DATA CHANGE NOTICE

SHUTTLE CREW OPERATIONS MANUAL

AMENDMENT: Rev. A, CPN-1

DATE: December 15, 2008

PAGE: 1 of 15

This version of SCOM contains changes reflecting OI-33 updates. All changes are in
Appendix E.

APPROVED BY
Michael R. Sterling
Book Manager, USA

Original approval obtained

Date:

12/15/2008

USA007587
Rev. A. CPN-1
(supersedes SFOC-FL0884)

Space Program Operations Contract

Shuttle Crew Operations Manual

OI-33

December 15, 2008

DRD-1.6.1.3-b

Contract NNJ06VA01C
Copyright 2004 by United Space Alliance, LLC. These materials are sponsored by the National Aeronautics and
SpaceAdministration under Contract NNJ06VA01C. The U.S. Government retains a paid-up, nonexclusive, irrevocable
worldwide license in such materials to reproduce, prepare derivative works, distribute copies to the public, and to perform
publicly and display publicly, by or on behalf of the U.S. Government. All other rights are reserved by the copyright owner.

Questions regarding the organization and content of the Shuttle

Crew Operations Manual should be directed to one of the following
SCOM representatives:
USA
Steven Williams, DA13
Michael Sterling, DA724
Book Manager

281-244-7698
281-244-7006

NASA
Anna Fisher, CB

281-244-8687

Bastion Technologies, Inc.

Vicki Atkins

281-280-6787

USA007587
Rev. A, CPN-1
REVISION LOG
Rev
letter

Change
no.

Basic
A
CPN-1

Description
New document number issued; supersedes
SFOC-FL0884.
OI-32 updates and return-to-flight issues
OI-33 updates added; OI-32 summary data
deleted

Date
10/15/04
08/01/08
12/15/08

USA007587
Rev. A
LIST OF EFFECTIVE PAGES
The status of all pages in this document is shown below:
Page No.

Change No.

Page No.

Change No.

i xx
1-1 1-2
1.1-1 1.1-20
1.2-1 1.2-16
1.3-1 1.3-4
1.4-1 1.4-10
2-1 2-2
2.1-1 2.1-30
2.2-1 2.2-24
2.3-1 2.3-22
2.4-1 2.4-50
2.5-1 2.5-16
2.6-1 2.6-58
2.7-1 2.7-28
2.8-1 2.8-46
2.9-1 2.9-64
2.10-1 2.10-22
2.11-1 2.11-22
2.12-1 2.12-4
2.13-1 2.13-74
2.14-1 2.14-18
2.15-1 2.15-16
2.16-1 2.16-42
2.17-1 2.17-22
2.18-1 2.18-32
2.19-1 2.19-10
2.20-1 2.20-4
2.21-1 2.21-30
2.22-1 2.22-26
2.23-1 2.23-4
2.24-1 2.24-8
2.25-1 2.25-8
3-1 3-4
3.1-1 3.1-2
3.2-1 3.2-2
3.3-1 3.3-2
3.4-1 3.4-2
3.5-1 3.5-6

Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A

4-1 4-2
4.1-1 4.1-12
4.2-1 4.2-4
4.3-1 4.3-4
4.4-1 4.4-2
4.5-1 4.5-2
4.6-1 4.6-2
4.7-1 4.7-2

Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A

4.8-1 4.8-2
4.9-1 4.9-2
4.10-1 4.10-4
5-1 5-2
5.1-1 5.1-2
5.2-1 5.2-8
5.3-1 5.3-10
5.4-1 5.4-8
5.5-1 5.5-2
6-1 6-2
6.1-1 6.1-2
6.2-1 6.2-6
6.3-1 6.3-8
6.4-1 6.4-4
6.5-1 6.5-4
6.6-1 6.6-2
6.7-1 6.7-4
6.8-1 6.8-16
6.9-1 6.9-4
6.10-1 6.10-2
6.11-1 6.11-2
7-1 7-2
7.1-1 7.1-12
7.2-1 7.2-12
7.3-1 7.3-14
7.4-1 7.4-28
8-1 8-2
8.1-1 8.1-2
8.2-1 8.2-4
8.3-1 8.3-2

LOEP

USA007587
Rev. A, CPN-1
Page No.

Change No.

8.4-1 8.4-2
8.5-1 8.5-2
8.6-1 8.6-2
8.7-1 8.7-2
8.8-1 8.8-2
9-1 9-2
9.1-1 9.1-10
9.2-1 9.2-4
9.3-1 9.3-12
A-1 A-70
B-1 B-18
C-1 C-26
D-1 D-12
E-1 E-6
I-1 I-6

Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A
Rev. A, CPN-1
Rev. A

LOEP

USA007587
Rev. A
Controls Specification, STS 83-0020V, for the
designated OI. It should be noted that several
CRT displays provided in the body of this
document are for illustrative purposes only;
certain CRT displays contain data combined in
one
illustration
that do
not
appear
simultaneously in operational use.

PREFACE
The Shuttle Crew Operations Manual (SCOM)
is a unique document containing information
about each shuttle system and every phase of a
generic space shuttle mission.
The SCOM is a reference document for space
shuttle crewmembers. The complexity of the
shuttle systems and the unique operational
environment, coupled with the numerous
malfunction/emergency procedures, necessitated some departures from an aircraft manual
approach (e.g. Air Force Dash1 or Navy/Marine
Corps NATOPS). Nonetheless, the SCOM is the
only single source document, written
specifically for shuttle astronauts, with
comprehensive data about shuttle systems and
operations.

Additional information or clarification is

presented in three formats: notes, cautions, and
warnings. Notes provide amplifying information of a general nature. Cautions provide
information and instructions necessary to
prevent hardware damage or malfunction.
Warnings provide information and instructions
necessary to ensure crew safety. The formats in
which this material appears are illustrated
below.
NOTE

This document contains condensed information

from a large number of space shuttle
publications, including the Flight Data File
(FDF), Crew Training workbooks, Flight
Procedure Handbooks (FPH), Flight Rules,
Shuttle Operational Data Book, and Shuttle
Performance Assessment Data Book.
The
SCOM is not a replacement for any of these
documents. It has been carefully reviewed by
Flight Crew Operations Directorate (FCOD) and
Mission
Operations
Directorate
(MOD)
personnel to ensure accuracy of information. In
all cases, should a conflict arise between the
SCOM and FDF or Flight Rules, the FDF and
Flight Rules will govern. If conflicts arise
between the SCOM and workbooks/FPHs, the
conflicts should be resolved with the appropriate book manager or system representative.

A barberpole APU/HYD READY TO

START talkback will not inhibit a start.

CAUTION
After an APU auto shutdown, the APU
FUEL TK VLV switch must be taken to
CLOSE prior to inhibiting auto shutdown
logic. Failure to do so can allow the fuel
tank isolation valves to reopen and flow
fuel to an APU gas generator bed that is
above the temperature limits for safe
restart.

WARNING
The FUEL CELL REAC switches on panel
R1 are in a vertical column with FUEL
CELL 1 REAC on top, FUEL CELL 3 REAC
in the middle, and FUEL CELL 2 REAC on
the bottom. This was done to allow the
schematic to be placed on the panel.
Because the switches are not in numerical
order, it is possible to inadvertently close
the wrong fuel cell reactant valve when
shutting down a fuel cell.

Information contained in the SCOM is current

per the Flight Software Operational Increment
(OI) designated on the cover page. If this SCOM
is published BEFORE the first launch of the
designated OI then the SCOM is current to
expected requirements.
If this SCOM is
published AFTER the first flight of a designated
OI, the SCOM will be current per as-flown
operational feedback from crews and ground
operators. CRT displays documented in the text
and in Appendix B are the CRT displays
documented in the Level C Functional
Subsystem Software Requirements Display and

PREFACE

USA007587
Rev. A

Configuration Control Plan

Program Documentation

The SCOM will be updated per the

specifications in the latest Space Flight
Operations Contract (SFOC) agreement between
the Space Shuttle Program and the United Space
Alliance (USA). USA's ongoing MOD and
FCOD support in the Shuttle Avionics Software
Control Board (SASCB), Program Requirements
Control Board (PRCB), Flight Rules Control
Board (FRCB), and Crew Procedures Control
Board (CPCB) processes will keep the Shuttle
Ops community apprised of vehicle impacts to
flight operations and associated documentation.
The
SCOM
update
effort
(including
configuration control) will be performed by the
SCOM Development Team and led by the
SCOM Book Manager.
Astronaut Office
participation in the SCOM update effort will be
coordinated per the SCOM Development Task
specified in the Training Operations Handbook.

There are a multitude of documents delineating

the organization and operation of the space
shuttle program (SSP). The following charts
depict the SSP organization, major program
documents (NSTS 07700) and associated
processes. Each major process will have a
significant collection of associated publications.
Several hundred of these documents have been
utilized in the development of the SCOM.

PREFACE

ii

iii

USA007587
Rev. A

PREFACE

USA007587
Rev. A

PREFACE

iv

USA007587
Rev. A

Program
Requirements
Control Board

NSTS 07700
Volume I

Joint PRCB

ISS

Volume II
Directives

Volume VIII
Operations

Volume X
Specifications

Other
Volumes

Vehicle/Center
Interfaces

Flight
Techniques

Vehicle
Characteristics

Flight Definition
Requirements

Flight Software

Flight Rules

Runway
Characteristics

Configuration
Management

Processing
Facilities

Payload
Accommodations

Operability and
QA

Flight Support
Equipment

Flight
Operations
Vehicle
Maintenance
Mission
Management

Crew
Procedures
Flight
Procedures
Training

Integrated
Logistics

Flight
Readiness

PREFACE

USA007587
Rev. A

This page intentionally left blank

PREFACE

vi

USA007587
Rev. A

CONTENTS
Section

Page

PREFACE .................................................................................................................................................

Configuration Control Plan ...................................................................................................................

Program Documentation........................................................................................................................

ii
ii

1.

GENERAL DESCRIPTION...........................................................................................................

1-1

OVERVIEW..................................................................................................................................

1.1-1

Space Shuttle Requirements ..................................................................................................................

Nominal Mission Profile ........................................................................................................................
Launch and Landing Sites .....................................................................................................................
Orbiter Ground Turnaround .................................................................................................................
Space Shuttle Coordinate Reference System .......................................................................................
Location Codes ........................................................................................................................................

1.1-1
1.1-2
1.1-5
1.1-6
1.1-7
1.1-8

1.2

ORBITER STRUCTURE ............................................................................................................

1.2-1

Forward Fuselage....................................................................................................................................
Crew Compartment ................................................................................................................................
Forward Fuselage and Crew Compartment Windows......................................................................
Wing .........................................................................................................................................................
Midfuselage .............................................................................................................................................
Aft Fuselage .............................................................................................................................................
Orbital Maneuvering System/Reaction Control System (OMS/RCS) Pods ..................................
Body Flap .................................................................................................................................................
Vertical Tail..............................................................................................................................................
Orbiter Passive Thermal Control ..........................................................................................................
Thermal Protection System....................................................................................................................

1.2-1
1.2-3
1.2-6
1.2-7
1.2-9
1.2-10
1.2-11
1.2-12
1.2-13
1.2-14
1.2-15

1.1

1.3

EXTERNAL TANK......................................................................................................................

1.3-1

Liquid Oxygen Tank...............................................................................................................................

Intertank ...................................................................................................................................................
Liquid Hydrogen Tank ..........................................................................................................................
Thermal Protection System....................................................................................................................
Hardware and Instrumentation ............................................................................................................

1.3-2
1.3-2
1.3-3
1.3-3
1.3-3

1.4

SOLID ROCKET BOOSTERS ..................................................................................................

1.4-1

Hold-Down Posts....................................................................................................................................
SRB Ignition .............................................................................................................................................
Electrical Power Distribution ................................................................................................................
Hydraulic Power Units ..........................................................................................................................
Thrust Vector Control.............................................................................................................................
SRB Rate Gyro Assemblies ....................................................................................................................
SRB Separation ........................................................................................................................................
Range Safety System...............................................................................................................................
SRB Descent and Recovery ....................................................................................................................

1.4-3
1.4-4
1.4-5
1.4-5
1.4-6
1.4-6
1.4-7
1.4-7
1.4-8

vii

CONTENTS

USA007587
Rev. A
Section
2.

Page

SYSTEMS.........................................................................................................................................

2-1

AUXILIARY POWER UNIT/ HYDRAULICS (APU/HYD) .................................................

2.1-1

Description ..............................................................................................................................................
Fuel System..............................................................................................................................................
Gas Generator and Turbine...................................................................................................................
Lubricating Oil ........................................................................................................................................
Electronic Controller ..............................................................................................................................
Injector Cooling System .........................................................................................................................
APU Heaters............................................................................................................................................
Water Spray Boilers................................................................................................................................
Main Hydraulic Pump ...........................................................................................................................
Hydraulic Reservoir ...............................................................................................................................
Hydraulic Accumulator.........................................................................................................................
Circulation Pump and Heat Exchanger...............................................................................................
Hydraulic Heaters ..................................................................................................................................
Operations ...............................................................................................................................................
APU/HYD Caution and Warning Summary .....................................................................................
APU/HYD Summary Data ...................................................................................................................
APU/HYD Rules of Thumb..................................................................................................................

2.1-1
2.1-2
2.1-5
2.1-5
2.1-6
2.1-11
2.1-12
2.1-13
2.1-17
2.1-20
2.1-20
2.1-20
2.1-22
2.1-22
2.1-24
2.1-25
2.1-25

2.1

2.2

CAUTION AND WARNING SYSTEM (C/W)......................................................................

2.2-1

Description ..............................................................................................................................................
Alarms ......................................................................................................................................................
Smoke Detection and Fire Suppression...............................................................................................
Rapid Cabin Depressurization..............................................................................................................
Operations ...............................................................................................................................................
SPEC 60, SM Table Maintenance ..........................................................................................................
C/W Summary Data ..............................................................................................................................
C/W Rules of Thumb.............................................................................................................................
F7 Light Summary ..................................................................................................................................
Fault Message Table ...............................................................................................................................

2.2-1
2.2-2
2.2-5
2.2-11
2.2-12
2.2-15
2.2-19
2.2-19
2.2-20
2.2-23

CLOSED CIRCUIT TELEVISION (CCTV) ...........................................................................

2.3-1

Description ..............................................................................................................................................
CCTV Cameras........................................................................................................................................
Video Processing Equipment................................................................................................................
CCTV Camera Lens Control .................................................................................................................
Pan/Tilt Units .........................................................................................................................................
Cabin Cameras ........................................................................................................................................
VTRs ........................................................................................................................................................
Monitors...................................................................................................................................................
TV Cue Card............................................................................................................................................
Orbiter Boom Sensor System (OBSS) ...................................................................................................
CCTV System Summary ........................................................................................................................

2.3-1
2.3-2
2.3-6
2.3-10
2.3-11
2.3-11
2.3-13
2.3-14
2.3-16
2.3-19
2.3-21

2.3

CONTENTS

viii

USA007587
Rev. A
Section

Page

2.4

COMMUNICATIONS ...............................................................................................................

2.4-1

Description...............................................................................................................................................
S-Band Phase Modulation......................................................................................................................
S-Band Frequency Modulation .............................................................................................................
Ku-Band System......................................................................................................................................
Payload Communication System..........................................................................................................
Ultrahigh Frequency System .................................................................................................................
Audio Distribution System ....................................................................................................................
Instrumentation.......................................................................................................................................
Communications System Summary .....................................................................................................
Communications System Rules of Thumb ..........................................................................................

2.4-1
2.4-2
2.4-10
2.4-13
2.4-21
2.4-23
2.4-27
2.4-38
2.4-42
2.4-49

2.5

CREW SYSTEMS ........................................................................................................................

2.5-1

Description...............................................................................................................................................
Crew Clothing/Worn Equipment ........................................................................................................
Personal Hygiene Provisions.................................................................................................................
Sleeping Provisions.................................................................................................................................
Exercise Equipment ................................................................................................................................
Housekeeping Equipment .....................................................................................................................
Restraints and Mobility Aids.................................................................................................................
Stowage Containers ................................................................................................................................
Reach and Visibility Aids.......................................................................................................................
Photographic Equipment .......................................................................................................................
Sighting Aids ...........................................................................................................................................
Window Shades and Filters...................................................................................................................
Shuttle Orbiter Medical System ............................................................................................................
Operational Bioinstrumentation System .............................................................................................
Radiation Equipment..............................................................................................................................
Air Sampling System ..............................................................................................................................

2.5-1
2.5-1
2.5-1
2.5-1
2.5-4
2.5-4
2.5-5
2.5-5
2.5-5
2.5-8
2.5-9
2.5-9
2.5-10
2.5-12
2.5-14
2.5-15

2.6

DATA PROCESSING SYSTEM (DPS) ...................................................................................

2.6-1

Description...............................................................................................................................................
General Purpose Computers (GPCs)....................................................................................................
Data Bus Network...................................................................................................................................
Multiplexers/Demultiplexers (MDMs) ...............................................................................................
Modular Memory Units .........................................................................................................................
Multifunction Electronic Display System (MEDS) .............................................................................
Master Timing Unit.................................................................................................................................
Software....................................................................................................................................................
MEDS ........................................................................................................................................................
Operations................................................................................................................................................
MDU Configuration................................................................................................................................
DPS Summary Data ................................................................................................................................
DPS Rules of Thumb...............................................................................................................................

2.6-1
2.6-2
2.6-7
2.6-11
2.6-12
2.6-13
2.6-16
2.6-20
2.6-25
2.6-30
2.6-31
2.6-53
2.6-57

ix

CONTENTS

USA007587
Rev. A
Section

Page

2.7

DEDICATED DISPLAY SYSTEMS ........................................................................................

2.7-1

Description ..............................................................................................................................................
Device Driver Unit..................................................................................................................................
Primary Flight Display (PFD) ...............................................................................................................
Attitude Director Indicator (ADI) ........................................................................................................
Horizontal Situation Indicator (HSI) ...................................................................................................
Flight Instrument Tapes.........................................................................................................................
PFD Status Indicators.............................................................................................................................
Surface Position Indicator (SPI) ............................................................................................................
Flight Control System Pushbutton Indicators ....................................................................................
Reaction Control System Command Lights..........................................................................................
Head-Up Display (HUD).......................................................................................................................
Dedicated Display Systems Summary Data .......................................................................................

2.7-1
2.7-2
2.7-3
2.7-3
2.7-8
2.7-14
2.7-16
2.7-17
2.7-19
2.7-19
2.7-21
2.7-25

2.8

ELECTRICAL POWER SYSTEM (EPS) ..................................................................................

2.8-1

Description ..............................................................................................................................................
Power Reactants Storage and Distribution System............................................................................
Fuel Cell System......................................................................................................................................
Electrical Power Distribution and Control..........................................................................................
APCU and SSPTS....................................................................................................................................
Operations ...............................................................................................................................................
EPS Caution and Warning Summary ..................................................................................................
EPS Summary Data ................................................................................................................................
EPS Rules of Thumb...............................................................................................................................

2.8-1
2.8-1
2.8-9
2.8-20
2.8-33
2.8-37
2.8-39
2.8-46
2.8-46

2.9

ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM (ECLSS) ..................

2.9-1

Description ..............................................................................................................................................
Pressure Control System........................................................................................................................
Atmospheric Revitalization System.....................................................................................................
Active Thermal Control System ...........................................................................................................
Supply and Waste Water Systems........................................................................................................
Operations ...............................................................................................................................................
ECLSS Caution and Warning Summary .............................................................................................
ECLSS Summary Data ...........................................................................................................................
ECLSS Rules of Thumb..........................................................................................................................

2.9-1
2.9-4
2.9-13
2.9-24
2.9-37
2.9-47
2.9-50
2.9-51
2.9-63

2.10 ESCAPE SYSTEMS .................................................................................................................... 2.10-1

Description .............................................................................................................................................. 2.10-1
Launch Pad Egress Systems .................................................................................................................. 2.10-1
Advanced Crew Escape Suit ................................................................................................................. 2.10-4
Parachute Harness and Parachute ....................................................................................................... 2.10-6
Cabin Vent and Side Hatch Jettison ..................................................................................................... 2.10-12
Egress Pole System ................................................................................................................................. 2.10-13
Emergency Egress Slide......................................................................................................................... 2.10-13
Overhead Escape Panel.......................................................................................................................... 2.10-18
Procedures for Bailout, Water Survival, and Rescue......................................................................... 2.10-18
Vehicle Loss of Control/Breakup......................................................................................................... 2.10-21
Escape Systems Summary Data............................................................................................................ 2.10-22

CONTENTS

USA007587
Rev. A
Section

Page

2.11 EXTRAVEHICULAR ACTIVITY (EVA)................................................................................. 2.11-1

EVA Overview......................................................................................................................................... 2.11-1
Extravehicular Mobility Unit................................................................................................................. 2.11-2
External Airlock....................................................................................................................................... 2.11-9
EVA Support Equipment ....................................................................................................................... 2.11-14
Simplified Aid for EVA Rescue............................................................................................................. 2.11-16
Operations................................................................................................................................................ 2.11-17
EVA Summary Data ............................................................................................................................... 2.11-21
EVA Rules of Thumb.............................................................................................................................. 2.11-21
2.12 GALLEY/FOOD........................................................................................................................... 2.12-1
Description...............................................................................................................................................
Galley........................................................................................................................................................
Volume A - Pantry ..................................................................................................................................
Food System Accessories .......................................................................................................................

2.12-1
2.12-1
2.12-3
2.12-4

2.13 GUIDANCE, NAVIGATION, AND CONTROL (GNC)..................................................... 2.13-1

Description............................................................................................................................................... 2.13-1
Navigation Hardware ............................................................................................................................ 2.13-5
Flight Control System Hardware.......................................................................................................... 2.13-27
Digital Autopilot ..................................................................................................................................... 2.13-49
Operations................................................................................................................................................ 2.13-56
GNC Caution and Warning Summary................................................................................................. 2.13-65
GNC Summary Data............................................................................................................................... 2.13-66
GNC Rules of Thumb ............................................................................................................................. 2.13-74
2.14 LANDING/DECELERATION SYSTEM................................................................................. 2.14-1
Description............................................................................................................................................... 2.14-1
Landing Gear ........................................................................................................................................... 2.14-1
Drag Chute............................................................................................................................................... 2.14-4
Main Landing Gear Brakes .................................................................................................................... 2.14-5
Nose Wheel Steering............................................................................................................................... 2.14-9
Operations................................................................................................................................................ 2.14-10
Landing/Deceleration System Summary Data................................................................................... 2.14-17
Landing/Deceleration System Rules of Thumb ................................................................................. 2.14-17
2.15 LIGHTING SYSTEM.................................................................................................................. 2.15-1
Description............................................................................................................................................... 2.15-1
Interior Lighting ...................................................................................................................................... 2.15-1
Exterior Lighting ..................................................................................................................................... 2.15-14
Lighting System Summary Data ........................................................................................................... 2.15-16
Lighting System Rules of Thumb ......................................................................................................... 2.15-16

xi

CONTENTS

USA007587
Rev. A
Section

Page

2.16 MAIN PROPULSION SYSTEM (MPS) .................................................................................. 2.16-1

Description .............................................................................................................................................. 2.16-1
Space Shuttle Main Engines (SSMEs) .................................................................................................. 2.16-3
Space Shuttle Main Engine Controllers ............................................................................................... 2.16-9
Propellant Management System (PMS)............................................................................................... 2.16-14
Helium System........................................................................................................................................ 2.16-20
MPS Hydraulic Systems ........................................................................................................................ 2.16-24
Malfunction Detection ........................................................................................................................... 2.16-26
Operations ............................................................................................................................................... 2.16-28
Post Insertion........................................................................................................................................... 2.16-35
Orbit ........................................................................................................................................................ 2.16-35
Deorbit Prep ............................................................................................................................................ 2.16-35
Entry ........................................................................................................................................................ 2.16-35
RTLS Abort Propellant Dump Sequence............................................................................................. 2.16-36
TAL Abort Propellant Dump Sequence .............................................................................................. 2.16-36
MPS Caution and Warning Summary ................................................................................................. 2.16-37
MPS Summary Data ............................................................................................................................... 2.16-39
MPS Rules of Thumb.............................................................................................................................. 2.16-42
2.17 MECHANICAL SYSTEMS ....................................................................................................... 2.17-1
Description .............................................................................................................................................. 2.17-1
Active Vent System ................................................................................................................................ 2.17-3
External Tank Umbilical Doors ............................................................................................................ 2.17-5
Payload Bay Door System ..................................................................................................................... 2.17-9
Mechanical Systems Summary Data.................................................................................................... 2.17-18
Mechanical Systems Rules of Thumb .................................................................................................. 2.17-22
2.18 ORBITAL MANEUVERING SYSTEM (OMS) ..................................................................... 2.18-1
Description .............................................................................................................................................. 2.18-1
Engines ..................................................................................................................................................... 2.18-3
Helium System........................................................................................................................................ 2.18-9
Propellant Storage and Distribution .................................................................................................... 2.18-12
Thermal Control...................................................................................................................................... 2.18-19
Thrust Vector Control (TVC) ................................................................................................................ 2.18-20
Fault Detection and Identification........................................................................................................ 2.18-22
Operations ............................................................................................................................................... 2.18-23
OMS Caution and Warning Summary ................................................................................................ 2.18-24
OMS Summary Data .............................................................................................................................. 2.18-31
OMS Rules of Thumb............................................................................................................................. 2.18-31
2.19 ORBITER DOCKING SYSTEM .............................................................................................. 2.19-1
Description ..............................................................................................................................................
External Airlock ......................................................................................................................................
Truss Assembly.......................................................................................................................................
Androgynous Peripheral Docking System .........................................................................................
APDS Avionics Overview .....................................................................................................................
APDS Operational Sequences (OPS)....................................................................................................
Operational Notes of Interest................................................................................................................

CONTENTS

xii

2.19-1
2.19-2
2.19-2
2.19-2
2.19-2
2.19-6
2.19-8

USA007587
Rev. A
Section

Page

2.20 PAYLOAD AND GENERAL SUPPORT COMPUTER........................................................ 2.20-1

Description............................................................................................................................................... 2.20-1
Equipment................................................................................................................................................ 2.20-2
2.21 PAYLOAD DEPLOYMENT AND RETRIEVAL SYSTEM (PDRS)................................... 2.21-1
Description............................................................................................................................................... 2.21-1
Remote Manipulator System ................................................................................................................. 2.21-1
Manipulator Positioning Mechanism................................................................................................... 2.21-12
Payload Retention Mechanisms............................................................................................................ 2.21-16
Operations................................................................................................................................................ 2.21-19
PDRS Caution and Warning Summary ............................................................................................... 2.21-24
PDRS Summary Data ............................................................................................................................. 2.21-25
PDRS Rules of Thumb ............................................................................................................................ 2.21-29
2.22 REACTION CONTROL SYSTEM (RCS) ............................................................................... 2.22-1
Description............................................................................................................................................... 2.22-1
Jet System ................................................................................................................................................. 2.22-3
Propellant System ................................................................................................................................... 2.22-4
Helium System ........................................................................................................................................ 2.22-9
Thermal Control ...................................................................................................................................... 2.22-11
RCS Redundancy Management ............................................................................................................ 2.22-12
Operations................................................................................................................................................ 2.22-17
RCS Caution and Warning Summary .................................................................................................. 2.22-19
RCS Summary Data ................................................................................................................................ 2.22-26
RCS Rules of Thumb............................................................................................................................... 2.22-26
2.23 SPACEHAB .................................................................................................................................. 2.23-1
Description...............................................................................................................................................
Configurations.........................................................................................................................................
Flight Deck Interfaces .............................................................................................................................
Command and Data Subsystem............................................................................................................
Caution and Warning .............................................................................................................................
Electrical Power Subsystem...................................................................................................................
Environmental Control Subsystem.......................................................................................................
Audio Communication Subsystem.......................................................................................................
Fire Suppression Subsystem..................................................................................................................
Closed Circuit Television Subsystem...................................................................................................

2.23-1
2.23-1
2.23-2
2.23-2
2.23-2
2.23-2
2.23-3
2.23-3
2.23-3
2.23-3

2.24 STOWAGE ................................................................................................................................... 2.24-1

Description...............................................................................................................................................
Rigid Containers......................................................................................................................................
Flexible Containers .................................................................................................................................
Middeck Accommodations Rack ..........................................................................................................

2.24-1
2.24-1
2.24-4
2.24-6

2.25 WASTE MANAGEMENT SYSTEM (WMS).......................................................................... 2.25-1

Description............................................................................................................................................... 2.25-1
Operations................................................................................................................................................ 2.25-4

xiii

CONTENTS

USA007587
Rev. A
Section
3.

Page

FLIGHT DATA FILE......................................................................................................................

3-1

CONTROL DOCUMENTS .......................................................................................................

3.1-1

Ascent Checklist......................................................................................................................................
Post Insertion Book.................................................................................................................................
Flight Plan................................................................................................................................................
Deorbit Preparation Book......................................................................................................................
Entry Checklist........................................................................................................................................

3.1-1
3.1-1
3.1-1
3.1-1
3.1-2

3.2

SUPPORT DOCUMENTS ........................................................................................................

3.2-1

Orbit Operations Checklist....................................................................................................................

Photo/TV Checklist................................................................................................................................
Payload Deployment and Retrieval System Operations Checklist .................................................
Extravehicular Activity Checklists.......................................................................................................
Rendezvous Checklist............................................................................................................................
Payload Operations Checklist...............................................................................................................
Deploy Checklist.....................................................................................................................................
Additional Support Documents ...........................................................................................................

3.2-1
3.2-1
3.2-1
3.2-1
3.2-1
3.2-2
3.2-2
3.2-2

3.3

OFF-NOMINAL DOCUMENTS..............................................................................................

3.3-1

Pocket Checklists ....................................................................................................................................

Ascent/Entry Systems Procedures Book.............................................................................................
Systems Abort Once Around Book ......................................................................................................
Malfunction Procedures Book ..............................................................................................................
In-Flight Maintenance Checklist...........................................................................................................
Payload Systems Data and Malfunction Procedures Book...............................................................
Medical Checklist ...................................................................................................................................
Contingency Deorbit Preparation Book ..............................................................................................

3.3-1
3.3-1
3.3-1
3.3-1
3.3-1
3.3-1
3.3-2
3.3-2

3.4

REFERENCE DOCUMENTS....................................................................................................

3.4-1

Reference Data Book ..............................................................................................................................

Systems Data Book .................................................................................................................................
Data Processing System Dictionary .....................................................................................................
Payload Systems Data/Malfunction Book..........................................................................................
Maps and Charts Book...........................................................................................................................

3.4-1
3.4-1
3.4-1
3.4-1
3.4-1

3.5

OPERATIONAL USE.................................................................................................................

3.5-1

FDF Fabrication.......................................................................................................................................
Preliminaries ...........................................................................................................................................
Basic ........................................................................................................................................................
482 ........................................................................................................................................................
Final ........................................................................................................................................................
Flight ........................................................................................................................................................

3.5-1
3.5-1
3.5-1
3.5-2
3.5-3
3.5-3

3.1

CONTENTS

xiv

USA007587
Rev. A
Section
4.
4.1

Page

OPERATING LIMITATIONS......................................................................................................

4-1

INSTRUMENT MARKINGS....................................................................................................

4.1-1

Description............................................................................................................................................... 4.1-1
Panel F9 Meters ....................................................................................................................................... 4.1-5
Panel O1 Meters ...................................................................................................................................... 4.1-6
Panel O2 Meters ...................................................................................................................................... 4.1-9
Panel O3 Meters ...................................................................................................................................... 4.1-11
4.2

ENGINE LIMITATIONS...........................................................................................................

4.2-1

Space Shuttle Main Engines (SSMEs)...................................................................................................

Orbital Maneuvering System (OMS) Engines.....................................................................................
Reaction Control System (RCS) Jets .....................................................................................................

4.2-1
4.2-2
4.2-3

4.3

AIRSPEED LIMITATIONS ......................................................................................................

4.3-1

Ascent .......................................................................................................................................................
Entry .........................................................................................................................................................
Landing.....................................................................................................................................................

4.3-1
4.3-1
4.3-2

4.4

ANGLE OF ATTACK LIMITATIONS ...................................................................................

4.4-1

Entry .........................................................................................................................................................

4.4-1

4.5

SIDESLIP LIMITATIONS ........................................................................................................

4.5-1

4.6

LANDING WEIGHT LIMITATIONS.....................................................................................

4.6-1

Maximum Landing Weight ...................................................................................................................

4.6-1

4.7

DESCENT RATE LIMITATIONS............................................................................................

4.7-1

Main Gear Touchdown ..........................................................................................................................

Nose Gear Touchdown...........................................................................................................................

4.7-1
4.7-1

4.8

CENTER OF GRAVITY LIMITATIONS................................................................................

4.8-1

4.9

ACCELERATION LIMITATIONS ..........................................................................................

4.9-1

Ascent .......................................................................................................................................................
Entry .........................................................................................................................................................
Vn Diagrams ............................................................................................................................................

4.9-1
4.9-1
4.9-1

4.10 WEATHER LIMITATIONS ...................................................................................................... 4.10-1

5.

NORMAL PROCEDURES SUMMARY ...................................................................................

5-1

PRELAUNCH...............................................................................................................................

5.1-1

Prelaunch Procedures.............................................................................................................................

5.1-1

5.2

ASCENT........................................................................................................................................

5.2-1

Powered Flight ........................................................................................................................................

OMS Burns ...............................................................................................................................................
Post Insertion ...........................................................................................................................................

5.2-1
5.2-3
5.2-5

5.1

xv

CONTENTS

USA007587
Rev. A
Section

Page

5.3

ORBIT ...........................................................................................................................................

5.3-1

Orbit Operations .....................................................................................................................................

OMS (RCS) Burns ...................................................................................................................................
Rendezvous .............................................................................................................................................
Last Full On-Orbit Day ..........................................................................................................................

5.3-1
5.3-4
5.3-4
5.3-8

5.4

ENTRY ..........................................................................................................................................

5.4-1

Deorbit Preparation................................................................................................................................
Deorbit Burn............................................................................................................................................
Entry Interface.........................................................................................................................................
Terminal Area Energy Management (TAEM) ....................................................................................
Approach and Landing..........................................................................................................................

5.4-1
5.4-3
5.4-5
5.4-6
5.4-7

5.5

POSTLANDING .........................................................................................................................

5.5-1

EMERGENCY PROCEDURES ....................................................................................................

6-1

LAUNCH ABORT MODES AND RATIONALE .................................................................

6.1-1

Mode 1 Unaided Egress/Escape .......................................................................................................

Mode 2 Aided Escape..........................................................................................................................
Mode 3 Aided Escape..........................................................................................................................
Mode 4 Aided Escape..........................................................................................................................

6.1-1
6.1-1
6.1-2
6.1-2

6.2

ASCENT ABORTS .....................................................................................................................

6.2-1

Performance Aborts................................................................................................................................
Systems Aborts........................................................................................................................................
Range Safety ............................................................................................................................................

6.2-1
6.2-4
6.2-4

6.3

RETURN TO LAUNCH SITE...................................................................................................

6.3-1

Powered RTLS.........................................................................................................................................
Gliding RTLS...........................................................................................................................................

6.3-2
6.3-6

6.4

TRANSOCEANIC ABORT LANDING .................................................................................

6.4-1

Nominal Transoceanic Abort Landing ................................................................................................

Post MECO Transoceanic Abort Landing ...........................................................................................

6.4-1
6.4-3

6.5

ABORT ONCE AROUND.........................................................................................................

6.5-1

OMS-1.......................................................................................................................................................
OMS-2.......................................................................................................................................................
Entry ........................................................................................................................................................

6.5-1
6.5-3
6.5-4

6.6

ABORT TO ORBIT.....................................................................................................................

6.6-1

Powered Flight........................................................................................................................................
OMS-1.......................................................................................................................................................
OMS-2.......................................................................................................................................................

6.6-1
6.6-1
6.6-1

6.7

CONTINGENCY ABORT .........................................................................................................

6.7-1

Powered Flight........................................................................................................................................
Three-Engine-Out Automation.............................................................................................................
ET Separation ..........................................................................................................................................
Entry ........................................................................................................................................................

6.7-1
6.7-2
6.7-2
6.7-3

6.
6.1

CONTENTS

xvi

USA007587
Rev. A
Section

Page

6.8

SYSTEMS FAILURES ................................................................................................................

6.8-1

APU/Hydraulics.....................................................................................................................................
Communications .....................................................................................................................................
Cryo .........................................................................................................................................................
Data Processing System .........................................................................................................................
Environmental Control and Life Support System ..............................................................................
Electrical Power System .........................................................................................................................
Guidance, Navigation, and Control .....................................................................................................
Mechanical ...............................................................................................................................................
Main Propulsion System ........................................................................................................................
Orbital Maneuvering System/Reaction Control System...................................................................

6.8-2
6.8-5
6.8-6
6.8-6
6.8-8
6.8-9
6.8-12
6.8-12
6.8-12
6.8-14

6.9

MULTIPLE FAILURE SCENARIOS........................................................................................

6.9-1

MPS He Leak with APC/ALC Failure.................................................................................................

Set Splits During Ascent.........................................................................................................................
Stuck Throttle in the Bucket...................................................................................................................
Second Hydraulic Failure and 1 SSME Failed ....................................................................................
Two APUs/Hydraulic Systems ............................................................................................................
APU 1 and Multiple Prox Box Failures................................................................................................
Two Freon/Water Loops .......................................................................................................................
Total Loss of FES .....................................................................................................................................
Total Loss of FES with BFS Failure.......................................................................................................
Two Fuel Cells .........................................................................................................................................
Both OMS Engines ..................................................................................................................................
OMS/RCS Leak with DPS/EPS Failures.............................................................................................
Cryo Leak with Failed Manifold Valve................................................................................................
BFS Self Engage .......................................................................................................................................

6.9-1
6.9-1
6.9-1
6.9-1
6.9-1
6.9-2
6.9-2
6.9-2
6.9-2
6.9-2
6.9-2
6.9-2
6.9-3
6.9-3

6.10 SWITCH AND PANEL CAUTIONS ....................................................................................... 6.10-1

MPS Switches...........................................................................................................................................
Fuel Cell Reactant Valves.......................................................................................................................
IDP/CRT Power Switch .........................................................................................................................
GPC/MDM ..............................................................................................................................................
PLB Mech Power/Enable.......................................................................................................................
HYD Press and APU Controller Power Switches...............................................................................
OMS Kit ....................................................................................................................................................

6.10-1
6.10-1
6.10-1
6.10-1
6.10-1
6.10-1
6.10-1

6.11 SYSTEMS FAILURE SUMMARY............................................................................................ 6.11-1

7.
7.1

TRAJECTORY MANAGEMENT AND FLIGHT CHARACTERISTICS .............................

7-1

ASCENT........................................................................................................................................

7.1-1

Powered Flight ........................................................................................................................................ 7.1-1

Insertion OMS Burns .............................................................................................................................. 7.1-8
Backup Flight System ............................................................................................................................. 7.1-9
Sensory Cues............................................................................................................................................ 7.1-10
Ascent Rules of Thumb .......................................................................................................................... 7.1-12

xvii

CONTENTS

USA007587
Rev. A
Section

Page

7.2

7.2-1

ORBIT ...........................................................................................................................................

Attitude Control...................................................................................................................................... 7.2-1

Translation............................................................................................................................................... 7.2-5
Rendezvous/Proximity Operations..................................................................................................... 7.2-6
Orbit Rules of Thumb ............................................................................................................................ 7.2-12
7.3

ENTRY ..........................................................................................................................................

7.3-1

Overview of Entry Flying Tasks...........................................................................................................

Deorbit Burn............................................................................................................................................
Entry ........................................................................................................................................................
Backup Flight System.............................................................................................................................
Sensory Cues ...........................................................................................................................................
Ground Controlled Approach ..............................................................................................................
Entry Rules of Thumb ............................................................................................................................

7.3-1
7.3-1
7.3-4
7.3-12
7.3-12
7.3-13
7.3-14

7.4

TERMINAL AREA ENERGY MANAGEMENT AND APPROACH,

LANDING, AND ROLLOUT (OPS 305) ................................................................................

7.4-1

Definition and Overview.......................................................................................................................

Terminal Area Energy Management ...................................................................................................
Heading Alignment Cone .....................................................................................................................
Outer Glideslope.....................................................................................................................................
Preflare .....................................................................................................................................................
Inner Glideslope......................................................................................................................................
Touchdown..............................................................................................................................................
Derotation ................................................................................................................................................
Rollout......................................................................................................................................................
Handling Qualities .................................................................................................................................
Wind Effects on Trajectory ....................................................................................................................
Backup Flight System.............................................................................................................................
Off-Nominal Approaches ......................................................................................................................
Sensory Cues ...........................................................................................................................................
Autoland ..................................................................................................................................................
Terminal Area Energy Management and Approach, Landing, and Rollout Rules of Thumb ....

7.4-1
7.4-1
7.4-8
7.4-9
7.4-14
7.4-15
7.4-16
7.4-18
7.4-19
7.4-20
7.4-22
7.4-23
7.4-24
7.4-25
7.4-25
7.4-28

8.

INTEGRATED OPERATIONS....................................................................................................

8-1

FLIGHT CREW DUTIES AND COORDINATION.............................................................

8.1-1

Dynamic Flight Phases...........................................................................................................................

Orbit Phase ..............................................................................................................................................
Intercom Protocol ...................................................................................................................................

8.1-1
8.1-1
8.1-2

8.2

WORKING WITH MISSION CONTROL.............................................................................

8.2-1

MCC Resources.......................................................................................................................................
Operations Monitoring and Control ....................................................................................................
Air-to-Ground Voice Communications ...............................................................................................
Telemetry Uplink....................................................................................................................................

8.2-1
8.2-1
8.2-2
8.2-3

8.3

PRELAUNCH ..............................................................................................................................

8.3-1

Flight Crew ..............................................................................................................................................

Mission Control Center..........................................................................................................................
Launch Control Center ..........................................................................................................................

8.3-1
8.3-1
8.3-1

8.1

CONTENTS

xviii

USA007587
Rev. A
Section

Page

8.4

LAUNCH ......................................................................................................................................

8.4-1

Flight Crew ..............................................................................................................................................

Mission Control Center ..........................................................................................................................
Launch Control Center...........................................................................................................................

8.4-1
8.4-2
8.4-2

8.5

ASCENT........................................................................................................................................

8.5-1

Flight Crew ..............................................................................................................................................

Mission Control Center ..........................................................................................................................

8.5-1
8.5-1

8.6

ORBIT ...........................................................................................................................................

8.6-1

Flight Crew ..............................................................................................................................................

Mission Control Center ..........................................................................................................................

8.6-1
8.6-1

8.7

ENTRY...........................................................................................................................................

8.7-1

Flight Crew ..............................................................................................................................................

Mission Control Center ..........................................................................................................................

8.7-1
8.7-1

8.8

POSTLANDING .........................................................................................................................

8.8-1

Flight Crew ..............................................................................................................................................

Mission Control Center ..........................................................................................................................
Launch Control Center...........................................................................................................................

8.8-1
8.8-1
8.8-1

9.

PERFORMANCE ............................................................................................................................

9-1

ASCENT........................................................................................................................................

9.1-1

Payload .....................................................................................................................................................
Launch Window......................................................................................................................................
Squatcheloids...........................................................................................................................................
Main Engines ...........................................................................................................................................
Altitude, Velocity, and Dynamic Pressure ..........................................................................................
MECO Targets .........................................................................................................................................
ET Impact .................................................................................................................................................
Abort Mode Boundaries.........................................................................................................................
Minimum Safe Orbit...............................................................................................................................

9.1-1
9.1-2
9.1-3
9.1-5
9.1-5
9.1-8
9.1-8
9.1-9
9.1-9

9.2

ORBIT ...........................................................................................................................................

9.2-1

Drag .........................................................................................................................................................
Period........................................................................................................................................................
Perturbations ...........................................................................................................................................
OMS/RCS ................................................................................................................................................

9.2-1
9.2-1
9.2-1
9.2-2

9.3

9.3-1

9.1

ENTRY (OPS 304)........................................................................................................................

Downrange/Crossrange ........................................................................................................................ 9.3-1

Trajectory.................................................................................................................................................. 9.3-2
Entry History ........................................................................................................................................... 9.3-2
Entry RCS Use Data ................................................................................................................................ 9.3-2
Rollout/Braking ...................................................................................................................................... 9.3-6
Loss of Braking ........................................................................................................................................ 9.3-6
Rollout History ........................................................................................................................................ 9.3-6
Performance Rules of Thumb................................................................................................................ 9.3-12
xix

CONTENTS

USA007587
Rev. A
Section

Page

Appendix
A

PANEL DIAGRAMS .....................................................................................................................

A-1

DISPLAYS AND CONTROLS.....................................................................................................

B-1

STUDY NOTES...............................................................................................................................

C-1

D RULES OF THUMB .......................................................................................................................

D-1

OI UPDATES...................................................................................................................................

E-1

INDEX...............................................................................................................................................

I-1

CONTENTS

xx

USA007587
Rev. A

1.

GENERAL DESCRIPTION

CONTENTS
1.1
1.2
1.3
1.4

OVERVIEW ...................................... 1.1-1

ORBITER STRUCTURE.................. 1.2-1
EXTERNAL TANK.......................... 1.3-1
SOLID ROCKET BOOSTERS......... 1.4-1

The section provides general background

information about the orbiter, its configuration
and coordinate systems, the nominal mission
profile, and general procedures followed
during a shuttle mission. It also briefly
discusses components, such as the external tank
and solid rocket, that are not included in the
next section on orbiter systems.

1-1

1. GENERAL DESCRIPTION

USA007587
Rev. A

This page intentionally left blank

1. GENERAL DESCRIPTION

1-2

USA007587
Rev. A

1.1

Space Shuttle Requirements

OVERVIEW

CONTENTS
Space Shuttle Requirements ................1.1-1
Nominal Mission Profile ......................1.1-2
Launch and Landing Sites ...................1.1-5
Orbiter Ground Turnaround ...............1.1-6
Space Shuttle Coordinate
Reference System........................1.1-7
Location Codes ......................................1.1-8

The space shuttle system consists of four

primary elements: an orbiter spacecraft, two
solid rocket boosters (SRBs), an external tank
(ET) to house fuel and oxidizer, and three space
shuttle main engines (SSMEs). The shuttle can
transport payloads into near Earth orbit 100 to
312 nm above the Earth. Payloads are carried in
a bay 15 feet in diameter and 60 feet long.
Major system requirements are that the orbiter
and the two SRBs be reusable.
The orbiter has carried a flight crew of up to
eight persons. The nominal mission is 4 to 16
days in space. The crew compartment has a
shirtsleeve environment, and the acceleration
load is never greater than 3 gs. In its return to
Earth, the orbiter has a crossrange maneuvering
capability of about 1,100 nm

Space Shuttle Statistics

1.1-1

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Nominal Mission Profile

Launch
In the launch configuration, the orbiter and two
SRBs are attached to the ET in a vertical (noseup) position on the launch pad. Each SRB is
attached at its aft skirt to the mobile launcher
platform by four bolts.

orbiter away from the ET at separation, and

maneuver the orbiter to burn attitude prior to
the orbital maneuvering system (OMS) burn.
The ET continues on a ballistic trajectory and
enters the atmosphere, where it disintegrates.
Its nominal impact is in the Indian Ocean for a
28 inclination launch.
Orbit Insertion and Circularization

The three SSMEs, fed liquid hydrogen fuel and

liquid oxygen oxidizer from the ET, are ignited
first. When it has been verified that the engines
are operating at the proper thrust level, a signal
is sent to ignite the SRBs. At the proper thrustto-weight ratio, initiators (small explosives) at
eight hold-down bolts on the SRBs are fired to
release the space shuttle for lift-off. Elapsed
time is a few seconds.

The normal ascent profile, referred to as direct

insertion, places the vehicle in a temporary
elliptical orbit at MECO. Orbital altitudes can
vary from 100 to 312 nm, depending on mission
requirements. The crew then performs an OMS
burn, designated as OMS 2, to stabilize the
orbit. This burn can add anywhere between 200
to 550 fps to the vehicles orbital velocity, as
necessary.

Maximum dynamic pressure is reached early in

the ascent, nominally 30 to 60 seconds after liftoff. Approximately 1 minute later (2 minutes
into the ascent phase), the two SRBs have
consumed their propellant and are jettisoned
from the ET. This is triggered by a separation
signal from the orbiter.

In cases of severe performance problems during

the ascent, the vehicle may find itself well short
of the expected MECO velocity, and even suborbital. In such cases, the crew performs what
is called an OMS 1 burn, which raises the
orbit to a safe altitude. They then peform an
OMS 2 burn to stablize that orbit.

The boosters briefly continue to ascend, while

small thrusters fire to carry them away from the
space shuttle. The boosters then turn and
descend, and at a predetermined altitude,
parachutes are deployed to decelerate them for
a safe splashdown in the ocean. Splashdown
occurs approximately 141 nm from the launch
site. The boosters are recovered and reused.

Orbit

The orbiter and ET continue to ascend, using

the thrust of the three SSMEs. Approximately
8 minutes after launch, the three engines
undergo main engine cutoff (or MECO), and the
ET is jettisoned on command from the orbiter.

On orbit, the forward and aft RCS jets provide

attitude control of the orbiter, as well as any
minor translation maneuvers along a given axis.
The OMS engines are used to perform orbital
transfers, such as those done to rendezvous
with the International Space Station (ISS).
While on orbit, the crew fulfills mission
objectives, such as ISS assembly and logistics,
payload deployment or retrieval, and scientific
experiments.

The forward and aft reaction control system

(RCS) jets provide attitude control, translate the

1. GENERAL DESCRIPTION
1.1 Overview

1.1-2

USA007587
Rev. A

Shuttle Mission Profile

Deorbit

Entry

At the completion of orbital operations, the RCS

is used to orient the orbiter in a tail-first
attitude. The two OMS engines are burned to
lower the orbit such that the vehicle enters the
atmosphere at a specific altitude and range from
the landing site. The deorbit burn usually
decreases the vehicles orbital velocity
anywhere from 200 to 550 fps, depending on
orbital altitude. When the deorbit burn is
complete, the RCS is used to rotate the orbiters
nose forward for entry. The RCS jets are used
for attitude control until atmospheric density is
sufficient for the pitch, roll, and yaw
aerodynamic control surfaces to become
effective.

Entry interface, the point where the vehicle

enters the atmosphere, is considered to occur at
an altitude of 400,000 feet, approximately
4,200 nm from the landing site, and at a velocity
of approximately 25,000 fps. The orbiter is
maneuvered to 0 roll and yaw (wings level)
and a 40 angle of attack for entry. The flight
control system issues the commands to roll,
pitch, and yaw RCS jets for rate damping.

1.1-3

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A
The forward RCS jets are not used during entry,
as they would adversely affect the vehicles
aerodynamics otherwise. Thus, only the aft
RCS jets are initally used to maneuver the
vehicle. At a dynamic pressure (qbar) of 10 psf,
the orbiters aerosurfaces become effective for
roll control, and the roll function in the aft RCS
jets is deactivated. At a qbar of 40 psf, the
aerosurfaces become more effective, and the
RCS pitch function is deactivated. The orbiters
speed brake is used below Mach 10 to help keep
the elevons in the airstream. At Mach 5, the
rudder becomes active and is used for trim.
Finally, at Mach 1, all RCS jet activity is
deactived, leaving only the aerosurfaces to
maneuver the vehicle.
Entry guidance must dissipate the tremendous
amount of energy the orbiter possesses when it
enters the Earths atmosphere to assure that the
orbiter does not either burn up (entry angle too
steep) or skip out of the atmosphere (entry
angle too shallow). It must also properly
position the vehicle to reach the desired
touchdown point. Guidance does all this by
controlling the atmospheric drag on the
orbiters surface. Higher atmospheric drag
levels enable faster energy dissipation with a
steeper trajectory.
Controlling atmospheric drag is achieved by
varying either the angle of attack or the bank
angle. However, varying the angle of attack
early during entry creates surface temperatures
above the orbiters design specification. This
leaves varying bank angle for energy control.
Increasing the bank angle decreases the vertical
component of lift, causing a higher sink rate,
greater atmospheric drag and thus more energy
dissipation.
This, too, raises the surface
temperature of the orbiter, but not nearly as
drastically as would increasing the angle of
attack.
If the orbiter is low on energy (i.e. the range to
the landing site is much greater than expected,
given the current velocity), entry guidance will
command lower than nominal drag levels. If
the orbiter has too much energy (i.e. the range
to the landing site is much less than expected,
given the current velocity), entry guidance will
command higher-than-nominal drag levels to
dissipate the extra energy.

1. GENERAL DESCRIPTION
1.1 Overview

Bank angle is also used to control crossrange.

Azimuth error is the angle between the plane
containing the orbiters position vector and the
heading alignment cone tangency point and the
plane containing the orbiters position vector
and velocity vector. When the azimuth error
exceeds a computer-loaded number, the
orbiters bank angle is reversed.
Thus, descent rate and downranging are
controlled by bank angle. The steeper the bank
angle, the greater the descent rate and the
greater the drag. Conversely, the minimum
drag attitude is wings level. Crossrange is
controlled by bank reversals. The entry thermal
control phase is designed to keep the backface
and surface temperatures within the design
limits. A constant heating rate is established
until a velocity below 19,000 fps.
The equilibrium glide phase transitions the
orbiter from the rapidly increasing drag levels
of the temperature control phase to the constant
drag level of the constant drag phase. The
equilibrium glide flight is defined as flight in
which the flight path angle, which is the angle
between the local horizontal and the local
velocity vector, remains constant. Equilibrium
glide flight provides the maximum downrange
capability. It lasts until the drag acceleration
reaches 33 fps2.
The constant drag phase begins at that point.
The angle of attack is initially 40, but it begins
to ramp down to approximately 36 by the end
of this phase.
In the transition phase, the angle of attack
continues
to
ramp
down,
reaching
approximately 14 at the entry terminal area
energy management (TAEM) interface, at an
altitude of approximately 83,000 feet, a velocity
of 2,500 fps, and a range of 60 nm from the
runway. Control is then transferred to TAEM
guidance.
During the entry phases described, the orbiters
bank commands keep the orbiter on the drag
profile and control crossrange.

1.1-4

USA007587
Rev. A
TAEM
TAEM (terminal area energy management)
steers the orbiter to one of two 18,000-ft radius
heading alignment cones (HAC), which are
located tangent to and on either side of the
runway centerline on the approach end. In
TAEM guidance, excess energy is dissipated
with an S-turn. This increases the ground track
range as the orbiter turns away from the HAC
until sufficient energy is dissipated to allow a
normal approach and landing guidance phase
capture, which begins at 10,000 feet altitude.
The orbiter also can be flown near the velocity
for maximum lift over drag or wings level for
the range stretch case. The spacecraft slows to
subsonic velocity at approximately 49,000 feet
altitude, about 26 nm from the landing site.
At TAEM acquisition, the orbiter is turned until
it is aimed at a point tangent to the HAC and
continues until it reaches way point (WP) 1. At
WP-1, the TAEM heading alignment phase
begins. The HAC is followed until landing
runway alignment, 20, has been achieved. In
the TAEM prefinal phase, the orbiter pitches
down to acquire the steep glideslope, increases
airspeed, banks to acquire the runway
centerline, and continues until on the runway
centerline, on the outer glideslope, and on
airspeed. The approach and landing guidance
phase begins with the completion of the TAEM
prefinal phase and ends when the spacecraft
comes to a complete stop on the runway.
Landing
The approach and landing trajectory capture
phase begins at the approach and landing
interface and continues to acquisition of the
steep outer glideslope. The approach and
landing phase begins at about 10,000 feet
altitude at an equivalent airspeed of 300 knots
equivalent airspeed (KEAS) and 5.8 or 6.3 nm
(for -20 or -18 glideslope, respectively) from
touchdown. Approach and landing guidance is
initiated at this point to guide the orbiter to the
-20 or -18 glideslope aimed at a target 7,500
feet short of the runway. The speed brake is
modulated to hold the reference velocity. The
descent rate in the later portion of TAEM and
approach and landing is greater than 10,000 feet
per minute.

At 2,000 feet above ground level (AGL), a

preflare maneuver is started to position the
spacecraft for a 1.5 inner glideslope in
preparation for landing with the speed brake
positioned to control touchdown energy. The
flight crew deploys the landing gear at 300 feet
AGL. The final flare reduces the sink rate of the
spacecraft to a target value of 3 fps.
Touchdown occurs approximately 2,500 feet
past the runway threshold at a speed of 195
KEAS (lightweight orbiters) or 205 KEAS
(heavyweight orbiters).

Launch and Landing Sites

The Kennedy Space Center (KSC) in Florida is
used for all shuttle launches. Shuttle landings
occur at KSC, also, as well as at Edwards Air
Force Base in California. Contingency landing
sites are also provided in the event the orbiter
must return to Earth in an emergency.
A 035 azimuth launch places the spacecraft in
an orbital inclination of 57, which means the
spacecraft in its orbital trajectories around Earth
will never exceed an Earth latitude higher or
lower than 57 north or south of the equator. A
launch path from KSC at an azimuth of 090
(due east from KSC) will place the spacecraft in
an orbital inclination of 28.5.
These two azimuths, 035 and 090, represent
the current launch limits from KSC. Any
azimuth angles further north or south would
launch a spacecraft over a habitable land mass,
adversely affect safety provisions for abort or
vehicle separation conditions, or present the
undesirable possibility that the SRB or external
tank could land on inhabited territory.
The Earth rotates from west to east at a speed of
approximately 900 nautical miles (nm) per hour.
For due east launches (090 azimuth), the
Earths rotational velocity adds to the velocity
increase caused by the SRBs and main engines.
Due east launches provide the maximum
payload and altitude capability. Launches on
azimuths other than due east benefit less and
less from Earths rotation as the launch azimuth
approaches north or south. Westerly launches
would decrease performance even further.

1.1-5

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Orbiter Ground Turnaround

Spacecraft recovery operations at the nominal
end-of-mission landing site are supported by
approximately 160 space shuttle launch operations team members. Ground team members
wearing self-contained atmospheric protective
ensemble suits that protect them from toxic
chemicals approach the spacecraft as soon as it
stops rolling. The ground team members take

A second GSE ground cooling unit is connected

to the left-hand orbiter T-0 umbilical spacecraft
Freon coolant loops to provide cooling for the
flight crew and avionics during the postlanding
and system checks. The spacecraft fuel cells
remain powered up at this time. The flight
crew then exits the spacecraft, and a ground
crew powers down the spacecraft. The orbiter
and GSE convoy eventually move from the
runway to the Orbiter Processing Facility (OPF).

Kennedy Space Center Ground Turnaround Sequence

sensor measurements to ensure the atmosphere
in the vicinity of the spacecraft is not
hazardous. In the event of propellant leaks, a
wind machine truck carrying a large fan is
moved into the area to create a turbulent
airflow that will break up gas concentrations
and reduce the potential for an explosion.
A ground support equipment (GSE) airconditioning purge unit is attached to the righthand orbiter T-0 umbilical so cool air can be
directed through the orbiters aft fuselage,
payload bay, forward fuselage, wings, vertical
stabilizer, and OMS/RCS pods to dissipate the
heat of entry.
1. GENERAL DESCRIPTION
1.1 Overview

If the spacecraft lands at Edwards Air Force

Base, the same procedures and GSE are used
after the orbiter has stopped on the runway.
The orbiter and GSE convoy move from the
runway to the orbiter mate and demate facility.
After detailed inspection, the spacecraft is
prepared to be ferried atop the Shuttle Carrier
Aircraft from Edwards Air Force Base to KSC.
For ferrying, a tail cone is installed over the aft
section of the orbiter.
In the event of a landing at an alternate site, a
crew of about eight will move to the landing
site to assist the astronaut crew in preparing the
orbiter for loading aboard the Shuttle Carrier

1.1-6

USA007587
Rev. A
Aircraft for transport back to KSC. For landings
outside the U.S., personnel at the contingency
landing sites will be provided minimum
training on safe handling of the orbiter, with
emphasis on crash rescue training, towing the
orbiter to a safe area, and prevention of
propellant conflagration.
Upon its return to the OPF at KSC, the orbiter is
safed (ordnance devices safed), the payload (if
any) is removed, and the orbiter payload bay is
reconfigured for the next mission.
Any
required maintenance and inspections are also
performed while the orbiter is in the OPF. A
payload for the orbiters next mission may be
installed in the orbiters payload bay in the OPF
or when the orbiter is at the launch pad.
While the orbiter is being refurbished, the ET
and SRBs (which are also processed at KSC) are
stacked and mated on the mobile launch
platform in the Vehicle Assembly Building
(VAB). Once prepared, the orbiter is towed
from the OPF to the VAB mated to the ET/SRB
stack. Connections are made, the integrated
vehicle is checked, and ordnance is installed.
The mobile launch platform moves the entire
space shuttle system on a crawler transporter to
the launch pad, where connections are made,
and servicing and checkout activities begin. If
the payload was not installed in the OPF, it is
installed at the launch pad followed by
prelaunch activities.

KSC Launch Operations has the responsibility

for all mating, prelaunch testing, and launch
control ground activities until the space shuttle
clears the launch pad tower. Responsibility is
then turned over to the Mission Control Center
(MCC) at the Johnson Space Center in Texas.
MCCs responsibility includes ascent, on-orbit
operations, entry, approach, and landing until
crew egress, at which time the orbiter is handed
over to the postlanding operations at the
landing site for turnaround and relaunch.

Space Shuttle Coordinate Reference

System
The space shuttle coordinate reference system is
a means of locating specific points on the
orbiter. The system is measured in inches and
decimal places; Xo designates the longitudinal
axis, Yo the lateral axis, and Zo the vertical axis.
The subscript o indicates orbiter; similar
reference systems are used for the ET (T), SRB
(B), and overall space shuttle system (S).
In each coordinate system, the X-axis zero point
is located forward of the nose tip; i.e., the
orbiter nose tip location is 236 inches aft of the
zero point (at Xo = 236), the ET nose cap tip
location is at XT = 322.5, and the SRB nose tip
location is at XB = 200. In the orbiter, the
horizontal Xo , Yo reference plane is located at
Zo = 400, which is 336.5 inches above the ET
horizontal XT, YT reference plane located at ZT =
400. The SRB horizontal XB, YB reference plane

1.1-7

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Crew Cabin (Cutaway View)

is located at ZB = 0 and coincident with the ET
horizontal plane at ZT = 400. The solid rocket
booster vertical XB, ZT planes are located at +
YS = 250.5 and -YS = 250.5. Also, the orbiter,
external tank, and shuttle system center X, Z
planes coincide.

compartments and lockers, access panels, and

wall-mounted equipment in the orbiter crew
compartments. The crew compartments are
the flight deck, middeck, and airlock. A
fourth compartment becomes part of the
configuration when the Spacehab is flown.
Because of compartment functions and
geometry, each has a unique location coding
format.

From the X = 0 point, aft is positive, and

forward is negative for all coordinate systems.
Looking forward, each shuttle element Y-axis
point right of the center plane (starboard) is
positive and each Y-axis point left of center
(port) is negative. The Z axis of each point
within all elements of the shuttle except the
SRBs is positive, with Z = 0 located below the
element. In the SRBs, each Z-coordinate point
below the XB, YB reference plane is negative,
and each point above that plane is positive.

Flight Deck Location Codes

A flight deck location code consists of two or
three alphanumeric characters. The first
character is the first letter of a flight deck
surface as addressed while sitting in the
commander/pilot seats. The characters are:
L Left

The shuttle system and shuttle element

coordinate systems are related as follows: the
external tank XT = 0 point coincides with XS =
0, the SRB XB 0 point is located 543 inches aft,
and the Yo , Zo reference plane is 741 inches aft
of XS = 0.

R Right
F Forward
A Aft
C Center Console
O Overhead

Location Codes

Orbiter location codes enable crewmembers

to locate displays and controls, stowage
1. GENERAL DESCRIPTION
1.1 Overview

Seats

W Windows
1.1-8

USA007587
Rev. A
SURFACES
L
R
C
O
F
A
W

Left
Right
Center console
Overhead
Forward
Aft
Windows

The second and third characters are numerics

identifying
the
relative
location
of
components on each flight deck surface. The
numbering system philosophy is summarized
in the table at left.

GENERAL NUMBERING PHILOSOPHY

Numbered from the top to bottom, forward to aft

Numbered from left to right, forward to aft

Numbered left to right, top to bottom
(facing the surface)
The forward windows are numbered left to right
(W1 through W6) facing forward
The overhead windows are numbered left to
right (W7 and W8) facing aft

S - Seats

The aft windows are numbered left to right

(W9 and W10) facing aft
The CDRs seat is S1 and the PLTs seat is S2

General Numbering Scheme for Flight Deck

Surfaces

Flight Deck Location Codes (1 of 2)

1.1-9

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Flight Deck Location Codes (2 of 2)

Middeck Location Codes
The middeck location codes have five characters
specifying the following:
First character M for middeck
Second character The first letter of a
middeck surface; the characters and
surfaces are:
L Left

A Aft

R Right

D Deck

F Forward

O Overhead

SURFACES

Standing on deck facing the surface

Standing on deck facing forward (+X) looking down

The overhead location grid matches the grid on the deck;

i.e., a point on the overhead has the same third, fourth,
fifth characters as a point directly below it on the deck

Middeck Location Codes (2 of 2)

The reference position for identifying the
surface is standing on the middeck floor (deck)
facing forward (+X).
Third/fourth/fifth characters These
characters form a location grid on each
middeck surface. The third and fourth
characters are numerics indicating the
1. GENERAL DESCRIPTION
1.1 Overview

The fifth character is an alpha character

indicating the distance from the top of a
in
surface
expressed
alphabetically
increments of 6 inches.
NOTE

REFERENCE POSITION

L, R, F, A

distance from the left side of a surface

expressed as a percentage of the total
width of the surface (follows the contour of
the wall).

1.1-10

The middeck panel numbers are not

consistent with the location coding
system defined by this document.
However, in each case, the location
coding, as indicated, is in close
proximity to the actual location.
Panel numbers were assigned prior to
the middeck closeout panel design
definition. The starting points for
location coding were behind the
closeout panels, whereas the starting
points used in this document are in
front of the closeout panels.

USA007587
Rev. A
Airlock Location Codes
An airlock code consists of four or five
alphanumeric characters, which specify the
following:
First character A for airlock
Second character The first letter of an
airlock surface; the characters and surfaces
are:
W Wall
O Overhead
D Deck
The wall is the inner wall of the cylindrical
airlock. The overhead and deck are flat
surfaces at each end of the cylinder. The airlock
is oriented upside down with respect to the

middeck, so that the airlock overhead

corresponds to the middeck floor. The wall
location codes have five characters, and the
overhead/deck codes have four characters.
Third/fourth/fifth characters (wall only)
These characters form a location grid on the
airlock wall. The third and fourth characters
are numerics indicating the distance (clockwise)
from the vertical centerline of the forward hatch
(airlock in) expressed as a percentage of the
total airlock circumference. The fifth character
is an alpha character indicating the distance
from
the
overhead
surface
expressed
alphabetically in increments of 6 inches.
Third/fourth characters (overhead/deck only)
These characters form location grids on the deck
and overhead surfaces. Since these surfaces are
small, items can be easily located without the
aid of the location grids.

Middeck Location Codes (1 of 7)

1.1-11

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Middeck Location Codes (2 of 7)

1. GENERAL DESCRIPTION
1.1 Overview

1.1-12

USA007587
Rev. A

Middeck Location Codes (3 of 7)

1.1-13

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

Middeck Location Codes (4 of 7)

1. GENERAL DESCRIPTION
1.1 Overview

1.1-14

USA007587
Rev. A

Middeck Location Codes (5 of 7)

1.1-15

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

1.2 in.

6.00 in.

Fourtier sleep station on middeck right wall

usa007587_948.cnv

Middeck Location Codes (6 of 7)

1. GENERAL DESCRIPTION
1.1 Overview

1.1-16

Middeck Location Codes (7 of 7)

USA007587
Rev. A

1.1-17

1. GENERAL DESCRIPTION
1.1 Overview

Airlock Location Codes

USA007587
Rev. A

1. GENERAL DESCRIPTION
1.1 Overview

1.1-18

Airlock Equipment and Associated Location Codes

USA007587
Rev. A

1.1-19

1. GENERAL DESCRIPTION
1.1 Overview

USA007587
Rev. A

This page intentionally left blank

1. GENERAL DESCRIPTION
1.1 Overview

1.1-20

USA007587
Rev. A

1.2

The forward fuselage is constructed of

conventional 2024 aluminum alloy skin-stringer
panels, frames, and bulkheads. The panels are
single curvature, stretch-formed skins with
riveted stringers spaced 3 to 5 inches apart. The
frames are riveted to the skin-stringer panels.
The major frames are spaced 30 to 36 inches
apart. The Yo = 378 upper forward bulkhead is
constructed of flat aluminum and formed
sections riveted and bolted together; the lower
is a machined section. The bulkhead provides
the interface fitting for the nose section.

ORBITER STRUCTURE

CONTENTS
Forward Fuselage.................................
Crew Compartment .............................
Forward Fuselage and Crew
Compartment Windows...........
Wing ......................................................
Midfuselage ..........................................
Aft Fuselage ..........................................
Orbital Maneuvering System/
Reaction Control System
(OMS/RCS) Pods ......................
Body Flap ..............................................
Vertical Tail...........................................
Orbiter Passive Thermal Control .......
Thermal Protection System.................

1.2-1
1.2-3
1.2-6
1.2-7
1.2-9
1.2-10

1.2-11
1.2-12
1.2-13
1.2-14
1.2-15

The orbiter structure is divided into nine major

sections: (1) forward fuselage, which consists of
upper and lower sections that fit clamlike
around a pressurized crew compartment, (2)
wings, (3) midfuselage, (4) payload bay doors,
(5) aft fuselage, (6) forward RCS, (7) vertical tail,
(8) OMS/RCS pods, and (9) body flap. The
majority of the sections are constructed of
conventional aluminum and protected by
reusable surface insulation.

Forward Fuselage
The forward fuselage consists of the upper and
lower fuselages. It houses the crew compartment and supports the forward RCS module,
nose cap, nose gear wheel well, nose gear, and
nose gear doors.

The nose section contains large machined

beams and struts. The structure for the nose
landing gear wheel well consists of two support
beams, two upper closeout webs, drag-link
support struts, nose landing gear strut and
actuator attachment fittings, and the nose
landing gear door fittings. The left and right
landing gear doors are attached by hinge
fittings in the nose section. The doors are
constructed of aluminum alloy honeycomb, and
although the doors are the same length, the left
door is wider than the right. Each door has an
up-latch fitting at the forward and aft ends to
lock the door closed when the gear is retracted,
and each has a pressure seal in addition to a
thermal barrier. Lead ballast in the nose wheel
well and on the Xo = 293 bulkhead provides
weight and center-of-gravity control. The nose
wheel well accommodates 1,350 pounds of
ballast, and the Xo = 293 bulkhead
accommodates a maximum of 1,971 pounds.
The forward fuselage carries the basic bodybending loads (loads that have a tendency to
change the radius of a curvature of the body)
and reacts to nose landing gear loads.

1.2-1

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A

Minimum Ground Clearances

Body Flap
Main Gear Door
Nose Gear Door
Wing Tip

Feet
12.07
2.85
2.95
11.92

Orbiter Dimensions
The forward fuselage is covered with reusable
insulation, except for the six windshields, two
overhead windows, and side hatch window
areas around the forward RCS jets. The nose
cap is also a reusable thermal protection system
constructed of reinforced carbon-carbon with
thermal barriers at the nose cap-structure
interface.
The forward fuselage skin has structural

provisions for installing antennas, deployable

air data probes, and the door eyelet openings
for the two star trackers. Two openings are
required in the upper forward fuselage for star
tracker viewing. Each opening has a door for
environ-mental control.
The forward orbiter/ET attach fitting is at the
Xo = 378 bulkhead and the skin panel structure
aft of the nose gear wheel well. Purge and vent

Orbiter
1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-2

USA007587
Rev. A

Forward Fuselage Structure

control is provided by flexible boots between
the forward fuselage and crew compartment
around the windshield windows, overhead
observation window, crew hatch window, and
star tracker openings. The forward fuselage is
isolated from the payload bay by a flexible
membrane between the forward fuselage and
crew compartment at Xo = 582.

integral stiffening stringers and internal

framing welded together to create a pressuretight vessel. The compartment has a side hatch
for normal ingress and egress, a hatch into the
airlock from the middeck, and a hatch from the
airlock into the payload bay for extravehicular
activity and payload bay access. The side hatch
can be jettisoned.

The forward RCS module is constructed of

conventional 2024 aluminum alloy skin-stringer
panels and frames. The panels are composed of
single-curvature, stretch-formed skins with
riveted stringers. The frames are riveted to the
skin-stringer panels. The forward RCS module
is secured to the forward fuselage nose section
and forward bulkhead of the forward fuselage
with 16 fasteners, which permit the installation
and removal of the module. The components of
the forward RCS are mounted and attached to
the module, which has a reusable thermal
protection cover, in addition to thermal barriers
installed around it and the RCS jet interfaces
and the interface-attachment area to the
forward fuselage.

Redundant pressure window panes are

provided in the six forward windshields, the
two overhead viewing windows, the two aft
viewing windows, and the side hatch windows.
Approximately 300 penetrations in the pressure
shell are sealed with plates and fittings. A large
removable panel in the aft bulkhead provides
access to the interior of the crew compartment
during initial fabrication and assembly. The
compartment supports the ECLSS, avionics,
GNC equipment, inertial measurement units,
displays and controls, star trackers, and
crew accommodations for sleeping, waste
management, seats, and an optional galley.

Crew Compartment
The
three-level
crew
compartment
is
constructed of 2219 aluminum alloy plate with

The crew compartment is supported within the

forward fuselage at only four attach points to
minimize the thermal conductivity between
them. The two major attach points are located
at the aft end of the crew compartment at the
flight deck floor level. The vertical load reaction

1.2-3

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A
link is on the centerline of the forward
bulkhead. The lateral load reaction is on the
lower segment of the aft bulkhead.
The
compartment
is
configured
to
accommodate a crew of four on the flight deck
and three in the middeck. The crew cabin
arrangement consists of a flight deck, middeck,
and lower level equipment bay.
The crew compartment is pressurized to 14.7
0.2 psia and is maintained at an 80-percent
nitrogen and 20-percent oxygen composition by
the ECLSS, which provides a shirt-sleeve
environment for the flight crew. The crew
compartment is designed for 16 psia.

The crew compartments volume with the

airlock in the payload bay is 2,553 cubic feet.
Flight Deck
The flight deck is the uppermost compartment
of the cabin. The commanders and pilots work
stations are positioned side by side in the
forward portion of the flight deck. These
stations have controls and displays for
controlling the vehicle throughout all mission
phases. Directly behind and to the sides of the
commander and pilot centerline are the mission
specialist seats.

Crew Compartment and Arrangement

The aft flight deck has two overhead and aft
viewing windows for viewing orbital
operations. The aft flight deck station also
contains displays and controls for executing
attitude or translational maneuvers for
rendezvous, stationkeeping, docking, payload
deployment and retrieval, payload monitoring,
remote manipulator system controls and
displays, payload bay door operations, and
closed-circuit television operations. The aft
flight deck is approximately 40 square feet.
Aft Flight Station
1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-4

USA007587
Rev. A
The forward flight deck, which includes the
center console and seats, is approximately 24
square feet. However, the side console controls
and displays add approximately 3.5 more
square feet. If the center console is subtracted
from the 24 square feet, this would amount to
approximately 5.2 square feet.
Middeck
Directly beneath the flight deck is the middeck.
Access to the middeck is through two interdeck
openings, which measure 26 by 28 inches.
Normally, the right interdeck opening is closed,
and the left is open. A ladder attached to the
left interdeck access allows easy passage in 1-g
conditions.
The middeck provides crew
accommodations and contains three avionics
equipment bays. The two forward avionics
bays utilize the complete width of the cabin and
extend into the middeck 39 inches from the
forward bulkhead. The aft bay extends into the
middeck 39 inches from the aft bulkhead on
either side of the airlock hatch. Attached to the
aft bay on the port side of the vehicle is the
waste management compartment and closeouts
which create a stowage compartment known as
volume 3B.
Just forward of the waste
management system is the side hatch. The
completely stripped middeck is approximately
160 square feet; the gross mobility area is
approximately 100 square feet.
The side hatch in the middeck is used for normal
crew ingress/egress and may be operated from
within the crew cabin middeck or externally. It is
attached to the crew cabin tunnel by hinges, a
torque tube, and support fittings. The hatch
opens outwardly 90 down with the orbiter
horizontal or 90 sideways with the orbiter
vertical. It is 40 inches in diameter and has a 10inch clear-view window in the center of the
hatch. The window consists of three panes of
glass. The side hatch has a pressure seal that is
compressed by the side hatch latch mechanisms
when the hatch is locked closed. A thermal
barrier of Inconel wire mesh spring with a
ceramic fiber braided sleeve is installed between
the reusable surface insulation tiles on the

forward fuselage and the side hatch. The total

weight of the side hatch is 294 pounds.
Depending on the mission requirements, bunk
sleep stations and a galley can be installed in
the middeck. In addition, three or four seats of
the same type as the mission specialists seats
on the flight deck can be installed in the
middeck.
The middeck also provides a stowage volume
of 140 cubic feet.
Accommodations are
included for dining, sleeping, maintenance,
exercising, and data management. On the
orbiter centerline, just aft of the forward
avionics equipment bay, an opening in the
ceiling provides access to the inertial
measurement units.
The middeck floor contains removable panels
that provide access to the ECLSS equipment.
The middeck equipment bay below the
middeck floor houses the major components of
the waste management and air revitalization
systems, such as pumps, fans, lithium
hydroxide carbon dioxide absorbers, heat
exchangers, and ducting. This compartment
has space for stowing lithium hydroxide
canisters and five separate spaces for crew
equipment stowage with a volume of 29.92
cubic feet.
Modular stowage lockers are used to store the
flight crews personal gear, mission-necessary
equipment, personal hygiene equipment, and
experiments. There are 44 identical boxes that
are 11 by 18 by 21 inches.
An airlock located in the payload bay is made
of aluminum and covered with thermal
blankets. Three hatches are installed. One from
the middeck, one to the payload bay and one
everhead used while docked. The docking
mechanism attached to the top of the airlock is
operated by avionics mounted under a false
floor in the bottom of the airlock. The airlock is
mounted in the payload bay via truss.
Normally, two extravehicular mobility units are
stowed in the airlock.

1.2-5

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A

Crew Compartment Middeck

Forward Fuselage and Crew Compartment

Windows
The orbiter windows provide visibility for
entry, landing, and on-orbit operations. For
atmospheric flight, the flight crew needs
forward, left, and right viewing areas. On-orbit
mission
phases
require
visibility
for
rendezvous, docking, and payload-handling
operations.
The six windows located at the forward flight
deck commander and pilot stations provide
forward, left, and right viewing. The two
overhead windows and two payload-viewing
windows at the aft station location on the flight
deck provide rendezvous, docking, and
payload viewing. There is also a window in the
middeck side hatch.
The six platform-shaped forward windows are
the thickest pieces of glass ever produced in the
optical quality for see-through viewing. Each
consists of three individual panes.
The
innermost pane, which is 0.625 of an inch thick,
is constructed of tempered aluminosilicate glass
to withstand the crew compartment pressure.
Aluminosilicate glass is a low-expansion glass
that can be tempered to provide maximum
mechanical strength. The exterior of this pane,
called a pressure pane, is coated with a red
reflector coating to reflect the infrared (heat
portion) rays while transmitting the visible
spectrum.

The center pane is constructed of lowexpansion, fused silica glass because of its high
optical quality and excellent thermal shock
resistance. This pane is 1.3 inches thick.
The inner and outer panes are coated with a
high-efficiency, anti-reflection coating to improve visible light transmission. These windows withstand a proof pressure of 8,600 psi at
240 F and 0.017 relative humidity.
The outer pane is made of the same material as
the center pane and is 0.625 of an inch thick.
The exterior is uncoated, but the interior is
coated with high-efficiency, anti-reflection
coating.
The outer surface withstands
approximately 800 F.
Each of the six forward windows outer panes
measures 42 inches diagonally, and the center
and inner panes each measure 35 inches
diagonally. The outer panes of the six forward
windows are mounted and attached to the
forward fuselage. The center and inner panes

Flight Deck Windows

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-6

USA007587
Rev. A
During orbital operations, the large window
areas of transparency expose the flight crew to
sun glare; therefore, window shades are
provided to preclude or minimize exposure.
Shades are provided for all windows on the
flight deck. The overhead window shades are
stored in the middeck of the orbiter crew
compartment. Attachment mechanisms and
devices are provided for their installation at
each window on the flight deck.
Side Hatch (Interior View)
are mounted and attached to the crew
compartment. Redundant seals are employed
on each window.
No sealing/bonding
compounds are used.
The two overhead windows at the flight deck
aft station are identical in construction to the six
forward windows, except for thickness. The
inner and center panes are 0.45 of an inch thick,
and the outer pane is 0.68 of an inch thick. The
outer pane is attached to the forward fuselage,
and the center and inner panes are attached to
the crew compartment. The two overhead
windows clear view area is 20 by 20 inches.
The left-hand overhead window provides the
crew members with a secondary emergency
egress. The inner and center panes open into
the crew cabin, and the outer pane is jettisoned
up and over the top of the orbiter. This
provides a secondary emergency exit area of 20
by 20 inches.
On the aft flight deck, each of the two windows
for viewing the payload bay consists of only
two panes of glass, which are identical to the
forward windows inner and center panes. The
outer thermal panes are not installed. Each
pane is 0.3 of an inch thick. The windows are
14.5 by 11 inches. Both panes are attached to
the crew compartment.
The side hatch viewing window consists of
three panes of glass identical to the six forward
windows. The inner pane is 11.4 inches in
diameter and 0.25 of an inch thick. The center
pane is 11.4 inches in diameter and 0.5 of an
inch thick. The outer pane is 15 inches in
diameter and 0.3 of an inch thick.

The forward station window shades (W-1

through W-6) are rolled up and stowed at the
base of the windows. Solid shades are used on
overhead windows (W-7 and W-8).
The aft window shades (W-9 and W-10) are
held in place via 0.63-inch-wide strip of Nomex
Velcro around the perimeter of the shade. The
shade is attached to the window by pressing the
Velcro strip to the pile strip around the window
opening.
The side hatch window cover is permanently
attached to the window frame and is hinged to
allow opening and closing.

Wing
The wing is an aerodynamic lifting surface that
provides conventional lift and control for the
orbiter. The left and right wings consist of the
wing glove, the intermediate section (which
includes the main landing gear well), the torque
box, the forward spar for mounting the reusable
reinforced carbon-carbon leading edge structure
thermal protection system, the wing/elevon
interface, the elevon seal panels, and the
elevons.
The wing is constructed of conventional
aluminum alloy with a multirib and spar
arrangement with skin-stringer-stiffened covers
or honeycomb skin covers. Each wing is 60
feet long at the fuselage intersection and has a
maximum thickness of 5 feet.
The forward wing box is an extension of the
basic wing that aerodynamically blends the
wing leading edge into the midfuselage wing
glove. The forward wing box is a conventional
design of aluminum ribs, aluminum tubes, and
tubular struts. The upper and lower wing skin
panels are stiffened aluminum. The leading

1.2-7

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A

Wing Structure
edge spar
aluminum.

is

constructed

of

corrugated

The intermediate wing section consists of the

conventional
aluminum
multiribs
and
aluminum tubes. The upper and lower skin
covers
are
constructed
of
aluminum
honeycomb. A portion of the lower wing
surface skin panel includes the main landing
gear door. The intermediate section houses the
main landing gear compartment and reacts to a
portion of the main landing gear loads. A
structural rib supports the outboard main
landing gear door hinges and the main landing
gear trunnion and drag link. The support for
the inboard main landing gear trunnion and
drag link attachment is provided by the
midfuselage. The main landing gear door is
conventional aluminum honeycomb.
The four major spars are constructed of
corrugated aluminum to minimize thermal
loads.
The forward spar provides the
attachment for the thermal protection system
reusable reinforced carbon-carbon leading edge
structure.
The rear spar provides the
attachment interfaces for the elevons, hinged
upper seal panels, and associated hydraulic and
electrical system components. The upper and
lower wing skin panels are stiffened aluminum.
1. GENERAL DESCRIPTION
1.2 Orbiter Structure

The elevons provide orbiter flight control

during atmospheric flight.
The two-piece
elevons are conventional aluminum multirib
and beam construction with aluminum
honeycomb skins for compatibility with the
acoustic environment and thermal interaction.
The elevons are divided into two segments for
each wing, and each segment is supported by
three hinges. The elevons are attached to the
flight control system hydraulic actuators at
points along their forward extremities, and all
hinge moments are reacted to at these points.
Each elevon travels 33 up and 18 down
(software limits).
The transition area on the upper surface
between the torque box and the movable elevon
consists of a series of hinged panels that
provide a closeout of the wing-to-elevon cavity.
These panels are of Inconel honeycomb
sandwich construction outboard of wing station
YW = 312.5 and of titanium honeycomb
sandwich construction inboard of wing station
YW = 312.5. The upper leading edge of each
elevon incorporates titanium rub strips. The
rub strips are of titanium honeycomb
construction and are not covered with the
thermal protection system reusable surface
insulation. They provide the sealing surface
area for the elevon seal panels.

1.2-8

USA007587
Rev. A
Except the elevon seal panels, the exposed areas
of the wings, main landing gear doors, and
elevons are covered with reusable surface
insulation thermal protection system materials.
Thermal seals are provided on the elevon lower
cove area along with thermal spring seals on the
upper rub panels. Pressure seals and thermal
barriers are provided on the main landing
gear doors.
The wing is attached to the fuselage with a
tension bolt splice along the upper surface. A
shear splice along the lower surface in the area
of the fuselage carry-through completes the
attachment interface.
B manufacturing the wings for Discovery (OV103) and Atlantis (OV-104), a weight reduction
program resulted in a redesign of certain areas
of the wing structure. An assessment of wing
air loads was made from actual flight data that
indicated greater loads on the wing structure.
As a result, to maintain positive margins of
safety during ascent, structural modifications
were incorporated into certain areas of the
wings. The modifications included the addition
of doublers and stiffeners.

Midfuselage
The midfuselage structure interfaces with the

forward fuselage, aft fuselage, and wings. It

supports the payload bay doors, hinges, tiedown fittings, forward wing glove, and various
orbiter system components, and it forms the
payload bay area.
The forward and aft ends of the midfuselage are
open, with reinforced skin and longerons
interfacing with the bulkheads of the forward
and aft fuselages. The midfuselage is primarily
an aluminum structure 60 feet long, 17 feet
wide, and 13 feet high. It weighs approximately
13,502 pounds.
The midfuselage skins are integrally machined
by numerical control. The panels above the
wing glove and the wings for the forward eight
bays have longitudinal T-stringers. The five aft
bays have aluminum honeycomb panels. The
side skins in the shadow of the wing are also
numerically control machined but have vertical
stiffeners.
The midfuselage structure is stabilized by 12
mainframe assemblies. The assemblies consist
of vertical side elements and horizontal
elements. The side elements are machined; the
horizontal elements are boron/aluminum tubes
with bonded titanium end fittings.
In the upper portion of the midfuselage are the
sill and door longerons. The machined sill

Midfuselage Structure
1.2-9

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A
longerons not only make up the primary bodybending elements, but also take the longitudinal
loads from payloads in the payload bay. The
payload bay door longerons and associated
structure are attached to the 13 payload bay
door hinges. These hinges provide the vertical
reaction from the payload bay doors. Five of
the hinges react to the payload bay door shears.
The sill longeron also provides the base support
for the payload bay manipulator arm (if
installed) and its stowage provisions, the Kuband rendezvous antenna, the antenna base
support and its stowage provisions, and the
payload bay door actuation system.
The side wall forward of the wing carry-through
structure provides the inboard support for the
main landing gear. The total lateral landing gear
loads are reacted to by the midfuselage structure.
The midfuselage also supports the two electrical
wire trays that contain the wiring between the
crew compartment and aft fuselage.
Plumbing and wiring in the lower portion of the
midfuselage are supported by fiberglass milk
stools. The other exposed areas of the
midfuselage are covered with the reusable
surface insulation thermal protection system.
Because of additional detailed analysis of actual
flight data concerning descent stress thermal

gradient loads, torsional straps were added to

the lower midfuselage stringers in bays 1
through 11. The torsional straps tie all stringers
together similarly to a box section, which
eliminates rotational (torsional) capabilities to
provide positive margins of safety.
Also, because of additional detailed analysis of
actual flight data during descent, roomtemperature vulcanizing silicone rubber
material was bonded to the lower midfuselage
from bay 4 through 12 to act as a heat sink and
distribute temperatures evenly across the
bottom of the midfuselage, which reduces
thermal gradients and ensures positive margins
of safety.

Aft Fuselage
The aft fuselage consists of an outer shell, thrust
structure, and internal secondary structure. It is
approximately 18-feet-long, 22-feet-wide, and
20-feet-high.
The aft fuselage supports and interfaces with
the left-hand and right-hand aft OMS/RCS
pods, the wing aft spar, midfuselage,
orbiter/external tank rear attachments, main
engines, aft heat shield, body flap, vertical tail,
and two T-0 launch umbilical panels.

Aft Fuselage Structure

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-10

USA007587
Rev. A
The aft fuselage provides the load path to the
midfuselage main longerons, main wing spar
continuity across the forward bulkhead of the
aft fuselage, structural support for the body
flap, and structural housing around all internal
systems for protection from operational
environments (pressure, thermal, and acoustic)
and controlled internal pressures during flight.
The forward bulkhead closes off the aft fuselage
from the midfuselage and is composed of
machined and beaded sheet metal aluminum
segments. The upper portion of the bulkhead
attaches to the front spar of the vertical tail.
The internal thrust structure supports the three
SSMEs.
The upper section of the thrust
structure supports the upper SSME, and the
lower section supports the two lower SSMEs.
The internal thrust structure includes the
SSMEs, load reaction truss structures, engine
interface fittings, and the actuator support
structure. It supports the SSMEs and the SSME
low-pressure turbopumps and propellant lines.
The two orbiter/external tank aft attach points
interface at the longeron fittings.
The internal thrust structure is composed
mainly of 28 machined, diffusion-bonded truss
members. In diffusion bonding, titanium strips
are bonded together under heat, pressure, and
time. This fuses the titanium strips into a single
hollow, homogeneous mass that is lighter and
stronger than a forged part. In looking at the
cross section of a diffusion bond, no weld line is
visible. It is a homogeneous parent metal, yet
composed of pieces joined by diffusion
bonding.
(In OV-105, the internal thrust
structure is a forging.) In selected areas, the
titanium construction is reinforced with
boron/epoxy tubular struts to minimize weight
and add stiffness.
The upper thrust structure of the aft fuselage is
of integral-machined aluminum construction
with aluminum frames except for the vertical
fin support frame, which is titanium. The skin
panels are integrally machined aluminum and
attach to each side of the vertical fin to react to
drag and torsion loading.
The outer shell of the aft fuselage is constructed
of integral-machined aluminum.
Various
penetrations are provided in the shell for access
to installed systems. The exposed outer areas of

the aft fuselage are covered with reusable

thermal protection system.
The secondary structure of the aft fuselage is of
conventional aluminum construction except
that titanium and fiberglass are used for thermal
isolation of equipment. The aft fuselage secondary structures consist of brackets, buildup
webs, truss members, and machined fittings, as
required by system loading and support
constraints. Certain system components, such
as the avionics shelves, are shock-mounted to
The secondary
the secondary structure.
structure includes support provisions for the
auxiliary power units, hydraulics, ammonia
boiler, flash evaporator, and electrical wire runs.
The two ET umbilical areas interface with the
orbiters two aft ET attach points and the ETs
liquid oxygen and hydrogen feed lines and
electrical wire runs.
The umbilicals are
retracted, and the umbilical areas are closed off
after ET separation by an electromechanically
operated beryllium door at each umbilical.
Thermal barriers are employed at each
umbilical door. The exposed area of each
closed door is covered with reusable surface
insulation.
The aft fuselage heat shield and seal provide a
closeout of the orbiter aft base area. The aft
heat shield consists of a base heat shield of
machined aluminum. Attached to the base heat
shield are domes of honeycomb construction
that support flexible and sliding seal
assemblies. The engine-mounted heat shield is
of Inconel honeycomb construction and is
removable for access to the main engine power
heads. The heat shield is covered with a
reusable thermal protection system except for
the Inconel segments.

Orbital Maneuvering System/Reaction

Control System (OMS/RCS) Pods
The OMS/RCS left- and right-hand pods are
attached to the upper aft fuselage left and right
sides. Each pod is fabricated primarily of
graphite epoxy composite and aluminum. Each
pod is 21.8 feet long and 11.37 feet wide at its
aft end and 8.41 feet wide at its forward end,
with a surface area of approximately 435 square
feet.
Each pod is divided into two
compartments: the OMS and the RCS housings.

1.2-11

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

USA007587
Rev. A

Aft Orbital Maneuvering System/Reaction Control System Pod

Each pod houses all the OMS and RCS
propulsion components and is attached to the
aft fuselage with 11 bolts. The pod skin panels
are graphite epoxy honeycomb sandwich. The
forward and aft bulkhead aft tank support
bulkhead and floor truss beam are machined
aluminum 2124. The centerline beam is 2024
aluminum sheet with titanium stiffeners and
graphite epoxy frames.
The OMS thrust
structure is conventional 2124 aluminum
construction. The cross braces are aluminum
tubing, and the attach fittings at the forward
and aft fittings are 2124 aluminum.
The
intermediate fittings are corrosion-resistant
steel. The RCS housing, which attaches to the
OMS pod structure, contains the RCS jets and
associated propellant feed lines. The RCS
housing is constructed of aluminum sheet
metal, including flat outer skins. The curved
outer skin panels are graphite epoxy honeycomb
sandwich. Doors in the skins (24) provide access
to the OMS and RCS and attach points.
The exposed areas of the OMS/RCS pods are
covered with a reusable thermal protection
system, and a pressure and thermal seal is
installed at the OMS/RCS pod aft fuselage
interface. Thermal barriers are installed, and
they interface with the RCS jets and reusable
1. GENERAL DESCRIPTION
1.2 Orbiter Structure

thermal protection system. The pods will

withstand 162-decibel acoustic noise and a
temperature range from minus 170 to plus 135F.

Body Flap
The body flap thermally shields the three
SSMEs during entry and provides the orbiter
with pitch control trim during its atmospheric
flight after entry.
The body flap is an aluminum structure
consisting of ribs, spars, skin panels, and a
trailing edge assembly. The main upper and
lower forward honeycomb skin panels are
joined to the ribs, spars, and honeycomb trailing
edge with structural fasteners. The removable
upper forward honeycomb skin panels
complete the body flap structure.
The upper skin panels aft of the forward spar
and the entire lower skin panels are
mechanically attached to the ribs. The forward
upper skin consists of five removable access
panels attached to the ribs with quick-release
fasteners. The four integral-machined aluminum actuator ribs provide the aft fuselage
interface through self-aligning bearings. Two

1.2-12

USA007587
Rev. A

Body Flap
bearings are located in each rib for attachment
to the four rotary actuators located in the aft
fuselage, which are controlled by the flight
control system and the hydraulically actuated
rotary actuators. The remaining ribs consist of
eight stability ribs and two closeout ribs
constructed of chemically milled aluminum
webs bonded to aluminum honeycomb core.
The forward spar web is of chemically milled
sheets with flanged holes and stiffened beads.
The spar web is riveted to the ribs. The trailing
edge includes the rear spar, which is composed
of piano-hinge half-cap angles, chemically
milled skins, honeycomb aluminum core,
closeouts, and plates. The trailing edge attaches
to the upper and lower forward panels by the
piano-hinge halves and hinge pins.
Two
moisture drain lines and one hydraulic fluid
drain line penetrate the trailing edge
honeycomb core for horizontal and vertical
drainage.
The body flap is covered with a reusable
thermal protection system and an articulating
pressure and thermal seal to its forward cover
area on the lower surface of the body flap to
block heat and air flow from the structures.

Vertical Tail
The vertical tail consists of a structural fin
surface, the rudder/speed brake surface, a tip,
and a lower trailing edge. The rudder splits
into two halves to serve as a speed brake.
The vertical tail structure fin is made of
aluminum. The main torque box is constructed
of integral-machined skins and strings, ribs, and
two machined spars. The fin is attached by two
tension tie bolts at the root of the front spar of
the vertical tail to the forward bulkhead of the
aft fuselage and by eight shear bolts at the root
of the vertical tail rear spar to the upper
structural surface of the aft fuselage.
The rudder/speed brake control surface is
made of conventional aluminum ribs and spars
with aluminum honeycomb skin panels and is
attached through rotating hinge parts to the
vertical tail fin.
The lower trailing edge area of the fin, which
houses the rudder/speed brake power drive
unit, is made of aluminum honeycomb skin.

1.2-13

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-13ORBITER STRUCTURE

USA007587
Rev. A

Vertical Tail
The hydraulic power drive unit/mechanical
rotary actuation system drives left- and righthand drive shafts in the same direction for
rudder control of plus or minus 27. For speed
brake control, the drive shafts turn in opposite
directions for a maximum of 49.3 each. The
rotary drive actions are also combined for joint
rudder/speed brake control. The hydraulic
power drive unit is controlled by the orbiter
flight control system.
The vertical tail structure is designed for a 163decibel acoustic environment with a maximum
temperature of 350 F.
All-Inconel honeycomb conical seals house the
rotary actuators and provide a pressure and
thermal seal that withstands a maximum of
1,200 F.
The split halves of the rudder panels and
trailing edge contain a thermal barrier seal.
The vertical tail and rudder/speed brake are
covered with a reusable thermal protection
system. A thermal barrier is also employed at
the interface of the vertical stabilizer and aft
fuselage.
1. GENERAL DESCRIPTION
1.2 Orbiter Structure

Orbiter Passive Thermal Control

A passive thermal control system helps
maintain the temperature of the orbiter
spacecraft, systems, and components within
their temperature limits. This system uses
available orbiter heat sources and sinks
supplemented by insulation blankets, thermal
coatings, and thermal isolation methods.
Heaters are provided on components and
systems in areas where passive thermal control
techniques are not adequate. (The heaters are
described under the various systems.)
The insulation blankets are of two basic types:
fibrous bulk and multilayer. The bulk blankets
are fibrous materials with a density of 2 pounds
per cubic foot and a sewn cover of reinforced
acrylic film Kapton. The cover material has
13,500 holes per square foot for venting.
Acrylic film tape is used for cutouts, patching,
and reinforcements.
Tufts throughout the
blankets minimize billowing during venting.
The multilayer blankets are constructed of
alternate layers of perforated acrylic film
Kapton reflectors and Dacron net separators.
There are 16 reflector layers in all, the two cover

1.2-14

USA007587
Rev. A
halves counting as two layers. Covers, tufting,
and acrylic film tape are similar to that used for
the bulk blankets.

underside of the vehicle where RCC is

not used, portions of the OMS/RCS
pods, the leading and trailing edges of
the vertical stabilizer, wing glove
areas, elevon trailing edges adjacent
to the RCC on the upper wing surface,
the base heat shield, the interface with
wing leading edge RCC, and the
upper body flap surface. The HRSI
tiles protect areas where temperatures
are below 2,300 F. These tiles have a
black surface coating necessary for
entry emittance.

Thermal Protection System

The thermal protection system (TPS) consists of
various materials applied externally to the outer
structural skin of the orbiter to maintain the
skin within acceptable temperatures, primarily
during the entry phase of the mission. The
orbiters outer structural skin is constructed
primarily of aluminum and graphite epoxy.
During entry, the TPS materials protect the
orbiter outer skin from temperatures above
350 F. In addition, they are reusable for 100
missions with refurbishment and maintenance.
These materials perform in temperature ranges
from minus 250 F in the cold soak of space to
entry temperatures that reach nearly 3,000 F.
The TPS also sustains the forces induced by
deflections of the orbiter airframe as it responds
to the various external environments. Because
the TPS is installed on the outside of the orbiter
skin, it establishes the aerodynamics over the
vehicle in addition to acting as the heat sink.
Orbiter interior temperatures also are controlled
by internal insulation, heaters, and purging
techniques in the various phases of the mission.

3.

Black tiles called fibrous refractory

composite insulation (FRCI) were
developed later in the TPS program.
FRCI tiles replace some of the HRSI
tiles in selected areas of the orbiter.

4.

Low-temperature reusable surface

insulation (LRSI) white tiles are used
in selected areas of the forward, mid-,
and aft fuselages, vertical tail, upper
wing, and OMS/RCS pods. These
tiles protect areas where temperatures
are below 1,200 F. These tiles have a
white surface coating to provide
better thermal characteristics on orbit.

5.

After the initial delivery of Columbia,

an advanced flexible reusable surface
insulation (AFRSI) was developed.
This material consists of sewn
composite quilted fabric insulation
batting between two layers of white
fabric that are sewn together to form a
quilted blanket. AFRSI was used on
Discovery and Atlantis to replace the
vast majority of the LRSI tiles.
Following its seventh flight, Columbia
also was modified to replace most of
the LRSI tiles with AFRSI. The AFRSI
blankets
provide
improved
producibility and durability, reduced
fabrication and installation time and
costs, and a weight reduction over
that of the LRSI tiles. The AFRSI
blankets
protect
areas
where
temperatures are below 1,200 F.

6.

White blankets made of coated

Nomex felt reusable surface insulation

The TPS is a passive system consisting of

materials selected for stability at high
temperatures and weight efficiency. These
materials are as follows:
1.

Reinforced carbon-carbon (RCC) is

used on the wing leading edges, the
nose
cap,
including
an
area
immediately aft of the nose cap on the
lower surface (chine panel), and the
immediate area around the forward
orbiter/ET structural attachment.
RCC
protects
areas
where
temperatures exceed 2,300 F during
entry.

2.

Black
high-temperature
reusable
surface insulation (HRSI) tiles are
used in areas on the upper forward
fuselage, including around the
forward fuselage windows, the entire
1.2-15

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-15ORBITER STRUCTURE

USA007587
Rev. A
(FRSI) are used on the upper payload
bay
doors,
portions
of
the
midfuselage and aft fuselage sides,
portions of the upper wing surface,
and a portion of the OMS/RCS pods.
The FRSI blankets protect areas where
temperatures are below 700 F.
7.

Additional materials are used in other

special areas. These materials are
thermal panes for the windows, metal
for the forward RCS fairings and
elevon seal panels on the upper wing
to elevon interface, a combination of
white- and black-pigmented silica

1. GENERAL DESCRIPTION
1.2 Orbiter Structure

1.2-16

cloth for thermal barriers and gap

fillers around operable penetrations,
such as main and nose landing gear
doors, egress and ingress flight crew
side hatch, umbilical doors, elevon
cove, forward RCS, RCS jets,
midfuselage vent doors, payload bay
doors,
rudder/speed
brake,
OMS/RCS pods, and gaps between
TPS tiles in high differential pressure
areas,
and
room-temperature
vulcanizing material for the thick
aluminum T-0 umbilicals on the sides
of the orbiter aft fuselage.

USA007587
Rev. A

1.3

components: the forward liquid oxygen tank, an

unpressurized intertank that contains most of
the electrical components, and the aft liquid
hydrogen tank.

EXTERNAL TANK

CONTENTS
Liquid Oxygen Tank............................
Intertank ................................................
Liquid Hydrogen Tank .......................
Thermal Protection System.................
Hardware and Instrumentation .........

1.3-2
1.3-2
1.3-3
1.3-3
1.3-3

The external tank (ET) contains the liquid

hydrogen fuel and liquid oxygen oxidizer and
supplies them under pressure to the three
SSMEs in the orbiter during ascent. When the
SSMEs are shut down, the ET is jettisoned and
enters the Earths atmosphere, where it breaks
up and impacts in a remote ocean area. ET
impact zones for direct insertion are discussed
in Section 1.1.

Since the STS-91 mission, a super lightweight

external tank (SLWT) has been used. This tank
weighs approximately 58,500 pounds inert. The
SLWT is 7500 pounds lighter than the
lightweight tank (no longer used) and this
reduction provides an increased payload
capability over prior configurations.
The ET is attached to the orbiter at one forward
attachment point and two aft points. In the aft
attachment area, there are also umbilicals that
carry fluids, gases, electrical signals, and
electrical power between the tank and the
orbiter. Electrical signals and controls between
the orbiter and the two SRBs also are routed
through those umbilicals.

The largest and heaviest (when loaded) element

of the space shuttle, the ET, has three major

Super Lightweight External Tank

1.3-1

1. GENERAL DESCRIPTION
1.3 External Tank

USA007587
Rev. A
is 19,563 ft3. It is 331 inches in diameter, 592
inches long and weighs 12,000 pounds empty.

Liquid Oxygen Tank

The liquid oxygen tank is an aluminum
monocoque structure composed of a fusionwelded assembly of preformed, chem-milled
gores, panels, machined fittings, and ring
chords. It operates in a pressure range of 20 to
22 psig. The tank contains anti-slosh and antivortex provisions to minimize liquid residuals
and damp fluid motion. The tank feeds into a
17-inch-diameter feed line that conveys the
liquid oxygen through the intertank, then
outside the ET to the aft right-hand ET/orbiter
disconnect umbilical.
The 17-inch-diameter
feed line permits liquid oxygen to flow at
approximately 2,787 pounds per second with
the SSMEs operating at 104 percent or permits a
maximum flow of 17,592 gallons per minute.
The liquid oxygen tanks double-wedge nose
cone reduces drag and heating, contains
electrical system components, and serves as a
lightning rod. The liquid oxygen tanks volume

Intertank
The intertank is a steel/aluminum semimonocoque cylindrical structure with flanges on each
end for joining the liquid oxygen and liquid
hydrogen tanks. The intertank houses ET instrumentation components and provides an
umbilical plate that interfaces with the ground
facility arm for purge gas supply, hazardous
gas detection, and hydrogen gas boiloff during
ground operations. It consists of mechanically
joined skin, stringers, and machined panels of
aluminum alloy. The intertank is vented during
flight. The intertank contains the forward SRBET attach thrust beam and fittings that
distribute the SRB loads to the liquid oxygen
and liquid hydrogen tanks. The intertank is 270
inches long, 331 inches in diameter, and weighs
12,100 pounds.

Liquid Oxygen Tank Structure

Intertank Structure
1. GENERAL DESCRIPTION
1.3 External Tank

1.3-2

USA007587
Rev. A

Liquid Hydrogen Tank Structure

Liquid Hydrogen Tank

Hardware and Instrumentation

The liquid hydrogen tank is an aluminum

semimonocoque structure of fusion-welded
barrel sections, five major ring frames, and
forward and aft ellipsoidal domes.
Its
operating pressure range is 32 to 34 psia. The
tank contains an anti-vortex baffle and siphon
outlet to transmit the liquid hydrogen from the
tank through a 17-inch line to the left aft
umbilical. The liquid hydrogen feed line flow
rate is 465 pounds per second with the SSMEs
at 104 percent or a maximum flow of 47,365
gallons per minute. At the forward end of the
liquid hydrogen tank is the ET/orbiter forward
attachment pod strut, and at its aft end are the
two ET/orbiter aft attachment ball fittings as
well as the aft SRB-ET stabilizing strut
attachments. The liquid hydrogen tank is 331
inches in diameter, 1,160 inches long, and has a
volume of 53,518 ft3 and a dry weight of 29,000
pounds.

The external hardware, ET/orbiter attachment

fittings, umbilical fittings, electrical, and range
safety system weigh 9,100 pounds.
Each propellant tank has a vent and relief valve
at its forward end. This dual-function valve
can be opened by ground support equipment
for the vent function during prelaunch and can
open during flight when the ullage pressure of
the liquid hydrogen tank reaches 36 psig, or
the ullage pressure of the liquid oxygen tank
reaches 31 psig.
There are eight propellant-depletion sensors,
four each for fuel and oxidizer. The fueldepletion sensors are located in the bottom of
the fuel tank.
The oxidizer sensors are
mounted in the orbiter liquid oxygen feed line
manifold downstream of the feed line
disconnect. During SSME burns, the orbiter
GPCs constantly compute the instantaneous
mass of the vehicle due to the usage of the
propellants. Normally, main engine cutoff
(MECO) is based on a predetermined velocity;
however, once past a flight-specific arming
mass, if any two of the fuel or oxidizer sensors
sense a dry condition, the engines will be shut
down.

Thermal Protection System

The ET thermal protection system consists of
sprayed-on foam insulation and premolded
ablator materials. The system also includes the
use of phenolic thermal insulators to preclude
air liquefaction. Thermal isolators are required
for liquid hydrogen tank attachments to
preclude the liquefaction of air-exposed
metallic attachments and to reduce heat flow
into the liquid hydrogen.
The thermal
protection system weighs 4,823 pounds.

The locations of the liquid oxygen sensors

allow the maximum amount of oxidizer to be
consumed in the engines, while allowing
sufficient time to shut down the engines before
the oxidizer pumps cavitate (run dry). In
addition, 1,100 pounds of liquid hydrogen are
loaded over and above that required by the 6:1
oxidizer/fuel engine mixture ratio. The excess
hydrogen ensures that the propellant ratio
1.3-3

1. GENERAL DESCRIPTION
1.3 External Tank

USA007587
Rev. A
during MECO is fuel-rich. High temperatures
during an oxidizer-rich engine shutdown can
cause severe erosion of engine components.

A swing-arm-mounted cap to the fixed service

structure covers the oxygen tank vent on top of
the ET during the countdown and is retracted
about 2 minutes before lift-off.
The cap
siphons off oxygen vapor that threatens to
form ice on the ET, thus protecting the orbiters
TPS during launch.

Four pressure transducers located at the top of

the liquid oxygen and liquid hydrogen tanks
monitor the ullage pressures.
Each of the two aft ET umbilical plates mate
with a corresponding plate on the orbiter. The
plates help maintain alignment among the
umbilicals. Physical strength at the umbilical
plates is provided by bolting corresponding
umbilical plates together. When the orbiter
GPCs command external tank separation, the
bolts are severed by pyrotechnic devices.

The liquid hydrogen tank umbilical has two

valves for liquid and one for gas.
The
intermediate-diameter
liquid
hydrogen
umbilical is a recirculation umbilical used only
during the liquid hydrogen chill-down
sequence during prelaunch.
The ET also has two electrical umbilicals that
carry electrical power from the orbiter to the
tank and the two SRBs and provide
information from the SRBs and ET to the
orbiter.

The ET has five propellant umbilical valves

that interface with orbiter umbilicals: two for
the liquid oxygen tank and three for the liquid
hydrogen tank. One of the liquid oxygen tank
umbilical valves is for liquid oxygen, the other
for gaseous oxygen.

1. GENERAL DESCRIPTION
1.3 External Tank

1.3-4

USA007587
Rev. A

1.4

and transmit the weight load through their

structure to the mobile launch platform.

SOLID ROCKET BOOSTERS

CONTENTS
Hold-Down Posts.................................
SRB Ignition ..........................................
Electrical Power Distribution .............
Hydraulic Power Units .......................
Thrust Vector Control..........................
SRB Rate Gyro Assemblies .................
SRB Separation .....................................
Range Safety System............................
SRB Descent and Recovery .................

At liftoff, the SRBs are ignited after the three

SSMEs thrust level is verified. Each booster
generates a thrust of approximately 3,300,000
lbs (at sea level), providing 71.4 percent of the
thrust at liftoff and during first-stage ascent,
lifting the space shuttle off the pad and up to an
altitude of about 150,000 ft (or 24 nm). The
solid propellant is spent after burning for a little
more than two minutes, at which point the SRBs
are jettisoned. Parachutes bring the SRBs back
down to Earth intact, impacting the ocean
approximately 122 nm downrange.

1.4-3
1.4-4
1.4-5
1.4-5
1.4-6
1.4-6
1.4-7
1.4-7
1.4-8

The two solid rocket booster (SRBs) are the

largest solid-propellant motors ever flown and
the first ever designed for reuse.
Prelaunch, each booster is attached to the
mobile launch platform at the aft skirt by four
bolts and nuts that are severed by small
explosives at liftoff. The ET is then attached to
the two SRBs at each SRBs aft frame by two
lateral sway braces and a diagonal attachment.
The forward end of each SRB is attached to the
ET at the SRBs forward skirt. The orbiter is
then mated to the ET/SRB stack. In the end, the
two SRBs carry the entire weight of the stack

Each SRB measures about 149 ft in length and

12 ft in diameter and weighs approximately
1,300,000 lbs at launch (approximately 1,100,000
lbs of that being propellant).
The propellant mixture in each SRB motor
consists of an ammonium perchlorate (oxidizer,
69.6 percent by weight), aluminum (fuel,
16 percent), iron oxide (a catalyst, 0.4 percent), a
polymer (a binder that holds the mixture
together, 12.04 percent), and an epoxy curing
agent (1.96 percent). The propellant is an
11-point star-shaped perforation in the forward
motor segment and a double-truncated-cone

Solid Rocket Booster

1.4-1

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

USA007587
Rev. A
perforation in each of the aft segments and aft
closure.
This configuration provides high
thrust at ignition and then reduces the thrust by
approximately a third some 50 seconds after
liftoff. This prevents overstressing the vehicle
during maximum dynamic pressure.
The SRBs are used as matched pairs, and each is
made up of four solid rocket motor segments.
The pairs are matched by loading each of the
four motor segments in pairs from the same
batches of propellant ingredients to minimize
any thrust imbalance. The segmented-casing
design assures maximum flexibility in fabrication and ease of transportation and handling.
Each segment is shipped to the launch site on a
heavy-duty rail car with a specially built cover.
Each nozzle has an expansion ratio of 7.72:1 and
has a carbon cloth liner that erodes and chars
during firing. Each nozzle is gimbaled for
thrust vector control, using a convergentdivergent, movable design in which an aft
pivot-point flexible bearing is the gimbal
mechanism. To actuate the gimbals, each SRB
has its own redundant auxiliary power unit and
hydraulic pumps.
The all-axis gimbal
capability is 8.
Each SRB has two integrated electronic
assemblies (IEA), one in the forward skirt and
one in the ET/SRB attach ring. After burnout,
the forward IEA initiates the release of the nose
cap and frustum. The aft IEA connects with the
forward IEA and the orbiter avionics systems
for SRB ignition commands and nozzle thrust
vector control. Each IEA has a multiplexer/
demultiplexer, which sends or receives more
than one message, signal, or unit of information
on a single communication channel.

The recovery crew retrieves the SRBs,

frustum/drogue chutes, and main parachutes.
The SRB nose caps and nozzle extensions are
not recovered. The nozzles are plugged, the
solid rocket motors are dewatered, and the
SRBs are towed back to the launch site. Once
there, each booster is disassembled and washed
with fresh and deionized water to limit salt
water corrosion. The motor segments, igniter,
and nozzle are then shipped back to the
manufacturer for refurbishment.
Following the Challenger accident, detailed
structural analyses were performed on critical
structural elements of the SRB. One such
element was the attach ring where the SRBs
connect to the ET. Areas of distress were noted
in some of the fasteners where the ring attaches
to the SRB motor case. This situation was
attributed to the high loads encountered during
water impact. The attach ring was redesigned
to correct the situation and ensure higher
strength margins during ascent. Instead of
forming a C and encircled the motor case
270, the attach ring now encircles the motor
case a complete 360.
Additionally, special structural tests performed
on the aft skirt discovered an anomaly in a
critical weld between the hold-down post and
skin of the skirt. This led to the addition of
reinforcement brackets and fittings in the aft
ring of the skirt.
The redesigned attach ring and the addition of
the brackets and fittings increased the SRBs
weight by approximately 450 pounds.

Eight booster separation motors (four in the

nose frustum and four in the aft skirt) of each
SRB burn for 1.02 seconds at SRB separation.
Each separation motor is 31.1 inches long and
12.8 inches in diameter.

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

1.4-2

USA007587
Rev. A

Hold-Down Posts
Each SRB has four hold-down posts that fit into
corresponding support posts on the mobile
launch platform. Hold-down bolts hold the
SRB and launcher platform posts together. Each
bolt has a nut at each end, but only the top nut
is frangible. The top nut contains two NASA
Standard Initiator detonators (NSIs), which are
ignited at solid rocket motor ignition
commands.

SRB Support/Hold-Down Post

SRB Hold-Down Configuration

1.4-3

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

USA007587
Rev. A
When the two NSI detonators are ignited at
each hold-down, the hold-down bolt travels
downward because of a combination of forces;
the release of tension in the bolt (pretensioned
before launch), NSI detonator gas pressure, and
gravity. The bolt is stopped by the stud
deceleration stand, which contains sand. The
SRB bolt is 28 inches long and is 3.5 inches in
diameter. The frangible nut is captured in a
blast container.
The solid rocket motor ignition commands are
issued by the orbiters computers through the
master events controllers to the hold-down
pyrotechnic initiator controllers (PICs) on the
mobile launch platform. They provide the
ignition to the hold- down NSI detonators. The
launch processing system monitors the SRB
hold-down PICs for low voltage during the last
16 seconds before launch. PIC low voltage will
initiate a launch hold.

The fire 1 and 2 commands cause the redundant

NSI detonators to fire through a thin barrier seal
down a flame tunnel. This ignites a pyrotechnic
booster charge, which is retained in the S&A
device behind a perforated plate. The booster
charge ignites the propellant in the igniter
initiator, and combustion products of this
propellant ignite the solid rocket motor
initiator, which fires down the length of the
solid rocket motor igniting the solid rocket
motor propellant.

SRB Ignition
During the final ordnance installation and
connection (performed a few days prior to
launch) the SRB ignition S&A devices safing
pin is removed from the S&A device. This
allows the S&A device to be armed remotely
during final countdown. Five minutes before
launch, the SRB S&A device is rotated to the
arm position. The solid rocket motor ignition
commands are issued when the three SSMEs are
at or above 90-percent rated thrust, no SSME
fail and/or SRB ignition PIC low voltage is
indicated, and there are no holds from the
launch processing system.
The solid rocket motor ignition commands are
sent by the orbiter computers through the
master events controllers (MECs) to the S&A
devices NSI detonators in each SRB. A PIC
single-channel capacitor discharge device
controls the firing of each pyrotechnic device.
Three signals must be present simultaneously
for the PIC to generate the pyrotechnic firing
output. These signals, arm, fire 1, and fire 2,
originate in the GPCs and are transmitted to the
MECs. The MECs reformat them to 28-volt dc
signals for the PICs. The arm signal charges the
PIC capacitor to 40 volts dc (minimum of 20
volts dc).
1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

Solid Rocket Booster-Exploded View

The GPC launch sequence also controls certain
critical valves in the main propulsion system
(MPS) and monitors the engine-ready
indications from the SSMEs. The MPS start
commands are issued by the GPCs at
6.6 seconds before launch (staggered start
engine 3, engine 2, engine 1all approximately
within 0.25 second), and the sequence monitors
the thrust buildup of each engine. All three
SSMEs must reach the required 90-percent
thrust within 3 seconds; otherwise, an orderly
shutdown is commanded, and safing functions
are initiated.

1.4-4

USA007587
Rev. A
Normal thrust buildup to the required 90percent thrust level will result in the SSMEs
being commanded to the liftoff position
3 seconds before liftoff, as well as the fire 1
command being issued to arm the SRBs. Also at
3 seconds before liftoff, the vehicle base bending
load modes are allowed to initialize (movement
of approximately 25.5 inches measured at the
tip of the external tank, with movement
towards the external tank).
SRB ignition sequence occurs as follows:

PIC initiated ignition of S&A pyrotechnic

charge

S&A charge ignites the Initiator propellant

Initiator propellant ignites rocket motor

ignitor

Ignitor propellant ignites booster motor

propellant

At T-0, the two SRBs are ignited, the frangible

nuts at each of the eight hold down studs are
separated, the onboard master timing unit,
event timer, and mission event timers are
started, the three SSMEs are at 100 percent and
launch is initiated. The ground launch sequence
is now terminated.
At 0.23 seconds after liftoff, booster chamber
pressure reaches 563.5 psia and liftoff
commences. At 0.6 seconds after liftoff, booster
chamber pressure reaches maximum limit,
nominally 914 psia.
The solid rocket motor thrust profile is tailored
to reduce thrust during the maximum dynamic
pressure region.

Electrical Power Distribution

Electrical power distribution in each SRB
consists of orbiter-supplied main dc bus power
to each SRB via SRB buses A, B, and C. Orbiter
main dc buses A, B, and C supply main dc bus
power to corresponding SRB buses A, B, and C.
In addition, orbiter main dc bus C supplies
backup power to SRB buses A and B, and
orbiter bus B supplies backup power to SRB bus
C. This electrical power distribution arrangement allows all SRB buses to remain powered in
the event one orbiter main bus fails.

The nominal dc voltage is 28 volts dc, with an

upper limit of 32 volts dc and a lower limit of 24
volts dc.

Hydraulic Power Units

There are two self-contained, independent
hydraulic power units (HPUs) on each SRB.
Each HPU consists of an auxiliary power unit
(APU), fuel supply module, hydraulic pump,
hydraulic reservoir, and hydraulic fluid manifold assembly.
The APUs are fueled by
hydrazine and generate mechanical shaft power
to a hydraulic pump that produces hydraulic
pressure for the SRB hydraulic system. The two
separate HPUs and two hydraulic systems are
located on the aft end of each SRB between the
SRB nozzle and aft skirt. The HPU components
are mounted on the aft skirt between the rock
and tilt actuators. The two systems operate
from 28 seconds before liftoff until SRB
separation. The two independent hydraulic
systems are connected to the rock and tilt servo
actuators.
The APU controller electronics are located in
the SRB aft IEA on the aft external tank attach
rings.
The APUs and their fuel systems are isolated
from each other. Each fuel supply module
(tank) contains 22 pounds of hydrazine. The
fuel tank is pressurized with gaseous nitrogen
at 400 psi, which provides the force to expel
(positive expulsion) the fuel from the tank to the
fuel distribution line, maintaining a positive
fuel supply to the APU throughout its
operation.
The fuel isolation valve is opened at APU
startup to allow fuel to flow to the APU fuel
pump and control valves and then to the gas
generator. The gas generators catalytic action
decomposes the fuel and creates a hot gas. It
feeds the hot gas exhaust product to the APU
two-stage gas turbine. Fuel flows primarily
through the startup bypass line until the APU
speed is such that the fuel pump outlet pressure
is greater than the bypass lines. Then all the
fuel is supplied to the fuel pump.
The APU turbine assembly provides mechanical
power to the APU gearbox. The gearbox drives
the APU fuel pump, hydraulic pump, and lube
oil pump. The APU lube oil pump lubricates

1.4-5

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

USA007587
Rev. A
the gearbox. The turbine exhaust of each APU
flows over the exterior of the gas generator,
cooling it, and is then directed overboard
through an exhaust duct.
When the APU speed reaches 100 percent, the
APU primary control valve closes, and the APU
speed is controlled by the APU controller
electronics. If the primary control valve logic
fails to the open state, the secondary control
valve assumes control of the APU at 113percent speed.
Each HPU on an SRB is connected to both servo
actuators on that SRB. One HPU serves as the
primary hydraulic source for the servo actuator,
and the other HPU serves as the secondary
hydraulics for the servo actuator. Each servo
actuator has a switching valve that allows the
secondary hydraulics to power the actuator if
the primary hydraulic pressure drops below
2,050 psi. A switch contact on the switching
valve will close when the valve is in the
secondary position. When the valve is closed, a
signal is sent to the APU controller that inhibits
the 100-percent APU speed control logic and
enables the 113-percent APU speed control
logic. The 113-percent APU speed enables one
APU/HPU to supply sufficient operating
hydraulic pressure to both servo actuators of
that SRB.
The APU 100-percent speed corresponds to
72,000 rpm and 113-percent to 81,000 rpm.
The APUs/HPUs and hydraulic systems are
reusable for 20 missions.

Thrust Vector Control

Each SRB has two hydraulic gimbal servo
actuators: one for rock and one for tilt. The
servo actuators provide the force and control to
gimbal the nozzle for thrust vector control.
The space shuttle ascent thrust vector control
(ATVC) portion of the flight control system
directs the thrust of the three SSMEs and the
two SRB nozzles to control attitude and
trajectory during liftoff and ascent. Commands
from the guidance system are transmitted to the
ATVC drivers, which transmit signals
proportional to the commands to each servo
1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

actuator of the main engines and SRBs. Four

independent flight control system channels and
four ATVC channels control six main engine
and four SRB ATVC drivers, with each driver
controlling one hydraulic port on each main
and SRB servo actuator.
Each SRB servo actuator consists of four
independent, two-stage servo valves that
receive signals from the drivers. Each servo
valve controls one power spool in each actuator,
which positions an actuator ram and the nozzle
to control the direction of thrust.
The four servo valves in each actuator provide a
force-summed majority voting arrangement to
position the power spool. With four identical
commands to the four servo valves, the actuator
force-sum action prevents a single erroneous
command from affecting power ram motion. If
the erroneous command persists for more than
a predetermined time, the differential pressure
activates causes an isolation valve to remove
hydraulic pressure from the defective servo
valve. This permits the remaining channels and
servo valves to control the actuator ram spool
unhindered. Failure monitors are provided for
each channel to indicate which channel has been
bypassed.
Each actuator ram is equipped with transducers
for position feedback to the thrust vector control
system. Within each servo actuator ram is a
splashdown load relief assembly to cushion the
nozzle at water splashdown and prevent
damage to the nozzle flexible bearing.

SRB Rate Gyro Assemblies

Each SRB contains two rate gyro assemblies
(SRGAs), with each SRGA containing one pitch
and one yaw gyro. These provide an output,
that is proportional to angular rates about the
pitch and yaw axes, to the orbiter computers
and guidance, navigation, and control system
during first-stage ascent flight in conjunction
with the orbiter roll rate gyros until SRB
separation. At SRB separation, a switchover is
made from the SRGAs to the orbiter RGAs.
The SRGA rates pass through the orbiter flight
aft multiplexers/demultiplexers to the orbiter
GPCs. The SRGA rates then pass through an

1.4-6

USA007587
Rev. A
interchangeable midvalue selection (IMVS)
scheme to provide SRB pitch and yaw rates to
the user software. The SRGAs are designed for
20 missions.

SRB Separation
SRB separation is initiated when the head-end
chamber pressure of both SRBs is less than or
equal to 50 psi. To protect against chamber
pressure sensor biases, SRB separation will also
occur once a certain time has elapsed from
booster ignition.
When the separation sequence is initiated, the
ATVC commands the actuators to the null
position and puts the SSMEs into a second-stage
configuration. This ensures the thrust of each
SRB is less than 100,000 pounds. Orbiter yaw
attitude is held for 4 seconds, and SRB thrust
drops to less than 60,000 pounds.
The SRBs separate from the external tank within
30 milliseconds of the ordnance firing
command.
The forward attachment point consists of a ball
(SRB) and socket (ET) held together by one bolt.
The bolt contains one NSI pressure cartridge at
each end. The forward attachment point also
carries the range safety system cross-strap
wiring connecting each SRB and the ET range

safety systems with each other.

The aft attachment points consist of three
separate struts: upper, diagonal and lower.
Each strut contains one bolt with one NSI
pressure cartridge at each end. The upper strut
also carries the umbilical interface between its
SRB and the external tank and on to the orbiter.
There are four booster separation motors
(BSMs) on each end of each SRB. The BSMs
separate the SRBs from the external tank. The
solid rocket motors in each cluster of four are
ignited by firing redundant confined detonating
fuse (CDF) pyrogen initiators from redundant
CDF manifolds.
The separation commands issued from the
orbiter by the SRB separation sequence initiate
the redundant NSI detonator pressure cartridge
in each bolt and ignite the BSMs to effect a clean
separation.

Range Safety System

The shuttle has two range safety systems (RSSs).
One is located in each SRB. Any one or both are
capable of receiving two command messages
(arm and fire) transmitted from the ground
station. The RSS is used only if the shuttle
vehicle violates a launch trajectory red line.

SRB Range Safety System

1.4-7

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

USA007587
Rev. A
An RSS consists of two antenna
command
receivers/decoders,
distributor, an S&A device with
detonators, four CDF assemblies,
linear-shaped charge (LSC).

couplers,
a
dual
two NSI
and one

The antenna couplers provide the proper

impedance for radio frequency and ground
support equipment commands. The command
receivers are tuned to RSS command
frequencies and provide the input signal to the
distributors when an RSS command is sent. The
command decoders use a code plug to prevent
any command signal other than the proper
command signal from getting into the
distributors. The distributors contain the logic
to supply valid destruct commands to the RSS
pyrotechnics.
The NSI detonators provide the spark to ignite
the CDF, which in turn ignites the LSC for
shuttle vehicle destruction. The S&A device
provides mechanical isolation between the NSI
detonators and the CDF before launch and
during the SRB separation sequence.
The first message, called arm, allows the
onboard logic to enable a destruct and
illuminates a light on the flight deck display
and control panel at the commander and pilot
station. The second message transmitted is the
fire command.
The SRB distributors in the SRBs are crossstrapped together. Thus, if one SRB received an
arm or destruct signal, the signal would also be
sent to the other SRB.
Electrical power from the RSS battery in each
SRB is routed to RSS system A. The recovery
battery in each SRB is used to power RSS
system B as well as the recovery system in the
SRB. The SRB RSS is powered down during the
separation sequence, and the SRB recovery
system is powered up.

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

SRB Descent and Recovery

The recovery sequence begins with the
operation of the high-altitude baroswitch,
which triggers the functioning of the
pyrotechnic nose cap thrusters. This ejects the
nose cap, which deploys the pilot chute. This
occurs
at
15,700 feet altitude, 188 seconds after
separation.
The 11.5-foot-diameter conical
ribbon pilot chute provides the force to pull the
lanyard activating the zero-second cutter, which
cuts the loop securing the drogue retention
straps. This allows the pilot chute to pull the
drogue pack from the SRB, causing the drogue
suspension lines to deploy from their stored
position. At full extension of the twelve 95-foot
suspension lines, the drogue deployment bag is
stripped away from the canopy, and the 54-footdiameter conical ribbon drogue chute inflates to
its initial reefed condition. The drogue disreefs
twice after specified time delays, and it
reorients/stabilizes the SRB for main parachute
deployment. The drogue chute can withstand a
load of 270,000 pounds and weighs
approximately 1,200 pounds.
After the drogue chute has stabilized the vehicle
in a tail first attitude, the frustum is separated
from the forward skirt by a charge triggered via
the low-altitude baroswitch at an altitude of
5,500 feet, 243 seconds after separation. It is
then pulled away from the SRB by the drogue
chute. The main parachute suspension lines are
pulled out from deployment bags that remain in
the frustum. At full extension of the lines,
which are 204 feet long, the three main
parachutes are pulled from the deployment
bags and inflate to their first reefed condition.
The frustum and drogue chute continue on a
separate trajectory to splashdown.
After
specified time delays, the main parachute
reefing lines are cut, and the parachutes inflate
to their second reefed and full open
configurations. The main parachute cluster
decelerates the SRB to terminal conditions.
Each of the 136-foot-diameter, 20 conical
ribbon parachutes can withstand a load of
180,000 pounds and weighs 2,180 pounds. The
nozzle extension is severed by pyrotechnic
charge at 20 seconds after low baroswitch
operation.

1.4-8

USA007587
Rev. A
Water impact occurs 277 seconds after
separation at a velocity of 76 feet per second.
The water impact range is approximately
140 miles off the eastern coast of Florida.
Because the parachutes provide for a nozzle
first impact, air is trapped in the empty (burned
out) motor casing, causing the booster to float
with the forward end approximately 30 feet out
of the water.

The main parachutes are released from the SRB

following splashdown using the salt water
activated release (SWAR) system. The drogue
with frustum and the depleted SRB are buoyant.
The main parachutes remain tethered to the SRB
until the retrieval ships arrive for recovery
operations. Various parameters of SRB
operation are monitored and displayed on the
orbiter flight deck control and display panel
and are transmitted to ground telemetry.

Recovery Separation Through Drogue Disreef

1.4-9

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

USA007587
Rev. A

Recovery Main Deploy Through Main Disconnect

1. GENERAL DESCRIPTION
1.4 Solid Rocket Boosters

1.4-10

USA007587
Rev. A

2.

This section discusses in detail each of 25

orbiter systems as listed here in the Table of
Contents. The subsections are organized
alphabetically, with a detailed internal table of
contents provided for each.

SYSTEMS

CONTENTS
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9

2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.19
2.20
2.21

2.22
2.23
2.24
2.25

AUXILIARY POWER UNIT/

HYDRAULICS (APU/HYD) ....
CAUTION AND WARNING
SYSTEM (C/W) ..........................
CLOSED CIRCUIT
TELEVISION (CCTV) ................
COMMUNICATIONS ...............
CREW SYSTEMS ........................
DATA PROCESSING
SYSTEM (DPS) ............................
DEDICATED DISPLAY
SYSTEMS .....................................
ELECTRICAL POWER
SYSTEM (EPS).............................
ENVIRONMENTAL CONTROL
AND LIFE SUPPORT
SYSTEM (ECLSS)........................
ESCAPE SYSTEMS.....................
EXTRAVEHICULAR
ACTIVITY (EVA)........................
GALLEY/FOOD.........................
GUIDANCE, NAVIGATION,
AND CONTROL (GNC) ...........
LANDING/DECELERATION
SYSTEM ......................................
LIGHTING SYSTEM ..................
MAIN PROPULSION
SYSTEM (MPS) ...........................
MECHANICAL SYSTEMS........
ORBITAL MANEUVERING
SYSTEM (OMS)...........................
ORBITER DOCKING
SYSTEM .......................................
PAYLOAD AND GENERAL
SUPPORT COMPUTER.............
PAYLOAD DEPLOYMENT
AND RETRIEVAL SYSTEM
(PDRS)..........................................
REACTION CONTROL
SYSTEM (RCS) ............................
SPACEHAB .................................
STOWAGE ..................................
WASTE MANAGEMENT
SYSTEM (WMS)..........................

2.1-1

Each system subsection begins with descriptive

information covering general purpose, function,
and location. Relevant elements of each system
are then provided in some detail. Where orbiter
panels or DPS displays apply, an illustration of
such appears as near the reference as possible.
In the case of large panels, appropriate
fragments are placed in the text, with full panel
diagrams provided in Appendix A.

2.2-1
2.3-1
2.4-1
2.5-1
2.6-1
2.7-1

Most system subsections conclude with a

summary. Caution and warning summaries
and rules of thumb are also provided where
appropriate.

2.8-1

2.9-1
2.10-1
2.11-1
2.12-1
2.13-1
2.14-1
2.15-1
2.16-1
2.17-1
2.18-1
2.19-1
2.20-1

2.21-1
2.22-1
2.23-1
2.24-1
2.25-1

2-1

2. SYSTEMS

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS

2-2

USA007587
Rev. A

2.1

hydraulic/Freon heat exchanger, electrical

circulation pump, and electrical heaters.

AUXILIARY POWER UNIT/

HYDRAULICS (APU/HYD)

Each system provides hydraulic pressure to

position hydraulic actuators for:

CONTENTS
Description.................................................. 2.1-1
Fuel System ................................................. 2.1-2
Gas Generator and Turbine ...................... 2.1-5
Lubricating Oil ........................................... 2.1-5
Electronic Controller.................................. 2.1-6
Injector Cooling System ............................ 2.1-11
APU Heaters ............................................... 2.1-12
Water Spray Boilers ................................... 2.1-13
Main Hydraulic Pump .............................. 2.1-17
Hydraulic Reservoir .................................. 2.1-20
Hydraulic Accumulator ............................ 2.1-20
Circulation Pump and Heat
Exchanger ......................................... 2.1-20
Hydraulic Heaters...................................... 2.1-22
Operations................................................... 2.1-22
APU/HYD Caution and Warning
Summary .......................................... 2.1-24
APU/HYD Summary Data....................... 2.1-25
APU/HYD Rules of Thumb ..................... 2.1-25

1.

Thrust vector control (TVC) of the

main engines by gimbaling the three
SSMEs

2.

Actuation of various control valves on

the SSMEs

3.

Movement of the orbiter aerosurfaces

(elevons, body flap, rudder/speed
brake)

4.

Retraction of the external tank/orbiter

17-inch liquid oxygen and liquid
hydrogen disconnect umbilicals within the orbiter at external tank jettison

5.

Main/nose landing gear deployment

(system 1)/(system 1 or 2)

6.

Main landing gear brakes and anti-skid

7.

Nose wheel steering (system 1 with

backup from system 2)

Each hydraulic system is capable of operation

when exposed to forces or conditions caused by
acceleration, deceleration, normal gravity, zero
gravity, hard vacuum, and temperatures
encountered during on-orbit dormant conditions.
Three identical, but independent, improved
auxiliary power units (APUs; also called IAPUs)
provide power for the orbiter hydraulic systems.
The APU is a hydrazine-fueled, turbine-driven
power unit that generates mechanical shaft
power to drive a hydraulic pump that produces
pressure for the orbiters hydraulic system. Each
unit weighs about 88 pounds and produces 135
horsepower.
Auxiliary Power Unit

Description
The orbiter has three independent hydraulic
systems. Each consists of a main hydraulic
pump, hydraulic reservoir, hydraulic bootstrap
accumulator, hydraulic filters, control valves,

Each APU consists of a fuel tank, a fuel feed

system, a system controller, an exhaust duct, lube
oil cooling system, and fuel/lube oil vents and
drains. Redundant electrical heater systems and
insulation thermally control the system above 45
F to prevent fuel from freezing and to maintain
required lubricating oil viscosity. Insulation is
used on components containing hydrazine, lube
oil, or water to minimize electrical heater power

2.1-1

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
requirements and to keep high surface
temperatures within safe limits on the turbine
and exhaust ducts.
The three APUs and fuel systems are located in
the aft fuselage. Each APU fuel system supplies
storable liquid hydrazine fuel to its respective
fuel pump, gas generator valve module, and
gas generator, which decomposes the fuel
through catalytic action. The resultant hot gas
drives a single-stage, dual pass turbine. The
turbine exhaust flow returns over the exterior of
the gas generator, cooling it, and is then
directed overboard through an exhaust duct at
the upper portion of the aft fuselage near the
vertical stabilizer.
The turbine assembly provides mechanical
power through a shaft to drive reduction gears
in the gearbox. The gearbox drives a fuel
pump, a hydraulic pump, and a lube oil pump.
The hydraulic pump supplies pressure to the
hydraulic system. The fuel pump increases the
fuel pressure at its outlet to sustain pressurized
fuel to the gas generator valve module and gas
generator.
The lube oil system supplies
lubricant to the gearbox reduction gears and
uses the reduction gears as scavenger pumps to
supply lube oil to the inlet of the lube oil pump
to increase the pressure of the lube oil system.
The lube oil of each APU is circulated through a
heat exchanger in a corresponding water spray
boiler. Three water spray boilers (WSBs), one
for each APU, cool the lube oil systems. The
hydraulic fluid of each hydraulic pump driven
by an APU is also circulated through a
hydraulic heat exchanger in the corresponding
water spray boiler to cool hydraulic fluid
during hydraulic system operation. The three
WSBs are also located in the aft fuselage of the
orbiter.

Fuel System
The APU fuel system (one for each of the three
APUs) includes the fuel tank and fuel isolation
valves, the fuel pump, and fuel control valves.
The improved APUs use passive heat sinks and
heat shields to minimize the effects of heat
soakback.

2. SYSTEMS

Fuel Tanks
The APU fuel tanks are mounted on supports
cantilevered from the sides of the internal
portion of the aft fuselage. The fuel is storable
liquid anhydrous hydrazine. The hydrazine is
stored in a fuel tank with a total capacity of
about 350 pounds.
The fuel tank, which
incorporates a diaphragm at its center, is
serviced with fuel on one side and the
pressurant (gaseous nitrogen) on the other. The
nitrogen is the force acting on the diaphragm
(positive expulsion) to expel the fuel from the
tank to the fuel distribution lines and maintain
a positive fuel supply to the APU throughout its
operation. Each typical prelaunch fuel tank
load is approximately 332 pounds. The fuel
supply supports the nominal power unit
operating time of 90 minutes in a mission or
any defined abort mode, such as an abort once
around, when the APUs run continuously for
approximately 110 minutes. Under operating
load conditions, an APU consumes approximately 3 to 3.5 pounds of fuel per minute.

Auxiliary Power Unit Locations

The fuel tanks are 28-inch-diameter spheres.
Fuel tanks 1 and 2 are located on the port side
of the orbiters aft fuselage, and tank 3 is located
on the starboard side. Each fuel tank is serviced
through its respective fill and drain service
connections, located on the corresponding side
of the aft fuselage. The gaseous nitrogen
servicing connection for each fuel tank is
located on the same panel as the fuel servicing
connections on the corresponding side of the aft
fuselage. The fuel tank is pressurized to 365 psi
prelaunch.

2.1-2

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
Each fuel tanks temperature and gaseous
nitrogen pressure are monitored by the APU
controller and transmitted to the GPC, where
quantity is calculated and transmitted to the
APU FUEL/H2O QTY meters on the dedicated
MEDS display. The fuel quantity of 100 percent
on the meter is equivalent to 350 pounds. Fuel
pressure (psia) is shown on the FUEL PRESS
meter on the dedicated MEDS display. Fuel
quantity in percent is also displayed on the BFS
SM SYS SUMM 2 display (FUEL QTY).

287

143

431

719

575

863

1007

1151

APU
143

XXX

XXX

XXX

1
2
3
XXXX XXXX XXXX

FUEL
QTY
%

287
1
2
3

FUEL
P
6
5

XXX

XXX

XXXX XXXX XXXX

XXX

H O
2
QTY
%

431

10

575
8
9

XXX

XXX

XXX

12

XXXX XXXX XXXX

QTY
%

The gaseous nitrogen pressure in each fuel tank

exerts a force on the tanks diaphragm to expel
the hydrazine fuel under pressure to the fuel
distribution system. Filters are incorporated
into each distribution line to remove any
particles. The fuel distribution line branches
into two parallel paths downstream of the filter.
An isolation valve is installed in each parallel
path, providing redundant paths to permit fuel
flow to the APU or to isolate the APU from the
fuel supply tanks.

11

HYDRAULIC

719

OIL
IN TEMP
F

PRESS
L

863
13

14

15

L
17

16

L
18

1 APU 1 FUEL QTY meter

7 APU 1 H2O QTY meter

13 HYD 1 QTY meter

2 APU 2 FUEL QTY meter

8 APU 2 H2O QTY meter

14 HYD 2 QTY meter

3 APU 3 FUEL QTY meter

9 APU 3 H2O QTY meter

15 HYD 3 QTY meter

4 APU 1 FUEL PRESS meter 10 APU 1 OIL TEMP meter

16 HYD 1 PRESS meter

5 APU 2 FUEL PRESS meter 11 APU 2 OIL TEMP meter

17 HYD 2 PRESS meter

6 APU 3 FUEL PRESS meter 12 APU 3 OIL TEMP meter

18 HYD 3 PRESS meter

usa007587_1077ar2.cvx

MEDS APU/HYDRAULIC Display

GN 2 Injector
cooling

Key:

H2 O

- H2 O
APU
controller

- N2 H4
- Oil
Fuel tank
valves (2)
Fuel pump

R
N2 H4

Gas
gen

GN 2
Pri.

Fuel
tank
Pressure
relief valve

(3)
(rpm)

Turbine

Gear
box

Sec.

GN2

Hydraulic
main pump
Oil pump

Fuel control valves

Fuel test
line

Overboard

Fuel pump seal cavity

drain catch bottle

From water
spray boiler

To water
spray boiler
049.cvs

Improved APU Fuel System Schematic

2.1-3

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

APU FUEL TK VLV Switches and Circuit Breakers on Panel R2

Fuel Tank Isolation Valves
Both isolation valves in each APU fuel
distribution system are electrically powered
solenoid valves that are controlled by the
corresponding APU FUEL TK VLV 1, 2, 3
switches on panel R2. They are energized open
when the corresponding switch is positioned to
OPEN; both valves are closed when the switch
is positioned to CLOSE, or if electrical power
is lost.
Each valve has a reverse relief function to
relieve pressure on fuel trapped in the fuel
distribution line downstream of the fuel tank
valves when both valves are closed. The valve
relieves the downstream pressure when the
pressure increases 40 psi to 200 psi above fuel
tank pressure due to heat soakback following
APU shutdown.
The IAPU fuel tank isolation valves are cooled
by fuel flow when the valves are open. Each
valve
has
redundant
temperature
measurements (two per valve, four per APU).
One temperature reading for each valve is
displayed on the BFS SM SYS SUMM 2 display
and the APU/HYD, DISP 86 display (Ops 201)
beside the FU TK VLV AT and BT labels. There
are two tank isolation valve circuit breakers per
2. SYSTEMS

APU (one per valve) located on panel R2. These

can be pulled to disconnect electrical power
from the solenoid if a valve fails open or shorts.
The valve heating profile, when the fuel is
stagnant, is gradual and, in the event of a failed
open valve or short, permits adequate time for
corrective action.
Fuel Pump
Each APU fuel pump is a fixed-displacement,
gear-type pump that discharges fuel at
approximately 1,400 to 1,500 psi and operates at
approximately 3,918 rpm. A fuel filter is located
at the fuel pump outlet, and a relief valve
relieves at approximately 1,725 psi back to the
pump inlet if the filter becomes clogged.
Each fuel pump is driven by the turbine through
the reduction gearbox. The fuel pump reduction
gear is located in the lube oil system gearbox, and
a shaft from the reduction gear drives the fuel
pump. Seals are installed on the shaft to contain
any fuel or lube oil leakage. If leakage occurs
through the seals, it is directed to a drain line that
runs to a 500-cubic centimeter catch bottle for
each APU. If the catch bottle is overfilled, it will
relieve overboard at approximately 45 psia
through a burst disk and drain port. After the
disk bursts, the pressure relief valve will cycle
at approximately 28 psia. On ascent or entry,

2.1-4

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
the flight crew can monitor the catch bottles
line pressure on the BFS SM SYS SUMM 2
display (PMP LK P).

For safety reasons, each APU has an automatic

shutdown feature that will shut the APU down
if the speed falls below 80 percent (57,600 rpm)
or rises above 129 percent (92,880 rpm).

Gas Generator and Turbine

Each gas generator consists of a bed of Shell 405
catalyst in a pressure chamber, mounted inside
the APU exhaust chamber. When the hydrazine
fuel comes into contact with the catalyst, it
undergoes
an
exothermic
reaction,
decomposing into a hot gas at approximately
1,700 F. The gas expands rapidly and makes
two passes through a single-stage turbine
wheel, passes over the outside gas generator
chamber, and exits overboard through its own
independent exhaust duct, located near the base
of the vertical stabilizer. The temperature of the
hot gas at the exhaust duct is approximately
1,000 F.

APU Information on BFS SM SYS

SUMM 2 Display
Fuel Control Valves
The APUs operating speed is controlled by the
primary and secondary fuel control valves,
which are installed in series downstream of the
fuel pump. These are solenoid-operated pulsertype valves. In the normal APU operating
mode, the primary control valve pulses to
maintain the APUs speed at about 74,000 rpm
(103%), while the secondary control valve
attempts to control at 113% rpm. If the APU is
taken to high via the APU SPEED SELECT
switch on panel R2, the primary valve attempts
to control at 115% rpm, while the secondary
valve begins pulsing, and controls APU speed
at about 81,000 rpm (113%). If the secondary
valve subsequently fails open, the primary
valve will maintain APU speed at about 83,000
rpm (115%). If the secondary valve loses
power, it goes to the closed position and shuts
down the APU. As noted above, the primary
valve goes to full open if it loses power,
allowing the secondary valve to take over
automatically and control at high speed (113%).
The crew can see APU speed on the BFS SM SYS
SUMM 2 display (APU SPEED %) in percent
(100 percent = 72,000 rpm).
The speed
fluctuates due to the nature of the pulsemodulated fuel flow system.

The shaft power from the spinning turbine is

sent to the hydraulic main pump associated
with the APU via a speed reduction gearbox. It
is also used to drive the APUs fuel pump and
lubrication oil pump.
The normal speeds of the hydraulic main pump,
APU fuel pump, and APU lube oil pump are
3,918 rpm, 3,918 rpm, and 12,215 rpm,
respectively. The lube oil system is necessary to
lubricate the APU gearbox and the fuel pump.
The temperatures of the gas generator bed, the
gas generator fuel injector, and the turbine
exhaust gas are visible on the BFS SM SYS
SUMM 2 DPS display (GG BED, INJ, TEMP
EGT). While the APU is running, the gas generator bed temperature transducer goes off-scale
high at about 510 F. On orbit, when the APU is
shut down, the gas generator bed temperature
transducer is useful to monitor the bed temperature when the bed is kept warm by heaters.

Lubricating Oil
The APU lube oil system is a scavenger-type
with a fixed-displacement pump. Each APU
turbine, through its gearbox, drives a lube oil
pump at 12,215 rpm. The system is pressurized
with gaseous nitrogen (GN2) to provide
adequate suction pressure to start the lube oil
pump under zero-gravity conditions. Each lube
oil system has its own nitrogen gas storage

2.1-5

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
vessel that is pressurized to approximately 140
psia. The pressurization system for each lube
oil system has a valve controlled by its
corresponding APU controller.
The GN2
pressurization valve for each power unit is
energized open by its corresponding controller
when the gearbox pressure is below 5.2 psi,
1.3 psi, to ensure that gearbox pressure is
sufficiently above the requirements for proper
scavenging and lube pump operation.

287

143

431

719

575

863

1007

1151

APU
143

287
1
2
3

431

XXX

XXX

XXX

1
2
3
XXXX XXXX XXXX

FUEL
QTY
%

FUEL
P
6
5

XXX

XXX

XXXX XXXX XXXX

XXX

H O
2
QTY
%

OIL
IN TEMP
F
10

575
8
9

11

HYDRAULIC
1

XXX

XXX

XXX

12

The pump increases the lube oil pressure to

approximately 60 psi, directs the lube oil
through the corresponding water spray boiler
for cooling, and returns the lube oil to the
accumulators and gearbox. Two accumulators
in each lube oil system allow thermal expansion
of the lube oil, accommodate gas initially
trapped in the external lube circuit, maintain
lube oil pressure at a minimum of approximately 15 psia, and act as a zero-gravity, allaltitude lube reservoir.

719

The following information is transmitted to the

BFS SM SYS SUMM 2 display by the APU
controller via the GPC: lube oil pump outlet
pressure (OIL OUT P) at approximately 45 psia,
outlet temperature at approximately 270 F, and
a return temperature from the water spray
boiler (OIL IN, OUT) at approximately 250 F
for each APU. The lube oil temperature of each
APU is also monitored on the APU OIL TEMP
meter on the dedicated MEDS display.

Electronic Controller

QTY
%

XXXX XXXX XXXX

PRESS
L

863
13

14

15

16

L
17

L
18

1 APU 1 FUEL QTY meter

7 APU 1 H2O QTY meter

13 HYD 1 QTY meter

2 APU 2 FUEL QTY meter

8 APU 2 H2O QTY meter

14 HYD 2 QTY meter

3 APU 3 FUEL QTY meter

9 APU 3 H2O QTY meter

15 HYD 3 QTY meter

4 APU 1 FUEL PRESS meter 10 APU 1 OIL TEMP meter

16 HYD 1 PRESS meter

5 APU 2 FUEL PRESS meter 11 APU 2 OIL TEMP meter

17 HYD 2 PRESS meter

6 APU 3 FUEL PRESS meter 12 APU 3 OIL TEMP meter

18 HYD 3 PRESS meter

usa007587_1077ar2.cvx

MEDS APU/HYDRAULIC Display

Each APU has its own digital controller. The

controller detects malfunctions, controls turbine
speed, gearbox pressurization, and fuel
pump/gas generator heaters. Each controller is
controlled by its corresponding APU CNTLR
PWR switch on panel R2. When the switch is
positioned to ON, 28-volt dc power is sent to
that controller and APU. The controllers are
redundantly powered via dual internal remote
power controllers. When the switch is positioned to OFF, electrical power is removed from
that controller and APU.
APU Start
An APU/HYD READY TO START talkback
indicator for each APU is located on panel R2.
The talkback signals gray when that APU
hydraulic system is ready to start; that is, when
the APU gas generator temperature is above
190 F, APU turbine speed is less than 80
percent, WSB controller is ready, a
corresponding APU fuel tank isolation valve is
open, and corresponding hydraulic main pump
is depressurized. When the APU is started, and
its turbine speed is greater than 80 percent of
normal speed, the corresponding indicator
shows barberpole.

2. SYSTEMS

2.1-6

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
NOTE

CAUTION

A barberpole APU/HYD READY TO

START talkback will not inhibit a start.

After an APU auto shutdown, the APU

FUEL TK VLV switch must be taken to
CLOSE prior to having an auto shutdown.
Failure to close a FUEL TK VLV after an APU
Shutdown can result in the fuel tank isolation
valves reopening and allowing flow fuel to
an APU gas generator bed that is above the
temperature limits for safe restart.

APU OPERATE 1, 2, 3 switches are located on

panel R2. When the switches are positioned to
START/RUN, the corresponding APU controller
activates the start of that unit and removes
electrical power automatically from the units
gas generator and fuel pump heaters.
To start the APU, fuel expelled from the
hydrazine tank flows through the open tank
valves and filter to the gas generator valve
module, which contains the primary and
secondary fuel control valves in series. The
primary pulse control valve is normally open,
and the secondary pulse control valve is
energized open. Fuel flowing through the
pump bypass valve is directed to the gas
generator, because the fuel pump is not being
driven at that moment by the APU turbine.
The fuel in the gas generator decomposes
through catalytic reaction, creates hot gas, and
directs the hot gas to the single-stage turbine,
which begins to rotate.
The turbines
mechanical shaft drives the reduction gears,
rotating the fuel pump, lube oil pump, and
hydraulic pump. The fuel pump increases the
fuel pressure at its outlet and provides
pressurized fuel to the gas generator valve
module and gas generator.
The startup logic delays the APU underspeed
logic check for 10.5 seconds after the start
command is issued. This allows the APU to
reach normal operating speed before the
shutdown logic begins checking for a speed
lower than 80 percent. The auto shutdown
capability of the controller can be disabled by
taking the APU AUTO SHUT DOWN switch on
panel R2 to INHIBIT.
The startup logic does not delay the APU
overspeed logic. If an overspeed is detected at
any time by the controller, the F7 and MASTER
ALARM will annunciate. If the AUTO SHUT
DOWN on panel R2 is ENABLED, the controller
will automatically close the tank isolation
valves and close the secondary control valve.

APU Speed Control

When the APU turbine speed exceeds the
control target (103 percent for NORMAL and
113 percent for HIGH) the appropriate control
valve closes. The fuel is then diverted through
a bypass line back to the fuel pump inlet. When
the turbine speed drops below the control
target, the appropriate valve opens directing
fuel to the gas generator and closing off the
bypass line. The primary fuel valve pulses to
maintain APU speed.
The frequency and
duration of the primary fuel control valve pulses
are functions of the hydraulic load on the unit.
The secondary fuel control valve normally stays
fully open during the operation of the primary.
If the primary valve loses power, it goes to the
fully open position, and the secondary valve
begins pulsing and controlling APU speed. If
the secondary valve loses power at any time it
closes and the APU is shut down. If the auxiliary
power unit is taken to a high speed (by the APU
SPEED SELECT switch on panel R2), the
primary valve attempts to control to 115 percent
rpm, while the secondary valve controls the
units speed at 113 percent rpm.
Each APU controller controls the speed of each
unit upon the activation of the APU SPEED
SELECT switch for each APU on panel R2. The
NORM position controls the speed at
74,160 rpm, 103 percent, plus or minus
8 percent. The HIGH position controls the
speed at 81,360 rpm, 113 percent, plus or minus
8 percent, with a second backup of 82,800 rpm,
115 percent, plus or minus 8 percent.

2.1-7

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
APU Auto Shutdown

APU Ready-for-Start Talkback Indicator Logic

The APU AUTO SHUT DOWN switches on

panel R2 enable the automatic shutdown
feature in the associated APU controllers.
When the switch is positioned to ENABLE, each
controller monitors its corresponding APU
speed. If that APU speed falls below 57,600
rpm (80 percent) or rises above 92,880 rpm (129
percent), the controller automatically shuts
down that unit. Each shutdown command
closes that units secondary fuel valve and the
tank isolation valves.

When an APU AUTO SHUT DOWN switch is

positioned to INHIBIT, the automatic shutdown
sequence for its APU controller is inhibited. If
the turbine speed falls below 80 percent or rises
above 129 percent APU UNDERSPEED or APU
OVERSPEED caution and warning lights on
panel F7 will be illuminated, and a tone will be
generated, even though the APU AUTO SHUT
DOWN switch is in INHIBIT.

Water Spray Boiler

Contr oll er A or B
enabl ed
Steam vent temperature
above 130 F
GN2 shutoff valve open
Hydraulic bypass valve
in proper position

Hydraulic main pump

pressure - normal
Water
APU fuel tank
boiler
val ve - open
controll er
ready

Panel R2

APU Controller
Gas generator temperature
above 190 F
Turbine speed below 80%

APU controller
ready signal
053.cv5

2. SYSTEMS

CAUTION
An APU should not be restarted after an
overspeed shutdown. Uncontained overspeed and turbine wheel breakup could
occur if restart is attempted.

Ready
to Start

2.1-8

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

APU/HYD READY TO START Talkbacks, APU OPERATE Switches,

APU SPEED SELECT Switches, APU CNTLR PWR Switches, and
APU AUTO SHUT DOWN Switches on Panel R2

2.1-9

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
28VA
CH1

CH2
Underspeed
Driver
CH4
CH3
28VB
Closes fuel
tank valves

28VA
CH1

CH2
Overspeed
Driver
CH4

O/S EXT 1A
O/S EXT 2A
O/S EXT 3C
C O/S EXT 2C

C&W
Electronics

O/S EXT 1B
O/S EXT 3B

12

APU 2
APU 3

Z5

CH3

O/S EXT 2B
O/S EXT 3A

APU 2
APU 3

CH1

Yellow
APU
overspeed

Closes fuel
tank valves

E 6
5.2-2

CH2

S/O
Valve
Driver

PNL F7a2
< 129%

28VA
D

APU
underspeed
PNL F7a2
< 80%
E 6
5.2-2

28VB

28VA

Yellow

CH4

CH3

CH1
28VB

PC
Valve
Driver

CH2

CH4

CH3
28VB
Primary
valve

Secondary
valve

APU Overspeed/Underspeed Detection

2. SYSTEMS

2.1-10

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

055.cvs

USA007587
Rev. A

Injector Cooling System

The gas generator injector water cooling system
is used only when the normal cool-down period
of approximately 180 minutes is not available.
The system sprays water to reduce the
temperature of the gas generator injector branch
passages to less than 400 F in the event that a
hot APU must be restarted after it has been
recently shut down. The water cooling ensures
that the hydrazine will not detonate in the fuel
line leading into the injector due to heat
soakback from the gas generator. The injector is
cooled by circulating water around it. The
water from the gas generator injector is
exhausted into the aft fuselage.
1

3.5 minutes before starting the APU. Operational

data from hot APUs shows that the GG INJ
temperature does not accurately reflect the drop
in injector branch temperatures. The crew is safe
to attempt a restart if the GG INJ temperature is
decreasing and at least 3.5 minutes of continuous
injector cooling has been completed. A Class 3
alarm with message "APU 1 (2) Cooldown" will
annunciate 225 seconds after APU injector
cooling is initiated.
CAUTION
Care must be taken not to delay in the OFF
position when taking the APU OPERATE
switch to START/RUN. If cooldown is
terminated more than 1 second prior to
starting the APU, the injector branch
temperatures may increase above start
limits, and detonation may occur without
another cooldown cycle.

APU OPERATE
2
3
START/RUN

INJECTOR COOL
Panel R2
APU 1
CONTROLLER
Vlv open cmd
APU1

The water tank supply is sufficient for about six

total hot starts. The units injector temperature
can be monitored on the BFS SM SYS SUMM 2
display (INJ).
Fuel Pump and Gas Generator
Valve Module Cooling

APU2

GN2 H2O

APU3
Control
Valves

056.cvs

APU Injector Cooling

A single water tank located in the aft fuselage of
the orbiter serves all three APUs. The water
tank is 9.4 inches in diameter and loaded with
about 9 pounds of water or 21 minutes worth of
cooling. The water tank is pressurized with
gaseous nitrogen at a nominal pressure of 120
psi. The pressure acts on a diaphragm to expel
the water through three 0.25-inch-diameter lines
to three control valves.
When the APU
OPERATE switch on panel R2 for APU 1, 2, or 3
is positioned to INJECTOR COOL, the water
valve of that unit opens and directs the water
into the gas generator injector to cool it.

The fuel pump and gas generator valve module

are cooled by passive cooling. The improved
APUs have passive heat sinks and heat shields to
absorb conductive and radiant heat.
This
prevents excessive heat soakback in the gas
generator valve and fuel pump assemblies.
There are no water tanks or associated plumbing
for this module with the APUs. The crew has no
requirement to do anything to provide cooling.
This passive cooling system, in conjunction with
active injector cooling, is used to allow for
contingency restarts in the event a deorbit
becomes necessary within approximately 180
minutes of APU shutdown.
CAUTION
An APU may not be restarted if the
temperature of the fuel pump is above
210 F or the temperature of the gas
generator valve module is above 200 F,
because hydrazine detonation may occur.

If the injector branch (internal) temperature of

an APU is above 400 F from heat soakback, or
if the catalytic bed heater temperature is above
430 F, the flight crew must cool the injector for
2.1-11

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

APU Heaters
The APU HEATER TANK/FUEL LINE/H2O
SYS 1A, lB, 2A, 2B, 3A, 3B switches on panel
A12 operate the thermostatically controlled
heaters located on the corresponding APU fuel
system and water system. The fuel tank, fuel
line, and water line heaters for each APU are
divided into redundant A and B systems. For
example, for APU 1, the TANK/FUEL LINE/
H2O SYS 1A switch powers the A heaters, and
the thermostats provide automatic control.
Only one set of heaters is used at a time. The 1B
switch powers the 1B heaters, and the
thermostats provide automatic control. The
APU fuel tank and line heater thermostats
maintain the temperatures between a nominal
55 F and 65 F. The water system heater
thermostats maintain the temperatures between
55 F and 65 F. The OFF position of each
switch removes power from the respective
heater circuits.
The APU HEATER GAS GEN/FUEL PUMP 1,
2, 3 switches on panel A12 power thermostatically controlled heaters located on the
corresponding APU, fuel pump, gas generator
valve module, and gas generator bed heater.
The thermostats control a series of heaters on
the gas generator valve module, fuel pump, and
all the fuel lines and the water lines from the
fuel pump spray manifold to the gas generator
valve module. The heaters are divided into
redundant A and B systems for each APU. The
A AUTO switch powers the A heater, and the A
thermostat
automatically
controls
the

corresponding APU fuel pump heater,

maintaining fuel pump and gas generator valve
module temperatures at about 100 F. The gas
generator bed heater is maintained between
360 and 425 F by a comparator in the APU
controller that receives its signal from the bed
temperature transducer. The gas generator
temperature range ensures efficient APU
startup through efficient catalytic reaction. The
B AUTO switch position provides the same
capability for the B heater system. The gas
generator and fuel pump heaters are
automatically deactivated by the corresponding
controller at APU start. The OFF position of
each switch removes power from the respective
heater circuits. These heater switches also
provide redundant power to the gas generator
and gearbox pressure signal conditioners for
use while the APU controller is off.
The lube oil system lines on each APU also have
a heater system. These heaters are controlled by
the APU HEATER LUBE OIL LINE 1, 2, 3
switches on panel A12. The lube oil line heaters
for each APU are also divided into an A and B
system; e.g., for 1, A AUTO, and B AUTO. The
A AUTO switch powers the A heater, and the
thermostat
automatically
controls
the
corresponding lube oil system heater,
maintaining the lube oil line in the temperature
range of 55 F to 65 F. The B AUTO switch
position provides the same capability to the B
heater system. The OFF position of each switch
removes power from the respective heater
circuits.

APU HEATER Controls on Panel A12

2. SYSTEMS

2.1-12

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Water Spray Boilers

The water spray boiler (WSB) system consists of
three identical independent water spray boilers,
one for each APU/hydraulic system. The
boilers are located in the aft fuselage of the
orbiter. Each WSB cools the corresponding
APU lube oil system and hydraulic system by
spraying water onto their lines; as the water
boils off, the lube oil and hydraulic fluid are
cooled. The steam that boils off in each water
spray boiler exits through its own exhaust duct,
located on the starboard side of the vertical
stabilizer.
Each WSB is 45 by 31 inches long by 19 inches
wide, and including controller and vent nozzle,
weighs 181 pounds. They are mounted in the
orbiter aft fuselage between Xo 1340 and 1400, at
Zo 488 minus 15, and at Yo plus 15. Insulation
blankets cover each boiler. The boiler's water
capacity is 142 pounds.
The WSBs have had WSB freeze-up problems in
the past. WSB freeze-up occurs after the preloaded
boiler water has evaporated, and active cooling has
not yet begun. During that time, residual water
in the core, spray bars, or water feedline is exposed
to low pressures and will begin freezing. To
alleviate this problem, each WSB stores a water
and propylene glycol monomethyl ethel (PGME)
mixture in a bellows-type storage tank. The
tank is pressurized by gaseous nitrogen,
providing positive water expulsion to feed the
boiler. The PGME and water mixture of 47%
and 53%, respectively, is the solution to the WSB
freeze-up problem. The PGME/water mixture has
been flown, preloaded in the boiler since
STS-102, and has been flown in the boilers and the

WSB tanks since STS-114. Currently, all WSB tanks

are loaded with the PGME mixture.
Hydraulic fluid passes through the boiler three
times. APU lube oil passes through the boiler
twice. The hydraulic fluid tubes are sprayed
with water from three water spray bars, and two
water spray bars spray the APU lube oil.
Separate water feed valves allow independent
control of the hydraulic fluid spray bars and
APU lube oil spray bars. Redundant electrical
controllers provide completely automatic
operation.
The boiler system maintains APU lube oil
temperature at approximately 250 F and the
hydraulic fluid in the range of 210 to 220 F.
The crew can see the WSB water quantity (H2O
QTY), nitrogen tank pressure (N2 P), nitrogen
regulator pressure (REG P), and nitrogen tank
temperature (N2 T) on the right side of the SM
APU/HYD (DISP 86) display on orbit.

SM APU/HYD Display (DISP 86)

Water Spray Boiler Unit

2.1-13

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
Gaseous nitrogen
Gaseous nitrogen
regulator and
shutoff valve
Gaseous
relief valve
nitrogen
Gaseous
Water fill
fill
nitrogen
vent
Gaseous
nitrogen

Steam
duct
outlet

Steam vent
dump nozzle

Vent heaters
Steam vent

142 Pounds
water
Water
tank

Tank
heaters

Gaseous
nitrogen
tank

(B)

Hydraulic
bypass/
relief valve

Secondary
controller

Water supply
valve (hydraulic)
T T
Boiler
heaters

(A)
Primary
controller

Hydraulic fluid
bypasses boiler
when it decreases
to 190F. Hydraulic
fluid directed through
water boiler at 210F
Vent
Hydraulic fluid
208F set-point
temperature
turns on
hydraulic-fluid
water feed valve
Lube oil

T T
Water supply
valve (lube)

Lube oil
drain

250F set-point
temperature turns
on APU lube oil
water feed valve

Water fill/
drain

060.cvs

Water Spray Boiler (One of Three)

Nitrogen Supply System
The gaseous nitrogen pressure for each WSB is
contained in a corresponding 6-inch spherical
pressure vessel. The pressure vessel contains
0.77 pound of nitrogen at a nominal pressure of
2,400 psi at 70 F. The gaseous nitrogen storage
system of each WSB is directed to its corresponding water storage tank. Each storage
vessel contains sufficient nitrogen gas to expel
all the water from the tank and allow for relief
valve venting during ascent.
The nitrogen shutoff valve between the pressure
valve and water storage tank of each boiler
permits the pressure to reach the nitrogen
regulator and water tank or isolates the nitrogen
supply from the water tank. Each nitrogen
valve is controlled by its respective BOILER N2
SUPPLY 1, 2, or 3 switch on panel R2. The
nitrogen shutoff valve, which is latched open or
closed, consists of two independent solenoid

2. SYSTEMS

coils that permit valve control from either the

primary or secondary controller.
A single-stage regulator is installed between the
nitrogen pressure shutoff valve and the water
storage tank. The gaseous nitrogen regulator
for each water spray boiler regulates the highpressure nitrogen between 24.5 and 26 psig as it
flows to the water storage tank.
A relief valve is incorporated inside each
nitrogen regulator to prevent the water storage
tank pressure from exceeding 33 psig. The
gaseous nitrogen relief valve opens between 30 to
33 psig.
Water Supply System
The water supply for each boiler is stored in a
positive-displacement aluminum tank containing a welded metal bellows separating the
stored water inside the bellows from the
nitrogen expulsion gas.

2.1-14

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

BOILER Switches on Panel R2

Redundant pressure and temperature sensors
located downstream from the gaseous nitrogen
pressure vessel and on the water tank for each
boiler transmit the pressures and temperatures
through each controller to the systems management general-purpose computer. The computer
computes the water tank quantity from the
pressure, volume, and temperature, and
transmits the water tank quantity to the
dedicated MEDS display for each boiler. Water
quantity is available when either the A or B
controller is powered.
Downstream of the water storage tank, the
feedwater lines to each water boiler split into
two parallel lines: one line goes to the hydraulic

fluid flow section and one to the lube oil section

of the WSB. The H2O spray valves in each
feedline are controlled independently by the
boiler controller.
Temperature Control
The two boiler controllers are operated by
the respective BOILER CNTLR/HTR 1, 2,
and 3 switches on panel R2.
When the
applicable switch is positioned to A, the A
controller for that boiler is powered; if it is
positioned to B, the B controller is powered.
The OFF position removes electrical power from
both controllers.

2.1-15

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
0

287

143

431

719

575

863

1007

1151

APU
143

287
1
2
3

431

XXX

XXX

XXX

1
2
3
XXXX XXXX XXXX

FUEL
QTY
%

FUEL
P
6
5

XXX

XXX

XXX

XXXX XXXX XXXX

H2O
QTY
%

10

575
8
9

11

HYDRAULIC

719

OIL
IN TEMP
F

XXX

XXX

XXX

12

XXXX XXXX XXXX

QTY
%

PRESS
L

863
13

14

15

16

L
17

L
18

1 APU 1 FUEL QTY meter

7 APU 1 H2O QTY meter

13 HYD 1 QTY meter

2 APU 2 FUEL QTY meter

8 APU 2 H2O QTY meter

14 HYD 2 QTY meter

3 APU 3 FUEL QTY meter

9 APU 3 H2O QTY meter

15 HYD 3 QTY meter

4 APU 1 FUEL PRESS meter 10 APU 1 OIL TEMP meter

16 HYD 1 PRESS meter

5 APU 2 FUEL PRESS meter 11 APU 2 OIL TEMP meter

17 HYD 2 PRESS meter

6 APU 3 FUEL PRESS meter 12 APU 3 OIL TEMP meter

18 HYD 3 PRESS meter

usa007587_1077ar2.cvx

MEDS APU/HYDRAULIC Display

The BOILER PWR 1, 2, and 3 switches on panel
R2 enable (provide the automatic control
functions) the specific controller A or B selected
for that boiler by the BOILER CNTLR/HTR 1, 2,
and 3 switches on panel R2. When the applicable controller A or B is enabled for that boiler, a
ready signal is transmitted to the corresponding
APU/HYD READY TO START indicator on
panel R2 if the following additional conditions
are met: gaseous nitrogen shutoff valve is open,
steam vent nozzle temperature is greater than
130 F, and hydraulic fluid bypass valve is in
the correct position with regard to the hydraulic
fluid temperature.
The core of each WSB is a stainless steel
crimped-tube bundle. The hydraulic fluid section is divided into three 17-inch-long passes of
smooth tubes (first pass-234 tubes, second pass224 tubes, and third pass-214 tubes). The lube
oil section of the APU comprises two passes
with 103 crimped tubes in its first pass and 81
smooth tubes in the second pass. The tubes are
0.0125 of an inch in diameter with a wall
thickness of 0.010 of an inch. Crimps located
2. SYSTEMS

every 0.24 of an inch break up the internal

boundary layer and promote enhanced turbulent heat transfer. Although the second pass is
primarily a low-pressure drop return section,
approximately 15 percent of the unit's lube oil
heat transfer occurs there. Three connected
spray bars feed the hydraulic fluid section,
while two spray bars feed the power unit's lube
oil section in each boiler.
When the orbiter is in the vertical position on
the launch pad, each boiler is loaded with up to
4.86 pounds of PGME/water mixture, which is
referred to as "pool mode" operation. When
each APU/ hydraulic system and WSB are in
operation 5 minutes before lift-off, the APU
lube oil tube bundle is immersed in the boiler
water precharge. As the vehicle ascends during
launch, the lube oil system of the APU heats up,
eventually the boiler water precharge boils off,
and the boiler goes into the spray mode about
13 minutes after launch. The hydraulic fluid
usually does not heat up enough during ascent
to require spray cooling.

2.1-16

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
When the APU/hydraulic combination is
started for atmospheric entry, the hydraulic
fluid and power unit lube oil flow commences,
fluid temperatures rise, and spraying is initiated
as required. During the lower part of entry,
when the boiler temperature reaches 188 F, the
water spray boiler returns to the pool mode.
The spray bars begin discharging excess water
to fill the boiler. When the water reaches the
liquid level sensors, the spray is turned off so
that the boiler is not overfilled. During entry,
because the orbiter's orientation is different
from that of launch, the boiler can hold up to 14
pounds of water.

pressure drop exceeds 49 psi and is capable of

flowing 43 gallons per minute at a differential
pressure of 50 psi across the boiler.
A
temperature controller bypass valve allows the
hydraulic fluid to bypass the boiler when the
fluid temperature decreases to 190 F. At 210 F,
the controller commands the bypass valve to
direct the fluid through the boiler. When the
hydraulic fluid cools to 190 F, the controller
again commands the valve to route the fluid
around the boiler. Bypass valve (BYP VLV)
status is available on the following displays: SM
SYS SUMM 2 (PASS AND BFS) and PASS DISP
86 APU/HYD.

The enabled controller of the operating WSB

monitors the hydraulic fluid and lube oil outlet
temperature from the APU. The hydraulic fluid
outlet temperature controls the hydraulic fluid
H2O spray control valve, and the lube oil outlet
temperature controls the lube oil water spray
control valve. Signals are based on a comparison of the hydraulic system fluid temperature to
its 208 F set point and of the lube oil of the
power unit to its 250 F set point. When the
respective water feed valve opens, instantaneous flows of 10 pounds per minute maximum
through the hydraulic section and 5 pounds per
minute maximum through the lube oil section
enter the water boiler through the corresponding spray bars to begin evaporative cooling of
the hydraulic fluid and APU lube oil. The
steam is vented out through the overboard
steam vent.

Heaters

The separate water feed valves modulate the

water flow to each section of the tube bundle
core in each WSB independently in 200-millisecond pulses that vary from one pulse every 10
seconds to one pulse every 0.25 of a second.
Because of the unique hydraulic system fluid
flows, control valves are located in the hydraulic
system fluid line section of each WSB. Normally,
hydraulic system fluid flows at up to 21 gallons
per minute; however, the hydraulic system
experiences 1- to 2-second flow spikes at up to 63
gallons per minute. If these spikes were to pass
through the boiler, pressure drop would increase
ninefold and the boiler would limit the flow of
the hydraulic system. To prevent this, a relief
function is provided by a spring- loaded poppet
valve that opens when the hydraulic fluid

Each water boiler, water tank, and steam vent is

equipped with electrical heaters to prevent
freeze-up in orbit. The water tank and boiler
electrical heaters are activated by the corresponding BOILER CNTLR/HTR 1, 2, and 3
switches on panel R2. The A or B position of
each switch selects the A or B heater system and
is automatically controlled by the corresponding
A or B controller. The steam vent heaters are also
activated by the BOILER CNTLR/HTR 1, 2 and 3
switches but only if the BOILER PWR 1, 2 or 3
switch on panel R2 is ON. The water tank and
boiler heaters are cycled on at 50 F and off at
55 F. The steam vent heaters are not operated
continuously in orbit; they are activated
approximately two hours before APU startup.
The steam vent heaters are cycled on at 150 F
and cycled off at 175 F.

Main Hydraulic Pump

The main hydraulic pump for each hydraulic
system is a variable displacement type. Each
operates at approximately 3,900 rpm when
driven by the corresponding APU.
Each main hydraulic pump has an electrically
operated depressurization valve. The depressurization valve for each pump is controlled by
its corresponding HYD MAIN PUMP PRESS 1, 2,
or 3 switch on panel R2. When the switch is
positioned to LOW, the depressurization valve is
energized to reduce the main hydraulic pump
discharge pressure from its nominal range of
2,900 to 3,100 psi output to a nominal range of
500 to 1,000 psi to reduce the APU torque
requirements during the start of the APU. "APU

2.1-17

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
Press Low" is one of the inputs required to get a
gray READY TO START talkback.
NOTE
An APU cannot be successfully started
with HYD MAIN PUMP PRESS positioned to NORM.
After an APU has been started, the
corresponding HYD MAIN PUMP PRESS
switch is positioned from LOW to NORM. This
de-energizes the respective depressurization
valve, allowing that hydraulic pump to increase
its outlet pressure from 500 to 1,000 psi to
2,900 to 3,100 psi. Each hydraulic pump is a
variable displacement type that provides 0 to 63
gallons per minute at 3,000 psi nominal with the
APU at normal speed and up to 69.6 gallons per
minute at 3,000 psi nominal with the APU at
high speed.

Main pump outlet pressure (HYD PRESS) can

be seen by the crew on the BFS SM SYS SUMM
2 or PASS DISP 86 APU/HYD displays. A
high-pressure relief valve in the filter module
for each hydraulic system also relieves the
hydraulic pump supply line pressure into the
return line in the event the supply line pressure
exceeds 3,850 psid.
A separate pressure sensor (sensor A) in the
filter module for each hydraulic system
monitors the hydraulic system source pressure
and displays the pressure on the HYDRAULIC
PRESSURE 1, 2, and 3 meters on the dedicated
MEDS display. This hydraulic pressure sensor
also provides an input to the yellow HYD
PRESS caution and warning light on panel F7 if
the hydraulic pressure of system 1, 2, or 3 is
below 2,400 psi.

HYD MAIN PUMP PRESS 1, 2, 3 Switches on Panel R2

2. SYSTEMS

2.1-18

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Reservoir

T
Thermal
control
valve
Freon/hyd
heat exch

N
X X X
X
N
N

GN2
N

Water
spray
boiler

HYD Bellows
Accumulator
Hydraulic
main
pump

APU

WSB
cntlr

M
Hyd bypass
valve

Circulation
pump
M
350
psig

2500 PSIG
Cl

0p

P
Unloader
valve
Open. P>2563 psig
Close. P<2050 psig

3000
psig

Open P 2600> psig

Reseat P 2600< psig

Priority
valve
(relieves
at 3000
psid)

Pressure
Return
NOTE: The system is shown in normal operation
- APU on
- Circ pump off

Pressure
Return
usa007587_064r2.cvx

Hydraulic System (Control Section)

0

287

143

431

719

575

863

1007

1151

APU
143

287
1
2
3

431

XXX

XXX

XXX

1
2
3
XXXX XXXX XXXX

FUEL
QTY
%

FUEL
P
6
5

XXX

XXX

XXX

H O
2
QTY
%

XXXX XXXX XXXX

10

575
8
9

11

HYDRAULIC

719

OIL
IN TEMP
F

XXX

XXX

XXX

QTY
%

12

XXXX XXXX XXXX

PRESS
L

863
13

14

15

16

L
17

L
18

1 APU 1 FUEL QTY meter

7 APU 1 H2O QTY meter

13 HYD 1 QTY meter

2 APU 2 FUEL QTY meter

8 APU 2 H2O QTY meter

14 HYD 2 QTY meter

3 APU 3 FUEL QTY meter

9 APU 3 H2O QTY meter

15 HYD 3 QTY meter

4 APU 1 FUEL PRESS meter 10 APU 1 OIL TEMP meter

16 HYD 1 PRESS meter

5 APU 2 FUEL PRESS meter 11 APU 2 OIL TEMP meter

17 HYD 2 PRESS meter

6 APU 3 FUEL PRESS meter 12 APU 3 OIL TEMP meter

18 HYD 3 PRESS meter

usa007587_1077ar2.cvx

HYDRAULIC PRESSURE and QUANTITY Meters

on HYD/APU Display
2.1-19

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Hydraulic Reservoir

Circulation Pump and Heat Exchanger

Hydraulic reservoir pressure is maintained

using an accumulator bootstrap mechanism.
The bootstrap uses a variable area piston
assembly to convert high pressure in the
accumulator to lower pressure in the reservoir
(roughly 40:1).
This reservoir pressure
maintains adequate hydraulic inlet pressure at
both the main pump and circulation pump to
prevent cavitation during startup and operation. When the main hydraulic pump is in
operation, the high-pressure side of the piston
and the bootstrap accumulator are pressurized
to 3,000 psig from the main pump discharge
line. When the main hydraulic pump is shut
down, the priority valve closes, and the
bootstrap accumulator maintains a pressure of
approximately 2,500 psi. The 2,500 psi on the
high side results in a main pump inlet (low
side) pressure of approximately 62 psia. The
minimum inlet pressure to assure a reliable
main pump start is 20 psia (which corresponds
to a high-pressure side of 800 psi). This prevents the main pump from cavitating (not
drawing hydraulic fluid), which could damage
the pump.

The circulation pump is actually two fixeddisplacement gear-type pumps in tandem,

driven by a single motor. One is a high pressure, low-volume pump (2,500 psig), which is
used to maintain accumulator pressure while
the hydraulic system is inactive in orbit. The
other is a low pressure, high-volume pump (350
psig), which is used to circulate hydraulic fluid
through the orbiter hydraulic lines while the
hydraulic system is inactive in orbit in order to
warm up cold spots. The hydraulic fluid is
circulated through a Freon/hydraulic fluid heat
exchanger to pick up heat from the orbiter Freon
coolant loops. A temperature-controlled bypass
valve directs the hydraulic fluid through the
heat exchanger if the temperature at the heat
exchanger inlet is less than 105 F. The bypass
valve bypasses the fluid around the heat
exchanger if the temperature is greater than 115 F.

The quantity in each reservoir is 8 gallons. The

hydraulic fluid specification is MIL-H-83282,
which is a synthetic hydrocarbon (to reduce fire
hazards). The reservoir provides for volumetric
expansion and contraction. The quantity of
each reservoir is monitored in percent on the
HYDRAULIC QUANTITY meters on the
dedicated MEDS display. A pressure relief
valve in each reservoir protects the reservoir
from overpressurization and relieves at 120
psid.

An unloader valve at the circulation pump

outlet directs the high pressure output from the
circulation pump into the accumulator until the
accumulator pressure is greater than 2,563 psia,
then redirects the high pressure output to
combine with the low pressure output to the
hydraulic lines.

Hydraulic Accumulator
The accumulator is a bellows type, precharged
with gaseous nitrogen to 1700 psig at 70 F. The
gaseous nitrogen capacity of each accumulator
is 115 cubic inches, and the hydraulic volume is
51 cubic inches.

2. SYSTEMS

2.1-20

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

BFS SM SUMM 2 Display

(Hydraulic System Values)

USA007587
Rev. A

HYD CIRC PUMP Switches on Panel R2

Each circulation pump can be manually turned
on or off with the corresponding HYD CIRC
PUMP switch on panel R2. If the switch is
placed in GPC, the pump will be activated and
deactivated by the SM GPC according to a
control software program based on certain
hydraulic line temperatures and/or accumulator pressure.
This program activates the
appropriate circulation pump when any of the
control temperatures drop below either 0 F, or 10 F, depending on their locations, and
deactivates the circulation pump when all of the
control temperatures for that system are greater
than 20 F, or after 15 minutes for system 1 and
10 minutes for systems 2 and 3.
The
activation/deactivation limits for these control
temperatures can be changed during the flight
by crew or Mission Control.
The program also includes a timer to limit the
maximum time a circulation pump will run, and
a priority system to assure that only one
circulation pump is on at a time. Only one
circulation pump is turned on at a time because of the
circulation pumps excessive power use.
Each
circulation pump uses 2.4 kW of electrical power.

This software will also automatically provide for

the repressurization of the hydraulic accumulator
when the pressure lowers to a value of 1,960 psi.
In this contingency, the circulation pump will
first receive the highest priority to operate and
will be turned ON while other circulation pumps
are operating in thermal mode (this means that
two pumps can be operating simultaneously).
After the pump has been repressurized, the
accumulator above 1,960 psi, or a period of 2
minutes (this value can be changed by Mission
Control Center uplink) has elapsed, the
circulation pump will be commanded to OFF.
The circulation pump is automatically
disconnected when its corresponding APU Run
command is issued by the APU controller. Each
circulation pump can be powered by one of two
orbiter main electrical buses, selectable by the
HYD CIRC PUMP POWER switches on panel
A12.
The crew can see circulation pump outlet
pressure as well as the hydraulic line and
component temperatures on the PASS SM HYD
THERMAL display, DISP 87.

2.1-21

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Hydraulic System Controls on Panel A12

2011/
HYD
CIRC PMP
CIRC PMP
PMP BDY
RSVR
ACCUM
HX IN
OUT

/087
1
P 64
P 64
T+ 61
T+ 58
P2616
T+ 75
T+ 59

SW VLV
ELEV L OB
IB
R IB
OB
RUD/SPDBK

PR
3*
2*
3*
2*
1*

TIRE PRESS
MG
LEFT
IB 377 377
OB 378 378
NG 369 369

tank, boiler, and steam vent to assure that the

water spray boiler is ready to operate for launch.

HYD THERMAL
2
66
66
+ 47
+ 64
2624
+ 75
+ 54

3
66
66
+ 47
+ 66
2624
+ 75
+ 54

S1

S2
2
3
2
3
3

1
1
1
1
2

RIGHT
377 377
376 376
364 364

4 000/02:36:29
000/00:00:00
CIRC PUMP CONTROL
LINE TEMPS 1
2
3
ELEVON LOB+ 94 + 61 + 59
ELEVON LOB+ 94 + 61 + 59
LIB+ 94 + 61 + 61
RIB+ 94 + 61 + 61
ROB+ 94 + 59 + 61
RD/SB
PDU+ 97 + 59 + 59
FUS+ 97 + 59 + 59
BDYFLP PDU+ 97 + 59 + 59
FUS+ 97 + 59 + 59
L BRAKE WHL
+ 70 + 45
FUS
+ 70 + 45
R BRAKE WHL+ 62 + 70 + 61
FUS+ 40 + 67 + 61
NG
UPLK+ 40
MFUS 1+ 40
MFUS 2+ 40
MG L
UPLK+ 40
MG R
UPLK+ 40
FUS+ 40

usa007587_068r1.cvx

SM HYD THERMAL Display (DISP 87)

The SM APU/HYD display (DISP 86) shows the
hydraulic system pressure, reservoir temperature, reservoir quantity (in percent), and
hydraulic accumulator pressure.

Hydraulic Heaters
Areas of the hydraulic lines that cannot be
warmed by fluid circulation while the system is
inactive on-orbit are warmed by heaters. These
heaters are automatically controlled by thermostats to maintain the hydraulic line temperatures in a specified range. Each heated area has
redundant heaters (A and B), which are controlled by the HYDRAULIC HEATER switches
on panel A12.

