RCS Jet Selection

The RCS sends pressure, temperature and valve position data to the data processing system through the flight-critical multiplexers/demultiplexers for processing by the orbiter computers. The computers use the data to monitor and display the configuration and status of the RCS. The DPS provides valve configuration and jet on/off commands to the RCS by way of the aft and forward reaction jet drivers. Data from the RCS through the MDMs also are sent to the pulse code modulation master unit for incorporation into the downlink to ground telemetry and to the orbiter's onboard recorders.

The RJDs AND fire commands A and B for an RCS jet. If both are true, they send a voltage to open the RCS fuel and oxidizer solenoid valves. This voltage is used to generate the RJD discrete. Fire command B also is sent and used by the RCS redundancy management. The RJD driver and logic power for the aft and forward RJDs are controlled by the RJDA-1A L2/R2, RJDA-2A L4/R4 and RJDF-1B F1 manf logic and driver on and off switches on panel O14; RJDA-1B L1/L5/R1 and RJDF-1A F2 manf logic and driver switches on panel O15; and RJDA-2B L3/R3/R5, RJDF-2A F3 and RJDF-2A F4/F5 manf logic and driver switches on panel O16.

The RCS redundancy management monitors the RCS jets' chamber pressure discretes, fuel and oxidizer injector temperatures, RJD on/off output discretes, jet fire commands and manifold valve status.

The DPS software provides status information on any RCS errors to the RCS redundancy management software. The errors are referred to as communications faults. When an RCS error is detected by any orbiter computer for two consecutive cycles, the data on the entire chain are flagged as invalid for the applications software. Communications faults in the RCS redundancy management help to prevent the redundant orbiter computers from moding to dissimilar software, to optimize the number of RCS jets available for use, and to prevent the RCS redundancy management from generating additional alerts to the flight control operational software. The RCS redundancy management will reconfigure for communications faults regardless of whether the communications faults are permanent, transient or subsequently removed. On subsequent transactions, if the problem is isolated, only the faulty element is flagged as invalid.

The RCS-jet-failed-on monitor uses the jet fire command B discretes, the RJD on/off output, the jet deselect inhibit discretes and the jet communications fault discretes as inputs from each of the 44 jets. The RCS-jet-failed-on logic checks for the presence of an RJD-on discrete when no jet fire command B exists. It outputs that the RCS jet has failed on if this calculation is true for three consecutive cycles during any flight phase. Note that the consecutive cycles are not affected by communications faults or by cycles in which there are fire commands for the affected RCS jet. However, the three-consecutive-cycle logic will be reset if the non-commanded jet has its RJD output discrete reset to indicate the jet is not firing. A jet-failed-on determination sets the jet-failed-on discrete (even for a minimum jet fire command pulse of 80 milliseconds on and off) and outputs the jet-failed-on indication to the backup caution and warning light, the yellow caution and warning RCS jet light on panel F7, a fault message on the CRT and an audible alarm. These discretes will be reset when the associated RCS jet redundancy management inhibit discrete is reset by the flight crew. A jet failed on will not be automatically deselected by the RCS redundancy management, and the orbiter digital autopilot will not reconfigure the jet selections.

The RCS-jet-failed-off monitor uses the RCS jet fire command B discretes, the jet chamber pressure discretes, the RCS jet-deselect inhibit discretes and the jet communications fault discrete as inputs from each of the 44 jets. The RCS-jet-failed-off logic checks for the absence of the jet chamber pressure discretes when a jet fire command B discrete exists. It outputs that the RCS jet has failed off if true for three consecutive cycles. The consecutive cycles are not affected by the communications faults or by cycles in which there are no fire commands for the affected RCS jet. However, the three-consecutive-cycle logic leading to a failed-off indication must begin anew if, before the third consecutive cycle is reached, the fire command and its associated chamber pressure indicate that the RCS jet has fired. A jet-failed-off determination sets the jet-failed-off discrete (even for a minimum jet fire command pulse of 80 milliseconds on and off) and outputs the jet-failed-off indication to the backup caution and warning light, the yellow RCS jet light on panel F7, a fault message on the CRT and an audible alarm. The RCS-jet-failed-off monitor will be inhibited for the jet failed off until the flight crew resets the redundancy management inhibit discrete. The RCS redundancy management will automatically deselect a jet that has failed off, and the DAP will reconfigure the jet selection accordingly. The RCS redundancy management will announce a failed-off jet, but will not deselect the jet if the jet's redundancy management inhibit discrete has been set in advance.

