting in
vacuum inerting of residual liquid hydrogen through bulk boiling.  The
GPCs terminate the liquid hydrogen dump and vacuum inerting
automatically when the orbiter reaches the 3,800-feet-per-second
velocity.  At that time, the inboard and outboard RTLS dump valves,
the inboard and outboard fill and drain valves, and the two RTLS
manifold repressurization valves are closed.  The liquid hydrogen
system is repressurized after an RTLS liquid hydrogen dump, and
repressurization continues as in a nominal entry.

CONTRACTORS.  The Rocketdyne Division of Rockwell International,
Canoga Park, Calif., is the prime contractor for the space shuttle
main engines.  Other contractors include Aeroflex Laboratories,
Plainview, N.Y.  (MPS vibration mounts); Airite Division, Sargent
Industries, El Segundo, Calif.  (MPS surge pressure receiver); Ametek
Calmec, Pico Rivera, Calif.  (1.5-inch and 2-inch liquid oxygen and
liquid hydrogen shutoff valve, 4-inch liquid hydrogen disconnect and
2-inch gaseous hydrogen/gaseous oxygen disconnect); Ametek Straza, El
Cajon, Calif.  (8-inch liquid hydrogen/liquid oxygen fill and drain,
2- and 4-inch liquid hydrogen recirculation lines, high-point bleed
line manifold and gimbal joint); Arrowhead Products, division of
Federal Mogul, Los Alamitos, Calif.  (12- to 17-inch-diameter liquid
oxygen and liquid hydrogen feed lines and flexible purge gas
connector); Astech, Santa Ana, Calif.  (MPS heat shield); Brunswick,
Lincoln, Neb.  (17.3- and 4.7-cubic-foot capacity helium tanks);
Brunswick-Circle Seal, Anaheim, Calif.  (helium check valves, gaseous
oxygen and gaseous hydrogen 1-inch helium pressurization line,
0.375-inch liquid hydrogen relief valve and engine isolation check
valves); Brunswick-Wintec, El Segundo, Calif.  (helium filter); Coast
Metal Craft, Compton, Calif.  (metal flex hose); Conrac Corp., West
Caldwell, N.J.  (engine interface unit); Consolidated Controls, El
Segundo, Calif.  (oxygen pressure primary flow control valve and
hydraulic valve, hydrogen/oxygen pressurant flow control valves,
20-psi helium regulator, 850-psi helium relief valve and 750-psi
helium regulator); Fairchild Stratos, Manhattan Beach, Calif.
(12-inch prevalves, 1.5-inch liquid oxygen disconnect, 8-inch liquid
oxygen and liquid hydrogen fill and drain valves, and gaseous nitrogen
and gaseous hydrogen disconnects); Gulton Industries, Costa Mesa,
Calif.  (pogo pressure transducer); K-West, Westminister, Calif.
(liquid oxygen and liquid hydrogen external tank ullage pressure
signal conditioner, MPS differential pressure transducer and
electronics propellant head pressure); Megatek, Van Nuys, Calif.  (MPS
line flange cryo seals); Moog Inc., East Aurora, N.Y.  (main engine
gimbal actuators); Parker Hannifin Corp., Irvine, Calif.  (1-inch
relief isolation valves, pogo check valves, 17-inch liquid hydrogen
and liquid oxygen disconnects, 8-inch liquid oxygen and liquid
hydrogen disconnects, and liquid oxygen and liquid hydrogen relief
valves); Simmonds Precision Instruments, Vergennes, Vt.  (liquid
oxygen and liquid hydrogen point sensors and electronics); Sterer
Engineering, Los Angeles, Calif.  (main engine hydraulic solenoid
shutoff valve); Whittaker Corp., North Hollywood, Calif.
(750-/250-psi helium regulator); Wright Components Inc.  Clifton
Springs, N.J.  (two-way pneumatic solenoid valve, three-way helium
solenoid valve and hydraulic latching solenoid valve).