Operations
The WSB controllers are powered up at launch
minus 8 hours, and the boiler water tanks are
pressurized in preparation for APU activation.
The controllers activate heaters on the water

2. SYSTEMS

APU start is delayed as long as possible to save

fuel. At T minus 6 minutes 15 seconds, the pilot
begins the prestart sequence. The pilot confirms
that the WSB is activated, then activates the
APU controllers and depressurizes the main
hydraulic pump.
Depressurizing the main
pump reduces the starting torque on the APU.
The pilot then opens the fuel tank valves and
looks for three APU ready-to-start indications
(gray talkbacks). At T minus 5 minutes, the
pilot starts the three units by setting the APU
OPERATE switches to START/RUN and checks
the hydraulic pressure gauges for an indication
of approximately 800 psi.
Then the pilot
pressurizes the main pump and looks for
approximately 3,000 psi on the gauges. All three
hydraulic main pump pressures must be greater
than 2,800 psi by T minus 4 minutes 5 seconds or
the ground launch sequencer (GLS) will initiate an
auto launch hold.
The APUs operate during the ascent phase and
continue to operate through the first OMS burn.
At the conclusion of the main engine purge,
dump, and stow sequence, the APUs and WSBs
are shut down. The same sequence applies for a
delayed OMS-1 burn. If an abort once around is
declared, the APUs are left running, but the
hydraulic pumps are depressurized to reduce
fuel consumption. The units are left running to
avoid having to restart hot APUs for deorbit
and reentry.
Six hours after lift-off, or as soon as they are
required, depending on the environment, the
gas generator/fuel pump heaters are activated
and are in operation for the remainder of the

2.1-22

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
orbital mission. The fuel and water line heaters
are activated immediately after APU/HYD
SHUTDN in the post OMS-1 timeframe to prevent
the lines from freezing as the APUs cool down.
Two hours after lift-off, during the Post Insertion
Checklist, the steam vent heaters of the WSBs are
turned on for about 1.5 hours to bake out ice
from the steam vents. The hydraulic thermal
conditioning is enabled by taking the hydraulic
circulation pumps to GPC. Further, the HYD
CIRC PUMP POWER switch(es) on panel A12
will be configured to distribute electrical loads
when appropriate.
While the vehicle is in orbit, the hydraulic
circulation pumps are in the GPC mode-automatically activated when hydraulic line
temperatures become too low and automatically
deactivated when the lines warm up
sufficiently.
On the day before deorbit, one APU is started to
supply hydraulic pressure for flight control
system checkout.
(Hydraulic pressure is
needed to move the orbiter aerosurfaces as part
of this checkout.)
The associated WSB
controller is activated, landing gear and brake
isolation valves are confirmed closed, and one
APU (selected by the Mission Control Center) is
started. The hydraulic main pump is set to
normal pressure (approximately 3,000 psi), and
aerosurface drive checks are made. After about
5 minutes, the checks are complete, and the
APU is shut down. Normally, the unit does not
run long enough to require WSB operation.
During deorbit prep (D/O minus 3.5 hours), the
APU/HYD systems are configured. The boilers'
steam vent heaters are activated to prepare the
system for operation during atmospheric entry,
and the circulation pumps are turned off. At
deorbit minus 2 hours, the brake heaters are
activated and the final switch configuration will
turn OFF the hydraulic heaters on panel A12.

At 45 minutes before deorbit, the WSB water

tanks are pressurized, the APU controllers are
activated, and the main hydraulic pumps are set
to low pressure. The pilot opens the fuel tank
valves and looks for three gray APU/HYD
READY TO START talkbacks. The pilot then
closes the fuel tank valves. This procedure
takes place while the crew is in contact with the
ground so that flight controllers can observe
APU status. Five minutes before the deorbit
burn, one APU (selected by Mission Control) is
started to ensure that at least one unit will be
operating for entry. The hydraulic pump is left
in low-pressure operation. The APU operates
through the deorbit burn. At 13 minutes before
entry interface (400,000-foot altitude), while the
orbiter is still in free fall, the other two APUs
are started, and all three hydraulic pumps are
pressurized to normal.
Two main engine
hydraulic isolation valves are cycled open and
then closed to ensure that the engines are
stowed for entry. If required, the aerosurfaces
are put through an automatic cycle sequence to
make sure warm hydraulic fluid is available in
the aerosurface drive units.
After touchdown, a hydraulic load test may be
done to test the response of the auxiliary power
units and hydraulic pumps under high load
(i.e., high flow demand) conditions. This test
cycles the orbiter aerosurfaces with one
hydraulic system at a time in depressed mode
(the remaining two APUs and hydraulic pumps
have to drive all the aerosurfaces). This is
typically done on the first flight of a new APU.
Then the main engine hydraulic isolation valves
are opened again, and the engines are set to the
transport position. At this point, the hydraulic
systems are no longer needed; the APUs and
WSBs are shut down.

2.1-23

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
Placing the APU AUTO SHUT DOWN switch
in INHIBIT only inhibits the automatic
shutdown of that APU if its turbine speed is
less than 80% or more than 129%. The APU
UNDERSPEED or APU OVERSPEED light
will always illuminate, and a tone will be
generated.

APU/HYD Caution and Warning

Summary
The yellow APU TEMP caution and warning
light on panel F7 is illuminated if the APU 1,
2, or 3 lube oil temperature is above 290 F.
The yellow APU OVERSPEED light is
illuminated if APU 1, 2, or 3 turbine speed is
more than 92,880 rpm (129%). If the APU
AUTO SHUT DOWN switch on panel R2 is in
ENABLE, an automatic shutdown of that
APU will occur.

The yellow HYD PRESS light illuminates

when hydraulic system 1, 2, or 3 drops below
2,400 psi for any reason.
The blue SM ALERT illuminates, and the
C/W tone is sounded if turbine speed falls
below 80% or rises above 129%.

The yellow APU UNDERSPEED light is

illuminated if APU 1, 2, or 3 turbine speed is
less than 57,600 rpm (80%). If the APU AUTO
SHUT DOWN switch for that APU is in
ENABLE, an automatic shutdown will occur.

O2 PRESS

The red BACKUP C/W ALARM illuminates if

hydraulic pressure of system 1, 2, or 3 drops
below 2,400 psi.

FUEL CELL
REAC

H2 PRESS

FUEL CELL
STACK TEMP

FUEL CELL
PUMP
AC
OVERLOAD

(R)

CABIN ATM
(R)

FREON
LOOP

O2 HEATER
TEMP

MAIN BUS
UNDERVOLT

AC
VOLTAGE

AV BAY/
CABIN AIR

IMU

FWD RCS

RCS JET
(R)

H2O LOOP

RGA/ACCEL

AIR DATA

LEFT RCS

RIGHT RCS

LEFT OMS

RIGHT OMS

(R)

LEFT RHC
(R)

PAYLOAD
WARNING (R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM (R)

RIGHT/AFT
RHC

(R)
(R)

(R)

GPC

FCS
SATURATION

OMS KIT

PRIMARY C/W

FCS
CHANNEL

MPS

APU
OVERSPEED

APU
UNDERSPEED

APU
TEMP

OMS TVC

(R)

(R)

HYD PRESS

070

APU/HYD Caution and Warning Lights on Panel F7

2. SYSTEMS

2.1-24

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
the launch phase, and are shut down after
the main engine propellant dump and stow
are completed (post OMS-1). The APUs are
restarted for entry: one APU prior to the
deorbit burn, and the other two prior to entry
interface.

APU/HYD Summary Data

The APU is a hydrazine-fueled, turbine-driven
power unit that generates mechanical shaft
power to drive a hydraulic pump that
produces pressure for the orbiter's hydraulic
system.
The three orbiter hydraulic systems provide
pressure to position hydraulic actuators for:
gimbaling SSMEs, actuating SSME control
valves, moving orbiter aerosurfaces, retracting ET disconnect umbilicals, deploying
landing gear, and providing brake power,
anti-skid, and nose wheel steering.
The APUs are located in the aft fuselage of
the orbiter.
Each APU/HYD system has an independent
water spray boiler for APU lube oil and
hydraulic fluid cooling. Water is used after
APU shutdown for injector cooling if a hot
restart is required. The APUs share a central
supply tank for injector cooling.
The three APUs are started 5 minutes before
lift-off. They continue to operate throughout

Each APU fuel tank load is approximately

325 pounds of hydrazine.
APU/HYD controls are located on panel R2;
heater controls are on panel A12.
Displays containing APU/HYD information
include the PASS and BFS SM SYS SUMM 2
display (DISP 79), APU/HYD display (DISP
86), HYD THERMAL (DISP 87), and
APU/ENVIRON THERM (DISP 88).
APU/HYD parameters can be monitored on
the APU/HYD MEDS Display if selected.
APUs can be manually shut down and
restarted after completion of a full injector
water cooling cycle (3.5 minutes), or after
approximately 180 minutes of passive
cooling on orbit.

APU/HYD Rules of Thumb

APU fuel usage rates vary with loading, but
average 1% per minute (3 to 3.5 lb/minute).
Usage rates are reduced by about half if the
hydraulic main pump is taken to low pressure (HYD MAIN PUMP PRESS switch on
panel R2 set to LOW), as is done during the
abort once around deorbit coast period.
The APU injector cooling tank shared by all
three APUs contains enough water for 21
minutes of continuous flow. This is enough
for six complete 3.5-minute hot restart
injector cooling cycles.
If all water spray boiler cooling is lost to the
lube oil after an APU reaches full operating
temperatures, only 2 to 3 minutes of operating time are available before bearing seizure
occurs.

2.1-25

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

APU/Hydraulic Overview

2. SYSTEMS

2.1-26

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Panel R2
2.1-27

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A
0

287

143

431

719

575

863

1007

1151

APU
143

287
1
2
3

431

XXX

XXX

XXX

FUEL
QTY
%

1
2
3
XXXX XXXX XXXX
FUEL
P
6
5

XXX

XXX

XXXX XXXX XXXX

XXX

H O
2
QTY
%

10

575
8
9

11

HYDRAULIC

719

OIL
IN TEMP
F

XXX

XXX

XXX

QTY
%

12

XXXX XXXX XXXX

PRESS
L

863
13

14

15

16

L
17

L
18

1 APU 1 FUEL QTY meter

7 APU 1 H2O QTY meter

13 HYD 1 QTY meter

2 APU 2 FUEL QTY meter

8 APU 2 H2O QTY meter

14 HYD 2 QTY meter

3 APU 3 FUEL QTY meter

9 APU 3 H2O QTY meter

15 HYD 3 QTY meter

4 APU 1 FUEL PRESS meter 10 APU 1 OIL TEMP meter

16 HYD 1 PRESS meter

5 APU 2 FUEL PRESS meter 11 APU 2 OIL TEMP meter

17 HYD 2 PRESS meter

6 APU 3 FUEL PRESS meter 12 APU 3 OIL TEMP meter

18 HYD 3 PRESS meter

usa007587_1077ar2.cvx

Panel F8
2. SYSTEMS

2.1-28

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

Panel A12

2.1-29

2. SYSTEMS

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

SM HYD THERMAL Display

(PASS DISP 87)

DISP 79 SM SYS SUMM 2 Display

(PASS and BFS)

2011/
/088
APU/ENVIRON THERM
4 000/02:36:51
000/00:00:00
FREON LOOP
1
2
1
2
ACCUM QTY
27
27 H20 LOOP
64
62
FREON ISOL
RAD ISOL PUMP OUT P
OUT T
64
63
FREON FLOW 2193 2190
P
30L
38
PL HX FLOW
290
286
564L 777
AFT CP FLOW 279
278 ICH FLOW
OUT T
41
38
RAD IN T
97
96
42
38
RAD OUT T
38
38 CAB HX IN T
45
55
EVAP OUT T
38
38 ACCUM QTY
APU FUEL T 1
2
3
EVAP TEMP
TK SURF
+69
+67
+68
HILD IB/OB
259 259
TK HTR
+70
+68
+69
NOZ
312
TEST LN 1 +62
+62
+63
TOP FWD/AFT 257 257
TEST LN 2 +62
+63
+63
L/R DUCT 162 162
FEED LN
+57
+58
+58
L/R NOZ
50
50
PUMP IN
+57
+58
+58
EVAP FDLN T
A
B
DRN LN 1 +62
+62
+63
FWD 80
80
DRN LN 2 +62
+62
+63
MID 1 80
80
OUT
+92
+90
+88
MID 2 79
75
BYP LN
+108
+106 +102
AFT 75
79
GG SPLY LN 113
111 107
TOPPING 75
79
ACCUM 75
79
H2O LN INJ +71
92 +72
HI LOAD 75
79

sfoc_scom_s2.1_078.cnv

APU/ENVIRON THERM (PASS DISP 88)

SM APU/HYD Display (PASS DISP 86)

BFS SM 0 THERMAL

2. SYSTEMS

2.1-30

2.1 Auxiliary Power Unit/Hydraulics (APU/HYD)

USA007587
Rev. A

2.2

The system consists of software and electronics

that provide the crew with visual and aural
cues when a system exceeds predefined
operating limits. Visual cues consist of four red
MASTER ALARM lights, a 40-light array on
panel F7, a 120-light array on panel R13U, GPC
annunciated fault messages, and a blue SM
ALERT light. The aural cue is sent to the
communications system for distribution to
flight crew headsets or speaker boxes.

CAUTION AND WARNING

SYSTEM (C/W)

CONTENTS
Description............................................
Alarms ...................................................
Smoke Detection and Fire
Suppression................................
Rapid Cabin Depressurization ...........
Operations.............................................
SPEC 60, SM Table Maintenance .......
C/W Summary Data............................
C/W Rules of Thumb ..........................
F7 Light Summary ...............................
Fault Message Table ............................

2.2-1
2.2-2
2.2-5
2.2-11
2.2-12
2.2-15
2.2-19
2.2-19
2.2-20
2.2-23

The crew interfaces with the C/W system

through panel R13U, panel C3, DPS displays,
panel F7, panel L1, and the four red MASTER
ALARM pushbutton indicators on panels F2,
F4, A7, and MO52J.

Description
The Caution and Warning System warns the
crew of conditions that may create a hazard
to orbiter operation and/or crew. Under certain
circumstances, the system also alerts the crew
to situations that require time-critical (under 5
minutes) procedures to correct them. The
system uses data such as temperature, pressure,
flow rates, and switch positions to determine
whether there is an alarm situation.

The C/W system interfaces with the auxiliary

power units, data processing system, environmental control and life support system,
electrical power system, flight control system,
guidance and navigation, hydraulics, main
propulsion system, reaction control system,
orbital maneuvering system, and payloads.
Inputs enter the software C/W logic circuitry
from the onboard computers through multiplexers/demultiplexers (MDMs) to activate
alarm tones and the BACKUP C/W ALARM.
Some of these are used to turn on the BACKUP
C/W ALARM light on panel F7 while crew
input resets the MASTER ALARM lights and tones.

Alarm
Annunciation

Emergency
Class 1

Caution & Warning

class 2

Alert
Class 3
Software

Fire
Smoke

-dP/dT

Hardware Only
Siren
MA lights
Smoke
detection
lights

Klaxon
MA lights

Alert tone
SM light
Fault message

Primary
C&W

Backup
C&W

Hardware

Software

C&W tone
MA lights
F7 lights
R13 lights

C&W tone
MA lights
F7 B/U light
Fault msg

Limit Sensing
Class D
Software
Status parameters
079.cvs

Caution and Warning Diagram

2.2-1

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A

Alarms

annunciated by hardware. The siren tone is

similar to emergency sirens on American
police cars or other civilian emergency
vehicles. The klaxon is a short repeating tone
that is unique and readily distinguished from
other C/W tones.

Four alarm classes constitute the C/W system.

Class 1 - Emergency
There are two alarms in this class: (1) smoke
detection/fire suppression and (2) rapid cabin
depressurization.
(These systems are
discussed in more detail later in this section.)
Class 1 is a hardware system only; its input is
not processed by any MDMs or software. The
system uses hardware, such as hard-wired
sensors, to monitor parameters and to issue
alarms. Because of the nature of the class 1
alarms, they always receive the highest
priority for resolution.

The emergency alarm visual cues consist of

illumination of the four MASTER ALARM
pushbutton indicators on panels F2, F4, A7,
and MO52J. The smoke detection system also
illuminates SMOKE DETECTION lights on
panel L1 and displays information on the SM
SYS SUMM 1 display (SMOKE). Similarly,
cabin pressure information can be seen on the
SM SYS SUMM 1 display (CABIN).
Class 2 - C/W

The emergency (class 1) aural alarms consist

of a siren (activated by the smoke detection
system) and a klaxon (activated by the delta
pressure/delta time sensor that recognizes a
rapid loss of cabin pressure), and they are

This class also consists of two subclasses:

primary C/W, which is a hardware system,
and backup (B/U) C/W, which is a software
system.
Panel R13

Panel R13
Value

X
0

Limit Set
Limit Func
Upper Set

X X X
Volts

Parameter Select

Param
Status
Tripped

Memory
Read

Lamp
Test
Left

Param
Enable

Clear

Right

(Fixed)

System
Transducer
1

20

(Variable)

Limit
Select
Logic

P 02A
R 03A 04M 05E
T 06E 07R
S 0809-

Inhibit

10-

Memory
Read

RAM

01-

Panel C3
Caution/Warning
PROM

00-

Lower Read
Inhibited

STATUS
LIMIT
VOLTS
X X
1 2 3 4 5

11-

Clear

Comparator

Control
Logic

Multiplexer
Power
Supply
A

30

40
Master Alarm and TG' A
Master Alarm A

Panel 7
H2 PRESS

O2 PRESS

O2 HEATER
TEMP

CABIN ATM
(R)
FREON
LOOP

AV BAY/
CABIN AIR

IMU

H2O LOOP

RGA/ACCEL

AIR DATA
(R)
RIGHT/AFT
RHC

LEFT RHC

(R)

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

AC
VOLTAGE

AC
OVERLOAD

FWD RCS
(R)

RCS JET

LEFT RCS

RIGHT RCS
(R)

LEFT OMS
(R)

RIGHT OMS

GPC

FCS (R)
SATURATION

OMS KIT

PAYLOAD
CAUTION

PRIMARY C/W

FCS
CHANNEL

MPS

BACKUP C/W
ALARM (R)

APU
TEMP

APU
OVERSPEED

APU
UNDERSPEED

PAYLOAD
WARNING (R)

Master Alarm B

FUEL CELL
REAC
(R)
MAIN BUS
UNDERVOLT

OMS TVC

(R)

(R)
HYD PRESS

Master Alarm and TG' B

Tone Vol
A
B

Backup
C/W

MDM

Caution/Warning
Electronics Unit

ESS 1 BC
C/W A

Computers

MDMs
Panel
F7

SM
ALERT

Power
Supply
B
Communication
System

Panel C3
Caution/Warning
MASTER
ALARM

Panels F2, F4,

A7, M052J

MODE
ACK

ASCENT
' Tone Generator

ESS 2 CA
C/W B

Caution and Warning System Overview

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-2

Panel C3

080.cvs

USA007587
Rev. A
The primary C/W system has the capacity to
monitor 120 inputs, which are received from
transducers through either signal conditioners
or flight forward MDMs. Baselined limit values
are stored in the C/W electronics unit located in
avionics bay 3. These values can be changed by
the crew through switches on panel R13U.
However, if power is lost and subsequently
recovered, the limits will return to their original
values. The majority of the original stored
values are identical to the backup C/W
(software) values. Thirty-nine lights on the
panel F7 annunciator matrix are dedicated to
the primary C/W; the exception is the BACKUP
C/W ALARM.

alarms that are produced by FDA (software that

monitors parameters and initiates alarms) have
limits that can be changed and displayed in
engineering units accessed through the SM
TABLE MAINTENANCE special function
display (SPEC 60). The remaining backup C/W
alarms that are produced by the guidance and
navigation program are accessed through
general-purpose
computer
read/write
procedures. A backup C/W out-of-tolerance
condition will trigger illumination of the four
MASTER ALARM lights, illuminate the red
BACKUP C/W ALARM light on panel F7, and
display a message on the fault message line and
fault summary page.

When a primary C/W alarm is issued, the

appropriate lamp on the panel F7 annunciator
matrix is illuminated, all four MASTER
ALARM indicators are illuminated, and the
C/W tone sounds. No GPC fault message is
generated by the primary C/W.
The C/W system receives power from two
sources. This power is supplied to the C/W
electronics unit by power supplies that are
internal to the electronics unit and are referred
to as power supply A and power supply B.
Power supply A receives power from the C/W
A circuit breaker powered by ESS 1BC on panel
013, and power supply B from C/W B circuit
breaker powered by ESS 2CA on panel 013.

O2 PRESS
CABIN ATM
(R )

H2 PRESS
O2 HEATER
TEMP

FREON
LO O P

AV BAY/
CABIN AIR

H 2 O L OOP

RGA/ACCEL
LEFT RHC

(R )

PAYLOAD
GPC
WARNING
(R )
PAYLOAD
PRIMARY C/W
CAUTION
BACKUP C/W
ALARM (R )

APU
TEMP

FUEL CELL
REAC
(R )
MAIN BUS
UNDER VOLT
IMU
AIR DATA
(R )
RIGHT/AFT
RHC

FUEL CELL
STAC K TEMP

FUEL CELL
PUMP

AC
VOLTA GE

AC
OVERLOAD

FWD RCS
(R )

RCS JET

LEF T RCS

RIGHT RCS
(R )

LEFT OMS
(R )

RIGHT OMS

FCS (R )
SATUR ATION

OMS KIT

FCS
CHANNEL

MPS

APU
OVERSPEED

APU
UNDERSPEED

OMS TVC
(R )

(R )
HYD PRESS

081.cvs

Caution and Warning Annunciator Matrix

on Panel F7

The 39 lights shown are dedicated to the primary C/W System. The
BACKUP C/W ALARM light is dedicated to the entire backup C/W
system. (R) signifies a red warning light.

A loss of power supply A will cause all panel F7

lights, except BACKUP C/W ALARM, to
illuminate. It will also cause a loss of panel
R13U status lights and function, smoke
annunciation via tone generator A, the
CAUTION/WARNING
MEMORY
READ
switch, lower bulbs of the MASTER ALARM
light (except for lamp test), primary C/W limit
sensing, and tones to the middeck.
A loss of power supply B causes the BACKUP
C/W ALARM light to come on in addition to
the primary C/W light, a loss of smoke
annunciation via tone generator B, upper bulbs
of the MASTER ALARM lights (except during a
lamp test), and sleep station headset tones.
The backup C/W (class 2) system is part of the
systems management fault detection and
annunciation (FDA), GNC, and backup flight
system software programs. Only the C/W
2.2-3

C/W Circuit Breaker on Panel 013

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
The class 2 (C/W) aural master alarm is
activated by the primary (hardware) system, the
backup (software) system, or both.
The
alternating C/W alarm tone is generated when
the hardware system detects an out-of-limit
condition on any of the 120 parameters it
monitors or when the software (backup) system
detects a parameter that is out of limits.
Class 2 primary and backup C/W visual cues
include a 40-light annunciator matrix on panel
F7. This matrix annunciates various system or
functional failures. Each light is driven by one
or more parameters. With the exception of the
BACKUP C/W ALARM light, once a lamp has
been illuminated, it will not be extinguished
until all parameters driving that light are back
within limits or inhibited. THE BACKUP C/W

C/W
CH
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

PARAMETER
NAME
CRYO O2 P TK1
CRYO O2 HTR1 TK1
FC1 REAC O2
DC VOLT MAIN A
CAB PRESS
GPC 1
RCS TK P OX - F
OMS TK P OX - L
APU 1 EGT
MPS HE TK P - C
CRYO O2 P TK2
CRYO O2 HTR 2 TK1
FC1 REAC H2
DC VOLT MAIN B
CAB O2 FLOW 1
GPC 2
RCS TK P FU - F
OMS TK P FU - L
APU 2 EGT
MPS HE TK P - L
CRYO O2 P TK34
CRYO O2 HTR 1 TK2
FC2 REAC O2
DC VOLT MAIN C
CAB O2 FLOW 2

C/W
CH
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
*40
41
42
43
44
45
46
47
48
49

PARAMETER
NAME
GPC 3
RCS LEAK/TK P - F
OMS ENG - L
APU 3 EGT
MPS HE TK P - R
CRYO O2 P TK 4/5
CRYO O2 HTR 2 TK2
FC2 REAC H2
AC1 VOLT (A, B, C)
CAB PPO2 A
GPC 4
RCS TK P OX - L
OMS TK P OX - R
APU 1 OIL T
MPS HE REG P - C
CRYO O2 P TK5
CRYO O2 HTR 1 TK3
FC3 REAC O2
AC2 VOLT (A, B, C)
CAB PPO2 B
GPC 5
RCS TK P FU - L
OMS TK P FU - R
APU 2 OIL T
MPS HE REG P - L

C/W
CH
50
51
52
53
54
*55
56
57
58
59
60
61
62
63
64
*65
66
67
68
69
70
71
72
73
74

ALARM light is extinguished once a MSG RESET

key is pushed.
Panel R13U is the crew's interface with the
primary C/W system. It includes a parameter
status light matrix that is used to check the
status of a parameter and also to check
parameter limits. When used to check the
status of parameters, the numbers on the left
side of the matrix are read first to obtain the
first two numbers of the parameter (row), then
the number on the top is read to obtain the third
number of the parameter. The matrix can
display all 120 parameters (numbered from 000
to 119) of the primary C/W system.

PARAMETER
NAME
CRYO H2 P TK1
CRYO O2 HTR 2 TK3
FC3 REAC H2
AC3 VOLT (A, B, C)
CAB N2 FLOW 1
RCS LEAK/TK P - L
OMS ENG - R
APU 3 OIL T
MS HE REG P - R
CRYO H2 P TK2
CRYO O2 HTR 1 TK4
FC1 STACK T
AC1 OVLD
CAB N2 FLOW 2
RCS TK P OX - R
OMS TVC
APU 1 OVERSPEED
MPS MANF PL O2
CRYO H2 P TK3
CRYO O2 HTR 2 TK4
FC2 STACK T
AC2 OVLD
CAB FAN P

C/W
CH
*75
76
*77
78
79
80
*81
82
83
84
*85
86
*87
88
*89
*90
91
92
93
94
95
96
97
98
99

PARAMETER
NAME
RCS TK P FU- R
APU 2 OVERSPEED
MPS MANF P LH2
CRYO H2 P TK 4/5
CRYO O2 HTR1 TK5
FC3 STACK T
AC3 OVLD
AV BAY 1 TEMP
RCS LEAK/TK P - R
APU 3 OVERSPEED

ADTA
FC1 COOL PUMP
RGA/AA
AV BAY 2 TEMP
PL WARNING
RCS JET
PL CAUTION
APU 1 UNDERSPEED
HYD 1 P

Hardware Caution and Warning Table

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-4

C/W
CH
100
101
102
103
104
105
106
107
108
109
110
111
112
*113
114
115
116
117
118
119

PARAMETER
NAME
L RHC
FCS SATURATION
FC2 COOL PUMP
IMU
AV BAY 3 TEMP
H2O LOOP 1 PUMP OUT P
FREON LOOP 1 FREON FLOW
FREON LOOP 1 EVAP OUT T
APU 2 UNDERSPEED
HYD 2 P
R/AFT RHC
FCS CH BYPASS
FC3 COOL PUMP

Not used

CAB HX OUT T
H2O LOOP 2 PUMP OUT P
FREON LOOP 2 FREON FLOW
FREON LOOP 2 EVAP OUT T
APU 3 UNDERSPEED
HYD 3 P

USA007587
Rev. A

Parameter Status Light Matrix on Panel R13U

Class 3 - Alert
This class is a software system operated by the
SM software. It would generally receive lower
priority than a class 1 or 2 alarm. Class 3 alert is
designed to inform the flight crew of a situation
leading up to a class 2 alarm or one that may
require a long procedure (over 5 minutes) in
order to rectify the problem. When an alert
parameter exceeds its limits, the blue SM
ALERT light on panel F7 is illuminated, a
discrete is sent to the primary C/W system to
turn on the alert tone, and the software displays
a fault message on the fault message line and
fault summary page.
Both guidance, navigation, and control (GNC)
and systems management (SM) software sense
out-of-limit conditions. These software systems
also serve some less critical parameters and
annunciate the SM alert tone. This tone is a
steady tone of predefined duration generated in
the C/W electronics when activated by inputs
from the onboard computers.
Class 0 - Limit Sensing
Class 0 is a software system consisting of up
and down arrows on the DPS displays next to a
parameter. It provides no aural annunciation.

A down arrow displayed next to a parameter

would indicate that the low limit for that
parameter had been met or violated. In addition, the down arrow is used to indicate a state
that does not agree with the nominal state; for
example, a fan that is nominally on (e.g., HUM
SEP fan) is off.
An up arrow displayed next to a parameter
would indicate that the upper limit for that
parameter has been exceeded.

Smoke Detection and Fire Suppression

This emergency class 1 alarm is hardware
driven. The crew is alerted to emergency
situations by use of visual and audio alarms.
Smoke detection and fire suppression capabilities are provided in the crew cabin avionics
bays and in the crew cabin. Smoke detectors,
which sense levels of smoke concentrations and
rate of concentration change, trigger alarms and
provide information on smoke concentration
levels to the performance-monitoring DPS
system and an array of red SMOKE
DETECTION lights on panel L1.
The smoke detector system is divided into two
groups: group A and group B. Group A smoke
detectors are located in the environmental
control
and
life
support
system

2.2-5

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
If the alarm returns in 20 seconds, it is
due to the concentration increasing at a
rate greater than or equal to 22
micrograms per cubic meter per second
for eight consecutive counts in 20
seconds.

cabin fan plenum outlet beneath the crew cabin

middeck floor and in the left return air duct on
the crew cabin flight deck, and one element is
located in each of the three forward avionics
bays (1, 2, and 3A). Group B smoke detectors are
located in the right return air duct on the crew
cabin flight deck and in avionics bays 1, 2, and
3A.

If the alarm returns immediately, the

detector would be suspect, and a self
test should be performed. If available,
the concentration readout should be
observed on SM SYS SUMM 1.
If the alarm does not return, perform
self test.
If available, check
concentration on SM SYS SUMM 1.
0001/

Smoke Detection and Fire Suppression

System
If a smoke detector senses a smoke particle
concentration of 2,000 (200) micrograms per
cubic meter for at least 5 seconds and/or a rate
of smoke increase of 22 micrograms per cubic
meter per second for eight consecutive counts in
20 seconds, a trip signal illuminates the
applicable red SMOKE DETECTION light on
panel L1, illuminates the four red MASTER
ALARM lights on panels F2, F4, A7, and
MO52J, and sounds the siren in the crew cabin.
The normal reading on the SM SYS SUMM 1
display for the smoke detectors is 0.3 to 0.4
milligram per cubic meter. A reading on the
display of 2.0, plus or minus 0.2, corresponds to
2,000 (200) micrograms per cubic meter.
After an alarm and a reset of the detector, the
following conditions may be observed:
If the alarm returns in 5 seconds, it is
due to the concentration exceeding 2,000
200 micrograms per cubic meter for 5
seconds.

2. SYSTEMS
2.2 Caution and Warning System (C/W)

/078

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
- 0.5
L/R FD - 0.4
0.2
AV BAY 1 - 0.2 - 0.0
2 - 0.1 - 0.3
3 - 0.1 - 0.1
CABIN
PRESS
14.7
dP/dT
+.00
BU/EQ -.00 +.00
PPO2
3.02 3.02
FAN DP
5.79
HX OUT T
49
O2 FLOW
0.0 0.0
N2 FLOW
0.0 0.0
IMU FAN DP
4.62
DV FC1 FC2 FC3
SS1 15
18
18
SS2 16
20
11
SS3 22
26
26
TOTAL AMPS 510
KW
15

DC VOLTS
FC
MAIN
ESS
CNTL

5 000/03:13:09
BFS 000/00:00:00
1/A
2/B
3/C
31.1 31.1 31.1
31.0 31.1 31.0
29.8 29.8 29.8
A
B
C
A
1 29.3 29.3 29.3
2 29.3 * 00.0 29.3
3 29.3 29.3 29.3

AC
117
VOLT A
B
117
C
117
AMPS A
4.4
B
3.9
C
2.4
FUEL CELL PH
AMPS
172
REAC VLV
OP
STACK T +204
EXIT T 150
COOL P
61
PUMP

117
117
117
4.1
4.2
3.2
167
OP
+203
150
61
P

117
117
117
2.7
3.2
4.8
PH
178
OP
+203
151
61

usa007587_085r5.cvx

SM SYS SUMM 1 (DISP 78)

Fire suppression in the crew cabin avionics bays
is provided by three Halon extinguisher bottles
permanently mounted in avionics bays 1, 2, and
3A. Each bottle contains 3.74 to 3.8 pounds of
Halon in a pressure vessel that is 8 inches long
and 4.25 inches in diameter. To activate the
applicable bottle in an avionics bay, the
corresponding FIRE SUPPRESSION switch on
panel L1 is positioned to ARM, and the
corresponding AGENT DISCH pushbutton
indicator on panel L1 is depressed for at least 2
seconds.
The AGENT DISCH pushbutton
indicator activates the corresponding pyro
initiator controller, which initiates a pyrotechnic
valve on the bottle to discharge the Halon into
the avionics bay. The discharge of Halon will
produce a noise of approximately 130 decibels
in the avionics bay.

2.2-6

USA007587
Rev. A
percent concentration is required to suppress a
fire. This concentration will provide protection
for approximately 72 hours. When the AV bay
fire bottles are discharged, the pushbutton
indicators will illuminate when the pressure in
the bottle falls below 60 10 psig. This
indicates that the bottle is fully discharged.
Red SMOKE DETECTION lights on panel L1 are
illuminated by the following: the CABIN light
is illuminated by a smoke detector in the ECLSS
cabin fan plenum, the L FLT DECK light is
illuminated by the crew cabin left flight deck
return air duct smoke detector, the R FLT DECK
light is illuminated by the crew cabin right
flight deck return air duct smoke detector. The
PAYLOAD light is illuminated by the smoke
detectors in pressurized payload modules; i.e.,
Spacehab. Note that although the payload
smoke detection light on L1 will illuminate, the
smoke concentration data field on Sys Summ 1
will not display data for the payload smoke
detector. The SPEC display for the payload will
contain that data. The applicable smoke detector
illuminates the applicable red AV BAY light on
panel L1, activates the C/W MASTER ALARM
red light, and sounds the siren in the crew
cabin.

FIRE SUPPRESSION Switches and Pushbuttons and SMOKE DETECTION Lights on

Panel L1
The discharge will give a Halon concentration
in the avionics bay of 7.5 to 9.5 percent. A 4 to 5

2.2-7

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A

Fire Extinguisher Locations

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-8

USA007587
Rev. A
Three hand-held fire extinguishers are available
in the crew cabin. Two are located in the crew
cabin middeck, and one is on the flight deck.
Each fire extinguisher nozzle is tapered to fit
fire hole ports located in several display and
control panels. The holes are of two types: a inch diameter hole covered with a marked label,
and an unmarked - to -inch diameter
tapered hole. These holes give access to the
volume immediately behind the individual
panel. To suppress a fire behind a panel or
within an avionics bay, the extinguisher nozzle
should be inserted into the fire hole and the
actuating mechanism depressed for 15 seconds.
This will ensure a complete discharge. The
extinguishing
agent
is
Halon-1301
(monobromotrifluoromethane).
Halon-1301
minimizes the major hazards of a fire: smoke,
heat, oxygen depletion, and formation of
combustion products such as carbon monoxide.
The fire extinguishers are 13 inches long. The
portable fire extinguishers can also be used as a
backup for extinguishers in the avionics bays.
Consideration should be given to the propulsive
force on the crewmember when discharging the
extinguishers on orbit.

Fire and Smoke Subsystem Control Circuit

Breakers on Panel 014

Fire and Smoke Subsystem Control Circuit

Breakers on Panel 015

Fire and Smoke Subsystem Control Circuit

Breakers on Panel 016
The circuit breakers that control the fire and
smoke subsystem are located on panels 014,
015, and 016. Panel 014 contains the MN A
SMOKE DETN L/R FLT DK and BAY 2A/3B,
FIRE SUPPR BAY 3, and ANNUN FWD ACA 1
circuit breakers. Panel 015 contains MN B
SMOKE DETN BAY 1B/3A, FIRE SUPPR BAY 1
and annunciator FWD ACA 1 and ACA 2/3 and
AFT ACA 4/5 circuit breakers.
Panel 016
contains MN C SMOKE DETN CABIN and BAY
1A/2B,
FIRE
SUPPR
BAY
2,
and
ANNUNCIATOR FWD ACA 2/3 and AFT ACA
4/5.

2.2-9

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A

Halon 1301
Halon 1301 is used as the extinguishing agent
for all fire suppression devices. It is colorless
and odorless. Discharge of the agent may create
a light mist in the vicinity of the discharge
nozzle. Therefore, visibility is not adversely
affected. Once the Halon is discharged into an
enclosure, it is difficult to detect its presence
through normal human senses.
Exposure to Halon in the 5 to 7 percent range
produces little, if any, noticeable effect. At
levels between 7 and 10 percent, mild central
nervous system effects such as dizziness and
tingling in the extremities have been reported.
Above 10 percent, some subjects report a feeling
of impending unconsciousness after a few
minutes, although test subjects exposed to up to
14 percent for 5 minutes have not actually lost
consciousness. These types of effects were
completely reversible upon removal from
exposure.
It is considered good practice to avoid all
unnecessary exposure to Halon 1301 and to
limit exposures to the following times:
7 percent and below: 15 minutes
7 to 10 percent: 1 minute
Avionics
Bay no. 1

10 to 15 percent: 30 seconds
Above 15 percent: prevent exposure
Anyone suffering from toxic effects of Halon
1301 should immediately move or be moved to
fresh air. In treating persons suffering toxic
effects, the use of epinephrine (adrenaline) and
similar drugs must be avoided. These drugs
may produce cardiac arrhythmias, including
ventricular fibrillation.
Although Halon 1301 has a low toxicity, its
decomposition can be hazardous. These products have a characteristically sharp acrid odor,
even in minute concentrations of only a few
parts per million. This smell provides a warning system but at the same time creates a
noxious, irritating atmosphere.
The accepted theory is that Halon must
decompose before it is effective in suppressing
fire. The decomposition takes place on exposure to a flame or to a hot surface of approximately 900 F.
Depending on the severity of the fire, length of
time Halon is exposed to flame, and concentration of Halon, the decomposition products may
be extensive or minimal.

Avionics
Bay no. 2

Notes:
Fire ports provide access to avionics bays
Fire ports are sized to fit portable fire
extinguisher nozzle
A Fire port/guide (typical)

Avionics bays 1 and 2

Avionics
Bay no. 3B
Avionics
Bay no. 3A

A Detail

Avionics bays 3A and 3B

Fire Port Locations

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-10

USA007587_1000

USA007587
Rev. A
The SMOKE DETECTION CIRCUIT TEST
switch on panel L1 tests the smoke detection
system, lights, and alarm circuitry. When the
switch is positioned to A or B, electrical power
is applied to the ACA channels controlling the
AGENT DISCH lights, and the white lights are
illuminated. Two tests are completed for both
the A and the B circuits to test the complete
logic circuitry of the smoke detection system. In
one test, after approximately a 20-second delay,
the SMOKE DETECTION A or B lights are
illuminated, and the siren is triggered. In the
other test, the SMOKE DETECTION CIRCUIT
TEST switch is turned off in 5 to 10 seconds,
bypassing the 20-second time delay and
immediately annunciating a siren and a SMOKE
DETECTION light (A or B).

Rapid Cabin Depressurization

Once the alarm system has been triggered, it

remains latched until the SMOKE DETECTION
SENSOR switch on panel L1 is positioned to
RESET.
When the system is latched, the
emergency alarm system will not activate an
alarm in case of another fire in the same or any
other avionics bay.

Values for dP/dt can be monitored on the SM

SYS SUMM 1 (dP/dt, dP/dt-EQ, dP/dt-BU),
and the dedicated display on panel O1 (dP/dt).

The cabin depressurization (dP/dt) sensor

measures the rate at which cabin pressure is
changing in the orbiter (in psi/min). The system
alerts the crew to a rapid pressure change with
respect to time by annunciation of the four
MASTER ALARM pushbutton indicators and
sounding of the klaxon (class 1 alarm) when the
measured dP/dt value exceeds -0.08 psi/min. The
alarm only annunciates for negative values. The
normal cabin dP/dt is zero psi per minute
(0.01) psi for all normal operations.
In addition, a class 3 alarm will annunciate for a
decrease in pressure greater than or equal to
0.12 psi per minute, based on dP/dt or backup
dP/dt.

The dP/dt detector is powered through the MN

B PPO2 C CABIN DP/DT circuit breaker on
panel 015.

Various parameters of the smoke detection

system and remote fire extinguishing agent
system are provided to telemetry.

Cabin Pressure Meters and Switches on Panel 01

2.2-11

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
pushbutton indicators will reset all tones,
including the systems management tone.

CN SL

10

CTR

AC A 1

AC A 2/3

ATM PR ESS CO NT ROL

PP O 2 C

N2
S U P P LY
2

CA BIN
d P/dT

ENVIRONMENT Display (DISP 66)

ST AR
TR KR
-Y

AD T A
2

O2/N 2
CN TLR
2

O2
XO VR
2

DD U

AC C E L
2

N2 R EG
IN LE T
2

LEFT

71/2

RIG H T

IN ST
R IG H T

71/2

71/2

Operations
Primary C/W System
The primary C/W system has three modes of
operation: ascent, normal, and acknowledge.
These modes are controlled by the CAUTION/
WARNING MODE switch on panel C3. The
switch has three settings: ASCENT, NORM, and
ACK. The normal mode is discussed first.
The primary C/W system receives 120 inputs
directly from transducers through signal
conditioners or from the flight forward
multiplexer/demultiplexers, and are fed into a
multiplexing system. Of these 120 inputs, 95
come directly from transducers, five are from
the general purpose computer (GPC) input/output
processors, 18 are provided by the GPC software,
through multiplexer/demultiplexer, and two
are spares. These inputs can be either analog or
bilevel discretes. The analog signals are 0 to 5 V
DC; the discretes are either 2.5 or 5 V DC. All of
these inputs are designed to provide upper or
lower limit detection.
If the parameter has
exceeded its limits, it will turn on the C/W tone,
light the appropriate light on panel F7, illuminate
the four red MASTER ALARM pushbutton
indicators, and store the parameter in memory.
The C/W tone can be silenced and the red
MASTER ALARM light extinguished by
depressing any one of the MASTER ALARM
pushbutton indicators; however, the C/W light
on panel F7 will remain illuminated until the
out-of-tolerance condition is corrected or
inhibited. Any one of the MASTER ALARM

2. SYSTEMS
2.2 Caution and Warning System (C/W)

MN B PPO2 C CABIN DP/DT Circuit

Breaker on Panel 015
The C/W ascent mode is the same as the normal
mode, except that the commander's red
MASTER ALARM pushbutton indicator will not
be illuminated.

UPL INK
NSP BLOCK

CAUTION/WARNING
MEMORY
MODE
READ
ACK

MASTER
MADS POWER
ON

G
P
C
B
L
O
C
K

(LL)

N
O
R
M

(LL)

ENABLE

CLEAR

OFF

ASCENT

PAYLOAD SAFING
1

3
NORM

EMERGENCY
LIGHTING
ON/ OFF

SAFE
OFF/ON

CAUTION/WARNING MEMORY and MODE

Switches on Panel C3
The C/W acknowledge mode is also the same as
the normal mode, except that the 40 annunciator
lights on panel F7 will not be illuminated unless
one of the red MASTER ALARM pushbutton
indicators (on panel F2 for the commander or
panel F4 for the pilot) is depressed.

2.2-12

USA007587
Rev. A
Panel R13U
Each of the 120 status C/W red parameter lights
on panel R13U receives an input from a specific
parameter. A primary C/W parameter matrix
cue card identifies the 120 input channels and
correlates them to the panel F7 C/W
annunciator light matrix. If an out-of-limit
condition exists on a specific parameter that is
set on panel R13U, it illuminates the
corresponding light on panel F7.
If the
CAUTION/WARNING PARAM STATUS switch
on panel R13U is held in the TRIPPED position
when an out-of-limit parameter light on panel
F7 is illuminated, the corresponding light on
panel R13U will also be illuminated.
Some limits, and the list of parameters
monitored, change with flight phase. The crew
uses the PARAM ENABLE/INHIBIT and LIMIT
switches on panel R13U to tailor the C/W
system for their current configuration.
The three CAUTION/WARNING PARAMETER
SELECT thumbwheels on panel R13U provide

signals to the C/W electronics unit to define a

specific parameter.
This is required for
enabling and inhibiting the selected parameter
and also for setting and reading a parameter's
current limits.
The CAUTION/WARNING LIMIT SET switch
grouping on panel R13U is used to change
limits or to read a parameter's limits. The three
VALUE thumbwheels provide the signals to the
C/W unit, defining the voltage value setting of
a parameter's upper or lower limit, X.XX.
The UPPER setting of the CAUTION/ WARNING
LIMIT SET LIMIT switch on panel R13U provides
a signal to the C/W electronics unit, which
modes the electronics to set or read the upper
limit of a parameter specified by the settings on
the PARAMETER SELECT thumbwheels for that
parameter. The CAUTION/ WARNING LIMIT
SET FUNC switch is cycled to set or read the
upper limit of that parameter. The LOWER
setting functions in the same manner, except for
the lower limit for a parameter.

Panel R13U
2.2-13

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
The CAUTION/WARNING LIMIT SET FUNC
SET switch position on panel R13U provides a
signal to the C/W electronics unit, which sets
the value specified by the LIMIT SET VALUE
thumbwheels into the parameter as specified by
the PARAMETER SELECT thumbwheels and
LIMIT SET LIMIT switch. The LIMIT SET
FUNC READ switch position on panel R13U
provides a signal to the C/W electronics unit,
which illuminates the lights under the STATUS
LIMIT VOLTS X.XX columns on panel R13U
that correspond to the voltage parameter limit
specified by the PARAMETER SELECT
thumbwheels and the LIMIT SET LIMIT switch.
The value read corresponds to the parameter's
full-scale range on a scale of zero to 5 volts DC.
The LIMIT SET FUNC switch center position
disables the set and read functions.
The ENABLE position of the CAUTION/
WARNING PARAM switch on panel R13U
provides a signal to the C/W electronics unit to
enable the parameter indicated on the
PARAMETER SELECT thumbwheels, which
allows the parameter to trigger the primary
C/W alarm when out of limits. The INHIBIT
position operates the same as ENABLE, except it
inhibits the parameter from triggering the
primary C/W alarm. The center position of the
switch disables the enable and inhibit functions.
The TRIPPED position of the CAUTION/
WARNING PARAM STATUS switch on panel
R13U provides a signal to the C/W electronics
unit, which illuminates the C/W status lights
that correspond to the parameters that are
presently out of limits, including those that are
inhibited. The INHIBITED position illuminates
those C/W lights on panel R13U that have been
inhibited. The center position disables the
tripped and inhibited functions.
The CAUTION/WARNING MEMORY READ
switch position on panel R13U provides a signal
to the C/W electronics unit, which provides
access to a memory buffer that stores inputs
from parameters that are currently out of limits
or have been out of limits since the memory
buffer was last cleared.
Moving the
CAUTION/WARNING MEMORY switch to
READ displays the parameters that are
currently out of limits or have been out of limits
since the buffer was last cleared. The CLEAR
2. SYSTEMS
2.2 Caution and Warning System (C/W)

position on panel R13U or panel C3 provides a

signal to the C/W electronics unit that clears
from the memory any parameters that are back
within limits, but any parameters that are out of
limits during this action remain in memory.
The center position of the switch on panel R13U
or panel C3 disables the clear and read
functions.
The CAUTION/WARNING TONE VOLUME A
potentiometer (recessed setscrew) on panel R13U,
when adjusted clockwise, increases the system
A siren, klaxon, C/W, and SM tone generator
output signals to the audio central control unit.
The B potentiometer functions the same as the A
potentiometer for system B tone generators.
The CAUTION/WARNING LAMP TEST switch
on panel R13U, when positioned to LEFT,
provides a signal to the C/W electronics unit,
which illuminates the left five columns of the
C/W status matrix lights on panel R13U. The
RIGHT position functions the same as the LEFT,
except for the right five columns of lights. This
allows the verification of all 120 lights, making
sure that none have burned out.
Software (Backup) Caution and Warning
When the software caution and warning system
detects an out of limits condition, it sounds an
aural tone or master alarm, lights the MASTER
ALARM or SM ALERT light, and issues a fault
message that is displayed flashing on the DPS
display fault message line. The master alarm
light and tones are reset by depressing a
MASTER ALARM light pushbutton. The fault
message will flash until acknowledged by a
depression of the ACK key or until the MSG
RESET key is depressed to erase the message.
The MSG RESET key will also extinguish the
SM ALERT light.
The displayed fault message is used to diagnose
system failures and frequently is used as the title
of the Flight Data File procedure to be worked by
the crew in response to the failure. The text of
the fault message identifies the system where
limits are being exceeded. A list of individual
fault messages is presented in the summary at
the end of this section.
For some general classes of fault messages, the
first part of the text contains the SPEC number

2.2-14

USA007587
Rev. A
to be consulted to determine the specific
parameter that is out of limits. The GPCs
declaring the fault are enumerated after the
message text. In parentheses at the end of the
fault message, software will display the number
of other fault messages generated while the
current message was being displayed. To view
these messages and the time at which they were
annunciated, the crew must look at the fault
summary page, or scroll through them using
the ACK key.
After reset of the displayed fault message, the
message line will be blank until another new
message is generated by the software. To avoid
missing messages in a multi-failure scenario,
crews should occasionally review all messages
on the fault summary page and try to reset
messages on the fault line as quickly as possible
after reviewing them.
Fault messages for some parameters are issued
every time the software completes the required
number of data counts with the parameter out
of limits. This can result in a steady stream of
fault messages and MASTER ALARMS that may
obscure other important fault messages. If this
situation is encountered, the crew or Mission
Control can inhibit the affected parameter to
prevent nuisance messages and alarms in OPS 2
or OPS 4. In OPS 1, 6, or 3, the crew generally
has to tolerate the extra alarms/fault messages
and pay extra close attention to the fault
summary display.
In order to clear messages from the fault
summary page, the crew enters a SPEC 99 PRO
on the keyboard. If the fault summary (DISP
99) is called up using a SPEC 99 PRO instead of
the FAULT SUMM key, the fault summary page
will appear, and then immediately clear itself.
Software caution and warning limits for some
parameters change depending on the phase of
flight. These changes can be entered by the
crew via the SPEC 60 TABLE MAINTENANCE
display or uplinked from the ground. The
ground uplink for limits changes is called a
Table Maintenance Block Update (TMBU).

SPEC 60, SM Table Maintenance

The primary avionics software system (PASS)
includes three types of applications software,
called major functions.
The first, systems
management (SM), is the function that is active
on orbit. The second, guidance, navigation, and
control (GNC), is active during all flight phases.
The third, payload software, provides operations
support to payloads. The backup flight system
(BFS), normally used only during ascent and
entry, also contains both SM and GNC software.
Modules within both SM and GNC software
monitor parameters and initiate alarms. To
change the characteristics of the PASS GNC, BFS
GNC, and BFS SM parameters, the crew would
have to perform a GPC memory read/write
procedure. (This procedure is described in the
DPS HW/SW 21002 Training Manual.)
However, PASS SM parameters can be accessed
directly by the crew. Within PASS SM is a
module called fault detection and annunciation.
This module monitors the backup C/W and alert
parameters and initiates alarms.
SPEC 60 SM TABLE MAINT is the crew interface
with the PASS SM parameters. Using SPEC 60,
the crew can read and change the following for
each PASS SM backup C/W or alert parameters:
(1) lower and upper limits, (2) noise filter value,
and (3) enable/inhibit status. Additionally, the
crew can read and change SM program
constants, initiate a checkpoint, and enable or
inhibit the entire fault detection and annunciation
software module.
SPEC 60, which is a PASS SM SPEC, is available
during SM OPS 2. When the SM TABLE MAINT
display is called up by its SPEC number (SPEC 60
PRO), each field will be blank except CHECKPT
time and FDA ENA. When SPEC 60 is called by
pressing RESUME, the fields that were
previously in use will retain their data. When a
legal item entry is made, the new data will be
displayed in the appropriate field and will
overwrite any previous data.
Any Backup C/W or Alert parameter may be
accessed by entering its software ID number in
item 1 of the SM TABLE MAINT display. The
limits, noise filter value, and enable/inhibit

2.2-15

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
status of Alert parameters may be changed with
items 2 through 10. The same characteristics of
Backup C/W parameters are available through
items 11 through 15. These display parameters
are discussed in more detail below.

Alert parameters that are preconditioned may

have two or three limits sets. All other alert
parameters have only one limit set. The SM
software selects which set of limits is currently
active and places an asterisk next to that set
(before item 2, 4, or 6). (There is no item entry
that allows the crew to move the asterisk to
directly select which set of limits is active. This
is done exclusively by software.) If only one set
of limits exists for the parameter, this set will be
displayed in the first limit set location, and the
asterisk will be placed by item 2. If a value is
entered in a limit set that does not exist for the
selected parameter, an illegal entry message
will be displayed.
Limits Backup C/W Low and Hi
(Items 11 and 12)

SM TABLE MAINT (SPEC 60)

PARAM ID (Item 1) and PARAM Value
The software ID number for the desired fault
detection and annunciation (FDA) parameters is
entered in item 1. The software IDs are located
in the C/W and FDF TABLE of the Flight Data
File Reference Data Book.
When a valid ID is entered, the ID number will
be displayed in the PARAM ID space, and the
current value of the parameter will be displayed
in the PARAM VALUE field. The status of the
parameter is indicated by the presence or
absence of an up or down arrow.
The
appropriate ALERT or BACKUP C/W data will
appear in the LIMITS portion (items 2 through
10 or items 11 through 15 respectively).
If the PARAM ID is not valid, all associated
data fields will be blank, and an ILLEGAL
ENTRY message will be displayed.
Limits Alert Low and Hi (Items 2 through 7)
These fields contain the upper and lower alert
limits of the FDA parameter identified in item 1.
The limit values are displayed in engineering
units and can be changed by entering the
desired data in the appropriate items.

2. SYSTEMS
2.2 Caution and Warning System (C/W)

The backup C/W system limits for the FDA

parameter identified in item 1 are displayed in
these fields. The limit values, which are in
engineering units, can be changed by entering
the new data in the desired item. Backup C/W
parameters have one set of limits.
Limits Alert Filter (Item 8)
The Alert parameter noise filter value can be
read or changed through item 8. It is the number of consecutive times the parameter has to be
sensed out of limits before an alarm
annunciates. The reverse is true for returning
back into limits. The range of valid values is 1
through 15.
Limits Backup C/W Filter (Item 13)
The backup C/W filter functions similarly to
the Alert filter (item 8).
Limits Alert ENA or INH (Items 9 and 10)
The annunciation of an out-of-limits Alert
parameter may be either enabled or inhibited by
executing the respective item. The items are
mutually exclusive, and an asterisk indicates
the current annunciation status by appearing
after the more recently selected item.
The class 0 status indicators (up and down
arrows) and transducer data symbols (H, L, M,
?) are not affected by this item.

2.2-16

USA007587
Rev. A
Limits Backup C/W ENA or INH
(Items 14 and 15)

Constant Value (Item 17)

These backup C/W items operate similarly to

the Alert items 9 and 10.

This field contains the current value of the

constant identified in item 16. The constant value
can be changed by entering the new data in item
17.

FDA ENA or INH (Items 19 and 20)

TMBU

The PASS FDA software can be either inhibited

or enabled by executing the respective item.
The items are mutually exclusive, and an
asterisk denotes the current state. The display
is initialized with FDA enabled.

TMBU is the type of uplink that Mission

Control uses to change the following data:

When FDA is inhibited, the following FDA

functions are disabled:

Parameter annunciation enable/inhibit

status

FDA alarm annunciation. This includes

backup C/W (class 2), Alert (class 3),
and limit sensing up or down arrows
(class 0).
Limit sensing (class 0). The last value of
each out-of-limits parameters status
indicator is displayed.
Precondition steering.
False alarm avoidance noise filters.
Other parameter status indicators (H, L, M, ?)
are not affected because they are not generated
by the FDA software.
Constants
SM constants may be accessed through items 16
and 17. These constants are primarily involved
in SM special processes such as water loop
pump cycling, alert preconditioning, and
payload deployment.
Constant ID (Item 16)
When a constant ID number is entered in item
16, both the CONSTANT ID and VALUE fields
are filled. If the ID was illegal, both data fields
are blanked.
The constant IDs and values are not typically
carried onboard the orbiter, although various
malfunction procedures contain occasional
constants. If a constant must be changed,
Mission Control will either provide the crew
with the data or directly change the constant
through a TMB Uplink. (See TMBU description
in this section.)

Parameter limit values

Parameter noise filter values

SM constant values
The use of TMBUs decreases the crew's
workload because the changes that are uplinked
do not have to be entered on SPEC 60.
SPEC 60 operations and TMBUs are interlocked
such that TMBU loads are rejected if SPEC 60 is
active. If a TMBU is in progress when SPEC 60
is called, the flashing words UPLINK and UL
will be displayed on the display, and all item
entries will be prohibited by an ILLEGAL
ENTRY message.
Uplink
The flashing word UPLINK is displayed in the
top center of SPEC 60 to indicate that a TMBU is
in progress.
UL
When any two-stage command (including a
TMBU) is uplinked, a flashing UL is displayed
in the upper right corner of all DPS displays
associated with the GPC(s) that are being
commanded.
Checkpoints
When a checkpoint is performed, the following
information is saved in a mass memory unit:

2.2-17

Parameter limit values

Parameter noise filter values
Parameter annunciation enable/inhibit
status

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
SM constant values

The mission elapsed time (MET) of the most

recent successful checkpoint will be displayed
as DD/HH:MM:SS, in the checkpoint time field.

Checkpoint timetags
The checkpoint capability is valuable because
changes made through item entries on SPEC 60
affect only the SM GPC software and not the
mass memory unit software. If these changes
are not saved in a mass memory unit, and the
SM GPC fails, flight software will lose the
changes that have been made. The changes
would then have to be reentered.
When checkpoint retrieval is enabled, the
software loaded into an SM GPC from a mass
memory unit will contain the most recent
version of changes saved during checkpoint.
Checkpoint Initiate (Item 18), Checkpoint
Status, and Time
When item 18 is executed, the STATUS field
will go blank. While the checkpoint is being
performed, a flashing BSY will be displayed
next to SM COMM BUFF at the top left of SPEC
60. This indicates that the SM communications
buffer is in use. When the checkpoint is
completed, the CHECK PT STATUS field will
contain GOOD. If the SM common buffer was
not available, CHECK PT STATUS will be FAIL,
and item 18 should be executed again.

2. SYSTEMS
2.2 Caution and Warning System (C/W)

SM COMM BUFF - BSY, or RDY

Either a flashing BSY or a status RDY is
displayed after SM COMM BUFF to indicate the
status of the SM Common Buffer. BSY (busy)
indicates that the SM COMM BUFF is being
used; RDY (ready) means the buffer is available.
Keypad entries are rejected if BSY is flashing.
CKPT RETRV ENA (SPEC 1, Item 12)
Executing this item will alternately select or
deselect CKPT RETRV ENA.
An asterisk
appears next to item 12 when checkpoint
retrieval is enabled.
MMU Assignment
(DPS Utility - SPEC 1, Items 3 and 4)
A checkpoint saves the changes in the mass
memory unit assigned to the SM software by
item 3 or 4. In order to save the checkpoint in
both, two checkpoints must be performed.

2.2-18

USA007587
Rev. A
the klaxon) is triggered when there is a rapid
change in cabin pressure with respect to
time.

C/W Summary Data

The C/W system consists of four alarm
classes: emergency (class 1), C/W (class 2),
alert (class 3), and limit sensing (class 0).
Emergency alarms cover two situations:
smoke detection/fire suppression and cabin
pressure.
Smoke detection and fire suppression
capabilities are provided in the crew cabin
avionics bays, the crew cabin, and the
pressurized payload modules.
Increased smoke particle concentration will
illuminate S M O K E D E T E C T I O N lights on
panel L1, illuminate four red M A S T E R
A L A R M lights on panels F2, F4, A7, and
MO52J, and sound the siren in the crew
cabin.
Fire suppression in the crew cabin avionics
bay is provided by one permanent Halon
extinguisher bottle in avionics bays 1, 2, and
3A. The bottle is operated by switches on
panel L1.
Three portable hand-held extinguishers in
the crew cabin are operated by inserting
them into fire holes located in several display
and control panels.
A class 1 alarm (four MASTER ALARM
pushbutton indicators and the sounding of

Class 2 alarms include primary (hardware)

and backup (software) systems. The crew
interfaces with the primary C/W system
through the 40-light annunciator matrix on
panel F7 and a 120-parameter monitor on
panel R13U. The interface with the backup
(software) system is via software messages
and SPEC 60 TABLE MAINT.
Some Class 3 alerts warn the crew of a
situation leading up to a class 2 alarm or of
one that may require a long procedure.
Class 0, a software system, consists of up and
down arrows displayed on the DPS displays
next to a parameter.
The SPEC 60 TABLE MAINT display allows
the crew to change limits, noise filter values,
and status of backup C/W or alert system
parameters.
Pressing the MASTER ALARM light will
silence the alarm and reset the light.
Pressing the ACK key will stop the fault
messages from flashing.
Subsequent
pressing of ACK key will scroll through fault
messages.
Pressing the MSG RESET key will erase fault
messages from the DPS displays and
extinguish the SM ALERT light.

C/W Rules of Thumb

The SENSOR RESET switch on panel L1
should be pressed when smoke concentration
goes below 1.8. This prevents masking of
alarms.
When panel R13U is not in use, the
PARAMETER SELECT thumbwheels should
be set to a value greater than 119.
Crewmembers should reset fault messages as
quickly as possible after review to avoid
covering other messages.
The fault summary should be reviewed
regularly to avoid missed fault messages.

2.2-19

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A
FUEL CELL REAC (R): Indicates an O2 or H2
Fuel Cell 1, 2, or 3 reactant valve is closed. The
hardware channels are 2, 12, 22, 32, 42, and 52
for FC 1, 2, and 3 O2 and H2, respectively.

F7 Light Summary
NOTE
A Class 2 audible tone and MASTER
ALARM lights accompany the appropriate C/W light. Most lights are hardwaredriven, but many parameters are also
software-sensed by the PASS or BFS
GPCs. The software provides a GPC fault
message and illuminates the BACKUP
C/W ALARM light. The hardware channels listed below are the same as the
channels on the C/W STATUS light
matrix on panel R13U. The color of each
light is indicated by (R) for red and (Y) for
yellow.

FUEL CELL STACK TEMP (Y): Indicates a Fuel

Cell 1, 2, or 3 stack temperature out of limits.
The hardware channels are 62, 72, and 82 for FC
1, 2, and 3, respectively.
FUEL CELL PUMP (Y): Indicates a Fuel Cell 1,
2, or 3 pump P out of limits. The hardware
channels are 92, 102, and 112 for FC 1, 2, and 3,
respectively.
CABIN ATM (R):
Indicates either cabin
pressure, PPO2, O2 flow rate, or N2 flow rate
out of limits. The hardware channels are 4, 14,
24, 34, 44, 54, and 64 for cabin press, O2 SYS 1
and 2 flow rate, PPO2 A and B, and N2 SYS 1
and 2 flow rate, respectively.

O2 PRESS (Y): Indicates an O2 tank 1, 2, 3, or 4

pressure or the O2 kit (Tank 5) pressure out of
limits. The hardware channels are 0, 10, 20, 30,
and 40 for Tanks 1, 2, 3, 4, and 5, respectively.

O2 HEATER TEMP (Y): Indicates an O2 Tank 1,

2, 3, or 4 heater temp or O2 kit (Tank 5) heater
temp out of limits. The hardware channels are
1, 11, 21, 31, 41, 51, 61, 71, and 81 for O2 Tank 1
HTR 1 and 2, Tank 2 HTR 1 and 2, Tank 3 HTR
1 and 2, Tank 4 HTR 1 and 2, and Tank 5,
respectively.

H2 PRESS (Y): Indicates either an H2 Tank 1, 2,

3, or 4 pressure or the H2 kit (Tank 5) pressure
out of limits. The hardware channels are 50, 60,
70, 80, and 90 for Tanks 1, 2, 3, 4, and 5,
respectively.

O2 PRESS

H2 PRESS

FUEL CELL
REAC

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

CABIN ATM

O2 HEATER
TEMP

MAIN BUS
UNDERVOLT

AC
VOLTAGE

AC
OVERLOAD

AV BAY/
CABIN AIR

IMU

FWD RCS

(R)
(R)

FREON
LOOP

RCS JET
(R)

H2O LOOP

RGA/ACCEL

AIR DATA

LEFT RCS

RIGHT RCS

LEFT OMS

RIGHT OMS

(R)

LEFT RHC
(R)

PAYLOAD
WARNING (R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM
(R)

RIGHT/AFT
RHC

(R)
(R)

(R)

GPC

FCS
SATURATION

OMS KIT

PRIMARY C/W

FCS
CHANNEL

MPS

APU
OVERSPEED

APU
UNDERSPEED

APU
TEMP

OMS TVC

(R)

(R)

HYD PRESS

098.cvs

Caution and Warning Light Matrix on Panel F7

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-20

USA007587
Rev. A

F7 Light Summary (continued)

MAIN BUS UNDERVOLT (R): Indicates main
bus A, B, or C voltage low. The hardware
channels are 3, 13, and 23 for main bus A, B,
and C respectively.
AC VOLTAGE (Y): Indicates AC bus 1, 2, or 3
phase A, B, or C out of limits. The hardware
channels are 33, 43, and 53 for AC bus 1, 2, and
3 respectively.
AC OVERLOAD (Y): Indicates an inverter 1, 2,
or 3 phase A, B, or C output of 225 percent
overload for 20 sec or 300 percent for 4 to 6 sec.
The hardware channels are 63, 73, and 83 for
inverter 1, 2, and 3 respectively.
FREON LOOP (R): Indicates a low Freon loop
1 or 2 flow rate or a temperature out of limits.
The hardware channels are 106, 116, 107, and
117 for loop 1 and 2 flow rate, and loop 1 and 2
temp respectively.
AV BAY/CABIN AIR (Y): Indicates out of limits
condition on cabin fan P, AV Bay 1, 2, or 3 air
out temp, or cabin heat exchanger air temp. The
hardware channels are 74, 84, 94, 104, and 114
for cabin fan P, AV Bay 1, 2, or 3 Temp, and
CAB HX temp respectively.
IMU (Y): Indicates detection of an inertial
measurement unit (IMU) failure or dilemma.
The hardware channel is 103 and is a discrete
driven from the GNC software.
FWD RCS (R): Indicates detection of an out of
limits condition on a forward RCS oxidizer tank
ullage pressure, fuel tank ullage pressure, or
forward oxidizer or fuel leak. The hardware
channels are 6, 16, and 26 for oxidizer tank
press, fuel tank press, and leak respectively.
RCS JET (Y): Indicates detection of an RCS jet
failed on, failed off, or leaking. The hardware
channel is 96 and is a discrete driven from the
GNC software.
H2O LOOP (Y): Indicates an out of limits
condition on H2O loop 1 or 2 pump out
pressure. The hardware channels are 105 and
115 for loop 1 and 2 respectively.

RGA/ACCEL (Y): Indicates detection of a rate

gyro assembly (RGA) 1, 2, 3, or 4 failure, or an
accelerometer 1, 2, 3, or 4 failure. The hardware
channel is 93 and is a discrete driven from the
GNC software.
AIR DATA (R): Indicates detection of an air
data transducer assembly (ADTA) dilemma.
The hardware channel is 91 and is a discrete
driven from the GNC software.
LEFT RCS (R): Indicates detection of a left RCS
oxidizer, fuel tank ullage pressure out of limits,
or left oxidizer or fuel leak. The hardware
channels are 36, 46, and 56 for oxidizer tank
press, fuel tank press, and leak respectively.
RIGHT RCS (R): Indicates detection of a right
RCS oxidizer, fuel tank ullage pressure out of
limits, or right oxidizer or fuel tank leak. The
hardware channels are 66, 76, and 86 for
oxidizer tank press, fuel tank press, and leak
respectively.
SPARE: Available for future warning parameter growth.
LEFT RHC (R): Indicates detection of a left
rotational hand controller (RHC) pitch, roll, and
yaw disagree. The hardware channel is 100 and
is a discrete driven from the GNC software.
RIGHT/AFT RHC (R): Indicates detection of a
right or aft RHC pitch, roll, or yaw disagree.
The hardware channel is 110 and is a discrete
driven from the GNC software.
LEFT OMS (R): Indicates detection of a left
OMS pod oxidizer, fuel tank ullage pressure out
of limits, or an engine abnormal (OMS engine
fail to cutoff, fail to ignite, or early shutdown)
condition. The hardware channels are 37, 47,
and 57 for the oxidizer, fuel tank press, and
engine abnormal respectively. The hardware
channels are 7, 17, and 27 for the oxidizer, fuel
tank press, and engine abnormal respectively.
RIGHT OMS (R): Indicates detection of a right
OMS pod fuel tank ullage pressure out of limits,
or an engine abnormal (OMS engine fail to
ignite, or early shutdown) condition.

2.2-21

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A

F7 Light Summary (continued)

PAYLOAD WARNING (R): Indicates detection
of up to five payload parameter inputs out of
limits. The hardware channels are 55, 65, 75, 85,
and 95.
GPC (Y): Indicates GPC 1, 2, 3, 4, or 5 has
determined itself failed and issued a self-fail
discrete. The hardware channels are 5, 15, 25,
35, and 45 for GPC 1, 2, 3, 4, and 5 respectively.
FCS SATURATION (Y): Indicates detection of
elevon position or hinge moment saturation.
The channel is 101 and is a discrete driven from
the GNC software.
OMS KIT (Y): Indicates detection of an OMS kit
oxidizer or fuel tank ullage pressure out of
limits. The hardware channels are 77 and 87 for
oxidizer and fuel respectively.
OMS TVC (R): Indicates detection of an OMS
pitch or yaw gimbal failure. The hardware
channel is 67. An OMS TVC failure may also
result in a LEFT or RIGHT OMS light.
PAYLOAD CAUTION (Y): Indicates detection
of a payload parameter input out of limits. The
hardware channel is 97 and is not presently
implemented.
PRIMARY C/W (Y): Indicates detection of a
C/W system self-test failure internal to the
C/W EU. The failures include the loss of power
supply A or B, loss of A or B timing, or the
inability of a C/W self-test parameter to pass
limit check.
No channel number.
The
parameter is internal to the C/W unit hardware
itself. The light also illuminates each time the
ESS 1BC C/W A circuit breaker is closed after
being opened and extinguishes when the
MASTER ALARM pushbutton indicator is
depressed.

2. SYSTEMS
2.2 Caution and Warning System (C/W)

FCS CHANNEL (Y): Indicates detection of an

elevon, rudder, or speedbrake actuator failure,
SRB rock or tilt actuator failure, or MPS engine
pitch and yaw actuator failure. The hardware
channel is 111 and is a discrete driven from the
GNC software.
MPS (R): Indicates detection of an MPS engine
He tank press, He regulator out press, LO2
manifold press, or LH2 manifold press out of
limits. The hardware channels are 9, 19, 29, 39,
49, 59, 69, and 79 for Engine 1, 2, and 3 He TK,
He reg, and LO2 and LH2 pressure respectively.
SPARE (R): Available for future warning
parameter growth.
BACKUP C/W ALARM (R): Indicates detection
of a C/W alarm via SM, GNC, or BFS software
monitoring. In OPS 2 SM parameter limits can
be accessed, changed, enabled, and inhibited
through SPEC 60 TABLE MAINT display.
APU TEMP (Y): Indicates an APU 1, 2, or 3
exhaust gas temp or lube oil temp out of limits.
The hardware channels are 8, 18, 28, 38, 48, and
58 for APU 1, 2, and 3 EGT and lube oil temp
respectively.
APU OVERSPEED (Y): Indicates an APU 1, 2,
or 3 speed greater than a specified percentage of
the designed speed. The hardware channels are
68, 78, and 88 for APU 1, 2, and 3 respectively.
APU UNDERSPEED (Y): Indicates an APU 1, 2,
or 3 speed less than a specified percentage of
the designed speed. The hardware channels are
98, 108, and 118 for APU 1, 2, and 3
respectively.
HYD PRESS (Y): Indicates a hydraulics system
1, 2, or 3 supply pressure out of limits. The
hardware channels are 99, 109, and 119 for APU
1, 2, and 3 respectively.

2.2-22

USA007587
Rev. A

Fault Message Table

Comments

The fault message table located in the FDF

Reference Data Book provides a reference to
crewmembers on all software-generated
messages. The following explains the table
and a typical fault message table is shown.
Message

The message column notes the

exact message annunciated.

OPS
availability

This column is broken into

two subcolumns: PASS and
BFS. Under each subcolumn is
a list of GPC Operational
Sequences (OPS) in which a
particular message can be
received.

Cause

This
column
provides
additional clarifying notes.
Clarifies conditions that
must be present for a
message to be annunciated.
For example, an FRCS
LEAK message is generated
for an OX/FU QTY >9.5
percent, which is indicated
by a bilevel discrete.
Identifies conditions with
no corresponding long form
malfunction procedure (in
other words, NO MAL.
Identifies procedures or
actions required when it is
not clear. For example, the
RCS LEAK ISOL PKT C/L
procedure should be used
for an F RCS He P msg.

This column lists the possible

causes that drive the message.

Identifies
impacts.
Examples include quantity
calculation suspended and
cause termination of auto
sequence.

OPS AVAIL
MESSAGE
F RCS
(cont)

RJET
UJET
He P
LEAK
PVT
TK P

S69 FC AMPS

PASS
G1,2,3,
6,8
G1,2,3,
6,8
G2,8
G,2,3,8
G2,3,8
G2,8

CAUSE

BFS

COMMENTS

F RIGHT JET 2(4,5) FAIL ON/OFF/LK

F UP JET 1(2,3) FAIL ON/OFF/LK
G,1,3,6
G1,3,6

G1,3,6

S2,4

F He (FU OR OX) TK P 2 LOW

PROP/He LEAK
LOSS OF P OR T DATA FRO RCS QTY
CALC
FWD RCS (FU OR OX) TK ULL PRESS
HI/LOW
FC AMPS

FAIL OFF DETECTION NOT

PERFORMED IN MM101 & 102 FOR
PASS

PKT C/L - RCS LEAK ISOL

OX/FU QTY > 9.5%
NO MAL
QTY CALC SUSPENDED
QTY CALC SUSPENDED

1(2,3)
SM1 FC AMPS 1(2,3)
S69 FC COOL P
SM1 FC COOL P 1(2,3)
S69 FC DELTA V
SM1 FC DELTA V 1(2,3)
S69 FC EXIT T
SM1 FC EXIT T 1(2,3)
S69 FC H2 FLOW
S69 FC H2 PUMP

SM
1(2,3)

FC COOL P

S2,4
SM

1(2,3)

FC SUBSTACK v > 150 MV

S2,4
SM

1(2,3)

FC EXIT T

S2,4
SM

1(2,3)
1(2,3)

S2,4
S2,4

FC H2 FLOW
FC H2 PUMP STATUS

Typical Fault Message Table

2.2-23

2. SYSTEMS
2.2 Caution and Warning System (C/W)

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.2 Caution and Warning System (C/W)

2.2-24

USA007587
Rev. A

2.3

camera configurations are specified in the Flight

Requirements Document for each shuttle flight.

CLOSED CIRCUIT TELEVISION

(CCTV)

The CCTV system consists of video processing

equipment, TV cameras, pan/tilt units (PTUs),
camcorders, video tape recorders (VTRs), color
television monitors (CTVMs), and all the
cabling and accessories required to make these
components work together. The crew can
control almost all CCTV operations. Most
CCTV configuration commands can be executed
by the Instrumentation and Communications
Officer (INCO) at Mission Control Center
(MCC). Among the commands MCC cannot
uplink are those to configure and operate loose
CCTV equipment, such as camcorders and
VTRs, wireless video system (WVS), digital
television (DTV) system, and the selection of
inputs to the color monitors.

CONTENTS
Description.............................................
CCTV Cameras ......................................
Video Processing Equipment ..............
CCTV Camera Lens Control................
Pan/Tilt Units (PTUs) ..........................
Cabin Cameras ......................................
VTRs .......................................................
Monitors .................................................
TV Cue Card ..........................................
OBSS .......................................................
CCTV System Summary ......................

2.3-1
2.3-2
2.3-6
2.3-10
2.3-11
2.3-11
2.3-13
2.3-14
2.3-16
2.3-19
2.3-21

Description
The closed circuit television (CCTV) system is
used on orbit to provide support to orbiter and
payload activities. This support includes transmitting real-time and recorded video from the
orbiter to Mission Control Center through the
S-band FM, S-Band PM, or Ku-band communications systems. Ku-band can be either analog
or digital. Mission requirements for CCTV and

Standard CCTV components are powered via

circuit breakers located on panel R14. Flightspecific keel cameras (prox ops or berthing) are
usually powered from a cabin payload bus.
CCTV pushbuttons on panel A7U have lights to
illuminate visual feedback on camera and
CCTV routing configuration. These lights are
powered via the ANNUNCIATOR light
switches located on panel A6U.

GMT

MTU

Video

Camcorder

VIDEO SWITCHING
UNIT (VSU)

MUX

OTHER Payloads, Spacehab, DTOs, etc.

VIDEO
(NTSC, B&W)
VIDEO & TLM

Illuminator

PLB Cameras

CAMERA &
VSU TLM

MN A
CNTL AB1

CAMERA TYPES:
CTVC, ITVC
PAYLOAD BAY CAMERAS
A
B
C
D
PORT RMS CAMERAS
Elbow
Wrist (w/o PTU)

Pwr, Cmds,
& Sync

CMDS & SYNC

POWER ON/OFF

MN B
CNTL BC1
CREW CMDS
PANEL A7

To MCC

DTV

Video & TLM

(Panel & DNLK)

Video

Ku-Band
System

Digital DNLK
Video

V10 Recorder

S-Band FM
System

Analog
DNLK Video

REMOTE CONTROL
UNIT
B

COLOR
MONITOR
2

COLOR
MONITOR
1

SYNC
SYNC

A
V10

SYNC
GEN/OSC

Record
video

TEST
PATTERN

POWER ON/OFF
GCILC MN A, OFF, MN B
PF2
MDM

CCTV Telemetry

MCC CMDS

KEEL/PROX OPS CAMERAS

OF4
MDM
usa007587_946r2.cvx

CCTV System Overview

2.3-1

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A

Payload Bay CCTV Camera Locations

CCTV Cameras
Three types of CCTV cameras are flown in the
payload bay. The cameras are designated as
color television camera (CTVC), intensified
television camera (ITVC), and Videospection.
The ITVC and Videospection camera are blackand-white (B&W) cameras. Camera names and
locations are shown in the above diagram.
Some missions require additional cameras in
the payload bay. These cameras are usually
positioned in one or more of four keel camera
mounts.
Occasionally, these cameras are
mounted on payload support structures and are
used to assist with berthing operations. A
CTVC mounted in the orbiter docking system
(ODS) is used for docking missions as a
centerline camera. The Videospection camera is
used on a flight-specific basis.
All payload bay CCTV cameras have heaters for
both the camera and the PTUs. These heaters
are independently powered from circuit
breakers located on panel R14. The heaters are
thermostatically controlled and activate when
the temperature reaches -8 C and turn off at 0
C. All CCTV cameras and PTUs in the payload
bay are covered with thermal blankets.
Field sequential color (FSC) was selected by the
Space Shuttle Program (SSP) as the color video
standard rather than the National Television
Standards Committee (NTSC) standard because
2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

NTSC cameras in the 1970s were much larger and

consumed more power than their FSC
counterparts.
In addition, FSC cameras
performed well for the Apollo program in the late
1960s and early 1970s. Today, miniaturization of
electronics allows NTSC cameras (both CCTV and
camcorders) to occupy a smaller volume and
consume less power than in years past. The SSP
retired the FSC lens assemblies and use only color
or black and white NTSC cameras.
Color Television Camera (CTVC)
The CTVC provides an RS-170A (NTSC) color
video signal that does not require additional
processing in MCC prior to distribution to the
media. NTSC is the color video standard in
North America, Japan, and other areas. Great
Britain and France are among nations with
television standards other than NTSC.
The CTVC overall size is 16.0 inches long, 5.88
inches wide, and 5.94 inches high. The CTVC
lens is encased within the CTVC housing. The
CTVC has a maximum horizontal field-of-view
of 77 and a minimum of about 9. The CTVC
uses three charge-coupled devices (CCDs) to take
discrete samples of light passing through a prism
after entering the lens. The red, green, and blue
(RGB) light separated by the prism is directed to
RGB CCDs. The CCDs are strobed by the
camera's timing circuits to provide RGB
component signals.
The RGB signals are

2.3-2

USA007587
Rev. A
processed independently to provide color
balancing. Payload bay floodlights, compact
portable lights (CPLs) in the cabin, and sunlight
are composed of different light spectra.
The nomenclature on the MENU and MODE
pushbutton indicators (PBIs) is no longer used.
A CTVC decal is used to assist crews in
operating the CTVCs. This menu system for
configuring the CTVCs provides control of the
CTVC operating modes using existing PBIs and
uplink commands.

CTVC Decal
Intensified Television Camera

Color Television Camera (CTVC)

The ITVC is essentially a B&W version of the

CTVC. The automatic light control (ALC),
manual gain, and gamma settings are exactly
the same. However, the ITVC has only one
CCD (versus the three on CTVC) and is
optimized for a low-light environment. Instead
of color balance, the ITVC includes day and
night operating modes. The night mode provides additional gain, which can be used with
any ALC setting as well as manual gain
settings. This feature allows a high gain option
without sacrificing the ALC protection,
particularly around orbital sunrise.
A
combination of night mode and manual gain 24
dB will make the ITVC sensitive down to 0.03
lux and provide a full-level output at around
0.02 lux.

CCTV Circuit Breakers on Panel R14

2.3-3

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
If the night mode is used with daylight, the
video will appear granular (noisy). The daylight
mode essentially deactivates the night mode.
The ITVCs also include an aperture correction
(AP COR) that provides finer detail (improves
resolution) if there is enough light. In low light
conditions, the scene will look better if AP COR
is off. Power-on defaults are similar to the
ITVC. Manual mode of 0 dB is displayed on
panel A7U and night operation mode and
gamma black stretch are active in the
background. The ITVC is configured using the
CTVC decal.

controlled and also enables the logic for

activating
light
emitting
diode
(LED)
illuminators when flown.

Videospection Camera

Intensified Television Camera (ITVC)

Camera Power
The CTVC and ITVC cameras have three
associated circuit breakers (cbs) on R14:
CAMR/PTU, CAMR HTR, and ILLUM/PTU
HTR.
In order to operate a camera, the
appropriate CAMR/PTU cb needs to be pushed
in. This cb also provides power to the PTU.
The CAMR HTR cb provides power to each
camera heater circuit that is thermostatically
controlled. The PTU HTR enables the PTU
heater circuits that are thermostatically

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

The Videospection camera is a simple fixed

focus, fixed field-of-view, B&W camera. It is
either on or off, with no available controls to
adjust the video it produces.
It does
automatically open and close its iris to adjust
for different light settings. It is powered via a
standard switch panel switch. It has been used
as a keel/berthing camera for various payloads.
It has also been attached to the remote
manipulator system (RMS) end effector to
provide a side view compared to the end
effector camera. Due to this configuration, it
has been known as the special purpose end
effector (SPEE) camera or the RMS sideview
camera (RSC). Like the CTVC and ITVC, it can
also accommodate an LED illuminator to aid its
low-light viewing situations.
However, its
illuminator may be a three-way illuminator that
has low, medium, and high intensity settings.

2.3-4

USA007587
Rev. A

TV Control Panel A7

2.3-5

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A

Video Processing Equipment

The video control unit (VCU) is the central
processor/controller for the CCTV system. The
VCU consists of two line replaceable units
(LRUs): the remote control unit (RCU) and the
video switching unit (VSU). Both LRUs are
located behind panels R17 and R18 in the aft
flight deck. These units are forced air cooled by
cabin fans, although neither LRU includes a
temperature sensor. An extension of the VSU is
the video processing unit (VPU), which allows
for more video interfaces than the VSU can
provide. It is located in panel R12. The latest
addition to the Shuttle video processing
equipment is the DTV system, which is located
at L10L. Finally, one non-installed piece of
equipment is the sequential still video (SSV)
system that allows the shuttle to send sequential
still video snapshots to MCC during Ku-band
loss of signal (LOS) periods.
Remote Control Unit
The RCU receives all CCTV commands from
both the crew and MCC. Ground command
interface logic (GCIL) control switch located on
panel A7U determines whether MCC can send
commands to the CCTV system. When the TV
POWER CONTROL switch is in the CMD
position, MCC can uplink commands to the
CCTV system, and the crew will be able to use
all panel A7U TV switches except the TV
POWER CONTR UNIT MN A / OFF / MN B
switch. This TV POWER CONTR UNIT switch
enables GCIL drivers to power up the VCU
through either DC Main A or B via panel R14,
thus this is the one true GCIL switch. The GCIL
drivers prevent the crew and MCC from
activating
or
deactivating
the
VCU
simultaneously. When the GCIL TV POWER
CONTROL switch is in PANEL, the crew can
configure the TV POWER CONTR UNIT switch
to provide VCU power or to turn the VCU off.
All uplink commands to the CCTV system are
inhibited when the GCIL switch is in PANEL.

TV POWER Controls on Panel A7U

Uplink commands to the RCU must pass through
payload 2 mutiltiplexer/demultiplexer (PF2
MDM). The VCU power MN A / OFF / MN B
commands to the GCIL drivers use PF1 or PF2
MDM like all other GCIL commands. However,
if the GCIL Main C circuit power provided from
panel R14 were to fail, the RCU will inhibit all
uplink CCTV commands, except for the VCU
power-on commands. The crew can send any
uplink CCTV command by executing a real-time
command (RTC) on SPEC1 of the Systems
Management General Purpose Computer (SM
GPC). The TV POWER CONTROL switch must
be in the CMD position for crews to use this
feature. Crews do not carry any CCTV specific
RTCs in any Flight Data File (FDF) documents.
This capability would only be used if MCC were
unable to uplink commands or for functions not
available from panel A7U. The RCU includes two
independent video sync generators. The sync
generators are tied to the power on logic and TV
SYNC NORMAL/REVERSE switch on panel
A7U.
When the TV SYNC switch is in NORMAL, sync
generator A is powered by Main A with sync
generator B on Main B. The bus that powers the
VCU also applies power to the sync generator
tied to that bus. When the TV SYNC switch is in
REVERSE, sync generator A is tied to Main B and
sync generator B is tied to Main A. This feature is
provided to allow the crew to switch sync
generators without power cycling the VCU in
case of a sync generator failure. MCC can see the
status of this switch, but cannot send a command
to switch sync generators without switching
main bus power sources.
In addition to generating master sync signals,
the RCU also generates a full-field test signal,

2.3-6

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A
better known as a test pattern. The test pattern
is black and white. The test pattern can be
selected as a video source from panel A7U or
via an uplink command.
The sync signal is distributed to CCTV cameras
and the VSU for synchronization purposes.
Commands to the cameras are embedded in the
sync signal. Each camera has a unique address.
This address is sent out with the command in
the sync signal. Therefore, only the correctly
addressed camera will respond to the
command. Uplinked commands are sent on a
different sync (horizontal scanning) line than
A7U commands. It is possible for the crew and
MCC to send conflicting commands to a camera
at the same time; coordination between crew
and MCC is very important to prevent potential
conflicts. Usually, the crew configures cameras
and MCC selects cameras for downlink. Prior
to launch, each crew should talk with the lead
INCO for their flight to work out CCTV
responsibilities during crew activity and sleep
shifts.
The crew activates payload bay cameras using
the TV CAMERA POWER switches located at
the top of panel A7U. These switches are
momentary in both the ON and OFF positions.
The ON/OFF talkbacks are set by the RCU. The
talkbacks indicate the status of a 28 V dc
discrete signal that enables a remote power
controller (RPC) to provide panel R14 circuit
breaker power to a payload bay camera and
PTU. The talkback status can be misleading
because the talkback can indicate ON when the
circuit breaker that provides power to the
camera is out. Crews should always use these
switches to power off the cameras prior to
deactivating the VCU to ensure correct camera
powerdown.

TV SYNC Switch on Panel A7U

CAMERA POWER Switches and Talkbacks on

Panel A7U

TV DOWN LINK switch on Panel A7U

There are two RMS camera switches to note. In
addition to the RMS TV CAMERA POWER
switch, another RMS camera switch is located
below the aft rotational hand controller (RHC)
on panel A7U.
The RMS CAMERA
WRIST/ELBOW select switches toggle between
the wrist (end effector) and elbow cameras.
Only one RMS camera can be activated at a
time. Cycling the switch powers off one camera
and powers on the other. MCC cannot select
between the wrist and elbow cameras nor can
MCC identify the position of the switch using
downlinked telemetry.
In addition to TV SYNC NORMAL/REVERSE
and RMS CAMERA WRIST/ELBOW switches,
MCC is unable to configure the TV
DOWNLINK ENABLE/INHIBIT switch function. This lever lock switch inhibits the VSU
output to the analog downlink Ku-Band and
S-Band FM communications systems. This
switch can be used to ensure that no video is
downlinked
during
"sensitive"
mission
operations.
For the majority of mission
operations, this switch should be in the
ENABLE position. MCC receives telemetry that
indicates the position of the TV DOWNLINK

2.3-7

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
switch. For DTV, this enable/ inhibit function
is performed by the MUX/ VTR/CC switch on
the DTV MUX on panel L10L.
The RCU provides some telemetry to the pulse
code modulation master unit (PCMMU) via OF4
MDM.
This includes camera overtemp,
downlink enable, VCU power source, sync
normal/reverse, sync generator active, and
"camera select." The camera select is the camera
selected for downlink. This may be a different
camera from the one the crew or MCC is
commanding at the time. The crew and MCC
can command different cameras at the same
time. The ALC/Gamma status of the downlink
camera will be included in the telemetry to the
PCMMU.
Video Switching Unit (VSU)
The VSU can accommodate up to 13 video
inputs and 7 outputs. However, panel A7U
only provides for 10 inputs and 4 outputs.
Adding pushbuttons to expand the VSU operational capability has been determined by the
SSP as being too expensive for the increase in
capability and is planned for the advanced
VPU.
The VSU is used to route video from a source to a
destination. All commands to the VSU are
processed by the RCU before being sent to the
VSU. Note that the crew routes video by
selecting a destination and then a source,
whereas MCC selects a source and then a
destination. When the crew selects a destination
on panel A7U, that output PBI illuminates. Once
an input is selected for that particular output, the
input PBI will illuminate as well. If the input is a
camera, the crew can select ALC/Gamma PBI
settings and/or send PTU/lens commands to
that camera and pan/tilt unit.
The VSU is synchronized to the RCU via the
sync generators. This allows the VSU to change
video sources for a destination at the end of a
video field to prevent visible picture distortion
when the video switches engage.
The
synchronization of the CCTV also allows the
VSU to read CCTV camera telemetry. The VSU
can read camera ID, temperature, and pan/tilt
angles. If the VSU detects a camera exceeding
45 Celsius, an overtemp warning is sent to the
RCU. The RCU sets a telemetry bit high so that

the SM GPC will annunciate a SM Alert and a

S76 COMM CAM TEMP message.
The
temperature limit is set in the VSU and cannot be
changed by a table maintenance block update
(TMBU). A TMBU can be used to inhibit the SM
alert and message.
The VSU is also capable of generating multiplex
(mux) scenes that appear as a split screen of two
CCTV cameras. The VSU takes the center
portion of a camera scene and places it on the left
or the right side of the mux picture. The VSU
determines where to extract the center portion of
the video source from the RCUs sync signals.
The VSU can only mux synchronous video
sources. VTR playback and camcorders cannot
be muxed by the VSU.
The VSU receives GMT from the orbiter timing
buffer. The GMT is formatted and inserted in the
vertical retrace interval by the VSU, using sync
timing from the RCU as a reference. This GMT is
inserted in all incoming video lines when the VSU
is in the sync mode. Since both camcorders and
VTRs are asynchronous devices (i.e., not in sync
with the RCU), the VSU fails to insert the GMT
timetag in the correct location of the
asynchronous video. Crews and flight controllers
will see this as a thin, flashing, segmented white
line that scrolls across the screen of the color
monitors and in the downlink video. The VSU
interprets the GMT as an elevated camera
temperature. This will produce a false SM S76
COMM CAM TEMP message. An asynchronous
(async) mode command is available to inhibit
GMT timetags and disable the VSU's temperature
sensing circuits. The async mode affects camera
mode sensing in the VSU. The ALC and Gamma
pushbuttons on panel A7U may remain static and
not reflect the true configuration of standard
orbiter payload bay cameras. This async mode is
usually enabled for VTR playback to downlink
and for downlinking camcorder video.
Otherwise, a white line will be visible in the scene.
The asynchronous mode does not mean that the
CCTV System is no longer synced together.
CCTV cameras are still slaved to the RCU, as is
the VSU. Since almost all payload customers
require a GMT timetag in recorded and real-time
video, crews and flight controllers must
coordinate the use of async mode.

2.3-8

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A
Video Processing Unit

Digital Television

The VPU first flew on STS-92 in October 2000.

The VPU provides two video signals from the
orbiter CCTV system to the International Space
Station (ISS) and provides one video signal
from the ISS to the orbiter CCTV system. The
VPU also provides the capability to patch one of
six video inputs to the CCTV PL2 video input of
the VSU. A subcomponent of the VPU is the
wireless video system (WVS) interface box
(WIB).
The WIB provides the in-cabin
communication link to the WVS system. WVS
is a wireless extravehicular activity (EVA)
helmet camera system controlled by a laptop in
the crew cabin and can provide a single video
signal into the TV system via the PL3 VSU input
and a view from each helmet to a Sony V10 for
viewing and recording. Each EVA helmet can
provide a single view from one of three
available lenses. Commands to the helmet are
transmitted via one ultrahigh frequency (UHF)
antenna, while video returns via one of seven
S-band antennas in the payload bay. The VPU
is located on panel R12 and is powered by a
circuit breaker located on MN B R14 Row D.

VIDEO PROCESSING UNIT

TO

Wireless Video System

Interface Box

VPU
POWER
ON

P/L 2

J603
CCTV PL / 3

OFF
OSVS
OUT 2

ISS

KEEL
1

PRI
C/L

SEC
C/L

MISS
CAM

XCVR1

PWR

1/2 A

J501

J502

BAL

BAL

J401

CTVM
IN

TO
VTR

XCVR2

FUSE

FROM

UNBAL
PRI . C/L

SEC . C/L

KEEL 2

J402

UNBAL

J702
AUX/REMOTE

J701
CMD/TLM
REMOTE

The DTV system first flew on STS-110 in April

2002. The DTV system provides the shuttle
with the capability to downlink a video signal
in a digital format. It takes any analog NTSC
formatted video signal from the CCTV system,
converts it to a digital signal, and records
and/or downlinks it to MCC via the Ku-band
channel 3 PAYLOAD MAX channel.
The
system hardware is located in L10L and consists
of three main components: the vertical interval
processor (VIP), a Sony DSR-25 VTR, and a
multiplexer (mux).
The VIP is AC powered from AC2 PAYLOAD 3
Phase. It conditions the video, audio and
vertical interval for processing by the DSR-25
VTR.
The Sony DSR-25 VTR takes the signals from
the VIP, converts it to digital, and passes it to
the mux. It provides up to 3 hours of video
recording and is DC powered from the mux.
The mux organizes the data for processing by
the Ku-band system. It receives its DC power
from the PAYLOAD AUX bus and provides
power for the VTR and can directly power a
camcorder. MCC only has insight to the status
of the DTV mux when the mux is on and a Kuband link is established. INCO will configure
the Ku-band system between a digital downlink
(channel 3 PL MAX) and an analog downlink
(channel 3 TV).

Video Processing Unit

Digital Television (DTV) Hardware

2.3-9

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
Sequential Still Video (SSV)

CCTV Camera Lens Control

The SSV system provides MCC with the

capability to view a video signal from the
shuttle without having to rely on Ku-band
signal coverage. It utilizes the S-band PM
system, which has more coverage than the Kuband system.
Unfortunately, it can only
provide a snapshot of the video signal that is
refreshed periodically. This refresh rate is
dependent upon a sample rate and the available
downlink rate through the shuttle S-band data
system, but is typically every 10 seconds.
For the SSV to work, the crew must configure a
compression encoder box and cables in the crew
cabin. The encoder digitizes the video signal to
be downlinked to MCC as data instead of video.
Once configured, INCO has the only control of
the signal being routed to the encoder box from
the VSU SPARE 1 video output, which is not
available to the crew on panel A7U.

The CTVC and ITVC cameras are normally

operated in an ALC mode; the three ALC settings
are peak, normal, and average. To select an ALC
mode, the crew will use panel A7U MENU and
MODE pushbuttons. MCC/INCO can also select
ALC settings via uplink commands. The peak
ALC setting is most sensitive to incoming light;
therefore, the iris will allow less light to enter the
lens than with an ALC setting of normal. The
average ALC setting will command the iris to
open more and increase the voltage gain when
compared to the ALC setting of normal.
Each CCTV camera type uses the same switches
and command sequences to adjust the field-ofview of the camera. Just above the six MENU/
MODE PBIs is a row of switches used to send
commands to the cameras and PTUs.
Lens commands are used to adjust the lens and
iris settings.
The focus, zoom, and iris
commands provide the crew and MCC with
direct control of lens settings. The CTVC and
ITVC insert lens data into the video. The color
monitors are able to display the lens data in the
upper portion of the monitor's display. This data
is also available to INCO in the MCC. In
addition to changing the field-of-view, the zoom
function can affect the apparent scene brightness
when the camera is in an ALC mode. As bright
objects increase or decrease in size, the ALC
adjusts accordingly to increase or decrease the
amount of light entering the lens. The IRIS
switch provides manual control of the iris to the
user. Use of this switch or an iris open/close
command by MCC disables ALC. When using
this switch, crews must not leave the payload bay
cameras unattended.
NOTE
Direct sunlight can permanently damage these
cameras if a camera iris remains open.

SSV Compression Encoder

Focus, Zoom, and Iris Control

2.3-10

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A

Pan/Tilt Units
The PTUs are used with cameras A, B, C, D, and
the RMS elbow. The PTUs are used to change
the camera field-of-view by moving a camera
about two axes. The PTUs can pan and tilt 170
in either direction, positive or negative, when
any CCTV camera is attached.
The PAN/TILT RESET/HIGH RATE/LOW
RATE switch on panel A7U is used to configure
the rate of movement for the PTU of the camera
selected. The RESET position is momentary and
resets the camera's pan/tilt coordinates to zero.
The HIGH RATE position allows the PTU to
pan and tilt at a rate of 12 per second. The
LOW RATE position allows the PTU to be
commanded at a rate of 1.2 per second. The
TILT UP/DOWN and PAN LEFT/RIGHT
momentary switches are used to initiate and
maintain movement about the tilt and pan axis
until the switches are released or a hardstop is
encountered. Pan and tilt commands can be
executed simultaneously.
The PTUs may
encounter clutch slippage during operation,
particularly when configured for high rate.
When the clutch slips, there is a temporary
suspension in PTU movement. The camera will
continue counting during this period because
there is no feedback from the PTUs to the
camera to suspend counting. This affects the
accuracy of camera pointing in support of
payload activities.

MCC is capable of configuring the pan/tilt rate

to be different from what the crew has set. For
uplinked commands, the rate defaults to high
during CCTV activation. INCOs usually use
the low rate for more effective management of
CCTV camera movement because of the time
delays in the orbiter's communications systems.

Cabin Cameras
Although all CCTV cameras are compatible
with the TV outlets located on panels O19 and
MO58F, there are no plans to regularly use
these cameras in the flight deck or middeck
areas. Camcorders have replaced the CCTVs in
the orbiter crew compartment. In addition to
providing excellent real-time video, the
camcorders can also record and play back video
without using an external video recorder. The
current main cabin camera is the Sony PD100
camcorder. Another cabin camera that is used
in the shuttle is called the minicam. Unlike the
camcorder, it only produces a video signal.

Cabin Camera Power Connectors/Control on

Panel 019

Cabin Camera Power Connectors/

Controls on Panel MO58F

Pan/Tilt Unit and Camera

with Thermal Blankets
2.3-11

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
Sony PD100 Camcorder
The Sony PD100 digital camcorder is a
commercial off-the-shelf (COTS) device that can
be used in one of three ways. It can be used
either as a camcorder to record video captured
by its integrated lens, a video camera that can
send a video signal into the orbiter TV system,
or a VTR that can record and playback video
with audio if needed. It processes video with
three CCDs, one for each color. It has a wide
conversion lens that can be attached to the
integrated lens to widen its field-of-view. It has
an integrated 3.5-inch liquid crystal display
(LCD) monitor that can be used to view live
camera video or playback VTR video. It uses a
40-minute digital DVCAM format tape for its
video recording/playback operations.

cannot be recorded by the camcorder. An audio

terminal unit (ATU) recorder cable is required
to interface with the orbiter audio system to
record and playback analog audio. Although
the camcorder can record and playback stereo
audio signals, the orbiter audio system is not
capable of transmitting or receiving stereo (one
audio channel only).

The PD100 can operate from either orbiter power

via an advanced video interface unit (AVIU),
from the DTV MUX, by battery power or by a
camcorder power interface (CCPI) unit. The
AVIU must be connected to either of the TV
ports. The battery is a Canon camcorder battery,
which requires an adapter to allow it to be used
on the Sony camcorder. The battery lasts from 40
to 60 minutes depending on how the camcorder
is used. This same adapter is required to power
the camcorder from an AVIU. No adapter is
required when powered from the DTV MUX.
The CCPI can be connected to either a TV port or
from an orbiter DC power port. The CCPI can
power up to two camcorders along with one
compact portable light (CPL). The CCPI can only
supply power, not transform return video. The
CCPI and CPL are rarely used.
The PD100 can record, playback or generate live
video in either analog or digital formats. Live
analog video from the camcorder must go
through the AVIU to be converted from
unbalanced to balanced video. It is then routed
into either of the TV ports. Live digital video
from the camcorder can go directly into the
DTV MUX with a single cable. Video from a
connector on the back of the color monitors can
be sent to the camcorder to be recorded. The
AVIU is required to convert the balanced
output video of the monitor to an unbalanced
signal usable by the camcorder. The vertical
interval (VI) data that is imbedded in this video

2.3-12

Sony PD100 Camcorder

Advanced Video Interface Unit (AVIU)

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A
Minicam

VTRs

The minicam is a small Sony XC-999 singleCCD video camera that can route NTSC video
into either of the orbiter TV ports. It requires an
AVIU for power and video conversion. The
four lenses that screw into the camera body are
a fish-eye 3.5mm lens, a normal 6mm lens, and
two telephoto lenses (12mm and 23mm). Since
it is just a camera, it requires an LCD monitor to
view the video and some kind of VTR to record
the video. The minicam is used for ascent and
entry video and is sometimes used during the
on-orbit phase of flight as another in-cabin
camera in addition to the camcorder. Minicam
video can be configured to be a synchronous video
source or an asynchronous video source per AVIU
switch configuration.

Minicam body

Even though the PD100 camcorder can be used

as a VTR, it normally is not used in that manner
on orbit. This task is left to one of two VTRs in
the crew cabin: a small, portable Sony V10 VTR
and the DTV VTR (Sony DSR-25) that is an
integrated part of the DTV system. Both are
digital recorders that are in the same family as
the PD100 camcorder so all of the video
recorders work well with each other and share
the same tape types/formats.
Sony V10 VTR
The Sony V10 digital VTR is a COTS video
recorder/player that can be used in-cabin for
various tasks. It is powered just like the Sony
PD100 camcorder and can record video through
an AVIU just like the camcorder. It has an
integrated 5.5-inch LCD monitor that can be
used to monitor video being sent to the VTR or
for viewing playback video. It uses the same
40-minute DVCAM digital tapes that the
camcorder uses. It can also record and play
back orbiter audio just like the camcorder. Like
the PD100, the V10 can record and/or play back
analog or digital video and audio. Also like the
PD100, the V10 cannot record VI data that is
imbedded in the orbiter analog video. This
means that information like payload bay
camera settings and GMT time will not be
recorded. The only way to record this data is
with the DTV VTR.

Minicam lenses

Sony V10 VTR

2.3-13

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
The DTV VTR is an integrated part of the DTV
system. The DSR-25 replaced the DSR-20 after
tape jamming failures were discovered on STS-107
and STS-114 that were specific to the DSR-20. The
DSR-25 first flew on STS-115 as the official
replacement in September of 2006. It is installed in
a bucket at L10L along with the VIP. It is a digital
VTR that performs the analog-to-digital
conversion for the DTV system. It provides a
built-in, long-duration video recording and
playback capability for the crew. It can use
either the 40-minute DVCAM digital tapes that
the PD100 and V10 use or a 3-hour DVCAM
digital tape without any special adapters.
Unlike the other units, it can record the VI data
that the VIP strips from the orbiter video signal.
It records this data on its audio channel 2.
Orbiter audio can be recorded on its audio
channel 1 via the direct link to the VIP and a
cable connected to a crew communications
umbilical (CCU). Playback video/audio/VI
data from the DSR-25 is designed to be sent to
MCC via the digital downlink route. It can be
configured to downlink video and audio
through the analog downlink route in an
alternate configuration. The DSR-25 does have
an integrated monitor to view live or playback
video.
The crew can also route a video
monitoring signal to either one of the CCTV
monitors (nominal), a V10 VTR, or a battery
operated LCD monitor.

Sony DSR-25 VTR

Monitors
The CCTV system uses a variety of monitors to
display video. Two color television monitors
located on panel A3 are always flown. The color
monitors replaced B&W monitors that had been
flown since the beginning of the SSP. Portable
LCD monitors are flown to display camcorder
and VTR video without having to use either
CCTV color monitor.

Color Television Monitor (CTVM)

CCTV Color Monitor
The CTVMs are the primary display equipment
of the CCTV system. These 10-inch monitors
display NTSC and FSC color. Rotary knobs are
used to control the contrast, brightness, color,
and tint of the video displayed. The color and
tint are only effective displaying NTSC video;
they are not effective with FSC video.
Each monitor uses a graphical menu for
configuration control.
The menu can be
displayed by activating either the FUNCTION or
SELECT controls. The menu will be displayed
for 12 seconds after the last command
(FUNCTION or SELECT) is executed. The
FUNCTION switch is used to move through
different menu headings. The SELECT
pushbutton allows the user to toggle between
different options within each menu heading.
The menu can be used to enable viewing of
CTVC/ITVC lens data, CCTV camera data, and
crosshairs. Data and crosshairs that appear
green are characters generated within the color
monitor and can be activated by selecting GRN
for camera data and crosshairs by turning on
lens data. White characters are generated
within the VSU and can be displayed by

2.3-14

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A
selecting WHT for camera data and crosshairs.
Lens data will display zoom, focus, and iris
settings of the CTVC and ITVC cameras. These
fields are static when a video source other than
a CTVC or ITVC is displayed. Lens data, when
activated, will appear at the top of the screen.
The camera data will display camera ID, pan
and tilt angles, and temperature, although the
white data displays temperature of the camera
only when the VSU detects a camera with an
elevated temperature.
Camera data is
displayed in the lower portion of the screen.
Each color monitor can select from one of five
independent video sources. PNL will display
any video routed to the monitor using panel
A7U. The DNLNK will allow the user to view
any video selected for downlink. The C and D
selections will view video from equipment
connected to the C IN or D IN connectors on the
front of the monitor. RGB will allow the user to
view video that directly drives the red, green,
and blue electron guns of the monitor (such as
NTSC component). The RGB connector is
located on the rear panel of the monitor. SPLT
is another source available and provides a split
screen image of C and D inputs.
There are two ground checkout menu functions
on the lower left portion of the menu (PULSE-X
ON/OFF and GUNS R G B). USCAN ON/OFF
enables or disables the underscanning feature.
When ON, the underscan allows viewing of
edge-to-edge video (horizontal and vertical)
with no loss of image data; i.e., you see what the
camera sees. When USCAN is OFF, about 5
percent of each horizontal and vertical edge is
lost. In addition, the top line of the upper menu
and the bottom line of the lower menu cannot
be seen when USCAN is OFF. The FSC function
selects between 6FLD (6 field) and 3FLD (3
field). This feature determines how often FSC
color is updated to the screen. 6FLD is the
default and preferred setting, except for
viewing FSC video of objects in rapid motion.
This function only applies to cameras with
wide-angle lens assembly (WLA) or color lens
assembly (CLA) lenses.
The DEGAUSS
function dissipates magnetic fields that build up
around the monitor as the orbiter moves at high
speed through the Earth's magnetic field, but
only when DEGAUSS is in the default AUTO

position.
AUTO engages the degaussing
circuitry every 90 seconds. OFF disables this
feature.
The SYNC function of the monitor displays the
source of sync used to display video and
graphics (menu and green data). When no
video is detected by the monitor, the field under
SYNC will indicate EXT for external source.
This means that the sync line from the RCU to
the monitor is providing the sync pulses
necessary to display the menu and data. This field
can be useful for quick troubleshooting for loss of
video (camera power fail vs. iris stuck closed).

CCTV color monitor with menu and L-Data

Video format can be selected manually or
automatically. The CTVMs default to AUTO
MODE in which the monitor determines the
video format from data embedded in the CCTV
camera video. CTVCs will use the NTSC format,
and ITVCs will use B&W decoding. Camcorders
do not provide this data; hence the monitors will
process the camcorder video using the default
NTSC converter. The crew can override the
AUTO selected format by taking MODE to MAN
and then toggling the FRMT to select NTSC, FSC,
or B&W. If a mux scene is routed to a monitor,
the monitor will select FSC because of the nature
of the video processing by the VSU in creating
the mux scene. In order to display NTSC color
from a CTVC in a mux scene, the user must
manually override the format and select NTSC.
The CTVMs have a connector labeled J3 on the
rear of the monitor. This connector provides a
balanced video signal of whatever video is
routed to the monitor output pushbutton on
panel A7U. A VTR or a camcorder can record
this video. Any VSU (white) data requested by

2.3-15

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
the monitor will be recorded by the camcorder.
Monitor (green) data will not be recorded.
LCD Monitor
The LCD monitor is a battery operated monitor
that can be used with any analog video device
to display video. Typical uses are with a
camera such as the minicam or with the DTV
VTR for playback or live video such as entry
video. It takes six AA batteries that are placed
in a separable battery compartment with all of
the batteries arranged in the same orientation.
It will only appear to work when video is
actually flowing into the device and it will drain
batteries at a relatively rapid rate. Therefore, it
is not used very often.

TV Cue Card
The TV cue card includes activation procedures
for the CCTV system and payload bay cameras.
This cue card also includes steps that can
command the cameras to different operating
modes. The steps indicated are good guidelines
for setting up cameras in a safe (ALC active)
configuration.
However, crews should not
hesitate to command cameras out of their normal
operating modes. Since lighting conditions on
orbit are quite dynamic, ALC modes, manual
gain modes, and gamma settings may require
changes. Crews should take the initiative and
adjust the cameras to provide the best possible
video of the object(s) in view. CCTV camera
operation is more of an art than a science when it
comes to getting acceptable looking video.
However, please note the caution block, as the
CCTV cameras are susceptible to damage by
direct sunlight while in a manual mode.

LCD Monitor

2.3-16

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A

TV Cue Card From Photo/TV Checklist (Front)

2.3-17

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A

TV Cue Card From Photo/TV Checklist (Back)

2.3-18

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A

OBSS on Starboard Sill

Orbiter Boom Sensor System (OBSS)
The OBSS first flew on STS-114 in July 2005. The
OBSS consists of a 50-foot boom stowed on the
starboard sill with two sensor packages on the aft
end of the boom. The main goal of the OBSS is to
provide on-orbit inspection video and data of the
orbiter thermal protection system (TPS) to determine
if the orbiter can safely return to Earth or if it needs
repair before coming home. The OBSS is grappled
by the shuttle remote manipulator system (SRMS)
and moved around by the crew to position the sensor
packages to take the inspection video and data for
further MCC processing. The orbiter Ku-band
system provides the downlink to MCC of the sensor
packages video and data. The OBSS has two
different sensor packages, each with pros and cons.
By having two different sensor packages there is not
a single or common failure point to take out both
sensor assemblies. Also by having two different
sensor packages, it provides MCC with more tools to
complete inspection objectives.

the same pan/tilt unit. LDRI video and ITVC video

cannot be viewed simultaneously. The laser is
infrared (IR) at 805 n. mi. and not visible to the
human eye. The LDRI camera is sensitive to IR and
produces NTSC black and white video. The LDRI
camera is similar to the ITVC video in that they are
both NTSC black and white 2-D video with similar
resolution when there is no laser modulation. When
there is laser modulation, the LDRI video appears to
flicker and when the data is processed at MCC, it
provides length, width, and depth of the scanned
area. The crew can manually put the LDRI in six
different modes of operation per the panel A7 PBIs.
The LDRI/ITVC Cue Card in the Photo/TV
Checklist has the steps for activation, general LDRI
control, and deactivation. The PDRS C/L directs the
crew when to go to different LDRI modes and when
to start and stop recording.

Aft End of OBSS

Laser Camera System (LCS)

ITVC/Laser Dynamic Range Imager (LDRI)

The first sensor package (SP1) is the ITVC/LDRI
system. The big picture of the system is that the
ITVC provides 2-dimensional (2-D) NTSC black and
white images of the TPS surfaces and the LDRI
provides 3-D information of the orbiter TPS
surfaces. Both the LDRI video and the boom ITVC
video are considered synchronous sources to the
CCTV system. The ITVC/LDRI video is sent to the
VPU MISS CAM port, labeled LDRI/ITVC with a
crew preference decal, and is viewable by selecting
the PL2 input. The orbiter DTV system is used to
downlink the video and data. The video and data can
be sent to MCC via the orbiter analog TV path in
case of a DTV failure, but DTV is preferred because
the video image is not degraded like the transmission
of the analog video. The ITVC is mounted on a
pan/tilt unit with the LDRI mounted on the bottom
of the ITVC, so both the LDRI and ITVC are using

The second sensor package (SP2) is the LCS. The

LCS consists of the laser camera head (LCH), a crew
cabin payload general support computer (PGSC)
called the laser camera controller (LCC), a black and
white integrated sensor inspection system digital
camera (IDC), and a lab at JSC for ground
processing. The LCS operates at around 1500 n. mi.
and produces detailed 3-D images of the scanned
area. The LCS output is a binary data file stored on
the LCC PGSC and downlinked to MCC via the
normal orbiter communication adapter (OCA)
methods through the orbiter Ku-band system. The
LCS does not have a pan/tilt unit and must rely on
the position of the boom. Activation, operation, and
deactivation of the system are found on the LCS Cue
Card in the P/TV C/L. The IDC is used for a
secondary view to obtain still images of the damaged
area after the primary scan is complete.

2.3-19

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A
OBSS Modes of Operation
The crew or MCC can command the LDRI into
six different modes of operation. Mode 1 has
the LDRI in a standby mode and is the default
mode upon activation. Mode 2 cycles the LDRI
laser on and off to act as an illuminator for the
ITVC. The human eye cannot see the laser, but
the electronics in the ITVC are sensitive enough
to pick up the IR and it make the scene look
brighter. In both modes 1 and 2, only ITVC
video can be seen. The LDRI camera video can
only be seen in modes 3 through 6. Mode 3 is a
2-D mode with the LDRI camera on, gamma
black stretch off, and the laser cycling on and
off but no modulation or phase shift, which
means no 3-D data and the scene is not
flickering as it does in modes 5 and 6. Mode 4
is the same as mode 3 but with gamma black
stretch on, so the darker regions of the scene are
brighter. Mode 5 is a 3-D mode with the LDRI
camera on, gamma black stretch off, and the
laser cycling on and off with modulation and
phase shift to provide 3-D data. The LDRI
scene appears to flicker in this mode. Mode 6 is
the same as mode 5 but with gamma black
stretch on, so the darker regions of the scene are
brighter.
The LDRI was designed to recognize commands
when a certain sequence of buttons is pushed.
For the crew to command to the LDRI, the
procedures in the LDRI/ITVC Cue Card in the
Photo/TV Checklist have them push the
MUX1L output PBI, then the MIDDECK PBI,
and then one of the six MENU or MODE PBIs.
Going from left to right on the MENU and
MODE PBIs are the six LDRI modes. The left
most MENU PBI is LDRI mode 1 and LDRI
mode 6 is the right most MODE PBI. When the
crew is commanding the LDRI, there is no
feedback on the MENU or MODE PBIs to let
them know what mode they are in, meaning the
MENU or MODE PBIs will not light up when a
LDRI mode is commanded. The LDRI mode
telemetry is in the LDRI video, which is coming
through the CCTV system via the PL2 input.
The crew will only see what LDRI mode they
are in on the MENU or MODE PBIs when they
push the output PBI that is assigned to PL2
input and LDRI video is being routed (which
are modes 3 through 6). In modes 1 and 2 the

MENU and MODE PBIs would show the ITVC

settings such as ALC AVG. When the crew has
the MUX1L and the MIDDECK PBIs pushed,
the only commands to the LDRI are the six
different modes and the iris open or close
commands via the IRIS switch, which provides
gain control for the LDRI in mode 3 through 6
to make the scene look brighter or darker.
When viewing the LDRI video on the monitor
and L-Data is on, the monitor shows T stop
values between 70 and 280. Default is 280,
which is the darkest and 70 is the brightest. If
the gain is changed from the default while in
modes 3 through 6, the gain will remain
unchanged when switching to other modes,
except when going back to mode 1, where it will
default back to 280. There are times when the
crew will be commanding the boom ITVC in the
blind when the LDRI is in modes 3 through 6 and
the video output PBI is pushed that is assigned to
the PL2 input PBI. In this scenario, the crew is
viewing LDRI video but any MENU or MODE
PBIs pushed or IRIS switch changes are going to
the ITVC in the blind because the crew cannot see
the changes since they are viewing the LDRI
video. If pan or tilt adjustments are made, the
crew would see the pan and tilt numbers change
on the monitor with even though LDRI video is
displayed because the LDRI is attached to the
bottom of the ITVC and the pan and tilt data is in
the LDRI video as well. To prevent the ITVC
from being commanded to an unwanted mode
and possibly incurring damage, it is
recommended pan and tilt adjustments be made
when in the ITVC viewing mode.
The
LDRI/ITVC pan range is +9.8 to -170. The tilt
range is +175 to -125.
There are three different modes of operation for
the LCS: quickview, detailed scan, and line scan.
The quickview is used so the crew can visually
verify in 10 to 30 seconds the scene has the
correct field of view by seeing a low resolution
scanned image. The detailed scan produces a
high resolution 3-D image.
The ground
processes the data to produce the 3-D models.
The scan is in a rectangular pattern and is used
for stop and stare operations. The line scan is
used when the RMS is providing continuous
motion and it is scanning in one direction. This
mode produces 3-D images but can also be used
to supplement 2-D images.

2.3-20

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A

CCTV System Summary

The CCTV system is used on orbit to support
payload and orbiter activities by using realtime and recorded video.
The CCTV system is composed of CCTV
cameras, pan/tilt units, color monitors,
camcorders, video tape recorders, video
processing equipment, and accessories.
All CCTV functions can be controlled by the
crew.
Most CCTV functions can be
configured by MCC via uplink commands.
Both crew and MCC can command all CCTV
camera functions.
CCTV equipment is powered from circuit
breakers located on panel R14.
Crews use panel A7U to control the CCTV
system.
The video control unit is the heart of the
CCTV system and is the central processor.
The VCU is composed of the remote control
unit and the video switching unit.
The CTVC provides NTSC color video. In
addition to CCTV camera data, CTVCs also
provide lens data.
The ITVC generates black and white video.
This CCTV camera is designed to operate in
a low-light environment.
Two 10-inch color monitors display video
onboard. The monitors are located on panel
A3 and provide connectors for VTRs to use
for recording. The monitors are configured
via a display menu system.

2.3-21

2. SYSTEMS
2.3 Closed Circuit Television (CCTV)

USA007587
Rev. A

This page intentionally left blank

2.3-22

2. SYSTEMS
2.3 CLOSED CIRCUIT TELEVISION (CCTV)

USA007587
Rev. A

2.4

the ground to the orbiter are referred to as

uplinks (UL), and signals from the orbiter to the
ground are called downlinks (DL).

COMMUNICATIONS

CONTENTS
Description.............................................
S-Band Phase Modulation....................
S-Band Frequency Modulation ...........
Ku-Band System....................................
Payload Communication System........
Ultrahigh Frequency System ...............
Audio Distribution System ..................
Instrumentation.....................................
Communications System Summary ...
Communications System Rules
of Thumb .....................................

TDRS communication takes place through the

White Sands Ground Terminal (WSGT) and
Second TDRS Ground Terminal (STGT). These
indirect signals from the TDRS to the orbiter are
referred to as forward links (FL), and the signal
from the orbiter to the TDRS is called the return
link (RL). Communication with a detached
payload from the orbiter is also referred to as
forward link, and return link is the signal from
the payload to the orbiter.

2.4-1
2.4-2
2.4-10
2.4-13
2.4-21
2.4-23
2.4-27
2.4-38
2.4-42
2.4-49

Description
The orbiter communication system transfers the
following types of information:
Telemetry information to the ground
about orbiter operating conditions and
configurations, systems, and payloads
Commands from the ground to the
orbiter systems to perform a function or
configuration change
Documentation from the ground that is
printed out through an orbiter communications
adapter
and
laptop
networked printer
Voice communications among the flight
crew members and between the flight
crew and ground, ISS, and EMU
This information is transferred through
hardline and radio frequency (RF) links.
Hardline refers to wires that connect
communicating devices, and RF refers to radio
signals. RF communication takes place directly
with the ground sites or through a tracking and
data relay satellite (TDRS).
Direct communication for NASA missions takes
place through space flight tracking and data
network (STDN) ground stations. For military
missions, Air Force Satellite Control Facility
(AFSCF) remote tracking station sites, also
known as space-ground link system (SGLS)
ground stations, are used. Direct signals from

The orbiter communication system is divided

into several smaller systems: S-band phase
modulation
(PM),
S-band
frequency
modulation (FM), Ku-band, ultrahigh frequency
(UHF) simplex, space-to-space orbiter radio
(SSOR), payload communications, audio, and
closed-circuit television (CCTV). (CCTV is
discussed separately in Section 2.3.)
The S-band FM, S-band PM, Ku-band, and UHF
simplex systems are used to transfer
information between the orbiter and the
ground.
The SSOR is used to transfer
information between the orbiter and ISS/EMU.
The payload communication system is used to
transfer information between the orbiter and its
payloads through either hardline or RF links.
The audio system provides analog voice
between the orbiter comm station and
MCC/POCC on the ground. The CCTV system
is used to visually monitor and record activities.
The ground command interface logic (GCIL),
also referred to as the ground command
interface logic controller (GCILC), controls
selected functions of the S-band PM, S-band
FM, Ku-band, payload communication, and
CCTV systems. Each of these communications
systems has an associated CONTROL switch
with the positions PANEL and COMMAND.
When the switch is set to PANEL, the system
can be accessed by the crew using panel
switches.
When the switch is set to
COMMAND, control is by ground command
via GCIL. The locations and operations of these
switches are provided in the individual
communications systems discussions that
follow.

2.4-1

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
Telemetry channel: carries real-time
orbiter
and
payload
operational
telemetry data to ground.

All commands are sent to the orbiter from the

ground through S-band system uplink or Kuband system forward link and are routed to the
onboard GPC through the network signal
processor (NSP) and associated flight forward
(FF) multiplexor/demultiplexor (MDM). The
commands to reconfigure the GCIL controlled
communication systems are routed from the
GPC through the payload forward (PF) MDMs to
GCIL.
NSP 1
(2)

FF 1
(3)
MDM

GN&C
GPC

SM
GPC

PF 1
(2)
MDM

S-band
payload
panel
A1L

S-band
PM
panel
A1L

KU-band
panel
A1U

S-band
FM
panel
A1R

CCTV
panel
A7

Turnaround tone ranging channel: used

to determine slant range from a known
point to the orbiter.
Tones are
transmitted from the ground to the
orbiter where they are "turned around"
and transmitted back to ground from
the orbiter on a coherent RF carrier.
Slant range can be computed from net
total two-way phase delay of the major
tone for the "round trip."
Two-way Doppler tracking: used to aid
in tracking the orbiter. An RF carrier, of
precisely
known
frequency,
is
transmitted to the orbiter.

GCIL A (B)

Panel/
command

Panel/
command

Panel/
command

Panel/
command

Panel/
command

S-band
payload
system

S-band
payload
system

KU-band
system

S-band
FM
system

CCTV
system
usa007587_125r1.cvx

Ground Command Interface Logic

NOTE
Because of the large number of distinct
elements of the Communications system,
a separate Operations subsection is not
included. That information is provided
within the separate element discussions.

S-Band Phase Modulation

The S-band PM system provides
communication between the orbiter
ground, either directly or through
satellite. It provides communication
for five functions:

two-way
and the
a relay
channels

Command channel:
used to send
commands from ground to orbiter.
Voice channel(s): used for two-way
voice communications between ground
and orbiter.

2. SYSTEMS
2.4 Communications

A characteristic of RF signals in the S-band

range is that "line-of-sight" must exist between
transmitting and receiving antennas to permit
communications. With the availability of the
Tracking Data Relay Satellite System (TDRSS)
network, communications coverage can be
about 80 percent, excluding a communications
gap called the zone of exclusion (ZOE). In the
ZOE, the orbiter will not be in the line-of-sight
with either satellite. Geographically, the ZOE is
over the Indian Ocean region. During critical
phases, such as orbit docking or OMS-2/deorbit
burns, the ZOE can be covered by scheduling a
TDRS Z satellite, thus providing nearly 100
percent communication coverage with MCC for
these orbits. For some missions, vehicle attitude
constraints imposed by payload experiment or
station requirements may cause loss of comm
because line-of-sight is obstructed, causing a
loss of signal (LOS) or ratty comm conditions;
i.e., when TDRS is oriented off the nose or off
the tail of the orbiter.
For orbit operations, the TDRSS network
provides most of the comm relay between the
orbiter and MCC. The TDRSS network has nine
satellites supported by the WSGT and STGT
facilities. Typically, the satellites used for
operational support are located approximately
130 apart in geosynchronous orbit.
The
satellites are commonly referred to as east
and west, A and B, or, more correctly, by
their logitudinal locations, such as 47 and 171.

2.4-2

USA007587
Rev. A
Antennas

Hemi

Quad

Hemi (FM) section

Quad (PM) section

S-band antenna switch

UL/FL
&
DL/RL
(HI PWR MODE)
RF
S-band
UL/FL RF
pre amp
(dual)

UL/FL
&
DL/RL
RF
(LO
PWR
MODE)

DL/RL RF
S-band
XPNDR
1

S-band
pwr amp
(dual)

DL/RL
TLM. VCE

S-band
XPNDR
2

UL/FL CMDS. VCE

DL/RL TLM. VCE
UL/FL
CMDS.
VCE
&
DL/RL
TLM.
VCE

K-band
XMTR/RCVR
UL/FL
CMDS. VCE
K-band
signal
processor

NSP 1
DL/RL
TLM. VCE

OCA or CIU CH2

CMDS
TLM

TLM DATA

NSP 2

CH3
TLM

TLM DATA

PCMMU 1

UL/FL
&
DL/RL
ANLG
VCE

VCE, DATA

PCMMU 2

TLM
DATA

VCE, DATA

SSR 2

SSR 1
CMDS

MDM FF1

Recorded data to S-band

FM or K-band Sys
CMDS

GPC

MDM FF3

CMDS
MDM

MDM PF1

MDM PF2

CMDS
GCIL CMDS

GCIL
CMDS

Ku-band
CCTV
S-band PM
S-band FM
S-band PL

GCILC
(SEMI DUAL)

Panel controls

S-band PM GCIL
CMDS
ACCU
(Dual unit)

Comm Stations (CDR/Left,

PLT/Right, MA, PS,
Middeck, Middeck)

us a0 0 7587 12 6r4 .cv x

S-Band PM System Interfaces and Data Flow

2.4-3

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
S-Band Forward Link
The S-band forward link operates through the
STDN or TDRS. It is phase modulated on a
center carrier frequency of either 2,106.4 MHz
(secondary) or 2,041.9 MHz (primary). The two
frequencies would prevent interference when
another satellite or payload is in operation at
the same time and place. One user selects the
high frequency, and the other selects the low
frequency.
The forward link originates from Mission
Control through the NASA STDN ground
stations for ascent and entry, or through the
WSGT/STGT via the TDRS system for orbit
operations. The high data rate is 72 kilobits per
second (kbps), consisting of two air-to-ground
(A/G) voice channels at 32 kbps each and one
command channel at 8 kbps, two-way Doppler,
and two-way tone ranging. The low data rate
of 32 kbps (currently not nominally used)
consists of one A/G voice channel at 24 kbps
and one command channel of 8 kbps, two-way
Doppler, and two-way ranging. The two-way
ranging does not operate through the TDRS.

The S-band return link low data rate of 96 kbps

(currently not nominally used) consists of one
A/G voice channel at 32 kbps and one telemetry
link at 64 kbps, two-way Doppler, and two-way
ranging. As noted, the two-way Doppler and
two-way ranging are used in the same manner
as in the high-data-rate mode.
Department of Defense Links
The Department of Defense (DoD) S-band
forward link is phase modulated on a center
carrier frequency of either 1,831.8 MHz
(secondary) or 1,775.5 MHz (primary) from the
Air Force Satellite Control Facility (AFSCF)
through its own ground stations (SGLS ground
stations).
The DoD S-band return link is phase modulated
on a center carrier frequency of 2,287.5 MHz
(secondary) or 2,217.5 MHz (primary) through
the SGLS mode to the AFSCF ground stations,
and also does not operate through the TDRS.
The two S-band return link frequencies also
would prevent interference if two users were in
operation at the same time.

S-Band Return Link

S-Band PM Power Modes

The S-band return link operates through the

STDN or TDRS. It is phase modulated on a
center carrier frequency of 2,287.5 MHz
(secondary) or 2,217.5 MHz (primary). The two
frequencies prevent interference if two users are
operating at the same time and place.

S-band PM power modes may be selected by

the crew using the S-BAND PM MODE rotary
switch on panel A1L. (Usually this is configured by uplink command from MCC.)
Selectable modes are SGLS, STDN LO and HI,
and TDRS DATA and RNG (TDRS RNG is not
used). In high power modes (TDRS and STDN
HI), incoming (received) signals from a quadselected antenna are directed through a preamplifier before reaching the transponder. Outgoing (transmit) signals are routed through a
power amplifier and the preamplifier assembly
diplexer after leaving the transponder en route
to an antenna. In low power modes (STDN LO
and SGLS), incoming signals flow from the
antenna directly to the transponder, and outgoing signals go directly from the transponder
to the selected antenna without amplification.

The S-band PM return link can originate from

one of two redundant S-band PM transponders
aboard the orbiter. The link transmits the data
through the NASA STDN ground stations for
ascent or entry, or through the TDRS via the
WSGT/STGT to Mission Control for orbit
operations.
The high data rate of 192 kbps consists of two
A/G voice channels at 32 kbps each and one
telemetry link of 128 kbps, two-way Doppler,
and two-way ranging. The two-way Doppler
and two-way ranging are operative only when
in view of the NASA STDN ground stations at
ascent or entry. The two-way ranging does not
operate with the TDRS.

2. SYSTEMS
2.4 Communications

2.4-4

USA007587
Rev. A

Top
S-band PM
upper right
quadrant

S-band PM
upper left
quadrant
Upper left
antenna
looking forward

Bottom

S-BAND PM MODE Rotary Switch on

Panel A1L

S-band PM
lower left
quadrant

S-Band PM Antennas
Four quadrant S-band PM antennas covered
with a reusable thermal protection system are
located approximately 90 apart on the forward
fuselage outer skin of the orbiter. On the flight
deck viewed through the forward windows, the
quadrant antennas are to the upper right, lower
right, lower left, and upper left. These antennas
are the radiating elements for transmitting
the S-band PM return link and for receiving the
S-band PM forward link. Each quad antenna is
a dual-beam unit that can "look" forward or aft
for both transmission and reception without
any physical movement, effectively creating
eight antennas for the S-band PM system: LL F
(lower left forward), LL A (lower left aft), UL F
(upper left forward), UL A (upper left aft), UR F
(upper right forward), UR A (upper right aft),
LR F (lower right forward), and LR A (lower
right aft).
These antennas are selected by the antenna
switch electronics via GPC control, uplink
command, or manual crew selection using the
S-BAND PM ANTENNA rotary switch on panel
C3. When the switch is set to the GPC position,
antenna selection is nominally automatic by the
PASS SM or BFS GPC, but can be commanded
by real-time command from MCC. The antenna
switching commands are sent to the switch

S Band PM
lower right
quadrant
Lower right
antenna
looking aft
128.cvs

S-Band PM Antenna Locations

assembly through the PF MDMs. Antenna
selection is based on the computed line of sight
to the NASA STDN ground station, the AFSCF
ground station, or the TDRS in view, depending
on the orbiter communication mode.
The
current antenna selection and operating antenna
switch electronics is shown on the OPS 201
ANTENNA display. Also on the display are
related items such as the S-band ground station
in view, TDRS in line of sight, and whether GPC
antenna selection is enabled or inhibited.
GPC control can be inhibited to permit ground
to command an antenna other than the one
currently selected by the GPC. The ground
sends a command load to inhibit GPC control
and a real-time command (RTC) to select the
desired antenna. GPC control is restored by
sending a load to enable the GPC mode. The
crew can perform the same functions by

2.4-5

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

S-BAND PM System Switches on Panel C3

selecting the ANTENNA display, executing
Item 12 (GPC INH), and then selecting the
desired antenna by RTC via keyboard. Using
GPC OVRD (Item 13), the crew can force the
S-band antenna management software to the
TDRS mode. An asterisk will be displayed by
Item 13 while GPC override is in effect. To
restore GPC control, Item 11 (GPC ENA) is
executed.
Other S-band PM fields on the ANTENNA
display allow prime selection of a TDRS A or B,
Items 14 and 15, respectively. Designation of a
TDRS A or B is done by Items 1 through 6.These
items select the chosen TDRS as prime; if this
TDRS is not in view, it selects the other TDRS. If
both are in view, the prime is selected. No
change is made to TDRS antenna selection if
neither is in view. Similar logic holds true for
Ku-band system, Items 9 and 10.

COMMUNICATIONS Display
Preamplifiers
The dual S-band preamplifier is used in the
TDRS and STDN HI modes for amplification.
In TDRS mode, the preamplifier is required fulltime for the forward link radio frequency
because of the much greater distance and,
consequently, lower strength signal from the
TDRS to the orbiter geosynchronous orbit
(minimum of about 22,300 miles) than from the
STDN to the orbiter (typically, slant ranges are
in the low hundreds of miles). The preamplifier
is not used in the SGLS or STDN LO modes.
One of the two redundant units is used at a
time, and the output of either unit can be crossstrapped to feed either transponder.
The
preamplifier provides an RF gain of about 25
decibels.

OPS 201 ANTENNA Display

2. SYSTEMS
2.4 Communications

2.4-6

USA007587
Rev. A
The power amplifiers use a traveling wave tube,
which has a filament that must be warmed up
before high voltage is applied to the tube. A
140-second timer provides the delay when the
OPERATE mode is selected from a cold start.
With the system in STANDBY, the filament is
kept heated, ready for "instant on" operation.
The PWR AMPL STANDBY and OPERATE
switches are on panel A1L; these functions are
generally under ground control. If the S-BAND
PM CONTROL switch on panel C3 is set to
PANEL, the switches on panel A1L establish
power amplifier configuration.
NOTE
Both the PWR AMPL STANDBY and
OPERATE switches should be in the same
position to avoid a reset of the 140-second
timer when the backup system is selected.
The COMMUNICATIONS display, SPEC 76,
also shows power amplifier status (PWR AMPL:
OPER, STBY, PWR OUT, and TEMP).
S-BAND PM ANT SW ELEC, PRE AMPL,
PWR AMPL, and XPNDR Switches on Panel
A1L

Transponders

The PRE AMPL control switches are on panel

A1L; this function is generally under ground
command control.
If the S-BAND PM
CONTROL switch on panel C3 is set to PANEL,
preamp 1 or 2 is selected, depending on the
position of the S-BAND PM PRE AMPL switch
on panel A1L.
The COMMUNICATIONS
display (SPEC 76) under SM OPS 201 shows
preamp status and frequency configuration
(PREAMP and FREQ).
Power Amplifiers
The S-band power amplifiers provide
amplification of transponder RF output for
STDN HI and TDRS operational modes. The
nominal power gain is about 17 decibels. There
are two redundant power amplifiers; one is
used at a time, and the input of either can be
cross-strapped with the output of either
transponder.
The output of the power
amplifiers can also be routed through either
frequency diplexer in the preamp assembly.

The S-band PM transponders function as

multipurpose,
multimode
transmitter/
receivers. The transponder can simultaneously
transmit and receive, transmit only, or receive
only. There are two redundant transponders;
only one transponder operates at one time. The
selected transponder transfers the forward link
commands and voice to the network signal
processor and receives the return link telemetry
and voice from the network signal processor.
The transponders may be cross-strapped.
Transponder 1 or 2 may be used with network
signal processor 1 or 2. The radio frequency
sections of either transponder can be used with
either preamplifier and power amplifier 1 or 2.
The selected transponders provide a coherent
turnaround of the PM forward link and PM
return two-way Doppler and two-way tone
ranging signals. These two-way signals operate
when the orbiter is in view of a NASA STDN
ground stations at ascent, entry, or when it is in
view of SGLS mode ground stations. The twoway Doppler operates through the TDRS, but
the two-way ranging does not.

2.4-7

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
Two-way Doppler is used by ground stations to
track the orbiter. The S-band PM forward and
return links are directly proportional to the
forward link frequency (two-way Doppler).
The S-band transponder provides a coherent
turnaround of the forward link carrier
frequency necessary for the two-way Doppler
data. By measuring the forward link and using
return link frequencies expected from the
orbiter, the ground tracking station can measure
the double Doppler shift that takes place and
can calculate the radial velocity (range rate) of
the orbiter with respect to the ground station.
Because these links are PM, the S-band carrier
center frequency is not affected by the
modulating wave. It would be impossible to
obtain valid Doppler data of the S-band carrier
center frequency if it were affected by the
modulating technique.

indicator on panel A1U when the switch to the

left of the indicator is set to S-BAND PM.
Signal strength is also shown on the OPS 201
ANTENNA DISPLAY (SIG STR). During ascent
and entry, this display is not available.
NOTE
The panel AIU signal strength indication
comes directly from the operating S-Band
PM
Transponder.
Signal
strength
indications on the F9 meter are processed
first by DSC OF3 before being displayed.
The OPS 201 ANTENNA display signal
strength comes from OI MDM OF3 data.

The S-band transponder also provides a

subcarrier for two-way tone ranging. The
transponder is used to determine slant range
from a known point to the orbiter and operates
only when in view of a NASA STDN ground
stations during ascent, entry, or in view of SGLS
mode ground stations. This capability does not
operate through the TDRS. The ground station
forward-links ranging tones at 1.7 MHz and
computes vehicle slant range from the time
delay in receiving the return link 1.7-MHz tones
to determine the orbiter's range. The orbiter's
azimuth is determined from the ground station
antenna angles.
The S-BAND PM XPNDR switch is located on
panel A1L; this function is generally handled by
ground command via the GCIL. If the S-BAND
PM CONTROL switch on panel C3 is set to
PANEL, the XPNDR selection is made from
panel A1L.
The orbit COMMUNICATIONS display, SPEC
76, gives transponder status (XPNDR and
MODE). The OPS 201 ANTENNA display also
shows the mode for the active transponder.
Received S-band PM RF signal strength is
shown on the DC AMPS/SIG STR meter on
panel F9 when the rotary switch below the
meter is set to one of six SIGNAL STRENGTH
positions, and on the SIGNAL STRENGTH

2. SYSTEMS
2.4 Communications

2.4-8

DCAMPS/SIG STR Meter and Rotary Switch

on Panel F9

USA007587
Rev. A
from the S-band transponder and outputs it as
either one or two analog voice signals to the
audio central control unit. The composite
forward link also has ground commands that
the NSP decodes and sends through the FF
MDMs (NSP 1 to FF 1 or NSP 2 to FF 3) to the
onboard computers, which route the commands
to the intended onboard systems. The NSP data
routing/ processing modes are controlled by
command or the NETWORK SIG PROC
switches on panel A1L. The NSP also routes
return link (telemetry and voice) and receive
forward link (commands and voice) via the Kuband system.
SIGNAL STRENGTH Indicator and Switch on
Panel A1U
Network Signal Processors
One of two redundant onboard network signal
processors (NSPs) receive commands (forward
link) and transmit telemetry data (return link)
to the selected S-band transponder. The active
processor receives one or two analog voice
channels from the onboard audio central control
unit (ACCU), depending on whether one (in the
low-data-rate mode) or both (in the high-datarate mode) of the A/G channels are being used.
Nominally, the HDR mode is used. Both voice
channels are downlinked only if the NSP is high
data rate on both forward and return links. It
converts them to digital voice signals, timedivision-multiplexes them with the telemetry
from the pulse code modulation master unit, and
sends the composite signal to the S-band PM
transponder for transmission on the return link.
On the forward S-band PM link, the NSP does
just the reverse. It receives the composite signal

Communications Security
Communications security (COMSEC) equipment provides the capability for encryption/
decryption of operational data aboard the
orbiter. The COMSEC equipment works with
the NSPs to provide selectable transmit, receive,
and record combinations under NSP mode
control.
The NSP routes data of the indicated type
through the COMSEC encryptor or decryptor as
appropriate and gets the data back from the
COMSEC line-replaceable unit encrypted or
decrypted; if "BYP," the indicated data are
handled directly by the NSP, and the COMSEC
is bypassed.
The three ENCRYPTION switches on panel A1L
provide power and routing control for
encrypted data through the NSP. Our current
operational mode is to use the COMSEC in the
SELECT/RCV mode - only the uplink (voice
and commands) is encrypted.

NSP ENCRYPTION Switch MODES

Link function
Recorded Data Encrypted*
Transmitted Data Encrypted
Received Data Encrypted

ALL
(DOD)

SELECT
(NASA)

T/R

Recorded Data Clear (unencrypted) **

Transmitted Data Encrypted
Received Data Encrypted

RCV

Recorded Data Clear (unencrypted) **

Transmitted Data Clear (unencrypted)
Received Data Encrypted

BYPASS

Recorded Data Clear (unencrypted) **

Transmitted Data Clear (unencrypted)
Received Data Clear (unencrypted)

* Data rate determined by NSP downlink DTA RATE switch.

** HDR only.

2.4-9

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
The
crew
can
perform
S-band
PM
communications system reconfiguration (TDRS,
STDN HI, STDN LO, or SGLS) by a single item
entry on BFS GNC OVERRIDE display (SPEC
51). The COMM status will show LOCK (if NSP
is locked) and NOLK (if NSP is not locked),
based on the status from the pulse code modulation master unit (PCMMU).
LOCK will
depend on the active NSP FRAME SYNC lock.
For Items 46-49, an asterisk * will show when
telemetry conditions for TDRS, STDN HI, STDN
LO, or SGLS, respectively, are met. No more
than one asterisk will be displayed at one time.
If data are not available from the PCMMU, all
asterisks will be blanked.
XXXX/051/
ABORT MODE
TAL
ATO
ABORT
MAX THROT

be selected either by panel switches or GCIL,

depending on whether the CONTROL switch is
set to COMMAND or PANEL. Set to PANEL,
the switches allow rotary switch selection of the
DATA SOURCE, and FM Power 1, Off, or 2.

OVERRIDE

XXX DDD/HH/MM/SS
BFS DDD/HH/MM/SS
ENTRY FCS
ELEVON
FILTER
ATMOSPHERE
AUTO 17X
NOM 20X
NOM
22X
FIXED 18X
ALT 21X
N POLE 23X
SSME REPOS 19 XXX
S POLE 24X

1X
2X
3X
4X

PROPLT DUMP

IMU
1
XXXX 2
3

XXX ICNCT 5
OMS DUMP
ARM
6X
START 7X
STOP
8X
9 QUAN/SIDE XXX
OMS DUMP TTG XXX
AFT RCS 13
14 TIME

XXX
XXX

FWD RCS 15
16 TIME

XXX
XXX

DES ATT
25X
X
26X
27X

AA
RGA SURF
LRU DES
DES DES
1 31X
35X 39X
2 32X
36X 40X
3 33X
37X 41X
ET SEP
4 34X
38X 42X
AUTO 28X
SEP
29X
ROLL MODE
WRAP MODE 45 XXX
ET UMB DR
CLOSE 30
COMM
XXXX
TDRS
46X
VENT DOOR CNTL
STDN-HI 47X
OPEN
43X XX
STDN-LO 48X
CLOSE 44X XX
SGLS
49X

usa007587_136

S-BAND FM Switches on Panel A1R

usa007587_1098r1.cvx

OVERRIDE Display

The FM signal processor is commanded to select

one of seven sources for output to the S-band
FM transmitter, which transmits it to the S-band
FM return link through the STDN ground
station or the DOD AFSCF ground station. The
S-band FM return link transfers one of the
following:

S-Band Frequency Modulation

The S-band FM system cannot receive
information; it is used to downlink data from
up to seven different sources, one at a time,
directly to the ground when there is a line of
sight between the orbiter and STDN or Air
Force ground stations. The S-band FM return
link can originate from one of two redundant Sband FM transmitters aboard the orbiter. Both
transmitters are tuned to 2,250 MHz. The Sband FM return link can be transmitted
simultaneously with the S-band PM return link
to a STDN ground station or to an Air Force
ground station. The S-band FM return link does
not operate through the TDRS system.
Crew controls for the S-band FM system are on
panel A1R. Status and configuration control of
the S-band FM system electronic elements can
2. SYSTEMS
2.4 Communications

2.4-10

Real-time SSME data from the engine

interface units during launch at 60 kbps
each (ME)
Real-time video (TV)
Solid State Recorder (part of the Mass
Memory Units) dumps of high- or lowdata-rate telemetry at 1,024 kbps (MMU
1 or MMU 2)
Payload analog at 300 hertz or 4 MHz
(PL ANLG)
Payload digital data at 200 bps or 5
Mbps (PL DIGITAL)
DOD data at 16 kbps or 256 kbps in real
time or 128 kbps or 1,024 kbps of
playback (DOD)

USA007587
Rev. A
Only one of the two FM signal processors is
used at a time. FM signal processor 1 interfaces
with FM transmitter 1, and FM signal processor
2 interfaces with FM transmitter 2. The transmitters and processors cannot be crossstrapped.
S-band FM is currently used primarily for
transmitting ME data during ascent and
MMU1/2 data recorder dumps during orbit
operations.

The basic difference between the quadrant and

hemispherical antennas is that the hemispherical antennas have a larger beamwidth, whereas
the quadrant antennas have a higher antenna
gain. The hemispherical antennas are so named
because there are two of them, one on the top of
the orbiter and one on the bottom.

Top

S-Band FM Antennas
Two hemispherical S-band FM antennas
covered with a reusable thermal protection
system are located on the forward fuselage
outer skin of the orbiter approximately 180
apart. On the flight deck, the hemispherical
antennas are above the head (upper) and below
the feet (lower) and radiate the S-band FM
return link.
The S-band antenna switch assembly provides
the signal switching among the two S-band FM
transmitters and either of the two hemispherical
antennas.
The proper antenna is selected
automatically by onboard or real-time
command from the ground, computer control,
or manual flight crew selection using the SBAND FM XMTR UPPER, RCVR LOWER
switch on panel A1R. In the GPC mode, the
onboard SM computer selects the proper
hemispherical antenna to be used whenever an
S-band FM transmitter is active. The antenna
selection is based on the computed line of sight
to the NASA STDN ground or the AFSCF
ground stations.

2.4-11

Bottom

1 28 .cn v

S-Band FM Antenna Locations

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
FM RF
to GND
ME data

S-band
PM RF
switch

TV
DIG PL

FM
signal
processor 1

ANLG PL

FM
XMTR
1

Upper
HEMI

MMU1PB
MMU2PB
FMSP data
source selector

S-BD FM
RF XFER
switch

RF

ME data

RF

S-band
FM RF
switch

RF

TV
DIG PL

MMU1PB
MMU2PB

ME
PB
GND

Lower
HEMI

FM
XTR
2

FM
signal
processor 2

ANLG PL

main engine
playback from recorder
ground

FM RF
to GND
Interchangeable
Active RF path

Inactive RF path
usa007587_138r1.cvx

S-Band FM System Block Diagram

High
gain
antenna

Deployed assembly
Antenna
Deployed mechanical assembly (DMA)
Deployed electronics assembly (DEA)

PL 1
MDMs

ANT CNTL, MODE CNTL

PL INTRG (Bent pipe)

Selectable PLMAX (DTV)
TV (Analog TV)
CH 2 & CH 3 Data data
PL Analog
sources
PL Digital (OCA)
MMU1
TLM/VCE
MMU2
NSP

DEA

RF

DMA

D
P
L
X
R

RF XMTR

RL DATA

DEA
RF

RCVR

CMDS/VCE

K-band
Signal
Processor
DATA

OCA
PGSC

EA1

SERVO

COMM
PROC

FL DATA

Interface
& config
CMDS

Electronics assembly 1 (EA 1)

PNL
CMDS

GCIL
usa007587_139r1.cvx

Ku-Band Communications System

2. SYSTEMS
2.4 Communications

2.4-12

USA007587
Rev. A

Ku-Band System
The Ku-band system operates between 15,250
MHz and 17,250 MHz. The Ku-band carrier
frequencies are 13,755 GHz from the TDRS to
the orbiter and 15,003 GHz from the orbiter to
the TDRS. The Ku-band antenna is located in
the payload bay. After the payload bay doors
are opened, the Ku-band antenna is deployed.
Once the antenna is deployed, the system can be
used to transmit information to and receive
information from the ground through the
TDRS. The Ku-band antenna can also be used
as a radar system for target tracking objects in
space, but it cannot be used simultaneously for
Ku-band communications and radar operations.
When the Ku-band antenna is deployed and
activated in the communications mode, the NSP
directs the return link data stream to both the
Ku-band signal processor and the S-band PM
transponder. The return link data stream is
transmitted through both the Ku-band and Sband PM antennas to the TDRS in view, via the
TDRS systems, to Mission Control.
The NSP accepts the forward link from the Kuband signal processor and the S-band PM
transponder; however, the NSP processes only
one of these signals. The source of the forward
link selected for processing depends on whether
S-band or Ku-band has been selected through
GCIL by the ground or by the NSP UPLINK
DATA switch on panel A1L. It is possible to
transmit the downlink through the Ku-band
and receive the forward link through the Sband, and vice versa.
The SM software can automatically switch NSP
uplink configuration to support either Ku-band
or S-band PM. The SM COMMUNICATIONS
display (SPEC 76) shows an AUTO K TO S and
AUTO S TO K status; the status fields will show
Enable (ENA) or Inhibit (INH), based on uplink
command configuration for these functions. If
both are enabled and the correct conditions are
met in the Ku-band system (good forward link),
the AUTO S TO K commands through the GCIL
to configure the NSP for TDRS Ku. If the Kuband forward link is subsequently lost, or
failures in the Ku-band uplink occur when

using Ku-band forward link, the AUTO K TO S

function switches the NSP back to a TDRS
S-band PM uplink configuration. The Fail
Safe function, shown on SPEC 76, is no longer
used.
The Ku-band system can handle more data than
the S-band systems. In either of two uplink
communications modes, it transmits three
channels of data, one of which is the same
interleaved voice and telemetry processed by
the S-band PM system. The possible sources of
information sent on the other two channels are
selectable by two KU SIG PROC rotary switches
on panel A1U, one for HIGH DATA RATE and
one for LOW DATA RATE (or by ground
commands).
Mode 1 return link consists of three channels.
Channel 1 consists of 192 kbps of operational
data (128 kbps of GPC downlist, OI and
payload telemetry plus two 32 kbps A/G voice
links). Channel 2 consists of a 2 Mbps low data
rate source selectable by the crew or by MCC.
The source for channel 2 can be one of the
following:
Payload interrogator
Attached payload digital (OCA)
MMU 1 or MMU 2 SSR
Channel 3 consists of 50Mbps high data rate PL
MAX data (attached payload digital data,
currently DTV real-time or playback video).
Mode 2 return link also consists of three
channels, but differs from Mode 1 by the data
source selectable for Channel 3. In Mode 2,
Channel 3 consists of a 4 Mbps high data rate
source selectable by the crew or by MCC. The
source for Mode 2 Channel 3 can be one of the
following:

2.4-13

Payload interrogator
Attached payload analog
Attached payload digital (OCA)
Real-time CCTV video downlink

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

Ku-Band Antenna Non-Coverage Zones

Ku-Band Deployed Assembly Location

2. SYSTEMS
2.4 Communications

2.4-14

USA007587
Rev. A

usa007587_142

KU-BAND Controls on Panel A1L

The three channels of data are sent to the Kuband signal processor to be interleaved with the
return link. This signal then goes to the
deployed electronics assembly, which contains
the transmitter, to be transmitted to the TDRS
through the Ku-band antenna.

routed from the deployed electronics assembly

to EA2, the radar signal processor. The signal is
processed to provide target angle, angle rate,
range, and range rate information. This status
information is then routed to EA1 to be used for
target tracking.

The Ku-band system forward link Mode 1

consists of 72-kbps data (two A/G voice
streams at 32 kbps each and 8 kbps of
command),
128-kbps
for
orbiter
communications adapter (OCA) uplink, and 16kbps synchronization. Mode 2 consists of only
the 72-kbps operational data (two A/G voice
streams at 32 kbps each and 8 kbps of
command).

Ku-Band Deployed Assembly

Three Ku-band modes of operation can be

selected by the MODE switch on panel A1U. In
the COMM mode, incoming signals go through
an internal electronics assembly (EA1) to the
Ku-band signal processor, which processes and
routes Ku-band communications data. Voice
and commands are sent to the network signal
processor. A separate output from the Ku-band
signal processor can be directed to the OCA for
PGSC computer file uplinks. In the RDR COOP
and RDR PASSIVE modes, incoming signals are

The Ku-band deployed assembly provides the

interface with the TDRS when there is a line of
sight between the orbiter and TDRS. The
assembly is mounted on the starboard sill
longeron in the payload bay. The deployed
assembly consists of a two-axis, gimbalmounted, high-gain antenna, an integral gyro
assembly, and a radio frequency electronics
box. The gimbal motors position the Ku-band
antenna, and rate sensors determine how fast
the antenna is moving. The Ku-band deployed
antenna assembly is 7 feet long and 1 foot wide
when stowed in the payload bay. The graphite
epoxy parabolic antenna dish is 3 feet in
diameter. The deployed antenna assembly
weighs 180 pounds. The weight of the entire
system is 304 pounds.

2.4-15

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

Ku-Band Deployed Assembly

VPU

u sa 0 0 7 5 8 7 _ 1 44

KU-Band Circuit Breakers on Panel R14

The antenna dish is edge-mounted on a twoaxis gimbal. The alpha gimbal provides a 360degree roll movement around the pole or axis of
the gimbal. The beta gimbal provides a 162degree pitch movement around its axis. The
alpha gimbal has a stop at the lower part of its
movement to prevent wraparound of the beta
gimbal control cable. Since the beta gimbal has
only a 162-degree movement, there is a 4-degree
diameter non-coverage zone outboard around
the pole and a 32-degree diameter non-coverage
zone toward the payload bay.
The antenna can be steered in several selectable
modes under manual control by the flight crew
using panel A1U or automatically by the SM
software. The KU BAND CONTROL switch on
2. SYSTEMS
2.4 Communications

panel A1U selects COMMAND (control by

GCIL or keyboard commands) or PANEL (crew
control by panel switches and selectors). With
the switch in PANEL, the antenna steering
mode can be selected using the rotary switch on
the left side of the panel. The switch positions
are GPC (GPC pointing and auto track), GPC
DESIG (GPC pointing only), AUTO TRACK
(manual pointing and auto track), and MAN
SLEW (manual pointing only).
At times, the Ku-band system, in view of a
TDRS, is interrupted because the orbiter blocks
the Ku-band antenna's view to the TDRS or
because orbiter attitude requirements or
payloads or ISS radiation sensitivities prohibit
its use.

2.4-16

USA007587
Rev. A
When the Ku transmitter is enabled and capable
of outputting, but the MCC through ground
commands has inhibited the RF carrier for flightspecific reasons, the control of this RF carrier
radiation is called Ku antenna masking. These
masking modes are used to provide protection
from Ku radiation for payloads, EVAs, and ISS.
The types of masking, commandable from the
ground, include: 1) inhibiting the Ku transmitter
when a specified beta gimbal angle is exceeded
(beta MASK) or when both a specified beta
gimbal angle and the orbiter hardware
obscuration zone are exceeded (beta + MASK), 2)
inhibiting the Ku-band transmitter in a specified
EVA protection zone, defined by certain
elevation and azimuth angles of the antenna
relative to the orbiter's X, Y, and Z axes. Ku
software also modes the Ku system to standby
mode, if the antenna remains near the beta stops
for a certain period of time, to prevent excessive
antenna gimballing.
None of these masking modes is readily evident
to the crew unless they monitor RF out power on
SM SPEC 76.
Only the orbiter hardware
obscuration zone is shown on the SM
ANTENNA display (see ANTENNA display on
page 2.4-6).
Ku-Band Antenna Deployment and Stowage
When the shuttle reaches orbit, before the
Ku-band antenna is deployed, the KU ANT
HTR circuit breaker on panel R14 is closed to
energize thermostatically controlled heaters for
the deployed electronics assembly, gimbals, and
antenna assembly. During Ku-band activation,
the KU ELEC and KU SIG PROC circuit
breakers on panel R14 are closed. (There is also
a CABLE HTR circuit breaker on panel R14.
The Ku-band system was originally designed to
have a cable heater, but it was never installed.
Therefore, this circuit breaker is always open.)
These circuit breakers provide electrical power
to the Ku-band electronic elements, electronics
assemblies 1 and 2, the signal processor
assembly, and Ku-band portions of panels A1U
and A2. Actual deployment involves the KU
ANTENNA controls and associated talkbacks
on panel R13L. The antenna is locked in the
stowed position to clear the adjacent payload

bay doors and radiators when they are closed or

moving.
It normally takes 23 seconds to deploy or stow
the assembly. In the deployed position, the
assembly forms a 67-degree angle with the
orbiter X axis. Activating the Ku electronics and
taking the KU BAND POWER switch on panel
A1U to ON frees the antenna gimbals by
removing the gimbal locking pins.
The
beginning of stow operations contains
approximately 30 seconds of gimbal lock
sequencing before assembly stow begins.
The Ku-band antenna must be stowed before
the payload bay doors are closed in preparation
for entry. This is done by setting the KU
ANTENNA three-position switch on panel
R13L to the STOW position. If the assembly
does not respond to normal stow operations,
the KU ANTENNA DIRECT STOW switch on
panel R13L is used. Setting this switch to ON
bypasses the normal stow control sequences
and causes the assembly to be driven inside the
payload bay. The KU ANTENNA DIRECT
STOW switch procedure is only used if locking
the alpha and beta antenna gimbals is
successful in their stow position, because entry
with antenna gimbals unlocked may cause
unacceptable damage. DIRECT STOW merely
positions the entire deployed assembly inside the
payload bay and does not affect gimbal locking.
If neither the normal stow nor the DIRECT
STOW can position the assembly inside the
payload bay, the assembly can be jettisoned. To
jettison the deployed assembly, the crew closes
the MN A and MN C PYRO JETT SYS A and
SYS B KU ANT circuit breakers on panel ML86B
to provide redundant jettison power. The crew
then activates the PYRO KU ANT ARM and
JETT switches on panel A14, which causes a
guillotine to cut the cables to the deployed
assembly and releases a clamp holding it to the
pivot assembly.
The separation point is
between the assembly and deployment
mechanism about 20 inches above the sill
longeron. No ejective force is imparted; the
assembly is merely cut loose, and the orbiter
maneuvers away from it. The jettison operation
takes about 4 seconds.

2.4-17

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

KU ANTENNA Switches and Talkback on Panel R13L

PYRO JETT KU Circuit Breakers on Panel ML86B

KU ANT Switches on Panel A14

2. SYSTEMS
2.4 Communications

2.4-18

USA007587
Rev. A
target or cooperative target transmitter that is
triggered by the radar-initiated pulse. The
latter provides a longer range capability.

Ku-Band Antenna Jettison Separation

Ku-Band Rendezvous Radar
The orbiter Ku-band system includes a
rendezvous radar that skin-tracks satellites or
payloads in orbit. For large payloads that must
be carried into orbit one section at a time, the
orbiter will rendezvous with the payload
segment currently in orbit to add on the next
section. The gimballing of the Ku-band antenna
permits it to conduct a radar search for space
hardware. The Ku-band system is first given
the general location of the hardware by the
orbiter computer; then the antenna makes a
spiral scan of the area to pinpoint the target (in
GPC mode).
Radar may also be used to search for space
hardware using a wide spiral scan of up to 60.
Objects may be detected by reflecting the radar
beam off the surface of the target (RDR
PASSIVE MODE) or by using the radar to
trigger a transponder beacon on the target (RDR
COOP MODE). These modes are selectable
using the KU BAND MODE switch on panel
A1U. To date, only RDR PASSIVE MODE has
been used.
During a rendezvous operation, the radar
system is used as a sensor that provides target
angle, angle rate, and range rate information for
updating the rendezvous navigation data in the
GNC computer. The operation is similar to
using the crew optical alignment sight or star
trackers, except that the radar provides range
data in addition to angle data. Angle tracking
maintains appropriate antenna pointing to keep
the target within the antenna beam. Range
tracking is accomplished by electronically measuring the time between a transmitted pulse and
a return pulse from the target. The return pulse
may be reflected from a passive (skin-tracked)

Angle tracking can be accomplished in two

ways: computer or manual designations or
automatic (auto) servo. During manual or
computer-designated tracking, the antenna
beam angle is positioned by services external to
the Ku-band system. Computer tracking (used
in GPC and GPC DESIG modes) provides
designated angle data based on combined target
and orbiter state vector information. Manual
tracking (used in MAN SLEW and AUTO
TRACK modes) applies manually initiated rates
to the antenna control system from switches at
the orbiter aft flight deck station (A1U).
Automatic angle tracking applies error rates to
the antenna control system from a receiving
station that measures the target position relative
to the antenna beam center. This closed-loop
servosystem, internal to the Ku-band system,
ignores external computer or manual designations. It is the only angle tracking mode that
provides angle data for updating navigation
data.
Range tracking is always automatic, although
computer-designated ranges are applied to the
Ku-band system until automatic tracking is
achieved. In the automatic tracking mode, the
Ku-band system provides actual antenna angle,
angle rate, range, and range rate data through
an MDM for rendezvous and proximity operations. Data routed to the indicators on panel A2
represent hard-wired azimuth, elevation, range,
and range rate information, which is not
processed by the GPCs.
Before any radar mode is used, the orbiter is
normally maneuvered to an attitude with the
minus Z axis pointing at the target location. In
all modes, therefore, the radar antenna is normally maneuvered around the minus Z axis.
The Ku-band system provides for antenna
steering modes, each with a different combination of capabilities for acquiring and tracking a
target: GPC, GPC DESIG, AUTO TRACK, and
MAN SLEW. All are mutually exclusive and
crew selectable using the rotary switch on panel
A1U.

2.4-19

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
The GPC mode is fully automatic in all phases
of target acquisition.
Two DPS display
commands are required before this mode can be
initiated (GNC SPEC 33, REL NAV DISP). One
command enables target position data to be
routed from the GNC to the SM antenna
management program through the intercomputer data bus (GNC SPEC 33, REL NAV DISP,
item 1). The antenna management program
converts the target position to antenna pointing
angles and estimated orbiter-to-target range
data. Another command enables the antenna
management program to send designated
antenna pointing and range data to the Ku-band
system through the payload 1 data bus and the
payload forward 1 MDM (GNC SPEC 33,
item 2).
When the GPC mode is selected, the antenna
points to the commanded angles and adjusts the
ranging system to the specified range. If a
receive signal is detected, the automatic closedloop system tracks the target in angles and
range and provides data for the SM and GNC
computers and panel displays. If the target is
not detected, the antenna is automatically
commanded to search around the designated
point.
The antenna is inertially stabilized
during the search operation.
The GPC DESIG mode provides the same
designated pointing as the GPC mode without
angle search or angle-tracking capabilities. No
closed-loop angle tracking is provided. The
designated angles are updated every 2 seconds.
Range search and tracking are automatic. The
antenna may be either inertially or body
stabilized.
The AUTO TRACK mode begins with manual
antenna control, including a manually initiated
search and inertial stabilization during the
target acquisition phase. Once the target is
detected, automatic angle and range tracking is
initiated and manual control is inhibited until
auto tracking is broken.
The MAN SLEW mode allows manual control of
antenna movement with maximum automatic
range search. Once the target is detected, an
automatic range track is initiated, but angles are
still under manual control. No angle search is
available in this mode.

2. SYSTEMS
2.4 Communications

The SEARCH mode, selected by a switch on

panel A1U, involves a programmed antenna
movement that causes the radar beam to
describe a spiral pattern starting at the
designated angles. The beam angle spirals out
to a maximum of 30 from the designated angle.
In the GPC steering mode, the variation of the
maximum angle of search from the designated
point is inversely proportional to designated
range. The smallest search spirals outward to a
maximum of 6.2 from the designated point for
ranges from 145 to 300 nautical miles (n. mi).
At minimum ranges (0 to 8 n. mi.), the spiral
search is the maximum 30 from the designated
point. If the antenna drive system detects but
overshoots the target during a spiral search, a
miniscan program is automatically initiated
near the point of detection. The miniscan
searches to a maximum of 9 from the starting
point in 1 minute. In the auto track steering
mode, only the manually initiated main 30degree scan is available.
In addition to angle search, the Ku-band system
provides a range search. The process includes
electronically varying the timing within the
range system until it coincides with the time
interval between the transmitted and received
radar pulses. Once the intervals coincide, radar
tracking is established, and the range data
output represents the range between the target
and the orbiter. The crew can read the range
and range rate values as panel and DPS display
parameters.
The crew is provided with two controls associated with range. Transmitter power output is
automatically varied in proportion to range
when a target is being tracked to keep the
return signal relatively constant, regardless of
range. If, however, the track is lost, and the
range system begins to search, the transmitter
may transmit maximum power during the
search. The crew can limit the maximum
transmitter power by using an aft station panel
control. The other control is a DPS command
that limits the range search in GPC steering
mode to 2,400 feet.
The Ku-band system has body and inertial
antenna stabilization modes. When the body is
stabilized, the antenna beam remains in a fixed
relationship to the orbiter X, Y, and Z axes
during orbiter attitude changes. When the

2.4-20

USA007587
Rev. A
system is inertially stabilized, the antenna beam
remains aligned to a point in inertial space,
regardless of the orbiter attitude changes. Both
of these modes are effective only when the
radar angle-tracking system is not tracking a
target. In the target angle-tracking mode, the
system aligns the antenna beam to the target,
and antenna movement is independent of
orbiter attitude changes.

display on various payload-related controls and

displays. Then it is routed to the active NSP to be
combined with voice and sent to MCC and POCCs,
local to Johnson Space Center or around the world.

Each antenna steering mode, except the

designate mode, has a specific stabilization
mode. The designate mode selects either body
or inertial stabilization on the basis of a realtime GPC command (not available to the crew).
Since the designate mode provides range
tracking only, inertial stabilization is effective
during target tracking.
The SM COMMUNICATIONS display, SPEC
76, provides the status of Ku-band temperatures
(PA, GMBL, GYRO), power out (in watts),
frame sync, and mode (COMM or RDR), to
flight crews.

Payload Communication System

The payload communication system is used to

transfer information between the orbiter and its
payload(s). It supports hardline and radio frequency
communications with a variety of payloads. The
system is used to activate, check out, and deactivate
attached and detached payloads.
Communication with an attached payload takes place
through the payload patch panel at the crew
compartment flight deck aft station, which is
connected to payloads in the payload bay. All
command and telemetry signals that meet the
payload communication system specifications can be
processed onboard. Incompatible signals can be sent
to the ground through Ku-band or directly to
payload ground stations.
This method of
transmission, referred to as bent-pipe telemetry,
means that no onboard signal processing occurs
before the telemetry is sent to the Ku-band system.
Payload telemetry can be directly transmitted to the
ground through the S-band FM or Ku-band systems
via the payload interrogator, payload analog, or
payload digital source selects or it can be combined
with other payload data in the payload data
interleaver (PDI).
The PDI provides payload
telemetry to the pulse code modulation master unit
(PCMMU), where the data can be accessed for

S-BAND PAYLOAD Switches on Panel A1L

The S-band payload antenna is located on the
top of the outer skin of the orbiter's forward
fuselage, just aft of the S-band FM upper
hemispherical antenna. The payload antenna is
covered with reusable thermal protection
system. This antenna is used as the radiating
element for S-band payload transmission and
reception to and from the orbiter to detached
payloads, such as the Hubble Space Telescope
(HST).
Communication problems involving antenna
position relative to payload position are not
evident while the payload is within a half mile
of the orbiter, along the minus Z axis.
However, to maintain good communication
with the orbiter from distances of several miles,
the payload must be within an 80-degree
beamwidth (with reference to the minus Z axis)
of the orbiter's payload interrogator antenna.
The boundary of the 80-degree beamwidth is
the 3-decibel point (or half-power point), which
must be considered during communication with

2.4-21

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
deployed payloads. This constraint is normally
satisfied by the payload deployment and
retrieval process.
The basic elements in the payload communication system are the payload interrogator (PI),
payload signal processor (PSP), payload data
interleaver (PDI), and PCMMU. These elements
are in the forward avionics bays. Commands to
the payload communication system are routed
through the GCILC from the payload MDMs 1
and 2, although these MDMs are also used for
orbiter commanding. Status and control of
payload communication systems can also be
accessed by the PCMMU/PL COMM display
(SPEC 62). For ISS missions, an orbiter interface
unit (OIU) 1 or 2 is used to provide translation
functions between the payload communication
system and 1553 ISS devices.

with the PSP. For PSP compatible payloads, the

PSP demodulates the telemetry from the subcarrier
and sends it to the PDI to be interleaved with other
payload data.
Hardline payload commands are routed
through the PSP and then output through the
payload patch panel directly to an attached
payload. Detached RF commands are routed
through the PSP and then through the payload
interrogator for transmission to the payload
through the payload antenna.
The payload interrogator receiver automatically
sweeps to acquire and track an unmodulated or
modulated RF signal. Payload interrogator
telemetry is available through an operational
instrumentation MDM to verify signal strength
and frequency lock. If payload frequencies are
near the orbiter S-band PM frequencies, care
must be taken to prevent interference.
When the payload outputs a data rate that is not
compatible with the PSP, the signal must be
routed directly via Ku-band or S-band FM system,
or the payload customer, such as HST team, must
provide an interface device from the patch panel to
the PDI.
Payload Signal Processor

PCMMU/PL COMM Display (SPEC 62) - OI-32

Payload Interrogator
Detached payloads communicate with the
orbiter on an RF signal through the payload
antenna by the payload interrogator. The
payload interrogator is a transmitter/receiver/
transponder unit that provides full duplex RF
communications between the orbiter and a
detached payload. It transmits commands to
and receives telemetry from NASA payloads
through the payload antenna.
Payload
interrogator controls are located on panel A1L.
The main carrier frequency of the detached
payload telemetry is demodulated by the PI.
The telemetry is routed directly to the Ku-band
system for transmission to the ground (bent-pipe
telemetry) when a payload signal is not compatible
2. SYSTEMS
2.4 Communications

The payload signal processor is the RF and

hardline command interface between the
ground or flight crew and the payload. It is also
a detached payload telemetry interface to the
payload data interleaver. The PSP is controlled
by the switches on panel A1L. The PSP output
is commanded or selected by the PSP CMD
OUTPUT switch.
The PI and PSP are commanded through
GCILC/MCC or selected by the crew (AIL)
using the associated control switches.
In past HST servicing mission (SM) flights, a PSPBypass configuration was used to allow bypassing
the PSP for HST return link telemetry via a jumper
cable from the PI to the PDI. Post-STS-61, a
communications improvement team (GSFC and
JSC) convened to come up with better methods of
downlinking low-rate HST telemetry. The result
was the HST PGSC assembly (HPGSCA). The
main purpose of the HPGSCA was to receive the
HST 32-Kbps data from the PI, clean up the bits
and amplify them, and send the data stream to the
PDI.

2.4-22

USA007587
Rev. A
The HPGSCA was flown on STS-82, -103, and 109. During these missions, there were some issues
with the HPGSCA. If the laptop hung up, it
required crew time to reboot the system. With this
in mind, the HST team at Goddard (GSFC) decided
to design a replacement for the HPGSCA with easier
crew operation and better functionality.
The
replacement unit is the bit sync assembly (BSA).
The BSA uses the heritage Aydin PC355 ISA cards
and minimizes the setup, teardown, and
configuration time required; it should be used on the
final HST servicing mission.
Orbiter Interface Unit
The OIU is an asynchronous LRU that serves two
separate functions. The OIU checks and expedites
commands to the ISS or devices using ISScompatible protocol. It also processes telemetry
(data) from these devices to route to the PDI in PDIcompatible serial data streams. Both the commands
and telemetry path between the OIU and ISS device
use the Military Standard 1553 B (MS 1553B)
protocol. Specifically, the OIU is the translator, or
interface LRU, between the orbiter PSP, the PDI,
and the ISS command and data handling (C&DH)
system MS 1553B communication buses. The OIU
also provides a MS 1553B interface to the SSOR,
adding an RF command and telemetry path to the
ISS while in the proximity operations phase of flight
(end of rendezvous timeline). The OIU is manifested
like a shuttle payload whenever an ISS mission or
payload requiring the MS 1553B protocol is flown.
Payload Data Interleaver
The payload patch panel interfaces attached
payloads to the PDI. The PSP acts as the
interface for detached payloads.
Attached
payloads are wired to specific input channels of
the PDI via the payload patch panel during
prelaunch activities.
When the PDI is
reconfigured by the flight crew, programming
procedures include assigning inputs in the PDI
to one of four decommutators.
The PDI allows the payload communication
system to interface with the rest of the orbiter
communication system and computers.
It
receives up to six different inputs from attached
or detached payloads and one ground support
equipment input.
For missions using the
payload signal processor, a maximum of five
attached payloads can be accommodated on

inputs 1 through 5. Input 6 is reserved for

detached payload telemetry using the RF link
through the payload signal processor and
payload interrogator.
The PDI has four
decommutators that can process up to four
payload data streams. The PDI ships the
payload telemetry to the PCMMU, where it can
be accessed by the SM GPC for display, and
combined with orbiter telemetry for transmission to the ground. The PL DATA INTLVR
POWER switch is on panel A1L.

Ultrahigh Frequency System

The ultrahigh frequency system actually consists of
two separate systems with different capabilities.
They are the UHF simplex (SPLX) system and the
UHF SSOR system. A five-position UHF MODE
rotary switch on panel O6 activates power to
these systems. The OFF selection disables both
systems. The simplex (SPLX) selection activates
the 259.7 MHz (296.8 MHz as backup)
transceiver. The SPLX + G RCV selection
activates the guard 243.0 MHz emergency
receiver
together
with
the
SPLX
transmitter/receiver.
The G T/R selection
activates the guard 243.0 MHz transceiver for
emergency voice communications through any
available ground station and disables the SPLX
transceiver. Selection of any of these three
modes automatically connects the UHF air
traffic controller (ATC) transceiver to the orbiter
audio central control unit (ACCU) air-to-air
(A/A) voice loop.
The UHF simplex, or ATC, system is used as a
backup for the S-band PM during ascent and
entry phases of flight for communications with
MCC through the STDN ground stations.
Simplex mode means that the orbiter flight crew
can transmit or receive, but cannot do both
simultaneously. The UHF system may also be
used for air traffic control and two-way voice
with chase aircraft during landing operations.
In the SPLX or GUARD mode, the UHF
transceiver takes the voice signal from the audio
central control unit A/A loop and routes it
through the external UHF antenna on the
bottom of the orbiter forward fuselage for
transmission to the ground station.
The
incoming UHF signal goes through the external
antenna to the UHF transceiver, which

2.4-23

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
demodulates it and routes it as an audio signal
to the audio central control unit A/A loop for
distribution in the orbiter.
Part of the UHF configuration is controlled
through three two-position toggle switches on
panel O6 labeled XMIT FREQ, SPLX PWR
AMPL, and SQUELCH.
The XMIT FREQ
switch selects one of the two UHF frequencies,
259.7MHz primary or 296.8 MHz secondary, for
external transmission. The SPLX PWR AMPL
switch enables or inhibits the UHF power
amplifier circuit. When the switch is positioned
to ON, the UHF system transmits 10 watts of
power through the antenna. When the switch is
positioned to OFF, the power transmission is
reduced to 0.25 watts by bypassing the power
amplifier circuit. SPLX SQUELCH is used in
the SPLX mode only.
The ON selection
activates a squelch circuit to reduce background
radio noise. This function may be selected to
OFF if the voice communication is weak. This
switch is normally selected to ON.

259.7/414.2

UHF System Controls on Panel O6

Panel O6
UHF
controls

Audio
External
antenna

Audio

Control

Note 3

Note 1
SPLX/Guard
UHF
tranceiver

Audio
central
control
unit
A/A loop

Audio
Audio

Note 2

Note 1 Selects UHF mode, XMT FREQ, power, and squelch

Note 2 Connected to the A/A only
Note 3 External antenna is for communication with locations external to orbiter
usa007587_152

SPLX/GUARD UHF Subsystem Functional Block Diagram

2. SYSTEMS
2.4 Communications

2.4-24

USA007587
Rev. A
SYSTEM 2
Panel O6
UHF
controls

Audio
central
control
unit

OIU

Control

SYSTEM 1

SSOR
UHF
tranceiver
Audio

External
antenna
(in cargo bay)

Internal
antenna
(in the airlock)

Data
usa007587_1091.cnv

EVA/SSOR UHF Subsystem Functional Block Diagram

UHF SSOR Controls on Panel A1R

2.4-25

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

Space-to-Space COMM

SSER
SSO/ISS: 7 km (high power)
SSO/ISS: 2 km (low power)
SSO-EMU: 160 meters (low power)
EMU -EMU: 75 meters (low power)
ISS-EMU: 80 meters (low power)

SSSR

SSER

SSOR

Time division multiple access

One frame

SSOR antenna

SLOT 1

SLOT 2

SLOT 3

SLOT 4

SLOT 5
td146c_038.ppt

Time Division Multiplexing

The UHF MODE EVA selection activates the
UHF SSOR or UHF EVA system and disables the
SPLX UHF systems. In the EVA mode, a
separate
UHF
system
is
used
for
communicating voice and data between the
orbiter, the ISS, and EVA crewmembers. The
orbiter system is called the SSOR and is part of
the space-to-space communications system
(SSCS). The SSCS is a time division multiplexed
network that provides slots for five users,
including the SSOR, space-to-space station
radio (SSSR), and up to three space-to-space
EVA radios (SSER).
The SSCS operates at 417.1 or 414.2 MHz,
depending on the selection of the SPLX/EVA
XMIT FREQ switch. All of the panel O6 UHF
switches, except SQUELCH, apply to the SSOR
system. The main antenna for SSOR is mounted
on the starboard side of the airlock truss. The
SSOR is also connected to an antenna inside the
orbiter airlock for EVA checkout prior to egress.
The SSOR is connected to the orbiter audio
system through the A1R AUDIO CENTER
panel UHF switches. EVA conversations are
routed to Mission Control via the S-band PM or
Ku-band system on A/G 1 or A/G 2, depending
on the configuration of the UHF switches on
2. SYSTEMS
2.4 Communications

panel A1R. A/G 1, A/G 2, and/or A/A may be

used; however, A/G 1 normally is selected.
EVA biomedical/suit data is routed through the
OI system once it is removed from the
UHF/SSOR carrier.
The SSOR system has a prime and backup set of
radios, selectable by 1 or 2 on the EVA STRING
switch.
String 1 is designated as prime.
Transmitter power out is determined by
selecting the SPLX/EVA PWR AMP switch.
Low or high power is 19.1 dBm (~80 mW) to
31.6 dBm (~1.44 W), respectively. High power
is never used - it exceeds FCC limits.
The SSOR may be operated with encryption. If
so, the ENCRYPT will be selected to ON.
The SSOR status is visible to the crew on two
orbiter DPS displays, SM COMMUNICATIONS
SPEC 76 and SM OIU SPEC 212. Prime (PRI)
and backup (B/U) status are indicated. Frame
sync (FRM SYNC) YES indicates that all active
SSCS users are established in the network and
communication should be good. FRM SYNC
BAD indicates no communication in the
network. Processor status (PROC STAT) OK
indicates which system is on. BAD indicates the
system is off.

2.4-26

USA007587
Rev. A
system for reception of C/W (tone) signals and
with the three tactical air navigation (TACAN)
sets for monitoring the TACAN audio
identification codes.
The major elements of the ADS include:
1.

Audio central control unit (ACCU),

which acts as a central switchboard to
gather and route audio signals
throughout the orbiter.
It is an
internally redundant LRU.

2.

Audio terminal unit (ATU) at crew

communication stations that permits
crewmembers to select audio talk/
listen lines and to control external/
internal communication keying modes
and listen volume levels.

3.

Speaker unit (SU) consisting of one

speaker mounted on the flight deck aft
A2 panel, the second mounted on
middeck ceiling panel MO29J. Both
SUs are connected to and subject to an
associated ATU configuration.

4.

Audio center panel, which is the control

center for extending audio buses to
docked ISS (the Spacelab switches)
and SSOR (the UHF switches) and
for selecting up to two voice signals
for recording on the solid state
recorders in the MMUs.

5.

Loose communications equipment

consisting of miscellaneous small,
stowable items such as the headset
interface unit (HIU), headset/helmet
cables, very light weight headset
(VLHS),
multi-headset
adapter
(MHA), battery powered speaker mic
unit (BPSMU), and handheld mic
(HHM).

6.

Crew
communications
umbilical
(CCU) jack, which is an individual
panel-mounted
jack
at
crew
communication stations where mating
headset plugs give the crew access to
audio buses. Each CCU location has
an associated ON/OFF switch to
control power to the headset interface
unit (HIU) microphone.

COMMUNICATIONS Display (SPEC 76)

The power level (PWR LEVEL) indication can
be between 19.1 dBm and 31.6 dBm, depending
on the SPLX/EVA PWR AMP switch selection.
This parameter defaults +15.0 L when both
systems are powered off (OFF or SPLX modes).
The STATUS parameter indicates the system
current, from 0 to 70 amps. Typically, 35 amps
is indicated for the active system and 0.0 L is
indicated if deactivated.

OIU Display (SPEC 212)

Audio Distribution System

The audio distribution system (ADS) routes
audio signals throughout the orbiter.
It
provides the means by which crew members
communicate with each other and with external
locations, such as Mission Control, through the
S-band PM, Ku-band, UHF and SSOR systems.
It also interfaces with the caution and warning
2.4-27

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
The eight loops in the audio system are:
1.

Air-to-Ground 1 (A/G 1)

2.

Air-to-Ground 2 (A/G 2)

3.

Air-to-Air (A/A or UHF SPLX)

4.

Intercom A (ICOM A)

5.

Intercom B (ICOM B)

6.

Paging (PAGE)

7.

C/W

8.

TACAN

are used to communicate from communication

station to communication station within the
orbiter and to ISS via hardline connections in the
orbiter docking system (ODS). The page loop
allows one crewmember to send voice
transmissions to all active stations. The C/W
loop sounds different tones for different
malfunctions or emergencies. The TACAN
loop, accessible only at the commander's and
pilot's stations, is used to identify TACAN
ground stations for navigation.

TACAN

CDR
Audio
Audio
center

PLT
Audio

TACAN

Docked
ISS

SSOR

MS
Audio

SU

Audio
central
control
unit

Caution/
W arning

Network
signal
processor

Middeck
audio

SU

Payload
station
audio

UHF
Simplex

Airlock
audio

Launch
umbilical

Audio Loops and System Interface

Control signal (digital)
Analog voice
Systems/elements interfacing
with audio system

usa007587_155

Audio Loops and System Interface

External communications are accomplished by
routing A/G 1, A/G 2, and A/A. A/G 1 & 2 are
used to communicate with the ground through
the S-band PM and Ku-band systems and with
the EV crewmember through SSOR during EVA
operations. A/A is used to communicate with
MCC via the UHF or ATC system when over
ground sites that support UHF. ICOM A and B
2. SYSTEMS
2.4 Communications

Audio Central Control Unit

The ACCU, the heart of the audio system, is
located in the crew compartment middeck
forward avionics bay.
(There are two
redundant ACCUs within the same hardware, but
only one is used at any given time.) The unit
identifies, switches, and distributes analog

2.4-28

USA007587
Rev. A
audio signals among the various audio
distribution system components. Both digital
and audio signals are received and processed by
the ACCU. The digital signals are used to
control the internal configuration of the ACCU
per the switch positions on the ATUs and other
devices. The audio signals are keyed and
routed
in
response
to
this
internal
configuration.
The AUDIO CENTER selection switch is on
panel C3. Setting the switch to 1 applies
primary power to the control center unit from
the ESS 2CA AUD CTR 1 circuit breaker on
panel R14. Selecting 2 applies power to the
secondary unit electronics from MN C AUD
CTR 2 circuit breaker on panel R14. OFF
removes all power from the ACCU.

NOTE
With the AUDIO CENTER selection
switch OFF, all normal audio functions
will be inoperative.
However, the
commander and pilot can communicate
via headset if one of their ATU
CONTROL switches is set to the alternate
position. This is also true for any two
stations that share ATUs through an
audio control switch position (i.e.,
mission specialist and payload specialist,
airlock CCU 1 and middeck ATU, and
airlock CCU 2 and payload specialist).
The ACCU circuitry activates signals from the
launch umbilical connection intercom A and B
channels. Any crew station ATU can then be
configured to transmit and receive intercom
signals from Launch Control Center (LCC)
through the umbilical. (Only intercom signals
are processed through the umbilical.)

AUDIO CENTER Selection Switch on Panel C3

2.4-29

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

Commanders Audio Terminal Unit of Panel 05

Audio Terminal Units

Six audio terminal units (ATUs) are used in the
crew compartment to select and control the
volume of each audio loop . ATU panels are
located at the following crew stations:
Panel O5 (LEFT AUDIO)
Panel O9 (RIGHT AUDIO)
Panel
R10
AUDIO)
Panel L9
AUDIO)

(MISSION

STATION

(PAYLOAD

STATION

Panel M042F (MID DECK SPEAKER

AUDIO)
Panel AW18D (AIRLOCK AUDIO)
These panels control signals routed through
audio hardware connected to the associated
crew communications umbilical (CCU). The MS
ATU controls the loops routed to the Flight
Deck speaker; the MD ATU controls the loops
routed to the Mid Deck speaker.

Audio Terminal Unit on Panel AW18D

2. SYSTEMS
2.4 Communications

Each ATU has a three-position power switch to

control all signals to or from the ATU. The
switch positions are AUD/TONE, AUD, and
OFF. In the AUD/TONE position, all available
functions of the ATU are armed, and
transmission and receptions may be made
2.4-30

USA007587
Rev. A
through the ATU, depending on the position of
other switches on the ATU. C/W tone signals
are sent to the ACCU to allow C/W audio to
reach the ATU, the CCU, and the speaker unit.
The AUD position has the same functions as
AUD/TONE except that C/W signals are
blocked from the ATU. The OFF position shuts
off power to the ATU power supply, for the
ATU amplifiers.
NOTE
Klaxon (cabin air pressure) and siren
(fire) C/W signals go directly to a speaker
unit, even with the speaker power off.
Each ATU has a two-position, PAGE switch that
must be held in the PAGE position to activate
the circuit. When activated, the circuit enables

the ATU to transmit to all other ATUs, the

SSOR, and the docked ISS. Any number of
stations
may
use
the
page
circuit
simultaneously regardless of the position of the
other channel control switches.
On all ATUs, the two air-to-ground channels,
the air-to-air channel, and intercom channels A
and B have individual three-position control
switches for selecting access to particular
channels for transmission or reception. The
switch positions are T/R, RCV, and OFF. The
T/R position permits transmission or reception
over the selected channel. The RCV position
deactivates transmission capability on the
selected channel and permits only reception of
signals. The OFF position deactivates transmission and reception on the selected channel.

