The RCS sends pressure, temperature and valve position data to
the data processing system through the flight-critical multiplexers/demultiplexers
for processing by the orbiter computers. The computers use the
data to monitor and display the configuration and status of the
RCS. The DPS provides valve configuration and jet on/off commands
to the RCS by way of the aft and forward reaction jet drivers.
Data from the RCS through the MDMs also are sent to the pulse
code modulation master unit for incorporation into the downlink
to ground telemetry and to the orbiter's onboard recorders.
The RJDs AND fire commands A and B for an RCS jet. If both are
true, they send a voltage to open the RCS fuel and oxidizer solenoid
valves. This voltage is used to generate the RJD discrete. Fire
command B also is sent and used by the RCS redundancy management.
The RJD driver and logic power for the aft and forward RJDs are
controlled by the RJDA-1A L2/R2, RJDA-2A L4/R4 and RJDF-1B F1
manf logic and driver on and off switches on panel O14; RJDA-1B
L1/L5/R1 and RJDF-1A F2 manf logic and driver switches on panel
O15; and RJDA-2B L3/R3/R5, RJDF-2A F3 and RJDF-2A F4/F5 manf logic
and driver switches on panel O16.
The RCS redundancy management monitors the RCS jets' chamber
pressure discretes, fuel and oxidizer injector temperatures, RJD
on/off output discretes, jet fire commands and manifold valve
The DPS software provides status information on any RCS errors
to the RCS redundancy management software. The errors are referred
to as communications faults. When an RCS error is detected by
any orbiter computer for two consecutive cycles, the data on the
entire chain are flagged as invalid for the applications software.
Communications faults in the RCS redundancy management help to
prevent the redundant orbiter computers from moding to dissimilar
software, to optimize the number of RCS jets available for use,
and to prevent the RCS redundancy management from generating additional
alerts to the flight control operational software. The RCS redundancy
management will reconfigure for communications faults regardless
of whether the communications faults are permanent, transient
or subsequently removed. On subsequent transactions, if the problem
is isolated, only the faulty element is flagged as invalid.
The RCS-jet-failed-on monitor uses the jet fire command B discretes,
the RJD on/off output, the jet deselect inhibit discretes and
the jet communications fault discretes as inputs from each of
the 44 jets. The RCS-jet-failed-on logic checks for the presence
of an RJD-on discrete when no jet fire command B exists. It outputs
that the RCS jet has failed on if this calculation is true for
three consecutive cycles during any flight phase. Note that the
consecutive cycles are not affected by communications faults or
by cycles in which there are fire commands for the affected RCS
jet. However, the three-consecutive-cycle logic will be reset
if the non-commanded jet has its RJD output discrete reset to
indicate the jet is not firing. A jet-failed-on determination
sets the jet-failed-on discrete (even for a minimum jet fire command
pulse of 80 milliseconds on and off) and outputs the jet-failed-on
indication to the backup caution and warning light, the yellow
caution and warning RCS jet light on panel F7, a fault message
on the CRT and an audible alarm. These discretes will be reset
when the associated RCS jet redundancy management inhibit discrete
is reset by the flight crew. A jet failed on will not be automatically
deselected by the RCS redundancy management, and the orbiter digital
autopilot will not reconfigure the jet selections.
The RCS-jet-failed-off monitor uses the RCS jet fire command
B discretes, the jet chamber pressure discretes, the RCS jet-deselect
inhibit discretes and the jet communications fault discrete as
inputs from each of the 44 jets. The RCS-jet-failed-off logic
checks for the absence of the jet chamber pressure discretes when
a jet fire command B discrete exists. It outputs that the RCS
jet has failed off if true for three consecutive cycles. The consecutive
cycles are not affected by the communications faults or by cycles
in which there are no fire commands for the affected RCS jet.
However, the three-consecutive-cycle logic leading to a failed-off
indication must begin anew if, before the third consecutive cycle
is reached, the fire command and its associated chamber pressure
indicate that the RCS jet has fired. A jet-failed-off determination
sets the jet-failed-off discrete (even for a minimum jet fire
command pulse of 80 milliseconds on and off) and outputs the jet-failed-off
indication to the backup caution and warning light, the yellow
RCS jet light on panel F7, a fault message on the CRT and an audible
alarm. The RCS-jet-failed-off monitor will be inhibited for the
jet failed off until the flight crew resets the redundancy management
inhibit discrete. The RCS redundancy management will automatically
deselect a jet that has failed off, and the DAP will reconfigure
the jet selection accordingly. The RCS redundancy management will
announce a failed-off jet, but will not deselect the jet if the
jet's redundancy management inhibit discrete has been set in advance.
