-
Computers in Spaceflight: The NASA
Experience
-
- - Chapter Four -
- - Computers in the Space Shuttle
Avionics System -
-
- The space shuttle main engine
controllers
-
-
- [124] Among the many
special-purpose computers on the Shuttle, the....
-
-
- [125] Box 4-6: Using
the Shuttle's Keyboards
-
- The Shuttle's keyboards are different from
those found on Gemini and Apollo because they are hexadecimal, or
base 16, rather than decimal, so that memory locations can be
altered by hex entries from the keyboard. A single hex digit
represents 4 bits, so just four digits can fill a half-word memory
location. The other keys perform specialized functions. The most
often used are
-
- ITEM: This selects a specific function
displayed on a CRT. For example, if the astronaut wishes to
perform a faction numbered 32 on the screen, he or she presses
ITEM, 3, 2, EXEC.
-
- OPS: This, plus a four-digit number,
selects the operational sequence and major mode desired by the
crew. For instance, to choose the first major mode of the ascent
software, OPS, 1, 1, 0, 1, and PRO is entered.
-
- SPEC: This key, plus appropriate digits
and PRO, selects a specialist faction or display function screen.
Each OPS has associated with it a number of primary screens that
reflect what is happening in the software. The ascent program has
a vertical path graphic, for instance. Additionally, special
functions can be called from SPEC displays that are overlaid on
the primary screens when called. On-orbit, and several other OPS,
have a "GPC Memory" display that can be used to read or write to
individual memory locations. It cannot be called from either the
ascent or descent OPS. Display function screens are just that:
used to show various data such as fuel cell levels, but with no
crew functions. To return to the primary screen that was on the
CRT before the SPEC or DISP call, the RESUME key is used.
-
- CLEAR: Each time this key is depressed,
one character is deleted from the input line on the CRT accessed.
This enables an astronaut to erase an error if it is caught before
EXEC or PRO is depressed.
-
- "+" : This sign can be used as a delimiter
around numeric data or between a series of function
selections.
- ....main engine controllers stand out as a
clear "first" in space technology. The Shuttle's three main
liquid-propellant engines are the most complex and "hottest"
rockets ever built. The complexity is tied to the mission
requirements, which state that they be throttleable, a common
characteristic of internal combustion engines and turbojets, but
rare in the rocket business. They run "hotter" than any other
rocket engine because at any given moment they are closer to
destroying themselves than their predecessors. Previous engines
were overbuilt in the sense that they were designed to burn at
full thrust through their entire....
-
-
-
[126]
-
Figure 4-8. Keyboard layout of the
Shuttle computer system. (From NASA, Data Processing System
Workbook)
-
-
-
- ....lifetime of a few minutes with no
chance that the continuous explosion of fuel and oxidizer would
get out of control. To ensure this, engineers designed combustion
chambers and cooling systems better than optimum, with the result
that the engines weighed more than less-protected designs, thus
reducing performance. Engineers also set fluid mixtures and flow
rates by mechanical means at preset levels, and levels could not
be changed to gain greater performance. The Shuttle engines can
adjust flow levels, can sense how close to exploding they are, and
can respond in such a way as to maintain maximum performance at
all times. Neither the throttleability or the performance
enhancements could be accomplished without a digital computer as a
control device.
-
- In 1972, NASA chose Rocketdyne as the
engine contractor, with....
-
-
-
[127]
-
Figure 4-9. A typical display of
the Primary Avionics Software System. (From NASA, Data Processing
System Workbook)
-
-
-
- .....Marshall Space Flight Center
responsible for monitoring the design, production, and testing of
the engines. Rocketdyne conducted a preliminary study of the
engine control problem and recommended that a distributed approach
be used for the solution166. By placing controllers at the engines themselves,
complex interfaces between the engine and vehicle could be
avoided. Also, the high data rates needed for active control are
best handled with a dedicated computer. Both Marshall and
Rocketdyne agreed that a digital computer controller was better
than an analog controller for three reasons. First, software
allows for greater flexibility. Inasmuch as the control concepts
for the engines were far from settled in 1972, NASA considered the
ease of modifying software versus hardware a very important
advantage167. [128] Second, the digital system could respond faster.
And third, the failure detection function could be
simpler168. Basically, the computer has only two functions: to
control the engine and to do self tests.
-
- The concept of fail operational/fail-safe
is preserved with the engine controllers because each engine has a
dual redundant computer attached to it. Failure of the first
computer does not impede operational capability, as the second
takes over instantly. Failure of the second computer causes a
graceful shutdown of the affected engine169. Loss of an engine does not cause any immediate
danger to a Shuttle crew, as demonstrated in a 1985 mission that
lost an engine and still achieved orbit. If engine loss occurs
early in a flight, the mission can be aborted through a RTLS
maneuver that causes the spacecraft essentially to turn around and
fly back to a runway near the launch pad. Slightly later aborts
may lead to a landing in Europe for Kennedy Space Center launches.