Pilots Audio Terminal Unit on Panel O9

2.4-31

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

Audio Terminal Unit on Panel R10

Audio Terminal Unit on Panel L9

2. SYSTEMS
2.4 Communications

2.4-32

USA007587
Rev. A

Audio Terminal Unit on Panel MO42F

A/G 2, and A/A require PTT of the XMIT
button, while ICOM A and B are voice keyed.
In the PTT/PTT mode, all voice channels are
push button keyed. In the VOX/VOX mode, all
voice channels are voice activated.
The VOX SENS rotary potentiometer on the
ATUs regulates the volume of the signal
required for voice keying. The MAX setting
requires a lower decibel level to key the circuit
than the MIN setting.

MS AUDIO CONTROL Switch on Panel R11L

Each channel control switch has a thumbwheel
VOLUME control to adjust signal intensity on
the related channel. The thumbwheels cover a
range of approximately 27 decibels in 3-decibel
increments.
The XMIT/ICOM MODE rotary switch controls
four combinations of external and intercom
transmissions. In the PTT/HOT mode, transmission through A/G 1, A/G 2, and A/A
requires manual keying of the audio hardware
XMIT push-to-talk (PTT) button; ICOM A and B
will be hot mike. In the PTT/VOX mode, A/G 1,

Volume control of all incoming signals to

speakers is adjusted by the MASTER SPEAKER
VOLUME controls on panels A13 and MO42F.
The airlock ATUs have unique MASTER
VOLUME 1 and 2 potentiometers on panel
AW18D, which control volume to the CCU1
and CCU2 outlets in the airlock.
Four ATUs (on panels O5, O9, AW18D, and
R10) allow a crewmember at a malfunctioning
ATU to switch to an alternate ATU. The left
may be switched to the right (commander's to
pilot's ATU), or right ATU control may be
switched to the left (pilot's to commander's
ATU). The commander's and pilot's CONTROL
knobs are located on panels O5 and O9.
Mission specialist ATU may be switched to the
payload specialist's ATU using the MS AUDIO
CONTROL switch on panel R11L. Airlock ATU

2.4-33

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
control may be switched to the middeck and
payload specialist's ATUs using the CONTROL
rotary switch on panel AW18D.
When the CONTROL switch is in the NORM
position, control of the ATU is from the panel to
which the knob belongs. The other position of
the knob indicates the ATU to which control can
be transferred. The CONTROL knob changes all
ATU functions to the alternative ATU except
the master volume control. This redundancy
protection is used in the event of a failure or
malfunction of any of the four audio terminal
units that have a CONTROL knob.

Speaker Units
Speaker units are located on panels A2 and
MO29J. They are controlled by the MS ATU on
panel R10 and the MD ATU on panel MO42F.
The speaker unit has a three-position SPKR
PWR switch. Only the OFF and SPKR positions
are used. In the OFF position, no signals go
through the associated ATU. In the SPKR
position, audio selected on the associated ATU,
including C/W tones, are enabled.
The
SPKR/MIC position is functionally identical to
the SPKR position. The top speaker is used for
audio and the bottom is dedicated to the
klaxon/siren.
The KEY light on the speaker illuminates when a
microphone on the associated ATU is keyed
(PTT, VOX, etc.). The KEY light indicates that
the speaker is muted.
Audio Center Panel
The AUDIO CENTER controls on panel A1R
have four functions: voice interface capability
with SSOR (UHF switches) and docked ISS
(Spacelab switches), the payload bay comm
outlets (not used), and loop selection for
recording. All switches on the panel send
digital impulses to the ACCU, enabling the
selected functions to communicate with the
docked ISS, SSOR, and recorders.
Two rotary knobs labeled VOICE RECORD
SELECT control various audio signals to be sent
to the recorders via the NSP. A/G 1, A/G 2, A/A,
and ICOM A or B audio can be sent to either
recorder. Any two signals may be recorded at
the same time, one on channel 1 and the other
on channel 2. Either channel may be turned
off.

Speaker Unit on Panels A2 and M02J

2. SYSTEMS
2.4 Communications

2.4-34

USA007587
Rev. A

AUDIO CENTER Controls on Panel A1R

The helmets have redundant noise-canceling
microphones
and
electrically
isolated
earphones. When air is inhaled, the demand
breathing regulator shuts off the microphones
to avoid transmitting breathing sounds.

Loose Communications Equipment

Launch and Entry Helmets
During launch and entry, each flight
crewmember wears a launch and entry
helmet to lessen the severe noise levels
encountered at launch and to allow
intelligible air-to-ground communications. A
communications carrier assembly (CCA)
headset
containing
microphones
and
earphones fits over the crewmember's head.
Also, there is a connector and cable interface
with the HIU, which is connected through
communications cables to the respective crew
communication umbilical and associated ATU.
The microphones can be positioned to suit the
individual crewmember.
For emergency
egress, a pull-away connection is used
between the communications carrier assembly
and headset interface unit, in addition to the
standard
communications
carrier
assembly/headset interface unit twist-on
connector.

NOTE
An improper face seal will cause enough
oxygen flow to cut off microphones.
Headset Interface Unit
The headset interface unit has separate pushto-talk (PTT) buttons for transmit and
intercom modes and a volume control that
determines the level of sound heard through
the earphone (microphone sound level is
determined by automatic gain control
circuitry within the audio terminal unit).
Push-to-talk means that a pushbutton must be
depressed to allow a crewmember to talk
through the system. The transmit (XMIT)
pushbutton allows access to intercom (ICOM)
and external circuits, while the ICOM
2.4-35

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
pushbutton is for intercom only. The volume
control knob acts in series with the loop
volume controls on the associated audio
terminal unit (ATU).
In addition, the
commander and pilot have PTT switches on
their rotational hand controllers for XMIT
keying.
The headset interface unit provides volume
control and PTT capabilities to the
communications carrier assembly used for
EVA and to the communications carrier
assembly. The headset interface unit has a
clip that attaches to the crew's flight suits.

Crewman Communications Umbilical

on Panel L5
Cables
The
communication
cables
vary
in
configuration, depending on seat location.
Each seat has two 4-foot communication
cables or a 14-foot length, as required. One
4-foot cable is flown as a spare. The cables
connect
to
crewman
communications
umbilical (CCU) outlets at various locations
in the crew compartment. Each CCU has a
specific audio terminal unit that controls
communication loop configurations.
The
CCU associated with the ATU on panel O5 is
located on panel L5 (LEFT COMM); for O9 on
R6 (RIGHT COMM); for R10 on A11 (MS
COMM), for L9 on A15 (PS COMM), and for
MO42F on MO39M (MID DECK COMM); two

Headset Interface Unit

2. SYSTEMS
2.4 Communications

2.4-36

USA007587
Rev. A
others for the airlock ATU are located on
panel AW82D (CCU 1 and CCU 2).

When the wireless unit is unstowed, part of

the assembly necessary is to insert and tighten
the flexible antenna in the bottom of each wall
and leg unit. The wall unit receives power
from the CCU outlet. All other switches are
set as required; typically, the individual
communication loops are used. The leg unit
is attached to the crewmember's leg with a
wraparound elastic strap.
The rotary
ON/OFF/VOLUME knob (unlabeled) is
turned clockwise past the ON/OFF detent,
and the volume is set as desired. Each leg
unit is powered by a replaceable lithium
battery pack. A weak battery is identified by
a continuous beeping sound when the leg
unit is powered on. A single battery pack
provides about 35 hours of service. Sliding a
new battery pack into the unit causes both the
electrical connector and mechanical connector
to latch.

Each CCU outlet has a power switch that

controls the associated microphone power. If
the CCU power is off, it results in a listen-only
mode, independent of audio terminal unit
configuration.
Multiple Headset Adapter
A multiple headset adapter (MHA) may be
plugged into the CCU outlets. It contains
three additional CCU outlets to allow up to
three crewmembers to share one CCU outlet.
When any one person connected to an MHA
keys (in PTT mode) or activates the voiceoperated transmitter, all three microphones
will be keyed, and individuals sharing the
MHA will hear each other talking on the side
tone.

Very Lightweight Headset

Wireless Communications Units

The very lightweight headset (VLHS) is the

interface between the leg unit and
crewmember. A single-strand wire headband
holds the earphone against the ear and
supports a thin boom holding a noisecancelling microphone near the mouth. A
cable and connector are attached to the
crewmember's leg unit.
The lightweight
headset cable and connector also can interface
with the headset interface unit.

Wireless communications units are rarely

used by current crews. On orbit, the crew
may use wireless communication units in
place of communication cables. A wireless
unit consists of one wall unit (audio interface
unit) and two leg units (crew remote units)
worn by crewmembers during orbital
operations. The wall unit connects to a CCU
outlet and remains attached to the crew
compartment wall. Each wall unit transmits
on a unique pair of UHF frequencies. Leg
units may be configured to work with any
wall unit. A leg unit may be converted into a
wireless handheld microphone by attaching a
noise-cancelling mic at the headset connector.
Each wall unit is identified by a letter
enclosed in a box. Each unit is stowed with
its cabling attached. The wall unit has a 23inch cable to interface with the CCU outlet,
and the leg unit has a 22-inch cable attached
to a lightweight headset.
NOTE
If the two leg units are set to use the same
frequency, one of the units' transmit
signals will be muted.

Very Lightweight Headset

2.4-37

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
Handheld Microphone

master timing equipment,

checkout equipment.

The handheld microphone is a noisecanceling microphone that connects directly

to any CCU outlet. The microphone is used
primarily with the SUs located at panels A2
and MO29J. To avoid feedback when using
the speakers, one ATU and its corresponding
CCU outlet on the aft flight deck and one
ATU and associated CCU on the middeck are
equipped with a speaker muting capability.
Muting is controlled through ATUs at panels
R10 and MO42F.

Dedicated Signal Conditioners

Dedicated signal conditioners acquire and
convert various sensor data from thousands
of orbiter sensors into a 0-5 V dc pulse
acceptable to MDMs. Sensors requiring DSCs
include frequency, temperature, rate, voltage,
current, and analog parameters.

Instrumentation
Orbiter operational instrumentation (OI)
collects, processes, and routes information
from transducers and sensors throughout the
orbiter and its payloads. More than 3,000
data parameters are monitored.

There are 14 orbiter DSCs, 4 in forward

avionic locations (OFs), 3 in the aft avionic
bays (OAs), 3 under the payload bay (MID)
(OMs), and 4 in the right and left tail sections
(ORs and OLs).

The instrumentation system consists of transducers, 14 dedicated signal conditioners

(DSCs), 7 MDMs, 2 PCMMUs, 2 recorders,

2.4 Communications

onboard

The OI system senses, acquires, conditions,

digitizes, formats, and distributes data for
display, telemetry, recording, and checkout.
It provides for pulse code modulation
recording, voice recording, and master timing
for onboard systems.
Instrumentation
equipment, except sensors and selected
dedicated signal conditioners, is located in the
forward and aft avionics bays. Sensors and
DSCs are located throughout the orbiter in
areas selected on the basis of accessibility,
minimum
harness
requirements,
and
functional requirements. Abbreviations used
to designate the locations of equipment are as
follows: OA refers to operational aft, OF to
operational forward, OL to operational left,
OR to operational right, and OM to
operational mid.

Two PTT pushbuttons are provided for XMIT

and ICOM audio modes. When used to
record audio on the videotape recorder, either
can be used. The pushbuttons should face the
operator to ensure that the noise-canceling
feature of the microphone remains functional.
The handheld microphone is equipped with a
7-foot cable that can connect at any CCU or to
other cables. The microphone/SU configuration is used for on-orbit communication
configurations.

2. SYSTEMS

and

2.4-38

USA007587
Rev. A

A/Gs
1 and 2
OI data

OI
MDMs

Payload
distribution
panel

TLM/
digitized/
voice

Voice
Attached
PL data

PDI

TLM
64 and
128 Kbs

PL data

S-band
PM
system

NSP

PCMMU
TFL

Detached
PL data

Downlist data
PSP

PI

A/G
CIU
GPC
MDM
MMU
NSP
OI
SSR

S-band
FM
system

SSRs

System data

MMU

Air-to-Ground
Communication Interface Unit
General Purpose Computer
Multiplexer/Demultiplexer
Mass Memory Unit
Network Signal Processor
Operational Instrumentation
Solid State Recorders

TFL

K-band
system

SM
GPC

PCMMU
PDI
PI
PL
PSP
SM
TFL
TLM

Pulse Code Modulation Master Unit

Payload Data Interleaver
Payload Interrogator
Payload
Payload Signal Processor
Systems Management
Telemetry Format Load
Telemetry
usa007587_171r3.cvx

Operational Instrumentation System Overview

Multiplexer/Demultiplexers (MDMs)
MDMs can operate in two ways. As multiplexers, they take data from several sources, convert
the data to serial digital signals (a digitized
representation of the applied voltage), and
interleave the data into a single data stream. As
demultiplexers, the MDMs take interleaved
serial digital information, separate and convert
it to analog, discrete, or serial digital, and send
each separate signal to its appropriate destination.
The OI MDMs act only as multiplexers. Upon
request from the pulse code modulation master
unit (PCMMU), the MDMs send these interleaved streams to the PCMMU through the OI
data buses. When the MDM is addressed by the
PCMMU, the MDM selects, digitizes, and sends
the requested data to the PCMMU in serial
digital form. The PCMMU/OI MDM interface
is based on demand and response; that is, the
OI MDMs do not send data to the PCMMU
until the PCMMU makes the request. There are
seven OI MDMs, four OFs, and three OAs for

forward and aft multiplexing of DSC and direct

data signals.
Pulse Code Modulation Master Unit
(PCMMU)
The PCMMU receives data from the OI MDMs,
downlist data from the GPCs under control of
flight software, and payload telemetry from the
Payload Data Interleaver (PDI).
It then
interleaves the data, formats data according to
programmed instructions stored within the
PCMMU (the telemetry format load, or TFL),
and sends the interleaved data to the network
signal processor to be combined with the air-toground voice data from the audio central
control unit for transmission through the Sband PM downlink and Ku-band system return
link, channel one. Telemetry from the PCMMU
is also sent through the network signal
processor to the solid state recorders (SSRs) for
storage and subsequent downlink on the S-band
FM or Ku-band system. OI and payload data
collected by the PCMMU are available to the

2.4-39

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
GPCs for display and monitoring purposes
upon request. All data received by the PCMMU
are stored in memory and periodically updated.
The PCMMU has two formatter memories:
programmable read only (PROM) and random
access (RAM). The read-only memory is hard
coded; the RAM is reprogrammed several times
during flight. The PCMMU uses the formatters
to load data from the computers and OI MDMs
into PCM telemetry data streams for
downlinking.
NOTE

OI PCMMU Controls on Panel C3

When the PCMMU is powered off (as

when switching to the alternate unit), the
TFL changes to the fixed format loaded in
the PROM.

The PCMMUs receive a synchronization clock

signal from the master timing unit. If this signal
is not present, the PCMMU provides its own
timing and continues to send synchronization
signals to the payload data interleaver and
network signal processor.

One of the two redundant PCMMUs and network signal processors operates at a time. The
one used is controlled by the crew through the
flight deck display and control panel. The
primary port of each MDM operates with
PCMMU 1 and the secondary port operates
with PCMMU 2.

2. SYSTEMS
2.4 Communications

The OI PCMMU controls are located on panel C3.

Master Timing Unit
The master timing unit is a stable crystalcontrolled timing source.
It provides
synchronization for instrumentation, payloads,
and other systems. The master timing unit is described in more detail in Section 2.6.

2.4-40

USA007587
Rev. A

MMU 1
MMU 2

Obsolete Recorder Controls on Panel A1R

Solid State Recorders
Two solid state recorders (SSRs) are used for
serial recording and dumping of digital voice
and pulse code modulation (PCM) data from
the OI systems. These recorders are embedded
in the mass memory units (MMUs); therefore,
the recorders are labeled MMU1 and
MMU2 on panel A1 for dumps through Kuband or S-band FM.
The recorders are
controlled entirely by ground command, with
no crew controls available.

2.4-41

2. SYSTEMS
2.4 Communications

SFOC-FL0884
Rev. A

Communications System Summary

The
orbiter
communications
system
transfers information between the orbiter
and the ground, either through hardline or
radio frequency links.
The system is divided into several smaller
systems: S-band phase modulation (PM),
S-band frequency modulation (FM), Kuband, UHF, payload communications,
audio, and CCTV.
The S-band PM system provides two-way
communication between the orbiter and the
ground, through either an STDN/SGLS
ground station or a TDRS. It provides
channels for five functions: command,
voice, telemetry, turnaround tone ranging,
and two-way Doppler tracking.

Four quadrant S-band antennas provide a

selection of eight directions.

The S-band FM system cannot receive

information. It is used to downlink data
directly to the ground from seven different
sources: SSME interface units, the video
switching unit, the solid state recorders,
payload analog, or payload digital.

There are two hemispherical S-band FM

antennas.

The Ku-band system provides for on-orbit

communication between the orbiter and the
ground. It can also be used as a radar
system for tracking objects in space.

The Ku-band antenna is deployed when the

payload bay doors are opened, and stowed
when they are closed. The antenna is
steerable.

The payload communication system is used

to transfer information between the orbiter
and its payloads.

The UHF simplex system is used as a

backup for the S-band PM and Ku-band
voice communications. SSOR is used as the
primary communications link with EVA
astronauts.

The audio distribution system gathers

audio signals from multiple sources and
routes them throughout the orbiter. It is
used as the means by which crewmembers
communicate with each other and with ISS
during rendezvous and undocking.

The major elements of the audio

distribution system are: the ACCU, ATU,
speaker
units,
CCU,
and
loose
communications equipment. The audio
center panel allows the crew to connect the
audio distribution system to SSOR, docked
ISS, and SSRs.

Orbiter operational instrumentation (OI)

collects, routes, and processes information
from transducers and sensors throughout
the orbiter and its payloads.

The OI system consists of transducers, 14

DSCs, 7 MDMs, 2 pulse code modulation
master units, encoding equipment, 2 solid
state recorders, master timing unit, and
onboard checking equipment.

Major communications equipment and

control panels are A1R, A1U, A1L, R13L,
O5, O6, O9, R10, L9, and R12. Others are
found on panels A13, A14, A15, L5, F9, C3,
R11L, R15, MO29J, MO42F, and AW18D.

Specific communications system DPS

displays are OPS 201 ANTENNA,
COMMUNICATIONS (SPEC 76), and PC
MMU/PL COMM (SPEC 62).

TV data can be downlinked over Ku-band

and S-band FM only.

2. SYSTEMS
2.4 Communications

2.4-42

USA007587
Rev. A
SB-SYS 1 PWR: CONTLBC1 AND MNBFLC2
Panel

PF 1 or 2

GPC

Comm
S-band PM

3A

CMDS
FF1
1
Commands
NSP1

Ku-band
sig proc
3A
A/G
1 (HDR)
A/G2
HDR
LDR

2
XMIT
HDR/LDR
NSP1
(S76)

3A

A
C
C
U
2

3A

RCV XMIT
COMSEC1
Cntl AB1 + AB3

UHF
Config
(PLT/MS)

Voice
ATUs
(6)

Ku-band sys
S-band FM/PM sys
P/L comm sys
CCTV

RCV
HDR/LDR

A
C
C
U
1

All
CCUs

GCIL

P
C
M
M
U
1

GPC
O1

P
C
M
M
U
1
1

4
PCMMU - (S62)

Cntl AB3 + AB1

COMSEC1
RCV XMIT

1
LDR
HDR
A/G1
A/G2 (HDR)
Ku-band
sig proc
3A

RCV
HDR/LDR

XMIT
HDR/LDR

NSP2
(S76)

3A
Commands

FF3

Panel

3A
CMDS
AV bay 1

AV bay 2

GPC

PF 1 or 2

GCIL
3A
Ku-band sys
S-band FM/PM sys
P/L comm sys
CCTV

AV bay 3A = 3A
AV bay 3B = 3B

usa007587_175r1.cvx

S-Band System 1 Power

2.4-43

2. SYSTEMS
2.4 Communications

USA007587
Rev. A
SIG STR (F3, A1)

XPNDR 1 (S76)
High Freq

TX STDN LO & SGLS

RCVR

FCX STDN LO

STDN LO
OR SGLS

FCX SGLS

Low Freq

XMTR

SB-SYS 1 PWR: CNTL BC1 and

MNCFLC2

TX STDN LO & SGLS

Antenna SW
(SM2011)

FCX STDN LO
FCX SGLS

3A
B

~
3

RCV

PWR AMP

~
4

2
(S76)

3A
RCV

S4

S1

ULF
ULA

STDN HI
OR TDRS

B
S2

S3

URF
URA

STDN HI
DR TDRS

High
Freq

XMI T

S1
Low
Freq

LLF
LLA

XMIT

3A

PRE AMP (S76)

SIG STR (F3, A1)

S2

LRF
LRA

S3

XPNDR 2 (S76)

Upper
Hemi

High Freq

S-band
FM

TX STDN LO & SGLS

RCVR

RX STDN LO

XMTR

Lower
Hemi

STDN LO
OR SGLS

RX SGLS
Low Freq
TX STDN LO & SGLS

Elec
1

RX STDN LO
RX SGLS

Elec
2

3A
3A
PF2

PF1

1
C3

S-Band System 2 Power

2. SYSTEMS
2.4 Communications

2.4-44

176.cvs

USA007587
Rev. A

Panel A1L

2.4-45

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

usa007587_1104

Panel A1R
2. SYSTEMS
2.4 Communications

2.4-46

USA007587
Rev. A

Panel A1U

Panel A13

2.4-47

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

OPS 201 ANTENNA Display

COMMUNICATIONS (SPEC 76) Display

PCMMU/PL COMM Display (SPEC 62), OI-32

2. SYSTEMS
2.4 Communications

2.4-48

USA007587
Rev. A

Communications System Rules of Thumb

When the TDRS has an elevation of greater

than +70 or less than -60 relative to the
orbiter (as shown on OPS 201), there is a
risk of degraded communications as the
orbiter nose or tail blocks line of sight
between the orbiter antenna and the TDRS.

Power amplifiers are specified to have a

minimum power output of 100 watts.
Flight experience has shown that a good
downlink can be sustained with a power
out of 65 watts. Power amplifiers require
140 seconds to warm up if not in a standby.

2.4-49

2. SYSTEMS
2.4 Communications

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.4 Communications

2.4-50

USA007587
Rev. A

2.5

Personal Hygiene Provisions

CREW SYSTEMS

Personal hygiene and grooming provisions are

furnished for both male and female flight
crewmembers. Ambient warm water for washing comes from a personal hygiene hose (PHH)
attached to the galley auxiliary port. Other
personal hygiene provisions are stowed in
middeck lockers and/or a middeck or airlock
stowage bag at launch and are removed for use
on orbit.

CONTENTS
Description.............................................
Crew Clothing/Worn Equipment ......
Personal Hygiene Provisions...............
Sleeping Provisions...............................
Exercise Equipment ..............................
Housekeeping Equipment ...................
Restraints and Mobility Aids...............
Stowage Containers ..............................
Reach and Visibility Aids.....................
Photographic Equipment .....................
Sighting Aids .........................................
Window Shades and Filters .................
Shuttle Orbiter Medical System ..........
Operational Bioinstrumentation
System ..........................................
Radiation Equipment............................
Air Sampling System ............................

2.5-1
2.5-1
2.5-1
2.5-1
2.5-4
2.5-4
2.5-5
2.5-5
2.5-5
2.5-8
2.5-9
2.5-9
2.5-10

A personal hygiene kit is furnished for each

crewmember for brushing teeth, hair care,
shaving, nail care, etc. Additional grooming
and hygiene items are available for female
crewmembers in the female preference bags.

2.5-12
2.5-14
2.5-15

Description
Several types of equipment and systems that the
crew uses are not covered in other sections of
this manual, since they are not necessarily part
of any of the larger systems. These items and
systems, which focus on crew efficiency and
comfort, are discussed in this section. Where
appropriate, operations are described within
each separate subject area.

Crew Clothing/Worn Equipment

Two washcloths and one towel per

crewmember per day are provided. In addition,
wet wipes, tissues, and wet washes are
provided for personal hygiene. The wet wipes
are located in Volume G (spares), a middeck
locker, and in the galley. Wet washes and
tissues are stowed in the waste management
compartment (WMC) and in a middeck locker.
Rubber grommets in the waste management
compartment allow crewmembers to restrain
their towels and washcloths.
If
the
WMS
becomes
nonfunctional,
contingency equipment is located in Volume G.
This equipment consists of wet washes, urine
collection devices, diapers, and Apollo fecal
bags.

Sleeping Provisions

The crew clothing/worn equipment consists of

items that provide for the personal needs of all
crewmembers. Prior to each flight, crewmembers select clothing and worn equipment from a
list of required and optional flight equipment.
Crew clothing used during on-orbit activities
includes such items as trousers, jackets, shirts,
sleep shorts, soft slippers, and underwear.
Optional worn/carry-on equipment includes
scissors, sunglasses, HP48 calculators, gray
tape, flashlight, Swiss army knife, pens and
pencils, and chronographs.

During a one-shift operation mission, all

crewmembers sleep simultaneously. At least
one crewmember wears a communication headset to ensure reception of ground calls and
orbiter caution and warning alarms.
A 24-hour period is normally divided into an
8-hour sleep period and a 16-hour wake period
for each crewmember. Three hours are allocated for pre/post sleep activities in which
crewmembers perform housekeeping, orbiter
cleaning, sleep and wake preparation, personal
hygiene, and food preparation and eating
activities.

2.5-1

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A
Sleeping provisions for crewmembers consist of
sleeping bags and liners, or rigid sleep stations
with one sleeping bag and two liners per bunk.
Sleeping bags are installed on the starboard
middeck wall and relocated for use on orbit.
Some sleeping bags can remain on the starboard
wall, and some can be attached via pip pins to
the middeck lockers. Others can be relocated to
the airlock, or flight deck (crew preference). A
sleeping bag is furnished for each crewmember
and contains a support pad with adjustable
restraining straps and a reversible/removable
pillow and head restraint.
Eight adjustable straps permit the sleeping bag
to be adjusted to its proper configuration. Three
helical springs above the adjustable straps on
one side of the bag relieve loads exerted by the
crewmember on the crew compartment structure. Eight pip pins allow the bag to be
attached to the middeck locker face in either a
horizontal or vertical configuration. Two elastic
adjustable straps restrain the upper and lower
parts of the body in the bag. Velcro strips on
the ends of both sides of the head restraint
attach it to the pillow.
A double zipper
arrangement permits the sleeping bag to be
opened and closed from the bottom to the top of
the bag. One zipper on each side of the sleeping
bag allows the bag to be attached to a support
pad for better rigidity.

A sleep kit is provided for each crewmember

and is stowed in the crewmembers clothing
locker during launch and entry. Each kit contains eye covers and ear plugs for use as
required during the sleep period.
For 24-hour operations missions, the four-tier,
rigid sleep station is flown. If manifested, it is
installed on the starboard side of the middeck.
The four-tier rigid sleep stations contain a
sleeping bag/liner, personal stowage provisions, a light, and a ventilation inlet and outlet
in each of the tiers. The Nomex knit sleeping
bag is installed on the ground in each tier and
held in place by eight spring clips. The light in
each tier is a single fluorescent fixture with a
brightness control knob and an off position.
The air ventilation inlet duct is an air diffuser
similar to an automobile ventilation duct. It is
adjusted by moving the vane control knob. The
air ventilation outlet duct is located in the fixed
panel at each tier and is opened or closed by
moving the vane control knob. The air inlet is
located at the crewmembers head. The outlet is
at the feet. All crewmembers heads are toward
the airlock and their feet toward the avionics
bay.

Reversible/removable head restraint

Reversible/removable pillow
(Nomex and Pyrell foam)

Personal sleeping bag

(Nomex knit)

Elastic body restraint

Adjustable straps

Helical spring in
cloth tunnel (3)

Pad (Nomex)

Buckle flap
(snap-fastened over buckle)
usa007587_184r2.cvx

Operational Sleeping Bag

2. SYSTEMS
2.5 Crew Systems

2.5-2

USA007587
Rev. A

Volume A

Four-tier rigid
sleep station
Sound
attenuation
pad

4
3
2
1

Modular
lockers

Floor
compartments
usa007587_185r1.cvx

Four-Tier Horizontal Sleep Station

Sleep station
4 (ref)

Sleep station
3 (ref)

Sleep station
2 (ref)

Sleep station
1 (ref)

usa007587_186r2.cvx

Four-Tier Rigid Sleep Station

2.5-3

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A

Exercise Equipment
The purpose of exercise during flight is to help
prevent cardiovascular deconditioning and to
minimize bone or muscle loss in the
crewmembers. Currently the cycle ergometer
(CE) is the primary equipment used to achieve
this end.
The CE attaches to the middeck floor studs. The
mounting frame is reconfigured on orbit to
attach to standard seat floor studs on the flight
deck or middeck. The CE uses a standard
flywheel and braking band system to generate
the required resistive force. Cycling resistance
can be controlled electronically by a control
panel or by a manual adjustment similar to
those found on exercise cycles used at home or
in gymnasiums. An accessories bag, which is
strapped to the top of the ergometer for launch
and entry, contains the attachable hardware as
well as crew clothing and shoes necessary for
nominal operations.

Housekeeping Equipment
In addition to time scheduled for sleep periods
and meals, each crewmember has housekeeping
tasks that require from 5 to 15 minutes of time
at intervals throughout the day. These include
cleaning of the waste management compartment, the dining area and equipment, floors and
walls (as required), and the cabin air filters;
trash collection and disposal; and changeout of
the crew compartment carbon dioxide (lithium
hydroxide) absorber canisters. (Changeout of
the canisters is discussed in Section 2.9.)
The materials and equipment available for
cleaning operations are biocidal cleanser, disposable gloves, general-purpose wipes, and a
vacuum cleaner. The vacuum is stowed in a
middeck
locker
or
the
middeck
accommodations rack (MAR), and the
remaining hardware is stowed primarily in the
waste management compartment. Additional
wipes are located with extra hygiene
consumables stowed in the middeck, and an
additional pair of gloves is located in each
personal hygiene kit.
The biocidal cleanser is a lotion-type detergent
formulation in a container approximately 2
inches in diameter and 6 inches long with a
2. SYSTEMS
2.5 Crew Systems

built-in dispenser. The cleanser is squirted on

the surface to be cleaned and wiped off with
dry, general-purpose wipes. It is used primarily
for periodic cleansing of the waste collection
system urinal and seat. It can be used to clean
the dining area and equipment and to clean
walls and floors. Disposable plastic gloves are
worn while using the biocidal cleanser.
A vacuum cleaner is provided for general
housekeeping and cleaning of the crew compartment air filters and Spacehab filters (on
Spacehab missions). It has a normal hose,
extension hose, and several attachments. The
crew will fly either an ac or dc powered version
depending on orbiter power constraints for the
mission.
The dc vacuum cleaner has the
additional capability of containing wet spills. A
muffler to reduce noise is part of the vacuum
cleaner assembly.
Trash management operations include routine
stowage of wet and dry trash, such as expended
wipes, tissues, and food containers. (Wet trash
includes all items that could offgas.) The equipment available for trash management includes
three trash bags, trash bag liners, wet trash
volumes, and the waste collection system (WCS)
coffee canister.
Three trash bags for dry trash are located in the
crew compartment: one on the inside of the
WMC door, one on the port side of the ditch
area, and one on the port side of the flight deck.
Each bag contains one installed disposable trash
bag liner and seven spare liners (located outside
the installed liner but inside the trash bag).
When the liner becomes full, it is removed and
stowed in a jettison stowage bag and a new liner
is installed.
The WMC wet trash compartment has a volume
of 1.85 cubic feet and is vented overboard for
odor control. Trash from the WMC is inserted
into the circular opening of the auxiliary wet
trash compartment and is contained by an
elbow bag. Tissues, as well as used WCS coffee
canister bags, are disposed of in this wet trash
compartment. The coffee canister, which is
about the same size and shape as an off-theshelf can of coffee, is installed near the WMC
during post insertion. Trash bags are inserted
in the canister and are filled with wipes used for

2.5-4

USA007587
Rev. A
fecal collection. After each WCS use, a used
trash bag is disposed of in the WMC wet trash,
and a new one is retrieved from the stowage
volume on the WMC wall and installed in the
canister.
An 8-cubic-foot wet trash stowage compartment
is available under the middeck floor (Volume
F). This compartment is vented overboard
(3 lb/day) for odor control. Any item that can
create an odor is considered to be wet trash and
is disposed of there.

Restraints and Mobility Aids

Restraints and mobility aids are provided in the
orbiter to enable the flight crew to perform all
tasks safely and efficiently during ingress (1-g,
orbiter vertical), egress (1-g, orbiter horizontal),
and orbital flight (orbiter orientation arbitrary).
Mobility aids are located in the crew
compartment for movement of the flight crewmembers during ingress, egress, and orbital
flight. These devices consist of permanent and
soft handholds, a platform and emergency
egress net (also referred to as the trampoline) in
the middeck, and an interdeck access ladder.
Restraints consist of foot loop restraints, seat
restraints, retention nets, Velcro, tape, snaps,
cable restraints, clips, bungees, and tethers.
Foot loop restraints are cloth loops attached to
the crew compartment decks by adhesive to
provide stability in zero g. Before launch, the
foot loop restraints are installed by the crew
compartment configuration drawings (CCCD)
by Flight Crew Equipment (FCE) personnel on
the floor areas of the aft flight deck work
stations, middeck, and near the waste management system and galley. Spares are stowed in
the modular lockers. To install a foot restraint,
the protective backing on the underside of the
restraint is removed, and the restraint is placed
in its desired location. The foot loop restraints
are easily used by placing a foot in the loop.
Seat restraints are similar to foot loop restraints.
They can be installed prelaunch, and spares are
manifested in the same location as the foot
restraints. One adhesive patch is placed on one
side of the seat, and the other patch is placed on

the opposite side. A restraint strap is placed

over the seat back and attached to each patch
via clips.
A mesh middeck retention net, attached to the
forward middeck lockers and the starboard wall
(no sleep station), is used to restrain the inflight
stowage bags, as well as other hardware. The
airlock stowage net, also made of mesh net, can
restrain this equipment in the airlock if the sleep
station is manifested, or if the crew determines
they wish to stow this hardware in the airlock.
Velcro, tape, snaps, cable restraints, clips,
bungees, and tethers are all manifested in the
IFM locker and can be utilized for a variety of
purposes.

Stowage Containers
Inflight Stowage Bags
Ten inflight stowage bags are manifested, one
per crewmember plus spares. These mesh bags
are used to stow suits, boots, and harnesses on
orbit.
Flight Deck Stowage Bags
The flight deck stowage bags provide restraint
for flight deck items when those items are not
immediately returned to locker stowage compartments. These bags are manifested in the
Flight Data File (FDF) locker and are installed
on orbit on the back of the CDR and PLT seats
(one per seat).
Jettison Stowage Bags
The jettison stowage bags are used for
restraining dry trash or early return items, such
as FDF, film, and cassettes. (See Section 2.25 for
further details on all stowage bags.)

Reach and Visibility Aids

Reach and visibility aids are hardware items
that assist the flight crew in monitoring and
manipulating displays and controls throughout
various phases of flight. These aids consist of
CDR/PLT adjustable mirrors, CDR/PLT two
axis (Z and X) seat adjustment, wicket tabs, and
an auxiliary reach mechanism.

2.5-5

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A
The adjustable mirrors are installed at launch on
handholds located between windows 2 and 3
for the CDR and windows 4 and 5 for the PLT.
During ascent and entry, the CDR and PLT use
the adjustable mirrors to facilitate seeing controls that are in the obscured areas of their
vision envelope. On orbit, mirrors can be
removed and stowed, if desired.
To install the adjustable mirror, place the split
clamp halves around the handhold, fit the
handwheel stem into both clamp halves, and
tighten the handwheel clockwise. To adjust the
mirror, loosen the mirror-lock knob (counterclockwise), move the mirror to the desired
orientation, and tighten the mirror-lock knob.

The CDR/PLT seats provide the CDR and PLT

with the capability to move their seats along the
orbiter Z- (vertical) and X- (longitudinal) axes to
facilitate the reach and visibility of controls
during the ascent and entry phase of flight. Seat
movement for each axis is provided by a single
ac motor. The total travel distances for the
Z- and X-axes are 10 and 5 inches, respectively.
Seat adjustment controls are located on the left
side of the seat pan. The controls consist of a
three-position toggle switch for power bus
selection and one spring-loaded, three-position
toggle switch each for control of horizontal and
vertical seat movement.

Adjustable Mirror

2. SYSTEMS
2.5 Crew Systems

2.5-6

USA007587
Rev. A

Seat Power and Controls

To operate the CDR/PLT seat, the crewmember
must first assign ac power to his or her seat
motors by moving the POWER BUSS SEL
switch to AC2 (up) or AC3 (down). To move the
seat along the horizontal axis, crewmembers
must actuate the HORIZ CONTR toggle switch
FWD to move the seat forward and AFT to
move the seat aft. Similarly, to move the seat
along the vertical axis, the crewmember must
actuate the VERT CONTR toggle switch UP to
move the seat upward and DN to move the seat
downward.
If the seat motors fail to work, and seat
adjustment is needed, manual adjustment
capability is provided. However, manual seat
adjustment can take place only on orbit and is
accomplished with a special seat adjustment
tool provided in the in-flight maintenance tool
kit.
Manual horizontal and vertical seat
adjustment control locations are under the seat
pan cushion and on the aft side of the fixed seat
structure.
The seat adjustment tool is a ratchet-driven,
3/16-inch Allen wrench inserted into the

vertical or horizontal manual adjustment to

move the seat along the Z- or X-axis.
Wicket tabs are devices that help the crewmember activate controls when his or her vision is
degraded. The tabs provide the crewmember
with tactile cues to the location of controls to be
activated as well as a memory aid to their
function, sequence of activation, and other
pertinent information. Wicket tabs are found on
controls that are difficult to see on panels O8, C3,
and R2 during the ascent and entry flight phases.
The auxiliary reach mechanism, sometimes
known as the swizzle stick, is a short adjustable bar with multipurpose end effectors that
are used to actuate controls that are out of the
reach of seated crewmembers. The reach aid is
used to push in and pull out circuit breakers,
move toggle switches, and turn rotary knobs. It
is stowed on the inboard side of the PLT seat. It
may be used during any phase of flight, but is
not recommended for use during ascent because
of the attenuation and switch-cueing difficulties
resulting from acceleration forces.
Operation of the reach aid consists of extending
it and actuating controls with the end effector.

2.5-7

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A
To extend the reach aid, the crewmember
depresses the spring-loaded extension tab and
pulls the end effector out to the desired length.

helmet can be swiveled on the neck ring. The

neck ring tie down may be adjusted to help
open up downward field of view. Mirrors, the
auxiliary reach mechanism (swizzle stick), and
other crewmembers can aid in locating and
actuating controls. Seat headrest pads and
helmet pads may be used to adjust the position
of the head in the seat and in the helmet. The
CDR and PLT seats may be adjusted as
necessary.

Photographic Equipment
Onestillcamerasystemisusedonorbittodocument
crew activities, meet payload requirements, and
record Earth observations. Additional cameras can
be stowed as required. Nikon D2Xs digital still
single lens reflex (SLR) cameras are flown for still
photography. The Nikon D2Xs electronic still
camera stores digital still images on removable
compact flash cards. Digital images can be
downlinked for printing and distribution.
Additionalcamerasystemsmaybeflownforspecific
experiments or as part of an ongoing NASA
evaluationofnewcamerasandtechnology.

Wicket Tabs on Panel R2

Wicket Tabs on Panel C3

The reach and visibility envelope of each
crewmember is limited by the ACES. Tactile
cues are restricted by the ACES glove. Visibility
is reduced because of the helmet and neck ring,
and reach is restricted by the bulk of the ACES
and the parachute and harness. Crewmembers
should practice techniques that enable them to
adjust their reach and visibility envelope. The
2. SYSTEMS
2.5 Crew Systems

Two Nikon D2Xs autofocus SLR cameras are

nominally manifested for each mission. The Nikon
D2Xs uses a 12megapixel CMOS sensor that
produces10MBcompressedimagefilesinaNikon
proprietary.NEFrawformatandcanexposeatISOs
from 100 to 3200. The D2X provides automatic
stateoftheart metering for ambient light and flash
exposure and is capable of exposures as brief as
1/8000ofasecond.Thecameraincorporatesafull
information
LCD
viewfinder
display.
Interchangeable autofocus lenses of various focal
lengths ranging from 10.5mm up to 800mm are
available.Thecamerapermitscontinuousexposures
atratesofupto3or5framespersecond.Itoperates
on an 11.1 V dc rechargeable liION battery. The
Nikonflash(SB800)operatesonfourAAbatteries.
The cameras are used primarily for incabin crew
activitiesandexperiments.Theymayalsobeusedto
document payload deployments and Earth
observations.
TheNikonD2XscanalsobeusedforEVAmissions.
A special camera thermal cover and a custom
eyepiece that assist the EVA crew with camera

2.5-8

USA007587
Rev. A
operations are also manifested. The Nikon D2Xs
EVA camera can also use a flash (SB800) in a
pressurized aluminum housing. While any of the
manifested camera bodies are capable of being used
forEVA,onlyafewlenseshavebeenqualifiedforthe
harshEVAenvironment.A400mmtelephotolensis
flown for handheld photography of the shuttle
external tank postjettison. In addition to the
handheld imagery, a Kodak DCS760 digital still
camera is used for recording images of the
EXTERNAL TANK (ET) from the right umbilical
well right after ET separation. The camera
automatically takes approximately 30 mapping
images of the ET while the shuttle performs an
11second+Xburn.Fornightlaunches,twoNikon
SB800flashesareinstalledintheleftumbilicalwell
and are synchronized with the DCS760. In this
configuration, the flash only fires every other shot;
therefore, only 15 images are usable. Within 24
hours of launch, the crew will downlink the images
fromthiscamerawiththeuseofalaptopcomputer,a
converter box, and cables via a connector on panel
A13.
Most of the photography conducted in theorbiter is
with handheld equipment. With the exception of
flashphotography,manyoftheimagesandscenesthe
crewcapturescanbeimprovedbyusingthemultiuse
brackets, clamps, and baseplate adapters. Twenty
twomountsthroughouttheflightdeck,middeck,and
airlock permit the crew to mount cameras and
accessories. The baseplate adapters (crew installed)
provide quick mounts in windows 9 and 10. The
multiuse clamp is used on various structures to
provideanattachmentbaseforamultiusearm.The
multiuse arm is a modified commercial device that
attachestoacameraandawallmountorclamp.The
arm permits universal pointing of the camera until
thecenterelbowknobistightened.Whentheknob
is secure, the camera is held rigidly at the selected
orientation (zero g). Multiuse equipment is also
usedtomountthecamcorderandphotofloodlight.

Sighting Aids
Sightingaidsincludeallitemsusedtoaidtheflight
crewwithinandoutsidethecrewcompartment.The
sighting aids include the crew optical alignment
sight (COAS), binoculars, adjustable mirrors, and

spotlights. (The COAS is discussed in detail in

Section 2.13.) Five models of binoculars are
availableforonorbituse.Binocularmodelsinclude
the Zeiss 8X20, Fuji 10X40 gyro stabilized
day/night, Fuji 14X40 gyro stabilized, Fuji 16X70,
and the Zeiss 20X60 mechanically stabilized. The
8X20and20X60modelsareroutinelyflownoneach
mission.
Thespotlightisahighintensity,handheldflashlight
poweredbyabatterypack,consistingoffive1.2volt,
onehalf Dsize nickelcadmium batteries. The
spotlight produces a 20,000candlepower output
with a continuous running time of 1.5 hours. The
lamp is a 6volt tungsten filament that cannot be
replacedinflight.
The highintensity search light (HISL) is used in
conjunction with the rangefinders during visual
acquisition of satellites. It provides crewmembers
with the capability to detect and maintain visual
contact with a payload for effective rendezvous and
stationkeepingat700to1000feetwhenonthedark
side. The light is portable and has a stainless steel
cameramountingrailonthehandlethatinterfacesto
themultiusemountingbracketsontheorbiter.The
light is aimed out the aft, or overhead, windows of
theflightdeck.

Window Shades and Filters

Window shades and filters are provided for
installation on the orbiter windows to minimize
crewmember exposure to sunglare during
ascent, entry, and orbital flight phases.
The window shades are stowed in a
compartmented bag attached to a mounting
pallet on the starboard side of the aft middeck.
To install the W1 through W6 window shades,
the crewmember unrolls the shade (white
surface outboard) over the window and mates
the Velcro with the Velcro on the window
frame. Removal of the shades is accomplished
by just the reverse. Demate the Velcro, and roll
the shade up as compactly as possible (blue
surface visible). Insert into window shade holders
and close the holders by mating Velcro together.
Aft window shades are installed simply by
placing the correct shade in the appropriate

2.5-9

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A
window (reflective side outboard) and securing
it to the mating Velcro on the window ledges.

subpack is the Drug Subpack because it contains

commonly used medications.

To remove a window shade from the window

shade stowage container, the crewmember must
unfasten the securing straps and pull the
Velcro-restrained closure panel away from the
desired stowage pouch.

The Airway Subpack contains emergency

airway management equipment to maintain an
open airway. Yellow labels with red lettering
identify the items in this subpack as emergency
items. Articles in the subpack include an oral
airway, laryngoscope, and a CO2 detector.

Interdeck light shades are provided to minimize

light leakage between the flight deck and
middeck during in-cabin photography. The light
shade is attached with Velcro to the flight deck
floor around the interdeck access. Adjustable
louvers are provided to regulate the amount of
light between the flight deck and the middeck.
The side hatch viewport is the only opticalquality window on OV 103, 104, and 105.
Unlike the 10 windows on the flight deck, the
side hatch viewport does not provide protection
from solar ultraviolet (UV) rays, which can
cause serious injury in as little as 10 seconds.
Therefore, a removable UV filter must be placed
on the side hatch viewport for on-orbit
operations.
The filter is held against the
viewport by Velcro and is normally installed post
insertion and removed during deorbit
preparations.

Shuttle Orbiter Medical System

The shuttle orbiter medical system (SOMS) is
required to provide medical care in-flight for
minor illnesses and injuries. It also provides
support for stabilizing severely injured or ill
crewmembers until they are returned to Earth.
The SOMS consists primarily of the medical kits
that are organized into subpacks, which group
similar items together that are used for specific
procedures; e.g., Airway Subpacks.
Each
subpack contains pockets, sleeves, and elastic
restraints that hold individual medications and
medical supplies. The SOMS contains additional
items, such as a sharps container, restraints, and
a resuscitator.
Most SOMS items are stowed together in a
middeck locker. If the subpacks are required on
orbit, they are unstowed and installed where
needed using Velcro. The most frequently used

2. SYSTEMS
2.5 Crew Systems

The Drug Subpack contains oral, topical, and

injectable medications. Oral medications are
contained in Ziploc bags that are heat-sealed so
that only a few pills may be dispersed at a time
in microgravity. Commonly used medications are
stowed on the spine of the subpack, giving easy
access to them without having to unstow the entire
subpack. There is also a medical data log and
allergies list on the outside of the subpack.
The Eye, Ear, Nose, and Throat (EENT) Subpack
contains general diagnostic and therapeutic
items used to treat EENT problems. The EENT
Subpack includes items such as dental
medications and instruments, eye drops, nasal
spray, and various medications and ointments.
The Intravenous Administration (IV ADMIN)
Subpack contains the equipment used to start
an IV line to deliver medications and/or fluids
to an ill or injured crewmember.
Skin
preparation items, IV extension sets and
butterfly needles, a blood pressure cuff, and one
500 ml bag of saline are some of the items
stowed in the IV ADMIN Subpack.
The saline supply bag contains four 500-ml bags of
saline. There are also two 250-ml bags inside the
medical middeck locker. There are a total of 3100 ml
of saline flown on the shuttle.
The Trauma Subpack contains items necessary
to treat in-flight medical emergencies. This
subpack contains equipment necessary for
laceration closure and urinary catheterization, such
as bandaging materials, gauze pads, sutures,
and urinary catheters.
A sharps container is provided for disposal of
injectables and needles. The needle end of the sharp
is inserted into the appropriate foam slot.
The patient/rescuer restraint system is emergency
hardware that is used if a crewmember becomes ill.
The restraints are stored in the medical middeck
locker.

2.5-10

USA007587
Rev. A
The patient restraints secure the patient in the
mid-calf area and the chest area. The restraints can
be easily tightened to fit the patient. The rescuer
restraint wraps around the rescuers waist and has
two extensions from the waist belt with pip pins on
the ends to fasten into the locker latches. This allows
the rescuer and patient to remain stationary.
The SOMS also includes a resuscitator.
The
resuscitator consists of a mask with a retaining cap, a
manually activated/demand regulated oxygen supply
valve, a 6-foot hose, and a quick disconnect fitting.
The resuscitator can supply 100 percent
supplemental oxygen in two ways: manual delivery
by pressing the AMBU bag for unconscious patients,
and on-demand flow for conscious patients.
The resuscitator, upon unstowage, can be connected
to the orbiter oxygen supply on the middeck
connections on panels MO32M and MO69M and
the flight deck connection on panel C6. The
resuscitator assembly is stored in a middeck locker
adjacent to the medical middeck locker.

The Contaminant Cleanup Kit (CCK) is a

multipurpose cleanup kit. Its purpose is to
protect crewmembers from contamination by
toxic and nontoxic particulates within the cabin
environment. The CCK houses the shuttle
emergency eyewash (SEE), which connects to
the clean water supply in the shuttle galley to
flush a crewmembers eyes in case of a chemical
burn or smoke irritation of the eye.
The Medical Accessory Kit (MAK) is a supplemental
kit that is manifested on a mission-specific basis. The
MAK provides additional stowage capability for
crew-specific and/or mission-specific medications; for
example, ice packs and ace bandages. Two are flown
on each flight.
The onboard Medical Checklist specifies the
location of medications/equipment in the
subpacks by using the name of the subpack,
followed by the pocket number. For example,
the laryngoscope is designated in the checklist
as being stowed in Airway Subpack 5.

2.5-11

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A

Medical Locker Equipment and Locations

The diagnostic equipment onboard and
information from the flight crew allows
diagnosis and treatment of injuries and illnesses
through consultation with flight surgeons in
Mission Control.

The Electrode Attachment Kit (EAK) contains

components to aid in the application of electrodes.
The EAK includes wet wipes, stomaseals, overtapes,
electrode paste, and a cue card to illustrate electrode
placement.

Operational Bioinstrumentation System

The OBS electrodes are attached to the skin with

electrode paste to establish electrical contact.
The electrode is composed of a plastic housing
containing a non-polarizable pressed pellet.
The housing is attached to the skin with doublesided adhesive tape, and the pellet contacts the
skin. There are three electrodes on the harness,
marked LC (lower chest), UC (upper chest),
and G (ground). The three electrodes are connected
to a signal conditioner that converts the ECG signal
to digital data to be transferred to the ground.

The operational bioinstrumentation system

(OBS) provides an amplified electrocardiograph
(ECG) analog signal from any crewmember
aboard the orbiter to the avionics system, where
the signal is converted to digital data and
transmitted to the ground in real time or stored
on tape for dump at a later time. On-orbit use is
limited to contingency situations (only at the
request of the flight surgeon) and is for IV use
only.

2. SYSTEMS
2.5 Crew Systems

2.5-12

USA007587
Rev. A
The signal conditioner provides a zero- to 5-volt
output and has an ON/OFF switch within the
input plug, which is actuated when the IVA
cable is plugged in. The unit has batteries that
are not replaced in flight.
The IVA cable connects to the signal
conditioner. The other end of the IVA cable
connects to the biomed cable, which then connects to
one of the biomed input connectors located on
panel M062M, A15, or A11. Rotary control
switches on panel R10 provide circuits from the
biomed outlets to the orbiters network signal
processor for downlink or recording. The two
rotary switches on panel R10 are BIOMED
CHANNEL 1 and CHANNEL 2.

Panel M062M

Electrode Attachment Areas: Ground (G),

Upper Chest (UC), and Lower Chest (LC)

2.5-13

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A
The space shuttle radiation instrumentation system
consists of both active and passive dosimeter devices.
Active and passive radiation dosimetry devices
include crew passive dosimeters (CPDs), passive
radiation dosimeters (PRDs), a tissue equivalent
proportional counter (TEPC), and a passive
dosimeter kit (PDK). High-rate dosimeters (HRDs)
are located inside the PDK.
The flight crews passive dosimeters use
thermoluminescent dosimeter chips (TLDs); they
must be worn by each U.S. crewmember throughout
their flight, including EVAs.
The dosimeters
measure the radiation dose to which a crewmember is
exposed during the course of a mission and will be
analyzed on the ground.
Passive radiation dosimeters are placed in the crew
compartment before launch by ground support
personnel and removed after landing for laboratory
analysis. The remaining dosimeters are stowed in
the PDK located in a middeck locker.

MS BIOMED Input Connector on Panel A11

The TEPC is an active spectrometer that records the

dose, dose rate, and the linear energy transfer (LET)
spectrum as a function of time. The TEPC is
required for most shuttle flights and nominally is
stowed and deployed in the aft, starboard middeck
area. Normal operations require minimal crew
interaction.
The unit is powered up, first at the power outlet,
then at the switchbox located inside the TEPC
assembly. This task normally is conducted on FD1.
The unit is powered down on the last flight day.

BIOMED Rotary Switches on Panel R10

Radiation Equipment
The harmful biological effects of radiation must
be minimized through mission planning based
on calculated predictions and by monitoring
dosage exposures. Preflight requirements include a projection of mission radiation dosage,
an assessment of the probability of solar flares
during the mission, and a radiation exposure
history of flight crewmembers.
In-flight
requirements mandate that each crewmember
carry a passive dosimeter throughout the
duration of the flight. In the event of a solar
flare or other radiation contingency, the crew
would be requested to retrieve and read out one
or more of the active dosimeters.

2. SYSTEMS
2.5 Crew Systems

Periodically, the crew may be required to read the

TEPC displays during certain radiation conditions,
such as a solar proton event.
The high rate dosimeter (HRD) is a COTS portable
radiation detector used for detecting high-rate
Neutron/Gamma radiation doses and Gamma
radiation doses. The HRD uses a PMOS-FET for
prompt photons and a PIN diode for prompt
neutrons. The HRD may respond in a passive
manner.
Without any power applied to the
instrument, the prompt neutrons will damage the
PIN diode. When the HRD is turned ON, it will
read the damage as a Dose. The HRD will remain
stored in PDK in a locker unless the crew is
instructed by the ground to read the instrument.
The crew may be requested to do this in the event of a
contingency situation.

2.5-14

USA007587
Rev. A
The HRD shall measure and display radiation doses
from 0-600 rad. The rad is a unit based on the
amount of energy absorbed and is defined as
any type of radiation that is deposited in the
absorbing media.
Radiation absorbed by
humans is expressed in roentgen equivalent in
man, or rems. The rem is determined by
multiplying rads times a qualifying factor,
which is a variable that depends on wavelength,
source, etc. For low-inclination orbits (35 and
lower), the qualifying factor is approximately
equal to one; therefore, the rem is
approximately equal to the rad. In space
transportation system flights, the doses received
have ranged from 0.05 to 0.07 rem, which is well
below flight crew exposure limits.

Air Sampling System

There are two modes of air sampling onboard. The
grab sample container (GSC) is an air sampling
system that provides a method for obtaining
cabin atmosphere samples to allow postflight
analysis of the gas environment within the crew
module. The GSC is stowed in a modular locker
for ascent, unstowed for sampling, and
restowed for entry.
The GSC is an evacuated steel cylinder that is fitted
with a valve operated by the valve knob. A screw
cap, which covers the air inlet to prevent dust from
contaminating the air sample, is tethered to the
valve.
Two GSCs nominally are manifested for each flight.
One is to be used during a contingency situation,
such as fire or smoke in the cabin, and the other is
used nominally during deorbit prep.

Grab Sample Container

The compound specific analyzer combustion
products (CSA-CP) is used for real-time analysis
of three constituents (carbon monoxide (CO),
hydrogen cyanide (HCN), and hydrogen
chloride (HCl)). Nominally, the CSA-CP is
unstowed on FD1 as an easy activity. The
sensors are evaluated and can be zeroed
on-orbit if out of spec. The CSA-CP is then
stowed temporarily at a crew selected location. The
crew should call MCC with the location.

2.5-15

2. SYSTEMS
2.5 Crew Systems

USA007587
Rev. A

CSA-CP Monitor
CSA-CP Pump

2. SYSTEMS
2.5 Crew Systems

2.5-16

USA007587
Rev. A

2.6

Monitor and control vehicle subsystems,

such as the electrical power system and
the environmental control and life
support system.

DATA PROCESSING SYSTEM

(DPS)

CONTENTS
Description.............................................
General Purpose Computers (GPCs)..
Data Bus Network.................................
Multiplexers/Demultiplexers
(MDMs)........................................
Modular Memory Units .......................
Multifunction Electronic Display
System (MEDS) ...........................
Master Timing Unit...............................
Software..................................................
MEDS ......................................................
Operations..............................................
MDU Configuration..............................
DPS Summary Data ..............................
DPS Rules of Thumb.............................

Process vehicle data for the flight crew

and for transmission to the ground, and
allow ground control of some vehicle
systems via transmitted commands.

2.6-1
2.6-2
2.6-7
2.6-11
2.6-12

Check data transmission errors and

crew control input errors; support
annun-ciation of vehicle system failures
and out-of-tolerance system conditions.

2.6-13
2.6-16
2.6-20
2.6-26
2.6-31
2.6-32
2.6-57
2.6-61

Support payloads with flight crew/

software interface for activation, deployment, deactivation, and retrieval.
Process rendezvous, tracking, and data
transmissions between payloads and the
ground.

Description
The DPS, consisting of various hardware
components and self-contained software,
provides the entire shuttle with computerized
monitoring and control. DPS functions are:
Support the guidance, navigation, and
control of the vehicle, including calculations of trajectories, SSME burn data,
and vehicle attitude control data.
Modular
memory
unit
(MMU)

Engine
interface unit
(EIU)

Master
events
controller
(MEC)

Pulse code
modulation
master unit
(PCMMU)

General
purpose
computer
(GPC)

Multifunction
electronic display
subsystem
(MEDS)

The DPS hardware consists of five generalpurpose computers (GPCs), two modular
memory units (MMUs) for large-volume bulk
storage, and a network of serial digital data
buses to accommodate the data traffic between
the GPCs and vehicle systems. The DPS also includes 20 orbiter and 4 SRB multiplexers/
demultiplexers (MDMs) to convert and format
data from the various vehicle systems, 3 SSME
interface units to command the SSMEs, a
multifunction electronic display system (MEDS)

Multiplexerdemultiplexer
(MDM)

Data

Solid rocket
booster (SRB)
MDM

bus

Ground support
equipment
(GSE)

isolation amplifier

Head-up
display
(HUD)

Device
driver unit
(DDU)
Orbiter

Outside world
usa007587_199r2.cvx

Data Processing System Interfacing Hardware

2.6-1

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
used by the flight crew to monitor and control
the vehicle and payload systems, 2 data bus
isolation amplifiers to interface with the ground
support equipment/launch processing system
and the SRBs, 2 master events controllers, and a
master timing unit.
DPS software accommodates almost every
aspect of space shuttle operations, including
orbiter checkout, prelaunch and final countdown for launch, turnaround activities, control
and monitoring during launch, ascent, on-orbit
activities, entry, and landing, and aborts or
other contingency mission phases. A multicomputer mode is used for the critical phases of
the mission, such as launch, ascent, orbit, entry,
landing, and aborts.

Built-in
test
equipment
status
CPU
control
logic

Watchdog
timer

Oscillator

Main
memory

General Purpose Computers (GPCs)

The orbiter has five identical IBM AP-101S
GPCs. The GPCs receive and transmit data to
and from interfacing hardware via the data bus
network. GPCs also contain the software that
provides the main on-board data processing
capability. Up to four of the systems may run
identical software. The fifth system runs different software, programmed by a different company, designed to take control of the vehicle if
an error in the primary software or other
multiple failures cause a loss of vehicle control.
The software utilized by the four primary GPCs
is referred to as PASS (primary avionics software system); the fifth GPC is referred to as BFS
(backup flight system).

Bus
control
element
1

Bus
control
element
24

IOP
control
logic

Multiplexer Data
interface
bus
adapter 1

Multiplexer Data
interface
adapter 24 bus

Bus terminal
units

Discrete
Discrete
input

lines
register

GPCs
Crew station controls
Mass memories
Back-up flight
controllers

Voter
Memory
control
logic

Discrete
output Discrete
register lines

GPCs
Crew station displays
Caution & warning

Power
supply
GPC
power
On
Off
PNL-06

200.cvs

General Purpose Computer Functional Block Diagram

2. SYSTEMS
2.6 Data Processing System

2.6-2

USA007587
Rev. A
GPCs 1 and 4 are located in forward middeck
avionics bay 1, GPCs 2 and 5 are located in
forward middeck avionics bay 2, and GPC 3 is
located in aft middeck avionics bay 3. The
GPCs receive forced-air cooling from an
avionics bay fan. (There are two fans in each
avionics bay, but only one is powered at a time.)
CAUTION
If both fans in an avionics bay fail, the
computers will overheat within 25 minutes
(at 14.7 psi cabin pressure) or 17 minutes
(at 10.2 psi) after which their operation
cannot be relied upon. An operating GPC
may or may not survive for up to an
additional 30 minutes beyond the
certifiable thermal limits.
Each GPC consists of a central processing unit
(CPU) and an input/output processor (IOP)
stored in one avionics box. The boxes are 19.55
inches long, 7.62 inches high, and 10.2 inches
wide; they weigh approximately 60 pounds.
The main memory of each GPC is volatile (the
software is not retained if power is interrupted),
but a battery pack preserves software contents
when the GPC is powered off. The memory
capacity of the GPCs is 256 k full-words, but
only the lower 128 k full-words are normally
used for software processing.
The CPU controls access to GPC main memory
for data storage and software execution and
executes instructions to control vehicle systems
and manipulate data.
The IOP formats and transmits commands to
the vehicle systems, receives and validates
response data transmissions from the vehicle
systems, and maintains the status of interfaces
with the CPU and the other GPCs.
The 24 data buses are connected to each IOP by
bus control elements (BCEs) that receive,
convert, and validate serial data in response to
requests for available data to be transmitted or
received from vehicle hardware.
For timing, each GPC contains an oscillator that
sends signals to internal components to regulate
operations. The GPC also uses the oscillator to

maintain an internal clock to keep track of

Greenwich mean time (GMT) and mission
elapsed time (MET) as a backup to the timing
signal from the master timing unit (MTU).
Each GPC contains a watchdog timer. The
watchdog timer is an incrementing clock
register in the GPC that is reset about once
every second by a signal from the CPU. If the
register ever overflows, then a problem exists
and is annunciated by a self-fail indication from
that GPC. The PASS set does not utilize this
hardware feature since it operates in
synchronization with each of its GPCs to ensure
proper functioning. Since the BFS operates
essentially standalone relative to the PASS set
synchronization, the BFS mechanization does
utilize the watchdog timer function to serve as a
check on its operation.
The PASS GPCs use a hardware "voter" to
monitor discrete inputs from the other GPCs.
Should a GPC receive a fail vote from two or
more of the other GPCs, it will cause the GPC to
annunciate a self-fail indication that also causes
the GPC to inhibit any fail votes of its own
against the other GPCs.
GPC Controls
The
GENERAL
PURPOSE
COMPUTER
hardware controls are located on panel O6.
Each of the five GPCs reads the position of its
corresponding OUTPUT and MODE switches
and INITIAL PROGRAM LOAD pushbuttons
from discrete input lines that go directly to the
GPC. Each GPC has OUTPUT and MODE
talkback indicators on panel O6 that are driven
by GPC output discretes.
Each GPC has a GENERAL PURPOSE
COMPUTER POWER switch on panel O6.
Positioning a switch to ON enables power from
three essential buses, ESS 1BC, 2CA, and 3AB.
The essential bus power controls remote power
controller (RPCs), which permit main bus DC
power from the three main buses (MN A, MN
B, and MN C) to power the GPC. There are
three RPCs for each GPC; thus, any GPC will
function normally, even if two main or essential
buses are lost. Each computer uses 560 watts of
power.

2.6-3

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Each GENERAL PURPOSE COMPUTER OUTPUT switch on panel O6 is a guarded switch
with BACKUP, NORMAL, and TERMINATE
positions. The switch provides a hardware
override to the GPC that precludes that GPC
from outputting on the flight-critical buses. The
switches for the PASS GNC GPCs are
positioned to NORMAL, which permits them to
output. The backup flight system switch (GPC
5) is positioned to BACKUP, which precludes it
from outputting until it is engaged. The switch
for a GPC designated on-orbit to be a systems
management (SM) computer is positioned to
TERMINATE, since the GPC is not to command
anything on the flight-critical buses.

process software. The MODE switch is leverlocked in the RUN position. The HALT position
initiates a hardware-controlled state in which
no software can be executed. A GPC that fails
to synchronize with others is either powered
OFF or moded to HALT as soon as possible to
prevent the failed computer from outputting
erroneous commands. The talkback indicator
above the MODE switch for that GPC indicates
barberpole when that computer is in HALT.
In STBY, a GPC is also in a state in which no
PASS software can be executed, but it is in a
software-controlled state.
The STBY mode
allows an orderly startup or shutdown of
processing. It is necessary, as a matter of procedure, for a PASS GPC that is shifting from RUN
to HALT or vice versa to be temporarily (more
than 3 seconds) in the STBY mode before going
to the next state. The STBY mode allows for an
orderly software cleanup and allows a GPC to
be correctly initialized (when reactivated)
without an initial program load. If a GPC is
moded to RUN or HALT without pausing in
STBY, it may not perform its functions correctly.
There is no STBY indication on the talkback
indicator above the MODE switch.
The RUN position permits a GPC to support its
normal processing of all active software and
assigned vehicle operations.
Whenever a
computer is moded from STBY to RUN, it
initializes itself to a state in which only system
software is processed (called OPS 0). If a GPC is
in another operational sequence (OPS) before
being moded out of RUN, that software still
resides in main memory; however, it will not
begin processing until that OPS is restarted by
flight crew keyboard entry.
The MODE
talkback indicator always reads RUN when that
GPC switch is in RUN, and no failures exist.

GENERAL PURPOSE COMPUTER

Hardware Controls
The talkback indicator above each OUTPUT
switch on panel O6 indicates gray if that GPC
output is enabled and barberpole if it is not.
Each GPC receives RUN, STBY, or HALT
discrete inputs from its MODE switch on panel
O6, which determines whether that GPC can
2. SYSTEMS
2.6 Data Processing System

Placing the backup flight system GPC in STBY

does not stop BFS software processing or
preclude BFS engagement; it only prevents the
BFS from commanding the payload buses used
by BFS systems management software.
The PASS GPC/BUS STATUS display (DISP 6)
indicates the current mode of each PASS GPC in
the common set.
The display does not
differentiate between STBY and HALT; only
RUN or HALT is displayed (GPC MODE).

2.6-4

USA007587
Rev. A
GPC Modes of Operation
GPC modes of operation are redundant set,
common set, and simplex. Redundant set
operations refer to the mode in which two or
more GPCs are concurrently receiving the same
inputs, executing the same GNC software, and
producing the same outputs. This mode uses a
maximum amount of intercomputer communications, and the GPCs must maintain a high
level of synchronization (called redundant set
synchronization).

GPC/BUS STATUS Display (DISP 6)

The INITIAL PROGRAM LOAD pushbutton for
a GPC on panel O6 activates the initial program
load command discrete input when depressed.
When the input is received, that GPC initiates
an initial program load (IPL) from the MMU
specified by the IPL SOURCE switch on panel
O6. The talkback indicator above the MODE
switch for that GPC briefly indicates IPL then
changes back to barberpole.
During non-critical periods in orbit, only one or
two GPCs are used for GNC tasks, and another
is used for systems management and payload
operations.
A GPC on orbit can also be "freeze-dried"; that
is, it can be loaded with the software for a
particular memory configuration and then
moded to HALT. Before an OPS transition to
the loaded memory configuration, the freezedried GPC can be moded back to RUN and the
appropriate OPS requested.
NOTE
Because all BFS software is loaded into
the BFS GPC at the same time, the BFS
GPC is sometimes referred to as being
freeze-dried on orbit when it is placed in
HALT. The BFS GPC can be moded to
RUN prior to entry and will begin
processing entry software following the
OPS 3 request without having to access a
modular memory unit. The term freezedry or freeze-dried is most often used
with respect to the PASS GPCs.

During redundant set operations, each GPC

outputs only certain portions of its total
software output to its interfacing hardware.
Therefore, although each GPC "thinks" it is
performing all its operations, only the GPC
responsible for supporting a specific group of
hardware will be able to actually transmit its
data and commands. The redundant set GPCs
compare all calculations to ensure that
individual outputs are the same.
Common set operations occur when two or more
GPCs communicate with one another while they
are performing their individual tasks. They do
not have to be performing the same major
function (although they can be), but they do
maintain common set synchronization. Any
GPC operating as a member of the redundant set
is also a member of the common set.
A simplex GPC is in RUN, but not a member of
the redundant set. Systems management and
payload major functions are always processed
in a simplex GPC.
GPCs running together in the same GNC OPS
are part of a redundant set performing identical
tasks from the same inputs and producing
identical outputs. Therefore, any data bus
assigned to a commanding GNC GPC (except
the instrumentation buses because each GPC
has only one dedicated bus connected to it) is
heard by all members of the redundant set.
These transmissions include all keyboard inputs
and mass memory transactions, as well as
flight-critical data. If one or more GPCs in the
redundant set fail, the remaining computers can
continue operating in GNC.
Each GPC
performs about 1.2 million operations per
second during critical phases.

2.6-5

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Each computer in a redundant set operates in
synchronized steps and cross-checks results of
processing hundreds of times per second.
Synchronization refers to the software scheme
used to ensure simultaneous intercomputer
communications of necessary GPC status
information among the PASS computers. If a
GPC operating in a redundant set fails to meet
any redundant synchronization point, the
remaining computers will immediately vote it
out of the redundant set. If a GPC has a
problem with one of its multiplexer interface
adapter receivers during two successive reads
of response data, or does not receive data while
other members of the redundant set do receive
data, the GPC with the problem will fail-tosync.

GPC STATUS Matrix on Panel 01

(W=white; Y=yellow)

GPC Failure Indications

GPC failure votes are annunciated in a number
of ways. Each GPC has discrete output lines for
fail votes against each of the other GPCs that go
to the other GPCs and the GPC status matrix. A
GPC FAIL detection will cause a class 2 GPC
fault message with illumination of the MASTER
ALARM. Error indications will be displayed on
DISP 18 GNC SYS SUMM 1 and DISP 6
GPC/BUS STATUS displays.
The GPC STATUS matrix (sometimes referred
to as the GPC fail CAM) on panel O1 is a 5-by-5
matrix of lights. Each light corresponds to a
GPC's fail vote against another GPC or itself.
For example, if GPC 2 sends out a failure vote
against GPC 3, the second white light in the
third column is illuminated. The off-diagonal
votes are votes against other GPCs. The yellow
diagonal lights from upper left to lower right
are self-failure votes. Whenever a GPC receives
two or more failure votes from other GPCs, it
illuminates its own yellow light and resets any
failure votes that it made against other GPCs
(any white lights in its row are extinguished).
Any time a yellow matrix light is illuminated,
the GPC caution and warning light on panel F7
is illuminated, in addition to MASTER ALARM
illumination, and a GPC fault message is
displayed on the DPS displays.

2. SYSTEMS
2.6 Data Processing System

2.6-6

DPS Parameters on GNC SYS SUMM 11

Display (DISP 18)

GPC MEMORY DUMP Switch on

Panel M042F

USA007587
Rev. A
A failed GPC's memory contents can be
dumped by powering ON, switching the
computer to TERMINATE and HALT, and then
selecting the number of the failed GPC on the
GPC MEMORY DUMP rotary switch on panel
M042F. The GPC is then moded to STBY to
start the dump. After 2 to 8 minutes, the dump
is stopped by moding the GPC to HALT and the
output to NORM. This process is referred to as
a hardware-initiated, standalone memory
(HISAM) GPC memory dump.

GPCs and vehicle systems. The network has

seven groups that perform specific functions:
1.

Flight-critical (FC) data buses that tie

the GPCs to the FC MDMs, integrated
display processors (IDPs), head-up
displays (HUDs), engine interface
units (EIUs), and master events
controllers (MECs).

2.

Payload data buses that tie the GPCs

to the payload MDMs and the
payload data interleaver (PDI), and
possibly
mission-dependent
flex
MDMs
or
sequence
control
assemblies.

Data Bus Network

The data bus network supports the transfer of
serial digital commands and data between the

GPCs 2 - 5*
GPC 1

1
2
3
4
5

GPC*
2

IC3

IP5
IDP
1

IC4
IC5

5
4
PCMMU
3
1
IP2
2
IP4

IDP
2

IDP
3

DK1
DK2

IP3
IDP
4

MMU
1

DK3

MMU
2

5
4
3 PCMMU
2
2

DK4

MMU1

18

MMU2

19

IP1

24

PDI
PL

FC5

14

FC6

21 FC String 2

FC2

P MDM
S FF1

P MDM
S FA1

P MDM
S FF2

1
2

FC3

FC String 3

1
P MDM
S FF3

P MDM
S FA3

P MDM
S FA4

P MDM
S FF4

3
4

HUD
1
2

1
2

FC8

17

HUD
2

1
2

FC4

FC String 4

FC1
FC2
FC3
FC4

***

11
12
13

P MDM
S PL1

S MDM
P PL2

2
3
4

PL2
LB1

LB2

2
3
4
SRB
MDM
2 LR1

SRB
MDM
2 LL2

1
MCIU

1
GSE

IDP
1

1
2
3
4

1
PDI

3
4

3
4

PL1

10

Display Drive Unit

Display Electronics Unit
Display Keyboard
Engine Interface Unit
Flight Critical
Ground Support Equipment
Head-Up Display
Intercomputer
Instrumentation/PCMMU
Launch Aft
Launch/Boost
Launch Forward
Launch Left
Launch Midbody (EDO)
Launch Right
Multiplexer/Demultiplexer
Master Events Controller
Modular Memory Unit
Pulse Code Modulation
Master Unit
- Payload Data Interleaver
- Payload

3
4

P MDM
S FA2

FC7

16

1
2

FC1

FC String 1

15

23

GPC*
3

IC2

22

GPC*
4

IC1

20

GPC*
5

DDU
DEU
DK
EIU
FC
GSE
HUD
IC
IP
LA
LB
LF
LL
LM
LR
MDM
MEC
MMU
PCMMU

SRB
MDM
2 LR1

SRB
MDM
2 LR2

IDP
2

MEC
1

MEC
2

EIU
1

EIU
2

1
2
3
4

IDP
3

EIU
3

*
1
1 MDM
2 LF1
1 MDM
2 LA1

2
3
4

IDP
4

with exception of IC buses

between GPCs and dedicated
IP bus to PCMMUs, any GPC
can command/listen on any
data bus
** Mission-dependent (RMS reqd)
*** Mission-dependent Payload
Bus Interfaces
FLEX MDMs,

( FLEX PAIRS )

GPCs 2 - 5*
usa007587_206r3.cvx

Data Bus Network

2.6-7

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
3.

Launch data buses that tie the GPCs to

ground support equipment, launch
forward, launch aft, launch mid, and
SRB MDMs, and the manipulator
controller interface unit (MCIU) used
by the remote manipulator system.

4.

Mass memory data buses for GPC/

MMU transactions.

5.

Display/keyboard (DK) data buses

for GPC/IDP transactions.

6.

Instrumentation/PCMMU (IP) data

buses.

7.

Intercomputer communication (ICC)

data buses.

Although all data buses in each group except

the instrumentation/PCMMU buses are connected to all five GPCs, only one GPC at a time
transmits commands over each bus. However,
several GPCs may receive data from the same
bus simultaneously.
Each data bus, with the exception of the intercomputer communication data buses, is
bidirectional; that is, data can flow in either
direction. The intercomputer communication
data bus traffic flows in only one direction (a
PASS software constraint, not a hardware
restriction).

hardware is segmented into these groups to

facilitate GPC command of these components
for redundancy, to allow for nominal mission
operations in the event of a loss of one string
caused by a GPC or MDM failure, and to allow
for safe return to Earth in the event of the loss of
a second string.
String 1 consists of FC data buses 1 and 5,
MDMs FF1 and FA1 and their hard-wired hardware, controls, and displays, the three engine
interface units, the two master events controllers, the four integrated display processors, and
head-up display 1. This distribution of hardware is fixed and cannot be changed. The other
three strings are defined in a similar manner.
During ascent and entry, when there are four
PASS GNC GPCs in the redundant set, each is
assigned a different string to maximize redundancy. All flight-critical hardware units are
redundant, and the redundant units are on different strings. The string concept provides
failure protection during dynamic phases by
allowing exclusive command of a specific group
of vehicle hardware by one GPC, which can be
transferred to another GPC in case of failure.
All or part of one string can be lost, and all
avionics functions will still be retained through
the other strings.
Flight-critical data bus 1 (FC1 )

Flight-Critical Data Buses

There are eight FC data buses directed into
groups of two, referred to as an FC string. Each
FC string can be commanded by a different
GPC. Multiple units of each type of GNC
hardware are wired to a different MDM and
flight-critical bus. FC1, 2, 3, and 4 connect the
GPCs with the four flight-critical forward (FF)
MDMs, the four flight-critical aft (FA) MDMs,
the four integrated display processors, and the
two head-up displays. The other four, FC5, 6, 7,
and 8, connect the GPCs to the same four FF
MDMs, the same four FA MDMs, the two
master events controllers, and the three main
engine interface units.
A string is composed of two FC data buses: one
from the first group (FC1, 2, 3, or 4) and one
from the second group (FC5, 6, 7, or 8). Vehicle
2. SYSTEMS
2.6 Data Processing System

2.6-8

String
1

Flightcritic al
forward
MDM 1

Fl ightcritical
aft
MDM 1

Integrate d
display
processor 1
(IDP 1)

IDP 2

EI U 2

IDP 3

EI U 3

IDP 4

Flight-critical data bus 5 (FC5 )

En gi ne
inte r fac e
u ni t 1
(E IU 1)

Headup
display 1
(HUD 1)

Master
events
controller
(MEC 1)

MEC 2

s foc s com s 2.6 207.cnv

Components of String 1

USA007587
Rev. A
With four PASS GNC GPCs in a redundant set,
each GPC is responsible for issuing commands
over the string assigned to it; that is, it is the
commander of that string. The other GNC
GPCs will monitor or listen on this string.
When the string's commanding GPC sends a
request for data to the hardware on the string,
all the other GNC GPCs will hear and receive
the same data coming back on the string. This
transaction (one commanding GPC and
multiple listening GPCs) is occurring in parallel
with the other three strings. Therefore, all GNC
GPCs will get a copy of all of the data from all
four strings. Once all the data are received from
the string, the GPCs then agree (or disagree)
that the data are consistent.
Payload Data Buses
Two payload data buses interface the five GPCs
with the two payload MDMs (also called
payload forward MDMs), which interface with
orbiter systems and payloads.
A PDI is
connected to payload data bus 1. Additionally,
on some flights, one or two flex MDMs and/or
sequence control assemblies connect the
payload data buses to communicate with other
payload equipment.
Each payload MDM is connected to two
payload data buses. Safety-critical payload
status parameters may be hard-wired; then
these parameters and others can be recorded as
part of the vehicle's system management, which
is transmitted and received over two payload
buses. To accommodate the various forms of
payload data, the PDI integrates payload data
for transmission to ground telemetry. PDI
configuration commands and status monitoring
are accomplished via payload data bus 1.
Launch Data Buses
Two launch data buses are used primarily for
ground checkout and launch phase activities.
They connect the five GPCs with the ground
support equipment/launch processing system,
the launch forward (LF1), launch mid (LM1),
and launch aft (LA1) MDMs aboard the orbiter,
and the two left and right SRB MDMs (LL1,
LL2, LR1, and LR2). Launch data bus 1 is used
on orbit for interface with the remote
manipulator system controller by the SM GPC.

Mass Memory Data Buses

Each of two MMUs interfaces with its data bus
via a multiplexer interface adapter, which
functions just like the ones in the GPCs. Each
data bus is connected to all five GPCs. Each
MMU is connected to only one mass memory
data bus.
In addition, each MMU has a separate discrete
line called the "ready discrete" that goes to each
of the GPCs. If the discrete is on, it tells the
GPC the modular memory unit is ready for a
transaction. When the discrete is off, the MMU
is either busy with another transaction or is
powered off.
Note that all MMU operations and
transmissions to the GPCs are on an on-demand
basis only. There is no insight into the state of
the MMU (other than the ready discrete) unless
a specific transaction is requested.
Display/Keyboard Data Buses
The four display/keyboard (DK) data buses,
one for each IDP, are connected to each of the
five GPCs. The computer in command of a
particular display/ keyboard data bus is a
function of the current MAJOR FUNC switch
setting of the associated IDP, current memory
configuration, GPC/CRT keyboard entries, and
the position of the backup flight control (BFC)
CRT switches. (These topics are discussed in
more detail under "Operations.")
Instrumentation/Pulse-Code Modulation
Master Unit (PCMMU) Buses
The five instrumentation/PCMMU data buses
are unique in that each GPC has its own
individual data bus to two PCMMUs. All the
other data buses interface with every GPC.
Flight controllers monitor the status of the
vehicle's onboard systems through data
transmissions from the vehicle to the ground.
These transmissions, called downlink, include
GPC-collected data, payload data, instrumentation data, and onboard voice. The GPC-collected data, called downlist, includes a set of
parameters chosen before flight for each
mission phase.

2.6-9

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
The system software in each GPC assimilates
the specified GNC, systems management,
payload, or DPS data according to the
premission-defined format for inclusion in the
downlist. Each GPC is physically capable of
transmitting its downlist to the current active
PCMMU
over
its
dedicated
instrumentation/PCMMU data bus. Only one
PCMMU is powered at a time. It interleaves the
downlist data from the different GPCs with the
instrumentation and payload data according to
the telemetry format load programmed in the
PCMMU. The resulting composite data set,
called the operational downlink, is transmitted
to one of two network signal processors (NSPs).
Only one NSP is powered at a time. In the NSP,
the operational downlink is combined with
onboard recorded voice for transmission to the
ground.
The S-band and Ku-band
communications systems transmit the data
either to the space flight tracking and data
network remote site ground stations or through
the Tracking and Data Relay Satellite (TDRS)
system to Mission Control.
Uplink is how ground commands originating in
Mission Control are formatted, generated, and
transmitted to the orbiter for validation,
processing, and eventual execution by onboard
software.
This capability allows ground
systems to control data processing, change
modes in orbiter hardware, and store or change
software in GPC memory and mass memory.
From MCC consoles, flight controllers issue
commands and request uplink. The command
requests are formatted into a command load for
transmission to the orbiter either by the STDN
sites or by the TDRS system. The S-band or Kuband transponder receivers aboard the orbiter
send the commands to the active NSP. The NSP
validates the commands and, when they are
requested by the GPCs through a flight-critical
MDM, sends them on to the GPC. The GPCs
also validate the commands before executing
them. Those GPCs listening directly to the
flight-critical data buses then forward uplink
commands for those GPCs not listening to the
FC buses over the intercomputer communication data buses.
The PCMMU also contains a programmable
read-only memory for accessing subsystem
data, a random-access memory in which to store
2. SYSTEMS
2.6 Data Processing System

data, and a memory in which GPC data are

stored for incorporation into the downlink.
To prevent the uplink of spurious commands
from somewhere other than Mission Control,
the flight crew can control when the GPCs
accept uplink commands, and when uplink is
blocked.
The GPC BLOCK position of the
UPLINK switch on panel C3 inhibits uplink
commands during ascent and entry when the
orbiter is not over a ground station or in TDRS
coverage.

UPLINK Switch on Panel C3

Intercomputer Communication Data Buses
There are five intercomputer communication
(ICC) data buses. The following information is
exchanged over these buses for proper DPS
operation: input/output errors, fault messages,
GPC status matrix data, IDP major function
switch settings, GPC/CRT keyboard entries,
resident GPC memory configuration, memory
configuration table, operational sequences,
master timing unit time, internal GPC time,
system-level display information, uplink data,
and state vectors.
All GPCs processing PASS software exchange
status information over the ICC data buses.
During launch, ascent, and entry, GPCs 1, 2, 3,
and 4 are usually assigned to perform GNC
tasks, operating as a redundant set, with GPC 5
as the backup flight system. Each of the PASS
GPCs acts as a commander of a given ICC data
bus and initiates all data bus transactions on
that data bus.

2.6-10

USA007587
Rev. A

The MDMs convert and format (demultiplex)

serial digital GPC commands into separate
parallel discrete, digital, and analog commands
for various vehicle hardware systems. The
MDMs also convert and format (multiplex) the
discrete, digital, and analog data from vehicle
systems into serial digital data for transmission
to the GPCs. Each MDM has two redundant
multiplexer interface adapters (MIAs), each
connected to a separate data bus. The MDM's
other functional interface is its connection to the
appropriate vehicle system hardware by hardwired lines.
There are 20 MDMs aboard the orbiter; 13 are
part of the DPS, connected directly to the GPCs
and named and numbered according to their
location in the vehicle and hardware interface.
The remaining seven MDMs are part of the
vehicle instrumentation system and send
vehicle instrumentation data to the PCMMUs.
(They are termed operational instrumentation
(OI) MDMs.)
The DPS MDMs consist of flight-critical forward
(FF) MDMs 1 through 4, flight-critical aft (FA)
MDMs 1 through 4, payload (PL) MDMs 1 and
2, and GSE/LPS launch forward (LF1), launch
mid (LM1), and launch aft (LA1). One or two
flex MDMs (FMDMs) may also be connected to
the PL data buses, depending on the payload
needs for a particular flight.
Of the seven operational instrumentation
MDMs, four are located forward (OF1, OF2,
OF3, and OF4), and three are located aft (OA1,
OA2, and OA3).

The system software in the redundant set GPC

activates a GNC executive program and issues
commands to authorized buses and MDMs to
request a set of input data. Each MDM receives
the command from the GPC assigned to
command it, acquires the requested data from
the GNC hardware wired to it, and sends the
data to the GPCs.
Each FC data bus is connected to a flight
forward and flight aft MDM. Each MDM has
two MIAs, or ports, and each port has a channel
through which the GPCs can communicate with
an MDM; however, the GPCs can interface on
the FC data buses with only one MIA port at a
time. Port moding is the software method used
to control the MIA port that is active in an
MDM. Initially, these MDMs operate with port
1; if a failure occurs in port 1, the flight crew can
select port 2. Since port moding involves a pair
of buses, both MDMs must be port moded at
the same time. The control of all other units
connected to the affected data buses is
unaffected by port moding. Port moding is a
software-only process and does not involve any
hardware changes.

FC
X

1
MDM
(EMDM)

GPC

FC
X+4

Multiplexer Interface Adapters

Multiplexers/Demultiplexers (MDMs)

Also recall, there are four SRB MDMs; i.e., SRB

launch left (LL) MDMs 1 and 2 and launch right
(LR) MDMs 1 and 2.

Bus Control Elements

The four PASS GPCs are loaded with the same

software. Interconnecting the four ICC buses to
the four PASS GPCs allows each GPC access to
the status of data received or transmitted by the
other GPCs so that identical results among the
four PASS GPCs can be verified. Each ICC bus
is assigned to one of the four PASS GPCs in the
command mode, and the remaining GPCs
operate in the listen mode for the bus. Each
GPC can receive data from the other three
GPCs, pass data to the others, and perform any
other tasks required to operate the redundant set.

Analog
signals

Serial
digital
data

Discretes

209.cvs

GPC/MDM Interfaces
Payload data bus 1 is connected to the primary
MIA port of payload MDM 1, and payload data
bus 2 is connected to the primary port of
payload MDM 2.
Payload data bus 1 is
connected to the secondary MIA port of payload

2.6-11

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
MDM 2, and payload data bus 2 is connected to
the secondary port of payload MDM 1. Which
bus is used to communicate with each MDM is
controlled by port moding.
The two launch data buses are also connected to
dual launch MDM multiplexer interface adapter
ports. The flight crew cannot switch these
ports; however, if an input/output error is
detected on LF1 or LA1 during prelaunch, an
automatic switchover occurs.
The hardware controls for the MDMs are the
MDM PL1, PL2, PL3, FLT CRIT AFT, and FLT
CRIT FWD power switches on panel O6. These
ON/OFF switches provide or remove power for
the four aft and four forward flight-critical
MDMs and PL1 and PL2 MDMs. The PL3
switch is unwired and is not used. There are no
flight crew controls for the SRB MDMs.

may be interchanged with another and the

payload MDMs may be interchanged.
Each MDM is 13 by 11 by 7 inches and weighs
about 38.5 pounds. MDMs use less than 80
watts of power.
Enhanced MDMs (EMDMs) were installed in
OV-105. EMDMs will be installed in the other
vehicles only as MDMs require replacement
(currently both types are on Atlantis). The
presence of EMDMs is transparent to the crew
except in the case of an MDM OUTPUT
message. With MDMs, the message means
there is a problem with an MDM or a GPC. An
MDM OUTPUT message with EMDMs means it
is most likely a GPC problem. Crews flying
with a combination of MDMs and EMDMs will
receive assistance from flight controllers in
interpreting an MDM OUTPUT message.

Each MDM is redundantly powered by two

main buses. The power switches control bus
power for activation of a remote power
controller (RPC) for each main power bus to an
MDM. The main buses power separate power
supplies in the MDM. Loss of either the main
bus or MDM power supply does not cause a
loss of function because each power supply
powers both channels in the MDM. Turning off
power to an MDM resets all the discrete and
analog command interfaces to subsystems.
The SRB MDMs receive power through SRB
buses A and B; they are tied to the orbiter main
buses and are controlled by the master events
controller circuitry. The launch forward, mid,
and aft MDMs receive their power through the
preflight test buses.
The FF, PL, LF, and LM MDMs are located in
the forward avionics bays and are cooled by
water coolant loop cold plates. LA and FA
MDMs are in the aft avionics bays and are
cooled by Freon coolant loop cold plates.
MDMs LL1, LL2, LR1, and LR2 are located in
the SRBs and are cooled by passive cold plates.
Module (or card) configuration in an MDM was
dictated by the hardware components to be
accessed by that type of MDM. A flight-critical
forward and aft MDM are not interchangeable.
However, flight-critical MDMs of the same type
2. SYSTEMS
2.6 Data Processing System

1128.cnv

MDM Power Switches on Panel 06

Modular Memory Units

There are two modular memory units (MMUs)
aboard the orbiter. A modular memory unit
consists of a solid state recorder (SSR) and a
solid state mass memory (SSMM) storage device

2.6-12

USA007587
Rev. A
for GPC software and orbiter systems data. For
more information on the SSR, see section 2.4.
For simplicity, MMU in this section will refer to
the SSMM functions to the DPS.

inches high, 12 inches wide, 20 inches long and

weighs 40 pounds.

Computing functions for all mission phases

require approximately 600,000 half-words of
computer memory.
The orbiter GPCs are
loaded with different memory configurations
from the MMUs. In this way, software can be
stored in MMUs and loaded into the GPCs
when actually needed.
To fit the required software into the available
GPC memory space, programs are subdivided
into eight memory configurations corresponding to functions executed during specific flight
and checkout phases. Thus, in addition to the
central memory in the GPCs themselves, 128
Mbit of information can be stored in each of the
two MMUs. Critical programs and data are
loaded in both MMUs and protected from
erasure.

MMU 1 Power Switch on Panel 014

The principal function of the MMU, besides

storing the basic flight software, is to store
background formats and code for certain
displays and the checkpoints that are written
periodically to save selected data in case the
systems management GPC fails.
Each MMU interfaces with its mass memory
data bus through MIAs that function like the
ones in the GPCs. Each mass memory data bus
is connected to all five computers; however,
each MMU is connected to only one mass
memory data bus. All MMU operations are on
an on-demand basis only.
The power switches are located on panel O14
for MMU 1 and panel O15 for MMU 2. The
MMU 1 switch on panel O14 positioned to ON
allows control bus power to activate an RPC,
which allows MNA power to MMU 1. The
MMU 2 switch on panel O15 positioned to ON
operates in a similar manner with MNB power.
An modular memory unit uses 83 watts of
power, with the SSMM consuming 9 of those
watts.
MMU 1 is located in crew compartment
middeck avionics bay 1 and MMU 2 is in
avionics bay 2. Each unit is cooled by water
coolant loop cold plates. Each MMU is 7.7

MMU 2 Power Switch on Panel 015

Multifunction Electronic Display System

(MEDS)
MEDS allows onboard monitoring of orbiter
systems, computer software processing, and
manual control for flight crew data and
software manipulation.
MEDS has four types of hardware: four IDPs,
11 multifunction display units (MDUs), 4
analog-to-digital converters (ADCs), and 3
keyboard units, which together communicate
with the GPCs over the DK data buses.

2.6-13

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
The system provides almost immediate
response to flight crew inquiries through
displays, graphs, trajectory plots, and
predictions about flight progress. The crew
controls vehicle system operation with
keyboards in conjunction with the IDPs. The
flight crew can alter the system configuration,
change data or instructions in GPC main
memory, change memory configurations
corresponding to different mission phases,
respond to error messages and alarms, request
special programs to perform specific tasks, run
through operational sequences for each mission
phase, and request specific displays.
Integrated Display Processor (IDP)
The IDP is the interface between MEDS and the
GPCs. It formats data from the GPCs and
ADCs for display on the MDUs. Also, it accepts
operator inputs from switches, edgekeys, and
keyboards. In addition to all of these functions,
the IDP monitors its own status and the status
of other MEDS LRUs. It has both hardware
built-in test equipment (BITE) and software selftests.

On the GPC side, each IDP is connected to

flight-critical data buses 1 through 4 and one
DK bus, in addition to the panel switches and
the keyboards. In general, it can display flight
instrument and subsystem data on more than
one crew station (left, right, aft). On the MEDS
side, each IDP controls a 1553B data bus that
allows the IDP to interface with the MDUs and
a pair of ADCs.
IDPs require 28 V dc that is supplied by a main
bus (IDP1 main A/FPC1, IDP2 main
B/FPC2, and IDP3 and 4 main C/FPC3). The
IDP power switches are located on panels C2
and R11. These switches also power their
respective CRT MDUs. Cooling is provided
through forced-air ducting.
The IDPs are in the forward cockpit beneath
panels to the left of the commander and to the
right of the pilot. An IFM capability is available
to swap a forward IDP with the aft IDP.

Integrated display processor

Multifunction display unit
Analog-to-digital converter

1082.CV5

MEDS Hardware Units

2. SYSTEMS
2.6 Data Processing System

2.6-14

USA007587
Rev. A
Multifunction Display Unit (MDU)
The MDU is a full color, flat panel, 6.7-inchsquare, active matrix liquid crystal display. Its
primary function is to drive the variety of
MEDS color displays that are readable in the
sunlight.
Similar to the IDP, the MDU has built-in tests to
provide various test coverage for the processor,
functions, and hardware.
Six edgekeys are located below the display on
the bezel of the MDU. A brightness control
knob and an ON/OFF switch are also on the
bezel on either side of the edgekeys. The
edgekeys are used to navigate the MEDS menu
system and to perform MEDS-specific activities,
not to interact with the rest of the DPS system
(i.e., clearing DPS fault messages, item entries).
There are 11 MDUs: CDR 1 and 2 on panel F6;
CRT 1, 2, and 3; MFD 1 and 2 on panel F7; PLT 1
and 2 on panel F8; CRT 4 on panel R12; and
AFD 1 in the aft station.
In general, each MDU has two ports (primary
and secondary) that are connected to two IDPs
via a 1553B data bus. Only one IDP commands
an MDU at a given time, but both IDPs monitor
the status of the MDU. The exception is the
CRT MDUs, which use only their primary port.
Their secondary port is not connected to any
data bus. Thus, they are connected only to a
single IDP and indirectly to only one DK data
bus.
Operationally, the CRT MDUs are
dedicated to the DPS display. This configuration maintains a one-to-one relationship
between a DK bus, an IDP, and its CRT MDU.
While in the autonomous mode, the MDU
continues to run and monitors its two ports for
an operating IDP.
The MDUs are controlled by the power knob on
the display bezel and a circuit breaker on panel
R14. However, the CRT MDUs do not have a
circuit breaker; they are powered by their
respective IDP power switches. Main A powers
MFD 2 and PLT 1. Main B powers CDR 2 and
MFD 1. Main C powers CDR 1, PLT 2, and AFD
1. The brightness control knob, located to the
right of the edgekeys, controls the illumination
of the menus and display.
MDUs are cooled via forced-air cooling ducts.

The MDUs on the forward portion of the flight

deck have a left and right group that
correspond to the flight instrument display
switches found on panel F6 (CDR side) and F8
(PLT side). The left side (CDR crew station)
consists of CDR 1, CDR 2, MFD 1, CRT 1, and
CRT 3. The right side (PLT crew station)
consists of CRT 2, PLT 1, PLT 2, and MFD 2.
The aft crew station consists of AFD 1 and CRT
4.
CRT 4 is slightly tilted to improve
readability.
An MDU IFM capability is available.
Analog-to-Digital Converter (ADC)
The ADCs convert analog MPS, HYD, APU,
OMS, and SPI subsystem data into 12-bit digital
data to be used by the IDP to generate the
displays on the MDUs. MEDS includes four
ADC units (1A, 1B, 2A, 2B). ADCs 1A and 1B
convert the analog signals from the MPS, OMS,
and SPI meters. ADCs 2A and 2B convert the
signals from the APU and HYD meters. Each
ADC maintains communication with two IDPs
simultaneously (the As with IDP 1 and 2 and
the Bs with IDP 3 and 4). The ADC software
performs a continuous self-test.
ADC 1A and 2A are powered by main A via a
single circuit breaker on panel R15, while 1B
and 2B are powered by main B via a single
circuit breaker on panel R15.
Keyboards
Three identical keyboards are located on the
flight deck: one each on the left and right sides
of the flight deck console (panel C2) and one on
the flight deck at the side aft flight station
(panel R11L). Each keyboard consists of 32
momentary double-contact pushbutton keys.
Each key uses its double contacts to permit
communication on separate signal paths to two
IDPs. Only one set of contacts on the aft station
keys is actually used, because this keyboard is
wired to communicate with only the aft IDP.
There are 10 numeral keys, 6 letter keys (used
for hexadecimal input), 2 algebraic keys, a
decimal key, and 13 special function keys.
Using these keys, the crew can ask the GPC
more than 1000 questions about the mission and
condition of the vehicle.

2.6-15

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

F6

M DU
CDR 1
P3

F7

P1

M DU
CRT 1

M DU
CDR 2
S1

M DU
PLT1

M DU
CRT 3
M DU
M FD 1

S2

P1

F8

P2

M DU
CRT 2

P2

S3

MDU
M FD 2

P3

P1

1553B DATA BUS 1

P2

M DU
PLT2
S1

P3

S2

S3

1553B D ATA BU S 2
1553B D ATA BU S 3
1553B D ATA BU S 4

ID P
1

ID P
2

ADC 1A

ID P
3

ID P
4

ID P
1

ADC 1A

ID P
2

ID P
3

ADC 2A
CRT1

ID P
4

ADC 2B

CRT2
CRT3

CNTL
AB1

ANALOG S
[MPS /O MS /SP I]

M NA
FPC1

CNTL
CA1
M NC
FPC3

CNTL
BC2

AN ALO GS
[APU AND HYD]

M NA
FPC2

P4
CNTL
AB1
M NA
FPC1

M F SW
& KYBD
INPUTS

IDP 1

CNTL
AB1
MNA
FPC1

M F SW
& KYBD
INPUTS

IDP 3

IDP/C RT
A

LH
KY BD
UNIT

PW R &
MAJ
FUNC
SW s

PW R &
MA J
FUNC
SW s

PW R &
MAJ
FUNC
SW s

LEFT
IDP/CRT
SEL
1 OR 3

RIGHT
IDP/CRT
SEL
3 OR 2

RH
KYBD
UNIT

CNTL
BC2
MNA
FPC2

M F SW
& KYBD
INPUTS

CNTL
CA2
MNC
FPC3

MF SW
& KYBD
INPUTS

A FT
S TA

S2
M DU
AFD 1

P4
R11U
M DU

IDP 2

CRT 4

IDP 4

C2

FC 1 - FC
4 DA TA
BUS ES

DK 1 FC 1 - FC
DA TA 4 DA TA
BUS BUS ES

DK 1
DA TA
BUS

FC 1 - FC
4 DATA
BUS ES

DK 1 FC 1 - FC
DA TA 4 DA TA
BUS BUSES

DK 1
DA TA
BUS

R11L
IDP/C RT
4
A B PW R &
AFT
M AJ
KYB D FUNC
UNIT SW s

1088.cv5

MEDS Data Bus Network

IFMs are available to swap out keyboards and
replace individual keys as failures occur.
Each of the four IDPs responds to computer
commands, transmits data, executes its own
software to process keyboard inputs, and sends
signals to drive displays on the MDUs. The
IDPs store display data, generate the displays,
update and refresh on-screen data, check
keyboard entry errors, and echo keyboard
entries to the DPS display shown on the MDU.
MEDS Data Bus Network
Each IDP has its own dedicated 1553B data bus
that connects it to MDUs and two ADCs.

Master Timing Unit

The GPC complex requires a stable, accurate
time source because its software uses
Greenwich mean time (GMT) to schedule
processing. Each GPC uses the master timing
2. SYSTEMS
2.6 Data Processing System

unit (MTU) to update its internal clock. The

MTU provides precise frequency outputs for
various timing and synchronization purposes to
the GPC complex and many other orbiter
subsystems.
Its three time accumulators
provide GMT and mission elapsed time (MET),
which can be updated by external control. The
accumulator's timing is in days, hours, minutes,
seconds, and milliseconds up to 1 year.
The MTU is a stable, crystal-controlled frequency source that uses two oscillators for
redundancy. The signals from one of the two
oscillators are passed through signal shapers
and frequency drivers to the three GMT/MET
accumulators.
The MTU outputs serial digital time data
(GMT/MET) on demand to the GPCs through
the accumulators. The GPCs use this information for reference time and indirectly for timetagging GNC and systems management

2.6-16

USA007587
Rev. A
processing. The MTU also provides continuous
digital timing outputs to drive the four digital
timers in the crew compartment: two mission
timers and two event timers. In addition, the
MTU provides signals to the PCMMUs,
COMSECs, payload signal processor, and FM
signal processor, as well as various payloads.
The GPCs start by using MTU accumulator 1 as
their time source. Once each second, each GPC
checks the accumulator time against its own
internal time. If the time is within tolerance
(less than one millisecond), the GPC updates its
internal clock to the time of the accumulator,
which is more accurate, and continues. However,
if the time is out of tolerance, the GPC will try the
other
accumulators and then the lowest
numbered GPC until it finds a successful
comparison.

For nominal operations, the MTU is using

oscillator 2 with the switch in AUTO. The OSC
1 or OSC 2 position of the switch manually
selects oscillator 1 or 2, respectively.
The MTU is located in crew compartment
middeck avionics bay 3B and is cooled by a
water coolant loop cold plate. The hardware
displays associated with the master timing unit
are the mission and event timers. MISSION
TIME displays are located on panels O3 and A4.
They can display either GMT or MET in
response to the GMT or MET positions of the
switch below the displays. The forward EVENT
TIME display is on panel F7, and it is controlled
by the EVENT TIME switches on panel C2. The
aft EVENT TIME display is on panel A4, and
its EVENT TIME control switches are on panel
A6U.

The PASS GPCs do not use the MET that they

receive from the MTU, because they compute
MET on the basis of current GMT and lift-off
time.
The TIME display (SPEC 2) provides the
capability to observe the current MTU and GPC
clock status, synchronize or update the MTU
and GPC clocks, and set CRT timers and alert
tone duration and timers.

ESS 1BC MTU A and ESS 2CA MTU B Circuit

Breakers on Panel O13
TIME Display (SPEC 2)
The MTU is redundantly powered by the ESS
1BC MTU A and ESS 2CA MTU B circuit
breakers on panel O13. The MASTER TIMING
UNIT switch on panel O6 controls the MTU.
When the switch is in AUTO, and a time signal
from one oscillator is out of tolerance, the MTU
automatically switches to the other oscillator.
2.6-17

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

MISSION TIME and EVENT TIME Displays

and MISSION TIMER Switch on Panel A4

MISSION TIME Display and Switch

on Panel O3

1126.cnv

MASTER TIMING UNIT Switch

on Panel O6
2. SYSTEMS
2.6 Data Processing System

2.6-18

USA007587
Rev. A

1114.cnv

EVENT TIME Display on Panel F7

EVENT TIMER Switches and TIMER SET Thumbwheels on Panel C2

2.6-19

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

EVENT TIMER Switches on Thumbwheels on Panel A6U

programs are written in HAL/S (high-order
assembly language/shuttle) specifically developed for real-time space flight applications.

Software
Primary Avionics Software System (PASS)
The PASS (also referred to as primary flight
software) is the principal software used to
operate the vehicle during a mission.
It
contains all the programming needed to fly the
vehicle through all phases of the mission and
manage all vehicle and payload systems.
Because the ascent and entry phases of flight are
so critical, four of the five GPCs are loaded with
the same PASS software and perform all GNC
functions simultaneously and redundantly. As
a safety measure, the fifth GPC contains a
different set of software, programmed by a
company different from the PASS developer,
designed to take control of the vehicle if a
generic error in the PASS software or other
multiple errors should cause a loss of vehicle
control. This software is called the backup
flight system (BFS). In the less dynamic phases
of on-orbit operations, the BFS is not required.
The information provided below describes how
the PASS software relates to the DPS and the
crew. Much of the material is common between
PASS and BFS; therefore, only BFS differences
are discussed immediately after the PASS
discussion.
DPS software is divided into two major groups,
system software and applications software. The
two groups are combined to form a memory
configuration for a specific mission phase. The
2. SYSTEMS
2.6 Data Processing System

System software is the GPC operating system

software that controls the interfaces among the
computers and the rest of the DPS. It is loaded
into the computer when it is first initialized. It
always resides in the GPC main memory and is
common to all memory configurations. The
system software controls GPC input and output,
loads new memory configurations, keeps time,
monitors discretes into the GPCs, and performs
many other DPS operational functions.
The system software consists of three sets of
programs. The flight computer operating system
(FCOS) (the executive) controls the processors,
monitors key system parameters, allocates
computer resources, provides for orderly
program interrupts for higher priority activities,
and updates computer memory.
The user
interface programs provide instructions for
processing flight crew commands or requests.
The system control program initializes each GPC
and arranges for multi-GPC operation during
flight-critical phases.
One of the system software functions is to
manage the GPC input and output operations,
which includes assigning computers as commanders and listeners on the data buses and
exercising the logic involved in sending
commands to these data buses at specified rates
and upon request from the applications software.

2.6-20

USA007587
Rev. A
The applications software performs the functions required to fly and operate the vehicle. To
conserve main memory, the applications software is divided into three major functions:
Guidance, navigation, and control
(GNC): specific software required for
launch, ascent to orbit, maneuvering in
orbit, entry, and landing. This is the
only major function where redundant
set synchronization can occur.
Systems management (SM): tasks that
monitor various orbiter systems, such as
life support, thermal control, communications, and payload operations. SM
is a simplex major function; only one
GPC at a time can actively process an
SM memory configuration.
Payload (PL):
this major function
currently contains mass memory utility
software. The PL major function is
usually unsupported in flight, which

means that none of the GPCs are loaded

with PL software. It is only used in
vehicle preparation at KSC, and is also a
simplex major function. Note that software to support payload operations is
included as part of the SM GPC memory
configuration.
Major functions are divided into mission phase
oriented blocks called operational sequences
(OPS).
Each OPS of a major function is
associated with a particular memory configuration that must be loaded separately into a GPC
from the MMUs. Therefore, all the software
residing in a GPC at any given time consists of
system software and an OPS major function;
i.e., one memory configuration. Except for
memory configuration 1, each memory
configuration contains one OPS.
Memory
configuration 1 is loaded for GNC at launch and
contains both OPS 1 (ascent) and OPS 6 (RTLS),
since there would be no time to load in new
software for a return to launch site (RTLS)
abort.

Orbiter
flight
computer
software

System
software

Applications
software

GNC
OPS 0
IDLE

SM

PL

OPS 9
Precount/
post
landing

OPS 1
Ascent

OPS 2
Onorbit

OPS 8
Onorbit
CHKOUT

OPS 3
Entry

OPS 2
Orbit/
doors

OPS 4 *
Orbit/
doors

OPS 9
Mass
memory
utility

901
Configuration
monitor

101
Terminal
count

201
Orbit
coast

801
Onorbit
CHKOUT

301
Pre
deorbit
coast

201
Orbit
operations

401
Orbit
operations

901
Mass
memory

102
First
stage

202
MNVR
EXEC

302
Dedeorbit
EXEC

202
PL bay
door
operations

402
PL bay
door
operations

103
Second
stage

105
OMS 2
insrtn

106
INSRTN
coast

OPS

303
Pre-entry
monitor

OPS 6
RTLS

104
OMS 1
insrtn

Major
function

Major
mode

304
601
RTLS
2nd
stage

Entry

602

TAEM/
landing

305

Glide
RTLS-1

* Currently disabled on board.

603
Glide
RTLS-2

222.cvs

Orbiter Flight Computer Software

2.6-21

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Mission
phase

Launch - 20 min
to lift-off

Major mode
(for Ops-1)

101

Launch to
solid rocket
booster sep
102

SRB sep to
external tank
sep maneuver
complete

ET sep to
completion of
OMS-1 burn

103

Completion of
OMS-1 burn to
completion of
OMS-2 burn

Completion of
OMS-2 burn to
selection of
GNC Ops-2

105

106

104

OMS-2
ET Sep
maneuver
complete

OMS-1

SRB
separation

GNC
major
function

Ops-1

Lift-off

Major
mode
101

Major
mode
102

Major
mode
103

Major
mode
104

Major
mode
105

Major
mode
106
223.cvs

Major Modes
During the transition from one OPS to another,
called an OPS transition, the flight crew
requests a new set of applications software to be
loaded in from the MMU. Every OPS transition
is initiated by the flight crew. When an OPS
transition is requested, the redundant OPS
overlay contains all major modes of that sequence.
Major modes are further subdivisions of an
OPS, which relate to specific portions of a
mission phase.
As part of one memory
configuration, all major modes of a particular
OPS are resident in GPC main memory at the
same time. The transition from one major mode
to another can be automatic (e.g., in GNC OPS 1
from precount MM 101 to first stage MM 102 at
lift-off) or manual (e.g., in SM OPS 2 from on-orbit
MM 201 to payload bay door MM 202 and back).
Each major mode has an associated DPS
display, called a major mode display or base
page, that provides the flight crew with
information about the current portion of the
mission phase and allows crew interaction.
There are three levels of DPS displays. Certain
portions of each OPS display can be
manipulated by flight crew keyboard input (or
ground link) to view and modify system
parameters and enter data.
The specialist
function (SPEC) of the OPS software is a block
of displays associated with one or more
operational sequences and enabled by the flight
2. SYSTEMS
2.6 Data Processing System

crew to monitor and modify system parameters

through keyboard entries. The display function
(DISP) of the OPS software is a group of displays associated with one or more OPS. These
displays are for parameter monitoring only (no
modification capability) and are called from the
keyboard. Display hierarchy and usage are
described in detail later in this section.
Backup Flight System
Even though the four PASS GPCs control all
GNC functions during the critical phases of the
mission, there is always a possibility that a
generic software failure could cause loss of
vehicle control. Therefore, the fifth GPC is
loaded with the BFS software. To take over
control of the vehicle, the BFS monitors the
PASS GPCs to keep track of the current state of
the vehicle. If required, the BFS can take over
control of the vehicle upon the press of a button.
The BFS also performs the SM functions during
ascent and entry because the PASS GPCs are all
operating in GNC. BFS software is always
loaded into GPC 5 before flight, but any of the five
GPCs could be made the BFS GPC if necessary.
Because the BFS is intended to be used only in a
contingency, its programming is much simpler
than that of the PASS. Only the software necessary to complete ascent or entry safely, maintain
vehicle control in orbit, and perform SM
functions during ascent and entry is included.

2.6-22

USA007587
Rev. A
Thus, all the software used by the BFS can fit
into one GPC and never needs to access mass
memory. For added protection, the BFS software is loaded into the MMUs in case of a BFS
GPC failure and the need to IPL a new BFS GPC.
The BFS, like PASS, consists of system software
and applications software. System software in
the BFS performs basically the same functions
as it does in PASS. These functions include
time management, PASS/BFS interface, MEDS
interface, input and output, uplink and downlink, and engage and disengage control. The
system software is always operating when the
BFS GPC is not in HALT.

ascent and entry, and in STBY whenever a PASS

systems management GPC is operating. If the
BFS is engaged while the MODE switch is in
STBY or RUN, the BFS takes control of the
flight-critical and payload data buses. The
MODE talkback indicator on panel O6 indicates
RUN if the BFS GPC is in RUN or STBY and
displays barberpole if the BFS is in HALT or has
failed.

Applications software in the BFS has two

different major functions, GNC and systems
management, but all its applications software
resides in main memory at one time, and the
BFS can process software in both major
functions simultaneously. The GNC functions
of the BFS, designed as a backup capability,
support the ascent phase beginning at MM 101
and the deorbit/entry phase beginning at MM
301. In addition, the various ascent abort
modes are supported by the BFS. The BFS
provides only limited support for on-orbit
operations via MM 106 or MM 301. Because the
BFS is designed to monitor everything the PASS
does during ascent and entry, it has the same
major modes as the PASS in OPS 1, 3, and 6.
The BFS SM contains software to support the
ascent and entry phases of the mission.
Whenever the BFS GPC is in the RUN or STBY
mode, it runs continuously; however, the BFS
does not control the payload buses in STBY.
The SM major function in the BFS is not
associated with any operational sequence and is
always available whenever the BFS is active.
Even though the five GPCs and their switches
are identical, the GENERAL PURPOSE
COMPUTER MODE switch on panel O6 works
differently for a GPC loaded with BFS. Since
HALT is a hardware-controlled state, no software is executed. The STBY mode in the BFS
GPC is totally different from its corollary in the
PASS GPCs. When the BFS GPC is in STBY, all
normal software is executed as if the BFS were
in RUN; the only difference is that BFS
command of the payload data buses is inhibited
in STBY. The BFS is normally put in RUN for

GENERAL PURPOSE COMPUTER MODE

Switches and Talkbacks on Panel O6
Pre-engage, the BFS is synchronized with the
PASS set using flight-critical I/O so that it can
track the PASS and keep up with its flow of
commands and data. Synchronization and
tracking take place during OPS 1, 3, and 6.
During this time, the BFS listens over the flightcritical data buses to the requests for data by
PASS and to the data coming back. The BFS
depends on the PASS GPCs for acquisition of all
its GNC data and must be synchronized with
the PASS GPCs so that it will know when to
receive GNC data over the FC buses. When the
BFS is in sync and listening to at least two
strings, it is said to be tracking PASS. As long as
the BFS is in this mode, it maintains the current
state vector and all other information necessary
to fly the vehicle in case the flight crew needs to

2.6-23

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
engage it. When the BFS GPC is tracking the
PASS GPCs, it cannot command over the FC
buses but may listen to FC inputs through the
listen mode. The BFS uses the MTU (like PASS)
and keeps track of GMT over the flight-critical
buses for synchronization.
The BFS also
monitors some inputs to PASS IDPs and
updates its own GNC parameters accordingly.
The BFS GPC controls its own instrumentation/
PCMMU data bus. The BFS GPC requirements
strictly forbid use of the ICC data bus to
monitor or to transmit status or data to the
other GPCs. The mass memory data buses are
not used except during initial program load,
which uses the same IPL SOURCE switch on
panel O6 as used for PASS IPL.

When the BFS is engaged, the BFC lights on

panels F2 and F4 are steadily illuminated, the
BFS's OUTPUT talkback indicator on panel O6
turns gray, all PASS GPC OUTPUT and MODE
talkback indicators on panel O6 display barberpole, the BFS controls the IDPs selected by the
BFC CRT SELECT switch on panel C3, big Xs
and poll fails appear on the remaining PASScontrolled IDPs, and all four GPC STATUS
matrix diagonal indicators for PASS GPCs are
illuminated on panel O1.

The BFC lights on panels F2 and F4 remain

unlighted as long as PASS is in control, and the
BFS is tracking. The lights flash if the BFS loses
track of the PASS and goes standalone. The
flight crew must then decide whether to engage
the BFS or try to initiate BFS tracking again by
an I/O RESET on the keyboard. When BFS is
engaged and in control of the flight-critical
buses, the BFC lights are illuminated and stay
on until the BFS is disengaged.
Since the BFS does not operate in a redundant
set, its fail votes from and against other GPCs
are not enabled; thus, the GPC STATUS light
matrix on panel O1 for the BFS GPC does not
function as it does in PASS. The BFS can
illuminate its own light on the GPC STATUS
matrix if the watchdog timer in the BFS GPC
times out when the BFS GPC does not complete
its cyclic processing.
To engage the BFS, which is considered a last
resort to save the vehicle, the crew presses a
BFS ENGAGE momentary pushbutton located
on the commander's and pilot's rotational hand
controllers (RHCs). As long as the RHC is
powered, and the appropriate OUTPUT switch
on panel O6 is in BACKUP, depressing the
ENGAGE pushbutton on either RHC engages
the BFS and causes PASS to relinquish control.
There are three contacts in each ENGAGE
pushbutton, and all three contacts must be
made to engage the BFS. The signals from the
RHC are sent to the backup flight controller,
which handles the engagement logic.
2. SYSTEMS
2.6 Data Processing System

2.6-24

BFC Light on Panel F2

BFC Light on Panel F4

Rotational Hand Controller

USA007587
Rev. A
switch on panel F6 to the RIGHT position disengages the BFS. The switch sends a signal to the
BFCs that resets the engage discretes to the GPCs.
The BFS then releases control of the flight-critical
buses as well as the payload buses if it is in STBY,
and the PASS GPCs assume command.
After disengagement, the PASS and BFS GPCs
return to their normal pre-engaged states. Indications of the PASS engagement and BFS
disengagement are as follows: BFC lights on
panels F2 and F4 are out, BFS's OUTPUT
talkback on panel O6 displays barberpole, all
PASS OUTPUT talkback indicators on panel O6
are gray, and BFS releases control of one of the
IDPs.
If the BFS is engaged, there is no manual thrust
vector control or manual throttling capability
during first- and second-stage ascent. If the BFS
is engaged during entry, the speed brake can be
positioned using the speed brake/throttle
controller, and the body flap can be positioned
manually. Control stick steering (CSS) by either
the commander or pilot is required during entry.

BFC CRT DISPLAY and SELECT Switches

on Panel C3

Pre-engage, the BFS supplies attitude errors on

the Trajectory display, whereas PASS supplies
attitude errors to the attitude director indicators;
however, when the BFS is engaged, the errors on
the Trajectory display are blanked, and attitude
errors are supplied to the attitude director
indicators.

MEDS
1125.cnv

BFC DISENGAGE Switch on Panel F6

When the BFS is not engaged, and the BFC CRT
DISPLAY switch on panel C3 is positioned to
ON, the BFS commands the first IDP indicated
by the BFC CRT SELECT switch. The BFC CRT
SELECT switch positions on panel C3 are 1 + 2,
2 + 3, and 3 + 1. When the BFS is engaged, it
assumes control of the second IDP as well.
If the BFS is engaged during ascent, the PASS
GPCs can be recovered on orbit to continue a
normal mission. This procedure takes about 2
hours, since the PASS inertial measurement unit
reference must be reestablished. The BFS is
disengaged after all PASS GPCs have been
hardware-dumped and reloaded with PASS
software. Positioning the BFC DISENGAGE

IDP Software
The IDP software manages the edgekey menu
system, generates the graphical displays, and
emulates the display electronics unit (DEU) for
the DPS displays. It also processes data from
the flight-critical, display/keyboard, and 1553
data buses, in addition to the switches and the
keyboards.
The IDP only receives data on the flight-critical
buses. It is able to process data simultaneously
on two different flight-critical buses for flight
instrument displays on different MDUs. The IDP
communicates on the display/keyboard buses on
a two-way command/response basis. The IDP
receives data over the DK bus for updating the
DPS displays. The IDP sends crew inputs and
MEDS health status information to the GPC
when polled by it.

2.6-25

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
The IDP also processes the following panel
switches: IDP load switch, IDP/CRT select
switches (left and right), and the major function
switches. The IDP validates keystrokes made
on the keyboard for syntax. If at least one of the
MDUs controlled by the IDP is displaying the
DPS display, the keystrokes will be validated,
echoed, and included in the poll response of the
IDP to the GPC.
MDU Software
The MDU function (MDUF) software is
responsible for drawing the displays on the
MDU and providing built-in test capability
(BITE).

indicates the port select configuration and

flight-critical data bus selected for that MDU.
The flight-critical data bus selected is the
number displayed next to FC. The port
reconfiguration mode is displayed below the
flight critical data bus information. AUT is
displayed when automatic port reconfiguration
capability has been selected and MAN is
displayed when manual reconfiguration
capability has been selected. Each MDU retains
its current configuration through a power cycle
(except for the menu, which reverts to the menu
associated with the display on the MDU).

MEDS Generic Screen Format

Each MDU screen follows a generic screen
format. The top portion of the screen is denoted
as the MEDS display format. The lower portion
contains the MEDS internal configuration
information. A horizontal cyan line separates
the two portions. The upper portion is blank or
displays the selected MEDS display. At the
bottom, the legends for the edgekeys are
displayed in the six boxes that are aligned with
their respective edgekeys. The color of the
boxes and the labels normally are cyan, unless
they correspond to the current MEDS display,
in which case they are white. A blank edgekey
legend means no option is available for that
edgekey. If the edgekey is pressed, the IDP
ignores it. The menu title is displayed above
the edgekey boxes and legend. The MEDS fault
message line is the line above the menu title.
Any MEDS-generated messages are displayed
in white on this line. Any GPC generated
messages are displayed on the DPS display in
orange (above the cyan horizontal line).
MEDS configuration information is displayed to
the left and the right of the menu bars. The
information to the left indicates which MDU
port is selected and which IDP is connected to
each MDU port. P indicates primary port and
S indicates the secondary port. The numbers
next to the P and S indicate the IDP that is
connected to that port of the MDU. An asterisk
indicates which port (and thus which IDP) is
selected to command the MDU. The information displayed to the right of the menu bars
2. SYSTEMS
2.6 Data Processing System

ME DS DISPLAY

P3*

MEDS FAULT MESSAGE LINE

MENU TITLE LINE

S1

FC3
AUT

1071.CV5

MEDS Generic Screen Format

MEDS Displays
The user may view all flight instrument and
subsystem status information via the various
MEDS displays.
Flight Instrument Displays
The flight instrument displays give the crew
insight into the current attitude, position, and
velocity of the vehicle. During ascent and entry,
the crew can view the Ascent/Entry Primary
Flight Display (A/E PFD). This display consists
of several indicators and gauges giving insight
into the attitude, altitude, position, velocity, and
angle of attack.
For orbit, only attitude
information is used; therefore, another display
is available that consists solely of that data,
called the Orbit PFD. The PFDs work as
described in Section 2.7, Dedicated Display
Systems.

2.6-26

USA007587
Rev. A

CDR 1
OMS/MPS

CRT 3
DPS

CDR 2
A/E PFD
MFD 1
HYD/APU

flight deck. Displayed below them are the four

IDPs. The ADCs and the aft MDUs are displayed graphically below the IDPs. Each of the
LRUs commanded by the current IDP has a blue
background for its box. Each LRU box provides
information about its configuration, status,
and/or comprehensive self-test (CST) results.

CRT 2
DPS

CRT 1
DPS

PLT 1
A/E PFD

PLT 2
HYD/APU

CRT 4
DPS

AFD 1
OFF

MFD 2
OMS/MPS

usa007587_1103r2.cvx
0

Typical Ascent MEDS Layout

143

287

431

719

575

863

1007

1151

DPS Display

143

The MEDS DPS display shows the DPS displays

to the crew. The IDP emulates the old CRT
system using data it obtains over the DK bus.
The DPS display allows the crew to interact
with the GPCs by entering commands via the
keyboards to monitor a variety of systems data.

CD R1
3
1
XX X
XX XX
XX XX
XXX XXX

2
287

3
4
431

In the MEDS-driven portion, a green outlined

box with a number inside of it has been added
just below the scratch pad line and centered
horizontally. The number represents the IDP
that is commanding the MDU.
Subsystem Status Displays
The MEDS Subsystem Status displays are used
to monitor the performance of several systems
in graphical format.
The displays available include an Orbital
Maneuvering System and Main Propulsion
System (OMS/MPS) display, a Hydraulic and
Auxiliary Power Unit (HYD/APU) display, and
a Surface Position Indicator (SPI) display.
For discussion on each of these displays, see the
appropriate section of the SCOM.
MEDS Maintenance Display
The MEDS maintenance display provides an
overview of the current configuration of the
MEDS system as viewed by the commanding
IDP of the MDU. The MEDS maintenance
display shows all the MEDS LRUs as a box. The
forward MDUs are arranged on the display the
same way as they are arranged in the forward

MF D1
2
3
XX X
XX XX
XX XX
XXX XXX

IDP 1
XX XX
XXX XXX
1 2 3 4

4
575

The GPC fill portion of the DPS display is

covered in detail later in this section.

CDR 2
1
2
XX X
XX XX
XX XX
XXX XXX

CRT 1
1
1
XX X
XX XX
XX XX
XXX XXX

719

CRT 3
3
1
XX X
XX XX
XX XX
XXX XXX

IP D2
XX XX
XXX XXX
1 2 3 4

CRT 2
2
1
XX X
XX XX
XX XX
XXX XXX

MF D2
1
3
XX X
XX XX
XX XX
XXX XXX

IDP 3
XX XX
XXX XXX
1 2 3 4

ADC 1A

ADC1B

AD C2A

ADC 2B

XX XX

XX XX

XX XX

XX XX

XXX XXX

XXX XXX

XXX XXX

XXX XXX

PLT1
2
1
XX X
XX XX
XX XX
XXX XXX

IDP 4
XX XX
XXX XXX
1 2 3 4
CRT 4
4
1
XX X
XX XX
XX XX
XXX XXX

PLT2
3
2
XX X
XX XX
XX XX
XXX XXX

AF D1
4
2
XX X
XX XX
XX XX
XXX XXX

863

1007

Identifies IDP connections to P RI/SE C ports

Identifies B IT sum m ary (HEX)

Identif ies F C bus num ber

Identif ies D um p status (TE XT )

or CS T results (HEX)

Identifies R econf ig m ode

1080.CV5

MEDS Maintenance Display

The MDU boxes provide information on the
port configuration, flight-critical bus selection,
and status of the MDU. The first row in the box
indicates the name of the LRU. The second row
denotes the IDPs that are connected to the
primary and secondary ports. The third row
displays the flight-critical bus selected, if that
MDU is displaying a flight instrument display;
otherwise, it is blank. The fourth row indicates
if the MDU is in the AUTO or MANUAL
reconfiguration mode. This reconfiguration
mode is also displayed on the MDUs with
which the IDP is communicating but not
commanding (no blue background). The fifth
row indicates the operational BITE summary in
hex. If one or more bits in the BITE summary
are off nominal, the entire BITE summary
shows red. The sixth row indicates the dump
status (text) or CST results (hex). If one or more
bits in a CST result are off nominal, the entire
CST result is displayed in red. If a CST has not
been performed, the CST results display NOCST in white. The last row of the box contains

2.6-27

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
the version number of the software loaded in
the MDU; e.g., V 0400.
The IDP boxes provide information on the
flight-critical bus selection and status of the
IDP. The first row in the box indicates the name
of the LRU. The second row denotes the
operational BIT summary in hex. If one or more
bits in the BIT summary are off nominal, the
entire BIT summary is red. The third row
indicates the dump status (text) or CST results
(hex). If one or more bits in a CST result are off
nominal, the entire CST result is displayed in
red. If a CST has not been performed, the CST
results display NO-CST in white. The fourth
row indicates which flight-critical data buses
currently are being supported. The buses are
displayed in reverse video. The last row
contains the version number of the software
loaded in the IDP; e.g., V 0300.

user to select the flight instrument menu,

subsystem status menu, the DPS display, and
the MEDS maintenance display and its menu.
0

143

287

431

719

575

1007

863

1151

143

FAULT

287

431

575

TIME

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

XXX/XX:XX:XX

719

863

1007

ID PX FAU LT S UMMAR Y

The ADC boxes provide information on the

status of the ADC. The first row in the box
indicates the name of the LRU. The second row
denotes the operational BITE summary in hex.
If one or more bits in the BITE summary are off
nominal, the entire BITE summary is red. The
last row indicates the dump status (text) or CST
results (hex). If one or more bits in a CST result
are off nominal, the entire CST result is
displayed in red.
MEDS Fault Summary Display
The MEDS fault summary display is the MEDS
equivalent of the GPC fault summary (SPEC
99). The display lists the past 15 MEDS fault
messages and the time of annunciation by the
current IDP.
Edgekey Menu System
The user accesses the edgekey menu system to
control the MEDS system. The MEDS edgekey
operations are organized by function and are
displayed in the proper hierarchy. In general,
edgekeys call up an additional menu, select a
MEDS configuration, select a particular MEDS
display, and initialize internal tests of the
MDUs, ADCs, and IDPs. Except for the top
menu (the main menu), the first edgekey (on the
left) is the up arrow, which allows the user to go
up to the next level. The main menu allows the
2. SYSTEMS
2.6 Data Processing System

UP

CLE A R
M S GS

ME DS
M SG R ST

ME DS
MS G ACK
1081.CV5

MEDS Fault Summary Display

Throughout the various menus, the user can
select MEDS MSG ACK or MEDS MSG RESET.
These edgekey operations are single-stroke
keys. The MEDS MSG ACK works the same as
the keyboard ACK key. The first time that it is
pressed, the MEDS fault messages goes static.
Subsequent pressings of the edgekey scroll
through the remaining MEDS fault messages.
The MEDS MSG RESET clears the MEDS fault
message line just like the MSG RESET key
works for the DPS displays.
The flight instrument menu allows the user to
select either ascent/entry or orbit displays, a
flight critical data bus, or clear the MEDS fault
message line. The A/E PFD displays the COMP
ADI/HSI display. The orbit selection displays
the ADI only.
The data bus select menu
maintains the current flight instrument MEDS
display, but allows the user to choose flightcritical 1 through 4.
The subsystem status menu allows the user to
access the MEDS displays to view the OMS, MPS,
HYD, APU, and SPI information that was
available previously on the analog meters. The
user may swap between these various subsystem
displays with just a single press of the appropriate
edgekey. This menu allows the user to port select

2.6-28

USA007587
Rev. A
on the MDU in case the current commanding IDP
has a problem with an ADC. This submenu also
allows the user to select MEDS MSG ACK.
After selecting the DPS menu, the DPS display
shows automatically. The edgekey options are
the MEDS MSG ACK and MSG RESET.
After selecting the MEDS maintenance menu,
the MEDS maintenance display is displayed
automatically. From this menu, the user can
select any of the following submenus: fault
summary, configuration status, CST, or memory
management.
After selecting the fault summary option, the
MEDS fault summary display is shown. With
this submenu, the user can clear the MEDS fault
messages, similar to a SPEC 99 PRO but for
MEDS. The options to MEDS MSG RESET and
ACK are also included on this menu.
The configuration status submenu allows the
viewer to port select to the alternate IDP,

change its reconfiguration mode to either

AUTO or MAN, or change the viewing mode.
The viewing mode can be changed only for the
Hosiden MDUs (all flight MDUs are Hosiden).
The negative viewing mode enhances the readability of the aft MDUs.
When negative
viewing is selected, NEG VIEW is displayed
above the flight-critical bus selection and
reconfiguration mode on the MEDS status area
of the MDU.
The CST submenu lets the user activate the CST
for the current MDU, the commanding IDP, and
the associated ADC1X and ADC2X for the
commanding IDP. The CST is a test of the hardware and the functional use of the MEDS LRU.
It has both interactive and noninteractive parts
for the IDP and MDU. The ADC CST is not
interactive. During the IDP CST, other MDUs
being commanded by this IDP will blank and
display the message IDP CST INITIATED. The
results of the CST are displayed on the MEDS
maintenance display.
MAIN MENU

SUB SYS TEM

ST AT U S

FLIGHT
INSTR UMEN T

OMS/MPS

A/E
PFD

MEDS
MAINT

DPS

MEDS
MSG R ST

FAULT
SUMM

CS T

CONFIG
STATUS

MEMORY
MGMT

HYD/AP U
ORBI T
PFD
DA TA
BUS
MEDS
MSG R ST

1
2
3
4

CLEAR
MSGS

POR T
SEL EC T

ST AR T
MDU

PORT
SELECT

MEDS
MSG R ST

AUTO /
MANUAL

ST AR T
IDP

MEDS
MSG ACK

MEDS
MSG ACK

NEG
VIEW

ST AR T
ADC1X

SPI

MEDS
MSG ACK

IDP
MDU

MEDS
MSG ACK

ST AR T
ADC2X

ADC1X
ADC2X
FILE
PATCH

1085.cv5

MEDS Edgekey Menu Hierarchy

2.6-29

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
The memory management menu has several
options. The edgekey menu tree does not
display the submenus for each of the possible
selections. In general, the memory management
menu allows the user to dump the EEPROM
and/or RAM for the ADC, MDU, and IDP to
the MSU, load IDP or MDU programs from the
MSU, load an IDP program load from
EEPROM, and patch files on the MSU.
Currently, no crew procedure references these
memory management functions.
MEDS Fault Messages
Each IDP has various messages that it can
annunciate. Each MEDS error can be broken
down into seven categories (A through G, with
A being the most severe). The IDP generates a
MEDS fault message for the categories that
warrant crew notification. The other categories
cause the IDP to notify the ground, archive the
method other than a MEDS fault message.

software change in the GPCs. If a GPC does not

recognize the IDP load request (i.e., it is a GNC
computer), an IDP power cycle recovers full
capability of the IDP with no loss of its critical
formats.
IDP Switches
Switches on panel C2 designate which keyboard
controls each forward IDP. When the LEFT
IDP/CRT SEL switch is positioned to 1, the left
keyboard controls IDP 1; if the switch is
positioned to 3, the left keyboard controls IDP 3.
When the RIGHT CRT SEL switch on panel C2
is set to 2, the right keyboard controls IDP 2; if
set to 3, it controls IDP 3. Thus, flight crew
inputs are made on the keyboards, and data are
output from the GPCs on the DPS displays.

MEDS fault messages for an IDP are displayed

on all commanded MDUs that are showing the
DPS display. If none of an IDPs commanded
MDUs has a DPS display, the IDP will select the
MDU with the highest ranking that is available
for the MEDS fault messages.

Operations
The crew interfaces with the five GPCs via the
four IDPs and their MDUs. This section first
discusses crew operations using PASS, and then
discusses crew operations using the BFS.
IDP Load Switch
The IDP load switch, located on panel O6, is
used to load the critical format information for
the DPS displays. The critical formats form a
skeleton that the IDP uses and fills with GPCprovided data. When the IDP load switch is
toggled and a GPC is running an ops mode that
supports the load (SM OPS 2 or 4, PL OPS 9, or
post-IPL OPS 0), the IDP receives the GPC
information and stores only the critical format
information in the EEPROM (other information
is sent that was used by the old CRT system).
Nominally, the only time the IDP needs to be
loaded with critical formats is after an OI flight
2. SYSTEMS
2.6 Data Processing System

2.6-30

1124.cnv

INTEGRATED DISPLAY PROCESSOR

Switches on Panel O6

USA007587
Rev. A
NOTE
If the LEFT IDP/CRT SEL and RIGHT
IDP/CRT SEL switches are both
positioned to 3, keystrokes from both
keyboards are interleaved.
The aft station panel R11L keyboard is connected
directly to the aft panel R11L IDP; there is no
select switch.
These switch positions also drive the MEDS
colored keyboard bars. If the LEFT IDP/CRP
SEL switch is selected to IDP 3 (in other words,
the commanders keyboard is talking to IDP 3),
a red horizontal bar will be displayed to the left
of the box for IDP 3s DPS display. If the switch
is moved to IDP 1, the red bar will disappear
from IDP 3s DPS display and move to the left
of the box on IDP 1s DPS display. The pilots
keyboard bar is yellow and is displayed to the
right of the box. Red and yellow were chosen,
because the crew already associates the CDR
with red and the PLT with yellow for FDF, food,
etc. Because the DPS displays can be called up
on any MDU, this information is helpful in
knowing which IDP a keyboard is talking to
and which IDPs DPS display is being
displayed. IDP 4s DPS display does not have
any keyboard bars displayed, because only the
aft keyboard can talk to it.
Each IDP has an associated MAJ FUNC switch.
The IDP/CRT 1, 3, 2, MAJ FUNC switches on
panel C2 tell the GPCs which of the different
functional software groups is being processed
by the keyboard units and what information is
presented on the IDPs DPS display. The
IDP/CRT 4 MAJ FUNC switch on panel R11L
functions in the same manner. This threeposition toggle switch allows the crew access to
the GNC, SM, or PL software on a desired IDP.
The GPC loaded with the desired major
function applications software will then drive
this IDPs DPS display. Each major function
accesses an independent set of display data and
functional software.

Possible IDP/Keyboard Assignments in

the Forward Flight Station

MDU Configuration
Overview
Nominally, MDUs are configured to their
primary ports and are in automatic port
reconfiguration mode. CRT MDUs show the
DPS (CRT) display. In general, the CDR and
PLT MDUs display the flight instruments, while
the MFD MDUs display the subsystem displays.
This configuration is similar to the old nonMEDS display configuration.

2.6-31

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Selecting Alternate MDU Ports
Automatic port reconfiguration capability
allows the MDU to swap automatically to the
other port if the MDU loses communication
with the currently selected IDP. Manual port
reconfiguration capability does not do a port
select automatically. The user has to manually
reconfigure the MDU onto its alternate port.
Operationally, MDUs will always be in auto
reconfiguration mode. If an MDU is in manual
mode and loses communication with the
selected IDP, or if an MDU is in automatic
reconfiguration mode and loses communication
with the IDPs on both ports, the MDU is in
autonomous mode. The MDU blanks the MEDS
display and displays the following message:
MDU IS AUTONOMOUS. The menu changes
to allow the user to reconfigure to automatic
port selection, manual primary port, or manual
secondary port.
The user can select alternate ports by navigating
through the MEDS edgekey menus to either the
subsystem menu or the MEDS maintenance
menu. The port select option was included in
the subsystem menu in case of failure of
an ADC. If an ADC that the current IDP com-

mander is using fails, it cannot display all of the

subsystem status information. For the MFD
MDUs, CDR 1, and PLT 2, the IDPs on the
alternate port were wired so that they will
access the other set of ADCs.
A port
reconfiguration allows recovery of all
subsystem status information.
(Note that
nominally, the MFD MDUs display subsystem
status displays.)
Recovering from a Disabled Edgekey
When an edgekey has been disabled, a red X
appears on the edgekey legend box. An edgekey is disabled when it is pressed continuously
for 3 seconds or longer or when MEDS detects
that it failed closed. To recover from an accidental edgekey disable, it is necessary to power
cycle the MDU via its power knob on the
display unit.
Selecting Negative Viewing
The configuration status submenu allows the
viewer to change the viewing mode. The
viewing mode can be changed only for the
Hosiden MDUs. The negative viewing mode
enhances the readability of the aft MDUs.
When negative viewing is selected, NEG
VIEW is displayed above the flight-critical bus
selection and reconfiguration mode on the
MEDS status area of the MDU.

1130.cnv

IDP/CRT Switches on Panel C2

2. SYSTEMS
2.6 Data Processing System

2.6-32

USA007587
Rev. A
Specialist functions (SPECs) are second in the
hierarchy. A SPEC allows crew execution of
other activities in conjunction with a particular
OPS. SPEC displays, like major mode displays,
allow direct crew interface with the software.
Each SPEC has an associated display that
overlays the major mode display when called.
When a SPEC is called, its display rolls in on
top of the major mode display, which is still
active underneath. The SPEC provides access to
an associated portion of the software located in
the GPC. Some SPECs are contained in systems
software, whereas others are resident in the
applications load. A SPEC can be associated
with a major function or an OPS, but the
systems software SPECs can be obtained in
most OPS and major functions. (The list of
SPECs and their availability is found in the DPS
Dictionary.)

1129.cnv

IDP/CRT 4 POWER and MAJ FUNC Switches

on Panel R11L
Display Hierarchy
DPS display organization consists of three
levels of crew software displays within any
given major function.
The display types
parallel the different types of modules used in
the GPC software. The established display
hierarchy within applications software is
operational
sequences
(OPS),
specialist
functions (SPEC), and display (DISP) functions.
The OPS is the highest level of crew software
control within a major function. Each memory
configuration contains one or more OPS. Each
OPS allows the crew to accomplish an associated mission phase task. Several operational
sequences are defined, each covering some
portion of the mission. For example, OPS 1
contains ascent software, OPS 2 contains on-orbit
software, and OPS 3 contains entry software.

Display functions (DISPs) are the lowest level of

software. Each DISP has an associated display
that presents the status of a predefined set of
parameters. Unlike major mode displays or
SPECs, a DISP cannot initiate a change in
software processing because DISP displays do
not permit direct crew interface with the
software. They provide information only.
When called, a DISP overlays the major mode
display and the SPEC, if one is active. Both the
SPEC and the major mode display are overlaid,
and access to them can be easily regained. The
method of terminating the processing of SPECs
and DISPs is discussed later.
The Keyboard
Each keyboard is composed of a 4 x 8 matrix of
32 pushbutton keys. This matrix consists of:

Each operational sequence is further divided

into major modes. Each major mode has an
associated display that allows direct crew interface with the software. These are OPS pages,
and are also referred to as major mode pages.

2.6-33

Sixteen alphanumeric keys: 0 through 9

and A through F, for a hexadecimal
numbering system.
Two sign keys (+ and -) serving the dual
roles of sign indicators and delimiters.
A delimiter is used to separate discrete
keyboard entries from their associated
data.
One decimal point key for use in
entering data with decimal notation.

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Thirteen special function keys: some of
these keys are single stroke commands,
and some are keys that start or finish a
multi-stroke command sequence. A key
that starts a command sequence is a
command initiator and requires a
command terminator key to be
depressed to tell the IDP the keyboard
entry is complete.

message indicator (if any) from the fault

message line. The fault message line is the
second to the last line on the DPS display.
Depressing this key will also extinguish all
software-driven
caution
and
warning
annunciators, software-controlled tones, and the
SM ALERT light.
An ILLEGAL ENTRY
message can only be cleared with the MSG
RESET key.
SYS SUMM is used to invoke the SYS SUMM
display.
The particular display called is
determined by the selected major function and
active OPS.
FAULT SUMM is used to invoke the FAULT
display. It operates as a single keystroke command. The FAULT display can be accessed in
every major function and OPS.
GPC/CRT initiates a multistroke keyboard
entry, allowing the selection of a particular GPC
to drive an IDP.
I/O RESET attempts to restore a GPC's
input/output configuration to its original status
prior to any error detection. It is a command
initiator and requires a terminator keystroke.
ITEM is used as a multi-keystroke command
initiator for changing the value of defined
parameters or implementing configuration
changes on a given display (OPS or SPEC).
EXEC acts as a multi-keystroke terminator to
command the execution of the action specified
on the scratch pad line. It is the terminator for
the initiators above it (GPC/CRT, I/O RESET,
and ITEM keys). EXEC may also be a single
keystroke command to enable an OMS burn.

Multifunction Electronic Display System

Keyboard Unit on Panels C2 and R11L
Each of these keys is discussed below.
ACK acknowledges receipt of a fault message
on the fault message line by causing the
message to become static and by extinguishing
the SM ALERT light and software-controlled
tones. If multiple messages are indicated on the
DPS display, each subsequent press of the ACK
key will bring up the next oldest
unacknowledged message and clear out the last
acknowledged one.
MSG RESET operates as a single keystroke
command that clears both the currently
annunciated fault message and the buffer
2. SYSTEMS
2.6 Data Processing System

OPS serves as a multi-keystroke initiator to

load a desired OPS load from mass memory
into one or more GPCs. It is also used to
transition from major mode to major mode
within an OPS.
SPEC acts as a multi-keystroke initiator to select
a defined SPEC or DISP display within a given
OPS.
In addition, this key provides the
capability to freeze a DPS display. A single
depression of the SPEC key freezes the display
so it may be statically viewed. The display will
remain frozen until another key (other than
ACK, MSG RESET, or another SPEC) is entered.

2.6-34

USA007587
Rev. A
PRO (Proceed) serves as a terminator to the
OPS and SPEC keys. The completed command
sequence initiates the selection of a desired
OPS, SPEC, or DISP display.
RESUME is used to terminate a displayed SPEC
or DISP. The highest level SPEC or DISP is
cleared and the underlying display is brought
to the forefront upon depression of this key.
CLEAR clears the last echoed keystroke from
the bottom line (scratch pad line) of the DPS
display. For each depression, one additional
keystroke is removed, proceeding from right to
left. After a command sequence is completed, a
single depression of the CLEAR key will erase
the static command from the scratch pad line.

Selection of a major mode does not involve a

mass memory access. Advancing major modes
is done by the same keyboard command as
loading an OPS. The first digit will be the same
as the OPS number, but the last two digits
specify the major mode. For example, to go to
GNC MM 202, enter OPS 2 0 2 PRO.
Within each OPS, certain SPEC and DISP
displays are available. The steps for selecting a
SPEC or a DISP are as follows:
1.

Depress the SPEC key. The SPEC key is

used in calling both SPEC and DISP
displays.

2.

Key in the SPEC or DISP number omitting

all leading zeros.
SPEC and DISP
numbers have three digits. They are
differentiated by their numbering
scheme. The display is a DISP only if
the first digit is a 9, or if the last digit
is a 6 through 9. To illustrate the
method for keying in SPEC and DISP
numbers, DISP number 106 would be
keyed in as "106"; SPEC number 034
would be keyed "34"; DISP number
066 would be keyed "66"; and SPEC
number 001 would be keyed "1."

3.

Depress the PRO key.

Display Selection Procedures

The crew can select a variety of DPS displays in
numerous ways. Some of the different ways to
select an OPS display and its available SPEC
and DISP displays are as follows:
Selection of the major function is done
by placing the MAJ FUNC switch (on
panel C2) associated with the IDP in use
in the GNC, SM, or PL position.
An OPS is loaded from the MMU via a
three-step keyboard entry. A new OPS
is called from mass memory by its first
major mode. The OPS is loaded into the
GPC that is currently driving the IDP on
which the keyboard entry is performed.
Once the OPS is loaded, access is
provided to major modes in that OPS.
Major mode displays are advanced by
the same keyboard command. The steps
for selecting an OPS display are as
follows:
1.

Depress the OPS key.

2.

Key in the three numbers of the

desired OPS.
The first digit
defines the OPS and the next two
digits specify the major mode.

3.

OPS and Major Mode Transitions

Transitions from major mode to major mode or
to another OPS are accomplished by either
automatic transitions or proper command entry.

Depress the PRO key. Once the

OPS is loaded into one or more
GPCs, that software can be
accessed at any time through any
IDP in the proper major function.
2.6-35

Automatic transitions:
Some major
mode transitions occur automatically,
usually as a function of some mission
event. Examples of automatic transitions are between major modes 101 and
102 (SRB ignition) and between major
modes 102 and 103 (SRB separation).
Selection of an RTLS abort also results in
an automatic OPS transition.
Command entry: Proper command entry
(OPS XXX PRO) is almost always used to
transition from one OPS to another. In
most cases, it is also a legal transition
operation for proceeding from one major
mode to the next (e.g.; 301 to 302).

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Display Retention Hierarchy

Display Sequencing, Overlaying,

and Retention

Major mode transitions: Both SPECs

and DISPs are retained during a major
mode transition. If a SPEC or DISP is
overlaying the major mode display, the
new major mode display can't be seen
until the overlaying displays are
terminated with the RESUME key.

Certain rules have been established for

proceeding from one display to another. These
can be categorized into treatment of proper
display sequencing, the overlaying of current
displays by new displays, and the display
retention hierarchy.

Major function change: OPS and SPEC

displays are retained within their major
function when major function positions
are switched. When the crew returns to
the first major function, the SPEC last
viewed will appear on the screen.
Depression of the RESUME key will
restore the underlying OPS. If no SPEC
had been selected, return to a major
function would restore the last major
mode display. DISP displays are not
retained at major function switch
transitions.

SPEC and DISP Displays

The hierarchy of overlaying SPECs and DISPs
makes sense if one remembers that a SPEC
allows crew interaction and control of
specialized operations, whereas a DISP
provides display information only. Both SPECs
and DISPs overlay the current major mode
display when called.
A SPEC need not be previously selected in
order to call a DISP. If a DISP is active, and
another SPEC or DISP is called, the current
DISP is terminated. The terminated DISP can
only be viewed again by entering its calling
command once more.

OPS transition:
SPECs, DISPs, and
major mode displays are not retained
through an OPS transition, since this
involves loading an entirely new
module of applications software in the
GPC. The SPECs may be called again if
they are available in the new OPS.

If a SPEC is selected, and a DISP is called to

overlay it, the SPEC is retained underneath the
DISP. If another SPEC is then selected, the
underlying SPEC as well as the DISP over it is
terminated. The terminated SPEC can only be
viewed again if it is recalled.
The RESUME key is used as a single keystroke
entry to terminate the SPEC or DISP currently
being displayed and to restore the underlying
display. If the display being terminated is a
DISP, control will be restored to the underlying
SPEC, or to the OPS display if no SPEC has been
selected. If a SPEC display is terminated, IDP
control is restored to the major mode display. It
is advisable to press RESUME after completing
viewing any SPEC or DISP to avoid confusion
and to eliminate locking out certain ground
command functions that are inhibited when
certain SPECs are active or underlying a DISP;
i.e., SM60 and SM62. The RESUME key cannot
be used to transition from one major mode
display to another or to page backwards
through major mode displays.

2. SYSTEMS
2.6 Data Processing System

Standard Display Characteristics

Standard Display Features
Two discrete brightness intensities for
displayed characters are designated "bright"
and "overbright." The bulk of all material is
displayed
in the "bright" intensity. Special messages and
special characters, such as parameter status
indicators, are displayed in "overbright," which
appears in a yellow font, to direct the crew's
attention during their display scan.
Certain words and messages are designed to
flash on and off. Fault messages will flash,
indicating a message that needs to be
acknowledged.
Command initiators are
designed to flash until the command is
completed, and an incorrect keyboard entry will
result in a flashing "ERR" to the right of the
erroneous entry.

2.6-36

USA007587
Rev. A
SPEC number
OPS
DISP number
number

2011/000/

GPC MEMORY

MEM/BUS CONFIG
1 CONFIG 3(G3)
2 GPC
1 2 3 4 0
STRING

P/L
CRT

LAUNCH
MM
OPS
OPS

Uplink
GPC
Display title indicator driver

1
2
3
4
1/2

7
8
9
10
11

1
2
3
4
1

1
2
3
4

12
13
14
15

1
2
3
0

1
2
1
2

16
17
18
19

0
0
1
2

3 UPLINK 50
3 INIT 51

UL

READ/WRITE
GNC
DATA 20*
BIT SET 22
CODE 21
BIT RST 23
26 ENG UNITS___
ADD ID
DESIRED
28 ______ 29
30
31
32
33
34
35
36
37
38
39
MEMORYDUMP
40 START ID______
41 NO WORDS________
42 WDS/FRAME____
DUMP START/STOP 43
44 DOWNLIST GPC 1
OPS 0 ENA 49
ERR LOG RESET 48

Mission
timer

CRT
timer

008/12:12:12
000/00:29:12
SEQ ID 24
WRITE 25
HEX 27*
ACTUAL

STORE MC=O2
45 CONFIG
46 GPC
STORE 47
MM AREA
PL 52 1
GNC 53 1
SM 54 1

S69 FUEL CELL

ITEM 23 EXEC
Fault message line

Scratch pad line

usa007587_234r1.cvx

Formatting Conventions Common to All Displays

Formatting Similarities
OPS number: The four-digit field in the upper
left corner of the first line designates the number
of the OPS display being processed. The first
digit represents the OPS; the next two digits
indicate the major mode. The last digit is always
a "1," and it is not used when making keyboard
entries.
SPEC number: Directly to the right of the OPS
number is a three-digit field. This field displays
the number of the SPEC overlaying the OPS.
This field is blank if no SPEC is selected.
DISP number: The last field in the upper left
corner represents the DISP number. It is a
three-digit field. This field is blank if no DISP is
currently being displayed.
Display title: Centered on the top line of the
display is the title of the display. Portions of some
titles are dynamic and will specify the mission
phase.
Uplink indicator: Directly to the right of the
display title is a two-space field. When an uplink to the GPC is in progress, a flashing "UL"
will be displayed. Otherwise this field is blank.
GPC driver: To the right of the uplink indicator
is a one-digit field. A number in this field indicates the particular GPC (1, 2, 3, 4, or 5) that is
commanding the IDP.

GMT/MET clock: This field displays time in

days, hours, minutes, and seconds (DDD/HH:
MM:SS). The field is updated every second. The
time displayed may be either GMT or MET
selectable via a keyboard entry to the SPEC 2
TIME display.
CRT timer: Directly below the GMT/MET
clock is a CRT timer field also displayed in
days,
hours,
minutes,
and
seconds
(DDD/HH:MM: SS). This field is also updated
every second, and can be set via a keyboard
entry to the TIME SPEC display.
Fault message line: The second line from the
bottom is reserved for fault messages. Illegal
keyboard entry messages and systems fault
messages are displayed on this line. In the case
of system faults, a number in parentheses to the
far right on this line indicates the number of
fault messages that have not been viewed and
acknowledged (further discussion of fault messages is covered in a later section).
Scratch pad line: The bottom line of the display
echoes keyboard entries made by the crew.
Command initiators (OPS, SPEC, ITEM,
GPC/CRT, and I/O RESET) will flash on the
scratch pad line until the command is terminated. The keystrokes remain on the scratch
pad line in a static mode until (a) a new
command is initiated, (b) the CLEAR key is
depressed, or (c) the MAJOR FUNC switch
position is changed. Keyboard syntax errors

2.6-37

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
detected by the IDP will result in a flashing
"ERR" on the scratch pad line following the
keyboard entry.

displaying the appropriate "up arrow" or "down

arrow" next to the parameter on the appropriate
display.

Specially Defined Symbols

In the case where the transducer limit is the

same as the operational limit, the "H" symbol
overrides the "up arrow" symbol. Several (normally two) consecutive readings verify this status
before the "up arrow" symbol is displayed.

These symbols include an asterisk and a set of

parameter status indicators. Parameter status
indicators are displayed in "overbright" intensity for quick recognition.
These special
symbols are defined as follows:
M: This symbol indicates missing data. It is
displayed directly to the right of the affected
parameter.
The parameter value may be
blanked, or the last value received by the GPC
may be displayed. If data are missing for a
parameter that has no numerical value
associated with it, then an M is used to indicate
the parameter status.
H: This symbol indicates that a parameter is
off-scale high. This indicates a transducer limit
has been reached, and the scale is registering its
highest possible value. The actual parameter
being measured may, in fact, be higher than the
recorded data, but the instrument in use does
not have the capacity to measure the value.
Off-scale high indicators do not appear on the
display until several (normally two) consecutive
readings have verified this finding.
This
symbol is displayed to the right of the data
affected.
L:
This symbol indicates off-scale low
parameters. This means that the parameter
value displayed is the lowest possible reading
due to transducer limitations. The actual value
of the parameter may exceed the displayed
value, but the range of the hardware is not
defined to evaluate this reading. As with the
"H," the off-scale low indicator is not displayed
until a set number of consecutive readings have
verified this status.
Up arrow: This symbol, displayed to the right
of the affected parameter, indicates a parameter
driven out-of-limits high. The value displayed
is a true reading but has equaled or exceeded
the operational high limit established by the
software. The fault detection and annunciation
(FDA) software keeps track of the low and high
limits for each parameter and annunciates any
violation of these limits to the crew by
2. SYSTEMS
2.6 Data Processing System

Down arrow: This symbol indicates that a

parameter value is equal to or less than the
operational low limit. The value displayed is
outside the software limits placed upon the
parameter. When the software limit established
is the same as the transducer limit, the "L"
symbol takes precedence over the "down arrow"
symbol. A set number of consecutive readings
verifies this indication before the "down arrow"
is displayed.
In addition, the down arrow is used to indicate
a discrete state that does not agree with the
nominal state. For example, a high pressure gas
supply valve state reading "closed" when its
position is normally "open" would drive the
"down arrow" symbol.
The down arrow is also used to indicate that a
hardware unit has been declared failed by a GPC.
?:
This symbol indicates a redundancy
management dilemma. That is, if two hardware
units measuring the same parameter disagree,
and the software cannot isolate which of the
two is failed, a "?" will be displayed in both
places.
*: This symbol indicates an active state or the
selected item of mutually exclusive items.
Item Operations
Within a given display, certain operations can
be performed by the crew. Those items that
may be altered are identified by an item
number. The item number is a maximum of
two digits and is placed in such a way that it is
readily identifiable with the parameter or status
configuration with which it is associated. When
item numbering is obvious, item numbers may
be implied and will not appear on the display.
Item numbering is sequentially ordered for each
display. There are never more than 99 items per
display. The two basic types of manipulations

2.6-38

USA007587
Rev. A
that the crew can perform are item
configuration change and item data entry.

Item Configuration Change

This operation allows the crew to choose any of
a number of options or to initiate a specific
action as defined by the particular display
format. Typical purposes of this operation
include selecting or deselecting an item, initiating and executing an action, and altering
software configurations. The procedure used in
performing an item configuration change
within a selected display is as follows:
1.

Depress the ITEM key.

2.

Key in the item number.

3.

Depress the EXEC key.

Item Data Entry

This operation lets the crew load data into the

software. Typical purposes include initializing
parameters, changing software limits, and
specifying memory locations. The procedure to
perform an item data entry is as follows:

Specially Defined Symbols on DPS Displays

2.6-39

1.

Depress the ITEM key.

2.

Key in the item number. Item numbers

are ordered sequentially (1, 2, 3, . . .) on
each display. They are located next to
the parameter to which they are
assigned. Some item numbers must be
inferred by their surrounding item
numbers.

3.

Key in a delimiter ("+" or "-"). A

delimiter serves to separate item
number codes from their corresponding data. The delimiter whose sign
corresponds to the sign of the data
should be used, but if no sign is
associated with the data, it doesn't
matter which delimiter is used. A "[ ]"
after the data field indicates that the
entry is sign-dependent.

4.

Key in the data.

Data size
specifications depend on the format
established for that particular data
load. Usually, the data size will be
indicated with an underline for each
digit. As a general rule, leading zeros
need not be entered. Remember that
the sign of the delimiter is the sign of
the data.

5.

Depress the EXEC key.

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Multiple Data Entries

Special Operations and Displays

Multiple item configuration changes cannot be

done; but multiple item data entries can. Multiple
data entries can be made with separate command
strings. This is time-consuming, so the software
allows more than one data entry to be made with
one command sequence. The procedure is the
same as above, except step 4 (after data are keyed
in). Add step 4a to make more than one item data
entry at once.

GPC/CRT Assignment

4a. Key in a delimiter. Consecutive data

entries may be loaded by using a
delimiter to separate each parameter.
Item entries are incremented sequentially so the item number need not be
entered for each parameter following
the one already entered.
Just hit
another delimiter, and the next item
number will appear, ready to receive its
associated data.
To skip an item
number, hit a delimiter twice. This
way, any amount of item numbers may
be skipped until the desired item
number is reached.
Both the "+" and the "-" keys can be interchangable as delimiters. However, if skipping
item numbers, it is a good idea to use the
delimiter corresponding to the sign of the next
data entry if there is any sign associated with it.
Using the sign key corresponding to the next
data entry ensures that the GPC receives the
proper data entry.

GPC assignment to a certain IDP is determined

via a predefined table of assignments. The table
is stored in all the common set GPCs' systems
software; the crew can manipulate it. There is a
table for each memory configuration (MC) that
is valid when that MC is active (loaded in one
or more GPCs), and the particular major
function is selected. The table can be changed
via the GPC MEMORY display (SPEC 0). The
current GPC driver for an IDP is controlled by
the MAJ FUNC switch. That is, the position of
the MAJ FUNC switch (GNC, SM, or PL)
determines the GPC with which the IDP
communicates. In some cases, a redundant set
of GPCs is formed for GNC, and the GNC IDPs
are normally split among them. This is done
with the predefined table. The table is looked at
by the GPCs when they are loaded with the
applications software, and that is when the
assignments take effect.
Another way to change the current GPC
assignment logic is with the GPC/CRT key.
(The old cockpit configuration consisted of a set
of CRTs. The key is still labeled GPC/CRT,
although its function is to assign a GPC to
command an IDP). The GPC/CRT key allows
the crew to reassign an IDP to a different GPC
commander. The steps for selecting a GPC to
command a given IDP are as follows:

A sample multiple item data keyboard entry is:

ITEM 7 + 2 + 1 + + 2 + - - 2 EXEC
In this example, Items 7, 8, 10, and 13 have no
sign associated with them so the sign of the
delimiters does not matter. There is room for
four item entries here, but the actual number
allowed on the scratch pad line is a function of
the size of the data.
This entry appears on the scratch pad line of the
corresponding IDP as:
ITEM (07) + 2 (08) + 1 (10) + 2 (13) - 2 EXEC.
All item operations will be one of these two
basic manipulations. However, data size and
form will differ for each display.
Remember, only OPS and SPEC displays allow
item operations. A DISP display does not.
2. SYSTEMS
2.6 Data Processing System

1.

Depress the GPC/CRT key.

2.

Key in the desired GPC number (1, 2, 3,

4, or 5).

3.

Key in the desired IDP number (1, 2, 3,

or 4). No delimiter is needed between
the GPC and the IDP numbers.

4.

Depress the EXEC key.

An assignment is not executed if the assigned

GPC does not have the applications software in
memory to support the IDP in its current major
function. If the GPC specified by a keyboard
entry is not a valid assignment, the reassignment does not occur, and the GPC driver
retains the IDP. Thus, if an IDP is in GNC, and
an attempt is made to assign a GPC that is not
in the redundant set to drive it, a redundant set
(or valid) GPC will drive the IDP instead of the
invalid GPC. If GPC 4 is the SM machine (nom-

2.6-40

USA007587
Rev. A
inal configuration), it is the only valid GPC to
drive an IDP whose MAJ FUNC switch is in SM.

OPS 1 to SM OPS 2), a new MFB is loaded from

the MMU along with the OPS overlay.

The payloads major function is usually

unsupported, which means that none of the GPCs
have payload applications software loaded. Any
GPC can be assigned to drive an IDP in an
unsupported major function. The GPC that was
driving the IDP in the previous major function
retains the IDP when it is placed in PL.

The controls for performing an OPS transition

(i.e., loading a new memory configuration into
the GPC from the MMU) are on the GPC
MEMORY display (SPEC 0), which is also the
OPS 0 OPS display. Item 1 determines the
memory configuration (CONFIG) to be loaded.
Currently, there are eight different memory
CONFIGs, besides memory CONFIG 0, which is
post-IPL OPS 0(no applications software loaded).

If the keyboard entry specifies a valid GPC, it

overrides any assignment made by the software.
The keyboard entry assignment remains in effect
whenever the MAJ FUNC switch is in a position
supported by that GPC. A new assignment can
be made via the keyboard.
The GPC/CRT key can also be used to isolate
an IDP from communication with all GPCs.
This is done by using "0" for the number of the
GPC. The PASS set can drive only three of the
four IDPs at one time, so at least one IDP is
always isolated from PASS.
The IDP drives a big X over its DPS display to
remind the crew that the IDP is not receiving
data. The IDP also annunciates a POLL FAIL
message to inform the crew that the GPC is no
longer successfully polling the IDP (not
attempting to communicate with the IDP).
Memory Configurations
After a GPC has been IPL'd, the only software
resident is the systems software, and the GPC is
in OPS 0 when moded to RUN. Any applications software is loaded in from the MMU
during an OPS transition. There are two levels
of applications software: the major function
base (MFB) and the OPS overlay. The MFB is
the software common to all OPS in a particular
major function. For GNC, the MFB contains
flight-critical software and data that are
retained from one mission phase to another;
e.g., the current state vector and inertial
measurement unit processing. When a GPC
transitions from one OPS to another in the same
major function (e.g., from GNC OPS 1 [ascent]
to OPS 2 [orbit]), the MFB remains in main
memory, and only the OPS overlay is loaded
from the MMU and written over the old OPS.
Of course, when the major function changes
(e.g., when GPC 4 is transitioned from GNC

MCC

ABBREV

1
2
3
4
5
6
No MC 7
8
9

(G1)
(G2)
(G3)
(S2)
(S4)
(P9)

GNC OPS 1 and 6 combined (ascent and aborts)

GNC OPS 2 (on orbit)
GNC OPS 3 (entry)
SM OPS 2 (on orbit)
SM OPS 4 (on orbit [not used])
PL OPS 9 (preflight)

(G8)
(G9)

GNC OPS 8 (on orbit checkout)

GNC OPS 9 (preflight/postflight)

Memory Configurations
Nominal Bus Assignment Table
Associated with each memory configuration is a
nominal bus assignment table (NBAT). It is
displayed via items 7-19 on SPEC 0 whenever a
memory configuration is entered, and it tells
which GPCs are in the target set and which
GPCs are to be in command of each data bus.
The nominal assignments are already loaded in
GPC main memory preflight. However, these
bus assignments may be changed any time,
including when an OPS transition is performed.
A typical NBAT is shown on SPEC 0 GPC
MEMORY for GNC OPS 3.

2.6-41

2011/000/

GPC MEMORY

MEM/BUS CONFIG
1 CONFIG 3(G3)
2 GPC
1 2 3 4 0
STRING

P/L
CRT

LAUNCH
MM
OPS
OPS

1
2
3
4
1/2

7
8
9
10
11

1
2
3
4
1

1
2
3
4

12
13
14
15

1
2
3
0

1
2
1
2

16
17
18
19

0
0
1
2

3 UPLINK 50
3 INIT 51

READ/WRITE
GNC
DATA 20*
BIT SET 22
CODE 21
BIT RST 23
26 ENG UNITS___
ADD ID
DESIRED
28 ______ 29
30
31
32
33
34
35
36
37
38
39
MEMORYDUMP
40 START ID______
41 NO WORDS________
42 WDS/FRAME____
DUMP START/STOP 43
44 DOWNLIST GPC 1
OPS 0 ENA 49
ERR LOG RESET 48

008/12:12:12
000/00:29:12
SEQ ID 24
WRITE 25
HEX 27*
ACTUAL

STORE MC=O2
45 CONFIG
46 GPC
STORE 47
MM AREA
PL 52 1
GNC 53 1
SM 54 1
usa007587_238r1.cvx

Sample NBAT Data on GPC MEMORY

Display (SPEC 0)

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Items 2-6 determine which GPCs will be
in the OPS. They are referred to as the
"target" GPCs. In this case, GPCs 1-4 are
in a redundant set. If a GPC is not to be
in that OPS, a 0 is entered in that GPC's
item number, which is one more than the
GPC number. (Item 2 is for GPC 1, etc.)
The commanders of the flight-critical
data buses or strings are entered in
items 7-10. (String 1 is FF1 and FA1,
etc.) In this case, each GPC is set to
command its same-numbered string.
The two PL buses are assigned together.
For OPS 1 and 3 they are assigned to
GPC 1 via item 11 in case the BFS fails.
When the BFS is in RUN (as it is for
entry), it commands the PL data buses.
The CRT portion of the NBAT refers to
which GPCs are assigned to command
the IDPs over the DK bus (the word CRT
remains from the previous CRT cockpit).
IDPs 1, 2, 3 are assigned to GPCs 1, 2, 3
respectively, via items 12-14. Since the
PASS can only control three IDPs at a
time, no GPC is assigned to IDP 4 during
entry. Note that IDP assignments are for
a particular major function only.

store.
This display is initialized with all
assigned to MMU 1, and execution of any of the
item numbers causes the appropriate MMU to
be assigned. Note that each of the pairs of item
numbers is mutually exclusive.
When a GPC needs to access mass memory, this
table tells it which MMU to use. For example,
the SM GPC may need to call a roll-in SPEC or
take a checkpoint (discussed later). In the case
of OPS transitions, if the MMU selected is busy
or fails twice, then the other is automatically
tried. For a GNC OPS transition where a
redundant set is involved, one GPC is assigned
to each mass memory bus via items 18 and 19
on SPEC 0 GPC MEMORY. The indicated GPC
will command the mass memory bus selected
by item 1 or 2 on SPEC 1 DPS UTILITY, then the
other GPC will command the next mass
memory bus if the first transaction fails. Of
course, all GPCs in the redundant set will be
listening over both buses and receive the overlay.

The launch data buses are assigned via

items 16 and 17. Since they have no
function during entry, they are
deassigned.
Items 18 and 19 show that GPC 1 will
command mass memory bus 1 for the
OPS 3 transition, and GPC 2 will command mass memory bus 2, either if the
transaction fails on mass memory bus 1
or if MMU 2 is prime selected on SPEC 1
DPS UTILITY.
MMU Assignment
Because there are two identical MMUs, there
must be a method to tell the GPCs which one to
use for a particular transaction. This is done on
DPS UTILITY SPEC 1 display via items 1
through 8. Only one MMU (and its data bus) is
assigned to each major function. A post-IPL
OPS 0 GPC also has an MMU assigned to it for
requesting freeze-dry software for a memory
2. SYSTEMS
2.6 Data Processing System

DPS UTILITY Display (SPEC 1)

Software Memory Source Selection
During an initial program load (IPL), an MMU
is selected as the software source via the IPL
SOURCE switch on panel O6. This switch is a
three-position toggle switch that will be either
in the MMU 1 or MMU 2 position during the
IPL sequence. At all other times, this switch
will nominally be in the OFF position.
The controls for selecting the memory source
for an OPS transition and the bus over which it
is loaded into the GPCs are on SPEC 1 DPS

2.6-42

USA007587
Rev. A
UTILITY (items 9 through 11). The display is
initialized with item 9 selected, which is almost
always used. As part of the GPC status exchanged at common set sync, each GPC
exchanges its current resident memory configuration. When a request is made for a
memory configuration, the software determines
whether or not another GPC already has the
requested OPS or a current major function base.
If another GPC already has any of the requested
software, the lowest numbered such GPC will
be used as a source for the other GPCs. Such a
GPC-to-GPC overlay of software will be done
over the mass memory data buses. An overlay
that is not available from a GPC will be loaded
from an MMU. Note that the major function
base may come from another GPC and the OPS
overlay from mass memory. For transitions to
OPS 3, the G3 archive (stored in the upper 128 k
of main memory prelaunch) is simply copied to
lower memory and executed.

This would only be used if the software in a

current GPC was suspect for some reason.
If there is no usable GPC source and the
selected MMU is off or being used for another
memory transaction, the class 3 fault message
OFF/ BUSY MMU 1 (2) is initiated. The current
status of each MMU is shown on the DPS
UTILITY display as either RDY (ready to
respond) or BSY (off or currently responding to a
GPC command).
Resetting I/O Configurations
When a GPC detects an error or is missing data
from a piece of equipment, a fault message will
be displayed on the appropriate DPS displays,
the SM ALERT light and tone will be activated,
and further attempts by the GPC to
communicate with the equipment will be
terminated. Two common causes of detected
errors or missing data are the powering down
of equipment or an error in a data transmission.
In these two cases, if the equipment is to be
powered up, or if the error has been corrected, it
is desirable to restore the GPC's data input to
the nominal configuration. Restoring input is
done through the I/O RESET key in the affected
major function. If an I/O RESET is performed
only on a GNC GPC, the entire redundant set of
GNC GPCs will be restored to nominal I/O
configuration. If it is performed on the SM
GPC, only the SM GPC's I/O configuration will
be restored to nominal.
To reset I/O
configurations, the procedure is to:
Select desired MAJ FUNC.
Depress the I/O RESET key.
Depress the EXEC key.

IPL SOURCE Switch on Panel 06

If there is a problem with both of the mass
memory data buses, then item 11 may be selected if there is a GPC source for both overlays.
In this case, the GPC-to-GPC overlay is done
over the launch data buses.
Memory reconfiguration may be forced from an
MMU, regardless of other GPC sources, by
selection of item 10 on the DPS UTILITY display. In this case, whether both are required or
not, both the major function base and the OPS
overlay will be loaded from mass memory.

If the powered down equipment has been

powered on, or if a problem with a piece of
equipment has been fixed, an I/O RESET
resumes communication, and does not cause
another fault message annunciation. If the GPC
still has a problem with any piece of assigned
equipment, a fault message reannunciates after
an I/O RESET. This termination of attempts by
the GPC to communicate with its assigned
equipment is called a commfault (i.e., the input
element has been bypassed by the GPC) and the
resultant loss of input data to applications
software is also referred to as a commfault.

2.6-43

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
Systems Summary Displays
Systems summary displays provide general
systems status information that can be accessed
quickly to aid immediate diagnosis of a
problem. They are designed to support the
caution and warning (C/W) matrix located on
panel F7. When a C/W alarm occurs, the crew
can call a systems summary display that has
general information from several systems to
pinpoint the problem to a specific system, then
continue troubleshooting the problem on
system-specific SPECs, DISPs, and hardware
panels. The systems summary displays are
DISPs and provide information only.
The systems summary displays are major
function-specific and are called with the SYS
SUMM key. If an IDP's MAJ FUNC switch is in
GNC, and the SYS SUMM key is pressed, GNC
SYS SUMM 1 will appear on that IDP. GNC
SYS SUMM 1 is DISP 18 so it may also be called
with a SPEC 18 PRO, but it is faster to use the
SYS SUMM key.

PASS GNC SYS SUMM 2, available in GNC

OPS 1, 6, 2, 8 and 3

There are four PASS systems summary

displays: GNC SYS SUMM 1, GNC SYS SUMM
2, SM SYS SUMM 1, and SM SYS SUMM 2.
The SYS SUMM key is a toggle function in each
major function. In SM on-orbit, hitting SM SYS
SUMM will cause SM SYS SUMM (DISP 78) to
appear on the IDP. If SYS SUMM is depressed
again, SM SYS SUMM 2 (DISP 79) will appear,
and if SYS SUMM is depressed once more, SM
SYS SUMM 1 reappears.
The same toggle function exists in GNC
between GNC SYS SUMM 1 (DISP 18) and GNC
SYS SUMM 2 (DISP 19).

GNC SYS SUMM 2, available in GNC

OPS 2 and 8
XXXX/XXX/078

SM SYS SUMM

XX X

DDD/HH:MM:SS
DDD/HH:MM:SS
SMOKE
1/A
2/B
DC VOLTS
1/A
2/B 3/C
CABIN
XX.XS
FC
XX.XS XX.XS XX.XS
L/R FD
XX.XS XX.XS
MAIN
XX.XS XX.XS XX.XS
AV/BAY 1 XX.XS XX.XS
ESS
XX.XS XX.XS XX.XS
2 XX.XS XX.XS
A
B
C
A
3 XX.XS XX.XS
CNTL
1 XXX.XSXXX.XSXXX.XSX
2
XXX.XSXXX.XSXXX.XSX
CABIN
3 XXX.XSXXX.XSXXX.XSX
PRESS
XX.XS
dP/dT-EQ .XXSX.XXXSAC
O2 CONC XXX.XS
VOLT A
XXXS
XXXS XXXS
PPO2
X.XXS X.XXS
B
XXXS
XXXS XXXS
FAN P
X.XXS
C
XXXS
XXXS XXXS
HX OUT T
XXXS
AMPS A XX.XS XX.XS XX.XS
O2 FLOW
XX.XS XX.XS
B XX.XS XX.XS XX.XS
N2 FLOW
XX.XS XX.XS
C XX.XS XX.XS XX.XS
IMU FAN
AXS BXS CXS FUEL CELL
V FC1
FC2 FC3
AMPS
XXXS
XXXS XXXS
SS1 XXXS XXXS XXXS
REAC VLV
XX
XX
XX
SS2 XXXS XXXS XXXS
STACK T
XXXS XXXS XXXS
SS3 XXXS XXXS XXXS
EXIT T
XXXS XXXS
XXXS
TOTAL AMPS XXXXS
COOL P
XXXS XXXS
XXXS
KW
XXS
PUMP
XXS XXS
XXS
(XX)
085.cnv

PASS SM SYS SUMM 1, available in

SM OPS 2
2. SYSTEMS
2.6 Data Processing System

2.6-44

USA007587
Rev. A
1.

Depress
the
MASTER
ALARM
pushbutton indicator.
This will
extinguish the MASTER ALARM light
and caution and warning tone.

2.

Depress the ACK key (on the keyboard).

The fault message will cease flashing.
If the crewmember can examine the
message while it flashes, this step is
unnecessary. Depress the ACK key
again to look at the next message in a
stack if required.

3.

Depress the MSG RESET key.

Depression of this key removes the
fault message from the fault message
line. In addition, the BACKUP C/W
light is extinguished.
(Hardwaredriven lights remain on until the
problem is corrected.)

PASS SM SYS SUMM 2, available in

SM OPS 2
Fault Detection and Annunciation
Five classes of alarms have been established.
Class 1, Emergency, has no interface with
software. Class 2, Caution and Warning (C/W),
is the second highest alarm class. It is divided
into primary (hardware-driven) and backup
(software-driven) systems. An alarm of the
software-driven class will result in the
annunciation of the BACKUP C/W ALARM light
on the C/W matrix on panel F7, the MASTER
ALARM lights, and an associated tone. In
addition, a fault message will be displayed
upon the fault message line of the DPS display.
Class 3, Alert, triggers the SM ALERT light and
corresponding tone.
A fault message is
displayed on the fault message line. Class 5,
Operator Errors, is the lowest priority alarm
and is caused only by a crew entry error. It
results in an ILLEGAL ENTRY fault message
being displayed. Class 0, Limit Sense, provides
a status indicator (down arrow, up arrow) to the
right of the affected parameter on an
appropriate IDP. No fault message, tone, or
light is triggered.

The crew response to a class 3 fault message is:

1.

Depress the ACK key. This will cause

the fault message to become static.
Depressing the ACK key will also
extinguish the SM ALERT light and
tone. (The tone duration is set to a
crew-selected length and may have
stopped before the ACK key is pressed.)
Depress the ACK key again to look at
the next message in a stack if required.

2.

Depress the MSG RESET key. This will

remove the fault message from the
fault message line. If the ACK key
had not been depressed, the MSG
RESET key would extinguish the SM
ALERT light and tone.

The output of a fault message to the fault

message line results in several indications
requiring crew interface. Although generally
the crew keyboard responses are similar, the
effects of these responses differ for each class
alarm.
The crew response to a class 2 backup fault
message is:

2.6-45

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
The major field is a 14-character field. The first
three characters identify the display on which
more information about the annunciated failure
can be found. An S or a G, followed by a two
digit number, indicates the major function (G
for GNC and S for SM) and the number of the
SPEC or DISP. If no display is associated with
the fault, this field is blank. In the example
below, "S88" is the CRT ID and means that
information on the fault can be found on SPEC
88 in SM.
The remaining characters identify the problem
or subsystem group associated with the fault.
In the example, "EVAP OUT T" is the FAULT
portion of the major field and indicates a fault
in the flash evaporator subsystem.

Sample CRT Fault Message

A class 5 fault message displays a flashing
"ILLEGAL ENTRY" on the fault message line.
The crew response is simply to depress the
MSG RESET key. This clears the fault message
from the fault message line. The ACK key will
not clear an "ILLEGAL ENTRY." It will cause
messages stacked under the "ILLEGAL ENTRY"
display to be acknowledged and cleared.
Some illegal keyboard entries are detected
by the IDP before being sent to the GPCs. When
this occurs, a flashing "ERR" appears
immediately to the right of the erroneous entry
on the scratch pad line. The crew response is
simply to depress the CLEAR key. Upon
depression of the CLEAR key, the "ERR" and
the last keystroke will disappear. Subsequent
depressions of the CLEAR key will remove
single keystrokes, proceeding from right to left.
This feature enables the crew to CLEAR back to
the portion of the command that was incorrect,
correct it, and proceed. This type of error is not
identified by class, since it is not GPC-detected
and is known simply as an IDP-detected error.
Fault Messages
Fault messages associated with alarm classes 2,
3, and 5 follow a standard format of five fields.

2. SYSTEMS
2.6 Data Processing System

The minor field is a four-character field that

further identifies the fault. It will specify the
subdivision, direction, location, parameter, or
specific unit of the subsystem or problem identified in the major field. In the example fault
message, "1" is the minor field message and
means that the temperature sensor 1 is the area
in which the fault was detected.
The C/W field is used only with caution and
warning class 2 backup messages. An asterisk
appears in this column across from the corresponding fault to denote that the condition is a
class 2 backup alarm.
The GPC field identifies the GPC that detected
this fault. This characteristic aids the crewmember in locating or identifying internal GPC or
I/O errors.
The far right field is the TIME field. This field
indicates the time at which the fault occurred.
The time is MET and is displayed in hours,
minutes, and seconds (HH:MM:SS).
A complete listing of all possible fault messages
can be found in the Flight Data File Reference
Data Book and in Section 2.2.
A class 5 alarm is annunciated by an "ILLEGAL
ENTRY" in the major field, and all other fault
message fields are blank. When a class 5
message is received, it is displayed
instantaneously on the fault message line of the
IDPs DPS display where the error occurred,
rather than on all IDPs like class 2 and 3 errors.

2.6-46

USA007587
Rev. A
To get rid of the class 5 message, a MSG RESET
must be done to the IDP where the error
occurred. Class 2 backup and class 3 messages
are extinguished by a MSG RESET on any IDP.
The Fault Summary Display
A historical summary of class 2 backup and
class 3 fault messages is provided via the
FAULT display (DISP 99). Class 5 errors are not
displayed as they are caused by illegal crew
entries to a single IDP. The FAULT display is a
DISP available in all OPS. It is selected for
viewing by depression of the FAULT SUMM key.

new fault message has occurred within a 4.8

second window, the new message is inhibited.
The last message displayed on the fault message
line of any DPS display is not necessarily the
most recent fault message. Unless the fault
message line was cleared with a MSG RESET,
the crewmember will not see new messages that
came in after the flashing or frozen message. In
that case, the crewmembers can see if a new
message has been annunciated by looking at a
two-character field, which is called the buffer
message indicator and is located in the last field
on the far right of the fault message line.
The buffer message indicator serves to indicate
the number of messages in the fault buffer on
the FAULT display since the last MSG RESET.
This number includes class 2 backup and class 3
messages only. Class 5 messages and the
currently displayed messages are not included
in this counter. The number is enclosed by
parentheses. If no fault messages are in the
stack, this field is blank. To view any of these
messages, the crewmember may depress the
ACK key to display subsequent messages or
look at the FAULT display. A MSG RESET
clears both the fault message line and the buffer
message indicator.

FAULT Display (DISP 99)

The PASS fault summary display consists of up
to 15 fault message lines. They appear in
reverse chronological order.
The oldest
message appears on the bottom line. When a
new fault message is generated, it appears on
the top line. The other messages are pushed
down, and the 15th message (the oldest)
disappears.
The only difference between the fault messages
on the FAULT display and the fault message on
the fault message line is the TIME field. On the
FAULT display, the time field includes days as
well as hours, minutes, and seconds (DDD/HH:
MM:SS).
Sometimes, a subsystem failure or malfunction
results in the output of several fault messages,
some of which may be identical. The fault
detection and annunciation logic can prevent the
annunciation of identical fault messages. When a
fault message is generated, its major and minor
fields are compared to those of the top message
of the display. If the fields are the same, and if the

In addition to using the FAULT SUMM key, the

FAULT display may also be selected by the
keyboard entry "SPEC 99 PRO." However, this
command will clear all fault messages from the
FAULT display and the fault message lines.
This capability is useful if and when the fault
messages displayed are no longer significant
(i.e., they are old, or they have been dealt with).
Crew Software Interface with the BFS
The crew software interface with the BFS is
designed to be as much like PASS as possible,
but there are some differences. This section
covers the differences between the PASS's and
BFS's crew and IDP interfaces. If something
is not mentioned in this section, it can be
assumed to operate the same as the PASS
interface.

2.6-47

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
BFC CRT Switches
Panel C3 contains two switches relevant to BFS
operations. The BFC CRT DISPLAY switch is a
two-position ON/OFF switch.
In the ON
position, the IDP(s) specified by the BFC CRT
SELECT switch is driven by the BFS computer.
(The BFC CRT SELECT switch controls IDP
assignment to the BFS computer.) The switch
is read by the GPC only when the BFC CRT
DISPLAY switch is in the ON position. The BFC
CRT SELECT switch has three positions. In
each position, the first digit is the IDP
commanded by the BFS pre-engage. Postengaged, the BFS also commands a second IDP
indicated by the second number. For example,
when the BFC CRT SELECT switch is in the 1 +
2
position,
IDP 1 is connected to the BFS GPC prior to
engaging the BFS. After the BFS is engaged,
this switch position allows the BFS computer to
command both IDP 1 and IDP 2. During ascent
and entry, one forward IDP will normally be
assigned to the BFS via the BFC CRT SELECT
switch. The nominal position of the switch is
the 3+1 position. However, this switch position
may be changed at any time, pre-engage or
post-engage. If the BFS is engaged with the BFC
CRT DISPLAY switch OFF, the BFS will
automatically assume command of IDPs 1 and
2. IDP 4 is typically assigned to the BFS as well
via a GPC/CRT assignment (mission specific).
No set of BFC CRT switches exists for the IDP 4.

BFC CRT DISPLAY and SELECT Switches on

Panel C3
SM:
This major function contains
limited nonredundant systems management and payload software. There is no
room in the BFS for the redundancy
management found in PASS. When the
MAJ FUNC switch is set in the SM position, the THERMAL display is invoked.
This display is unique to the BFS.
PL:
This major function is not
functional for the BFS. Should the MAJ
FUNC switch be set in this position, no
display change would occur. If the BFC
CRT DISPLAY switch is turned on,
allowing the BFS to drive an IDP
already in the PL major function, the
DPS display will be blank except for
time and GPC driver fields because the
BFS has no software to support this
major function.

BFS Functions of the MAJ FUNC Switch

The MAJ FUNC switches on panels C2 and
R11L are also functional for the BFS. However,
the display data and functional software
accessed by the three-position switch are
slightly different. The BFS functions of the MAJ
FUNC switch are defined as follows:
GNC: Flight critical software including
limited guidance, navigation, and control software is contained in this major
function. The BFS GNC major function
contains only that software necessary
for safe orbital insertion and return,
including ascent abort logic.