The RCS-jet-failed leak monitor uses the RCS jet fuel and oxidizer injector temperatures for each of the 44 jets with the specified temperatures of 30 F for oxidizer and 20 F for fuel for the primary and 130 F for the vernier jets (in OPS 2 and 8). It declares a jet-failed leak if any of the temperatures are less than the specified limit for three consecutive cycles. An RCS-jet-failed leak monitor outputs the RCS-jet-failed leak to the backup caution and warning light, the yellow RCS jet caution and warning light on panel F7, a fault message on the CRT and an audible alarm. The RCS-jet-failed leak monitor will be inhibited until the flight crew resets the RCS redundancy management inhibit discrete. The RCS redundancy management will automatically deselect a jet declared leaking, and the DAP will reconfigure the jet selection accordingly. The RCS redundancy management will announce a failed leak jet, but it will not deselect the jet if the jet's redundancy management inhibit discrete has been set in advance.

The RCS jet fault limit module limits the number of jets that can be automatically deselected in response to failures detected by RCS redundancy management. The limits are modifiable by the flight crew input on the RCS SPEC display (RCS forward, left, right jet fail limit). This module also reconfigures a jet's availability status. Automatic deselection of a jet occurs if all the following are satisfied: jet detected failed off or leak (jet-on failures do not result in automatic deselection), jet-select/deselect status is select, jet's manifold status is open, redundancy management is not inhibited for this jet, jet failure has not been overridden, and the number of automatic deselections of primary jets on that aft RCS pod is less than the associated jet fail limit (no limit on vernier jets). A jet's status can be changed from deselect to select only by item entry on the RCS SPEC page. Automatic deselection of a jet can be prevented by use of the inhibit item entries on the RCS SPEC page.

The manifold status monitor uses the open and close discretes of the oxidizer and fuel manifold isolation valves to determine their open/close status independently of status changes made by the flight crew. The flight crew can override the status of all manifolds on an individual basis by item entries on the RCS SPEC. The use of the manifold status override feature will not inhibit or modify any of the other functions of the manifold status monitor.

The available jet status table module provides a list of jets available for use to the flight control system. The available jet status table uses the manifold open/close discretes from the manifold status monitor and the jet-deselect output discretes from the jet fault limit module as inputs. This table outputs the jet available discretes and the jet status discrete. The available jet status module shows a jet as available to the flight control system if the jet-deselect output discretes and the manifold open/close discretes indicate select and open, respectively. The available jet status table will be computed each time the jet status change discrete is true.

The digital autopilot jet-select module contains default logic in certain instances. When the orbiter is mated to the ET, roll rate default logic inhibits roll rotation, and yaw commands are normally in the direction of favorable yaw-roll coupling. During insertion, a limit of seven aft RCS jets per tank set applies for ET separation and for return-to-launch-site aborts. If negative Z and plus X translation commands are commanded simultaneously, both will be degraded. A limit of four aft RCS jets per tank set normally applies. Plus X is degraded when simultaneous negative Z and plus X and Y translation and yaw rotation commands exceed a demand of five aft RCS jets. If plus X and negative Z translations are commanded simultaneously, plus X is given priority.

The DAP jet-select module determines which aft RCS jets (right, left or both) must be turned on in response to the pitch, roll and yaw jet commands from the entry flight control system. The forward RCS jets are not used during entry. After entry interface, only the four Y-axis and six Z-axis RCS jets on each aft RCS pod are used. No X-axis or vernier jets are used. The DAP sends the discretes that designate which aft RCS jets are available for firing (a maximum of four RCS jets per pod may be fired) and, during reconfiguration or when the RCS crossfeed valves are open, the maximum combined total number of yaw jets available during certain pitch and roll maneuvers.

During ascent or entry, the DAP jet-select logic module in the flight control system receives both RCS rotation and translation commands. By using a table lookup technique, the module outputs 38 jet on/off commands to the RCS command subsystem operating program, which then generates dual fire commands A and B to the individual RCS reaction jet drivers to turn each of the 38 primary RCS jets on or off. The fire commands A and B for each of the 38 primary RCS jets are set equal to the digital autopilot RCS commands. Commands are issued to the six RCS vernier jets similarly on orbit.

The transition digital autopilot becomes active immediately after main engine cutoff and maintains attitude hold in preparation for ET separation. The transition DAP controls the spacecraft in response to control stick steering or automatic commands during orbit insertion OMS thrusting periods, orbit coast, on-orbit checkout, deorbit maneuver and deorbit maneuver coast. These commands are converted to OMS engine deflections (thrust vector control) during OMS insertion thrusting periods and RCS jet firing during the insertion phase. RCS commands are issued to support OMS rotations (roll control) when only one OMS engine is used or for rotation, attitude hold or translation when the OMS engines are not thrusting. The transition DAP uses attitude feedback and velocity increments from the inertial measurement units through the attitude processor. This feedback information allows the transition DAP to operate as a closed-loop system for pointing and rotation, but not for translation.