The RCS-jet-failed leak monitor uses the RCS jet fuel and oxidizer
injector temperatures for each of the 44 jets with the specified
temperatures of 30 F for oxidizer and 20 F for fuel for the primary
and 130 F for the vernier jets (in OPS 2 and 8). It declares a
jet-failed leak if any of the temperatures are less than the specified
limit for three consecutive cycles. An RCS-jet-failed leak monitor
outputs the RCS-jet-failed leak to the backup caution and warning
light, the yellow RCS jet caution and warning light on panel F7,
a fault message on the CRT and an audible alarm. The RCS-jet-failed
leak monitor will be inhibited until the flight crew resets the
RCS redundancy management inhibit discrete. The RCS redundancy
management will automatically deselect a jet declared leaking,
and the DAP will reconfigure the jet selection accordingly. The
RCS redundancy management will announce a failed leak jet, but
it will not deselect the jet if the jet's redundancy management
inhibit discrete has been set in advance.
The RCS jet fault limit module limits the number of jets that
can be automatically deselected in response to failures detected
by RCS redundancy management. The limits are modifiable by the
flight crew input on the RCS SPEC display (RCS forward, left,
right jet fail limit). This module also reconfigures a jet's availability
status. Automatic deselection of a jet occurs if all the following
are satisfied: jet detected failed off or leak (jet-on failures
do not result in automatic deselection), jet-select/deselect status
is select, jet's manifold status is open, redundancy management
is not inhibited for this jet, jet failure has not been overridden,
and the number of automatic deselections of primary jets on that
aft RCS pod is less than the associated jet fail limit (no limit
on vernier jets). A jet's status can be changed from deselect
to select only by item entry on the RCS SPEC page. Automatic deselection
of a jet can be prevented by use of the inhibit item entries on
the RCS SPEC page.
The manifold status monitor uses the open and close discretes
of the oxidizer and fuel manifold isolation valves to determine
their open/close status independently of status changes made by
the flight crew. The flight crew can override the status of all
manifolds on an individual basis by item entries on the RCS SPEC.
The use of the manifold status override feature will not inhibit
or modify any of the other functions of the manifold status monitor.
The available jet status table module provides a list of jets
available for use to the flight control system. The available
jet status table uses the manifold open/close discretes from the
manifold status monitor and the jet-deselect output discretes
from the jet fault limit module as inputs. This table outputs
the jet available discretes and the jet status discrete. The available
jet status module shows a jet as available to the flight control
system if the jet-deselect output discretes and the manifold open/close
discretes indicate select and open, respectively. The available
jet status table will be computed each time the jet status change
discrete is true.
The digital autopilot jet-select module contains default logic
in certain instances. When the orbiter is mated to the ET, roll
rate default logic inhibits roll rotation, and yaw commands are
normally in the direction of favorable yaw-roll coupling. During
insertion, a limit of seven aft RCS jets per tank set applies
for ET separation and for return-to-launch-site aborts. If negative
Z and plus X translation commands are commanded simultaneously,
both will be degraded. A limit of four aft RCS jets per tank set
normally applies. Plus X is degraded when simultaneous negative
Z and plus X and Y translation and yaw rotation commands exceed
a demand of five aft RCS jets. If plus X and negative Z translations
are commanded simultaneously, plus X is given priority.
The DAP jet-select module determines which aft RCS jets (right,
left or both) must be turned on in response to the pitch, roll
and yaw jet commands from the entry flight control system. The
forward RCS jets are not used during entry. After entry interface,
only the four Y-axis and six Z-axis RCS jets on each aft RCS pod
are used. No X-axis or vernier jets are used. The DAP sends the
discretes that designate which aft RCS jets are available for
firing (a maximum of four RCS jets per pod may be fired) and,
during reconfiguration or when the RCS crossfeed valves are open,
the maximum combined total number of yaw jets available during
certain pitch and roll maneuvers.
During ascent or entry, the DAP jet-select logic module in the
flight control system receives both RCS rotation and translation
commands. By using a table lookup technique, the module outputs
38 jet on/off commands to the RCS command subsystem operating
program, which then generates dual fire commands A and B to the
individual RCS reaction jet drivers to turn each of the 38 primary
RCS jets on or off. The fire commands A and B for each of the
38 primary RCS jets are set equal to the digital autopilot RCS
commands. Commands are issued to the six RCS vernier jets similarly
The transition digital autopilot becomes active immediately after
main engine cutoff and maintains attitude hold in preparation
for ET separation. The transition DAP controls the spacecraft
in response to control stick steering or automatic commands during
orbit insertion OMS thrusting periods, orbit coast, on-orbit checkout,
deorbit maneuver and deorbit maneuver coast. These commands are
converted to OMS engine deflections (thrust vector control) during
OMS insertion thrusting periods and RCS jet firing during the
insertion phase. RCS commands are issued to support OMS rotations
(roll control) when only one OMS engine is used or for rotation,
attitude hold or translation when the OMS engines are not thrusting.