2. SYSTEMS
2.6 Data Processing System

BFS ENGAGE Pushbutton

The BFS ENGAGE pushbutton is located on the
commander's and pilot's rotational hand controllers (RHCs). During the dynamic flight
phases (ascent and entry), the commander and
pilot usually rest a hand on or near the RHC. In
this way, BFS engagement can occur as quickly
as possible. If the crew delays engagement
during these flight phases, they could lose
control of the vehicle, or the BFS' navigation

2.6-48

USA007587
Rev. A
calculations could degrade very quickly so that
control would be essentially lost after
engagement.
Some force (8 lb) is required to depress this
pushbutton to prevent inadvertent engages.
While on-orbit, the pushbutton is essentially
disabled by reconfiguring the BFS OUTPUT
switch. The BFS cannot track PASS while it is in
OPS 2 and is moded to HALT on-orbit. If the
BFS needs to be engaged on-orbit, the BFS must
be "awakened", and the only software that will
be of any use is entry and systems management
software.
Keyboard and Display Differences for the BFS
The keyboard operates exactly the same way for
the BFS as for the PASS. A few additional
capabilities need to be mentioned.
Rotational Hand Controller

The GPC/CRT key: In addition to the

BFC CRT DISPLAY switch, this key
provides the capability to assign an IDP
to (or isolate an IDP from) the BFS GPC.
Both methods can be used interchangeably, but as long as the BFC CRT
DISPLAY switch is working, it is the
fastest method of allowing the BFS to
drive an IDP or to change BFS IDPs.
The BFC CRT DISPLAY switch allows
PASS to automatically begin driving the
IDP again when the BFS is turned off.
When the BFS is assigned an IDP with
the GPC/CRT key, it is the same as
deassigning that screen from PASS with
a GPC/CRT 0X EXEC. PASS must be
reassigned to resume commanding of
that IDP.
The BFS INDICATOR: When the BFS is
commanding an IDP, the BFS indicator
will appear on that IDPs DPS display.
On the second line of every BFS display
a three-character space field has been
reserved for the message "BFS." This
field is located directly below the GPC
indicator.
The BFS indicator is
displayed in the overbright intensity
and is intended to prevent possible
confusion of a PASS display with a BFS
display. Often the BFS display will be
identical or very close to the
corresponding PASS display.

BFS Indicator on DPS Display

BFS Display Sequencing
The BFS is designed to operate in the same
manner as the PASS where possible. BFS
requirements, however, demanded a distinction
be made between BFS pre-engage and BFS postengage major mode transitions and associated
display sequencing.
BFS pre-engage major mode display sequencing
is either automatic, or it may be performed in
the same manner as that of the PASS. Before
the BFS is engaged, the BFS is listening to
keyboard inputs made to the PASS controlled
IDPs across the display/keyboard (DK) buses
and updating its software accordingly. This is

2.6-49

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
called DK listening and the BFS can hear PASS
item entries, PASS major mode transitions, and
PASS GPC/CRT assignments. On the other
hand, the PASS doesn't know that the BFS
exists, so it never DK listens to the BFS.
Therefore, BFS major mode transitions are
performed automatically as a function of the
major mode transitions performed on a PASS
keyboard. If the BFS does not follow the PASS
major mode transitions, then the BFS must
receive a manual OPS XXX PRO.

0001/000/

MEMORY DUMP
21 START ID
22 NUMBER WDS
23 WDS/FRAME
START/STOP DUMP 24

2. SYSTEMS
2.6 Data Processing System

LAUNCH BUS

1 26
2 27

TF L ENA
29

OFF 28*
PASS/BF S XFE R ENA 25

BFS TIME UPDATES

UPDATE 38
30 GMT D[ ]___/__:__:__.___
34 MET D[ ]
/ : : .

MI SSION TIME
G MT 39
M ET 40
u sa0 07 58 7_ 250r2.cvx

BFS MEMORY Display

BFS GNC OPS 3 - Entry: This OPS must
be manually selected from BFS GNC
OPS 0 or BFS GNC OPS 1. BFS GNC
OPS 3 is available for use during the
entry portion of the mission. It is a legal
transition to go from the BFS GNC OPS
1 to BFS GNC OPS 3 (for aborts), but
nominally, the transition will be from
BFS GNC OPS 0. In both cases, the
manual keyboard entry "OPS 301 PRO"
is required.

Three operational sequences are defined for BFS

GNC; one operational sequence is defined for
the BFS SM. Transactions to and from these
OPS displays differ considerably from the
PASS.
BFS keyboard and DPS display
peculiarities are outlined as follows:

BFS GNC OPS 1 and 6 - Ascent: This

OPS must be manually selected via a
keyboard assigned to the BFS prelaunch.
BFS GNC OPS 1 is available for use
during the ascent portion of the mission.
The OPS 6 transition is automatic upon
abort selection with the ABORT rotary
switch and pushbutton, or an OPS 601
PRO may be used.

5 008 /12:1 2:12

BF S 000 /00:2 9:12

READ/WRITE
DATA 1* BIT SET 3
SEQ I D 5
CODE 2
BIT RST 4
WRITE 6
7 ENG UNITS
H EX 8*
ADD ID
DESIRED
AC TUAL
9 ______ 10
11
12
13
14
15
16
17
18
19
20

BFS post-engage major mode display

sequencing is the same as that of the PASS.
After the BFS is engaged, the BFS GPC is on its
own. It no longer listens to the PASS GPCs.
Therefore, major mode display sequencing has
been designed to be the same as that of the PASS.

BFS GNC OPS 0 - BFS MEMORY

display: This display is forced to the
DPS display when BFS is not processing
either GNC OPS 1 or 3. Nominally, this
occurs prior to ascent and again prior to
entry. This display corresponds to the
PASS GPC MEMORY display and
performs the same functions for the BFS.
It also performs some of the same
functions as PASS SPEC 2, the TIME
SPEC, in that time updates can be
performed along with selection of GMT
or MET to be displayed.
GPC
MEMORY is the default display for
PASS OPS 0, and the BFS MEMORY
display is the default display for BFS
GNC OPS 0.

BFS MEMORY

The major mode displays for BFS OPS 1, 3, and

6 are similar, if not identical, to their PASS
counterparts. A complete listing of PASS and
BFS displays can be found in the DPS Dictionary.
BFS Special Operations and Displays
In the pre-engaged mode, the BFS GPC
performs BCE and MDM bypasses when PASS
data are bypassed, or it sets its own bypasses.
The I/O RESET command when made via the
BFS keyboard restores those I/O configurations
set by the BFS GPC. That is, a BFS "I/O RESET
EXEC" restores the bypasses set by the BFS GPC.
In addition, the I/O RESET operation attempts to
synchronize the BFS with the PASS GPC listen
commands so the BFS can track PASS.
Post-engage, the only bypasses set are those
detected by the BFS GPC. The "I/O RESET
EXEC" command functions to restore those
bypasses.

2.6-50

USA007587
Rev. A
SM SYS SUMM. There are two SM SYS
SUMM displays. SM SYS SUMM 1 is
identical to the PASS SM SYS SUMM 1,
while BFS SM SYS SUMM 2 is a unique
display. They are called in the same
manner as the PASS SM SYS SUMM
displays.

The BFS systems summary displays operate the

same way the PASS displays work. The BFS
display numbers are the same as their PASS
counterparts and some of the displays
themselves are identical. However, three of the
BFS SYS SUMM displays are unique to the BFS.
GNC SYS SUMM.
The GNC SYS
SUMM consists of two DISPs. GNC SYS
SUMM 1 is display format and content
unique to BFS. It is called via the SYS
SUMM key or by the command "SPEC
18 PRO." GNC SYS SUMM 2 is identical
to the GNC SYS SUMM 2 display
available in the PASS OPS 2 and 8. It is
called by the command "SPEC 19 PRO"
or by depressing the SYS SUMM key
twice.

BFS GNC SYS SUMM 1, available in GNC

OPS 1, 6, and 3 (Unique to BFS)

THERMAL. This is a systems summary

DISP available as the SM OPS 0 display
in BFS. It is forced to the screen anytime
the MAJ FUNC switch is placed in the
SM position (unless an SM SPEC is
called up over it). This display is
unique to the BFS. It cannot be obtained
with a SPEC key, and it never requires a
keyboard entry.

BFS SM SYS SUMM 1, available in SM OPS 0

(Unique to BFS)

BFS GNC SYS SUMM 2, available in GNC

OPS 1, 6, and 3 (Identical to PASS GNC SYS
SUMM 2 except shaded lines)

BFS THERMAL, available in SM OPS 0

(unique to BFS)
2.6-51

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A
alarm.
The BFS FAULT display
provides a history of only class 2 backup
and class 3 messages annunciated by the
BFS GPC itself.

BFS Unique CRT IDs. In BFS SM, all

messages referring to SM SYS SUMM 1
or SM SYS SUMM 2 are indicated by the
CRT IDs SM1 and SM2. Fault messages
referring to the THERMAL display are
indicated by the CRT ID SM0.

BFS SM SYS SUMM 2, available in SM OPS 0

(unique to BFS)
BFS Fault Messages
Several crew interface characteristics of fault
annunciation in the BFS differ from those in the
PASS.
The BFS FAULT display. The BFS
FAULT display functions in the same
manner as the PASS. The BFS FAULT
display is composed of 20 fault lines as
compared to 15 in the PASS. The C/W
field displays an asterisk when the
message annunciated is a class 2 backup

2. SYSTEMS
2.6 Data Processing System

2.6-52

USA007587
Rev. A

DPS Summary Data

The DPS combines various hardware
components and self-contained software to
provide computerized monitoring and
control.
DPS hardware includes 5 GPCs, 2 modular
memory units, a data bus network, 20
MDMs, 4 IDPs, 11 MDUs, and other
specialized equipment.
Each of the five GPCs consists of a CPU and
an IOP stored in one avionics box. During
ascent/entry, four of the GPCs are loaded
with identical PASS software; the fifth is
loaded with different software, the BFS.
The data bus network transfers data between
the GPCs and vehicle systems. There are
seven types of data buses: flight-critical, payload, launch, mass memory, display/keyboard,
instrumentation/PCMMU,
and
intercomputer communication.
The 13 DPS MDMs convert data to
appropriate formats for transfer between the
GPCs and vehicle systems.
Two modular memory units provide bulk
storage for software and data.
Four IDPs, 11 MDUs, and associated keyboards provide the means for flight crew
interaction with the GPCs.
The two types of DPS software, system
software and applications software, combine
to form a memory configuration for a specific
mission phase.
The system software is operating software
that always resides in GPC main memory.
The applications software performs the
functions required to fly and operate the
vehicle.
It is divided into three major
functions: guidance, navigation, and control
(GNC); systems management (SM); and
payload (PL).

Major functions are divided into mission

phase oriented blocks called operational
sequences (OPS).
OPS are further divided into blocks called
major modes (MM), which relate to specific
portions of a mission phase.
There are three levels of DPS displays: major
mode or OPS, specialist (SPEC), and display
(DISP).
The four PASS GPCs control all GNC
functions during ascent/entry mission
phases; the fifth GPC is loaded with backup
flight system (BFS) software to take over in
case of PASS GPC failure.
The BFS contains a limited amount of
software; there are some operational differences between BFS and PASS.
The BFS is engaged by pushbutton on the
rotational hand controller.
A GPC FAIL detection will display a class 2
GPC FAULT message with illumination of
the MASTER ALARM. The GPC STATUS
matrix (sometimes referred to as the
computer annunciation matrix (CAM)) on
panel O1 lights to indicate failure votes; any
time a yellow matrix light is illuminated, the
GPC caution and warning light on panel F7
also lights.
Most DPS control switches are located on
panels O6 and C2. Others may be found on
panels C3, R11L, F2, F4, F6, and F7.
DPS displays relevant to the DPS are:
GPC/BUS STATUS (SPEC 6), GPC
MEMORY (SPEC 0), DPS UTILITY (SPEC 1),
and TIME (SPEC 2).

2.6-53

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

Panel O6

2. SYSTEMS
2.6 Data Processing System

2.6-54

Panel C2

USA007587
Rev. A

2.6-55

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

GPC/BUS STATUS (SPEC 6)

2011/000/

GPC MEMORY

MEM/BUS CONFIG
1 CONFIG 3(G3)
2 GPC
1 2 3 4 0
STRING

P/L
CRT

LAUNCH
MM
OPS
OPS

1
2
3
4
1/2

7
8
9
10
11

1
2
3
4
1

1
2
3
4

12
13
14
15

1
2
3
0

1
2
1
2

16
17
18
19

0
0
1
2

3 UPLINK 50
3 INIT 51

READ/WRITE
GNC
DATA 20*
BIT SET 22
CODE 21
BIT RST 23
26 ENG UNITS___
ADD ID
DESIRED
28 ______ 29
30
31
32
33
34
35
36
37
38
39
MEMORYDUMP
40 START ID______
41 NO WORDS________
42 WDS/FRAME____
DUMP START/STOP 43
44 DOWNLIST GPC 1
OPS 0 ENA 49
ERR LOG RESET 48

DPS UTILITY (SPEC 1)

008/12:12:12
000/00:29:12
SEQ ID 24
WRITE 25
HEX 27*
ACTUAL

STORE MC=O2
45 CONFIG
46 GPC
STORE 47
MM AREA
PL 52 1
GNC 53 1
SM 54 1
usa007587_238r1.cvx

GPC MEMORY (SPEC 0)

2. SYSTEMS
2.6 Data Processing System

TIME (SPEC 2)

2.6-56

USA007587
Rev. A

DPS Rules of Thumb

Always HALT fail to sync GPCs and reassign
their IDPs to good GPCs to avoid inadvertent
entries (NBATs/restrings, burn targets, etc.).
Before OPS transitions and restrings, always
verify the appropriate NBAT is what you
want it to be; never assume that it is correct!
Also check the proper major function and
GPC switch configuration.
Make sure you have the correct memory
configuration called up before you start
making NBAT changes.
During OPS transitions, keep "hands off"
everything, including all switches and
keyboard entries.
Clear the Fault Message line as soon as you
have seen the message or use the ACK key to
display subsequent messages.
Post BFS engage, check to ensure that all
active PASS GPCs have recognized the
engage (both MODE and OUTPUT talkbacks
are barberpole). If not, take the offending
GPC to HALT (or if this does not work,
power it OFF) immediately to avoid I/O
problems on the flight critical strings.
It is a very good idea to resume SPECs and
DISPs when not using them or before moving
the major function switch.
It is important to be able to identify GPC
failures. The information you provide will affect
Mission Control analysis and its ability to plan
for subsequent failures (both DPS and nonDPS).

Always hard assign IDPs (both PASS and

BFS) via PASS IDPs (BFS will DK listen). If
you assign BFS to drive an IDP via a BFS
keyboard, and a PASS GPC is currently
driving the display, dual DK Bus
commanders will result, which can cause
PASS redundant set breakups.
Always distribute your IDPs among different
GPCs. On orbit, always be sure to minimize
SM usage on all IDPs at the same time; if you
lose SM, you also lose PASS IDP interface.
The same is true if in single GPC GNC OPS,
such as in a Group B powerdown.
When using the GPC MODE switch, always
take your hand off between positions. On
past missions, there have been problems with
the switch being in essentially two positions
at the same time. This problem can occur on
other orbiter switches too. It is a good idea
to always pause slightly in each switch
detent to ensure the contacts are made and
recognized by the GPCs.
The IDP/CRT SEL switch should always be
checked before making a keyboard entry,
and data should always be checked on the
scratch pad line before it is entered.
When moding PASS GPCs into the common
set (i.e., STBY to RUN), always pause 10
seconds before and after switch throws to
avoid a possible fail-to-sync and to ensure
proper common set initialization.

2.6-57

2. SYSTEMS
2.6 Data Processing System

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.6 Data Processing System

2.6-58

USA007587
Rev. A

2.7

plays may be generated by the navigation or

flight control system software or more directly
by the navigation sensors.
The dedicated
displays are located in front of the commanders
and pilots seats and on the aft flight deck panel
by the aft-facing windows.

DEDICATED DISPLAY SYSTEMS

CONTENTS
Description.............................................
Device Driver Unit ................................
Primary Flight Display (PFD)..............
Attitude Director Indicator (ADI).......
Horizontal Situation Indicator (HSI) ..
Flight Instrument Tapes .......................
PFD Status Indicators ...........................
Surface Position Indicator (SPI) ..........
Flight Control System Pushbutton
Indicators.....................................
Reaction Control System Command
Lights............................................
Head-Up Display ..................................
Dedicated Display Systems Summary
Data ..............................................

2.7-1
2.7-2
2.7-3
2.7-3
2.7-8
2.7-14
2.7-16
2.7-17

The dedicated displays are:

2.7-19

Primary flight display (PFD) on the

MEDS flight instrument display, which
displays the attitude director indicator
(ADI), horizontal situation indicator
(HSI), and Flight Instrument Tapes as
appropriate to the flight phase

2.7-19
2.7-21

Surface position indicator (SPI) on the

MEDS SPI display

2.7-25

Reaction control system activity lights

on panel F6
Head-up display (HUD) on the glareshield in front of the commanders and
pilots seats

Description
Dedicated displays provide the flight crew with
information required to fly the vehicle manually
or to monitor automatic flight control system
performance. The data on the dedicated dis-

Not all the dedicated displays are available in

every operational sequence or major mode.
Their availability is related to the requirements
of each flight phase.

Computers

Integrated
display
processor

Keyboard

Multifunction Display Unit (MDU)

Orbit PFD
(ADI)

HUD

MDM

Translational
hand
controller
(THC)

A/E PFD
(ADI/HSI)

Speed brake/
thrust
controller
(SBTC)

SPI

Rotational
hand
controller
(RHC)

Rudder pedal
transducer
assembly
(RPTA)

sfoc scom s2 .7 25 8. cnv

Dedicated Display and Control System

2.7-1

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A

Device Driver Unit

The device driver unit (DDU) is an electronic
mechanism that provides dc and ac power for
the rotational and translational hand controllers
(RHC and THC), the speedbrake/thrust
controller (SBTC), and rudder pedal transducer
assemblies (RPTA).
The orbiter contains three device driver units:
one for the commanders station, one for the
pilots station, and one for the aft station.
The commanders DDU is powered from the
MN A DDU LEFT circuit breaker on panel O14
and the MN B DDU LEFT circuit breaker on
panel O15. The pilots DDU is powered from
the MN B DDU RIGHT circuit breaker on panel
O15 and the MN C DDU RIGHT circuit breaker
on panel O16. The aft flight station DDU is
powered from the MN A DDU AFT circuit
breaker on panel O14 and the MN C DDU AFT
circuit breaker on panel O16.

MN B DDU Circuit Breakers on Panel 015

MN C DDU Circuit Breakers on Panel 016

Selecting a Flight-Critical Data Bus

MN A DDU Circuit Breakers on Panel 014

In MEDS, the Integrated Display Processors

(IDPs) handle all the flight-critical (FC) bus data
used to drive the flight instrument displays on
their commanded Multifunction Display Units
(MDUs). The data bus select menu allows the
user to select the FC bus (1 - 4) that will be used
for the flight instrument displays for that MDU.
MEDS software follows two rules when a data
bus is selected for an MDU.
Each IDP can support up to two
different FC data bus selections.
Each IDP supports only one FC bus
selection for each crew station (CDR,
PLT, and aft).

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-2

USA007587
Rev. A
detailed discussion of the PFD during the
various phases of flight or abort modes, see that
particular section.
DAP: Auto
Throt: Auto
M/VI

To select a different FC data bus, the user can

select the DATA BUS option via the edgekeys.
The MDU retains the current MEDS display, but
a new submenu appears and allows the user to
select FC1, 2, 3, or 4 via the edgekey.

R 180
5 P 016

Y 000
03

10

0
3

1.7

33
3

R 0.3
Beta

75
KEAS

1.0 g
Accel

X-Trk 32.0
33

Inc

6
9

50

50

FLIGHT INSTRUMENT MENU

A/E
ORBIT
DATA
MEDS
MEDS FC2
PFD
PFD
BUS
MSG RST MSG ACK AUT
12

24

21

18

15

UP

7.10

27

-1
0

P2*
S1

30

21

2.0K

24 5
15

150K

12

5.0K

Although all displays indicate a FC

bus, it is only meaningful on the flight
instrument displays.
Additionally,
because the FC data buses are assigned
to specific orbiter GPCs, the selection
of a FC bus to drive a flight instrument
display also provides a means of
assessing the status of individual
computers that are assigned to FC1, 2,
3, or 4. See Section 2.6 for detailed data
bus information.

160 K 2105

NOTE

305

5
5.32
5.2

33

06

5.4

MM: 103
ATT: LVLH

If the FC data bus selected for an MDU violates

one of these rules, other MDUs that are
displaying flight instrument displays and that
are being driven by this same IDP will also
change their FC data bus selection.

Example of Ascent/Entry Primary Flight

Display in MM103

Primary Flight Display

Attitude Director Indicator (ADI)

The primary flight display (PFD), also referred

to as the flight instruments, contains data
needed for the crew to fly the vehicle and
maintain control.
The PFD displays a
combination of the attitude director indicator
(ADI), horizontal situation indicator (HSI),
various tapes and meters showing vehicle
parameters, such as angle of attack (),
Mach/velocity (M/V), equivalent airspeed
(KEAS), altitude (H), altitude rate (H dot),
altitude acceleration (H double dot) and a
g-meter.
The PFD may also have status
indicators that display the current major mode,
abort mode, ADI attitude setting, speedbrake,
throttle, and DAP status.
The PFD elements will change to show data
specific each phase of flight, called phasetailoring. During some portions of flight, when
certain data is not needed, it will be removed
from the display. That area will either be left
blank or replaced with data more pertainent to
that phase of flight. In this section, the PFD
elements are presented generically, intended to
give an overall understanding.
For more

The ADI gives the crew attitude information as

well as attitude rates and errors, which can be
read from the position of the pointers and
needles. The ADI can be viewed on the
Ascent/Entry PFD (A/E PFD), which is a
composite of various flight instruments
depending upon flight phase, or on the Orbit
PFD.
The commanders and pilots ADIs (supported
by IDPs 1, 2, and 3) are supported throughout
the mission; the aft ADI (supported by IDP 4) is
active only during orbital operations.
The orbiters attitude is displayed to the flight
crew by a software simulated enclosed ball
(sometimes called the eight ball) that is
gimbaled to represent three degrees of freedom.
The ball, covered with numbers indicating
angle measurements (an implied 0 is added as
the last digit of each), moves in response to
software-generated commands to depict the
current orbiter attitude in terms of pitch, yaw,
and roll.

2.7-3

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
LVLH position shows the orbiters attitude from
an orbiter-centered rotating reference frame
with respect to Earth. The REF position is
primarily used to see the orbiters attitude with
respect to an inertial reference frame defined
when the flight crew last depressed the ATT
REF pushbutton above/below the ADI
ATTITUDE switch. The REF position is useful
when the crew flies back to a previous attitude
or monitors an OMS burn for attitude
excursions. On ascent pre-MECO and on entry,
with the ADI in LVLH, yaw is not displayed
and the ADI is pinned to the belly-band in yaw.

The wide band dividing the ball represents 0

yaw and is referred to as the belly-band. There
is also an artifical horizon representing pitch of
0, where positive pitch angles (0 to 180) are
drawn on the white half of the ball and negative
pitch angles (180 to 360) are drawn on the
darker half of the ball.
In addition to the graphical attitude
representation of the ADI ball there is a digital
readout to the ADIs upper-right showing the
current roll, pitch, and yaw attitude in degrees.
Each ADI has a set of switches by which the
crew can select the mode or scale of the readout.
The commanders switches are located on panel
F6, the pilots on panel F8, and the aft switches
on panel A6U.

The ADI ATTITUDE switches on panels F6 and

F8 are active during ascent, orbital, and
transition flight phases. However, they have no
effect during entry (MM304, 305, 602, and 603),
when the ADI attitude is always shown as
LVLH. Also, when the backup flight system
(BFS) is engaged, only the commanders
switches on panel F6 are monitored for
configuring both commander and pilot ADIs.
The switch on panel A6U, like the aft ADI, is
operational only in orbit.

The ADI ATTITUDE switches determine the

units frame of reference: INRTL (inertial),
LVLH (local vertical/local horizontal), and REF
(reference). The INRTL position allows the
flight crew to view the orbiters attitude with
respect to the inertial reference frame. The

Rate Indicator

Roll Scale

Rate Scale Label

Digital Attitude

Attitude Error Needle

Roll Index Mark

Roll Bug
Artificial Horizon

XXX

XXX
03

R 029
P 001
Y 002

Rate Scale Label

33
XXX

Attitude Ball

06

Off Flag

33

O
F
F

30 XXXX

33

Rate Indicator

Pitch Scale
33

Theta Limits Bracket

33

12

Attitude Error Needle

3

24XXXX

Att Error Scale Label

XXX

15

Belly Band

21

Rate Scale Label

Vehicle Reference

XXX

XXX
Attitude Error Needle
Yaw Scale

Attitude Director Indicator

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-4

Rate Indicator

USA007587
Rev. A

1101.cnv

Commanders ADI Switches and ATT REF

Pushbutton on Panel F6

1102.cnv

Pilots ADI Switches and ATT REF

Pushbutton on Panel F8

Each ADI has a set of three rate pointers that

provide a continuous readout of vehicle body
rotational rates. Roll, pitch, and yaw rates are
displayed on the top, right, and bottom
pointers, respectively. The center mark on the
scale next to the pointers represents zero rates.
The graduated marks on either side of center
indicate positive or negative rates. The ADI
RATE switch for each indicator unit determines
the magnitude of full-scale deflection. HIGH is
the coarsest setting and LOW is the finest setting.
Scaling for each switch position is listed in table A,
ADI Rate Switch vs. Full Range Deflection. On the
A/E PFD, the rate pointer scales will be labeled
according to the selected scale. The rate scales
are not labeled on the Orbit PFD. These pointers
are fly to in the sense that the RHC must be
moved in the same direction as the pointer to
null a rate.
ADI rate readings are independent of the
selected attitude reference. During ascent, the
selected rates come directly from the solid
rocket booster or orbiter rate gyro assembly
(RGA) sensors to the ADI processor for display
via the rate pointers. During entry, only the
RGA selected pitch rate is directly diplayed as
the ADI rate. The selected roll and yaw rates
are first sent to flight control software, where
they are processed and output to the ADI as
stability roll and yaw rates.
(This
transformation is necessary because, in
aerodynamic flight, control is achieved about
stability axes, which in the cases of roll and yaw
differ from body axes.)
In all major modes except TAEM (MM 305 and
603), the rate pointers strictly display vehicle
rate information. During TAEM when the ADI
RATE switch is in MED, the ADI rate pointers
instead display information on HAC intercept,
glideslope error, and crosstrack error, which can
be used to help fly the proper HAC profile.
During TAEM when the ADI RATE switch is in
HIGH or LOW, rates will be displayed on a 5
per second scale (see table A). The rate scale
labels in TAEM will reflect these changes
accordingly.

1109.cnv

Aft ADI Switches and ATT REF

Pushbutton on Panel A6U
2.7-5

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
In addition to the rate pointers, there are three
magenta-colored needles on each ADI that
display vehicle attitude errors. These error
needles extend in front of the ADI ball, with
roll, pitch, and yaw arranged in the same
manner as the rate pointers. Similar to the rate
pointers, each error needle has an arc-shaped
background scale (also magenta) with
graduated marks that allow the flight crew to
read the magnitude of the attitude error. The
errors are displayed with respect to the body
axis coordinate system and, thus, are
independent of the selected reference frame of
the ADI.
The ADI error needles are driven by flight
control outputs that show the difference
between the required and current vehicle
attitude.
These needles are also fly to,
meaning that the flight crew must maneuver in
the direction of the needle to null the error. For
example, if the pitch error needle is deflected
down, the flight crew must manually pitch down
to null the pitch attitude error.
The amount of needle deflection, indicating the
degree of attitude error, depends upon the
position of the ADI ERROR switch for each ADI
and the flight phase. For ascent, orbit, and
transition phases, in the HIGH position, full-scale
deflection of the error needles represent 10,
MED represents 5, and LOW represents 1. For
entry, the needles signify different errors in

2. SYSTEMS
2.7 Dedicated Display Systems

different phases (see table B). On the A/E PFD

the error scale is also labeled (in magenta)
according to ADI ERROR switch position.
On entry during TAEM (MM 305 and 603), a
Theta Limits bracket (in green) may be driven
overlaying the ADI ball. This is a pitch flying
reference (maximum/minimum pitch attitude)
when air data transducer assembly (ADTA) data
is not available to Guidance and Control (G&C)
below Mach 2. This is described in more detail in
the TAEM section, 7.4.
The SENSE switch on panel A6U allows the
flight crew to use the aft ADI, RHC, and THC in
a minus X or minus Z control axis sense. These
two options of the aft ADI and hand controllers
correspond to the visual data out of the aft
viewing (negative X) or overhead viewing
(negative Z) windows.
Each ADI has a single flag labeled OFF on the
left side of the display that is used to indicate
whether valid GPC data is driving the ADI
software. Presence of the OFF flag can be used
to determine if a FC bus problem exists at the
GPC driving the IDP that is hosting the ADI,
and is used to help troubleshoot in DPS
malfunction procedures.. There are no flags for
the rate and error needles; but these indicators
are blanked when they are invalid.

2.7-6

USA007587
Rev. A
MISSION PHASE
Ascent
(101-106, 601)
Transition/entry
(301-304, 602)
High
Medium
Low
On-orbit
(201, 202, 801)
High
Medium
Low
TAEM to HAC intercept (305, 603)
High
Medium
Low
HAC intercept to prefinal (305, 603)
High

ROLL

PITCH

YAW

(deg/s)
10
5
1
(deg/s)
5
1
0.2

(deg/s)
10
5
1
(deg/s)
5
1
0.2

(deg/s)
10
5
1
(deg/s)
5
1
0.2

5 deg/s
Time to HAC
intercept (10 sec)
5 deg/s

5 deg/s
Altitude error
(5000 feet)
5 deg/s

5 deg/s

5 deg/s

5 deg/s
Altitude error
(5000 feet)
5 deg/s

5 deg/s
HAC X-range
error (5000 feet)
5 deg/s

5 deg/s
Altitude error
(1000 feet)
5 deg/s
(deg/s)
5
5
5

5 deg/s
HAC X-range
error (1000 feet)
5 deg/s
(deg/s)
5
5
5

Medium
Low
Prefinal to 7000 ft
High

Blank
5 deg/s

Blank
5 deg/s

(305, 603)
5 deg/s

Medium

Blank

Low
7000 ft to landing
High
Medium
Low

5 deg/s
(deg/s)
5
5
5

(305, 603)

(A)
ADI Rate Switch vs. Full Range Deflection
MISSION PHASE
Ascent/
(101-106, 601)
On orbit
(201, 202, 801)
Transition
(301, 303)
High
Medium
Low
ENTRY (MM 304, 602*)
High
Medium
Low
* recovery & transition phases
TAEM (MM 305**, 602*, 603**)
High
Medium
Low
* Nz Hold phase
** WOWLON = 0
WOWLON = 1
Rollout (MM 305, 603)
High
Medium
Low

ROLL

PITCH

YAW

(Deg)
10
5
1
(Deg)
25
25
10

(Deg)
10
5
1
(Deg)
5
2
1

(Deg)
10
5
1
(Deg)
2.5
2.5
2.5

(Deg)
25
25
10

(gs)
1.25
1.25
0.5

(Deg)
2.5
2.5
2.5

(Deg) (Deg/s)
10
20
5
5
1
1

(Deg)
2.5
2.5
2.5

(B)
ADI Error Switch vs. Full Range Deflection

1110.cnv

SENSE Switch on Panel A6U

2.7-7

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A

Horizontal Situation Indicator (HSI)

The HSI displays a pictorial view of the vehicles
position relative to various navigation points and
shows a visual perspective of certain guidance,
navigation, and control parameters;
e.g.,
direction, distance, and course/glidepath
deviation. The flight crew uses this information
primarily to control or monitor vehicle
heading/yaw performance. The HSI is only
available on the A/E PFD during ascent (MM 102,
103, 104), return to launch site (MM 601, 602) and
entry/landing (MM 603, 304, 305) phases.
The HSI provides an independent software
source to compare with ascent and entry
guidance, a means of assessing the health of
individual navigation aids during entry, and
information needed by the flight crew to fly
manual ascent, return to launch site, and entry.
HSI Ascent Displays
During nominal ascent (MM 102 and 103, first
and second stage), the HSI provides information
about the target insertion orbit. The compass
card displays heading with respect to target
insertion plane.
The mission-defined target
insertion plane is defined to be 0 on the compass
card and the magenta-colored course arrow
points directly to 0. The compass card headings
on ascent are also displayed with respect to

vehicle orientation. While the orbiter is rolled

heads-down, the compass card headings increase
in a counterclockwise direction, and while headsup the compass card is flipped so headings
increase in a clockwise direction. The heading of
the body plus X axis (the nose of the orbiter) with
respect to the target insertion plane is read at the
lubber line.
The Earth-relative velocity (Vrel) or E bearing
pointer provides the heading of the Vrel vector
with respect to the target insertion orbit plane.
The angular difference between the Vrel and the
orbiter nose, Beta, is displayed in a digital
readout box to the upper-left of the HSI. Both
the E pointer and the Beta box are pertinent
while on the solid rocket boosters (SRBs) and
through SRB separation. They will be removed
(blank) after a mission-elapsed time (MET) of 2
minutes and 30 seconds, or at an altitude of
200,000 feet.
The inertial velocity (Vi), or I bearing pointer,
provides the heading of the Vi vector relative to
the target insertion plane (course arrow). This
is also displayed digitally to the right of the HSI
in the delta-inclination ( Inc) box.
The course deviation indicator (CDI) deflection
indicates the lateral offset or crosstrack (in n.
mi.) between the current orbital plane and the
targeted orbital plane. The scale for the course

Horizontal Situation Indicator

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-8

USA007587
Rev. A
deviation updates throughout ascent from 50 to
10 to 1 n. mi. as the crosstrack decreases. is also
displayed digitally to the right of the HSI in the
crosstrack (X-Trk) box.
HSI Abort Displays
The HSI for ascent aborts is very similar to
nominal ascent, with some notable exceptions.
With an abort to orbit (ATO), the desired target
inclination may be redefined to equal the
current inclination, thus the course arrow
would no longer point directly to 0 on the
compass card. With the ATO abort, a digital
box displaying target inclination (Tgt Inc) will
appear to the right of the HSI, to help indicate if
the target inclination was redefined.
With a transoceanic abort landing (TAL), the
HSI will also display a Runway or R bearing
pointer, which depicts the heading of the TAL
landing site with respect to the orbiter nose
(lubber line). Also in the TAL ascent phase, the
targeted inclination is no longer applicable.
Thus the Inc box and the CDI are removed
and the Crosstrack (X-Trk) box is redefined to
show the lateral offset in nautical miles (n. mi.)
of the Vi vector with respect to the Runway
bearing pointer. Also, the magenta course
arrow no longer points to the targeted
inclination, but instead points to the tangency of
a predetermined crosstrack circle defined about
the TAL site. A delta crosstrack ( X-Trk) box is
then shown to the right of the HSI to display the
lateral offset in nautical miles of the Vi vector
with respect to the crosstrack circle tangency
(course arrow). If Vi is already pointing inside
the crosstrack circle (between the course arrow
and the runway pointer), then the delta
crosstrack is defined to be 0 n. mi.

the E bearing pointer and its associated Beta

read-out return. Also with the RTLS abort, the
HSI compass card is redefined to represent
actual magnetic heading with north, east, south,
west (N, E, S, W) directions depicted.
Ascent abort displays for the A/E PFD are
shown and described in more detail in their
respective ascent abort sections, 6.3 through 6.5.
HSI Entry Display Modes
During entry flight phases (MM304, 305, 602,
603), the HSI softwares mode and source
configuration may be controlled by cockpit
switches. The commanders HSI switches are
on panel F6, and the pilots are on panel F8.
The HSI SELECT MODE switch selects the
mode: ENTRY, TAEM, or APPROACH. These
HSI area navigation software modes are slightly
different from the guidance phases with
virtually identical names (Entry, TAEM, and
Approach and Landing). The ENTRY position
enables HSI mode auto-switching from Entry to
TAEM to Approach.
Or the TAEM and
Approach modes can be entered directly by
respectively taking the HSI SELECT MODE
switch to TAEM and APPROACH.

TACAN

1107. cnv

With a return to launch site (RTLS) abort, the

HSI will also display a Runway or R bearing
pointer, which depicts the heading of the launch
site (KSC) with respect to the orbiter nose
(lubber line).
Targeted inclination and
crosstrack are no longer applicable, thus the
course arrow, the CDI, and the digital boxes for
Inc and X-Trk are removed. Inertial velocity is
also no longer applicable, but Earth-relative
velocity becomes important, so with the RTLS
abort, the I bearing pointer is removed and

HSI SELECT Switches on Panel F6

and Panel F8
The HSI SELECT SOURCE switch selects
TACAN, navigation (NAV), or microwave
landing system (MLS); the 1, 2, 3 switch selects
one of the three TACAN or MLS units. When
the HSI SELECT SOURCE switch is positioned
to NAV, the HSI is supplied with data from the
navigation processor, and the 1, 2, 3 switch is
ignored. This makes the HSI display dependent
on the same sources as the navigation software

2.7-9

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
(IMU, selected air data, selected navigational
aids), but it is independent of guidance
targeting parameters.
When the HSI SELECT SOURCE switch is in
TACAN or MLS, the HSI area navigation
software is supplied with data derived from the
unit specified by the 1, 2, 3 switch. The TACAN
and MLS positions should only be used when
TACAN or MLS data are available. TACAN
data is used during entry to update the
navigation state, and is usually acquired about
300 nm. from the landing site. MLS has a range
of 20 nm. and would be normally be selected
after the orbiter is on the HAC.
HSI Entry Display Parameters
Depending on phase of entry, each HSI displays
magnetic heading (compass card), selected
course, runway magnetic heading, course
deviation, glideslope deviation, runway and
HAC tangency/center bearing, runway and
HAC center range, as well as bearing and
course deviation indicator (CDI) flags to
indicate validity.
Each HSI consists of a compass card measuring
0 to 360. Fixed at the center of the card is an
aircraft symbol about which the compass card
rotates.
The magnetic heading (the angle between
magnetic north and vehicle direction measured
clockwise from magnetic north) is displayed by
the compass card and read under the lubber
line located at the top of the indicator dial. (A
lubber line is a fixed line on a compass aligned
to the longitudinal axis of the craft.) The
compass card is positioned at N (north) when
the heading input is zero degrees. As the
heading point is increased, the compass card
rotates counterclockwise beneath the fixed
lubber line if flying in a heads-up attitude.
In the Entry mode (MM 304 and 602), the
compass card heading indicates the magnetic
heading of the vehicles relative velocity vector
(Vrel). When the HSI is in the TAEM and
Approach modes during MM 305 and 603, the
compass card indicates magnetic heading of the
body X axis.

2. SYSTEMS
2.7 Dedicated Display Systems

Magnetic
north

Vehicle
direction
Magnetic
heading

276.cvs

HSI Heading Geometry

The magenta-colored course arrow is used in
glided flight (MM 304 & 305 or 602 & 603) to
indicate the selected runway heading with
respect to true north. As the compass card
rotates, the course arrow will rotate with the
card. This provides a continuous reference to
the selected runway.
On entry, the HSI course deviation indicator
(CDI) shows course deviation as an angular
measurement of vehicle displacement from the
extended runway centerline.
The CDI
represents course deviation by the deflection of
the deviation bar from the course pointer line.
When the HSI is in the Entry mode (MM 304
and 602), the CDI is inactive and pegged at zero
and the scale is not labeled. When the HSI is in
the TAEM mode, full-scale deflection on the
CDI is 10 as reflected by the scale label.
When the HSI is in the Approach mode, fullscale deflection is decreased to 2.5. The CDI
is a fly to indicator for flying the vehicle to
the extended runway centerline. When the
course deviation is zero, the deviation bar is
aligned with the end of the course pointer.
With the pointer in the top half of the compass
card, an increase in course deviation to the left
(right) causes the bar to deflect to the right (left).
Software processing also ensures that the CDI
remains fly to, even when the orbiter is
heading away from the runway.

2.7-10

USA007587
Rev. A
In course deviation geometry, if the orbiter is to
the left of the runway, it must fly right (or if the
orbiter is to the right of the runway, it must fly
left) to reach the extended runway centerline.
The corresponding course deviation bar would
deflect to the right (or to the left) accordingly.
The sense of the CDI deflection is a function of
vehicle position rather than vehicle heading.

Reference Point
Runway
a, b:
Course Deviation
Angles Corresponding
to Points A and B
a

A, B:
Orbiter Positions

B
Extended Centerline

277.cvs

Course Deviation Geometry

HSI mode
Entry

TAEM

Approach

Bearing
[ ] indicates bearing
pointer label
[H] Spherical bearing to
NEP HAC intercept

Range
[ ] indicates range label
[selected rwy] Spherical
surface range to runway
touchdown point via NEP

[H] Bearing to NEP HAC

intercept

[selected rwy] Range to fly

to runway touchdown
point, via the HAC, for
selected EP (NEP or MEP)

[C] Bearing
center

[HAC-C]
distance to
center

to

HAC

[R] Bearing to runway

touchdown point

Course
deviation
(CDI)
Pegged at zero
(no CDI flag)

Glide slope
deviation (GSI)

Deviation from
runway
centerline (full
scale 10)

Error from
guidance
TAEM
reference
altitude (full
scale 5000 ft,
2500 ft)

Deviation from
runway
centerline (full
scale 2.5)

Error from
guidance A/L
reference
altitude (full
scale 1000 ft).
Not computed
below 1500 ft
(GS flag
displayed)

Horizontal
the HAC

[selected rwy] Horizontal

distance to runway touchdown point

Blanked

Compass
card
(heading)
Magnetic
heading of
vehicle
velocity
vector (flight
path)
Magnetic
heading of X
body axis

Magnetic
heading of X
body axis

HSI Function Matrix

With the HSI in the TAEM and Approach
modes (MM 305 and 603), glideslope deviation,
the distance of the vehicle above or below the
desired glideslope, is indicated by the deflection
of the glide slope indicator (GSI) pointer
displayed to the right of the HSI. The GSI
display is blank when the HSI is in the Entry
mode. The pointer is a fly to indicator, so an
increase in glideslope deviation above (below)

the desired slope

downward (upward).

deflects

the

pointer

The desired glideslope is actually only a

conceptual term in HSI processing. At any
instance, the HSI GSI deviation is really the
difference between the current orbiter altitude
and a reference altitude computed by Area Nav.
This reference altitude may be slightly different
than the reference altitude computed by

2.7-11

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
guidance.
Also included in the reference
altitude equation are factors for a heavy
orbiter and for high winds.

305 and 602, 603). The HAC Center bearing

pointer, labeled C, indicates bearing to the
HAC center when in the TAEM mode (MM 305
and 603). When the HSI is in the Approach
mode, the H bearing pointer is redefined to
indicate the bearing to the touchdown point at the
primary runway (way point 2).
When the bearing inputs are zero, the pointers
are at the top lubber line, regardless of compass
card position. The bearing pointer commands
are developed by subtracting the vehicle
heading from the calculated bearing values.
When the bearing inputs are increased, the
pointers rotate clockwise about the compass
card. The pointer does not reverse when it
passes through 360 in either direction. In other
words, each bearing pointer has a reciprocal
tail of the pointer 180o out.

HORIZ SIT Display (SPEC 50)

Runway

The HORIZ SIT display (SPEC 50) allows the

flight crew to configure the software for
nominal winds or high head winds. The item 7
entry toggles to select the nominal entry point
(NEP) or minimum entry point (MEP), which
determines the distance from the runway
threshold to the intersection of the glideslope
with the runway centerline or aim point. The
item 8 entry toggles from the nominal (NOM)
aim point to the close-in (CLSE) or high-wind
aim point, which pushes the intercept point
closer to the runway threshold. The distance
selected is factored into the computation of HSI
reference altitude from which the glideslope
deviation is derived.
The GSI in TAEM indicates deviations from the
guidance reference altitude 5,000 feet. The GSI
during approach and landing indicates
guidance reference altitude 1,000 feet.
The HSI GSI computation is not processed
below 1,500 feet during the Approach mode; so
the glideslope indicator flag (GS) is displayed.
In glided flight, the HSI also displays bearing
pointers relative to the compass card. The HAC
bearing pointer, labeled H, indicates spherical
bearing to HAC tangency point (Way Point 1)
when in the Entry and TAEM modes (MM 304,

2. SYSTEMS
2.7 Dedicated Display Systems

Magnetic
north

R
an
g

Bearing
angle

Reference
point

278.cvs

Horizontal Situation Indicator Bearing and

Range Geometry
The HSI also displays range values immediately
to the right of the compass card. With TAL,
RTLS, or East Coast Abort Landing (ECAL) and
entry phases, the selected runway is displayed
immediately above a box with a digital readout
of range to the runway in nautical miles (nm).
On entry this range includes the curvilinear
geometry for a path to the HAC tangency,
around the HAC and to the runway threshold.
In the TAEM mode, a range box for HAC center
(HAC-C) will also appear, showing the straightline range from the vehcile to the center of the
HAC in nautical miles.

2.7-12

USA007587
Rev. A

HSI Flight Path Geometry-Top View

Heading alignment cone

Reference altitude
(used by guidance)

W a y p o int 1

N om inal entry po int

R u n way

Fina l a p pro ac h
stee p g lid e slo pe

W a y p o int 2

Steep guideslope
intercept point

Fina l a p pro ac h
sh a llo w glid es lo pe

R un way centerlin e

280.cv5

HSI Flight Path Geometry-Side View

2.7-13

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
The HSI has three OFF flags BRG (bearing),
GS (glideslope), and CDI identifying invalid
data. BRG indicates invalid course and/or
bearing data. GS indicates invalid glideslope
deviation.
CDI indicates invalid course
deviation data.

ranges from -180 to +180. Below Mach 3.0, a

magenta diamond indicates the optimum alpha
for maximum lift-over-drag (max L/D). On
entry (MM 304, 305, 602, and 603), except for
contingency aborts, a green bar on the tape
depicts
the
range
of
allowable
maximum/minimum alphas.

Also during entry and the acquisition phase of

TAEM, the current Az (delta azimuth) is
displayed to the upper-right of the HSI. Az is
the angular difference between the heading to
the HAC tangency point and the heading of the
relative velocity vector (entry) or the vehicle
heading (TAEM). When the guidance enters the
HAC phase during TAEM, the Az field is
blanked.

Flight Instrument Tapes

The flight instrument tapes consist of several
meters and/or digital displays indicating angle
of attack (), vehicle Mach or velocity (M/V),
knots equivalent airspeed (KEAS), altitude (H),
altitude rate (H dot), altitude acceleration (H
double dot), and a g-meter (Accel/Nz). For each of
the tapes, with the exception of altitude
acceleration, the value is read by a digital
window centered on the moving tape. The flight
instrument tapes are only available on the
ascent/entry primary flight display (A/E PFD).
Some documentation refer to the tapes as the
alpha/Mach
indicator
(AMI)
and
the
altitude/vertical velocity indicator (AVVI),
refering to the old cockpit configuration when
the tapes were displayed in a separate format.
The AMI consisted of the angle of attack, velocity
and airspeed tapes. The AVVI consisted of the
altitude, altitude rate, and altitude acceleration
tapes.
The tape displays vehicle angle of attack,
defined as the angle between the vehicle plus X
axis and the wind-relative velocity vector
(negative wind vector). Alpha is shown in a
scrolling window with a fixed pointer
indicating the current angle of attack in 1
increments.
The digital decimal value is
provided as part of the pointer using white
numbers on a black background. Positive alpha
values are black numbers on a white
background, and negative values are white
numbers on a black background. The tape
2. SYSTEMS
2.7 Dedicated Display Systems

Angle of Attack
On ascent and on entry above Mach 0.9, the M/V
tape displays Mach number, relative velocity
(Vrel), or inertial velocity (Vi). Mach number is
the ratio of vehicle airspeed to the speed of
sound in the same medium. The Vrel is in feet
per second in relation to the Earth. Vi is in feet
per second and does not consider the rotational
speed of the surface. The actual parameter
displayed is always Mach number; the tape is
simply rescaled above Mach 4 to read Vrel (MM
102, 304, 305, 602 and 603 with the tape labeled
M/VR) or Vi (MM 103 and 601 with the tape
labeled M/VI). The scale ranges from 0 to 27.0K
feet per second, with a scale change at Mach 4
(4.0M). Located below the tape is a digital
readout box displaying knots equivalent
airspeed (KEAS).
Below Mach 0.9 on entry, the M/VR tape swaps
with the KEAS digital box. The KEAS tape
range is zero to 500 knots, and scaling is 1 inch
per 10 knots. The digital readout box will then
read Mach number.

2.7-14

USA007587
Rev. A
(AA) normal acceleration (NZ) value and is
labeled NZ. A magenta Target NZ line is
provided during MM 602 showing the Target
NZ value calculated on RTLS and contingency
aborts in glided flight.
The H (altitude) tape displays the altitude of the
vehicle above the runway (nav-derived or
barometric altitude). The scale range is 1,100
feet to +165 n.mi., with scale changes at -100, 0,
200, 2000, 30K, 100K and 400K feet. The scale is
in feet from 1,100 to 400K and in n.mi. from
+65 nm to +165 n.mi.
The altitude tape has black number and
markings on a white background for altitudes
above 2,000 feet. The tape background color is
yellow for altitudes below 2,000 feet.
When the radar altimeter (RA) sensor selected
by the commander (pilot) is locked on, an R
appears to the right of the altitude digital, and
the digital is driven by the RA data on the
commanders (pilots) PFD. A floating yellow
triangle also appears to the right of the tape at
the value of the RA altitude. If no RA is locked
on, a K, indicating thousands of feet, or an
M, indicating nautical miles will appear to the
right of the altitude tape digital indicating the
units.

Entry PFD above Mach 0.9

The H& tape displays vehicle altitude rate. The

scale range is 2,940 to +2,940 feet per second
with scale changes at 740 feet per second and
+740 feet per second. The negative and positive
regions are color-reversed: negative numbers
are white on a gray background and positive
numbers are black on white.

Entry PFD below Mach 0.9

The g-meter is a circular meter in the lower-left
corner of the A/E PFD which displays vehicle
acceleration from -1g up to 4g on ascent during
powered flight (MM 102, 103, and 601) and entry
(MM 304, 305, 602 and 603). The value is displayed
via a green arrow on the meter and a digital
readout box. In powered flight, the meter reflects
the IMU-derived vehicle acceleration and is
labeled Accel. During glided flight, the meter
displays the selected accelerometer assembly

&& tape is dislayed in the lower-right corner

The H
of the PFD on entry during MM 304 and 602
and indicates altitude acceleration of the
vehicle. A triangular pointer moves along the
fixed scale. The scale range is 10 to +10 ft/sec2,
where the negative side is grey and the positive
side is white. Software limits acceleration
values to 12.75 ft/sec2.

The RDR ALT indicator is controlled by the

RADAR ALTM switch on panel F6 for the
commander and panel F8 for the pilot. RADAR
ALTM positioned to 1 selects radar altimeter 1;
2 selects radar altimeter 2.

2.7-15

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
displayed. The probes are not deployed until
below Mach 5, however, the data will not be
accurate until the velocity is less than Mach 3.5,
due to calibration of the probes.

Commanders RADAR ALTM Switch

on Panel F6
Commanders AIR DATA Switch on Panel F6

Pilots RADAR ALTM Switch on Panel F8

With the AIR DATA source switch in the NAV
&& tapes are navigationposition, the H, H& , H
derived. The AIR DATA switch is positioned to
LEFT or RIGHT to select the left or right air data
probe after air data probe deployment at Mach
5. With the switch in LEFT or RIGHT, the H,
H& , tapes receive information from the selected
&& tape still receives
air data probe, but the H
navigation data.
The AIR DATA switch on panel F6 for the
commander and panel F8 for the pilot also
determines the source of data for the , M/V, and
KEAS tapes and/or digital readouts When in the
NAV position, the same parameters (alpha, Mach
and airspeed) that are sent to guidance, flight
control, navigation, and other software users are
displayed.
With the switch in LEFT or RIGHT the left or right
air data probe assembly data is processed and
2. SYSTEMS
2.7 Dedicated Display Systems

Pilots AIR DATA Switch on Panel F8

PFD Status Indicators

Unlike the Orbit PFD, the A/E PFD has four
status fields, two each in the upper left and
right corners, which display the major mode,
abort mode, DAP, ADI attitude switch position,
and SBTC status. These status indicators will
change, depending upon the phase of flight, to
show appropriate data.
The top right status indicator field always
displays the major mode. If an abort has been
declared, an indicator will be displayed
immediately to right of the major mode (R for
RTLS, T for TAL, CA for contingency aborts,
AOA, or ATO).
During powered flight (MM 102, 103 and 601),
the left side fields display the DAP mode
(AUTO or CSS) and the throttle mode (AUTO or

2.7-16

USA007587
Rev. A
MAN). If either CSS or MAN are selected, a
yellow box will outline the field to indicate an
off-nominal configuration. Post-MECO (MM
104-106), the DAP mode indicates either AUTO
or INRTL, while the throttle field will blank.

BODY FLAP
ELEVONS
RUDDER-DEG
%
DEG
TE UP
30 20 10 0 10 20

L RUD

-30

Also the bottom right status displays the ADI

attitude switch, either Inrtl, LVLH, or. Ref
during ascent and post-MECO.

40

-10

R RUD
AILERON-DEG

20

-20

30

L AIL

R AIL

60

SPEEDBRAKE %
ACTUAL

+10

80

+20

100

20

40

60

80

080

COMMAND

TE DW

080
100

289.CNV

Example of PFD Status Indicators in MM 102

During entry transition (MM301-303), the status
fields display the same functions as postMECO.
During entry (MM304, 305, 602, and 603), the
left side fields display both the DAP pitch and
roll/yaw modes (AUTO or CSS). The bottom
right field displays the speedbrake mode
(AUTO or MAN). If either MAN speedbrake is
selected, or if CSS is selected above Mach 1.0, a
yellow rectangle is drawn around the indicator.

Surface Position Indicator

The four elevon position indicators show the
elevon positions in the order of appearance as
viewed from behind the vehicle (left outboard,
left inboard, right inboard, right outboard). The
scales all range from +20 to -35, which are
near the software limits for the elevon
commands. The pointers are driven by four
separate signals and can read different values, but
normally the left pair is identical and the right
pair is identical. Positive elevon is below the null
line (elevon deflected down) and negative is
above (elevon deflected up).
E LE VON S
DE G

-30
-20
Fu ll u p - 33
E lev on

Example of PFD Status Indicators in MM304

-10
N ull

W ing s ec tio n

F ull dow n + 18

Surface Position Indicator (SPI)

0
+1 0
+2 0

The SPI is a MEDS display that is active during

entry (MM 304, 305, 602 and 603) and displays
the actual positions of the elevons, body flap,
rudder, aileron, and speedbrake, as well as the
commanded speedbrake position.
The IDPs get data from analog-to-digital
converters (ADCs) 1A and 1B for display on the
SPI (see Section 2.6 for more information on
IDPs and ADCs). For ADC failures or invalid
data cases, the SPI bars will be outlined in red
and the triangles will disappear.

2.7-17

B OD Y F L AP
%

0
20

0%

(-1 1

.7 )

40
60

10

Tra il ( 3 4% )

0%

(+

80
22

.5

100
2 90 .cvs

SPI Elevon Travel

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
The body flap scale reads body flap positions
from zero to 100 percent of software-allowed
travel. Zero percent corresponds to full up
(-11.7) and 100 percent corresponds to full
down (+22.5). The small pointer at 34 percent
is fixed and shows the trail position.

si
Po

tion

- 20

on
lev

ft E
e
n - 10
L
Po sitio
E levon
t
h
ig
R

10

Wing section

Rudder position is displayed as if viewed from

the rear of the vehicle. Deflection to the left of
center represents left rudder. The scale is +30
(left) to 30 (right), but software limits the
rudder command to 27.1.

ELEVONS
DEG
TE UP

AILERON-DEG

L AIL

5
R AIL

-30
Aileron =

-20

-20 + 10
2

= -5

-10
0

RUDDER-DEG

30 20 10
L RUD

10 20

30

+10
+20

R RUD

TE DW

-27.1
(right)

292.cvs

SPI Aileron Travel

0
+27.1
(left)

291.cnv

SPI Rudder Travel

The aileron display measures the effective
aileron function of the elevons in combination.
Aileron position equals the difference between
the average of the left and right elevon divided
by two. Deflection of the pointer to the right of
center indicates a roll-right configuration (left
elevons down, right elevons up) and vice versa.
The scale is 5 to +5, with 5 at the left side.
The aileron command can exceed 5 (max.
10), in which case the meter saturates at 5.

The speed brake position indicator indicates the

actual position on the upper scale and
commanded position on the lower scale. The
position ranges from zero to 100 percent; zero
percent is fully closed, and 100 percent is fully
open, which corresponds to 98 percent with
respect to the hinge lines.
The speed brake command is scaled identically to
position and has the same travel limits. It always
represents the speed brake auto guidance
command.
49.3

25%
98.6
(100% open)

SPEEDBRAKE %
ACTUAL
065

20 40 60 80 100
49.3
COMMAND

065
293.cvs

SPI Top View of Open Speed Brake

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-18

USA007587
Rev. A

Flight Control System Pushbutton

Indicators

Reaction Control System Command Lights

The flight control systems pushbutton

indicators transmit flight crew moding requests
to the digital autopilot (DAP) in the flight
control software and reflect selection by
illuminating the effective DAP state. These
indicators are located on panel F2 for the
commander and panel F4 for the pilot.

The RCS COMMAND lights on panel F6 are

active post-MECO during MM 104-106, OPS 2, 8,
3, and MM 602-603. Their primary function is to
indicate reaction control system (RCS) jet
commands by axis and direction during
transitional and orbit phases. Their secondary
function on entry is to indicate when more than
two yaw jets are commanded and when the
elevon drive rate is saturated.

The pushbutton indicators are used to command

and reflect the status of the pitch and roll/yaw
control modes. The PITCH and ROLL/YAW
indicator pushbuttons transmit moding requests
to the DAP as well as light up to indicate the
effective state of the pitch and roll/yaw DAP
channels.
AUTO indicates that control of that axis (pitch
or roll/yaw) is automatic, and no crew inputs
are required. CSS is control stick steering; crew
inputs are required, but are smoothed by the
DAP
(stability
augmentation,
turn
coordination).
The SPD BK/THROT (speed brake/throttle)
pushbutton indicator is a single pushbutton
with two separate lights, AUTO and MAN, to
indicate that the DAP speed brake channel is in
the automatic or manual mode.
When
depressed, the pushbutton only transmits the
AUTO request. The MAN indicator will only
light up for which ever position, commander or
pilot has taken manual control with the
speedbrake/thrust controller (SBTC). Only one
position at a time, commander or pilot, can have
MAN selected.
The BODY FLAP pushbutton indicator is also one
pushbutton with separate AUTO and MAN lights,
indicating the state of the body flap channel.

On entry, MM304, until the roll jets are no

longer commanded (dynamic pressure exceeds
10 pounds per square foot), the ROLL L and R
lights indicate that left or right roll jet
commands have been issued by the DAP. The
minimum light-on duration is extended so that
the light can be seen even during minimumimpulse firings. On entry (MM304 and 602),
when dynamic pressure is greater than or equal
to 10 pounds per square foot, the ROLL lights
are quiescent until 50 pounds per square foot,
after which time both lights (L and R) are
illuminated whenever more than two yaw jets
are commanded on.
On entry, OPS 3 and 6, the PITCH U and D
lights indicate up and down pitch jet commands
until dynamic pressure equals 40 pounds per
square foot, after which the pitch jets are no
longer used. When dynamic pressure is 50
pounds per square foot or more, the PITCH
lights, like the ROLL lights, assume a new
function. Both light (U and D) whenever the
elevon surface drive rate exceeds 20 per second
(14 per second if only one hydraulic system is
working).
On entry, the YAW L and R lights function as
yaw jet command indicators throughout entry
until the yaw jets are disabled at Mach 1. The
yaw lights have no other functions.

2.7-19

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
Entry Flight Control System Mode Pushbutton Indicator Light Logic
LIGHTS

LEFT/RIGHT LIGHT LOGIC

}
}

PITCH AUTO

Both on or both off

PITCH CSS

both on or both off

ROLL/YAW AUTO

Both on or both off

ROLL/YAW CSS

Auto, CSS
mutually
exclusive

Auto, CSS
mutually
both on or both off exclusive

CAUSES
PITCH AUTO pushbutton indicator depressed
PITCH CSS pushbutton indicator depressed or RHC out of detent in pitch
ROLL/YAW AUTO pushbutton indicator depressed
ROLL/YAW CSS pushbutton indicator depressed or RHC out of detent in roll or yaw

SPD BK/THROT

AUTO

Both on or both off

MAN

One on, one off

Auto, man.
mutually
exclusive

Neither SBTC takeover pushbutton depressed or AUTO pushbutton depressed

Either SBTC takeover pushbutton depressed

BODY FLAP

AUTO

Auto, man.
mutually
Both on or both off exclusive
Both on or both off

MAN

AUTO pushbutton indicator depressed

MAN pushbutton depressed

Commanders Flight Control System Pushbutton Light Indicators on Panel F2

Pilots Flight Control System Pushbutton Light Indicators on panel F4

RCS COMMAND Lights on Panel F6

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-20

USA007587
Rev. A

Head-Up Display (HUD)

The HUD is an optical miniprocessor that cues
the commander and/or pilot during the final
phase of entry and particularly in the final
approach to the runway.
With minimal
movement of their eyes from the forward
windows (head up) to the dedicated display
instruments (head down), the commander and
pilot can read data from head-up displays
located in the front of them on their respective
glareshields. The HUD presents the same data
that is presented on several other instruments,
including the PFD and the SPI.
The HUD allows out-of-the-window viewing by
superimposing
flight
commands
and
information on a transparent combiner in the
windows field of view. Since the orbiter
avionics systems are digital, and minimal
impact on the orbiter was paramount, the headup display drive electronics were designed to
receive data from the orbiter data buses. The
HUD electronics utilize, to the maximum extent
possible, the same data that drive the existing
electromechanical display devices. The orbiter
display device uses a CRT to create the image,
which is then projected through a series of lenses
onto a combining glass.
Each HUD is a single-string system, but it is
connected to two data buses for redundancy. It
is an electronic/optical device with two sets of
combiner glasses located above the glareshield
in the direct line of sight of the commander and
the pilot.
Essential flight information for
vehicle guidance and control during approach
and landing is projected on the combiner
glasses and focused at infinity.

The images, generated by a small CRT and

passed through a series of lenses, are displayed
to the flight crew on the combiners as lighted
symbology.
The transmissiveness of the
combiner allows the crew to look through it and
see actual targets like the runway.
For instance, if the crew is 9,000 feet on the final
approach course in a solid overcast, the base of
which is at 8,000 feet, the lighted outline of the
runway would be displayed on the combiner.
However, when the orbiter exits the overcast at
8,000 feet, the lighted outline of the runway
would be superimposed on the real runway. As
the orbiter proceeds down the steep glideslope,
the velocity vector is superimposed over the
glideslope aim point. At preflare altitude, flare
triangles move up to command the pullout. The
pilot maintains the velocity vector symbol
between the triangles. After a short period of
stabilized flight on the shallow glideslope, the
guidance diamond commands a pitch-up until
the nose is about 8 above the horizon, which is
essentially the touchdown attitude.
After
touchdown, during the rollout phase, the crew
maintains the approximate touchdown attitude,
+6 theta (nose above the horizon), until 185
knots equivalent airspeed and then commands
a derotation maneuver.
The HUD has proved to be a valuable landing
aid and is considered the primary pilot display
during this critical flight phase.
A HUD POWER ON/OFF switch located on the
left side of panel F3 provides and terminates
electrical power to the commanders head-up
display on panel F6. A second switch is located
on the right side of panel F3 for the pilots headup display on panel F8.

Panel F3

2.7-21

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A
WARNING
A generic hardware problem has been
identified in several HUD units. At 13
KFT, the flight director symbol is uncaged
). Cycling
to become a velocity vector (
HUD POWER after this transition may
result in erroneous symbol positioning.
Flying these false cues would result in
landing short of the runway, at a very high
sink rate. (Ref: JSC Memo DF6-90-053)

A three-position MODE switch is located below

the HUD. In the NORM position, automatic
sequencing of formats and symbology is
provided. The TEST position forces up a test
display for 5 seconds.
Selection of the
momentary DCLT (declutter) position initiates a
symbol blanking routine. Successive selections
of DCLT will serially remove display elements
in the following order. The first activation
removes the runway symbology. The second
activation removes the airspeed and altitude
tapes (replacing them with digital values) and
the horizon/pitch attitude scales, but leaves the
horizon line when within FOV. The third
declutter level removes all symbology except
for the boresight. A fourth declutter attempt
will return the HUD to its original form with all
symbols displayed.
Data displayed on the HUD comes from the
GPCs across flight critical (FC) databus 1 or 2
for the CDRs HUD and FC databus 3 or 4 for
the PLTs HUD. A HUD databus switch on
panel F6 (CDR) or F8 (PLT) controls the data
source.

Head-Up Display and Controls on Panel F6

(Identical on Panel F8)

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-22

USA007587
Rev. A

Fixed
flight
director

10

Boresight
Flight path
pitch attitude
15

250
Guidance

26

260

Altitude
reference
monitor
R

1.2G

20
25

Airspeed
scale

Altitude
scale
270

24

Normal
acceleration
HDG
Guidance mode
descriptor

Speedbrake
position

Commanded
speedbrake
position

300.cvs

Approach and Land Display (TAEM Heading Phase); No Declutter

27 0
15

28 0
8
R
20
29 0
7

OGS
301.cvs

Approach and Land Display (Declutter Level 1)

2.7-23

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A

285

8000

OGS
Note: Horizon is displayed when
in the HUD FOV.

302.cvs

Approach and Land Display (Declutter Level 2)

Approach and Land Display (Declutter Level 3)

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-24

USA007587
Rev. A

Dedicated Display Systems Summary

Data

The A/E PFD has a status indicator field

across the top for major mode, abort, and
DAP status.

Dedicated displays are located on the flight

instrument and subsystem status displays
driven on the 11 multifunction display units
(MDU) in a MEDS cockpit.

The orbit PFD is simply an ADI with no

status indicators across the top.

Dedicated displays include: the primary

flight displays (PFDs), SPI, RCS activity
lights, and HUDs.
Circuit breakers for device driver units are
located on panels O14, O15, and O16.
The attitude director indicator (ADI) displays
orbiter attitude by a simulated ball gimbaled
to represent three degrees of freedom.
The PFD will alter appearance based upon
phase of flight and abort mode.
The horizontal situation indicator (HSI)
visually
displays
certain
guidance,
navigation, and control parameters such as
directions, distances, and course/glide path
deviation.

The SPI displays actual positions of the

elevons, body flap, rudder, aileron, and
speedbrake.
Speedbrake commanded
position is also displayed.
The HUD cues the commander and/or pilot
during
final
phases
of
entry
by
superimposing
flight
commands
and
information on a transparent combiner in the
windows field of view. Power switches are
located on panel F3.
On orbit, when in the Flight Control System
(FCS) checkout mode (MM 801), all displays
can be driven by test software to allow the
crew to verify correct operation prior to
entry.

The Ascent/Entry PFD (A/E PFD) displays

flight instruments, which include angle of
attack, vehicle velocity, knots equivalent
airspeed,
acceleration,
altitude,
radar
altitude. vertical velocity, and vertical
acceleration on a flight phase-tailored basis
for ascent, aborts, and entry.

2.7-25

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A

Panel F6

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-26

USA007587
Rev. A

Panel F8

2.7-27

2. SYSTEMS
2.7 Dedicated Display Systems

USA007587
Rev. A

Panel A6U

2. SYSTEMS
2.7 Dedicated Display Systems

2.7-28

USA007587
Rev. A

2.8

Power is controlled and distributed by

assemblies located in the forward, mid, and aft
sections of the orbiter. Each assembly is a
housing for electrical components such as remote
switching devices, buses, resistors, diodes, and
fuses. Each assembly usually contains a power
bus or buses and remote switching devices for
distributing bus power to subsystems located in
its area.

ELECTRICAL POWER SYSTEM

(EPS)

CONTENTS
Description............................................
Power Reactants Storage and
Distribution System ..................
Fuel Cell System ...................................
Electrical Power Distribution and
Control ........................................
APCU and SSPTS .................................
Operations.............................................
EPS Caution and Warning Summary
EPS Summary Data..............................
EPS Rules of Thumb ............................

2.8-1
2.8-1
2.8-9

Power Reactants Storage and Distribution

System

2.8-20
2.8-33
2.8-37
2.8-39
2.8-46
2.8-46

Description
The electrical power system (EPS) consists of the
equipment and reactants that produce electrical
power for distribution throughout the orbiter
vehicle, and fulfill all the orbiter external tank,
solid rocket booster, and payload power
requirements, when not connected to ground
support equipment. The EPS operates during all
phases of flight. For nominal operations, very
little flight crew interaction is required by the
EPS.
The EPS is functionally divided into three
subsystems: power reactants storage and distribution (PRSD), three fuel cell (FC) power plants,
and electrical power distribution and control
(EPDC).
Through a chemical reaction, the three FCs
generate all 28-volt direct-current electrical
power for the vehicle from launch minus 50
seconds through landing rollout. Prior to that,
electrical power is provided by ground power
supplies and the onboard FCs.

The PRSD system stores the reactants (cryogenic

hydrogen and oxygen) and supplies them to the
three FCs that generate all the electrical power for
the vehicle during all mission phases.
In
addition, the subsystem supplies cryogenic
oxygen to the environmental control and life
support system (ECLSS) for crew cabin
pressurization. The hydrogen and oxygen are
stored in tanks at cryogenic temperatures (-285F
for liquid oxygen and -420 F for liquid
hydrogen) and supercritical pressures (above 731
psia for oxygen and above 188 psia for
hydrogen).
The PRSD system components are located in the
orbiter midbody underneath the payload bay
liner. The system stores the cryogenic hydrogen
and oxygen in double-walled, thermally
insulated spherical tanks with a vacuum annulus
between the inner pressure vessel and outer tank
shell. Each tank has heaters to add energy to the
reactants during depletion to control pressure.
Each tank has sensors that measure temperature,
pressure, and quantity.
The tanks are grouped in sets of one hydrogen
and one oxygen tank. The number of tank sets
installed depends on the specific mission
requirement and vehicle. Up to five tank sets can
be installed in the midfuselage under the payload
bay liner.

2.8-1

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

Po w e r
re a ctan ts
sto ra g e &
distrib u tio n
syste m

H2

O2

DC
Fu e l ce ll po w e r
syste m
(3)

AC g e n era tio n
& d istrib utio n

DC bus
distrib u tio n
syste m
(m a in , e sse n tia l,
co n trol, a nd
pa yloa d b use s)

Lo a d s

H2O
En viro nm e n ta l
co n tro l a nd
life su p p o rt syste m
307 .cv s

The Electrical Power System

Switch inputs and dedicated displays

Power
reactant
storage
and
distribution

Caution/
warning

To annunciator
Matrix

Displays
and
controls

Instrumentation

Oxygen

Telemetry
Environmental
control
and life
support system

Data
processing
system

To CRTs

Heat and water

Fuel
cells
Switch inputs and dedicated displays

Electrical Power System Interfaces

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-2

308.cvs

USA007587
Rev. A

O2

MANF P
P

TK1

TO ECS
SYS 1

CRYO

FC1
REAC
VLV

SPLY
VLV

MANF P

H2
TK1

REAC
VLV

MANF
VLV

MANF
VLV

TK3

TK3
FC3
REAC
VLV

TK5

REAC
VLV

TK5

TK4
TK4
MANF
VLV

MANF
VLV
TO ECS
SYS 2

SPLY
VLV
REAC
VLV

REAC
VLV
FC2

TK2

TK2

MANF P

MANF P
usa007587_309r3.cvx

The PRSD System

Cryogenic Storage Tanks
All oxygen tanks are identical and consist of
inner pressure vessels of Inconel 718 and outer
shells of aluminum 2219. The inner vessel is
33.435 inches in diameter and the outer shell is
36.8 inches in diameter. Each tank has a volume
of 11.2 cubic feet and stores up to 781 pounds of
oxygen. The dry weight of each tank is 215
pounds. Maximum fill time is 45 minutes.
All hydrogen tanks are also identical. Both the
inner pressure vessel and the outer shell are
constructed of aluminum 2219.
The inner
vessels diameter is 41.51 inches and the outer
shells is 45.5 inches. The volume of each tank is
21.39 cubic feet, and each stores up to 92 pounds
of hydrogen. Each tank weighs 227 pounds dry.
Maximum fill time is 45 minutes.
The inner pressure vessels are kept supercold by
minimizing conductive, convective, and radiant
heat transfer. Twelve low-conductive supports
suspend the inner vessel within the outer shell.
Radiant heat transfer is reduced by a shield
between the inner vessel and outer shell

(hydrogen tanks only), and convective heat

transfer is minimized by maintaining a vacuum
between the vessel and shell. During ground
operations, a vacuum ion pump maintains the
required vacuum level and is also used as a
vacuum gauge to determine the vacuums
integrity. The pump consists of an electrical
power supply and an anode, which absorbs free
ions between the tank walls.
Cryogenic Tank Heaters
Each hydrogen tank has one heater probe with
two elements; each oxygen tank has two heater
probes with two elements per probe. As the
reactants are depleted, the heaters add heat
energy to maintain a constant pressure in the
tanks.
The heaters operate in automatic and manual
modes. In the automatic mode, the heater is
controlled by a tank heater controller. Each
heater controller receives a signal from a tank
pressure sensor. If pressure in a tank is less than
or equal to a specific pressure, the controller
turns the heater on. When the pressure in the

2.8-3

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
tanks goes above the upper limit, the respective
controller turns the heater off. The O2 TK1, 2, 3,
and H2 TK1, 2, 3 heater switches are located on
panel R1; switches for the O2 and H2 TK4 heaters
are on panel A11. The heater switches for tank set
5 are on panel A15.

H2 PRESS meters on panel O2. The specific tank

(1, 2, 3, 4, or 5) is selected by the rotary switch
below the meters.

Heater controller psia

Pressure limits

Low

High

(psia)
H2 tank 1, 2

200-206

220-226

H2 tank 3-5

217-223

237-243

O2 tank 1,2

803-819

838-854

O2 tank 3-5

832-848

866-882

CRYO TANK 4 HEATER Switches

on Panel A11

O2 and H2 TK HEATERS Switches

on Panel R1
Dual-mode heater operation is available for pairs
of oxygen and hydrogen tanks. If the heaters of
both tanks 1 and 2, or tanks 3 and 4, are put in
the automatic mode, the tank heater logic is
interconnected.
In this case, the heater
controllers of both tanks must sense a low
pressure before the heaters will turn on. Once
they are on, a high pressure signal from either
tank will turn off the heaters in both tanks.

Cryogenic System Meters and Switches on

Panel O2
Each tank set has a hydrogen/oxygen control
box that contains the electrical logic for the
hydrogen and oxygen heaters and controllers.
The control box is located on cold plates in the
midbody under the payload bay envelope.

In the manual mode, the flight crew controls the

heaters by using the ON OFF positions for each
heaters switch on panel R1, A11, or A15.
Pressure in each tank is shown as O2 TK P and
H2 TK P on the DISP 68 CRYO SYSTEM display.
Pressure is also displayed on the CRYO O2 and
2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-4

USA007587
Rev. A
to RESET. The TEST position will cause a 1.5amp delta current to flow through all four
detectors of a specified oxygen tank, causing
them to trip out. During on-orbit operations, the
flight crew will be alerted to a current level
detector trip-out by an SM ALERT, S68 CRY0 02
message.

DISP 68 CRYO SYSTEM Display (on orbit)

The CRYO O2 HTR ASSY TEMP meter on panel
O2, in conjunction with the rotary switch below
it, selects one of the two heaters in each tank and
permits the temperature of the heater element to
be displayed. The range of the display is from
-425 F to +475 F. The temperature sensor in
each heater also is hard-wired directly to the
caution and warning system, which drives the
yellow O2 HEATER TEMP light on panel F7.
This light is illuminated if the temperature is at
or above 344 F. A signal also is sent to the GPCs
where software checks the limit; if the
temperature is at or above 349 F, the BACKUP
C/W ALARM light on panel F7 is illuminated.
This signal also is displayed on SM SPEC 68
CRYO SYSTEM and transmitted to the ground.
Two current level detectors are built into the
circuit of each oxygen tank heater to interrupt
power in case of electrical shorts. The second
detector is redundant. Each heater assembly has a
corresponding set of detectors, A and B, which
monitor the heater A current and the heater B
current, respectively. The detectors are powered
by circuit breakers on panels O14, O15, O16, and
ML86B. The detectors monitor the current going
into and out of a heater. If the current difference
is 0.9 amps or greater for 5 milliseconds, a trip
signal is sent to the heater logic to remove power
from the heaters, regardless of the heater switch
position. If one element of a heater causes a
trip-out, power to both elements is removed.
The O2 TK 1, 2, 3 HEATERS RESET/ TEST
switches on panel R1 and the O2 RESET/ TEST
switches on panels A11 and A15 can be used to
reapply power to that heater by positioning them

Cryogenic System Heater Sensor Circuit

Breaker on Panel O14
Each oxygen and hydrogen tank has a quantity
sensor powered by a circuit breaker. These are
identified on panel O13 as CRYO QTY O2 (or H2)
TK 1 and TK 2 and on panel ML86B as CRYO
QTY O2 (or H2) TK 3, TK 4, and TK 5. Data from
the quantity sensors are sent to panel O2, where
the rotary switch below the meters is used to
select the tank for display on the CRYO O2 (or
H2) QTY meters. The range of the meters is zero
to 100 percent. The data are also displayed on
SM SPEC 68.

2.8-5

Cryogenic System Heater Sensor Circuit

Breaker on Panel O15

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

Cryogenic System Heater Sensor Circuit Breaker on Panel ML86B

Cryogenic System Heater Sensor Circuit

Breaker on Panel O16
There are two pressure sensors for each oxygen
and hydrogen tank. One sensor transmits its
data to the tank heater controllers, the caution
and warning matrix on panel F7, and is
displayed as "P" on SM SPEC 68. The yellow O2
PRESS light is illuminated if oxygen tank
pressure is below 540 psia or above 985 psia. The
yellow H2 PRESS light illuminates if hydrogen
tank pressure is below 153 psia or above 293.8
psia. Data from the other sensor is displayed as
TK P on SM SPEC 68 and the PRESS meters on
panel O2. The SM ALERT and BACKUP C/W
ALARM lights on panel F7 are also driven by the
data. The range of the O2 meter is 0 to 1,200 psia.
The H2 meters range is 0 to 400 psia. The range
of "P" displayed on the PASS and BFS SM SYS
SUMM 1 and SM SPEC 68 and SM SPEC 168 is
515 to 1,215 psia for oxygen and 145 to 305 psia
for hydrogen.

2. SYSTEMS
2.8 Electrical Power System (EPS)

O2 TK 1, TK 2 HEATERS RESET/TEST
Switches on Panel R1
The data from oxygen and hydrogen fluid
temperature sensors is displayed on SM SPEC 68
and transmitted to the ground.

2.8-6

USA007587
Rev. A

Cryogenic Tank Quantity Sensor Circuit Breakers on Panel ML86B

Reactant Distribution
The cryogenic reactants flow from the tanks
through a relief valve/filter package module and
a valve module. They then flow to the FCs
through a common manifold. Hydrogen is
supplied to the manifold from the tank at a
pressure of 200 to 243 psia and oxygen is
supplied at 803 to 883 psia. The pressure of the
reactants will be essentially the same at the FC
interface as it is in the tanks, since only a small
decrease in pressure occurs in the distribution
system.

Cryogenic Tank Quantity Sensor Circuit

Breakers on Panel O13

Each tank has a relief valve/filter package

module that contains the tank relief valve and a
12-micron filter. The filter removes contaminants
that could affect the performance of components
within the PRSD and the FCs. The valve relieves
excessive pressure overboard that builds up in
the tank. The oxygen tank relief valve relieves at
1,005 psia and the hydrogen tank relief valve
relieves at 302 psia. Tanks one and two also have
a manifold relief valve that relieves pressure in
the manifold lines. The manifold relief valves are
a built-in safety device in the event a manifold
valve and FC reactant valve are closed because of
a malfunction. The reactants trapped in the
manifold lines would be warmed up by the
internal heat of the orbiter and overpressurize.
The manifold relief valve will open at 290 psi for
hydrogen and 975 psi for oxygen to relieve
pressure and allow the trapped reactants to flow
back to their tanks.
2.8-7

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
The reactants flow from the relief valve/filter
packages through four reactant valve modules:
two hydrogen (hydrogen valve modules 1 and 2)
and two oxygen (oxygen valve modules 1 and 2).
The valve modules contain a check valve for each
cryogenic tank line to prevent the reactants from
flowing from one tank to another in the event of
a leak. This prevents a total loss of reactants.
The oxygen valve modules also contain the
environmental control and life support system
atmosphere pressure control system 1 and 2
oxygen supply valves. Each module also contains
a manifold valve and FC reactant valves.
Each FC has two reactant valvesone for
hydrogen and one for oxygen. The valves are
controlled by the FUEL CELL 1, 3, 2 REAC
switches on panel R1. When the switch is
positioned to OPEN, the hydrogen and oxygen
reactant valves for that FC are opened and
reactants are allowed to flow from the manifold
into the FC. When the switch is positioned to
CLOSE, the hydrogen and oxygen reactant valves
for that FC are closed, isolating the reactants from
the FC and rendering that FC inoperative. Each
FUEL CELL REAC switch on panel R1 also has
two talkback indicators, one on each side of the
switch. The corresponding talkback indicates OP
when the valve is OPEN and CL when the valve
is closed. There is redundant capability to close
the REAC VALVES via the FUEL CELL REAC
VLV circuit breakers and switches on panel C3.

FUEL CELL 1, 3, 2 REAC Switches and

Talkbacks on Panel R1

WARNING
The FUEL CELL REAC switches on panel R1
are in a vertical column with FUEL CELL 1
REAC on top, FUEL CELL 3 REAC in the
middle, and FUEL CELL 2 REAC on the
bottom.
This was done to allow the
schematic to be placed on the panel.
Because the switches are not in numerical
order, it is possible to inadvertently close the
wrong FC reactant valve when shutting
down a FC.

It is critical to have reactants available to the FCs.

When any FC reactant valve is closed, the red
FUEL CELL REAC light on panel F7 is
illuminated and a caution/warning tone is
sounded. The computers sense the closed valve,
which causes the BACKUP C/W ALARM light on
panel F7 to be illuminated, an SM ALERT to
occur, and a closed indication to be displayed on
SM SPEC 69 and SM SYS SUMM 1. This alerts
the flight crew that the FC will be inoperative
within approximately 20 to 30 seconds for a
hydrogen valve closure and 90 seconds for an
oxygen valve closure. The time varies with
power loading.
The O2 and H2 MANIFOLD VLV switches on
panel R1 control the respective hydrogen and
oxygen manifold valves. When the two hydrogen and two oxygen manifold valves are in the
2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-8

USA007587
Rev. A
CLOSE position, FC 1 receives reactants from
cryogenic tank set 1, FC 2 receives reactants from
cryogenic tank set 2, and FC 3 receives reactants
from cryogenic tank sets 3 and above. ECLSS
atmosphere pressure control system 1 receives
oxygen from oxygen tank 1, and system 2
receives oxygen from oxygen tank 2. When the
switches are positioned to CLOSE, the talkback
indicator associated with each switch indicates
CL.
With both H2 and O2 MANIFOLD VLV 1 switches
positioned to OPEN and the MANIFOLD VLV 2
switches positioned to CLOSE, cryogenic tanks 1,
3 and above supply hydrogen to FCs 1 and 3, and
oxygen cryogenic tanks 1, 3 and above supply
oxygen to FCs 1 and 3, as well as to ECLSS
atmosphere pressure control system 1. The
talkback indicator associated with each MANF
VLV 1, 2 switch indicates OP, CL, respectively.
O2 and H2 TK 2 continue to supply FC 2.

When the H2 and O2 MANIFOLD VLV 2

switches are positioned to OPEN, and the
MANIFOLD VLV 1 switches are positioned to
CLOSE, hydrogen cryogenic tanks 2 and 3 and
above supply hydrogen to FCs 2, 3, and oxygen
cryogenic tanks 2 and 3 and above supply
oxygen to FCs 2 and 3, as well as to ECLSS
atmosphere pressure control system 2. The
talkback indicator associated with each MANF
VLV 1, 2 switch indicates OP, CL, respectively.
H2 and O2 tank 1 continue to supply FC 1.
With the H2 and O2 MANIFOLD VLV 1 and 2
switches positioned to OPEN, all hydrogen
cryogenic tanks are available to supply hydrogen
to all three FCs, and all oxygen cryogenic tanks
are available to supply oxygen to all three FCs, as
well as to ECLSS atmosphere pressure control
systems 1 and 2. Because tank sets 1 and 2 are
regulated at a slightly lower pressure, tank sets 3
and above will feed before tank set 1 and 2.
Reactants will be supplied to the FCs by the
tank(s) with the highest pressure.
Manifold pressure data from two pressure
sensors located in the respective hydrogen and
oxygen valve modules is displayed on SM SPEC
68 CRYO SYSTEM. This information is also sent
to the systems management computer where its
lower limit is checked. If the respective hydrogen and oxygen manifold pressures are below
150 psia and 200 psia respectively, an SM ALERT
will occur.

Fuel Cell System

O2 and H2 MANIFOLD VLV Switches and

Talkbacks on Panel R1
CAUTION
There are no relief valves for O2 and H2
manifold 3's with manifold valves 1 and 2
closed.
This configuration should be
avoided except for leak isolation and
troubleshooting.

The three FCs are located under the payload bay

liner in the forward portion of the orbiters
midfuselage. Each FC is 14 inches high, 15 inches
wide, 40 inches long, and weighs 255 pounds.
Each FC is reusable and restartable. The three FCs
are individually coupled to the PRSD subsystem,
the active thermal control system (ATCS), the
supply water storage subsystem, and the
electrical power distribution and control (EPDC)
subsystem. The FCs generate heat and water as
by-products of electrical power generation. The
excess heat is directed to the FC heat exchanger,
where it is rejected to the Freon coolant loops.
The water is directed to the supply water storage
subsystem for the environmental control and life
support system.

2.8-9

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
ACCESSORIES

The accessory section monitors the reactant flow,

removes waste heat and water from the chemical
reaction, and controls the temperature of the
stack. The accessory section consists of the
hydrogen and oxygen flow system, the coolant
loop, and the electrical control unit.

POWER

Reactant flow monitor

96 cells

Heat rejection

Converts H2 & O2 into:

Water rejection
Thermal control

Power

Cell performance monitor

Potable water

Electrical control unit

Heat

Fuel Cell Block Diagram

The nominal voltage and current range of each
FC is 32.5 volts DC at 2 kW (61.5 amps),
decreasing to 27.5 volts DC at 12 kW (436 amps).
Each is capable of supplying up to 10 kW
maximum continuous power in nominal
situations, 12 kW continuously in off-nominal
situations (with one or more FCs failed), and up
to 16 kW for 10 minutes. The average on-orbit
power consumption of the orbiter is
approximately 14 kW, leaving additional
capability available for payloads. Each FC is
serviced between flights and reused until it has
accumulated 2,000 hours of on-line service.
The orbiters three FCs operate as independent
electrical power sources, each supplying its own
isolated, simultaneously operating DC bus. Each
FC consists of a power section and an accessory
section. The power section, where hydrogen and
oxygen are transformed into electrical power,
water, and heat, consists of 96 cells contained in
three substacks. Manifolds run the length of
these substacks and distribute hydrogen, oxygen,
and coolant to the cells. The cells contain an
oxygen electrode (cathode), and a hydrogen
electrode (anode) that are separated by a porous
matrix saturated with potassium hydroxide
electrolyte.

2. SYSTEMS
2.8 Electrical Power System (EPS)

The FC generates power through an

electrochemical reaction of hydrogen and
oxygen. At the hydrogen electrode (anode),
hydrogen is oxidized according to the following
reaction:

2H2 + 4OH

4H2O + 4e

forming water and releasing electrons. At the

oxygen electrode (cathode), oxygen is reduced in
the presence of water. It forms hydroxyl ions
according to the following relationship:

O2 + 2H2O + 4e

4OH

The net reaction consumes one oxygen molecule

and two hydrogen molecules in the production
of two water molecules, with electricity and heat
formed as by-products of the reaction.
The FC coolant system circulates a liquid
fluorinated hydrocarbon and transfers the waste
heat from the cell stack through the FC heat
exchanger to the Freon coolant loop system in the
midfuselage. Internal control of the circulating
fluid maintains the cell stack at a load-dependent
operating temperature of approximately 200 F.

2.8-10

USA007587
Rev. A
When the reactants enter the FCs, they flow
through a preheater (where they are warmed
from a cryogenic temperature to 40 F or greater),
a 6-micron filter, and a two-stage, integrated dual
gas regulator module. The first stage of the
regulator reduces the pressure of the hydrogen
and oxygen to 100 to 120 psia. The second stage
reduces the oxygen pressure to a range of 60 to
65 psia and maintains the hydrogen pressure at
4.5 to 6 psia differential below the oxygen
pressure.
The regulated oxygen lines are
connected to the accumulator, which maintains
an equalized pressure between the oxygen and
the FC coolant. If oxygen and hydrogen pressure
decrease, the coolants pressure is also decreased
to prevent a large differential pressure inside the
stack that could deform the cell stack structural
elements.

The hydrogen pump uses three-phase AC power

to circulate the hydrogen gas back to the FC
stack, where some of the hydrogen is consumed
in the reaction. The remainder flows through the
FC stack, removing the product water vapor
formed at the hydrogen electrode.
The
hydrogen-water vapor mixture then combines
with the regulated hydrogen from the dual gas
generator module and the loop begins again. The
performance at the pump is monitored via the H2
pump status voltage display on SM SPEC 69.

Upon leaving the dual gas regulator module, the

incoming hydrogen mixes with the hydrogenwater vapor exhaust from the FC stack. This
saturated gas mixture is routed through a
condenser, where the temperature of the mixture
is reduced, condensing a portion of the water
vapor to form liquid water droplets. The liquid
water is then separated from the hydrogen-water
mixture by the hydrogen pump /water
separator. A centrifugal water separator extracts
the liquid water and pressure-feeds it to potable
tanks in the lower deck of the pressurized crew
cabin. Water from the potable water storage
tanks can be used for crew consumption and for
cooling the Freon loops by feeding the flash
evaporator system.

Reactant consumption is directly related to the

electrical current produced: if there are no
internal or external loads on the FC, no reactants
will be used. Because of this direct proportion,
leaks may be detected by comparing reactant
consumption with current produced.
An
appreciable amount of excess reactants used
indicates a probable leak.

The oxygen from the dual gas regulator module

flows directly through two ports into a closedend manifold in the FC stack, achieving optimum
oxygen distribution in the cells. All oxygen that
flows into the stack is consumed, except during
purge operations.

2.8-11

2. SYSTEMS
2.8 Electrical Power System (EPS)

Fuel Cell 1 Typical Display and Controls

USA007587
Rev. A

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-12

Fuel Cell - Typical

USA007587
Rev. A

2.8-13

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Water Removal
Water and electricity are the products of the
oxidation/reduction reaction of oxygen and
hydrogen that takes place in the FCs. The water
must be removed or the cells will become
saturated with water, decreasing reaction
efficiency. With an operating load of about 7 kW,
it takes only 110 amp-hr or approximately 20
minutes to flood the FC with produced water,
thus effectively halting power generation.
Hydrogen is pumped through the stack and the
portion that is not consumed in the reaction acts
as a carrier gas, picking up and removing water
vapor on the way. After being condensed, the
liquid water is separated from the hydrogen by
the hydrogen pump/water separator and
discharged from the FC to be stored in the ECLSS
potable water storage tanks.

valve, relief line, and vent nozzle are displayed

on SM SPEC 69 FUEL CELLS.
If the potassium hydroxide electrolyte in any FC
migrates into the product water, a pH sensor
located
downstream
of
the
hydrogen
pump/water separator will sense the presence of
the electrolyte and alert the crew via an SM
ALERT and display on SM SPEC 69. A common
pH sensor is located downstream of the interface
between each FCs primary water path, prior to
entering the ECLSS supply H2O tanks.

Product water is routed to tank A; when tank A

is full, it is routed to tank B, then tanks C and D.
An alternate water delivery path is also available
to deliver water to the ECLSS tanks if the
primary path is lost. If the water tanks are full, or
there is line blockage, the water relief valves open
at 45 psia to allow the water to vent overboard
through the water relief line and nozzle. Check
valves prevent water tanks from discharging
through an open relief valve.
For redundancy, two thermostatically activated
heaters are wrapped around the discharge and
relief lines to prevent blockage caused by the
formation of ice in the lines. Two switches on
panel R11U, H2O LINE HTR and H2O RELIEF
HTR, provide the flight crew with the capability
to select either A AUTO or B AUTO for the FC
water discharge line heaters and the water relief
line and vent heaters respectively.
Thermostatically controlled heaters will maintain
the water line temperature above 53 F when
required. The normal temperature of product
water is approximately 140 to 150 F.
Thermostatically controlled heaters also maintain
the water relief valves temperature when in use
between 70 to 100 F.
FC 1, 2, or 3 DC voltage and current can be
monitored on the DC VOLTS and DC
AMPS/SIG STR meters on panel F9, using the
rotary switch below the meters to select a specific
FC, and on SM SPEC 69. Temperature sensors
located on the FC water discharge line, relief
2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-14

H2O LINE and H2O RELIEF HTR Switches

On Panel R11U

USA007587
Rev. A
automatically by flight software, or via
commands sent by Mission Control. When a
purge is initiated by opening the purge valves,
the oxygen and hydrogen systems become openloop systems; increased flows allow the reactants
to circulate through the stack, pick up the
contaminants, and blow them overboard through
the purge lines and vents. Electrical power is
produced throughout the purge sequence. No
more than 10 kilowatts (350 amps) should be
required from a FC being purged because of the
increased reactant flow and preheater limitations.

FUEL CELLS DPS Display (DISP 69)

DC VOLTS and DC AMPS Meters and Rotary

Switch on Panel F9

FC purges can be activated automatically or

manually via switches on panel R11U. At the
initiation of either an auto or manual purge, the
purge line heaters are turned on to heat the purge
lines and ensure that the reactants do not freeze
in the lines. The hydrogen reactant is the more
likely to freeze because it is saturated with water
vapor. Depending on orbit trajectory and vehicle
orientation, the heaters may require 27 minutes
to heat the lines to the required temperatures.
Because of limitations on the hydrogen and
oxygen preheaters in the FCs, the crew checks the
FC current to ensure each FC has a load of less
than 350 amps. As the current output of the FC
increases, the reactant flow rates increase and the
preheaters raise the temperature of the reactants
to a minimum of 40 F to prevent the seals in the
dual gas regulator from freezing before purging.
At loads greater than 350 amps, additional flow
during a purge would exceed the maximum flow
the preheaters are capable of warming. The crew
also checks that the FC is not shut down, that
time to deorbit is more than 3 hours, and, for an
automatic purge, that an SM OPS transition is not
scheduled within the next hour. An SM OPS
transition will halt the automatic purge sequence.

Fuel Cell Purge

During normal FC operation, the reactants are
present in a closed-loop system and either
consumed in the production of electricity or
recirculated through the stack. Any inert gases
or other contaminants will accumulate in and
around the porous electrodes in the cells and
reduce the reaction efficiency and electrical load
support capability.
Purging is performed
periodically to cleanse the cells. The purge
sequence can be controlled manually by the crew,

2.8-15

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

FUEL CELL Purge Switches on Panel R11U

The purge lines from all three FCs are
manifolded together downstream of their purge
valves and associated check valves. The line
leading to the purge outlet is sized to permit
unrestricted flow from only one FC at a time.
NOTE
If more than one FC is purged
simultaneously, back pressure may build
in the purge line. Due to the sizing of the
hydrogen and oxygen purge lines, the back
pressure in the H2 line can cause the
hydrogen pressure to rise above the
oxygen pressure. Although the dual gas
regulator is designed to prevent this from
happening, it is not advisable to expose all
three FCs to this condition at the same
time. If there is a generic problem with the
dual gas regulator, it could cause all three
FCs to fail simultaneously.
For an automatic purge, the FUEL CELL PURGE
heater switch is positioned to GPC and the FUEL
CELL PURGE VALVES 1, 2, and 3 switches on
panel R11U are positioned to GPC. The FUEL
CELL GPC PURGE SEQ switch is then positioned
to START and must be held until 3 seconds after
2. SYSTEMS
2.8 Electrical Power System (EPS)

the talkback indicator beside the switch indicates

gray. The automatic purge sequence will not
begin if the indicator indicates barberpole. First,
the GPC turns the purge line heaters on and
monitors the temperature of the lines. The one
oxygen line temperature sensor must register at
least 69 F and the two hydrogen line
temperature sensors 79 F and 40 F, respectively,
before the purge valves will open. When the
proper temperatures have been reached, the GPC
will open the hydrogen and oxygen purge valves
for FC 1 for 2 minutes, close them, and then
repeat the process for FCs 2 and 3. If a FUEL
CELL PURGE VALVE switch is not in the GPC
position, the software purge sequence will skip
that FC and continue to the next FC in the
sequence. If the temperatures are not up to the
minimum limit after 27 minutes, the GPC will
issue an SM ALERT, display the data on SM
SPEC 69, and stop the auto sequence. Thirty
minutes after the FC 3 purge valves have been
closed (to ensure that the purge lines have been
totally evacuated of water vapor by the heaters),
the GPC will turn off the purge line heaters. This
provides sufficient time and heat to bake out any
remaining water vapor. If the heaters are turned
off before 30 minutes have elapsed, water vapor
left in the lines may freeze. The GPC purge
sequence start can also be initiated using the
SPEC 60 SM TABLE MAINT display. The
sequence is normally performed by Mission
Control uplink on orbit.
The flight crew, using the switches on panel
R11U, would also initiate a manual FC purge. In
the manual mode, the three FCs must be purged
separately. The FUEL CELL PURGE HEATER
switch is positioned to ON for the same purpose
as in the automatic mode, and the flight crew
verifies that the temperatures of the oxygen line
and two hydrogen lines are at the same
minimum temperatures as in the automatic mode
before the purge sequence is initiated. The FUEL
CELL PURGE VALVE 1 switch is then positioned
to OPEN for 2 minutes and the flight crew
observes that the oxygen and hydrogen flow
rates increase on SM SPEC 69. The switch is then
positioned to CLOSE, and a decrease in the
oxygen and hydrogen flow rates is observed on
SM SPEC 69, confirming the purge valves are
closed. FC 2 is purged in the same manner using
the FUEL CELL PURGE VALVES 2 switch. Then
FC 3 is purged in the same manner using the
FUEL CELL PURGE VALVES 3 switch. After the

2.8-16

USA007587
Rev. A
30-minute line bakeout period, the FUEL CELL
PURGE HEATER switch is positioned to OFF.
Manual purges use different heaters than
automatic purges. At least one manual purge is
scheduled per flight.
Fuel Cell Cooling/Temperature Control
To cool the FC stack during its operations,
distribute heat during FC start-up, and warm the
cryogenic reactants entering the stack, the FC
circulates fluorinated hydrocarbon throughout
the FC. The FC coolant loop and its interface
with the ECLSS Freon coolant loops are identical
in FCs 1, 2, and 3.
The temperature of the coolant returning from
the Freon coolant loops is sensed before it enters
the FC. This is displayed as COOL T on SM
SPEC 69. It then enters the FC and passes
through a 75-micron filter. After the filter, two
temperature-controlled mixing valves allow
some of the hot coolant to mix with the cool
returning coolant to prevent the condenser exit
control valve from oscillating. The control valve
adjusts the flow of the coolant through the
condenser to maintain the hydrogen-water vapor
exiting the condenser at a temperature between
148 and 153 F.
The stack inlet control valve maintains the
temperature of the coolant entering the stack
between 177 and 187 F. The accumulator
interfaces with the oxygen cryogenic reactant to
maintain an equalized pressure between the
oxygen and the coolant (the oxygen and
hydrogen pressures are controlled at the dual gas
regulator) to preclude a high pressure differential
in the stack. The pressure in the coolant loop is
sensed before the coolant enters the stack and is
displayed as COOL P on SM SPEC 69.

hot coolant from the stack flows through the

oxygen and hydrogen preheaters where it warms
the cryogenic reactants before they enter the
stack.
The coolant pump utilizes three-phase AC power
to circulate the coolant through the loop. The
differential pressure sensor senses a pressure
differential across the pump to determine the
status of the pump. The FUEL CELL PUMP light
on panel F7 will be illuminated if FC 1, 2, or 3
coolant pump delta pressure is lost and a fault
message will be sent to the DPS display. If the
coolant pump for FC 1, 2, or 3 is off, the BACKUP
C/W ALARM light will be illuminated and a fault
message and a P will be displayed.
The temperature-actuated flow control valve
downstream from the pump adjusts the coolant
flow to maintain the FC coolant exit temperature
between 190 and 210 F. The stack inlet control
valve and flow control valve have bypass orifices
to allow coolant flow through the coolant pump
and to maintain some coolant flow through the
condenser for water condensation, even when the
valves are fully closed due to the requirements of
thermal conditioning. The hot coolant that is not
used at the mixing valves exits the FCs to the FC
heat exchanger where it transfers its excess heat
to be dissipated through the ECLSS Freon coolant
loops in the midfuselage.

The coolant is circulated through the FC stack to

absorb
the
waste
heat
from
the
hydrogen/oxygen reaction occurring in the
individual cells. After the coolant leaves the
stack, its temperature is sensed and the data is
displayed on the FUEL CELL STACK TEMP
meter through the three-position switch located
below the meter on panel O2 and on the SM
SPEC 69 display as STACK T. The yellow FUEL
CELL STACK TEMP, the red BACKUP C/W
ALARM light, and the SM ALERT light on panel
F7 will be illuminated if FC and stack
temperatures exceed upper or lower limits. The
2.8-17

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

FUEL CELL Circuit Breakers on Panel L4

FUEL CELL STACK TEMP Meter and FUEL

CELL 1, 2, 3 Switch on Panel O2
Electrical Control Unit
The electrical control unit located in each FC
power plant contains the startup logic, heater
thermostats, 30-second timer, and interfaces with
the controls and displays for FC startup,
operation, and shutdown. The unit controls the
supply of AC power to the coolant pump,
hydrogen pump/water separator and the pH
sensor. It also controls the DC power supplied to
the flow control bypass valve (open only during
startup) and the internal startup and sustaining
heaters. It also controls the status of the FUEL
CELL 1, 2, 3 READY FOR LOAD and COOLANT
PUMP P talkback indicators on panel R1.
The nine FC circuit breakers that connect threephase AC power to the three FCs are located on
panel L4. Each FC electrical control unit (ECU)
receives its power from an essential bus through
the FC CNTLR switch on panels O14, O15, and
O16.

FC1 CNTRL Switch on Panel O14

(Note: FC2 on O15 and FC3 on O16 are the same.)
Cell Performance Monitor
As FC life increased with the introduction of the
third substack, the likelihood of individual cell
failures caused by wearout or age increased.
Consequently, the design of the cell performance
monitor (CPM) was intended to detect individual
cell performance problems or imminent failures
such as cell crossover.
Crossover is defined as an uncontrolled mixing
of the reactants that results in the generation of
excessive product heat. The combination of
hydrogen and oxygen requires little heat to
explode. During normal FC operation, hydrogen
and oxygen are diffusely mixed to produce

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-18

USA007587
Rev. A
electricity. The matrix, a fibrous asbestos blotter
device within each cell, holds the KOH
electrolyte and limits the H2/O2 mixing.
Crossover occurs when the matrix fails to do its
job. A manufacturing flaw in the matrix or an
impurity in the matrix fibers may cause a pin
hole to develop after hours and hours of
exposure to the caustic KOH in the presence of
the waste heat within the cell.
As the direct combination of the reactant
molecules occurs at the pin hole, increased waste
heat may cause the pin hole to burn and enlarge,
allowing more reactants to combine. If this
reaction continues, it might propagate
uncontrollably and possibly cause a violent
explosion. Crossover may proceed rapidly or
gradually. Before the introduction of the cell
performance monitor (CPM) prior to STS-9, the
electrical performance indicators of a crossoverdistressed cell were not detectable, since the lost
electrical performance of the substack with the
degraded cell was picked up by the healthy
substacks.
The CPM compares each half substack voltage
and calculates a delta volts measurement. By
comparing both halves of a substack, the CPM
can detect cell changes. Since all the cells in a
substack are producing the same current, both
halves of the substack should be at
approximately identical voltages. Ideally V = 0,
but small fluctuations are common. A significant
voltage loss in any one cell will produce a change
in the V with 300 mV being a critical
performance loss. V can be either positive or
negative,
so
the
CPM
converts
the
positive/negative V between the upper and
lower substack halves to an absolute value and
then outputs that value (0 to 500 mV). To
provide margin and accommodate the absolute
value, the C/W limit is set at 150 mV. The
output is then converted to a 0 to 5 V DC signal
for telemetry and crew display systems by a
times 10 amplifier. Calibration curves rescale
this to electronic units (EU) (0 to 50 mV).
Every 7.5 minutes the CPM performs a self-test to
ensure data accuracy and to prevent FC
shutdown due to faulty data. During the self-test
period:

The voltage measurement of the substack

halves ceases.

A test signal of 50 mV is input to the

voltage measurement logic.

The output of the times 10 amplifier is

examined for 425 to 575 mV.

If the test fails, the output voltage is driven

to 5 volts until the next self-test is
performed 7 1 minute later. A test voltage
of 50 mV is introduced and the sequence
repeats itself.

If the self-test is passed, the unit resumes

substack half voltage measurements.
Fuel Cell Monitoring System

The fuel cell monitoring system (FCMS) is a data

collection system that provides insight into the
single cell voltages in the orbiter FC powerplants.
The FCMS is a PGSC program that records
voltage in each individual cell as well as in all
three FCs and saves these readings into an ASCII
data file. This file is then downlinked to MCC for
evaluation.
FCMS has two recording modes, full rate and
interval. Full rate records a sample every second
until the maximum file size is reached. In
interval, FCMS records samples at crew-specified
intervals for a certain amount of time, also
specified by the crew. In this mode, if the
amount of data exceeds maximum file size, the
crew receives a message that the program will
stop recording when the maximum size is
reached. File size is limited to 1.44 Mb to ensure
that it will fit onto a single floppy disk, although
flash drives are currently used on board.
One data sample consists of a GMT time tag for
FC 1 the cell 1 reading followed by 288 voltage
readings; i.e., 96 cells/FC powerplant times 3 FC
powerplants.
FCMS uses the PCMMU 2 port on the flight deck
(panel O5) and a special FCMS cable to collect
data for the PGSC program. FCMS data also can
be recorded prelaunch directly through the T-0
umbilicals.
Baseline recordings normally are recorded at the
beginning of each mission for comparison in the
event of a subsequent failure.

2.8-19

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Fuel Cell Start

2011/

The FUEL CELL START/STOP switches on panel

R1 are used to initiate the start sequence or stop
the FC operation. When a switch is held in its
momentary START position, the ECU connects
the three-phase AC power to the coolant pump
and hydrogen pump/water separator (allowing
the coolant and the hydrogen-water vapor to
circulate through these loops) and connects the
DC power to the internal startup and sustaining
heaters and the flow control bypass valve. The
switch must be held in the START position until
the COOLANT PUMP P talkback (tb) shows
gray (approximately 3 to 4 seconds), which
indicates that the coolant pump is functioning
properly by creating a differential pressure across
the pump. When the COOLANT PUMP P tb
indicates barberpole, the coolant pump is not
running.
The READY FOR LOAD tb for each FC shows
gray after the 30-second timer times out or when
the stack-out temperature is above 187 F,
whichever occurs last. Stack-out temperature can
be monitored on the SM SYS SUMM 1 (STACK
T) and SM SPEC 69 FUEL CELLS displays
(STACK T). It can also be monitored on the
FUEL CELL STACK OUT TEMP meter on panel
O2, using the switch beneath the meter to select
the FC. When the READY FOR LOAD tb shows
gray, the FC is up to the proper operating
temperature and is ready for loads to be attached
to it. It should not take longer than 25 minutes
for the FC to warm up and become fully
operational; the actual time depends on the FC's
initial temperature. The READY FOR LOAD
indicator remains gray until the FUEL CELL
START/STOP switch for each FC is set to STOP,
the FC CNTLR switch on the overhead panel is
set to OFF, or the essential bus power is lost to
the ECU.

2. SYSTEMS
2.8 Electrical Power System (EPS)

/078

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
0.0
L/R FD
0.0
0.0
AV BAY 1 0.3
0.3
2 0.3
0.4
3 0.3
0.3
CABIN
PRESS
14.0
dP/dT-EQ +.00 +.000
02 CONC 21.4
PPO2
3.00 3.00
FAN P 5.00
HX OUT T
46
O2 FLOW
0.0
0.0
N2 FLOW
0.0
0.0
IMU FAN A
B* C
V FC1 FC2 FC3
SS1 22
21
22
SS2 22
22
23
SS3 23
21
21
TOTAL AMPS 557
KW
17

DC VOLTS
FC
MAIN
ESS
CNTL
AC

4 000/14:44:12
000/00:00:00
1/A
2/B
3/C
30.6 30.1 31.0
30.6 30.1 31.0
29.6 29.6 29.3
A
B
C
A
1 29.4 29.4 29.6
2 29.4 29.4 29.4
3 29.4 29.4 29.4

VOLT A
118
B
117
C
117
AMPS A
4.3
B
5.5
C
3.1
FUEL CELL
AMPS
180
REAC VLV
OP
STACK T +202
EXIT T
150
COOL P
61
PUMP

118
117
117
6.3
6.6
5.0

117
118
118
2.1
2.2
3.2

232
OP
+206
152
60

146
OP
+200
149
61

usa007587_243r2.cvx

SM SYS SUMM 1 (SPEC 78)

Electrical Power Distribution and Control

The electrical power distribution and control
(EPDC) subsystem controls and distributes AC
and DC electrical power to the orbiter
subsystems, the solid rocket boosters, the
external tank, and payloads. The 28 volts DC
generated by each of the three FCs is distributed
to a main DC bus. The three main DC buses (MN
A, MN B, and MN C) are the prime sources of
power for the vehicle's DC loads. Each DC main
bus supplies power to three solid-state (static),
single-phase inverters, which in-turn powers
their respective AC bus. These three inverters are
phase sequenced with each other to provide
three-phase alternating-current (ac). Thus a total
of nine inverters convert DC power to 117 volt
(rms), 400-hertz AC power for distribution to
three AC buses (AC 1, AC 2, and AC 3) for the
vehicle's AC loads.

2.8-20

USA007587
Rev. A

FUEL CELL START/STOP Switches and READY FOR LOAD

and COOLANT PUMP P Talkback Indicators on Panel R1
Bus System
The three main DC buses are main A (MN A),
main B (MN B), and main C (MN C). Three AC
buses, AC 1, AC 2, and AC 3, supply AC power
to the AC loads. Three essential buses, ESS 1BC,
ESS 2CA, and ESS 3AB, supply DC power to
selected flight crew controls and electrical loads
that are deemed essential. Nine control buses CNTL AB 1, 2, 3; CNTL BC 1, 2, 3; and CNTL CA
1, 2, 3 - are used to supply control power to flight
crew controls. Two preflight buses, PREFLT 1
and PREFLT 2, are used only during ground
operations.

Depending on the criticality of orbiter electrical

equipment, some electrical loads may receive
redundant power from two or three main buses.
If an electrical load receives power from two or
three sources, it is for redundancy only and not
for total power consumption.
DC Power
Main Buses
The main buses distribute DC electrical power
from the FCs to locations throughout the orbiter.
Distribution assemblies handle the routing of
main bus power.

2.8-21

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Left SRB
Right SRB
IDCA
1 (2, 3)

Inverters
(9)

Fwd load
controller
assemblies
1 (2, 3)

Panel buses
Flight deck

Solid rocket
booster

Fuel cells
1 (2, 3)

Panel buses
Middeck

Fwd
power
controller
assemblies
1 (2, 3)

Fwd
motor
controller
assemblies
1 (2, 3)

GSE

Main dc
distribution
assemblies
1 (2, 3)

Mid power
controller
assemblies
1 (2, 3)

Forward section

Aft power
controller
assemblies
4 (5, 6)

Mid motor
controller
assemblies
(1, 2, 3, 4)

Midsection

Aft power
controller
assemblies
1 (2, 3)

Aft load
controller
assemblies
1 (2, 3)

External
tank

Aft motor
controller
assemblies
1 (2, 3)

Aft section
usa007587_335r2.cvx

Electrical Power Distribution Block Diagram

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-22

USA007587
Rev. A
Ground Support
Equipment
Fuel
Cell 1

AC Bus 1
FLCA 1

FPCA 1

FMCA 1

APCA 4

DA 1
MPCA 1

APCA 1

Solid Rocket
Boosters

ALCA 1

External
Tank

AMCA 1

MMCA 1, 3
GSE

Fuel
Cell 2

AC Bus 2
FLCA 2

FPCA 2

FMCA 2

APCA 5

DA 2
MPCA 2

APCA 2

SRBs

ALCA 2

ET

AMCA 2

MMCA 1, 2, 3, 4
GSE

Fuel
Cell 3

AC Bus 3
FLCA 3
FMCA 3

FPCA 3

APCA 6

DA 3
MPCA 3
DA
FLCA
FMCA
FPCA
MPCA
MMCA
APCA
ALCA
AMCA

APCA 3

SRBs

ALCA 3

ET

AMCA 3

MMCA 2, 4
Distribution Assembly
Forward Load Controller Assembly
Forward Motor Controller Assembly
Forward Power Controller Assembly
Mid Power Controller Assembly
Mid Motor Controller Assembly
Aft Power Controller Assembly
Aft Load Controller Assembly
Aft Motor Controller Assembly

usa007587_336ri.cvx

Direct Current Power Distribution Diagram

2.8-23

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

CONTROL BUS Circuit Breakers on Panel R14

Essential Buses

Control Buses

Essential buses supply power to switches that are

necessary to restore power to a failed main DC or
AC bus and to essential electrical loads and
switches. In some cases, essential buses are used
to
power
switching
discretes
to
multiplexers/demultiplexers. Examples of the
selected flight crew switches and loads are the
EPS switches, GPC switches, TACAN, radar
altimeter and microwave scan beam landing
system power switches, the caution and warning
system, emergency lighting, audio control panel,
and master timing unit.

Nine control buses supply control power to the

display and control panel switches on the flight
deck and in the middeck area. A control bus
does not supply operational power to any system
loads. Each control bus receives power from
each main DC bus for redundancy. The main
buses identified in the control bus name are
connected through RPCs and diodes.
For
example, CNTL BC1 is powered by MN B and
MN C through RPCs. The "unnamed bus",
which in this example is MN A, provides power
to the control bus through a circuit breaker and a
fuse. The number in each control bus name does
not refer to a power source for the bus; it is
merely a numeric designator for the bus.

Three essential buses, ESS 1BC, ESS 2CA, and

ESS 3AB receive power from three redundant
sources. For example, ESS 1BC receives DC
power from FC 1 through the ESS BUS SOURCE
FC 1 switch on panel R1 via a fuse when the
switch is positioned to ON, and from main DC
buses B and C through remote power controllers
(RPCs) when the ESS BUS SOURCE MN B/C
switch on panel R1 is positioned to ON.
Electrical power is then distributed from the
essential bus in distribution assembly 1 through
fuses to the corresponding controller assemblies
and to the flight and middeck panels.

2. SYSTEMS
2.8 Electrical Power System (EPS)

The control buses are enabled by the CONTROL

BUS PWR MN A, MN B, and MN C switches on
panel R1 and the MN A CONTROL BUS
BC1/2/3, the MN B CONTROL BUS CA1/2/3
and the MN C CONTROL BUS AB1/2/3 circuit
breakers on panel R14.

2.8-24

USA007587
Rev. A
panel R1 to the ON position. The talkback
indicator above this switch will indicate ON. The
MN B bus may be removed from the PRI PL bus
by positioning the switch momentarily to OFF.
The talkback indicator will indicate OFF. A third
possible source of electrical power for the PRI PL
bus may be supplied from the MN C bus through
the PRI MN C switch on panel R1, positioned
momentarily to the ON position. The talkback
indicator will indicate ON. The MN C bus may
be removed from the PRI PL bus by positioning
the switch momentarily to OFF. The talkback
indicator will indicate OFF.
NOTE
Main buses B and C can be tied via the PRI
PL bus. This is referred to as a "backdoor
bus tie."

Bus Control Switches and Talkbacks

on Panel R1
The RPCs are powered continuously unless one
of the CONTROL BUS PWR MN A, MN B, MN C
momentary switches on panel R1 is positioned to
the RESET position, which turns the
corresponding RPCs power off and resets the
RPC if it has been tripped off. An SM ALERT
light is illuminated if the control bus voltage is
less than 24.5 volts DC and a fault message is sent
to the DPS display. The Mission Control Center
can monitor the status of each RPC.
Payload Buses
Payload buses are provided to supply DC
electrical power to the payloads. FC 3 may be
connected to the primary payload bus by
positioning the PRI FC3 momentary switch on
panel R1 to the ON position. The talkback
indicator above the switch will indicate ON when
FC 3 is connected to the PRI PL bus. The PRI PL
bus is the prime bus for supplying power to the
payloads. FC 3 may be disconnected from the
payload bus by positioning the PRI FC3 switch to
the OFF position. The talkback indicator above
the switch will indicate OFF.

Two additional payload buses are located in the

aft section of the payload bay at the aft bulkhead
station. The aft payload B bus may be powered
up by positioning the AFT MN B switch on panel
R1 to ON. The aft payload C bus may be
powered up by positioning the AFT MN C switch
on panel R1 to ON. The OFF position of each
switch removes power from the corresponding
aft payload bus.
The AUX switch on panel R1 permits main bus A
and main bus B power to be supplied to the AUX
PL A and AUX PL B buses when the switch is
positioned to ON. The auxiliary payload buses
can provide power for emergency equipment or
controls associated with payloads. The OFF
position removes power from the AUX PL A and
PL B buses. The two auxiliary payload buses
may be dioded together to form one bus for
redundancy.
The CABIN switch on panel R1 provides MN A
or MN B power to patch panels located behind
the payload specialist and mission specialist
stations on the aft flight deck. These patch panels
supply power to the payload-related equipment
located on panels at these stations. Two threephase circuit breakers, AC 2 PAYLOAD 3 and
AC 3 PAYLOAD 3 on panel MA73C, provide AC
power to the payload patch panels.

A second source of electrical power for the PRI

PL bus may be supplied from the MN B bus by
positioning the PRI MN B momentary switch on
2.8-25

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
AC Power Generation
AC power is generated and made available to
system loads by the EPDC subsystem using three
independent AC buses, AC 1, AC 2, and AC 3.
The AC power system includes the AC inverters
for DC conversion to AC and inverter
distribution and control assemblies containing
the AC buses and the AC bus sensors. The AC
power is distributed from the inverter
distribution and controller assemblies to the
flight and middeck display and control panels
and from the motor controller assemblies to the
three-phase motor loads.

INV PWR and INV/AC BUS Switches and

Talkbacks, and AC CONTR Circuit Breakers
on Panel R1

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-26

USA007587
Rev. A

AC2 Cabin PAYLOAD 3 and AC3 Cabin PAYLOAD 3 Circuit Breakers

on Panel MA73C
Each AC bus consists of three separate phases
connected in a three-phase array. Static inverters, one for each phase, are located in the
forward avionics bays. Each inverter has an
output voltage of 117 volts (rms) at 400 hertz.
Input power to the inverters is controlled by the
INV PWR 1, 2, 3 switches on panel R1. INV
PWR 1 routes power to AC 1 from MN A, INV
PWR 2 to AC 2 from MN B, and INV PWR 3 to
AC 3 from MN C. All three inverters of AC 1
receive MN A bus power when the INV PWR 1
switch is positioned to ON, and all three must be
in operation before the talkbacks above the
switches indicate ON. The indicators will show
OFF when main bus power is not connected to
the inverters. The INV/AC BUS 1, 2, 3 switches
on panel R1 are used to apply each inverter's
output to its respective AC bus. An indicator
above each switch shows its status, and all three
inverters must be connected to their respective
AC buses before the indicators show ON. The

talkback indicators will show OFF when any of

the phases are not connected to their respective
AC bus.
The INV PWR and INV/AC BUS switches and
talkbacks must have control power from the AC
CONTR circuit breakers on panel R1 in order to
operate. Once AC power has been established,
these circuit breakers are opened to prevent any
inadvertent disconnection, whether by switch
failure or accidental movement of the INV PWR
or INV/AC BUS switches.
Electrical Power Distribution and
Control Assemblies
Electrical power is controlled and distributed by
assemblies. Each assembly (main distribution
assembly, power controller assembly, load controller assembly, and motor controller assembly)
is in an electrical equipment container.

2.8-27

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Distribution Assemblies
The DC power generated by each of the FCs is
supplied to a corresponding distribution
assembly (DA). FC 1 powers DA 1, FC 2 powers
DA 2, and FC 3 powers DA 3. Each distribution
assembly contains fuses, relays, and remotely
controlled motor-driven switches called power
contactors. The DAs control and distribute DC
power to a corresponding mid power controller
assembly, forward power controller assembly,
and aft power controller assembly.
The FC/MAIN BUS A switch on panel R1
positioned to ON connects FC 1 to the MN A DA
1 and controllers and disconnects FC 1 from the
MN A DA 1 and controllers when positioned to
OFF.
The talkback indicator next to the
FC/MAIN BUS A switch will indicate ON when
FC 1 is connected to main bus A distribution
assembly and controllers, and OFF when FC 1 is
disconnected from main bus A distribution
assembly and controllers. The FC/MAIN BUS B
and C switches and talkback indicators on panel
R1 function in the same manner. The No. 1
distribution assembly and all No. 1 controllers go
with FC 1 and MN A bus, all No. 2 controllers
and DA 2 go with FC 2 and MN B, and all No. 3
controllers and DA 3 go with FC 3 and MN C.
Power Controllers
Power contactors are also located in the aft power
controller assemblies to control and distribute
ground-supplied 28-volt DC power to the orbiter
through the T-0 umbilical before the FCs take
over the supply of orbiter DC power.
Each of the forward, mid, and aft power
controller assemblies supplies and distributes DC
power to a corresponding motor controller assembly and DC power to the orbiter is supplied
through the T-0 umbilical before the FCs take
over the supply of orbiter DC power.
Each of the forward, mid, and aft power
controller assemblies supplies and distributes DC
power to a corresponding motor controller
assembly and DC power to activate the corresponding AC power system.
Aft power controller assemblies 4, 5, and 6 were
added to accommodate additional electrical loads
in the aft section. Assemblies 4, 5, and 6 are

2. SYSTEMS
2.8 Electrical Power System (EPS)

powered by FC 1/MN A, FC 2/MN B, and FC

3/MN C, respectively.
Remote Power Controllers
Each power controller assembly contains RPCs
and relays. The RPCs are solid-state switching
devices; they have the capability to limit the
output current to a maximum of 150 percent of
rated value for 2 to 3 seconds. Within 3 seconds,
the RPC will trip, removing the output current.
To restore power to the load, the RPC must be
reset. This is accomplished by cycling a control
switch. If multiple control inputs are required
before a RPC is turned on, hybrid drivers are
usually used as a logic switch, which then drives
the control input of the RPC.
Load Controllers
Each load controller assembly contains hybrid
drivers, which are solid-state switching devices
(no mechanical parts) used as logic switches and
for low-power electrical loads. When the drivers
are used as a logic switch, several control inputs
are required to turn on a load. The hybrid
drivers are current protected by internal fuses.
Hybrid relays requiring multiple control inputs
are used to switch three-phase AC power to
motors.
Relays are also used for loads in power controller
assemblies and motor controller assemblies.
In the midbody, there are no load controller
assemblies; therefore, the mid power controller
assemblies contain remote power controllers,
relays, and hybrid drivers.
Motor Controllers
There are 10 motor controller assemblies used on
the orbiter: three are in the forward area, four are
in the midbody area, and three are in the aft area.
Panel MA73C contains the controls for the motor
controller assemblies. Their only function is to
supply AC power to noncontinuous AC loads for
AC motors used for vent doors, air data probe,
star tracker doors, payload bay doors, payload
bay latches, ET doors and latches, RMS deploy
motors and latches, and reaction control
system/orbital maneuvering system motoractuated valves. Each motor controller assembly
contains main DC buses, AC buses, and hybrid
relays that are remotely controlled for the

2.8-28

USA007587
Rev. A
application or removal of AC power to AC
motors. The main DC bus is used only to supply
control or logic power to the hybrid relays so the
AC power can be switched on or off. The hybrid
relays permit major electrical power distribution
buses to be located close to the major electrical
loads, which minimizes use of heavy electrical
feeders to and from the pressurized crew

compartment display and control panels. This

reduces the amount of spacecraft wiring and
weight, and permits more flexible electrical load
management. If a main bus is lost, the hybrid
relays using that main bus will not operate. In
some cases, the hybrid relays will use logic
power from a switch instead of the motor
controller assembly bus.

Motor Controller Assembly Controls on Panel MA37C

2.8-29

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
The three forward motor controller assemblies
(FMC 1, FMC 2, and FMC 3) correspond to MN
A/AC 1, MN B/AC 2, and MN C/AC 3,
respectively. Each FMC contains DC power from
a main bus, an AC bus, and an RCS AC bus. The
main bus supplies control or logic power to the
relays associated with both the AC bus and RCS
AC bus. The AC bus supplies power to the
forward left and right vent doors, the star tracker
Y and Z doors, and the air data left and right
doors. The RCS AC bus supplies power to the
forward RCS manifold and tank isolation valves.
The aft motor controller assemblies (AMC 1,
AMC 2, and AMC 3) correspond to MN A/AC 1,
MN B/AC 2, and MN C/AC 3 respectively.
Each aft motor controller assembly receives
power from a main bus and its corresponding AC
bus and a main RCS/OMS bus and its
corresponding RCS/OMS AC bus. Both main
buses are used for control or logic power for the
hybrid relays. The AC bus is used by the aft
RCS/OMS manifold and tank isolation and
crossfeed valves, the aft left and right vent doors,
and the ET umbilical doors.
The mid motor controller assemblies (MMC 1,
MMC 2, MMC 3, and MMC 4) contain two main
DC buses and two corresponding AC buses.
MMC 1 contains main bus A and B and their
corresponding buses, AC 1 and AC 2. MMC 2
contains MN B and C and AC 2 and AC 3 buses.
MMC 3 contains the same buses as MMC 1, and
MMC 4 contains the same buses as MMC 2.
Loads for the main buses/ac buses are vent doors,
payload bay doors and latches, radiator panel
deployment actuator and latches, RMS deploy
motors and latches, and payload retention latches.
Component Cooling
The electrical components in the midbody are
mounted on cold plates and cooled by the Freon
coolant loops. The power controller assemblies,
load controller assemblies, motor controller
assemblies, and inverters located in forward
avionics bays 1, 2, and 3 are mounted on cold
plates and cooled by the water coolant loops.
The inverter distribution assemblies in forward
avionics bays 1, 2, and 3 are air-cooled. The load
controller
assemblies,
power
controller
assemblies, and motor controller assemblies
located in the aft avionics bays are mounted on

2. SYSTEMS
2.8 Electrical Power System (EPS)

cold plates and cooled by the Freon coolant

loops.
Bus Tie
In the event of an electrical failure, or to load
share between FCs, any main bus can be
connected to another main bus through the use of
the MN BUS TIE switches on panel R1 and
power contactors in the distribution assemblies.
For example, main bus A can be connected to
main bus B by positioning both the MN BUS TIE
A and the MN BUS TIE B switch to ON. The
talkback indicators next to the switches will
indicate ON when main bus A is connected to
main bus B. Other indications of an effective bus
tie are matching voltages for the two buses. To
disconnect main bus A from main bus B, the MN
BUS TIE A and B switches must be positioned to
OFF; the talkback indicators next to the switches
will then indicate OFF.
NOTE
It is also possible to tie the main buses B
and C together via the PRI switches. This
is done by connecting each main bus to the
primary payload bus. This is called a
backdoor bus tie
Instrumentation and System Monitoring
Main bus A, B, or C voltages can be displayed on
the DC VOLTS meter on panel F9 by selecting
MAIN VOLTS A, B, or C on the rotary switch
beneath the meter.
The MAIN BUS
UNDERVOLT red caution and warning light on
panel F7 will be illuminated if main bus A, B, or
C voltage is 26.4 volts dc, informing the crew that
the minimum equipment operating voltage limit
of 24 volts DC is being approached. A BACKUP
C/W ALARM light will also be illuminated at 26.4
volts dc. An SM ALERT light will be illuminated
at 27 volts DC or less, alerting the flight crew to
the possibility of a future low-voltage problem.
A fault message also is transmitted to the DPS
display.
The nominal FC voltage is 27.5 to 32.5 volts dc,
and the nominal main bus voltage range is 27 to
32 volts dc, which corresponds to 12- and 2kilowatt loads respectively. If buses are tied,
they will indicate the same voltage.

2.8-30

USA007587
Rev. A
The ESS bus voltage can be monitored on the DC
VOLTS meter on panel F9 by selecting ESS
VOLTS 1BC, 2CA, 3AB on the rotary switch
below the meter. An SM ALERT light will be
illuminated to inform the flight crew if the
essential bus voltage is less than 25 volts dc. A
fault message also is shown on the DPS display.

MN BUS TIE Switches on Panel R1

Each AC bus has a sensor, switch, and circuit

breaker for flight crew control. The AC 1, 2, and
3 SNSR circuit breakers located on panel O13
apply essential bus power to their respective AC
BUS SNSR 1, 2, 3 switch on panel R1 and
operational power to the respective INV/AC BUS
switch and indicator. The AC BUS SENSR 1, 2, 3
switch selects the mode of operation of the AC
bus sensor: AUTO TRIP, MONITOR, or OFF.
The AC bus sensor monitors each AC phase bus
for over- or undervoltage, and each phase
inverter for an overload signal. The overvoltage
limits are bus voltages greater than 123 to 127
volts AC for 50 to 90 milliseconds.
The
undervoltage limits are bus voltages less than 102
to 108 volts AC for 6.5 to 8.5 milliseconds. An
overload occurs when any AC phase current is
greater than 14.5 amps for 10 to 20 seconds, or is
greater than 17.3 to 21.1 amps for 4 to 6 seconds.
When the respective AC BUS SNSR switch is in
the AUTO TRIP position, and an overload or
overvoltage condition occurs, the AC bus sensor
will illuminate the respective yellow AC OVERLOAD or AC VOLTAGE caution and warning
light on panel F7 and trip off (disconnect) the
inverter from its respective phase bus for the
bus/inverter causing the problem. There is only
one AC VOLTAGE and one AC OVERLOAD
caution and warning light; as a result, all nine
inverters/ac phase buses can illuminate the
lights. The DPS display or the AC VOLTS meter
and rotary switch beside it on panel F9 would be
used to determine which inverter or phase bus
caused the light to illuminate. The phase causing
the problem would approach 0 amps after the
bus sensor disconnects the inverter from the bus.
Because of the various three-phase motors
throughout the vehicle, there will be an induced
voltage on the disconnected phase if only one
phase has loss of power.

EPS Meters and Switches on Panel F9

2.8-31

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Before power can be restored to the tripped bus,
the trip signal to the INV/AC BUS switch must be
removed by positioning the AC BUS SNSR
switch to OFF, which extinguishes the caution
and warning light and resets the bus sensor logic.
The signal then goes back to the AUTO TRIP
position. The INV/AC BUS switch is then
positioned to ON, restoring power to the failed
bus.
If there is an undervoltage, the yellow AC
VOLTAGE caution and warning light on panel F7
will be illuminated, but the inverter will not be
disconnected from its phase bus.
When the AC BUS SENSR 1, 2, 3 switches are in
the MONITOR position, the AC bus sensor will
monitor for an overload, overvoltage, and
undervoltage and illuminate the applicable
caution and warning light; but it will not trip off
the phase bus/inverter causing the problem.
NOTE

AC 1, 2, 3 SNSR Circuit Breakers on Panel O13

AC BUS SNSR switches are placed in

MONITOR for ascent to prevent an AC bus
problem from causing an AUTO-TRIP,
which could result in the loss of SSME
controllers on ascent.
When the AC BUS SNSR switches are OFF, the
AC bus sensors are non-operational, and all
hardware caution and warning and trip-out
capabilities are inhibited. The BACKUP C/W
ALARM light will be illuminated for overload or
over- and undervoltage conditions. A fault
message also is sent to the DPS display.

AC BUS SNSR Switches and INV/AC BUT

Switches and Talkback Indicators on Panel R1
2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-32

USA007587
Rev. A

APCU and SSPTS

Orbiter

APAS, ODS
and/or ROEU

APCU 1(2)

Cabin P/L &

Aux P/L Bus
Control Power
Conv 1(2) ON/OFF
Standard Switch
Panel

Output 1(2) CL/OP

124(140) V DC

Conv 1(2) tb
Output 1(2) tb
124(140) V DC
28 V DC input
Primary P/L Bus
Interconnect (dotted line)
dependent on APCU config

P/L MDM 1(2)

1(2) Conv A amps

1(2) Conv B amps
1(2) V out Low Res
1(2) V Out High Res
1(2) Conv A temp
1(2) Conv B temp
1(2) Trip Status

Assembly Power Converter Unit

OV-104 carries hardware to allow the orbiter to power
certain payloads at a higher voltage than the orbiters
normal electrical system configuration. The payloads,
typically ISS-related, operate at 120 volts DC,
whereas the orbiter operates at 28 volts DC. The
assembly power converter unit (APCU) is a step-up
converter controlled via switches on the orbiter flight
deck (Panel L12, also known as Standard Switch
Panel 1) that consists of two units of two converters
each. Data is visible to the crew on SM SPEC 200
APCU STATUS.
Each APCU contains two converters, both powered on
or off by the APCU CONV switch on SSP1. Each
APCU also has an OUTPUT RELAY switch, which
opens or closes the relay that allows power to be
transferred downstream.
Both switches have
grey/barberpole talkbacks. OPEN means the relay is

open and there is no power downstream to the

payload, while CLOSE sets the relay to allow power
transfer (thus the switch in the up direction is CLOSE
and in the down direction is OPEN). The CABIN PL
1 payload bus provides control power to the APCU 1
switches through the SW PWR 1 circuit breaker,
while the AUX PL B payload bus provides control
power directly to the APCU 2 switches. The talkbacks
are driven by voltage, so the CONV talkbacks would
be expected to turn gray when the converters are
powered on, while the OUTPUT RLY talkbacks would
be expected to turn gray once the relay is closed. The
power that gets transformed to 120 volts DC comes
from the PRI PL bus.
The APCUs have an interconnected mode such that
power from one unit may be used to power a payload
downstream of the other unit. This configuration is
set on the ground and cannot be changed during
flight.

2.8-33

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
On SM SPEC 200, the amps and temperature can be
seen for each of the converters. The voltage is shown
as high- and low-resolution, but both readings come
off a single voltage sensor. The trip status will be one
of 16 discretes ranging from -4.84 to +4.88, each of
which indicates a particular failure mode of input or
output overvoltage, undervoltage, overcurrent, or a
combination of any of them. To find out the exact
failure mode, a lookup table in the Malfunction book
must be consulted, but regardless of the failure mode,
by tripping off, the APCU has been safed.

APCU Switches and Talkback Indicators on

Standard Switch Panel 1 (L12)

SM SPEC 200 APCU STATUS

Typically, both APCU 1 and APCU 2 power
redundant heaters on ISS hardware carried in the
payload bay are in non-interconnected mode. They are
powered by 120 volts DC because that is how the ISS
power system operates. APCU 2 also powers the
heaters and sensor packages at the end of the orbiter
boom sensor system (OBSS). The higher voltage in
this case is designed to reduce line loss in transferring
power the length of the remote manipulator system
(RMS) and OBSS boom itself.

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-34

USA007587
Rev. A

Station/Shuttle Power Transfer System (SSPTS)

OV-103 and OV-105 previously carried the

standalone version of the APCU described above, but
have been upgraded to the newer Station/Shuttle
Power Transfer System (SSPTS). Operated via
switches on panel A15 that were formerly used by the
EDO Cryo Pallet System (which is no longer used),
SSPTS consists of two power transfer units (PTUs),
each of which has a single APCU voltage step-up
converter similar to the ones discussed above, and two
voltage step-down orbiter power converter unit
(OPCU) converters. The OPCU allows 120 volt DC
power from the ISS solar arrays to be transferred to
the shuttles main buses A and B at 28 volts. The
OPCU portion of SSPTS offloads some electrical load
from the orbiters FCs onto the ISS solar arrays; the
reduction in load on the FCs reduces the cryo usage,
which is then used for mission extension days. The
APCU portion of SSPTS is usable at any point in the
mission, while the OPCU portion is only usable after
docking to the ISS. Data is visible to the crew on SM
SPEC 179 POWER TRANSFER.
Before any power can be converted either by an APCU
or OPCU, the PTUs must be connected to the
shuttles main buses. PTU 1 is associated with main
A, and PTU 2 is associated with main B. To connect

the PTU to the main bus, the CNTL PWR circuit

breakers on A15 row B must be pushed in first. These
breakers power the PTU/MAIN BUS switches and
talkbacks. Upon successful connection between a PTU
and main bus, the associated talkback will turn from
OFF to ON. At this point, an APCU may be
activated to convert orbiter DC power for payload
requirements, and, after docking, the OPCU can be
activated to convert ISS DC power for shuttle main
bus requirements.
The SSPTS APCU works similarly to the standalone
(or legacy APCU), except that the SSPTS APCU
has a single converter per PTU while the legacy
APCU has two converters per unit. The new
converter is about twice as efficient as the old ones, so
only one is needed. The SSPTS APCU is controlled
by a pair of switches, CONV for the converter and
OUTPUT for the output relay, but neither has
talkbacks. The APCU 1 and 2 switches are on panel
A15 rows D and E, respectively. The SSPTS APCU
outputs also have the capability of being
interconnected, depending on payload requirements;
this is changeable only on the ground.

2.8-35

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
Because the OPCUs take input power from the ISS,
they can only be activated after docking. Each of the
four OPCU converters receives its power from a
remote power control module (RPCM) on the ISS, and
any combination and number of these RPCMs may be
activated. When an RPCM is activated, power goes
through the X1/X2 connectors in the docking system
to the OPCU. For troubleshooting, the crew has two
ODS MATE switches on A15 (row C) that test the
X1/X2 connectors for continuity.
Once the RPCM is activated on the ISS, the OPCU
volts and temperature sensors on the shuttle are
powered and the data changes from off-scale low to a
valid reading. The crew can use this as a method of
verifying that the ISS RPCMs have been activated.
To convert ISS power, the SSPTS OPCU converters
are activated via switches on panel A15. Initially, the
OPCU output voltage is 31.12 volts DC, generally
slightly lower than the main bus voltage, but by
increasing the output voltage above the level of the
main buses, the OPCUs will draw loads away from
the mains. This voltage adjust is accomplished either
by the crew or Mission Control. If the V-ADJ voltage
adjust switch is in PNL, the crew can manually adjust
the voltage up or down in increments of 0.04 volts per
switch movement, and if the switch is in CMD,
Mission Control will send real-time commands
(RTCs) to adjust the voltage. The OPCUs are
hardware limited to output 31.80 volts, and
maximizing OPCU output volts minimizes FC loads.
However, depending on the loads, the OPCUs may go
into input-current-limiting mode; when it reaches its
maximum output power, it automatically drops the
output voltage and allows the FC to pick up additional
loads.
Since the OPCUs only take power from main buses A
and B, main C tends to pick up some of the dioded
loads and carry more of the load. To even out the loads
among the three main buses, Mission Control may opt
to perform a bus tie to main C to evenly distribute the
dioded loads.

SSPTS Switches and Talkback Indicators on

Panel A15
At the top of SPEC 179 are fields for fuel cell power
(displayed here individually, while on SYS SUM 1 the
total power is displayed), main bus volts, and the
status of the PTU/main bus connection (ON or OFF).
Although only two FC/main buses are used in SSPTS,
the third is shown here for completeness. A field next
to the main bus letter will read TIE when that
bus is tied, using the same telemetry signal that drives

the bus tie talkback on panel R1.

SM SPEC 179 POWER TRANSFER
OPCU data on SPEC 179 is divided by PTU and then
by converter. Each of the four converters has output
volts, output amps, temperature, and various trip
statuses. As mentioned previously, output volts and
temperature will be off-scale low until the ISS RPCMs
provide input housekeeping power. The trip status
fields are blank until the converter has tripped, and

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-36

USA007587
Rev. A
show in text format the reason for the trip (e.g., IN
OC for input overcurrent and OUT OV for output
overvolt).
APCU data on SPEC 179 is similar to that seen on
the legacy display. The crew can see APCU output
volts, input and output amps, temperature, output
relay status (ON or OFF), and trip status. The
output status replaces the need for a talkback on the
panel, and the trip status as a numeric discrete has
been replaced by text on the display (such as IN UV
for input undervolt, OUT OC for output overcurrent,
etc.). The trip status on the display is blank unless
invoked.
The SSPTS APCUs are used for the same purposes as
their standalone predecessor; they power heaters on
ISS hardware carried in the payload bay, while APCU
2 also powers the heaters and sensor packages at the
end of the OBSS.

Operations
Prelaunch
During prelaunch operations, the onboard FC
reactants (oxygen and hydrogen) are supplied by
ground support equipment to assure a full load
of onboard reactants before lift-off. At T minus 2
minutes 35 seconds, the ground support
equipment filling operation is terminated. The
ground support equipment supplies hydrogen
and oxygen to the PRSD manifold at pressures
greater than the tank heater control range
pressures (approximately 280 psia for hydrogen
and 960 psia for oxygen). This helps to prevent
cryo tank heater cycling during powered flight.
The ground support equipment supply valves
close automatically to transfer to onboard
reactants.
The FCs will be on when the crew boards the
vehicle. Until T minus 50 seconds, power to the
orbiter is load shared between the FCs and
ground support equipment, even though the FCs
are on and capable of supplying power. Main
bus power is supplied through the T-0
umbilicals, MN A through the left-side umbilical
and MN B and C through the right-side umbilical
to aft power controllers (APCs) 4, 5, and 6. From
APCs 4, 5, and 6, the ground support equipment
power is directed to the distribution assembly
where the power is distributed throughout the
vehicle. The power for the PREFLT 1 and
PREFLT 2 test buses is also supplied through the

T-0 umbilical. These test buses are scattered

throughout the orbiter and are used to support
launch processing system control of critical
orbiter loads, although they also power up the
essential buses in the APCs when on ground
support equipment.
As in the main bus
distribution, essential bus power from the APCs
is directed to the distribution assemblies and then
distributed throughout the vehicle. At T minus
50 seconds, the ground turns off the ground
support equipment power to the main buses, and
the FCs automatically pick up the remaining
vehicle electrical loads.
Indication of the switchover can be noted on the
DPS display and the DC AMPS meter. The FC
current will increase to approximately 220 amps;
the oxygen and hydrogen flow will increase to
approximately 4.6 and 0.6 pound per hour
respectively; and the FC stack temperature will
increase slightly. At T minus zero, the T-0
umbilical is disconnected with the preflight test
bus wires live.
Prelaunch and On-Orbit Tank Heater
Management
Before lift-off, the O2 TK1 HEATERS A, O2 TK2
HEATERS A, H2 TK1 HEATERS A, and H2 TK 2
HEATERS A switches on panel R1 are set on
AUTO. As part of the Post OMS 1 Burn procedures, all the switches on O2 and H2 tanks 1 & 2
are positioned to AUTO, while the other tank
heaters remain OFF. On orbit, the cryo tank
heaters are managed to provide for tank quantity
balancing. Tanks 3, 4, and 5 will supply reactants
to the FCs instead of tanks 1 and 2 when all the
tank heaters are set to AUTO. This is because the
heater controllers in tanks 3, 4, and 5 control to a
higher pressure than tanks 1 and 2. For entry,
tanks 1 and 2 supply the reactants to the FCs.
Fuel Cell Operating Modes
FC standby consists of removing the electrical
loads from a FC but continuing operation of the
FC pumps, controls, instrumentation, and valves,
while electrical power is supplied by the
remaining FCs. A small amount of reactants is
used to generate power for the FC internal
heaters.
If the temperature in the FC
compartment beneath the payload bay is lower
than 40 F, the FC should be left in STANDBY
instead of being shut down to prevent it from
freezing.

2.8-37

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A
FC shutdown, after standby, consists of stopping
the coolant pump and hydrogen pump/water
separator by positioning that FUEL CELL
START/STOP switch on panel R1 to the STOP
position.
FC safing consists of closing the FC reactant
valves and consuming the reactants inside the FC
by either leaving the FC connected to its main
bus or by keeping the pump package operating
with the internal heaters.

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-38

USA007587
Rev. A

EPS Caution and Warning Summary

The SM ALERT will illuminate if a cryo
heater current level sensor detects a short on
a heater circuit.
The yellow O2 PRESS and the red BACKUP
C/W ALARM lights illuminate if oxygen
tank pressure is below 540 psia or above 985
psia.
The yellow H2 PRESS and the red BACKUP
C/W ALARM lights illuminate if hydrogen
tank pressure is below 153 psia or above
293.8 psia.
When any FC reactant valve is closed, the red
FUEL CELL REAC light is illuminated, a tone
is sounded and the BACKUP C/W ALARM is
illuminated.
The yellow FUEL CELL STACK TEMP light
will illuminate if FC and stack temperatures
are below 170.7 F or above 241.9 F. The red
BACKUP C/W ALARM and blue SM ALERT
will also light for similar limits.

O2 PRESS

H2 PRESS

The yellow FUEL CELL PUMP light will

illuminate if FC 1, 2, or 3 coolant pump delta
pressure is lost. If the coolant pump for FC 1,
2, or 3 is off, the BACKUP C/W ALARM will
be illuminated.
The yellow O2 HEATER TEMP light on panel
F7 illuminates if the temperature sensor
senses the oxygen tank temperature is at or
above 344 F. Software checks the limit; if it
is above 349F, the BACKUP C/W ALARM
light illuminates as well.
The red MAIN BUS UNDERVOLT light and
the BACKUP C/W ALARM illuminate if main
bus A, B, or C voltage is 26.4 volts dc.
The yellow AC VOLTAGE light illuminates
for an overvoltage or undervoltage condition
in the AC bus. The red BACKUP C/W
ALARM will also illuminate.
The yellow AC OVERLOAD light illuminates
for an overload condition in the AC bus.

FUEL CELL
REAC

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

AC
VOLTAGE

AC
OVERLOAD

(R)

CABIN ATM
(R)

FREON
LOOP

O2 HEATER
TEMP

AV BAY/
CABIN AIR

MAIN BUS
UNDERVOLT

IMU

FWD RCS

RCS JET

(R)

H2 O LOOP

RGA/ACCEL

AIR DATA

LEFT RCS

RIGHT RCS

LEFT OMS

RIGHT OMS

(R)

LEFT RHC
(R)

PAYLOAD
WARNING
(R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM (R)

GPC
PRIMARY C/W
APU
TEMP

RIGHT/AFT
RHC
(R)

(R)
(R)

FCS
SATURATION

OMS KIT

FCS
CHANNEL

MPS

OMS TVC
(R)

(R)

APU
APU
HYD PRESS
OVERSPEED UNDERSPEED

346.cvs

EPS Caution and Warning Lights on Panel F7

2.8-39

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

O2

CRYO

MANF P
P

TK1

FC1
REAC
VLV

SPLY
VLV

TO ECS
SYS 1

H2

MANF P

TK1

REAC
VLV

MANF
VLV

MANF
VLV

TK3

TK3
FC3
REAC
VLV

TK5

REAC
VLV

TK5

TK4
TK4
MANF
VLV

MANF
VLV
SPLY
VLV

TO ECS
SYS 2

REAC
VLV

REAC
VLV
FC2

TK2

TK2

MANF P

MANF P
usa007587_309r3.cvx

O2/ H2 HTR LOSS

BUS
LOSS
MNA DA1

PAIRED
TK1
A

TK3
B

A/M
AUTO
AUTO

A/M

CNTL AB1

MAN

AB2

A/M

A/M

AUTO

A/M

A/M

AUTO

AUTO

A/M
MAN

A/M

A/M

BC 3

MAN

MAN
MAN

CA 2

A/M

A/M
MAN

MAN

A/M

A/M
A/M

A/M

CA 3
AUT0*

AUTO*

AUTO

AUTO

AUTO

AUTO

AUTO*

AUTO*

3AB

A/M

MAN

BC 2

CNTL CA1

A/M

A/M

MAN

2CA

A/M

CNTL BC1

ESS 1BC

TK5

TK 4
B

A/M

MNB DA2
MNC DA3

PAIRED
TK2

AUTO*

AUTO*

AUTO

AUTO

AUTO

AUTO

AUTO*

AUTO*

AUTO

AUTO

* AUTO operation regained if both A and B HTR SW of other paired tank(s) are not in auto. A/M = Auto and Manual loss.

Cryogenic System

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-40

Panel R1

USA007587
Rev. A

2.8-41

2. SYSTEMS
2.8 Electrical Power System (EPS)

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-42

Panel A15

Panel R1

USA007587
Rev. A

USA007587
Rev. A

Panel R11U

Panel O2

Panel F9

2.8-43

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

0001/

/078

0001/

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
- 0.9
L/R FD - 0.4
0.2
AV BAY 1 - 1.2 - 0.0
2 - 0.6 - 0.3
3 - 0.1 - 0.9
CABIN
PRESS
14.7
dP/dT
+.00
BU/EQ -.00 +.00
PPO2
3.02 3.02
FAN DP
5.79
HX OUT T
49
O2 FLOW
0.0 0.0
N2 FLOW
0.0 0.0
IMU FAN DP
4.62
DV FC1 FC2 FC3
SS1 15
18
18
SS2 16
20
11
SS3 22
26
26
TOTAL AMPS 510
KW
15

DC VOLTS
FC
MAIN
ESS
CNTL

5 000/03:13:09
BFS 000/00:00:00
1/A
2/B
3/C
31.1 31.1 31.1
31.0 31.1 31.0
29.8 29.8 29.8
A
B
C
A
1 29.3 29.3 29.3
2 29.3 * 00.0 29.3
3 29.3 29.3 29.3

AC
VOLT A
117
B
117
C
117
4.4
AMPS A
B
3.9
C
2.4
FUEL CELL PH
AMPS
172
REAC VLV
OP
STACK T +204
EXIT T 150
COOL P
61
PUMP

117
117
117
4.1
4.2
3.2
167
OP
+203
150
61
P

117
117
117
2.7
3.2
4.8
PH
178
OP
+203
151
61

usa007587_085r4.cvx

/078

SM SYS SUMM 2
4
206
814
-248
-248
HYD
PRESS
ACUM P
RSVR T
QTY

5 008/23:29:22
BFS 000/00:00:00
5
MANF1 MANF2
206
208
207
814
815
815
-248
-248
1
2
3
3064 3064 3064
3080 3080 3080
116
153
142
72

74

71

W/B
H2O QTY 78
BYP VLV BYP

73
BYP

78
BYP

THERM CNTL
1
H2O PUMP P
23
FREON FLOW
2384
EVAP OUT T
38

2
63
2384
38

usa007587_051r1.cvx

BFS SM SYS SUMM 1

2011/

/079

CRYO TK
1
2
3
H2 PRESS
208
208
206
O2 PRESS
816
815
814
HTR T1
-248 -248 -248
T2
-248 -248 -248
APU
1
2
3
TEMP EGT 942
942
942
B/U EGT 942
942
942
OIL IN 250
250
250
OUT 264
264
264
GG BED
511H 511H 511H
INJ
1271 1271 1271
SPEED %
99
102
101
FUEL QTY
59
60
62
PMP LK P 14
14
14
OIL OUT P 42
42
41
FU TK VLV
A T 63
65
62
B T 63
65
62
AV BAY
1
2
3
TEMP
97
97
83
FAN P
3.56 3.68 4.12

BFS SM SYS SUMM 2

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
0.0
L/R FD
0.0
0.0
AV BAY 1 0.3
0.3
2 0.3
0.4
3 0.3
0.3
CABIN
PRESS
14.0
dP/dT-EQ +.00 +.000
02 CONC 21.4
PPO2
3.00 3.00
FAN P 5.00
HX OUT T
46
O2 FLOW
0.0
0.0
N2 FLOW
0.0
0.0
IMU FAN A
B* C
V FC1 FC2 FC3
SS1 22
21
22
SS2 22
22
23
SS3 23
21
21
TOTAL AMPS 557
KW
17

4 000/14:44:12
000/00:00:00
DC VOLTS
1/A
2/B
3/C
FC
30.6 30.1 31.0
MAIN
30.6 30.1 31.0
ESS
29.6 29.6 29.3
A
B
C
A
CNTL 1 29.4 29.4 29.6
2 29.4 29.4 29.4
3 29.4 29.4 29.4
AC
VOLT A
118
118
117
B
117
117
118
C
117
117
118
AMPS A
4.3
6.3
2.1
B
5.5
6.6
2.2
C
3.1
5.0
3.2
FUEL CELL
AMPS
180
232
146
REAC VLV
OP
OP
OP
STACK T +202 +206 +200
EXIT T
150
152
149
COOL P
61
60
61
PUMP
usa007587_243r2.cvx

PASS SM SYS SUMM 2

PASS SM SYS SUMM 1

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-44

USA007587
Rev. A

SM SPEC 179 POWER TRANSFER

SM SPEC 67 (ELECTRIC)

SM SPEC 68 (CRYO SYSTEM)

SM SPEC 200 APCU STATUS

SM SPEC 69 (FUEL CELLS)

2.8-45

2. SYSTEMS
2.8 Electrical Power System (EPS)

USA007587
Rev. A

EPS Summary Data

EPS Rules of Thumb

The EPS operates during all flight phases

and consists of the equipment and reactants
that
produce
electrical
power
for
distribution throughout the orbiter.

Never close a circuit breaker or reset an

RPC found out of configuration without
MCC coordination.

The FC picks up full power load support

after ground equipment is turned off at
T minus 50 seconds, supporting power
requirements for the solid rocket booster,
orbiter, and payloads.

Loss of cooling to a FC requires crew action

within 9 minutes to prevent a catastrophic
loss of crew/vehicle due to possible FC fire
and explosion.

EPS subsystems are:

power reactants
storage and distribution, FCs, and electrical
power distribution and control.

The
Power
Reactants
Storage and
Distribution system stores cryogenic
hydrogen and oxygen and supplies them to
the FCs. It also supplies oxygen to the
ECLSS. The components are located in the
orbiter midbody underneath the payload
bay.

FC run limit prior to shutdown for loss of

cooling is 9 minutes at a 7 kW nominal load.
Run time is inversely proportional to FC
load.

Any interruption of continuous AC power

during ascent will result in the loss of main
engine controller redundancy. Reconfiguration of AC powered equipment prior to
MECO should be avoided.

The FC system (three FCs) transforms

hydrogen and oxygen to electricity by a
chemical reaction. The system supplies
potable water to the ECLSS and consists of
power and accessory sections.

Never connect or reconnect power to a

known shorted or failed component; this
includes switch throws, circuit protection
device resets, or bus ties.

The electrical power distribution and

control system distributes electrical power
throughout the orbiter. It has five types of
assemblies: power control, load control,
motor control, main DC distribution, and
AC distribution and control.

The EPS requires very little flight crew

interaction during nominal operations.

Three oxygen and hydrogen tanks are good

for up to 8 days on orbit; five oxygen and
hydrogen tanks are good for up to 12 days
on orbit; eight oxygen and hydrogen tanks
are good for up to 18 days on orbit. Exact
duration varies with crew complement and
power load.

The majority of the EPS controls are on

panels R1 and R11U. Power sources and
circuit breakers are distributed on panels
O13, O14, O15, O16, ML86B, R14, A15, and
MA73C. Heaters are controlled from panel
R1, A11, and A15.

A FC hydrogen pump uses 0.3 amps/AC

phase; a coolant pump uses 0.5 amps/AC
phase.

Meters for monitoring EPS parameters are

located on panels F9 and O2

DPS displays containing EPS data are BFS

SM SYS SUMM 1 and 2, PASS SM SYS
SUMM 1 and 2, SM SPEC 67 (ELECTRIC),
SM SPEC 68 (CRYO SYSTEM), SM SPEC 69
(FUEL CELLS), SM SPEC 179 (POWER
TRANSFER), and SM SPEC 200 (APCU
STATUS).

2. SYSTEMS
2.8 Electrical Power System (EPS)

2.8-46

USA007587
Rev. A

2.9

ENVIRONMENTAL CONTROL
AND LIFE SUPPORT SYSTEM
(ECLSS)

1.

Pressure
control
system
(PCS)
maintains the crew compartment at 14.7
psia with a breathable mixture of oxygen
and nitrogen. Nitrogen is also used to
pressurize the supply and waste water
tanks.

2.

Atmospheric
revitalization
system,
(ARS) uses air circulation and water
coolant loops to remove heat, control
humidity, and clean and purify cabin air.

3.

Active thermal control system (ATCS)

consists of two Freon loops that collect
waste heat from orbiter systems and
transfer the heat overboard.

4.

Supply and waste water system stores

water produced by the fuel cells for
drinking, personal hygiene, orbiter
cooling, and eventual transfer to the
International Space Station (ISS). The
waste water system stores crew liquid
waste and waste water from the
humidity separator. The system also has
the capability to dump supply and waste
water overboard.

CONTENTS
Description.................................................. 2.9-1
Pressure Control System ........................... 2.9-4
Atmospheric Revitalization System ........ 2.9-13
Active Thermal Control System............... 2.9-24
Supply and Waste Water Systems ........... 2.9-37
Operations................................................... 2.9-47
ECLSS Caution and Warning Summary. 2.9-50
ECLSS Summary Data............................... 2.9-51
ECLSS Rules of Thumb ............................. 2.9-63

Description
The ECLSS maintains the orbiters thermal
stability and provides a pressurized, habitable
environment for the crew and onboard avionics.
The ECLSS also manages the storage and
disposal of water and crew waste.
ECLSS is functionally divided into four systems:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Water coolant loops

Interchanger heat exchanger
Payload heat exchanger
Freon-21 coolant loops
Fuel cell power plants
Cargo heat exchanger
Hydraulic heat exchangers
to radiators
Aft avionics bay and cold plates
Ground support equipment
heat exchanger
Flash evaporators
Ammonia boiler
To radiators
Midbody cold plates
Fuel cell heat exchanger to
Freon-21 coolant loops
Freon-21 coolant pumps 22
Avionics bays 1, 2, and
3A heat exchangers,
fans, and coolant plants

17
18
19
20
21
22
23
24

Inertial measurement units heat exchanger and fans

Water pumps
Cabin air to water heat exchanger
Humidity water separators
Carbon dioxide absorber
Cabin fans and check valve assemblies
Liquid-cooled garment heat exchanger
Potable water chiller heat exchanger

10

4
7
5

3
2

9
8

23

11

24

12

15

13
14

21

16
18 17
20

19
usa007587_1169

2.9-1

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
ECLSS
N2
Supply
H2O

Waste
H2O

Pressure
control
system

O2/N2

H2O

Heat
rejection
systems

H2O/Freon
HX

Air/H2O
HX

Cabin
air

Freon

Heat
loads
CO2
Removal

To
space

Heat
loads

ARS

ATCS

Cabin

Payload bay
usa007587_354r2.cvx

Environmental Control and Life Support System Overview

ISS

EMU

Supply and
waste water
system

Crew

Pressure
control
system

C/W
INST
DPS
D&C

Fuel
cell

Atmospheric
revitalization
system

EPDC

PRSD

Hydraulics

ATCS

Payloads

usa007587_355r2.cvx

Environmental Control and Life Support System Interfaces

2. SYSTEMS

2.9-2

2.9 Environmental Control and Life Support System

USA007587
Rev. A
The crew compartment provides a life-sustaining environment for the flight crew. The cabin
volume is 2,475 cubic feet. For extravehicular
activity (EVA), an external airlock is
depressurized and repressurized.
Under
normal circumstances, the cabin may be
depressed to 10.2 psia to ease prebreathe
requirements prior to an EVA. The airlock is
outside the middeck in the payload bay and
brings the combined cabin volume to
approximately 2,703 cubic feet. The external
airlock volume varies and is based on missionspecific configuration. The external airlock is
covered in detail in the Orbiter Docking System
(ODS) section of this document.

0001/

/078

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
- 0.9
L/R FD - 0.4
0.2
AV BAY 1 - 1.2 - 0.0
2 - 0.6 - 0.3
3 - 0.1 - 0.9
CABIN
PRESS
14.7
dP/dT
+.00
BU/EQ -.00 +.00
PPO2
3.02 3.02
FAN DP
5.79
HX OUT T
49
O2 FLOW
0.0 0.0
N2 FLOW
0.0 0.0
IMU FAN DP
4.62
DV FC1 FC2 FC3
SS1 15
18
18
SS2 16
20
11
SS3 22
26
26
TOTAL AMPS 510
KW
15

DC VOLTS
FC
MAIN
ESS
CNTL

5 000/03:13:09
BFS 000/00:00:00
1/A
2/B
3/C
31.1 31.1 31.1
31.0 31.1 31.0
29.8 29.8 29.8
A
B
C
A
1 29.3 29.3 29.3
2 29.3 * 00.0 29.3
3 29.3 29.3 29.3

AC
VOLT A
117
B
117
C
117
4.4
AMPS A
B
3.9
C
2.4
FUEL CELL PH
AMPS
172
REAC VLV
OP
STACK T +204
EXIT T 150
COOL P
61
PUMP

117
117
117
4.1
4.2
3.2
167
OP
+203
150
61
P

117
117
117
2.7
3.2
4.8
PH
178
OP
+203
151
61

usa007587_085r4.cvx

ECLSS Parameters on the BFS SM SYS

SUMM 1 Display (DISP 78)

Most ECLSS parameters can be monitored

during ascent and entry on BFS DISP 78 (SM SYS
SUMM 1) and BFS DISP 79 (SM SYS SUMM 2)
displays. On orbit ECLSS parameters are also
available on SM DISP 66 (ENVIRONMENT) and
SM DISP 88 (APU/ENVIRON THERM) displays.
2011/

/066

ENVIRONMENT

4 000/02:33:38
000/00:00:00
CABIN
AV BAY
1
2
3
dP/dT +.01 CABIN P 14.7 TEMP
90
90
78
PPO2
AIRLK P 14.8 FAN P 3.80 3.77 3.92
A 3.04 FAN P 5.55
SUPPLY H20
B 3.04 HX OUT T 45L QTY A 67
PRESS
32
C 3.04 CABIN T 71
B 18
DMP LN T 77
PPC02 1.9
C 94
NOZ T A 64
1
2
D 94
B 64
O2 FLOW
0.0L 0.0L WASTE H20
REG P
100
100 QTY 1 15
PRESS
17
N2 FLOW
0.0L 0.0L
DMP LN T 58
REG P
202
202
NOZ T A 82
O2/N2 CNTL VLV N2
O2
B 82
H20 TK N2 P
17
17
VAC VT NOZ T 224
N2 QTY
131
131
CO2 CNTLR
1
2
EMER O2 QTY
1
FILTER P
0.00L
REG P
4L
PPCO2
- 0.0L
TEMP
32.0L
A B C
P BED A PRESS
0.0L 0.0L
IMU
FAN
*
4.5
B PRESS
0.0L 0.0L
HUMID SEP
*
P
0.00L 0.00L
VAC PRESS
0.0L

ECLSS Parameters on the BFS SM

SYS SUMM 2 Display (DISP 79)
2011/
/088 APU/ENVIRON THERM
4 000/02:36:51
FREON LOOP
1
2
000/00:00:00
ACCUM QTY
27
27
H2O LOOP
1
2
FREON ISOL
RAD ISOL PUMP OUT P
24
62
FREON FLOW 2193 2190
OUT T
64
63
PL HX FLOW
290
286
P
0L
38
AFT CP FLOW 279
278 ICH FLOW
14L 777
RAD IN T
97
96
OUT T
41
38
RAD OUT T
38
38 CAB HX IN T
42
38
EVAP OUT T
38
38 ACCUM QTY
45
55
EVAP TEMP
APU FUEL T 1
2
3
HILD IB/OB
259 259
TK SURF
+ 69 + 67 + 68
NOZ
312
TK HTR
+ 70 + 68 + 69
TOP FWD/AFT 257 257
TEST LN 1 + 62 + 62 + 63
L/R DUCT 162 162
TEST LN 2 + 62 + 63 + 63
L/R NOZ
50
50
FEED LN
+ 57 + 58 + 58
EVAP FDLN T
A
B
PUMP IN
+ 57 + 58 + 58
FWD 80
80
DRN LN 1 + 62 + 62 + 63
MID 1 80
80
DRN LN 2 + 62 + 62 + 63
MID 2 79
75
OUT
+ 92 + 90 + 88
AFT 75
79
BYP LN
+108 +106 +102
TOPPING 75
79
GG SPLY LN 113
111
107
ACCUM 75
79
HI LOAD 75
79
H2O LN INJ+ 71
92 + 72

usa007587_093r1.cvx

ENVIRONMENTAL Display (DISP 66)

usa007587_078r2.cvx

APU/ENVIRON THERM Display (DISP 88)

2.9-3

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Payload bay

Cabin

100 psi
O2 reg
R

O2 supply
valve
System 1
cryo O2
Freon
loop 1
M

N2
Tank 1
sys1

H2O tk
N2 reg
R

200 psi
N2 reg
M

Cab reg
inlet

Sys 1 O2/ N2
manifold

N2
Tank 2
sys 1

14.7 psi
cab reg
R

Emer
8 psi reg
R

O2/N2
control
valve

Direct O2
LEH supply

N2
Tank 1
sys 2

200 psi
N2 reg
M

N2
Tank 2
sys 2

O2/N2
control
valve

EMU supply

Emer
8 psi reg
R

R
H2O tk
N2 reg

O2 supply
valve

System 2
cryo O2

100 psi
O2 reg
Freon
loop 2

Sys 2 O2/ N2
manifold
R
Cab reg 14.7 psi
inlet
cab reg
usa007587_359r2.cvx

Pressure Control System

Pressure Control System

The pressure control system normally
pressurizes the crew cabin to 14.7 0.2 psia. It
maintains the cabin at an average 80-percent
nitrogen (130 pounds) and 20-percent oxygen
(40 pounds) mixture that closely resembles the
atmosphere at sea level on Earth. The system
also provides the cabin atmosphere necessary to
cool cabin-air-cooled equipment. Oxygen partial pressure is maintained automatically
between 2.95 and 3.45 psi, with sufficient
nitrogen pressure of 11.5 psia added to achieve
the cabin total pressure of 14.7 0.2 psia.
Positive and negative pressure relief valves
protect the structural integrity of the cabin from
over- and underpressurization, respectively.
The pressure control system nitrogen is used to
pressurize the supply and waste water tanks.
The system also provides breathing oxygen
directly to the launch and entry suit helmets
and to emergency breathing masks.
Cabin pressure is maintained by either of two
pressure control systems (designated PCS 1 and
PCS 2). Each PCS consists of a liquid oxygen
storage system and a gaseous nitrogen storage
system. The PCS oxygen is supplied from the
electrical power systems (EPS) cryogenic
oxygen in the midfuselage of the orbiter. The
cryogenic supercritical oxygen storage system is
2. SYSTEMS

controlled by electrical heaters within the tanks

and supplies oxygen to the ECLSS pressure
control system at a pressure of 803 to 883 psia in
a gaseous state. The nitrogen storage tanks are
serviced to a nominal pressure of 2,964 psia at
80 F. Normal on-orbit operations use one
oxygen and one nitrogen supply system.
Cabin pressure is controlled by the nitrogen/
oxygen control and supply panels, an associated
PPO2 sensor, and the pressure relief valves. The
nitrogen/oxygen control panel regulates PCS 1
and PCS 2 oxygen and nitrogen. Typically, PCS
1 is activated for the first half of the mission and
PCS 2 is activated for the second half. System 1
and system 2 nitrogen/oxygen supply panels
are located in the middeck (panel MO10W) and
the forward flight deck (panel L2). Both O2 and
N2 supply systems 1 and 2 have a crossover
capability, which allows the respective systems
to be tied together.
The oxygen supply system provides the
makeup cabin oxygen for flight crew
consumption and makeup for normal cabin
leakage. The nitrogen system provides nitrogen
for pressurizing the cabin and the supply and
waste water tanks. Each crew member uses an
average of 1.76 pounds of oxygen per day.
About 6 pounds of nitrogen and 14 pounds of
oxygen are used per day for normal loss of crew

2.9-4

2.9 Environmental Control and Life Support System

USA007587
Rev. A

ATM PRESS CONTROL O2 SYS SUPPLY and

XOVR Switches and Talkbacks on Panel L2
cabin gas to space and metabolic usage for a
typical seven-member crew. The supply and waste
water tanks are pressurized to 17 psig to expel
water from the tanks for use by the crew, for
dumping overboard, or for supplying water at the
appropriate pressure for use by the flash evaporator
system (FES).
Oxygen System
Oxygen from the power reactant storage and
distribution system (cryogenic oxygen supply
system) is routed to the pressure control oxygen
system 1 and system 2 supply valves. These
valves are controlled by the ATM PRESS
CONTROL O2 SYS 1 SUPPLY and O2 SYS 2
SUPPLY switches on panel L2. When one of the
switches is momentarily positioned to OPEN, the
corresponding valve opens to permit oxygen to
flow through an oxygen restrictor at a maximum
flow of approximately 25 pounds per hour for
either system 1 or 2. The oxygen restrictor also
functions as a heat exchanger with the Freon
coolant loop, warming the oxygen supplied to
the oxygen regulator of that system before it
flows into the cabin. Freon loop 1 warms system
1 oxygen, and loop 2 warms system 2. A
talkback indicates OP when the O2 supply valve
is open. When the switch is momentarily

positioned to CLOSE, the valve is closed,

isolating that oxygen supply system.
The
talkback indicates CL.
Next, the oxygen piping penetrates the
bulkhead and enters the crew compartment. A
check valve downstream of the O2 flow
restrictor prevents oxygen from flowing from
one supply source to the other when the
crossover valves are open. Downstream of the
oxygen check valve, oxygen systems 1 and 2 are
connected by a crossover valve that permits
system 1 and system 2 to be interconnected. The
crossover valves are controlled by the ATM
PRESS CONTROL O2 XOVR SYS 1 and SYS 2
switches on panel L2. When one of the switches
is positioned to OPEN, the associated oxygen
supply system is directed to the launch and
entry helmet O2 supply 1 and 2 manual valves,
airlock oxygen 1 and 2 extravehicular mobility
unit, and direct O2. If both switches are
positioned to OPEN, oxygen supply systems 1
and 2 are interconnected. When a switch is
positioned to CLOSE, that oxygen supply
system is isolated from the crossover feature.
The crossover valves are normally open.

2.9-5

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Payload bay

Cabin
100 psi
O2 reg O2 reg
inlet
R

O2 supply
valve
System 1
cryo O2

Payload O2

14.7 psi
Cab reg cab reg
inlet
R

Freon
loop 1

Emer
8 psi reg
R
O2
crossover
valve

O2/N2
control
valve

Direct O2
O2 XOVR
manifold

LEH supply
EMU supply

O2/N2
control
valve

O2
crossover
valve

System 2
cryo O2

Emer
8 psi reg
R

Sys 2 O2/N2
manifold

O2 supply
Freon
valve
loop 2

R
O2 reg 100 psi
inlet
O2 reg
X0 = 576

Payload O2

Cab reg 14.7 psi

cab reg
inlet
usa007587_361r5.cvx

Oxygen System
Downstream of the oxygen crossover line is an
oxygen regulator inlet manual valve. When the
valve is manually positioned to OPEN by the O2
REG INLET switch on panel MO10W, oxygen is
directed to a regulator that reduces the oxygen
supply pressure to 100 10 psig.
Each
regulator valve has a manual toggle
OPEN/CLOSE valve, a regulator, and a relief
valve. The relief valve relieves pressure at 245
psig and reseats at 215 psig. The relief pressure
is vented into the crew cabin. The regulated O2
then passes through another check valve that
prevents downstream nitrogen from entering the
oxygen system. The oxygen enters a manifold

2. SYSTEMS

that is shared by the nitrogen system. This

manifold is connected to its 14.7 psi cabin
regulator inlet manual valve and the 8 psi
regulator. Between the oxygen regulator and the
oxygen check valve, the oxygen is fed to the
payload oxygen manual valve for use by the
payload, if needed. This valve, as well as the 14.7
cabin pressure manual valve, is located on panel
MO10W. Makeup O2 for metabolic usage is
provided by a bleed orifice inserted on orbit into
LEH O2 8 quick disconnect on panel MO69M.
The bleed orifice is sized to supply 0.24 pounds-mass
per hour (lbm/hr) of O2 for four- to five-member crews
and 0.36 lbm/hr for six- to seven-member crews.

2.9-6

2.9 Environmental Control and Life Support System

USA007587
Rev. A

O2 REG INLET Switches on Panel MO10W

2.9-7

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
14.7
cabin reg

Cabin reg
inlet

N2 tank 3
sys 1

N2
supply
M

N2
reg inlet
M

H2O tank
N2 reg inlet

200 psi
N2 reg
R

Payload N2

N2
supply
manifold

N2 tank 1
sys 2

Sys 1 O2/N2
manifold

To MMU

N2 tank 4
sys 1

O2/N2
control
valve4

8 psi
emer
reg

N 2 crossover

T0 MMU
Payload N2

N2 tank 2
sys 2

H2O tank
N2 reg

N2
Supply

N2
reg inlet

200 psi
N2 reg

O2/N2
control
valve

8 psi
emer
reg

R
H2O tank
N2 reg inlet

Payload bay cabin

Sys 2 O2/N2
manifold

H2O tank
N2 reg
Cabin
reg
inlet

14.7
cabin
reg
363.cvs

Nitrogen System for Nominal Mission

Nitrogen System
Gaseous nitrogen is supplied from two nitrogen
systems, consisting of either two or three
nitrogen tanks (depending on orbiter) per
system that are mounted in the payload bay.
System 1 is mounted on the port side and
system 2 is on the starboard side. OV-103 and
OV-105 each have a standard six-tank
configuration, while OV-104 is currently equipped
with five nitrogen tanks (two in System 1 and three
in System 2). On each of the vehicles, additional
tanks may be flown as mission kits.
Note: The N2 tank configuration and number
of tanks flown may vary by flight, based on
mission requirements.
The nitrogen supply tanks are constructed of
filament-wound Kevlar fiber with a titanium
liner. Each nitrogen tank is serviced to a

2. SYSTEMS

nominal pressure of 2,964 psia at 80 F, with a

volume of 8,181 cubic inches. The nitrogen
tanks in each system are manifolded together.
The PCS 1 and PCS 2 nitrogen supply systems
are controlled by the atmosphere pressure
control nitrogen supply valves in each system.
Each valve is controlled by its corresponding
ATM PRESS CONTROL N2 SYS 1 and SYS 2
SUPPLY switch on panel L2. When a switch is
momentarily positioned to OPEN, nitrogen
flows to both atmosphere pressure control
system regulator inlet valves, since both sets of
tanks are manifolded together downstream of
the supply valve. A talkback near the switch
indicates barberpole when the motor-operated
valve is in transit, and OP when the supply
valve is open. When the switch is positioned to
CLOSE, that nitrogen supply system is isolated
from the nitrogen system regulator inlet valve,
and the talkback indicator shows CL.

2.9-8

2.9 Environmental Control and Life Support System

USA007587
Rev. A

ATM PRESS CONTROL N2 SYS SUPPLY and

REG INLET Switches and Talkbacks on Panel L2
The nitrogen regulator inlet valve in each
nitrogen system is controlled by its respective
ATM PRESS CONTROL N2 SYS REG INLET
switch on panel L2. When the switch is
positioned to OPEN, that systems nitrogen at
source pressure is directed to the systems
nitrogen regulator. A talkback indicator below
the SYS 1 switch and above the SYS 2 switch
indicates barberpole when the motor-operated
valve is in transit, and OP when the valve is
open. When the switch is positioned to CLOSE,
the supplied nitrogen is isolated from the
systems nitrogen regulator, and the talkback
indicator indicates CL.
The nitrogen regulators in supply systems 1 and
2 reduce the pressure to 200 15 psig. Each
nitrogen regulator is a two-stage regulator with
a relief valve. The relief valve relieves pressure
at 295 psig into the vacuum vent line and
reseats at 245 psig.

The pressure regulated nitrogen of each system

then enters the crew cabin and encounters a check
valve to prevent backflow from one nitrogen source
supply to the other if the nitrogen crossover is open.
This check valve also prevents flow from the pressure
control system out of the crew cabin in the event of
an upstream plumbing leak. Past the check valve,
each systems regulated nitrogen is directed to the
nitrogen manual crossover valve, the manual
water tank regulator inlet valve, the payload
manual nitrogen supply valve, and the oxygen
and nitrogen controller valve in each system.
Each system can supply nitrogen at a rate of at least
125 lbm/hr. The manual valves are controlled
from panel MO10W, and the controller valve is
controlled from the panel L2 O2/N2 CNTLR
VLV switch.
The nitrogen crossover manual valve connects
both regulated nitrogen systems when the valve
is open and isolates the nitrogen supply systems
from each other when closed. Normally, the
valve is always closed.

2.9-9

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Oxygen/Nitrogen Manifold
The O2/N2 control valve controls the flow of
either N2 or O2 into the O2/N2 manifold,
depending on the partial pressure of oxygen in
the cabin. Whatever gas (O2/N2) is in the
O2/N2 manifold will flow into the cabin when
the cabin pressure drops below 14.7 psia, and
the 14.7 regulator inlet valve is open. This flow
will continue as long as the cabin pressure is
less than 14.7. An 8 psia emergency regulator
provides flow to maintain a cabin pressure of 8
psia in the event of a large cabin leak. There is
no regulator inlet valve to isolate the 8 psia
emergency regulator; therefore, it is always
configured to provide flow.

given pressure control system, the actual position of

the valve (OPEN, to flow nitrogen or CLOSE, to
inhibit nitrogen flow and allow oxygen to flow into
the O2/N2 manifold) is governed by the associated O2/N2
controller. If the PPO2 SNSR/VLV switch on panel
L2 is in the NORM position, O2/N2 Controller 1
controls the position of the O2/N2 CNTLR VLV in
pressure control system 1 and O2/N2 Controller 2
controls the position of the O2/N2 CNTLR VLV in
pressure control system 2. These associations are
reversed if the PPO2 SNSR/VLV switch is in the
REVERSE position.

The 14.7 psi cabin regulator regulates the cabin

pressure to 14.7 0.2 psia and is capable of a
maximum flow of 75 to 125 lb/hr. The 8 psi
emergency regulator regulates to 8 0.2 psia
and is also capable of a maximum flow of 75 to
125 lb/hr. Both the 14.7 and 8 psi regulators
flow into the cabin through a port in panel
MO10W located above the waste management
system compartment. Regulators consist of two
stages: a low-flow regulator (0 to 0.75 lb/hr) for
small demand when the cabin pressure is near
14.7 psia and a high flow regulator (0.75 to at
least 75 lb/hr) for high demand when cabin
pressure is significantly below 14.7 psia.

PPO2 SNSR/VLV and O2/N2 CNTRL VLV

Switches on Panel L2

NOTE
Crewmembers should be aware that the
regulators make a noticeable sound when
they flow oxygen or nitrogen into the
cabin. It is most noticeable in the vicinity
of the waste management system compartment. Additionally, use of the waste
control system (WCS) during high N2
flow is not advisable due to the
possibility of hypoxia.
PPO2 Control
The partial pressure of oxygen (PPO2) in the
crew cabin can be controlled automatically
during orbit by one of two O2/N2 controllers.
Two PPO2 sensors (A and B) located under the
mission specialist station provide inputs to the
PPO2 control systems 1 and 2 controller and
switches, respectively. When the O2/N2 CNTLR
VLV switch on panel L2 is positioned to AUTO in a
2. SYSTEMS

PPO2 CONT and CABIN REG INLET Switches

on Panel MO10W

2.9-10

2.9 Environmental Control and Life Support System

USA007587
Rev. A
When the PPO2 sensor and O2/N2 controller
associated with the O2/N2 control valve that is in the
AUTO position detects low oxygen levels in the crew
cabin, the O2/N2 control valve is automatically
closed. When the 200-psi nitrogen in the O2/N2
manifold
drops
below
100
psi,
the
corresponding oxygen system flows oxygen
through its check valve into the manifold and
through the 14.7 psi cabin regulator into the
crew cabin. When the PPO2 sensor and O2/N2
controller determine that the oxygen in the crew
cabin is at the upper end of its allowed control
range, the corresponding O2/N2 control valve is
automatically opened. The 200-psi nitrogen
enters the O2/N2 manifold and forces the
corresponding oxygen systems check valve
closed and flows through the 14.7 psi regulator
into the crew cabin whenever the cabin pressure
drops below 14.7 psia 0.2. The OPEN and
CLOSE positions of the O2/N2 CNTLR VLV SYS
1 and SYS 2 switches on panel L2 permit the
flight crew to manually control the O2/N2 valve
in each system and manually switch between O2
and N2 systems.

B monitor the oxygen partial pressure and the

signal to the SENSOR switch on panel O1.
When the switch is positioned to SENSOR A,
oxygen partial pressure from sensor A is
monitored on the PPO2 meter on panel O1 in
psia. If the switch is set on SENSOR B, oxygen
partial pressure from sensor B is monitored.
The cabin pressure sensor output is routed
directly to the CABIN PRESS meter on panel O1
and is displayed in psia. These parameters can
also be viewed on DPS displays SM SYS SUMM
1 (PPO2) and DISP 66, ENVIRONMENT (PPO2
A, B, C).
If the change in pressure versus change in time
(dP/dT) decreases at a rate of 0.08 psi per
minute or more, a klaxon will sound in the crew
cabin, and the MASTER ALARM pushbutton
light indicators will be illuminated. Normal
cabin dP/dT is zero psi per minute 0.01 psi.

The SYS 1 and SYS 2 PPO2 CNTLR switches

were designed to control the PPO2 level (via the
O2/N2 CNTLR) of the cabin between the normal
range (2.95-3.45 at 14.7 psi) and the emergency
range (1.95-2.45 at 8 psi). The control range can
be determined by positioning the switch in
NORM or EMER.
The EMER position is
procedurally never used.
The flow rates of oxygen systems 1 and 2 and
nitrogen systems 1 and 2 can be monitored via
the O2/N2 FLOW meter on panel O1 and on the
SM SYS SUMM 1 (DISP 78, both BFS and PASS)
and SM ENVIRONMENT (DISP 66, PASS only)
displays. The flow of the selected system is
displayed on the meter and CRT displays in
pounds per hour. The currently used flow sensors
go off-scale low (OSL) at 0 lbm/hr flow and off-scale
high (OSH) at 5 lbm/hr, and high flow alarms
annunciate at 4.9 lbm/hr. To replace a set of failed
sensors, new flow sensors are being incorporated into
OV-104 that are capable of measuring flow up to
25 lbm/hr. However, these sensors are nonlinear, so
they will report a maximum flow rate onboard of
12.4 lbm/hr. Calibration for these sensors has been
specified to also annunciate a high flow alarm at
4.9 lbm/hr (actual and displayed), just like the
currently used flow sensors. PPO2 sensors A and

Meters and Switches on Panel O1

(Transducers also supply information for SM
SYS SUMM 1, DISP 66, and C/W.)

2.9-11

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
2011/

/078

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
0.0
L/R FD
0.0
0.0
AV BAY 1 0.3
0.3
2 0.3
0.4
3 0.3
0.3
CABIN
PRESS
14.0
dP/dT-EQ +.00 +.000
02 CONC 21.4
PPO2
3.00 3.00
FAN P 5.00
HX OUT T
46
O2 FLOW
0.0
0.0
N2 FLOW
0.0
0.0
IMU FAN A
B* C
V FC1 FC2 FC3
SS1 22
21
22
SS2 22
22
23
SS3 23
21
21
TOTAL AMPS 557
KW
17

DC VOLTS
FC
MAIN
ESS
CNTL
AC

4 000/14:44:12
000/00:00:00
1/A
2/B
3/C
30.6 30.1 31.0
30.6 30.1 31.0
29.6 29.6 29.3
A
B
C
A
1 29.4 29.4 29.6
2 29.4 29.4 29.4
3 29.4 29.4 29.4

VOLT A
118
B
117
C
117
AMPS A
4.3
B
5.5
C
3.1
FUEL CELL
AMPS
180
REAC VLV
OP
STACK T +202
EXIT T
150
COOL P
61
PUMP

118
117
117
6.3
6.6
5.0

117
118
118
2.1
2.2
3.2

232
OP
+206
152
60

146
OP
+200
149
61

usa007587_243r2.cvx

The SM SYS SUMM 1 display is an SM

display (DISP78) available in SM OPS 2
2011/

/066

ENVIRONMENT

CABIN
dP/dT +.01 CABIN P 14.7
PPO2
AIRLK P 14.8
A 3.04 FAN P 5.55
B 3.04 HX OUT T 45L
C 3.04 CABIN T 71
PPC02 1.9
1
2
O2 FLOW
0.0L 0.0L
REG P
100
100
N2 FLOW
0.0L 0.0L
REG P
202
202
O2/N2 CNTL VLV N2
O2
H20 TK N2 P
17
17
N2 QTY
131
131
EMER O2 QTY
1
REG P
4L
IMU
FAN
HUMID SEP

B
*
*

P
4.5

4 000/02:33:38
000/00:00:00
AV BAY
1
2
3
TEMP
90
90
78
FAN P 3.80 3.77 3.92
SUPPLY H20
QTY A 67
PRESS
32
B 18
DMP LN T 77
C 94
NOZ T A 64
D 94
B 64
WASTE H20
QTY 1 15
PRESS
17
DMP LN T 58
NOZ T A 82
B 82
VAC VT NOZ T 224
CO2 CNTLR
1
2
FILTER P
0.00L
PPCO2
- 0.0L
TEMP
32.0L
BED A PRESS
0.0L 0.0L
B PRESS
0.0L 0.0L
P
0.00L 0.00L
VAC PRESS
0.0L

CABIN RELIEF and CABIN VENT Switches

and Talkbacks on Panel L2
Cabin Relief Valves

usa007587_093r1.cvx

The ENVIRONMENT display is an SM

display (DISP 66) available in SM OPS 2

Two positive pressure relief valves are in parallel to provide overpressurization protection of
the crew module cabin above 15.5 psid. The
valves will crack at 15.5 psid, reach full flow by
16.0 psid, and reseat again below 15.5 psid.
Each cabin relief valve is controlled by its
corresponding CABIN RELIEF switch on panel
L2. When the switch is positioned to ENABLE,
the motor-operated valve opens, exposing cabin
pressure to a corresponding positive pressure
relief valve. The relief valve maximum flow
capability is 150 pounds per hour at 16.0 psid.
A talkback indicator above the switch indicates
barberpole when the motor-operated valve is in
transit, and ENA when the motor-operated
valve is open. When the switch is positioned to
CLOSE, the corresponding motor-operated
valve isolates cabin pressure from the relief
valve and the talkback indicator indicates CL.
Vent Isolation and Vent Valves
The cabin vent isolation valve and cabin vent
valve are in series to vent the crew cabin to
ambient pressure while the orbiter is on the
ground. Approximately 1 hour 30 minutes
before lift-off, the cabin is pressurized to
approximately 16.7 psi for leak checks. Cabin

2. SYSTEMS

2.9-12

2.9 Environmental Control and Life Support System

USA007587
Rev. A
pressure is then monitored for 35 minutes to
verify that no pressure decay occurs. During
this time, the cabin vent and cabin vent isolation
valves are alternately opened and closed to
verify that each holds pressure.

relieving pressure into the crew cabin at a

differential pressure of 18.5 1.5 psig.

The cabin vent isolation valve is controlled by

the VENT ISOL switch on panel L2, and the
cabin vent valve is controlled by the VENT
switch. Each switch is positioned to OPEN to
control its respective motor-operated valve.
When both valves are open, the cabin pressure
is vented into the mid-fuselage. The maximum
flow capability through the valves at 2.0 psid is
1080 pounds per hour.

The airlock pressure is maintained equal with

cabin pressure via the airlock equalization
valves located on the cabin/airlock hatch.
During normal operations the airlock hatch is
open. The airlock depressurization valve is
used to depressurize the cabin to 10.2 psia and
to depressurize the airlock for EVA.