The on-orbit DAP and RCS command orbit subsystem operating program generate the dual fire commands to the individual RCS jets in response to commands from the flight control system during orbit operations and on-orbit checkout. The fire A and fire B commands for each jet are set equal to the on-orbit DAP RCS commands. The fire B commands are also sent to redundancy management. There are automatic or control stick steering rotation mode, manual translation and primary or vernier RCS capabilities on orbit.

The automated or guided rotation commands are supplied by the universal pointing processor, and control stick steering rotation or translation commands are supplied by the rotational hand controller or translational hand controller. Crew commands from the flight deck forward or aft station are accepted. Three selectable control stick steering rotation modes and two selectable translation modes (for X, Y and Z translations) are provided. The capability to select nose (forward RCS) or tail (aft RCS) only for pitch and/or yaw control is provided by the primary jets. Primary jet roll control is provided only by the aft RCS jets.

The vernier jets are used for tight attitude dead bands and fuel conservation. The loss of one down-firing vernier jet results in the loss of the entire vernier mode.

The on-orbit DAP has two sets of initialized dead bands - DAP A and DAP B. DAP A is used for maneuvers that do not require accurate pointing. DAP B has a narrow dead band and is used for maneuvers that require accurate pointing, such as IMU alignment.

The entry and landing RCS command subsystem operating program generates the dual fire commands to the individual RCS thrusters in response to commands from the flight control system during entry guidance, terminal area energy management, and approach and landing. This program sets the fire A and fire B commands equal to the aerojet DAP commands or the return-to-launch-site abort DAP commands, depending on the one selected by the flight control system. These commands are sent to the 20 aft RCS Y and Z jets. The fire B commands are also sent to redundancy management.

The aerojet DAP is a set of general equations used to develop effector commands that will control and stabilize the orbiter during its descent to landing. The aerojet DAP resides in the entry OPS but is used only during entry, terminal area energy management, and approach and landing.

This is accomplished by using either control stick steering commands or automatic commands as inputs to the equations. The solution of these equations results in fire commands to the available RCS jets and/or appropriate orbiter aerosurfaces.

The on-orbit and transition digital autopilots also are rate command control systems. Sensed body rate feedback is employed for stability augmentation in all three axes. This basic rate system is retained in a complex network of equations whose principal terms are constantly changing to provide the necessary vehicle stability while ensuring sufficient maneuvering capability to follow the planned trajectory.

For exoatmospheric flight or flight during the trajectory in which certain control surfaces are rendered ineffective by adverse aerodynamics, a combination of aft RCS jet commands and aerosurface commands is issued. For conventional vehicle flight in the atmosphere, the solution of equations results in deflection commands to the elevons, rudder, speed brake and body flap. Inputs from entry guidance can consist of automatic attitude, angle of attack, surface position and acceleration commands and control stick steering roll, pitch and yaw rate commands from the flight-crew-operated controllers or a combination of the two, since the software channels may be moded independently.

Roll, pitch and yaw indicator lights on panel F6 indicate the presence of an RCS command during entry, terminal area energy management, and approach and landing. The indicators are L and R for roll and yaw left or right and U and D for pitch up and down. Their primary function is to indicate when more than two yaw jets are commanded and when the elevon drive rate is saturated.

From entry interface until the dynamic pressure is greater than 10 pounds per square foot, the roll l and roll r lights indicate that left or right roll commands have been issued by the DAP. The minimum light-on duration is extended to allow the light to be seen even for a minimum impulse firing. When a dynamic pressure of 10 pounds per square foot has been sensed, neither roll light will be illuminated until 50 pounds per square foot has been sensed and two RCS yaw jets are commanded on.

The pitch lights indicate up and down pitch jet commands until a dynamic pressure of 20 pounds per square foot is sensed, after which the pitch jets are no longer used. When 50 pounds per square foot is sensed, the pitch lights assume a new function. Both pitch lights will be illuminated whenever the elevon surface drive rate exceeds 20 degrees per second (10 degrees per second if only one hydraulic system is remaining).

The yaw lights function as yaw jet command indicators throughout entry until the yaw jets are disabled at approximately 45,000 feet. The yaw lights have no other function.

The forward RCS module and OMS/RCS pods can be removed to facilitate orbiter turnaround, if required, and are reusable for a minimum of 100 missions.