The transition DAP uses attitude feedback and velocity increments
from the inertial measurement units through the attitude processor.
This feedback information allows the transition DAP to operate
as a closed-loop system for pointing and rotation, but not for
The on-orbit DAP and RCS command orbit subsystem operating program
generate the dual fire commands to the individual RCS jets in
response to commands from the flight control system during orbit
operations and on-orbit checkout. The fire A and fire B commands
for each jet are set equal to the on-orbit DAP RCS commands. The
fire B commands are also sent to redundancy management. There
are automatic or control stick steering rotation mode, manual
translation and primary or vernier RCS capabilities on orbit.
The automated or guided rotation commands are supplied by the
universal pointing processor, and control stick steering rotation
or translation commands are supplied by the rotational hand controller
or translational hand controller. Crew commands from the flight
deck forward or aft station are accepted. Three selectable control
stick steering rotation modes and two selectable translation modes
(for X, Y and Z translations) are provided. The capability to
select nose (forward RCS) or tail (aft RCS) only for pitch and/or
yaw control is provided by the primary jets. Primary jet roll
control is provided only by the aft RCS jets.
The vernier jets are used for tight attitude dead bands and fuel
conservation. The loss of one down-firing vernier jet results
in the loss of the entire vernier mode.
The on-orbit DAP has two sets of initialized dead bands - DAP
A and DAP B. DAP A is used for maneuvers that do not require accurate
pointing. DAP B has a narrow dead band and is used for maneuvers
that require accurate pointing, such as IMU alignment.
The entry and landing RCS command subsystem operating program
generates the dual fire commands to the individual RCS thrusters
in response to commands from the flight control system during
entry guidance, terminal area energy management, and approach
and landing. This program sets the fire A and fire B commands
equal to the aerojet DAP commands or the return-to-launch-site
abort DAP commands, depending on the one selected by the flight
control system. These commands are sent to the 20 aft RCS Y and
Z jets. The fire B commands are also sent to redundancy management.
The aerojet DAP is a set of general equations used to develop
effector commands that will control and stabilize the orbiter
during its descent to landing. The aerojet DAP resides in the
entry OPS but is used only during entry, terminal area energy
management, and approach and landing.
This is accomplished by using either control stick steering commands
or automatic commands as inputs to the equations. The solution
of these equations results in fire commands to the available RCS
jets and/or appropriate orbiter aerosurfaces.
The on-orbit and transition digital autopilots also are rate
command control systems. Sensed body rate feedback is employed
for stability augmentation in all three axes. This basic rate
system is retained in a complex network of equations whose principal
terms are constantly changing to provide the necessary vehicle
stability while ensuring sufficient maneuvering capability to
follow the planned trajectory.
For exoatmospheric flight or flight during the trajectory in
which certain control surfaces are rendered ineffective by adverse
aerodynamics, a combination of aft RCS jet commands and aerosurface
commands is issued. For conventional vehicle flight in the atmosphere,
the solution of equations results in deflection commands to the
elevons, rudder, speed brake and body flap. Inputs from entry
guidance can consist of automatic attitude, angle of attack, surface
position and acceleration commands and control stick steering
roll, pitch and yaw rate commands from the flight-crew-operated
controllers or a combination of the two, since the software channels
may be moded independently.
Roll, pitch and yaw indicator lights on panel F6 indicate the
presence of an RCS command during entry, terminal area energy
management, and approach and landing. The indicators are L and
R for roll and yaw left or right and U and D for pitch up and
down. Their primary function is to indicate when more than two
yaw jets are commanded and when the elevon drive rate is saturated.
From entry interface until the dynamic pressure is greater than
10 pounds per square foot, the roll l and roll r lights indicate
that left or right roll commands have been issued by the DAP.
The minimum light-on duration is extended to allow the light to
be seen even for a minimum impulse firing. When a dynamic pressure
of 10 pounds per square foot has been sensed, neither roll light
will be illuminated until 50 pounds per square foot has been sensed
and two RCS yaw jets are commanded on.
The pitch lights indicate up and down pitch jet commands until
a dynamic pressure of 20 pounds per square foot is sensed, after
which the pitch jets are no longer used. When 50 pounds per square
foot is sensed, the pitch lights assume a new function. Both pitch
lights will be illuminated whenever the elevon surface drive rate
exceeds 20 degrees per second (10 degrees per second if only one
hydraulic system is remaining).
The yaw lights function as yaw jet command indicators throughout
entry until the yaw jets are disabled at approximately 45,000
feet. The yaw lights have no other function.
The forward RCS module and OMS/RCS pods can be removed to facilitate
orbiter turnaround, if required, and are reusable for a minimum
of 100 missions.