A talkback indicator above each switch indicates

the position of the respective valve: CL when the
valve is closed, barberpole when the valve is in
transit, and OP when it is open.

The atmospheric revitalization system (ARS)

circulates air and water throughout the cabin to
control ambient heat, relative humidity, carbon
dioxide, and carbon monoxide levels. The ARS
also provides cooling for cabin avionics.

WARNING
Because of the high flow capability of the
cabin vent isolation valves, these valves
should never be opened after lift-off.
Negative Pressure Relief Valves
If the crew cabin pressure is lower than the
pressure outside the cabin (e.g., during the final
stages of entry following a cabin leak), two negative
pressure relief valves in parallel will open at 0.2
psid, permitting flow of ambient pressure into
the cabin. Caps over each valve provide a
positive pressure seal and will pop off when the
valve opens. No crew controls are necessary.

Airlock Depressurization and

Equalization Valves

Atmospheric Revitalization System

Cabin air is circulated around the cabin to

remove heat and humidity. The heated air is
then ducted (via cabin fans) to the cabin heat
exchanger, where the heat is removed by the
water coolant loops. The water coolant loop
system collects heat from the cabin heat
exchanger, the inertial measurement unit (IMU)
heat exchanger, the cold-plated electronic units
in the avionics bays, and the avionics bay heat
exchangers. The water coolant loop transfers
the heat collected to the Freon/water heat
exchanger of the active thermal control system.
The active thermal control system then expels
the heat overboard.
Cabin Air Flow

Water Tank Regulator Inlet Valve

The H2O TK N2 REG INLET valve in each
nitrogen system permits nitrogen to flow to its
regulator and H2O TK N2 ISOL SYS 1, 2 valve.
The REG inlet and isolation manual valves are
on panel MO10W. The regulator in each
nitrogen system reduces the 200-psi supply
pressure to 15.5 to 17.0 psig. Each regulator is a
two-stage regulator with the second stage

Except for ducting, all air loop components are

located under the middeck floor. The air
circulated through the flight crew cabin also
picks up odor, carbon dioxide, debris, and
additional heat from electronic units in the crew
cabin. Based on the crew cabin volume of 2,300
cubic feet and 330 cubic feet of air per minute,
one volume crew cabin air change occurs in
approximately 7 minutes, and approximately
8.5 air changes occur in 1 hour.

2.9-13

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Cabin
Temperature: 65 to 80 F
Humidity: 30 to 75 percent
Oxygen partial pressure: 2.29 psia to 3.45 psia

Ex

Cab
in t
e
s elempera
c t o t u re
r

Avionics from
flight deck

Cabin
temperature
controller

ha

us
t

du

e
t ur

er a
mp

cti
n

e
ct t
Condensing
Du sor
heat exchanger
se n
Temperature
control
valve

Cabin temperature
sensor
b
Air

Int a

ke
d

uct

i ng

Cabin fans
debris trap

Lithium hydroxide
and charcoal
canisters

Water
coolant

a
yp

du
ss

ct

a te
ns
de
n
Co

Air/water
separators
Air

371.cvs

Cabin Air
The heated cabin air is drawn through the cabin
Lithium Hydroxide Canisters
loop and through a 300-micron filter by one of
two cabin fans. Each cabin fan (A and B) is
The cabin air leaves the cabin fan at a rate of
controlled by its respective CABIN FAN switch
about 1,400 lb/hr. An orifice in the duct directs
on panel L1. Normally, only one fan is used.
approximately 120 lb/hr to each of two lithium
hydroxide (LiOH) canisters, where carbon
Each fan is powered by a three-phase, 115-volt
dioxide is removed, and activated charcoal
AC motor. These 495-watt motors produce a
removes odors and trace contaminants. The
nominal flow rate of 1,400 lb/hr through the
canisters are changed periodically on a
cabin air ducting. A check valve located at the
predetermined schedule, generally one or two
outlet of each fan prevents air from backflowing
times a day, through an access door in the
through the non-operating fan. This flappermiddeck floor. (For larger crews, the canisters are
type check valve will open if there is a 2-inch
changed more frequently.) Each canister is
H2O (.0723 psi) differential pressure across the
rated at 48 man-hours. Up to 30 spare canisters
valve. A cabin fan will not start on two phases
are stored under the middeck floor in a locker
of ac. However, if the cabin fan is already
between the cabin heat exchanger and water
operating when a phase of AC is lost, the fan
tanks. The LiOH canisters are the primary means of
will continue to run on two phases of ac. A
carbon dioxide (CO2) control onboard the orbiter.
cabin fan can be started on 2-1/2 phases of ac,
with the extra half phase provided by the
induced voltage generated by other rotating
CAUTION
equipment (that is, fans and pumps) running on
During lithium hydroxide canister changeout,
that AC bus. If a phase of AC is lost with a
the cabin fan(s) should be turned off. Dust
short, then the induced voltage will not be
from the canisters kicked up by a cabin fan
usable, and starting the cabin fan will not be
has caused eye and nose irritation. Lithium
possible.
hydroxide dust may also be a contributing
factor to humidity separator failures.

2. SYSTEMS

2.9-14

2.9 Environmental Control and Life Support System

USA007587
Rev. A
substrate. Upon exposure to carbon dioxide
laden cabin air, the resin combines with water
vapor in the air to form a hydrated amine which
reacts with carbon dioxide to form a weak
bicarbonate bond. Water is required for the
process since dry amine cannot react with the
carbon dioxide directly. While one bed adsorbs
carbon dioxide, the other bed regenerates with
thermal treatment and vacuum venting. This
latter requirement prevents the use of the RCRS
during ascent or entry.
The adsorption/regeneration process runs continuously
with the beds automatically alternating processes every 13 minutes. A full cycle is made up
of two 13 minute cycles. An RCRS configured
vehicle uses a single LiOH canister for launch
and another for entry. An activated charcoal
canister in the other CO2 absorber slot removes
odors. It is changed out mid mission on 10+ day
flights.

Carbon Dioxide Absorbers

Regenerable Carbon Dioxide Removal System
OV-105 has the hardware capability to perform
RCRS operations designed for use on long-duration
standalone missions. However, the hardware is not
needed while docked to the ISS, and the RCRS is not
planned to be used in the future. This is presented as
historical information.
The ability to use the RCRS in the EDO orbiters
solved a major weight and volume stowage
problem encountered when attempting to conduct 10 to 16 day duration missions for a crew
of up to seven astronauts. Carbon dioxide
removal is accomplished by passing cabin air
through one of two identical solid amine resin
beds. The resin consists of a polyethylenimine
(PEI) sorbent coating on a porous polymeric

When flown, the RCRS is located in volume D

under the middeck floor. In addition to the two
chemical beds, the major components of the
RCRS include a set of vacuum cycle and
pressure equalization valves, an RCRS fan, an
airflow
control
valve,
an
ullage-save
compressor, and two redundant controllers (1
and 2).
The airflow control valve is set
prelaunch for either a crew size of "4" or "5 to 7"
crewmembers.
These two positions select
airflow through the RCRS of 72 or 110 lb/hr
respectively. The control switches for the RCRS
are located on panel MO51F. Both AC and DC
power for the 1 and 2 controllers are operated
from this panel. Each controller has a three
position momentary switch for selection of
OPER or STBY. This panel also has status lights
for each controller that illuminate OPER or FAIL
as appropriate.
Crew insight into RCRS
operation
is
found
on
SPEC
66
ENVIRONMENT in OPS 2.
The scrubbed air is then forced through the
cabin heat exchanger.

2.9-15

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

CO2 Removal System Panel MO51F

2. SYSTEMS

2.9-16

2.9 Environmental Control and Life Support System

To
vacuum
vent
duct

Vacuum
poppet

Vacuum
poppet

RCRS
inlet
temp

RCRS
CO2
partial
press

2.9-17

Air
poppets

Vacuum poppet

VCV B outlet

Vacuum poppet

Bed B

RCRS
filter
P

Muffler

Cntrl 1
bed
P

Cntrl 2
bed B
pressure

Cntrl 1
bed B
pressure

Cntrl 2
bed
P

Cntrl 2
bed A
pressure

Cntrl 1
bed A
pressure

RCRS
vacuum
pressure

PEV
4

PEV
1

Pressure
equalization
valve (PEV)
module

Filter

Compressor

Muffler

P D-0.5 psi

Muffler

NOTE: Valves are configured

for RCRS State 8

PEV
6

PEV
5

PEV
2

PEV
3

Regenerable Carbon Dioxide Removal System (RCRS)

VCV B inlet

Air
poppets
VCV A outlet

Bed A

VCV A inlet

Flow control
valve

Inlet filter/muffler/fan assembly

40 micron

Muffler

From cabin
air loop

374.cvs

To cabin
air loop

USA007587
Rev. A

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Cabin Air Temperature Control
The cabin temperature control valve is a
variable position valve that proportions the
volume of air that bypasses the cabin heat
exchanger.
The valve may be positioned
manually by the crew, or automatically by one
of the two cabin temperature controllers. The
cabin temperature controller is a motor-driven
actuator that adjusts the cabin temperature
control valve to achieve the temperature
selected by the CABIN TEMP rotary switch on
panel L1. The cabin temperature control valve
and the two controllers are located in the ECLSS
bay below panel MD44F.
When the CABIN TEMP CNTLR switch on
panel L1 is positioned to 1, it enables controller
1. The rotary CABIN TEMP switch elects and
automatically controls the bypass valve by
diverting 0 to 70 percent of the air flow around
the cabin heat exchanger, depending on the
position of the switch. Normally, full COOL
corresponds to a temperature of approximately 65 F,
and full WARM corresponds to about 80 F.
The controllers are attached to a single bypass
valve by an actuator arm. If controller 1
malfunctions, the actuator arm linkage must be
removed from controller 1 by the flight crew at
panel MD44F and connected manually to
controller 2 before the CABIN TEMP CNTLR
switch on panel L1 is positioned to 2. This
enables controller 2 and permits the rotary
CABIN TEMP switch to control controller 2 and
the single bypass control valve. The CABIN
TEMP CNTLR switchs OFF position removes
electrical power from both controllers, the
rotary switch, and automatic control of the
single bypass valve. For ascent and entry, the
CABIN TEMP is set to full COOL to ensure
maximum air cooling during these relatively
warm phases of flight.

HUMIDITY SEP, CABIN TEMP, CABIN

TEMP CNTLR, and CABIN FAN Switches
on panel L1
Panel O1

Panel O1
10
11
12
13

Avionics bay 1 air

outlet temperature

Air temp

Avionics bay 2 air

outlet temperature
Avionics bay 3 air
outlet temperature
Cabin heat exchanger
air outlet temperature

Yellow
Av bay
cabin air

+
9

Panel F7
C/W
electronics

Cabin fan
delta pressure
376.cvs

The air from the cabin heat exchanger and the

bypassed air come together in the supply duct
downstream of the heat exchanger and are
exhausted into the crew cabin through the CDR
and PLT consoles and through various station
duct outlets into the crew cabin.

2. SYSTEMS

2.9-18

2.9 Environmental Control and Life Support System

Avionics Bay and Cabin Heat Exchanger

Temperature Monitoring and
Caution/Warning, Crew Cabin Air

USA007587
Rev. A
Cabin Temperature Monitoring

Manual Temperature Control

The cabin heat exchanger outlet temperature is

transmitted to a rotary switch below the AIR
TEMP meter on panel O1. When the switch is
positioned to CAB HX OUT, the temperature
can be monitored on the meter. The cabin heat
exchanger outlet temperature provides an input
to the yellow AV BAY/CABIN AIR caution and
warning light on panel F7.
The light is
illuminated if the cabin heat exchanger outlet
temperature is above 145 F, if avionics bay 1, 2,
or 3 temperatures exceed 130 F, or if the cabin
fan delta pressure is less than 4.2 inches of
water or above 6.8 inches of water.

If cabin temperature controllers 1 and 2 or the

CABIN TEMP rotary switch on panel L1 are
unable to control the single bypass valve, the
flight crew can position the single bypass valve
actuator drive arm to the desired position and
pin the bypass valve arm to one of four fixed
holes (FULL COOL, FULL HEAT, etc.) on panel
MD44F. The FULL COOL position establishes
the maximum cabin air flow rate to the cabin
heat exchanger, the 2/3 COOL position
establishes a flow rate that provides
approximately two-thirds of the maximum
cooling capability, the 1/3 COOL position
establishes a flow rate that provides
approximately one-third of the maximum
cooling, and the FULL HEAT position
establishes the minimum cabin air flow rate to
the cabin heat exchanger.

Manual Temperature Controls

on Panel MD44F
Cabin Air Humidity Control
AIR TEMP Meter and Switch on Panel O1

Cabin air is directed to the crew cabin heat

exchanger, where heat is transferred to the water
coolant loop. Humidity condensation that forms
in the heat exchanger is pushed by the air flow to
the slurper. One of two humidity separators
draws air and water from the slurper. In the
humidity separator, centrifugal force separates
the water from the air. The fan separator
removes nominally about 1 and up to
approximately 4 pounds of water per hour. The
water is routed to the waste water tank, and the
air is ducted through the exhaust for return to the
cabin. There are two fan separators (A and B)
2.9-19

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
controlled individually by HUMIDITY SEP A
and B switches on panel L1. Normally, only
one fan separator is used.
The relative
humidity in the crew cabin typically is
maintained between 30 and 65 percent in this
manner.
The orbiters have been modified to allow
redirecting the condensate water from the
humidity separator to a contingency water
container (CWC) while on orbit.
This
modification is in support of ISS missions where
waste tank dumping will be minimized while
docked. Once undocked, the CWC will be
dumped overboard through the contingency
crosstie waste quick disconnect.
A small portion of the revitalized and
conditioned air from the cabin heat exchanger is
ducted to the carbon monoxide removal unit
(the ambient temperature catalytic oxidizer, or
ATCO), which converts carbon monoxide to
carbon dioxide. A bypass duct carries warm
cabin air around the cabin heat exchanger and
mixes it with the revitalized and conditioned air
to control the crew cabin air temperature
between 65 and 80 F.
Avionics Bay Cooling
Cabin air is also used to cool the three avionics
equipment bays and some of the avionics units
in the bays. Each of the three avionics equipment bays in the middeck has a closeout cover
to minimize air interchange and thermal
gradients between the avionics bay and crew
cabin; however, the covers are not airtight. For
all practical purposes, air circulation is closed
loop within the bay. The electronic avionics
units in each avionics bay meet outgassing and
flammability requirements to minimize toxicity
levels.
Each of the three avionics equipment bays has
identical air-cooling systems. Two fans per bay
are controlled by individual AV BAY 1, 2, 3
FAN A and B switches on panel L1. Normally,
only one fan is used at a time. When the A or B
switch for an avionics bay is positioned to ON,
the fan draws air from the floor of the avionics
bay through the applicable air-cooled avionics
units and a 300-micron filter into the avionics
bay fan.
2. SYSTEMS

Note: The fan duct work for Av Bay 3A has

been modified to accept a larger cabin fan for
additional middeck cooling for payloads that
will be stowed in the middeck for ISS missions.
The standard avionics bay fans will be flown
until the larger fan is needed.
The avionics bay fan outlet directs the air
through that avionics bay heat exchanger,
located beneath the middeck crew compartment
floor. The water coolant loops flow through the
heat exchanger to cool the fan outlet air, and
the cooled air is returned to the avionics bay.
A check valve in the outlet of the fan that is
not operating prevents a reverse flow through
that fan.
The air outlet temperature from the fan in each
avionics bay is monitored and transmitted to a
rotary switch on panel O1. When the switch is
positioned to AV BAY 1, 2, or 3, that avionics
bays fan outlet temperature can be displayed
on the AIR TEMP meter.
The air outlet
temperature of each avionics bay also provides
an input to the yellow AV BAY/CABIN AIR
caution and warning light on panel F7. This
light is illuminated if any of the avionics bay
outlet temperatures are above 130 F. The OFF
position of the A or B switch removes power
from that avionics bay fan.
Inertial Measurement Unit (IMU) Cooling
The three IMUs are cooled by one of three fans
drawing cabin air through a 300-micron filter
and across the three IMUs. The fans are located
in AV Bay 1. The fan outlet air flows through
the IMU heat exchanger located on the flight
deck and is cooled by the water coolant loops
before returning to the crew cabin. Each IMU
fan is controlled by the IMU FAN switches on
panel L1.
The ON position turns the
corresponding fan on, and the OFF position
turns it off. Normally, one fan is sufficient
because one fan cools all three IMUs. A check
valve is installed on the outlet of each fan to
prevent a reverse airflow through the fans that
are not operating.

2.9-20

2.9 Environmental Control and Life Support System

USA007587
Rev. A
the ECLSS bay below the forward lockers. The
pumps are powered by three-phase, 117-volt AC
motors.
Some electronic units in each of the avionics
equipment bays and in the cabin are mounted on
cold plates. The water coolant loops flow through
the cold plates, and the heat generated by the
electronics unit is transferred to the cold plate and
then to the water coolant loop, which carries heat
from the electronic unit. The cold plates mounted
on the shelves in each avionics bay are connected
in a series-parallel arrangement with respect to
the water coolant loop flow.
2011/
/088 APU/ENVIRON THERM
4 000/02:36:51
FREON LOOP
1
2
000/00:00:00
ACCUM QTY
27
27
H2O LOOP
1
2
FREON ISOL
RAD ISOL PUMP OUT P
24
62
FREON FLOW 2193 2190
OUT T
64
63
PL HX FLOW
290
286
P
0L
38
AFT CP FLOW 279
278 ICH FLOW
14L 777
RAD IN T
97
96
OUT T
41
38
RAD OUT T
38
38 CAB HX IN T
42
38
EVAP OUT T
38
38 ACCUM QTY
45
55
EVAP TEMP
APU FUEL T 1
2
3
HILD IB/OB
259 259
TK SURF
+ 69 + 67 + 68
NOZ
312
TK HTR
+ 70 + 68 + 69
TOP FWD/AFT 257 257
TEST LN 1 + 62 + 62 + 63
L/R DUCT 162 162
TEST LN 2 + 62 + 63 + 63
L/R NOZ
50
50
FEED LN
+ 57 + 58 + 58
EVAP FDLN T
A
B
PUMP IN
+ 57 + 58 + 58
FWD 80
80
DRN LN 1 + 62 + 62 + 63
MID 1 80
80
DRN LN 2 + 62 + 62 + 63
MID 2 79
75
OUT
+ 92 + 90 + 88
AFT 75
79
BYP LN
+108 +106 +102
TOPPING 75
79
GG SPLY LN 113
111
107
ACCUM 75
79
HI LOAD 75
79
H2O LN INJ+ 71
92 + 72

IMU FAN and AV BAY FAN Switches

on Panel L1
Water Coolant Loop System
The water coolant loops circulate water through
the crew compartment to collect excess heat and
transfer it to the Freon coolant loops. Two
complete, separate water coolant loops flow side
by side and can operate at the same time,
although only one is active at any given time.
Loop 2 is normally the active loop. The only
difference between loops 1 and 2 is that loop 1
(the backup) has two water pumps, and loop 2
has one pump. The water pumps are located in

usa007587_078r2.cvx

APU/ENVIRON THERM Display (DISP 88)

2.9-21

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Crew Cabin Water Coolant Loops

The status of the water loops can be monitored on
the APU/ENVIRON THERM display (DISP 88),
which is available in SM OPS 2. The information is
found in the items under H2O LOOP.
Water Loop Pumps
A ball-type check valve downstream of each water
pump in loop 1 prevents reverse flow through the
non-operating pump.
The water pumps in
coolant loop 1 are controlled by the H2O PUMP
LOOP 1 A and B switch on panel L1 in
conjunction with the H2O PUMP LOOP 1 GPC,
OFF, ON switch beside it. The ON position
continuously energizes the loop 1 pump. The GPC
position enables the general-purpose computer
to command the loop 1 pump, which is selected
by the H2O PUMP LOOP 1 A or B switch, to
circulate water through water coolant loop 1
nominally for 6 minutes every 4 hours while on
orbit (OPS 2) to thermally condition the
normally static loop. The OFF position removes
electrical power from both the A and B pumps
of loop 1.
The coolant loop 2 water pump is controlled by the
H2O PUMP LOOP 2 switch on panel L1. The ON
position energizes the loop 2 water pump
continuously. In OPS 2, when the switch is

2. SYSTEMS

positioned to GPC, water pump 2 is commanded by

the GPC to circulate water through water coolant
loop 2 for 6 minutes every 4 hours. In OPS 1, 3,
and 6, the GPC-ON command for the water loop 2
pump stays resident in the BFS, so taking the switch
to the GPC position immediately activates the pump
(assuming the associated pump power circuit breakers
are closed). The OFF position removes electrical
power from water coolant loop 2 pump.
Water Loop Flow
Water loops 1 and 2 are routed side by side
through the same areas. Downstream of each
water pump, water flow splits into three
parallel paths. One is through the AV Bay 1
air/water heat exchanger and cold plates. A
second is through the AV Bay 2 air/water heat
exchanger and cold plates, and thermal
conditioning of the crew cabin windows. A
third is through the crew cabin MDM flight
deck cold plates, the AV Bay 3A air/water heat
exchanger and cold plates, and the AV Bay 3B
cold plates. The three parallel paths in each
coolant loop then rejoin upstream of the
Freon/water heat interchanger. The flow path
splits again with one parallel path in each water
coolant loop flowing through the Freon/water
interchanger, where the water loop is cooled.

2.9-22

2.9 Environmental Control and Life Support System

USA007587
Rev. A

H2O Loop Switches on Panel L1

The cooled water then flows through the liquidcooled garment heat exchanger, potable water
chiller, cabin heat exchanger, and IMU heat
exchanger to the respective water coolant loop 1
and 2 pump package. The other parallel path in
each water coolant loop, containing warm
water, bypasses the interchanger and heat
exchanger, rejoining the loop at the loop pump
package. A valve installed in the bypass path
controls the amount of bypass flow, thus
controlling the mixed water temperature out of
the pump package.
The bypass valve is controlled by bypass
controllers either manually or automatically via
H2O LOOP 1 and 2 BYPASS MODE switches on
panel L1. When the switch is positioned to
AUTO, the water bypass controller and bypass
valve automatically control the amount of water
in the coolant loop that bypasses the
Freon/water interchanger and heat exchangers
in an attempt to maintain a pump outlet set point

temperature of 63.0 2.5 F. When the water

pumps outlet temperature exceeds the set point
temperature, the loops bypass valve is
commanded to close, and more loop flow is
directed to the Freon/water interchanger to
provide increased cooling.
When the bypass controller senses that the
water pumps outlet temperature is below the set
point temperature, the controller increases the
amount of water bypassed around the
Freon/water interchanger, reducing the heat
rejection rate and increasing the water
temperature out of the pump outlet. When the
H2O LOOP BYPASS MODE switch for the
coolant loop is positioned to MAN, the flight
crew uses the corresponding H2O LOOP MAN
INCR/DECR momentary switch on panel L1 to
manually control the bypass valve position in
that water coolant loop.

2.9-23

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
The bypass valve is manually adjusted before
launch to provide a flow of approximately 950
pounds per hour through the Freon/water
interchanger, and the control system remains in
the manual mode until post insertion. On orbit,
the active water coolant loop's H2O LOOP
BYPASS MODE switch is set to AUTO and the
bypass valve automatically controls the loop so
that the water pumps outlet temperature
remains at about 63 F.

for DPS display readout on the DISP 88

APU/ENVIRON THERM display (PUMP
OUT P).

The accumulator in each water coolant loop

provides a positive pressure on the
corresponding
water
pump
inlet
and
accommodates thermal expansion and dampens
pressure surges in that water coolant loop when
the pump is turned on or off. Each accumulator is
pressurized with gaseous nitrogen at 19 to 35 psi.
The pressure at the outlet of the water pump in
each water coolant loop is monitored and
transmitted to the H2O PUMP OUT PRESS
meter on panel O1. When the switch below the
meter is positioned to LOOP 1 or LOOP 2, the
corresponding water coolant loops pressure in
psia is monitored on the meter.
NOTE
For normal operations, only one water
loop is active (usually loop 2). Running
two water loops for long periods of time
is undesirable. Two operating loops will
flow too much water through the
Freon/water interchanger and result in a
significant increase in the cabin
temperature. This occurs because two
active water loops are capable of picking
up more heat than the Freon/water
interchanger can transfer to the Freon
loops. Over time, the water loops will
start to heat up, and cooling efficiency
will decrease.

H2O PUMP OUT PRESS Meter and Switch

on Panel O1 (The same transducer feeds SM
DISP 88)

Active Thermal Control System

The yellow H2O LOOP caution and warning

light on panel F7 will be illuminated if the
outlet pressure of the water coolant loop 1
pump is less than 19.5 psia or greater than 79.5
psia, or if the outlet pressure of the loop 2 pump
is less than 45 psia or greater than 81 psia. The
pump outlet pressure and delta pressure across the
pump of each coolant loop are monitored and
transmitted to the systems management GPC
2. SYSTEMS

The active thermal control system (ATCS)

provides orbiter heat rejection during all phases
of the mission after solid rocket booster
separation.
The system consists of two
complete, identical Freon coolant loops, cold
plate networks for cooling avionics units,
liquid/liquid heat exchangers, and three
onboard heat sinks: radiators, flash evaporators,
and ammonia boilers.
Freon Loops
Two Freon coolant loops transport excess heat
from the Freon/water interchanger, fuel cell
heat exchanger, payload heat exchanger, and
midbody and aft avionics electronic units. The
Freon loops then deliver the heat to the heat
sinks.
Each loop has a pump package

2.9-24

2.9 Environmental Control and Life Support System

USA007587
Rev. A
consisting of two pumps and an accumulator.
The pump package is located in the midbody of
the orbiter below the payload bay liner. One
pump in each loop is active at all times. The
metal bellows-type accumulator in each loop is
pressurized with gaseous nitrogen to provide a
positive pressure on the pumps and permit
thermal variation in that coolant loop. When the
accumulator bellows is fully extended,
approximately 80 lb of Freon is in the
accumulator (normally only 20 to 30 percent of
this amount is used). A ball check valve

downstream of the pumps in each coolant loop

prevents a reverse flow through the nonoperating pump in the loops. The pumps in
each coolant loop are controlled individually by
the FREON PUMP switches on panel L1. When
either switch is positioned to A or B, the
corresponding Freon pump in that loop
operates. The OFF position of each switch
prohibits either Freon pump in that coolant loop
from operating.

Active Thermal Control System Component Locations

2.9-25

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
When a Freon pump is operating, Freon is
routed in parallel paths through the fuel cell
heat exchanger and the midbody cold plate
network to cool electronic avionics units,
including the station/shuttle power transfer system
(SSPTS) electronics.
The Freon coolant
converges to one flow path before entering the
hydraulics heat exchanger.
Normally, the warmest portion of the Freon loop is at
the outlet of the hydraulic system heat exchanger.
The Freon flows from the hydraulic fluid heat
exchanger to the radiators, which are bypassed
through a bypass valve during ascent and entry
unless cold soak cooling from the radiators is
being used.
When the payload bay doors are opened on orbit, radiators located on the inside of the
payload bay doors are used for heat rejection to
space. After the radiators, the Freon coolant
flows through the ground support equipment
heat exchanger (used for providing prelaunch and
post-landing cooling), ammonia boilers, and
flash evaporator located in the aft fuselage. It is
then divided into two parallel paths. One path
flows through the cargo heat exchanger (located
on the left side roughly center of the
midfuselage) and continues through the ECLSS
oxygen restrictor to warm cryogenic oxygen to

2. SYSTEMS

about 40 F. The flows splits through a flowproportioning valve module into parallel paths
to the payload heat exchanger, and atmospheric
revitalization system Freon/water interchanger
(located in the lower forward portion of the
midfuselage) and then returns to a series flow.
The second path flows in series through aft
avionics bays 4, 5, and 6 to cool electronic
avionics equipment.
The flow continues
through cold plates to cool four rate gyro
assemblies. The parallel paths combine and
return in series to the Freon coolant pump in
that Freon coolant loop.
The FREON FLOW meter on panel O1 permits
the crew to monitor Freon flow to the Freon/
water interchanger. The switch below the meter
selects the loop to be monitored. Freon loop
status can also be monitored under the FREON
LOOP area on the APU/ENVIRON THERM
display (DISP 88) and the BFS THERMAL
display (FREON Loop 1, 2) in OPS 1. The
yellow FREON LOOP caution and warning light
on panel F7 will illuminate if Freon/water
interchanger (ICH) flow in either loop is less
than 1186 lbm/hr. The crew has no insight into
total loop flow.

2.9-26

2.9 Environmental Control and Life Support System

USA007587
Rev. A

FREON PUMP Switches on Panel L1

Freon Coolant Loop

2.9-27

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Radiators
Radiators act as a heat sink for the coolant
loops. The radiator system consists of four
radiator panels attached to the inside of each
payload bay door. The two forward radiator
panels on each payload bay door are deployable
when the doors are opened on orbit. The heat
rejection requirements of the orbiter for a
specific mission will determine if the forward
radiators are to be deployed. The third and
fourth radiator panels are fixed to the aft
underside of the aft right and left payload bay
doors and are not deployable.
The maximum heat rejection capability is 61,100
Btu per hour. When the payload bay doors are
closed, the radiators are usually bypassed.

The radiator panels provide an effective heat

dissipation area of 1,195 square feet on orbit.
Each radiator panel is 10 feet wide and 15 feet
long. The Freon tubing in the radiator panels is
more than 1 mile long.
For ascent, the radiators are normally bypassed
since the doors are closed. Radiator flow is
established shortly before the doors are opened
on orbit. During deorbit preparations, prior to
closing the doors, the Freon in the radiators is
cold-soaked by positioning the orbiter in a tail
Sun attitude and slowing flow through the radiators
by taking the RAD CONTROLLER OUT TEMP
switch to the HI position on panel L1. This cold
soak is saved for use as a heat sink during the
latter stages of entry.

The radiator panels on the left and right sides

are each configured to flow in series, while flow
within each panel is parallel through a bank of
tubes connected by an inlet and outlet connector
manifold. The radiator panels on the left side
are connected in series with Freon coolant loop
1. The radiator panels on the right side are
connected in series with Freon coolant loop 2.

BFS THERMAL DISPLAY

Radiator Mounting and Construction
The deployable radiators are secured to the
inside of the right and left payload bay doors by
six motor-operated latches. When the payload
bay doors are opened on orbit, if the mission
dictates that the deployable radiators be
deployed, then the six motor-driven latches
unlatch the radiators from the payload bay
doors, and a motor-driven torque-tube-lever
arrangement deploys the forward radiators at
35.5 from the payload bay doors. Deploying
the forward radiators provides more surface
area, and thus greater heat rejection.

FREON FLOW Meter and Switch on Panel O1

2. SYSTEMS

The aft fixed radiator panels are attached to the

payload bay doors by a ball joint arrangement
at 12 locations to compensate for movement of
the payload bay door and radiator panel caused
by the thermal expansion and contraction of
each member.

2.9-28

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Payload Bay Radiators

RADIATOR DEPLOY and STOW Switches and Talkbacks on Panel R13L

2.9-29

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
The radiator panels are made of an aluminum
honeycomb face sheet 126 inches wide and 320
inches long. The forward deployable radiator
panels are two-sided and have a core thickness of
0.9 of an inch. They have longitudinal tubes
bonded to the internal side of both face sheets.
Each of the forward deployable panels contains
68 tubes spaced 1.9 inches apart.

to OFF. The PL BAY MECH PWR switches are

then positioned to OFF.

Each tube has an inside diameter of 0.131 inch.

Each side of the forward deployable radiator
panels has a coating bonded by an adhesive to
the face sheet consisting of silver-backed Teflon
tape for proper emissivity properties. The aft
fixed panels are one-sided, and their cores are
0.5 inch thick. They have tubes only on the
exposed side of the panel and a coating bonded
by an adhesive to the exposed face sheet. The
aft panels contain 26 longitudinal tubes spaced
4.96 inches apart. Each tube has an inside
diameter of 0.18 inch. The additional thickness
of the forward radiator panels is required to
meet deflection requirements when the orbiter
is exposed to ascent acceleration.
Radiator Deploy Systems
There are two radiator deploy systems, each of
which drives one of two motors on each door.
The systems drive the radiator panels away
from the payload bay doors (deployed) or to the
stowed position, using two reversible threephase AC motors. It takes 50 seconds to deploy
or stow the radiators.
The crew deploys and stows the radiators using
switches on panel R13L. To deploy, the PL BAY
MECH PWR SYS 1 and SYS 2 switches are set to
ON to provide power to the panel switches.
Both RADIATOR LATCH CONTROL switches
are set concurrently to RELEASE; after 30
seconds, they are set to OFF. The RADIATOR
CONTROL switches are then concurrently set to
DEPLOY; after 50 seconds, they are set to OFF.
The PL BAY MECH PWR switches are then set
to OFF.
To stow the radiators, the PL BAY MECH PWR
switches are again positioned to ON. The
RADIATOR CONTROL switches are both
concurrently set to STOW, and after 50 seconds
to OFF. The LATCH CONTROL switches are
then positioned to LATCH, and after 30 seconds,
2. SYSTEMS

Radiators and Radiator Flow Control Valve

Assembly
Single Radiator Operations
It is possible to deploy either the port side or the
starboard side radiator independently. This
cannot be done directly with switches, because
each controls motors on both sides. To deploy
only one radiator, circuit breakers must be
pulled to disable motors on one side. Single
radiator operations may be done in case of a
contingency situation, such as failure of one
radiator or necessary Ku-Band antennae
pointing, or a planned situation, such as flying
in an attitude such that one door must remain
partially closed to protect against debris strikes.
Radiator Flow Control
A radiator flow control valve assembly in each
Freon coolant loop controls that loops
temperature via variable flow control, which
mixes hot bypassed Freon coolant with the cold
Freon coolant from the radiators. The radiator

2.9-30

2.9 Environmental Control and Life Support System

USA007587
Rev. A
bypass valve allows Freon to flow through the
radiator or bypass the radiator completely.
In the automatic mode, the RAD CONTROLLER
LOOP 1 and LOOP 2 switches on panel L1 are
positioned to AUTO A or AUTO B to apply
electrical power to the corresponding radiator
flow controller assembly. The RAD BYPASS
VALVE MODE switch is positioned to AUTO,
and the RAD CONTROLLER OUT TEMP switch
on panel L1 is positioned to NORM or HI.
With the RAD CONTROLLER OUT TEMP
switch on panel L1 positioned to NORM, the
radiator controller outlet temperature in Freon
coolant loops 1 and 2 is automatically controlled
at 38 F (2); in HI, the temperature is
automatically controlled at 57 F ( 2).
NOTE
To achieve the radiator NORM and HI
control point temperatures, the radiator panel
outlet temperature must be at or below the
corresponding control point temperature.

NOTE
If a primary flash evaporator system (FES)
controller switch on L1 is ON, the FES is
activated automatically when the radiator
controller outlet temperature exceeds 41 F
to supplement the radiators ability to
reject excess heat.
The talkback indicators below the RAD
CONTROLLER switches on panel L1 indicate the
position of the bypass valve in that Freon coolant
loop. The RAD BYPASS VALVE LOOP 1 and 2
talkback indicators show BYP when the bypass
valve in that Freon coolant loop is in the bypass
position, barberpole when the motor-operated
bypass valve is in transit, and RAD when the
bypass valve is in the radiator flow position.
When the RAD BYPASS VALVE MODE switch
on panel L1 is positioned to MAN for the Freon
coolant loop selected, automatic control of the
radiator bypass valve in that loop is inhibited,
and the flight crew controls the bypass valve
manually using the RAD BYPASS VALVE
LOOP 1, LOOP 2, MAN SEL switches on panel
L1.

When the switch is set to BYPASS, the loops

motor-operated bypass valve causes that Freon
coolant loop flow to bypass the radiators. When
the switch is positioned to RAD FLOW, the
valve permits coolant to flow through the
radiator and associated flow control valve.
NOTE
Besides specifying the NORM or HI radiator
controller output set point temperature, the
flow control valve cannot be controlled
manuallyonly automatically via the
controller. The bypass valve can be
operated manually or automatically.
Freon Radiator Isolation Valves
Orbital debris could damage the orbiter Freon
loop radiators located on the inner surface of
the payload bay doors. Debris striking a Freon
coolant line in the radiator could cause loss of
Freon in that loop. To preclude this loss, a
method was designed to isolate the punctured
radiator from the rest of the loop.
To isolate the affected radiator from the Freon
loop, AC-powered isolation valves and directional-flow check valves with associated
plumbing were added to the Freon loops.
Switches on L2 provide control of the isolation
valves. Power to the valves and control logic
are provided via circuit breakers on panels L4
and O14. The AC-powered isolation valve has
automatic and manual controls. During OPS 2
orbit operations, with the FREON ISOLATION
MODE switch in AUTO, if the affected Freon
loop accumulator quantity drops below a
threshold quantity (default is 12 percent) for at
least 3-5 seconds, a class 3 SM alert will
annunciate and a command will be sent to the
isolation valve on the affected loop to isolate the
affected radiator. However, this automatic
isolation will not occur if the Freon loop
accumulator quantity shows less than -5% or if
the status is M due to MDM failures. (The
-5% threshold prevents inadvertent automatic
radiator isolation in the event of an accumulator
quantity instrumentation failure; off-scale low for
Freon loop accumulator quantity is about -11%.) In
MAN, the crew has to isolate the affected
radiator manually if a leak is detected by
holding the affected loops switch in ISOLATE
until the radiator is isolated (~5 sec). Manual

2.9-31

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
control of the valve can override the auto
control in both directions (RAD FLOW or
ISOL) to reset the valve to the normal flow
condition for a system test or for a false failure
that may have caused the isolation valve to

isolate the radiator. Only manual control of the

radiator isolation valves is available during ascent
and entry (while the SM is managed by the backup
flight system (BFS)).

Panel L2 - Freon Loop Isolation

RAD CONTROLLER SWITCHES and Talkbacks and

FLASH EVAP CONTROLLER Switches on Panel L1

2. SYSTEMS

2.9-32

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Flash Evaporator System
The FES rejects heat loads from Freon coolant
loops 1 and 2 by evaporating supply water in a
vacuum. The FES is used during ascent above
140,000 feet, and it supplements the radiators on
orbit if required. It also rejects heat loads
during deorbit and entry to an altitude of
approximately 100,000 feet.
The FES is located in the aft fuselage of the
orbiter. There are two evaporators, a high-load
evaporator and a topping evaporator. Two
major differences are that the high-load
evaporator has a higher cooling capacity and
only one overboard vent on the left side of the
vehicle. The topping evaporator vents steam
equally to the left and right sides of the orbiter
to minimize propulsiveness. The evaporators
are cylindrical shells with dual water spray
nozzles at one end and a steam exhaust duct at
the other end. The shell is composed of two
separate finned packages, one for each Freon
loop. The hot Freon from the coolant loops
flows around the finned shell, and water is
sprayed onto the inner surface of the shell by
water nozzles from either evaporator. The
water vaporizes, cooling the Freon coolant
loops. In the low-pressure atmosphere above
100,000 feet, water vaporizes quickly. Changing
water liquid to vapor removes approximately
1,000 Btu per hour per pound of water. The
water for the evaporators is obtained from the
supply water storage tanks through FES water
supply feedlines A and B.
Flash Evaporator Controllers
The flash evaporators have three controllers:
primary A, primary B, and secondary. The
primary A and B controllers have two separate,
functionally redundant shutdown logic paths
(under-temperature and over-temperature with
insufficient rate of cooling). The secondary
controller has no automatic shutdown capability.
The flash evaporator controllers are enabled by
the FLASH EVAP CONTROLLER switches on
panel L1. The PRI A switch controls primary
controller A, the PRI B switch controls primary
controller B, and the SEC switch controls the
secondary controller.
When the PRI A, PRI B, or SEC switch is
positioned to GPC, the corresponding controller

is turned on automatically during ascent by the

backup flight system (BFS) computer as the
orbiter ascends above 140,000 feet (MM103/SRB
SEP). During entry, the BFS computer turns the
corresponding controller off as the orbiter
descends below about 100,000 feet (MM305). The
ON position of the switch provides electrical
power directly to the corresponding flash
evaporator controller. The OFF position of the
switch removes all electrical power and inhibits
flash evaporator operation.
The primary A controller controls water flow to
the flash evaporator from water supply system
A through water feed line A. The primary B
controller controls water flow to the flash
evaporator from water supply system B through
water feed line B.
NOTE
When a primary controller is enabled, both
High Load and Topping evaporators can be
used simultaneously.
The secondary controller controls water flow to
the high load flash evaporator from water
supply system A through feed line A if the
FLASH EVAP CONTROLLER SEC switch on
panel L1 is in the A SPLY position, and if the HI
LOAD EVAP switch is in the ENABLE position.
If the switch is in the B SPLY position, and the
HI LOAD EVAP switch is in the ENABLE
position, the secondary controller controls water
flow to the flash evaporator from water supply
system B through feed line B. When the
secondary controller is used, and the HI LOAD
EVAP switch is OFF, both the A and B water
supply systems will feed the topping
evaporator in an alternate pulsing fashion; the
high load evaporator is disabled.
When the
secondary controller is used, and the HI LOAD
EVAP switch is in the ENABLE position, the
topping evaporator is disabled.
The primary A and B controllers modulate the
water spray in the evaporator to keep the Freon
coolant loops evaporator outlet temperature
stable at 39 1 F. The secondary controller
modulates the water spray in the evaporator to
control the Freon coolant loops evaporator
outlet temperature at 62 F. The temperature
sensors are located at the outlets of both
evaporators.

2.9-33

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
The applicable FES controller pulses water into
the evaporators, cooling the Freon. The steam
generated in the topping evaporator is ejected
through two sonic nozzles at opposing sides of
the orbiter aft fuselage to reduce payload water
vapor pollutants on orbit and to minimize
venting thrust effects on the orbiters guidance,
navigation, and control system.
The high-load evaporator is used in conjunction
with the topping evaporator during ascent and
entry when higher Freon coolant loop
temperatures impose a greater heat load that
requires a higher heat rejection. The HI LOAD
EVAP switch on panel L1 must be in the
ENABLE position for high-load evaporator
operation.
After leaving the high-load
evaporator, Freon flows through the topping
evaporator for additional cooling. The steam
generated by the high-load evaporator is ejected
through a single sonic nozzle on the left side of
the orbiter aft fuselage.
The high-load
evaporator normally would not be used on orbit
because the high heat rejection capability of the high
load evaporator is not normally needed on orbit
when radiator cooling is available, and attempting to
use the high-load evaporator under low heat load
would likely cause the evaporator controller to shut
down. The high load also has a propulsive vent
(causing unbalanced rates on the vehicle), and it
might contaminate a payload.
NOTE
Norm jets are required to control vehicle
attitude when the FES high load is used
on orbit.
FES Auto Shutdown
Each primary controller has an automatic
shutdown capability to protect the evaporator
from over- or undertemperature conditions.
The evaporators outlet temperature is
monitored to determine whether a thermal
shutdown of the evaporator is warranted. If the
evaporator outlet temperature goes below 37 F
for 20 seconds or more, an undertemperature
shutdown of the evaporator occurs. If the
evaporator outlet temperature is greater than
41 F for 55 seconds, the overtemp shutdown
logic is enabled. An overtemp shutdown occurs
when the cooling rate is less than 2.1 to 7.8 F

2. SYSTEMS

per minute from 20 to 40 seconds after the

overtemp logic is enabled. If the evaporator is
shut down, electrical power to the affected
controller must be recycled to re-enable
operations.
Temperature Monitoring
The evaporator outlet temperature of Freon
coolant loops 1 and 2 is transmitted to panel O1.
When the switch below the FREON meter on
panel O1 is positioned to LOOP 1 or LOOP 2,
the evaporator outlet temperature of Freon
coolant loops 1 or 2 can be monitored in degrees
Fahrenheit on the FREON EVAP OUT TEMP
meter or on the DISP 79 SM SYS SUMM 2
display (EVAP OUT T), or on the DISP 88
APU/ENVIRON THERM display. If the outlet
temperature drops below 32.2 F, or rises above
64.8F (after post insertion), the red FREON
LOOP caution and warning light on panel F7
will be illuminated. (The upper limit for ascent
is
115 F.)
FES Heaters
Electrical heaters are employed on the topping
and high-load flash evaporators steam ducts to
prevent freezing. The HI LOAD DUCT HTR
rotary switch on panel L1 selects the electrical
heaters. Switch positions A and B provide
electrical power to the corresponding
thermostatically controlled heaters on the highload evaporator steam duct and steam duct
exhaust. The A/B position provides electrical
power to both thermostatically controlled
heaters. The C position provides electrical
power to both thermostatically controlled C
heaters. The OFF position removes electrical
power from all the heaters.

2.9-34

2.9 Environmental Control and Life Support System

USA007587
Rev. A

The SM SYS SUMM 2 display is an SM

display (DISP 79) available in the BFS and in
PASS SM OPS 2
The topping evaporators left and right nozzle
heaters are controlled by the TOPPING
EVAPORATOR
HEATER
L(R)
NOZZLE
switches on panel L1. When the switches are
positioned to A AUTO or B AUTO, electrical
power is provided to the corresponding left and
right nozzle heaters, and the corresponding
nozzle temperature is maintained between 40
and 70 F. The OFF position removes electrical
power from both heater systems.
FREON EVAP OUT TEMP Meter and Switch
on Panel O1
The TOPPING EVAPORATOR HEATER DUCT
rotary switch on panel L1 selects the
thermostatically controlled electrical heaters on
the topping evaporator. Positions A and B
provide electrical power to the corresponding
heaters, while A/B provides electrical power to
both A and B heaters. The C position provides
power to the C heaters and part of the B heaters.
The OFF position removes electrical power from
all the heaters.

FES Water Dumps

The FES topping evaporator can be used to
dump excess water from the supply water
storage tanks, if required, on orbit. When the
RAD CONTROLLER OUT TEMP switch on
panel L1 is placed in HI, the radiator flow
control valve assembly controls that radiator
outlet at 57 F. Since the topping evaporator
controls to 39 F, water is used up at a rate of
about 25 lb/hr, thus dumping excess water.
Ammonia Boilers
The ammonia boiler system acts as a heat sink
by using the low boiling point of ammonia
(NH3) to cool the Freon coolant loops when the
orbiter is below 400,000 feet during entry or on
the ground after landing.
The resultant
superheated vapor is vented overboard. Two
complete, individual ammonia storage and
control systems feed one common boiler
containing ammonia passages and the
individual Freon coolant loops 1 and 2. Each
system consists of a storage tank, an isolation

2.9-35

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
valve, an overboard relief valve, two control
valves, a controller, three temperature sensors, a
pressure sensor and a feedline to the boiler.
The ammonia boiler is a shell-and-tube system
with a single pass of ammonia on the ammonia
side and two passes of each Freon coolant loop
through the boiler. The ammonia flows in the
ammonia tubes and the Freon coolant loop
flows over the tubes, cooling the Freon coolant
loops. When the ammonia flows over the warm
Freon coolant lines in the boiler, it immediately
vaporizes, and the heat and boiler exhaust are
vented overboard in the upper aft fuselage of
the orbiter next to the bottom right side of the
vertical tail.
The ammonia system is used during entry if the
radiators have not been cold-soaked, as would be
the case in the event of an ascent abort. If radiator
coldsoak cooling is used during entry, the
ammonia system is activated post-landing when
radiator outlet temperatures reach 55 F. The
ammonia boiler operations are used post-landing
until a ground-cooling cart is connected to the
ground support equipment (GSE) heat
exchanger.
Storage Tanks
Each ammonia boiler storage tank contains a
total of 49 pounds of ammonia (approximately
30 minutes of cooling under nominal post-landing
conditions), all of which is usable. Each tank is
pressurized with gaseous helium at a maximum
operating pressure of 550 psia. Downstream of
each ammonia storage tank to the common
boiler are three control valves: a normally
closed isolation valve, a normally open
secondary control valve, and a normally open
primary control valve. A relief valve in each
ammonia boiler storage system provides
overpressurization protection of that ammonia
storage tank.
Primary Ammonia Boiler Controller
The primary controller in the ammonia system
controller energizes the ammonia system
isolation valve, permitting ammonia to flow to
two motor-operated controller valves. The
controller also commands the primary motoroperated valve to regulate the flow to the
2. SYSTEMS

ammonia boiler.
Ammonia boiler supply
systems A and B are enabled by the
corresponding NH3 CONTROLLER switches on
panel L1. To prepare for the possibility of low
altitude cooling in the event of an ascent abort, one
of the NH3 CONTROLLER switches (usually B)
is positioned to PRI/GPC before launch, which
enables the GPC to control electrical power to
the primary and secondary controllers within
the ammonia controllers. When the orbiter
descends through 120,000 feet in Major Mode 304
(or upon transition to Major Mode 602 during a
return to launch site (RTLS) abort), the backup
flight system (BFS) computer commands the
selected ammonia system controller on.
Ammonia Boiler Control Sensors
Three temperature sensors associated with
ammonia system A are affixed to Freon coolant
loop 1, and three sensors associated with ammonia
system B are affixed to Freon coolant loop 2. For
each ammonia system, one sensors temperature is
fed to the primary controller logic to help control
ammonia boiler Freon outlet temperatures to 35
3 F if the primary controller is active. Also, for
each ammonia system, a different sensors
temperature helps the secondary controller logic
control ammonia boiler Freon outlet temperature to
34 3 F if the secondary controller is active. The
third sensor feeds temperature data to the
controllers fault detection logic. If an ammonia
boiler controller is operating in the PRI/GPC
configuration and the associated fault detection logic
senses temperatures below 31.25 F for longer than
10 seconds, the fault detection logic
automatically inhibits the primary controller,
which removes power from the associated
ammonia system isolation valve and the
primary control valve. The logic switches to the
secondary controller in the same ammonia
system controller, which energizes a redundant
coil in the ammonia system supply isolation
valve and adjusts the secondary control valve to
achieve appropriate Freon outlet temperatures. It
commands the isolation valve to full open and
allows the secondary controller to control the
secondary control valve to regulate the
ammonia flow to the ammonia boiler. This
automatic switchover is only from the primary to the
secondary controller.

2.9-36

2.9 Environmental Control and Life Support System

USA007587
Rev. A

NH3CONTROLLER Switches on Panel L1

Secondary Controller

Cargo Heat Exchanger

When the NH3 CONTROLLER A or B switch on

panel L1 is positioned to SEC/ON, the A or B
ammonia system controller is electrically
powered and enabled directly (no computer
command is required). The secondary controller in the ammonia system controller energizes
the systems isolation valve open, permitting
ammonia to flow to two motor-operated
controller valves. The secondary controller also
commands its motor-operated control valve to
regulate the ammonia flow to the ammonia
boiler. The three temperature sensors on each
Freon coolant loop operate and control Freon
coolant loop 1 and 2 temperature in the same
manner as in the PRI/GPC mode. Fault detection
logic does not exist in the secondary controller.

The cargo heat exchanger was installed on the

shuttle in anticipation of a certain type of ISS
logistics module that needed active cooling from the
orbiters Freon coolant loops. The proposed logistics
modules were demanifested, but OV-103 and OV105 were already outfitted with the heat exchanger,
cooling lines and accumulator (evacuated), and
associated coolant line heaters. In these vehicles,
switches for the cargo coolant loop heaters are on
panel A14. These switches should always be in the
OFF position and are never expected to be used.

The OFF position of the NH3 CONTROLLER

switches removes all electrical power from the
ammonia system controller, rendering the
ammonia system inoperative.

Supply and Waste Water Systems

The supply water system provides water for
flash evaporator system cooling, crew
consumption, and hygiene. The supply water
system stores water generated by the fuel cells,
and the waste water system stores waste from
the crew cabin humidity separator and from the
flight crew. Four supply water tanks and one
waste water tank are located beneath the crew
compartment middeck floor.

2.9-37

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Data on the supply and waste water system can
be monitored on the ENVIRONMENT display
(DISP 66) under H2O SUPPLY and WASTE items
and on the BFS THERMAL display (H2O SUP P).
Supply Water System
The supply water system consists of four water
tanks that are pressurized with nitrogen from
the pressure control system. Each of the four
supply water tanks has a usable capacity of 165
pounds of water (plus 3.3 pounds residual), is 35.5
inches in length and 15.5 inches in diameter,
and weighs 39.5 pounds dry.

water tank A.
The separator removes 85
percent of the excess hydrogen. The hydrogen
separators consist of a matrix of silver
palladium tubes, which have an affinity for
hydrogen. The hydrogen is dumped overboard
through a vacuum vent. The redundant water
line to the tank B inlet manifold does not pass
through the hydrogen separator. Water passing
through the hydrogen separators can be stored
in all four supply water tanks: A, B, C, and D.
2011/

/066

ENVIRONMENT

CABIN
dP/dT +.01 CABIN P 14.7
PPO2
AIRLK P 14.8
A 3.04 FAN P 5.55
B 3.04 HX OUT T 45L
C 3.04 CABIN T 71
PPC02 1.9
1
2
O2 FLOW
0.0L 0.0L
REG P
100
100
N2 FLOW
0.0L 0.0L
REG P
202
202
O2/N2 CNTL VLV N2
O2
H20 TK N2 P
17
17
N2 QTY
131
131
EMER O2 QTY
1
REG P
4L

The three fuel cells generate a maximum of 25

pounds of supply water per hour (about 0.77
pounds of water per hour per generated kilowatt).
The product water from all three fuel cells flows
to a single water relief control panel. The water
can be directed to potable water tank A or to the
fuel cell water relief nozzle. Normally, the
water is directed to water tank A.

IMU
FAN
HUMID SEP

The product water lines from all three fuel cells

were modified to incorporate a parallel
(redundant) path of product water to supply
water tank B in the event of a blockage of the
primary water path to the tanks. If such a
blockage were to occur, pressure would build
up and relieve fuel cell water through the
redundant paths to the supply water tank B inlet
manifold.

B
*
*

P
4.5

4 000/02:33:38
000/00:00:00
AV BAY
1
2
3
TEMP
90
90
78
FAN P 3.80 3.77 3.92
SUPPLY H20
QTY A 67
PRESS
32
B 18
DMP LN T 77
C 94
NOZ T A 64
D 94
B 64
WASTE H20
QTY 1 15
PRESS
17
DMP LN T 58
NOZ T A 82
B 82
VAC VT NOZ T 224
CO2 CNTLR
1
2
FILTER P
0.00L
PPCO2
- 0.0L
TEMP
32.0L
BED A PRESS
0.0L 0.0L
B PRESS
0.0L 0.0L
P
0.00L 0.00L
VAC PRESS
0.0L
usa007587_093r1.cvx

H2O System Parameters on the

ENVIRONMENT Display (DISP 66)

Instrumentation
Temperature sensors are installed on each of the
redundant paths; in addition, the primary path
pressure sensor is transmitted to telemetry and
can be monitored on the BFS THERMAL
display. A pH sensor is located at the common
product water outlet of the water relief panel. It
provides a redundant measurement of fuel cell
health and water purity. A single measurement
of water purity in each fuel cell is also provided.
If a single fuel cell pH sensor indicated high, the
flight crew would be required to sample the
potable water to verify the proper pH.
Hydrogen Separators
The hydrogen-enriched water from the fuel cells
flows through the single water relief panel
through two hydrogen separators to potable
2. SYSTEMS

BFS THERMAL Display

Microbial Filter
The water entering tank A, which is sterilized
before launch, passes through a microbial filter
that adds approximately one-half parts per
million iodine to the water to prevent microbial
growth. The water stored in tank A is normally

2.9-38

2.9 Environmental Control and Life Support System

USA007587
Rev. A
used for flight crew consumption; tanks B, C,
and D are commonly used for flash evaporator
cooling. The water from the microbial check
valve is also directed to a galley supply valve.
If the water tank A inlet valve is closed, or tank
A is full, water is directed to tank B through a
1.5 psid check valve where it branches off to
tank B. If the tank B inlet valve is closed, or
tank B is full of water, the water is directed
through another 1.5 psid check valve to the
inlets to tanks C and D.
Each supply water tank has an inlet and outlet
valve that can be opened or closed selectively to
use water; however, the tank A outlet valve
normally remains closed to isolate the treated
water from the untreated water in the other tank.

water tanks with nitrogen at 15.5 to 17.0 psig.

Nitrogen supply system 1 is controlled by the
H2O TK N2 REG INLET and H2O TK N2 ISOL
SYS 1 manual valves on panel MO10W.
Nitrogen supply system 2 is controlled by the
SYS 2 manual valves on panel MO10W. The
regulator in each nitrogen supply system
controls the nitrogen pressure to the tanks at
15.5 to 17 psig, and a relief valve in each
nitrogen supply system will relieve into the
crew cabin if the nitrogen supply increases to
18.5 1.5 psig, to protect the tanks from
overpressurization.

Manual Valves on Panel ML26C

Tank Depressurization

Nitrogen Supply System Valves on Panel

MO10W
Tank Pressurization
Each supply water and waste water tank is
pressurized with gaseous nitrogen from the
crew compartment nitrogen supply system.
The nitrogen and water are separated by a
metal bellows. Nitrogen supply systems 1 and
2 can be used individually to pressurize the

All the tanks can be vented to cabin pressure,

but tank A is depressed for ascents, as described
here. For only tank A, inlet nitrogen pressure is
controlled by the SPLY H2O GN2 TK A SPLY
and TK VENT manual valves on panel ML26C.
When the tank A supply valve is closed, the
tank is isolated from the nitrogen supply.
When the tank A vent valve is opened, the tank
is pressurized only by the crew cabin
atmosphere. For launch, the tank A supply
valve is closed, and the tank vent valve is
opened, which lowers tank A pressure by
removing back-pressurization from the nitrogen
supply system. The fuel cell water head pressure
is lower to help prevent flooding of the fuel
cells during ascent. On orbit, the tank A supply
valve is opened, and the tank A vent to the

2.9-39

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
cabin is closed, allowing nitrogen supply
pressure to tank A.
Alternate Water Pressurization
If neither nitrogen supply system 1 nor 2 can be
used to pressurize the water tanks, the H2O
ALTERNATE PRESS switch on panel L1 can be
positioned to OPEN, which would apply the
crew cabin pressure to the water tanks.
Normally, this switch is positioned to CLOSE to
isolate the cabin pressurization system from the
water tank pressurization system.
Supply Water Tank Inlet Valves
Supply water tank A, B, and C valves are
controlled from panel R11L, and tank D valves
are controlled from panel ML31C. When the
SUPPLY H2O TK A INLET, TK B INLET, or TK C
INLET switch on panel R11L is positioned to
OPEN, the inlet valve for the tank permits water
into that tank. A talkback indicator above the
corresponding switch indicates OP when the
corresponding valve is open, barberpole when
the valve is in transit, and CL when that valve is
closed. When the switch is positioned to
CLOSE, the water inlet to that tank is isolated
from the inlet water supply. The SUPPLY H2O
TK D INLET switch and talkback indicator are
located on panel ML31C and operate in the
same manner as the switches and talkbacks for
tanks A, B, and C.

2. SYSTEMS

H2O ALTERNATE PRESS Switch on Panel L1

2.9-40

2.9 Environmental Control and Life Support System

USA007587
Rev. A

TK and OUTLET Switches and Talkbacks on Panel R11L

TK INLET and OUTLET Switches and Talkbacks on Panel ML31C

2.9-41

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Tank Outlet Valves
Positioning the SUPPLY H2O TK A, B, or C
OUTLET switch on panel R11L to OPEN permits
water from the corresponding tank to flow from
the tank into the water outlet manifold due to the
tank nitrogen pressurization system. A talkback
indicator above the switch would indicate OP
when that valve is open, barberpole when it is in
transit, and CL when it is closed. The CLOSE
position of each switch isolates that water tank
from the water outlet manifold. The SUPPLY
H2O TK D OUTLET switch and talkback indicator
are located on panel ML31C and operate in the
same manner as the tank A, B, and C switches
and talkback indicators on panel R11L.
If the supply water tank B outlet valve is opened
(normally tank A is used only for crew
consumption), water from the corresponding
tank is directed to the water outlet manifold.
The tank A and B water is then available to the
extravehicular mobility unit (EMU) fill in the
airlock, to the flash evaporator water supply
system A, and to the water dump line. The tank
A outlet valve is normally closed to prevent
contamination of the water in tank A. Thus,
tank B would supply water to flash evaporator
water supply system A and to the EMU fill in
the airlock. If it is necessary to provide space
for storing water in tank A and/or B, tank A
and/or B water can be dumped overboard.
An external airlock water transfer valve and
line are installed in the orbiters. The valve and
line could provide capability to transfer water
from the orbiter's supply H2O system to the
International Space Station (ISS). However, there
are no current plans to use this water transfer
capability. This configuration is covered in more
detail in the ODS section of this document.
If the tank C or D outlet valve is opened, water
from either tank is directed to the water outlet
manifold. The water is then available to the flash
evaporator B water supply.
Supply Water Crossover Valves
A crossover valve installed in the water outlet
manifold is controlled by the SUPPLY H2O
CROSSOVER VLV switch on panel R11L.
When the switch is positioned to OPEN, the
crossover valve opens and allows tank A or B
2. SYSTEMS

(also C or D) to supply both flash evaporator

water supply systems A and B, the EMU fill in
the airlock, and the water dump line. A talkback
indicator above the switch indicates OP when
the crossover valve is opened, barberpole when
the valve is in transit, and CL when the valve is
closed. The CLOSE position isolates the water
manifold between the tank A and B outlets and
the tank C and D outlets.
Contingency Water Container Fill
Configuration
There is an additional supply H2O tank configuration for ISS to transfer H2O to the ISS via
contingency water container (CWC) bags. In
this configuration, the tank A outlet is OPEN,
the tank B inlet is CLOSED, and the XOVER
valve is closed. The circuit breakers on ML86B
that provide power to the tank B inlet and the
XOVER valves are then pulled to preclude
inadvertent valve opening. This configuration
allows tanks A and B to be used for potable H2O
transfer and tanks C and D to be used for FES
operations. This configuration may remain a
backup option if the supply H2O transfer lines
become operational on the ISS.
Supply Isolation Valve
Water from supply system A is routed directly
to the flash evaporator. Water from system B is
routed to an isolation valve in the system. The
valve is controlled by the SUPPLY H2O B SPLY
ISOL VLV switch on panel R11L. When the
switch is positioned to OPEN, water from
supply system B is directed to the flash evaporator. A talkback above the switch indicates
OP when the valve is opened, barberpole when
it is in transit, and CL when the valve is closed.
The CLOSE position isolates water supply
system B from the flash evaporator.
Supply Water Dumps
Supply water from all the tanks can be dumped
overboard, if necessary, through a dump
isolation valve and a dump valve. Supply water
from tank C or D can also be dumped
overboard, if necessary, through the crossover
valve and through the dump isolation valve
and dump valve.
The overboard dump
isolation valve is located in the crew cabin, and
the dump valve is located in the midfuselage.

2.9-42

2.9 Environmental Control and Life Support System

USA007587
Rev. A
The dump isolation valve is controlled by the
SUPPLY H2O DUMP ISOL VLV switch on
panel R11L. The dump valve is controlled by
the SUPPLY H2O DUMP VLV switch on panel
R11L.
The SUPPLY H2O DUMP VLV ENABLE/NOZ
HTR switch on panel R11L must be positioned
to ON to supply electrical power to the SUPPLY
H2O DUMP VLV switch. The ON position also
applies power to the nozzle heaters, which
warm the nozzles to prevent freezing when the
dump valve is opened. When the DUMP VLV
and DUMP ISOL VLV switches are positioned
to OPEN, the corresponding valve is opened,
which allows supply water to be dumped
overboard. A talkback indicator above each
switch indicates OP when the corresponding
valve is open, barberpole when it is in transit,
and CL when it is closed. Closing either valve
inhibits the dumping of supply water. At the
completion of the dump, each switch is
positioned to CLOSE to close the corresponding
valve. The nozzle heater is then deactivated by
placing the SUPPLY H2O DUMP VLV
ENABLE/NOZ HTR switch to OFF.

SUPPLY H2O CROSSOVER VLV, ISOL VLV,

and DUMP VLV Switches and Talkback on
Panel R11L

H2O LINE HTR Circuit Breakers on Panel ML86B

2.9-43

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Contingency Crosstie
There is a contingency crosstie connection in the
supply water overboard dump line between the
dump isolation valve and dump valve. There is
a corresponding crosstie connection in the
waste water overboard dump line between the
dump isolation valve and dump valve. These
crosstie connections permit joining the waste
water system through a flexible hose to the
supply water system for emergency dumping of
waste water through the supply water dump
nozzle (and vice versa). CWC bags are also
filled through the contingency crosstie for
emergency storage of supply or waste water.
The CWC bags nominally hold 95 pounds of H2O
and are stowed in the middeck for entry.
Supply H2O Dump Line Purge Device

controlled heaters on the waste water line and the

waste collection system vacuum vent line.)
The supply water feed lines to the flash
evaporators are approximately 100 feet long. To
prevent the water in the lines from freezing,
redundant heaters are installed along the length
of the water lines. The heaters are controlled by
the FLASH EVAP FEEDLINE HTR A SUPPLY
and B SUPPLY switches on panel L2. When a
switch is positioned to 1, it enables the
thermostatically controlled heaters on the
corresponding supply line to automatically
control the temperature on that line. When a
switch is positioned to 2, it enables the redundant thermostatically controlled heater system
on the corresponding supply line. The OFF
position of each switch inhibits heater operation
on the corresponding supply line.

Before beginning a supply H2O dump, a purge

device is installed in the supply H2O quick
disconnect of the contingency crosstie. The
purge device allows cabin air at 3 lb/hr to
purge the supply H2O dump valve of any
remaining water droplets to preclude a
condition known as burping of the dump
valve. When the water droplets freeze under
the dump valve, they expand and could cause
the dump valve to open. Purging the valve post
dump alleviates this problem.
Dump Nozzle Heaters
The supply water dump nozzle employs a
heater to prevent freezing of the supply water
dump nozzle at the midfuselage. The dump
nozzle heater is powered when the SUPPLY
H2O DUMP VLV ENABLE/NOZ HTR switch on
panel R11L is positioned to ON. When the
switch is positioned to OFF, it removes electrical
power from the nozzle heater, as well as the
SUPPLY H2O DUMP VLV switch, which causes
the dump valve to close.
The supply water line upstream of the water
dump nozzle has electrical heaters on the line to
prevent supply water from freezing. The A and B
heaters on the line are thermostatically controlled
and are powered by the H2O LINE HTR A and B
circuit breakers on panel ML86B. (These circuit
breakers also provide power to thermostatically

2. SYSTEMS

FLASH EVAP FEEDLINE HTR Switches

on Panel L2
Galley Water Supply
The galley supply valve in the supply water line
from the microbial filter of tank A permits or
isolates the supply water from the galley or
water dispenser. When the SUPPLY H2O
GALLEY SUP VLV switch on panel R11L is
positioned to OPEN, supply water is routed
through parallel paths: one path flows through
the atmospheric revitalization system water
coolant loop water chiller for cooling of the
supply water, and the other path bypasses the

2.9-44

2.9 Environmental Control and Life Support System

USA007587
Rev. A
water chiller with ambient temperature water.
A talkback indicator above the switch indicates
OP when the valve is open, barberpole when
the valve is in transit, and CL when the valve is
closed. The CLOSE position of the switch
isolates the potable supply water from the
middeck ECLSS supply water panel.

Waste water is directed to the waste water tank

1 inlet valve, which is controlled by the WASTE
H2O TANK 1 VLV switch on panel ML31C.
When the switch is positioned to OPEN, waste
water is directed to the waste water tank. A
talkback indicator above the switch indicates
OP when the valve is open, barberpole when
the valve is in transit, and CL when the valve is
closed. Positioning the switch to CLOSE closes
the waste water tank inlet, isolating the waste
water tank from the waste water collection
system. When the valve is open, waste water
from the tank can also be directed to the waste
water dump line for overboard dumping. The
waste water tank 1 outlet valve (or drain valve)
operates the same as the inlet valve. It is
controlled by the WASTE H2O TK 1 DRAIN
VLV switch on panel ML31C. The addition of
the condensate quick disconnect (QD) required
the humidity separator common outlet to be
plumbed to the waste tank via the drain line.
When the waste water outlet valve is OPEN,
humidity waste will flow into the waste tank.
During condensate collection, the outlet valve
will be closed and humidity waste water will
flow into a connected CWC bag to be disposed
of later. This valve is also opened for ground
draining of the tank.
Waste Water Dumps

GALLEY Water Supply Switch and Talkback

on Panel R11L
If the galley is not available or manifested for a
flight, the chilled water and ambient water are
connected to an Apollo water dispenser to
dispense ambient and chilled water for drinking
and food reconstitution.
Waste Water System
A single waste water tank receives waste water
from the humidity separator and the waste
management system.
The tank is located
beneath the crew compartment middeck floor
next to the supply water tanks.
The waste water tank holds 165 pounds of
expellable water (plus 3.3 pounds residual), is 35.5
inches long and 15.5 inches in diameter, and
weighs 39.5 pounds dry. It is pressurized by
gaseous nitrogen from the same source as the
supply water tanks.

The waste water dump isolation valve and waste

water dump valve in the waste water dump line
allow waste water to be dumped overboard
through the waste water dump nozzle. The
WASTE H2O DUMP ISOL VLV switch on panel
ML31C positioned to OPEN allows waste water
to be directed to the waste water dump valve. A
talkback indicator above the switch indicates OP
when the valve is open, barberpole when the
valve is in transit, and CL when the valve is
closed.
For waste water to be dumped overboard, the
waste water dump valve must be opened. It is
controlled by the WASTE H2O DUMP VLV
ENABLE/NOZ HTR and WASTE H2O DUMP
VLV switches on panel ML31C. When the
WASTE H2O DUMP VLV ENABLE/NOZ HTR
switch is positioned to ON, electrical power is
supplied to the waste water dump nozzle
heaters and the WASTE H2O DUMP VLV
switch. The heaters at the waste water dump nozzle

2.9-45

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
prevent waste water from freezing at the overboard
dump nozzle.
When the WASTE H2O DUMP VLV switch is
positioned to OPEN, the dump valve allows
waste water to be dumped overboard. A
talkback indicator above the switch indicates
OP when the valve is open, barberpole when
the valve is in transit, and CL when the valve is
closed. If waste water is dumped overboard,
the DUMP ISOL VLV switch is positioned to CL
upon completion of the dump. The WASTE
H2O DUMP VLV is positioned to CLOSE, and
the WASTE H2O DUMP VLV ENABLE/NOZ
HTR switch is set to OFF.
CAUTION
If the DUMP VLV ENABLE/NOZ HTR
switch is positioned to OFF before the
DUMP VLV switch is positioned to CLOSE,
the dump valve will remain open and the
heaters protecting the dump nozzle from
freezing will be deactivated.

The waste water dump line, upstream of the

waste dump nozzle, has electrical heaters on the
line to prevent waste water from freezing. The
thermostatically controlled A and B heaters are
powered by the H2O LINE HTR A and B circuit
breakers on ML86B. (These circuit breakers also
provide power to thermostatically controlled
heaters on the supply water line and waste
collection system vacuum vent line.)
Contingency Crosstie
The contingency crosstie quick disconnect in the
waste water overboard dump line between the
dump isolation valve and dump valve permits
waste water to be joined with the supply water
system through a flexible hose for emergency
dumping of supply water through the waste
water dump or using waste water for the flash
evaporators.
Waste Water Tank Draining
The waste water tank 1 drain valve controls the
draining of the waste water tank during ground

WASTE H2O System Switches and Talkbacks on Panel ML31C

2. SYSTEMS

2.9-46

2.9 Environmental Control and Life Support System

USA007587
Rev. A
operations through the ground support
equipment flush and drain. When the WASTE
H2O TK 1 DRAIN VLV switch on panel ML31C
is positioned to OPEN, the valve permits the
draining and flushing of the waste water tank.
The drain line is capped during flight. A
talkback indicator above the switch indicates
OP when the valve is open, barberpole when
the valve is in transit, and CL when the valve is
closed.

Operations
Pressure Control System
For ascent, both 14.7 psia cabin regulator inlet
valves are closed to isolate the 14.7 psia cabin
regulators.
If a cabin leak develops, this
configuration conserves nitrogen by not
allowing any makeup flow into the cabin until
the cabin pressure drops below 8 psia. The O2
regulator inlet valves are closed, directing all
the O2 to the O2 crossover manifold to supply
the launch and entry suit helmets. The O2/N2
control valve on pressure control system 1 is
open to allow N2 to pressurize the O2/N2
manifold. The O2/N2 control valve on pressure
control system 2 is closed. This would normally
allow oxygen to flow to the O2/N2 manifold,
but since the oxygen regulators are closed,
nothing is configured to flow through the
emergency 8 psia regulators on pressure control
system 2. The crew will close the visors of their
launch and entry suit helmets shortly before liftoff and breathe 100 percent O2 until shortly after
solid rocket booster separation.
The pressure control system remains in the
ascent configuration until early in the flight
plan when the orbit pressure control system
configuration is performed.
The pressure
control system configuration to system 1
typically is called for in the flight day 1 EZ
activities block. The 14.7 psia cabin regulator
inlet valve on the selected pressure control
system is opened. This enables the cabin
regulator to automatically maintain the cabin
pressure at 14.7 psia. The O2 regulator inlet
valve is opened, and the selected system O2/N2
control valve is taken to AUTO. This enables
the O2/N2 controller to control whether O2 or N2
flows into the O2/N2 manifold based on cabin
PPO2 level. During late Flight Day 1 timeline

activities, the O2 bleed orifice is installed in

launch and entry helmet QD-8. The O2 bleed
orifice is sized based on number of crew and
compensates for the crews metabolic O2 usage
by flowing O2 directly into the cabin. This helps
keep the PPO2 level stable when the cabin
pressure is greater than 14.7 psia and the cabin
regulators are not flowing. It also minimizes
automatic switchovers of the O2/N2 controller and,
in doing so, lessens the chances for annunciating an
O2 or N2 high flow alarm. A reconfiguration to
pressure control system 2 may be performed
halfway through the mission or post-undocking
on flights to the ISS.
A 10.2 psia cabin protocol was developed by the
flight surgeons to minimize the risk of decompression sickness (bends) for crewmembers
preparing for an EVA. The EVA crewmembers
must prebreathe pure O2 before they go EVA to
help flush N2 out of their body tissue. The
following 10.2 cabin protocol options have
been developed:
Option 1
60-minute initial prebreathe on
launch and entry suit helmet
12 hours at 10.2 psia cabin pressure
75-minute final prebreathe in suit
Option 2
60-minute initial prebreathe on
launch and entry suit helmet
24 hours at 10.2 psia cabin pressure
40-minute final prebreathe in suit
Option 3
4-hour prebreathe in suit
For scheduled EVAs, option 1 or 2 is chosen to
minimize the in-suit prebreathe just prior to the
EVA. The cabin is depressurized to 10.2 psia
using the airlock depressurization valve located
in the airlock. Because there is no 10.2 psia
cabin regulator, the cabin pressure and the
PPO2 levels must be manually managed during
10.2 psia cabin operations.

2.9-47

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A
operating cabin fan(s) should be turned off for
removal and installation of LiOH and charcoal
canisters.

NOTE
If a 10.2 depress is scheduled early in the
mission, the PCS 1 configuration may be
delayed until 10.2 operations are no
longer required. This saves consumables
during consumable-critical missions, such
as ISS docking missions, where orbiter O2
and N2 are used to repress and resupply
the ISS.
The pressure control system configuration is the
same for entry as it was for ascent.
Atmospheric Revitalization System
The atmospheric revitalization system is
already configured for ascent at crew ingress.
One cabin fan, one humidity separator, one
IMU fan, and one fan in each avionics bay are
already operating.
The cabin temperature
control valve is positioned in the FULL COOL
position by powering the controller and
adjusting the rotary switch to the COOL
position. Once the FULL COOL position is
reached, cabin temperature controller 1 is
unpowered. The humidity separators and the
IMU fan signal conditioners are unpowered to
protect against an AC to AC bus short, which
could cause loss of a main engine controller.
(The wire bundle that carries power to these
signal
conditioners
had
a
short
on
STS-6.) Water loop 2 is on, and water loop 1 is
off during ascent. Both water bypass valves are
positioned to flow approximately 950 lb/hr
through the Freon/water interchanger.
If no failures occur during ascent, no actions are
required to manage the atmospheric revitalization system in OVs 103 and 104 (OV-105 if
flown without the RCRS), with the exception of
scheduled LiOH canister changeouts. During
the post insertion period for RCRS configured
vehicles, the crew will activate the system.
Every 13 minutes, the RCRS will automatically
switch chemical beds between regeneration and
adsorption as part of a 26-minute full
regeneration cycle with no further crew actions
for nominal operations. Mid-mission (on 10+
day flights), the activated charcoal canister will
be changed out. Additionally, during deorbit prep
for RCRS configured vehicles, the crew will replace the
LiOH canister, and deactivate the RCRS. The
2. SYSTEMS

The orbit fan and pump configuration is the

same on orbit as for ascent, except water loop 1
is set to the GPC position and the BYPASS
controller for water loop 2 is set to the AUTO
position. While in SM OPS 2, the GPC position
enables the inactive water loop to be cycled on
periodically. This periodic cycling prevents the
inactive water loop from freezing. The cycling
sequence is initiated any time an OPS transition
is made into SM OPS 2. When an OPS
transition is made, the pump will receive a 6minute ON command, then remain off for 4
hours. The pump will nominally cycle on for 6
minutes every 4 hours.
The pump on water loop 2 is powered by AC3
when its switch is in the ON position. The GPC
position of the WATER PUMP LOOP 2 switch
provides an alternate power source for the
pump during ascent and entry. When the BFS
computer has control of the payload MDMs, the
GPC position powers the loop 2 pump with
AC1 power. Since water loop 2 has only one
pump, this enables the pump to remain
powered even if AC3 should fail. However, the
circuit breakers that provide AC1 power to the
GPC position of H2O loop 2 and the A pump of
H2O loop 1 are nominally pulled for the entire
mission. This is because of the possibility of an
AC1-to-AC3 short as a result of a relay failure
or switch failure. If power is required for the
pump to operate, these circuit breakers will
need to be pushed in. The GPC position of the
WATER LOOP 1 PUMP switch has no special
function during ascent and entry; it acts just like
the OFF position.
If the situation arises where no PASS SM or BFS
computers are available, the water loop pumps
can still be commanded on in the GPC position
using real-time commands.
The real-time
commands can be issued by a ground uplink or
crew inputs on DPS UTILITY SPEC 1. The realtime commands must be issued through the
computer that has control of the payload
MDMs. It would take a severe loss of system
redundancy for the use of real-time commands
to ever be required.

2.9-48

2.9 Environmental Control and Life Support System

USA007587
Rev. A
Cooling Management
Depending on the mission phase, the Freon
cooling loops are cooled four different ways.
Prior to launch, cooling is provided by the
ground support equipment. After lift-off, there
is no active means of cooling until about the time
of solid rocket booster separation. It takes the
orbiter slightly more than 2 minutes to reach an
altitude where water evaporation provides
effective cooling. Until that time, sufficient
thermal inertia is in the Freon loops to limit
the temperature increase so that no active heat
rejection is required.
At solid rocket booster separation, the flash
evaporator system receives a GPC ON
command from the BFS and begins providing
active cooling. The FES continues to be the
primary cooling source through the ascent
phase and on into the post insertion timeframe.
During the Post Insertion checklist procedures,
flow is initiated through the radiators, the
payload bay doors are opened, and the
radiators become the primary source of cooling.
The topping FES may be left on to provide
supplemental cooling when necessary. If the
orbiter is in a warm attitude, the radiator panels
may not be effective enough to provide the
desired cooling. The FES can provide the
additional cooling necessary to achieve the
desired Freon loop temperatures.
During the deorbit prep procedures, the radiators
are cold soaked for use later during entry. The
radiator coldsoak process stores cool Freon in the
radiator panels.
This is accomplished by
changing the radiator control temperature set
point from NORM to HI (38 to 57 F). The FES is
reactivated to cool the Freon loops from 57 to
39 F. Since less cool Freon from the radiator
panels is required to achieve the 57 F RAD OUT
temperature, the Freon stays in the radiator
panels longer and becomes even cooler. After
being in this configuration for a little over an

hour, the radiators are bypassed, and the FES

begins providing all the cooling. The FES
provides the cooling during the rest of the
deorbit, through entry interface, and on down to
about V = 12k (approximately 175,000 ft). Below
100,000 ft, the atmospheric pressure is too high for
the FES to cool effectively. At V = 12k, the
radiator controllers are activated and put through
their auto startup sequence, and radiator flow is
reinitiated to utilize the stored Freon coldsoak.
Normally, the radiator coldsoak is used as the
primary source of vehicle cooling from this point
through rollout.
Once the radiator coldsoak is depleted, the
ammonia boilers are used as the primary
cooling source until the ground support
equipment cooling cart hookup is complete.
Then the ammonia cooling is deactivated, and
ground support equipment cooling is initiated.
For ascent aborts, the thermal management of
the Freon cooling is somewhat different. The
FES still provides the cooling after solid rocket
booster separation. The cooling management
during the entry portion changes. The ammonia
boilers provide the cooling during the lower
stages of the abort entry. The ammonia is used
for cooling during the entry phase of an ascent
abort because the orbiter lifts off without a
radiator coldsoak, and the FES functions
normally only at low atmospheric pressure
(above 100,000 ft).
For a transoceanic abort landing (TAL) or an
abort once around (AOA), the ammonia boiler
receives a GPC ON command from the BFS at
MM 304 and 120,000 ft. For a return to launch
site abort, the ammonia boiler receives a GPC
ON command from the BFS at external tank
separation (MM 602). The ammonia boiler will
provide the cooling from this point through
landing. The ammonia boilers can provide
cooling for approximately 30 to 40 minutes under
ascent abort conditions.

2.9-49

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

ECLSS Caution and Warning Summary

The yellow H2O LOOP C/W light will illuminate if the outlet pressure of water coolant
loop pump 1 is less than 19.5 psia or greater
than 79.5 psia, or if pump 2 pressure is less
than 45 psia or greater than 81 psia.

The red CABIN ATM caution and warning

light on panel F7 is illuminated for any of the
following monitored parameters: (1) cabin
pressure below 13.76 psia (13.74 psia for
OV-104) or above, 15.36 psia for OV-103,
15.53 psia for OV-104, and 15.35 for OV-105,
(2) PPO2 below 2.7 psia or above 3.6 psia,
(3) oxygen flow rate above 4.9 pounds per
hour, and (4) nitrogen flow rate above 4.9
pounds per hour.

The yellow FREON LOOP light will illuminate if Freon flow in either coolant loop is
less than 1186 lbm/hr, or if either loops Evap
Out Temperature is less than 32.2 F or
greater than 64.8 F (upper limit for ascent is
115 F.)

The yellow AV BAY/CABIN AIR C/W light

will illuminate for the following conditions:
any avionics bay temperature higher than
130 F, the heat exchanger out temperature
higher than 145 F, or cabin fan delta P below
4.16 inches of water or greater than 6.8
inches.

O2 PRESS

H2 PRESS

FUEL CELL
REA C

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

(R)

CABI N ATM
(R )

FREON
LOOP

O2 HEATER
TEMP

MAI N BUS
UNDE RVOLT

AC
VOL TAGE

AC
OVER LOA D

AV BAY/
CABI N AI R

I MU

FWD RCS

RCS JET

(R)

H2 O LOOP

RGA/ ACCEL

AI R DATA

LEFT RC S

RI GHT RCS

LEFT R HC

RI GHT/ AF T
RH C

LEFT OMS

RI GHT OMS

GP C

FC S (R)
SATURATI ON

OMS KI T

PRI MARY C/ W

FC S
CHANNEL

MPS

APU
OVERSPE ED

APU
UNDERSP EED

(R)
(R )

PAYLOAD
WARN I NG

(R )

PAYLOAD
CAUTI ON
BACKUP C/ W
ALAR M (R)

APU
TEMP

(R)
(R)

OMS TVC

(R)

(R)

HYD PRESS

ECLSS Caution and Warning Lights on Panel F7

2. SYSTEMS

2.9-50

2.9 Environmental Control and Life Support System

USA007587
Rev. A

ECLSS Summary Data

The functions of the ECLSS are to maintain
the orbiters thermal stability, provide a pressurized, habitable environment for the crew
and onboard avionics, and store water and
liquid waste.
The four components of the ECLSS are the
pressure control, atmospheric revitalization,
active thermal control, and supply and waste
water systems.
The pressure control system pressurizes the
crew cabin at 14.7 psia, pressurizes the supply and waste water tanks, and provides
breathing oxygen directly to the launch and
entry suit helmets, and emergency breathing
masks.
The main components of the pressure control
system are oxygen and nitrogen systems,
tanks, and valves.
The atmospheric revitalization system circulates air through the crew compartment to
control relative humidity between 30 and 65
percent, maintain carbon dioxide and carbon
monoxide at non-toxic levels, air filtration,
control temperature and ventilation in the
crew compartment, and provide avionics
cooling. The water loop provides cooling for
the crew and avionics.
The atmospheric revitalization system consists of cabin air loops, water coolant loops,
fans, and heat exchangers and interchangers.

The active thermal control system provides

orbiter heat rejection during all phases of the
mission.
The active thermal control system consists of
two complete, identical Freon coolant loop
systems, cold plate networks for cooling avionics units, liquid/liquid heat exchangers,
and radiators, flash evaporators, and ammonia boilers.
The supply water system stores water
generated by the fuel cells. The supply water
is used for flash evaporator system cooling,
crew consumption, and hygiene.
The waste water system stores waste from
the crew cabin humidity separator and from
the crew.
Four supply water tanks and one waste
water tank are located beneath the crew
compartment middeck floor.
Panels that control the major portion of
ECLSS functions are panels L1, L2, MO10W,
and R11L. Panels ML31C, ML86B, MA73C,
R13L, MO51F, and MD44F also control
ECLSS functions.
ECLSS status can be monitored on panel O1
and on the following DPS displays: ENVIRONMENT (DISP 66), SM SYS SUMM 1, SM
SYS SUMM 2, APU/ENVIRON THERM
(DISP 88), and BFS THERMAL.

2.9-51

2. SYSTEMS

2.9 Environmental Control and Life Support System

Supply Water Storage System

USA007587
Rev. A

2. SYSTEMS

2.9-52

2.9 Environmental Control and Life Support System

Freon Loops

USA007587
Rev. A

2.9-53

2. SYSTEMS

2.9 Environmental Control and Life Support System

Water Loops

USA007587
Rev. A

2. SYSTEMS

2.9-54

2.9 Environmental Control and Life Support System

Pressure Control System (Orbit)

USA007587
Rev. A

2.9-55

2. SYSTEMS

2.9 Environmental Control and Life Support System

Panel L1

USA007587
Rev. A

2. SYSTEMS

2.9-56

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Panel L2

2.9-57

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Panel MO10W

2. SYSTEMS

2.9-58

2.9 Environmental Control and Life Support System

USA007587
Rev. A

Panel R11L

2.9-59

2. SYSTEMS

2.9 Environmental Control and Life Support System

Panel O1

USA007587
Rev. A

2. SYSTEMS

2.9-60

2.9 Environmental Control and Life Support System

USA007587
Rev. A
2011/
/088 APU/ENVIRON THERM
4 000/02:36:51
FREON LOOP
1
2
000/00:00:00
ACCUM QTY
27
27
H2O LOOP
1
2
FREON ISOL
RAD ISOL PUMP OUT P
24
62
FREON FLOW 2193 2190
OUT T
64
63
PL HX FLOW
290
286
P
0L
38
AFT CP FLOW 279
278 ICH FLOW
14L 777
RAD IN T
97
96
OUT T
41
38
RAD OUT T
38
38 CAB HX IN T
42
38
EVAP OUT T
38
38 ACCUM QTY
45
55
EVAP TEMP
APU FUEL T 1
2
3
HILD IB/OB
259 259
TK SURF
+ 69 + 67 + 68
NOZ
312
TK HTR
+ 70 + 68 + 69
TOP FWD/AFT 257 257
TEST LN 1 + 62 + 62 + 63
L/R DUCT 162 162
TEST LN 2 + 62 + 63 + 63
L/R NOZ
50
50
FEED LN
+ 57 + 58 + 58
EVAP FDLN T
A
B
PUMP IN
+ 57 + 58 + 58
FWD 80
80
DRN LN 1 + 62 + 62 + 63
MID 1 80
80
DRN LN 2 + 62 + 62 + 63
MID 2 79
75
OUT
+ 92 + 90 + 88
AFT 75
79
BYP LN
+108 +106 +102
TOPPING 75
79
GG SPLY LN 113
111
107
ACCUM 75
79
HI LOAD 75
79
H2O LN INJ+ 71
92 + 72
usa007587_078r2.cvx

ENVIRONMENT (DISP 66)

APU/ENVIRON THERM (DISP 88)

PASS SM SYS SUMM 1

BFS THERMAL
0001/

/078

SM SYS SUMM 1

SMOKE
1/A
2/B
CABIN
- 0.9
L/R FD - 0.4
0.2
AV BAY 1 - 1.2 - 0.0
2 - 0.6 - 0.3
3 - 0.1 - 0.9
CABIN
PRESS
14.7
dP/dT
+.00
BU/EQ -.00 +.00
PPO2
3.02 3.02
FAN DP
5.79
HX OUT T
49
O2 FLOW
0.0 0.0
N2 FLOW
0.0 0.0
IMU FAN DP
4.62
DV FC1 FC2 FC3
SS1 15
18
18
SS2 16
20
11
SS3 22
26
26
TOTAL AMPS 510
KW
15

PASS SM SYS SUMM 2

DC VOLTS
FC
MAIN
ESS
CNTL

5 000/03:13:09
BFS 000/00:00:00
1/A
2/B
3/C
31.1 31.1 31.1
31.0 31.1 31.0
29.8 29.8 29.8
A
B
C
A
1 29.3 29.3 29.3
2 29.3 * 00.0 29.3
3 29.3 29.3 29.3

AC
VOLT A
117
B
117
C
117
AMPS A
4.4
B
3.9
C
2.4
FUEL CELL PH
AMPS
172
REAC VLV
OP
STACK T +204
EXIT T 150
COOL P
61
PUMP

117
117
117
4.1
4.2
3.2

117
117
117
2.7
3.2
4.8
PH
167
178
OP
OP
+203 +203
150
151
61
61
P

usa007587_085r4.cvx

BFS SM SYS SUMM 1

2.9-61

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

BFS SM SYS SUMM 2

2. SYSTEMS

2.9-62

2.9 Environmental Control and Life Support System

USA007587
Rev. A

ECLSS Rules of Thumb

NOTE
Numbers presented here are for
typical orbit power and heat loads
and may vary significantly,
depending on attitude and power
loading.
Supply water tanks fill at about 6.5 percent
per hour, depending on fuel cell load (14 kW
typical orbit power load * 0.77 lbm/hr/kW 1.65
lbm per %).
Waste water tank fills at about 4.4 percent per
day per crewmember (urine and condensed
humidity). Relative contributions from urine and
condensate are about equal.
Assuming no concurrent fuel cell water
replenishment, supply water tanks empty at
about 90 percent per hour for a water dump
(or, about 40 seconds per percent to dump);
about 40 percent per hour when using full-up
FES (high load and topping evaporator) for
cooling with payload bay doors closed, and
about 15 percent per hour when using the
FES topping evaporator for supply water
dumps on orbit with the doors open.
Waste water tank empties at about 2 percent per
minute.
On-orbit cold soak is good for about 15
minutes of cooling.
Prelaunch Freon
conditioning is good for 2 to 3 minutes of
cooling.
Each ammonia boiler supply is good for about
25 to 35 minutes of ground cooling.
A single LiOH canister is usable for about 48
man-hours.
Typical nitrogen usage rate is about 6 lbm per
day (assuming 7 crewmembers, at 14.7 psia).
All of the ECLSS parameters visible on the panel
O1 meters come from the same sensor that can be
read on the display. They are not redundant and
the meter/display pair cannot be used as
confirming cues for a reading.

2.9-63

2. SYSTEMS

2.9 Environmental Control and Life Support System

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS

2.9-64

2.9 Environmental Control and Life Support System

USA007587
Rev. A

2.10

probably not survive a water ditching; therefore,

bailout is the primary escape mode over water.

ESCAPE SYSTEMS

CONTENTS
Description............................................. 2.10-1
Launch Pad Egress Systems ................ 2.10-1
Advanced Crew Escape Suit ............... 2.10-4
Parachute Harness and Parachute...... 2.10-6
Cabin Vent and Side Hatch Jettison ... 2.10-12
Egress Pole System................................ 2.10-13
Emergency Egress Slide ....................... 2.10-13
Overhead Escape Panel ........................ 2.10-18
Procedures for Bailout, Water Survival,
and Rescue................................... 2.10-18
Vehicle Loss of Control/Breakup ....... 2.10-21
Escape Systems Summary Data .......... 2.10-22

Description
Escape systems refer to equipment and systems
intended to facilitate emergency and contingency egress of the flight crew. Escape systems
include equipment worn by the crewmembers,
hardware built into the orbiter, and external
systems located on the launch pad. Types of
escape or emergency egress from the orbiter
depend upon the mission phase (basically
prelaunch, in-flight, and post-landing). The
prelaunch phase implies the crew must perform
an emergency egress while the orbiter is still
positioned on the launch pad.
The in-flight phase requires that the crew can
safely bail out of the orbiter during controlled
gliding flight at altitudes of 30,000 feet and
below. A special in-flight crew escape system is
devised for this phase. It includes pressure
suits, oxygen bottles, parachutes, life rafts,
pyrotechnics to vent the cabin and jettison the
orbiter side hatch, and an escape pole to allow
the crewmembers to clear the vehicle. The most
likely uses of the system would be during a
return-to-launch-site (RTLS) abort, transatlantic
abort landing (TAL), or abort once-around
(AOA) when the orbiter has insufficient energy
to achieve a runway landing or after an
emergency deorbit made regardless of landing
site opportunities.
During the post-landing phase, the crew exits the
orbiter following an emergency landing or
landing at a contingency site. The orbiter will

The orbiter-based hardware associated with the

in-flight crew escape system was installed after
the Challenger accident. Some orbiter modifications were required for the inclusion of the inflight escape system. The side hatch water
coolant lines for side hatch thermal
conditioning were modified to accommodate
the installation of the pyrotechnic separation
system. The flight crewmembers' seats were
also modified to accommodate the crew's
altitude protection system suit. In addition, a
handhold was added in the middeck next to the
side hatch to permit the crewmembers to
position themselves through the side hatch
opening for bailout. The interdeck access ladder
was widened, and a handhold was added to the
commander's seat to allow easier movement
through the interdeck access.
Software adjustments were also required to
accommodate the in-flight escape system. Software changes applied to the primary avionics
software system for OPS 3 and 6. The changes
enable an automatic flight control mode of the
orbiter with input by crewmembers by using
the ATO abort position on the abort rotary
switch in MM 603/305. The automatic mode
stabilizes the orbiter by controlling the velocity
and angle of attack to the desired bailout
conditions, thus allowing the commander to
escape.

Launch Pad Egress Systems

In the event of a potential catastrophe on the
launch pad, escape by the flight crew is
facilitated by descending to a safe area via
slidewire baskets.
The emergency egress/
escape system uses seven separate slidewires
and seven multi-person basket assemblies to
effect rapid escape of personnel from the
195-foot level of the fixed service structure to a
landing zone.
The landing zone is
approximately 1,200 feet west of the fixed
service structure. The flight crew leaves the
slidewire baskets and proceeds to the bunker,
which is provided with breathing air, first aid
supplies, and communications equipment. The
flight crew will only leave the bunker upon
instructions by the NASA Test Director.

2.10-1

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A
Slidewire
anchor poles
Arresting nets
Elevators

Underground
bunker

Fixed service structure

18 In

65 Ft

Embarkation area
(catwalks)

Deceleration
chain system

M113 parking
area
Landing
zone
area

Orbiter

Orbiter
ac ce ss
arm

Slidewires

17 ft 6 in

20 Ft spacing
(Typical)

1000ft
40 f t

1152ft
16 Ft

416.cvs

Launch Pad Emergency Egress System

An M-113 is positioned near the slidewire
termination area. The M-113 is a military
armored personnel carrier designed to provide
protected evacuation from the launch pad area.
There are four modes of escape from the launch
pad area, varying in degrees of egress aid to the
crew by the closeout crew or pad fire/rescue
crew. In the case of an aided escape, support
crews are responsible for opening the side hatch
using an emergency hatch opening tool.
The launch pad structure also includes an
escape temperature and hydrogen fire-hazard
monitoring system, consisting of 10 temperature
sensors and 14 ultraviolet (UV) hydrogen fire
detectors. Nine UV fire detectors are located in
the area of the white room, the orbiter access
arm, and the fixed service structure both above
and below the fire barrier. Five UV fire
detectors are also spaced vertically down the
fixed service structure from the 175-foot level to
the 95-foot level to view a profile of the orbiter.

2. SYSTEMS
2.10 Escape Systems

The 10 temperature sensors are located along

the egress path, from the white room to the
slidewire basket embarkation area. The sensors
are placed both above and below the fire
barrier. The signals from these sensors are
displayed on firing room console C-7 in the
launch control center.
The Firex spray system provides a water
shower to the orbiter access arm and the fixed
service structure in the event of a fire. There are
20 water spray nozzles located on the orbiter
access arm, approximately 4 feet above the
walkway, and 20 on the fixed service structure,
7 to 10 feet overhead. Each nozzle emits 287
gallons of water per minute. Two control
modes, local and remote, operate the Firex
spray system. The local mode consists of two
pairs of activation paddles located outside the
white room on the orbiter access arm and on the
east side of the elevators directly facing the
orbiter access arm. The remote mode is a hardwire backup control panel located in the launch
control center.

2.10-2

USA007587
Rev. A
FLAME DETECTION (EEFDS)

Fixed service
structure

EL 220

Orbiter
access arm

Slidewires
EL 200
7

LC-39 Pad B
EEFDS Flame detector locations
FSS levels 100 Ft THR 180 Ft

EL 180
11

FD

12

FD

13

FD

EL 160

EL 140

EL 120

EL 100

14

FD

EL 80

Mobile Launch Platform

usa007587_417r2.cvx

Water
spray
nozzles
287 GPM

Slidewire
20 nozzles

System
disabled
Emergency egress
spray station

OAA

(Paddles)

Red fire
hose

System
enabled
(Paddles)

Control modes:
1. Local - Paddle switches
2. Remote - LPS/FHCP
usa007587_418r1.cvx

Emergency Egress Water Spray Control Panels

2.10-3

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Advanced Crew Escape Suit

The advanced crew escape suit (ACES) is
designed to provide protection to each
crewmember for the following off-nominal
conditions:
Loss of cabin pressure
Environmental extremes
Effects of prolonged zero gravity
Contaminated atmosphere
The ACES has an inner pressure bladder that
encompasses the crewmembers body and an
outer covering. The outer covering is an orange
Nomex material that is heat/flame resistant and
provides a highly visible target for search and
rescue (SAR).
The pressure bladder is
constructed of Gore-Tex that wicks body
moisture and vapor away from the
crewmember when unpressurized, yet holds
pressure when inflated. The ACES is designed
to provide pressure protection indefinitely for
total loss of cabin pressure or above 100,000
feet.
The ACES is a full-pressure suit that applies
static pressure evenly to the entire body surface.
Suit pressure is automatically maintained by a
dual suit controller and, at full inflation,
provides an absolute pressure of 3.67 psia. Suit
pressurization begins when the cabin pressure
altitude rises to around 35,000 feet and is hard
pressed (3.67 psia) above 60,000 feet. Ground
testing of the dual suit controller is through the
Dial-to-Test and Press-to-Test manual
controls.
For either manual or automatic
pressurizations, several ACES components
must be properly attached.
Detachable gloves are required for the ACES
suit to properly provide pressure protection.
The gloves attach to the sleeves via metalmating rings. The rings provide an airtight seal
and allow the gloves to swivel for improved
mobility. Similarly, a mating-metal ring is
provided for the helmet.
The ACES helmet provides a pressurized
breathing volume and head protection to the
crewmember. A clear, rotating pressure visor is

2. SYSTEMS
2.10 Escape Systems

used to seal the helmet cavity for the

crewmembers face. Also, an independently
mounted sunshade can be rotated as required.
Another component is the antisuffocation valve
located at the lower right rear of the helmet. If
the oxygen supply is lost, inhalation by the
crewmember will open the valve, allowing
ambient air into the helmet. The helmet also
provides an interface for communications
between the communications carrier assembly
(CCA) and the orbiter.
The CCA, or comm cap, contains all necessary
equipment for crewmember voice communication. The comm cap contains dual/redundant
microphones and dual/redundant earphones.
All comm hardware is connected with comm
cables and pass throughs. The ACES also has a
pass through for several other reasons.
A bioinstrumentation pass-thru (BIP) is located
on the upper right leg allowing medical lines
and/or water cooling lines to pass into the suit
for the crewmember. Crewmembers require
cooling for personal comfort while wearing the
ACES and receive it from an external source.
WARNING
For the ACES to pressurize, gloves must be
worn, helmet pressure visor must be
down/locked, and BIP plug must be seated
properly.
Each crewmember relies on a closed water loop
system to provide personal cooling. Water is
cooled in the core of the individual cooling unit
(ICU), mounted on crewmembers seats, using a
thermoelectric principle. From the ICU, the
water is pumped through water lines into the
ACES via the BIP. The cooled water then
circulates throughout tubes sewn into a liquidcooled garment (LCG), worn under the ACES.
The water returns back through the BIP to the
ICU, where it begins the cycle again. Another
item crewmembers wear under the ACES is the
anti-g suit.
Each crewmember is issued an anti-g suit to be
worn during shuttle reentry and landing. The
anti-g suit, or g-suit, is designed to counteract
the effects of orthostatic intolerance due to body
fluid loss by applying mechanical pressure to
the lower abdomen and legs.

2.10-4

USA007587
Rev. A

Advanced Crew Escape Suit (ACES)

d.

Inflation of the g-suit is controlled at the O2

manifold/g-suit controller (one piece),
located on the upper left leg. This assembly
consists of the following components,
referenced to the illustration on the next page:
a.

A male O2 hose fitting that connects

to the orbiter O2 supply hose. It is
provided with a breakaway fitting
to facilitate rapid egress from the
vehicle.

b.

A second male O2 hose fitting that

connects the manifold with the
emergency O2 bottles in the
crewmember's parachute harness.

c.

A third (threaded) male O2 hose

fitting that connects the manifold
with the oxygen regulator for
crewmember respiration.

2.10-5

When the manifold is connected to

orbiter O2, rotating the g-suit dial
(knurled knob) clockwise, inflates
the g-suit bladders 0.5 psi per
complete turn, to a maximum
pressure of 2.5 psi. A one-way
valve inside the manifold prevents
the g-suit from inflating with
emergency O2, which is reserved for
breathing. Rotation of the knob
counterclockwise will deflate the gsuit bladders 0.5 psi per complete
turn. Each complete revolution of
the knob is indicated by a slight
detent. The recommended setting
for inflation is 1.5 psia, which is
obtained by rotating the red knurled
knob
three
complete
turns
clockwise.

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

O2 Manifold/G-Suit Controller
e.

When the g-suit controller clip is

pulled free, the current volume of O2
will be trapped maintaining g-suit
pressure. Reinstallation of the clip
will allow a normal deflation of the
g-suit bladders.

can supply a total of 401 liters of

oxygen at 14.7 psi. At 38 liters per
minute, the EOS will last for at least
10 minutes at sea level and longer at
high altitudes.
2.

A locking carabiner is attached to the

left side of the harness. It is an oval
aluminum ring for attaching descent
devices used during post-landing
emergency egress. It can also be used
during rescue operations.

3.

A life preserver unit (LPU) encircles

the crewmember's upper torso. It
inflates automatically via two CO2
cartridges (FLU-8) when submersed in
water.
It may also be inflated
manually via two inflation toggles on
the front of the harness. The unit is
designed to keep an unconscious
crewmember's head out of the water.

4.

Sixteen individual packages contain

two liters of emergency drinking
water and are stored at the rear of the
harness.

Parachute Harness and Parachute

The parachute harness contains an interwoven
system of nylon straps that attach the personal
parachute assembly (PPA) to the crewmember.
These straps provide complete body support for
crewmembers during bailout, emergency
egress, and rescue operations. In addition to the
support straps, the harness also includes the
following items that may prove necessary in an
emergency:
1.

The emergency oxygen system (EOS)

consists
of
two
high-pressure
cylinders
containing
breathing
oxygen. Regulators reduce the 3000
psi pressure of the bottles to a
working pressure of 70 psi.
A
common manifold delivers oxygen
from the bottles to the O2 manifold/gsuit controller. The EOS is activated
by a green apple on the right side of
the harness. Once activated, the EOS

2. SYSTEMS
2.10 Escape Systems

2.10-6

USA007587
Rev. A

Harness Diagram
The PPA is an integrated pack assembly
containing parachutes, risers, and actuation
devices required for automatic and manual
deployment of the parachutes. The PPA also
contains survival equipment in the form of a
personal life raft and personal locator beacon.
Finally, the PPA doubles as a seat back cushion
and is already in the orbiter when the crew
ingresses prior to launch. During seat strap-in,
the insertion technicians attach the PPA to the
harness.
There are four connections between the PPA
and the harness; two riser attach fittings (Frost
fittings) and two ejector snaps. During an
inflight bailout, the crewmember will egress the
seat, taking the parachute with him/her. When
immersed in salt water, two Seawater Activated
Release System (SEAWARS) units, one for each
riser, automatically release the risers and
canopy from the harness. For a ground egress,
the crewmember manually releases the four
PPA attach points leaving it in the seat. The
PPA contains the following items:

2.10-7

Automatic and manual pilot chute

deployment system
Drogue chute release knob
An 18-inch-diameter pilot chute
A 4.5-foot-diameter drogue chute
A 26-foot-diameter main canopy
Deployment sleeve
Automatic actuation device (AAD)
Life raft compartment
Life raft
SARSAT personnel locator beacon

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Parachute Pack (Back)

For an in-flight bailout, crewmembers would

use the primary parachute deployment
sequence.
First, crewmembers connect the
extraction bridle to a lanyard on the crew
escape pole. As the crewmember descends
down the escape pole, the extraction bridle is
fully extended initiating the auto sequence.
After a 1.5 second delay, the bridle/lanyard are
separated from the PPA via two heavy-duty
pyrotechnic line cutters. Next, the upper flap of
the PPA is opened when two light-duty line
cutters release the spring-loaded pilot chute.
The
18-inch-diameter
pilot
parachute
immediately pulls out the drogue deployment
sleeve.

2. SYSTEMS
2.10 Escape Systems

The 4.5-foot-diameter drogue chute stabilizes

the crewmember in a preferred attitude to
reduce injury during freefall, and reduce
parachute opening deployment damage. When
the drogue chute is deployed, the AAD is
armed.

2.10-8

USA007587
Rev. A

Parachute Pack (Back)

2.10-9

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A
The AAD is a pressure-activated pyrotechnic
device with an internal aneroid that is sensitive
to atmospheric pressure. When the AAD senses
a pressure altitude of 14,000 + 1,000 feet, the
pyrotechnic charge releases the drogue chute,
which pulls the main parachute canopy out of
the pack.
The main parachute is a modified version of the
Navy 26-foot conical canopy with Kevlar
reinforcement. A discard line reefing system is
added to increase the basic strength and reduce
the load to the crewmember during opening
shock. Four anti-oscillation windows are added
at the base of the canopy to reduce oscillation
during descent. The canopy is attached to the
risers by 22 suspension lines.

Riser

Pilot and
drogue chutes

Main canopy

Manual raft
inflation lanyard

Raft and SARSAT

NOTE
The parachute is not steerable.

419.cvs

The average descent rate for a crewmember

under main canopy is 24-ft/sec.
Manual activation can be accomplished by
pulling the ripcord handle on the upper left
riser. Pulling the ripcord handle performs the
same function as the bridle activation by firing a
single light duty pyrotechnic cutter, which then
deploys the pilot chute. The ripcord handle
would be used if the bridle activation failed or
the escape pole was not used. The drogue chute
release knob is also located on the left parachute
riser.
The drogue chute release knob is used if the
AAD fails to deploy the main canopy. Pulling
the drogue chute release knob disconnects the
drogue chute riser from the PPA, allowing it to
deploy the main canopy.
WARNING
The drogue chute release knob will not
deploy the main canopy unless the drogue
chute has been deployed via the
bridle/lanyard or the ripcord handle.
For auto or manual main canopy deployment,
the Search and Rescue Satellite Aided Tracking
(SARSAT) personnel locator beacon will be
activated and the liferaft compartment
loosened.

2. SYSTEMS
2.10 Escape Systems

Parachute Pack (Side)

The SARSAT beacon is activated during main
canopy deployment. A magnetic plug, pulled
out by the canopy riser, activates the SARSAT
beacon and begins transmitting during crewmember descent. The beacon has a range of 60
miles to aircraft at a 10,000-foot altitude. The
main canopy also fires two redundant lightduty pyrotechnic cutters, loosening the bottom
of the PPA where the liferaft is located.
However, the liferaft remains stowed in place
during descent until water entry.
The polyurethane coated nylon life raft
automatically inflates upon immersion in water.
If required, a manual inflation lanyard is also
installed on the left side of the PPA. Once
inflated, the life raft is attached to the PPA with
a 64-inch tether to keep it within reach of the
crewmember. The raft is also equipped with
two sea dye markers, a sea anchor, a bailing
pump, and a bailing cup. Each crewmember
also carries survival gear, located in both of the
lower leg pockets of the ACES.
The survival gear includes a PRC-112 survival
radio, a strobe light, a pen-gun flare kit, a
day/night flare, a signal mirror, two 12-hour
stick chem-lights, and motion sickness pills.

2.10-10

USA007587
Rev. A

Survival Gear

2.10-11

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Emergency Crew Module Depressurization and Side Hatch Jettison T-Handles

Cabin Vent and Side Hatch Jettison

The cabin vent system and hatch jettison system
allow the flight crew to quickly and safely
egress the orbiter during emergency situations.
The cabin vent system consists of pyrotechnics
and valves that let the crew quickly
depressurize the crew cabin to ambient pressure
prior to hatch jettison during bailout.
Depressurizing the cabin prevents it from
structural buckling during hatch jettison. The
hatch jettison pyrotechnic system ejects the
hatch from the orbiter, allowing the crew to bail
out or rapidly egress the orbiter after landing.
NOTE
The pyrotechnics systems use mechanical
energy transfer systems and do not
require orbiter electrical power.

2. SYSTEMS
2.10 Escape Systems

Separate T-handle initiators, located on the

forward port middeck floor, activate the cabin
vent and hatch jettison systems. The T-handles
are located inside a pyro box accessible to the
crewmember seated in seat 5.
Squeezing
together two latches on the top opens the pyro
box. A safing pin is used to secure the box
during orbit operations. Pre-launch and prior
to deorbit, the pin is removed. Reinstalling the
pin safes the side hatch.
NOTE
The convoy crew will not approach the
orbiter unless the crew has reported the
side hatch safed.
The pyro vent valve is activated by squeezing
and pulling the aft T-handle. The pyro vent
valve opens a 15-square-inch hole between the
crew compartment and the payload bay. The
purpose of the valve is to depressurize the cabin
at a controlled rate prior to jettisoning the side
hatch in flight. This is necessary to prevent

2.10-12

USA007587
Rev. A
severe buckling of the middeck floor, which
would occur if the side hatch were jettisoned
without any attempt to equalize the inside and
outside pressure. Pyro vent valve initiation at
an altitude of 40,000 feet requires approximately
75 seconds to lower the pressure in the cabin to
that of the ambient air outside the orbiter.
Equalization occurs at approximately 31,000
feet.
WARNING
The cabin vent pyros are an ignition source
in the payload bay and should not be used
for post-landing egress.

Crew Egress/Wing Clearance

Three separate sets of pyrotechnics are

associated with the side hatch, all of which are
activated simultaneously by squeezing and
pulling the forward T-handle. A total of four
linear-shaped charges (two per hinge for
redundancy) cut through hinge arms near the
side hatch. Two (redundant) expanding tube
assemblies are included to fracture the 70
frangible bolts that hold the hatch adapter ring
to the orbiter. Three (partially redundant)
thruster packs are used to separate the hatch
from the orbiter at a velocity of approximately
45 ft/sec. The hatch jettison features could be
used in a landing emergency.

Egress Pole System

The crew escape pole is designed to guide
escaping crewmembers on a trajectory that will
clear the vehicle's left wing when bailing out of
the orbiter. The escape pole consists primarily
of a curved, spring-loaded, telescoping steel
and aluminum cylinder. The escape pole is
contained in an aluminum housing that attaches
to the middeck ceiling and side hatch tunnel
area. A magazine holding eight lanyards is
attached to the port end of the pole housing
near the side hatch tunnel. The lanyards are the
means by which crewmembers are guided
down the pole.

Each lanyard assembly consists of a hook

attached to a Kevlar strap that surrounds the
escape pole. Four roller bearings on each strap
surround the pole and permit the lanyard to roll
freely down the pole. The Kevlar thread
stitching can break away, providing the
crewmember with an energy absorber. The
crewmember slides down the escape pole and
off the end directing him/her beneath and away
from the vehicle.

Emergency Egress Slide

The emergency egress slide provides a rapid
and safe orbiter egress during post landing
contingency and emergency situations. The
slide allows the safe egress of the crewmembers
to the ground within 60 seconds after the side
hatch is fully opened or jettisoned. It also
accommodates the egress of incapacitated
crewmembers.
Equipment consists of an
inflatable slide, pressurized Argon bottle,
aspirator, girt bracket, and slide cover, all
stowed together below the side hatch.
The slide can be deployed by attaching it to the
side hatch if the hatch has not been jettisoned or
rotating the slide into the opening if the hatch
has been jettisoned. The slide is inflated by
pulling a lanyard that activates an Argon bottle
pressurized to 3,000 psi. The slide inflates to
approximately 2.75 psig. A relief valve bleeds
off pressures greater than 3.0 psig.

2.10-13

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Emergency Egress Slide with Side Hatch Jettison

2. SYSTEMS
2.10 Escape Systems

2.10-14

USA007587
Rev. A

Deployed Pole Assembly

2.10-15

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Lanyard Magazine Assembly

2. SYSTEMS
2.10 Escape Systems

2.10-16

USA007587
Rev. A

Descent Control Device

2.10-17

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Sky genie (4)

Sky genie (4)

Cooling units

Overhead Egress Window Jettisoned

Overhead Escape Panel

In the event that egress through the side hatch is
not possible, the port side flight deck overhead
window (window 8) provides the flight crew
with a secondary emergency egress route. This
overhead window consists of three panes of
glass, two panes attached to the crew compartment and one attached to the upper forward
fuselage. The overhead window jettison system
consists
primarily
of
expanding
tube
assemblies, mild detonating fuses, frangible
bolts, and associated initiators.
Pulling the ring handle located forward of the
flight deck center console (C3) activates the
overhead window jettison system. When initiated, the outer pane is jettisoned upward and
aft. A time delay in the pyrotechnic firing
circuit delays the initiation of the opening of the
inner pane 0.3 second after the outer pane is
jettisoned. The inner window pane rotates
downward and aft into the crew compartment
aft flight deck on hinges located at the aft
portion of the window frame. A capture device
attenuates the opening rate and holds the
window in position. This overhead window
2. SYSTEMS
2.10 Escape Systems

jettison system can also be initiated by

ground personnel from the outside of the
orbiter on the starboard side of the forward
fuselage.
Crewmembers use the MS2 seat (seat 4) to
climb up through the window.
Seven
emergency ground descent devices (Sky
Genies) are stowed on the overhead aft
flight deck outboard of each overhead
window, one for each flight crewmember.
The emergency ground descent device
enables crewmembers to lower themselves
to the ground over the starboard side of the
orbiter.

Procedures for Bailout, Water Survival,

and Rescue
When it is determined that a bailout is
necessary, the commander places the orbiter
in a minimum-sink-rate attitude and
engages the autopilot. At 50,000 feet, the
commander directs the crew to close and
lock their visors and activate emergency
oxygen.
At 40,000 feet, MS 3 (seated
middeck in seat 5) vents the cabin via the
pyro vent valve T-handle initiator. At an

2.10-18

USA007587
Rev. A
altitude of 31,000 feet the cabin pressure is
about equalized with the outside atmosphere.
Shortly thereafter, the commander directs MS3
to jettison the side hatch. As soon as the hatch
is jettisoned, all crewmembers disconnect their
oxygen and communication connections, and
egress their seats.
MS3 deploys the egress pole by pulling the
safing pin and arming pin and rotating the
handle counterclockwise. Should the pole fail
to deploy fully, the manual ratchet is used to
manually extend the pole. The exit involves
each crewmember attaching the lanyard hook
assembly to the parachute harness and egressing through the side hatch opening. It takes
approximately 2 minutes for a maximum crew
of eight to bailout.
As each crewmember exits the orbiter, the force
exerted by entering the windstream activates the
automatic parachute sequence.
Once the
crewmember is off the pole and away from the
orbiter (1.5 second delay), a pyrotechnic cutter
separates the bridle and lanyard. The 18-inch pilot
chute is deployed 1.5 seconds later, and
immediately deploys the 4.5-foot drogue chute.
The drogue chute stabilizes the crewmember
down to an altitude of 14,000 feet, then deploys
the main canopy.

The crewmember's next task is to unpack

the signaling equipment.
The SARSAT
personnel locator beacon is the primary
signaling device. It is located on the raft
spray shield. The telescoping antenna is
extended, and the flexible antenna is
removed. The PRC-112 is used to monitor
282.8 MHz and establish voice contact with
search and rescue forces.
The arrival time of the search and rescue
forces depends on where the bailout
occurred. The first rescue force to arrive will
probably be a C-130 transport aircraft,
specially equipped for search and rescue.
Two teams are dropped, each consisting of
three rescue jumpers in a motorized rescue
boat. One team drops to each end of the line
of orbiter crewmembers. The C-130 may
also drop two 20-person rafts for the
assembled
crewmembers and rescue
personnel to wait in until rescue helicopters
arrive.

Prior to a water landing, the crewmember pulls

the manual inflation tab for the life preserver
unit.
The unit is designed to inflate
automatically upon immersion in any type of
water, but should be activated manually as an
additional safeguard.
Upon landing in
saltwater, the SEAWARS automatically releases
the crewmember from the parachute risers. At
the same time, the life raft automatically deploys
and inflates. The crewmember's first task is to
deploy the sea anchor and get into the life raft.
Next, the crewmember pulls the activation tab on
the upper CO2 cylinder to inflate the upper
chamber. Raft bailing proceeds by either using
the spray shield, the bailing cup, or the bailing
pump.

2.10-19

2. SYSTEMS
2.10 Escape Systems

Survival Gear

USA007587
Rev. A

2. SYSTEMS
2.10 Escape Systems

2.10-20

USA007587
Rev. A

Vehicle Loss of Control/Breakup

Although there are no formal requirements for
crewmembers to bail out of the orbiter during
uncontrolled flight, they may be able to do so
under certain circumstances. The pyro vent and
hatch jettison pyrotechnics do not require orbiter
power to function and can be activated even if
orbiter power is lost. Each crewmember is
wearing his or her own emergency oxygen
bottles and parachute, and if the crew cabin is not
tumbling rapidly, at least some crewmembers
should be able to get to the side hatch and get out.
In the case involving loss of orbiter control, the
crewmembers should activate their emergency
oxygen as soon as possible and then evaluate
the situation. If the crew module is lofting to
altitudes above 50,000 feet, the crew should
remain within it until it passes through 40,000
feet on the way back down. If the cabin is
depressurized, the ACES and a cabin altimeter
on the middeck can be used to judge the bailout
altitude of 40,000 feet.
The escape pole is intended for use only during
controlled gliding flight, and its use should not
be attempted during an uncontrolled bailout.
Once out of the orbiter, crewmembers should
pull their parachute ripcord handle to activate
the automatic opening sequence for their
parachutes.

2.10-21

2. SYSTEMS
2.10 Escape Systems

USA007587
Rev. A

Escape Systems Summary Data

Escape systems refer to equipment and
systems intended to facilitate emergency
egress of the flight crew. Escape systems
include
equipment
worn
by
the
crewmembers, hardware built into the
orbiter, and external systems located on the
launch pad.
Escape by the flight crew on the launch pad
is facilitated by descending to a safe area via
slidewire baskets. The launch pad structure
also includes an escape temperature and
hydrogen fire-hazard monitoring system and
a Firex spray system for water shower.
The ACES is designed to protect
crewmembers from (1) loss of cabin pressure
and/or orbiter oxygen at altitudes of up to
100,000 feet, (2) cold atmospheric and/or
water temperatures after bailing out, (3)
pooling of blood in the lower body, and (4)
contaminated atmosphere during flight or
post-landing procedures.
The personal parachute assembly is worn by
the crew in the event of bailout. It is
designed to work automatically with the
crew egress pole system or with manual
backups as needed.
The hardware associated with the orbiter for
purposes of in-flight crew escape consists of
several types of pyrotechnics plus the egress
pole.

2. SYSTEMS
2.10 Escape Systems

Three separate sets of pyrotechnics are

associated with jettisoning the side hatch, all
of which are activated simultaneously by
squeezing and pulling a T-handle.
The purpose of the egress pole is to guide
escaping crewmembers on a trajectory that
will clear the orbiter's left wing.
The emergency egress slide is intended for
use after a normal opening of the middeck
side hatch or after jettisoning of the side
hatch at the nominal end-of-mission landing
site or at a remote or emergency landing site.
In the event that egress through the side
hatch is not possible, the port side flight deck
overhead window (W8) provides the flight
crew with a secondary emergency egress
route.
The commander may decide a bailout is
necessary, if the range-to-go exceeds about 50
n. mi. at an altitude of 55,000 feet. The orbiter
is placed in a minimum-sink-rate attitude on
autopilot.
Bailout includes using the escape pole to
leave the orbiter, deploying the parachute for
descent, and inflating the life raft for a water
recovery. Special survival gear and procedures are provided in the case of a bailout.

2.10-22

USA007587
Rev. A

2.11

The current space suit, designed for a total

maximum time of 7 hours, provides environmental protection, mobility, life support, and
communications. Two suits are flown in each
baseline orbiter mission, and consumables are
provided for three two-person, 6-hour EVAs.

EXTRAVEHICULAR ACTIVITY
(EVA)

CONTENTS
EVA Overview.......................................
Extravehicular Mobility Unit...............
External Airlock.....................................
EVA Support Equipment .....................
Simplified Aid for EVA Rescue...........
Operations..............................................
EVA Summary Data .............................
EVA Rules of Thumb............................

2.11-1
2.11-2
2.11-9
2.11-14
2.11-16
2.11-17
2.11-21
2.11-21

AnairlockisusedwhencrewmembersgoEVA.
Theairlockisdepressedwiththecrewmembers
within, allowing them to egress into vacuum.
Theairlockallowsasmallvolumeoftheshuttle
to be depressed, rather than the entire crew
cabin. The external airlock provides docking
capability with other space vehicles when
outfittedwithanorbiterdockingsystem(ODS).

EVA Overview
An EVA occurs when a crewmember leaves the
protective environment of a spacecraft's pressurized cabin and ventures out into the vacuum
of space in a space suit. An EVA is commonly
known as a spacewalk. Two EVAs are available
for payload use, with a third reserved for
orbiter contingency operations. EVA has been
useful in satellite repair, retrieval, and refueling,
as well as with space station assembly.
Mission

Date

There are three basic categories of EVA:

scheduled, unscheduled, and contingency. A
scheduled EVA is an EVA incorporated into the
nominal flight plan to complete a specific
mission objective. An unscheduled EVA is not
part of the flight plan, but is conducted to
achieve payload operation success or to
advance overall mission accomplishments. A
contingency EVA is also unscheduled, but is
required to ensure safe return of the orbiter and
crew.

Purpose of EVA

EVA crew

No. EVA/
mission

Duration,
man-hours

STS-6

Apr 4-9, 83

System Functional Demo

Musgrave/Peterson

8 hr, 34 min

STS-41B

Feb 3-11, 84

MMU Capability Demo

NcCandless/Stewart

23 hr, 14 min

STS-41C

Apr 6-13. 84

Solar Max Satellite Repair

Van Hoften/Nelson

20 hr, 12 min

STS-41G

Oct 5-13, 84

Orbiter Fuel Transfer Demo

Leestma/Sullivan

6 hr, 58 min

STS-51A

Nov 8-16, 84

Westar/Palapa Satellite Retrieval

Allen/Gardner

24 hr, 28 min

STS-51D

Apr 12-19, 85

Syncome F3 Satellite Repair

Griggs/Hoffman

6 hr, 20 min

STS-51I

Aug 27-Sep 3, 85

Syncome F3 Satellite Repair

Fisher/Van Hoften

23 hr, 42 min

STS-61B

Nov 26-Dec 3, 85

Large Structure Assembly

Spring/Ross

24 hr, 40 min

STS-37

Apr 5-10, 91

GRO Satellite Repair/Locomotion Studies

Ross/Apt

20 hr, 58 min

STS-49

May 10-14, 92

59 hr, 51 min

Jan 17, 93

Thuot, Hieb, Akers,

Hornton,
Harbaugh, Runco

STS-54

8 hr, 56 min

STS-57

Jun 25, 93

Low, Wisoff

11 hr, 40 min

STS-51
STS-61

Sep 16, 93
Dec 4-8, 93

Intelsat Repair and Assembly of Station by

EVA Methods (ASEM)
First EVA Detailed Test Objective (DTO
1210)
EURECA Antenna Stow and Second EVA
DTO (1210)
Third EVA DTO (1210)
Hubble Space Telescope Repair Mission

1
5

14 hr, 10 min
70 hr, 58 min

STS-64
STS-63

Sep 16, 94
Feb 9, 95

Walz, Newman
Musgrave, Hoffman,
Akers, Thornton
Lee, Meade
Foale, Harris

1
1

13 hr, 42 min
13 hr, 18 min

STS-69

Sept 16, 95

Voss, Gernhardt

13 hr, 32 min

STS-72

Jan 14-16, 95

Chiao, Barry, Scott

26 hr, 4 min

STS-76

Mar 27, 96

Godwin, Clifford

12 hr, 4 min

SAFER First Flight

First EVA Development Flight Test (EDFT)
(Spartan Mass Handling)
Second EDFT (Task board with station EVA
interfaces)
Third EDFT (Station assembly and
maintenance hardware)
Fourth EDFT (MEEP - Mir Environmental
Effects Payload)

Space Shuttle EVA Chronology

2.11-1

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A

Extravehicular Mobility Unit

Extravehicular Mobility Unit

The extravehicular mobility unit (EMU) is an
independent anthropomorphic system that provides environmental protection, mobility, life
support, and communications for the
crewmember to perform EVA in Earth orbit.
For EMU design considerations, an EVA is
defined as any time the EMU external
environmental pressure is below 4.0 psia. The
EMU is designed to accommodate an EVA
mission with a total maximum duration of 7
hours, consisting of 15 minutes for egress, 6
hours for useful EVA tasks, 15 minutes for
2. SYSTEMS
2.11 Extravehicular Activity (EVA)

ingress, and a 30-minute reserve. The EMU also

accommodates specific metabolic rate limits,
including (1) an average metabolic rate not
exceeding 1600 Btu/hr in any given EVA hour
and not exceeding 1000 Btu/hr for the entire
duration, (2) a peak metabolic rate not
exceeding 2000 Btu/hr for a period of 15
minutes, and (3) a minimum metabolic rate not
less than 400 Btu/hr for a period of 30 minutes.
The EMU is an integrated assembly, primarily
composed of the space suit assembly, life
support system, and numerous items of associated support and ancillary equipment.

2.11-2

USA007587
Rev. A
Space Suit Assembly
The space suit assembly (SSA) is the anthropomorphic pressure vessel that encloses the
crewmember's torso, limbs, and head. The SSA
provides a variety of functions while the
crewmember performs an EVA, including suit
pressure retention, crewmember mobility, crewmember liquid cooling distribution, oxygen
ventilation gas circulation, downlink of crewmember's electrocardiogram data via EMU
radio, crewmember interface with EMU radio,
crewmember in-suit drinking water, and urine
containment. The SSA operates under specific
pressure requirements and leakage criteria.
The space suit assembly consists of the
following:
Hard upper torso/arms
Lower torso assembly
Extravehicular gloves
Helmet/extravehicular visor assembly
Liquid cooling and ventilation garment
Operational bioinstrumentation system
Communications carrier assembly
Disposable in-suit drink bag

upper arm assembly, rotating scye bearing,

lower arm assembly, rotating arm bearing, wrist
disconnect ring, urethane pressure bladders,
cloth restraint systems, and TMGs for the upper
and lower arm assemblies.
The lower torso assembly (LTA) consists of a
flexible anthropomorphic pressure vessel that
encompasses the waist, lower torso, legs, and
feet. The LTA includes the following components: waist assembly, waist disconnect ring,
trouser assembly, rotating waist bearing
between the waist and trouser assemblies, boot
assembly, urethane pressure bladders, cloth
restraint systems, and TMGs for the waist,
trouser, and boot assemblies.
The current sizing of the arm/leg assemblies
can be accomplished on the ground using
different sizes of each assembly for a particular
crewmember. There is also available an onorbit capability of EMU resizing by using
various arm/leg segments and sizing rings.
The on-orbit quick-sizing capability, uses
threaded quick-disconnects, softgood sizing
elements, aluminum sizing rings, and
adjustable-length restraint lines.
The suit
incorporates dual lip seal mobility bearings and
low-torque fabric joints.

Maximum absorption garment

The hard upper torso (HUT) provides pressure
containment for the upper torso as well as being
the central component from which the mechanical, electrical, and fluid interfaces of the EMU
branch. The HUT is available in four sizes to
accommodate 5th through 95th percentile-sized
crewmembers. The planar HUT, which deletes
the arm gimbal and bellows assembly, will be
available in two sizes. The HUT includes the
following components: fiberglass shell (with
water tubes and oxygen ducts), assorted
mounting brackets, waterline and vent tube
assembly, multiple water connector, EMU
electrical harness, shoulder bearing assemblies,
waist disconnect ring (passive half), helmet
disconnect ring, and thermal micrometeoroid
garment (TMG). The right and left arm assemblies are flexible, anthropomorphic pressure
vessels that encompass the arms. Each arm
assembly includes the following components:
2.11-3

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
The extravehicular gloves consist of a detachable, flexible pressure vessel, encompassing
each hand for use during EVA. The extravehicular gloves include the following components: urethane pressure bladder and cloth
restraint system, wrist disconnect ring with
rotating wrist bearing, two wrist gimbal rings,
adjustable palm restraint bar/strap, wrist tether
strap, fingertip heaters, and TMG with palm
restraint bar. The current Phase VI series gloves
are customized to fit individual crewmembers.
The build process begins with a casting of the
crewmembers hands if a previously cast glove
does not fit.

components: clear protective visor, sun visor,

center and side eyeshades, fiberglass shell, and
latch mechanisms and supporting structure for
the visor and eyeshades.

Enhanced Lower Torso Assembly

Enhanced Arm Assembly

The helmet, a "one-size-fits-all" model, consists
of a detachable, transparent, hard pressure
vessel encompassing the head. The helmet
includes the following components: hard transparent bubble, helmet disconnect ring, helmet
purge valve, and vent pad. Two crew optional
items are also available for the helmet. One of
these items is the Fresnel lens, which is
mounted to the lower front inside of the helmet
to improve display control module visibility for
the crewmember. The other item is the valsalva
device, attached to the inside of the bubble,
which allows the crewmember to clear his or
her ears during pressure changes.
The
extravehicular visor assembly (EVVA) attaches
to the helmet to provide the crewmember with
visual, thermal, impact, and micrometeoroid
protection. The EVVA includes the following
2. SYSTEMS
2.11 Extravehicular Activity (EVA)

The liquid cooling and ventilation garment

(LCVG) is a form-fitting elastic garment worn
against the crewmember's body. The LCVG
includes the following components: outer
restraint fabric, inner liner assembly, crew
optional comfort pads, biomed pocket, dosimeter pocket, water tubing network, paramanifold
assembly, ventilation ducting network, vent
plenum assembly, multiple water connector,
and full torso zipper. The garment supports a
network of tubing that circulates water over the
body to provide cooling to the crewmember. It
also supports a network of ducting that draws
ventilation gas from the suit extremities and
routes it back to the primary life support system
to complete the suit ventilation loop. Connections to the ducting in the HUT for both cooling
water and ventilation flow are made at the
LCVG half of the multiple water connector.
Various sizing options for the LCVG are
available to achieve a good fit for the
crewmember.

2.11-4

USA007587
Rev. A
The communications carrier assembly (CCA) is
a cloth aviator-type cap that positions and
supports the electronics for interface with the
EMU radio for crewmember communications.
The CCA contains the microphones and earphones necessary for the EVA crewmembers to
communicate with each other or with the
orbiter. The CCA also allows the EVA crewmembers to talk to Mission Control via the
orbiter communications system. Six sizes allow
the CCA to fit 5th through 95th percentile-sized
crewmembers. The CCA includes the following
components: skull cap, ear cups, ear phones, ear
seals, microphone modules, microphone booms,
summing module, interconnect wiring, interface
cable, neck strap, crew-optional chin strap, and
perspiration absorption strap.
The disposable in-suit drink bag (DIDB) is a
single use, heat sealed, flexible bladder
assembly mounted within a reusable restraint
bag. The DIDB holds 32 oz. of water. The
restraint bag is mounted to the front interior of
the HUT and has a drinking tube extending to
the neck area.
The maximum absorption garment (MAG)
consists of multiple layers of material designed
to rapidly absorb and store urine. The MAG is
designed to be worn under the LCVG by male
or female crewmembers during EVA. It has the
capacity to hold 32 fluid ounces of urine and is
disposable after use.
The MAG includes
multilayer absorbent material and tape
attachment straps.
Life Support System
The life support system (LSS) provides a safe
living environment inside the EMU. The LSS
provides a variety of functions while the crewmember performs an EVA. These include
provisions for
breathing oxygen, suit
pressurization, crewmember cooling, crewmember communications, displays and controls
for crewmember operation of the EMU, and
monitoring of EMU consumables and operational integrity.
The life support system
consists of the following:
Primary oxygen system
Secondary oxygen pack

Oxygen ventilation circuit

Liquid transport cooling system
Feedwater circuit
Electrical interfaces
Extravehicular communicator (EMU radio)
Display and control module
Caution and warning system
The primary life support subsystem (PLSS)
consists of the primary oxygen system, oxygen
ventilation circuit, liquid transport system,
feedwater
circuit,
electrical
interfaces,
extravehicular communicator, and the caution
and warning system. The secondary oxygen
pack is a separate unit that is attached to the
bottom of the PLSS. Together, the PLSS and the
secondary oxygen pack make up the backpack
of the EMU.
The primary oxygen system provides a
crewmember with breathing oxygen and
satisfies pressure requirements for EVA. The
system stores 1.217 pounds of oxygen at 850
psia and 90 F. It delivers oxygen during EVA
at 4.3 0.1 psid, and maintains a metabolic use
rate range of 0.02 to 0.33 lb/hr. The system is
charged through a servicing and cooling
umbilical (SCU) to the orbiter environmental
control and life support system. Charging
pressure is 850 50 psig. The minimum usable
pressure is 60 psi. The system performs various
functions,
including
suit pressurization,
provision of breathing oxygen, and water
pressurization. The primary oxygen system
includes the following components: oxygen
tanks, oxygen tank pressure sensor, flow
limiter, oxygen shutoff valve, oxygen actuator,
suit pressure regulator, water pressure
regulator, and dual mode relief valve.
The secondary oxygen system, also known as
the secondary oxygen pack (SOP), is the backup
assembly to the primary oxygen system. This
backup system provides a minimum of 30
minutes of emergency oxygen with the DCM
purge valve open. The SOP functions include
suit pressurization, provision of breathing
oxygen, and some degree of cooling in the
purge mode. There is no required crewmember

2.11-5

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
interface to activate the SOP; it automatically
activates whenever the oxygen actuator is in the
EVA position and suit pressure is less than 3.9
psid. The SOP includes two oxygen tanks,
containing a total of 2.65 pounds of oxygen at
5800 psia and 70 F. The system includes the
following components: oxygen tanks, SOP inlet
pressure gauge, first-stage regulator, interstage
gauge,
second-stage
regulator/shutoff
valve/flow restrictor, PLSS/SOP interface
connector, and oxygen tank pressure sensor.
The SOP is not rechargable on-orbit.
The oxygen ventilation circuit forms a closed
loop with the space suit assembly. The circuit
provides oxygen for breathing, suit pressurization for intravehicular activity (IVA) and EVA
operation, and ventilation for cooling and
elimination of exhaled gases. The oxygen flow
picks up heat, humidity, carbon dioxide, and
other contaminants, which are removed from
the EMU by the ventilation circuit components.
The system includes the following components:
fan/water separator, slurper/sublimator, vent
flow sensor/backflow check valve, suit pressure
sensor, suit pressure gauge, contaminant
control (lithium hydroxide-LiOH) cartridge
(CCC), carbon dioxide sensor, display control

module purge valve, helmet purge valve,

positive pressure relief valve, negative pressure
relief valve, and SOP checkout fixture.
Ventilation flow is picked up at the body
extremities and returned to the upper torso via
a vent duct manifold that is part of the LCVG.
From the upper torso, the gas is routed back
into the PLSS and the CCC. The LiOH CCC is
sized to absorb 1.48 pounds of carbon dioxide
associated with 7000 Btu of metabolic activity
over a 7-hour EVA period. The cartridge is
installed in the back of the PLSS and is
replaceable on orbit. On the ground, the used
LiOH cartridge can be recharged for future use.
The liquid transport system uses the centrifugal
pump to circulate approximately 240 lb/hr of
water through the LCVG. The function served
by the liquid transport system is to provide
cooling to the crewmember. The system includes the following components: pump, temperature control valve, LCVG, gas trap, pump
priming valve, pump check valve, sublimator
temperature sensor, and service and cooling
umbilical bypass valve. During IVA operation,
the pump circulates water not only through the
EMU, but also through the service and cooling
umbilical to the orbiter heat exchanger.

Secondary Oxygen Pack

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-6

USA007587
Rev. A

LiOH Cartridge
The feedwater circuit contains the equipment
and water to dissipate heat loads imposed on
the system by the crewmember, the PLSS, and
the environment. It also contains equipment to
remove moisture from the ventilation circuit
and gas from the transport circuit, to separate
the water and gas, and to put them back in their
respective loops. The feedwater circuit functions involve heat rejection, LCVG water
makeup, and vent loop condensate separation
and storage. The system includes the following
components: feedwater tanks (2 primary/1
reserve), feedwater tank pressure sensors,
reserve feedwater tank check valve, feedwater
pressure regulator, feedwater shutoff valve,
feedwater pressure sensor, sublimator, feedwater relief valve, condensate water relief valve,
water separator, and coolant isolation valve.
The primary and reserve tanks store approximately 9 pounds of feedwater at 15 psig. The
reserve feedwater tank provides 30 minutes of
water for EMU cooling in the event that primary
feedwater is depleted. Potable water from the
orbiter ECLSS is used to fill or recharge the tanks.
The EMU electrical system is composed of the
following main components: battery, feedwater
shutoff valve, coolant isolation valve, motor,
instrumentation, extravehicular communicator,

display and control module, and caution and

warning system.
Electrical interfaces exist
between the display and control module and
parts of the PLSS, SOP, and C/W. The power
supply for operation of all electrical components
of the EMU is a battery installed in the back of
the PLSS. The EMU battery consists of eleven
sealed, silver-zinc, high current density cells
connected in series. The battery provides a
minimum of 32 amp-hr of power over a 7-hour
EVA mission at a full charge voltage between
21.6 and 21.9 V dc.
The extravehicular communicator (EVC) is
composed of two parts, the orbiter-based equipment and the EMU-based equipment. The
orbiter equipment consists of the EVA/air
traffic control transceivers and antennas. This
configuration provides communication with the
EVA crewmembers and relay between EVA
crewmembers and the ground (including downlink ECG and real-time data system (RTDS)
telemetry). The EMU equipment consists of the
EMU radio and antenna. It provides voice
communications with other EVA crewmembers
and the orbiter, ECG/RTDS telemetry to the
orbiter for recording and/or downlink, and
caution and warning tones to alert the EVA

2.11-7

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
crewmember of anomalies or other significant
events. The EVC includes the following components: orbiter UHF system, EMU radio, EMU
electrical harness, communications carrier
assembly, biomed sensors, COMM MODE
selector switch, FREQ switch, volume controls,
and real-time data system. Orbiter panels O6,
A1R, and R10 are the crew communication
interfaces. The panels control UHF operation,
air-to-air or ground transmission, and biomed
data downlink/recording respectively.
The display and control module (DCM)
contains all controls and displays necessary for
nominal operation and monitoring of EMU
systems. The DCM includes the following
components: POWER mode switch, DISPL
switch, FAN switch, WATER switch, FREQ
switch, communications volume controls,
display intensity control, oxygen actuator,
temperature control valve, pressure gauge,
DCM purge valve, alphanumeric display, and
COMM mode selector. The DCM is installed on
the hard upper torso, with the surfaces covered
with a TMG. This TMG contains the labels for
the controls and displays.

The EMU caution and warning system (CWS)

consists of instrumentation and a microprocessor
to obtain, process, and visually display
information for use by the EVA crewmember in
the operation and management of the EMU. The
system contains built-in test equipment (BITE),
consisting of software and hardware that verify
proper CWS operation. CWS serial data are also
routed to the ground by the real-time data
system. The CWS functions involve displaying
EMU leak check procedures, monitoring and
displaying EMU consumables status, monitoring
EMU operational integrity, and alerting
crewmembers to EMU anomalies. The system
includes
the
following
components:
alphanumeric display with BITE indicator, display (DISPL) switch, alert/status/warning tones,
sensors, and "black box" processor. The CWS
receives inputs from EMU sensors and from the
DISPL switch located on the DCM. Sensors
gather information throughout the EMU system
and relay it to the CWS. Information is provided
on pressures, temperatures, currents, and
voltages.

Display and Control Module

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-8

USA007587
Rev. A
EMU Ancillary Equipment
The EMU ancillary equipment consists of
hardware necessary to support the EMU during
all phases of EVA (prep/post/operation). The
following list itemizes the components with a
brief description of their functions.
EMU helmet lights - Attach to the helmet EVVA
and provide two functionally independent sets of
lights for portable lighting during an EVA task.
EMU scissors - Steel cutters with one serrated
edge capable of cutting anything from fabric
bags and straps to lightweight steel cable and
Kevlar cord.
EMU wrist mirror - Attaches to the wrist of the
EVA glove to allow the EVA crewmember to
view the controls and displays on the DCM or
other areas of the EMU.
EVA cuff checklist - A set of reference cards
bound by an aluminum alloy bracket attached
to a wrist band. The reference cards, approximately 4 inches by 5 inches in size, contain
procedures and reference data for performing
EVA tasks and for aiding in the diagnosis and
resolution of EMU malfunctions.
In-suit drink bag syringe - A device used to
remove gas from the water in the drink bag.
The needle of the syringe is inserted in the inlet
valve of the bag, and gas is suctioned out of the
bag with the syringe.
Thermal mittens - An adjustable enclosure
composed of several layers of thermal blankets
and aluminized Mylar with a layer of Nomex
felt on the palm and undersides of the fingers
that fit conformally around the EV gloves to
provide greater thermal hand protection at
extreme high and low temperature worksites.
Lower torso assembly donning handles - Left and
right handles that aid in the mating of the hard
upper torso and lower torso assembly halves of
the waist ring.
Body Seal Closure Contingency tool (LTA prybar) A pry bar used to disconnect the LTA and HUT
halves of the waist ring in the event that the
latching
mechanism
becomes
jammed.
Operation of the pry bar may damage the

latching mechanism; therefore, it should be

used only if the waist ring becomes jammed and
the crewmember is entrapped in the space suit.
Bends treatment adapter (BTA) - An emergency
device that may be used on-orbit in the event an
EVA crewmember contracts decompression
sickness (bends). The BTA converts the EMU
into a hyperbaric treatment chamber, pressurizing the EMU to 8.0 psid over ambient cabin
pressure.
SOP checkout fixture - A flight support test item
installed on the HUT half of the neck ring
during pre-EVA operations.
DCM plug - A cover that attaches to the multiple
connector on the DCM in the event that water
begins leaking from the connector after the
service and cooling umbilical multiple
connector is removed.
EMU servicing kit - Items necessary for
preparing the EMU for EVA, such as antifog
wipes, tissue-type wipes, and scissors. It also
contains additional equipment necessary for
routine EMU maintenance, including valsalva
devices, stericide wipes, and lubricant wipes.
Bio kit - Equipment associated with the biomed
instrumentation, including EVA cables, overtapes, electrode placement illustration, alcohol
wipes, stoma seals, and electrode paste.
Airlock stowage bag - A Nomex bag used for
temporary storage and transfer of items used in
prep- and post-EVA operations. When stowed
in the airlock over the inner hatch, the bag and
its contents are removed from the airlock prior
to airlock depressurization.
EVA bag - Used to stow various items (camera,
thermal mittens, tool caddy) in the airlock for
possible use during EVA.
The EVA bag
remains in the airlock during the EVA.

External Airlock
The
external
airlock
on
the
orbiter
accommodates astronaut EVA operations. The
external airlock permits EVA crewmembers to
transfer from the middeck crew compartment
into the payload bay in EMUs through a short
tunnel, without depressurizing the orbiter crew
cabin. The external airlock can stow two EMUs
and has the interfaces and associated displays

2.11-9

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
and controls for the orbiter systems that support
EMU operation and servicing.
Sized to
accommodate a two-person EVA, the external
airlock dimensions have a diameter of 63
inches, a length slightly longer than 83 inches,
and three D-shaped 40-inch-diameter openings.
The floor is not solid; it is a cover over the
endcone at the bottom of the external airlock. It
has an empty volume of 228 cubic feet. The
external airlock depresses a total volume of 208
cubic feet with two EMUs. Support functions
performed in the external airlock include
depressurization and repressurization, EVA
equipment recharge, LCVG water cooling, and
EVA equipment checkout, donning, and
communications.
All EVA gear, checkout
panel, and recharge stations are located against
the internal walls.
External Airlock Hatches
Three pressure-sealing hatches are mounted on
the airlock. They are designated as an inner
hatch, an EV hatch, and a docking hatch.
The inner hatch is located on the exterior of the
external airlock opening into the middeck. The
inner hatch isolates the airlock from the crew
cabin. The inner hatch is hinged to be pulled
first into the middeck and rotated down until it
rests with the low-pressure (outer) side facing
the airlock floor. The hatch has a hold-open
hook that snaps into place over a flange when
the hatch is fully open.
The EV hatch isolates the airlock from the
unpressurized payload bay when closed and
permits the EVA crewmembers to exit from the
airlock to the payload bay when open. The EV
hatch of the external airlock opens in the same
manner as the inner hatch.
The external airlock's third hatch is an additional
upper, outer hatch that is used for docking
operations. The docking hatch, located on the
top of the external airlock (toward the payload
bay doors), is hinged to be pulled into the
external airlock and then rotated until the low
pressure side rests against the airlock wall
facing toward the nose of the orbiter.

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

Each hatch has interconnected latches with

gearbox and actuator, a window, a hinge
mechanism with hold-open device, a differential
pressure gauge on each side, and two
equalization valves. The external airlock hatches
also have hold-open protection and deployable
struts for support against the airlock structure.
External airlock repressurization is controlled
from the middeck or inside the external airlock.
It is performed by equalizing the external;
airlock and cabin pressure with airlock-hatchmounted equalization valves on the inner hatch.
Depressurization of the external airlock is
controlled from inside the external airlock. It is
depressurized by venting the external airlock
pressure overboard. The three D-shaped airlock
hatches are installed to open toward the primary pressure source, the orbiter crew cabin, to
achieve pressure-assist sealing when closed.
Each hatch opening is 40 inches in diameter, yet
with one side being flat, the minimum dimension is 36 inches.
The 4-inch-diameter window in each external
airlock hatch is used for crew observation from
the cabin to the airlock and the airlock to the
payload bay. The dual window panes are made
of polycarbonate plastic and are mounted directly to the hatch using bolts fastened through
the panes. Each external airlock hatch has dual
pressure seals to maintain the external airlock's
pressure integrity. One seal is mounted on the
external airlock hatch and the other on the
external airlock structure. A leak check quick
disconnect is installed between the hatch and
the airlock pressure seals to verify hatch
pressure integrity before flight.
Each airlock hatch has the following design
characteristics: (1) capable of being fully locked/
unlocked from either side, (2) designed for 2000
open/close cycles, (3) one-handed operation by
astronaut in pressure suit, (4) capable of opening
against 0.2 psid maximum, (5) latches capable of
withstanding 20 g's in the +X direction, and (6)
actuator handle load of 30 pounds maximum.
The gearbox with latch mechanisms on each
hatch allows the flight crew to open or close the
hatch during transfers and EVA operations.
The gearbox and the latches are mounted on the
low-pressure side of each hatch, with a gearbox
handle installed on both sides to permit

2.11-10

USA007587
Rev. A
operation from either side of the hatch. Some of
the latches on each hatch are double-acting with
cam surfaces that force the sealing surfaces
apart when the latches are opened, thereby
acting as crew-assist devices. To latch or
unlatch the hatch, the gearbox handle must be
rotated 440.
The hatch actuator/gearbox is used to provide
the mechanical advantage to open and close the
latches. The hatch actuator lock lever requires a

force of 8 to 10 pounds through an angle of 180

to unlatch the actuator. A minimum rotation of
440 with a maximum force of 30 pounds
applied to the actuator handle is required to
operate the latches to their fully unlatched
positions.
The hinge mechanism for each hatch permits a
minimum opening sweep into the airlock or the
crew cabin middeck.

External Airlock
(port side view)

2.11-11

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A

External Airlock ISS Configuration

Airlock Repressurization, Schematic Diagram

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-12

USA007587
Rev. A

Airlock Hatch Latches, Schematic Diagram

X0 576.00
bulkhead

Upper hatch for

extravehicular
activity operations
Spacehab
Pressurize
Module

Pressurized
Crew
Compartment

Aft hatch

Forward fuselage

Airlock in middeck

Tunnel adapter
provides:
Shirt-sleeve passage to
Spacehab
EVA capability (with airlock)
usa007587_1113r1.cvx

Airlock/Tunnel Adapter

2.11-13

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
External Airlock Subsystems
The external airlock air circulation system
provides conditioned air to the external airlock
during non-EVA periods. Upon external airlock
hatch opening in flight, a duct is installed on the
middeck floor fitting by the flight crew through
the cabin/airlock hatch and connected to the
airlock booster fan. The duct has threaded
fittings installed on the end of it which are used
to secure it The duct must be removed from the
airlock before the cabin/airlock hatch is closed
for chamber depressurization.
To assist the crewmember before and after EVA
operations, the external airlock incorporates
handrails and foot restraints. Handrails are
located alongside the avionics and ECLSS
panels, with aluminum alloy handholds
mounted on each side of the hatches. Each
handrail has a clearance of 2.25 inches between
the airlock wall and the handrail to allow
crewmembers to grip it while wearing a
pressurized glove.
External
airlock-based
EMU
support
components provide for EMU stowage, EMU
operational support, and EMU recharge during
intravehicular activity operations.
These
components include the EMU mount, the
service and cooling umbilical, and the lower
torso restraint bag. The EMU mount provides a
mechanical interface between the EMU and
airlock wall for EMU stowage. The mount
attaches to the back side of the EMU and
engages with three fixtures on the wall of the
external airlock. The mount is also used to
maintain the EMU in a fixed position on orbit
for EMU donning and doffing operations. If
necessary, the EMU mount can be removed
from the airlock wall while on orbit.
The service and cooling umbilical consists of
three water hoses, a high pressure oxygen hose,
electrical wiring, water pressure regulators, and
a strain relief tether. The system is used to
interconnect the EMU and the orbiter airlock for
the following major functions: electrical power,
hardline communications, oxygen supply,
wastewater drainage, water cooling capability
and recharge capability for the PLSS oxygen
tanks, water reservoir, and battery.

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

The lower torso restraint bag is attached to the

bottom of the EMU mount and covers the lower
torso of the EMU to restrain it during launch
and entry. Straps on either side of the bag are
attached to points on the upper part of the EMU
mount and are tightened to ensure that the
EMU is fully restrained.
The external airlock is used in conjunction with
a tunnel adapter during Spacehab missions
when the orbiter is docked to the ISS. The
airlock tunnel adapter, hatches, tunnel
extension, and tunnel permit the flightcrew to
transfer from the orbiter's pressurized middeck
compartment to the Spacehab pressurized shirtsleeve environment. An upper hatch in the
tunnel adapter provides egress/ingress for EVA
operations.
In the event of an EVA, the
flightcrew may not be present in the Spacehab.

EVA Support Equipment

A variety of equipment is available to support
the EVA crewmember. Depending on the task
to be performed, the proper tool is available
outside the airlock. The general equipment
functions include securing the crewmember to
the orbiter/RMS, providing the crewmember
with mechanical assistance, and assisting the
crewmember in mobility. The following list
itemizes the EVA support components with a
brief description of their functions.
Crewmember safety tether - Ensures the
crewmember is positively tethered to the orbiter
while providing access to all areas of the
payload bay. Before airlock egress, this safety
tether is attached to a waist tether and remains
attached at all times during EVA, while the
crewmember translates from one area of the
payload bay to another.
Slidewires - Facilitate the translation of a
crewmember and equipment in the forward and
aft directions of the payload bay. Two slidewires, one on each side of the payload bay, may
be installed for a length of approximately 46
feet.
Tethers - Include waist and wrist tethers. Waist
tethers are used to attach the crewmember to
the orbiter safety tether system and to provide
additional crewmember restraint at a worksite

2.11-14

USA007587
Rev. A
when required. Waist tethers use a large hook
to be attached to various tether points
(including the crewmember safety tether) and a
small hook that attaches to an EMU waist tether
ring. Wrist tethers are used to secure tools and
hardware to the EVA crewmember and to tether
points.
Wrist tethers are both fixed and
adjustable, attaching to loops on the EMU
glove.
Handrails - Aluminum tubing strategically
located to aid in crewmember translation or
restraint to accomplish a specific task. Handrails are located on the forward and aft bulkheads, the hingeline of the payload bay doors,
and the RMS end effector. Handrails are
designed with tether attach points.
Portable foot restraint - A working platform
designed to restrain the EVA crewmember
while performing contingency operations on
various components of the payload bay
systems. The portable foot restraint stabilizes
the crewmember by using a system of toe
guides and heel clips designed to interface with
the EMU boots.
EVA Winch - Allows the EVA crewmember to
close the payload bay doors in the event of a
payload bay door drive system failure. Prior to
launch, the winch is mounted on both the
forward and aft payload bay bulkheads. The
winch consists of a reel, assisted by spring
energy, housing 24 feet of 3/8-inch-diameter
Kevlar rope with a hook attached to the
free end.
Mini-workstation - A mechanical device that
mounts on the front of the EMU to stow tools
and to provide a means of tether restraint for an
EVA crewmember at a worksite.
Tube cutter - Used for a contingency doorclosing operation. The tool consists of springloaded retention rollers, a cutter wheel mounted
on a slide, a blade ratchet handle, a rotating
body, a control lever, and a tube-cutter ratchet
handle.
It is designed to cut drive door
linkages.
General purpose cutter (large cutter) - Designedto
cut larger cables, wires, and structural tubes
thatcannotbecutbythecompoundcutter.The
ratchetdirectionofthejawsiscontrolledbyan

openandclose lever mounted on the head of

thetool.
Payload bay doors disconnect tools - Used to
disengage the power drive unit on each payload
bay door from the power-drive-unit torque
shaft, allowing manual closing of the doors.
The tool is approximately 6-3/4 inches long
from the tip of the tether ring to the end of the
3/8-inch steel, square drive extension.
Additional tools for disconnecting the door
drive linkage system include vise-grip,
ratcheting box-end wrench, adjustable wrench,
loop pin extractor, Velcro/ tape caddy, bolt
puller, and trash bag.
Three-point latch tool - Used to compensate for failed
bulkhead latches. The tool consists of a stowable
ratchet handle, two interchangeable tool handles, a
ratchet control selection lever, a spring-loaded
compensator, and two fixed-load pickup points.
Centerline latch tool - Used to compensate for a
failed payload bay door centerline latch. The tool
consists of a fixed-load and a spring-loaded
pickup point, plus a reversible ratchet with a
stowable handle and a pair of trigger release
buttons with a safety that prevents an accidental
release.
Airlock latch disconnect tool - A common, EVAmodified, crescent wrench used to force open a
jammed latch and/or latches disconnected from
the rotary actuator. The other contingency airlock disconnect tool is a drive ratchet with a
7/16-inch hex socket and 4-inch extension.
RMS rope reel - Used with the snatch blocks in
case of an RMS joint failure. The reel consists of
a rope spool, spool bracket, rope guide, and
cam cleats.
The rope reel contains
approximately 80 feet of 5/16-inch-diameter
Kexlon rope.
Snatch block - A common marine device used, in
the event of an RMS failure, in conjunction with
the RMS rope reel and EVA winch to backdrive
the RMS to a stowed position.
Payload retention device (PRD) - Used as an onorbit temporary tiedown tool so that the article
or payload being secured can be repositioned as
necessary to prevent damage. It consists of a
housing that encloses a 15-foot Kevlar webbing
strap on a spring-loaded reel.

2.11-15

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
RMS manipulator positioning mechanism wrench
(RMS MPM wrench) - A double-ended, openend steel wrench used to deploy or stow the
MPMs (in the event the MPM motors fail) by
manually turning the drive shaft in the
appropriate direction, thus allowing for
payload deployment and/or payload bay door
closing.
RMS shoulder brace release - A flat steel bar with
an angled foot used to disengage the RMS
shoulder brace locking mechanism, thus releasing the shoulder brace. If the lock is not
released, the RMS is inoperative.
Grapple fixture release tools - Used to remove a
grapple fixture shaft should an end effector malfunction, failing to release a payload. The tools
include a probe and 1/2-inch ratcheting box-end
wrench.
Radiator actuator disconnect tools - A 3/8-inch
drive ratchet and 1/4-inch allen wrench extension used to disconnect the radiator actuators
and support stowage of the radiators in the
event of a failure.
External tank umbilical door tool - Used to
override a failed external tank door centerline
latch and support ET door closure.
Generic jam removal tools - Compound cutters,
needle nose pliers, probe, hammer, prybar,
forceps, trash bag. For use in disconnecting or
dislodging jams in various orbiter mechanisms,
such as PLBD hinges, latches, etc.
Portable foot restraint (PFR) bridge clamp - Provides
a PFR socket that mounts on the sill of the PLB in
available locations on existing bridge rails.

Simplified Aid for EVA Rescue

The simplified aid for EVA rescue (SAFER) is a
small, self-contained, propulsive backpack
system used to provide a free-flying rescue

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

capability for an EVA crewmember. SAFER is a

"simplified," single-string system that fits on the
bottom of the EMU PLSS and attaches to existing
mounts on the sides of the PLSS.
SAFER is designed to be used as a self-rescue
device for a separated EVA crewmember in
situations where the orbiter is unavailable to
provide rescue capability. Such situations would
include when the orbiter is docked to a large
payload or structure, such as the ISS. The SAFER
will also be used during all future ISS EVA
operations where the orbiter might not be present
at the ISS during an EVA.
To provide self-rescue capability, the SAFER
offers a minimum of 13 minutes of battery
power. The SAFER has 24 gaseous-nitrogen
(GN2) thrusters to provide 6 degrees-of-freedom
maneuvering control. The SAFER is controlled
by a single hand controller housed in a hand
controller module box located on the bottom of
the unit. The SAFER propulsion subsystem
provides a total delta velocity of at least 8 ft/sec
with an initial charge. The flight unit weighs
approximately 85 pounds and folds for launch,
landing, and on-orbit stowage.
The SAFER is the product of a Johnson Space
Center (JSC) in-house project to develop, build,
and produce a rescue device for when the orbiter
cannot provide rescue capability and for ISS EVA
operations. An on-orbit SAFER detailed test
objective (DTO) conducted on shuttle mission
STS-64 was very successful. This DTO demonstrated SAFER's operational capabilities and
collected performance data to augment the
design and development of the final operational
SAFER. The STS-76 SAFER was a transitional
unit between the DTO unit flown on STS-64 and
the final production unit that was manifested for
ISS. SAFER has a limited certification timeframe;
however, after use on orbit, the unit will be
returned
to
Earth
for
refurbishing.

2.11-16

USA007587
Rev. A

Attachment of SAFER to EMU

Operations
As previously discussed, there are three types
of EVA:
scheduled, unscheduled, and
contingency. A scheduled EVA is defined as
any EVA incorporated into the normal flight
plan in order to complete a specific mission
objective. A subcategory of scheduled EVA is
the quick-response EVA, which must be
performed within a few hours after a problem is
discovered.
It is usually associated with
payload deployment. Quick-response EVAs are
planned pre-flight, and the crew prepares for
the EVA even though it may not be performed.
An unscheduled EVA is not part of the flight
plan; rather, it is conducted to achieve payload
operation success or to advance overall mission
accomplishments.
A contingency EVA is also unscheduled, but is
required to ensure safe return of the orbiter and
flight crew. Contingency EVAs occur if orbiter

hardware sustains a malfunction. Procedures,

tools, and specified work locations are
identified for practice on any STS mission. The
recognized failures pertain to the following
orbiter systems: radiator actuator, payload bay
doors, bulkhead latches, centerline latches,
airlock hatch, remote manipulator system
(RMS), bulkhead camera, Ku-band antenna, and
external tank doors. The corrective actions for
each system failure are itemized in the System
Failure Corrective Actions Table.
Extravehicular activities are classified according
to level of complexity: simple, intermediate, or
complex. A simple payload EVA requires minimal unique tools, mockups, or mobility aids.
Existing procedures and techniques may be
adapted to particular EVA needs, thus requiring
minimal crew training. An intermediate payload EVA requires development of new tools
and equipment. Some procedure and technique
development is required, with more extensive
training necessary. A complex payload EVA

2.11-17

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
requires the design and development of complex or elaborate tools and equipment. The
tasks require extension of basic capabilities and
may pose difficulty in access or restraint.
Procedure and technique development is
extensive, as are crew training requirements.

11. Airlock repressurization - Airlock

repressurization and opening of the
inner hatch.
12. Post-EVA - Shutdown of the EMU
systems and doffing of the EMU and
ancillary components.

Regardless of the EVA type, a series of procedures is required to initiate and terminate an
EVA. These procedures cover an integrated
timeline sequence from the EVA checklist. The
detailed procedures are summarized for reference in the following steps:
1.

Quick don mask prebreathe - Donning

of the mask for prebreathe and cabin
depressurization.

2.

Cabin depressurization to 10.2 psi Reducing the cabin pressure from 14.7
psi to 10.2 psi.

3.

EMU checkout - Preliminary checkout

of the EMU systems prior to EMU
donning.

4.

Middeck preparation and preparation

for donning - Configuration of the
EMU and its ancillary components for
crewmember donning.

5.

Suit donning - Crewmember donning

of the EMU and ancillary components,
approximately 40 minutes duration.

13. EMU maintenance/recharge - Changeout or recharge of the EMU battery

and lithium hydroxide cartridge and
general cleaning of the EMU for
subsequent EVA; recharge of the EMU
water system.
14. Post-EVA entry preparation - Reconfiguration and restowage of the EMU
and airlock equipment.
A set of procedures are followed when a
crewmember has contracted the bends during
an EVA. The crewmember discontinues the
EVA and returns to the airlock to connect to the
service and cooling umbilical. The airlock is
repressed to 10.2 psia, and the cabin is
repressed to 14.7 psia. The helmet is doffed,
and the crewmember drinks a minimum of 32
ounces of fluids.
After proper EMU
reconfiguration, the bends treatment adapter is
installed for bends recovery.

6.

EMU check - Configuration and

checkout of the EMU prior to EMU
purge.

Scheduling an EVA is a very complex and

involved task. The following list outlines the
general mission constraints regarding EVA, but
does not attempt to define the detailed specific
activities.

7.

EMU purge - Nitrogen purge of the

EMU prior to prebreathe.

The maximum scheduled duration for

an EVA is 6 hours.

8.

Prebreathe - Crewmember acclimation

to lower chamber pressure, over a
period of 40 to 70 minutes.

All scheduled and unscheduled EVAs

require two crewmembers.

9.

Preparation for depressurization Configuration of the airlock and

closing the inner hatch prior to airlock
depressurization.

10. Airlock depressurization - Configuration and checkout of the EMU, airlock

depressurization to vacuum, and
opening of the outer hatch.

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-18

No scheduled or unscheduled EVA shall

occur on flight day 1 (~24 hours MET).
No scheduled EVA shall be planned to
occur prior to flight day 4 (~72 hours
MET) unless:
i)

A specific flight is dedicated to

scheduled EVA activity, and

USA007587
Rev. A
ii)

That payload customer has

specifically negotiated with NASA
for the early scheduled EVA
capability, and an exemption is
processed.

The latest an EVA may be scheduled in

preflight planning is EOM-2.
No unscheduled EVA shall be planned
to occur prior to flight day 3 (~48 hours
MET) unless:
i)

ii)

A specific payload has no alternative but to utilize an EVA as its

third level of redundancy for the
purpose of a critical backup to
deploy/operations that would
prevent loss of the payload, and
That payload customer has been
made aware of the inherent risk
that the EVA may not be able to
be performed due to crew status,
and the customer has agreed to
accept the risk, and

iii) That payload customer has specifically negotiated with NASA

for the early unscheduled EVA
capability, and an exemption is
processed.
The following are required response times
prior to an unscheduled payload EVA:

2.11-19

i)

Upon the discovery of a failure

leading to an EVA, approximately
24 hours are allotted for EVA
preparation prior to starting
actual EVA maintenance on a
failed component.

ii)

If the case above occurs on launch

day, then approximately 44 hours
are allotted prior to starting EVA
maintenance.

iii) If a payload requires a shorter

EVA
response
time,
the
requirement for that EVA must be
negotiated with NASA, and an
exemption must be processed.
Payload activities that could require an
unscheduled EVA at the end of a
mission may only be scheduled if there
are sufficient consumables and landing
opportunities to extend the mission to
perform the EVA and preserve 2 waveoff days.
A minimum of 1 flight day must separate two scheduled EVAs, for any given
EVA crewmember.
A contingency EVA will be scheduled in
real time whenever it is necessary to
restore the orbiter to a configuration for
safe return.

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A
FAILURE

CORRECTIVE ACTION

Radiator actuator

Radiator actuator disconnect

Payload bay door system

PDU
Winch operations
PLBD drive system linkage cut
PLBD drive system disconnect
Electrical crossover disconnect
Jam removal

Bulkhead latch

3-point latch tool installation

Jam removal

Centerline latch

Centerline latch tool installation

Jam removal

Airlock hatch

Airlock latch disconnect

Hinge disconnect

RMS

RMS joint alignment

RMS tiedown
MPM stow/deploy
RMS shoulder brace release
Grapple fixture release

Bulkhead camera
Ku-band
stowing

antenna

Disconnect and remove camera

fails

to align

External tank door

for

Ku-band antenna gimbal alignment

ET door centerline latch release

System Failure Corrective Actions Table

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-20

USA007587
Rev. A

EVA Summary Data

EVA refers to operations performed outside
the spacecraft crew compartment.
For generic orbiter missions, two suits are
included with consumables provided for
three, two-person, 6-hour EVAs.
There are three basic categories of EVA:
scheduled, unscheduled, and contingency.
The extravehicular mobility unit (EMU) is an
independent anthropomorphic system that
provides environmental protection, mobility,
life support, and communications for the
crewmember to perform EVA in Earth orbit.
An EVA is defined, for EMU design considerations, as any time the EMU external
environmental pressure is below 4.0.
The EMU is an integrated assembly, primarily composed of the space suit assembly, life
support system, and numerous items of
associated support and ancillary equipment.

The orbiter's external airlock permits EVA

flight crew members to transfer from the
middeck crew compartment into the payload
bay in EMUs without depressurizing the
orbiter crew cabin. The external airlock also
provides launch and entry stowage of up to
two EMUs.
The external airlock's support functions
include
airlock
depressurization
and
repressurization, EVA equipment recharge,
LCVG water cooling, EVA equipment
checkout, donning, and communications.
Depending on the task to be performed, the
proper tool is available outside the external
airlock.
The
general
EVA-support
equipment functions include securing the
crewmember to the orbiter/RMS, providing
the crewmember with mechanical assistance,
and assisting the crewmember in mobility.
A standard series of procedures (pre and
post operations) are required to initiate and
terminate an EVA, regardless of the EVA
type.

EVA Rules of Thumb

Always use "make before break" tether protocol.
Do not use the glove as a hammer.
EVA crewmember and equipment must
remain tethered at all times.
Slow, deliberate motion provides much
greater stability than quick, jerky motions.
Body positioning is 90 percent of the task.
Each EVA crewmember should check out his
or her own EMU.

2.11-21

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.11 Extravehicular Activity (EVA)

2.11-22

USA007587
Rev. A

2.12

Oven

GALLEY/FOOD

CONTENTS
Description............................................. 2.12-1
Galley...................................................... 2.12-1
Volume A - Pantry ................................ 2.12-3
Food System Accessories .................... 2.12-4

Description
The middeck of the orbiter is equipped with
facilities for food stowage, preparation, and
dining. The food supply is categorized as either
menu food, pantry food, or fresh food. Meals
are individually tailored, based on crewmember
preference. Menu food consists of three daily
meals per crewmember and provides an average energy intake of approximately 2,700
calories per crewmember per day. The pantry
food is a 2-day contingency food supply that
also contains food for snacks and beverages
between meals and for individual menu
changes. Pantry food provides an average
energy intake of 2,100 calories per crewmember
per day. Fresh food items consist of perishable
items such as fruits, vegetables and tortillas.
The
types
of
food
include
fresh,
thermostabilized,
rehydratable,
irradiated,
intermediate-moisture, and natural-form and
rehydratable beverages.
Three 1-hour meal periods are scheduled for
each day of the mission. Breakfast, lunch, and
dinner are scheduled as close to normal meal
times as possible. Dinner is scheduled at least 2
to 3 hours before crewmembers begin their presleep activities.

Galley
The galley is a multipurpose facility that
provides a centralized location for one
individual to handle all food preparation
activities for a meal. The galley has facilities for
heating food, rehydrating food, and stowing
food system accessories. The galley consists of
a rehydration station, oven, hot water tank, and
associated controls.

The oven is divided into two principal compartments: an upper compartment designed for
heating up to 14 rehydratable food containers
inserted on tracks, and a lower compartment
designed to accept up to 7 flexible packages.
The OVEN/RHS ON/OFF switch provides
power to the oven heaters and the control
electronics assembly. The oven fan ON/OFF
switch enables/disables power to three oven
fans. These fans circulate warm air over a heat
sink, thus providing forced convection heating
for the rehydratable packages. The flexible
packages are held against the heat sink by three
spring-loaded plates, and warmed by
conduction. The oven has a heating range of
160 to 185 F. The oven door is operated by a
"squeeze" latch requiring only 3 lb of pressure
to open.
Rehydration Station Dispensing System
The galley rehydration station dispensing
system interfaces directly with food and beverage packages to provide rehydration capability
and drinking water for crewmembers.
When both WATER HEATER switches are
turned on, 145 - 165 F water is available for
rehydration. The VOLUME/OUNCES switch
selects the volume of water to be dispensed by
the rehydration station in 0.5-ounce increments
from 0.5 of an ounce to 8 ounces. The yellow
(HOT) pushbutton indicator allows hot water to
be dispensed when it is depressed and is
illuminated when energized. When the selected
volume of water has been dispensed, the
pushbutton will begin to flash on and off. The
light will be extinguished when the food
package is retracted, releasing the rehydration
station lever ARM/LIMIT switch.
The blue (COLD) pushbutton indicator allows
cold water (40o - 60o F) to be dispensed when it
is depressed and is illuminated when
energized.
The rehydration station lever ARM/LIMIT
switch serves as an interlock so water can be
dispensed only when a food package is
connected to the needle. The food package
makes contact with the rehydration station lever,
which activates the LIMIT switch (note that the
flight crew does not physically actuate the lever).

2.12-1

2. SYSTEMS
2.12 Galley/Food

USA007587
Rev. A
Galley Controls
The galley controls consist of the OVEN/RHS
switch, the two WATER HEATER switches, the
OVEN FAN switch, the rehydration station hot
and cold pushbuttons and quantity selector
dial, and the MV2 valve. Six water heater strips
on the hot water tank are energized when the
two WATER HEATER switches are turned on.
The OVEN/RHS switch controls power to the
oven heaters and rehydration pumps and
associated electronics.

On the lower right-hand side of the galley

(above the MV2) is an auxiliary port water
quick disconnect (AUX PORT QD) that allows
the crewmembers to access ambient to hot (70o 120o F) potable water when a 12-foot flex line
and water dispensing valve are attached to the
QD. The MV2 valve, located below the AUX
PORT QD, allows the crew to control the
temperature of water (hot to ambient) out of the
AUX PORT. The galley also has a test port
(under the rehydration station) and a canon
plug (by the oven latch) that are used for
ground operations.

Storage (straws)
RHS controls

Disinfectant
wipes
Oven fan switch

Oven

Aux port
Water heater switches
Oven RHS switch

Shuttle Galley

2. SYSTEMS
2.12 Galley/Food

2.12-2

USA007587
Rev. A

Volume A - Pantry
Volume A holds a hodgepodge of items in two
half trays and two quarter trays stowed upside
down. Snack foods, such as almonds, dried
apricots, butter cookies, candy-coated nuts,
candies, granola bars, peanut butter, and dried
beef, are stowed in the first tray. This "free-forall" food is available to anyone at any time and
tends to be very popular. The second tray of
volume A contains all the entry day weather
wave-off entrees. Unlike the menu food that is
packed by meals and itemized with labels, this
food is stuffed into the tray in a jumble.
Crewmembers are free to swap out their
planned meals during the mission with items
from this tray. The third and fourth trays hold
extra drink bags and beverages, straws,
condiments and utensils. The extra drink bags
are for drinking water. Drinking straws can be
removed from this tray and temporarily stowed

in the storage compartment of the galley for

easy access. Each crewmember is provided
with one set of utensils, which includes a knife,
fork, tablespoon, and a small pair of scissors, for
the entire flight.
About 6 months before a flight, crewmembers
attend a food tasting provided by the food
systems group (SF3) to sample and rate every
food and drink item, including reentry kits.
Several weeks later, crewmembers individually
meet with a dietitian to develop their personal
menus for the flight. Choices are based on the
crewmember's preferences from the tasting and
on the dietitian's nutritional and caloric
recommendation. Generally, the food supply is
more than adequate because about 30 to 50
percent of all the food manifested for flight
returns unopened. The food systems people
make a good effort to accommodate special
requests for favorite and ethnic foods.

Utensils

Vitamins

Salt, Pepper, and Toothpicks

Disinfectant Wipes
2.12-3

2. SYSTEMS
2.12 Galley/Food

USA007587
Rev. A

Food System Accessories

Accessories consist of gum and candy, vitamins,
disinfectant wipes, and the galley adapter. The
galley adapter is a removable piece of the galley
slide/adapter mechanism. The disinfectant wipes are
a COTS product that allow crewmembers to clean
their eating utensils. Each package contains 26
wipes and is fitted with Velcro patches that allow its
installation on the front of the galley. Packages are
stowed for launch and noted on the Consumables
Cue Card for replenishment, as needed.

Top of Tray

Reentry Kits
The reentry kits, also known as fluid loading
kits, contain either empty drink bags and salt
tablets, chicken consomm (drink) packets, or
Astroade packets (like Gatorade without sugar).
Crewmembers must consume a certain amount
of water and salt tablets, depending on their
body weight, prior to entry to aid in their
readjustment to one g.
Trays
The trays consist of a flat piece of aluminum with
magnets and Velcro patches for holding utensils,
food, and drink packets. Crewmembers either
can Velcro the trays to a wall (ceiling/floor) or
can strap the trays to one of their legs for use. The
strap on the bottom side has been modified so
that it fits over the right or the left thigh (not
both).

2. SYSTEMS
2.12 Galley/Food

2.12-4

Bottom of Tray

USA007587
Rev. A

2.13

system to compute the commands required to

transfer the vehicle from one position and
velocity to another, as well as to point the
vehicle at a specified target (Earth, Sun, another
orbiting vehicle, etc.). The state vector data are
also used by the ground controllers for monitoring the status of the onboard navigation
system. Information about the orbiter and
target state vectors is displayed to the crew on
the dedicated displays and GNC DPS displays.

GUIDANCE, NAVIGATION,
AND CONTROL (GNC)

CONTENTS
Description............................................
Navigation Hardware .........................
Flight Control System Hardware.......
Digital Autopilot ..................................
Operations.............................................
GNC Caution and Warning
Summary ....................................
GNC Summary Data............................
GNC Rules of Thumb ..........................

2.13-1
2.13-5
2.13-27
2.13-48
2.13-55
2.13-65
2.13-66
2.13-74

Description
Guidance is the computation of corrective actions to change from the navigation-determined
vehicle state to a required vehicle state. The
required state depends on particular mission
requirements, which usually specify a required
present state (e.g., a particular orbit) or an
objective (e.g., rendezvous at a point in space)
from which the present required state can be
computed.
Navigation is the determination of the state of
motion of the vehicle; i.e., position, velocity,
and attitude. This state is determined with
reference
to
some
mission-dependent
coordinates suitable for defining the motion of
the vehicle.
Control is the application of corrective maneuvers to obtain the changes commanded by guidance. Flight control for the orbiter converts
guidance computations into effector commands
to point and translate the vehicle. Control software frequently uses navigation data to determine the effectors used and the appropriate
system control gains.
State Vector
The basic function of the orbiter navigation
system is to maintain an accurate estimate of
the inertial position and velocity of the vehicle,
called its state vector, with respect to time. In
addition, during a rendezvous mission, the
navigation system must maintain an estimate of
a target's position and velocity. This information is then used by the onboard guidance

The navigation system tracks the orbiter's position and velocity with six parameters (X, Y, Z,
Vx, Vy, Vz) that define the state vector. A time
tag is also associated with this state vector. The
X, Y, Z components are the orbiter's position in
the Mean of 1950 (M50) coordinate system
measured in feet from the center of the Earth.
The velocity components are measured in feet
per second, and are also in the M50 coordinate
system. The time at which the state vector is
applicable is based on Greenwich mean time
(GMT).
The navigation system uses the standard
equations of motion along with the information
received from the inertial measurement units,
the navigation sensors, and the software models
of the forces acting on the orbiter (gravity, drag,
vents, etc.) to predict the components of the
state vector at each time value. This process is
called state vector propagation, a scheme in
which errors are inherent. The equations of
motion and the propagation technique are
approximations, as are the gravity, drag, and
vent models. In addition, the acceleration,
position, and range rate information received
from the inertial measurement units and the
navigation sensors is also prone to error. To
correct these errors, which increase with time,
the ground controllers periodically uplink a
new state vector or a delta to the current
onboard state based upon the more accurate
ground radar tracking data.
The release of OI-27 flight software (FSW)
began the process of replacing the orbiter
tactical air navigation (TACAN) system with a
global positioning system (GPS). GPS provides
the navigation system with an alternate source
of orbiter state vector data throughout the orbit
and entry phases of flight. Currently, there is a
mixed fleet of either triple-string GPS or triple
string TACAN with a single GPS receiver.

2.13-1

2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
OV-105 is the only vehicle that has triple-string
GPS installed. This section addresses both
triple-string TACAN and triple-string GPS
configurations.

WARNING
Control software uses state vector
information to select control effectors and
set control gains, especially during entry.
Large navigation errors can cause the
orbiter to depart controlled flight.

M50 Coordinate System

Starball Coordinate System

2. SYSTEMS

2.13-2

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Coordinate Systems
The position and velocity of the orbiter must be
uniquely defined in terms of an inertial coordinate system - a reference frame that is neither
rotating nor accelerating.
Such a system
ensures that the normal equations of motion are
valid. The onboard navigation system uses the
M50 inertial system.
However, some
computations are considerably simpler if
performed in other coordinate systems. For
example, when landing the orbiter, the position
of the vehicle relative to the runway is more
meaningful than its position in a coordinate
system fixed in space. Therefore, the onboard
navigation system uses a number of different
coordinate systems to simplify the various
inputs, outputs, and computations required.
These inputs and outputs can be expressed in
any coordinate system by using coordinate
transformations resident in the navigation
software.

1950 Cartesian system, generally called the M50

system. The M50 system is used to establish
and maintain the inertial position and velocity
of the orbiter during all flight phases. The X
axis points toward the mean vernal equinox (the
apparent point on the celestial sphere where the
Sun crosses the Earth's equator on its northward
journey) of the year 1950. The Z axis points
along Earth's mean rotational axis of 1950 with
the positive direction toward the North Pole.
The Y axis completes the right-handed system,
with the corresponding X-Y plane lying in the
plane of the equator. Note that this is an inertial
system and, although its origin is at the Earth's
center, the M50 system is completely
independent of the Earth's rotation.

All the coordinate systems referenced are righthanded Cartesian systems. These right-handed
systems have three mutually perpendicular axes,
sequentially ordered such that each axis satisfies
the application of the right-hand rule to the other
two axes (XYZ system: applying right-hand rule
to X-Y yields Z, to Y-Z yields X, and to Z-X yields
Y).
Body Axis Coordinate System
The body axis coordinate system maintains the
origin at the orbiter's center of mass with the
three axes stemming from that point. The X axis
is parallel to the Xo axis of the orbiter structural
body (orbiter + external tank + solid rocket
boosters) and lies in the orbiter plane of
symmetry. The positive direction is toward the
nose. The Z axis lies in the orbiter plane of
symmetry and is perpendicular to the X axis.
The positive direction is opposite the payload
bay. The Y axis completes the right-handed
orthogonal system and points out of the right
wing. Note that vehicle pitch is a rotation about
the Y body axis, roll is a rotation about the X
body axis, and yaw is a rotation about the Z body
axis.
M50 Coordinate System
The inertial coordinate system used by the
onboard navigation system is the Aries Mean of

Body Axis Coordinate System

Starball Coordinate System
The Starball coordinate system, a variation of
the M50 system, is described by rotating the
M50 system by 90 about the X axis. The
Starball orientation makes the pitch angle
equivalent to the right ascension and the yaw
angle
equivalent
to
declination,
thus
simplifying maneuvers to point at stars. This
coordinate system is seldom, if ever, used.
Local Vertical/Local Horizontal
Coordinate System
The local vertical/local horizontal (LVLH)
coordinate system is an orbiter-centered system.
The positive Z axis points toward the center of

2.13-3

2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
the Earth along the geocentric radial vector of
the vehicle. The positive Y axis points toward
the negative angular momentum vector of the
vehicle's orbit. The X axis completes the righthand rule with positive X along the vehicle's
direction of motion in the orbital plane. The
LVLH system allows the crew to see the attitude
of the orbiter in relation to the Earth's surface.
It is not an inertial system, because it rotates at
approximately 4 deg/min with respect to the
inertial frame.
Runway Coordinate System
For launch, landing, and Earth observation, it is
advantageous to know the orbiter's position and
velocity in coordinate systems fixed to the
Earth. These non-inertial systems are related to
the M50 system by transformations that depend

on time, Earth rotation rate, and the latitude

and longitude of the point of interest. The
runway coordinate system is a good example of
an Earth-fixed reference frame. The origin of
the system is placed at the runway center at the
approach threshold. The Z axis is normal to the
ellipsoid model through the runway centerline
and positive toward the center of the Earth. The
X axis is perpendicular to the Z axis and lies in a
plane containing the Z axis and the runway
centerline (positive in the direction of landing).
The Y axis completes the right-hand rule. Note
that A is the runway azimuth measured in the XY plane from true north to the positive X axis
(positive clockwise). The runway coordinate
system is used by navigation and the crew
during ascent, entry, and landing phases of
flight.

LVLH Coordinate System

Runway Coordinate System

2. SYSTEMS

2.13-4

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Guidance, Navigation, and Control Software

Control Modes

Guidance, navigation, and control (GNC)

software commands the GNC system to effect
vehicle control and to provide sensors and
controllers with the data needed to compute
these commands. The process involves three
steps:

The GNC system consists of two operational

modes: automatic and control stick steering
(CSS). In the automatic mode, the primary
avionics software system (PASS) essentially
allows the GPCs to fly the vehicle. The flight
crew may control the vehicle in the CSS mode
using hand controllers, such as the rotational
hand controller. In the CSS mode, flight crew
commands must still pass through and be issued
by the GPCs. There are no direct mechanical
links between the flight crew and the orbiter's
various propulsion systems or aerodynamic
surfaces. The orbiter is an entirely digitally
controlled, fly-by-wire vehicle.

1.

Navigation tracks the vehicle's actual

location.

2.

Guidance equipment and software

compute the orbiter location required
to satisfy mission requirements.

3.

Flight control transports the orbiter to

the required location.

During launch and ascent, most of the GNC

commands are directed to gimbal the three
SSMEs and two SRBs to maintain thrust vector
control. The GNC software also controls SSME
burns for maximum aerodynamic loading of the
vehicle during ascent, referred to as max q. To
circularize the orbit and perform on-orbit and
deorbit maneuvers, the GNC software commands the orbital maneuvering system (OMS)
engines. At external tank separation, on orbit,
and during portions of entry, GNC controls
commands to the reaction control system (RCS).
In atmospheric flight, GNC controls the orbiter
aerodynamic flight control surfaces.
Guidance, Navigation
and Control Hardware
GPS

TACAN
MLS
Rendezvous
radar
Air data
probes

Star tracker

COAS
Radar
altimeter*

The navigation system uses measurements from

onboard sensors to improve its estimate of the
state vector. These sensors and the physical
data they sense include:
Inertial measurement unit (IMU) -Senses vehicle attitude in inertial space
and accelerations along inertial axes.
Star trackers -- Sense vehicle line of sight
vectors to stars or orbiting target.

GNC Software

Earth-relative position and velocity

Earth-relative position

Earth-relative position

Position and rates

Altitude
Attitude/accelerations

IMU

Navigation Hardware

GN&C
hardware
sensor
data
processing

Positio n,
velocity,
attitude
data
Accelerations

Navigation

Position,
velocity,
attitude
parameters

Guidance

Alignment commands

COAS
IMU
MLS
TACAN
GPS

Alignment commands

Inertial orientation

- Crew optical alignment sight

- Inertial measurement unit
- Microwave landing system
- Tactical air navigation
- Global positioning system

Altitude

* Not used by Navigation

454

Navigation Interfaces
2.13-5

2. SYSTEMS

2.13 Guidance, Navigation, And Control (GNC)

USA007587
Rev. A
Crew optical alignment sight (COAS) -Allows the crew to visually align the
vehicle line of sight to stars or orbiting
targets. The head-up display (HUD)
test pattern also allows the crew to
align the vehicle line of sight to the
stars. The HUD serves as the backup
to the star trackers.

commands into control surface, engine gimbal

(thrust vector control), and RCS jet fire
commands.

Tactical air navigation (TACAN) -Senses vehicle position with respect to a

ground-based TACAN station.
Air data system -- Senses air temperature and pressure in free stream and
air disturbed by vehicle.

