Presently each side (string) of the CDS is divided into two equal parts: a primary and an extended memory -- its quad redundant in memory. The new FSW will first be loaded into the extended memory on one side while the primary memories on both sides operate the spacecraft dual-string in a quiescent mode. Then the loading side will switch operation to the new FSW in the extended memory and then copy its extended memory (the new FSW) into its primary memory. The second side will be loaded the same way such that the dual-string redundancy is maintained throughout the loading process. The primary purpose of the new CDS FSW is to store the highest priority Atmospheric Entry Probe data in the CDS extended memories. Originally, storing the Probe data on the tape recorder was the backup to the real-time transmission of that data to earth over the Orbiter HGA. Now, without the HGA, the tape recorder is the prime route and CDS extended memory storage is the backup. The tape recorder can be connected to only one string of the CDS at a time-- the new FSW adds a feature that will autonomously switch the recorder to the other string if the string to which it is connected goes down.
In August 1994, tests were performed that verified that every memory cell that has not been in regular use (a bit more than half the memory) is functional, thus providing high confidence that the entire CDS memory is fully functional. While now unlikely, there is an option to do additional memory testing before the loading in February.
In the case of AACS, only the off-line (i.e., the redundant, not operating) memory was tested in August. The memories must be swapped to test the currently on-line memory. Since the memories must be swapped to load the new FSW, the currently on-line memory will be tested in February before loading the new FSW when that memory is necessarily off-line for the loading. This avoided an unnecessary memory swap with its attendant difficulties and risks in August. The new AACS FSW will provide several layers of new fault protection for relay link antenna pointing. Nominally, the clock (azimuth) angle of the antenna will be controlled using the gyros. The star scanner is used to provide a gross check on the gyros and control is autonomously switched to the scanner if the miscompare tolerance is violated. There is considerable concern about the reliable operation of the star scanner deep in Jupiter's radiation field. Accordingly, the new FSW will obtain roll (clock) reference using only the brightest available star - Canopus - during relay. If Canopus is not being detected reliably, then the FSW will switch to the Sun Acquisition Sensor, which is not susceptible to radiation, and use the sun pulse for roll reference. These three sources of roll reference are progressively more robust but result in less accurate though quite adequate antenna azimuth control. Having three different reference sources provides maximum reliability for this most critical mission event.
The ASFT will be performed in March 1995 shortly after the IFL. The Probe telemetry during the ASFT will be stored on the Orbiter tape recorder and in the CDS using the new FSW. The verification of the new capability to store Probe data in the CDS will be provided by downlinking the data from the CDS storage. The taped data will also be downlinked. The contingency mission decision will be made by May 1st for input to the finalization of the Orbiter's Probe release flight sequence.
The Probe is spin-stabilized at 10.5 rpm by spinning up the entire spacecraft to 10.5 rpm prior to release. There is no attitude or path control system on the Probe; it is totally ballistic. Thus, entry Flight Path Angle (FPA) and Angle-of-Attack (AOA) must be established by the Orbiter before release. TCM's 23 and 24 (Fig. 1) will precisely adjust the spacecraft trajectory such that the separation impulse and all gravitational and non-gravitational (e.g., solar pressure, etc.) forces will result in an atmosphere relative Probe FPA of -8.6 deg (+/-1.4 deg 99%) at 450 km altitude above the one-bar reference pressure surface.
At Release minus 6days, the Probe is switched to internal power. Probe data will be via the new CDS storage; it will also be tape recorded, but tape playback will be for contingencies only. Following verification of internal power and other checks, the umbilical cable is cut with a pyro-activated guillotine. Cable cut will be verified by the loss of Probe signals to the Orbiter.
After verification of umbilical cut, the spacecraft will turn to the required Probe Release attitude, transition from dual-spin to all-spin mode, and then spin-up to 10.5 rpm. All pre-release actions that can be performed before the turn are done then because the telemetry link performance is less at the release attitude because earth will be 10 deg off the LGA axis. The Probe is released by simultaneous firing of the three (captured) explosive nuts at the "tripod" attach points. Each nut has redundant pyros. The separation springs impart a 0.3 m/s delta-V to the Probe. The Probe release attitude is parallel to what will be theÊatmosphere relative entry velocity vector, i.e., zero A-O-A. The predicted aggregate affects of turn accuracy and separation and all subsequent disturbances shows that the 6.0 deg A-O-A tolerance specification is easily met. At key points throughout the sequence, "go commands" must be received from the ground for the sequence to continue. After Probe release, the Orbiter spins back down, transitions to dual-spin, and turns back to near earth point.
ODM will be a 59.6 m/sec maneuver, 29 deg off earthline. It will be the first use of the 400N main engine. In a manner entirely analogous to the Probe Release scenario, the Orbiter must turn to the maneuver attitude and then spin-up to 10.5 rpm to provide stability for the 400N burn. The ODM could be performed with the 10N thrusters with a net Propellant Margin penalty of only 3 kg. However, using the 400N engine for ODM provides a crucial inflight characterization of the engine well prior to its mandatory use for Jupiter Orbit Insertion (JOI). To the maximum practical extent the planned JOI operating conditions (pressures, temperatures, etc.) will be duplicated at ODM and the observed engine performance will be analyzed to determine any changes to the JOI plan. The 400N engine burns are terminated on accumulated accelerometer counts with min/max timed backup cutoff. The thrust level inferred at ODM is, for example, an important consideration in the min/max "timer" setting for JOI.
The 400N engine uses the same propellant supply (MMH&NTO) and feed system as the 10N thrusters. The feed system pressurization gas (He) is also used to actuate the 400N engine propellant valve via an electrically operated pilot valve. Nominally, the last pyro event on Galileo is opening an isolation valve to flow the He pressurant to the pilot valve. This will occur a few days after Probe Release in preparation for ODM. On each of the redundant 10N thruster branches a pair of electrically operated latch valves secures the propellant supply from the thrusters except during their intended use; likewise, there is a pair on the 400N branch. In a contingency where a 400N latch valve does not open, pyro isolation valves will be fired open to manifold a 10N propellant branch to the 400N branch, below the latch valves. The 400N ODM will demonstrate with high confidence that the engine and feed system are working properly or it will indicate contingencies must be invoked for JOI.