If the engine fails near orbit it may be possible to achieve an
orbit and then modify it using the orbital maneuvering system
engines.
-
-
- Controller Software and
Redundancy Management
-
-
- As with the main computers on the Shuttle,
software is an important part of the engine controller system.
NASA managers adopted a strict software engineering approach to
the controller code. Marshall's Walter Mitchell said, "We try to
treat the software exactly like the hardware"170. In fact, the controller software is more closely
married to engine hardware than in other systems under computer
control. The controllers operate as a real-time system with a
fixed cyclic execution schedule. Each major cycle has four
5-millisecond minor cycles for a total of 20 milliseconds. This is
a high frequency, necessitated by the requirement to control a
rapidly changing engine environment. Each major cycle starts and
ends with a self test. It proceeds through engine control tasks,
input sensor data reads, engine limit monitoring tasks, output,
another round of input sensor data, a check of internal voltage,
and then the second self test171. Some free time is built into the cycle to avoid
overruns into the next cycle. So that the controller will not
waste processing time handling data requests from the primary
avionics system, direct memory access of engine component data can
be made by the primary172.
-
- As with the primary computers in the
Shuttle, the memory of the controller cannot hold all the software
originally designed for it. A set of preflight checkout programs
have to be stored on the MMU and rolled in during the countdown.
At T-30 hours, the engines are activated and the flight software
load is read from the mass memory173. Even this way, fewer than 500 words of the 16K are
unused174.
-
-
[129]
-
Figure 4-10. A Shuttle Main Engine
Controller mounted in an engineering simulator at the Marshal
Space Flight Center. (NASA photo)
-
-
-
- Although redundant, the controllers are
not synchronized like the primary computers. Marshall Space Flight
Center studied active synchronization, but the additional hardware
and software overhead seemed too expensive175. The present system of redundancy management most
closely resembles that used by the Skylab computers. Since
Marshall also had responsibility for those computers and was
making the decision about the controllers at the same time Skylab
was operating, some influence from the ATMDC experience is
possible. Two watchdog timers are used to flag failures. One is
incremented by the real-time clock and the other, by a clock in
the output electronics. Each has to be reset by the software. If
the timers run out, the software or critical hardware of the
computer responsible for resetting them is assumed failed and the
Channel B computer takes over at that point. The timeout is set at
18 milliseconds, so the engine involved is "uncontrolled" by a
failed computer for less than a major cycle before the redundant
computer takes over176.
- [130] Box 4-7: Shuttle
Engine Controller Hardware
-
- The computer chosen for the engine
controllers is the Honeywell HDC-601. The Air Force was using it
in 1972 when the choice was made, so operational experience
existed. Additionally, the machine was software compatible with
the DDP 516, a ground-based Honeywell minicomputer, so a
development environment was available. Honeywell built parts of
the controller in St. Petersburg, Florida and shipped those to the
main plant in Minneapolis for final assembly; within a couple of
years, all the construction tasks moved to St. Petersburg. By
mid-1983, Honeywell completed 29 of the
computers177.
-
- The HDC-601 uses a 16-bit instruction
word. It can do an add in 2 microseconds, a multiply in 9.
Eighty-seven instructions are available to programmers, and all
software is coded in assembly language178. The memory is 2-mil plated wire, which has been
used widely in the military and is known for its ruggedness. It
functions much like a core memory in that data are stored as a one
or zero by changing the polarity in a segment of the wire. Each
machine has 16K of 17 bits, the seventeenth bit used to provide
even parity179. Plated wire has the advantage of having
nondestructive readout capability.
-
- The controllers are arranged with power,
central processor, and interfaces as independent components, but
the I/O devices are cross strapped. This provides a reliability
increase of 15 to 20 times, as modular failures can be isolated.
The computers and associated electronics are referred to as
Channel A and Channel B. With the cross strapping, if Channel A's
output electronics failed, than Channel B's could he used by
Channel A's computer180.
-
- Packaging is a serious consideration with
engine controllers, since they are physically attached to a
running rocket engine, hardly the benign environment found in most
computer rooms. The use of late 1960s technology, which creates
computers with larger numbers of discrete components and fewer
ICs, means that the engine builders are penalized in designing
appropriate packages181. Rocketdyne bolted early versions of the controller
directly to the engine, resulting in forces of 22g rattling the
computer and causing failures. The simple addition of a rubber
gasket reduced the g forces to about 3 or 4. Within the outer box,
the circuit cards are held in place by foam wedges to further
reduce vibration effects182.
-