2011/

Microwave landing system (MLS) -Senses vehicle position with respect to

ground stations alongside the landing
runway.
Radar altimeters (RA) -- Senses vehicle
altitude above the ground.
GPS - Senses satellite ranging signals to
determine position and velocity.
NOTE
Radar altimeter altitude is not used for
navigation or guidance. The information
is displayed for the crew to monitor.
Each piece of navigation hardware is hard-wired
to one of eight flight-critical multiplexer/demultiplexers (MDMs) connected to each of five GPCs.
Several navigation system parameters can be
monitored at the lower right-hand corner of the
GNC SYS SUMM 1 display (DISP 18).
Inertial Measurement Units
There are three IMUs on the orbiter. Each
contains three accelerometers and two two-axis
gyros mounted on an inertially stabilized fourgimbal platform. The IMUs provide inertial attitude and velocity data to the GNC software
functions. Navigation software uses the processed IMU velocity and attitude data to
propagate the orbiter state vector. Guidance uses
the attitude data, along with the state vector from
the navigation software, to develop steering
commands for flight control. Flight control uses
the IMU attitude data to convert the steering
2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

2.13-6

/018

RCS
JET ISOL
MANF FAIL VLV
F1
OP
2
OP
3
OP
4
OP
5
OP
L1
OP
2
OP
3
OP
4
OP
5
OP
R1
OP
2
OP
3
OP
4
OP
5
OP

GNC SYS SUMM 1

SURF
L OB
IB
R IB
OB
AIL
RUD
SPD BRK
BDY FLP

POS

MOM

1 000/02:46:03
000/00:00:00
DPS
GPC
MDM FF
FA

1 2 3 4 5

FCS CH 1 2 3 4

NAV
1 2 3 4
IMU
ACC
RGA
TAC
MLS
ADTA

CNTLR 1 2 3
RHC L
R
A
THC L
A
SBTC L
R

usa007587_203r1.cvx

GNC SYS SUMM 1 Display

(Three-String TACAN Vehicles)
2011/

/018

RCS
JET ISOL
MANF FAIL VLV
F1
OP
2
OP
3
OP
4
OP
5
OP
L1
OP
2
OP
3
OP
4
OP
5
OP
R1
OP
2
OP
3
OP
4
OP
5
OP

GNC SYS SUMM 1

SURF
L OB
IB
R IB
OB
AIL
RUD
SPD BRK
BDY FLP

POS

CNTLR 1 2 3
RHC L
R
A
THC L
A
SBTC L
R

MOM

1 000/02:46:03
000/00:00:00
DPS
GPC
MDM FF
FA

1 2 3 4 5

FCS CH 1 2 3 4

NAV
1 2 3 4
IMU
ACC
RGA
GPS
MLS
ADTA

usa007587_203ar1.cvx

GNC SYS SUMM 1 Display

(Three-String GPS Vehicles)

USA007587
Rev. A
displacement is measured by a pick-off device,
which generates an electrical signal that is
proportional to the sensed acceleration. This
signal is amplified and returned to a torquer
within the accelerometer, which attempts to
reposition the mass to its null position.
The acceleration data measured by the
accelerometers are the primary sources for the
three position and three velocity components of
the state vector used during ascent and entry.
On orbit, a sophisticated drag model is
substituted for IMU velocity information,
except during large vehicle accelerations.
During large on-orbit accelerations, IMU
velocity data are used in navigation
calculations.
Inertial Measurement Units
Although flight could be accomplished with
only one IMU, three units are installed on the
orbiter for redundancy. The IMUs are mounted
on the navigation base, which is located inside
the crew compartment flight deck forward of
the flight deck control and display panels. The
base provides a platform on which the IMUs
can be repeatedly mounted with great accuracy,
enabling the definition of transformations that
relate IMU reference frame measurements to
any other reference frame.
The IMU consists of a platform isolated from
vehicle rotations by four gimbals. Since the
platform does not rotate with the vehicle, its
orientation remains fixed, or inertial, in space.
The gimbal order from outermost to innermost is
outer roll, pitch, inner roll, and azimuth. The
platform is attached to the azimuth gimbal. The
inner roll gimbal is a redundant gimbal used to
provide an all-attitude IMU, while preventing the
possibility of gimbal-lock (a condition that can
occur with a three-gimbal system and can cause
the inertial platform to lose its reference). The
outer roll gimbal is driven from error signals
generated by disturbances to the inner roll
gimbal. Thus, the inner roll gimbal will remain
at its null position, orthogonal to the pitch
gimbal.

The inertial sensors consist of two gyros, each

with two degrees of freedom, mounted on the
cluster platform. Angular motion about any
axis perpendicular to the spin axis causes
rotation about a third orthogonal axis, which is
electrically sensed. In response to this sensed
rotation, the appropriate gimbals are torqued to
null the gyro rotation. This gimbal torquing in
response to vehicle motion results in an
inertially stabilized platform. In addition, the
gyros may be pulse torqued (small angles) or
slewed (large angles) by software, which results
in gimbal torquing to position or reposition the
platform. Each gimbal has a coarse (one-speed
or 1X) resolver and a fine (eight-speed or 8X)
resolver. The resolver readouts are sent to the
data processing system, which determines the
gimbal angles, which in turn determine the
attitude of the orbiter.

The IMUs have three accelerometers, one on

each of the X, Y, and Z axes. The accelerometer
is basically a force rebalance-type instrument.
When the accelerometer experiences an
acceleration along its input axes, it causes a
pendulum
mass
displacement.
This
2.13-7

IMU Platform Assembly

2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
One gyro, the vertical gyro, is oriented so its
input axes are aligned with the X and Y
platform axes; its input axes provide IMU
platform roll and pitch stabilization.
The
second gyro is oriented so that one input axis
lies along the platform's Z axis, and the other
lies in the X-Y plane. This gyro, the azimuth
gyro, provides platform yaw stabilization with
the Z input axis, while the second input axis is
used as a platform rate detector for built-in test
equipment. Each gyro contains a two-axis pickoff that senses deflection of the rotating wheel.
The gyro also contains a pair of two-axis
torquers that provide compensation torquing
for gyro drift and a means to reposition the
platform.
The spin axis of a gyro is its axis of rotation.
The inertial stability of the spin axis is a basic
property of gyroscopes and is used in
stabilization loops, which consist of the gyro
pick-off, gimbals, and gimbal torquers. When
the vehicle is rotated, the platform also tends to
rotate due to friction at the gimbal pivot points.
Because the gyro casing is rigidly mounted to
the platform, it will also rotate. The gyro resists
this rotation tendency to remain inertial, but the
resistance is overcome by friction. This rotation
is detected by the pick-offs as a deflection of the
rotating gyro wheel. A signal proportional to
this deflection is sent to the gimbal electronics,
which route the signals to the appropriate
torquers, which in turn rotate their gimbals to
null the pick-off point. When the output is
nulled, the loop is closed.
Four resolvers in an IMU are used to measure
vehicle attitude. A resolver is located at one of
two pivot points between adjacent gimbals. The
IMU resolvers are electromechanical devices that
apply the principle of magnetic induction to
electrically measure the angle between two
adjacent gimbals. This electrical signal is then
transformed into a mechanical angle by the IMU
electronics.
The single gimbal angle measurements are used
to determine vehicle attitude.
Attitude
information is used by flight control for turn
coordination and steering command guidance.
An attitude director indicator (ADI) displays
attitude and navigation data.
Platform attitude can be reoriented by slewing
or pulse torquing. Slewing rotates the platform
2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

at a high rate (1.2 per second), and pulse

torquing rotates it very slowly (.007 per
second).
Platform reorientation relies on
another property of gyroscopes: precession. If
a force is applied to a spinning gyroscope, the
induced motion is 90 from the input force. In
each IMU, a two-axis torquer is located along
the input axes of both gyros. Commands are sent
to the torquers from the GPC to apply a force
along the input axes. The result is a deflection of
the gyro spin axis that is detected and nulled by
the stabilization loops. Because the gyro spin
axis is forced to point in a new direction, the
platform has to rotate to null the gyro outputs.
The three IMUs have skewed orientations: their
axes are not co-aligned and not aligned with the
vehicle axes. This is done for two reasons. First,
gimbaled platforms have problems at certain
orientations. Skewing ensures that no more than
one IMU will have an orientation problem for a
given attitude. Second, skew allows resolution of
a single-axis failure on one IMU by multiple axes
on another IMU since the possibility of multipleaxis failure is more remote. Skewing is also used
by redundancy management to determine which
IMUs have failures.

IMU Skew
Each IMU contains heaters, temperature
sensors, and built-in test equipment (BITE).
Very precise thermal control must be
maintained in order to meet IMU performance
requirements. The IMU thermal control system
consists of an internal heater system and a
forced-air cooling system. The internal heater
system is completely automatic and is activated
when power is initially applied to the IMU. It
continues to operate until the IMU is powered
down. The forced-air cooling consists of three

2.13-8

USA007587
Rev. A
continues to operate until the IMU is powered
down. The forced-air cooling consists of three
fans that serve all three IMUs. Each IMU fan is
controlled by an individual IMU FAN switch
located on panel L1. Only one fan is used at a
time; three are provided for redundancy.
Each IMU is supplied with redundant 28-volt
dc power through two separate remote power
controllers. The IMU 1, 2, and 3 power switches
are located on panels O14, O15, and O16. Loss
of one control bus or one main bus will not
cause the loss of an IMU.
Each IMU has two modes of operation, a
warmup/standby mode and an operate mode.
When an IMU switch is positioned to ON, the
IMU is powered in the warm-up/standby mode,
which applies power only to the heater circuits.
It takes approximately 8 hours from cold start for
the IMU to reach its operating temperature
range, at which time the IMU enters a standby
mode. A software command in GNC OPS 2, 3, or
9 transitions the IMU to the operate mode. To
mode the IMU to operate, the controlling GPC
sends the operate discrete to the IMU through the
flight forward MDM. The IMU, upon receiving
this command, initiates its run-up sequence.
The run-up sequence first cages the IMU, a
process of reorienting the IMU gimbals and
then mechanically locking them into place so
that the gyros may begin to spin. When the
IMU is caged, its platform orientation is known
when it becomes inertial. The caged orientation
is defined as the point at which all resolver
outputs are zero. Inner roll and azimuth must
always be at 90 angles to each other.

2.13-9

IMU FAN ON/OFF Switches on Panel L1

IMU 1 Power Switch on Panel O14

2. SYSTEMS
2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
and display flight parameters. During the
orbital flight phase, the IMUs provide GNC
software with attitude and accelerometer data.
On-orbit alignments are necessary to correct
platform
misalignment
caused
by
uncompensated gyro drift. During entry, IMU
operation differs only in the manner in which
accelerometer data are used by navigation.
The IMUs can be safely powered off from either
the warmup/standby mode or the operate
mode. A braking system is used to ensure that
the gyros have slowed to a stop.
The IMU software scheme is designed to select
the best data for GPC use and to detect system
failures.
This scheme is referred to as
redundancy management. IMU parameters can
be accessed using the IMU ALIGN display
(SPEC 21) and the GND IMU CNTL/MON
display (SPEC 104)(GNC OPS 9 only).

IMU 2 Power Switch on Panel O15

IMU 3 Power Switch on Panel O16

Once the IMU gimbals are caged, the gyros
begin to spin, and power is applied to the
remaining IMU components. When the gyros
have reached the correct spin rate, the
stabilization loops are powered, and the IMU
becomes inertial. At this time, the IMU returns
an in-operate-mode discrete to the GPC,
indicating that the run-up sequence is complete.
This process requires approximately 85 seconds.

IMU ALIGN Display (SPEC 21)

The IMUs are in operate by the time the flight

crew enters the vehicle before launch and remain
in that state for the duration of the flight, unless
powered down to minimize power consumption.
While in the operate mode, the IMU maintains its
inertial orientation and is used for calibration and
preflight, on-orbit, and entry alignments.
During ascent, the IMUs provide accelerometer
and resolver data to the GNC software to
propagate the state vector, determine attitude,
2. SYSTEMS

GND IMU CNTL/MON Display (SPEC 104)

(available in OPS 9 only)

2.13-10

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
In the event of an IMU dilemma, the IMU
caution and warning light on panel F7 will be
illuminated. (The light will not illuminate for a
redundancy management fail.) If temperatures
are out of limits or if BITE detects a failure, a
fault message (IMU BITE/T X) and SM ALERT
will be annunciated.
The accuracy of the IMU deteriorates with time.
If the errors are known, they can be physically
or mathematically corrected. Software based on
preflight calibrations is used to compensate for
most of the inaccuracy. The star trackers are
used to determine and correct additional errors.
The IMU subsystem operating program (SOP)
processes and converts the data from the IMUs.
The following computations are performed in
the IMU SOP: conversion of velocities to the
M50 coordinates; conversion of resolver outputs
to gimbal angles; computation of accelerations
for displays; performance of additional software
BITE checks; support of selection, control, and
monitoring of IMU submodes of the operate
mode; and computation of torquing commands,
based on the misalignment determined by the
star trackers or another IMU.
Typical
misalignments are due to gyro drifts.
Star Trackers
The star tracker system consists of the negative Y
axis tracker and the negative Z axis tracker. They
are located just forward and to the left of the
commander's plus X window in a well outside
the crew compartment, an extension of the
navigation base on which the IMUs are mounted.
The star trackers are slightly inclined off the
vehicle axes for which they are named. The star
trackers are used to align the IMUs onboard the
orbiter, as well as to track targets and provide
line-of-sight vectors for rendezvous calculations.
The GPC memory contains inertial information
for 100 stars in OPS 2 and 50 stars in OPS 3. The
stars are chosen for their brightness and their
ability to provide complete sky coverage.
The star trackers are oriented so that the optical
axis of the negative Z star tracker is pointed
approximately along the negative Z axis of the

orbiter, and the optical axis of the negative Y

star tracker is pointed approximately along the
negative Y axis of the orbiter.
Since the
navigation base provides the mount for the
IMUs and star trackers, the star tracker line of
sight is referenced to the navigation base and
the orbiter coordinate system; thus, the GPC
knows the star tracker's pointing direction and
its orientation with respect to the IMUs.
Each star tracker has a door to protect it during
ascent and entry. The doors are opened on orbit
to permit use of the star trackers. To enable the
star tracker doors to open, the STAR TRACKER
POWER -Y and -Z switches on panel O6 must
be positioned to ON. The STAR TRACKER
DOOR CONTROL SYS 1 and SYS 2 switches on
panel O6 control two three-phase ac motors on
each door. Positioning the SYS 1 switch to
OPEN controls motor control logic and drives
the -Y and -Z star tracker doors by
electromechanical actuators to the open
position. Limit switches stop the motors when
the doors are open and control talkback
indicators above the DOOR CONTROL
switches. Setting the SYS 2 switch to OPEN
controls
redundant
ac
motors
and
electromechanical actuators to open both doors.
Limit switches stop the motors when the doors
are open and control the same two talkback
indicators above the DOOR CONTROL SYS 1
and SYS 2 switches. Normally, both the SYS 1
and SYS 2 switches are used together to actuate
the star tracker doors.
Positioning the SYS 1 switch to CLOSE drives the
system 1 motors and closes the -Y and -Z doors;
the talkback indicators above the switches
indicate CL. Setting the SYS 2 switch to CLOSE
drives the system 2 motors and closes the -Y and Z doors; the talkback indicators above the
switches indicate CL.
The indicators are
barberpole when a door is between open and
closed. The door opening or closing time with
two motors is 6 seconds; with one motor, it is 12
seconds.
The OFF position of the SYS 1 or 2 switch
removes power from the corresponding motor
control logic circuitry.

2.13-11

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The star trackers are used to align the IMU inertial
platforms. A star tracker searches for, acquires,
and tracks stars whose approximate position is
determined by the IMUs. By knowing the
relationship of the star tracker to the orbiter and
the location of the star in space, a line-of-sight
vector from the orbiter to the star is defined. Two
such vectors define the orbiter inertial attitude.
The difference between the inertial attitudes
defined by the star tracker and the IMU is pro-

cessed by software and results in IMU torquing

angles. If either the IMU gimbals are physically
torqued or the matrix defining its orientation is
recomputed, the effects of the IMU gyro drift
are removed, and the IMU is restored to its
inertial attitude. If the IMU alignment is in
error by more than 1.4, the star tracker may be
unable to acquire and track stars. In this case,
the HUD must be used to realign the IMUs to
within 1.4; the star trackers can then be used to
realign the IMUs more precisely.

465

Star Trackers

2. SYSTEMS

2.13-12

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
suppress software. The bright object sensor
reacts to close the shutter before a bright object,
such as the Sun or Moon, can damage the star
tracker (the sensor has a larger field of view
than the star tracker shutter).
There are two types of star trackers used by the space
shuttle program, a solid state star tracker (SSST) or
an image dissector tube (IDT) star tracker.
Currently, there is a mixed fleet of star trackers
installed on the three orbiters. Each star tracker
contains an electronics assembly mounted on the
underside of the navigation base. The star
tracker itself does not move; the field of view is
scanned electronically. The star tracker may be
commanded to scan the entire field of view or a
smaller offset field of view (1 square) about a
point defined by horizontal and vertical offsets.
An object is tracked when the correct location is
sensed. Star tracker outputs are the horizontal
and vertical position within the field of view of
the object being tracked and its intensity.
There is no redundancy management for the
star tracker assemblies. They operate independently and can do the entire task. They can
be operated either separately or concurrently.

STAR TRACKER Controls and Talkbacks

on Panel O6
NOTE
The star tracker cannot be used if the IMU
alignment error is greater than 1.4
because the angles the star tracker is
given for searching are based on current
knowledge of the orbiter attitude, which
is based on IMU gimbal angles. If that
attitude is greatly in error, the star tracker
may acquire and track the wrong star.
In addition to aligning the IMUs, the star trackers
can be used to provide angular data from the
orbiter to a target. This capability can be used
during rendezvous or proximity operations.
The star tracker includes a light shade assembly
and an electronics assembly mounted on top of
the navigation base. The light shade assembly
defines the tracker field of view (10 square). Its
shutter mechanism may be opened manually by
the crew using an entry on the S TRK/COAS
CNTL display, or it can be opened and closed
automatically by a bright object sensor or target

The star tracker SOP supports the modes that

are commanded manually from SPEC 22 S
TRK/COAS CNTL: self-test, star track, target
track, break track, and term/idle. Self-test consists of software and hardware tests. In the star
track mode, the star tracker does an offset scan
search for the star, acquires it, and tracks it. The
star may be selected by the flight crew or GPC;
in either case, a field-of-view check is made.
Target track is the same as star track, but it
tracks a target. Threshold is independent of
target track. Break track forces the star tracker
to stop tracking a star or target and to perform a
search scan from the current location to track
the next target it acquires. In the term/idle
mode, the star tracker hardware continues
operation, but star tracker software processing
ceases. In addition, the star tracker SOP
maintains the star table. When a star tracker
has acquired and tracked a star, and the data
have passed software checks, the star
identification, time tag, and line-of-sight vector
are stored. The identification and time elapsed
since time tag are displayed in the star table.
When two or three stars are in the table, the
angular difference between their line-of-sight

2.13-13

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
vectors is displayed. The difference between
the star tracker and star catalog angular
differences is displayed as an error. The star
tracker SOP selects line-of-sight vectors of two
stars in the star table for IMU alignment and
outputs an ALIGN ENA discrete. The software
selects the star pair whose angular difference is
closest to 90, as long as the difference is between
35 - 145.
The flight crew may manually override the SOP
selection or clear the table if desired. The SOP
also determines and displays star tracker status.
Star tracker parameters are accessible to the crew
on the S TRK/COAS CNTL display (SPEC 22).

Crew Optical Alignment Sight

The COAS is an optical device with a reticle
focused at infinity projected on a combining
glass. The reticle consists of a 10-wide circle
with 1 marks. A light bulb with variable
brightness illuminates the reticle. The COAS
requires 115-volt ac power for reticle
illumination. The COAS is 9.5 by 6 by 4.3
inches and weighs 2.5 pounds.
The COAS can be used if IMU alignment is in
error by more than 1.4, rendering the star
tracker unable to acquire and track stars, but,
primarily, the HUD is used.
The COAS can be mounted at either the
commander's station to view along the +X axis
or next to the aft flight deck overhead starboard
window to view along the -Z axis. To use the
COAS or HUD, the flight crewmember must
manually maneuver the orbiter until the
selected star is in the field of view. The
crewmember then maneuvers the orbiter so that
the star crosses the center of the reticle or the "P"
in the HUD test pattern. At the instant of the
crossing, the crewmember enters a mark by
depressing the most convenient of the three
ATT REF pushbuttons located on panels F6, F8,
and A6U. At the time of the mark, software
stores the gimbal angles of the three IMUs. This
process can be repeated if the accuracy of the
star's centering is in doubt.
When the
crewmember feels a good mark has been taken,

S TRK/COAS CNTL Display (SPEC 22)

View into Star Tracker Cavity

2. SYSTEMS

2.13-14

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
the software is notified to accept it. Good marks
for two stars are required for an IMU
alignment. The separation between the two
stars should be between 60 and 120.

1103.cnv

ATT REF Pushbutton on Panel F6

COAS Reticle Pattern

By knowing the star being sighted and the HUD
or COAS's location and mounting relationship
in the orbiter, software can determine a line-ofsight vector from the HUD/COAS to the star in
an inertial coordinate system. Line-of-sight
vectors to two stars define the attitude of the
orbiter in inertial space. This attitude can be
compared to the attitude defined by the IMUs;
if an error exists, the IMUs can be aligned to the
correct orientation.
The COAS's mounting, relative to the
navigation base on which the IMUs are
mounted, is calibrated before launch. The
constants are stored in software, and COAS
line-of-sight vectors are based on known
relationships between the COAS line of sight
and the navigation base. These constants are
usually updated by the crew on orbit using a
calibration mode to mark on a star while the
IMUs are known to be correctly aligned. The
HUD is consistent and, generally, needs no
calibration.

1104.cnv

ATT REF Pushbutton on Panel F8

1112.cnv

ATT REF Pushbutton on Panel A6U

The COAS can also be used to visually track targets
during proximity operations or to visually verify
tracking of the correct star by the -Z star tracker.
COAS data processing is accomplished in the
star tracker SOP. This SOP accepts and stores
crew inputs on COAS location, star identification, or calibration mode, accepts marks, com-

2.13-15

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
putes and stores the line-of-sight vectors, enables IMU alignment when two marks have
been accepted, and computes, updates, and
provides display data. COAS parameters may
be accessed using the S TRK/COAS CNTL
(SPEC 22) display (lower right).
Tactical Air Navigation
The onboard TACAN units determine slant
range and magnetic bearing of the orbiter to a
TACAN or VHF omnirange tactical air
navigation (VORTAC) ground station.
The ground-based TACAN and VORTAC stations constitute a global navigation system for
military and civilian aircraft operating at L-band
frequencies (1 GHz). The TACAN unit includes
a transmitter, a receiver, and a data processor.
The data processor decodes the selected channel
and sends the frequency to the receiver.
Vehicles without the three-string GPS upgrade
are equipped with three TACANs that operate
redundantly. Each TACAN has two antennas,

one on the orbiter's lower forward fuselage and

one on the orbiter's upper forward fuselage.
The antennas are covered with thermal
protection system tiles. The three passivecooled TACANs are located in the orbiter crew
compartment middeck avionics bays.
The
onboard TACANs are used to obtain orbiter
position data from an external source during
entry.
TACAN's maximum range is 400
nautical miles (n. mi.). Each set is 7.62 inches
high, 7.62 inches wide, and 12.53 inches long
and weighs 30 pounds.
Each ground station has an assigned frequency
(L-band) and a three-letter Morse code identification. The ground station transmits on one of
252 (126X, 126Y) preselected frequencies
(channels) that correspond to the frequencies the
onboard TACAN sets are capable of receiving.
These frequencies are spaced at 63-MHz intervals.
The TACAN ground station beacon continuously transmits pulse pairs on its assigned frequency. The orbiter TACAN receivers pick up
these pulse pairs, and the TACAN data processors decode them to compute bearing. The on-

TACAN Operation
2. SYSTEMS

2.13-16

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
board TACAN sets detect the phase angle
between magnetic north and the position of the
orbiter with respect to the ground station. The
ground beacon is omnidirectional. When the
orbiter is over the ground station, or nearly so,
it is in a cone of confusion. Within this cone,
bearing is unusable.
Periodically, the onboard TACAN sets emit an
interrogation pulse that causes the selected
TACAN ground station to respond with
distance-measuring equipment pulses.
The
slant range (orbiter to ground station) is
computed by the onboard TACAN sets by
measuring the elapsed time from interrogation
to valid reply and subtracting known system
delays. As the orbiter approaches a ground
TACAN station, the range decreases. After a

course has been selected, the onboard TACAN

sets derive concise deviation data.
The TACAN range and bearing data are used to
update the state vector position components
during entry. Range and bearing data are also
displayed on the horizontal situation indicators
(see section 2.7 for description), as well as on
the GNC SPEC 50 HORIZ SIT display.
TACAN controls are located at the top of panel
O7. The TACAN 1,2,3 ANT SEL switches control antenna selection. In the AUTO position,
the onboard GPCs automatically select the best
antenna for that TACAN. The UPPER and
LOWER positions of the switches allow the
flight crew to manually select the upper or
lower L-band antenna.

Horizontal Situation Indicator

TACAN Switches and Thumbwheels on Panel O7

(Three-string TACAN Vehicles )

2.13-17

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Each TACAN also has a MODE rotary switch
on panel O7. The modes are OFF, receive
(RCV), transmit and receive (T/R), and GPC. In
the GPC mode, the onboard GPCs control
TACAN ground station channel selection
automatically, and both bearing and range are
processed by hardware and software. In the
T/R mode, both bearing and range are
processed by hardware and software, but
TACAN ground station channels are selected
manually
using
the
four
CHANNEL
thumbwheels for that TACAN on panel O7.
The first three thumbwheels (left to right) select
the channel (frequency), and the fourth selects
the X or Y. In the RCV mode, only bearing is
received and processed by the hardware; the
thumbwheels for that TACAN are used to select
the channel.
Approximately every 37 seconds, the selected
TACAN ground station transmits its three-letter
identification to the onboard TACAN. In order
for the Morse code identification to be verified
by the commander and pilot, TACAN ID audio
controls are located on panel O5 (designated

LEFT AUDIO) for the commander and panel O9

(designated RIGHT AUDIO) for the pilot. The
TACAN ID ON/OFF switch is positioned to
ON to receive the TACAN identification. The
TACAN ID 1, 2, 3 switch selects the onboard
TACAN that will transmit the TACAN identification code. VOLUME TACAN thumbwheels
on panels O5 and O9 control the volume setting
of the TACAN identification code to the commander and pilot.
During entry, when at least two available
TACANs lock on, TACAN range and bearing
data are used by navigation software to update
the state vector until microwave landing system
(MLS) acquisition at approximately 18,000 feet.
TACAN azimuth and range (TAC AZ, RNG)
are provided on the lower left side of the
HORIZ SIT display (SPEC 50). TACAN range
and bearing data cannot be used to produce a
good estimate of the altitude position
component, so navigation uses barometric
altitude derived from the air data system
probes, which are deployed by the fight crew at
approximately Mach 5.

TACAN Controls on Panel O5

TACAN Controls on Panel O9

2. SYSTEMS

2.13-18

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Global Positioning System
The GPS is a relatively new navigation tool to
the shuttle.
Because of the anticipated
decommissioning of TACAN stations by the
Department of Defense (DOD), shuttle program
officials decided to use GPS as the replacement
for TACANs, which had been a primary
navigational tool for entry.
The NAVSTAR GPS is a space-based radio
positioning navigation system that provides
three-dimensional position, velocity, and time
information to suitably equipped users
anywhere on or near the surface of the Earth.
The GPS constellation consists of 27 NAVSTAR
satellites, including 3 active on-orbit spares.
The satellites travel in 10,980 n. mi. orbits at
velocities of 14,500 km/hr for periods of 12
hours. These satellites are in six planes, each at
an inclination of 55 with respect to the equator.
NAVSTAR satellites and their support
equipment are financed by the DoD, but their
navigation signals are available free of charge to
anyone. The NAVSTAR satellite constellation
control center facility is located at Falcon Air
Force Base in Colorado Springs, CO.

HORIZ SIT Display (SPEC 50)

(TACAN Azimuth and Range
Three-String TACAN Vehicles)

HORIZ SIT Display (SPEC 50)

(Three-String GPS Vehicles)
If MLS is not acquired, TACAN data can be used
until an altitude of 1,500 feet. When runways
with MLS are acquired, MLS operation is
automatic. The flight crew is provided with the
controls and displays necessary to evaluate MLS
performance and take over manually, if required.
TACAN redundancy management consists of
processing and mid-value-selecting range and
bearing data. The three TACANs are compared
to determine if a significant difference is
detected. When all three TACANs are good,
redundancy management selects middle values
for range and bearing. If a fault is detected, the
SM ALERT light is illuminated, and a GPC
annunciated fault message occurs for the
applicable TACAN parameter.

The way a GPS receiver interacts with the

NAVSTAR satellites to determine position and
velocity is fairly straightforward. Each GPS
satellite repeatedly transmits a specific sequence
of codes. The receiver knows each satellites
code pattern, as well as what time a satellite is
supposed to transmit specific parts of the code.
After identifying a specific satellite (via codematching techniques), the GPS receiver
compares the time at which it received the
specific part of the code to the time at which the
satellite was supposed to have sent it. This time
delta directly corresponds to how far the
receiver is from the given satellite. For a
receiver to determine exactly where it is near
the Earth, it must make at least three such
measurements from three different satellites.
For the receiver to accurately measure the time
delta, it must have an extremely accurate
internal clock. Most receivers do not have an
atomic clock; therefore, a fourth measurement is
taken from another satellite to help the receiver
determine its clock bias and, thus, determine an
accurate state vector.

2.13-19

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Space Segm ent
Planned Constellations
6 planes
4 satellites per plane
55 incline

Uplink Data
- Satellite ephem eris
(position constants)
- Clock-correction factors
- Atm ospheric data
- Alm anac

Downlink Data
-

Coded range signals

Position inform ation
Atm ospheric data
Alm anac

Monitor
stations

User Segm ent

Ground
antenna

Master control
station

Control Segm ent

1086.cv5

GPS Operation
The NAVSTAR satellites transmit two separate
codes, one intended for U.S. military use (called
Y-code) and one for civilian use (called
coarse/acquisition (C/A) code). The major
difference between these two is that the military
code is encrypted and requires the military
receivers to have a special key to decipher the
transmitted messages. The orbiter receivers
contain the key necessary to use the encrypted
Y-code; accuracy is expected to be better than
110 ft. DoD is able to introduce noise into the
civilian code to provide less accurate solutions
to non-military users. This noise was removed
from the civilian signal in 2000, but could be
reinstated if the DoD determined it to be
necessary.
Starting with OV-105, the orbiter has three GPS
receivers that operate redundantly.
Each
receiver is equipped with two antennas, one on
the orbiters lower forward fuselage and one on
the upper forward fuselage. The antennas are
covered with thermal protection system tiles.
The satellite signals are received by the
antennas, amplified through a preamplifier, and
then routed through a combiner to combine the

2. SYSTEMS

signals from the upper and lower antenna pairs

into a single stream of data. From there, the
signals are transmitted directly to the associated
receiver for processing. The three convectioncooled GPS receivers are in the orbiter forward
avionics bays. Each receiver is 6.78 inches high
by 3.21 inches wide by 12.0 inches long; each
weighs 13 pounds and consumes 40 watts of
power.
Unlike air data and MLS, where navigation data
are used to update the onboard state vector, the
selected GPS vector completely replaces the
propagated vectors periodically during orbit
(OPS 2 and 8) and entry (OPS 602/603 and OPS
3). For example, during orbit, the FSW will
replace its propagated state vector with a
selected GPS vector every 90 minutes. This
vector will then be propagated forward by the
FSW for the next 90 minutes, using the nominal
FSW propagation techniques. GPS information
is displayed on the horizontal situation
indicators (HSIs) on panels F6 and F8, as well as
on the HORIZ SIT display (SPEC 50) and the
GPS STATUS display (SPEC 55).

2.13-20

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
measurements using the civilian codes. This is
a procedure that would be used in the event of a
non-U.S. landing to protect the key from being
obtained by unauthorized users. A permanent
switch guard prevents accidental movement of
this switch. All of the new GPS switches on
panel O7 will replace the existing TACAN
switches.
GPS 2
PRE AMPL
UPPER

SMOKE
DETN
BAY
1B/3A

CRYO
O2 HTR
TK 2
SNSR 2

FIRE
SUPPR
BAY 1

UTILITY
POWER
F1/M013Q

CABIN
dP/dT

N2
SUPPLY
2

FLOOD
RIGHT
LEFT
CNSL
CTR

ANNUNCIATOR
FWD
ACA 2/3

ACA 1

AFT
ACA 4/5

C
FREON
RAD CNTLR
1
2

ATM PRESS CONTROL

O2
N2 REG
O2/N2
CNTLR
XOVR
INLET
2
2
2

CABIN
RELIEF
A

GPS 2
PRE AMPL
LOWER

O15

CRYO
O2 HTR
TK 1
SNSR 1

CRYO O2 HTR
TK 1
TK 2
SNSR 2
SNSR 1

SMOKE DETN
L/R
BAY
FLT DK
2A/3B

O14 O15 O16

FREON
RAD CNTLR
1
2

GPS 1
PRE AMPL
LOWER
UPPER

N2
SUPPLY
1

GPS 3
PRE AMPL
UPPER
LOWER

O7

H2O
ALT
PRESS

HORIZ SIT Display (SPEC 50)

(Three-String GPS Vehicles)

SMOKE DETN
BAY
1A/2B

CABIN

O16

O14

FLIGHT DECK
LOOKING FWD

O7
GPS 3

GPS 2

GPS 1
PRE AMPL
UPPER
ON

ENCRYPT
ZEROIZE

OFF

PRE AMPL
UPPER
ON

ENCRYPT
ZEROIZE

OFF
NORMAL

PRE AMPL
UPPER
ON

ENCRYPT
ZEROIZE

OFF
NORMAL

NORMAL

LOWER
ON

POWER
ON

LOWER
ON

POWER
ON

LOWER
ON

POWER
ON

OFF

OFF

OFF

OFF

OFF

OFF

GPS Controls
(Three-String GPS Vehicles)

GPS STATUS Display (SPEC 55)

GPS hardware controls are located at the top of
panel O7.
GPS 1,2,3 PRE AMPL UPPER
(LOWER) switches provide power to each of the
antenna preamplifiers, with circuit breakers
located on panels O14, O15, and O16. Each
receiver has a POWER switch on panel O7 and
is powered through a single energy storage
system (ESS) bus/forward power controller
(FPC) combination. The ENCRYPT switches
located on panel O7 control the integrity of the
Y-code key within each receiver. In NORM, the
key is kept intact such that it can be used to
decode the Y-code signals being sent by the
NAVSTAR satellites. If this switch is moved to
the ZEROIZE position, the key will be erased
from the memory of the receiver and the
receiver will only be able to make

Unlike the classical redundancy management

(RM) schemes applied to other shuttle sensors,
the GPS uses a cyclic quality assessment (QA)
process that is more conducive to its
performance. Because of the nature of its
operation, whereby poor satellite coverage may
result in short periods of invalid data, it would
not be prudent to permanently remove a unit
from availability because of these questionable
periods.
There are four separate QA checks the software
will perform to determine the status of the data
from each receiver. These four checks include
each receivers estimate of the error in its own
navigation state (QA1), the difference between
each receivers state and the FSWs computed
state (QA2), the difference between each
receivers current state and its previous state
(QA3), and the differences between each
receiver and the other receivers (QA4). If the
FSW determines that one of the QA1, QA3, or

2.13-21

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
QA4 checks has failed, the associated receiver
will not be considered available to the selection
filter. A miscompare of the QA2 check does not
cause the receiver to be considered unavailable.
With three candidates available (three level) to
the selection filter, mid-value select (MVS) logic
is used to select a units state vector for
processing. With two candidates available (two
level), the candidate data are averaged. With
only one receiver available (one level), the
single GPS is selected. When no eligible GPS
candidates are available, the GPS selection filter
will propagate the last valid data for processing.
This vector will not be used to update the
onboard navigation state if it has been longer
than 18 seconds since the selection filter has had
valid GPS data.

temperature sensors are installed on each probe

and wired to an ADTA. The pressures and
temperatures sensed by the left probe are
connected by pneumatic tubing to ADTAs 1 and
3. Those sensed by the right probe are connected to ADTAs 2 and 4.

Air Data System

The air data system provides information on the
movement of the orbiter in the air mass (flight
environment). There are two air data probes,
one on the left and one on the right side of the
orbiter's forward lower fuselage.
During
ascent, on orbit, deorbit, and initial entry
phases, the probes are stowed inside the
forward lower fuselage. The air data probe is
covered by thermal protection system tiles
while in the stowed position. At Mach 5,
depending on mission requirements, the air
data probes are deployed. Each probe is 4.87
inches high, 21.25 inches long, 4.37 inches wide,
and weighs 19.2 pounds.
The air data system senses air pressures related
to
spacecraft
movement
through
the
atmosphere to update the navigation state
vector in altitude, provide guidance in
calculating
steering
and
speed
brake
commands,
update
flight
control
law
computations, and provide display data for the
commander's and pilot's flight instruments, and
various GNC displays. (The flight instruments
are detailed in Section 2.7.)
Each air data probe has four pressure-port sensors and two temperature sensors. The pressures sensed include static pressure and angleof-attack upper, center, and lower pressure.
The four pressures are sensed at ports on each
probe.
The probe-sensed pressures are
connected by a set of pneumatic lines to two air
data transducer assemblies (ADTAs). The two
2. SYSTEMS

2.13-22

2.13. Guidance, Navigation, and Control (GNC)

AIR DATA PROBE Switches on Panel C3

USA007587
Rev. A
Within each ADTA, the pressure signals are
directed to four transducers, and the temperature signal is directed to a bridge. The
pressure transducer analogs are converted to
digital data by digital-processor-controlled
counters. The temperature signal is converted
by an analog-to-digital converter. The digital
processor corrects errors, linearizes the pressure
data, and converts the temperature bridge data
to temperatures in degrees Centigrade. These
data are sent to the digital output device and
then to the onboard computers to update the
navigation state vector. The computers then
send the data for display on various GNC
displays and on the commander's and pilot's
flight instruments.

Each probe is independently deployed by an

actuator consisting of two ac motors connected
to a rotary electromechanical actuator. Each
probe is controlled by its AIR DATA PROBE
switch on panel C3. To deploy the air data
probes, the LEFT and RIGHT switches are
positioned to DEPLOY. The redundant motors
for each probe drive the probe to the deployed
position. When the probe is fully deployed,
limit switches remove electrical power from the
motors. Deployment time is 15 seconds for twomotor operation and 30 seconds for singlemotor operation.
The DEPLOY position
deploys the probe without electrical heaters; the
DEPLOY/HEAT position deploys the air data
probes with heaters powered.

The ADTA SOP uses ADTA data to compute

angle of attack, Mach number (M), equivalent
airspeed (EAS), true airspeed (TAS), dynamic
pressure (qbar), and barometric altitude (h).

The AIR DATA PROBE STOW LEFT and

RIGHT switches on panel C3 are used to stow
the probes.
The stow procedure includes
positioning the switches to ENABLE and
positioning the corresponding AIR DATA
PROBE switch to STOW. The AIR DATA
PROBE STOW INHIBIT position opens the ac
motor circuits, disables the stow, and protects
the microswitches.

The GPCs compare the pressure readings from

the four ADTAs. If all the pressure readings
compare within a specified value, one set of
readings from each probe is averaged and sent
to the software. If one or more pressure signals
of a set of probe pressure readings fail, the
failed set's data flow is interrupted, and the
software receives data from the other ADTA on
that probe. If both probe sets fail, the software
operates on data from the two ADTAs
connected to the other probe. The best total
temperature from all four ADTAs is sent to the
software.

The fault detection system illuminates the red

AIR DATA and BACKUP C/W ALARM lights
on panel F7, and illuminates the MASTER
ALARM. A fault also sounds the audible tone
and generates a fault message.
A communication fault illuminates the SM ALERT
light.

Air Data Probe

2.13-23

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Air D at a
Trans duc er As semblies

P robes

Data Processing S ystem

D ata/Stat us

MDM Data
FF1

A DTA
1

GPCs

Dep lo y/St ow
St atu s
Pressu r es

L ef t
P robe

A DTA Da ta/St atus

3

Flight In st rument s

MDM Data
FF3
Redundancy
Management

A DTA
2

Data/Status

MDM
FF2

Dat a

IDP

Subsytem
O perating
Program

DPS D ispl ays

De plo y/Sto w
Sta tus
P re ssur es

AD TA
4

Ri ght
Prob e

MDM Dat a
FF4

Data/St atus

ADTA Power
Air Dat a Probe (Deploy Heat/Deploy/Stow)

Pane l
Sw it ch es

Air Dat a Probe St ow (Enable/Inhibit)

IDP
FF

- Integrated Display Processor

- Fl ight Forw ar d
4 82 .cnv

Air Data System Functional Block Diagram

Microwave Landing System
The three onboard MLS units are airborne
navigation and landing aids with decoding and
computational capabilities. The MLS units
determine slant range, azimuth, and elevation
to the ground stations alongside the landing
runway. MLS is used during the approach and
landing flight phases.
When the channel
(specific frequency) associated with the target
runway approach is selected, the orbiter's
MLS units receive elevation from the glide
slope ground station and azimuth and slant
range from the azimuth/distance-measuring
equipment ground station.
The orbiter is equipped with three independent
MLS sets, each consisting of a Ku-band receiver
transmitter and decoder. Data computation
capabilities determine elevation angle, azimuth
angle, and orbiter range with respect to the MLS

2. SYSTEMS

ground station. The MLS provides the orbiter

highly accurate three-dimensional navigation
position information to compute state vector
components.
The three orbiter Ku-band
antennas are located on the upper forward
fuselage.
The three MLS and decoder
assemblies are located in the crew compartment
middeck avionics bays. Each MLS decoder
assembly is 8.25 inches high, 5 inches wide, 16.6
inches long, and weighs 17.5 pounds. The radio
frequency (RF) assembly is 7 inches high, 3.5
inches wide, 10.25 inches long, and weighs
6 pounds.
The ground portion of the MLS consists of two
shelters: an elevation shelter and an azimuth/distance-measuring equipment (DME)
shelter. The elevation shelter is located near the
projected touchdown point, and the azimuth/DME shelter is located at the far end of
the runway.

2.13-24

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Elevation beam
0 to 29 high
Plus or m inus 20 wide
Azimuth/DM E beam
Plus or m inus 13.5 wide
0 to 23 high
Slant range

Glide slope
ground
station

Elevation

Extended
runway
centerline

Azimuth

Runway
Azim uth/distancemeasuring equipm ent
ground station
483.cvs

Major Microwave Landing System

Decoder-receiver (3)
Control unit
and indicators
Distance-measuring
equipment transmitter (3)

Range interrogation
Range solicit and reply

Antenna (3)

Azimuth guidance
Elevation
RF monitor (3)
Elevation station (2)

Control cables
RF monitor (3)
Distance-measuring
equipment unit (2)

Azimuth station (2)

484.cvs

Major Microwave Landing System Components

and Radio Frequency Links

2.13-25

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The MLS ground station signals are acquired
when the orbiter is close to the landing site,
usually at an altitude of approximately 18,000
feet. Final tracking occurs at the approach and
landing interface at approximately 10,000 feet
altitude and 8 n. mi. from the azimuth/DME
station. (Refer to the Operations section for
further information on entry procedures.)
The MLS azimuth, elevation, and range data are
used to compute steering commands from
acquisition through landing and rollout.
The commander's and pilot's horizontal situation indicators display the orbiter's position
with respect to the runway. Elevation with
respect to planned glide slope is shown on the
glide slope indicator. The course deviation
needle displays azimuth information, and range
is displayed on a mileage indicator. Azimuth/
DME data are used during the landing rollout.
The three orbiter MLS sets operate on a
common channel during the landing phase.
The MLS ground station transmits a DME solicit
pulse. The onboard MLS receiver responds
with a DME interrogation pulse. The ground
equipment responds by transmitting a return
pulse. A decoder in the onboard MLS decodes
the pulses to determine range, azimuth, and
elevation. Range is a function of the elapsed
time between interrogation pulse transmission
and signal return. Azimuth pulses are returned
in pairs. The spacing between the two pulses in
a pair identifies the pair as azimuth and
indicates on which side of the runway the
orbiter is situated. Spacing between pulse pairs
defines the angular position from the runway
centerline. The spacing between the two pulses
in a pair identifies the pair as elevation, while
the spacing between pulse pairs defines the
angular position of the orbiter above the
runway.
Each RF assembly routes range, azimuth, and
elevation information in RF form to its decoder
assembly, which processes the information and
converts it to digital data for transmission to the
onboard GNC software via the MDMs.
Because the azimuth/DME shelters are at the
far ends of the runway, the MLS provides
useful data until the orbiter stops. Azimuth
data provide position in relation to the runway
2. SYSTEMS

centerline; the DME gives the distance from the

orbiter to the end of the runway.
Each MLS has an MLS ON/OFF power switch
and a CHANNEL (frequency) selection
thumbwheel on panel O8. Positioning the MLS
1, 2, or 3 switch to ON provides power to the
corresponding system. MLS 1 receives power
from main bus A, MLS 2 from main bus B, and
MLS 3 from main bus C. Positioning the
CHANNEL 1, 2, and 3 thumbwheels selects the
frequency (channel) for the ground station at
the selected runway for the corresponding MLS.

RADAR ALTIMETER Switches and MLS

Switches and Thumbwheels on Panel O8
Redundancy management selects range,
azimuth and elevation angles for processing
navigation data.
The three MLS sets are
compared to identify any significant differences
among them. When data from all three MLS
sets are valid, redundancy management selects
middle values from three ranges, azimuths, and
elevations. In the event that only two MLS sets
are valid, the two ranges, azimuths, and
elevations are averaged. If only one MLS set is
valid, its range, azimuth, and elevation are
passed for display. During fault detection, the
SM ALERT light is illuminated, and a GPC
annunciated fault message is shown.

2.13-26

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
SRB rate gyro assembly (SRB RGA) -Senses vehicle rotation rates about two
body axes during first stage ascent
before SRB separation.

Radar Altimeters
The two RAs onboard the orbiter measure absolute altitude from the orbiter to the nearest
terrain within the beam width of the orbiter's
antennas. The two independent RAs consist of a
transmitter and receiver antenna. The systems
can operate simultaneously without affecting
each other. The four C-band antennas are located
on the lower forward fuselage.
The two
receiver/transmitters are located in the middeck
forward avionics bays. Each radar altimeter
receiver/transmitter measures 3.13 inches high,
7.41 inches long, 3.83 inches wide, and weighs
4.5 pounds.

The following hardware provides manual

guidance commands:
Rotational hand controller (RHC) -Commands
rotational
rates
and
accelerations about a body axis.
Translational hand controller (THC) -Commands vehicle translations along a
body axis (orbit only).
Rudder pedal transducer assembly
(RPTA) -- Generates an electrical output
signal which is proportional to the
rudder pedal displacement.
During
glided flight, this signal controls the
position of the rudder. During rollout,
this signal is used for nose wheel
steering.

Each RA transmits a C-band (4,300 MHz

modulated at 8.5 kHz) pulse through its
transmitting antenna. The signal is reflected by
the nearest terrain, and the leading edge of the
return radar echo is locked on by the RA's
receiving antenna. The altitude outputs by the
RA are analog voltages, proportional to the
elapsed time required for the ground pulse to
return. The range output of the RA is from zero
to 5,000 feet. The RA may not lock on if large
pitch or roll angles are present.
The GPCs process the data for display on the
commander's and pilot's altitude tape and head
up displays (described further in Section 2.7)
from 5,000 feet. Two RADAR ALTIMETER
ON/OFF switches are located on panel O8. RA
data is not used as input to navigation; it is for
crew use only.

Speed brake/thrust controller (SBTC) -During ascent, commands SSME throttle

settings between 67% and 109% (PLT
only). During entry commands the
position of the speed brake (CDR &
PLT).
The following hardware responds to software
commands:
Ascent thrust vector control (ATVC) -Takes position commands generated by
the GPCs during powered flight and
converts them into position error
commands, which are then used to drive
the SSME and SRB nozzles.

Flight Control System Hardware

The flight control system (FCS) ascent and entry
hardware
provides
manual
guidance
commands to GNC software and responds to
effector commands from GNC software in order
to effect vehicle and trajectory control.
The following hardware includes
responsible for flight control data:

Aerosurface servoamplifier (ASA) -Takes position commands generated by

the GPCs during glided flight and
converts them into position error
commands, which are then used to drive
the aerosurfaces.

sensors

Accelerometer assembly (AA) -- senses

vehicle accelerations along two body
axes.
Rate gyro assembly (RGA) -- senses
vehicle rotation rates about three body
axes.

Each piece of FCS hardware is hardwired to one

of eight flight-critical MDMs connected to each
of the five GPCs by data buses. Each GPC is
assigned to command one or more data buses.

2.13-27

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
GN&C
Hardware
Crew
controllers

GN&C Software
Guidance

Commands

Auto steering
commands

Inertial
measurement
unit

Angles

Rate gyro
assembly

Rates

Accelerometer
assembly

Acceleration

Air data
transducer
assembly

Air Data

Aerosurface
commands

Manual
steering
commands

GN&C
hardware
sensor
data
processing

Engine-on
and gimbal
commands

GN&C
Hardware
GN&C
hardware
command
data
processing

Flight
Control

Attitude

Aerosurface
angle commands
Position
feedback

Rates

Engines
Engine-on
and gimbal
commands

Aerosurface
servoactuator

Accelerations
Air data parameters

486.cvs

Flight Control Interfaces

Accelerometer Assemblies
There are four AAs onboard the orbiter, each
containing
two
identical
single-axis
accelerometers. One senses vehicle acceleration
along the lateral (left and right) vehicle Y axis; the
other senses vehicle acceleration along the
normal (vertical) Z axis. The four AAs are
located in the crew compartment middeck
forward avionics bays 1 and 2. The AAs are
convection cooled.
The AAs provide acceleration feedback to the
FCS. These accelerations are used to augment
stability during first-stage ascent, aborts, and
entry, to relieve vehicle load during first-stage
ascent, and to compute steering errors for
display on the commander's and pilot's attitude
director indicators.
The lateral acceleration readings enable the FCS
to null side forces during both ascent and entry.
The normal acceleration readings augment
pitch control and indicate the need to relieve
normal loads. During the latter stages of entry,
the normal acceleration measurements provide
feedback for guidance to control pitch. (In
contrast, the accelerometers within the IMUs
measure three accelerations used in navigation
to calculate state vector changes.)
Each accelerometer consists of a pendulum
suspended so that its base is in a permanent
magnetic field between two torquer magnets. A
light beam passes through an opening in one of
2. SYSTEMS

the torquer magnets; photodiodes are located

on both sides of the other torquer magnet.
When acceleration deflects the pendulum
toward one photodiode, the resulting light
imbalance on the two photodiodes causes a
differential voltage. This voltage increases the
magnetic field on one of the torquer magnets to
rebalance the pendulum at an offset position
representing the sensed acceleration.
The
magnitude of the current required to
accomplish this is proportional to the
acceleration. The polarity of the differential
voltage depends on the direction of the
pendulum's movement, which is opposite the
direction of acceleration. The only difference
between the lateral and normal accelerometers
is the position in which they are mounted
within the assembly. When the acceleration is
removed, the pendulum returns to the null
position. The maximum output for a lateral
accelerometer is plus or minus 1 g; for a normal
accelerometer, the maximum output is plus or
minus 4 g's.
The accelerations transmitted to the forward
MDMs are voltages proportional to the sensed
acceleration. These accelerations are sent to the
GPCs, where an accelerometer assembly
subsystem operating program converts the
eight accelerometer output voltages to
gravitational units. This data is also sent to the
MEDS displays and attitude director indicator
during entry.

2.13-28

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The accelerometer assemblies provide failoperational redundancy during both ascent and
entry. The four assemblies employ an
interchangeable mid-value software scheme
(IMVS) to select the best data for redundancy
management and a reasonableness limit check
for failure detection. Software fault detection
will operate when all four AAs are operational
and will then detect the first failure and deselect
that accelerometer assembly. A caution and
warning message "RM FAIL ACC" is generated
to inform the flight crew of an accelerometer
failure. The RGA/ACCEL caution and warning
light on panel F7 is not supported.

Accelerometer 2 and 4 Power Controls on

Panel O15

Accelerometer 1 Power Control on Panel O14

Accelerometer 3 Power Control on Panel O16

Accelerometer 1 is powered from main bus A
through the ACCEL 1 circuit breaker on panel
O14. Accelerometer 2 is powered from main
bus B through the ACCEL 2 circuit breaker on
panel O15. Accelerometer 3 is redundantly
powered through the ACCEL 3 ON/OFF switch
on panel O16. Accelerometer 4 is redundantly
powered through the ACCEL 4 ON/OFF switch
on panel O15. The accelerometers are turned
off once on orbit and on again before entry.

2.13-29

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Orbiter Rate Gyro Assemblies
The orbiter has four RGAs. Each RGA contains
three identical single-degree-of-freedom rate
gyros so that each gyro senses rotation about
one of the vehicle axes. Thus, each RGA
includes one gyro sensing roll rate (about the X
axis), one gyro sensing pitch rate (about the Y
axis), and one gyro sensing yaw rate (about the
Z axis). These rates are the primary feedback to
the FCS during ascent, entry, insertion, and
deorbit. The FCS must have good rate feedback
in all three axes to maintain control.

Rate Gyro Assembly Location and

Rotation Axes
The RGAs are located on the aft bulkhead
below the floor of the payload bay. They are
mounted on cold plates for cooling by the Freon
coolant loops.

RGAs 1 and 4 prevent the loss of more than one

rate gyro assembly if main bus power is lost.
The RGAs are turned off on orbit, except during
flight control system checkout, to conserve
power. RGAs are reactivated during deorbit
prep, and prior to any transition to OPS 3, when
they are required for the transition DAP to
control vehicle attitude.
WARNING
A transition to OPS 3 with RGAs
off can result in loss of control.
The RGAs afford fail-operational redundancy
during both ascent and entry. Redundancy
management
software
employs
an
interchangeable mid-value scheme (IMVS) to
select the best data for flight control use and has
two methods of failure detection.
A
reasonableness limit fault detection operates
when all four RGAs are operational and then
detects the first failure and deselects that RGA.
The RGAs also have power failure fault
detection via a spin motor run detector (SMRD),
which will deselect any RGA that has lost
power up until only one RGA remains. A
caution and warning message, "RM FAIL RGA,"
is generated to inform the flight crew of an RGA
failure.

Each gyro has three axes. A motor forces the

gyro to rotate about its spin axis. When the
vehicle rotates about the gyro input axis, a
torque results in a rotation about the output
axis. An electrical voltage proportional to the
angular deflection about the output axis,
representing vehicle rate about the input axis, is
generated and transmitted through the flight aft
MDMs to the GPCs and RGA SOP. This same
voltage is used within the RGA to generate a
counteracting torque that prevents excessive
gimbal movement about the output axis. The
maximum output for roll rate gyros is 40 per
second; for the pitch and yaw gyros, the
maximum output is 20 per second.
The RGA 1, 2, 3, and 4 power switches are
located on panels O14, O15, O16, and O15
respectively. The redundant power supplies for
2. SYSTEMS

2.13-30

2.13 Guidance, Navigation, and Control (GNC)

RGA 1 Power Switch on Panel O14

USA007587
Rev. A
forward ring within the forward skirt near the
SRB-external tank attach point.
Similar to orbiter RGAs, each SRB RGA generates
an electrical voltage that is transmitted through
the flight aft MDMs to the GPCs and the SRB
RGA SOP. The SRB RGA SOP converts the eight
voltages representing a rate into units of degrees
per second. The maximum outputs for the SRB
RGAs are 10 per second. These rates are used
by the flight control system during first-stage
ascent as feedback to identify rate errors, which
are used for stability augmentation. The pitch
and yaw axes and a combination of rate, attitude,
and acceleration signals are blended to provide a
common signal to the SSMEs and SRB thrust
vector control during first stage. In the roll axis,
rate and attitude are summed to provide a
common signal to the engines and SRB thrust
vector control.

RGA 2 and 4 Power Switches on Panel O15

The compensated rate signals from the SRB RGA

SOP are sent to redundancy management
software, where the interchangeable mid-value
scheme (IMVS) selects the best data for flight
control use and a reasonableness limit check is
performed for failure detection. The reasonableness limit fault detection will operate when all
four SRB RGAs are operational and will then
detect the first failure and deselect that rate gyro
assembly. Unlike orbiter RGAs, SRB RGAs do
not have fault detection for power failures. In
addition, there is no crew insight into SRB RGA
fault detection.
RGA 3 Power Switch on Panel O16
Solid Rocket Booster Rate Gyro Assemblies
The SRB RGAs are used exclusively during
first-stage ascent as feedback to find rate errors
before SRB separation. There are two RGAs on
each SRB, each containing two identical singledegree-of-freedom rate gyros. These gyros
sense rates in the vehicle pitch and yaw axes
similar in function to the orbiter RGAs. Because
the SRBs are more rigid than the orbiter body,
these rates are less vulnerable to errors created
by structural bending.
They are thus
particularly useful in thrust vector control. The
two RGAs in each SRB are mounted on the

The SRB RGAs are commanded to null and

released from the flight control system 2 to 3
seconds before SRB separation; SRB yaw and
pitch rate data are then replaced with orbiter
RGA pitch and yaw data.
Rotational Hand Controller
There are three RHCs on the orbiter flight deck:
one at the commander's station, one at the
pilot's station, and one at the aft flight deck
station. Each RHC controls vehicle rotation
about the roll, pitch, and yaw axes. During
ascent, the commander's and pilot's RHCs may
be used to gimbal the SSMEs and SRBs. For
insertion and deorbit, the commander's and
pilot's RHCs may be used to gimbal the OMS
engines or to command the RCS jets.

2.13-31

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Each controller is triply redundant; thus, only
one good signal from a controller is required for
the controller to operate.
Each RHC has an initial dead band of 0.25 in
all three axes. To move the RHC beyond the
dead band, an additional force is required.
When the amount of deflection reaches a certain
level, called the soft stop, a step increase in the
force required for further deflection occurs. The
soft stop occurs at 19.5 in the roll and pitch
axes, and 9.5 to 10.5 in the yaw axis. The
mechanical hard stop is 24.3 in the roll and
pitch axes and 14.3 in the yaw axis.

Rotational Hand Controller

On orbit, the commander's, pilot's, and aft flight
station RHCs may be used to gimbal the OMS
engines and command RCS jets. In addition,
the commander's and pilot's RHCs may be used
to command RCS jets during the early portion
of entry, as well as to command the orbiter
aerosurfaces during the latter portion of entry.
The aft flight station RHC is used only on orbit.
Human factors dictate that an RHC deflection
produce a rotation in the same direction as the
flight crewmember's line of sight. A SENSE
switch on panel A6U selects the line-of-sight
reference, either -Z or -X, for the aft station RHC.
Several switches are located on the RHC.
Depressing the red button on the right engages
the backup flight system (BFS). The switch to
the left trims the RHC by biasing the pitch and
roll commands coming from the RHC. (The aft
RHC's trim switch is inactive.) The trigger
switch on each RHC is a push-to-talk switch
that enables voice transmission.
Each RHC contains nine transducers: three
transducers sense pitch deflection, three sense
roll deflection, and three sense yaw deflection.
The transducers produce an electrical signal
proportional to the deflection of the RHC.
Each channel is powered by a separate power
supply in its associated display driver unit.
2. SYSTEMS

Inputs from the RHCs to the FCS pass through a

redundancy management scheme and the RHC
SOP before they are passed to the aerojet digital
autopilot. The RHC SOP performs four key
functions. First, if an RHC is deemed bad,
through redundancy management, then all
commands from that RHC are set to zero. The
SOP is also responsible for compensating and
biasing the RHC commands, with the aft RHC
commands transformed according to the SENSE
switch position. Next the compensated and
transformed commands are summed, by axis, to
produce rotation commands for the flight
control software. Finally, the SOP sets discretes
to indicate if an RHC deflection is outside the
software detent or beyond the software softstop.
In a nominal mission, the flight crew can make
manual inputs using the RHC during every
major mode except terminal countdown.
During all phases except ascent, when an RHC
deflection exceeds the detent in an axis, the
RHC SOP downmodes the flight control system
from the automatic mode to control stick
steering (CSS) in the axis of deflection. (This is
referred to as hot stick downmode.) During
ascent, a CSS PITCH and/or ROLL/YAW
pushbutton indicator on panel F2 or F4 must be
depressed for manual inputs to be implemented
into the flight control system from the
commander's or pilot's RHC. On ascent, the
CSS light for the pushbutton indicator
illuminates, a CSS indicator appears on the
Ascent/Entry Flight Display (AFD), and control
is downmoded to CSS for all axes. On entry,
the CSS light and the AFD CSS indicator appear
for only the deflected axis that has downmoded.

2.13-32

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Rotational Hand Controller Mechanical Limits

When the flight crew commands three-axis
motion using the RHC, the GPCs process the
RHC and motion sensor commands.
The FCS interprets the RHC motions (fore and
aft, right and left, clockwise and counterclockwise) as rate commands in pitch, roll, and
yaw.
The flight control equations are
subsequently processed to provide control
response and stability. If conflicting commands
are given from more than one RHC, no
commands result.

CSS Pushbuttons on Panel

landing, the commander and pilot have twoaxis (bank and pitch only) capability.
Aerosurface deflection trim, in all three axes, is
controlled by the panel trim switches on panels
L2 and C3, while bank and pitch vehicle rate
trim is controlled with the trim switches on the
RHC. For a return-to-launch-site abort, both the
com-mander's and pilot's RHC have three-axis
capability during powered flight and two-axis
capability during gliding flight.

CSS Pushbuttons on Panel F2

During orbital flight, any one of the three stations can input three-axis control commands to
the flight control system. During entry and

The commander's RHC is powered when the

FLT CNTLR POWER switch on panel F7 is
positioned to ON. Similarly, the pilot's RHC
and the aft RHC are powered when the FLT
CNTLR POWER switches on panels F8 and
A6U are positioned to ON.

2.13-33

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Positive Deflections of the Rotational Hand Controller by Axis

RHC software redundancy management detects
malfunctions in roll, pitch, or yaw axes for all
three channels. The first malfunction detected
will deselect all axes in that channel. For a
second malfunction between the remaining two
channels, the RHC is put in dilemma and the
RHC SOP will no longer accept inputs from that
RHC. For any detected malfunction, caution
and warning generates an "RHC L," "RHC R,"
or "RHC A" message and illuminates the
corresponding LEFT RHC or R/AFT RHC light
on panel F7.
Translational Hand Controller
Signals from the THC in FCS command the RCS
jets on orbit. There are two THCs, one at the
commander's station and one at the aft flight
deck station. The commander's THC is active
during orbit insertion, on orbit, and during
deorbit. The aft flight deck station THC is
active only on orbit.
Each THC contains six three-contact switches,
one in the plus and minus directions for each
axis (+X, -X, +Y, -Y, +Z, -Z). Moving the

2. SYSTEMS

forward THC to the right closes three switch

contacts and commands translation along the
plus Y axis.
The aft THC is used when the crewmember is
looking out the rear or overhead windows. The
SENSE switch on panel A6U selects the line-ofsight reference along the -X or -Z axis of the
orbiter for the aft THC. The SENSE switch must
be in the -X position for aft windows and -Z for
the overhead windows for the aft THC
commands to be correctly transformed to give
the desired orbiter movement.
The THCs are used for manual control of
translation along the longitudinal (X), lateral
(Y), and vertical (Z) vehicle axes.
The redundant signals from the forward and aft
THC pass through a redundancy management
process and SOP before being passed to the
flight control system. If the forward and aft
THCs generate conflicting translation commands, no output translation command is
issued.

2.13-34

2.13. GUIDANCE, NAVIGATION, AND CONTROL (GNC)

USA007587
Rev. A

FLT CNTLR POWER Switch on Panel F6

Translational Hand Controller

2.13-35

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Positive Deflections of the Translational Hand Controller

1111.cnv

FLT CNTRL POWER and SENSE Switches

on Panel A6U

FLT CNTRL POWER Switches on Panel F8

2. SYSTEMS

2.13-36

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
THC software redundancy management detects
miscompares between the three channels for all
six directions of movement. The first miscompare detected deselects only that channel for
that direction. A second miscompare between
the remaining two channels puts that THC
direction in dilemma, so its commands are no
longer noted by flight control. For any detected
miscompare, caution and warning generates an
"SBTC/THC L" or "SBTC THC A" message.
The commander's THC is powered when the
FLT CNTLR POWER switch on panel F6 is
positioned to ON. The aft THC is powered
when the FLT CNTLR POWER switch on panel
A6U is positioned to ON.
Rudder Pedal Transducer Assembly
There are two pairs of rudder pedals, one pair
each for the commander and pilot.
The
commander's and pilot's rudder pedals are
mechanically linked so that movement on one
side moves the other side. When depressed, the
pedal moves a mechanical input arm in an
RPTA. The RPTA contains three transducers,
each generating an electrical signal proportional
to the rudder pedal deflection.

The rudder pedals command orbiter acceleration in yaw by positioning the rudder during
atmospheric flight. However, because the flight
control software automatically performs turn
coordination during banking maneuvers, the
rudder pedals are not operationally used during
glided flight. It is not until after touchdown
that the crew uses them for nose wheel steering
during rollout.
The RPTA SOP maintains many functions in processing the RPTA data. The RPTA SOP converts
the selected left and right commands from volts
to degrees and selects the larger absolute value of
the left and right commands for output to flight
control software after applying a deadband.
RPTA redundancy management software uses a
reasonableness limit check to detect a
malfunction among the three channels. When
the first malfunction is detected, that channel will
be deselected. A second malfunction between
the remaining two channels puts the RPTA in
dilemma and the RPTA SOP will set that RPTA
output to zero. There is no crew insight into
RPTA fault detection.
Depressing the upper portion of the rudder
pedals provides braking. Differential braking
may also be used for directional control during
rollout.

Rudder Pedal Transducer Assembly

2.13-37

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Speed Brake/Thrust Controller
There are two SBTCs, one on the commander's
left-hand side on panel L2 and one on the pilot's
left-hand side on panel C3. The SBTCs serve two
distinct functions. During ascent, the pilot's
SBTC may be used to throttle the engines.
During entry, either the commander's or pilot's
SBTC may be used to control aerodynamic drag
(hence airspeed) by opening or closing the speed
brake.
At the forward setting, the SSME thrust level is
the greatest, or the speed brake is closed.
Rotating the SBTC back decreases the SSME
thrust level or opens the speed brake.
Each SBTC contains three transducers that
produce a voltage proportional to the
deflection. Redundancy management uses a
mid-value select scheme (MVS) to determine
output. It also uses a reasonableness limit check
between the channels to detect failures. When
the first malfunction is detected, that channel
will be deselected.
A second malfunction
between the remaining two channels puts the
SBTC in dilemma and inputs from that SBTC
will no longer be accepted. For any detected
malfunction, caution and warning generates an
"SBTC/THC L" or "SBTC/THC R" message.
In the case of the engine thrust-level setting, the
top half (AUTO) of both SPD BK/THROT
pushbutton indicators on panels F2 and F4 are
illuminated nominally. Only the pilot's SBTC
can be enabled for manual throttle control. The
pilot depresses the TAKEOVER pushbutton on
the SBTC, causing the GPC throttle command to
be frozen at its current value. While depressing
the TAKEOVER button, the pilot moves the
SBTC to match the frozen GPC command.
Manual control is established when the SBTC
command matches within four percent of the
GPC command. When the match is achieved, the
pilot's SPD BK/THROT MAN pushbutton
indicator on panel F4 is illuminated, and the
AUTO light is extinguished on both panels F2
and F4. A manual throttle indicator also appears
on the Ascent/Entry Flight Display (AFD).

2. SYSTEMS

Speed Brake/Thrust Controller

At this point, the pilot will have manual control
of the throttles and the TAKEOVER pushbutton
is then released. If the TAKEOVER pushbutton
is released before a match is achieved, the
system reverts to GPC auto commands. Under
manual throttle command, depressing either or
both pushbutton indicators on panel F2 and F4
causes the system to revert to the GPC auto
commands. Transferring back to auto leaves
the throttle at the last-commanded manual
setting until a new command is issued.
On entry, if the speed brake mode is in
automatic, and the commander or pilot wishes
to control the speed brake manually,
momentarily depressing the TAKEOVER
pushbutton takes manual control of the speed
brake. The SPD BK/THROT MAN pushbutton
indicator will be illuminated on the side with
manual control and the AUTO lights will both
be extinguished.
A manual speed brake
indictor also appears on the AFD. The speed
brake is driven to the position currently
commanded by the SBTC. To place the speed
brake under software control, either or both
SPD BK/THROT pushbutton indicators on
panels F2 and F4 can be depressed, thus
illuminating the AUTO lights on both panels.

2.13-38

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The SBTC SOP converts the selected SSME
throttle command to a setting in percent and the
selected speed brake command from volts to
degrees. In addition, the SBTC SOP selects the
speed brake command from the SBTC whose
TAKEOVER button was depressed last. If both
TAKEOVER buttons are depressed simultaneously, the commander's SBTC is given control.
If redundancy management declares an SBTC
bad, the command is frozen.
The commander's SBTC is powered by the FLT
CNTLR POWER switch on panel F7 when
positioned to ON. The pilot's SBTC is powered
by the FLT CNTLR POWER switch on panel F8.
Body Flap Switches
There are two BODY FLAP switches, one on
panel L2 for the commander and one on panel
C3 for the pilot. Each switch is lever-locked and
spring-loaded to the AUTO/OFF position. The
UP and DOWN positions of each switch have
two power supplies from separate control
buses. In addition, each contact status is sent to
the data processing system via an MDM. The
switches provide manual control for positioning
the body flap for main engine thermal
protection and for pitch trim to reduce elevon
deflections during the entry phase.
Body flap control is initialized in its automatic
mode with both BODY FLAP AUTO

pushbutton indicators illuminated on panels F2

and F4. The body flap can be switched to its
manual mode by depressing either BODY FLAP
pushbutton. The white BODY FLAP MAN
pushbutton indicators will then illuminate,
indicating manual control of the body flap. To
regain automatic control, the BODY FLAP
pushbutton indicator on panel F2 or F4 is again
depressed, extinguishing the MAN light and
illuminating the AUTO light. The pushbutton
indicator is triply redundant.
Panel Trim Switches
Roll and pitch panel trim switches allow the
crew to actually move the aerosurfaces, whereas
the yaw panel trim switch inputs an
acceleration bias into the yaw channel.
The TRIM PANEL switches on panel F3 enable
control bus power to a set of three panel trim
switches.
The
dual-redundant
TRIM
RHC/PANEL switches on panel F3 provide
signals to the GPCs, prohibiting software
execution of the associated RHC and panel trim
switch inputs while in the INHIBIT position.
The ENABLE position permits the RHC and
TRIM PANEL switch to be used for trimming.
Six panel switches control roll, pitch, and yaw.
The switches, labeled ROLL TRIM, PITCH
TRIM, and YAW TRIM, are located on panel L2

BODY FLAP and SPD DK/THROT Pushbuttons on Panel F2

SPD BK/THROT and BODY FLAP Pushbuttons on Panel F4

2.13-39

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
for the commander and panel C3 for the pilot.
The commander's trim switches on panel L2 are
activated when the TRIM PANEL switch on the
left side of panel F3 is positioned to ON. The
pilot's trim switches on panel C3 are activated
when the TRIM PANEL switch on the right side
of panel F3 is positioned to ON.
The
corresponding TRIM RHC/PANEL switch must
be in ENABLE for roll, pitch, and yaw trimming
to take place. All the panel trim switches are
spring loaded to the OFF position.
RHC Trim Switches
The RHC trim switches bias the rate commands
coming from the RHC (up to 1.5 deg/sec in
pitch; up to 2.5 deg/sec in roll). The RHC trim
is active when the corresponding FLT CNTRL
POWER switch on panel F7 or F8 is ON and the
corresponding TRIM RHC/PANEL switch on
F3 is in ENABLE. Like the panel trim switches,
the RHC trim switches are spring loaded to the
OFF position.
Trim Switch RM
Both the panel trim and the RHC trim switches
have two contacts each. In the event of a
dilemma as a result of disagreeing contacts, the
resultant trim command in that axis is zero.
BODY FLAP and TRIM Switches on Panel C3

2. SYSTEMS

2.13-40

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

509.cnv

BODY FLAP and TRIM Switches on Panel L2

TRIM Switches on Panel F3

2.13-41

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Aerosurface Servoamplifiers
Vehicle control during atmospheric flight is
accomplished in the entry phase by deflecting
the seven aerosurfaces on the orbiter. Each
aerosurface is driven by a hydraulic actuator
controlled by a redundant set of electrically
driven servovalves. There are four of these
valves for each aerosurface actuator (except for
the body flap, whose three actuators do not use
servovalves and are instead hard-assigned to
the three hydraulic systems).
The servovalves are controlled by electronic
devices called aerosurface servoamplifiers
(ASAs). There are four ASAs located in aft
avionics bays 4, 5, and 6. Each ASA commands
one valve for each aerosurface. The ASA power
switches are found on panels O14, O15, and O16.
In addition to the command channels from the
ASAs to the servovalves, there are data
feedback channels to the ASAs from the
aerosurface actuators. These feedback channels
include position feedback signals and pressure
feedback signals. Each aerosurface has four
associated position feedback transducers that
provide a servoloop closure for each of the four
independent servoloops associated with the
aerosurfaces.

The path from an ASA to its associated

servovalve in the actuators and the path back
from the aerosurface feedback transducers to an
ASA is called a flight control channel. There are
four flight control channels for each
aerosurface.
Each of the four elevons located on the trailing
edges has an associated servoactuator for
positioning. Each servoactuator is supplied
with hydraulic pressure from the three orbiter
hydraulic systems. A switching valve is used to
control the hydraulic system that becomes the
source of hydraulic pressure for that
servoactuator. The valve allows a primary
source of pressure to be supplied to that
servoactuator.
If the primary hydraulic
pressure drops to around 1,200 to 1,500 psia, the
switching valve allows the first standby
hydraulic pressure to supply that servoactuator.
If the first standby hydraulic pressure drops to
around 1,200 to 1,500 psia, the secondary
standby hydraulic source pressure is supplied
to that servoactuator. The yellow HYD PRESS
caution and warning light is illuminated on
panel F7 if the hydraulic pressure of system 1, 2,
or 3 is below 2,400 psia. The red BACKUP C/W
ALARM light on panel F7 also illuminates.

Aerodynamic Surfaces and Associated Control Axes

2. SYSTEMS

2.13-42

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Aerosurface Servoamplifier

1113.cnv

ASA 1 Power Switch on Panel O14

ASA 3 and 4 Power Switch on Panel O16

ASA 2 Power Switch on Panel O15

Each elevon servoactuator receives command

signals from each of the four ASAs. Each
actuator is composed of four two-stage
servovalves that drive a modulating piston.
Each piston is summed on a common
mechanical shaft, referred to as the secondary
force-sum actuator.
The summed force
positions this power spool to control the flow of
hydraulic fluid to the actuator power ram, also
referred to as the primary actuator.
The
direction of ram movement is controlled, thus
driving the elevon to the desired position.
When the desired position is reached, the
secondary power spool moves to block the

2.13-43

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
hydraulic pressure to the hydraulically
operated ram, thus stopping the ram at that
position.

approximately Mach 2.5, the elevons have

reached a null position, where they remain.

If a problem develops within a servovalve, or it is

commanded to a position different than the
positions of the other three within an actuator,
secondary delta pressure (SEC P), measured for
that servovalve off the secondary force-sum
actuator, begins to rise. Once the secondary delta
pressure is at or above 2,025 psi for more than
120 milliseconds, the corresponding ASA sends
an isolation command to bypass that servovalve,
effectively removing it from operation.
The FCS CHANNEL yellow caution and
warning light on panel F7 is illuminated to
inform the flight crew of a bypassed servovalve.
Also, an "FCS CH X" caution and warning
message is generated, corresponding to which
FCS channel (1, 2, 3, or 4) had a bypassed
servovalve on one of its actuators. A red FCS
SATURATION caution and warning light on
panel F7 is illuminated if one of the four elevons
is set at more than +12 or less than -15. This
condition also generates an "FCS SAT POS"
caution and warning message, informing the
crew that elevon movement is becoming
saturated. The FCS SATURATION light is also
illuminated if any one of the four elevons has a
hinge moment greater than 80 percent and an
"FCS SAT MOM" message informs the crew that
the elevon loading is saturated and flight
control is marginal.
There are four FCS CHANNEL switches on
panel C3. Each has an OVERRIDE, AUTO, and
OFF position. The switch controls the channel's
automatic isolation capability for high SEC P
for the elevons, rudder, speed brake, and SRB
and SSME actuators. When an FCS CHANNEL
switch is in AUTO, the isolation capability
discussed above can take place. Moving the
switch to OVERRIDE and back to AUTO will
reset any isolated servovalves on that channel.
Leaving the switch in OVERRIDE will prevent
the auto isolation due to high SEC P from
taking place. When the switch is positioned to
OFF, that channel is bypassed on all actuators.
During ascent, the elevons are deflected to
reduce wing loads caused by rapid acceleration
through the lower atmosphere. In this scheme,
the inboard and outboard elevons are deflected
separately. By the time the vehicle reaches
2. SYSTEMS

FCS CHANNEL Switches on Panel C3

The rudder/speed brake, which consists of upper
and lower panels, is located on the trailing edge
of the orbiter's vertical stabilizer.
One
servoactuator positions the panels together to act
as a rudder; another opens the panels at the
rudder's flared end so it functions as a speed
brake.
The rudder and speed brake servoactuators
receive four command signals from the four
ASAs. Each servoactuator is composed of four
two-stage servovalves that function like those of
the elevons to drive a secondary force-sum
actuator or power spool. The exception is that
the rudder's power spool controls the flow of
hydraulic fluid to the rudder's three reversible
hydraulic motors; the speed brake's power
spool controls the flow of hydraulic fluid to the
speed brake's three reversible hydraulic motors.
Each rudder and speed brake hydraulic motor
receives hydraulic pressure from only one of the
orbiter's hydraulic systems as determined by
switching valves like those of the elevons.
The three rudder hydraulic motors provide
output to the rudder differential gearbox,
connected to a mixer gearbox that drives rotary
shafts. These rotary shafts drive four rotary
actuators, which position the rudder panels.
The three speed brake hydraulic motors provide
power output to the speed brake differential
gearbox, connected to the same mixer gearbox
as that of the rudder. This gearbox drives
rotary shafts, which drive the same four rotary

2.13-44

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
actuators involved with the rudder. Within
each of the four rotary actuators, planetary

gears blend the rudder positioning with the

opening of the speed brake.

If a problem occurs in one of the four rudder or

speed brake channels, the corresponding SEC
P transducer causes the corresponding ASA to
open an isolation valve, bypassing that
actuator's servovalve. The FCS CHANNEL
switches control the rudder and speed brake
channels the same way they control the elevons.
If two of the three hydraulic motors fail in the
rudder or speed brake, no servovalves are
bypassed; however, about half the design speed
output results from the corresponding gearbox.

commands are removed from the solenoid

valves. If the hydraulic system associated with
the hydraulic motor fails, the remaining two
hydraulic motors position the body flap, and
the HYD PRESS caution and warning light is
illuminated.

Three servoactuators at the lower aft end of the

fuselage are used to position the body flap.
Each is separately supplied with hydraulic
pressure from one of the three orbiter hydraulic
system and has a solenoid-operated enable
valve controlled by one of three ASAs. Note
that the fourth ASA is not used for the body
flap command, but it is still used for position
feedback. Each solenoid-operated enable valve
supplies hydraulic pressure from one orbiter
hydraulic system to two corresponding
solenoid-operated up and down pilot valves,
which are, in turn, controlled by one of the three
ASAs.
When one of the individual pilot valves receives
a command signal from its corresponding ASA,
it positions a common mechanical shaft in the
control valve, allowing hydraulic pressure to be
supplied to the hydraulic motors.
The
hydraulic motors are reversible, allowing the
body flap to be positioned up or down. The
hydraulic brake associated with each hydraulic
motor releases the hydraulic motor for rotation.
When the desired body flap position is reached,
the control valves block the hydraulic pressure
to the hydraulic motor and apply the hydraulic
brake. Each hydraulic motor provides the
power output to a differential gearbox, thus
driving a rotary shaft and four rotary actuators,
which position the body flap. Four rotary
position transducers measure the output of the
differential gearbox to provide position
feedback through all four ASAs to the flight
control system software.
There is no channel isolation capability for the
body flap. With the FCS CHANNEL switch in
OFF, the corresponding ASA's body flap

Each ASA is hardwired to a flight aft MDM.

Commands originate from guidance software or
from controllers. These inputs go to the flight
control software, where they are routed to the
ASAs. Several SOP functions associated with
the ASA commands and data include:
Converts elevon, rudder, and speed brake
commands produced by flight control
software from degrees to millivolts
Sets commands to body flap valves
based on an enable command from body
flap redundancy management and
up/down commands from flight control
Converts position feedback to degrees
for the elevons, rudder, speed brake,
and body flap
Computes body flap and speed brake
deflections as percentages
Calculates elevon and rudder positions
for display on the surface position
indicator
Monitors the FCS CHANNEL switches
and, if any are positioned to
OVERRIDE, sets the override command
for that ASA
Monitors hydraulic system pressures for
failures and limits aileron and elevator
commands according to the number of
failures
Isolation status of the FCS CHANNEL
servovalves is displayed on the GNC SYS
SUMM 1 display under FCS CH for all
actuators, and on the SPEC 53 CONTROLS
display in more detail for each aerosurface and
SSME actuator.

2.13-45

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

RHC comm ands

Orbiter
hydraulic
system

Crew
inputs
Po

we

Each actuator
uses two of the
three hydraulic
systems

Supply

Return

Override
commands

MPS
TVC
SOP

Flight
FCS

Flight aft
MDMs

ATVCs
SSM E
servoactuators

GPCs

ATCV
FCS
GPCs
MDM

Ascent thrust vector control

Flight control system
General-purpose computers
Multiplexer/dem ultiplexer

MPS
RHC
SOP
TVC

Main propulsion system

Rotational hand controller
Subsystem operating program
Thrust vector control

From other ATVC

channels

518

SSME Thrust Vector Control Interface Flow

Ascent Thrust Vector Control
The associated flight aft MDMs are also located
in the aft avionics bays.

Ascent Thrust Vector Controller

The orbiter ATVC portion of the FCS controls
attitude and trajectory directing the thrust of the
three main engines and two solid rocket
boosters during lift-off and first-stage ascent,
and of the main engines only during secondstage ascent.
ATVC is provided by four avionics hardware
packages that supply gimbal commands and
fault detection for each hydraulic gimbal
actuator. The packages are located in the three
aft avionics bays in the orbiter aft fuselage and
are cooled by cold plates and the Freon system.

2. SYSTEMS

The ATVC command flow starts in the GPCs, in

which the flight control system generates the
position commands, and terminates at the
SSME and SRB servoactuators, where the
actuators gimbal the nozzles in response to the
commands. All the position commands are
issued to the ATVC command SOP. This
program
processes
and
transmits
the
commands to their corresponding flight aft
MDMs. The commands are then separated and
distributed to the four ATVC channels, which
generate equivalent command analog voltages
for each command issued. These voltages are,
in turn, sent to one of four servovalves on a
servoactuator, commanding the SSME and SRB
hydraulic actuators to extend or retract, thus
gimbaling the nozzles to which they are
fastened.
Ten actuators respond to the command voltages
issued by four ascent thrust vector control
channels. Each FCS channel contains an ATVC
that has six SSME drivers and four SRB drivers.
Each actuator receives four identical command
voltages from four different drivers, each
located in one of the four ATVCs.
Both main engine and solid rocket booster
servoactuators consist of four independent,

2.13-46

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
two-stage servovalves that receive signals from
the drivers. The force of these four servovalves
is summed on a secondary force-sum actuator
or power spool, which positions an actuator
ram and thus the engine to control thrust
direction.
The four servovalves in each actuator provide a
force-summed majority voting arrangement to
position the power spool. With four identical
commands to the four servovalves, the
actuator's force-sum action prevents a single
erroneous command from affecting power ram
motion. If the erroneous command persists for
more than a predetermined time, differential
pressure measured off of the secondary forcesum actuator for that servovalve is sensed in the
corresponding ATVC, which activates an
isolation driver.
This driver energizes an
isolation valve that isolates the defective
servovalve and removes hydraulic pressure,
permitting the remaining channels and
servovalves to control the actuator ram spool,
provided the FCS CHANNEL 1, 2, 3, or 4 switch
on panel C3 is in the AUTO position. A second
failure would isolate the defective servovalve
and remove hydraulic pressure in the same
manner as the first failure, leaving only two
channels remaining.
Failure monitors are provided for each channel
on the GNC SYS SUMM 1 display and with the
yellow FCS CHANNEL and red BACKUP C/W
ALARM lights on panel F7 to indicate which
channel has a bypassed servovalve for any of
the MPS and/or solid rocket boosters. There is
more detailed crew information on precisely
which MPS actuator has a bypassed servovalve
on the SPEC 53 CONTROLS display. If the FCS
CHANNEL 1, 2, 3, or 4 switch on panel C3 is
positioned to OFF, then that ATVC channel is
isolated from its servovalves on all SSME and
solid rocket booster actuators. The OVERRIDE
position
of
the
switch
inhibits
the
corresponding ATVC from automatically
bypassing servovalves on that channel due to
high secondary delta pressure problems on the
power spool and provides the capability to reset
a bypassed servovalve on that channel.

The ATVC 1, 2, 3, 4 power switches are located

on panel O17. The ON position enables the
ATVC channel selected; OFF disables the
channel.

ATVC Power Switches on Panel O17

The SSME servoactuators change each main
engine's thrust vector direction as needed
during the flight sequence. Each main engine
has one pitch actuator and one yaw actuator.
The pitch actuator gimbals the engine up or
down a maximum of 10.5 from the installed
null position. The yaw actuator gimbals the
engine left or right a maximum of 8.5 from the
installed position. The installed null position
for the left and right main engines is 10 up
from the X axis and 3.5 outboard from an
engine centerline parallel to the X axis. The
center engine's installed null position is 16
above the X axis centerline for pitch and on the
X axis centerline for yaw. When any engine is
installed in the null position, the other engines
cannot collide with it.
Each SRB also has two thrust vector control
actuators. However, the SRB TVC coordinate
axes are called "rock" and "tilt" rather than pitch
and yaw. The rock and tilt axes form a 45
angle with the pitch and yaw axes. This allows
an equivalent 7 movement range in pitch and
yaw with a rock/tilt gimbal range of 5.

2.13-47

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

SSME and SRB Thrust Vector Control

The OMS provides propulsive control for
orbit insertion, orbit circularization, orbit
transfer, and rendezvous.

Digital Autopilot
The digital autopilot (DAP) is the heart of
flight control software. It is composed of
several software modules that interpret
maneuver requests, compare them to what
the vehicle is doing, and generate commands
for the appropriate effectors.
There are
different DAPs for different flight phases,
particularly insertion and orbit, and various
modes and submodes within each.

Orbital DAP Panel

There are 24 ORBITAL DAP pushbutton
indicators on panels C3 and A6U. Assuming
no electrical, computer, or hardware failures
affect the operation of the indicators, inputs
made to one panel are reflected in the
configuration of the other panel. All the
pushbuttons are active in the Orbital DAP,
whereas only a subset are operational in the
Transition DAP or when the backup flight
system is engaged. None of the indicators are
operational during ascent or entry. As with
other aft flight-deck controls, aft panel A6U
pushbutton indicators (PBIs) are only
supported in OPS 2.

The DAP controls the orbiter in response to

automatic or manual commands during
insertion and on orbit. The effectors used to
produce control forces and moments on the
orbiter are the two OMS engines and the 38
primary RCS jets. Six vernier RCS jets are
also available on orbit for attitude control.
The forward and aft RCS jets also provide
attitude control and three-axis translation
during external tank separation, insertion,
and on-orbit maneuvers, as well as roll
control for a single-OMS-engine operation.
2. SYSTEMS

A discussion of the various pushbuttons

follows:
2.13-48

2.13. Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
maintain the attitude and attitude rates within
the deadbands specified on the DAP CONFIG
display.
In CONTROL INRTL, the orbiter is in inertial
attitude hold (a fixed orbiter attitude relative to
an inertial reference), and in CONTROL LVLH
the orbiter is in LVLH hold (a fixed orbiter
attitude relative to the Earth). The ROTATION
DISC RATE pushbutton indicators must be
illuminated for INRTL or LVLH to hold
attitude.
The CONTROL FREE PBI puts the Orbital DAP
into free drift. In this mode, the ROTATION
PULSE pushbutton indicators will illuminate,
and RCS jets will not fire if the RHC and THC
remain in detent.
1116.cnv

ORBITAL DAP Pushbuttons on Panel C3

(Panel A6U identical)

The first row of the MANUAL MODE

TRANSLATION pushbuttons control which of
the +Z (up firing) jets will fire. Nominally, none
of the pushbutton indicators are illuminated,
and the "normal" number of up firing jets will
be commanded to fire.
If the LOW Z
pushbutton indicator is depressed, Orbital DAP
will never command an up firing jet to fire.
This mode is used to protect a payload or
crewmember that is operating close to the
orbiter.
In HIGH Z, all the up firing jets will be
commanded to fire if a +Z translation is
commanded with the THC. All other Orbital
DAP maneuvers will result in the "normal"
number of up firing jets to fire. This mode is
used to quickly separate the orbiter from a
payload.

DAP CONFIG Display (SPEC 20)

The SELECT (A or B) PBIs toggle the Orbital
DAP between one of two configurations. These
configurations are changed and displayed on
the DAP CONFIG display (SPEC 20).
The CONTROL PBIs toggle the Orbital DAP
between AUTO, INRTL, LVLH, and FREE. In
AUTO the orbiter's attitude is controlled by
universal pointing (UNIV PTG) or orbit burn
guidance. In this control mode, the Orbital
DAP will rotate the orbiter about the shortest
angle to the desired attitude. The rate of
rotation is determined by ROT RATE items on
the DAP CONFIG (SPEC 20) display. Once in
attitude, the Orbital DAP will fire jets to

The second and third rows of MANUAL MODE

TRANSLATION pushbuttons toggle the Orbtial
DAP between NORM and PULSE. In NORM,
RCS jets will be continuously commanded to
fire if the THC is moved out of detent. In
PULSE, Orbital DAP will fire RCS jets to
achieve the TRANSLATION PULSE rate
specified on the DAP CONFIG display. The
PULSE units are feet per second.
The first row of the MANUAL MODE
ROTATION portion of the DAP panel toggles
the Orbital DAP between primary (PRI),
alternate (ALT), and vernier (VERN). In PRI,
one or more of the primary RCS jets will be
continuously commanded to fire if either the

2.13-49

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
attitude or attitude rate deadbands are
exceeded. This mode will not be used for many
different RMS and payload operations.
In ALT, the primary RCS jets are still used, but
the number of jets, duration of firings, and time
between firings can be controlled on the DAP
CONFIG display. This extra control of jet
firings greatly reduces the stress on a payload
and the RMS. The ALT mode allows almost
unrestricted payload and RMS operations if the
vernier jets are not available. In ALT mode, the
Orbital DAP also determines the best jet(s) to
fire based on the combined orbiter/payload
moments of inertias. These inertias are selected
with CNTL ACCEL (item 14) on the DAP
CONFIG display.
In VERN, the Orbital DAP uses the six vernier
RCS jets for attitude control. Vernier control
produces less stress on the RMS/payload, uses
less propellant, and can achieve tighter
deadbands than either PRI or ALT. Like the
ALT mode, the best jet(s) to use are determined
by the orbiter/payload moments of inertias.
The second and third rows of the ROTATION
pushbutton indicators toggle the Orbital DAP
between discrete rate (DISC RATE) and PULSE.
For these rows to have any effect, the ORBITAL
DAP CONTROL must not be in AUTO. In
DISC RATE, if the RHC is taken out of detent,
the Orbital DAP will fire RCS jets to achieve
and maintain the rate specified by the ROT
RATE in the DAP CONFIG display. If the RHC
is in detent, the Orbital DAP will fire jets to
maintain either INRTL or LVLH attitude hold,
depending on the selection of the ORBITAL
DAP CONTROL pushbutton indicators.
In ROTATION PULSE, moving the RHC out of
detent commands a pulse of jet firings to
increase the rotation rate by the ROT PLS rate
specified on the DAP CONFIG display. When
the RHC is in detent, the Orbital DAP is in free
drift for that axis. Pushing the CONTROL
FREE pushbutton indicator is functionally
equivalent to pushing all three ROTATION
PULSE pushbutton indicators.
Continuous rotation RCS jet firings can be
obtained by moving the RHC past the soft stop.
This continuous firing of jets can be obtained in
2. SYSTEMS

either DISC RATE or PULSE.

Even if
CONTROL is in AUTO, moving the RHC out of
detent will force the Orbital DAP to INRTL, and
further movement past the soft stop will cause
continuous jet firings.
Transition DAP
The Transition DAP is used from MECO until
transition to OPS 2, and then again in MM 301303.
At MECO, the Transition DAP first becomes
active, firing RCS as needed to null out any
residual rates. External tank separation is
automatically commanded about 20 seconds
after MECO. Here, the Transition DAP sends
commands to fire the orbiter's down firing RCS
jets, causing the orbiter to translate in the -Z
direction. When a rate of 4 feet per second is
reached, RCS commands are removed.
Insertion flight control is also accomplished
with the Transition DAP. The Transition DAP
uses commands from the guidance software for
automatic maneuvers to the OMS burn attitude
using RCS jets. During the OMS-2 burn (and
OMS-1 burn, if required), the Transition DAP
uses the OMS engines thrust vector control and
RCS jets, as needed. The Transition DAP also
receives commands from the commander's THC
and the commander's or pilot's RHC. The
Transition DAP then takes these commands and
converts them into appropriate RCS or OMS
TVC commands. The Transition DAP monitors
the resultant attitude and attitude rates and
sends
the
necessary
commands
to
achieve the desired attitude and attitude rate
within premission-specified deadbands.
The flight crew interfaces directly with the
Transition DAP through the forward RHCs and
THC and indirectly through entries to the OMS
MNVR EXEC display and the ORBITAL DAP
pushbuttons on panel C3.
In the Transition DAP, the commander's THC is
active and totally independent of the DAP
pushbuttons or RHC position or status.
Whenever the commander's THC is out of
detent in either plus or minus X, Y, or Z,
translation acceleration commands are sent
directly to the RCS jet selection logic for

2.13-50

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
continuous RCS jet firing.
Rotational
commands may be sent simultaneously with
translation commands within the limits of the
RCS jet selection logic. For example, if both
plus X and minus Z translations are
commanded simultaneously, plus X translation
receives priority.
For rotations, the flight crew can select either
automatic or manual control via the ORBITAL
DAP CONTROL pushbutton indicators (AUTO,
INRTL) or manual control by moving the RHC
out of detent. In INRTL, the capability exists to
rotate about any axis in one of two modes.
When the ROTATION PULSE mode is selected,
each RHC deflection results in a single burst of
jet fire. In DISC RATE mode, RHC deflection
results in a specified rate being commanded in
that axis for the entire time the RHC is
deflected. A free-drift mode (INRTL/PULSE) is
also available in which no RCS jets are fired, or
an attitude-hold mode, in which the Transition
DAP sends commands to maintain the current
attitude with null rates within premissionspecified deadbands. Also, if the RHC is
deflected beyond the soft stop, continuous RCS
jet firings result. In translation, movement of
the THC results in continuous jet firings. Pulse
translation mode is not available in the
Transition DAP.
The Transition DAP also involves maintaining
the OMS thrust vector control. The OMS
processor generates OMS engine gimbal
actuator thrust vector control commands to
produce
the
desired
spacecraft/engine
relationship for the specified thrust direction.
For the OMS burn, the orbital state vector
(position and velocity) is produced by
navigation using inertial measurement unit
delta velocities during powered and coasting
flight. This state is sent to guidance, which uses
target inputs through the IDP to compute thrust
direction commands for flight control and burn
parameters for DPS display. Flight control
converts the commands into OMS engine
gimbal angles (thrust vector control) for the
OMS burn.
OMS thrust vector control for a normal twoengine burn is entered by depressing the
ORBITAL DAP CONTROL AUTO pushbutton
indicator with both RHCs within software

detents. OMS manual thrust vector control for

both OMS engines is entered by depressing the
INRTL pushbutton indicator or by moving the
commander's or pilot's RHC out of detent. The
flight crew supplies the rate commands to the
burn vector control system instead of guidance.
The manual RHC rotation requests are
proportional to RHC deflections and are
converted into gimbal angles. OMS thrust in
either case is applied through the spacecraft's
center of gravity.
Orbital DAP
The orbital flight control software includes an
RCS DAP, an OMS TVC DAP, and an attitude
processor module to calculate vehicle attitude,
as well as logic to govern the selection of a
DAP. The attitudes calculated by the attitude
processor are displayed on the attitude director
indicator, as well as on the OPS 201 UNIV PTG
display, which is available whenever orbit
software is active. The vehicle attitude is used
by the DAP to determine attitude and rate
errors.
RCS DAP
The RCS DAP is used at all times in the on-orbit
phase except during an OMS burn. This DAP
controls vehicle attitudes and rates through RCS
jet fire commands. Either the larger primary
jets or the less powerful vernier jets can be used
for rotational maneuvers, depending on
whether PRI, ALT, or VERN is selected on the
panel C3 (or A6U) ORBITAL DAP CONTROL
panel.
The choice of primary or vernier
thrusters depends on fuel consumption
considerations, how quickly the vehicle needs
to be maneuvered to satisfy a mission objective,
and interaction with payloads. ALT mode uses
primary jets with fewer jet firings of a small
duration and selectable delay between firings to
allow attitude control when vernier jet
capability is lost.
The rotation rates and deadbands, translation
rate, and additional DAP options can be
changed by the flight crew during the orbit
phase using the DAP CONFIG display. The
flight crew loads the DAP with these options in
two ways, one option set is accessed by
depressing the A pushbutton on the ORBITAL

2.13-51

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
DAP SELECT panel and the other by depressing
the B pushbutton.

through the LVLH pushbutton on panel C3 or

A6U.

Each planned DAP configuration is given a reference number. In general, the A configurations
have
larger
deadbands
and
slower
maneuvering rates than the B configurations.
The wider deadbands of the A configurations
are used to minimize fuel usage, while the
tighter deadbands of the B configurations allow
greater precision in executing maneuvers or
holding attitude.

The RCS DAP includes only a manual translation capability, executed through the forward or
aft THC. Only the primary RCS jets are used. If
in VERN, DAP will automatically upmode to
primary RCS (PRCS) when the THC is moved
out of detent. The DAP will return to VERN or
ALT when the desired rate is achieved or the
THC is returned to detent. Deflections of the
THC result in RCS jet firings based on the
MANUAL MODE TRANSLATION pushbutton
indicator selected on the ORBITAL DAP panel.
PULSE mode results in a single burst of jet fire.
NORM mode results in continuous jet firings as
long as the THC is out of detent.

The RCS DAP operates in either AUTO or in

one of two manual modes (INRTL or LVLH),
depending on selections made on the ORBITAL
DAP CONTROL panel. The INRTL mode is
also accessed when the RHC is moved out of its
detent position (i.e., hot stick downmode). In
both the automatic and manual modes, the
rotation rate is controlled by the selection of
DAP A or B and the information loaded in the
DAP CONFIG display.
In addition, in
automatic, the DAP determines the required
attitude to be achieved from the UNIV PTG
display and then computes the RCS jet-fire
commands necessary to achieve these
requirements within the current set of
deadbands.
In the manual rotation mode, the RCS DAP
converts flight crew inputs from any of the
three RHCs to RCS jet-fire commands,
depending on whether PULSE or DISC RATE is
selected on the MANUAL MODE ROTATION
ROLL, PITCH, and YAW pushbuttons on panel
C3 or A6. Simply, when PULSE is selected, a
single burst of jet fire is produced with each
RHC deflection. The desired rotational rate is
specified on the DAP CONFIG display
(ROTATION). When DISC RATE is selected, jet
firings occur whenever the RHC is out of
detent, but inside the soft stop, thus
maintaining the rotational rate specified on the
DAP CONFIG display. When the RHC is
beyond the soft stop, continuous jet firings will
result. When the RHC is returned to detent, the
current M50 attitude will be maintained within
the specified deadbands.
Another manual RCS DAP mode, local
vertical/local horizontal (LVLH), is used to
maintain the current attitude with respect to the
rotating LVLH reference frame. It is selected
2. SYSTEMS

Two additional submodes, HIGH Z and LOW

Z, are available for special applications of +Z
translations. NORM will fire three up-firing jets
when a +Z translation is commanded and is the
default. HIGH Z will fire all nine up-firing jets
and would be used only for emergency escape
from the vicinity of another orbiting body.
LOW Z fires two aft-firing and two forwardfiring jets for +Z maneuvers. LOW Z is used to
maneuver near payloads that can be contaminated or damaged by the plume from an upfiring jet. Selection of NORM, HIGH Z, or LOW
Z has no effect on choice of jets for X, Y, or -Z
translations. LOW Z will inhibit upfiring jets
for rotations.
OMS TVC DAP
The OMS thrust vector control DAP is available
when an OMS burn is executed through the
ORBIT MNVR EXEC display. The TVC DAP
uses the guidance-generated velocity requirements and converts these into the appropriate
OMS gimbal commands, assuming AUTO is
selected on the ORBITAL DAP CONTROL
panel. The TVC DAP also generates the OMS
fire commands, the OMS shutdown commands,
and, if necessary, due to OMS engine failure,
the required RCS commands to maintain
attitude control. Under INRTL selection, the
TVC DAP takes inputs from the RHC to control
attitude during the burn. When the RHC is in
detent, the TVC DAP will maintain the current
inertial attitude.

2.13-52

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Before
OMS
ignition,
the
orbiter is
automatically or manually maneuvered to the
OMS ignition attitude using the RCS jets.
Automatic TVC for one OMS engine is identical
for two, except that the RCS processor is
responsible for roll control. Single-OMS-engine
burn is also through the orbiter's center of
gravity, except when pitch or yaw rate
commands are non-zero. If the left or right
OMS engine fails during a burn, a red LEFT or
RIGHT OMS light on panel F7 is illuminated.
Since an OMS cutoff is based on time rather
than velocity, a velocity residual may exist
following the cutoff. The residual can be
reduced to zero by the RCS through the THC.
Aerojet DAP
Entry flight control is accomplished using the
Aerojet DAP, which generates effector and RCS
jet commands to control and stabilize the
vehicle during its descent from orbit. During
exoatmospheric flight, or flight during which
certain aerosurfaces are rendered inefficient due
to adverse aerodynamics, a combination of
aerosurface and RCS jet commands are used.

with a rate error that is turned into a jet

command until qbar = 40 psf, and/or elevator
command after qbar = 2 psf. The body flap is
used as a trim device to keep the elevons on or
near schedule. This allows the elevons to be in
the right position for maximum effectiveness,
and to limit hinge moments and thermal effects.
The speed brake is opened at VREL = 10,000 fps
and is used supersonic as a lateral-directional
stability device (speed brake opens causing a
pitch-up moment that the elevons counteract by
moving down, making the elevons more
effective as an elevator and as ailerons).
Subsonic, the speed brake is used first as an
energy modulator, then as a qbar modulator
below 9,000 ft.
Other features of the pitch channel include:
Pitch panel trim moves the elevons up
or down. It requires trim be enabled
and on, and either the CDR or PLT use
the TRIM switches on panel L2 or C3.
There is no current use for this feature,
especially with the body flap in AUTO.

The Aerojet DAP has the following characteristics:

RHC pitch rate trim biases the output of

the RHC by inputting a rate command.
It requires trim to be enabled and flight
controller power on, and the CDR or
PLT to use the "beep trim" switch on
their RHC. Any input by the RHC rate
trim will be zeroed if the pitch axis is
returned to AUTO. This switch is used
to perform the beep trim derotation
during landing rollout.

(1) Flight adaptive (changes as a function

of qbar)
(2) Closed loop (compares feedback with
command to generate an error signal)
(3) Rate command (jets and aerosurfaces
are commanded as necessary to achieve
the desired rate)

Nose-up turn compensation provides a

pitch rate as a function of steady state
turn yaw rate and bank angle during
bank maneuvers in MM 305. This
provides a constant flight path angle
without the crew having to make a pitch
adjustment during turns.

Once the desired rate is obtained, forward loop

trim integrators maintain the desired rate. The
Aerojet DAP is activated by MM 304 transition,
usually at EI-5, and runs through wheel stop on
the runway. It slowly blends out the use of jets
and blends in the use of aerosurfaces as the
orbiter makes the transition from a spacecraft to
hypersonic glider to subsonic glider to finally a
high-speed 100-ton tricycle.

At nose gear touchdown, the pitch axis

will mode to AUTO and auto-load relief
will move the elevons down to off-load
the main gear. (This is the only entry
phase auto flight control feature in the
BFS.)

Pitch control is driven by either the auto system

via alpha error (MM 304/602) or NZ error (MM
305/603), which is turned into a rate command,
or by CSS via RHC input. This rate command is
compared to the pitch RGA output to come up
2.13-53

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Because of the very high angles of attack ()
that the orbiter flies, there is a large difference
in the velocity vector and the body X axis. For
conventional airplanes that fly at small , a
body axis roll is very close to a velocity vector
bank. (Bank refers to a rotation about the
velocity vector, or a stability axis rotation. Roll
refers to a rotation about the X axis or a body
axis rotation.) But at an of 90, a velocity
vector bank is a body axis yaw. Therefore, at
=40 (the orbiters angle of attack from MM
304 transition to VREL = 10,500 fps), a velocity
vector bank requires a combination of a body
axis roll and body axis yaw.
Another very important feature of the orbiter
during early entry (VREL > 4,000 fps) is that the
vehicle rolls and yaws due to sideslip (). Beta
can be generated by either yaw jets or the
adverse yaw caused by aileron displacement.
(Adverse yaw means instead of rolling because
of the increased lift caused by moving an
aileron down, the vehicle will yaw because of
the increased drag caused by moving an aileron
down. This yaw produces .) Therefore,
adverse yaw is purposely used during early
entry to start a bank by using "reverse aileron"
(right aileron down when initiating a bank to
the right) along with yaw jets to develop a to
get the vehicle banking. One of the two
purposes of a gain called GALR is to determine
whether the first output from the roll channel is
reverse or proverse aileron, and how big the
output should be. (Basically, no initial aileron is
used until qbar=10 psf, reverse aileron is used
from qbar=10 psf until approximately VREL =
3,800 fps, and steadily increasing proverse
aileron from VREL = 3,800 fps.) However, once a
has been induced, it must be controlled. More
precisely, the change in must be made zero
when the desired bank rate is achieved.
Proverse aileron, used in the proper
relationship to compensated body axis yaw and
, is introduced after the bank has been started
to control and maintain the bank rate. This is
called beta dot damping, and GALR controls
how much aileron is used for damping and
when it is terminated. Beta damping is used
from qbar=2 psf until VREL = 900 fps, although it
starts ramping down at approximately VREL =
3,800 fps.

2. SYSTEMS

Roll channel is driven by either the auto system

via bank angle error, which is turned into a
bank rate command, or by CSS via RHC input.
This bank rate command is multiplied by (1GALR) to determine if the initial command
should be reverse or proverse ailerons. It is
converted into a roll rate command and is
summed with beta dot damping (which is
multiplied by GALR to determine magnitude)
and compared with the output from the roll axis
RGAs after compensation for roll rates from the
steady-state turn. This is the rate error that is
turned into jet commands until qbar=10 psf
and/or aileron commands after qbar=2 psf.
The Entry Mode Switch, also known as the Roll
Mode Switch, on the CDR L2 panel, allows the
crew to select one of three Aerojet DAP flight
control modes. The switch positions are Auto,
Low Gain, and No Yaw Jet. Auto allows
selection, via Override SPEC 51, of either the
baseline or Wraparound DAP roll modes.
Wraparound DAP provides the same GALR
terms as the No Yaw Jet mode, which are seven
times that of the baseline GALR term for VREL >
4,000 fps. Wraparound DAP is the nominal
entry roll mode.
With increased GALR,
Wraparound DAP decreases RCS propellant
usage by using the ailerons as the primary
control effectors and the RCS jets as
supplemental control effectors.
The No Yaw Jet entry mode eliminates all yaw
jet commands. Bank maneuvers are accomplished only with aileron commands. This
flight mode is certified for qbar >20 psf (or very
soon after the first non-zero bank) to landing.
No Yaw Jet will be used in critical entry cases of
low aft RCS propellant (<10% total quantity) or
loss of aft RCS yaw jets.
The Low Gain position cuts the GALR terms in
half, using both yaw jets and ailerons for
control. This mode may be selected in offnominal situations because of airframe
vibrations or oscillations.
Other features of the roll channel are:

2.13-54

2.13 Guidance, Navigation, and Control (GNC)

Roll channel trim is automatic in AUTO

until rollout. Because auto trim in CSS
is terminated at Mach 1.25, if CSS is
taken at Mach >1 while the vehicle is
maneuvering, such as rolling onto the

USA007587
Rev. A
HAC, the CDR may experience a roll
rate on final that must be compensated
for by displacing the RHC slightly to the
right or left.
This is because the
automatic trim input during the
maneuver is locked into the flight
control system when CSS is taken. This
usually becomes apparent when rolled
out on final. The RHC roll trim may be
used to trim the RHC.

The rudder is not active for control until M < 5.0

due to the high angle of attack on entry
essentially blanking the vertical tail/rudder
from the airstream. Once the angle of attack
decreases, the rudder is blended into the flight
control system.
Other features of the yaw channel are:
The RPTA does not directly control the
rudder, but commands lateral acceleration, and the rudder moves as necessary
to maintain that lateral acceleration.
Yaw panel trim performs exactly the
same function. There is no operational
reason to command a non-zero lateral
acceleration. The RPTAs are not active
until the rudder becomes active at
M< 5.0.

RHC roll rate trim is exactly the same as

pitch rate trim.
At main gear touchdown, auto load
balance keeps the wings level during
rollout and prevents the downwind tire
from experiencing excessive loads with
crosswinds.
After
nose
gear
touchdown, load balance is faded out
over 100 seconds.
Any yaw jet firing causes the ailerons to
trim in the proper direction to reduce
the number of jet firings (right yaw jet
firings will cause right aileron to trim
down).
Except during bank maneuvers, DAP attempts
to keep small throughout entry. Until Mach
0.6, the yaw channel is driven by bank angle
error, which is turned into a bank rate
command. After Mach 0.6, the yaw channel is
driven by the roll rate compensated for steady
state turn so rudder pedal inputs are not
required to maintain coordinated flight. The
bank rate command or the compensated roll
rate is converted to a body yaw command and
summed with a beta compensation term until
qbar=20 psf. That is compared with the output
from the yaw axis RGAs after compensation for
yaw rates from the steady state turn. This yaw
rate error is then summed with lateral
acceleration (NY), RPTA input, and yaw panel
trim inputs. This is the rate that is turned into
jet commands until Mach 1 and/or rudder
commands after Mach 5. This causes the beta
during early entry to cause the orbiter to bank,
or during late entry (M < 0.6), coordinates the
bank.

At GSENBL set (WOW set for 2 sec,

theta < 0 deg, WONG), if in AUTO R/Y,
the yaw channel will provide nose
wheel steering commands to maintain
runway centerline.

Operations
Ascent
The terminal count phase extends from T-20
minutes through SRB ignition. During this
timeframe, the GNC OPS 1 software is loaded
into the GPCs and verified by the ground.
Guidance and flight control software are not
active during terminal count.
Navigation
software is initialized at T-8 seconds when the
onboard state vector is initialized and state
vector propagation begins.
First-stage guidance is active from SRB ignition
through SRB separation command. In this
stage, guidance uses a preflight planned
("canned") table of roll, pitch, and yaw attitudes
referenced to relative velocity. In addition to
sending commands to flight control to obtain
proper attitudes, the guidance software also
sends commands to the MPS throttle per a
preflight defined throttle schedule. Steering of
the vehicle during first stage is accomplished by
gimballing primarily the SRB nozzles. Firststage guidance also attempts to relieve vehicle

2.13-55

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
aerodynamic
accelerations.

loads

based

on

sensed

The navigation software during first stage

propagates the vehicle state vector using the
Super-G integration scheme using IMU data
and a gravity model.
The flight control software during first stage
uses commands issued by guidance. If the crew
has selected CSS, commands are input through
the RHC. Feedback from rate gyro assemblies
and accelerometers is used to generate
commands to reposition the SRB nozzles and
main engine bells. The current vehicle attitude
rates and the errors between current and
desired attitudes are sent to the attitude director
indicator for display to the crew. If the crew
does take CSS, the resultant control mode is
discrete rate/attitude hold. In this mode, when
the rotational hand controller is moved, a
specified attitude rate is commanded as long as
the RHC is out of its neutral position. When the
RHC is in detent, attitude hold commands are
generated by flight control.
During first stage, no GNC-related crew actions
are planned unless a failure occurs. Following
launch, the crew uses the Ascent Flip Book for
general procedures. To ensure that the auto
flight control system is maintaining the
expected ascent profile, the crew can scan the
cue cards placed next to the dedicated displays.
Second-stage ascent begins at SRB separation
and extends through MECO and external tank
separation.
During second stage, the crew
monitors the onboard systems to ensure that the
major GNC events occur correctly. These events

2. SYSTEMS

include closed loop guidance convergence, 3-g

throttling, MECO, external tank separation, and
-Z translation.
The second stage guidance software uses a
cyclic, closed loop scheme to calculate the
necessary commands to take the mated vehicle
to a specified set of target MECO conditions.
These conditions include cutoff velocity, radius
from the Earth, flight path angle, orbital
inclination, and longitude of the ascending
node. The name of the targeting scheme is PEG
(powered explicit guidance) 1.
The predicted time of MECO (TMECO) is
calculated by both PASS and BFS and displayed
on their respective ASCENT TRAJ displays for
the crew to evaluate. (Adiscrepancy between
PASS and BFS may indicate a guidance error,
requiring the crew to take manual control.)
Following SRB separation, it may take the PEG 1
guidance algorithm several cycles to converge
and for TMECO to become stable. Forty seconds
prior to MECO, guidance begins targeting only
for the desired cutoff velocity.
Guidance software also governs the main
engine throttle commands such that 3 g's are
not exceeded. The crew can ensure that 3 g's
are not exceeded by monitoring the g-indicator
on either the BFS ASCENT TRAJ 2 display or
the Ascent/Entry Flight Display.
Second-stage navigation software continues as
it did during first stage; i.e., it propagates a state
vector using the Super-G integration scheme.

2.13-56

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

PASS and BFS ASCENT TRAJ 1 Displays

Pass and BFS ASCENT TRAJ 2 Displays

Second-stage flight control software continues
through MECO as it did during first stage, with
the exception of gimballing the main engines
versus the SRBs. After SRB separation, attitude
hold is commanded until guidance converges.
At MECO, the transition (or TRANS) DAP,
becomes active. Initially it sends attitude hold
commands.
External tank separation is
automatically commanded about 20 seconds after
MECO. The DAP immediately sets commands to
fire the orbiter -Z RCS jets resulting in the orbiter
translating in the -Z direction (away from the
external tank). When -4 fps delta velocity is
reached, the fire commands are removed.

Orbit Insertion
During the orbit insertion phase, the guidance
software is used to target the OMS 2 burn (and
OMS 1 burn, if required).
The primary
targeting scheme used is called PEG 4. This is a
cyclic, closed loop scheme that computes the
required delta velocity to achieve a specific
point in space and a specific flight path angle.
Navigation during the orbit insertion phase is
identical in processing to that used in the
mainstage
whenever
the
IMU-sensed
acceleration is greater than the noise threshold.
If the IMU-sensed acceleration drops below the

2.13-57

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
threshold, navigation ignores the IMU data and
propagates the state vector using an
atmospheric drag model of the orbiter.
Insertion flight control is accomplished using
the transition DAP. The transition DAP uses
commands from guidance for automatic
maneuvers to burn attitude using the RCS jets.
During the OMS 1 and 2 burns, it uses the OMS
engines and RCS jets as required. It can also
receive commands from the crew via the
forward THC and RHC. The transition DAP
takes these commands and converts them into
the appropriate RCS commands.
It then
monitors the resultant attitude and attitude
rates. The necessary commands are sent to
achieve the targeted attitude and attitude rate
within the pre-mission specified deadbands.
For rotations, the crew selects either AUTO or
INRTL control on the ORBITAL DAP panel or
by moving the RHC. In translation, movement
of the THC results in continuous jet firings.
Orbit GNC
The major GNC-related orbit tasks include
achieving the proper position, velocity, and
attitude necessary to accomplish the mission's
objectives. To do this, the GNC software
maintains an accurate state vector, maneuvers
to specified attitudes and positions, and points a
specified orbiter body vector at a selected target.
These activities are planned with several
constraints
in
mind,
including
fuel
consumption, vehicle thermal limits, payload
requirements,
and
rendezvous/proximity
operations considerations. The GNC displays
for the majority of on-orbit operations are OPS
201 UNIV PTG and MNVR EXEC. Both are
available in OPS 2, and MNVR EXEC is
available for the orbit portion of OPS 1 and 3.
The navigation software has several important
features. As before, it propagates the orbiter
state vector using the Super-G integration
scheme. During coasting flight, the software
uses a model of atmospheric drag acceleration
to propagate the state vector.
Another
navigation option that is available on-orbit is
called rendezvous navigation.
When this
option is enabled by a crew input on the REL
NAV display, the software propagates a target
2. SYSTEMS

state vector, as well as the orbiter state vector.

In this mode, navigation can use external sensor
data from the star tracker, rendezvous radar or
COAS, in computing the orbiter/target relative
state vector.
For vehicles equipped with three-string GPS
hardware, the navigation software will replace
its propagated vector with a selected GPS vector
every 90 minutes. This will happen only if the
selected GPS state vector falls within the
navigation softwares expected error. After the
orbiter vector is updated, it will then be
propagated for the next 90 minutes using the
same techniques as described above (i.e., SuperG, drag model, etc.). This automatic GPS state
vector update will be inhibited during
rendezvous operations to avoid interfering with
the current rendezvous navigation sensor
processes.
For vehicles with single-string GPS, periodic
updates are sent from Mission Control to
correct any errors that develop with the
onboard nav state. In the event of no-comm,
GPS can be incorporated as described above.
The on-orbit guidance software has several
features. Universal pointing is used to compute
attitude changes required to "point" a specified
orbiter body axis at a specified target, to
maneuver to a predetermined attitude, to rotate
the orbiter about a specified body axis, or to
maintain attitude hold. The crew interacts with
this software via the UNIV PTG display.
Another guidance feature is PEG 7, or external
V, targeting for OMS or RCS burns. In this
mode, guidance sends the commands to flight
control to execute a burn specified by an
ignition time (TIG) and delta velocities in the
local vertical coordinate system at ignition.
Commands continue to be generated until the
original V requirement is met. The crew
monitors this option with the ORBIT MNVR
EXEC display.

2.13-58

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

GPS STATUS Display (SPEC 55)

REL NAV Display (SPEC 33)

2011/
/
UNI V PTG
CUR MNVR COMPL 0 2 : 5 5: 2 9
1 START TI ME
0 / 0 0 0 : 0 0: 0 0
MNVR OPTI ON
5 R
0. 00
6 P
0. 00
7 Y
0. 00

START MNVR
TRK
ROT
CNCL

TRK/ ROT OPTI ONS

8 TGT I D
2
9
10
11
12
13

RA
0. 0 0 0
DEC [ ] 0. 0 0 0
L AT [ ] 0. 0 0 0
L ON[ ]
0. 0 0 0
AL T[ ]
0. 0

1 4 BODY VECTOR 3
15 P
16 Y
17 OM

2 00 0 / 0 2: 4 4 : 5 8
00 0 / 0 0: 0 0 : 0 0

CUR FUT
CUR FUT
18
RBST 2 5 X X
19 *
CNCL 2 6
20
DURATI ON 27
21
XX: XX: XX. XX

ATT MON
2 2 MON AXI S 1
ERR TOT 2 3 *
ERR DAP 2 4
ROLL
CUR
163. 59
REQD 3 0 4 . 0 4
ERR + 7 4 . 8 6
RATE - 0 . 26 6

+X

PI TCH
40. 77
13 9 . 8 0
- 62. 92
- 0. 367

YAW
3 3 8. 3 8
3 4 2. 9 9
+ 8 6. 9 3
+ 0 . 44 3

9 0 . 00
0 . 00
2 7 0 . 00
525

UNIV PTG Display

ORBIT TGT Display (SPEC 34)

MNVR Display

2.13-59

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The third guidance capability is an on-orbit
targeting scheme used to compute the burn
parameters required to move the orbiter to a
specified target offset position in a given
amount of time. This capability is used to do
on-board targeting of rendezvous maneuvers.
The crew monitors this feature using the SPEC
34 ORBIT TGT display.
The orbital flight control software includes the
RCS DAP, OMS TVC DAP, an attitude
processor, and the logic to govern DAP
selection.
The attitudes calculated by the
attitude processor are displayed on the ADI and
the UNIV PTG display screen. The vehicle
attitude is used by the DAP to determine
attitude and rate errors.
Options for the DAP, including the translation
rate, rotation rates, and deadbands, are
changeable by the crew during the orbit phase
using the DAP CONFIG display. The Flight
Plan specifies which DAP configurations should
be loaded at each time in the mission.
Deorbit
The deorbit phase of the mission includes the
deorbit burn preparations, the loading of burn
targets, the execution and monitoring of the
burn, post-burn reconfiguration, and a coast
mode until about 400,000 feet above the Earth's
surface. The deorbit and entry flight software is
referred to as OPS 3.
During the deorbit phase, navigation uses the
Super-G algorithm to propagate the orbiter state
vector, based upon a drag model or IMU data.
Navigation maintains and propagates three
orbiter state vectors, each based upon a
different IMU. From these three state vectors, a
single orbiter state vector is calculated using an
interchangeable mid-value selection process. A
single-state vector is passed on for use by
guidance, flight control, dedicated display, and
DPS display software. Three separate state
vectors are propagated to protect the onboard
software from problems due to two IMU data
failures. This three-state vector system is only
used during entry, since that phase is most
critical with respect to navigation errors and
their effects on vehicle control and an accurate
landing. Another feature available during this
2. SYSTEMS

phase is the software computational capability

of a statistical estimate of the error in the state
vector propagation, to be used later in flight when
external sensor data are available. Also in this
phase, it is possible for the crew or Mission
Control to input a delta state vector to correct
navigation.
Vehicles with three-string GPS hardware will be
able to incorporate a selected GPS state vector
every 42 seconds throughout the deorbit and
entry phases of flight. This will be initialized via
crew command upon entering OPS 301. Similar
to orbit, the nav software will pick the best
available GPS vector to replace the three IMU
propagated state vectors. These three updated
vectors will continue to be propagated as
described above for the next 42 seconds, at which
time they will be replaced with a new selected
GPS vector and then the process will repeat.
Guidance during the deorbit phase is similar to
that used in the orbit insertion phase. The PEG
4 scheme is used again to target the deorbit
burn and guide the vehicle during the burn
although the required conditions are different.
The deorbit burn targets ensure the proper
conditions for entry interface, including
altitude, position with respect to the Earth (and
landing site), and velocity/flight path angle
constraints. These deorbit burn targets are
specified preflight for a nominal mission,
although it is also possible for the ground to
uplink changes or for the crew to recompute
them onboard. It is also possible to specify
OMS fuel "wasted" (burned out of plane) during
the deorbit burn in order to establish an
acceptable orbiter center of gravity (c.g.) for
entry. The crew is responsible for loading these
targets on the DEORB MNVR EXEC display.
The display is used to set up and target the OMS
burn, to specify fuel to be wasted, to display the
required burn attitude, to initiate an automatic
attitude maneuver, and to monitor the progress
of the burn. The crew's task for deorbit guidance
includes ensuring the correct burn targets are
entered on the DEORB MNVR EXEC display,
"loading" this target for PEG 4 deorbit burn
guidance software, and maneuvering to
calculated and displayed burn attitude either in
AUTO or manually using the RHC. The burn

2.13-60

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
itself is typically executed in AUTO such that the
crew's task is to monitor the burn progress in
terms of velocities and OMS performance.
Flight control during the deorbit phase is
similar to the procedures used during orbit
insertion - the transition DAP is again in effect.
Entry
The entry phase of flight is subdivided into
three separate subphases because the software
requirements for each are different:
The ENTRY subphase extends from EI-5
to the point at which the vehicle is
traveling at 2500 fps (83,000 ft altitude).
The terminal area energy management
(TAEM) subphase begins at 2500 fps and
extends to the approach/landing capture
zone, defined when the vehicle is on
glide-slope, on airspeed, and on runway
centerline (below 10,000 ft altitude).
The approach/landing (A/L) subphase
begins at the approach/landing capture
zone and extends through wheel stop
after touchdown.
The guidance software during the entry portion
of flight performs different tasks during each of
the ENTRY, TAEM, and A/L subphases.
During the ENTRY subphase, guidance
attempts to keep the vehicle on a trajectory that
provides
protection
against
excessive
temperature, dynamic pressure, and normal
acceleration (Nz) limits.
To do this, the
software sends commands to flight control to
fly a drag/acceleration determined profile,
which guides the vehicle through a tight
corridor limited on one side by altitude and
velocity requirements for ranging (in order to
make the runway), and on the other side by the
thermal, qbar, and Nz constraints. Ranging is
accomplished by adjusting drag acceleration to
velocity such that the vehicle stays in that
corridor. Drag acceleration can be adjusted by
modifying the angle of attack, which changes
the vehicle's cross sectional area with respect to
the airstream, or by adjusting the vehicle bank
angle, which affects lift and thus the vehicle's
sink rate into denser atmosphere. The vehicle's
angle of attack is maintained at a high value
(=40) during most of this phase to protect the

upper surfaces from extreme heat. It is ramped

down to a lower value at the end of this phase
for vehicle controllability. Using bank angle to
adjust drag acceleration results in the vehicle
turning off course. Therefore, at certain times,
the vehicle must be rolled back toward the
runway. This is called a roll reversal and is
commanded as a function of azimuth error from
the runway.
During the entry phase of flight, the crew uses
IDP displays, dedicated displays, certain panel
switches (such as TRIM switches), the RHC, and
the SBTC to control the vehicle. Between the
ENTRY interface and the TAEM interface, five
ENTRY TRAJ displays sequentially become
available. These displays are used to monitor
autoguidance and the vehicle's trajectory
compared to the planned entry profile. The five
displays are identical with the exception of the
central plot, which shows vehicle velocity
versus range or energy/weight versus range
with a changing scale as the vehicle approaches
the landing site. This central plot also includes
static background lines that allow the crew to
monitor the vehicle's progression compared to
planned entry profiles.
Once TAEM interface is reached, the VERT SIT 1
display becomes available. This display includes
a central plot of vehicle altitude with respect to
range. The plot has three background lines that
represent the nominal altitude versus range
profile, a dynamic pressure limit profile, and a
maximum lift-over-drag profile. At 30,000 feet
altitude, the scale and titles on the display change
to VERT SIT 2. This second display is used
through landing.
When the A/L interface
conditions are met, a flashing A/L is displayed
on the VERT SIT 2 display.
Guidance software during TAEM generates the
necessary commands to enable the vehicle to
achieve the proper A/L conditions by following
an energy/weight versus range profile. During
TAEM, as the name implies, the goal is to
manage the vehicle's energy while the orbiter
travels around an imaginary arc called the
heading alignment cone (HAC). A HAC is an
imaginary cone that when projected on the
Earth, lies tangent to the extended runway
centerline.

2.13-61

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
The guidance software performs the TAEM
function as follows:
S-Turns:
If the vehicle is high on
energy, it dissipates the excess by
turning away from the HAC until the
proper energy conditions are met.
HAC Acquisition: Turns the vehicle
toward the targeted tangent point on the
HAC and flies to this point.
Heading Alignment: Flies the vehicle
around the HAC to the point at which
the HAC is tangent to the runway
centerline, called the nominal energy
point (NEP).
Prefinal: From the NEP, flies the vehicle
down the runway centerline until the
proper A/L conditions (airspeed,
altitude, flight path angle, distance off
centerline) are met.
Within the above steps, TAEM guidance makes
the necessary adjustments to account for
various energy conditions.
Approach/landing guidance software commences when the vehicle is about 10,000 feet
altitude (at 5.8 or 6.3 nm range from the runway
threshold) and near the proper altitude, airspeed, and flight path angle for the outer glide
slope (20 or 18, depending on orbiter weight).
The guidance software sends commands to
keep the vehicle tracking the runway centerline
and on the steep glide slope until
approximately 2000 feet, at which point a preflare maneuver is performed to put the orbiter
on a shallow glide slope (1.5). Final flare is
initiated between 30 and 80 feet (based on sink
rate), reducing the sink rate to 3 fps for
touchdown. At this point, guidance software
generates commands directing the vehicle to the
runway centerline.
In the entry phase, navigation software
functions similarly to the deorbit phase (i.e.,
three-state vectors computed using the Super-G
algorithm corresponding to each inertial
measurement unit) with the exception that
additional external sensor data are sequentially
incorporated.
This information is used to
provide the accuracy necessary to bring the
orbiter to a pinpoint landing and to some extent
2. SYSTEMS

to maintain vehicle control.

The TACAN
system provides slant range and magnetic
bearing to various fixed stations around the
landing site and becomes available at about
160,000 feet altitude until 1500 feet above
ground level. The ADTA system provides
pressure data to compute angle of attack, Mach
number, equivalent airspeed, true airspeed,
dynamic pressure, barometric altitude, and
altitude rate. Only barometric altitude is used
for the navigation software. The microwave
landing system precisely determines slant
range, azimuth, and elevation to the ground
stations located along the side of the landing
runway.
When landing at runways with
microwave landing system ground stations,
data become available at 18,000 feet for
processing by navigation.
Another tool used by the navigation software is
a "software sensor" called drag altitude, which
uses a model of the atmosphere to correlate the
drag acceleration measured by the inertial
measurement units to altitude.
The drag
altitude data are important in keeping
downrange and altitude errors bounded until
TACAN data is available.
The navigation software also maintains a
statistical estimate of the expected error in the
state vector. When an external sensor, such as
TACAN, becomes available to the navigation
software, a check is made to see if the data lays
within the current expected range of error.
Crew controls are provided on the HORIZ SIT
display to force the software to accept or inhibit
the external sensor data regardless of whether
they lie within this expected range. There is
also a control on the display that may be
selected to allow the software to use the
external sensor data to update its state vector as
long as the data lie within the expected range.
This scheme is part of what is called Kalman
filtering and is used to prevent navigation from
being polluted by bad sensor data.
The
navigation parameters computed as a result of
this filter can be seen by the crew on the
dedicated displays when NAV is selected as the
data source. In addition to providing insight
and control over navigation parameters, the
HORIZ SIT display supplies the crew with
spacecraft position and heading information.

2.13-62

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
GPS-equipped vehicles will not have TACAN
data to incorporate into the three-state vectors
corresponding to each IMU. Similar to the other
navigation sensors, GPS data are constantly
checked to make sure they lie within an
expected error range. Crew controls (via the
HORIZ SIT display) allow the navigation
software to automatically incorporate a GPS
vector if the vector falls within the expected
range or to force the software to accept or
inhibit the data regardless of whether the
information lies within the expected range. As
described in the Deorbit subsection, navigation
software will select and incorporate a GPS
vector every 42 seconds up to 17,000 feet and
then every 9 seconds thereafter to allow for
smoother updates to navigation software in the
event that MLS is not available. If MLS is
available, MLS will update navigation software
as described above and GPS updates will
automatically be inhibited by the navigation
software.
30 41 /
D
50 50

45

40

ENT RY TRAJ 1

1 BI AS[ ]
D REF 1 4.
40 q
4 0.
AZ +1 3.
L O ENRGY
3 0 3 I NH

0
8
7
7

3 04 1 /
D
50
50

45

ENT RY T RAJ 2
4 5D

1 BI AS [ ]
D REF 3 0 .
40 q
97 .
AZ + 6 .

40

LO ENRGY
3 0 3 I NH

35

20

30

25

0
7
6
4

1 0 10 / 18 : 4 0: 56
00 0/ 00 : 1 6: 57
35 D 25 D 20 D

15 D

10

0
- 1 25

- 1 90

NY
NY T RI M
AI L
RUD
Z ERO H BI
H BI AS
REF
ROLL REF
CMD

RESUME

R. 0 10
. 0 00
L 0. 2
0. 0
AS 2
5
- 11 6
L 64
L 58
53 0

ENTRY TRAJ 2 Display

01 0/ 18 : 36 : 2 4
00 0/ 0 0: 12 : 2 4
10 D
8D
6D

15 D
20 D

25 D
- 40
35

30

25

20

10

0
- 180
RESUME

- 10 0

NY
NY TRI M
AI L
RUD
ZERO H BI
H BI AS
REF
ROL L REF
CMD

. 00 0
. 00 0
R0 . 1
0. 0
AS 2
0
- 1 04
L 61
L 63

VERT SIT 1

529

ENTRY TRAJ 1 Display

VERT SIT 2

2.13-63

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

TAEM Guidance Subphases

.
HORIZ SIT Display (SPEC 50)
(Three-String GPS Vehicles)

HORIZ SIT Display (SPEC 50)

(Three-String TACAN Vehicles)
.

2. SYSTEMS

2.13-64

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

GNC Caution and Warning Summary

IMU overheating or BITE-detected failures
display a fault message and annunciate an
SM ALERT. An IMU failure illuminates the
SM ALERT and displays a fault message,
while a dilemma illuminates the IMU C/W
light on panel F7.
A TACAN, GPS, or microwave scanning
beam landing system (MSBLS) fault will
illuminate the SM ALERT and display a fault
message.
Fault detection in the air data system
illuminates the SM ALERT for a failure or
the red AIR DATA and BACKUP C/W
ALARM lights on panel F7 for a dilemma, in
addition to sounding an alarm and
generating a fault message.
The RGA/ACCEL light on panel F7 is not
supported. RGA or AA failure will sound an
alarm and generate a DPS fault message.

O2 PRESS

H2 P R E S S

CA BIN AT M
(R )

O 2 H EA TE R
TEMP

A malfunction in the commander's RHC will

illuminate the LEFT RHC light on panel F7; a
malfunction in the pilot's RHC or the aft RHC
will illuminate the RIGHT/AFT RHC light.
If the hydraulic system pressure drops below
2,800 psi, the HYD PRESS and BACKUP
C/W ALARM lights will illuminate.
The yellow FCS CHANNEL light illuminates
to indicate a failed channel; the red FCS
SATURATION light is illuminated if one of
the four elevons is set at more than +12
(down) or less than -15 (up).
The OMS TVC light illuminates if the left or
right OMS gimbal fails, or if software detects
a TVC failure.
The LEFT or RIGHT OMS light illuminates if
the left or right OMS engine fails.

FU E L CELL
REAC
(R )
MA IN B U S
UNDERVOLT

FUE L C EL L
ST AC K TEM P

FU E L C ELL
PUMP

AC
VOLTAGE

AC
OV E R LO AD
RCS JET

FR EO N
LO O P

AV BAY/
CAB IN AIR

IM U

FW D RC S

H2 O L O O P

RG A/A C CE L

AIR D A TA

LE FT RC S

(R )

LE FT RH C
(R )
PAYLOAD
W A R N IN G (R )
PAYLOAD
C A U T IO N
BA C K U P C /W
A L A R M (R )

GPC

PR IM A RY C /W
AP U
TEM P

(R )
RIG H T/A FT
RHC
(R )

RIG H T R C S
(R )

LE F T OM S

RIG H T O M S
(R )

FCS
SATU RATIO N

O M S K IT

FCS
CHANNEL

MPS

AP U
OVERSPEED

APU
UNDERSPEED

OMS TVC

(R )

(R )
HY D PR E S S

GNC Caution and Warning Lights on Panel F7

2.13-65

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

GNC Summary Data

GNC systems determine the current state of
motion of the vehicle, compute actions to
change its state of motion, and apply
corrective maneuvers to achieve the change.
GNC elements are navigation and flight
control system hardware and digital
autopilot software.
A bad orbiter navigation state can degrade
flight control, since navigation data are used
to set control gains and choose control
effectors.
Navigation hardware includes: (1) IMUs,
which sense vehicle orientation and
accelerations; (2) star trackers, which sense
vehicle line of sight vectors; (3) COAS, which
allows the crew to manually determine line
of sight vectors; (4) TACAN, which senses
vehicle position with respect to a ground
based station; (5) GPS, which senses satellite
ranging signals to determine orbiter position
and velocity; (6) air data system, which
senses temperature and pressure; (7) MLS,
which senses vehicle position with respect to
a ground-based station along the runway;
and (8) radar altimeters.
The flight control system hardware includes
four accelerometer assemblies, four orbiter
rate gyro assemblies, four SRB rate gyro
assemblies, rotational and translational hand
controllers,
rudder
pedal
transducer

2. SYSTEMS

assemblies,
two
speed
brake/thrust
controllers, two body flap switches, panel
trim switches, aerosurface servoamplifiers,
and ascent thrust vector control.
DAP software interprets maneuver requests,
compares them to what the vehicle is doing,
and generates commands for the appropriate
effectors.
Different DAPs function during different
flight phases. Transition DAP (TRANSDAP)
becomes active at MECO; orbit DAP includes
an RCS DAP, an OMS TVC DAP, and an
attitude processor module. TRANSDAP is
used again for the deorbit burn until EI-5
minutes. Aerojet DAP is used from EI-5
until wheel stop on landing.
Primary
GNC-related
switches
and
pushbuttons are located on panels C3, A6U,
F2, F3, and F4. Other switches, pushbuttons,
and circuit breakers are located on the
following: F6, F7, F8, O5, O6, O7, O8, O9,
O14, O15, O16, O17, and L1.
GNC-related information and crew access
are provided by several displays: GNC SYS
SUMM 1, IMU ALIGN, GND IMU
CNTL/MON, S TRK/COAS CNTL, HORIZ
SIT, MNVR, UNIV PTG, DAP CONFIG,
PASS ASCENT TRAJ 1, PASS ASCENT
TRAJ 2, BFS ASCENT TRAJ 1, BFS ASCENT
TRAJ 2, REL NAV, ORBIT TGT, ENTRY
TRAJ 1-5, VERT SIT 1, VERT SIT 2, and GPS
STATUS.

2.13-66

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Panel C3

2.13-67

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

Panel F2

Panel F3

Panel F4

2. SYSTEMS

2.13-68

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

GNC SYS SUMM 1 Display

GND IMU CNTL/MON Display (SPEC 104)

(available on OPS 9 only)

GNC SYS SUMM 1 Display

(Three-String GPS Vehicles)

S TRK/COAS CNTL Display

IMU ALIGN Display (SPEC 21)

HORIZ SIT Display (SPEC 50)

(Three-String TACAN Vehicles)
2.13-69

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

2011/
/
UNI V PTG
CUR MNVR COMPL 0 2 : 5 5: 2 9
1 START TI ME
0 / 0 0 0 : 0 0: 0 0
MNVR OPTI ON
5 R
0. 00
6 P
0. 00
7 Y
0. 00

START MNVR
TRK
ROT
CNCL

TRK/ ROT OPTI ONS

8 TGT I D
2
9
10
11
12
13

RA
0. 000
DEC [ ] 0 . 0 0 0
L AT [ ] 0 . 0 0 0
L ON[ ]
0. 000
AL T[ ]
0. 0

1 4 BODY VECTOR 3
15 P
16 Y
17 OM

2 000/ 02: 44: 58

000/ 00: 00: 00

CUR FUT
CUR FUT
18
RBST 2 5 X X
19 *
CNCL 2 6
20
DURATI ON 27
21
XX: XX: XX. XX

ATT MON
2 2 MON AXI S 1
ERR TOT 2 3 *
ERR DAP 2 4
ROL L
CUR
163. 59
REQD 3 0 4 . 0 4
ERR + 7 4 . 8 6
RATE - 0 . 2 6 6

+X

PI TCH
40. 77
13 9 . 8 0
- 62. 92
- 0. 367

YAW
338. 38
342. 99
+ 86. 93
+ 0 . 44 3

9 0 . 00
0 . 00
2 7 0 . 00
525

UNIV PTG Display

HORIZ SIT Display (SPEC 50)
(Three-string GPS Vehicles)

GPS STATUS Display (SPEC 55)

DAP CONFIG Display

MNVR Display
2. SYSTEMS

2.13-70

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

PASS and BFS ASCENT TRAJ 1 Displays

PASS and BFS ASCENT TRAJ 2 Displays

2.13-71

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
30 41 /
D
50 50

45

ENT RY TRAJ 1

1
10 D

1 BI AS[ ]
D REF 1 4.
40 q
4 0.
AZ +1 3.

40

L O ENRGY
3 0 3 I NH

35

20

0
8
7
7

01 0/ 18 : 36 : 2 4
00 0/ 0 0: 12 : 2 4
8D
6D

15 D
20 D

25 D
- 40

30

25

NY
NY TRI M
AI L
RUD
ZERO H BI
H BI AS
REF
ROL L REF
CMD

10

0
- 180
RESUME

- 10 0

. 00 0
. 00 0
R0 . 1
0. 0
AS 2
0
- 1 04
L 61
L 63
529

ENTRY TRAJ 1 Display

REL NAV Display

3 04 1 /

D
50
50

45

ENT RY T RAJ 2
4 5D

1 BI AS [ ]
D REF 30 .
40 q
97 .
AZ + 6 .

40

LO ENRGY
3 0 3 I NH

35

20

30

25

0
7
6
4

1 0 1 0 / 1 8 : 4 0: 56
00 0/ 0 0 : 1 6: 57
35 D 25 D 2 0 D

15 D

10

0
- 1 25

- 1 90

NY
NY T RI M
AI L
RUD
Z ERO H BI
H BI AS
REF
ROLL REF
CMD

RESUME

530

ENTRY TRAJ 2 Display

ORBIT TGT Display

ENTRY TRAJ 3 Display

2. SYSTEMS

2.13-72

2.13 Guidance, Navigation, and Control (GNC)

R. 0 10
. 0 00
L 0. 2
0. 0
AS 2
5
- 11 6
L 64
L 58

USA007587
Rev. A

VERT SIT 1 Display

ENTRY TRAJ 4 Display

ENTRY TRAJ 5 Display

VERT SIT 2 Display

2.13-73

2. SYSTEMS

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A
Delay 2 seconds between switch throws
when
moving
FCS
CHANNEL
switches. Port bypass, or port pop, is a
mechanical means to avoid force fights;
feedback deselection is a software
means to avoid a bad input into the
selection filter.

GNC Rules of Thumb

The PASS FDIR for the RGAs, AAs, and
aerosurfaces terminates after the first
failure.
After the first failure, crew
management of the selection filter is
required. However, PASS has an RGA
SMRD FDIR that will continue to deselect
any power failed RGAs. For the BFS
selection filter, crew management is
always required. Proper selection filter
management is required for proper
control.

For ascent, only the pilot's SBTC is active.

To get manual throttles, the pilot must
depress the TAKEOVER button and then
match the commanded throttle setting.
Manual rotational control is available only
in PASS and must be both pitch and
roll/yaw.

For FCS channel management:

For entry, both SBTCs are active. To get

manual speed brake, the CDR or pilot
must depress the TAKEOVER button.
Manual rotational control is available in
either pitch or bank in PASS and is
required in both axes in BFS.

Never have more active channels on

one GPC than another.
If there are two failures on the same
actuator, take the remaining FCS
channels to OVERRIDE.
Always maintain two good commands
and one good feedback on each
aerosurface.

2. SYSTEMS

For TACAN and ADTA management, talk

to MCC before incorporating.

2.13-74

2.13 Guidance, Navigation, and Control (GNC)

USA007587
Rev. A

2.14

the midfuselage. Each landing gear includes a

shock strut with two wheel and tire assemblies.
Each main landing gear wheel is equipped with
a brake assembly with anti-skid protection.

LANDING/DECELERATION
SYSTEM

CONTENTS
Description............................................
Landing Gear ........................................
Drag Chute............................................
Main Landing Gear Brakes .................
Nose Wheel Steering............................
Operations.............................................
Landing/Deceleration System
Summary Data ...........................
Landing/Deceleration System
Rules of Thumb .........................

Landing Gear Doors

2.14-1
2.14-1
2.14-4
2.14-5
2.14-9
2.14-10

The nose landing gear has two doors, and each

main gear has one door. When the crew commands gear deployment, the doors open automatically as the gear is dropped. This is accomplished by the door extend/retract mechanism,
which is actuated by the dropping gear. The
nose landing gear doors have two door hooks
that hold the doors closed, and the main gear
doors have four door hooks.

2.14-17
2.14-17

Description
The orbiter, unlike previous space vehicles,
lands on a runway using a conventional type of
landing system. Once the orbiter touches down,
the crew deploys the drag chute, begins
braking, and starts nose wheel steering
operations.
The orbiter drag chute, first used on the maiden
flight of OV-105, improves the orbiter's deceleration and eases the loads on the landing gear
and brakes.
Braking is accomplished by a sophisticated
system that uses electrohydraulic disk brakes
with an anti-skid system. Only the two main
gear sets have braking capability, and each can
be operated separately.

In addition, the doors have door-assist bungee

assemblies. These assemblies exert additional
force on the inside of the doors to assist in door
deployment to overcome the aerodynamic forces
acting against the doors and/or in case the
pressure inside the wheel wells is less than the
outside pressure. The nose landing gear bungee
assist assemblies exert 2,000 pounds of force on
the doors; the main landing gear bungee assist
assemblies exert approximately 5,000 pounds of
force on the doors over the first 2 inches of travel.
The nose landing gear also contains a pyro boost
system to further assure nose gear door and gear
extension in case high aerodynamic forces on the
nose gear door are present. This pyro system is
fired each time the landing gear is deployed.
Electrical
power
system

Crew controls

Three primary steering options are available.

The crew can use the rudder to assist steering
while at higher ground speeds. By selecting
nose wheel steering, the crew can use the
rudder pedal assembly to operate a hydraulic
steering actuator incorporated in the nose
landing gear. By applying variable pressure to
the brakes, the crew can steer the vehicle by a
method called differential braking.

Power and control signals

Main landing
gear uplock and
strut actuators

Nose landing
gear steering
actuators

Nose landing
gear uplock and
strut actuators

(Sys 1 & 2)

System 1

System 2

Main landing
gear brakes

(Sys 1)

System 3

Hydraulic system

Landing Gear

usa007587_543r2.cvx

The orbiter landing gear system is a tricycle

configuration consisting of a nose landing gear
and a left and right main landing gear. The
nose landing gear is located in the lower
forward fuselage, and the main landing gear is
in the lower left and right wing area adjacent to

Landing/Deceleration Interfaces
Each of the landing gear doors has hightemperature reusable surface insulation tiles on
the outer surface and a thermal barrier or door
seal to protect the landing gear from the high
temperatures encountered during reentry.

2.14-1

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A
Gear Retraction
During retraction, each gear is hydraulically
rotated forward and up by ground support
equipment until it engages an uplock hook for
each gear in its respective wheel well. The
uplock hook locks onto a roller on each strut. A
mechanical linkage driven by each landing gear
mechanically closes each landing gear door.
The nose landing gear is retracted forward and
up into the lower forward fuselage and is
enclosed by two doors. The main landing gear
is also retracted forward and up into the left
and right lower wing area, and each is enclosed
with a single door. The nose and main landing
gear can be retracted only during ground
operations.
Gear Deployment

Nose Landing Gear Deployed

When deployment of the landing gear is

commanded by the crew, the uplock hook for
each gear is unlocked by hydraulic system 1
pressure. (See Section 2.1 for more information
on orbiter hydraulic systems.) Once the hook is
released from the roller on the strut, the gear is
driven down and aft by springs, hydraulic
actuators, aerodynamic forces, and gravity. A
mechanical linkage released by each gear
actuates the doors to the open position. The
landing gear reaches the full-down and extended
position within 10 seconds and are locked in the
down position by spring-loaded downlock
bungees. If hydraulic system 1 pressure is not
available to release the uplock hook, a pyrotechnic initiator at each landing gear uplock hook
automatically releases the uplock hook on each
gear 1 second after the flight crew has commanded gear down.

Main Landing Gear Deployed

The landing gear is deployed at 300 100 feet

and at a maximum of 312 knots equivalent airspeed (KEAS).

Shock Struts
The shock strut of each landing gear is the
primary source of impact attenuation at
landing.
The struts have air/oil shock
absorbers
to
control
the
rate
of
compression/extension and prevent damage to
the vehicle by controlling load application rates
and peak values.
Each landing gear shock strut assembly is
constructed of high-strength, stress- and corrosion-resistant steel alloys, aluminum alloys,

2. SYSTEMS
2.14 Landing/Deceleration System

2.14-2

USA007587
Rev. A
stainless steel, and aluminum bronze. The
shock strut is a pneumatic-hydraulic shock
absorber containing gaseous nitrogen and
hydraulic fluid. Because the shock strut is
subjected to zero-g conditions during space
flight, a floating piston separates the gaseous
nitrogen from the hydraulic fluid to maintain
absorption integrity.

With a 20-knot crosswind, the maximum

allowable gear sink rate for a 211,000-pound
orbiter is 6 feet per second; for a 240,000-pound
orbiter, it is approximately 5 feet per second.
(Current maximum operational crosswind is
limited to 15 knots.)

The nose landing gear shock strut has a 22-inch

stroke. The maximum allowable derotation rate
is approximately 9.9 per second or 11.5 feet per
second, vertical sink rate.

Landing gear wheels are made in two halves

from forged aluminum. The nose landing gear
tires are 32 by 8.8 inches and have a normal
nitrogen inflation pressure of 350 psi prior to
launch. The maximum allowable load per nose
landing gear tire is approximately 45,000
pounds. Nose landing gear tires are rated for
217 knots maximum landing speed. They may
be reused once.

The main landing gear shock strut stroke is 16

inches. The allowable main gear sink rate for a
211,000-pound orbiter is 9.6 feet per second; for
a 240,000-pound orbiter, it is 6 feet per second.

Wheels and Tires

The main landing gear tires are 44.5 by 21 inches

and have 16 cord layers in a bias-ply design.
They are normally inflated with nitrogen to a
pressure of 370 pounds per square inch (psi). The
maximum allowable load per main landing gear
tire is 132,000 pounds. With a 60/40 percent tire
load distribution, the maximum tire load on a
strut is 220,000 pounds. The main gear tires are
rated at 225 knots maximum ground speed and
have a life of one landing.

Nose Landing Gear Stowed

2.14-3

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A

Main Landing Gear Stowed

Drag Chute
The orbiter drag chute was designed to assist
the deceleration system in safely stopping the
vehicle on the runway at end of mission (EOM)
and abort weights.
Design requirements
included the ability to stop a 248,000 lb
transoceanic abort landing (TAL) orbiter in 8,000
feet with a 10 knot tailwind on a hot (103 F)
day and maximum braking at 140 knots ground
speed or one half runway remaining. The drag
chute, housed at the base of the vertical

stabilizer, is manually deployed by redundant

commands from the commander (CDR) or pilot
(PLT) prior to derotation. The drag chute is
jettisoned at 60 (20) knots ground speed to
prevent damage to the main engine bells. The
drag chute will be used on lake bed and
concrete runways except with crosswinds
greater than 15 knots or in the presence of main
engine bell repositioning problems. The drag
chute may be deployed without engine bell
repositioning
if
landing/rollout
control
problems exist.

Drag Chute Configuration

2. SYSTEMS
2.14 Landing/Deceleration System

2.14-4

USA007587
Rev. A

Nominal Sequence of Drag Chute Deployment, Inflation, and Jettison

Pilot and Main Chutes

Main Landing Gear Brakes

When drag chute deployment is initiated, the

door is blown off of the chute compartment by
pyros and a mortar fires deploying a nine foot
pilot chute. The pilot chute in turn extracts the
40 foot, partially reefed conical main chute. The
main chute is reefed to 40 percent of its total
diameter for about 3.5 seconds to lessen the
initial loads on the vehicle. The main chute
trails the vehicle by 89.5 feet on a 41.5 foot riser.
Drag Chute Controls
The drag chute deployment and jettison
pushbuttons, ARM 1(2), DPY 1(2), and JETT 1(2)
are installed on either side of both the CDR's
and PLT's heads-up displays (HUD). Activation
of each lighted pushbutton initiates a signal
through the primary and redundant paths
simultaneously.
The deployment sequence
requires that both the ARM and DPY
pushbuttons be activated simultaneously. The
JETT pushbutton signal will only be effective
when the ARM command has previously been
initiated. Circuit breakers for the drag chute
controls are located on panels O15 and O16.

Each of the orbiter's four main landing gear

wheels has electrohydraulic disc brakes and an
associated anti-skid system. The disc brake
assembly consists of nine discs, five rotors, four
stators, a backplate, and a pressure plate. The
carbon-lined rotors are splined to the inside of
the wheel and rotate with the wheel. The
carbon-lined stators are splined to the outside of
the axle assembly and do not rotate with the
wheel.
The brakes are controlled by the commander or
pilot applying toe pressure to the upper portion
of the rudder pedals; electrical signals produced
by rudder pedal toe pressure control hydraulic
servovalves at each wheel and allow hydraulic
system pressure to actuate braking. Brakes
cannot be applied until about 1.9 seconds after
weight on the main gear has been sensed. The
anti-skid system monitors wheel velocity and
controls brake pressure to prevent wheel lock
and tire skidding. The braking/anti-skid system is redundant in that it utilizes system 1 and
2 hydraulic pressure as the active system with
system 3 as standby, and it also utilizes all three
main direct current (DC) electrical systems.

2.14-5

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A

Panels F2, F3
OPEN

FA1
R4
CLOSE

OPEN

GPC
OPEN

GPC

OPEN

FA2

GPC
Hyd sys 3

Main gear
deploy

WOW

Brake isol
valve 1

Brake isol
valve 2

NWS
S/V

NWS
Nose gear
deploy

WOW

Lg extend
valve 2

Brakes
FA3

R4
CLOSE

Lg/NWS hyd sys

Auto 1/2
Sys 2
R4
inhibit

Lg extend
valve 1
FA1

R4
CLOSE

Hyd sys 2

Vrel = 800

Lg extend
isol valve

R4
CLOSE

Hyd sys 1

Lg arm
& down

WOW

Brake isol
valve 3

552.cvs

Landing Gear Hydraulics

Brake System Hydraulic Power
Each of the four main landing gear wheel brake
assemblies is supplied with pressure from two
different hydraulic systems.
Each brake
hydraulic piston housing has two separate
brake supply chambers. One chamber receives
hydraulic source pressure from hydraulic system 1 and the other from hydraulic system 2.
There are eight hydraulic pistons in each brake
assembly. Four are manifolded together from
hydraulic system 1 in a brake chamber. The
remaining four pistons are manifolded together
from hydraulic system 2. When the brakes are
2. SYSTEMS
2.14 Landing/Deceleration System

applied, the eight hydraulic pistons press the

discs together, providing brake torque.
When hydraulic system 1 or 2 source pressure
drops below approximately 1,000 psi, switching
valves provide automatic switching to
hydraulic system 3. Loss of hydraulic system 1,
2, or both would have no effect on braking
capability, because standby system 3 would
automatically replace either system. Loss of
hydraulic system 3 and either 1 or 2 would
cause the loss of half of the braking power on
each wheel, and additional braking distance
would be required.

2.14-6

USA007587
Rev. A
The brake isolation valves in hydraulic systems
1, 2, and 3 must be open to allow hydraulic
pressure to the brakes. All three valves are
automatically commanded open after weight on
the main landing gear is sensed. The 3,000 psi
hydraulic pressure is reduced by a regulator in
each of the brake hydraulic systems to 2,000
psig.

hydraulic brake pressure to one of the brake

chambers.
The brake/skid control valves
contain a brake coil and a skid coil. The brake
coil allows hydraulic pressure to enter the brake
chambers. The skid coil, when energized by the
skid control circuit, provides reverse polarity to
the brake coil, preventing the brake coil from
allowing brake pressure to the brake chamber.

Anti-Skid

Anti-skid control is automatically disabled

below approximately 10 to 15 knots to prevent
loss of braking for maneuvering and/or coming
to a complete stop.

The anti-skid portion of the brake system

provides optimum braking by preventing tire
skid or wheel lockup and subsequent tire
damage.
Each main landing gear wheel has two speed
sensors that supply wheel rotational velocity
information to the skid control circuits in the
brake/skid control boxes. The velocity of each
wheel is continuously compared to the average
wheel velocity of all four wheels. Whenever the
wheel velocity of one wheel is 60 percent below
the average velocity of the four wheels, skid
control removes brake pressure from the slow
wheel until the velocity of that wheel increases
to an acceptable range.
The brake system contains eight brake/skid
control valves.
Each valve controls the
Panel 014
BRAKES
MN A
ON

Power
OF F

To skid control
Panel 015
BRAKES
MN B
ON

Hydraulic
power
OF F

Panel 016

Panel F3

Commander
pedals

Pilot pedals

Transducers (8)

Transducers (8)

ANTISKI D
FAIL

Brake/skid control boxes

A and B
(4 circuits per box)
Switch
valve
Switch
valve

Switch
Brake/skid control valve
valves (8)
Switch
valve

To skid
control

Wheel speed
sensors (8)
(2 per wheel)

No-weight-on
-main-gear
sensors

Hydraulic
power

Brake chambers (8)

(2 per wheel)

BRAKES
MN C
ON

OF F

The anti-skid system control circuits contain

fault detection logic. The yellow ANTI SKID
FAIL caution and warning light on panel F3
will be illuminated if the anti-skid fault
detection circuit detects an open circuit or short
in a wheel speed sensor or control valve
servocoil, or a failure in an anti-skid control
circuit. A failure of these items will only
deactivate the failed circuit, not total anti-skid
control. If the BRAKES switches on panels O14,
O15, and O16 are ON, and the ANTISKID
switch on panel L2 is OFF, the ANTISKID FAIL
caution and warning light will also be
illuminated.

Panel L2
To skid
control

ANTISKI D
ON

Main wheels (4)

OF F

553.cvs

Brake/Skid Control System Overview

2.14-7

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A

ANTI SKID FAIL Caution and Warning Light on Panel F3

Panel L2

Panel 014

Panel 015

Panel 016

ANTISKID
ON

BRAKES
MN A
ON

BRAKES
MN B
ON

BRAKES
MN C
ON

Panel F3
ANTISKID
FAIL

OFF

OFF

Anti-skid
Switch
ON

OFF

OFF

Brake Power
Switch
ON

OFF

Anti-skid
Failure*

OFF

YES

* Anti-skid fault detection circuits detect any of the

following failures:
- Open or short in a wheel speed sensor circuit
- Open or short in a skid control servovalve circuit
- Failure in an anti-skid control circuit

NO

Anti-skid**
Fail Light
ON

OFF

** Applies only if brake

power switches MN B,
MN C or both are
ac t i vat ed.

Note: A failure will deactivate only the failed circuit and not total anti-skid control.
555.cvs

Anti-Skid Fail Light Status

Temperature Control
Insulation and electrical heaters are installed on
the portions of the hydraulic systems that are
not adequately thermally conditioned by the
individual hydraulic circulation pump system
because of stagnant hydraulic fluid areas.
Redundant electrical heaters are installed on the
main landing hydraulic flexible lines located on
the back side of each main landing gear strut
between the brake module and brakes. These
2. SYSTEMS
2.14 Landing/Deceleration System

heaters are required because the hydraulic fluid

systems are dead-ended, and fluid cannot be
circulated with the circulation pumps. The
hydraulic system 1 lines to the nose landing gear
are located in a tunnel between the crew
compartment and forward fuselage. The passive
thermal control systems are attached to the crew
compartment, which leaves the hydraulic system
1 lines to the nose landing gear exposed to
environmental temperatures, thus requiring
electrical heaters on the lines in the tunnel.

2.14-8

USA007587
Rev. A
The HYDRAULICS BRAKE HEATER A, B, and C
switches on panel R4 enable the heater circuits.
The HYDRAULICS BRAKE HEATER switches A,
B, and C provide electrical power from the
corresponding main buses A, B, and C to the
redundant heaters on the main landing gear
flexible lines and the hydraulic system 1 lines in
the tunnel between the crew compartment and
forward fuselage leading to the nose landing
gear.

rudder pedals. Two types of operation are

available, GPC and caster. The GPC mode is
supported by hydraulic systems 1 and 2
through the selection of nose wheel steering
(NWS) system 1 or 2. This provides redundant
avionics modes regardless of hydraulic system
support. NWS 1 or 2 will work with either
hydraulic system 1 or 2.
In the GPC modes, the flight control software uses
accelerometer assembly feedback to modify
commands from the rudder pedal transducer
assemblies (RPTAs) to automatically counter
hardovers or large lateral accelerations due to
gear or tire malfunctions. If GPC 1 or 2, or FF1 or
2 is inoperative, steering downmodes to caster if
NWS 1 is selected. Similarly, the loss of GPC 3 or
4, or FF3 or 4 will prevent the use of NWS 2 and
cause a downmode. The loss of either NWS
system will only cause a downmode to castor.
The other NWS system must be selected if
required. In caster, no positive control over the
nose wheel position is available, and differential
braking and rudder are used for directional control.
A hydraulic servoactuator mounted on the nose
strut permits orbiter NWS up to 9 left or right
after system activation. Hydraulic systems 1
and 2 provide redundant hydraulic pressure to
either NWS 1 or 2. If NWS is not activated, or if
hydraulic systems 1 and 2 fail, the NWS
actuator acts as a nose wheel shimmy damper
in the caster mode.

HYDRAULICS BRAKE HEATER Switches on

Panel R4

Nose Wheel Steering

The nose landing gear contains a hydraulic
steering actuator that responds to electronic
commands from the commander's or pilot's

NWS can only be enabled after certain preconditions are met. Among these preconditions
are three major milestones: weight-on-wheels
(WOW), pitch angle () less than 0, and weighton-nose-gear (WONG). There are three sensors
on each main gear designed to sense when main
gear touchdown (MGTD) occurs so that WOW
can be set. One sensor is a proximity sensor and
the other two are wheel speed sensors (one per
tire). Once WOW is set, the speed brake is
commanded full open, flat turn discrete is set,
half gain RHC is enabled, and the HUD format
downmodes. After WOW is set on one strut,
brakes are also enabled.

2.14-9

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A
pushbutton and
pushbutton.

then

the

guarded

DN

NOTE
Deploying the landing gear at equivalent
airspeeds greater than 312 knots may
result in high aerodynamic loads on the
doors and interference with the normal
opening sequence.

1105.cnv

Commanders LANDING GEAR Controls

on Panel F6
OI-21 NWS Functional Drawing
WONG can be set by either of two proximity
sensors located on the nose gear. Once WONG
is set (presupposing WOW is already set and
the vehicle attitude (theta) is less than zero), the
ground speed enable "flag" is set. This enables
NWS and the I-loaded downward deflection of
the elevons for tire load relief. As a backup to
the WOW and WONG discretes, the crew
nominally selects SRB SEP MAN/AUTO and
presses the associated pushbutton. This will
manually bypass the WOW/WONG discretes
and set the ground speed enable "flag." Per the
entry procedure, this should be accomplished
just after nose gear touchdown. Taking the F7
SEP Switch to MAN and pressing the associated
pushbutton is an alternate method of manually
backing up WOW/WONG.

Operations
Landing Gear
Landing gear deployment is initiated when the
commander (on panel F6) or pilot (on panel F8)
depresses the guarded LANDING GEAR ARM
2. SYSTEMS
2.14 Landing/Deceleration System

1106.cnv

Pilots LANDING GEAR Controls on Panel F8

Depressing the ARM pushbutton energizes
latching relays for the landing gear extend
valves 1 and 2 in preparation for gear deploy. It
also arms the nose and main landing gear
pyrotechnic initiator controllers and illuminates
the yellow light in the ARM pushbutton. This is
normally performed by the pilot at approximately 2,000 feet above ground level (AGL).
The DN pushbutton is then depressed. This
energizes latching relays that open the
hydraulic system 1 extend valve 1 and
hydraulic system 2 landing gear extend valve 2.

2.14-10

USA007587
Rev. A
Fluid in hydraulic system 1 flows to the landing
gear uplock and strut actuators and the NWS
switching valve. The green light in the DN
pushbutton indicator is illuminated. Normally,
the DN pushbutton is pressed at least 15
seconds before touchdown at an altitude of 300
feet 100 feet and at an airspeed no greater
than 312 KEAS.
The proximity switches on the nose and main
landing gear doors and struts provide electrical
signals to control the LANDING GEAR NOSE,
LEFT, and RIGHT indicators on panels F6 and
F8. The output signals of the landing gear and
door uplock switches drive the landing gear UP
position indicators and the backup pyrotechnic
release system. The output signals of the
landing gear downlock switches drive the
landing gear DN position indicators.
The
landing gear indicators are barberpole when the
gear is in transit.
The left and right main landing gear WOW
switches produce output signals to the
guidance, navigation, and control software to
reconfigure the flight control system for landing
and rollout gains.
The two WONG signals, along with WOW and
theta (pitch angle) less than 0, allow the GNC
software to issue a nose wheel steering enable
signal. This signal is then sent to the steering
control box to enable nose wheel steering.
Six gear proximity switches are signal conditioned by the landing gear proximity sensor
electronics box 1, located in avionics bay 1. Six
additional gear proximity switches are signal
conditioned by the landing gear proximity
sensor electronics box 2, located in avionics bay
2. All WOW proximity switches are redundant
through two signal conditioners.
Hydraulic system 1 source pressure is routed to
the nose and main landing gear uplock
actuators, which releases the nose and main
landing gear and door uplock hooks. As the
uplock hooks are released, the gear begins its
deployment. During gear extension, a camming
action opens the landing gear doors. The
landing gear free falls into the extended position, assisted by the strut actuators and
airstream in the deployment. The hydraulic

strut actuator incorporates a hydraulic fluid

flowthrough orifice (snubber) to control the rate
of landing gear extension and thereby prevent
damage to the gear's downlock linkages.
The BRAKE ISOL 1, 2, and 3 are opened via a
GPC command sent after weight on the main
gear is sensed. The landing gear isolation
valves cannot be opened or closed with
hydraulic pressures less than approximately 100
psi. Hydraulic systems 1 and 2 share the
braking duties, each providing hydraulic
pressure to one-half of the braking pucks.
Hydraulic system 3 provides the backup
pressure for all the braking pucks. Landing
gear extend valve 2 is located downstream of
brake isolation valve 2. Since brake isolation
valve 2 is opened after weight on wheels is
present, hydraulic system 2 can only be used for
redundant nose gear deploy if the brake isol 2 is
manually opened early.
The BRAKE ISOL VLV 2 and 3 switches on
panel R4 positioned to CLOSE isolate the
corresponding hydraulic system from the main
landing gear brake control valves. The adjacent
talkback indicator would indicate CL. When
switches 2 and 3 are positioned to OPEN, the
corresponding
hydraulic
system
source
pressure is available to the main landing gear
brake control valves.
The corresponding
talkback indicator would indicate OP. Landing
gear extend valve 2 is located downstream of
brake isolation valve 2. This valve further
isolates hydraulic system 2 supply pressure
from the nose wheel steering and nose landing
gear deploy actuators and is opened by a
LANDING GEAR DN command.
When the nose and main LANDING GEAR DN
command is initiated, hydraulic system 1
pressure is directed to the nose and main
landing gear uplock hook actuators and strut
actuators to actuate the mechanical uplock hook
for each landing gear. This will allow the gear
to be deployed and provide hydraulic system 1
pressure to the nose wheel steering actuator.
The landing gear/nose wheel steering hydraulic
system switching valve will automatically select
hydraulic system 2 supply pressure if system 1
should fail, thereby providing redundant
hydraulics for NWS actuation and nose gear
deploy.

2.14-11

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A
NOTE
Hydraulic system 1 is the only hydraulic
system for deploy of the main landing
gear.
If the hydraulic system fails to release the
landing gear within 1 second after the DN
pushbutton is depressed, the nose and left and
right main landing gear uplock sensors
(proximity switches) will provide inputs to the
pyro initiator controllers (PICs) for initiation of
the redundant NASA standard initiators (pyro
system 1 and 2). They release the same uplock
hooks as the hydraulic system. As mentioned
earlier, the nose landing gear, in addition, has a
PIC and redundant NASA standard initiators
that initiate a pyrotechnic power thruster 2
seconds after the DN pushbutton is depressed
to assist gear deployment. This "nose gear pyro
assist" pyro fires every time the gear are
deployed.
The landing gear drag brace overcenter lock
and spring-loaded bungee lock the nose and
main landing gear in the down position.
Two series valves, landing gear retract control
valve 1 and 2, prevent hydraulic pressure from
being directed to the retract side of the nose and
main landing gear uplock hook actuators and
strut actuators if the retract/circulation valve
fails to open during nose and main landing gear
deployment.
During the landing sequence, GNC software
commands the landing gear extend isolation
valve OPEN at 0.8 Mach. The crew will verify
the valve is open at 0.7 Mach, ARM the gear at
2000 ft, and passing 300 feet, DEPLOY the gear.
Brake ISO VLV 1, 2, and 3 are automatically
opened after weight on the main gear is sensed
with GPC commands via MDM FA1, FA2, and
FA3, respectively.
NWS is activated once
weight is sensed on the nosewheel. The pilot
verifies that the brake isolation valves are open
for landing rollout. Should the gear or brake
isolation valves fail to automatically OPEN, the
pilot manually opens them using switches on
panel R4.

2. SYSTEMS
2.14 Landing/Deceleration System

BRAKE ISOL VLV Switches and Talkbacks on

Panel R4
Ground Reset
Landing gear reset is a post landing function,
which will be performed by the crew.
The LG ARM/DN RESET switch on panel A12
positioned to RESET unlatches the relays that
were latched during landing gear deployment
by the LANDING GEAR ARM and DN
pushbutton indicators. The primary function of
this procedure is to remove power to the PIC
circuits that are still charged as a backup
landing gear deploy method.
The RESET
position also will extinguish the yellow light in
the ARM pushbutton indicator and the green
light in the DN pushbutton.
Drag Chute
During entry, at a velocity between 8000 to 3500
fps, the main engine bells are repositioned 10
below the nominal to preclude damage during
drag chute deployment.
The crew cannot
monitor the bell repositioning but can
determine that the system is enabled at item 19

2.14-12

USA007587
Rev. A

LG ARM/DN RESET Switch on Panel A12

on the SPEC 51 OVERRIDE display. The crew
can inhibit the repositioning while in MM 301304 by toggling item 19 in SPEC 51. Nominal
EOM drag chute deployment will be initiated
only if main engine bell repositioning is
enabled.
Although the drag chute may be deployed at
speeds up to 230 KEAS, current EOM procedures
call for its deployment at 195 KEAS with a
crosswind component no greater than 15 knots.
If the drag chute is deployed above 230 KEAS,
the drag chute pivot pin is designed to fail,
resulting in the chute being jettisoned. Approximately one second after the CDR or PLT presses
the ARM 1(2) and DPY 1(2) pushbuttons simultaneously, the pilot chute deploys. Within 1
second, the pilot chute extracts the main chute,
which deploys to its 40 percent reefed diameter.
After about 3.5 seconds of reefed deployment,
two cutters sever the reefing ribbon allowing the
main chute to inflate to its full 40-foot diameter.

WARNING
Deployment of the drag chute between 135
and 40 ft AGL can cause loss of control of
the vehicle. Drag chute jettison must be
initiated immediately to prevent loss of the
vehicle and crew.
At 60 (20) KGS, the drag chute will be
jettisoned. Below 40 KGS, if drag chute jettison
has not been initiated, the chute will be retained
until the orbiter has stopped to minimize
damage to the main engine bells.
Brake Controls
The BRAKES MN A, MN B, and MN C switches
are located on panels O14, O15, and O16. These
switches
allow
electrical
power
to
brake/anti-skid control boxes A and B. The
ANTISKID switch located on panel L2 provides
electrical power for enabling the anti-skid

2.14-13

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A
portion of the braking system boxes A and B.
The BRAKES MN A, MN B, and MN C switches
are positioned to ON to supply electrical power
to brake boxes A and B, and to OFF to remove
electrical power. The ANTISKID switch is
positioned to ON to enable the anti-skid system,
and OFF to disable the system.
When weight is sensed on the main landing
gear, the brake/anti-skid boxes A and B are
enabled and brake isolation valves 1, 2, and 3
are opened, permitting the main landing gear
brakes to become operational.

BRAKES Switch on Panel O15

BRAKES Switch on Panel O14

BRAKES Switch on Panel O16

ANTISKID Switch on Panel L2
The main landing gear brakes controlled by the
commander's or pilot's brake pedals are located
on the rudder pedal assemblies at the commander's and pilot's stations. Pressure on the
toe of the adjustable brake/rudder pedals
results in a command to the wheel braking
system.
Each brake pedal has four transducers. The left
pedal transducer unit outputs four separate
braking signals through the brake/skid control
2. SYSTEMS
2.14 Landing/Deceleration System

2.14-14

USA007587
Rev. A
boxes for braking control of the two left main
wheels. The right pedal transducer unit does
likewise for the two right main wheels. When
the brake pedal is deflected, the transducers
transmit electrical signals of 0 to 5 volts DC to
the brake/anti-skid control boxes.
If both right pedals are moved, the pedal with
the greatest toe pressure becomes the controlling pedal through electronic OR circuits. The
electrical signal is proportional to the toe pressure. The electrical output energizes the main
landing gear brake coils proportionately to
brake pedal deflection, allowing the desired
hydraulic pressure to be directed to the main
landing gear brakes for braking action. The
brake system bungee at each brake pedal
provides the artificial braking feel to the
crewmember.

NOSE WHEEL STEERING Switch

on Panel L2

Nose Wheel Steering

GPC Mode
The NOSE WHEEL STEERING switch on panel L2
positioned to NWS 1(2) enables the corresponding
NWS (avionics) system. In addition to the NWS
mode selections of the switch, the FLIGHT CNTLR
POWER switch on panel F8 must be positioned to
ON, and the flight control system ROLL/YAW CSS
pushbutton on panel F2 or F4 must be depressed
to enable the GPC for nose wheel steering. When
either pushbutton is depressed, a white light
illuminates the pushbutton.

When the commander or pilot makes an input

to the rudder pedals in the NWS 1(2) mode, the
rudder pedal command position is appropriately scaled within the GPC's software and
transmitted to a summing network, along with
lateral accelerometer inputs from within the
flight control system. The accelerometer inputs
are utilized to prevent any sudden orbiter
lateral deviation. From this summing network,
a nose wheel steering command is sent to
comparison network, as well as to the steering
servo system.

ROLL/YAW CSS Pushbutton on Panel F2

NWS FAIL Light on Panel F3

2.14-15

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A
Steering position transducers on the nose wheel
strut receive redundant electrical excitation
from the steering position amplifier, which
receives redundant electrical power from data
display unit 2.
Each of the three transducers transmits nose
wheel position feedback to a redundancy
management mid-value-select software. It then
transmits a nose wheel position signal to the
comparison network. The orbiter nose wheel
commanded and actual positions are compared
for position error and for rates to reduce any

2. SYSTEMS
2.14 Landing/Deceleration System

error. Absence of an error condition will allow

nose wheel steering to be enabled after WOW,
WONG, and theta less than 0 are sensed in the
software. The enable signal permits hydraulic
system 1(2) pressure to be applied to the nose
wheel steering actuator from the NWS
switching valve. If hydraulic system 1 is lost,
hydraulic system 2 provides the pressure for
nose wheel steering. If both systems' pressures
drop below approximately 1,325 psi, the
actuator remains in the caster mode and a
failure is annunciated to the NWS FAIL C/W
yellow light on panel F3.

2.14-16

USA007587
Rev. A

Landing/Deceleration System Summary

Data

Landing/Deceleration System Rules of

Thumb

The orbiter has the capability of landing on

a runway using a tricycle type of landing
gear system. Once the orbiter touches
down, the crew begins braking and
steering operations.

Landing gear should not be deployed at

equivalent airspeeds greater than 312
knots.
1 knot of touchdown speed corresponds
to 90 feet of distance. This is often
rounded up to 100 feet for convenience.

The landing gear consists of a nose landing

gear and a left and right main landing
gear. Each landing gear includes a shock
strut with two wheel and tire assemblies.
The nose wheels are co-rotating through a
common axle, whereas the main gear
wheels rotate independently.
Each of the four main landing gear wheels
has electrohydraulic brakes and an antiskid system.
Each gear wheel brake
assembly is supplied with pressure from
two different hydraulic systems. Systems 1
and 2 are the primary hydraulic systems
for brake pressure; system 3 can back up
either or both systems.
Redundant electrical heaters are installed
on the main landing hydraulic flexible
lines located on the back side of each main
landing gear strut between the brake
module and brakes.
The orbiter nose wheel is steerable after
nose wheel touchdown at landing.
ANTI SKID FAIL and NWS FAIL caution
and warning lights are located on panel F3.
Landing/deceleration controls are located
on panels F6, F8, R4, L2, F2, F4, A12, O14,
O15, and O16.

2.14-17

2. SYSTEMS
2.14 Landing/Deceleration System

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.14 Landing/Deceleration System

2.14-18

USA007587
Rev. A

2.15

Interior Lighting

LIGHTING SYSTEM

Interior floodlights provide general illumination

throughout the crew cabin and allow the crew to
function within the flight deck, middeck, airlock,
tunnel adapter, and Spacehab (if installed).
Circuit breakers, switches, and variable controls
are used to operate the lights. Both fluorescent
and incandescent lamps are used.

CONTENTS
Description.............................................
Interior Lighting ....................................
Exterior Lighting ...................................
Lighting System Summary Data .........
Lighting System Rules of Thumb .......

2.15-1
2.15-1
2.15-14
2.15-16
2.15-16

Emergency lighting is provided by selected

fixtures that are powered via a separate power
input from an essential bus. Existing floodlights
are used, but a separate input powers the lights.

Mission station
floodlight
(fluorescent)
Right seat/center
console floodlight
(incandescent)
Right console
floodlight
(incandescent)

Right glareshield
floodlights
(fluorescent)
Left glareshield
floodlights
(fluorescent)

*
Orbit station
floodlight
(fluorescent)
Left seat/center
console floodlight
(incandescent)

Left console
floodlight (fluorescent)
Payload station
floodlight (fluorescent)
Left seat/center console
floodlight (fluorescent)
Left console floodlight
(fluorescent)

Flight deck
top view

Payload station
floodlight
(fluorescent)

Orbit station
floodlight
(fluorescent)

Left glareshield floodlights

(fluorescent)

Flight deck
side view
*Indicates an emergency light
568.cvs

Floodlight Locations Flight Deck Forward and Aft

Description

Dual fluorescent lamp fixtures provide lighting

for the glareshield, mission station, and payload
station floodlights. The mission station lighting
is controlled by the MS LIGHTING FLOOD
ON/OFF switch on panel R10; the adjacent
rotary control DIM/BRT switch controls brightness. The payload station lighting is controlled
by the PS FLOOD ON/OFF switch on panel L9,
which also has an adjacent DIM/BRT rotary
switch to control brightness.
A single fluorescent lamp fixture with an integral
off/variable-on is employed on each side of the
commanders and pilots side consoles and the
orbit station. The commanders glareshield light,
which consists of left inboard (dual lamp) and
left outboard (dual lamp), is controlled by the
LIGHTING LEFT GLARESHIELD FLOOD
BRIGHT, VAR, OFF switch and a DIM, BRT
rotary control on panel O6. (The DIM, BRT
rotary control operates in conjunction with the
VAR position.) The pilots glareshield light
functions the same as the commanders, except
the controls (LIGHTING RIGHT GLARESHIELD
FLOOD and DIM, BRT) are on panel O8.

The lighting system provides both interior and

exterior lighting. Interior lighting encompasses
display and control visibility and general crew
station and crew equipment operations.
Exterior lighting provides illumination for
payload bay door operations, EVA, remote
manipulator system operations, stationkeeping,
and docking.
Interior lighting consists of
floodlights, panel lights, instrument lights,
numeric lights, and annunciator lights. Exterior
lighting includes floodlights, spotlights, and
docking lights.
2.15-1

MS LIGHTING Controls on Panel R10

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A
the DIM, BRT rotary control on panel O6. The
pilots seat or console light is controlled by the
RIGHT SEAT/CTR CNSL FLOOD, SEAT/OFF/
CTR CNSL switch and the DIM, BRT rotary
control on panel O8.

PS FLOOD Lighting Controls on Panel L9

Pilots Light Controls on Panel O8

CDR LIGHTING Controls on Panel O6

The commanders side console light is controlled
by an integral off/variable-on control switch on
the fixture. The pilots side console light is
controlled by the same type of control switch on
the fixture. The orbit station light is controlled by
the ORBIT STATION LIGHTING FLOOD
ON/OFF switch and DIM, BRT rotary control on
panel A6U. There are two seat/center console
floodlights: one for the commander and one for
the pilot. Each light has two incandescent bulbs:
the left one illuminates the commanders lap or
the center console, and the other illuminates the
pilots lap or the center console. The commander
or pilot can select either the lap or center console,
but not both at once. The commanders seat or
console light is controlled by the LEFT SEAT/CTR
CNSL FLOOD, SEAT/OFF/CTR CNSL switch and
2. SYSTEMS
2.15 Lighting System

Eight middeck ceiling floodlight fixtures are

located behind a translucent polycarbonate
material. They are the same fixtures as those at
the orbit station and are individually controlled
by MID DECK FLOODS ON/OFF switches on
panel MO13Q. The middeck panel MO13Q is
lighted by a small fluorescent lamp at each end
of the recessed panel and is controlled by the
MO13Q LTG ON/OFF switch on the panel.
The waste management compartment floodlight
is also the same as the orbit station fixture and
is controlled by the WASTE MANAGEMENT
COMPARTMENT FLOOD ON/OFF switch on
panel ML18F.
The middeck sleep station bunks (if installed)
use the same floodlights as the commanders
and pilots flight deck consoles and are also
controlled individually.
The airlock floodlights are similar to those at the
commanders and pilots flight deck side
consoles, except they are controlled by LIGHTING FLOOD switches on panel AW18A and an
AIRLOCK 2 switch on panel MO13Q.

2.15-2

USA007587
Rev. A

ORBIT STATION LIGHTING Controls on Panel A6U

MID DECK FLOODS Controls on Panel MO13Q

2.15-3

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A

Floodlight Locations - Middeck and Airlock

2. SYSTEMS
2.15 Lighting System

2.15-4

USA007587
Rev. A
If the tunnel adapter is installed, the floodlights
are similar to those at the commanders and
pilots side consoles. Tunnel adapter lights 2, 3,
and 4 are controlled by individual ON/OFF
switches on the tunnel adapter panel TW58T.
Tunnel adapter light 1 is controlled by the
TUNNEL ADAPTER 1 ON/OFF switch on panel
MO13Q and the ON/OFF 1 switch on the tunnel
adapter panel.

EMERGENCY LIGHTING and WASTE

MANAGEMENT COMPARTMENT FLOOD
Lighting Control Switches on Panel ML18F

The Spacehab (if installed) can accommodate

different flight configurations, either a single
module or a double module configuration.
Each module has four overhead floodlights.
The fixtures are single-lamp floodlights with an
integral dimmer control on three. There is a
main switch located on the monitor and control
panel (MCP) at the entrance of the module that
powers three floodlights per module. The
emergency lighting system powers the remaining one floodlight per module in the event of a
power failure. The Spacehab has a caution and
warning (C&W) system that enables the master
alarm light switch closure.
The C&W
luminaries are located on the MCP in the
Spacehab.

AIRLOCK 2 and TUNNEL ADAPTER Lighting Controls on Panel MO13Q

2.15-5

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A

Airlock Flood LIGHTING Switches on Panel AW18A

(Switches on Tunnel Adapter Panel TW58T are in
Identical Configuration)

EMERGENCY LIGHTING
Switch on Panel C3
The emergency floodlights for the crew module
are controlled by EMERGENCY LIGHTING
ON/OFF switches on either panel C3 or ML18F.
The emergency lighting system is powering the
floodlights when both panel switches are in the
same position. When the emergency system is
turned on, a relay is activated that configures the
lights to full bright. Chem lights are available for
crewmembers during minimum floodlight
operations.

2. SYSTEMS
2.15 Lighting System

Panel Lighting
Many flight deck instrument panels have
integral lighting that illuminates the panel
nomenclature and markings on the displays and
controls. This illumination aids the flight crew
in locating displays and controls while
operating the orbiter. Panel lighting is transmitted from behind a panel overlay through the
panel nomenclature, making it appear whitelighted. It is also transmitted to the edges of the
displays and controls for general illumination.

2.15-6

USA007587
Rev. A
The lighting source consists of small
incandescent, grain-of-wheat lamps mounted
between the metal panel face and the plastic
panel overlay. The overlay has a layer of white
paint and a layer of gray paint on the top
surface. The panel nomenclature is formed by
etching the letters and symbols into the gray
paint, leaving the white layer underneath.
On panel L4, panel lighting circuit breakers are
found in the Q row: PANEL L/CTR, L OVHD;
PANEL R OVHD, R; and PANEL MS, OS. The
lighting circuit breakers are generally out for
day launches.
LIGHTING PANEL LEFT/
CENTER and LEFT OVERHEAD OFF/BRT
rotary switches are found on panel O6.
LIGHTING PANEL RIGHT and RIGHT
OVERHEAD OFF/BRT rotary switches are
located on panel O8. A LIGHTING PANEL
OFF/BRT rotary switch is located on panel R10.
An ORBIT STATION LIGHTING PANEL
OFF/BRT rotary switch is located on panel A6U.

Instrument Lighting
The flight deck instruments have internal
integral lighting that illuminates the face to
enable the flight crew to read the displayed
data. Lighting is provided by incandescent
lamps located behind the face of the instruments. Prisms are used to distribute the light
evenly over the face. Circuit breakers labeled
INST OS, INST R, INST OVHD, and INST
L/CTR are located in rows Q and R on panel L4.
LIGHTING INSTRUMENT LEFT/CTR and
OVERHEAD OFF/BRT rotary switches are
located on panel O6. A LIGHTING PANEL
RIGHT INSTRUMENT OFF/BRT rotary switch
is located on panel O8. An ORBIT STATION
LIGHTING INSTRUMENT OFF/BRT rotary
switch is located on panel A6U.

2.15-7

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A

PANEL INST and NUMERIC Circuit Breakers on Panel L4

2. SYSTEMS
2.15 Lighting System

2.15-8

USA007587
Rev. A

PANEL, INSTRUMENT, and NUMERIC

Lighting Controls on Panel O8

PANEL and INSTRUMENT LIGHTING

Controls on Panel O6

PANEL, INSTRUMENT, and NUMERIC Lighting on Panel A6U

2.15-9

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A
Numeric Lighting
Indicators on the flight deck use illuminated
numeric (digital) readouts to display data. The
illumination is provided by a single incandescent lamp in each segment of a digit. Seven
segments are required to generate the numbers
zero through nine. Each numeric indicator has
a red light to indicate failures in the indicator
and will be illuminated when any lamp in the
indicator fails. The numeric (digital) indicators
are EVENT TIME (panels F7 and A4), MISSION
TIME (panels O3 and A4), RCS/OMS PRPLT
QTY (panel O3), and RANGE/ELEVATION and
RANGE RATE/AZIMUTH (rendezvous radar)
on panel A2. The LIGHTING NUMERIC OS
circuit breaker is located in row Q on panel L4.
A LIGHTING NUMERIC OFF/BRT rotary switch
is located on panel O8, and an ORBIT STATION
LIGHTING NUMERIC OFF/BRT rotary switch is
located on panel A6U. The RMS (if installed)
has numeric readouts on panel A8U.

1114.cnv

EVENT TIME Numeric (Digital) Indicator

on Panel F7

PANEL Lighting Control on Panel R10

MISSION TIME and EVENT TIME Numeric
(Digital) Indicators on A4

RCS/OMS PRPLT QTY and MISSION TIME

Numeric (Digital) Indicators on panel O3

2. SYSTEMS
2.15 Lighting System

2.15-10

USA007587
Rev. A

RANGE/ELEVATION AND RANGE RATE/AZIMUTH

Numeric (Digital) Indicators on Panel A2

LIGHTING NUMERIC Rotary Switch on

Panel O8

ORBIT STATION LIGHTING NUMERIC

Rotary Switch on Panel A6U

2.15-11

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A
Annunciator Lights
Annunciators provide visual indications of
vehicle and payload systems status.
The
annunciator lights are classified as emergency,
warning, caution, and advisory. Emergency
and warning annunciators are red, and cautions
are yellow. Advisory annunciators may be
white (status), green (normal configuration),
yellow (alternate configuration), or blue (special
applications).
Annunciator lighting is provided by incandescent lamps that illuminate the lens area of the
annunciators. Most annunciators are driven by
an annunciator control assembly, which
controls the illumination of the lights during a
normal or test input and also controls the
brightness level. The caution and warning
status lights on panel F7 and the GPC STATUS
lights on panel O1 have separate electronic
units for lighting control. Some annunciator
lighting is provided by directly driven light
emitting diodes (LEDs).

annunciator lights associated with ACA 1.

ACAs 2 and 3 are enabled by positioning the
BUS SELECT ACA 2/3 switch to either the MN B
or MN C position, and thus the annunciator
lights associated with ACAs 2 and 3. BUS
SELECT ACA 2/3 also provides electrical power
to the annunciator light INTENSITY BRIGHT,
VAR switch on panel O6 and the LOW, MED
rotary control on panel O6, thus controlling the
intensity of the annunciator lights associated
with ACAs 2 and 3. The OFF position of the
BUS SELECT ACA 1 switch removes power
from ACA 1, disabling the annunciator lights
associated with it. The OFF position of the BUS
SELECT ACA 2/3 switch removes power from
ACAs 2 and 3, disabling the annunciator lights
associated with them.

Three different lens configurations exist for the

pushbutton indicators and indicator lights. One
configuration has illuminated nomenclature in
the appropriate color on an opaque black
background. The nomenclature cannot be seen
until it is illuminated. Another configuration
has non-illuminated white nomenclature on an
opaque black background and a bar that
illuminates in the appropriate color.
The
nomenclature in this configuration is always
visible. The third configuration has a bar that
illuminates on an opaque black background and
no nomenclature on the lens, but nomenclature
is available as part of the panel.
The forward flight deck ANNUNCIATOR BUS
SELECT ACA 1 and ACA 2/3 switches on panel
O6 provide electrical power to enable the
corresponding AC power supplies. (Section 2.8
has details on the power system and associated
terminology.) ACA 1 is enabled by positioning
BUS SELECT ACA 1 to either the MN A or MN
B position, and thus the annunciator lights
associated with ACA 1. BUS SELECT ACA 1
also provides electrical power to the
ANNUNCIATOR INTENSITY BRIGHT, VAR
switch and the LOW, MED rotary switch on
panel O6, controlling the intensity of the
2. SYSTEMS
2.15 Lighting System

1115.cnv

ANNUNCIATOR Lighting
Controls on Panel O6

MASTER
ALARM

CSS

Illuminated
Illuminated barnomenclature
white nomenclature
(Nomenclature is black
when not illuminated).

Illuminated barno nomenclature

(Bars appear black when not illuminated).

All backgrounds are opaque black.

2.15-12

592.cvs

Typical Annunciator Configurations

USA007587
Rev. A
The ANNUNCIATOR INTENSITY switch on
panel O6 positioned to BRIGHT bypasses the
INTENSITY LOW, MED rotary control. The
ANNUNCIATOR INTENSITY switch positioned
to VAR permits the INTENSITY LOW, MED
rotary control to control annunciator light
intensity.

through 4 on panel R13U. Positioning the

switch to RIGHT applies power to the ACA 4
and 5 annunciator lamp test circuits, illuminating the annunciator lights (MASTER ALARM)
and VIDEO OUTPUT and ALC/GAMMA
pushbuttons on panel A7U and columns 5
through 9 on panel R13U.

The ANNUNCIATOR LAMP TEST switch on

panel O6 or O8 positioned to LEFT applies power
to the ACA 1, 2, and 3 annunciator lamp test
circuits, illuminating annunciator lights on
panels F2 (MASTER ALARM), F6, L1 (SMOKE
DETECTION), O1 (GPC STATUS), and M029J,
the left 20 C/W lights on panel F7, and the SM
ALERT on panel F7. Positioning the LAMP TEST
switches to RIGHT applies power to the ACA 1,
2, and 3 annunciator lamp test circuits,
illuminating the annunciator lights on panels C3,
F4 (MASTER ALARM), F8, and M052J (MASTER
ALARM), the right 20 C/W lights on panel F7,
and the MAIN ENGINE STATUS lights on panel
F7.
The aft flight deck ANNUNCIATOR BUS
SELECT switch on panel A6U provides electrical
power to enable ACAs 4 and 5. ACAs 4 and 5
are enabled by positioning BUS SELECT to either
the MN B or MN C position, and thus the
annunciator lights associated with ACAs 4 and 5.
The BUS SELECT switch also provides electrical
power to the annunciator light INTENSITY
BRIGHT, VAR switch and the LOW, MED rotary
control on panel A6U, thus controlling
annunciator light intensity associated with ACAs
4 and 5. The OFF position of the BUS SELECT
switch removes power from ACAs 4 and 5,
disabling the annunciator lights associated with
them.

ANNUNCIATOR LAMP TEST Switch

on Panel O8

The ANNUNCIATOR INTENSITY switch on

panel A6U, when positioned to BRIGHT,
bypasses the INTENSITY LOW, MED rotary
control on panel A6U. Positioned to VAR, it
permits the INTENSITY LOW, MED rotary
control to vary annunciator light intensity.
The ANNUNCIATOR LAMP TEST switch on
panel A6U, when positioned to LEFT, applies
power to the ACA 4 and 5 annunciator lamp
test circuits, illuminating the annunciator lights
on panels A2 and A6U, the VIDEO INPUT
pushbuttons on panel A7U, and columns 0
2.15-13

ANNUNCIATOR Lighting Controls

on Panel A6U
2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A

Exterior Lighting
The exterior floodlights improve visibility for
the crew during payload bay door operations,
EVA
operations,
RMS
operations,
stationkeeping, and docking.
Metal halide lamps light the payload bay. These
lamps are gas discharge arc tubes similar to
mercury vapor lamps.

the payload bay flood controls on panel A7U; it

has BRIGHT, DIM, and OFF settings. The RMS
floodlight is controlled by RMS SPOTLIGHT
STBD and PORT switches on panel A7U. The
DOCKING and FWD BHD switches are only active
for OV-104, where the lights are still installed. The
switches are physically present on OV-103 and -105,
but do not do anything.

After a floodlight is turned on, it takes 2 to 3

minutes to reach full brightness. It is recommended by the manufacturer that payload bay
floodlights remain powered for a minimum of
10 minutes before being turned off. The only
exception is if a floodlight fails to illuminate. If a
light does not reach full brightness in 5 minutes,
it should be unpowered. Also, when a light is
turned off, it should not be repowered for 10 to
16 minutes, depending on the amount of payload
blocking of the light. These time constraints will
help prolong floodlight life.
The premature failure of the lamps on a
previous flight may have been caused by not
waiting the required time before repowering the
lamps. It is better to leave the lamps powered
until the task is finished than to try to save
power by turning them off.
Each lamp has a separate DC/DC power supply
that produces the higher voltage required to
operate the lamps. Power for the lamps is
supplied by the mid power control assemblies,
using 10-amp remote power controllers to
control the lights.
The power supplies for the metal halide lamps
are mounted to the floodlight electronics
assemblies, which are cooled by the Freon
loops. The floodlight used for docking and the
forward bulkhead floodlight use a cold plate
cooled by the water loops. These two lights are
present only on OV-104, and have been removed
from OV-103 and OV-105 due to issues with the
water loop cold plate.
The payload bay floodlights are controlled by
switches on panel A7U. The panel contains
PAYLOAD BAY FLOOD AFT, MID, and FWD
sets of switches, with a STBD and PORT switch
in each set. The DOCKING light switch is below
2. SYSTEMS
2.15 Lighting System

2.15-14

PAYLOAD BAY FLOOD, DOCKING, and

RMS Lighting Controls on Panel A7U

USA007587
Rev. A

Forward bulkhead
floodlight (metal halide)
Overhead docking
floodlight
(incandescent)

Viewing
light

Television camera
(REF)

End
effector
(REF)

596.cvs

597.cvs

Bulkhead Floodlights (OV-104 only)

STBD
F WD

Remote Manipulator System Wrist Floodlight

Y = 56
X = 750

X = 576

Y = -48

Y = 56

Y = 56

X = 979
Y = -56

Y = -56

X = 1140.67

Electrical wire tray

Payload bay floodlight (6-metal halide)

Electrical wire tray

Z = 325.2

Z = 320

Z = 325.2

Z = 325.2

598.cvs

Payload Bay Forward/Mid/Aft Floodlights

2.15-15

2. SYSTEMS
2.15 Lighting System

USA007587
Rev. A

Lighting System Summary Data

Lighting System Rules of Thumb

Interior lighting consisting of floodlights,

panel lights, instrument lights, numeric
lights, and annunciator lights provides general illumination throughout the crew cabin.

Power consumption of cockpit lighting can

be as much as 1 to 2 kW with all lights on.

Exterior floodlights and spotlights improve

visibility for the flight crew during payload
bay door operations, EVA operations, RMS
operations, stationkeeping, and docking.
Emergency lighting is provided by separate
fixtures powered by a separate power input
from an essential bus. Emergency lighting is
controlled by switches on panels C3 and
ML18F.

When payload bay floodlights are powered,

they should be left on for a minimum of 10
minutes.
When payload bay floodlights are turned off,
they should remain unpowered for 10 to 16
minutes prior to repowering.
If a payload bay floodlight does not reach
full brightness within 5 minutes of being
powered, it should be turned off.

Switches controlling the lighting system are

distributed over panels R10, L9, O6, O8,
A6U, A7U, MO13Q, ML18F, and AW18A.
Lighting system circuit breakers are located
on panel L4.

2. SYSTEMS
2.15 Lighting System

2.15-16

USA007587
Rev. A

2.16

data processing system controls most of the

MPS functions during ascent and entry.

MAIN PROPULSION SYSTEM

(MPS)

The MPS has three SSMEs, three SSME

controllers, the ET, the orbiter MPS propellant
management system and helium subsystem,
four ascent thrust vector control units, and six
SSME hydraulic TVC servoactuators. (The
external tank is described in detail in Section
1.3.) Most of the MPS is located in the aft
fuselage beneath the vertical stabilizer.

CONTENTS
Description..........................................
Space Shuttle Main Engines
(SSMEs) .....................................
Space Shuttle Main Engine
Controllers...........................................
Propellant Management System
(PMS).........................................
Helium System ...................................
MPS Hydraulic Systems....................
Malfunction Detection.......................
Operations...........................................
Post Insertion ......................................
Orbit ....................................................
Deorbit Prep........................................
Entry ....................................................
RTLS Abort Propellant Dump
Sequence ...................................
TAL Abort Propellant Dump
Sequence ...................................
MPS Caution and Warning
Summary ..................................
MPS Summary Data ..........................
MPS Rules of Thumb .........................

2.16-1
2.16-3
2.16-9
2.16-14
2.16-20
2.16-24
2.16-26
2.16-28
2.16-35
2.16-35
2.16-35
2.16-35
2.16-36
2.16-36
2.16-37
2.16-39
2.16-42

12-inch feed
8-inch liquid oxygen
fill and drain

Description
The space shuttle main engines (SSMEs),
assisted by two solid rocket motors during the
initial phases of the ascent trajectory, provide
vehicle acceleration from lift-off to main engine
cutoff (MECO) at a predetermined velocity.

17-inch feed
8-inch liquid hydrogen
fill and drain

Orbiter lower surface

LO2

LH2
External tank

The MPS has critical interfaces with the orbiter

hydraulic system, electrical power system,
master events controller, and data processing
system. The hydraulic system supplies hydraulic pressure to operate the main engine valves
and gimbal actuators. The electrical power
system furnishes ac power to operate the main
engine controllers and dc power to operate the
valves and transducers in the propellant
management and helium systems. The master
events controller initiates firings of pyrotechnic
devices to separate the SRBs from the external
tank and the external tank from the orbiter. The

Liquid hydrogen ground

umbilical disconnnect panel
Liquid oxygen ground
umbilical disconnnect panel

Liquid hydrogen engine inlet line

Liquid hydrogen
supply manifold

Engine no. 1
(center)

Orbiter-external
tank liquid hydrogen
disconnect

Engine no. 2
(left)

Liquid hydrogen recirculation

Engine no. 3
(right)
Heat
shield

Liquid oxygen supply manifold

Liquid hydrogen prevalve
Liquid oxygen prevalve

Engine gimbal bearing

Fluid system interface panel
(3)

Orbiter-external tank
liquid oxygen disconnect
Liquid oxygen engine inlet line
600.cvs

Main Propulsion System

2.16-1

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A

Pressure
Hydraulic
system

Return

Electrical
power
system

Power
Main
propulsion
system

Master
events
controller

Commands

Commands
Data

Data
processing
system

601.cvs

Critical Interfaces with the Main Propulsion System

Liquid propellants

Engine
data
and status

SSME
controller (3)
(mounted
on SSME)

Space
shuttle
main
engines
(3)

Engine
data

Gimbal
movement

GP's

Engine
data
and status

GP's

Commands

Ascent thrust
vector control
(in orbiter)

Helium
supply
(in orbiter)

Commands

Commands
Engine
interface
unit
(in orbiter)

Helium

Liquid hydrogen
recirculation

Helium

Helium
supply
(in orbiter)

Gaseous
propellants

Gaseous propellants

Liquid propellants

External tanks

Commands

Propellant
management system
(in orbiter)

Liquid hydrogen recirculation

Commands
Data

Thrust

Valve actuation

Engine gimbal
actuator fastened
to engine

Servovalve
isolation
status

Gimbal power

Orbiter APU
hydraulic power
602.cvs

Main Propulsion System Subsystem

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-2

USA007587
Rev. A
the main engines under pressure. Using a
staged combustion cycle, the propellants are
partially burned at high pressure and relatively
low temperature in two preburners, then completely burned at high pressure and high temperature in the main combustion chamber.
The engines are generally referred to as the
center (engine 1), left (engine 2), and right
(engine 3). Each engine is designed for 15,000
seconds of operation over a life span of 30
starts. Throughout the throttling range, the
ratio of the liquid oxygen to liquid hydrogen
mixture is 6:1. Each nozzle area ratio is 77.5:1.
The engines are 14 feet long and 7.5 feet in
diameter at the nozzle exit. Overall, a space
shuttle main engine weighs approximately
7,000 pounds.
The main engines can be throttled over a range
of 67 to 109 percent of their rated power level in
1-percent increments. A value of 100 percent
corresponds to a thrust level of 375,000 pounds
at sea level and 470,000 pounds in a vacuum;
104 percent corresponds to 393,800 pounds at
sea level and 488,800 pounds in a vacuum; 109
percent corresponds to 417,300 pounds at sea
level and 513,250 pounds in a vacuum.

Space Shuttle Main Engine

At sea level, flow separation in the nozzle

reduces the engine throttling range, prohibiting
operation of the engine at its minimum
67-percent throttle setting. All three main
engines receive the same throttle command at
the same time.
Normally, these come
automatically from the orbiter general-purpose
computers (GPCs) through the engine
controllers.
During certain contingency
situations, engine throttling may be controlled
manually through the pilot's speedbrake/thrust
controller. SSME throttling reduces vehicle
loads during maximum aerodynamic pressure
and limits vehicle acceleration to a maximum of
3 g's during ascent.

Main Engine Numbering System

Space Shuttle Main Engines (SSMEs)

The three SSMEs are reusable, high-performance, liquid propellant rocket engines with variable thrust. The engines use liquid hydrogen
for fuel and cooling and liquid oxygen as an
oxidizer. The propellant is carried in separate
tanks within the external tank and is supplied to

Hydraulically powered gimbal actuators allow

each engine to be gimbaled in the pitch and yaw
axes for thrust vector control.
The SSME major components are the fuel and
oxidizer turbopumps, preburners, a hot gas
manifold, main combustion chamber, nozzle,
oxidizer heat exchanger, and propellant valves.

2.16-3

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Fr om
LH2 prevalve
30 psia
Low pressure
fuel turbopump
276 psia
High pressure
fuel turbopump
6515 psia
Mai n
fuel valve
Mai n
combustion
chamber
cooling

External tank
pressurization

Chamber
coolant
valve

Nozzle
cooling

Preburners
Low pressure
fuel turbopump
turbine
High pressure
oxidizer
turbopump

High pressure
fuel turbopump
turbine
Hot gas
manifold
cooling

Hot gas
manifold
Mai n
combustion
chamber
605.cvs

Main Engine Fuel Flow

High-Pressure Fuel Turbopump

Fuel Turbopumps
Low-Pressure Fuel Turbopump
The low-pressure fuel turbopump is an axialflow pump driven by a two-stage axial flow
turbine powered by gaseous hydrogen. It
boosts liquid hydrogen pressure from 30 psia to
276 psia and supplies the high-pressure fuel
turbopump.
During engine operation, this
pressure increase allows the high-pressure fuel
turbopump to operate at high speeds without
cavitating. The low-pressure fuel turbopump
operates at approximately 16,185 rpm, measures
approximately 18 by 24 inches, and is flangemounted to the SSME at the inlet to the lowpressure fuel duct.

2. SYSTEMS
2.16 Main Propulsion System (MPS)

The high-pressure fuel turbopump, a threestage centrifugal pump driven by a two-stage,

hot-gas turbine, boosts liquid hydrogen
pressure from 276 psia to 6,515 psia. It operates
at approximately 35,360 rpm. The discharge
flow from the high-pressure turbopump is
routed through the main fuel valve and then
splits into three flow paths. One path is
through the jacket of the main combustion
chamber, where the hydrogen is used to cool
the chamber walls, and then to the low-pressure
fuel turbopump to drive its turbine. The second
flow path, through the chamber coolant valve,
supplies liquid hydrogen to the preburner
combustion chambers and also cools the hot gas
manifold.

2.16-4

USA007587
Rev. A
The third hydrogen flow path is used to cool the
engine nozzle. It then joins the second flow
path from the chamber coolant valve. The highpressure fuel turbopump is approximately 22
by 44 inches and is flanged to the hot-gas
manifold.
Oxidizer Turbopumps
Low-Pressure Oxidizer Turbopump
The low-pressure oxidizer turbopump is an
axial-flow pump driven by a six-stage turbine
powered by liquid oxygen. It boosts the liquid
oxygen pressure from 100 psia to 422 psia. The
flow is supplied to the high-pressure oxidizer
turbopump to permit it to operate at high
speeds without cavitating. The low-pressure
oxidizer turbopump operates at approximately
5,150 rpm, measures approximately 18 by 18

inches, and is flange-mounted to the orbiter

propellant ducting.
High-Pressure Oxidizer Turbopump
The high-pressure oxidizer turbopump consists
of two single-stage centrifugal pumps (a main
pump and a preburner pump) mounted on a
common shaft and driven by a two-stage, hotgas turbine. The main pump boosts liquid
oxygen pressure from 422 psia to 4,300 psia
while operating at approximately 28,120 rpm.
The
high-pressure
oxidizer
turbopump
discharge flow splits into several paths, one of
which is routed to drive the low-pressure
oxidizer turbopump turbine. Another path is
routed through the main oxidizer valve and
enters the main combustion chamber. Another
small flow path is tapped off and sent to the
oxidizer heat exchanger, where it is vaporized

From LO2 prevalve

100 psia
Low pressure
oxidizer turbopump
422 psia
High pressure oxidizer
turbopump main pump
4300 psia

Oxidizer
heat
exchanger

Mai n
oxidizer
valve

High pressure
oxidizer
preburner
bur n

Low pressure
oxidizer
turbopump
pump

7420 psia
External tank
pressurization

Preburners

Pogo
suppression
High pressure
fuel turbopump
turbine

High pressure
oxidizer
turbopump
Hot gas
manifold

Mai n
combustion
chamber

606.cvs

Main Engine Oxidizer Flow

2.16-5

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
and then used to pressurize the external tank.
The final path enters the preburner boost pump
to raise the liquid oxygen's pressure from 4,300
psia to 7,420 psia at the inlet to the liquid
oxygen preburner. The high-pressure oxidizer
turbopump measures approximately 24 by 36
inches. It is flanged to the hot-gas manifold.
Bellows
The low-pressure oxygen and low-pressure fuel
turbopumps are mounted 180 apart on the
engine.
The lines from the low-pressure
turbopumps to the high-pressure turbopumps
contain flexible bellows that enable them to flex
when loads are applied. This prevents them
from cracking during engine operations.

could create a hazard. To prevent this, the two

sections are separated by a cavity that is
continuously purged by the MPS engine helium
supply during engine operation. Two seals, one
located between the turbine section and the
cavity, and the other between the pump section
and cavity, minimize leakage into the cavity.
Should this cavity experience a drop in helium
pressure below opertating limits, the main
engine controller will initiate an automatic
engine shutdown, rather than risk the
possibility of the propellants leaking through
the seals, mixing in the cavity, and resulting in
catastrophic engine shutdown.

Helium Purge
Because the high-pressure oxidizer turbopump
turbine and pumps are mounted on a common
shaft, mixing the fuel-rich hot gas in the turbine
section and the liquid oxygen in the main pump

Main Engine Schematic

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-6

USA007587
Rev. A
during the engine start sequence to initiate
combustion. The igniters are turned off after
approximately
3
seconds
because
the
combustion process is self-sustaining. The main
injector and dome assembly are welded to the
hot-gas manifold.
The main combustion
chamber is bolted to the hot-gas manifold. The
combustion chamber, as well as the nozzle, is
cooled by gaseous hydrogen flowing through
coolant passages.

WARNING
Catastrophic shutdown may occur if low
helium pressure occurs in the cavity while
the operating limits are inhibited. The
same is true if there is a rapid loss of
helium pressure (e.g. both MPS helium
isolation valves are closed). In either case,
the propellants could possibly leak through
the seals and mix in the cavity, resulting in
catastrophic shutdown.

The hot-gas manifold is the structural backbone

of the engine. It supports the two preburners,
the high-pressure turbopumps, and the main
combustion chamber. Hot gas generated by the
preburners, after driving the high-pressure
turbopumps, passes through the hot-gas
manifold on the way to the main combustion
chamber.

The nozzle assembly is bolted to the main

combustion chamber. The nozzle is 113 inches
long, with an exit plane of 94 inches. The
physical dimension of the nozzle creates a 77.5:1
expansion ratio. A support ring welded to the
forward end of the nozzle is the engine attach
point to the engine heat shield.
Thermal
protection is provided for the nozzles to protect
them from the high heating rates experienced
during the launch, ascent, on-orbit, and entry
phases. The insulation consists of four layers of
metallic batting covered with a metallic foil and
screening.

Preburners

Oxidizer Heat Exchanger

The oxidizer and fuel preburners are welded to

the hot-gas manifold. Liquid hydrogen and
liquid oxygen from the high-pressure
turbopumps enter the preburners and are
mixed so that efficient combustion occurs. The
preburners produce the fuel-rich hot gas that
passes through the turbines to generate the
power
to
operate
the
high-pressure
turbopumps. The oxidizer preburner's outflow
drives a turbine that is connected to the highpressure oxidizer turbopump and the oxidizer
preburner boost pump. The fuel preburner's
outflow drives a turbine connected to the highpressure fuel turbopump.

The oxidizer heat exchanger converts liquid

oxygen to gaseous oxygen for tank pressurization and pogo suppression.
The heat
exchanger receives its liquid oxygen from the
high-pressure oxidizer turbopump discharge
flow.

Hot Gas Manifold

Main Combustion Chamber

Each engine main combustion chamber receives
fuel-rich hot gas from the fuel and oxidizer
preburners. The high-pressure oxidizer turbopump supplies liquid oxygen to the combustion
chamber where it is mixed with fuel-rich gas by
the main injector. A small augmented spark
igniter chamber is located in the center of the
injector. The dual-redundant igniter is used

Pogo Suppression System

A pogo suppression system prevents the
transmission of low-frequency flow oscillations
into the high-pressure oxidizer turbopump and,
ultimately, prevents main combustion chamber
pressure (engine thrust) oscillation.
Flow
oscillations transmitted from the vehicle are
suppressed by a partially filled gas
accumulator, which is attached by flanges to the
high-pressure oxidizer turbopump's inlet duct.
The system consists of a 0.6-cubic-foot accumulator with an internal standpipe, helium precharge valve package, gaseous oxygen supply
valve package, and four recirculation isolation
valves.

2.16-7

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
During engine start, the accumulator is charged
with helium 2.4 seconds after the start
command to provide pogo protection until the
engine heat exchanger is operational and
gaseous oxygen is available. The accumulator is
partially chilled by liquid oxygen during the
engine chill-down operation. It fills to the
overflow standpipe line inlet level, which is
sufficient to preclude gas ingestion at engine
start. During engine operation, the accumulator
is charged with a continuous gaseous oxygen
flow.
The liquid level in the accumulator is controlled
by an internal overflow standpipe, which is orificed to regulate the gaseous oxygen overflow at
varying engine power levels. The system is
sized to provide sufficient supply of gaseous
oxygen at the minimum flow rate and to permit
sufficient gaseous oxygen overflow at the
maximum pressure transient in the low-pressure oxidizer turbopump discharge duct. Under all other conditions, excess gaseous and liquid oxygen are recirculated to the low-pressure
oxidizer turbopump inlet through the engine
oxidizer bleed duct.
The pogo accumulator is also pressurized with
MPS helium at engine shutdown to provide a
positive pressure at the high-pressure oxidizer
turbopump inlet. Without this positve pressure,
the sudden loss of acceleration that
accompanies main engine cutoff (MECO) causes
the turbine to cavitate before the blades have
had a chance to spin down. The positive
pressure provided by the accumulator prevents
the turbine from cavitating, flying apart, and
causing vehicle damage.
CAUTION
In situations where there is insufficient
helium to charge the pogo accumulator
(e,g, a helium supply leak), a manual
engine shutdown may be required preMECO, while the vehicle is still under
acceleration.

2. SYSTEMS
2.16 Main Propulsion System (MPS)

Valves
Each engine has five propellant valves (oxidizer
preburner oxidizer, fuel preburner oxidizer,
main oxidizer, main fuel, and chamber coolant)
that are hydraulically actuated and controlled
by electrical signals from the engine controller.
They can be fully closed by using the MPS
engine helium supply system as a backup
actuation system.
The turbine speeds of the high-pressure oxidizer turbopump and the high-pressure fuel
turbopump depend on the position of the
oxidizer and fuel preburner oxidizer valves.
The engine controller uses the preburner
oxidizer valves to control engine thrust by
regulating the flow of liquid oxygen to the
preburners. The oxidizer and fuel preburner
oxidizer valves increase or decrease the liquid
oxygen flow into the preburner, thereby
increasing or decreasing preburner chamber
pressure and, consequently, turbine speed. This
directly affects liquid oxygen and gaseous
hydrogen flow into the main combustion
chamber which, in turn, can increase or
decrease engine thrust. The fuel preburner
oxidizer valve is used to maintain a constant 6:1
propellant mixture ratio.
The main oxidizer valve controls liquid oxygen
flow into the engine combustion chamber. The
main fuel valve controls the total liquid
hydrogen flow into the engine cooling circuit,
the preburner supply lines, and the lowpressure fuel turbopump turbine. When the
engine is operating, the main valves are fully
open.
A chamber coolant valve on each engine
combustion chamber coolant bypass duct
regulates the amount of gaseous hydrogen
allowed to bypass the nozzle coolant loop to
control engine temperature.
The chamber
coolant valve is 100 percent open before engine
start, and at power levels between 100 and 109
percent. For power levels between 67 and 100
percent, the valve's position will range from
68.3 to 100 percent open.

2.16-8

USA007587
Rev. A
Propellant Dump
After MECO, the main oxidizer valves in all
three engines are opened to allow residual
liquid oxygen to be dumped through the engine
nozzles.
Also after MECO, both liquid
hydrogen fill/drain valves, as well as the fuel
bleed valve, are opened to allow residual liquid
hydrogen to drain over the left wing of the
orbiter.

Space Shuttle Main Engine Controllers

The controller is a pressurized, thermally
conditioned electronics package attached to the
thrust chamber and nozzle coolant outlet
manifolds on the low-pressure fuel turbopump
side of the engine. Each controller contains two
redundant digital computer units (DCUs),
referred to as DCU A and DCU B. Normally,
DCU A is in control, while DCU B electronics
are active but not in control. Instructions to the
engine control elements are updated 50 times
per second (every 20 milliseconds). Engine
reliability is enhanced by a dual-redundant
system that allows normal DCU operation after
the first failure and a fail-safe shutdown after a
second failure. High-reliability electronic parts
are used throughout the controller. The digital
computer is programmable, allowing engine
control equations and constants to be modified
by changing the software.

The controller is packaged in a sealed,

pressurized chassis and is cooled by convection
heat transfer through pin fins as part of the
main chassis. The electronics are distributed on
functional modules with special thermal and
vibration protection.
Operating in conjunction with engine sensors,
valves, actuators, and spark igniters, the
controllers form a self-contained system for
engine control, checkout, and monitoring. The
controller provides engine flight readiness
verification, engine start and shutdown
sequencing, closed-loop thrust and propellant
mixture ratio control, sensor excitation, valve
actuator and spark igniter control signals,
engine performance limit monitoring, and
performance and maintenance data.
The
controller also provides onboard engine
checkout, response to vehicle commands, and
transmission of engine status.

2.16-9

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Controller power is supplied by the three ac
buses in a manner that protects their
redundancy. Each computer unit within a
controller receives its power from a different
bus. The buses are distributed among the three
controllers such that the loss of any two buses
will result in the loss of only one engine. The
digital computer units require all three phases
of an ac bus to operate. There are two MPS
ENGINE POWER switches on panel R2 for each
engine controller (LEFT, CTR, RIGHT); the top
switch is for DCU A, and the bottom switch is
for DCU B. Cycling an MPS ENGINE POWER
switch to OFF and back to ON will cause the
affected digital computer unit to stop
processing.
Switches for engine controller heaters are found
on panel R4, but these are nonfunctional.
Heaters were once thought to be needed to keep
the controllers thermally conditioned. This later
turned out not to be the case. Since then, the
heaters have not been installed.

MPS ENGINE POWER Switches on Panel R2

MAIN PROPLSION SYSTEM ENGINE

CNTLR HTR Switches on Panel R4

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-10

USA007587
Rev. A
Command and Data Flow
Command Flow
Each controller receives commands transmitted
by the GPCs through its own engine interface
unit (EIU), a specialized multiplexer/
demultiplexer (MDM) that interfaces with the
GPCs and with the engine controller. When
engine commands are received by the unit, the
data are held in a buffer until the GPCs request
data. The unit then sends the data to each GPC.
Each engine interface unit is dedicated to one
SSME and communicates only with the engine
controller that controls its SSME. The three
units have no interface with each other.
The engine interface units are powered through
the EIU switches on panel O17. If a unit loses
power, its corresponding engine cannot receive
GPC

3
1
2
4

any throttle, shut down, or dump commands,

and will not be able to communicate with the
GPCs. As a result, the controller will maintain
the last valid command until it is shut down
manually via the MPS ENGINE POWER
switches on panel R2.
Each orbiter GPC, operating in a redundant set,
issues engine commands from resident SSME
subsystem operating programs to the EIUs for
transmission to their corresponding engine
controllers. Engine commands are output over
the GPC's assigned flight-critical data bus (a
total of four GPCs outputting over four flightcritical data buses). Therefore, each EIU will
receive four commands. The nominal ascent
configuration has GPCs 1, 2, 3, and 4 outputting
on flight-critical data buses 5, 6, 7, and 8, respectively. Each data bus is connected to one
multiplexer interface adapter in each EIU.

EIU
Right
FC7
FC5
FC6
FC8

Controller

MIA
1

CIA
1

CHA
(AC3)

CHB
(AC1)

2
3
4

First in
First out

SSME

DCU
A
(AC3)

CHC
(AC3 or AC1)

CIA
1

CHA
(AC1)

CHB
(AC2)

CHC
(AC1 or AC2)

CIA
1

CHA
(AC2)

CHB
(AC3)

CHC
(AC2 or AC3)

Right
#3

DCU
B
(AC1)

Center
1
2
3
4

FC5
FC6
FC7
FC8

MIA
1
2
3
4

First in
First out

DCU
A
(AC1)
DCU
B
(AC2)

Center
#1

Left
2
3
1

FC6
FC7
FC5

MIA
1
2
3
First in

FC8

DCU
A
(AC2)

First out

Left
#2

DCU
B
(AC3)
610.cvs

Main Engine Command Flow

2.16-11

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
controller will issue its own commands to
accomplish the function requested by the
orbiter GPCs. If command voting fails, and two
or more commands fail, the engine controller
will maintain the last command that passed
voting.
Whenever the controller does not receive two of
three valid inputs, it creates a command path
failure. The GPCs will issue an MPS CMD
C(L,R) fault message and light the yellow
MAIN ENGINE STATUS light on panel F7.

EIU Switches on Panel O17

The EIU checks the received engine commands
for transmission errors. If there are none, the
EIU passes the validated engine commands on
to the controller interface assemblies (CIAs),
which output the validated engine commands
to the engine controller. An engine command
that does not pass validation is not sent to the
CIA.
Instead, it is dead-ended in the
multiplexer
interface
adapter
(MIA).
Commands that come through MIA 1 and MIA
2 are sent to CIA 1 and CIA 2, respectively.
Commands that come to MIA 3 and MIA 4 pass
through CIA 3 data-select logic. This logic
outputs the command that arrives at the
interface first. The other command is deadended.
The selected command is output
through CIA 3. In this manner, the EIU reduces
the four input commands to three output
commands.
The engine controller vehicle interface
electronics receive the three engine commands,
check for transmission errors (hardware
validation), and send controller hardwarevalidated engine commands to the controller
channel A and B electronics. Normally, channel
A electronics are in control, with channel B
electronics active but not in control. If channel
A fails, channel B will assume control. If
channel B subsequently fails, the engine
controller will shut the engine down. If two or
three commands pass voting, the engine

2. SYSTEMS
2.16 Main Propulsion System (MPS)

The backup flight system (BFS) computer,

GPC 5, contains SSME hardware interface
program applications software. When the four
primary GPCs are in control, GPC 5 does no
commanding. When GPC 5 is in control, the
BFS sends commands to, and requests data
from, the engine interface unit. The BFS, when
engaged, allows GPC 5 to command flightcritical buses 5, 6, 7, and 8 for main engine
control through the SSME hardware interface
program, which performs the same main engine
command functions as the SSME subsystem
operating program.
The command flow
through the engine interface units and engine
controllers is the same when GPC 5 is engaged
as for the four-GPC redundant set.
Data Flow
The engine controller provides all the main
engine data to the GPCs. Sensors in the engine
supply pressures, temperatures, flow rates,
turbopump speeds, valve positions, and engine
servovalve actuator positions to the engine
controller. The engine controller assembles
these data into a vehicle data table and adds
other status data. The vehicle data tables
output via channels A and B to the vehicle
interface electronics for transmission to the
engine interface units. The vehicle interface
electronics output data over both the primary
and secondary data paths.
The vehicle data table is sent by the controller to
the engine interface unit. There are only two
data paths versus three command paths
between the engine controller and the engine
interface unit. The data path that interfaces
with CIA 1 is called primary data. Primary
data consist of the first 32 words of the SSME

2.16-12

USA007587
Rev. A
vehicle data table. Secondary data is the path
that interfaces with CIA 2. Secondary data
consist of the first six words of the vehicle data
table. Primary and secondary data are held in
buffers until the GPCs send a primary and
secondary data request command to the engine
interface units. Primary data are output only
through MIA 1 on each engine interface unit.
Secondary data are output only through MIA 4
on each engine interface unit.
At T minus zero, the orbiter GPCs request both
primary and secondary data from each engine
interface unit. For no failures, only primary
data are looked at. If there is a loss of primary
data (which can occur between the engine
controller channel A electronics and the SSME
subsystem operating procedure), only the
secondary data are transmitted to the GPCs.
Loss of both primary and secondary data creates
a data path failure. This causes the GPCs to issue
an MPS DATA C(L,R) fault message and light
GPC

the appropriate yellow MAIN ENGINE STATUS

light on panel F7
NOTE
Unlike powered flight, loss of either
primary or secondary data prelaunch will
result in a data path failure. This will
either inhibit engine ignition or result in a
launch pad shutdown of all three main
engines.

Electric Lockup
An electric lockup occurs when the engine
controller loses data from either the LH2
flowmeters or the main combustion chamber
pressure sensors, both of which are needed to
set the proper mixture ratio. Because the
mixture ratio can no longer be controlled, the
controller will actively hold the engine valves at
their last commanded position. This puts the
Controller

EIU
Right
FC7

MIA
1

Buffer 1

CIA
1

CHA
(AC3)

Buffer 2

CHB
(AC1)

CHC
(AC3 or AC1)

Buffer 1

CIA
1

CHA
(AC1)

Buffer 2

CHB
(AC2)

CHC
(AC1 or AC2)

Buffer 1

CIA
1

CHA
(AC2)

Buffer 2

CHB
(AC3)

CHC
(AC2 or AC3)

DCU
A
(AC3)

2
FC8
4

SSME

DCU
B
(AC1)

Right
#3

Center
FC5
1

MIA
1

DCU
A
(AC1)

3
FC8
4

DCU
B
(AC2)

Right
#1

Left
FC6
2

MIA
1

2
3

1
FC8
4

DCU
A
(AC2)

DCU
B
(AC3)

Right
#2

612.cvs

Main Engine Data Flow

2.16-13

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
engine in lockup; that is, it will no longer
throttle. The engine will still shutdown when
commanded. However, shutdown will now
occur from a different throttle setting than
normal. A manual shutdown of the engine preMECO may be required (see section 6.8).
Controller Software
The two primary engine controller programs
are the flight operational program and the test
operational program. The flight operational
program is a real-time, process-control program
that processes inputs from engine sensors,
controls the operation of the engine
servovalves, actuators, solenoids, and spark
igniters, accepts and processes vehicle
commands, provides and transmits data to the
vehicle, and provides checkout and monitoring
capabilities.
The test operational program supports engine
testing prior to launch. Functionally, it is
similar to the flight operational program but
differs in implementation. The programs are
modular and are defined as computer program
components. Each consists of a data base
organized into tables. During application of the
computer program components, the programs
perform data processing for failure detection
and status of the vehicle. As system operation
progresses through an operating phase,
combinations of control functions are operative
at different times. These combinations within a
phase are defined as operating modes.
The checkout phase initiates active control
monitoring or checkout. The standby mode in
this phase puts the controller on pause while
active control sequence operations are in
process. Monitoring functions that do not affect
engine hardware status are continually active
during this mode. Such functions include
processing vehicle commands, updating engine
status, and self-testing the controller. During
checkout, data and instructions can be loaded
into the engine controller's computer memory,
permitting updates to the software and data as
necessary to proceed with engine-firing or
checkout operations. Component checkout is
also performed during this mode.
The start preparation phase consists of system
purges and propellant conditioning to prepare
2. SYSTEMS
2.16 Main Propulsion System (MPS)

for engine start. The first, purge sequence 1

mode,
includes
oxidizer
system
and
intermediate seal purge operation. This is
followed by purge sequence 2 mode, which
includes fuel system purge operation and the
continuation of purges initiated during purge
sequence 1. Purge sequence 3 mode includes
propellant recirculation (bleed valve operation).
Purge sequence 4 mode includes fuel system
purges and indicates that the engine is ready to
enter the start phase. The engine-ready mode
occurs when proper engine thermal conditions
for start have been attained, and other criteria
for start have been satisfied, including a
continuation of the purge sequence 4 mode.
The start phase covers engine ignition operations and scheduled open-loop operation of the
propellant valves. The start initiation mode includes all functions before ignition confirm and
the closing of the thrust control loop. During
thrust buildup, the main combustion chamber
pressure is monitored to verify that closed-loop
sequencing is in progress.
Main stage is automatically entered upon successful completion of the start phase. Mixture
ratio control and thrust control are active.
The shutdown phase covers operations to reduce
main combustion chamber pressure and drive all
valves closed to effect full engine shutdown.
The post-shutdown phase starts at completion
of SSME shutdown. During the terminate sequence, all propellant valves are closed, and all
solenoid and torque motor valves are deenergized.

Propellant Management System (PMS)

Liquid hydrogen and liquid oxygen pass from
the ET to the PMS, which consists of manifolds,
distribution lines, and valves. It also contains
lines needed to transport gases from the engines
to the external tank for pressurization.
During prelaunch activities, this subsystem is
used to load liquid oxygen and liquid hydrogen
into the external tank. After MECO, the PMS is
used to complete a liquid oxygen and liquid
hydrogen dump and vacuum inerting. It is also
used for manifold repressurization during entry.

2.16-14

USA007587
Rev. A

MPS PMS Schematic (Ascent Pocket Checklist)

Propellant Manifolds
Two 17-inch-diameter MPS propellant feedline
manifolds are in the orbiter aft fuselage, one for
liquid oxygen and one for liquid hydrogen.
Each manifold interfaces with its respective line
on the ET. Both manifolds interface with an 8inch fill/drain line containing an inboard and
outboard fill/drain valve in series. Inside the
orbiter, the manifolds diverge into three 12-inch
SSME feedlines, one for each engine.
Fluid pressures within the LO2 and LH2
feedline manifolds can be monitored on the two
MPS PRESS ENG MANF meters on the
OMS/MPS MEDS display or on the BFS GNC
SYS SUMM 1 display (MANF P LH2, LO2).
OMS/MPS Display.
2.16-15

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Fill/Drain Valves
Two (outboard and inboard) 8-inch-diameter
liquid oxygen and liquid hydrogen fill/drain
valves are connected in series. They are used to
load the external tank before launch to perform
the post-MECO MPS propellant dump. The
valves can be manually controlled by the
PROPELLANT FILL/DRAIN LO2, LH2
OUTBD, INBD switches on panel R4. Each
switch has OPEN, GND, and CLOSE positions
Relief Valves
Each 8-inch liquid hydrogen and liquid oxygen
manifold has a 1-inch-diameter line that is routed
to a feedline relief isolation valve and then to a
feedline relief valve. When the feedline relief
isolation valve is opened automatically after
MECO, the corresponding manifold can relieve
excessive pressure overboard through its relief
valve. The relief isolation valves can also be
manually controlled by the MAIN PROPULSION
SYSTEM FEEDLINE RLF ISOL LO2 and LH2
switches on panel R4. The switches have OPEN,
GPC, and CLOSE positions.

GNC SYSTEM SUMMARY 1

Backup Liquid Hydrogen Dump Valves

PROPELLANT FILL/DRAIN, REVALVE and

FEEDLINE RLF ISOL Switches on Panel R4
Feedline Disconnect Valves
Two disconnect valves are found in each feedline
where the orbiter meets the external tank. One is
on the orbiter side of the manifold, and the other
is on the external tank side. All four are closed
automatically prior to external tank separation.

2. SYSTEMS
2.16 Main Propulsion System (MPS)

The backup liquid hydrogen dump line

connects the feedline manifold to an overboard
port above the left wing of the orbiter. The line,
designed primarily for a post-MECO liquid
hydrogen dump during a return-to-launch site
(RTLS) abort, is also used to vent the liquid
hydrogen manifold after a nominal MECO.
Since liquid hydrogen evaporates quickly, this
vent is used to prevent pressure buildup in the
hydrogen manifold from repeatedly cycling the
relief valve before the propellant dump begins.
It is also used for two post-dump vacuum
inerts, nominally.
Flow through the lines is controlled by two
valves in series, which are normally commanded by the GPCs. However, during OPS 1,
they can be manually controlled by the MPS
PRPLT DUMP BACKUP LH2 VLV switch on
panel R2, which has OPEN, GPC, and CLOSE
positions. In an RTLS abort dump, liquid hydrogen is dumped overboard through a port at
the outer aft fuselage's left side between the
OMS/RCS system pod and the upper surface of

2.16-16

USA007587
Rev. A
the wing. These valves are also known as the
LH2 RTLS Dump valves.
Topping Valve
This valve controls the flow of liquid hydrogen
through the tank topping manifold, which is
used for prelaunch liquid hydrogen tank topping
and thermal conditioning.
During thermal
conditioning, propellants flow through the
engine components to cool them for engine start.
Liquid hydrogen is loaded through the
outboard fill/drain valve, circulates through the
topping valve to the engines for thermal
conditioning, and is pumped into the external
tank for tank topping. (The part of the topping
recirculation line that goes to the external tank
is not shown on the pocket checklist schematic.)
The topping valve can be controlled indirectly
by the crew via the LH2 inboard FILL DRAIN
switch on panel R4. When this switch is taken
to OPEN, both the LH2 inboard fill/drain and
topping valves open.
There is no topping valve for liquid oxygen.
Since liquid oxygen is harmless in the
atmosphere, it is not circulated back to the
external tank during thermal conditioning.
Rather, it is dumped overboard through the
engine liquid oxygen bleed valves and out the
overboard bleed valve.
Liquid Hydrogen
and Liquid Oxygen Bleed Valves
Three liquid hydrogen bleed valves, one in each
engine, connect the engine internal liquid
hydrogen line to the topping valve manifold.
The valves are used to route liquid hydrogen
through the engines during prelaunch thermal
conditioning and to dump the liquid hydrogen
trapped in the engines post-MECO.
There are also three liquid oxygen bleed valves
that are not shown on the pocket checklist
schematic. They connect the engine internal
liquid oxygen lines to an overboard port and are
used only during prelaunch thermal conditioning.

Prevalves
The prevalve in each of the three 12-inch
feedlines to each engine isolates liquid oxygen
and liquid hydrogen from each engine or
permits liquid oxygen and liquid hydrogen to
flow to each engine. Most of the prevalve
functions are automatic, but they can also be
controlled by the LO2 and LH2 PREVALVE,
LEFT, CTR, RIGHT switches on panel R4. Each
switch has OPEN, GPC, and CLOSE positions.
Ullage Pressure System
Ullage refers to the space in each tank not
occupied by propellants. The ullage pressure
system consists of the sensors, lines, and valves
needed to route gaseous propellants from the
three main engines and supply them to the
external tank to maintain propellant tank
pressure during engine operation.
There are two external tank pressurization
manifolds, one for gaseous oxygen and one for
gaseous hydrogen.
During prelaunch, the
manifolds are used to supply ground support
pressurization of the ET using helium routed
through the T-0 umbilical. Self-sealing quick
disconnects are provided at the T-0 umbilical
for separation at lift-off.
Each manifold contains three 0.63-inchdiameter pressurization lines, one from each
engine. The three lines join in a common
manifold prior to entering the ET.
In each SSME, a small portion of liquid oxygen
from the high-pressure oxidizer turbopump main
pump is diverted into the engine's oxidizer heat
exchanger. The heat generated by the engine's
high-pressure oxidizer turbopump converts the
liquid oxygen into gaseous oxygen and directs it
through a check valve to a fixed orifice and then
to the ET. During ascent, the liquid oxygen tank
pressure is maintained between 20 and 25 psig
by the fixed orifice. If the tank pressure is greater
than 30 psig, it is relieved through the liquid
oxygen tank's vent and relief valve.
In each SSME, a small portion of gaseous
hydrogen from the low-pressure fuel turbopump is directed through two check valves, two
orifices, and a flow control valve before
entering the ET. During ascent, the liquid

2.16-17

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
hydrogen tank pressure is maintained between
32 and 34 psia using both a variable and a fixed
orifice in each SSME supply system. The active
flow control valve is controlled by one of three
liquid hydrogen pressure transducers. When
the tank pressure decreases below 32 psia, the
valve opens; when the tank pressure increases
to 33 psia, the valve closes. If the tank pressure
exceeds 35 psia, the pressure is relieved through
the liquid hydrogen tank's vent and relief valve.
If the pressure falls below 28 psia, the MPS LH2
ULL PRESS switch on panel R2 is positioned
from AUTO to OPEN, causing all three flow
control valves to go to full open.
The three liquid hydrogen and three liquid
oxygen ullage pressures are displayed on the
BFS GNC SYS SUMM 1 display (ULL P).
The SSME/ET liquid hydrogen pressurization
system also contains a line that is used to vent
the liquid hydrogen pressurization manifold
during post-MECO inerting. It is controlled by
the H2 PRESS LINE VENT switch on panel R4.
This valve is normally closed. Post-MECO,
however, this valve is opened for about one
minute to allow for vacuum inerting. The GND
position allows the launch processing system to
control the valve during ground operations.

MAIN PORPULSION SYSTEM MANF PRESS

and H2 PRESS LINE VENT Switches
on Panel R4
Manifold Repress Valves
The liquid hydrogen and liquid oxygen
manifold repress valves route helium from the
MPS helium system into the feedline manifolds.
The helium pressure is used to expel
propellants during the MPS propellant dump
and to repressurize the propellant lines during
entry. The valves can be controlled manually
using the MAIN PROPULSION SYSTEM
MANF PRESS switches on panel R4.
MPS Valve Types
All the valves in the MPS are either electrically
or pneumatically operated. Pneumatic valves
are used where large loads are encountered,
such as in the control of liquid propellant flows.
Electrical valves are used for lighter loads, such
as the control of gaseous propellant flows.
The pneumatically actuated valves are divided
into two types:
type 1, which requires
pneumatic pressure to open and close the valve,
and type 2, which is spring-loaded to one
position and requires pneumatic pressure to
move to the other position.

MPS PRPLT DUMP BACKUP LH2VLV

Switch and LH2ULLAGE PRESS Switch
on Panel R2
2. SYSTEMS
2.16 Main Propulsion System (MPS)

Each type 1 valve actuator is equipped with two

electrically actuated solenoid valves, which
control helium pressure to an "open" or "close"
2.16-18

USA007587
Rev. A
port on the actuator. Energizing the solenoid
valve on the open port allows helium pressure to
open the pneumatic valve.
Energizing the
solenoid on the close port allows helium pressure
to close the pneumatic valve. Removing power
from a solenoid valve removes helium pressure
from the corresponding port of the pneumatic
actuator and allows the helium pressure trapped
in that side of the actuator to vent into the aft
compartment.
Removing power from both
solenoids allows the pneumatic valve to remain
in the last commanded position. This is known
as a bi-stable valve.

pressure to either an open or a close port on the

actuator. Removing power from the solenoid
valve removes helium pressure from the
corresponding port of the pneumatic actuator
and allows helium pressure trapped in that side
of the actuator to vent overboard. Spring force
takes over and drives the valve to the opposite
position. If the spring force drives the valve to
the open position, the valve is referred to as a
normally open (NO) valve. If the spring force
drives the valve to a closed position, the valve is
referred to as a normally closed (NC) valve.
Type 2 pneumatic valves are used for the liquid
hydrogen RTLS inboard dump valve (NC), the
liquid hydrogen RTLS outboard dump valve
(NC), the liquid hydrogen feedline relief shutoff
valve (NO), the liquid oxygen feedline relief
shutoff valve (NO), the three liquid hydrogen
engine recirculation valves (NC), the two liquid
oxygen pogo recirculation valves (NO), the
liquid hydrogen topping valve (NC), the liquid
hydrogen high-point bleed valve (NC), and the
liquid oxygen overboard bleed valve (NO).

Type 1 valves are used for the liquid oxygen

and liquid hydrogen feedline 17-inch umbilical
disconnect valves, the liquid oxygen and liquid
hydrogen prevalves, the liquid hydrogen and
liquid oxygen inboard and outboard fill and
drain valves, and the liquid hydrogen 4-inch
recirculation disconnect valves.
Each type 2 valve is a single electrically
actuated solenoid valve that controls helium

Propellant
valve (open)

Propellant
valve (open)

Actuator

Actuator

Overboard
vent

Overboard
vent

Helium
pressure

Close
solenoid
(de-energized)

Open
solenoid
(de-energized)

1 Control switch
in open position

Propellant
valve (open)

Overboard
vent

Overboard
vent

Helium
pressure

Close
solenoid
(de-energized)

Open
solenoid
(de-energized)

2 Control switch
in closed position

Actuator

Overboard
vent

Overboard
vent

Helium
pressure

Close
solenoid
(de-energized)

Open
solenoid
(de-energized)

3 Control switch in GPC

position after valve closed
(no GPC command present)
619.cvs

Propellant Management Subsystem Typical Type 1 Pneumatically

Actuated Propellant Valve

2.16-19

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Propellant
valve (open)

Propellant
valve (closed)

Propellant
valve (closed)

Actuator

Actuator

Actuator

Overboard
vent

Helium
pressure

Control switch
in open position

Helium
pressure

Open
solenoid
(energized)

Open
solenoid
(energized)
1

Overboard
vent

Helium
pressure

Control switch
in closed position

Overboard
vent

Open
solenoid
(de-energized)
3

Control switch in GPC

position (no GPC
command present)
620.cvs

Propellant Management Subsystem Typical Type 2

Pneumatically Actuated Propellant Valve Helium System
The electrically actuated solenoid valves are
spring-loaded to one position and move to the
other position when electrical power is applied.
These valves also are referred to as either
normally open or normally closed, depending
on their position in the de-energized state.
Electrically actuated solenoid valves are the
gaseous hydrogen pressurization line vent
valve (NC), the three gaseous hydrogen pressurization flow control valves (NO), and the
three gaseous oxygen pressurization flow
control valves (NO).

Helium System
The MPS helium system consists of seven 4.7cubic-foot helium supply tanks, three 17.3cubic-foot helium supply tanks, and associated
regulators, check valves, distribution lines, and
control valves.
The MPS helium system is used for in-flight
purges within the engines, and it provides pressure for actuating engine valves during
emergency pneumatic shutdowns.
It also

2. SYSTEMS
2.16 Main Propulsion System (MPS)

supplies pressure to actuate the pneumatically

operated valves within the propellant
management system.
During entry, the
remaining helium is used for the entry purge
and repressurization.
(Unlike the orbital
maneuvering system and reaction control
system, the MPS does not use helium to
pressurize propellant tanks.)
The MPS helium supply system is divided into
four separate subsystems, one for each of the
three main engines and a fourth pneumatic
system to operate the propellant valves.
All the valves in the helium subsystem are
spring-loaded to one position and electrically
actuated to the other position. The supply tank
isolation valves are spring-loaded to the closed
position and pneumatically actuated to the open
position. Valve position is controlled via electrical signals either generated by the onboard
GPCs or manually by the flight crew. All the
valves can be controlled automatically by the
GPCs, and the flight crew can control some of
the valves.

2.16-20

USA007587
Rev. A
17.3 cubic feet
Center
engine

Left
engine

4.7 cubic
feet

Crew has manual

control capability

Right
engine

IC = Interconnect

Midbody fuselage
Art fuselage
Check
valves

Check
valves
Filters

Out IC

Out IC
Isolation
valves

Pressure
regulators
Low

Out IC

High

Low

High

In IC

In IC

In IC

Pneumatic
supply

Regulator

High

Low

Relief
valves
Check
valves
Left engine
helium
crossover
A
Central
engine

Left
engine

Right
engine

Pneumatic

E
Pneumatic
usa007587_621.cnv

Helium System Storage and Supply

PNEU
He

L
He

C
He

R
He

Out

He
INTRCNCT
PNEU
He
ISOL

RLF
vlv
To MPS:
fill/drn
manf press

ISOL
vlvs

ISOL
vlvs

ISOL
vlvs

PNEU L
Eng He XOVR

Hyd
sys
2

In

L eng
vlvs

C eng
vlvs

Hyd
sys
1

PNEU
accum
2

To MPS:
Prevalves
RLF isols
b/u LH2 vlvs

Left
4

R eng
vlvs

Hyd
sys
3

Center
3
4

Right
2
4

1
STRG

?
A
(2)

A
(3)

A
(1)

?
A
(2)

A
(3)

A
(1)

CH
(AC)

622.cvs

Main Propulsion System Helium Schematic from the Ascent Pocket Checklist

2.16-21

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Helium Tanks
The tanks are composite structures consisting of
a titanium liner with a fiberglass structural
overwrap. The large tanks are 40.3 inches in
diameter and have a dry weight of 272 pounds.
The smaller tanks are 26 inches in diameter and
have a dry weight of 73 pounds. The tanks are
serviced before lift-off to a pressure of 4,100 to
4,500 psi.
Four of the 4.7-cubic-foot helium supply tanks
are located in the aft fuselage, and the other
three are located below the payload bay in the
midfuselage. The three 17.3-cubic-foot helium
supply tanks are also located below the payload
bay in the midfuselage.
Each of the larger supply tanks is plumbed to
two of the smaller supply tanks (one in the midbody, the other in the aft body), forming three
clusters of three tanks. Each set of tanks normally provides helium to only one engine and is
commonly referred to as left, center, or right
engine helium, depending on the engine
serviced. Each set normally provides helium to
its designated engine for in-flight purges and
provides pressure for actuating engine valves
during emergency pneumatic shutdown.

isolation valves is connected in parallel, with

each valve in the pair controlling helium flow
through one leg of a dual-redundant helium
supply circuit. Each helium supply circuit
contains two check valves, a filter, an isolation
valve, a regulator, and a relief valve.
The two isolation valves connected to the
pneumatic supply tanks are also connected in
parallel. The rest of the pneumatic supply system consists of a filter, the two isolation valves, a
regulator, a relief valve, and a single check valve.
Each engine helium supply isolation valve can be
individually controlled by the He ISOLATION A
LEFT, CTR, RIGHT, and He ISOLATION B
LEFT, CTR, RIGHT switches on panel R2. The
switches have OPEN, GPC, and CLOSE
positions. The two pneumatic helium supply
isolation valves are controlled by a single
PNEUMATICS He ISOL switch on panel R2,
which also has OPEN, GPC, and CLOSE
positions.

The remaining 4.7-cubic-foot helium tank is

referred to as the pneumatic helium supply
tank. It provides pressure to actuate all the
pneumatically operated valves in the propellant
management subsystem.
The helium pressure of the pneumatic, left,
center, and right supply systems can be
monitored on the MPS PRESS HELIUM, PNEU,
L, C, R meters on panel F7 by positioning the
switch below the meters to TANK. Left, center,
right, and pneumatic tank pressures can be
monitored on the BFS GNC SYS SUMM 1
display (MPS L, C, R HE TK P, and MPS PNEU
HE P TK).

He ISOLATION, PNEUMATICS L ENG He

XOVR and He ISOL, and He
INTERCONNECT Switches on Panel R2

Helium Isolation Valves

Helium Pressure Regulators

Eight helium supply tank isolation valves

grouped in pairs control the flow of helium
from the tanks. One pair of valves is connected
to each of the three tank clusters, and one pair is
connected to the pneumatic supply tank. In the
engine helium supply tank system, each pair of
2. SYSTEMS
2.16 Main Propulsion System (MPS)

Each engine helium supply tank has two

pressure regulators operating in parallel. Each
regulator controls pressure to within 730 to
785 psia in one leg of a dual-redundant helium
supply circuit and is capable of providing all
the helium needed by the main engines.

2.16-22

USA007587
Rev. A
The pressure regulator for the pneumatic
helium supply system is not redundant and
regulates outlet pressure between 715 to
770 psig.
Downstream of the pneumatic
regulator are the liquid hydrogen manifold
pressure regulator and the liquid oxygen
manifold pressure regulator. These regulators
are used only during MPS propellant dumps
and manifold pressurization. Both regulators
are set to provide outlet pressure between 20
and 25 psig. Flow through the regulators is
controlled by the appropriate set of two
normally closed manifold pressurization valves.
Downstream of each pressure regulator, with
the
exception
of
the
two
manifold
repressurization regulators, is a relief valve.
The valve protects the downstream helium
distribution lines from overpressurization if the
associated regulator fails fully open. The two
relief valves in each engine helium supply are
set to relieve at 790 to 850 psig and reseat at
785 psig.
The regulated pressure of the left, center, right,
and pneumatic systems can be monitored on the
BFS GNC SYS SUMM 1 display (MPS L, C, R
REG P and MPS PNEU REG). They are also
displayed on the OMS/MPS MEDS Display.
The MEDS display, however, only displays the
REG A pressure, unlike BFS GNC SYS SUMM 1
which displays both REG A and REG B.
Pneumatic Left Engine Helium
Crossover Valve
The crossover valve between the pneumatic and
left engine helium systems serves as a backup
for the nonredundant pneumatic pressure
regulator system. In the event of a pneumatic
helium regulator failure or a leak in the
pneumatic helium system, the left engine
helium system can provide regulated helium
through the crossover valve to the pneumatic
helium distribution system. The PNEUMATICS
L ENG He XOVR switch is on panel R2.

287

143

431

575

OMS
L
XXXX

11

719

863

1007

R
XXXX

PNEU
XXXX

C/1
XXXX

L/2
XXXX

R/3
XXXX

143

1151

MPS

He
TK
P

10

He
TANK
P

TANK
P

287

XXXX
XXXX

XXXX

XXXX

XXXX

XXXX

3
431

N2
TK
P

He
REG A
P

REG
P

14
575

C/1
L

XXXX

XXXX

ENG MANF
LO2
LH2
XXXX
XXXX

L/2

XXXX

XXXX

R/3

13

XXXX

12

719

P
S
I
A

Pc
%

863

16

15

Pc
%

17

Pc
%

18

19

L O M S He T K PRE SS m eter

L E NG H e T K PR ESS m eter

15 LO 2 E NG M A NF P RES S m eter

R O M S He T K P RE SS m eter

L O M S N2 T K PRE SS m eter

10 R E NG He T K PRE SS m eter

C E NG He T K PRE SS m eter

16 LH2 E NG M ANF P RE SS m eter

17 L E NG Pc m eter

R O M S N2 TK P RES S m eter

11 PNE U He R EG PR ES S m eter

18 C E NG Pc m eter

L O M S Pc m eter

12 L E NG H e R EG P RE SS m eter

19 R E NG Pc m eter

R O M S Pc m eter

13

C E NG H e R EG P R ES S m eter

PN E U He T K PR ESS m eter

14

R E NG H e R EG P R ES S m eter
1078.C V5

OMS/MPS MEDS Display

Helium Interconnect Valves

During ascent, the four helium supply systems
operate independently.
However, during
dumps and purges, and in the event of system
leaks, one system can draw helium from
another via the helium interconnect valves.
Each engine helium supply has two
interconnect valves associated with it: one
designated IN OPEN; the other, OUT
OPEN. Check valves ensure that helium flows
in only one direction through the IN OPEN and
OUT OPEN interconnect valves. Through the
IN OPEN valve, helium is drawn into the
affected engine from a pressure line common to
all three engine helium systems. This common
line is normally fed by the pneumatic helium
supply. The OUT OPEN valve, on the other
hand, routes the affected engines helium to the
common line where other engines can access it.
Each pair of interconnect valves is controlled by
a single switch on panel R2.
Each He
INTERCONNECT LEFT, CTR, RIGHT switch
has three positions: IN OPEN, GPC, and OUT
OPEN.
With the switch in GPC, the
interconnect valves are controlled by the orbiter
software.

2.16-23

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
Manifold Pressurization
Manifold
pressurization
valves,
located
downstream of the pneumatic helium pressure
regulator, are used to control the flow of helium
to the LO2 propellant manifold for a nominal
LO2 propellant dump and for LH2 and LO2
manifold repressurization on entry. There are
four of these valves grouped in pairs. One pair
controls helium pressure to the liquid oxygen
propellant manifold, and the other pair controls
helium pressure to the liquid hydrogen
propellant manifold.
There are additional regulators just past the
manifold repress valves that regulate the
pneumatic helium from the normally regulated
pressure of 750 psi to a lower, usable pressure.
The LH2 manifolds are pressurized to 17 to
30 psig and the LO2 manifolds are pressurized
to 20 to 25 psig during the MPS dump and entry
manifold repressurization.
Additionally, on the LH2 propellant manifold,
there are manifold pressurization valves that
open during propellant dumps to remove LH2
from the manifold while executing return-tolaunch-site (RTLS) or transoceanic abort landing
(TAL) profiles.
Pneumatic Control Assemblies
There is one pneumatic control assembly on
each SSME. The assembly is essentially a
manifold pressurized by one of the engine
helium supply systems and contains solenoid
valves to control and direct pressure to perform
various essential functions. The valves are
energized by discrete ON/OFF commands from
the output electronics of the SSME controller.
Functions controlled by the pneumatic control
assembly include the high-pressure oxidizer
turbopump intermediate seal cavity and
preburner oxidizer dome purge, pogo system
postcharge, and pneumatic shutdown.

MPS Hydraulic Systems

Hydraulic System Operation
The three orbiter hydraulic systems (see
section 2.1 for more on the hydraulic system)
supply hydraulic pressure to each SSME to
2. SYSTEMS
2.16 Main Propulsion System (MPS)

actuate the engine valves and to provide thrust

vector control. The three hydraulic supply
systems are distributed to the thrust vector
control (TVC) valves. These valves are controlled by HYDRAULICS MPS/TVC ISOL VLV
switches (one for each of the three hydraulic
systems) on panel R4. A valve is opened by
positioning its switch to OPEN. The talkback
indicator above each switch indicates OP when
the valve is open and CL when it is closed.
When the three MPS/TVC ISOL valves are
opened, hydraulic pressure is applied to the five
hydraulically actuated engine valves (the main
fuel valve, the main oxidizer valve, the fuel
preburner oxidizer valve, the oxidizer
preburner oxidizer valve, and the chamber
coolant valve).
All hydraulically actuated
engine valves receive hydraulic pressure from
the same hydraulic system: HYD SYS 1 for the
center engine valves; HYD SYS 2 for the left
engine valves; HYD SYS 3 for the right engine
valves. Each engine valve actuator is controlled
by dual-redundant signals: channel A/engine
servovalve 1 and channel B/engine servovalve
2 from that engine's controller electronics. In
the event of a hydraulic system failure, all the
hydraulically actuated engine valves can be
blown closed with helium pressure from the
affected engines helium supply.
Hydraulic Lockup
Hydraulic lockup occurs when the engine
controller senses any one of the five
hydraulically actuated engine valves outside
the limits of where it is expected to be. This
may be due to a hydraulic system failure or a
failure of the engine valve itself. Consequently,
the controller will hydraulically isolate all five
engine valves at their last position.
This
minimizes, but does not prevent, the valve from
drifting. The valve could still deviate further
and possibly cause a loss of performance and
even an engine failure. The engine is now in
lockup; that is, the engine will no longer to
throttle. The engine will still shutdown when
commanded. However, shutdown will now
occur from a different throttle setting than
normal. A manual shutdown of the engine preMECO may be required (see section 6.8).
Whether commanded or manual, a shutdown
will be done pneumatically via engine helium.

2.16-24

USA007587
Rev. A
pressure from two of the three orbiter hydraulic
systems and provides a single source to the
actuator.

Main Engine Gimbal Actuators

Normally, the primary hydraulic supply is
directed to the actuator. However, if the
primary system were to fail and lose hydraulic
pressure,
the
switching
valve
would
automatically switch over to the secondary
system, and the actuator would continue to
function.

MPS/TVC ISOL VLV Switches and

Talkbacks on Panel R4

The following tables summarizes the hydraulic

system assignments for the SSME actuators:
Pitch

Thrust Vector Control

The three MPS/TVC ISOL valves on panel R4
must also be opened to supply hydraulic
pressure to the six main engine TVC actuators.
There are two servoactuators per SSME: one for
yaw and one for pitch. Each actuator is
fastened to the orbiter thrust structure and to
the powerheads of the three SSMEs.
Two actuators per engine provide attitude
control and trajectory shaping by gimbaling
both the SSMEs and SRBs during first-stage and
the SSMEs alone during second-stage. Each
SSME servoactuator receives hydraulic pressure
from two of the three orbiter hydraulic systems;
one system is the primary system, and the other
is a standby secondary system.
Each
servoactuator has its own hydraulic switching
valve. The switching valve receives hydraulic

Yaw

PRI

SEC

PRI

SEC

Center

Hyd
Sys 1

Hyd
Sys 3

Hyd
Sys 3

Hyd
Sys 1

Left

Hyd
Sys 2

Hyd
Sys 1

Hyd
Sys 1

Hyd
Sys 2

Right

Hyd
Sys 3

Hyd
Sys 2

Hyd
Sys 2

Hyd
Sys 3

Detailed information about ascent thrust vector

control is provided in section 2.13.
Hydraulic System Isolation On Orbit
The HYDRAULICS MPS/TVC ISOL VLV SYS 1,
SYS 2, and SYS 3 switches on panel R4 are
positioned to CLOSE during on-orbit operations
to protect against hydraulic leaks downstream

2.16-25

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
of the isolation valves. In addition, there is no
requirement to gimbal the main engines from
the stow position. During on-orbit operations
when the MPS/TVC ISOL valves are closed, the
hydraulic pressure supply and return lines
within each MPS/TVC component are interconnected to enable hydraulic fluid to circulate
for thermal conditioning.

have main engine limits inhibited. In this case,

the engine will continue to run, though at
increased risk of undergoing a catastrophic
shutdown.
WARNING
An engine failure with limits inhibited will
probably result in vehicle damage. Further,
as the controller will probably be damaged
as well, the engine failure would go
unrecognized by the GPCs.

Malfunction Detection
There are three separate means of detecting
malfunctions within the MPS: SSME redlines,
the hardware caution and warning (C/W)
system, and the software C/W system.
SSME Redlines

The flight crew can control whether main

engine limits are enabled or inhibited via the
MAIN ENGINE LIMIT SHUT DN switch on
panel C3. The switch has three positions:

The SSME controller processes numerous

engine operating parameters, four of which are
critical to safely operating the engine. The
controller closely monitors these four
parameters to see whether they remain within
the main engine limits (or redlines) specified
by the Flight Rules:

ENABLE -- Enables main engine limits.

AUTO -- Enables main engine limits.
However, immediately after one engine has
shut down (either automatically or
manually), main engine limits are inhibited
on the remaining engines.

The high-pressure fuel turbopump's

discharge temperature not to exceed
1860 R.

INHIBIT -- Inhibits main engine limits.

SSME Status Lights

The high-pressure oxidizer turbopump's

discharge temperature not to exceed
1660 R or fall below 720 R.

The MAIN ENGINE STATUS lights (CTR,

LEFT, RIGHT) on panel F7 each have a red half
and an amber half.

The high-pressure oxidizer turbopump's

intermediate seal purge pressure not to
fall below 159 psia.

The red half illuminates for an engine in

shutdown or post-shutdown phase or for an
engine that is running with a redline violation.

During steady state operation, the main

combustion chamber's pressure not to
fall more than 200 psia (400 psia, during
throttling) below the reference chamber
pressure.

The amber half illuminates for an engine

experiencing any of the following failures:
Command path failure
Hydraulic lockup

The high-pressure fuel and oxidizer

turbopumps vibration levels not to exceed
8 g and 4 g, respectively.
Assuming main engine limits are enabled, a
redline violation sensed by the controller will
cause the controller to automatically shut down
the engine to guard against uncontained SSME
damage. Certain situations, however, call to
2. SYSTEMS
2.16 Main Propulsion System (MPS)

Electric lockup
Data path failure
Hardware C/W
Operating limits have been given to certain
pieces of MPS hardware:

2.16-26

USA007587
Rev. A
MPS He REG P (Reg A only) not to exceed
810 psia or fall below 680 psia.
MPS He TK P not to fall below 1150 psia.
MPS LH2 MANF P not to exceed
65 psia.
MPS LO2 MANF P not to exceed
249 psia.
A violation of any of those limits will illuminate
the red MPS light on the C/W matrix, found on
panel F7. (Violations in the He TK P and
LH2/LO2 MANF P will also illuminate the
Backup C/W Alarm light.).
Software C/W
For certain MPS out-of-limit or fault conditions
detected by the GPCs, the following fault
messages appear on the PASS and/or BFS DPS
displays.
Generated by both PASS and BFS:
"SSME FAIL C(L,R)" - Premature main
engine shutdown.
"MPS CMD C(L,R)" - Command path
failure occurs, when the main engine

controller does not receive 2/3 valid

inputs from the GPCs. (message from
PASS only pre-engage).
"MPS HYD C(L,R)" - Hydraulic lockup
occurs, whenever the main engine
controller senses any one of the five
engine valves out of position.
"MPS ELEC C(L,R)" - Electric lockup
occurs, whenever the main engine
controller loses all Pc data or all fuel flow
rate data from the engine.
"MPS DATA C(L,R)" - Data path failure
occurs, due to loss of both primary and
secondary data from the main engine
controller to the GPCs.
"ET SEP INH" - Message triggered by
either vehicle rates greater than 0.7
deg/sec
post-MECO
or
feedline
disconnect failures. (During RTLS, also
triggered when either angle of attack or
sideslip angle exceeds limits post-MECO.)
NOM/ATO -- ET separation
inhibited until the flight crew
either nulls the rates or manually
initiates ET separation.

MAIN ENGINE LIMIT SHUT DN Switch and MAIN ENGINE SHUT DOWN
Pushbuttons on Panel C3
2.16-27

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
TAL -- ET separation inhibited
only for excessive rates (which
flight crew must null). Otherwise,
automatic separation after a brief
delay to allow for venting.

"MPS PNEU P ACUM" - MPS pneumatic

accumulator pressure is less than 700 psia.

RTLS -- Automatic ET separation

after a brief delay to allow for
venting.

"MPS PNEU P REG" - MPS pneumatic

regulator pressure is less than 700 psia or
greater than 810 psia.

(indication
shutdown).

"ET SEP AUTO" - Like ET SEP MAN,

this also means that the ET SEPARATION
switch on panel C3 is in dilemma.
However, function has defaulted to AUTO
instead, and ET separation will occur as
expected.
"ME SHDN SW C(L,R)" - MAIN ENGINE
SHUT DOWN pushbutton on panel C3 is
in dilemma and no longer functional.
Generated by BFS only:

premature

engine

"MPS PNEU P TK" - MPS pneumatic tank

pressure is less than 3800 psia.

Generated by PASS only:

"ET SEP MAN" - The ET SEPARATION
switch on panel C3 is in dilemma.
Function has defaulted to MANUAL. ET
separation must be manually initiated by
the flight crew.

of

These failures have messages that are

annunciated in OPS 1 and 6. Also, the BFS does
all processing of the MPS helium and ullage
pressure systems.
In OPS 3, the MPS parameters on the BFS SYS
SUMM 1 will be blanked, except for helium REG
A and B pressure.
In OPS 2, there is no software caution and
warning for the MPS.
Therefore, if either
manifold pressure (LO2 or LH2) violates limits
while on orbit, the only indication the crew will
see is hardware caution and warning (MPS light
and master alarm.) There will be no message on
the DPS display.

Operations

"MPS H2 OUT P C(L,R)" - SSME GH2

outlet pressure less than 1050 psia
(indication of a premature engine
shutdown).

Prelaunch

"MPS LH2/O2 ULL" - ET LH2 ullage

pressure is less than 28 psig or greater
than 48.9 psig; ET LO2 ullage pressure is
0 or more than 29.0 psig.

At T minus 5 hours 50 minutes, the launch

processing system initiates the SSME liquid
hydrogen chill-down sequence in preparation
for liquid hydrogen loading. At T minus
5 hours 15 minutes, the fast-fill portion of the
liquid oxygen and liquid hydrogen loading
sequence begins, and the liquid hydrogen
recirculation pumps are started shortly
thereafter. At T minus 3 hours 45 seconds, the
fast fill of the liquid hydrogen tank to 98
percent is complete, and a slow topping off
process that stabilizes to 100 percent begins. At
T minus 3 hours 30 minutes, the liquid oxygen
fast fill is complete. At T minus 3 hours 15
minutes, liquid hydrogen replenishment begins,
and liquid oxygen replenishment begins at T
minus 3 hours 10 minutes.

"MPS O2 OUT T C(L,R)" - SSME GO2

outlet temperature less than 125 F

During prelaunch, the pneumatic helium supply

provides pressure to operate the liquid oxygen

"MPS HE P C(L,R)" + MPS He TK P is less than 1150 psi.

+ Change in He TK P is greater than 20
psi over 3 seconds (indication of a
helium leak).
+ MPS He REG P is less than 679 psi or
more than 810 psi.

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-28

USA007587
Rev. A
and hydrogen prevalves and outboard and
inboard fill and drain valves. The three engine
helium supply systems are used to provide antiicing purges.
The MPS helium tanks are pressurized from
2,000 psi to their full pressure at T minus
3 hours 20 minutes. This process is gradual to
prevent excessive heat buildup in the supply
tank. Regulated helium pressure is between 715
and 775 psi.
At this time, the MPS He ISOLATION A and B
switches, the MPS PNEUMATICS L ENG He
XOVR and He ISOL switches, and the MPS He
INTERCONNECT LEFT, CTR, RIGHT switches
on panel R2 are in the GPC position. With the
switches in this position, the eight helium
isolation valves are open, and the left engine
crossover and the six helium interconnect valves
are closed.

AC BUS SNSR Switches on Panel R1

At T minus 16 minutes, one of the first actions by
the flight crew (the pilot) is to place the six MPS
He ISOLATION A and B switches and the MPS
PNEUMATICS He ISOL switch on panel R2 in
the OPEN position. This procedure will not
change the position of the helium isolation

valves, which were already open, but it inhibits

launch processing system control of valve
position.
During prelaunch, liquid oxygen from ground
support equipment is loaded through the
ground support equipment liquid oxygen T-0
umbilical and passes through the liquid oxygen
outboard fill and drain valve, the liquid oxygen
inboard fill and drain valve, and the orbiter
liquid oxygen feedline manifold. The liquid
oxygen exits the orbiter at the liquid oxygen
feedline umbilical disconnect and enters the
liquid oxygen tank in the external tank.
During loading, the liquid oxygen tank's vent
and relief valves are open to prevent pressure
buildup in the tank due to liquid oxygen loading.
The
MAIN
PROPULSION
SYSTEM
PROPELLANT FILL/DRAIN LO2 OUTBD and
INBD switches on panel R4 are in the GND
(ground) position, which allows the launch
processing system to control the positions of
these valves. Just prior to lift-off, the launch
processing system will first command the liquid
oxygen inboard fill and drain valve to close. The
liquid oxygen in the line between the inboard
and outboard fill and drain valves is then
allowed to drain back into the ground support
equipment, and the launch processing system
commands the outboard fill and drain valve to
close.
Also during prelaunch, liquid hydrogen
supplied through the ground support
equipment liquid hydrogen T-0 umbilical
passes through the liquid hydrogen outboard
fill and drain valve, the liquid hydrogen
inboard fill and drain valve, and the liquid
hydrogen feedline manifold.
The liquid
hydrogen then exits the orbiter at the liquid
hydrogen feedline umbilical disconnect and
enters the liquid hydrogen tank in the external
tank. During loading, the liquid hydrogen
tank's vent valve is left open to prevent pressure
buildup in the tank due to boiloff. The MAIN
PROPULSION
SYSTEM
PROPELLANT
FILL/DRAIN LH2 OUTBD and INBD switches
on panel R4 are in the GND position, which
allows the launch processing system to control
the position of these valves.
During the T minus 3 hour hold the pilot
positions the three AC BUS SNSR switches on

2.16-29

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
panel R1 to MONITOR to protect the main
engine controllers. Each engine controller is
powered by two of the three ac buses, one for
each digital computer unit. The loss of one bus
would result in a loss of controller redundancy
on two engines, and the loss of any two buses
would cause the associated engine to shut
down.
With the AC BUS SNSR switches
positioned to MONITOR, the sensors will
provide caution and warning for a potential
over/undervoltage or overload condition, but
they will not trip a bus off line before the crew
can verify whether a true failure exists.
Engine Start
At T minus 4 minutes, the fuel system purge
begins. It is followed at T minus 3 minutes
25 seconds by the beginning of the engine
gimbal tests, during which each gimbal actuator
is operated through a canned profile of
extensions and retractions. If all actuators
function satisfactorily, the engines are gimbaled
to a predefined position at T minus 2 minutes
15 seconds. The engines remain in this position
until engine ignition.
At T minus 2 minutes 55 seconds, the launch
processing system closes the liquid oxygen tank
vent valve, and the tank is pressurized to 21
psig with ground support equipment-supplied
helium. The liquid oxygen tank's pressure can
be monitored as MANF P LO2 on both the BFS
GNC SYS SUMM 1 DPS display and on the
OMS/MPS MEDS display.
The 21-psig
pressure corresponds to a liquid oxygen engine
manifold pressure of 105 psia.
At T minus 1 minute 57 seconds, the launch
processing system closes the liquid hydrogen
tank's vent valve, and the tank is pressurized to
42 psig with ground support equipmentsupplied helium.
The pressure can be
monitored as MANF P LH2 on both the BFS
GNC SYS SUMM 1 DPS display and the
OMS/MPS MEDS display.
At T minus 31 seconds, the onboard redundant
set launch sequence is enabled by the launch
processing system. From this point on, all
sequencing is performed by the orbiter GPCs in
the redundant set, based on the onboard clock
time. The GPCs still respond, however, to hold,

2. SYSTEMS
2.16 Main Propulsion System (MPS)

resume count, and recycle commands from the

launch processing system.
At T minus 16 seconds, the GPCs begin to issue
arming commands for the solid rocket booster
ignition pyro initiator controllers, the holddown release pyro initiator controllers, and the
T-0 umbilical release pyro initiator controllers.
At T minus 9.5 seconds, the engine chill-down
sequence is complete, and the GPCs command
the liquid hydrogen prevalves to open. (The
liquid oxygen prevalves are open during
loading to permit engine chill-down.) The
MAIN PROPULSION SYSTEM LO2 and LH2
PREVALVE LEFT, CTR, RIGHT switches on
panel R4 are in the GPC position.
At T minus 6.6 seconds, the GPCs issue the
engine start command, and the main fuel valve
in each engine opens. Between the opening of
the main fuel valve and MECO, liquid
hydrogen flows out of the external tank/orbiter
liquid hydrogen disconnect valves into the
liquid hydrogen feedline manifold. From this
manifold, liquid hydrogen is distributed to the
engines through the three engine liquid
hydrogen feedlines.
In each line, liquid
hydrogen passes through the prevalve and
enters the main engine at the inlet to the lowpressure fuel turbopump.
When the GPCs issue the engine start command,
the main oxidizer valve in each engine also
opens. Between the opening of the main engine
oxidizer valve and MECO, liquid oxygen flows
out of the external tank and through the external
tank/orbiter liquid oxygen umbilical disconnect
valves into the liquid oxygen feedline manifold.
From this manifold, liquid oxygen is distributed
to the engines through the three engine liquid
oxygen feedlines. In each line, liquid oxygen
passes through the prevalve and enters the main
engine at the inlet to the low-pressure oxidizer
turbopump.
If all three SSMEs reach 90 percent of their rated
thrust by T minus 3 seconds, then at T minus 0,
the GPCs will issue the commands to fire the
solid rocket booster ignition pyro initiator
controllers, the hold-down release pyro initiator
controllers, and the T- 0 umbilical release pyro
initiator controllers.
Lift-off occurs almost
immediately because of the extremely rapid

2.16-30

USA007587
Rev. A
thrust buildup of the solid rocket boosters. The
three seconds prior to T minus 0 allow the
vehicle base bending loads to return to minimum
by T minus 0. If one or more of the three main
engines do not reach 90 percent of their rated
thrust at T minus 3 seconds, all SSMEs are shut
down, the solid rocket boosters are not ignited,
and a pad abort condition exists.
Ascent
Beginning at T minus 0, the SSME gimbal
actuators, which were locked in their special
preignition position, are first commanded to
their null positions for solid rocket booster start
and then are allowed to operate as needed for
thrust vector control.
Between lift-off and MECO, as long as the
SSMEs perform nominally, all MPS sequencing
and
control
functions
are
executed
automatically by the GPCs. During this period,
the flight crew monitors MPS performance,
backs up automatic functions, if required, and
provides manual inputs in the event of MPS
malfunctions.

thrust versus mission elapsed time (MET).

Although the bucket duration and thrust level
vary, a typical bucket runs from about 30 to 65
seconds MET.
The solid rocket booster
propellant is also shaped to reduce thrust. At
approximately 65 seconds MET, the engines are
once again throttled up to the appropriate
power level (typically 104 percent) and remain
at that setting for a normal mission until 3-g
throttling is initiated.
SRB separation is the next major event on
ascent. The SRBs burn out after about 2
minutes of flight. Appearance of an overbright
"Pc < 50" (SRB chamber pressure is less than 50
psi) on the trajectory display indicates to the
crew that the SRB separation sequence has
begun.
Actual separation occurs about 5
seconds later to allow for SRB thrust tailoff.

During ascent, the liquid hydrogen tank's

pressure is maintained between 32 and 34 psig
by the orifices in the two lines and the action of
the flow control valve.
The liquid oxygen tank's pressure is maintained
between 20 and 25 psig by fixed orifices in the
ET to SSME pressurization lines. A pressure
greater than 30 psig will cause the tank to
relieve through its vent and relief valve.
The SSME thrust level depends on the flight: it
is usually 104 percent, but the maximum setting
of 109 percent may be required for emergency
situations. PASS commanded thrust (THROT) is
displayed in PASS ASCENT TRAJ 1 and TRAJ 2
displays.
The throttle level that would be
commanded by the BFS (T) is displayed on the BFS
ASCENT TRAJ 1 and TRAJ 2 displays. Actual
throttle levels are read on the OMS/MPS MEDS
display. As dynamic pressure rises, the GPCs
throttle the engines to a lower power level
(typically 72 percent) to minimize structural
loading while the orbiter is passing through the
region of maximum aerodynamic pressure.
This is called the "thrust bucket" because of the
way the plot looks like a bucket on a graph of
2.16-31

PASS ASCENT TRAJ 1 DISPLAY

(throttle commanded by the PASS)

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
liquid hydrogen are depleted before the
specified MECO velocity is reached. Liquid
oxygen depletion is sensed by four sensors in
the orbiter liquid oxygen feedline manifold.
Liquid hydrogen depletion is sensed by four
sensors in the bottom of the liquid hydrogen
tank. If any two of the four sensors in either
system indicate a dry condition (assuming the
propellant mass has dropped to the point where
the sensors have been armed), the GPCs will
issue a MECO command to the engine
controllers. This allows the engines to safely
shutdown while there is still enough propellant
to avoid cavitating the turbopumps.

PASS ASCENT TRAJ 2 DISPLAY

Liquid oxygen manifold pressure is greatly
affected by acceleration from the SRBs, but
because of its low density, liquid hydrogen is not.
At SRB separation, the liquid oxygen manifold
pressure will drop from well over 100 psia to
approximately 50 psia. Pressure rises again as
the vehicle approaches 3 g's. The crew can
monitor the manifold pressures (MANF P) on
both the BFS GNC SYS SUMM 1 display and on
the OMS/MPS MEDS display.

The crew observes MECO through the

illumination of the three red MAIN ENGINE
STATUS lights on panel F7 and the Pc
indicators on the OMS/MPS MEDS display
dropping
to
0 percent.
Four of the ORBITAL DAP
pushbutton lights on panel C3 illuminate,
indicating that the Trans DAP has been
activated and that the MECO CONFIRMED
software flag has been set. This flag must be set
to enter the ET separation sequence. (NOTE:
the DAP lights will not illuminate on an RTLS
abort since the Trans DAP is not activated at
MECO.
The MECO CONFIRMED flag,
however, is still set.)

Beginning at approximately 7 minutes

30 seconds MET, the engines are throttled back
as necessary to maintain vehicle acceleration at
3 g's or less. Three g's is an operational limit
devised to prevent excessive physical stress on
the flight crew and vehicle. Approximately
six seconds before MECO (the period known as
fine count), the engines are throttled back to
the minimum 67 percent in preparation for
shutdown.
Main Engine Cutoff (MECO)
Normally, the GPCs command MECO once the
vehicle has attained a specified velocity. The
cutoff bugs on the PASS ASCENT TRAJ 2 and the
BFS ASCENT TRAJ 2 displays march across the
top of the display leading up to MECO and
reach the CO tick mark at MECO.
The engines can also be shut down due to a
low-level cutoff, where the liquid oxygen or
2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-32

ORBITAL DAP CONTROL AUTO Light on

Panel C3

USA007587
Rev. A
Once MECO has been confirmed at
approximately 8 minutes 30 seconds MET, the
GPCs execute the external tank separation
sequence. The sequence takes approximately
20 seconds to complete and includes opening
the feedline relief isolation valves, arming the
external tank separation pyro initiator
controllers, closing the liquid hydrogen and
liquid oxygen feedline 17-inch disconnect
valves, turning the external tank signal
conditioners' power off (deadfacing), firing the
umbilical unlatch pyrotechnics, retracting the
umbilical plates hydraulically, and gimbaling
the SSMEs to the MPS dump sequence position.
At this point, the computers check for external
tank separation inhibits. If the vehicle's pitch,
roll, and yaw rates are greater than 0.7 degree
per second, or the feedline disconnect valves
fail to close, automatic external tank separation
is inhibited. If these inhibit conditions are met,
the GPCs issue the commands to the external
tank separation pyrotechnics. The crew has the
capability to override the external tank
separation with the ET SEPARATION switch
located on panel C3. Also, a deflection of the
forward translational hand controller (THC)
will interrupt the separation sequence.
At ET separation, the gaseous oxygen and
gaseous hydrogen feedlines are sealed at the
umbilicals by self-sealing quick disconnects.
Post-MECO
Ten seconds after MECO, the backup liquid
hydrogen dump valves are opened for two
minutes to ensure that the liquid hydrogen
manifold pressure does not result in operation
of the liquid hydrogen feedline relief valve.
After external tank separation, approximately
1,700 pounds of propellant are still trapped in
the SSMEs, and an additional 3,700 pounds of
propellant remain trapped in the orbiter's MPS
feedlines. This 5,400 pounds of propellant
represents an overall center-of-gravity shift for
the orbiter of approximately 7 inches. Nonnominal center-of-gravity locations can create
major guidance problems during entry. The
residual liquid oxygen, by far the heavier of the
two propellants, poses the greatest impact on
center-of-gravity travel.

A hazard from the trapped liquid hydrogen

occurs during entry, when any liquid or gaseous
hydrogen remaining in the propellant lines may
combine with atmospheric oxygen to form a
potentially explosive mixture. In addition, if the
trapped propellants are not dumped overboard,
they will sporadically outgas through the orbiter
liquid oxygen and liquid hydrogen feedline relief
valves, causing slight vehicle accelerations.
The MPS propellent dumps (LO2 and LH2)
occur simultaneously.
Both dumps are
completely automatic. The helium subsystem is
used during the MPS dump to help expel the
liquid oxygen from the LO2 manifold. To
support this, at MECO plus 20 seconds, the
GPCs interconnect the pneumatic helium and
engine helium supply system by opening the
center and right out/open interconnect valves
and the left in/open interconnect valve if the
MPS He INTERCONNECT LEFT, CTR, RIGHT
switches on panel R2 are in the GPC position.
This connects all 10 helium supply tanks to a
common manifold, and it ensures that sufficient
helium is available to perform the liquid oxygen
and liquid hydrogen propellant dumps.
The MPS dump starts automatically at MECO
plus 2 minutes. The MPS dump may be started
manually by taking the MPS PRPLT DUMP
SEQUENCE switch to START. The earliest that
the manual MPS dump can be performed is
MECO plus 20 seconds. The only reason that
the crew may need to start the dump prior to
MECO plus 2 minutes is if the LO2 or LH2
manifold pressure rises unexpectedly. The MPS
dump will start automatically prior to MECO
plus 2 minutes if the LH2 manifold pressure is
greater than 60 psi. The dump takes 2 minutes
to complete. The STOP position of the MPS
PRPLT DUMP SEQUENCE switch prevents the
automatic dump from starting during the ET
separation sequence if it is delayed by an RCS
leak or feedline disconnect valve failure.
For the LO2 dump, the GPCs command the two
liquid oxygen manifold repressurization valves
to open (the MAIN PROPULSION SYSTEM
MANF PRESS LO2 switch on panel R4 must be
in the GPC position), command each engine
controller to open its SSME main oxidizer valve
(MOV), and command the three liquid oxygen
prevalves to open (the LO2 PREVALVE LEFT,

2.16-33

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
CTR, RIGHT switches on panel R4 must be in
the GPC position). The liquid oxygen trapped
in the feedline manifolds is expelled under
pressure from the helium subsystem through
the nozzles of the SSMEs. This dump is
propulsive and typically provides a change in
orbital velocity of about 9 to 11 fps.
The pressurized liquid oxygen dump continues
for 90 seconds. At the end of this period, the
GPCs automatically terminate the dump by
closing the two liquid oxygen manifold
repressurization valves, wait 30 seconds, and
then command the engine controllers to close
their SSME main oxidizer valve. The three
liquid oxygen prevalves remain open during
the orbit phase of the flight.
Concurrent with the liquid oxygen dump, the
GPCs automatically initiate the MPS liquid
hydrogen dump. The GPCs command the two
liquid hydrogen fill and drain valves (inboard
and outboard) to open, the topping valve to
open, and the three LH2 prevalves to open.
The liquid hydrogen trapped in the orbiter
feedline manifold is expelled overboard without
pressure from the helium subsystem. The liquid
hydrogen flows overboard through the inboard
and outboard fill and drain valves, and the
topping valve for two minutes. The GPCs
automatically stop the dump by closing the
liquid hydrogen outboard fill and drain valve
and the topping valve.
At the end of the liquid oxygen and liquid
hydrogen dumps, the GPCs close the helium
out/open and in/open interconnect valves,
provided the He INTERCONNECT LEFT, CTR,
RIGHT switches on panel R2 are in the GPC
position. After the MPS dump is complete, the
SSMEs are gimballed to their entry stow position
with the engine nozzles moved inward (toward
one another) to reduce aerodynamic heating.
Although the gimbals move to an MPS dump
position during the external tank separation, the
I-loads are currently the same as the entry stow
position. At this time, the BODY FLAP lights on
panel F2 and F4 turn off. This is the crew's
indication that the MPS dump is complete.
In the post OMS-1 procedures, the pilot positions
all six MPS ENGINE POWER switches on panel
2. SYSTEMS
2.16 Main Propulsion System (MPS)

R2 to OFF, which removes all power to the main

engine controllers. Once power is removed from
the controllers, the main oxidizer valves (through
which the residual liquid oxygen is dumped) can
no longer be operated.
The pilot also positions the six He ISOLATION
switches and the PNEUMATIC He ISOLATION
switch to GPC at this time. When this is done,
the helium isolation valves automatically close.
This cuts off helium to the helium regulators,
which then begin to bleed down.
NOTE
As the helium regulators bleed down,
they trigger multiple MASTER ALARMS,
which the crew can expect.

The
external
tank
gaseous
hydrogen
pressurization manifold is manully vacuum
inerted by opening the hydrogen pressurization
line vent valve by placing the MAIN
PROPULSION SYSTEM H2 PRESS LINE VENT
switch on panel R4 to OPEN. After about one
minute, the switch is taken back to the GND
position, which closes the valve. The hydrogen
pressurization vent line valve is electrically
activated; however, it is normally closed
(spring-loaded to the closed position).
Removing power from the valve solenoid closes
the valve.
Vacuum Inerting
Fifteen minutes after the MPS dump stops, the
GPCs initiate the sequence for vacuum inerting
the orbiter's liquid oxygen and liquid hydrogen
manifolds. Vacuum inerting allows traces of
liquid oxygen and liquid hydrogen trapped in
the propellant manifolds to be vented into space.
The LO2 vacuum inerting is accomplished by the
GPCs opening the LO2 inboard and outboard fill
and drain valves. The LH2 vacuum inerting is
accomplished by the GPCs opening the backup
LH2 dump valves.
The liquid oxygen and hydrogen lines are
inerted simultaneously for two minutes. At the
end of the sequence, the GPCs close the LO2
outboard fill drain valve and the LH2 backup

2.16-34

USA007587
Rev. A
dump valves. The LO2 and LH2 inboard valves
are left open to prevent a pressure buildup
between the inboard and outboard valves.
Any GPC or FA MDM failure that will not
allow the automatic vacuum inert to function
properly will require the crew to perform a
manual vacuum inerting procedure.
Following the OMS 2 burn, upon transition to
MM 106, the LH2 system goes through a second
vacuum inerting to evacuate all of the residual
liquid hydrogen.
Residual hydrogen ice
sublimates quickly after the OMS 2 burn (and
the LH2 manifold pressure rises) due to the
vibrations induced by the firing of the OMS
engines. This second inert takes about three
minutes to complete.

Post Insertion
In the post insertion portion of the flight, the
MPS is essentially unpowered.
On panel L4, the 18 circuit breakers connecting
ac power to the main engine controllers are all
opened to reduce the risk of a short.
Via switches on panel O17, the four ascent
thrust vector control (ATVC) units, the three
engine interface units (EIUs), and the two
master events controllers (MECs) are all
powered OFF.

the manifold pressure caution and warning

parameter (left enabled during post insertion )
would alert the crew of the high manifold
pressure and the malfunction procedure would
be performed, relieving the pressure or
deducing a manifold pressure transducer
failure.

Deorbit Prep
During the deorbit prep timeframe, the MPS
hardware C/W is reconfigured in preparation
for entry. First, the MPS helium "A" regulators
are re-enabled. Helium will be used for the
entry purge and manifold repressurization. The
hardware C/W will help the crew identify a
regulator that has failed high before it overpressurizes the aft compartment. Next, the
manifold pressure is inhibited. The manifolds
are at a vacuum state and do not need to be
monitored during entry.
Also during deorbit prep, the ATVC switches
are powered back on. This will allow the main
engine nozzles, which may have drifted out of
position while on orbit, to return to their entry
stow positions. Activating the ATVCs also
supports SSME repositioning for drag chute
deploy, which automatically occurs during
glided flight.

Entry

The hardware C/W system is reconfigured to

inhibit caution and warning on the helium tank
pressures and the "A" regulators, since the
helium system is secured and no longer used.
In the event of an incomplete MPS dump, the
LH2 and LO2 manifold pressure caution and
warning is left enabled to alert the crew to a
possible high manifold pressure while on orbit.

The GPCs reconfigure the MPS helium system

in preparation for the entry repressurization
and purge at the MM 303 transition.

Orbit

Once MM 303 is entered, the GPCs command

the PNEUMATIC ISOLATION A and B, and the
L ENG He XOVR to OPEN provided the switch
is in the GPC position. At the same time, the
MPS He INTERCONNECTS CTR and RIGHT
are commanded out/open, while the MPS He
INTERCONNECT LEFT is commanded in/
open. This feeds all the MPS helium through
the left engine, through the PNEUMATICS L
ENG He XOVR, and through the pneumatic
isolation valves. Also at this time, the LH2

All main propulsion systems have been secured

by the time post insertion is complete. The MPS
orbit procedures deal with off-nominal
manifold pressures and are not normally
performed. The concern on orbit is possible
high manifold pressures due to an incomplete
vacuum inert or MPS dump. If high manifold
pressures were detected during orbit, the MCC
would advise the crew to perform a manual
vacuum inert. If the MCC were not available,

NOTE
Expect the F7 MPS light to be on until
MM 303.

2.16-35

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A
RTLS dump valves go open to insure the LH2
manifold is completely vented prior to entry.
At a ground-relative velocity (VREL) of 8000 fps
(around an altitude of 151,000 feet), the ATVCs
pitch down the main engine bells out of the way
of the drag chute when it is deployed after
touchdown.
At a VREL of 5300 fps (between 130,000 and
110,000 feet altitude, depending on the entry
trajectory), the helium blowdown valves open
which allows helium to continuously purge the
aft compartment, OMS pods, and the LH2
umbilical cavity area. There is no manual
control of the blowdown valves.
The
blowdown purge continues for 650 seconds and
typically ends a few minutes after touchdown.
Also at a VREL of 5300 fps, the MAIN
PROPULSION SYSTEM MANF PRESS LH2 &
LO2 valves are commanded OPEN, provided
the switches on panel R4 are in the GPC
position.
This allows the LH2 and LO2
manifolds to be pressurized, preventing
contaminants from entering the manifolds
during entry. Removing contamination from
the manifolds or feedlines can be a long and
costly process since it involves disassembly of
the affected parts.
The manifold repress
continues until the ground crews install the
throat plugs in the main engine nozzles.
Further, the LH2 backup dump valves and the
LO2 prevalves go closed.

RTLS Abort Propellant Dump Sequence

For RTLS abort, immediately post-MECO, the
valve sequencing is the same as for a nominal
MECO. After approximately 25 seconds, the
vehicle enters MM 602 and the RTLS dump
begins. The RTLS entry dump differs only
slightly from the nominal entry dump.

the RTLS liquid oxygen dump, the GPCs

terminate the dump whenever the ground
relative velocity drops below 3,800 feet-persecond.
The liquid oxygen system is
repressurized when VREL is 3800 fps, and
repressurization continues as in a nominal
entry.
LH2 manifold is expelled in the same manner as
the nominal post-MECO dump (with one
exception) until VREL is 3800 fps, at which time
the valves are closed. The only exception is that
the RTLS LH2 dump is assisted by helium
pressurization through the RTLS manifold
pressurization valves for two minutes, beginning
at RTLS dump start.
The entry repressurization and the aft
compartment surge also occur during the RTLS.
The helium blowdown valves are opened at
VREL of 5300 fps, followed by the manifold
repress valves opening at a VREL of 3800 fps. As
with the nominal entry, the blowdown valves
remain open until a few minutes after landing.

TAL Abort Propellant Dump Sequence

For a TAL abort, the entire dump sequence is
the same as that for RTLS. On the TAL, the
dump begins at the transition to MM 304.
The LO2 is also dumped at the MM 304
transition through the LO2 prevalves and then
out the MOVs, just as in the nominal dump. To
assist in removing the LO2 propellants, the LO2
inboard and outboard fill drains are opened at a
VREL of 20,000 fps if the LO2 manifold pressure
is less than 30 psi.

During the RTLS dump, liquid oxygen is

initially dumped through the LO2 prevalves
and through the main oxidizer valves (MOVs)
in the SSMEs. When the dynamic pressure is
above 20 psf (plus an I-load), there is a
subsequent venting through the liquid oxygen
fill and drain valves. This dump is done
without helium pressurization and relies on the
self-boiling properties of the liquid oxygen. In
2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-36

USA007587
Rev. A

MPS Caution and Warning Summary

Data path failure is the loss of both primary
and secondary data paths between the engine
controller and the GPCs. Data path failure
indications include an SM ALERT light and
audio tone, an amber MAIN ENGINE
STATUS light on panel F7, the engine Pc
meter on the OMS/MPS MEDS display
driven to zero, and an MPS DATA L (C, R)
message.
Command path failure is when the engine
controller does not receive 2/3 valid inputs
from the GPCs. The engine will not respond
to any commands, such as throttling or
shutdown.
Indications include an SM
ALERT light on panel F7 and audio tone, an
amber MAIN ENGINE STATUS light on
panel F7, no change in the Pc meter during
throttling, and an MPS CMD L (C, R)
message. This message will only annunciate
on the PASS pre-BFS engage.
Hydraulic lockup occurs when the engine
controller senses any of the five hydraulically
actuated engine valves out of position. The
engine will no longer throttle. Indications
are an SM ALERT light and audio tone, an
amber MAIN ENGINE STATUS light on
panel F7, no change in Pc meter during
throttling, and an MPS HYD L (C, R)
message.
Electric lockup occurs when the controller
loses all Pc or all fuel flow rate data from the
engine. The engine will no longer throttle.
Indications are SM ALERT light and audio
tone, an amber MAIN ENGINE STATUS light
on panel F7, no change in Pc meter during
throttling, and MPS ELEC L (C, R) message.
Engine failure indications are a visual and
audible MASTER ALARM, a red MAIN
ENGINE STATUS light, engine Pc meter
reading of zero, a Backup C&W Alarm light
on the F7 C/W matrix, and an SSME FAIL L
(C, R) message on the DPS display. A drop
in acceleration also occurs but may be hard
to detect (especially in MM 102, pre SRB
SEP).
ET SEP switch failures are shown by an SM
alert light and an ET SEP MAN or ET SEP
AUTO message.
MAN is the default

software position for NOM/ATO; AUTO, for

RTLS/TAL. This is annunciated by the PASS
only (since BFS has no switch RM).
Main engine shutdown pushbutton failures
cause an ME SHDN SW C(L,R) message
and an SM alert light and tone that is
annunciated by the PASS only (since BFS has
no switch RM).
Liquid hydrogen ullage pressure below 28.0
psia is indicated by an SM ALERT light and
audio tone, one or more down arrows by the
LH2 pressure readings on the BFS GNC SYS
SUMM 1 display, and an MPS LH2/O2
ULL message on the BFS DPS display.
High liquid hydrogen or liquid oxygen
manifold pressure indications are: a visual
and audible MASTER ALARM, out of limits
indications by the applicable MANF P
reading on both the BFS GNC SYS SUMM 1
display and the OMS/MPS MEDS display,
and an MPS LH2/LO2 MANF message on
the DPS display. The limits are 249 psia for
liquid oxygen, and 65 psia for liquid
hydrogen.
Helium tank leaks or regulator failure are
indicated by an SM ALERT light and audio
tone, an up arrow by the applicable dP/dT or
regulator on the BFS GNC SYS SUMM 1
display, and an MPS He P C (L, R)
message.
ET separation inhibit is indicated by an SM
ALERT light and audio tone and an ET SEP
INH message.
The MPS light on panel F7 illuminates (red)
if liquid hydrogen manifold pressure exceeds
65 psia on orbit or liquid oxygen manifold
pressure exceeds 249 psia on orbit.
A
MASTER ALARM also illuminates, an audio
alarm sounds, and the red BACKUP C/W
ALARM on panel F7 is lit as well. The light
will also illuminate for helium pressure
below 1,150 psia or regulated helium
pressure below 680 or above 810 psia on the
"A" regulators only.
The red upper half of the MAIN ENGINE
STATUS lights on panel F7 will be
illuminated for an engine in shutdown or
post-shutdown phase or exceeding redline
limits with limits inhibited.

2.16-37

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A

MPS Caution and Warning Summary (continued)

MPS pneumatic system anomalies are
annunciated by an SM alert light and audio
tone, and an applicable message on the BFS
DPS display. The following pneumatic
system messages are annunciated along
with an SM alert light and audio tone for
the given condition. MPS PNEU TK,

pneumatic tank pressure drops below

3800 psi. MPS PNEU ACUM, pneumatic
accumulator pressure drops below 700 psi.
MPS PNEU REG, pneumatic regulator
pressure drops below 700 psi or goes above
810 psi.

O2 PRESS

H2 PRESS

FUEL CELL
REAC

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

CABIN ATM

O2 HEATER
TEMP

MAIN BUS
UNDERVOLT

AC
VOLTAGE

AC
OVERLOAD

AV BAY/
CABIN AIR

IMU

FWD RCS

RCS JET

(R)
(R)

FREON
LOOP

(R)

H2 O LOOP

RGA/ACCEL

AIR DATA

LEFT RCS

RIGHT RCS

(R)

LEFT RHC
(R)

PAYLOAD
WARNING(R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM (R)

GPC
PRIMARY C/W
APU
TEMP

RIGHT/AFT
RHC

(R)

LEFT OMS

RIGHT OMS

(R)

FCS (R)
SATURATION

OMS KIT

FCS
CHANNEL

MPS

OMS TVC
(R)

(R)

APU
APU
HYD PRESS
OVERSPEED UNDERSPEED

633.cvs

MPS Caution and Warning Lights on Panel F7

OMS/MPS Display

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-38

USA007587
Rev. A

MPS Summary Data

The main engines, assisted by two solid
rocket motors during the initial phases of the
ascent trajectory, provide the vehicle
acceleration from lift-off to MECO at a
predetermined velocity.
Most of the MPS is located at the aft end of
the orbiter beneath the vertical stabilizer.
The MPS consists of three SSMEs and
controllers, the external tank, propellant
management and helium systems, four
ascent thrust vector control units, and six
hydraulic servoactuators.
The SSMEs are reusable, high-performance
engines that use liquid hydrogen for fuel and
cooling and liquid oxygen as an oxidizer.
The SSMEs can be throttled 67 to 109 percent
in 1 percent increments. Thrust level values
are: 100 percent = 375,000 pounds at sea
level, 470,000 pounds in a vacuum; 104
percent = 393,800 pounds at sea level, 488,000
pounds in a vacuum; 109 percent = 417,300
pounds at sea level, 513,250 pounds in a
vacuum.
Major SSME components are fuel and
oxidizer turbopumps, preburners, a hot gas
manifold, main combustion chamber, nozzle,
oxidizer heat exchanger, and propellant
valves.

The propellant management system consists

of manifolds, distribution lines, and valves
that transport propellant from the external
tank to the three main engines for
combustion, and gases from the engines to
the external tank for pressurization.
The helium system consists of 10 supply
tanks and associated regulators, check
valves, distribution lines, and control valves.
The helium system is used for: (1) in-flight
engine purges, (2) pressure for emergency
closing of engine valves, (3) pressure to
actuate pneumatically operated propellant
valves, (4) expelling the propellants during
the MPS dump and (5) entry purge and
repressurization.
There is one helium system per engine, plus
a fourth pneumatic system to operate the
propellant valves.
The three orbiter hydraulic systems supply
hydraulic pressure to the MPS to actuate
engine valves and provide engine gimballing
for thrust vector control.
MPS controls are located primarily on panels
R2 and R4, and C3 with a few on panels F7,
O17, and R1.
MPS system status indicators appear on
several displays, which include OMS/MPS
MEDS, BFS GNC SYS SUMM 1, and both
PASS and BFS ASCENT TRAJ 1 and 2.

Each SSME has a controller with two

redundant digital computer units. Operating
in conjunction with engine sensors, valves,
actuators, and spark igniters, the controllers
form a self-contained system for engine
control, checkout, and monitoring.

2.16-39

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A

Panel R2
2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-40

USA007587
Rev. A

Panel R4

BFS GNC SYS SUMM 1

Panel O17

2.16-41

2. SYSTEMS
2.16 Main Propulsion System (MPS)

USA007587
Rev. A

MPS Rules of Thumb

Direct insertion MECO is usually close to
8 minutes 30 seconds MET.
An SSME will consume approximately
4 percent propellant per engine per minute at
104 percent.
Propellant remaining is
displayed on the PASS ASCENT TRAJ 2
display and is a guidance-calculated number.
When an engine fails, the helium dP/dT is
greater than 40 for several seconds, due to
engine shutdown purges, and then it goes to
zero. This is a good crosscheck to confirm
engine shutdown.
Two automatic ways to set MECO confirm
are: three Pc's < 30% or two Pc's <30% and a
data path failure on the third SSME. Three
manual ways to set MECO confirm are: push
the three SSME PB's, OPS 104 PRO, or FAST
SEP.

An SSME FAIL C (L, R) message indicates

that the GNC software has recognized an
engine shut down.
An engine in data path failure will never
display a red MAIN ENGINE STATUS light.
There are no direct indications to the crew of
limit shutdown enable/inhibit status. The
status is available to the MCC, or it can be
deduced by the crew.
Limits must be enabled on an engine when
the helium regulator pressure begins to
decay due to a helium leak. An SSME will
fail catastrophically if there is insufficient
helium, and limit shutdown is inhibited.
Loss of an APU in powered flight will result
in a hydraulic lockup.
An SSME in hydraulic or electric lockup may
require a pre-MECO shutdown.

Both PASS and BFS do not require all three

MAIN ENGINE SHUT DOWN pushbuttons
simultaneously to set MECO confirmed.

Actual throttle levels on the first stage

throttle bucket can vary due to SRB thrust
level dispersions. This is an artifact of "first
stage adaptive guidance."

To shut down an engine, both contacts on the

MAIN ENGINE SHUT DOWN pushbutton
must be good. If one contact is commfaulted,
the button can only be used to set the safing
flag on an engine that failed under a data
path failure. If, however, a contact is powerfailed, the button is totally inoperative.

Manual SSME shutdown typically occurs

about 30 seconds before MECO.
This
corresponds to: VI = 23K (3-eng uphill),
VI = 24.5K (2-eng uphill), and VI = 22.5K
(TAL).

In the BFS, if a contact on the MAIN ENGINE

SHUT DOWN pushbutton is either
commfaulted or power-failed, the button is
totally inoperative.
An SSME command path failure must always
be shut down manually with the A/C
switches and PBs.

MPS ENGINE POWER switches look very

similar to He ISOLATION switches and are
located close together on panel R2. Use
caution.
Loss of ALC 1, 2, 3 (APC 4, 5, 6) will cause
SSME helium isolation A to close on the C, L,
R SSME, respectively.
Do not attempt
subsequent helium leak isolations.

Shutdown with A/C switches will always

cause a data path failure.

2. SYSTEMS
2.16 Main Propulsion System (MPS)

2.16-42

USA007587
Rev. A

2.17

Electromechanical Actuators

MECHANICAL SYSTEMS

The orbiters electromechanical actuators, also

called power drive units (PDUs), contain two
three-phase alternating current (AC) motors,
brakes, a differential assembly, a gearbox, and
limit switches.
Except for the ET door
centerline latches, all actuator assemblies also
contain torque limiters.

CONTENTS
Description.............................................
Active Vent System...............................
External Tank Umbilical Doors...........
Payload Bay Door System....................
Mechanical Systems Summary
Data ..............................................
Mechanical Systems Rules of
Thumb..........................................

2.17-1
2.17-3
2.17-5
2.17-9
2.17-18

Power for the actuator motors and limit

switches is provided by the orbiters motor
control assemblies (MCAs). The MCAs are
powered via MCA LOGIC switches and circuit
breakers on panel MA73C.

2.17-22

Description
The orbiters mechanical systems are those
components that must be deployed, stowed,
opened, or closed. An electrical or hydraulic
actuator physically moves each of these
components.
The mechanical systems include the active vent
system, external tank (ET) umbilical doors,
payload bay doors, deployable radiator system,
and the landing and deceleration system. The
landing and deceleration system is discussed in
Section 2.14, and the radiators are included in
Section 2.9. Descriptions of the remaining
systems, as well as their operations are
discussed in this section.
There are other orbiter systems that use
mechanical actuators but they are not
considered mechanical systems. These systems
are not discussed in this section. Instead, they
are covered in the following sections: Section
2.4, Ku-band Antenna; Section 2.13, Star Tracker
Doors and Air Data Probes; and Section 2.19,
Payload Retention Latches.

Nominally, both of an actuators AC motors will

drive at the same time, which is referred to as
dual motor drive. If only one motor is driving,
it is called single motor drive. If a mechanism is
being driven with single motor drive, it will
take twice as long to reach the desired position
than it would with dual motor drive.
Commands are sent to the MCAs to turn the AC
motors on and off. Commands can originate
from the general purpose computers (GPCs), data
processing system (DPS) item entries, or
hardwired switches. These commands are sent
via multiplexer/demultiplexers (MDMs). Each
actuator motor is commanded through a
separate MDM; therefore, the loss of one MDM
will not cause the loss of an entire actuator.
The AC motors are reversible so that
mechanisms may be driven in both directions
(open or closed, stowed or deployed, latched or
released). When a mechanism reaches the
commanded position, the limit switches send
signals back to the MCA to open relays that
remove the AC power to the associated motors.
These limit switch signals also provide feedback
through telemetry, DPS displays, and talkbacks
in the crew compartment.

2.17-1

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Electromechanical Actuator

MCA Controls on Panel MA73A

2. SYSTEMS
2.17 Mechanical Systems

2.17-2

USA007587
Rev. A

Active Vent System

The active vent system (AVS) equalizes the
orbiters unpressurized compartments to the
ambient environment as the orbiter travels from
the pressurized atmosphere of Earth to the
vacuum of space.
The AVS consists of 14 vent ports (7 on each
side) in the orbiter fuselage. For identification,
each door is numbered forward to aft.
Originally, there were a total of 18 vents. An
engineering analysis showed that vent ports 3,
5, and 6 provide sufficient venting of the
payload bay and mid-fuselage compartments.
Because of this, vent ports 4 and 7 were
permanently capped shut on both sides of
Atlantis and Discovery.
The associated
actuators and linkages also were removed.
Endeavour did not have the equipment
installed.
Each vent door has a pressure seal and a
thermal seal, and is driven inward by its
associated electromechanical actuator. The vent
openings are sized according to the volume to
be vented.
The doors for the vent ports are opened and
closed during the mission to perform the
functions of the AVS. Normal opening or
closing time is 5 seconds for each vent door,
with dual motor drive.
Some of the vent doors (1, 2, 6, 8, and 9) also
have intermediate positions to provide the
capability to purge the unpressurized
compartments with dry air or nitrogen. Purge
operations are performed on the ground to

provide thermal conditioning, moisture control,

and to exclude hazardous gases or
contaminants.
Vent Operations
The vent doors are controlled by a GNC
software sequence that can be started by a
master timing unit, major mode transition,
velocity, or DPS item entry.
When commanded via item entry by the crew, they
will use GNC SPEC 51 OVERRIDE in the PASS.
There are similar capabilities in the BFS, but the
item entries on the BFS page are only legal if BFS is
engaged.
During countdown, the vent doors are in their
purge positions until T-28 seconds, when the
OPEN sequence is automatically called by the
redundant set launch sequencer (RSLS). The
vent doors are commanded open in a staggered
sequence at approximately 2.5-second intervals.
The vent doors remain open during ascent,
orbital insertion, and all on-orbit phases.
During entry preparation, the crew performs a
DPS item entry on GNC SPEC 51 OVERRIDE to
close the vent doors. At this time, all the vent
doors are commanded closed and then port
vents 1, 2, 8, and 9 are automatically reopened.
These vents are left open to vent any hazardous
gases during the deorbit burn and to prevent
vehicle overpressurization should a rapid orbital
maneuvering system (OMS)/reaction control
system (RCS) leak occur. These vents are
automatically closed at the MM304 transition.

2.17-3

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Vent Locations
When the relative velocity of the orbiter reaches
2400 ft/s on entry, all the vent doors are
automatically commanded open, allowing the
unpressurized compartments to equalize with
the ambient atmosphere.
Postlanding, once in OPS 9, the crew will
perform DPS item entries on GNC SPEC 105
TCS CONTROL to configure the AVS for purge
operations.
Nominally, the AVS operates automatically
except for the preentry and postlanding
configuration, which are commanded by the
orbiter crew at the appropriate times. In the
return-to-launch site (RTLS) abort, the vent
doors are automatically commanded closed at
MM 602. For a transoceanic abort landing
(TAL), the vent doors are automatically
commanded closed at ET separation.

2. SYSTEMS
2.17 Mechanical Systems

2.17-4

3041/051/
OVERRIDE
2 000/00:13:15
000/00:03:09
ABORT MODE
ENTRY FCS
TAL
1
ELEVON
FILTER
ATMOSPHERE
ATO
2
AUTO 17*
NOM 20
NOM
22*
ABORT
3
FIXED 18
ALT 21*
N POLE 23
THROT MAX 4
SSME REPOS 19 ENA
S POLE 24
ABT 50
IMU STAT ATT DES
PRL
NOM 51
1
3 25
SYS AUT DES
PRPLT DUMP
2
26
1 28* 31
INH ICNCT 5
3
27
2 29* 32
OMS DUMP
3 30* 33
ARM
6
ADTA
H

M
DES
START 7
L 1
0
0.0 0.00 34
STOP
8
3
0
0.0 0.00 35
9 QUAN/SIDE 84
R 2
0
0.0 0.00 36
OMS DUMP TTG
0
4
0
0.0 0.00 37
ET SEP
ROLL MODE AUTO
AUTO
38
AUTO SEL
42
AFT RCS 13
ENA
SEP
39
WRAP MODE 45 ACT
VENT DOOR CNTL
14 TIME - 1 ET UMB DR
CLOSE
40
OPEN
43
FWD RCS 15
INH RCS RM MANF
CLOSE
44* CL
16 TIME - 0
CL OVRD 41
usa007587_741r3.cvx

OVERRIDE Display (SPEC 51)

USA007587
Rev. A
PASS/BFS
Major Mode
(RTLS)

301

302

Command
OPEN
ITEM 43
All doors open

CLOSE
ITEM 44
All doors close;
then port 1, 2, 8, 9
Auto reopen

All doors open

303
304
305

All doors open

Port 1, 2, 8, 9 open
All doors open

(602)
(603)

All doors open

All doors open

All doors close

All doors close
All doors close
Command not available
until rollout flag set
All doors close
Command not available
until rollout flag set

Manual Vent Door Command Capability during Entry

External Tank Umbilical Doors

Electrical and fuel umbilicals between the external tank and the orbiter enter the shuttle
through two aft umbilical openings located on
the underside of the orbiter. These umbilical
cavities contain the orbiter/ET attachment
points and the fuel and electrical disconnects.
The left cavity contains the liquid hydrogen
umbilical, and the right cavity contains the
liquid oxygen umbilical.
Each umbilical cavity has an associated ET
door. During ascent, this door is open to allow
the umbilical connections between the orbiter
and the ET. After the ET separates from the
orbiter, the two aft umbilical openings are
exposed. The ET doors are closed to cover these
exposed areas and to shield them from entry
heating.
A closeout curtain is installed at each of the
orbiter/external tank umbilicals.
After ET
separation, the residual liquid oxygen in the
main propulsion system is dumped through the
three SSMEs and the residual liquid hydrogen
is dumped overboard. The umbilical curtain
prevents hazardous gases (gaseous oxygen and
hydrogen) from entering the orbiter aft fuselage
through the umbilical openings before the
umbilical doors are closed.

Each umbilical door, which is approximately 50

in2, is covered with reusable thermal protection
system tiles. Additionally, each door has an
aerothermal barrier that requires approximately
6 psi to seal it with adjacent thermal protection
tiles.
There are two types of latches associated with
the ET doors, centerline latches and uplock
latches. The centerline latches hold the ET
doors open during ascent, and the uplock
latches secure the doors when they are closed.
The centerline latches must be disengaged from
the doors before both ET doors can be closed.
In the latched position, each centerline latch fits
into a notch on the outer edge of the left and
right ET doors. When stowed, the two centerline latches rotate and retract into the body of
the orbiter so that they are flush with the orbiter
thermal protection system mold line.
After the ET doors are closed, uplock latches
pull the doors fully closed, compressing them
against aerothermal seals and positioning them
flush with the orbiter body. These latches
secure each door closed and prevent them from
vibrating or opening during reentry.
Three uplock latches are located inside each
umbilical cavity. The latches engage three
uplock rollers located on each ET door. The
latches can engage the rollers as long as the ET
door is within 2 inches of being closed.

2.17-5

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

ET Door Positions

Right Side ET Umbilical Door

Centerline Latch Movement

2. SYSTEMS
2.17 Mechanical Systems

2.17-6

USA007587
Rev. A
Aft uplock

Enables uplock
latch motor 2
and door close
talkback

Enables door close

talkback
Fwd uplock

Enables uplock
latch motor 1
and door close
talkback

Door Uplock Latch and Roller

644.cvs

Uplock Latch Limit Switches

CAUTION
Thermal damage will occur if the ET doors
are not fully latched flush with the orbiter
body.
ET Door Operations
The ET doors are closed post OMS-1 burn after
MPS vacuum inerting. The doors and latches
must be sequenced in an orderly manner to
prevent damage. First, the centerline latches are
stowed, then the doors are closed, and finally
the doors are latched.
The doors are nominally closed by the crew
with the ET UMBILICAL DOOR switches
located on panel R2. The MODE switch must be
in the GPC/MAN position to enable manual
crew control with the panel R2 switches.

The crew stows the centerline latches by taking

the CENTERLINE LATCH switch to the STOW
position. Each centerline latch is driven by one
electromechanical actuator.
Nominally, 6
seconds are required to stow the centerline
latches with dual motor drive. The GND
position of this switch removes commands from
the centerline latch motors.
The talkback above the CENTERLINE LATCH
switch has two positions. The microswitches
that drive the talkback are located within the
centerline latch drive mechanisms and are
activated based on the position of the latches.
The talkback will be barberpole when the
latches are deployed or in transit, and will be
STO when the latches are stowed.

ET UMBILICAL DOOR Controls on Panel R2

2.17-7

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A
Once stowed, the crew cannot redeploy the
centerline latches. This task can be performed
only on orbit by real-time commands from
MCC or postlanding by ground crews.
The crew uses the LEFT DOOR and RIGHT
DOOR switches on panel R2 to close the ET
doors. When the crew positions the switches to
CLOSE,
commands
are
sent
to
electromechanical actuators to drive the doors
closed through a system of bellcranks and
pushrods. Each door has its own actuator and
will close in approximately 24 seconds with the
dual motor drive.
As the doors move within 2 inches of being
closed, two rollers mounted on the outboard
edge of each door contact two ready-to-latch
(RTL) paddles located in the umbilical cavity.
The two RTL paddles drive three RTL
microswitches that enable the uplock latch
motors and drive the CL position of the DOOR
talkback.
Two of the three microswitch
indications are needed to provide a CL
indication on the door drive talkback. Each
door also has two open microswitches that
drive the OP position of the door talkback.
The crew uses the LEFT LATCH and RIGHT
LATCH switches on panel R2 to close the ET
door uplock latches. When the crew positions
the switches to LATCH, commands are sent to
electromechanical actuators that drive the
uplock latches through a system of pushrods.
Each set of three uplock latches is driven by one
actuator. Nominally, it takes 6 seconds to open
or close the uplock latches with dual motor
drive. Onboard talkbacks will indicate LAT
once the uplock latches close.
When the uplock latches engage the rollers that
are located on the inside face of the ET door, the
doors are pulled closed approximately 1 to 2
inches, providing the 6 psi required to compress
the aerothermal barrier. Compression of the
aerothermal barrier results in a seal that
protects the umbilical cavity from reentry
heating.
The RELEASE position of the LEFT and RIGHT
LATCH switches is used postlanding to open
the uplock latches in preparation for ET door
opening. The latch talkbacks indicate REL once
the uplock latches are fully opened.
2. SYSTEMS
2.17 Mechanical Systems

As mentioned previously, the door RTL

microswitches drive the door CL talkback and
enable the uplock latch motors. If an ET door
closes but microswitch failures prevent the
uplock latches from being enabled, an override
is available.
The system is designed so that the LEFT LATCH
switch can override the right RTL microswitches, and the RIGHT LATCH switch can
override the left RTL microswitches.
The
override is performed by placing both the LEFT
LATCH and RIGHT LATCH switches in the
LATCH position. By doing this, one switch
overrides the missing microswitch indications,
enabling the uplock latch motors, while the
other switch sends its latch command.
Mission Control has additional telemetry to
determine if missing RTL indications have prevented the uplock latches from being enabled.
The crew should not attempt this override until
the ground has verified that this is the case.
During RTLS and TAL aborts, transition into
MM 602 or 304 will automatically initiate an ET
door software closure sequence. When the
sequence starts, GPC commands are sent for 12
seconds to stow the centerline latches. Six
seconds from the initial centerline latch
command, commands are sent to close the ET
doors. After single motor time for the doors has
elapsed (48 seconds), close commands are sent to
the uplock latches for 12 seconds.
Note that the automatic closure sequence doubles
the normal drive times on the doors and uplock
latches, thus allowing for a single motor failure in
any of the actuators. The sequence does not
allow single motor drive time on the centerline
latches before sending the ET door close
commands. If one of the centerline latches does
have a motor failure, it still should have rotated
far enough in 6 seconds to disengage the ET
doors and allow them to close.
The panel R2 talkbacks remain active
throughout the software closure sequence; they
may be used by the flight crew for insight into
the completion of the sequence.
During MM 104, 105, and 106, the crew can
initiate the ET door software closure sequence
with an item entry on GNC SPEC 51

2.17-8

USA007587
Rev. A
OVERRIDE. However, because the sequence
sends commands based on times rather than on
microswitch indications, crew initiation of the
automatic sequence should only be considered
as a backup method during an AOA.

centerline latch mechanism and the structural

and seal overlap.

Postlanding, the crew opens the ET umbilical

doors using the panel R2 switches, which gives
the ground crews access to the umbilical
cavities.

Payload Bay Door System

The payload bay doors provide an opening for
payload deployment from and retrieval into the
payload bay. The doors provide structural
support for the orbiter midbody, and they
house the environmental control and life support
system (ECLSS) radiators that transfer heat from
the vehicle to space.
There are two doors, port and starboard. Each
door consists of five segments interconnected
by expansion joints.
The port door with
attached systems weighs approximately 2,375
pounds, and the starboard door weighs about
2,535 pounds. The starboard door contains the
centerline latch active mechanisms, which
accounts for the weight difference.
These
weights do not include the deployable radiator
system, which adds 833 pounds per door. The
doors are approximately 60 feet long with a
combined area of 1,600 square feet. Thermal
and pressure seals are used to close the gaps at
the forward and aft fuselage interface, door
centerline, and expansion joints. The starboard
door overlaps the port door to form the
pressure and thermal seal on the centerline.

Payload Bay Doors Location

Each door is connected to the midfuselage by 13
hinges; i.e., 5 shear hinges (nonmoving hinges)
and 8 floating hinges (moving hinges that allow
for thermal expansion and contraction of the
doors). Each door is driven open and closed by
a single electromechanical actuator, each of
which has two three-phase AC motors.
The doors are held closed by a total of 32
latches, 16 centerline latches that secure the
doors to each other on the centerline and 8
forward and 8 aft bulkhead latches that secure
the doors on the bulkheads.

The starboard door must be opened first and

closed last because of the arrangement of the

2.17-9

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Payload Bay Door Latch Locations

Centerline Latches
The centerline latches are grouped in four sets
of four latches each, or four centerline latch
"gangs." The latches are numbered from 1 to 16,
starting forward and moving aft. Each latch
gang is driven by a single typical orbiter
electromechanical actuator using two threephase AC motors. The motors are reversible,
which allows the crew to latch or unlatch the
doors from each other at the centerline.
The starboard door contains the centerline latch
hooks, and the port door contains the centerline
latch rollers. The hooks are the active portion of
the centerline latch system; they rotate to grasp
the latch rollers.

2. SYSTEMS
2.17 Mechanical Systems

As the electromechanical actuator torque shaft

rotates, the bellcrank and link cause the hook to
rotate closed or open, engaging the latch roller
on the port door. It takes 20 seconds to open or
close a gang of centerline latches (dual motor
time).
The status of the centerline latch gang is
provided by limit switches. Two open and two
closed limit switches are associated with each
centerline latch gang.
These limit switch
indicators relay the position of the latch gang
(i.e., latch gang is open or closed). They also
provide a method for enabling and disabling
latch drive motors.

2.17-10

USA007587
Rev. A
Rotary output
Manual input
Clutch/brake

Motor #1

Planetary gearing

Torque limiter
and no-back

Limit switches

Motor #2

Differential
assembly

Clutch/brake

648.cvs

Payload Bay Door Centerline Latch Actuator Schematic

Payload Bay Door Centerline Latch

2.17-11

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A
Bulkhead Latches
The bulkhead latches are grouped in four sets of
four latches each, comprising the starboard and
port forward and aft bulkhead latch gangs.
Each latch gang is driven by a single typical
electromechanical actuator using two three-phase
AC motors. The motors are reversible, which
allows the crew to latch or unlatch the doors from
the forward and aft bulkheads. The latches are
numbered 1-4, starting with the latch closest to the
door hinge line.
The latch hooks for the bulkhead latches are
located on the forward and aft edges of each
door, and the latch rollers are located on the
forward and aft bulkheads. The hooks are the
active portion of the bulkhead latch system;
they rotate to grasp the latch roller.

As the electromechanical actuator torque shaft

rotates, the linkage connecting the latches
begins to move. The linkage design causes a
staggered latch open or close sequence; latch 1
closes first, then latches 2, 3, and 4 close. It
takes 30 seconds to open or close a group of
bulkhead latches (dual motor time). The
staggered sequence results in latch 1 being
nearly closed as latch 4 is just starting to close.
The status of the bulkhead latch groups is
provided by limit switches similar to those used
by the centerline latches. There are two open
and two closed limit switches for each bulkhead
latch gang relay the position of the latch gang
(i.e., open or closed). They also provide a
method for enabling or disabling the latch drive
motors and the payload bay door drive motors.

Payload Bay Door Bulkhead Latches

2. SYSTEMS
2.17 Mechanical Systems

2.17-12

USA007587
Rev. A
Doors
Each of the payload bay doors is driven open or
closed by a single electromechanical actuator
with two three-phase AC motors per drive unit.
Torque limiters are incorporated in the rotary
actuators to avoid damaging the door drive
motors or mechanisms in the event of jamming
or binding during operation.
It takes 63
seconds to open or close each door (dual motor
time). The doors open through an angle of
175.5.
The electromechanical actuator drives a 55-footlong torque shaft that turns the rotary actuators,
causing the push rods, bellcranks, and links to
push the doors open. The same arrangement
pulls the doors closed.

The status of the doors is provided by limit

switches; these, however, are slightly different
from the centerline latch and bulkhead latch
limit-switch indicators. Each door has two
limit-switch modules, one each on the forward
and aft bulkhead. Each switch module contains
four limit switches; i.e., three RTL indicators
and one closed indicator. The RTL indicators
determine when the door is within 4 of being
closed. This is important because the forward
and aft bulkhead latches are then within reach
to latch the door closed. The closed microswitches indicate when the door is completely
closed. Each door also has two open limit
switches located on the torque shaft. These
limit switches determine when the door drive
unit has driven to the full open position.

The push-pull rod is color-coded with silver

and gold bands to assist the crew in
determining how far open the door is, since there
is no telemetry to the ground. As the push rod
opens or closes the door, certain colors are
displayed. Each band, gold or silver, represents
the amount the doors are open or closed in
degrees of rotation; the distance between stripes
indicates about 17.5 of motion. The crew can
use this information to determine if the door is
warped or jammed by seeing if any push rod
has more or less stripes visible than the others.
If the door is completely open, nine colored
bands should be visible (one gold, six silver,
and two gold bands; the final silver stripe
indicating full open is, at best, only partially
visible to the crew). If the door is completely
closed, one gold band at the top of the push rod
should be partially visible.
There are six push-pull rods per door. They can
be located by looking along the sill longeron
that runs along the entire length of the payload
bay. The pushrod closest to the crew
compartment is not visible from the aft flight
deck; to see it, the closed circuit television
(CCTV) system must be used.

2.17-13

FULL closed
position
0
17.5

Color
Silver band

35.5

Gold band
Rod is black

52.5

70.0

87.5

105.5

122.5

140.0
FULL open
position
175.5
651.cvs

Push-Pull Rod Markings

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Payload Bay Door Drive System

Open
position
switch

Manual
disengage

Brake

Motor

Differential

Gearbox

Output

*
*

Brake

Motor

*
EMA
Shafts
couplings

*
*

Closed
position
switch

Torque
limiter

Rotary
actuator

Linkage

Torque
limiter

Rotary
actuator

Linkage

Torque
limiter

Rotary
actuator

Linkage

Torque
limiter

Rotary
actuator

Linkage

Torque
limiter

Rotary
actuator

Linkage

Torque
limiter

Rotary
actuator

Linkage

Open
position
switch

Payload
bay
door

Closed
position
switch
653.cvs

Payload Bay Door Drive System Mechanical Block Diagram

2. SYSTEMS
2.17 Mechanical Systems

2.17-14

USA007587
Rev. A
Payload Bay Door Operations: Opening
The crew can use either the Auto or Manual
mode to open the payload bay doors. Both
sequences are controlled by software. In either
mode, the crew makes item entries to the PL
BAY DOORS display, which provides the
interface between the crew and the doors. The
display can be called up as PASS SM OPS 202
(or 402) or as BFS SM SPEC 63. Nominally, the
doors are opened and closed using PASS in OPS
202, but when the primary software is not in
OPS 2, and payload bay door operations are
needed, the BFS is used. This occurs when the
doors must be opened early (loss of cooling, for
example) or when the doors are closed late in
preparation for entry. Operations in PASS and
BFS are identical, except for the Warning below,
which only applies to BFS. In addition, the crew
uses control switches and talkbacks on panel
R13L.

"move" the switch to its various locations. The

OP/CL status column reflects the state of the
mechanism, based on how the software
interprets the microswitch status. The AUTO
SEQ column shows any Auto Sequence failures.
Finally, the right side of the display represents
the microswitches as seen by the software; a 1
means that the indication "C" (closed) or "O"
(open) is present, a 0 means it is not present. For
the latches, two positive indications are
required for a confirmed state of the latch,
which is then reflected in the OP/CL column.
For the doors, a combination of open, closed,
and RTL indications is required for the software
to determine the state of the door.

WARNING
When in BFS, unless specifically directed by
MCC or Flight Data File procedures, do not go
back to AUTO mode if mechanisms have been
commanded in MANUAL mode. There is a
possibility of driving mechanisms out of order.

The PL BAY DOORS display has 17 manual

item entries and several columns of status data.
When selected, Item 1, AC POWER ON, applies
AC power to the latch and door drives. Item 2,
AC POWER OFF, removes the AC power. Items
1 and 2 are mutually exclusive. Item 3, AUTO
MODE SEL, allows the user to select the Auto
mode to open and close the doors and latches.
Items 4 through 13 select a latch or door to
move manually (listed in the order in which
they will be performed from the top of the page
to the bottom for opening the doors, from the
bottom up for closing the doors). Item 14, PBD
SW BYPASS, manually bypasses the PL BAY
DOOR switch on panel R13L in case it has failed
or if the crew cannot get to the switch for some
reason; the status of this hardware switch is
indicated at the top right of the display as the
PBD-SW status (which will read OP, CL, STOP,
or FAIL). If the switch is manually bypassed
with an Item 14, Items 15 through 17 are used to

PL BAY DOORS Display

An "active group" is that group of items that is
currently being or are about to be commanded
to drive. Typically, an active group consists of
two latch gangs (centerline latches 5-8 and 9-12,
1-4 and 13-16, starboard bulkhead latches, or
port bulkhead latches) or a single door
(starboard or port).
The software monitors the latches and door
drives for premature and out-of-sequence
operation during the Auto mode only (i.e.,
making sure that door opening doesn't occur
before it is unlatched). If any of the latches or
doors are out of configuration, the Auto mode
stops, removes AC power to all the payload bay
door (PLBD) motors, and generates a fault
message, PBD CONFIG, with an SM ALERT. If
any latch or door drive exceeds its single-motor
drive time, the Auto sequence will stop, remove
AC power to all the PLBD motors, terminate all

2.17-15

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A
drive commands, and generate a fault message,
PBD SEQ FAIL, with an SM ALERT. These
safety devices prevent door and latch damage.

If none of these conditions exists, Mission

Control will give the crew the go-ahead to open
the doors. The doors and latches must be
opened in an orderly manner to prevent
possible damage. The doors and latches are
normally opened in Auto mode, though they
may be opened in Manual mode based on crew
preference, various failures, or as specified by
the procedures.
RAD/PLBD OPS NO GO FOR FOLLOWING FAILURES
OMS/RCS
2 OMS Engs

GNC
2 IMUs

1 OMS Eng and 3 RGAs

1 +X RCS Jet
3 AAs
1 OMS Inlet line
3 ADTAs
OMS Prop TK
3 Elevon or
Leak
BF Pos
Aft RCS He or
Fdbks
Prop Leak
(same
surface)
COMM
2 FCS CH
No Voice and
(same
No CMD
surface)

ECLS/EPS
MECH
1 H2O or Freon 2 LG deploy
Loop
methods
Both RFCAs
Both Cab Fans
3 OF 6 Av
Bay Fans
2 FCs

Pressure or
redundant window
pane failure
DPS
3 GPCs
2 PL MDMs

Any Mn or 3
phase AC Bus

2 FF or FA MDMs

Any CNTL or
MPC Bus

APU/HYD
2 APU/HYD/WSB

3 IMU Fans

Opening Doors in Auto Mode

PL BAY DOORS Controls on Panel R13L

The PL BAY DOOR SYS 1 and SYS 2 switches
on panel R13L close DC powered relays that
allow AC power to reach the motors in the
electromechanical actuators. The third switch
on panel R13L used for PLBD operations is the
PL BAY DOOR switch, which has three
positions (open, stop, close) to initiate the
opening and closing sequences.
The status of the sequence as it proceeds should
be monitored both on the display and visually
out the window. Crewmembers should time
the various mechanism motions to verify dual
motor time.
Payload Bay Door Operations: Opening
The payload bay doors are opened approximately 1 hour 25 minutes into a nominal flight.
Certain conditions must be met before the doors
can be opened. The following table lists the
failures that will require the crew to leave the
doors closed and deorbit to the first day
primary landing site (PLS).

2. SYSTEMS
2.17 Mechanical Systems

In Auto mode, the software controls the

sequence of opening the latches and doors,
commanding the next group only after the
previous group has completely moved to its
end of travel open.
The crew will first configure the AC and DC
power sources and select the Auto mode on the
DPS display. They have no active role in the
sequence of opening other than to monitor
times and microswitches and to take manual
action if a failure occurs.
First, centerline latch groups 5-8 and 9-12 open.
These groups secure the mid-centerline region
of the doors. When the orbiter is exposed to the
cold environment of space, warping of the
doors is likely. Opening these two groups first
relieves the tension in the doors caused by
thermal expansion and contraction.
Next to open are centerline latch groups 1-4 and
13-16, which secure the centerline near the
forward and aft bulkheads. Opening these
groups next helps relieve the tension in the door
caused by thermal warping. Centerline latches
must be opened before the bulkhead latches to
decrease tension in the doors.

2.17-16

USA007587
Rev. A
When all the centerline latches are open, the
starboard forward and aft bulkhead latches
open.
This removes any tension in the
starboard door due to the latches and thermal
warping. The starboard door is then opened. It
is opened first because it overlaps the port door
and contains the centerline latch mechanisms.
The port forward and port aft bulkhead latches
on the port door are opened next, followed last
by the port door.
When OP/CL status of the port door shows OP,
the PL BAY DOOR switch and the PL BAY
DOOR SYSTEM switches on panel R13L are set
to their unpowered positions, item 2 on the DPS
display (AC POWER OFF) is executed, and the
payload bay floodlights are turned off.
Opening Doors in Manual Mode
The software does not monitor the latch and
door opening during the Manual mode as it
does in the Auto mode. The crew must monitor
the limit-switch indications and motor drive
times very carefully to determine if the doors
and latches are opening properly. Any latch or
door can be driven out of sequence (i.e., the
bulkhead latches can be opened first). The
major difference between Auto and Manual
modes is that in Manual, the crew must select
which item(s) to drive and then cause the
mechanism(s) to drive using the switch or
bypass; in Auto, the software controls which
items are selected and driven. For nominal
operations using Manual mode, the sequence of
the latches and doors matches that of the Auto
mode.
Payload Bay Doors: Closing
The payload bay doors are closed approximately 2 hours 45 minutes before the deorbit
burn. The door closing sequence is the direct
reverse of the sequence for opening them. The
port door is closed first, followed by the port
forward and port aft bulkhead latches. The
starboard door is closed next, followed by the
starboard forward and aft bulkhead latches.
Finally, the centerline latch groups are closed in
the following order: 1-4 and 13-16, then 5-8 and
9-12.
The crew can use Auto or Manual mode to close
the doors.
The difference in monitoring

between the two modes is the same as it is to

open the doors. Panel R13L and the PL BAY
DOORS display are also used for closing the
doors. The payload bay doors are normally
closed using the Auto mode, typically via the
OPS 202 display in PASS (SM SPEC 63 display
in BFS).
Closing Doors in Auto Mode
To close the doors using the Auto mode, the
crew configures the AC and DC power sources,
selects the Auto mode, and then initiates the
auto sequence by taking the PL BAY DOOR
switch to CLOSE. The status of the sequence is
displayed on the DPS display. One manual step
is taken during the Auto procedures: after the
port door has been closed and latched, and the
starboard door is as close as possible to the port
door before contacting it (about 3-4 feet apart),
the crew performs a fit check by taking the PL
BAY DOOR switch to STOP and visually
comparing the centerline latches to a diagram.
The sequence is continued in Auto mode when
this is verified. When the sequence is complete,
the PL BAY DOOR switch is set to STOP and the
AC and DC power sources are removed.
Closing Doors in Manual Mode
To close the doors using the Manual mode, the
crew first configures the AC and DC power
sources. The manual sequence is initiated by
selecting the individual mechanism item(s) and
driving them taking the PL BAY DOOR switch
to CLOSE, then deselecting the items, and
proceeding to the next active group.
First to close are the port door and then the
bulkhead latches, followed by the starboard
door. As in the Auto mode, when the starboard
door is as close as possible to the port door
before contacting it (approximately 3-4 feet
apart), the crew performs a fit check by taking
the PL BAY DOOR switch to STOP and visually
comparing the centerline latches to a diagram.
Afterwards, the starboard door is completely
closed and the bulkhead latches are closed. The
centerline latches are then closed in the
following sequence: 14 and 1316, and 58
and 912.
When the last of the latches is closed, the PL
BAY DOOR switch is set to STOP and the AC
and DC power sources are removed.

2.17-17

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Mechanical Systems Summary Data

Orbiter mechanical systems are those

components that must be deployed,
stowed, opened, or closed.
Each is
physically moved by an electrical or
hydraulic actuator.

The external tank umbilical doors shield

the two aft umbilical openings on the
underside of the orbiter. The doors are
closed post-OMS 1 burn after MPS vacuum
inerting.

All orbiter electromechanical actuators

contain two three-phase AC motors,
brakes, a differential, a gearbox, and limit
switches. With the exception of the ET
door centerline latches, all actuator
assemblies also contain torque limiters.

ET umbilical doors are controlled by the

flight crew with switches on panel R2 or
item entry on the GNC SPEC 51
OVERRIDE display.

The payload bay doors provide an opening

for payload deployment from and retrieval
into the payload bay.

Two doors, port and starboard, are

connected to the midfuselage. They are
held closed by groups of centerline and
bulkhead latches.

Payload
bay
doors
are
opened
approximately 1 hour 25 minutes into a
nominal flight and closed about 2 hours 45
minutes before the deorbit burn.

Payload bay doors displays and controls

are on panel R13L and the PL BAY DOORS
display.

Power for actuator motors and limit

switches is provided by motor control
assemblies that are controlled by panel
MA73C.
The active vent system equalizes the
unpressurized orbiter compartments and
controls the orbiters internal environment
by opening and closing vent doors in orbit
or on the ground.
The active vent system operates automatically, except for preentry when the crew
uses the GNC SPEC 51 OVERRIDE display
to open or close the vent doors.

2. SYSTEMS
2.17 Mechanical Systems

2.17-18

USA007587
Rev. A

Panel R2
2.17-19

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Panel R13L

2. SYSTEMS
2.17 Mechanical Systems

2.17-20

USA007587
Rev. A

BFS OVERRIDE Display (SPEC 51)

PASS OVERRIDE Display (SPEC 51)

PASS PL BAY DOORS Display

(BFS is identical except for Major Mode
notation at the top)

2.17-21

2. SYSTEMS
2.17 Mechanical Systems

USA007587
Rev. A

Mechanical Systems Rules of Thumb

Always use a timer when operating mechanical
systems, noting either dual or single motor time.
Do not continue to command driving if greater
than the single motor time has elapsed without
the mechanism reaching the desired state.

2. SYSTEMS
2.17 Mechanical Systems

2.17-22

USA007587
Rev. A

2.18

engine burns. Normally, OMS maneuvers are

done using both OMS engines together;
however, a burn can be performed using only
one OMS engines. For velocity changes less
than 6 fps, RCS is used. For velocity changes
greater than 6 fps, a single OMS engine burn is
preferred, because engine lifetime concerns
make it desirable to minimize engine starts.
Two OMS engines are used for large velocity
changes or for critical burns. Propellant from
one pod can be fed to the engine in the other
pod through crossfeed lines that connect the left
and right OMS pods.

ORBITAL MANEUVERING
SYSTEM (OMS)

CONTENTS
Description.............................................
Engines ...................................................
Helium System ......................................
Propellant Storage and Distribution...
Thermal Control ....................................
Thrust Vector Control (TVC)...............
Fault Detection and Identification ......
Operations..............................................
OMS Caution and Warning Summary
OMS Summary Data.............................
OMS Rules of Thumb ...........................

2.18-1
2.18-3
2.18-9
2.18-12
2.18-19
2.18-20
2.18-22
2.18-23
2.18-24
2.18-31
2.18-31

Description
The OMS provides propulsion for the orbiter
during the orbit phase of flight. The OMS is
used for orbit insertion, orbit circularization,
orbit transfer, rendezvous, and deorbit. It may
provide thrust above 70,000 feet altitude. Each
OMS pod can provide more than 1,000 pounds
of propellant to the RCS. Amounts available for
interconnect depend on loading and number of
OMS starts during the mission.
The OMS is housed in two independent pods on
each side of the orbiters aft fuselage. The pods,
which also house the aft reaction control system
(RCS), are referred to as the OMS/RCS pods.
Each pod contains one OMS engine and the
hardware needed to pressurize, store, and
distribute the propellants to perform OMS

The OMS has important interfaces with the data

processing system and the electrical power
system. The OMS valves and gimbal actuators
receive commands, and the system returns
some data to the GPCs through multiplexer/
demultiplexer units.
Electrical power is
supplied to the OMS through main buses,
control buses, and alternating current buses to
operate switches, valves, instrumentation,
gimbal actuators, and heaters.
The OMS/RCS pods are designed to be reused
for up to 100 missions with only minor repair,
refurbishment, and maintenance. The pods are
removable to facilitate orbiter turnaround,
if required.
NOTE
At one time, there were plans to provide
additional capability by including an OMS
kit. It is now unlikely that OMS kits will
ever be used, but OMS kit switches and
gauges appear throughout the orbiter.
They currently are inoperative and are
likely to remain so.

Orbital Maneuvering System

2.18-1

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

Maneuver Display
Executing item 22 (LOAD) causes guidance to
compute a burn solution on the basis of the target parameters that have been entered under
PEG 4 or PEG 7. Executing item 23 (TIMER)
sets up a timer that counts down to time of
ignition and is displayed on the second line at
the upper right corner of the display.

1041/
/
XXXXX MNVR YYYYY XX X DDD/HH:MM:SS
OMS BOTH 1X
BPS DDD/HH:MM:SS
L 2XS
BURN ATT
XXXX
R 3XS
24 R XXX
VTOT
XXXX.X
RCS SEL 4X
25 P XXX
TGO
XX:XX
5 TV ROLL XXX
26 Y XXX
TRIM LOAD
MNVR 27X XXXXX
VGO X XXXX.XX
6 P []X.X
TTG XX:XX
Y XXX.XX
7 LY[]X.X
REI XXXX
Z XXX.XX
8 RY[]X.X
TXX XX:XX
9 WT XXXXXX
GMBL
HA
HP
10 TIG
L
R
TGT XXX
XXX
XXX/XX:XX:XX.X P X.XS X.XS
CUR XXX
XXX
TGT PEG 4
Y X.XS X.XS
14 C1
XXXXX
15 C2 []X.XXXX PRI 28X 29X
35 ABORT TGT XX
16 HT
XXX.XXX SEC 30X 31X
17 T
XXX.XXX OFF 32X 33X
FWD RCS
18 PRPLT[]XXXXX
ARM
36X
TGT PEG 7
GMBL CK 34X
DUMP 37X
19 VX[]XXXX.X
OFF
38X
20 VY []XXX.X
XXXXXXX
SURF DRIVE
21 VZ []XXX.X
ON
39X
XXXX 22/TIMER 23
OFF
40X

Items 24 through 26 (BURN ATT) are the

desired inertial attitude for the OMS burn,
which guidance computes as part of the burn
solution. Executing item 27 (MNVR) causes an
automatic maneuver to this attitude.

usa007587_526r2.cvx

Items 1 through 4 (OMS BOTH, L, R, and RCS

SEL) are used to select both OMS engines, one
engine, or RCS jets for an OMS burn and are
mutually exclusive item entries. This information is used by guidance and the OMS software.
Item 5 (TV ROLL) is the roll attitude for OMS
burns. Normally, it is 180, corresponding to a
heads-down attitude. A different number can
be entered in MM 202 only, but is seldom
changed.
Items 6 through 8 (TRIM LOAD P, LY, RY) are
used to enter gimbal trim angles for OMS burns.
Item 9 (WT) is the current weight of the orbiter
in pounds, which is computed and used by
guidance. It can be changed when a more accurate weight is known.
Item 10 (TIG) is the time of ignition for an OMS
burn in days/hours:minutes:seconds of mission
elapsed time (MET). It is entered as part of a
burn target.
Target parameters for powered explicit guidance (TGT PEG 4) are entered with items 14 to
18. PEG 4 guidance puts the orbiter on course
for a specific point in space and is normally
used for OMS 1, OMS 2, and deorbit burns.
PEG 4 targets are only used in OPS 1 and 3.
Items 19 to 21 (TGT PEG 7) are where the target
parameters are entered for another type of
guidance, known as PEG 7 or External V
guidance. It is used to add or subtract orbital
velocity and does not target the vehicle for a
specific point in space. PEG 7 targets can be
used in OPS 1, 2, or 3. PEG 7 delta velocities are
in the LVLH coordinate frame.
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

The TTG field displays the time to attitude in

the current DAP. When in attitude the mm:ss
field will blank. If the in-attitude time is less
than TIG -30 seconds (and not in attitude),
mm:ss will be displayed over bright. The fields
next to the ITEM 27 display the current DAP
mode (AUTO, INRTL, LVLH or FREE).
The GMBL L, R items on the display are the
actual gimbal position angles. Items 28 through
33 (PRI, SEC, OFF) permit selection of primary
or secondary gimbal motors or turn off both
gimbal motors.
Executing item 34 (GMBL CK) starts an automatic gimbal check sequence.
The EXEC item flashes on the screen 15 seconds
before TIG; it remains there until the EXEC key
is depressed, which enables OMS burn ignition.
V TOT is the total change in velocity needed to
satisfy the target requirements. TGO is the
expected duration of the burn. Below that are
the X, Y, and Z components of V TOT. All of
this is computed by Guidance when a target is
loaded. These delta velocities are in the body
axis coordinate frame.
TGT HA and HP are the altitudes in nautical
miles (n. mi.) of the apogee and perigee for the
orbit that will result from the successful
completion of the targeted OMS burn. CUR HA
and HP are the current apogee and perigee
altitudes. Mileages are from the Earths surface.
Item 35 (ABORT TGT) permits entry of a stored
PEG 4 target for OMS 1 or OMS 2 with a single
keystroke. It is used primarily for calling up
ATO and AOA targets.

2.18-2

USA007587
Rev. A
Flight software is divided into operational
sequences (OPS) that are subdivided into major
modes (MMs).
Operational sequences and
major modes are discussed in detail in Section
2.6; however, it should be noted that OMS
burns can only be performed in MM 104, 105,
202, and 302. OMS dumps can be performed in
MM 102, 103, 304, 601, and 602.
The maneuver (MNVR) display appears
automatically in MM 104, 105, 106, 202, 301, 302,
and 303. The title has a prefix and a suffix that
vary according to major mode. The BFS version
of the display is identical to the primary
display.
Major mode
MM 104
105
106
202
301
302
303

Title

OMS 1 MNVR EXEC

OMS 2 MNVR EXEC
OMS 2 MNVR COAST
ORBIT MNVR EXEC
DEORB MNVR COAST
DEORB MNVR EXEC
DEORB MNVR COAST

Mission phse

OMS 1 burn
OMS 1 burn
Post-OMS 2 coast
Orbital maneuvers
Pre-deorbit coast
Deorbit burn
Pre-deorbit coast

Maneuver Display Titles Associated with

Major Mode

Engines
The OMS engines are designated left and right,
descriptive of location. The engines are located
in gimbal mounts that allow the engine to pivot
left and right (yaw) and up and down (pitch)
under the control of two electromechanical
actuators. This gimbal system provides for
vehicle steering during OMS burns by
controlling the direction of the engine thrust in
pitch and yaw (thrust vector control) in
response to commands from the digital
autopilot or from the manual controls.
The OMS engines can be used singularly by
directing the thrust vector through the orbiter
center of gravity or together by directing the
thrust vector of both engines parallel to the X
axis. During a two-OMS-engine burn, the RCS
will come into operation only if the attitude or
attitude rate limits are exceeded. However,
during a one-OMS-engine burn, RCS roll
control is required. Section 2.22 has more
information about the RCS and its interaction
with the OMS.
Each of the two OMS engines produces 6,087
pounds of thrust. For a typical orbiter weight,
both engines together create an acceleration of
approximately 2 ft/sec2 or 0.06 gs. Using up a

fully loaded tank, the OMS can provide a total

velocity change of approximately 1,000 ft/sec.
Orbital insertion burns and deorbit burns each
typically require a velocity change of about 100
500 ft/sec. The velocity change required for
orbital adjustment is approximately 2 ft/sec for
each nautical mile of altitude change.
Each OMS engine is capable of 1,000 starts and
15 hours of cumulative firing. The minimum
duration of an OMS engine firing is 2 seconds.
The OMS engines use monomethyl hydrazine
as the fuel and nitrogen tetroxide as the
oxidizer. These propellants are hypergolic,
which means that they ignite when they come
in contact with each other; therefore, no ignition
device is needed. Both propellants remain
liquid at the temperatures normally experienced
during a mission, however, electrical heaters are
located throughout the OMS pods to prevent
any freezing of propellants during long periods
in orbit when the system is not in use.
Each OMS engine has a gaseous nitrogen tank
that provides pressurized nitrogen to operate
the engine valves. The OMS engine does not
have propellant pumps; propellant flow to the
engines is maintained by pressurizing the
propellant tanks with helium.
In the OMS engine, fuel is burned with oxidizer
to produce thrust. The major elements of the
OMS engine are the bipropellant valve
assembly, the injector plate, the thrust chamber,
and the nozzle.
Bipropellant Valve Assembly
Each OMS engine receives pressure-fed
propellants at a bipropellant valve assembly,
which regulates the flow of propellants to the
engine to start and stop engine burns. The
valve assembly consists of two fuel valves in
series and two oxidizer valves in series. Having
two valves in series for each propellant
provides redundant protection against leakage,
but it also means that both valves must open to
allow propellant flow to the engine.
Each fuel valve is mechanically linked to an
oxidizer valve so that they open and close
together. The name bipropellant valve means
that each linked set of valves controls the flow
of both propellants.

2.18-3

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A
Fuel oxidizer
Fuel inlet
pressure sensor

Oxidizer inlet
pressure sensor

N2 pressure
to open

Valve 1
Valve 2

N2

Valve
% position
sensor

Bipropellant
valve assembly
(Valves open)

Spring to close
Fuel injector
temperature
sensor

T
Injector plate
Cooling jacket
P

Thrust
chamber

P sensor

Nozzle

661.cvs

Orbital Maneuvering System Engine

The bipropellant valves are ball valves that
rotate from fully closed (0 percent) to fully open
(100 percent). The crew can read the valve
position in percent for each set on the GNC SYS
SUMM 2 display. The VLV 1 and 2 position
indicators on the display should read
approximately 100 percent for both valve 1 and
valve 2 at the start of an OMS burn and remain
there throughout the burn. If the valve position
is less than 70 percent for either valve, there will
probably be insufficient propellant flow, and
ignition may not occur. Also, ignition may
occur with the possibility of engine hard start or
combustion instability resulting in structural
failure and/or chamber burnthrough.
The bipropellant valves are driven open and
closed by pneumatic pistons. There is one piston
for each set of bipropellant valves. The pistons
are normally held in the closed position by
springs. Pressurized nitrogen is used to fill the
piston, which then mechanically opens the
bipropellant valves. The engine control valves
regulate the flow of nitrogen to the pistons and
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

thereby control the opening and closing of the

bipropellant valves. The engine control valve is a
solenoid valve that responds to commands from
the GPCs. Both engine control valves must
operate in order for the bipropellant valves to
open.
The engine control valves are discussed in more
detail in the next section on the nitrogen system.
Injector Plate
After passing through the bipropellant valves,
the oxidizer line runs directly to the engine
injector plate. The fuel, however, is used to cool
the engine, and so it is routed through a cooling
jacket around the thrust chamber before it
reaches the injector plate. A temperature sensor
is located near the fuel inlet to the injector, and
the reading from this sensor can be viewed by
the crew in the FU INJ T entry on the BFS GNC
SYS SUMM 2 display. This parameter does not
appear on the PASS GNC SYS SUMM 2 display,
but can be found on SM SPEC 89 PRPLT
THERMAL in OPS 2.

2.18-4

USA007587
Rev. A

3011/

/ 019

GNC SYS SUMM 2

OMS AFT QTY

L
OXI D 28. 6
FU 28. 3
FU I NJ T
79

R
28. 6
28. 3
79
J ETI
RCS
OXI D FU FAI L
FWD HE P1464 1264
TK P 248 244
QTY
0
0
MANF 1 P 248 242
2 P 248 244
3 P 250 246
4 P 244 244
5
AFT HE P2800 2672
L
TK P 244 249
QTY 63
63
MANF 1 P 244 246
2 P 246 250
3 P 248 250
4 P 246 250
5

5 015/ 20 : 25: 34
BFS 000/ 00 : 26: 24
OMS
L
R
TK P
HE 2610 2680
OXI D 260
258
FU 267
258
SOL
N2 TK
P 2220 2220
VL V
REG P 319
319
P VL V
CL
CL
ENG I N
P
OXI D 257 258
FU 258 258
VLV 1 2 - 2
2
0
0
J ET I SOL
OXI D FU FAI L VL V
HE P 274426 16
R TK P 247 2 47
QTY 62
61
1 P 242 2 46
2 P 250 2 46
3 P 246 2 50
4 P 246 2 42
5

662

OMS Parameters on BFS GNC SYS SUMM 2 Display

OMS Parameters on SM SPEC 89 PRPLT THERMAL Display

Since the fuel injector temperature is the
temperature of the fuel after it has passed
through the chamber cooling jacket, it provides
an indirect indication of the temperature of the
thrust chamber walls. A high fuel injector
temperature indicates that the engine may be
sustaining thermal damage. The fuel normally
flows to the engine at a temperature between
30 and 125 F. During engine operation, when
the fuel is cooling the chamber, the fuel injector
temperature should be approximately 218 F.
The temperature limit for safe operation is 260 F.
Thrust Chamber
The fuel and oxidizer are mixed at the injector
plate in the thrust chamber. When the fuel
reaches the thrust chamber, it is directed
through 120 cooling channels in the combustion

chamber walls, providing regenerative cooling

to the combustion chamber walls, and then to
the injector of the engine. The oxidizer is routed
directly to the injector.
The fuel and oxidizer orifices are positioned so
that the propellants will impinge and atomize,
causing the fuel and oxidizer to ignite because
of hypergolic reaction. The resulting hot gas
creates thrust as it exits the chamber and
expands through the engine nozzle.
The
contoured nozzle extension is bolted to the aft
flange of the combustion chamber.
The pressure in the thrust chamber (Pc) is measured by a sensor that is wired directly to the
OMS Pc meter on the MEDS MPS/OMS display.
The meter is calibrated in percent. The normal
Pc during a burn is between 100 and 105

2.18-5

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A
percent, which corresponds to a pressure of
approximately 131 psia. For an off-scale high
condition, the MEDS OMS Pc meter will display
the maximum (160) value in the digital box in
red with an empty red box for the tape. For an
off-scale low condition, the minimum (0) value
will be displayed instead. For Analog Digital
Converter (ADC) failures, the display is
blanked with an empty red box. The LEFT or
RIGHT OMS red caution and warning light on
panel F7 will illuminate if Pc is less than 80
percent when the engine should be on, or
greater than 80 percent when the engine should
be off.

The inlet pressures are an indirect indication of

propellant flow rates. If they are abnormal,
problems should be anticipated. An imbalance
in the flow rates for fuel and oxidizer will result
in an incorrect mixture ratio in the thrust
chamber. If the mixture becomes fuel-rich, the
chamber pressure and temperature will
decrease, and combustion will eventually be
choked off. If the mixture becomes fuel-lean,
the chamber temperature will increase, and
engine damage could result. If the fuel-lean
condition is the result of a low fuel flow rate,
the situation is especially serious, since the fuel
is used to cool the outside of the thrust
chamber.
Nitrogen System
Gaseous nitrogen is used to operate the engine
control valves and also to purge the fuel lines at
the end of each burn. The nitrogen system consists of a storage tank, engine pressure isolation
valve, regulator, relief valve, check valve, accumulator, engine purge valves, bipropellant
solenoid control valves, and actuators that
control the bipropellant ball valves.
A spherical gaseous nitrogen storage tank is
mounted next to the combustion chamber in
each of the two engines to supply pressure to its
engine pressure isolation valve.
The tank
contains enough nitrogen to operate the ball
valves and purge the engine 10 times.

OMS Pc N2 and He TANK Meters on the

MEDS MPS/OMS Display
Pressure sensors in the fuel and oxidizer lines
are located just above the bipropellant valves.
These inlet pressures for each engine are shown
on the GNC SYS SUMM 2 display as ENG IN P,
one for oxidizer, one for fuel. When the OMS
engines are not burning, the inlet pressures
should match the propellant tank pressures,
which are normally 254 psi. During OMS
burns, propellant flow into the thrust chamber
causes the inlet pressure to drop to
approximately 220 to 235 psi for the fuel and to
200 to 206 psi for the oxidizer, but the
propellant tank pressures remain higher. The
exact inlet pressures are engine dependent.
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

Two sensors monitor each tanks pressure. One

sensor displays the tank pressure on the MEDS
MPS/OMS display. The other sensor displays
the tank pressure on the GNC SYS SUMM 2
display. Both pressures are downlisted by
telemetry.
A dual-coil, solenoid-operated nitrogen pressure isolation valve (sometimes called the engine pressure valve) is located in each gaseous
nitrogen system. The valve is energized open
and spring-loaded closed. It must be open for
nitrogen to reach the OMS engines. The valve
permits gaseous nitrogen flow from the tank to
the regulator, accumulator, bipropellant ball
valve control valves, and purge valves 1 and 2
when energized open and isolates the nitrogen
tank from the gaseous nitrogen supply system
when closed.

2.18-6

USA007587
Rev. A
The nitrogen pressure valves in each system are
controlled by the OMS ENG LEFT, RIGHT
switches on panel C3. Placing the switch in the
ARM/PRESS position opens the nitrogen
pressure valve. The switch is placed in the
ARM/PRESS position by the crew before each
OMS burn and is left in the OFF position at all
other times. When one of the OMS ENG
switches is placed in the ARM/PRESS position,
the respective OMS engine pods pressure
isolation valve is energized open. When the
switches are in any other position (ARM or
OFF), the valve remains closed.
The gaseous nitrogen engine pressure isolation
valve, when energized open, allows gaseous
nitrogen supply pressure to be directed into a
regulator, through a check valve and an in-line
accumulator, and to a pair of valves. The status of
the nitrogen pressure valve can be seen on the
GNC SYS SUMM 2 display: the P VLV parameter
reads OP for open and CL for closed. When the
position of the OMS ENG switch on panel C3 is
changed, the display should be checked to see
that the valve is in the proper position.

Pressure
P
sensor

Nitrogen
tank

P Pressure sensor
(CRT)

N2 press valve
Regulator
Relief valve
Fuel oxidizer
Check valve

Regulator pressure
P sensor

Accumulator
Control valve 1
Biopropella
valve
assembly
Control valve 2
Purge valve 2

Purge valve 1

Check
valve

665.cvs

Nitrogen System
A single-stage regulator is installed in each
gaseous nitrogen pneumatic control system
between the gaseous nitrogen engine pressure
isolation valve and the engine bipropellant
control valves. The regulator reduces nitrogen
pressure from its tank pressure, which can be as
high as 3,000 psig, to a desired working
pressure of 315 to 360 psig. A pressure sensor
downstream of the regulator monitors the
regulated pressure and transmits it to telemetry
and to the GNC SYS SUMM 2 display (REG P).
A pressure relief valve downstream of the
regulator limits the pressure to the engine
bipropellant control valves and actuators if a
regulator malfunctions. The relief valve opens
between 450 and 500 psig and reseats at 400
psig minimum.
The check valve located downstream of the
regulator will close if gaseous nitrogen pressure is
lost on the upstream side of the check valve and
will isolate the remaining gaseous nitrogen
pressure on the downstream side of the check
valve.
The 19-cubic-inch gaseous nitrogen (GN2)
accumulator downstream of the check valve
and upstream of the bipropellant control valves
provides enough pressure to operate the engine
bipropellant control valves at least one time
with the engine pressure isolation valve closed
(ARM position), or in the event of loss of
pressure on the upstream side of the check
valve. The accumulator is protected from
upstream leaks by the one-way check valve.
From the accumulator, the nitrogen flows to the
engine control valves where it can be used to
operate the bipropellant valve pistons.
Two solenoid-operated control valves on each
OMS engine allow nitrogen to control the
bipropellant control valve actuators and
bipropellant ball valves.
Control valve 1
controls the no. 1 actuator and the first set of
fuel and oxidizer ball valves. Control valve 2
controls the no. 2 actuator and the second set of
fuel and oxidizer ball valves, in series with the
no. 1 system. Each control valve contains two
solenoid coils, either of which, when energized,
opens the control valve.

2.18-7

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A
connecting arm is converted into rotary motion,
which drives two ball valves, one fuel and one
oxidizer, to the open position. Each pair of ball
valves opens simultaneously. Fuel and oxidizer
are then directed to the combustion chamber of
the engine, where the propellants atomize and
ignite upon contact.
When the computer commands thrust off, or
when an engines OMS ENG switch on panel C3
or the L or R OMS ENG VLV switch on panel
O14/O16 is positioned OFF, the solenoid
control valves are de-energized, removing GN2
pressure from the actuators. The GN2 pressure
in the actuators is vented overboard through the
solenoid control valve. The spring in the actuator forces the actuators piston to move in the
opposite direction, and the actuator drives the
fuel and oxidizer ball valves closed simultaneously. The series-redundant arrangement
of ball valves ensures engine burn is terminated.
OMS ENG Switches on Panel C3
The right OMS engine GN2 solenoid control
valves 1 and 2 are energized open by computer
commands if the OMS ENG RIGHT switch on
panel C3 is in the ARM or ARM/PRESS position
and the R OMS ENG VLV switch in the bottom
row on panel O16 is ON; the valves are deenergized normally when the thrust is
commanded off or if the OMS ENG RIGHT
switch on panel C3 is positioned to OFF. The
left OMS engine GN2 solenoid control valves 1
and 2 are controlled in the same manner, using
the OMS ENG LEFT switch on panel C3 and the
L OMS ENG VLV switch in the bottom row on
panel O14.

R OMS ENG VLV Switch on Panel O16

Check valves are installed in the vent port

outlet of each GN2 solenoid control valve on the
spring pressure side of each actuator to protect
the
seal
of
these
from
atmospheric
contamination.
Ball Valve Actuation
When the GN2 solenoid control valves are
energized open, pressure is directed into the
two actuators in each engine. The nitrogen acts
against the piston in each actuator, overcoming
the spring force on the opposite side of the
actuators. Each actuator has a rack-and-pinion
gear; the linear motion of the actuator
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-8

L OMS ENG VLV Switch on Panel O14

USA007587
Rev. A
OMS Purge
The nitrogen subsystem also purges the fuel
lines following OMS burns. After an OMS
burn, some fuel and oxidizer will be left in the
engine inlet lines and will be subject to cold
temperatures. The oxidizer does not present a
problem, but the fuel could freeze, especially in
the cooling jacket around the thrust chamber.
The frozen fuel will eventually sublimate. But
for the first 10 minutes or so following a burn, it
might be dangerous to start another burn, since
forcing more fuel into already frozen lines could
cause damage.
This situation is avoided by forcing nitrogen
through the fuel lines immediately after the
engine shuts down. This purge is part of the
automatic OMS burn sequence and takes about
2 seconds. When a burn ends, the control
valves close, and the purge valves open.
Nitrogen can then flow into the fuel line below
the bipropellant valves where it forces the
remaining fuel through the inlet lines and
cooling jacket and out through the engine.
Each engine has two gaseous nitrogen purge
valves in series. These valves are solenoidoperated open and spring-loaded closed. They
are normally energized open by the GPCs after
each burn unless the purge is inhibited by
having the OMS ENGINE switches on panel C3
in ARM. The two purge valves of an engine are
energized open 0.36 second after OMS engine
thrust has been commanded off. Opening the
purge valves permits gaseous nitrogen to flow
through the valves and check valve into the fuel
line downstream of the ball valves. It then
flows out through the combustion chamber and
engine injector to space for 2 seconds. This
purges the residual fuel from the combustion
chamber and injector of the engine, permitting
safe engine restart. The purge valves are then
de-energized and spring-loaded closed. When
the purge is completed, the gaseous nitrogen
tank pressure isolation valve is closed by
placing the respective OMS ENG switch on
panel C3 to OFF. The check valve downstream
of the purge valves prevents fuel from flowing
to the engine purge valves during engine burns.
The automatic software will perform the purge
only if the OMS ENG switch on panel C3 is in

the ARM/PRESS position; that is, when the

nitrogen pressure valve is open. For that
reason, the crew should leave both OMS ENG
switches in ARM/PRESS for at least 2 seconds
after an OMS burn so that the purge can be
completed. When the nitrogen pressure valve is
open, nitrogen for the purge is supplied by the
tank. If the valve were closed, the purge would
deplete the accumulator, and the OMS start
capability of the accumulator would be lost.
This is not normally a problem since the
accumulator can be repressurized. But if the
valve were closed because of an upstream leak,
it would be important to save the nitrogen in
the accumulator. The purge is not as important
as the need to preserve the engine restart
capability. With the OMS ENG switch in ARM
or OFF, the valve is closed, and the engine
purge is automatically inhibited.

Helium System
Each OMS pod helium pressurization system
consists of a high-pressure gaseous helium
storage tank, two helium pressure isolation
valves, two dual pressure regulator assemblies,
parallel vapor isolation valves on the regulated
helium pressure to the oxidizer tank only, dual
series-parallel check valve assemblies, and
pressure relief valves.
Helium Tanks
Oxidizer and fuel are supplied to each OMS
engine by separate sets of propellant tanks. The
OMS engine does not have fuel or oxidizer
pumps; propellant flow must be maintained by
keeping the tanks pressurized with helium. A
single helium tank provides pressurization to
both fuel and oxidizer tanks. One advantage to
having a single helium tank in each pod is that
it helps ensure that the two propellant tanks
remain at the same pressure and thus avoids
incorrect mixture ratios. The helium tanks
operating pressure range is 4,800 to 390 psia.
Two pressure sensors downstream of each
helium tank in each pod monitor the helium
source pressure.
One sensor displays the
pressure on the MEDS MPS/OMS display. The
reading from the other sensor appears on the
GNC SYS SUMM 2 display (OMS TK P HE).

2.18-9

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

Helium tank
Pressure sensor P

Helium press valves

A and B

P Pressure sensor (CRT)

Dual pressure regulators

Va por isolation
valves
Check va lves
Re lief va lves
Tank press ure sensors
(gage and CRT)

Oxidizer
tank

Fuel
tank

Tank isolation valves

P Oxidizer inlet
pressure sensor
( CRT )

P
Fuel inlet
pressure sensor
( CRT )

To biopropellant valves

To biopropellant valves

669.cvs

Propellant and Helium Supply

The valves are controlled by the LEFT and
RIGHT OMS He PRESS/VAPOR ISOL switches
on panel O8. The switches have manual OPEN
and CLOSE positions as well as a GPC position
that allows automatic control. These valves are
normally closed at all times except during OMS
burns. If the switches are in the GPC position,
the automatic OMS burn sequence opens the
helium pressure valves at the start of a burn and
closes them at the end of a burn.

NOTE
Below a certain propellant quantity, there
is enough residual helium pressure in the
propellant tank to effectively use all the
propellant in that tank. This quantity is
referred to as max blowdown. Max
blowdown for an OMS tank is
approximately 39 percent.
Helium Pressure Valves
Two helium pressure valves in each pod isolate
the helium tank from the propellant tanks. The
valves are in a parallel arrangement, and are
labeled A and B. This arrangement provides
redundant paths for the helium to reach the
propellant tanks. These valves are held closed by
springs and are opened by electrical solenoids.

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-10

NOTE
When manually opening the He
PRESS/VAPOR ISOL switches, delay 2
seconds between opening the A and B
valves. This will prevent a possible water
hammer effect due to a large and sudden
pressure change.

USA007587
Rev. A
Helium Pressure Regulators
Below each helium pressure valve is a pressure
regulator that reduces the helium source
pressure from its value in the tank, which can
be as high as 4,800 psi (at launch), to the desired
working pressure of approximately 250 psig.
Each pressure regulator assembly contains a
flow limiter and primary and secondary
regulators in series. Normally, the primary
regulator is the controlling regulator. Should
the primary regulator fail, the secondary one
will continue to provide pressure control.
The primary regulator pressure at normal flow
is 252 to 262 psig, while the secondary regulator
pressure at normal flow is 259 to 269 psig.

lines. The vapor isolation valves in the helium

pressurization line to the oxidizer tank prevent
oxidizer vapor from migrating upstream and
over into the fuel system, causing a hypergolic
reaction. The vapor isolation valves are lowpressure,
two-position,
solenoid-operated
valves that are energized open and springloaded closed. They can be commanded by the
positioning of the LEFT and RIGHT OMS He
PRESS/VAPOR ISOL switches on panel O8.
When either the A or B switch is in the OPEN
position, both vapor isolation valves are
energized open; when both switches are in the
CLOSE position, both vapor isolation valves are
closed. When the switches are in the GPC
position, the GPC opens and closes the valves
automatically.
Check Valves
The check valve assembly contains four
independent check valves connected in a seriesparallel configuration to provide a positive
checking action against a reverse flow of
propellant liquid or vapor. The parallel path
permits redundant paths of helium to the
propellant tanks, while the series arrangement
provides redundant backflow protection.
Filters are incorporated into the inlet of each
check valve assembly.
Relief Valves

OMS He PRESS/VAPOR ISOL Switches on

Panel O8
Vapor Isolation Valves
Over a long period of time, it is possible for
small amounts of propellant vapors to diffuse
through the check valves and into the helium

Below the check valves are the relief valves that

protect the propellant tanks from over pressurization. Each pressure relief valve contains a
burst diaphragm and filter. If excessive pressure is caused by helium or propellant vapor,
the diaphragm will rupture, and the relief valve
will open and vent the excessive pressure overboard. The filter prevents particulates from the
non-fragmentation-type
diaphragm
from
entering the relief valve seat. The relief valve
will close and reseat after the pressure has returned to the operating level.
The burst
diaphragm is used to provide a more positive
seal of helium and propellant vapors than the
relief valve. The diaphragm ruptures between
303 and 313 psig, while the relief valve opens at
286 psig and reseats at 280 psig.

2.18-11

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

Propellant Storage and Distribution

acquisition and retention assembly in the aft

end. This assembly consists of a mesh screen
dividing the fore and aft compartments and an
acquisition system. Surface tension created by
the screen retains propellant in the aft
compartment during zero-gravity conditions.

The OMS propellant storage and distribution

system consists of one fuel tank and one
oxidizer tank in each pod. It also contains
propellant feed lines, crossfeed lines, isolation
valves, and crossfeed valves.
The OMS
propellant in both pods enables the orbiter to
perform a 1,000-foot-per-second velocity change
with a 65,000-pound payload in the payload
bay. The OMS pod crossfeed lines allow the
propellants in the pods to be used to operate
either OMS engine.

The acquisition assembly consists of four stub

galleries and a collector manifold. The stub
galleries acquire wall-bound propellant at OMS
start and during RCS burns to prevent gas
ingestion. The stub galleries have screens that
allow propellant flow and prevent gas
ingestion. The collector manifold is connected
to the stub galleries and also contains a gas
arrestor screen to further prevent gas ingestion,
which permits OMS engine ignition without the
need of a propellant-settling maneuver
employing RCS engines. The propellant tanks
nominal operating pressure is 250 psi, with a
maximum operating pressure limit of 313 psia.

Fuel (monomethyl hydrazine) and oxidizer

(nitrogen tetroxide) are stored in domed
cylindrical titanium tanks within each pod. The
propellant tanks, which are pressurized by the
helium system, are divided into forward and aft
compartments. Each tank contains a propellant

Helium
Tank
P

P Helium tank pressure

Gaseous
nitrogen
(GN2) tank

GN2
relief
valve

Oxidizer
vapor
isolation
valves

Dual helium
pressure
regulators

GN2 engine pressure

isolation valve

GN2 regulator

GN2 check valve

P GN regulated pressure
2

Helium pressure
isolation valves

GN2
accumulator

Oxidizer
relief
valve

Series-parallel
check valves
Fuel
relief
valve
P Fuel tank
pressure

Oxidizer tank P
pressure

Oxidizer inlet
P pressure

Oxidizer total Q
Oxidizer
quanitity
tank
Oxidizer aft Q
quantity

Fuel inlet
pressure P

Fuel total
Q quantity
Q Fuel aft
quantity

Fuel
tank

Control valve 1
Biopropellant
valve
assembly
Control valve 2

Oxidizer
tank
isolation
valves

GN2 purge
valve 1

B
Fuel injector
temperature
T

Oxidizer
crossfeed
valves

GN2 check valve

To aft RCS
P
oxidizer
crossfeed
valves 1/2, 3/4/5
To OMS oxidizer
crossfeed
valves A, B

Chamber
P
pressure

OMS
engine

GN2 purge
valve 2

Fuel tank
isolation
valves

Fuel
crossfeed
valves
To aft
P
RCS fuel
crossfeed
valves 1/2, 3/4/5
To OMS fuel crossfeed
valves A, B
671.cv
A

Orbital Maneuvering System Pressurization and Propellant Feed System

for One Engine (other Engine Identical
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-12

USA007587
Rev. A
Each propellant tank has one pressure sensor
wired directly to the RCS/OMS/PRESS meters
on panel O3.
Selecting the OMS PRPLT
position of the rotary switch below the bank of
meters enables the crew to read fuel and
oxidizer tank pressures.
The same
measurement is also displayed on the GNC SYS
SUMM 2 display (TK P OXID, FU entries). If
the tank pressure is lower than 232 psia or
higher than 284 psia, the LEFT or RIGHT OMS
red caution and warning light on panel F7 will
be illuminated.

burn, which settles the propellant surface, the

probe capacitance gauging system outputs are
enabled, which permits the quantity of
propellant remaining to be displayed. The
totalizer outputs are displayed on the
RCS/OMS PRPLT QTY LEDs on panel O3
when the rotary switch below the LEDs is
positioned to the OMS FUEL or OXID position.
In addition, the GNC SYS SUMM 2 display has
a readout of the aft probe quantity (OMS AFT
QTY). Quantity gauging is updated when at
least one OMS engine is burning.

OMS Quantity Gauging

When the forward probe is dry (quantity

approximately 45 percent), the ungaugeable
propellant in the region of the intermediate
bulkhead is added to the aft probe output
quantity, decreasing the total quantity at a
preset rate for 108 seconds, and updates from
the aft probes are inhibited. After 108 seconds
of burning (quantity approximately 30 percent),
the aft probe output inhibit is removed, and the
aft probe updates the total quantity. When the
quantity decreases to 5 percent, the low-level
signal is output.

A capacitance gauging system in each OMS

propellant tank measures the propellant in the
tank. The system consists of a forward and aft
probe and a totalizer. The fluid in the area of
the communication screens cannot be measured
and is called the "ungaugeable region."
The totalizer receives OMS valve operation
information and inputs from the forward and
aft probes in each tank and outputs total and aft
quantities and a low level quantity. The inputs
from the OMS valves allow control logic in the
totalizer to determine when an OMS engine is
burning and which tanks are being used. The
totalizer begins an engine flow rate/time
integration process at the start of the OMS burn,
which reduces the indicated amount of
propellants by a preset estimated rate for the
first 14.8 seconds. After 14.8 seconds of OMS

2.18-13

NOTE
Erroneous temperature and/or pressure
transducer readings will cause erroneous
propellant quantity calculations.

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

RCS/OMS/PRESS Meters and PRPLT QTY LEDs on Panel O3

Helium
OMS/RCS quantity
gage

Forward compartment
Forward quantity
40%
30%

Totalizer

Forward quantity probe

Computation
Aft quantity

45%
Screen
Aft probe
measurement

Ungaugeable
region

Aft compartment

30%

Aft quantity probe

BFS GNC SYS SUMM 2
Acquisition screen

Propellant
673.cvs

Orbital Maneuvering System Quantity Gauging

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-14

USA007587
Rev. A
Tank Isolation Valves
Parallel tank isolation valves (A and B) are
located in each pod between the propellant
tanks and the OMS engine and the OMS
crossfeed valves and permit propellant to be
isolated from the rest of the downstream
systems. The valves are driven open and closed
by ac motors that normally use three-phase ac
power but can operate on two-phase power.

Crossfeed lines connect the left and right OMS

propellant lines at a point between the tank
isolation valves and the bipropellant valves.
Each crossfeed line has two crossfeed valves
arranged in parallel to provide redundant paths
for propellant flow. The LEFT and RIGHT OMS
CROSSFEED switches are on panel O8, and
each controls a pair of fuel and oxidizer valves
in the crossfeed lines.

The LEFT and RIGHT OMS TANK ISOLATION

A switches on panel O8 control the A fuel and A
oxidizer valve in that pod, and the B switches
control the B fuel and B oxidizer valve in that
pod. The switches have manual OPEN and
CLOSE positions and a GPC position that
enables automatic control of the valves. When
the LEFT or RIGHT OMS TANK ISOLATION
switches in a pod are positioned to GPC, valves
are automatically opened or closed upon
command from the orbiter computer. When a
pair of valves is opened, fuel and oxidizer from
the propellant tanks are allowed to flow to that
OMS engine and OMS crossfeed valves.
The switch positions OPEN, GPC, and CLOSE
are permanent-position switches.
Electrical
power is provided to an electrical motor
controller assembly, which supplies power to
the ac-motor-operated valve actuators. Once
the valve is in the commanded position, logic in
the motor controller assembly removes power
from the ac-motor-operated valve actuator. A
talkback indicator above each LEFT or RIGHT
OMS TANK ISOLATION switch on panel O8
indicates the status of the fuel valve and
oxidizer valve.
The talkback indicator is
controlled by microswitches in each pair of
valves. The talkback indicator indicates OP
when that pair of valves is open, barberpole
when the valves are in transit or one valve is
open or closed, and CL when that pair of valves
is closed.
Crossfeeds and Interconnects
An OMS engine in one pod may be fed with
propellant from the other pod. This is called an
OMS crossfeed and would be done to balance
the propellant weight in each pod or in
situations where an OMS engine or a propellant
tank had failed.

OMS TANK ISOLATION and CROSSFEED

Switches and Talkbacks
When a crossfeed is set up, the tank isolation
valves on the receiving side are closed. (The
OMS propellant tanks on each side should not
be directly connected in most cases.) The OMS
crossfeed valves are then opened for the feeding
and receiving side to establish a flow path from
the OMS propellant tanks on one side to the
engine on the other side.
OMS propellant can also be fed to the aft RCS
jets using OMS propellant from either OMS pod
in orbit.
This is called an OMS-to-RCS
interconnect, and it provides the capability to

2.18-15

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A
operate the aft RCS using OMS propellant for
orbital maneuvers.
The RCS has its own
crossfeed valves, similar to the OMS crossfeed
valves, that are used to connect the RCS
propellant lines to the crossfeed lines. The same
crossfeed lines are used for OMS crossfeeds,
RCS crossfeeds, and OMS-to-RCS interconnects.
When an OMS-to-RCS interconnect is set up,
the RCS tank isolation valves are closed with
AFT LEFT RCS and AFT RIGHT RCS TANK
ISOLATION switches on panel O7. The RCS
crossfeed valves are opened, and then one of
the OMS crossfeed valves (B crossfeed valve) is
opened. The OMS crossfeed valves on the nonfeeding side are kept closed. This sequence
prevents a direct connection between the OMS
and RCS tanks. Normally, an interconnect
involves one OMS pod feeding the RCS on both
sides. This type of interconnect is used during
orbit operations and is set up manually. The
most important use of an OMS-to-RCS
interconnect would be during an ascent abort,
when the interconnect setup is automatic.
In each pod, parallel left or right OMS crossfeed
valves are controlled by the LEFT and RIGHT
OMS CROSSFEED A, B switches on panel O8.

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

The A switch controls the A fuel and A oxidizer

ac-motor-operated valve actuators in the pod
selected, and the B switch controls the B fuel
and B oxidizer valve in the pod selected. When
the A or B switch in a pod is positioned to GPC,
the A or B pair of fuel and oxidizer valves is
automatically opened or closed upon command
from the orbiter computer.
For example, when the A or B pair of crossfeed
valves in the left pod is opened, fuel and
oxidizer from the left pod are routed to the
OMS crossfeed valves of the right pod; thus, a
pair of A or B crossfeed valves in the right pod
must be opened to permit the left pod fuel and
oxidizer to be directed to the right OMS pod
engine.
A talkback indicator above the crossfeed
switches on panel O8 indicates the status of the
selected pairs fuel and oxidizer valves. The
talkback indicator indicates OP when both
valves are open, barberpole when the valves are
in transit or one valve is open and one closed,
and CL when both valves are closed. The LEFT
and RIGHT OMS CROSSFEED A and B
switches on panel O8 permit manual control of
the corresponding pair of fuel and oxidizer
valves.

2.18-16

USA007587
Rev. A
Left OMS

Right OMS
Oxidizer tank

Oxidizer tank

OMS
engines
Fuel tank

Fuel tank

1/2
Left RCS

1/2

3/4/5

OMS crossfeed valves

1/2

3/4/5
RCS crossfeed
valves

3/4/5
1/2

Right RCS

3/4/5

Oxidizer tank

Oxidizer tank
RCS manifolds

Fuel tank

Fuel tank
RCS manifolds
Note: Tank isolation and manifold isolation valves are not shown in this diagram

675.cvs

Orbital Maneuvering System and Reaction Control System Crossfeed Valves

(OMS and RCS Tank Isolation Valves Not Shown)

RCS TANK ISOLATION Switches and Talkbacks on Panel O7

2.18-17

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A
The LEFT and RIGHT OMS CROSSFEED A and
B switches also provide the capability to supply
OMS propellants to the left and right aft RCS
engines. The left and right aft RCS will not be
used to supply propellants to the OMS because
the RCS tanks cannot support the flow rate
required by the OMS engines.

4.

Check that the LEFT OMS TANK

ISOLATION A and B valves (panel
O8) are open, and verify that the
talkback indicators show OP.

5.

Check the RIGHT OMS CROSSFEED

A and B valves on panel O8 and verify
that the indicators show CL.

The OMS crossfeed fuel and oxidizer line

pressures are monitored on telemetry and are
transmitted to the RCS SPEC 23 display.

6.

Open the LEFT OMS CROSSFEED B

valve on panel O8 and verify the
talkback indicator shows OP. Check
the A valve is closed and verify the
indicator shows CL.

7.

The left OMS-to-aft RCS interconnect

quantity gauging can then be initiated
by entering OMS PRESS ENA item
entry (ITEM #5) on the RCS SPEC 23
display. The crew can then select the
desired DAP.

In summary, to perform an OMS to RCS

interconnect on orbit, the flight crew must first
select FREE on the ORBITAL DAP controls on
panel C3, then configure the following switches
(using a feed from the left OMS as an example):
1.

Position the aft AFT LEFT RCS TANK

ISOLATION 1/2, 3/4/5A and 3/4/5B
and AFT RIGHT RCS TANK
ISOLATION 1/2, 3/4/5A and 3/4/5B
switches on panel O7 to CLOSE.

2.

Check that the talkback indicator

above these switches indicates CL,
and position the AFT LEFT RCS
CROSSFEED 1/2, 3/4/5 and AFT
RIGHT RCS CROSSFEED 1/2, 3/4/5
switches to OPEN. The crew can then
check for a propellant leak in the
crossfeed lines.

3.

Check that the left OMS He

PRESS/VAPOR ISOL VALVE A and B
switches on panel O8 are in the CL
position.

There
is
software
that
automatically
repressurizes the left OMS propellant tanks. If
the LEFT OMS He PRESS/VAPOR ISOL VALVE
A switch is in GPC and the OMS PRESS ENA
item entry (item no. 48) is done on RCS SPEC 23,
the left OMS helium pressure vapor isolation
valve A is commanded open when the left OMS
tank (ullage) pressure drops to 236 psig, and the
open commands are terminated 30 seconds later.
If the left OMS tank (ullage) pressure remains
below 236 psia, the sequence sest an OMS/RCS
valve miscompare flag and sets a Class 3 alert
and DPS fault message. This feature is not used
nominally because it would feed any OMS or
RCS leaks.

RCS CROSSFEED Switches and Talkbacks on Panel O7

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-18

USA007587
Rev. A
Valve Actuators

usa007587_678r1.cvx

RCS Display (GNC SPEC 23)

The flight crew can terminate the sequence and
inhibit the OMS-to-RCS gauging sequence by
use of the L/R OMS OFF item entry (item no.
7) on the RCS display. The valves can then be
reconfigured to their normal positions on panels
O7 and O8. The OMS-to-aft-RCS interconnect
gauging sequence is not available in the backup
flight control software, or in OPS 1 or 3.
The OMS-to-aft-RCS propellant quantities are
calculated by burn time integration. Once each
cycle, the accumulated aft RCS jet cycles are
used to compute the OMS propellant used since
the initiation of gauging. The number of RCS
jet cycles is provided by the RCS command
subsystem operating program to account for
minimum-impulse firing of the RCS jets. The
gauging sequence is initiated by L/R OMS
AFT item entry of the OMS left (item 5) or
OMS right (item 6) interconnect on the RCS SPEC
23 display and is terminated by the return to
normal item entry (L/R OMS OFF, item 7).
The gauging sequence maintains a cumulative
total of left and right OMS propellant used
during OMS-to-aft-RCS interconnects and displays the cumulative totals as a percentage of
left and right OMS propellant on the RCS display (OMSRCS QTY). The flight crew may
manually update the OMS(RCS quantity by
entering item 49 for the Left OMS or item 50 for
the Right OMS interconnect quantity.

There are 64 ac-motor-operated valve actuators

in the OMS/RCS nitrogen tetroxide and
monomethyl hydrazine propellant systems. An
electrical microswitch in each of the ac-motoroperated valve actuators signals the respective
valves position (open or closed) to the onboard
flight crew displays and controls as well as
telemetry. An extensive improvement program
was implemented to reduce the probability of
particulates
in
the
electrical
floating
microswitch portion of each ac-motor-operated
valve actuator. Particulates could affect the
operation of the microswitch in each valve and,
thus, the position indication of the valves to the
onboard displays and controls and telemetry.

Thermal Control
OMS thermal control is achieved by the use of
strip heaters and insulation on the interior
surface of the pods that enclose the OMS
hardware components. Wraparound heaters
and insulation condition the crossfeed lines.
The heaters prevent propellant from freezing in
the tank and lines. The OMS heaters are
divided into three segments: left pod, right
pod, and crossfeed lines.

SM SPEC 89 PRPLT THERMAL Display

Each OMS/RCS pod is divided into eight heater
areas. Each of the heater areas in the pods
contains an A and B element, and each element
has a thermostat that controls the temperature
from 55 to 75 F. These heater elements are
controlled by the RCS/OMS HEATERS LEFT
POD and RIGHT POD A AUTO and B AUTO

2.18-19

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

USA0075 87_1 090

RCS/OMS HEATERS Switches on Panel A14

switches on panel A14.
Sensors located
throughout the pods supply temperature
information to the SPEC 89 PRPLT THERMAL
display (items listed under POD) and telemetry.
The crossfeed line thermal control in the aft
fuselage is divided into 11 heater areas. Each
area is heated in parallel by heater systems A
and B, and each area has a control thermostat to
maintain temperature at 55 F minimum to 75
F maximum. Each circuit also has an overtemperature thermostat to protect against a
failed-on heater. These heater elements are
controlled by the RCS/OMS HEATERS OMS
CRSFD LINES A AUTO and B AUTO switches
on panel A14. Temperature sensors near the
control thermostats on the crossfeed lines
supply temperature information on the SM
SPEC 89 PRPLT THERMAL display (OMS
CRSFD items) and telemetry.

Thrust Vector Control (TVC)

The OMS engines are attached to the orbiter in
gimbal mounts that allow the engines to pivot
up and down and from side to side. The OMS
TVC system consists of a gimbal ring assembly,
two gimbal actuator assemblies, and two gimbal
actuator controllers. The engine gimbal ring
assembly and gimbal actuator assemblies
provide OMS TVC by gimbaling the engines in
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

pitch and yaw. Each engine has a pitch actuator

and a yaw actuator. Each actuator is extended
or retracted by one of a pair of dual-redundant
electric motors and is actuated by generalpurpose computer control signals.
The gimbal ring assembly contains two mounting pads to attach the engine to the gimbal ring
and two pads to attach the gimbal ring to the
orbiter. The ring transmits engine thrust to the
pod and orbiter.
The pitch and yaw gimbal actuator assembly for
each OMS engine provides the force to gimbal
the engines. Each actuator contains a primary
and secondary motor and drive gears. The primary and secondary drive systems are isolated
and are not operated concurrently. Each actuator consists of two redundant brushless dc
motors and gear trains, a single jackscrew and
nut-tube assembly, and redundant linear position feedback transducers. A GPC position
command signal from the primary electronic
controller energizes the primary dc motor,
which is coupled with a reduction gear and a
no-back device.
The output from the primary power train drives
the jackscrew of the drive assembly, causing the
nut-tube to translate (with the secondary power
train at idle), which causes angular engine

2.18-20

USA007587
Rev. A
movement. If the primary power train is
inoperative, a GPC position command from the
secondary electronic controller energizes the
secondary dc motor, providing linear travel by
applying torque to the nut-tube through the
spline that extends along the nut-tube for the
stroke length of the unit. Rotation of the nuttube about the stationary jackscrew causes the
nut-tube to move along the screw. A no-back
device in each drive system prevents
backdriving of the standby system.
The electrical interface, power, and electronic
control elements for active and standby control
channels are assembled in separate enclosures
designated the active actuator controller and
standby actuator controller. These are mounted
on the OMS/RCS pod structure. The active and
standby actuator controllers are electrically and
mechanically interchangeable.
The gimbal assembly provides control angles of
(6 in pitch, and (7 in yaw with clearance
provided for an additional 1 (for snubbing and
tolerances.
The thrust vector control command subsystem
operating program (SOP) processes and outputs
pitch and yaw OMS engine actuator commands
and the actuator power selection discretes. The
OMS TVC command SOP is active during the
following operational sequences: orbit insertion
(OMS-1 and OMS-2), orbit coast, deorbit, deorbit coast, and return-to-launch-site abort (major
modes 104, 105, 201, 301, 302, 303, and 601).

thrust vector through the center of gravity. The

major mode RTLS flag by itself will cause the
engines to be commanded to a stowed position
for return-to-launch-site entry.
The gimbal check flag causes the engines to be
commanded to plus 7 yaw and 6 pitch, then to
minus 7 yaw and 6 pitch, and back to zero
yaw and pitch. In the absence of these flags, the
TVC command SOP will output the digital
autopilot gimbal actuator commands to the
engine actuators. The backup flight control
system allows only manual TVC during a burn,
but it is otherwise similar.
The OMS TVC feedback SOP monitors the
primary and secondary actuator selection
discretes from the MNVR display and performs
compensation on the selected pitch and yaw
actuator feedback data. These data are output
to the OMS actuator fault detection and
identification and to the MNVR display. The
OMS TVC feedback SOP is active during orbit
insertion (OMS-1 and OMS-2), orbit coast,
deorbit maneuver, and deorbit maneuver coast.
The present OMS gimbal positions can be
monitored on the MNVR display when this SOP
is active, and the primary or secondary actuator
motors are selected.
Left OMS engine

Right OMS engine

Yaw actuator

Yaw actuator

The flight crew can select either the primary or

secondary motors of the pitch and yaw actuators by item entry (PRI 28,29 and SEC 30,31 on
the MNVR display), or they can turn the actuator motors off. The actuator command outputs
are selected by the TVC command SOP,
depending on the flag that is present; i.e., major
modes, deorbit maneuver, orbit coast, RTLS
abort, center-of-gravity trim, and gimbal check.
The deorbit maneuver coast flag causes the TVC
command SOP to output I-loaded values to
command the engines to the entry stowed
position.
The presence of the RTLS abort and center-ofgravity trim flags causes the engines to be
commanded to a predefined position with the
2.18-21

Pitch actuator

Pitch actuator

Yaw actuator

Pitch actuator

Gimbal ring
(pivot points)

OMS engine

681.cvs

Orbital Maneuvering System Gimbal

Actuators

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

Fault Detection and Identification

OMS Engine
The OMS engine fault detection function detects
and identifies off-nominal performance of the
OMS engine, such as off-failures during OMS
burns, on-failures after or before a burn, and
high or low engine chamber pressures.
Redundancy management software performs
OMS engine fault detection and identification.
It is assumed that the flight crew arms only the
OMS engine to be used; the OMS engine not
armed cannot be used for burns.
Fault
detection is initialized at solid rocket booster
ignition and terminated after the OMS-1 burn
or, in the case of an RTLS abort, at the transition
from RTLS entry to the RTLS landing sequence
program. Fault detection also is initiated 15
seconds before each OMS burn and terminated
after the OMS burn is complete.
The PASS OMS engine fault detection uses both
a velocity comparison and a chamber pressure
comparison method to determine a failed-on or
failed-off engine. The velocity comparison is
used only after MECO since the OMS thrust is
small compared to MPS thrust before MECO.
The BFS OMS engine fault detection uses only a
chamber pressure comparison method.
The measured velocity increment is compared
to a predetermined one-engine and two-engine
acceleration threshold value by the redundancy
management software to determine the number
of engines actually firing. This information,
along with the assumption that an armed
engine is to be used, allows the software to
determine if the engine has low thrust or has
shut down prematurely.
The chamber pressure comparison test
compares a predetermined threshold chamber
pressure level to the measured chamber
pressure to determine a failed engine (on, off, or
low thrust).
The engine-on command and the chamber
pressure are used before MECO to determine a
failed engine. The velocity indication and the
chamber pressure indication are used after
MECO to determine a failed engine. If the
engine fails the chamber pressure test but
2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

passes the velocity test after MECO, the

chamber pressure transducer will be considered
failed. Such a failure would illuminate the red
RIGHT OMS or LEFT OMS caution and
warning light on panel F7, sound the master
alarm, and produce a fault message, but the
engine is still burning. If an engine fails the
chamber pressure and velocity tests, the engine
is considered failed, and a down arrow next to
the failed engine appears on the MNVR display,
in addition to illumination of the light on F7
and master alarm.
When the flight crew disarms a failed engine by
turning the appropriate ARM/PRESS switch on
panel C3 to OFF, a signal is sent to the OMS
burn sequence to shut down the engine and to
signal guidance to reconfigure.
Guidance
reconfigures and downmodes from two OMS
engines, to one OMS engine, to four plus
X RCS jets.
OMS Gimbal Fault Detection
The OMS gimbal actuator fault detection
indicator detects and identifies off-nominal
performance of the pitch and yaw gimbal
actuators of the OMS engines.
The OMS gimbal actuator fault detection is
divided into two processes.
The first
determines if the actuators should move from
their present position. If the actuators must
move, the second part determines how much
they should move and whether the desired
movement has occurred.
The first part checks the actuators gimbal
deflection error (the difference between the
commanded new position and the actuators
last known position) and determines whether
the actuators should extend or retract or if they
are being driven against a stop. If the actuators
are in the desired position or being driven
against a stop, the first part of the process will
be repeated. If the first part determines that the
actuator should move, the second part of the
process is performed.
The second part of the actuator fault detection
process checks the present position of each
actuator against its last known position to
determine whether the actuators have moved

2.18-22

USA007587
Rev. A
more than a threshold amount. If the actuators
have not moved more than this amount, an
actuator failure is incremented by one. Each
time an actuator fails this test, the failure is
again incremented by one. When the actuator
failure counter reaches an I-loaded value of
four, the actuator is declared failed, and a fault
message is output. The actuator failure counter
is reset to zero any time the actuator passes the
threshold test.
The first and second parts of the process
continue to perform in this manner. The
process can detect full-off gimbal failures and
full-on failures indirectly. The full-on failure
determines that the gimbal has extended or
retracted too far and commands reverse motion.
If no motion occurs, the actuator will be
declared failed. The flight crews response to a
failed actuator is to select the secondary
actuator electronics by item entry on the MNVR
display. Gimbal failure on the left or right OMS
will illuminate the red OMS TVC caution and
warning light on panel F7.

Operations
The OMS burn sequence commands the OMS
engines on or off and commands the engine
purge function. The flight crew can select, via
item entry on the MNVR display, a one or twoengine burn.
The sequence determines which engines are
selected and then provides the necessary
computer commands to open the appropriate
helium vapor isolation valves and the engine
gaseous nitrogen solenoid control valves and
sets an engine-on indicator. The sequence will
monitor the OMS engine fail flags and, if one or
both engines have failed, issue the appropriate
OMS shutdown commands as soon as the crew
has confirmed the failure by placing the OMS
ENG switch on panel C3 in the OFF position.
This will then terminate the appropriate
engines control valve commands.

to the helium pressurization/vapor isolation

valves, and two gaseous nitrogen engine control
valves. If the engine purge sequence is not
inhibited, the sequence will check for the left
and right engine ARM/PRESS signals, and
open the engine gaseous nitrogen purge valves
for two seconds for the engines that have the
ARM/PRESS signals present.
The ascent profile for a mission uses a single
OMS burn, and is referred to as direct insertion.
In a direct-insertion ascent profile, the OMS-1
burn after main engine cutoff is normally not
required unless there is an underspeed. The
OMS-2 burn is then used to achieve orbit
circularization.
The direct-insertion ascent
profile allows the main propulsion system to
provide more energy for orbit insertion.
Additional OMS burns using one or both OMS
engines are performed on orbit according to the
missions requirements to modify the orbit for
rendezvous, payload deployment, or transfer to
another orbit.
The two OMS engines are used to deorbit.
Target data for the deorbit maneuver are
computed by the ground and loaded in the
onboard GPCs via uplink. These data are also
voiced to the flight crew for verification of
loaded values. After verification of the deorbit
data, the flight crew initiates an OMS gimbal
test on the DPS keyboard unit.
Before the deorbit burn, the flight crew
maneuvers the spacecraft to the desired deorbit
burn attitude manually using the rotational
hand controller, or automatically with an item
entry on the MNVR display. Upon completion
of the OMS burn, the RCS is used to null any
residual velocities, if required.
The aft RCS plus X jets can be used to complete
any planned OMS burn in the event of an OMS
engine failure. In this case, the OMS-to-RCS
interconnect would feed OMS propellants to the
aft RCS.

In a normal OMS burn, when the OMS cutoff

flag is true, the sequence terminates commands

2.18-23

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

OMS Caution and Warning Summary

There are class 2 and class 3 alerts for the
OMS.
Class 2 alerts can occur in all OPS and
generate a MASTER ALARM light and tone
and a light on the caution and warning
matrix on panel F7.
A class 3 alert is generated by the primary
GNC or SM software in OPS 2 and 8 or by
the BFS software in other OPS. Class 3 alerts
include an SM ALERT light and tone and a
fault message.
The red LEFT OMS and RIGHT OMS lights
on panel F7 will illuminate under the
following conditions:
Left or right OMS oxidizer tank
pressure is less than 232 or greater than
288 psi.
Left or right OMS fuel tank pressure is
less than 232 or greater than 288 psi.
Left or right OMS engine Pc is less than
80 percent when the engine should be
on or greater than 80 percent when the
engine should be off.

An L (R) OMS GMBL fault message will be

displayed when there is a 2 difference
between command and feedback position for
an OMS gimbal actuator.
An L (R) OMS PC fault message will be
displayed when OMS engine Pc is less than
80 percent.
An L (R) OMS QTY fault message will be
displayed when OMS propellant tank
quantity is less than 5 percent.
An L (R) OMS TK P fault message will be
displayed when OMS oxidizer or fuel tank
pressure is below 234 or above 288 psi; when
OMS helium tank pressure is below 1,500 psi;
OMS N2 tank pressure is below 1,200 psi; or
OMS N2 regulator pressure is above 434 or
below 299 psi.
An L (R) OMS VLV fault message will be
displayed when OMS helium pressure valve
and vapor isolation valve positions do not
agree.
An L (R) OMS TEMP fault message will be
displayed when OMS engine fuel injector
temperature is above 260 F.

The red OMS TVC light will illuminate when

there is gimbal failure on the left or right
OMS.

O2 PRESS

H2 PRESS

FUEL CELL
REAC

FUEL CELL
STACK TEMP

FUEL CELL
PUMP

(R)

CABIN ATM
(R)

FREON
LOOP

O2 HEATER
TEMP

MAIN BUS
UNDERVOLT

AC
VOLTAGE

AC
OVERLOAD

AV BAY/
CABIN AIR

IMU

FWD RCS

RCS JET

(R)

H2O LOOP

RGA/ACCEL

AIR DATA

LEFT RCS

RIGHT RCS

RIGHT/AFT
RHC

LEFT OMS

RIGHT OMS

GPC

FCS (R)
SATURATION

OMS KIT

PRIMARY C/W

FCS
CHANNEL

MPS

APU
OVERSPEED

APU
UNDERSPEED

(R)

LEFT RHC
(R)

PAYLOAD
WARNING (R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM (R)

APU
TEMP

(R)
(R)

OMS TVC (R)

(R)

HYD PRESS

OMS Caution and Warning Lights on Panel F7

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-24

USA007587
Rev. A
OMS

He TK P

He TK P

OMS/MPS
BFS, GNC SYS SUMM 2

He press isol vlv

Dual he press regs

Vapor
isol
vlvs

GN2 TK P

Quad
chk
vlvs

OMS/MPS

GN2
TK P

Quad
chk
vlvs

BFS, GNC SYS SUMM 2

Eng P
vlv

Rlf
vlv
Oxid
TK P

RLF
vlv
P

GN2
reg

FU
TK P

P
RLF
vlv
Q

Tot qty meter

oxid aft qty

FU
TK

OXID
TK
GN2 P
reg

BFS, GNC SYS SUMM 2

BFS, GNC SYS SUMM 2

GN2
accum

Oxid tk
isol
valvs

Oxid
eng
P in P

Oxid
xfeed
vlvs

FU tk
isol
vlvs

FU eng
in P

FU
xfeed
vlvs

Purge
vlvs

Ball
vlv
assy

Oxid
RCS
xfeed

Q FU P
tot qty meter
fu aft qty

FU
rcs
xfeed

Chk
vlv
Oxid
OMS
xfeed

FU
oms
xfeed

FU inj T
T

OMS
eng

A PC

683.CVS

Orbital Maneuvering System

2.18-25

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

Panel O3
Panel O3

USA007587
Rev. A

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-26

USA007587
Rev. A

Panel O7
2.18-27

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

Panel O8

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-28

USA007587
Rev. A
0

143

287

431

575

OMS
L
XXXX

11

719

863

1007

MPS
R
XXXX

PNEU
XXXX

C/1
XXXX

L/2
XXXX

R/3
XXXX

143

1151

He
TK
P

10

He
TANK
P

TANK
P

287

XXXX
XXXX

XXXX

XXXX

XXXX

XXXX

3
431

N2
TK
P

He
REG A
P

REG
P

14
575

C/1
L

XXXX

XXXX

ENG MANF
LO2
LH2
XXXX
XXXX

L/2

XXXX

XXXX

R/3

13

XXXX

12

719

P
S
I
A

Pc
%

863

16

15

Pc
%

17

Pc
%

18

19

L O M S He T K PRE SS m eter

L ENG H e T K PRESS m eter

15 LO2 E NG MANF PRESS m eter

R O M S He T K P RE SS m eter

C E NG He T K PRE SS m eter

16 LH2 E NG M ANF P RE SS m eter

L O M S N2 T K PRE SS m eter

10 R E NG He T K PRE SS m eter

17 L E NG Pc m eter

R O M S N2 TK P RES S m eter

11 PNE U He R EG PRES S m eter

18 C E NG Pc m eter

L O M S Pc m eter

12 L ENG H e R EG P RESS m eter

19 R E NG Pc m eter

R O M S Pc m eter

13

C E NG H e R EG PRES S m eter

PNEU He T K PRESS m eter

14

R E NG H e R EG PRES S m eter
1078 CV5

OMS/MPS Display

2.18-29

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

usa007587_678r1.cvx

MNVR Display

SPEC 23 RCS Display

GNC SYS SUMM 2 Display

SM SPEC 89 PRPLT THERMAL Display

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-30

USA007587
Rev. A

OMS Summary Data

OMS Rules of Thumb

The OMS provides propulsion for orbit

insertion, orbit circularization, orbit transfer,
rendezvous, and deorbit.

1 percent of OMS propellant

The OMS engines are collocated with the aft

RCS in two independent OMS/RCS pods on
each side of the orbiters aft fuselage. Each
engine produces 6,087 pounds of thrust and
specific impulse of 313 seconds.
The OMS engines use monomethyl
hydrazine as fuel and nitrogen tetroxide as
oxidizer. The propellants are hypergolic.
Gaseous pressurized nitrogen operates the
OMS engine valves and is also used to purge
the fuel lines at the end of each burn.
Propellant flow to the engines is maintained
by a helium pressurization system.
Each OMS/RCS pod contains one OMS fuel
tank and one OMS oxidizer tank. Crossfeed
lines allow propellants to be used to operate
either engine. OMS propellant can also be
fed to aft RCS jets using OMS propellant
from either or both pods.
OMS engines are attached to the orbiter in
gimbal mounts that allow the engines to
pivot up and down and from side to side (6
pitch, 7 yaw).
Switches that the crew uses to operate the
OMS are located on panels C3, O14, O16, O7,
O8, and A14. Panels that display OMS
parameters are F7 and O3.
The MNVR display is used by the crew to
enter burn targeting parameters.
Other
displays on which OMS data appear are
GNC SYS SUMM 2, SPEC 23 RCS, and SM
SPEC 89 PRPLT THERMAL

= 6 fps
= 3 n. mi.
130 lb (80 lb oxidizer, 50 lb fuel) uses
400 psi of helium for long burns.
One OMS engine causes approximately 1 fps2
acceleration.
For OMS ignition, there must be power and
command to at least one coil on both control
valves.
OMS TVC requires an enable discrete from
the FF MDM, and commands from the FA
MDM.
FUEL INJECTOR TEMP message may be a
signature of a bad temperature transducer or
a fuel blockage.
CHAMBER PRESSURE message may be a
signature of a bad pressure transducer or an
oxidizer blockage.
There are several failures that inop OMS FDI
(FA MDM commfault or Pc transducer
failing high during the burn).
Always check redundant sources to confirm
any malfunction.
Max
blowdown
on
approximately 39 percent.

the

OMS

is

1,000 lbs of OMS (approximately 8 percent)

moves the X c.g. 1.5 inches aft and the Y c.g.
0.5 inches left or right.
Max OMS quantity for landing = 22 percent/
side.

2.18-31

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.18 Orbital Maneuvering System (OMS)

2.18-32

USA007587
Rev. A

2.19

ORBITER DOCKING SYSTEM

CONTENTS
Description.............................................
External Airlock.....................................
Truss Assembly .....................................
Androgynous Peripheral Docking
System ..........................................
APDS Avionics Overview....................
APDS Operational Sequences
(OPS) ............................................
Operational Notes of Interest ..............

2.19-1
2.19-2
2.19-2

Description
The orbiter docking system (ODS) will be used
to dock the shuttle to the International Space
Station (ISS).
The ODS has three major
components:
External airlock

2.19-2
2.19-2
2.19-6
2.19-8

Truss assembly
Androgynous
System

Peripheral

Docking

The ODS is located in the payload bay aft of the

576 bulkhead, behind the tunnel adapter.

Orbiter Docking System View Looking Aft

2.19-1

2. SYSTEMS
2.19 Orbiter Docking System

USA007587
Rev. A

ODS Configuration in the Payload Bay on STS-117

External Airlock
The external airlock provides an airtight, internal
tunnel between the two spacecraft after docking.

Truss Assembly
The truss assembly provides a sound structural
base within which the components of the docking system are housed. The truss assembly is
physically attached to the payload bay and
houses rendezvous and docking aids, such as
camera/light assemblies and trajectory control
systems.

control panels in the aft flight deck and nine

avionics boxes in the subfloor of the external
airlock provide power and logic control of the
mechanical components.
The docking
mechanism on the rendezvousing spacecraft
(orbiter) is intended to be active, while the
corresponding mechanism on the target
spacecraft (ISS) is typically passive.

4.3"
15.7"

Androgynous Peripheral Docking System

The Androgynous Peripheral Docking System
(APDS), manufactured by RSC-Energia in
Kaliningrad, Russia, is designed to achieve the
capture, dynamic attenuation, alignment, and
hard docking of spacecraft by using essentially
identical docking mechanisms attached to each
vehicle. The primary components of each
docking mechanism are a structural base ring
housing 12 pairs of structural hooks (1 active, 1
passive per pair), an extendable guide (active)
ring with 3 petals, a motor-driven capture latch
within each guide petal, 3 ball screw/nut
mechanism pairs connected via a common
linkage, 6 electromagnetic brakes (dampers),
and 5 fixer mechanisms (that allow for only
z-axis movement of the active ring). Two
2. SYSTEMS
2.19 Orbiter Docking System

Extendable Guide Ring Positions

APDS Avionics Overview

Aft Flight Deck Panels
The docking system power panel (A6L) is a
Rockwell-built panel that provides power for

2.19-2

USA007587
Rev. A
the various components of the ODS. This panel
includes circuit breaker (cb) protection for all
the ODS-related bus sources, as well as switches
for application of logic and drive power to the
APDS control panel, the APDS avionics boxes,
the docking lights, and the vestibule depress
valves.

begins a chain reaction of relay operations. The

result is that several latching relays are set,
providing the circuit flow paths for logic and
drive power to be distributed to the other avionics
boxes.

The APDS control panel (A7L) is supplied by

RSC-Energia and is used to control the docking
mechanism operation. On the left of the panel
are nine circuit breakers (cbs) that are operated
as switches. The three control panel power cbs
supply logic bus power to the control panel
functions.
The heater/data collection units
(DCU) cbs provide power to heaters located
around the docking ring. The H2/DCU and
H3/DCU cbs also provide redundant power to
each of the two DCUs. The APDS power
switches supply logic power to the power
switching unit (PSU). Activating these cbs also
illuminates indicator lights below each cb.
Eighteen status lights are located in the middle of
the panel and provide the prime feedback on the
operation of the docking mechanism. The right
side of the panel includes the functional controls
of the mechanism that allow for manual
operation of the various motor-driven
components. Also on the right are the controls of
the backup pyro separation system.

The DSCU contains extensive logic control

circuits that interface with each of the remaining
avionics boxes, except the PFCU. These circuits
control the timing and sequencing of the
automatic docking sequence. The DSCU also
receives the inputs from any manual
pushbutton command from the APDS control
system panel and routes the inputs to the
appropriate control box for execution. The
DSCU is responsible for providing all feedback
to the STATUS lights on the control panel as
well.

SPEC 167 provides an alternate (backup) set of

telemetry from the system. Information from
the display is used to help monitor docking
system operations. SPEC 167 details can be
found in the Generic Reference Data Book.
Power Switching Unit
The PSU contains several relays with the sole
purpose of distributing power, both logic and
drive, to the other avionics boxes operating in
the nominal docking sequence. These boxes
include the docking system control unit
(DSCU), docking mechanism control unit
(DMCU), pressure actuation control units
(PACUs), and latch actuation control unit
(LACU). The DCUs are powered through the
heater/DCU switches on panel A7L. The pyro
firing control unit (PFCU) is powered through
several other switches on both A6L and A7L
panels.
When the POWER ON pushbutton is depressed,
it activates a momentary relay in the PSU and

Docking System Control Unit

During docking, the initial contact and capture

indications are routed into the DSCU. To receive
a capture indication, at least one of two series of
three "short" capture contacts (one contact from
each of the three sensors) must be made, in
addition to one of the six "long" capture contacts.
When this condition is met, a latched logic loop is
created, which in turn creates the capture ground
buses. The latched loop can be broken only by a
POWER OFF command, loss of at least two of
three APDS bus powers, or loss of all six long
capture contacts.
The manual commands for RING OUT,
UNDOCKING, OPEN HOOKS, and OPEN
LATCHES require the creation of a dedicated
ground bus. This is done using the APDS CIRC
PROT OFF pushbutton. All other manual
commands can be accomplished without
removing the circuit protection.
The DSCU also directly powers the fixers and
the electromagnetic brakes (dampers). The
fixers are energized whenever the ring is
retracted during the auto sequence, and whenever the ring is manually driven in either
direction. (An unwanted fixers ON command
can be avoided with the FIXERS OFF
pushbutton command on the control panel.)
The dampers are activated 5 seconds after the
capture latching logic loop is created and are
deactivated with a POWER ON command in the
Docking Sequence Cue Card.

2.19-3

2. SYSTEMS
2.19 Orbiter Docking System

USA007587
Rev. A
Docking Mechanism Control Unit
The DMCU provides power to each of the two
extend/retract
actuator
motors
when
commanded from the DSCU. The motors are
single winding dc motors. The DMCU
essentially has two similar halves, one to drive
the ring in, and the other to drive the ring out.
Instead of using latching logic, the DMCU uses

mechanically latching relays to provide power

to the motors. Therefore, the relays must be
energized to the reset position to stop the ring
drive. To accomplish this, the DSCU issues
both ring drive and ring drive stop commands
at the appropriate times. A ring drive stop
command must be issued before a drive
command in the opposite direction will be
accepted because of inhibits built into the logic.

Docking System Power Panel, Panel A6L

2. SYSTEMS
2.19 Orbiter Docking System

2.19-4

USA007587
Rev. A

APDS Control Panel, Panel A7L

Pressure Actuation Control Units
PACUs 1 and 2 control the operation of the
active hooks, which are separated into two
gangs of six each (hook gangs 1 and 2,
respectively). Again, the DSCU issues the
hooks open and close commands to the PACUs,
based on the appropriate signals it receives.
Each PACU uses latching logic to supply power
to the two dc motors per actuator. The hook
gangs are commanded simultaneously with one
set of commands from the DSCU; i.e., they
cannot be operated separately. However, if the
hooks are driving in one direction, the opposing
command can be issued, and the motors will
reverse direction.
Latch Actuation Control Unit
The capture latch motors, one motor per latch,
are continuous drive motors controlled by the
LACU. The capture latches are not redundantly
powered (one motor per latch with latch 1
powered via APDS POWER ADS, latch 2 via
APDS POWER BDS, and latch 3 via APDS
POWER CDS). The motors are dc motors, but they

drive in one direction only, rotating an eccentric

cam inside the capture latch. There are 10 sensor
contacts per latch that provide feedback. There
are two redundant open/close contacts for motor
control, two redundant open/close contacts for
panel feedback, and one open/close contact for
SPEC 167 telemetry per latch. For the motor to
operate; for example, in the close direction, one of
the two open contacts must be mated, which
provides a ground path for the motor current.
When the closed position is reached, the closed
contacts mate, but it is the loss of the open
contact shortly thereafter that causes the motor to
stop driving. With the closed contacts mated, it
is now ready to drive in the open direction when
the proper relays in the LACU are energized. All
the relays in the LACU serve to provide power
and a ground path to each latch motor.
Pyro Firing Control Unit
The pyro power switches on panel A6L, and the
PYRO AP, BP, CP cbs on panel A7L provide the
main bus and logic power to the PFCU. With these
switches powered, the PYRO CIRC PROT OFF
pushbutton will remove one inhibit from the logic

2.19-5

2. SYSTEMS
2.19 Orbiter Docking System

USA007587
Rev. A
by energizing several relays within the PFCU. This
will allow the ACTIVE or PASSIVE HOOKS
FIRING command from the control panel to be
transmitted to each pyrobolt in the hook
mechanisms. There is only one pyrobolt per hook,
but there are two redundant initiators per charge.

APDS Operational Sequences (OPS)

Docking System Initialization
Configuring the SYSTEM POWER SYS 1, 2
switches on A6L panel provides three logic
power buses to the Russian A7L panel. These
switches also provide MN A/B power to the
A6L panel for the docking lights, depress
valves, etc.
Docking Mechanism Powerup
First, the PSU power switches on panel A6L are
turned on to feed MNA and MNB bus power to
the PSU avionics box.
Next, the three
HEATER/DCU cbs are turned on to activate
heaters on elements of the docking mechanism.
The H2 and H3 cbs also power the two DCU
avionics boxes that provide telemetry data for
SPEC 167 and downlink. Now, on A7L, the
three control panel power cb switches are
activated to provide logic power to the control
panel pushbuttons and status lights. The three
APDS power cbs provide logic power from the
control panel to the PSU avionics box. The
POWER ON momentary pushbutton activates
numerous relays within the PSU to distribute
logic power to the following avionics boxes: the
DSCU, the DMCU, the LACU, and both PACUs.
This also enables the feedback circuitry from the
various mechanism microswitches, which
illuminate their respective status lights on the
A7L panel. The control panel also has a lamp
test pushbutton that is used to test all 18 pairs of
status lights and the 2 pyro circuit protect off
lights.
Docking Ring Extension
The docking system is launched with the active
docking ring fully retracted and aligned in its
final position, the structural hooks open, and
the capture latches closed. In preparation for
docking, the ring must be extended to its readyto-dock or ring INITIAL position. To do this, it
2. SYSTEMS
2.19 Orbiter Docking System

is necessary to remove the inhibit that exists for

manual operation of the mechanism. This is
accomplished by depressing the APDS CIRC
PROT OFF pushbutton.
This pushbutton
activates several relays that enable the logic for
the manual RING OUT, OPEN HOOKS, OPEN
LATCHES, and UNDOCKING pushbuttons.
Without this step, these four pushbuttons are
not operative.
With the inhibit removed, the RING OUT
command is sent to the DMCU avionics box.
This command activates two dc motors to drive
the ring out to its initial position (15.7 inches
from final position) at a rate of approximately
4.3 in/min. As the ring is driving, the fixers are
also activated to keep the ring aligned while it
drives. One second after the ring reaches its
initial position, the ring motors and the fixers
are automatically commanded off. The system
is then powered down.
Docking
Once the orbiter is on the Vbar (or Rbar) for
final approach, the docking system is powered
back on. When the POWER ON pushbutton is
depressed, the docking system will be ready for
docking. In this timeframe, it is also necessary
to close the inner airlock hatch, check the
function of the airlock fan, and turn on the
docking lights and cameras.
At contact, the initial contact light on A7L may
temporarily illuminate and the ring aligned
light may go off. This will cue the crew to
activate the preset postcontact thrusting (PCT)
sequence, using the spare digital autopilot
(DAP) pbi. The PCT is designed to provide the
force required to attain capture with the APDS
while not exceeding dynamic loads.
To
enhance the probability of success, the PCT
should be initiated within 2 seconds of initial
contact. To prevent exceeding loads, it should
not be initiated once capture is achieved.
The following steps are found in the Docking
Sequence Cue Card. Once capture is achieved,
the capture light illuminates.
The electromagnetic brakes (dampers) are automatically
energized 5 seconds post-capture to dampen
relative motion between the two vehicles. When
relative motion has ceased, the crew performs a

2.19-6

USA007587
Rev. A
POWER ON pushbutton command to disable
the dampers. When relative motion has again
ceased, the docking sequence cue card calls for
a set of actions to release any dampers that may
still be mechanically engaged.
This is
accomplished by first executing a FIXERS OFF
pushbutton, followed by a RING IN pushbutton
to start the ring driving in. Five seconds later,
the ring drive is terminated by a POWER ON
pushbutton. The FIXERS OFF pushbutton is
necessary to inhibit the FIXERS ON command
that would automatically be issued with a ring
drive command. The fixers are disabled to
prevent them from engaging the ring in a
potentially misaligned configuration. Once the
5-second RING IN is terminated and relative
motion has ceased, an APDS CIRC PROT OFF
pushbutton is executed to enable the RING
OUT pushbutton. A RING OUT pushbutton is
then initiated to start the ring out motion. The
RING OUT is terminated 5 seconds later by a
POWER OFF pushbutton followed immediately
by a POWER ON pushbutton. This power cycle
stops the ring drive and resets the APDS CIRC
PROT and FIXERS OFF logic. Once the disable
and release damper steps in the docking
sequence cue card has been executed, an MCC
GO is required to proceed with the next RING
IN pushbutton. Conditions for MCC GO are
ring alignment and no relative motion .
Automatic Docking Sequence
With the RING IN pushbutton and subsequent
ring retraction, a FIXERS ON command is
automatically initiated. The retracting ring will
eventually pull the structural rings close
enough together to activate the ready-to-hook
sensors (three of four required to indicate RDY).
The RDY signal activates the CLOSE HOOKS
close command and the hooks begin driving
closed. About 10 seconds after the hooks begin
driving, they reach an in between sensor that
stops the ring from retracting further. As the
hooks drive closed, the mating surfaces will
compress the pressure seals and activate three
INTERFACE SEALED sensors (two of three
required to indicate). Once the sets of hooks are
closed, the docking sequence cue card calls for
actions to load relieve the capture latches, open
the capture latches, and retract the ring to the
final position. An APDS CIRC PROT OFF

pushbutton, followed by a RING OUT

pushbutton is executed to extend the ring
slightly (10-second drive) to relieve loads on the
capture latches. The capture latches are opened
with an OPEN LATCHES pushbutton, and the
ring is retracted to its FINAL position with a
RING IN pushbutton. The docking is then
complete, and the system is powered down.
Failed Capture
For failed capture cases that result in a bounce
off, it is necessary to check out the mechanism
before conducting another attempt. This can be
simply accomplished by fully extending the
ring to the FORWARD position (20.4 inches) to
verify function and realign it, and either
retracting it to the INITIAL position or fully
retracting it to the FINAL position and then
reextending it to the INITIAL position. If the
mechanism appears functional, and the cause of
the failed capture is apparent, it is not necessary
to delay a second attempt (from the mechanism
perspective only). For cases where the
mechanism captures, but either the orbiter or
the ISS does not get the signal (i.e., the orbiter
does not get active damping or the ISS does not
go to free drift), the response can be more
complicated. If the crew can determine that the
relative motion appears stable and will not
bottom out the mechanism, the preferred
approach is to hang on and wait it out. If
motion ever appears unstable or excessive, the
crew may be required to open the capture
latches and back away.
Manual Docking Sequence
With the exception of the active damping, the
entire docking sequence can be completed
manually by the crew.
Pushbuttons are
available to command the ring in or out, open
or close the hooks, open or close the capture
latches, and disengage the fixers.
Undocking Timeline
Prior to undocking, the external airlock and
internal airlock hatches must be closed and the
ISS verified ready for undock, including the
release of any PMA hooks (located on the ISS
docking ring) used for structural margin.
Again, the docking lights and cameras will be
turned on.
The airlock vestibule will be

2.19-7

2. SYSTEMS
2.19 Orbiter Docking System

USA007587
Rev. A
depressed using the switches on A6L, and leak
checks will be performed. With that complete,
the docking system will be powered up for
undocking.
The APDS circuit protect acts as an inhibit to
using several other pushbuttons, as mentioned
earlier. When the APDS CIRC PROT OFF pushbutton is depressed, the UNDOCKING, OPEN
HOOKS, OPEN LATCHES, and RING OUT
pushbuttons are enabled.
The undocking
sequence nominally requires just the APDS
CIRC
PROT
OFF
and
UNDOCKING
pushbuttons to be pushed. (In certain failure
cases, the OPEN HOOKS and OPEN LATCHES
pushbuttons could be required.) By depressing
the UNDOCKING pushbutton, the hooks are
commanded open. As they release, four spring
plungers compressed between the mating
surfaces, with a combined spring force of
approximately 700 lb, impart a small separating
velocity on the ISS/orbiter. The sep burns are
then performed, and the docking system is
powered off.
Contingency Undock
This procedure assumes the orbiter hooks have
failed closed during a previous undocking
attempt. This would require use of the pyro
system to separate. If the failed hooks are on
the ISS side, the pyro system for the passive
hooks can be used from the orbiter side to effect
undocking. The pyro power switches on A6L
energize four buses to the PFCU avionics box.
The pyro cbs on A7L enable three logic power
buses to the PFCU. Depressing the PYRO CIRC
PROT OFF pushbutton activates numerous
relays within the PFCU and essentially enables
the active and passive HOOKS FIRING
pushbuttons.
If the firing of the hook pyro bolts does not
result in separation of the two vehicles, the only
remaining option is for the crew to perform an
extravehicular activity (EVA) to remove the 96
bolts that attach the vestibule to the external
airlock. The interface is held via specially
designed quick-release clamps while the bolts
are removed.

2. SYSTEMS
2.19 Orbiter Docking System

Operational Notes of Interest

IFM Workarounds
Because of the number of unknowns with the
Russian avionics, an in-flight maintenance
(IFM) procedure was deployed that would
bypass the avionics and directly drive any
motor on the APDS. The procedure has the
crew access the American-made feedthrough
connectors in the external airlock; the
connectors are located in "bubbles" behind
closeout panels. The connector required for the
intended operation is demated and jumpers
from the IFM pin kit are attached between the
power and ground sockets in the connector and
the IFM breakout box. When the breakout box
is activated, the motors drive in the intended
direction.
With this procedure, however,
feedback is lost due to the demated connector
and must be accounted for before the procedure
is accomplished.
The IFM was originally
intended as a backup to open the hooks should
there be a power or avionics problem during
undocking.
However, the procedure was
expanded to include the capability to drive any
motor in any direction.
Power On Time Constraints
The avionics boxes have a power on time
constraint of 2 hours, after which they must be
off for 30 minutes before being repowered. This
is due to heat buildup concerns of continuously
energized relays within the boxes.
Pushbutton Operation
The manual pushbuttons on the APDS control
panel should not be depressed for any more
than 2-3 seconds. This is because pushing those
pushbuttons activates momentary relays inside
the DSCU, and the relays could overheat if they
are energized for too long.
In addition, each pushbutton on the A7L panel
covers a set of electrical contacts. To ensure a
positive electrical connection when depressing a
pushbutton, the standard Russian training
procedure is to instruct crews to use a two
fingers for two seconds rule. This rule ensures
that the pushbutton is fully and evenly
depressed, making a good electrical connection.

2.19-8

USA007587
Rev. A
Electrical Bus Failures
The Russian design philosophy within the
avionics utilizes three separate electrical paths;
two of the three are required to activate any
particular function. For feedback from sensors
external to the avionics boxes, the three paths
typically are combined into two paths to the
sensors with the APDS A logic bus common to
both paths; i.e., A and B complete through one
sensor contact, A and C through the other. In
this way, with any two buses powered, the
system can complete its function. Conversely,
however, if any one contact shorts to ground,
two of the three paths associated with that
function will be activated and possibly disrupt
the system operation. This is the basis for all
the avionics single-point failures.

With this design, a workaround was

implemented such that with any single sensor
contact shorted to ground, the APDS A logic
bus can be powered off to regain full manual
functionality of the system.
It does not,
however, work very well when the DMCU is
involved (ring position sensors), because the
removal of one power leg must occur within a
short time if commanding ring drive. The
relays in the DMCU are not powered
symmetrically like the other boxes, so the 2-of-3
voting scheme is not entirely valid. Two
commands are still required to activate the ring
drive motors, but only one path (A or C) needs
to be satisfied to stop the ring drive. There are
workarounds for this scenario, but they are not
as simple or straightforward.

2.19-9

2. SYSTEMS
2.19 Orbiter Docking System

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.19 Orbiter Docking System

2.19-10

USA007587
Rev. A

2.20

and from MCC and displays the video on the

PGSC screen.

PAYLOAD AND GENERAL

SUPPORT COMPUTER

Spacehab

CONTENTS

With Spacehab module missions, PGSCs in the

Spacehab provide an interface to Spacehab
systems data and to experiments in Spacehab.

Description............................................. 2.20-1
Equipment.............................................. 2.20-2

PDRS

Description
The payload and general support computer
(PGSC) is a laptop portable computer used
either as a standalone computer or as a terminal
device for communicating with other electronic
systems. The PGSC is one element of the
command and data services provided by the
Space Shuttle Program (SSP). These computers
are used in many different activities.
Experiments
PGSCs are used in the middeck or flight deck to
interface with flight-specific experiments that
may be located in the cabin or payload bay. The
PGSCs are used to monitor experiment data
and/or issue commands to payloads or
experiments in the payload bay.
Orbiter Communications Adapter
The orbiter communications adapter (OCA) is a
card that is installed in the expansion tray to
provide an interface to either the orbiter S-band
PM system or the Ku-band system. While in the
S-band mode, the OCA acts as a modem and
allows electronic file transfers via one of the airto-ground (A/G) audio loops, usually A/G 2
through the payload specialist (PS) audio panel.
The A/G 2 loop provides a bandwidth of 32
kbps. The Ku-band system is capable of using a
bandwidth of 128 kbps, in addition to one A/G
loop for uplinks, thus enabling a higher data
rate transfer. In the Ku mode, the downlink
bandwidth could be in either 2 or 4 Mbps.
Electronic file transfers include personal mail to
individual crewmembers; Flight Data File (FDF)
procedures; drawings; whiteboard, which is a
real-time system of displaying what a person in
MCC is sketching on a board; and video
conferencing, which provides real-time video to

On missions with RMS operations, PGSCs are

loaded with two RMS Situational Awareness
applications. The RMS situational awareness
display (RSAD) provides current joint angle
information in relation to reach limits and
singularities. It also has options to display
other information such as position and attitude.
Dynamic Onboard Ubiquitous Graphics
(DOUG) provides an artificial simulated birds
eye view of the shuttle and Space Station from
any perspective.
Rendezvous
During missions that will deploy/rendezvous
with a payload or that will dock with Space
Station, PGSCs are used as a tool to aid the
crews situational awareness about the orbiter's
approach/separation to/from the target. Other
tools used in conjunction with the PGSCs
include:
Handheld LIDAR (HHL)
Pulse code modulation master unit
(PCMMU) decommutation software
(PCDECOM).
Rendezvous
proximity
program (RPOP)

operations

Trajectory control sensor (TCS)

The above are used for the tools for rendezvous
and docking (TRAD) system.
Deorbit
The Deorbit Manager application can be used to
determine landing opportunities, deorbit
targeting
information,
deorbit
footprint
information, as well as entry and landing c.g.
data. This application is used in the event that a
contingency deorbit is necessary with no
communication with the ground.

2.20-1

2. SYSTEMS
2.20 Payload and General Support Computer

USA007587
Rev. A
Cables to interface an HHL or TCS to a
PGSC

Equipment
Equipment flown to support PGSC activities
includes:
IBM 760XD laptop

Expansion tray to provide additional

ports to the PCMMU payload bay
equipment

RS-422 and RS-232 Y - cables to interface

multiple PGSCs

OCA card to interface with orbiter

communications systems

PCMMU data cable to interface the

orbiter PCMMU data to the PGSC

TV tuner to interface orbiter CCTV

signals to a PGSC

RS-422 PDIP cables to interface PGSC

with equipment located in the payload
bay

Power status indicators

Bluetooth status indicators

Security Keyhole

Universal serial bus (USB) connectors

Video-out connector
Serial connector

Ethernet connector

Modem
connector
Video-in connector

Parallel
connector
External-monitor
connector

A31P PGSC without Expansion Unit

2. SYSTEMS
2.20 Payload and General Support Computer

2.20-2

AC power connector

USA007587
Rev. A
AC power
connector

PCMCIA slots

Universal serial bus

(USB) connectors

External-monitor
connectors

RJ11

Parallel
connector

RJ45

MIDI/Joystick
port

Eject Button
PWR

A31P Expansion Unit

2.20-3

2. SYSTEMS
2.20 Payload and General Support Computer

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.20 Payload and General Support Computer

2.20-4

USA007587
Rev. A

2.21

Remote Manipulator System

PAYLOAD DEPLOYMENT AND

RETRIEVAL SYSTEM (PDRS)

The RMS is the mechanical arm portion of the

PDRS. The arm can perform several tasks, such
as deploying and retrieving a payload,
providing a stable platform for EVA crewmember foot restraints or workstations, mating
space station components, and taking payload
bay surveys. The RMS is capable of maneuvering up to 586,000 pounds.

CONTENTS
Description.............................................
Remote Manipulator System ...............
Manipulator Positioning
Mechanism ..................................
Payload Retention Mechanisms..........
Operations..............................................
PDRS Caution and Warning
Summary .....................................
PDRS Summary Data ...........................
PDRS Rules of Thumb ..........................

2.21-1
2.21-1
2.21-12
2.21-16
2.21-19

The RMS is installed on the port longeron of the

payload bay for those missions requiring it.
Some deployable payloads do not require use of
the RMS.

2.21-24
2.21-25
2.21-29

NOTE

Description

Original concepts called for an optional

second arm to be placed along the
starboard longeron. It is no longer under
consideration; however, there are still
residual references to the starboard arm
on orbiter panels and controls.

The PDRS consists of the hardware, software,

and interfaces required to remotely hold and
control the movements of a specified object,
usually a payload, and to remotely observe or
monitor objects or activities.
The PDRS includes the remote manipulator
system (RMS), the manipulator positioning
mechanisms (MPMs), the manipulator retention
latches (MRLs), the manipulator controller
interface unit (MCIU), and dedicated displays
and controls. The PDRS also interfaces with
other orbiter systems, such as the SM GPC, the
electrical power distribution system (EPDS),
and the CCTV.

The available starboard infrastructure is used

for the orbiter boom sensor system (OBSS) that
will be employed for all missions to inspect the
orbiter thermal protection system.
When cradled, the arm rests on three MPM
pedestals that contain MRLs to secure the arm
during launch, entry, and periods of inactivity.
When the payload bay doors are closed,

RMS-Stowed Position and General Arrangement

2.21-1

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
including during launch and entry, the MPM is
in the rolled in, or stowed, position. After the
doors are opened on orbit, the MPM must be
rolled out, or deployed, to not interfere with
payload clearances.
The arm has six joints connected via structural
members (booms) and a payload capture/
release device (end effector) on the end. The
arm is 50 feet 3 inches long and 15 inches in
diameter. The arm has 6 degrees of freedom,
three translational (X, Y, and Z) and three rotational (P, Y, and R). They are in reference not
only to the orbiter but also to the end effector or
the payloads it can carry. It weighs 905 pounds;
the total system weighs 994 pounds.

RMS Displays and Controls, Aft Station

On-orbit RMS operations are performed by a
team of two arm operators, R1 and R2. R1
controls the actual RMS trajectories and is
stationed on the port aft flight deck. R2 is
stationed on the starboard aft flight deck and

2. SYSTEMS

controls DPS inputs, payload retention latch

assemblies (PRLAs), and cameras.
The RMS has a built-in test capability to detect
and display critical failures. It monitors the
arm-based electronics (ABE), displays and
controls (D&C), and the manipulator controller
interface unit (MCIU) firmware checks.
Failures are displayed on a light matrix on
panel A8U and on the DPS display and are
available for downlink through orbiter
telemetry.
All the major systems of the ABE are monitored.
The MCIU checks the integrity of the
communications link between itself and the
ABE, D&C, and the orbiter SM GPC. The MCIU
also monitors end effector functions, thermistor
circuit operation, and its own internal integrity.
The computer checks include an overall check
of each joints status via the consistency check,
encoder data validity, and the proximity of the
arm to reach limits, soft stops, and singularities.
The RMS can be operated only in a weightless
environment because the arm motors are unable
to move the arms weight under the influence of
Earths gravity. Each of the six joints has an
extensive range of motion, allowing the arm to
reach across the payload bay, over the crew
compartment, or to areas on the undersurface of
the orbiter.
Arm joint travel limits are
annunciated to the flight crew arm operator
before the actual mechanical hard stop for a
joint is reached.

2.21-2

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
Multilayer
beta cloth
THC
Display and
control panel
SPA

SPA

Shoulder

Lower SPA
Elbow cable
camera harness
bracket
Elbow

SPA
Upper cable
harness

SPA

SPA

Wrist

Wrist camera bracket

and light bracket
Standard
end effector
EEEU

Lower arm boom

BDA

MM/SCU
RHC
MCIU

Upper arm boom

MM/SCU
BDA
- Backup drive amplifier
EEEU
- End effector electronics unit
GPC
- General-purpose computer
MCIU
- Manipulator controller interface unit
MM/SCU - Motor module/signal conditioning unit
RHC
- Rotational hand controller
SPA
- Servo power amplifier
THC
- Translational hand controller

MM/SCU

Power
Power
To GPC
Orbiter
cable harness

usa007587_691r1.cvx

RMS Components
Manipulator Controller Interface Unit
The principal function of the MCIU is to handle
and evaluate the exchange of information
between itself and the SM GPC, the displays
and controls, and the RMS.
The MCIU
manipulates data, analyzes and responds to
failure conditions, and controls the end effector
auto
capture/release
and
rigidization/derigidization sequence logic.
A spare MCIU is usually flown on RMS flights
and can be changed out with a failed MCIU in
flight. Procedures for changing out the MCIU
are contained in the All Vehicle IFM Checklist.
Translational Hand Controller

Translational Hand Controller

The THC allows an operator to control the

three-dimensional linear motion of the RMS
point of resolution (POR) by means of manual
inputs. The POR is a software-defined point
about which all translations and rotations occur.
For an unloaded arm, the POR is at the tip of
the EE. For a loaded arm, the POR is usually
defined to be at or near the payload geometric
center, but can also be defined at a berthing
interface or the payloads center of gravity. The
POR rate commands are proportional to the
deflection of the controller.

The hand controller provides three independent

electrical inputs to the MCIU, one for each axis.
The THC incorporates in each axis a spring and
viscous damper, which provide suitable force
feel characteristics to aid the operator.
Rotational Hand Controller
The RHC is a three-axis controller that provides
electrical control signals for pitch, yaw, and roll
control of the RMS. Control signals are proportional to manual input displacements in each of
the three mutually perpendicular axes. The
RHC also provides additional RMS controls

2.21-3

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
through three switches located on the handgrip.
The three switches are:

RATE HOLD pushbutton. This pushbutton

is mounted on the top of the grip assembly
and is thumb-operated. The pushbutton is
used to maintain the POR translational and
rotational rates at a commanded value.
Rate hold is engaged when the pushbutton
is depressed momentarily. Rate hold is
disengaged when the pushbutton is again
depressed momentarily. The rates can be
biased once rate hold has been actuated and
the hand controllers have been returned to
detent by deflecting a hand controller a
second time.
RATE switch.
The VERNIER/COARSE
RATE switch is a slide switch that produces
the signal used by the RMS software to
determine the POR rate limits when
operating in resolved-rate modes and the
joint rate limits when operating in SINGLE
mode. The switch is configured to produce
coarse (faster) rates when pushed away
from the operator and vernier (slower) rates
when pushed toward the operator.
CAPTURE/RELEASE switch. This rocker
switch is mounted on the aft part of the grip
assembly and is used to capture and release
payloads. The lower part of the switch
sends the capture signal to the end effector,
and the upper part sends the release signal.
A finger-operated guard is provided over
the release part of the switch to prevent
inadvertent actuation during normal
operation of the RHC.

2. SYSTEMS

Manipulator Arm Drive System

Each joint of the manipulator arm is driven
electromechanically, and the drive trains for all
joints are similar, except for gear ratio. Each of
the six joints has an identical reversible, brushless DC motor that is used in both prime and
backup modes of operation.
Motor shaft
position is provided by a commutation scanner
assembly consisting of two optical commutators
on the input side of each motor. One commutator electronically interfaces with the primary
motor drive amplifier and one electronically
interfaces with the backup drive amplifier.
The drive motor is held in a quiescent state by
the brakes, which apply a brake pad to a contact
surface on the motor shaft. Continuous application of 28 V DC to the brake is required to
disengage the brake.
Each joint contains a gear train that differs in
gearing ratios. Dry lubrication is used throughout the gear trains. Backlash is minimized by
the use of close tolerance gears and a backlash
control device.
An electro-optical encoder is fitted to the gear
box output of each joint. The encoder is used to
sense the angular position of the joint. The
encoder uses an LED light source and a single
disk. The encoder in the wrist roll joint has a
hole in the center to allow cables to pass
through.

2.21-4

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Rotational Hand Controller

Each joint in the arm contains a digital servo
power amplifier (SPA). The SPA is associated
with the motor module and position encoder for
that joint. The major function of the SPA is to
provide a drive signal to the motor. The SPA
conditions incoming +28 V DC MN A power to
the appropriate level needed to drive the joint,
and regulates power to the other components of
the motor module. The SPA also performs
several built-in test equipment (BITE) checks to
ensure it is functioning properly. Should one of
these tests fail, a master alarm and SM message
will be generated.
One backup drive amplifier is located in the
shoulder. The backup drive amplifier conditions
+28 V dc MN B power for arm use and provides
drive signals to the selected joint motor.
Motor Module
Mechanical Arm Assembly
The manipulator arm drive system components,
the arm cable harness, and arm structural
components form the mechanical arm assembly.
The structural components consist of joint
housings, electronic housings, and arm booms.

2.21-5

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
Each joint is fitted with a mechanical stop that is
capable of stopping the joint from moving. This
mechanical stop is known as the hard stop
The shoulder brace is designed to minimize the
high-pitch-axis moment loading on the shoulder
pitch gear train during the launch environment.
On orbit, the brace is released to allow RMS
operations. The shoulder brace is designed to
enable ground engagement of the release
mechanism using an external power source. It
cannot be relatched on orbit, but there is no
requirement to relatch the brace before reentry
and landing. A plunger is extended between
two pieces of tapered metal, pushing the ends of
the pieces outward, wedging the ends of the
receptacle on the outer casing of the shoulder
yaw joint, and engaging the shoulder brace.

2. SYSTEMS

Shoulder Brace
Shoulder brace release is controlled by the leverlocked SHOULDER BRACE RELEASE switch on
panel A8U. Positioning the switch to PORT
releases the brace, which withdraws the plunger
by an electrical linear actuator. This allows the
tapered metal pieces to relax and move toward
each other, which permits the brace to slide out
of the shoulder yaw outer casing, unlatching the
brace. The switch must be held 2 seconds after
the RELEASE talkback indicator on panel A8U
indicates gray because the microswitch
indicating release is not at the end of the
plungers travel. A barberpole indication shows
that the shoulder brace is not released.
The arm boom assemblies are two thin-walled
tubular sections called the upper and lower arm
booms. The arm booms are structures designed
to meet stiffness criteria. To achieve an efficient
stiffness/weight design and to maintain
simplicity of construction, a circular section
graphite/epoxy composite design has been
implemented.
End flanges are made of
aluminum alloy and are bonded and bolted to
the graphite/epoxy tubular sections. Provisions
are made for the installation of electrical cable
harness assemblies along the length of each arm.

2.21-6

2.19 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Electrical Flight Grapple Fixture

SHOULDER BRACE RELEASE Switch and

Talkback Indicator on Panel A8U
On top of the lower arm and immediately
below the elbow joint interface is a mount for
installation of an elbow CCTV camera and
pan/tilt unit.
Wire arm cable harnesses are designed to
minimize electrical cross-talk and electromagnetic interference. They are of a weight-efficient
design and are installed on the outside of the
upper and lower arm booms, utilizing a lightweight mounting technique with adhesive
Kapton tape. Sufficient slack is allowed for
relative thermal expansion and contraction
between the cables and arm booms and for
movement of the joints.

The standard end effector drive system captures

or releases a payload using a rotating ring at the
open end of the unit to close three wire snares
around the payload-mounted grapple fixture.
The entire snare ring is then pulled into the end
effector until the grapple fixture base plate is flush
against the tip of the end effector. This process is
called rigidizing the end effector. To release a
payload, the carriage is extended or derigidized to
a point where there is no axial tension on the
grapple fixture probe, and the snares are then
opened.

End Effectors
The RMS can operate with standard or specialpurpose end effectors.
The standard end
effector can grapple a payload, keep it rigidly
attached as long as required, and then release it.
Special-purpose end effector designs are available and can be built and installed on the RMS
during ground turnaround in place of the
standard end effector. A male plug on the
optional electrical flight grapple fixture can
receive electrical power through a female
connector located in the special purpose
end effector.
2.21-7

Standard End Effector

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
Thermal Protection
The RMS has both passive and active thermal
control systems. The passive system consists of
multilayer insulation blankets and thermal
coatings that reflect solar energy away from the
arm and aid in controlling the temperature of
the hardware. The blankets are attached to the
arm structure and to each other with Velcro.
Exposed areas around the moving parts are
painted with a special white paint.

For example, when the JOINT switch is

positioned to END EFF TEMP and the PARAMETER switch is positioned to PORT TEMP,
LED 1 displays the commutators temperature,
LED 2 displays the end effector electronics temperature, and LED 3 identifies the location as
the end effector.

To maintain the arms temperature within

predetermined operating limits, an active system
of 26 heaters on the arm consumes up to 525 watts
of power at 28 V DC. There are two redundant
heater systems, one powered from the orbiters
MN A DC bus and the other from the MN B DC
bus. Only one system is required for proper
thermal control. The heaters in each system are
concentrated at the arms joint and end effector to
heat the electronics and ac motor modules. The
heaters are enabled by the PORT RMS HEATER
A and B guarded switches on panel A8L. When
the switches are positioned to AUTO, the heaters
are thermostatically controlled by 12 thermistors
located along the arm. The joint thermistors turn the
heaters on at 14 F and off at 43 F. The thermistor
in the end effector turns the heaters on at 23 F
and off at 52 F.
LED numerical displays 1, 2, and 3 in the
middle of panel A8U can be used in conjunction
with the JOINT and PARAMETER rotary
switches to display arm temperatures in
degrees Fahrenheit along with identification
numbers.

2. SYSTEMS

PORT RMS HEATER Switches on Panel A8L

2.21-8

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

LEDs and Rotary Switches on Panel A8U

CCTV
The orbiters CCTV aids the flight crew in
monitoring PDRS operations. Mounted on the
end effector are a spotlight and a fixed CCTV
camera that can be zoomed. A CCTV with pan
and tilt capability is located below the elbow. In
addition, four CCTV cameras in the payload bay
can be panned, tilted, and zoomed.
Keel
cameras, which look up from the bottom of the
payload bay, may be provided, depending on the
mission tasks. LED illuminators normally are
mounted around the lens of all of the CCTV
cameras to add additional lighting when
required. The two CCTV monitors at the aft
flight deck station can each display any two of
the CCTV camera views simultaneously with
split screen capability. Two views show on the
same monitor, which allows crewmembers to
work with four different views at once.
Crewmembers can also view payload operations
through the aft flight station overhead and
payload bay viewing windows. (See Section 2.3
for CCTV operations.)

Reach Limits, Soft Stops, and Hard Stops

Each RMS joint has travel limits. As an example,
the wrist pitch joint can be physically moved
positive or negative 121.4 to the mechanical hard
stop. At positive or negative 114.4, software
warns the RMS operator that the arm is
approaching its end of travel by activating the
yellow REACH LIM light and the red MASTER
ALARM pushbutton indicator on panel A8U,
sounding the master alarm, displaying a computer
fault message, sounding an SM tone, and
displaying a REACH LIMIT indication on the DPS
display.

Elbow CCTV System

Wrist CCTV and Light Configuration

If the operator continues driving the joint past

the reach limit, the next warning is the soft stop.
At this point (positive or negative 116.4 for the
wrist pitch joint), the SOFTWARE STOP
talkback on panel A8U (top center) will indicate
2.21-9

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
barberpole. The arm can only be operated in
SINGLE, DIRECT, or BACKUP modes once it
reaches a soft stop. If the operator continues to
drive the joint in this direction, motion will stop at
positive or negative 121.4. All joint angles equal
0 when the arm is cradled.

BRAKES and SAFING Switches and

Talkbacks and SOFTWARE STOP Talkback
on Panel A8U

2. SYSTEMS

2.21-10

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Joint
Shoulder yaw
Shoulder pitch
Elbow pitch
Wrist pitch
Wrist yaw
Wrist roll

Reach limit
+175.4
-175.4
+2.6
+140.4
-2.4
-155.6
-114.4
+114.4
-114.6
+114.6
-440.0
+440.0

Soft Stop
+177.4
-177.4
+0.6
+142.4
-0.4
-157.6
-116.4
+116.4
-116.6
+116.6
-442
+442

Mechanical
stop
+180
-180
-2
+145
+2.4
-161
-121.4
+121.4
-121.3
+121.3
-447
+447

Joint Travel Limits

Safing and Braking
Safing and braking are the two methods
available for bringing the arm to rest. Safing
can be accomplished by positioning the SAFING
switch at the top of panel A8U to SAFE, which
brings the arm to rest using the servocontrol
loops. When the switch is positioned to AUTO,
safing is initiated by the MCIU when certain
critical built-in test equipment failures are
detected or communication with the SM GPC is
lost. The CANCEL position removes the safing
state. The SAFING talkback indicator indicates
gray when safing is not in progress and
barberpole when safing is in progress.
In the initial stages of PDRS operations
development, safing was considered the primary method whereby the MCIU could quickly
respond to a failure condition and arrest the
motion of the arm. MCIU initiations of auto
brakes was added later to respond to certain
failure conditions in the SPA. The BRAKES
ON/OFF switch and talkback indicator are

located on panel A8U. The brakes are manually

disengaged by moving the switch to the OFF
position. This setting sends a hardwired signal
to the brake logic function in the MCIU. The
MCIU then commands the brakes to be lifted or
removed from restraining the joints on the arm.
The operator may reapply the brakes by placing
the switch in the ON position. The arm operator
is trained to respond to any suspected RMS
failure condition by immediately placing the
BRAKES switch to the ON position while operating in any mode except DIRECT DRIVE and
BACKUP.
In DIRECT DRIVE the operator
responds by moving the MODE rotary switch to a
non-DIRECT DRIVE position. In BACKUP the
proper response is to place the RMS SELECT
switch to OFF. Use of the SAFING switch is not
recommended.

2.21-11

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Manipulator Positioning Mechanism

The MPM is composed of a torque tube, the
MPM pedestals, which are mounted on the
torque tube, the MRLs, and the jettison system.
MPM Pedestals
The port MPM houses the separation system
and provides the cradling units upon which the
arm rests. There are four support assemblies.
One is a shoulder attach point located at an
orbiter
X-value of 679.5. The support assembly at the
port shoulder attach point is unique. Since the
RMS is attached to the orbiter at this point, it
does not contain an MRL, but does contain a
separation system that is part of the MPM.

indications. Current flight rules prohibit loaded

arm operations from the stowed configuration.
The PORT RMS DEPLOY/STOW switch is on
panel A8L. The talkback above the switch
indicates STO when the MPMs are in the
stowed position, DPY when they are deployed,
and barberpole in transit. The status of the
shoulder MPM can be monitored on the SPEC
94
PDRS
CONTROL
display
(MPM
STO/DPLY).
The STBD RMS DEPLOY/STOW switch is also
located on panel A8L.
The talkback and
microswitch operate the same as the Port MPM.
An item entry on SPEC 94 PDRS CONTROL is
used to select Port or Starboard MPM data for
display.

The port MPM pedestals are located at X-values

of 911.05, 1189, and 1256.5. The three pedestals
are similar. Each contains two 45 saddle
interfaces for cradling the arm and a retention
latch to lock the arm in place. The mating
hardware for the arm consists of two 45 mating
plates to rest on the support saddle and a latch
striker held by the retention latch.
The support assembly also contains redundant
sensors or microswitches to indicate ready-tolatch and latched/release conditions.
The starboard pedestals for the OBSS are located
at X values of 679.5, 911.05, and 1256.5. All
three of these contain MRLs. The OBSS has
additional bracing at the forward MPM attach
point to help with loads in the X direction. A
power connector is engaged in the forward
MPM when the MRL is latched. This provides
heater power to the OBSS while it is latched in
the MPMs.
MPM Torque Tube
The MPM drive system consists of dual
redundant motors rotating a torque tube that in
turn drives the rotary actuators that move the
RMS pedestals. The torque tube rotates the arm
from its stowed position to its operational
position outside the payload bay. The drive
mechanism
has
two
overcenter
lock
components, one of which locks in the deployed
position and the other which locks in the
stowed position. The drive system contains
microswitches
needed
for
stow/deploy
2. SYSTEMS

2.21-12

2.21 Payload Deployment and Retrieval System (PDRS)

STBD RMS Controls on Panel A8L

USA007587
Rev. A
The OBSS is latched in three locations along the
starboard longeron.
The retention latches
operate the same as described for the port side.
The only difference is that the STARBOARD
RMS RETENTION LATCHES switch was
changed to a lever lock switch to prevent
inadvertent release of the OBSS.
Jettison System

PDRS CONTROL Display (SPEC 94)

Manipulator Retention Latches
The arm is latched in three locations (aft, mid,
and forward) along the port longeron to secure
it for launch and entry loads. The retention
latches are dual rotating surfaces that are driven
by redundant motors. When the three ready-tolatch indications are received, the operator
positions the PORT RMS RETENTION
LATCHES switch on panel A8L to LATCH, and
the retention hooks catch the striker bars on the
RMS and secure them firmly in place. All three
latches are controlled by the switch. The MRL
system contains microswitches for ready to
latch, latched, and released indications. The
microswitch status can be viewed via panel A8L
(AFT, MID, FWD) talkbacks and the SPEC 94
PDRS CONTROL display (LAT/REL/RDY).

If for any reason the arm or OBSS cannot be

recradled and restowed, they can be jettisoned
so that the payload bay doors can be closed.
There are four separation points, on the port side,
one at the shoulder and one at each of the three
pedestals. The starboard side has separation points
at each of the three pedestals. Each of the
separation points is individually actuated. The
separation system is designed to cause a nonimpulsive separation.
The shoulder attach point has a wire bundle
that must be separated prior to shoulder
support separation. The wire bundle is severed
by a redundant pyro-operated guillotine prior
to the activation of the support jettison system.
The jettison system works by redundant pressure cartridges firing to force down a retractor
that pulls back four overcenter tie-down hooks,
releasing the arm or OBSS at the selected
support.
The GUILLOTINE switches for the RMS are
located on panel A14.

2.21-13

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

RMS Retention Mechanism

Jettison System

2. SYSTEMS

2.21-14

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

RMS Shoulder Wire Bundle

RMS Jettison Controls on Panel A14

2.21-15

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Active Payload Retention System

Payload Retention Mechanisms

Non-deployable payloads are retained by
bolted
passive
retention
devices,
and
deployable payloads are secured by motordriven, active retention devices. Payloads are
secured in the orbiter payload bay with the
payload retention system or are equipped with
their own unique retention systems. The orbiter
payload retention system provides three-axis
support for up to three payloads per flight. The
payload retention mechanisms secure the
payloads during all mission phases and allow
installation and removal of the payloads when
the orbiter is either horizontal or vertical.
Attachment points in the payload bay are in
3.933-inch increments along the left- and rightside longerons and along the bottom centerline
of the bay. Of the potential 172 attach points on
the longerons, 48 are unavailable because of the
proximity of spacecraft hardware. The remaining 124 may be used for deployable payloads.
Along the centerline keel, 89 attach points are
available, 75 of which may be used for
deployable payloads.
Bridge Fittings
Bridge fittings are used to react to the loads
imparted to the orbiter structure by the
payload, and provide a structural interface for
both the payload retention latch assemblies
(PRLAs) and active keel actuators (AKAs).
Bridge fittings fall into standard and
2. SYSTEMS

lightweight categories, just as the PRLAs and

AKAs do, and, of course, differ in type when
used to interface longeron versus keel latches.
The keel bridge has a T-slot that accepts the
T-bar fitting of the AKA; the two mated
members are bolted in place. Contrastingly, the
longeron bridge fitting incorporates a T-bar rail
onto which the PRLA T-slot slides.
The standard and lightweight bridge fittings
differ in both cross-sectional thickness and
material. The standard fittings are made of titanium and are thicker than their lightweight aluminum counterparts. Bridge fittings, whether
standard or lightweight, longeron or keel type,
are compatible with the hole patterns and
wiring routes for a particular bay only.
Therefore, each fitting is unique dimensionally
for any given bay.
There are 13 longeron bridges per side and 12
keel bridges available per flight. Only the
bridges required for a particular flight are
flown. The bridges are not interchangeable
because of main frame spacing, varying load
capability, and subframe attachments.
The longeron bridge fittings attach to the payload bay frame at the longeron level and at the
side of the bay. Keel bridge fittings attach to
the payload bay frame at the bottom of the
payload bay.

2.21-16

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
Trunnions
The payload trunnions are the cylindrical
portion of the payload that interfaces with the
payload retention system. The trunnions that
interface with the longeron are 3.24 inches in
diameter and 7 or 8.75 inches long, depending
on their position in the payload bay. The keel
trunnions are 3 inches in diameter and vary in
length from 4 to 11.5 inches, depending on
where they fit in the payload bay.
Payload Guides/Scuff Plates
Payload guides and scuff plates assist in
deploying and berthing payloads in the
payload bay. The payload is constrained in the
X direction by guides and in the Y direction by
scuff plates and guides. Bright yellow and
black striped markings are painted on the
guides to enhance visual cues during payload
berthing. The guides are mounted to the
inboard side of the payload latches and
interface with the payload trunnions and scuff
plates. The scuff plates are attached to the
payload trunnions and interface with the
payload guides.

Payload Retention System

The guides are V-shaped, and one part of the V is

2 inches taller than the other. Parts are available
to make either the forward or aft guide taller.

Active Keel Actuator

Latches
There are normally three or four longeron latches
per payload. Two primary latches are required to
take the X- and Z-loads, and one or two
stabilizing latches are required to take Z-loads.
The stabilizing latches float free in the X-X
direction.
The latches are driven by dualredundant motors.
A payload may also require a keel latch that takes
the side loads. The keel latch centers the payload
in the Y direction in the payload bay when it
closes; the keel latch must be closed prior to
closing the longeron latches. The keel latch can
float plus or minus 2.75 inches in the X direction.

This difference enables the operator monitoring

the berthing or deployment operations through
the aft bulkhead CCTV cameras to better determine when the payload trunnion has entered
the guide. The top of the taller portion of the
guide is 24 inches above the centerline of the
payload trunnion when it is all the way down
in the guide. The top of the guide has a 9-inch
opening. These guides are mounted to the
8-inch guides that are a part of the longeron
payload retention latches.
Payload Retention System Controls
The PAYLOAD RETENTION LOGIC POWER
SYS 1 switch on panel A6U positioned to ON
provides MN A bus power to the PAYLOAD
SELECT rotary switch. The SYS 2 switch
positioned to ON provides MN B bus power to
the PAYLOAD SELECT switch.

2.21-17

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
Positioning the PAYLOAD SELECT switch to 1
provides power-on logic for the dual actuator
motors of up to five latches for one payload, the
latch status for that payload on DISP 97 PL
RETENTION, and the talkback indications
associated with the payload. Position 2 of the
switch provides power-on logic for the dual
actuator motors of up to five latches for the
second payload, the latch status for that
payload on DISP 97, and the talkback
indications associated with that payload.
Position 3 provides power-on logic for the dual
actuator motors of up to five latches for the
third payload, the latch status for that payload
on DISP 97, and the talkback indications
associated with up to five latches. In addition,
two monitor settings are available.
These
positions allow the crewmember to monitor all
payload retention latches at once on DISP 97,
but inhibit all latch control commands.
Talkback indicators are also inhibited when in
the monitor position and indicate barberpole.
The PAYLOAD RETENTION LATCHES 1, 2, 3,
4, and 5 switches on panel A6U are enabled by
the PAYLOAD SELECT rotary switch. Positioning the PAYLOAD SELECT switch to 1 enables
up to five retention latches for payload 1, and
each of the five retention latches for payload 1
would be controlled by the individual 1, 2, 3, 4,
and 5 switches. Positioning the PAYLOAD
SELECT switch to 2 or 3 has the same effect for
payloads 2 and 3.

Orbiter Payload Guide, Active Retention

Fitting
release. There are two microswitches for the
ready-for-latch talkback indication; however, as
above, only the A indication controls the
talkback indicator.

NOTE
Payload retention latch wiring configurations are mission-dependent.
Positioning
a
PAYLOAD
RETENTION
LATCHES switch to RELEASE enables
AC power to the dual electric motors associated
with the retention latches designated by the
position of the PAYLOAD SELECT switch,
driving the retention latch open. The operating
time of the latch with both motors operating is
30 seconds; with only one motor operating it is
60 seconds. The talkback indicator immediately
above the switch indicates REL when the latch
is fully open. There are two microswitches for
the REL talkback indication; however, only one
is used to control the talkback indicator
(the A indication). The talkback is barberpole
when the payload latch is between latch and
2. SYSTEMS

2.21-18

2.21 Payload Deployment and Retrieval System (PDRS)

NOTE
When driving the PAYLOAD RETENTION LATCHES to RELEASE, do not
continue to command a release for longer
than 60 seconds if no REL indication is
received. If the A release microswitch
has failed whereby no indication is
present, the latch will continue to drive
against the fully open position as long as
RELEASE is selected, which could quickly
lead to actuator damage.

DISP 97 PL RETENTION Display

USA007587
Rev. A

PAYLOAD RETENTION Switches and Talkbacks on Panel A6U

Positioning
a
PAYLOAD
RETENTION
LATCHES switch to LATCH provides AC power
to the dual electric motor associated with the
latches designated by the position of the
PAYLOAD SELECT switch, driving the
retention latch closed. The operating time of
one or both motors is the same as for releasing a
payload. A gray READY talkback indicates that
latch is ready to latch. The indicator shows LAT
when the latch is closed.
There are two
microswitches for the LAT indication; however,
only system A is required to control the
talkback indicator.

RMS Powerup
This procedure releases the MRLs and gets the
arm out of the cradle to a pre-cradle configuration.
This procedure may be performed
several times during a flight, as the arm is
usually powered down when not in use. The
RMS POWER switch is on panel A8L.
NOTE
Placing the RMS POWER switch to
PRIMARY generates an RMS master
alarm. This alarm is generated because
the panel powers up faster than the
MCIU, thereby causing the MASTER
ALARM light and tone to annunciate
before the MCIU can respond with the
proper master alarm flag. This is a
normal condition and will occur every
time the RMS POWER switch is cycled
OFF and back to PRIMARY.

Operations
The RMS can perform a wide range of operations. This section gives an overview of these
operations, as well as the actions required to
configure the arm to support these operations.
On-Orbit Initialization
Prior to any planned RMS operations, the
shoulder brace must be released, and for any
loaded operations, the MPM must be deployed.
This procedure contains both of these activities,
as well as the deployment of the starboard MPM.
The status of some of the panel lights, talkbacks,
and switches is also checked.
The PDRS
CONTROL SPEC 94 display is called up, and
the interface with the SM GPC is established.
This operation is usually scheduled at about 2.5
hours MET.

RMS Checkout
This procedure verifies in exacting detail that all
the arm hardware and the panel switches and
functions are in good operating condition. This is
about an hour-long procedure and is done only
once per flight. It is usually scheduled as early as
possible in order to allow plenty of time for any
problems to be worked around.

2.21-19

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

RMS POWER Switches on Panel A8L

Flight-Specific Operations

Deploy Operations

The arm can perform nine different types of

operations. One or more may be done per
flight. These operations are broken down as
described below.

These operations involve grappling a payload

that is berthed in the payload bay, releasing the
payload latches, unberthing the payload,
maneuvering the payload to the release position
and orientation, and releasing the payload.

Contingency-Only Unloaded Operations

These unscheduled operations will only be
performed if a problem arises in another orbiter
system. The training for these operations is
very minimal, and the tasks performed would
involve surveys of some parts of the orbiter.

Retrieve Operations
These operations involve capturing a free-flying
payload, maneuvering the payload to a hover
position (aligned with the berthed position, but
about 10 feet over the bay), berthing and
latching the payload, and ungrappling it.

Unloaded Operations
involve
These
scheduled
operations
maneuvering the arm to various positions or
along various trajectories. An example of this
would be a payload survey. There is no
payload attached to the arm during these
maneuvers.

These operations apply to one payload that is

both deployed and retrieved, as in the steps
listed above. The order of deploy and retrieve
operations is flight specific.
Station Build Operations

Loaded Operations
These operations involve grappling a payload
that is berthed in the payload bay, releasing the
payload latches, unberthing the payload,
maneuvering the payload, reberthing and
relatching the payload, and ungrappling the
payload.

2. SYSTEMS

Deploy and Retrieve Operations

These operations apply to taking a station

element such as an MPLM and then either
installing it on to the ISS or handing it off to the
SSRMS for subsequent installation. These tasks
could also involve removing a station element
and relocating it to another port.

2.21-20

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
RMS/EVA Operations

OBSS Jettison

These operations involve using the RMS as a

portable work platform with an EVA
crewmember attached to the end of the arm
with a foot restraint. The EVA crewmember can
be moved around via the RMS because it
provides access to worksites where the tasks
would be made more difficult if they had to be
performed free floating.

This is a contingency procedure that is used to

jettison the OBSS plus the starboard MPM
pedestals. The berthed OBSS is grappled prior to
pedestal jettisoning, then the OBSS with attached
pedestals is maneuvered to a jettison position and
released. The orbiter pilot performs an orbiter
separation from the jettisoned unit.
Operating Modes

OBSS Operations
While undocked, these operations involve
grappling the OBSS, unberthing the OBSS, and
using auto sequences to inspect the orbiter
thermal protection system (TPS). When docked
to ISS, the operations also include a handoff of
the OBSS from the SSRMS.
RMS Powerdown
This procedure returns the arm to the cradled
configuration and relatches the MRLs. This is
usually done any time arm operations are not
required. However, there are occasions when the
arm will be left uncradled to meet missionspecific objectives (e.g., when the RMS cameras
are used to view an ISS mechanism overnight).
The power to the ABE is deactivated, but the
MCIU remains powered up and in contact with
the SM GPC. For the final flight powerdown, the
MPM will be stowed as part of this procedure.
RMS Deactivation
This procedure removes power from the RMS
heaters and turns off the MCIU. This will only
be done after all arm operations scheduled for
the flight have been completed.
RMS Jettison

The RMS can be operated in a variety of modes.

These modes are detailed below.
Single Joint Modes
Operating the arm in a single joint mode allows
only one joint at a time to be driven. Single joint
operations are very painstaking and time consuming, and so are only used when absolutely
necessary. Uncradling and cradling must be
done via a single joint mode, since the arm is in
the soft stop region for two joints. The single
joint modes are SINGLE, which is a computersupported mode; DIRECT, which commands
the joints via hardwired signals and uses MN A
(primary) power; and BACKUP, which commands the joints via hardwired signals and uses
MN B (backup) power.
Manual Augmented Modes
The manual augmented modes are computersupported modes that use the RMS hand
controllers (HCs) to control the arm trajectories.
The modes that fall into these categories are
orbiter unloaded, orbiter loaded, end effector,
and payload modes. They are selected by
corresponding positions of the MODE rotary
switch on panel A8U: ORB UNL, ORB LD, END
EFF, PL.

This is a contingency procedure that is used to

jettison the arm only, the arm plus MPM
pedestals, or the arm/payload combination.
Jettison causes a non-impulsive separation of
the arm, and then the orbiter pilot performs an
orbiter separation from the jettisoned unit.
Should the jettison have to be done in an
expedited manner, a QUICK RESPONSE JETTISON procedure has been created and is located
in the contingency deorbit checklist.

2.21-21

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
POHS is disabled (SPEC 94, ITEM 29), joint
position hold is used. The POHS reference
position and attitude are displayed on SPEC
169. The resultant POHS errors for translation
and rotation are also displayed on SPEC 169.
ORB UNL. Orbiter unloaded mode uses the
unloaded POR and defines the HC inputs to
coincide with the desired arm trajectory as
viewed out the aft windows. For example, to
translate the arm to the left as you are looking
out the aft window (toward the starboard side
of the vehicle), the THC would be deflected to
the left. To move the arm out of the payload
bay (up), the THC would be deflected up. To
bring the arm toward you, the THC would be
pulled out. RHC inputs are similar. To pitch
the arm or payload up with respect to you as
you are looking out the aft window, the RHC
would be tilted back toward you. To yaw the
arm/payload as you are viewing it, the RHC
would be twisted left or right about its long
axis. To roll with respect to your view, the RHC
would be deflected left and right.
ORB LD. Orbiter loaded mode is usually used
for a loaded arm. The HC inputs in orbiter
loaded mode are identical to those in ORB UNL;
however, the POR is defined to be at a point
within the grappled payload.

Mode Selection Rotary Switches and Lights on

Panel A8U
In standard RMS operations, the manual
augmented modes are supplemented with the
position/orientation hold select (POHS) mode.
POHS mode is a software improvement that has
greatly increased the ability of the RMS
operator to control the arm trajectory. The
POHS mode is used to improve RMS
performance in the manual augmented modes
by correcting unwanted motion of the point of
resolution. POHS mode can be selected on
SPEC 94. When POHS is enabled (SPEC 94,
ITEM 28), POR position hold is used to prevent
POHS
reference
drift.
When

2. SYSTEMS

In the orbiter loaded mode, there are three types

of HC references: normal, fly-to (also referred
to as fly-camera), and fly-from (also referred to
as fly-payload). These command references are
mutually exclusive and can be enabled or
disabled via SPEC 94. Fly-payload is used the
same way orbiter loaded mode is used; however, any orbiter-based camera or window view
can be used. Fly-camera is the same as flypayload with all commands reversed.
END EFF. End effector mode allows the HC
inputs to reflect motion desired when viewed
through the end effector camera. The sense the
operator has is that he or she is sitting on the
end of the end effector. When the arm is
aligned parallel to the longeron, and the wrist
joint angles are all zero, HC inputs in END EFF
coincide with those in ORB UNL/LD. If the
wrist is then pitched down in that
configuration, the motion to take the arm down
into the payload bay would be a THC
downward deflection in ORB UNL/LD, but

2.21-22

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A
would be a push inward on the THC in END
EFF mode.
PL. Payload mode uses the software-predefined
POR and coordinate system and applies the HC
inputs as follows: THC-in will cause motion in
the +X axis of the software-defined PL
coordinate system; THC-out corresponds to
motion along the -X axis of the PL coordinate
system. THC-right will cause motion along the
PL +Y axis, while THC-left will cause motion
along the PL -Y axis. THC-down will cause
motion along the PL +Z axis, and THC-up will
cause motion in the PL -Z axis. RHC P will
cause motion about the PL Y axis, RHC Y will
cause rotation about the PL Z axis, and RHC R
will cause rotation about the PL X axis.
TEST. Test mode, while not strictly speaking a
manual-augmented mode, uses the same POR
and coordinate system definition as ORB UNL.
Test mode allows the arm operator to monitor
and verify the HC commands without causing
any arm motion. This is done by cutting off the
joint drive current at each joint.

These
Auto-Commanded Auto Sequences.
sequences consist of up to 200 pre-defined
points that can be grouped in up to 20 sets, or
sequences. To use an auto-commanded auto
sequence, the operator enters the desired sequence number on the PDRS CONTROL SPEC
for one of AUTO 1, 2, 3, or 4 slots, then selects
AUTO 1, 2, 3, or 4 via the MODE rotary switch
on panel A8U. The arm is then commanded to
start via the AUTO SEQ switch, and will fly
through that predefined trajectory.
Operator-Commanded Auto Sequences. For
these, the arm operator must manually enter a
desired POR end position and attitude via the
PDRS CONTROL SPEC. The operator then
selects OPR CMD mode via panel A8U and
starts the sequence. The arm will fly from its
current position to the desired end point and
then stop. Should another sequence be desired,
the operator would have to enter the new end
point on the SPEC.

AUTO Modes
There are two types of auto modes, auto-commanded auto sequences and operator-commanded auto sequences. In either case, the SM
GPC controls the arm trajectory.
OBSS operations require many long Auto
trajectories. POHS was added to Auto modes to
better detect sluggish joints that may cause the
arm to deviate from the planned trajectory.

2.21-23

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

PDRS Caution and Warning Summary

The RMS has a separate C/W matrix on
panel A8U. This system is not associated
with the orbiters C/W system.
The red MCIU light indicates that the MCIU
has failed a self-test.
The red DERIGIDIZE light indicates that the
end effector has derigidized without command.
The red ABE light indicates that a failure has
occurred in the ABE of any joint.
The red RELEASE light indicates that the end
effector has released the grapple fixture
without command.
The red GPC DATA light indicates invalid
data transmitted from the orbiter computer
to the MCIU and detected by the MCIU BITE.
The yellow CHECK CRT light indicates an
RMS failure message is on the orbiter DPS
display.

The yellow CONTR ERR light indicates the

presence of abnormal conditions in an armjoint that may not be detected by BITE and
may cause a joint runaway (software automatically applies the brakes when such a
condition occurs).
The yellow REACH LIM light indicates that
one of the joints is close to its travel limit.
The yellow PORT TEMP light indicates that
the temperature of the port arm has exceeded
its predetermined caution threshold.
The yellow SINGULAR light indicates that
the arm is in one of three singularity configurations.
The red MASTER ALARM signals the RMS
operator that an RMS C/W light was activated. The light and tone are canceled by
depressing the pushbutton.
The RMS C/W tone volume may be adjusted
by the CAUTION/WARNING TONE VOLUME knob.

RMS Caution and Warning Lights on Panel A8U

2. SYSTEMS

2.21-24

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

PDRS Summary Data

The PDRS is used to maneuver itself or an
attached payload in orbit. It consists of the
RMS, MPM, and MRLs, and interfaces with
other orbiter systems such as the SM GPC,
the EPDS, and the CCTV.
The RMS consists of the arm itself and the
controls and interfaces needed to maneuver
it. It is located on the port longeron.
The MPMs consist of the torque tube, the
pedestals, the MRLs, and the jettison system.
The MPMs must be stowed whenever the
payload bay doors are closed. The port MPM
must be deployed for any loaded operations.
The starboard MPM differs from the port in
having a pedestal where the port has the shoulder,
and in the omission of the mid-pedestal.
The pedestals contain the MRLs and the
jettison electronics and mechanism. They are
the supports on which the RMS rests while it
is cradled and the OBSS rests while it is berthed.
The MRLs latch the arm and OBSS to their
respective MPMs and restrain them when not in
use.

The on-orbit arm operations fall into nine

categories:
contingency-only
unloaded
operations, unloaded operations, loaded operations, deploy operations, retrieve operations, deploy and retrieve operations, station
build operations, RMS/EVA operations, and
OBSS operations.
The arm has three basic modes of operation:
single joint modes, manual-augmented
modes, and auto modes.
All RMS operations involve a two-person
operator team. Each member is vital to the
success of the mission.
The PDRS controls are located primarily on
panels A8U and A8L. Other panels that
affect the RMS are ML86B, A14, A7U, A6,
and R13.
The major PDRS DPS display is SPEC 94
PDRS CONTROL. PDRS OVERRIDE SPEC
95, PDRS STATUS DISP 169, and PDRS
FAULTS SPEC 96 also control and monitor
the RMS. DISP 97 PL RETENTION monitors
payload retention device status.

The jettison system allows the arm, the arm

and
pedestals,
the
arm/payload
combination, and/or the OBSS and pedestals to
be non-impulsively separated from the
orbiter if the arm cannot be cradled and
stowed prior to payload door closure.

2.21-25

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Panel A8U

Panel A8L
2. SYSTEMS

2.21-26

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

Panel A6U

2.21-27

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

SPEC 94 PDRS CONTROL Display

DISP 169 PDRS STATUS Display

SPEC 95 PDRS OVERRIDE Display

2011/094/096

ABE BITE:
MDA OVERCURRENT /
MOTOR DRV FAULT
COMMUTATOR
TACHOMOTER
TOTAL COMPENSATOR
MICROCOMPUTER
MDA DEMAND VOLTAGE
A/D CONVERTER
BRAKE
POS ENCODER
BACKUP RELAY
CHECK CRT:
DIRECT DRIVE BITE
POS ENCODER
CONTR ERROR
REACH LIMIT
CHECK CRT:
SPA BITE TEST

DISP 97 PL RETENTION Display

PDRS FAULTS

SY

000/00:32:24
000/00:32:24
SY SP EP WP WY WR
MCIU:
MADC
MCPC
ICF
ABE:
COMM
CHECK CRT:
DC/MCIU
EXT FS
EE FLAG
EEEU
EE CMDS
HC
MCIU HC
TMP CKT
SP

EP

WP

WY

WR

usa007587_1070r1.cvx

SPEC 96 PDRS FAULTS Display

2. SYSTEMS

2.21-28

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

PDRS Rules of Thumb

Whenever there are both talkbacks and DPS
displays that reflect microswitch status, they
should ALWAYS both be checked during
any operation affecting them.
Whenever troubleshooting RMS malfunctions in the long-form MAL book, always
READ AHEAD. The MALs sometimes may
require an operator response after the
execution of the block which is listed in the
next block, depending on the path that is
taken.
The hand controllers are rate-proportional
and are extremely sensitive. They should be
held in such a way that you can control the
full range of inputs without ever stopping to
rearrange your hand. Care must be taken to
not overcontrol the inputs. A good practice
is to slowly and steadily input a desired
command, wait patiently until you see the
reactions of that command on the arm, and
as the desired motion is achieved, slowly
back off the input. Ideally, you should reach
the axis detent at the same time the arm
achieves the desired position and attitude.
Visible MPM motion may cease during
deployment or stowage before the expected
microswitches indications are received. This is
because the last part of travel in either
direction is when the affected overcenter lock
is locking. Therefore, do not turn off the
PORT RMS switch when visible motion
stops. Wait for the microswitches or max
time, whichever occurs first.
Practice safety habits, the most important of
which are brakes on, then RMS Select off (if
required) for abnormal joint response, and
use the EE CC for abnormal EE ops during
the specified conditions.

During arm cradling, periodically check all

joint angles to make sure that joints that you
have already aligned to 0 have not moved.
At least two good camera views should be
set up to aid in RMS operations. However,
CCTV cameras have a tendency to
malfunction at the most inconvenient times.
Expect this and know how to perform all
operations with alternate cameras or without
the use of certain cameras. Use the Grapple
Target overlay during EE grapple operations.
Develop a scan pattern that encompasses
window, CCTV, and panel status.
Always remember what the DAP should be
for the operation you are performing. In
addition, keep in mind the down mode
option for the DAP in case the arm enters an
unexpected singularity or reach limit.
Never rotate the MODE switch through
DIRECT while the brakes are on. This actually puts the arm in mode, and sets you up
for a possible runaway if a SINGLE/DIRECT
DRIVE switch failure occurs or is present.
Verify the RATE switch setting by feel and
talkback status. This should be done EVERY
TIME prior to moving the arm, regardless of
mode.
Make sure you know the proper definitions
of
cradling,
stowing,
berthing,
mating, and installing.
Rates for berthing/unberthing:
Usually
maintain rates at about 0.01 to 0.02 ft/sec
between Z = 414 and -438. For Z < -438
(away from the bay), rates can be increased
somewhat.
For berthing or unberthing of payloads with
keel trunnions: the keel pin enters/exits the
AKA when the longeron trunnions are at the
top of the built-in 8-inch PRLA guides.

2.21-29

2. SYSTEMS

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS

2.21-30

2.21 Payload Deployment and Retrieval System (PDRS)

USA007587
Rev. A

2.22

The third identifier designates the direction of

the jet plume: A (aft), F (forward), L (left), R
(right), U (up), D (down). For example, jets F2U,
F3U, and F1U are forward RCS jets receiving
propellants from forward RCS manifolds 2, 3,
and 1, respectively; the jet plume direction is up.

REACTION CONTROL SYSTEM

(RCS)

CONTENTS
Description.............................................
Jet System ...............................................
Propellant System .................................
Helium System ......................................
Thermal Control ....................................
RCS Redundancy Management ..........
Operations..............................................
RCS Caution and Warning
Summary .....................................
RCS Summary Data ..............................
RCS Rules of Thumb.............................

2.22-1
2.22-3
2.22-4
2.22-9
2.22-11
2.22-12
2.22-17
2.22-19
2.22-26
2.22-26

Description
The orbiters RCS consists of forward and aft
control jets, propellant storage tanks, and
distribution networks located in three vehicle
modules: forward, left, and right. The forward
module is contained in the nose area, forward
of the cockpit windows. The left and right (aft)
modules are collocated with the orbital
maneuvering system (OMS) in the left and right
OMS/RCS pods near the tail of the vehicle.
Each RCS consists of high-pressure gaseous
helium storage tanks, pressure regulation and
relief systems, a fuel and oxidizer tank, a
propellant distribution system, reaction control
jets, and electrical jet and pod heaters.

Forward, Left, and Right RCS Modules

The RCS units provide propulsive forces from a

collection of jet thrusters to control the orbiters
motion. Each jet is permanently fixed to fire in
a general direction: up, down, left, right, forward, or aft. The selective firing of individual
jets or specific combinations of jets provides
thrust for:
Attitude control
Rotational maneuvers (pitch, yaw, roll)
Small velocity changes along the orbiter
axes (translational maneuvers)
Each RCS jet is identified by the propellant
manifold that supplies the jet and by the
direction of the jet plume. The first identifier
designates a jet as forward (F), left aft (L), or right
aft (R) RCS. The second identifier, number 1
through 5, designates the propellant manifold.
2.22-1

Left and Forward RCS Modules

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A
Manual RCS use is accomplished through the
rotational and translational hand controllers,
and automatic use is handled by the digital
autopilot (DAP) and the general purpose
computers (GPCs).
Nominal uses of the RCS occur during ascent,
orbit, and entry. During ascent, the RCS is used
for rotational control during mated coast with
the external tank. It is also used to provide Z
translation at external tank separation, using all
10 down (Z) primary jets. This is the only RCS
translational maneuver done automatically.
The RCS is also used during ascent to maneuver
to OMS burn attitude and to trim residuals
post-burn, if required.

jets is side-firing, and the other set is downfiring. The primary RCS jets provide 870
pounds of vacuum thrust each, and the vernier
RCS jets provide 24 pounds of vacuum thrust
each for precise maneuvering. The vernier jets
are used for tight attitude dead bands and fuel
conservation.

During orbit, the RCS provides attitude control,

including pointing and attitude hold, and
rendezvous maneuvers.
During entry, the RCS provides for center of
gravity (c.g.) management through the forward
propellant dump. Also during entry, yaw, roll,
and pitch control is provided by the aft
left/right (Y) and up/down (Z) jets.
The RCS is also used during off-nominal
situations. In the case of loss of two SSMEs on
ascent, the OMS-to-RCS interconnect is
automatically commanded, and the RCS
provides single-engine roll control. If the OMS
gimballing system is not performing adequately
to control vehicle attitude during an OMS burn,
RCS jets are used to help maintain attitude.
This is also known as "RCS wraparound." The
RCS is also used to adjust an orbit if the OMS
fails prematurely. During aborts, the RCS may
be used to assist with ascent propellant dumps
to
decrease
vehicle
weight,
improve
performance, and control center of gravity.
NOTE
RCS jets assist in OMS and/or RCS
dumps by burning propellant in either
propulsive or non-propulsive (null)
burns.

RCS Jet Identification

NOTE
The loss of one down-firing vernier jet
results in the loss of the entire vernier
mode due to the loss of control authority.
If one side-firing vernier jet is lost, control
can be maintained, except for some RMSloaded operations.
Two helium tanks supply gaseous helium pressure to the oxidizer and fuel tanks. The
oxidizer and fuel are then supplied under
pressure to the RCS jets. Nitrogen tetroxide
(N2O4) is the oxidizer, and monomethyl
hydrazine (MMH) is the fuel. The propellants
are toxic, liquid at room temperature, and
hypergolic (they ignite upon contact with each
other). The propellants are supplied to the jets,
where they atomize, ignite, and produce a hot
gas and thrust.

There are a total of 44 RCS jets; 38 primary and

6 vernier. The vernier jets are only used on
orbit for fine attitude control. The forward RCS
has 14 primary and 2 side-firing vernier jets.
The aft RCS has 12 primary and 2 vernier jets in
each pod for a total of 28. One set of aft vernier
2. SYSTEMS
2.22 Reaction Control System (RCS)

2.22-2

CAUTION
On-orbit leak of MMH fuel may cause a
module fire on entry when MMH mixes
with atmospheric oxygen.

USA007587
Rev. A
The primary jets are operable in a maximum
steady-state mode of 1 to 150 seconds, with a
maximum single-mission contingency of 800
seconds for the RCS aft (+X) jets and 300 seconds maximum for the RCS forward (X) jets.
The multiple primary jets provide redundancy.
A single steady-state vernier firing of up to 275
seconds in any 2-hour period is allowed.
Vernier jets are used for finite maneuvers and
stationkeeping (long-time attitude hold). The
vernier jets are not redundant.
The forward RCS module and OMS/RCS pods
can be removed to facilitate orbiter turnaround,
if required.

Jet System
The jet system combines fuel and oxidizer to
produce hypergolic combustion (hot gas thrust).
The systems major components are the reaction
jet driver, fuel and oxidizer valves, injector head
assembly, combustion chamber, nozzle, and
electrical junction box.
The reaction jet driver converts GPC fire
commands into the required voltage for
opening the bipropellant valves, thus initiating
the combustion process.
The driver also
generates chamber pressure discretes and sends
them to redundancy management as an
indication of actual jet firings.
Each primary and vernier RCS jet has one fuel
and one oxidizer solenoid-operated pilot
poppet valve that is energized open by an
electrical thrust-on command, permitting the
propellant hydraulic pressure to open the main
valve poppet and allow the respective
propellant to flow through the injector into the
combustion chamber.
When the thrust-on
command is terminated, the valves are
deenergized and closed by spring and pressure
loads.
The injector assembly directs the flow of
propellants to the combustion chamber. The
primary thrusters have injector hole pairs (one
fuel, one oxidizer), called doublets, canted

toward each other for stream impingement of

the propellants in the combustion chamber.
Each primary jet has 84 doublets arranged in a
showerhead
circular
pattern
in
the
combustion chamber. Additional fuel holes are
provided near the outer edge of the injector
assembly for cooling the combustion chamber
walls.
Each of the six vernier RCS jets has a single pair
of fuel and oxidizer injector holes canted to
cause impingement of the fuel and oxidizer
streams for combustion.
The combustion chamber of each RCS jet is
constructed of columbium with a columbium
disilicide coating to prevent oxidation. The
nozzle of each RCS jet is tailored to match the
external contour of the forward RCS module or
the left and right aft RCS pods. The nozzle is
radiation-cooled, and insulation around the
combustion chamber and nozzle prevents the
excessive heat of 2,000 to 2,400 F from
radiating into the orbiters structure.
The electrical junction box for each RCS jet has
electrical connections for an electrical heater, a
chamber pressure transducer, oxidizer and fuel
injector temperature transducers (to detect
propellant leaks) for each valve, and the
propellant valves.
There is a small possibility of random but
infrequent combustion instability of the
primary RCS jets, causing a burnthrough in the
combustion chamber wall of an RCS primary jet
in a very few seconds. An instability protection
system is incorporated into each of the 38
primary RCS jets. The electrical power wire of
each primary RCS jet fuel and oxidizer valve is
wrapped around the outside of each primary
RCS jet combustion chamber wall. If instability
occurs within a primary RCS jet, the
burnthrough would cut the electrical power
wire to that primary RCS jets valves, remove
electrical power to the valves, close the valves,
and render the jet inoperative for the remainder
of the mission.

2.22-3

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

Primary Jet

Vernier Jet

Propellant System
The system that distributes the propellants to
the RCS jets consists of fuel and oxidizer tanks,
tank isolation valves, manifold isolation valves,
crossfeed valves, distribution lines, and filling
and draining service connections.
Propellant Tanks
Each RCS module contains two propellant
tanks, one for fuel and one for oxidizer. The
nominal full load of the forward and aft RCS
tanks in each pod is 1,464 pounds in the
oxidizer tanks and 923 pounds in the fuel tanks.
Each tank is pressurized with helium, which
expels the propellant into an internally
mounted,
surface-tension,
propellant
acquisition device that acquires and delivers the
propellant to the RCS jets. The propellant
acquisition device is required because of the
2. SYSTEMS
2.22 Reaction Control System (RCS)

orbiters orientation during ascent, on orbit, and

during entry. The device is also needed to deal
with the various accelerations, which range from
very high during ascent, entry, or abort to very
low during orbital operation. The forward RCS
propellant tanks have propellant acquisition
devices designed to operate primarily in a lowgravity environment, whereas the aft RCS
propellant tanks are designed to operate in both
high and low gravity, ensuring adequate
propellant flow during all phases of flight. A
compartmental tank with individual wire mesh
screen devices in both the upper and lower
compartments supplies propellant independent
of tank load or orientation. A barrier separates
the upper and lower compartments in each
tank.
The aft RCS propellant tanks incorporate an
entry collector, sumps, and gas traps to ensure
proper operation during abort and entry
mission phases.

2.22-4

USA007587
Rev. A

RCS/OMS/PRESS Meters and Rotary Switch and

RCS/OMS PRPLT QTY LEDs and Switch on Panel O3
(Note: Information on these meters is from a different source
than the information on PASS GNC SYS SUMM 2)
The left, forward, and right RCS fuel and
oxidizer tank ullage pressures (pressures within
an RCS propellant tank used for expelling
propellant and calculating propellant volume)
can be monitored on panel O3. When the lefthand rotary switch on panel O3 is positioned to
RCS PRPLT, the pressures are displayed on the
three RCS/OMS/PRESS meters. The LEFT
RCS, FWD RCS, or RIGHT RCS red caution and
warning light on panel F7 will illuminate if a
modules tank ullage pressure is less than 200
psia or higher than 300 psia.

the usable (rather than total) quantity for each

module and makes it possible to determine if
the difference between each pair of tanks
exceeds a preset tolerance (leak detection).
The sequence assumes that helium flows to the
propellant tanks to replace propellant leaving.
As a result, the computed quantity remaining in
a propellant tank will be decreased by normal
usage, propellant leaks, or helium leaks.
NOTE
Erroneous temperature and/or pressure
transducer readings will cause erroneous
propellant quantity calculations.

RCS Propellant Quantity

The RCS quantity monitor uses the GPC to
calculate the usable percent of fuel and oxidizer
in each RCS module.
The quantities are
computed based on the pressure, volume, and
temperature method, which requires that
pressure and temperature measurements be
combined with a unique set of constants to
calculate the percent remaining in each of the
six propellant tanks. Correction factors are
included for residual tank propellant at
depletion, gauging inaccuracy, and trapped line
propellant. The computed quantity represents

The left, right, and forward RCS fuel and

oxidizer quantities are displayed to the flight
crew by the RCS/OMS PRPLT QTY LEDs on
panel O3. When the rotary switch on panel O3
below the LEDs is positioned to the RCS FUEL
or OXID position, the LEDs will indicate, in
percent, the amount of fuel or oxidizer. If the
switch is positioned to RCS LOWEST, the
gauging system selects whichever is lower (fuel
or oxidizer) for display on the LED.

2.22-5

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A
The left, right, and forward RCS quantities also
are sent to PASS GNC SYS SUMM 2 (RCS L
QTY, R QTY, FWD QTY), and in the event of
failures, substitution of alternate measurements
and the corresponding quantity will be displayed.
If no substitute is available, the
quantity calculation for that tank is suspended
with a fault message.
The sequence also provides automatic closure of
the high-pressure helium isolation valves on
orbit when the propellant tank ullage pressure
is above 300 psia. When the tank ullage
pressure returns below these limits, the close
command is removed.

PASS GNC SYS SUMM 2 Display

Exceeding a preset absolute difference of 9.5
percent between the fuel and oxidizer propellant quantities will illuminate the respective
LEFT RCS, RIGHT RCS, or FWD RCS red caution and warning light on panel F7, activate the
BACKUP C/W ALARM, and cause a fault message to be sent to the DPS display. A bias of 9.5
percent is added when a leak is detected so that
subsequent leaks in that same module may be
detected in the PASS. BFS will annunciate a
leak only once.
Tank Isolation Valves
The valves located between the propellant tanks
and the manifold isolation valves isolate the
propellant tanks from the remainder of the propellant distribution system.
The isolation
valves are ac-motor-operated and consist of a
lift-off ball flow control device and an actuator
assembly that contains a motor, gear train, and
2. SYSTEMS
2.22 Reaction Control System (RCS)

actuator gear. One pair of valves (one fuel and

one oxidizer) isolates the propellant tanks from
the 1/2 manifold (manifolds are referenced by
number: 1/2/3/4/5) in the forward and aft left
and right RCS. One pair of valves isolates the
propellant tanks from the 3/4/5 manifold in the
forward RCS. Two pairs of valves, in parallel,
identified as A and B, isolate the propellant
tanks from the 3/4/5 manifold in the aft left
and right RCS.
The forward RCS tank isolation valves are
controlled by the FWD RCS TANK ISOLATION
1/2 and 3/4/5 switches on panel O8. The aft left
RCS tank isolation valves are controlled by the
AFT LEFT RCS TANK ISOLATION 1/2 and 3/4/5
A and B switches on panel O7, and the aft right
tank isolation valves are controlled by the AFT
RIGHT RCS TANK ISOLATION 1/2 and 3/4/5 A
and B switches on panel O7. These permanentposition switches have three settings: OPEN,
GPC, and CLOSE.
When the FWD RCS TANK ISOLATION 1/2 and
3/4/5 switches on panel O8 are positioned open,
fuel and oxidizer from the propellant tanks are
allowed to flow to the corresponding manifold
isolation valves. Electrical power is provided to
an electrical motor controller assembly that
supplies power to the ac-motor-operated valve
actuators. Once the valve is in the commanded
position, logic in the motor controller assembly
removes power from the actuator.
Microswitches in each pair of valves control
talkback indicators above each tanks isolation
switch on panel O8. The talkback indicator
shows OP or CL when that pair of valves is
open or closed and barberpole when the valves
are in transit, or one valve is open, and the other
is closed, or for some microswitch failures. The
OPEN and CLOSE positions of the FWD RCS
TANK ISOLATION 1/2 and 3/4/5 switches on
panel O8 permit manual control of the
corresponding pair of valves. The GPC position
is not supported in the Forward RCS.
The OPEN, GPC, and CLOSE positions of the
AFT LEFT RCS TANK ISOLATION 1/2 and 3/4/5
A and B and AFT RIGHT RCS TANK
ISOLATION 1/2 and 3/4/5 A and B switches on
panel O7 are the same type as those of the
forward RCS tank isolation switches and are

2.22-6

USA007587
Rev. A
controlled electrically in the same manner. A
talkback indicator above each switch indicates
the position of the pair of valves as in the
forward RCS. The 3/4/5 A and B switches
control parallel fuel and oxidizer tank isolation
valves to permit or isolate propellants to the
respective aft left and aft right RCS manifold
isolation valves 3, 4, and 5.
The aft tank isolation valves can be commanded
open or closed when in the GPC position in OPS
1, 3 and 6 for auto-crossfeed purposes.
Manifold Isolation Valves
The forward RCS manifold isolation valves are
between the tank isolation valves and the
forward RCS jets. The valves for manifolds 1, 2,
3, and 4 are the same type of ac-motor-operated
valves as the propellant tank isolation valves
and are controlled by the same type of motorswitching logic. The forward RCS manifold
valve pairs are controlled by the FWD RCS
MANIFOLD ISOLATION 1, 2, 3, 4, and 5
switches on panel O8. Each MANIFOLD
ISOLATION switch controls a pair of valves
(one fuel and one oxidizer), which allow
propellant to flow to the jets on the
corresponding manifold. A talkback indicator
above each of the five switches on panel O8
indicates the status of that pair of valves. The
talkback indicator is controlled in the same
manner as the tank isolation valve indication.
The OPEN and CLOSE positions of the switch
permit control the corresponding oxidizer and
fuel valves.
The GPC position is only
supported in OPS 2 and 8.

The FWD RCS MANIFOLD ISOLATION 5

switch on panel O8 controls the manifold 5 fuel
and oxidizer valves, which control propellants
for the forward vernier RCS jets only. The
switch is spring-loaded in the GPC position.
When the switch is moved to the OPEN position, electrical power is momentarily applied
through logic in an electrical load controller assembly to energize the solenoid valves open
and magnetically latch the valves. To close the
valves, electrical power is momentarily applied
to energize the solenoids surrounding the magnetic latches of the valves, which allows spring
and propellant pressure to force the valves
closed. A position microswitch in each valve
indicates valve position to an electrical
controller assembly and controls a talkback
indicator above the switch. When both valves
are open, the indicator shows OP; when both
are closed, it indicates CL. If one valve is open,
and the other is closed, the talkback indicator
shows barberpole.

When the Shuttle is docked to the ISS (or any

large payload) in OPS 2, a jet fail on could cause
structural failure at the joints or to the less
robust portions of the docked stack. The
GPCs can automatically close the affected
manifold in OPS 2 or 8 if a jet fail on is
annunciated, PROVIDED the AUTO MANF CL
capability has been enabled via SPEC 23 and the
switch is in the GPC position.
NOTE
The manifold isolation valves have a
backflow capability when the manifold is
closed, and the manifold pressure is 30 to
50 psi higher than the tank leg.

FWD RCS TANK ISOLATION and

MANIFOLD ISOLATION Switches and
Talkbacks on Panel O8

2.22-7

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

AFT TANK ISOLATION, AFT MANIFOLD ISOLATION, and RCS CROSSFEED

Switches and Talkbacks on Panel O7
The AFT LEFT RCS MANIFOLD ISOLATION 1,
2, 3, 4, 5 and AFT RIGHT RCS MANIFOLD
ISOLATION 1, 2, 3, 4, 5 switches are on panel
O7. The OPEN, GPC, and CLOSE positions of
each switch are the same type as the forward
switches and are controlled electrically in the
same manner. The OPS 2 and 8 auto-manifold
close capability for jet fail on is identical to the
Forward RCS. The AFT LEFT and AFT RIGHT
RCS MANIFOLD 1, 2, 3, and 4 switches provide
corresponding tank propellants to the
applicable primary RCS jets or isolate the
propellants from the jets. The AFT LEFT and
AFT RIGHT RCS MANIFOLD 5 switches
provide corresponding tank propellants to the
applicable vernier RCS jets or isolate the
propellants from the jets.
RCS Crossfeed Valves
If either aft RCS pods propellant system must be
isolated from its jets, the other aft RCS propellant
system can be configured to crossfeed propellant.
The aft RCS crossfeed valves that tie the crossfeed
2. SYSTEMS
2.22 Reaction Control System (RCS)

manifold into the propellant distribution lines

below the tank isolation valves can be configured
so that one aft RCS propellant system can feed
both left and right RCS jets. The aft RCS
crossfeed valves are ac-motor-operated valve
actuators and identical in design and operation to
the propellant tank isolation valves. The aft RCS
crossfeed valves are controlled by the AFT LEFT
and AFT RIGHT RCS CROSSFEED 1/2 and 3/4/5
switches on panel O7. The positions of the four
switches are OPEN, GPC, and CLOSE. The GPC
position allows the orbiter computer to
automatically control the crossfeed valves, and
the OPEN and CLOSE positions enable manual
control. The OPEN position of the AFT LEFT
RCS CROSSFEED 1/2 and 3/4/5 switches
permits the aft left RCS to supply propellants to
the aft right RCS crossfeed valves, which must
be opened by placing the AFT RIGHT RCS
CROSSFEED 1/2 and 3/4/5 switches to the OPEN
position for propellant flow to the aft right RCS
jets. (Note that the AFT RIGHT receiving RCS
TANK ISOLATION 1/2 and 3/4/5 A and B valves

2.22-8

USA007587
Rev. A
must be closed.) The CLOSE position of the
AFT LEFT and AFT RIGHT RCS CROSSFEED
1/2 and 3/4/5 switches isolates the crossfeed
capability. The crossfeed of the aft right RCS to
the left RCS would be accomplished by
positioning the AFT RIGHT and LEFT RCS
CROSSFEED switches to OPEN and positioning
the AFT LEFT RCS TANK ISOLATION 1/2 and
3/4/5 A, B switches to CLOSE.

Helium System
Each RCS has two helium storage tanks, four
helium isolation valves, four pressure regulators, two check valves, two relief valves, and
servicing connections for draining and filling.
Helium Tanks
The two helium tanks in each RCS supply gaseous helium individually, one to the fuel tank
and one to the oxidizer tank.
NOTE
The helium tanks provide ullage pressure
for the propellant tanks. Each propellant
tank has a specific quantity where, should
the helium tank fail, the nominal ullage
pressure would result in the maximum
delta V. This quantity is referred to as
max blowdown. Max blowdown for the
forward RCS is 22 percent; for the aft
RCS, it is 24 percent propellant quantity
remaining.

helium line and one in the fuel helium line. The

switch positions are OPEN, GPC, and CLOSE.
When the switch is positioned to GPC, the pair
of valves can be closed automatically upon
command from the orbiter computer. The
OPEN/CLOSE positions permit manual control
of that pair of valves.
Electrical power is momentarily applied
through logic in an electrical load controller
assembly to energize the two helium isolation
solenoid valves open and to magnetically latch
the valves open. To close the two helium
isolation valves, electrical power is momentarily
applied through the load controller to energize a
solenoid surrounding the magnetic latch of the
two helium isolation valves, which allows spring
and helium pressure to force the valve closed.
A position microswitch in each valve indicates
valve position to an electrical controller assembly and controls a position indicator (talkback)
above each switch on panels O7 and O8. When
both valves (helium fuel and helium oxidizer)
are open, the talkback indicates OP; when both
valves are closed, the talkback indicates CL. If
one valve is open, and the other is closed, the
talkback indicates barberpole.
The RCS helium supply pressure is monitored
on panel O3. When the rotary switch on panel
O3 is positioned to RCS He X10, the forward
and aft RCS helium pressures are displayed on
the RCS/OMS/PRESS OXID and FUEL meters
on panel O3.

Helium Isolation Valves

Two parallel helium isolation valves are located
between the helium tanks and the pressure
regulators in each RCS. When open, the helium
isolation valves permit the helium source
pressure to flow to the propellant tank. The
helium isolation valves are controlled by the
FWD RCS He PRESS A and B switches on panel
O8 and the AFT LEFT RCS He PRESS A and B
and AFT RIGHT RCS He PRESS A and B
switches on panel O7. Each switch controls two
helium isolation valves, one in the oxidizer

Helium Pressure Regulators

Helium pressure is regulated by two regulator
assemblies, connected in parallel, downstream
of the helium isolation valves. Each assembly
contains two stages, a primary and a secondary,
connected in series. If the primary stage fails
open, the secondary stage regulates the pressure. The primary regulates the pressure at 242
to 248 psig, the secondary at 253 to 259 psig.

2.22-9

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

AFT RCS He PRESS Switches and Talkbacks on Panel O7

FWD RCS He PRESS Switches and Talkbacks

on Panel O8
2. SYSTEMS
2.22 Reaction Control System (RCS)

RCS/OMS Meters and Rotary Switch on

Panel O3
(Note: Information on these meters is the
same as the information on SPEC 23 and BFS
GNC SYS SUMM 2)

2.22-10

USA007587
Rev. A
Check Valves
The check valve assembly, which consists of
four poppets in a series-parallel arrangement, is
located between the pressure regulator
assemblies and the propellant tank. The series
arrangement limits the backflow of propellant
vapor and maintains propellant tank pressure
integrity in the event of an upstream helium
leak. The parallel arrangement ensures the flow
of helium pressure to the propellant tank if a
series check valve fails in the closed position.
Pressure Relief Valve
A helium pressure relief valve assembly located
between the check valve assemblies and propellant tank will vent excessive pressure overboard before it reaches the propellant tank.
Each valve consists of a burst diaphragm, filter,
and relief valve. The non-fragmentation diaphragm, which provides a positive seal against
helium leakage, will rupture between 324 and
340 psig. The filter prevents any particles of the
burst diaphragm from reaching the relief valve
seat. The relief valve relieves at 315 psig minimum and reseats at 310 psig. The relief valve is
sized to handle, without damaging the propellant tank, helium pressure flow volume if a
regulator malfunctions to a full-open position.

Thermal Control
Electrical heaters are provided in the forward
RCS module and the OMS/RCS pods to
maintain the propellants in the module and
pods at safe operating temperatures and to
maintain safe operating temperatures for the
injector of each primary and vernier RCS jet.
Each primary RCS jet has a 20-watt heater,
except the four aft-firing jets, which have 30watt heaters. Each vernier RCS jet has a 10-watt
heater.
The forward RCS has six heaters mounted on
radiation panels in six locations.
Each
OMS/RCS pod is divided into nine heater
zones. Each zone is controlled in parallel by an
A and B heater system. The aft RCS jet housing

contains heaters for the yaw, pitch up, pitch

down, and vernier jets in addition to the aft
OMS/RCS drain and purge panels.
The forward RCS panel heaters are controlled
by the FWD RCS switch on panel A14. When
the switch is positioned to A AUTO or B AUTO,
thermostats on the forward left-side panel and
right-side panel automatically control the respective forward RCS heaters. When the respective forward RCS panel temperature
reaches a minimum of approximately 55 F, the
respective panel heaters are turned on. When
the temperature reaches a maximum of approximately 75 F, the heaters are turned off.
The OFF position of the switch removes all
electrical power from the forward RCS heaters.
The aft RCS heaters are controlled by the LEFT
POD A AUTO and B AUTO and RIGHT POD A
AUTO and B AUTO switches on panel A14.
When the switches are positioned to either A
AUTO or B AUTO, thermostats automatically
control the nine individual heater zones in each
pod.
Each heater zone is different, but
generally
the
thermostats
control
the
temperature between approximately 55 F
minimum to approximately 75 F maximum.
The OFF position of the respective switch
removes all electrical power from that pod
heater system.
The forward and aft RCS primary and vernier
jet heaters are controlled by the FWD and AFT
RCS JET 1, 2, 3, 4, and 5 switches on panel A14.
When the switches are positioned to AUTO,
individual thermostats on each jet automatically
control the individual heaters on each jet. The
primary RCS jet heaters turn on between
approximately 66 to 76 F, and they turn off
between approximately 94 to 109 F. The
vernier RCS jet heaters turn on between
approximately 140 to 150 F and off between
approximately 184 to 194 F. The OFF position
of the switches removes all electrical power
from the jet heaters. The 1, 2, 3, 4 and 5
designations refer to propellant manifolds.
There are two to four jets per manifold.

2.22-11

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

usa007587_678r1.cvx

SPEC 23 RCS Display

RCS/OMS HEATERS Switches on Panel A14

RCS Redundancy Management

RCS redundancy management (RM) software
includes RCS jet failure detection and
annunciation, jet availability, SPEC 23 RCS,
SPEC 51 BFS OVERRIDE, and manifold status
processing.
Jet failure modes detected and annunciated are
fail-off, fail-on, and fail-leak.
Fault
annunciation is a class 2 alarm consisting of a
master alarm, illumination of the yellow RCS
JET and red BACKUP C/W ALARM lights on
panel F7, and a fault summary message (F (L,R)
RCS A (D, R, U) JET).

SPEC 51 BFS OVERRIDE Display

Jet Fail-Off
Detection:
CMD B present with no Pc Discrete for
three consecutive cycles.

All statuses, flags, counters, and related RCS

RM data are carried across OPS transitions.
However, when BFS is engaged, all flags,
statuses, and counters are cleared and
reinitialized.
The jet parameters used in RM are the Pc
discrete, CMD B, driver out discrete, and the
oxidizer and fuel injector temperatures. Pc
discrete is turned on when the jet chamber
pressure reaches 36 psi and remains on until the
chamber pressure falls below 26 psi. Individual
fail detection and response parameters are as
follows.

2. SYSTEMS
2.22 Reaction Control System (RCS)

RM is suspended for an MDM or LRU

commfault.
RM is unable to detect a fail-off jet when
the Pc transducer is failed high.
RM Response:

2.22-12

Fail-off flag is set.

Message is annunciated.
Jet is deselected unless the pod limit has
been reached.

USA007587
Rev. A
Jet Fail-Leak

Jet Fail-On
Detection:

Detection:

Either oxidizer or fuel injector temperature is below the RCS RM injector

temperature limit for three consecutive
cycles.

Driver out discrete is present when a

CMD B is not issued for three consecutive cycles.
RM is suspended for an MDM or LRU
commfault.

RM is suspended for an MDM or LRU

commfault.

RM is unable to detect a fail-on jet when

the driver out discrete is failed low.

RM is unable to detect a fail-leak jet for

a failed-high temperature transducer.

RM Response:

A failed-low injector temperature transducer will trip RM.

Fail-on flag is set.

Message is annunciated.

RM Response:

In OPS 2 (8) a closed command is sent to

the affected manifold valves if AUT
MANF CL is enabled.

Fail-leak flag is set.

Message is annunciated.
Jet is deselected unless the pod limit has
been reached.
Once RM has annunciated a failure for a jet, that
failure will not be reannunciated until the fail
flag is reset. The remaining failure modes that
were not detected can be annunciated. Vernier
jet failures are annunciated in OPS 2 and 8 only.

2.22-13

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

Fire
CMD B

Fire
CMD A
Fire CMD A

DAP

Fire CMD B

MDM
MDM

Reaction
Jet Driver
DET

DSC
MDM

MDM

DSC
PC
Discrete
Des INH
Crew
Manifold
Switches
Motor
Control
Assy

Jet
Jet DES Avail/Priority
Tables

Jet
Fail
Off

Valve
Discretes

Jet
Fail
On

Manifold
Status

Jet
O1 PC

DR Out
Discrete

Manifold
Status
OVRD

MDM

Spec
23

FCOS

Jet
Fail
Leak

Commfaults

Jet INJ T'S

Jet
INJ T'S
Spec
51

742.cvs

RCS Redundancy Management Schematic

Nomenclature
To clarify nomenclature, a few RCS RM
definitions are listed below.
Deselected Jet A jet that is not available and
will not be commanded to fire.
Reselected Jet A jet that was previously not
available and is now available and could be
commanded to fire.
Auto-Deselected Jet A jet that has been
deselected by RCS RM software. RM will autodeselect a jet for fail-off and fail-leak detection.
Manually Deselected Jet A jet that has been
deselected by SPEC 23 item entry.
Manually Reselected Jet A jet that is
reselected via SPEC 23 item entry. This is the
only method to reselect an individual jet that
was auto-deselected by RCS RM. (A whole
manifold of jets can be reselected via SPEC 51
and SPEC 23 item entry.)

2. SYSTEMS
2.22 Reaction Control System (RCS)

Pod Counter The internal RCS RM counter

that counts the number of jets per pod that have
been auto-deselected by RCS RM.
Pod (Fail) Limit The PRI JET FAIL LIM on
SPEC 23 (item 4) that limits the number of
primary jets that can be auto-deselected per
pod.
Pod Counter is Full Pod counter equals pod
fail limit. Typically, this means two jets have
failed and have been auto-deselected in a pod.
Override a Manifold Open (Closed) An
action performed via item entry on SPEC 23 that
toggles the RCS RM manifold status to open
(closed). The RCS RM manifold status is an
independent variable that may differ from the
actual manifold valve position. Overriding a
manifold closed will deselect all the jets on that
manifold.
Deselection Candidate Any jet that is
annunciated fail-off or fail-leak by RCS RM

2.22-14

USA007587
Rev. A
becomes a deselection candidate, unless the jet
has been deselect inhibited.
Jet Availability Table An array that contains
a bit for each jet. The bit is on if the associated
jet is available and may be commanded to fire
by DAP. The bit is off when the jet is not
available as determined by RCS RM.
Unavailable jets will not be commanded to fire.
Jet Pod Counter and Pod Limit
RCS SPEC 23 displays the PRI JET FAIL LIM.
This limit is the number of primary jets that RCS
RM will deselect for the pod (forward, left, or
right) currently displayed on SPEC 23. This
number
is
I-loaded to 2 and can be changed via SPEC 23.
RCS RM will auto-deselect primary jets until the
pod counter equals the pod limit. RM will
continue to annunciate all jet failures not
previously annunciated when the pod counter
is full; however, no new jets will be autodeselected.
Manually reselecting an auto-deselected jet will
reduce the pod counter by one. Manually
reselecting a jet that was manually deselected
via SPEC 23 will not have an impact on the pod
counter.
The pod counter is not affected by subsequent jet
failures on a previously deselected jet.
Decreasing the pod limit does not reselect jets. If
the pod limit is at two, and two jets are currently
auto-deselected, changing the limit to one will
not reselect one of the auto-deselected jets.
Once a jet is annunciated fail-off or fail-leak,
that jet is a deselection candidate. Assume the
pod limit is two. If the pod counter is full, and a
third (or more) jet becomes a deselect candidate,
this jet will not be auto-deselected, as expected.
If one of the jets on the same pod is then manually reselected, the pod counter is decremented
to one, also as expected. However, the deselection candidate that could not previously be
auto-deselected since the pod counter was at the
limit will now be auto-deselected, and the pod
counter will be incremented to two again. All
deselect candidates remain deselectable until
their fail-flags are cleared.

RCS Manifold RM
RCS RM contains an independent evaluation of
RCS manifold valve status.
Input to this
processing includes the actual manifold valve
status, commfault protection, and crew display
item entry processing. The RCS RM manifold
status can differ from the actual valve positions.
Manifold status is reevaluated when valve
discretes change, a commfault occurs, or
manifold status is changed by crew display item
entries. A commfault is declared when the data
path for the manifold valve microswitch
discrete is failed. A commfault occurs when an
MDM or GPC fails, or a BCE BYPASS is
declared.
If RCS RM sets the manifold status to closed, all
jets on the affected manifold will be removed
from the availability table. Manifold status is
set to closed by RCS RM in four cases:
manually closing the valve, commfault, crew
display item entry, and some dilemma cases.
RCS RM will set the manifold status to closed
for MDM commfaults on the associated
microswitch channelization. An I/O RESET
will force RCS RM to reevaluate the manifold
status. Thus, if an I/O RESET clears the
commfault, the manifold status will be set to
open.
Crew item entries on SPEC 23 can toggle a
manifold status open or closed.
RCS Manifold RM can detect two failure modes:
power fail and dilemma. Input to these failure
detection processes are the four manifold
microswitch discretes: OX OP, OX CL, FU OP,
and FU CL.
Actual electrical bus voltages are not used in
power fail determination. The manifolds are
paired by common microswitch buses, and
power fails are issued only if both manifolds
indicate loss of power to their microswitches.
RCS RM Manifold Dilemma
Detection Three cases of microswitch
indications result in an RCS RM manifold
dilemma:

2.22-15

1 OP indication + 1 or 0 CL indications
2 OP indications + 2 CL indications
2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A
0 OP indications + 0 CL indications
(FRCS manifolds 1, 2, 4, and 5 only)
Indications
can
be
OX
and/or
FU
microswitches. These conditions must exist for
three consecutive passes.
RM Response Issue RCS RM DLMA
message.
In summary, if the number of open indications
is greater than the number of closed indications,
the manifold status is open; otherwise, the
manifold status is closed.
RCS Manifold Power Fail
Detection All four manifold microswitch
discretes are 0 for six consecutive passes.
Power fail processing is performed on the
following manifold pairs: FRCS M3/4, ARCS
L1/R1, L2/R2, L3/R3, L4/R4, and L5/R5.
RM Response Issue RCS PWR FAIL
message. Manifold status is unchanged.
Forward manifolds 1, 2, and 5 are not analyzed
for power fail conditions. If these manifolds
suffer a power fail to their microswitches, an
RCS RM DLMA will be issued, rather than an
RCS PWR FAIL.
Forward manifold 3 microswitches are
redundantly powered by MN A FPC1 and MN
C FMC3. Forward manifold 4 microswitches
are powered only by MN C FMC3. Both MN A
FPC1 and MNC FMC3 must be lost for RCS RM
to issue a power fail for this manifold pair.
Because of the low probability of this case,
forward manifold 3/4 power fails are rarely
detected. However, for the loss of MN C FMC3,
an RCS RM DLMA message is annunciated,
FRCS manifold 4 is declared closed, and the
associated jets are declared unavailable.
Jet Selection
The DAP jet-select module contains default logic
in certain instances. When the orbiter is mated to
the ET, roll rate default logic inhibits roll rotation,
and yaw commands are normally in the direction
of favorable yaw-roll coupling. During insertion,
a limit of seven aft RCS jets per tank set applies
for ET separation and for return-to-launch-site
aborts. If negative Z and plus X translation
2. SYSTEMS
2.22 Reaction Control System (RCS)

commands are commanded simultaneously, both

will be degraded. A limit of four aft RCS jets per
tank set normally applies. If plus X and negative
Z translations are commanded simultaneously,
plus X is given priority. Multi-axis translation
and rotation commands may require more jets
than allowed and result in degraded control and
excessive propellant usage. The DAP jet-select
module determines which aft RCS jets (right,
left, or both) must be turned on in response to
the pitch, roll, and yaw jet commands from the
entry flight control system. The forward RCS
jets are not used during entry. After entry
interface, only the four Y-axis and six Z-axis
RCS jets on each aft RCS pod are used. No
X-axis or vernier jets are used. The DAP sends
the discretes that designate which aft RCS jets
are available for firing (a maximum of four RCS
jets per pod may be fired).
During
reconfiguration, or when the RCS crossfeed
valves are open, the DAP determines the
maximum combined total number of yaw jets
available during certain pitch and roll
maneuvers.
During ascent or entry, the DAP jet-select logic
module in the flight control system receives
both RCS rotation and translation commands.
By using a table lookup technique, the module
outputs 38 jet on/off commands to the RCS
command subsystem operating program, which
then generates dual fire commands A and B to
the individual RCS reaction jet drivers to turn
each of the 38 primary RCS jets on or off. The
fire commands A and B for each of the 38
primary RCS jets are set equal to the digital
autopilot RCS commands.
Commands are
issued to the six RCS vernier jets similarly
on orbit.
Jet Fire Indications
ROLL, PITCH, and YAW white indicator lights
on panel F6 indicate the presence of an RCS
command during orbit and early entry. The
indicators are L and R for roll and yaw left or
right and U and D for pitch up and down.
From entry interface until the dynamic pressure
is greater than 10 pounds per square foot, the
ROLL L and ROLL R lights indicate that left or
right roll commands have been issued by the
digital autopilot.
The minimum light-on

2.22-16

USA007587
Rev. A
duration is extended to allow the light to be
seen even for a minimum impulse firing. When
a dynamic pressure of 10 pounds per square
foot has been sensed, neither ROLL light will be
illuminated until 50 pounds per square foot has
been sensed, and more than two RCS yaw jets
are commanded on.

target data in the onboard general-purpose

computers can be modified by the flight crew
via the DPS and keyboard, if necessary, before
the OMS burn.
The OMS-2 burn uses both OMS engines to
raise the orbiter to a predetermined circular
orbit. (OMS-1 burns are only planned for
standard insertions.) During the OMS-2 burn,
vehicle attitude is maintained by gimbaling
(swiveling) the OMS engines.
The RCS
normally does not operate during an OMS burn.
If, during an OMS burn, the gimbal rate or
gimbal limits are exceeded, RCS roll control
would be required; or if only one OMS engine is
used during a burn, RCS roll control may be
required.
Upon completion of the OMS-2 burn, the RCS
can be used to null any residual velocities, if
required. It is then used for attitude hold and
minor translation maneuvers as required for onorbit operations. The flight crew can select
primary or vernier RCS jets for attitude control
in orbit. Normally, the vernier jets are selected
for on-orbit attitude hold.

Jet Fire Indicator Lights on Panel F6

The PITCH lights indicate up and down pitch jet
commands until a dynamic pressure of 20
pounds per square foot is sensed, after which the
pitch jets are no longer used. When 50 pounds
per square foot is sensed, the PITCH lights
assume a new function. Both PITCH lights will
be illuminated whenever the elevon surface drive
rate exceeds 20 per second (14 per second if
only one hydraulic system is remaining).
The YAW lights function as yaw jet command
indicators throughout entry until the yaw jets
are disabled at Mach 1 (approximately 45,000
feet). The YAW lights have no other function.

Operations
After main engine cutoff, the forward and aft
jets are used to maintain attitude hold until
external tank separation.
Then the RCS
provides a negative Z translation maneuver of
about 4 feet per second to move the orbiter
away from the external tank. Upon completion
of the maneuver, the RCS holds the orbiter
attitude until it is time to maneuver to the OMS2 burn attitude. Although the targeting data for
the OMS-2 burn are selected before launch, the

On orbit, the vernier jets are used for fine attitude

control, and the primary jets are used for coarse
attitude control and minor translations.
Before the deorbit burn, the flight crew
maneuvers the spacecraft to the desired attitude
using RCS jets. After the OMS burn, the RCS is
used to null any residual velocities, if required.
The spacecraft is then maneuvered to the proper
entry interface attitude using the RCS. The
remaining propellants aboard the forward RCS
may be dumped by burning the propellants
through the forward RCS yaw jets before entry
interface if orbiter center-of-gravity control is
necessary.
The RCS aft (+ X) jets can be used to complete
any OMS deorbit burn if an OMS engine fails.
In this case, the OMS-to-aft-RCS interconnect
can be used to feed OMS propellant to the aft
RCS.
From an entry interface of 400,000 feet, the
orbiter is controlled in roll, pitch, and yaw with
the aft RCS jets. The orbiters ailerons are used
starting at a dynamic pressure (q-bar) of 2
pounds per square foot (psf), and the aft RCS

2.22-17

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A
roll jets are deactivated at a q-bar of 10 psf. At a
q-bar of 2 psf, the orbiters elevons are active,
and the aft RCS pitch jets are deactivated at a

q-bar of 40 psf. The rudder is activated at Mach

5.0, and the aft RCS yaw jets are deactivated at
Mach 1 (approximately 45,000 feet).

RCS activity

RCS activity

RCS activity

Circularization
Insertion
FRCS Activity
at SRB SEP Window Protect

OMS-1
Second
stage

Powered
flight

MECO

Orbit

OMS-2
Deorbit
burn

ET separation

First
stage
SRB
separation
usa006163_006.cvx

Nominal Ascent Profiles

2. SYSTEMS
2.22 Reaction Control System (RCS)

2.22-18

USA007587
Rev. A

RCS Caution and Warning Summary

There are class 2 and 3 alerts for the RCS.
Class 2 alerts can occur in all the OPS and
generate a MASTER ALARM light and tone
and a light on the Caution and Warning
matrix on panel F7.
A class 3 alert is generated by the primary
GNC or SM software in OPS 2 and 8 or by
the BFS software in other OPS.
The red LEFT RCS, FWD RCS, or RIGHT RCS
light will illuminate if propellant tank ullage
pressure is less than 200 psia or higher than
312 psia. Exceeding a preset difference of 9.5
percent between fuel and oxidizer propellant
quantities
will
also
illuminate
the
appropriate one of these lights, activate the
BACKUP C/W ALARM, and send a fault
message to the DPS display.
RCS jet failure illuminates the yellow RCS
JET and red BACKUP C/W ALARM lights
and sends a fault message to the DPS
display.
An F(L,R) RCS X JET (where X=U,D,L,R,F or
A) fault message will be displayed in the
PASS when a jet fail ON, jet fail OFF, or jet
fail LEAK occurs. (OPS 1,2,3,6,8)

An F(L,R) RCS PVT fault message will be

displayed in the PASS when there is loss of
pressure or temperature data that is needed
for RCS quantity calculations. (OPS 2,3,8)
An F(L,R) RCS TK P fault message will be
displayed when propellant tank pressure
exceeds upper (312 psi) or lower (200 psi)
limits. (PASS OPS 2,8; BFS OPS 1,3,6)
A G23 RCS SYSTEM F(L,R) fault message
will be displayed in the PASS when propellant tank outlet pressure exceeds upper (300
psi) or lower (220 psi) limits or propellant
tank temperature exceeds upper (90 F) or
lower (50 F) limits. (OPS 2,8)
An RCS PWR FAIL fault message will be displayed in the PASS when there is loss of
valve logic power to the manifold isolation
valves. (OPS 1,2,3,6,8)
An RM DLMA MANF fault message will be
displayed in the PASS when a dilemma is
detected in the manifold valve status (FU and
OX valve positions disagree). (OPS 1,2,3,6,8)
An S89 PRPLT THRM RCS fault message
will be annunciated when the temperature in
the affected structure exceeds I-loaded upper
or lower limits. (OPS 2)

An F(L,R) JET fault message will be

displayed in the BFS when a jet fail ON or jet
fail OFF occurs when the BFS is engaged.
(OPS 1,3,6)

O2 PRESS

FUEL CELL
REAC

FUEL CELL
STACK TEMP

FUEL CELL
PUMP
AC
OVERLOAD

(R)

CABIN ATM
(R)

FREON
LOOP

O2 HEATER
TEMP

MAIN BUS
UNDERVOLT

AC
VOLTAGE

AV BAY/
CABIN AIR

IMU

FWD RCS

RCS JET

(R)

H2 O LOOP

An F(L,R) He P fault message will be

displayed when helium pressure (FU or OX)
in the affected pod is below 500 psi. (PASS
OPS 2,8; BFS OPS 1,3,6)
An F(L,R) RCS LEAK fault message will be
displayed when propellant quantities (FU
and OX) in any one pod differ by more than
9.5 percent. (PASS OPS 2,3,8; BFS OPS 1,3,6)

H2 PRESS

RGA/ACCEL

AIR DATA

LEFT RCS

(R)

LEFT RHC
(R)

PAYLOAD
WARNING(R)
PAYLOAD
CAUTION
BACKUP C/W
ALARM (R)

GPC
PRIMARY C/W
APU
TEMP

RIGHT/AFT
RHC

RIGHT RCS
(R)

LEFT OMS

RIGHT OMS

(R)

FCS (R)
SATURATION

OMS KIT

FCS
CHANNEL

MPS

OMS TVC
(R)

(R)

APU
APU
HYD PRESS
OVERSPEED UNDERSPEED

RCS Caution and Warning Lights on Panel R7

2.22-19

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A
FWD RCS
He TK P
P
meter +
GNC 23 RCS

He
TK

He TK P

+ BFS

GNC SYS SUMM 2

B
He
PRESS

DUAL He
REGS

AFT RCS
He TK P
P
meter +
GNC 23 RCS

He
TK

He TK P

QUAD
CK
VLVS

+ BFS

GNC SYS SUMM 2

B
He
PRESS

RLF
VLV

DUAL He
REGS
TK P P
METER +

FU
(OXID)
TK

GNC 23 RCS
QUAD
CK
VLVS

BFS, GNC SYS SUMM 2

TK P
P

RLF
VLV
METER +

TK ISOL
1/2

GNC 23 RCS
+
FU
(OXID)
TK

MANF
P1 P

XFEED
1/2

Y
U
A

MANF
ISOL
2

MANF
P2 P

B TK ISOL
3/4/5

BFS, GNC SYS SUMM 2

TK ISOL
1/2

MANF
ISOL
1

P TK P

TK P
GNC SYS SUMM 2

GNC SYS SUMM 2

Y
U
D

MANF
ISOL
2

MANF
ISOL
3

MANF
ISOL
4

MANF
P1 P

MANF
P
P2

MANF
P
P3

MANF
P
P4

MANF
ISOL
4

MANF
P4 P
Y
D
A

L
U
D
F

TK ISOL
3/4/5

MANF
ISOL
3
MANF
P3 P

MANF
ISOL
1

R
U
D
F

L
R

P
Y
U
D

Y
D

XFEED
3/4/5
746.cnv

Reaction Control System

2.22 Reaction Control System (RCS)

R
D

MANF
ISOL
5

F7

2. SYSTEMS

L
U
D
F

MANF
ISOL
5

2.22-20

Panel O3

USA007587
Rev. A

2.22-21

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

Panel O7
2. SYSTEMS
2.22 Reaction Control System (RCS)

2.22-22

USA007587
Rev. A

Panel O8
2.22-23

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

Panel MA73C
2. SYSTEMS
2.22 Reaction Control System (RCS)

2.22-24

USA007587
Rev. A

Panel R14

usa007587_678r1.cvx

PASS GNC SYS SUMM 2 Display

SPEC 23 RCS DisplayRCS Summary Data

2.22-25

2. SYSTEMS
2.22 Reaction Control System (RCS)

USA007587
Rev. A

RCS Summary Data

RCS Rules of Thumb

The RCS consists of forward and aft systems

of control jets, propellant storage tanks, and
distribution networks located in three separate vehicle modules.

1% RCS prop = 1 fps V.

The forward module is in the nose area, and

the left and right aft modules are in the left
and right OMS/RCS pods near the tail of the
vehicle.
The forward RCS has 14 primary and two
vernier jets; the aft RCS has 12 primary and
two vernier jets per pod.
Primary jets provide 870 pounds each of vacuum thrust; vernier 24 each. The vernier jets
are only used on orbit for fine attitude
control.
Each jet is permanently fixed to fire in a general direction.
The selective firing of
individual jets or combinations of jets provides thrust for attitude control, rotational
maneuvers, and translational maneuvers.
Manual RCS use is through the rotational
and translational hand controllers, and
automatic use is handled by the digital
autopilot
and
the
general
purpose
computers.
Nominal uses of the RCS include mated
coast, ET separation, and trim residuals during ascent; attitude control and maneuvers in
orbit; and entry flight control and center of
gravity management.

1% RCS prop = 22 lb.

1,000 lbs of ARCS prop moves X c.g. 1.2. in, Y
c.g. 0.4 in.
1,000 lbs of FRCS prop moves X c.g.-3.5 in.
ARCS max blowdown qty 24%.
FRCS max blowdown qty 22%.
Loss of a single downfiring vernier jet is loss
of vernier mode.
If fuel tank pressure is 20 psi higher than the
oxidizer tank pressure, then verniers are nogo.
Always secure the RCS from the manifolds
up to the helium tanks.
Always open the RCS from the helium tanks
down to the manifolds.
A momentary barberpole talkback may be
seen when adjacent A or B RCS helium
isolation valves are operated due to vibration
form the operating valve.

Off-nominal uses include single-engine roll

control, RCS wraparound during OMS burn,
OMS completions, and abort dumps.
RCS jets are fueled with N2O4 and MMH.
The propellants are liquid at room
temperature and hypergolic.
Propellant quantities are monitored on panel
O3.
Most RCS control switches are distributed
over panel O7 and O8.
Thermal control switches are located on
panel A14.
RCS information display and control is
through the GNC SYS SUMM 2 and SPEC 23
RCS displays.

2. SYSTEMS
2.22 Reaction Control System (RCS)

2.22-26

USA007587
Rev. A

2.23

space for crewmembers to work on experiments

in a shirt-sleeve environment. Spacehab offers
the Space Shuttle Program several module
configurations to accommodate mission-specific
requirements.

SPACEHAB

CONTENTS
Description.............................................
Configurations.......................................
Flight Deck Interfaces ...........................
Command and Data Subsystem..........
Caution and Warning ...........................
Electrical Power Subsystem.................
Environmental Control Subsystem.....
Audio Communication Subsystem.....
Fire Suppression Subsystem................
Closed Circuit Television Subsystem.

2.23-1
2.23-1
2.23-2
2.23-2
2.23-2
2.23-2
2.23-3
2.23-3
2.23-3
2.23-3

Configurations

Description
The Spacehab module is a pressurized experiment carrier designed to augment space shuttle
middeck experiment accommodations and to
provide a pressurized volume for logistics
transfer to the International Space Station (ISS).
The Spacehab system consists of a module
flown in the orbiter payload bay that is
configured with middeck-type lockers, racks,
and/or the logistics transportation system (LTS)
to accommodate a variety of experiments and
equipment. The Spacehab module provides

All Spacehab configurations are connected to

the orbiter with standard orbiter payload
support resources from the cabin and payload
bay.
The Spacehab module provides
crewmembers with a place to carry logistics
and/or experiments and contains cooling,
power, and command and data provisions, in
addition to Spacehab housekeeping systems
(i.e., power distribution and control, lighting,
fire and smoke detection, fire suppression,
atmosphere control, status monitoring and
control, and thermal control).
The Spacehab configuration for logistics
mission to the ISS allows the Spacehab single
module to be mounted in a trunnion location to
accommodate the orbiter docking system (ODS)
in the forward payload bay. The module is
connected to the ODS using a Spacehab tunnel
adapter with extravehicular activity (EVA)
hatch, and a Spacehab tunnel segment.

Spacehab Configuration -- Typical ISS Mission

2.23-1

2. SYSTEMS
2.23 Spacehab

USA007587
Rev. A

Flight Deck Interfaces

Command and Data Subsystem

Several panels located on the flight deck allow

the crew to control and monitor Spacehab
subsystems operations. Those interfaces are
listed below with brief descriptions of their
primary functions.

The Spacehab command and data subsystem

(CDS) receives hardwired commands from the
orbiter SSP and Spacehab monitor and control
panel (MCP). The CDS can receive commands
for Spacehab subsystem and experiment
activation and deactivation from either ground
uplink or the orbiter DPS via the payload signal
processor (PSP) link. The Spacehab can also
receive commands from an orbiter-provided
microcomputer, the payload general support
computer (PGSC). The PGSC commanding
capability can be used only to command the
Spacehab video switching unit (VSU).

R1 Panel
The R1 panel controls the connection of
main dc power to the Spacehab via the
primary payload bus.
The R1 panel controls the connection of
essential and emergency power to the
Spacehab via auxiliary payload bus and
aft payload B bus.
The R1 panel controls the connection of
aft flight deck dc power (cabin payload)
to the Spacehab for system operations.
L1 Panel
The L1 panel controls the distribution of
orbiter Freon flow to the payload heat
exchanger to support Spacehab thermal
load requirements.
C3A5
The C3A5 panel provides controls to
activate the Spacehab fire suppression
subsystem (FSS) and H2O line heaters.
IDP
The orbiter DPS display allows the crew
to monitor and control Spacehab subsystems via the Spacehab displays and
SPECs (BFS display 206 SH Launch/
Entry, SM SPEC 214 SH ACT/DEAC,
and SM SPEC 215 SH ECS).

The data management unit (DMU) is the major

element of the Spacehab CDS. The DMU provides data acquisition and command functions for
the Spacehab module. The DMU also provides all
serial interfaces required for data transmission
between the Spacehab module and the orbiter.
The payload data interleaver (PDI) interface to
the DMU gives ground controllers the
capability to monitor Spacehab subsystem and
experiment telemetry.

Caution and Warning

The orbiter caution and warning (C&W) system
and Spacehab subsystems work together to alert
the crew if Spacehab subsystem equipment is
failing. When an alarm condition is detected,
the orbiter provides a signal that activates the
master alarm light in the Spacehab module.
The Spacehab C&W subsystem is defined in
three groups:
Class 1, Emergency C&W
Class 2, Hardware C&W/software
C&W
Class 3, Fault detection annunciation
(FDA)

L12 Panel
The L12 panel consists of the standard
switch panel (SSP) configurations to
support Spacehab activation, control,
and monitoring.

2. SYSTEMS
2.23 Spacehab

Electrical Power Subsystem

The Spacehab electrical power subsystem (EPS)
distributes direct current, alternating current,
and emergency current sources to subsystems
and experiment equipment. Main power is distributed via the power distribution unit (PDU).

2.23-2

USA007587
Rev. A
The PDU is the major component of the Spacehab EPS. The PDU receives and distributes
main dc, secondary dc, and 3-phase 115-volt ac
power from the orbiter. Also, the PDU distributes Spacehab inverter-generated, 3-phase
115-volt ac power to subsystem and experiment
equipment.
The emergency power received from both the
orbiter auxiliary A and aft payload B buses is
routed to the Spacehab fire suppression control
unit (FSCU) and the monitoring and control
panel (MCP).
Control and monitoring of the Spacehab EPS is
provided by hardwired interfaces to the SSP,
payload multiplexer/demultiplexer (PL MDM),
and by discrete inputs and outputs to the DMU.

Environmental Control Subsystem

The Spacehab environmental control subsystem
(ECS) controls the habitable environment and
provides heat rejection for subsystem and
experiment thermal control. The ECS provides
this capability during prelaunch, launch, on
orbit, entry, and postlanding mission phases.
The ECS controls atmospheric temperature
control and pressure limitation, contingency
depressurization, equipment thermal control,
smoke detection, fire suppression, experiment
vacuum venting, atmospheric monitoring, trace
contaminate removal, and emergency egress
breathing capability.

Audio Communication Subsystem

The audio communication subsystem (ACS) is
no longer flown on Spacehab missions to the
ISS.
Crew communications from inside
Spacehab are provided by the battery powered
speaker microphone unit (BPSMU).
The
BPSMU provides the Spacehab crew with an
audio communication link to the orbiter/ISS
and to the flight controllers in the Mission
Control Center (MCC).

The BPSMU has the following audio channels:

Air-to-ground 1 (A/G1)

Air-to-ground 2 (A/G2)

Intercommunication A (ICOM A)

Intercommunication B (ICOM B)

Page

Alarm tone

The channels can be configured independently

to talk/listen, listen only, or off.

Fire Suppression Subsystem

The FSS includes both smoke sensors and fire
suppression equipment.
Detection of fire/
smoke is annunciated through the orbiter C&W
electronics unit (CWEU) to crewmembers in
both the orbiter and Spacehab module. The fire
suppression bottles can be discharged using
controls located on the SSP, on the payload
safing panel (C3A5), on the Spacehab MCP, or
by Spacehab SPEC commanding via the orbiter
DPS display. Fire suppression firing circuits,
smoke detector data circuits, and test/checkout
provisions are provided by the FSCU and the
MCP.
Activation of the FSS is single fault tolerant
during all mission phases. A handheld fire
extinguisher is provided for extinguishing
localized fires.

Closed Circuit Television Subsystem

The closed circuit television (CCTV) cameras or
orbiter-provided camcorders may be located in
the Spacehab module for video downlink of
Spacehab experiment operations.
In the
standard
configuration,
orbiter-provided
camcorders are used to provide video recording
of Spacehab experiment operations.

2.23-3

2. SYSTEMS
2.23 Spacehab

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.23 Spacehab

2.23-4

USA007587
Rev. A

2.24

Rigid Containers

STOWAGE

Modular Lockers

CONTENTS
Description.............................................
Rigid Containers....................................
Flexible Containers ...............................
Middeck Accommodations Rack ........

2.24-1
2.24-1
2.24-4
2.24-6

Description
Various provisions are available for stowing
loose onboard equipment and trash/waste
materials during different phases of the flight.
Provisions consist primarily of rigid and flexible
containers.
Rigid containers include:

The lockers are made of lightweight carbon

fiber composite material much like fiberglass.
The mounting frame at the rear of the locker
and locker door are milled aluminum. Guides
for installation tools and Teflon spacer pads are
bonded on the composite using epoxy. Lockers
hold 2 cubic feet of contents that can weigh no
more than 68 pounds.

Modular lockers
Floor compartments
Volume B return trash containers
The flexible containers are as follows:

Some equipment onboard the orbiter is stowed

in lockers with insertable trays. The trays can
be adapted to accommodate a wide variety of
soft goods, loose equipment, and food. The
lockers are interchangeable and attach to the
orbiter with spring-loaded captive bolts. The
lockers can be removed or installed in flight by
the crewmembers. There are four sizes of trays:
a single tray (two of which fit inside a locker), a
double tray, a half-length single tray (four of
which fit inside a locker), and a half-length
double tray. Approximately 150 cubic feet of
stowage space is available, almost 95 percent of
it on the middeck.

Flight deck stowage bags

Helmet stowage bag
Seat FDF containers
Soft stowage containers
Trash containers
Jettison stowage bags
In-flight stowage bags
Middeck retention net
Airlock stowage bags
Airlock retention net

Foam inserts are used in the trays to provide a

friction fit for zero-g retention. In addition,
straps, snaps, and mesh retention nets are used
in some trays. Soft containers are used in
orbiter spaces too small for the fixed lockers.

Stowage areas in the orbiter crew compartment

are located on the flight deck, the middeck, in
the airlock, and lower equipment bay.

In the aft flight deck, stowage lockers are

located below the rear payload control panels in
the center of the deck. A trash container is
nominally mounted on the port and starboard
side of the flight deck, near the interdeck access
opening.
These side containers are interchangeable.

2.24-1

2. SYSTEMS
2.24 Stowage

USA007587
Rev. A

Middeck Forward Modular Lockers and Floor Compartment

In the middeck, lockers can be attached to the
forward avionics bay. Provisions for 33 lockers
are available in this area. In addition, there is
an area to the starboard side of the airlock
module where 11 lockers can be attached.
To obtain access to the locker interior, the crewmember needs to rotate two quarter-turn, selfaligning ball latches inboard to release the
locker door.
The crewmember can open the door a full
180. By using the standard hole pattern of the
locker, straps and brackets can be attached to
the locker faces via pip pins for restraining
equipment.
In addition, a crewmember can remove lockers
in flight in order to gain access to the floor
compartments or the avionics bays.

2. SYSTEMS
2.24 Stowage

In the event the locker door cannot be closed or

latched because of misalignment problems, the
crewmembers can remove the locker and use
turnbuckles to provide structural support.
Floor Compartments
Seven floor compartments are available. Volume
F (MD76M), the wet trash compartment,
provides 8 cubic feet of stowage under the
middeck floor.
The CO2 absorbers are
manifested at MD52M, with the in-use position at
MD54G. Two other compartments (volumes G
(MD80R) and H (MD23R)) are used to store
contingency hygiene equipment and EVA
accessories respectively. Volume D (MD52C) is
beneath the forward lockers and holds
approximately 8 cubic feet. The remaining floor
compartment, volume E (MD76C), is used
primarily to store official flight kits and personal
preference kits.

2.24-2

USA007587
Rev. A
No. 10-32 insert
(6 Req'd in back plate)

Structural attach
fasteners (4)

Track
(with small trays only)

Instl/removal
tool guides

Fringe hinge

0.2 dia (5.08MH)

3 in each side
Launch/
landing locks (2)

CAUTION
Two thumblatches must
be secured for entry/landing.
usa007587_783r1.cvx

Schematic of Modular Lockers

Wet Trash Compartment

Volume D (MD52C)

To deposit any trash or waste materials into the

wet trash compartment, the crewmember
merely lifts the latch handle and opens the
circular door, deposits the material through a
rubber grommet into the trash bag, and closes
the door. Air in the wet trash volume is vented
overboard at the rate of approximately
3 lb/day.

Partially blocked by middeck forward lockers,

Volume D is used for EVA Tools, G-suits and
miscellaneous storage. The door is not hinged.

NOTE
The WCS vacuum vent valve must be
opened to allow the waste gases to be
vented overboard.

Volume E (MD76C)

The types of wet trash to be stowed in the

compartment are:
Medical kit items (no Sharps)
Emesis bags

The compartment door has a spring-loaded

latch mechanism. To open, the spring-loaded
latch mechanism is squeezed between the
thumb and forefinger to release the latch. Then
the door is subsequently lifted open. To close,
the door can be pushed shut without squeezing
the latch mechanism.

To gain access to this compartment, two lockers

(MF71M and MF71O) have to be removed.
Official flight kits and personal preference kits
are nominally stowed here. The compartment
door has the same type of spring-loaded latch
mechanism used in volume D.

Urine collection devices

Fecal bags
WCS odor/bacteria filter
Discarded food packages

Volume G (MD80R)
To gain full access to this compartment, lockers
(MA16L and MA16N) have to be removed.
Contingency
hygiene
equipment
(urine
collection devices, diapers, Apollo fecal bags,
wet wipes, etc.), and a spare odor bacteria filter
are stowed here. The compartment door has the
2.24-3

2. SYSTEMS
2.24 Stowage

USA007587
Rev. A
same type of spring-loaded latch mechanism
used in volume D.

is manifested for each crewmember, which is

used to stow the ACES helmet on orbit.

Volume H (MD23R)

The task of inserting desired FDF items into the

mesh bag consists of simply opening the bag,
placing items in the bag, and drawing the string
tight to close.

This floor compartment has the same type of

spring-loaded latch mechanism as used in
volumes E and G. EVA accessories (liquidcooled ventilation garments, EMU batteries and
lights, tools, etc.) are stowed in this compartment, located at the base of the interdeck ladder
on the port side of the middeck.
Volume A (MF57A)
This volume installs above the forward lockers
near the middeck ceiling. With 3 cubic feet of
stowage, this volume is used as a food pantry.

Seat FDF Containers

A soft fabric container, called a saddlebag, is
available for each seat to store FDF or other
small loose items.
Specialist Seat Saddlebag - To remove the
container from the seat requires the following
steps:
Pull up on container release handle to
disengage the container attachments
from seat.

Volume B
This volume is installed just outboard of the aft
lockers on the starboard side of the middeck.
To deposit any dry trash, towels, or dirty
laundry in this compartment, the crewmember
simply inserts the dry trash material through a
door located on the inboard side of the
compartment.

Unwrap the container Velcro straps

from seat leg support structure to
remove container.
The specialist seat FDF container is installed on
the right side as follows:

Volume 3B (MA73J)
This stowage volume originated as a printer
closet built into the closeout of the avionics bay
near the WCS compartment. With the printer
no longer used, the volume houses a cabin air
cleaner and emergency breathing masks for
launch and return.

Flexible Containers
Flight Deck Stowage Bag

Attach container Velcro straps around

right side leg support structure.
Insert container attachments to seat
attach point.
CDR/PLT Seat Saddlebag - These saddlebags
are Nomex fabric with Velcro closures mounted
via frame to the panels on the starboard side of
the CDR and PLT seats. Two bags on each seat
are used for ascent stowage of CDR and PLT
FDF as well as helmet bags and headsets.

For flight deck stowage, a flight deck stowage

bag is mounted on the back of the CDR and PLT
seats. Each bag has built-in pockets for stowing
loose items on orbit. Also called a VW bag, the
bag must be stowed for launch/return.
Helmet Stowage Bag
A Nomex-mesh bag with a drawstring is
provided for stowing unnecessary FDF material
or other onboard loose equipment on orbit. The
bag is located in the CDR's FDF stowage
container. In addition, one helmet stowage bag
2. SYSTEMS
2.24 Stowage

2.24-4

USA007587
Rev. A
Fwd

Only particular types of trash should be stowed

in these containers, as follows:

Aft

Drink containers
Wipes used for nonwaste collection
system purposes
Batteries
Printer paper
Vacuum cleaner residue/bag
No wet or odor producing trash

Fwd

NOTE
Absolutely no human waste materials
(fecal, urine, or emesis) are to be stowed
in these trash bags/liners.
(

= Containers)

The starboard trash bag is flown on panel R15

on the starboard flight deck. The bag is used to
hold Photo TV equipment and batteries for
temporary restraining, stowage, or transporting
on orbit.

781.cvs

Flight Deck FDF Containers

Trash Containers
Four trash containers are flown.
Two
containers are mounted in the middeck area,
one on the inside surface of the waste
management compartment door and one on AV
bay 3B. The flight deck containers are located
on the port and starboard flight deck. Each
container contains a disposable trash bag plastic
liner, with spares located in the bottom of the
container (outside the installed liner).
The crewmember deposits trash into the
container disposable plastic liner through the
alligator clamp opening. Once the plastic liner
is full, the top of the trash bag liner is closed
with its Velcro closure. The trash bag zipper is
opened, and the full liner is removed through
the side opening. The top of the liner can be
further rolled and secured with gray tape. The
liner is then stowed in Volume B. A new liner is
inserted through the trash bag top opening and
secured to the trash bag mating surfaces using
the Velcro strips on the liner.

Jettison Stowage Bags

Teflon-coated Nomex cloth bags are provided to
stow equipment and materials on orbit. Each
bag has a drawstring for sealing the opening of
the bag.
At least one of these bags is used as a return-toHouston bag.
It contains items (such as
videocassettes, audio cassettes, film, and notes)
that must be flown to Houston immediately
following a mission.
In-Flight Stowage Bags
Nomex green or gold colored mesh bags of the
same approximate dimensions as the jettison
stowage bags are stowed in a middeck stowage
locker. The bags are used for stowing the
crewmembers' launch equipment such as ACES,
boots, and harness. Each bag has a drawstring
to seal the opening of the bag.

2.24-5

2. SYSTEMS
2.24 Stowage

USA007587
Rev. A

Middeck Accommodations Rack

Middeck Retention Net

The middeck retention net, a polybenzine imidazole brown-colored mesh net with caribiners,
is manifested on non-sleepstation flights. This
net is used to restrain items such as seats,
launch/entry suits, boots, and helmets on orbit.
It is located on the starboard forward middeck
and attaches to the MF71 row of lockers and the
starboard wall.
Middeck Stowage Bag
Made of white Nomex, these bags come in 5
MLE (middeck locker equivalent) and 10 MLE
sizes and are used for generic stowage and
transfer. For launch and return, these bags are
secured via Kevlar straps to composite pallets
that are bolted to the middeck aft area.
Airlock Stowage Bag
The airlock stowage bag, when manifested, is
mounted to the external airlock floor. This bag
is made of white Nomex material and provides
an alternate stowage location, primarily for
SAFER.
Tunnel Retention Net

The middeck accommodations rack (MAR)

permits stowage of small payloads and
experiments in the middeck of the orbiter. The
MAR is installed just forward of the side hatch
in the area aft of the galley. The MAR provides
approximately 15 cubic feet of internal volume
with a maximum payload weight of about 340
pounds.
The lightweight middeck accommodations rack
(LWMAR) is usually flown in place of the MAR
in the absence of a powered payload. The
LWMAR is a carbon-fiber composite structure
which offers approximately the same stowage
volume as the MAR, but at a much lighter
weight and can hold a maximum weight of
about 390 pounds.
The LWMAR has two bi-fold doors that swing
upward and downward to provide access to the
shelves inside. Each door is held in place with
eight latches. These doors are opened half at a
time by retracting four latches. Internal shelves,
also made of composite carbon fiber material,
are bolted in place and can be relocated,
reconfigured or removed by ground personnel
to satisfy mission stowage requirements.

The tunnel retention net is used to restrain

equipment in the Spacehab tunnel. It is a brown
polybenzine imidazole mesh net that covers the
EVA hatch and is used only for on-orbit
stowage.

2. SYSTEMS
2.24 Stowage

2.24-6

USA007587
Rev. A

Lightweight Middeck Accommodations Rack (LWMAR)

2.24-7

2. SYSTEMS
2.24 Stowage

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.24 Stowage

2.24-8

USA007587
Rev. A

2.25

collecting and storing solid waste. When the

commode is in use, it is pressurized, and
transport air flow is provided by the fan
separator. When the commode is not in use, it
is depressurized for solid waste drying and
deactivation.

WASTE MANAGEMENT
SYSTEM (WMS)

CONTENTS
Description............................................. 2.25-1
Operations.............................................. 2.25-4

Description
The waste management system (WMS) is an
integrated,
multifunctional
system
used
primarily to collect and process crew biological
wastes. The WMS is located in the middeck of
the orbiter crew compartment in a 29-inch-wide
area immediately aft of the crew ingress and
egress side hatch.
The system collects, stores, and dries fecal
wastes. It processes urine and transfers it to the
wastewater
tank
and
processes
EMU
condensate water from the airlock and transfers
it to the wastewater tank if an EVA is required
on a mission. The system also provides an
interface for venting trash container gases
overboard
and
dumping
atmospheric
revitalization wastewater overboard in a
contingency situation, and it transfers
atmospheric revitalization system wastewater
to the wastewater tank.
A waste management compartment door and
two privacy curtains attached to the inside of
the door provide privacy. One curtain is
attached to the top of the door and interfaces
with the edge of the interdeck access, and the
other is attached to the outer edge of the door
and
interfaces
with
the
middeck
accommodations rack (MAR), if installed. The
door also serves as an ingress platform during
prelaunch (vertical) operations since the flight
crew must enter the flight deck over the waste
management compartment. The door has a
friction hinge and must be open to gain access
to the waste management compartment.
The WMS consists of a commode, urinal, fan
separators, odor/bacteria filter, vacuum vent
quick disconnect, and controls. The commode
is 27 by 27 by 29 inches, and it is used like a
standard toilet. The commode contains a single
multilayer hydrophobic porous bag liner for

Waste Management System

The urinal is essentially a funnel attached to a
hose and provides the capability to collect and
transport liquid waste to the wastewater tank.
The fan separator provides transport air flow
for the liquid. The fan separators separate the
waste liquid from the air flow. The liquid is
drawn off to the wastewater tank, and the air
returns to the crew cabin through the
odor/bacteria filter. The filter removes odors
and bacteria from the air that returns to the
cabin. The vacuum vent quick disconnect is
used to vent gases directly overboard from
equipment connected to the quick disconnect
through the vacuum line.
The urinal assembly is a flexible hose with
attachable funnels that can accommodate both
men and women. The assembly can be used in
a standing position.

2.25-1

2. SYSTEMS
2.25 Waste Management System

USA007587
Rev. A

Side hatch

MAR

Privacy
curtains
(fold up on
inside of door
for storage)

Waste management
compartment door
Inboard

Forward
usa007587_787r1.cnv

Waste Management System Privacy Curtains

Urine/air

Odor/bacteria
filter
Cabin air return
Bacteria
filter

Urinal funnel
(personal)
Conical
screen
prefilter
(removable)
Couple

Charcoal
Fan
separator
No.1

Screen
(fixed)

Muffler
Feces/air
Seat
Air
Slide valve

Pitot
Hose pump
0.25
inch
EMU
water
from
airlock

Hydrophobic porous liner

(removable)
Storage
container

Hose
block

Elastic net
Vane compactor
Compactor
drive

Waste
liquid

Pressure
transducer

Ball
valve

0.375
inch

Vacuum
Auxiliary trash
vent (wall)

Air
Waste
water
tank

Orifice
Check
valves
Air
Pitot pump
Fan
separator
No. 2

Ball
valve

Ball valve

Ball
valve
Particulate
screen

Tissue
collection
(coffee can)
Ballast valve

Cap
Vacuum
ball valve

Vacuum vent QD
(on front of WCS)
Trash vent
(from wet trash
compartment
in floor)

usa007587_788r1.cvx

Waste Management System

All waste management system gases are
ducted from the fan separator into the
odor/bacteria filter and then mixed with cabin

2. SYSTEMS
2.25 Waste Management System

air. The filter can be removed for in-flight

replacement.
Various restraints and adjustments enable the
crew to achieve the proper body positioning
2.25-2

USA007587
Rev. A
to urinate or defecate in a zero-gravity
environment.
Two foot restraints are
provided.
A toe bar is located at the
commode base and is used for standing
urination.
It consists of two flexible
cylindrical pads on a shaft that can be
adjusted to various heights by releasing two
locking levers that are turned 90
counterclockwise.
The crewmember is
restrained by slipping his or her feet under
the toe bar restraint.

The WMS compartment is stocked with

gloves, trash bags, tissues, and wet wipes.
Rubber grommets in the compartment allow
crewmembers to restrain their towels and
washcloths.

Waste Management System Container Liner

Waste Management System Fan Separator

A footrest restrains the feet of a crewmember
sitting on the commode. The footrest consists
of an adjustable platform with detachable
Velcro straps for securing the feet. The Velcro
straps are wrapped crosswise over each foot
and secured around the back. The footrest
can be adjusted to various angles and heights.
Two locking handles pulled outward adjust
the angle; two other locking levers adjust the
height of the footrest.
Two body restraints are provided for when
crewmembers are seated on the commode.
This restraint is a thigh bar that the
crewmember lifts up out of the detent
position, rotates over the thigh, and releases.
The thigh bar exerts a preloaded force of
approximately 10 pounds on each thigh.
Waste Management System Middeck

Handholds are used for positioning or

stabilizing the crewmember and form an
integral part of the top cover of the waste
management collection system assembly.

2.25-3

2. SYSTEMS
2.25 Waste Management System

USA007587
Rev. A

Operations
The controls on the waste collection system
(WCS) are the VACUUM VALVE, FAN SEP
select switch, MODE switch, fan separator
bypass switches, and COMMODE CONTROL
handle. The system uses dc power to control
the fan separators and ac power for fan
separator operations. The MODE switch and
the COMMODE CONTROL handle are
mechanically interlocked to prevent undesirable
system configurations. The remaining controls
operate independently.
The fan separator
bypass switches allow the crewmember to
manually override a fan separator limit switch
failure.
For launch and entry, the VACUUM VALVE
switch is set to CLOSE.
During on-orbit
operations, when the WCS is not in use, the
vacuum valve is set to OPEN. This exposes the
commode overboard via the vacuum vent
system, and any solid wastes in the commode

are dried. This also allows venting of the

auxiliary wet trash and the volume F wet trash
compartment. The hydrophobic bag liner in the
commode allows gas from the commode to vent
overboard, but does not allow the passage of
free liquid.
In the urine collection mode, the VACUUM
VALVE remains in OPEN. The FAN SEP
switch is positioned to 1 or 2. When the switch
is positioned to 1, main bus A dc power is
supplied to fan separator 1; when it is
positioned to 2, main bus B dc power is
supplied to fan separator 2. The MODE switch
positioned to AUTO energizes a microswitch in
the Auto cradle for the selected fan separator
(dependent on FAN SEP position). When the
urinal hose is removed from the cradle, the
active fan separator pulls cabin air flow through
the urinal at a minimum of 10 cubic feet per
minute and cabin air through the coffee can at
30 cubic feet per minute.

Waste Management System Controls

2. SYSTEMS
2.25 Waste Management System

2.25-4

USA007587
Rev. A
The coffee can air mixes with the urine
transport air flow in the fan separator. Liquid
check valves at the wastewater outlet from each
fan separator prevent backflow through the
non-operating separator during separator
operation and prevent backflow to the urinal
and air outlet when the separators are off. The
liquid and air mixture from the urinal line
enters the fan separator axially and is carried to
a rotating chamber. The mixture first contacts a
rotating impact separator that throws the liquid
to the outer walls of the rotating fluid reservoir.
This centrifugal force causes the liquid to
separate and draws it into a stationary pitot
tube in a reservoir and directs the liquid
through the dual check valves and into the
wastewater tank. Air is drawn out of the
rotating chamber and passes through the
odor/bacteria filter, where it mixes with cabin
air and re-enters the crew cabin.
In the EMU water drain mode, a guard is
rotated over the MODE switch to preclude
deactivation during the EMU and airlock water
collection mode. The urinal cannot be used
during the EMU dump because of possible
separator flooding. EMU condensate water is
drained only if an EVA is required on a mission.
The EMU wastewater is dumped through
wastewater valves in the airlock. Other than
these requirements, EMU dump is the same as
the urine collection mode.
In the urine and feces collection mode, the
MODE
switch
is
moved
to
the
COMMODE/MANUAL/EMU
position,
the
COMMODE CONTROL handle is pulled up,
and the commode is pressurized with cabin air
through the debris screen and flow restrictor in
approximately 15 seconds.
NOTE

valve, and it cannot be pushed forward unless

the MODE switch is positioned all the way to
the COMMODE/MANUAL/EMU position).
When the COMMODE CONTROL handle is
pushed forward, the slide valve on the
commode is opened.
The WCS is used like a normal toilet. The
commode seat is made of a contoured, hard
Ultem plastic material that provides proper
positioning and is sealed to minimize air
leakage. Feces enter the commode through the
4-inch-diameter seat opening and are drawn in
by cabin air flowing through holes under the
seat at 30 cubic feet per minute. Fecal matter is
deposited into the porous bag liner, and the air
is drawn through the hydrophobic material to
the fan separator.
The hydrophobic liner
material prevents free liquid and bacteria from
leaving the collector. All paper is deposited in a
WCS canister bag and then placed in the WCS
auxiliary wet trash compartment.
It is
recommended that no tissues be placed in the
commode, since they tend to block airflow and
cause more bulk in the commode. Urine is
processed as in the urine collection mode. The
BACK/DOWN position of the COMMODE
CONTROL handle closes the slide valve and
depressurizes the commode for deactivation
and solid waste drying. If the handle were left
partially up, it would cause loss of cabin air
through the vacuum vent.
NOTE
The COMMODE CONTROL handle must
be completely down (in BACK/DOWN
position) upon completion of WMS usage,
or loss of cabin air through the vacuum
vent valve will occur.
After usage, the WCS should be cleaned with
wet wipes to maintain an odorless and sanitary
environment.
The seat can be lifted for
cleaning. The WCS should be sanitized once a
day with a disinfectant wipe. Urinal funnels may
be sanitized daily with the disinfectant wipe as well.

If the MODE switch is positioned to

AUTO, the handle cannot be pulled up
because of a mechanical interlock. At the
top of the handle is a pop off ball that will
come off at 40 lb of force to prevent
damage to the linkages inside the unit.
The COMMODE CONTROL handle is
positioned to PUSH FWD after 15 seconds (it
cannot be pushed forward until after 15 seconds
because of the delta pressure across the slide

Alternate Fan Separator Operations

If fan separator 1 is inoperative or fails to
achieve proper operational speed (which can be
verified by a reduced noise level or lack of air

2.25-5

2. SYSTEMS
2.25 Waste Management System

USA007587
Rev. A
flow), the FAN SEP switch is positioned from 1
to 2, and hose block from 1 to 2, then operate as
normal.

valve is closed. The unpowered position closes

the valve.
Even if the vacuum vent isolation valve could
not be opened, vacuum vent functions would
not be lost. A small hole in the valve plate
allows proper venting overboard in such a
contingency.

The lever-locked FAN SEP 1 BYPASS and FAN

SEP 2 BYPASS switches permit the crew to
manually override a fan separator limit switch
failure in either the FAN SEP or MODE
switches. When either switch is positioned to
ON, dc power is applied to the corresponding
relay, energizing it and providing ac power to
activate the corresponding fan separator. Both
BYPASS switches should not be ON at the same
time. Before the SEP 1 or 2 BYPASS switch is
activated, the FAN SEP select switch and hose
block should be positioned in the corresponding
fan separator position to preset the fan
separator inlet valve.

Between the WCS ball valve and the vacuum

vent valve is a vacuum vent quick disconnect
(QD). For a failure of the vacuum vent system,
vacuum venting can be regained by connecting
a transfer hose from this QD to the contingency
wastewater crossite QD, which allows venting
through the wastewater dump line.

Vacuum Vent System

Heaters

The vacuum vent system provides a pathway

for removal of hydrogen (off-gassed by the fuel
cells), for venting odors, and for drying solid
waste material in the commode when the
commode is not in use.

Thermostatically controlled heaters are installed

on the vacuum vent line. Electrical power for
the A and B heaters is supplied on the H2O LINE
HTR A and B circuit breakers on panel ML86B.
(These circuit breakers also supply electrical
power to supply water dump line A and B
heaters and wastewater line A and B heaters.)

The vacuum vent line T's off from the WCS line
at the WCS three-way ball valve. When the
commode is not in use, it is exposed to vacuum
through this vent line. A manual valve that is
downstream of the commode serves to isolate
the WCS from the vacuum vent system, if
required. One situation in particular where this
would be necessary would be if the WCS failed
and created a cabin leak. The vacuum vent
isolation valve is located downstream of the
vacuum valve. It is controlled by the WASTE
H2O VACUUM VENT ISOL VLV CONTROL
switch on panel ML31C. This switch receives
electrical power from the VACUUM VENT
ISOL VLV BUS SELECT switch on panel ML31C
when the switch is positioned to MNA or
MNB.
When the WASTE H2O VACUUM VENT ISOL
VLV CONTROL switch is positioned to OPEN,
the vacuum vent isolation valve is opened,
allowing the vacuum vent line to be open to
vacuum. A talkback indicator above the switch
indicates OP when the valve is open, barberpole
when the valve is in transit, and CL when the

2. SYSTEMS
2.25 Waste Management System

Alternate Vacuum Venting

Heaters are also installed on the vacuum vent

nozzle and are controlled by the WASTE H2O
VACUUM VENT NOZ HTR switch on panel
ML31C. Electrical power is supplied to the
vacuum vent nozzle heaters when the switch is
positioned to ON. The OFF position removes
electrical power from the vacuum vent nozzle
heaters.
Alternative Waste Collection
For a non-operational WCS, contingency waste
collection devices are available. Fecal collection
is accomplished by using an Apollo fecal bag.
Apollo fecal bags can be stowed inside the WCS
commode or in the wet trash (volume F)
compartment. For men, the urine collection
device (UCD) is used for urine collection. A
UCD consists of a collection bag, a restraint
assembly, and a roll-on cuff. For women, urine
collection is accomplished via absorbent pants
(Pull-Ups). The Pull-ups are a modified version
of adult diapers.

2.25-6

USA007587
Rev. A

VACUUM VENT Switches and Talkback on Panel ML31C

H2O LINE HTR A and B Circuit Breakers on Panel ML86BThis page intentionally left blank

2.25-7

2. SYSTEMS
2.25 Waste Management System

USA007587
Rev. A

This page intentionally left blank

2. SYSTEMS
2.25 Waste Management System

2.25-8

USA007587
Rev. A
and policies pertaining to the development,
publication, fabrication, and validation of FDF
under the authority of the Director of Mission
Operations. The management process, policies,
and guidelines under which the FDF is
developed are contained in the Crew
Procedures
Management
Plan
(CPMP),
USA-005466. This plan and its Annexes A-E
detail the development of crew procedures and
activities as well as the fabrication and
processing of the FDF material.
Crew
procedures and activities are documented in a
variety of books and checklists. Time-critical or
frequently used procedures are documented on
cue cards and in flip books (a series of cue cards
that are ringed together). These documents are
categorized into four groups:

3. FLIGHT DATA FILE

CONTENTS
3.1
3.2
3.3
3.4
3.5

CONTROL DOCUMENTS.......
SUPPORT DOCUMENTS ........
OFF-NOMINAL
DOCUMENTS............................
REFERENCE DOCUMENTS ...
OPERATIONAL USE................

3.1-1
3.2-1
3.3-1
3.4-1
3.5-1

The Flight Data File (FDF) is the total onboard

complement of documentation and related crew
aids available to the crew for flight execution.
The FDF consists of procedural checklists,
timelines, schematics, charts, cue cards, portable
onboard computer software, teleprinter/
graphics messages, and accessories. The FDF
also includes office-type supplies, such as pens,
pencils, markers, Velcro, and rubber bands.
The FDF used in training is essentially identical
to the material used on orbit, except where
trainer-unique
characteristics
require
differences.

Control documents The FDF books that

provide the schedule of crew activities for
an entire flight. There is one controlling
document for every phase of a flight
(i.e., Ascent, Post Insertion, Orbit, Deorbit,
and Entry). These documents are time
oriented and refer to other FDF documents
as required.

The Crew Procedures Control Board (CPCB) is

the governing body for establishing guidelines

FDF Products
3-1

3. FLIGHT DATA FILE

USA007587
Rev. A

Generic documents to account for vehicle

or mission-specific data.

Support documents Used on orbit to

accomplish various objectives scheduled
in the Control documents, such as flightspecific payload procedures, EVA, or
rendezvous and proximity operations.
The CPCB may occasionally designate a
Support book as the controlling document
for that specific phase of the flight.

Off-Nominal documents Contain

contingency procedures for all phases of
flight.

Reference documents Provide data

not normally required for a particular
task, but useful to the crew. Documents
include DPS displays, caution and
warning (C/W) parameters, landing site
charts, and stowage locations for crew
use items.

Generic documents Reflown from

flight to flight since they usually do not
contain flight-specific data. Temporary
pages may occasionally be added to

3. FLIGHT DATA FILE

Flight-Specific documents Contain

flight-specific data used in conjunction
with Generic publications.
Flightspecific documents contain data for a
single mission and have no generic
companion document.

Standby Supplements Contain

procedures that are not flown because
they have a very low probability of being
needed.
The data are available on
console in Mission Control and can be
uplinked if required.

Certain pages of Control, Support, and OffNominal documents are labeled Not Flown.
These pages are included in the books sent to
the various recipients on the distribution list,
including Mission Control, but are not
included in the flight quality copies used in
the trainers or in flight. Cue cards are also
included in the body of the distribution
copies but may not be flown as part of a book
or checklist; exceptions are Ascent and Entry
Cue Cards and flip book pages that are
provided to mission specialist 2.

Each FDF book within the four main groups

can also be categorized into one of three
subgroups:

3-2

USA007587
Rev. A

SSP FDF Structure (Typical Books)

3-3

3. FLIGHT DATA FILE

USA007587
Rev. A

This page intentionally left blank

3. FLIGHT DATA FILE

3-4

USA007587
Rev. A

3.1

Post Insertion Book

CONTROL DOCUMENTS

The Post Insertion Book is a flight-specific

document that includes summary and detailed
timelines and procedures to prepare the orbiter,
crew, and payload for on-orbit operations.
Additionally, it contains on-orbit switch
pictorials and abort to orbit (ATO) post
insertion data. There are no Post Insertion Cue
Cards; however, during the post insertion
phase, cue cards for various on-orbit activities
are unstowed and utilized.

CONTENTS
Ascent Checklist ...................................
Post Insertion Book ..............................
Flight Plan .............................................
Deorbit Preparation Book ...................
Entry Checklist .....................................

3.1-1
3.1-1
3.1-1
3.1-1
3.1-2

Ascent Checklist
The Ascent Checklist is a flight-specific
document. This checklist contains the nominal
procedures for prelaunch through the postOMS 2 burn, aborts, weather preliminary
advisory data (PADs), and prelaunch switch
configurations (not flown). Abort entry related
material is included in this checklist because of
the time critical nature of ascent aborts. Ascent
Cue Cards are also controlled by the Ascent
Checklist.
#

CARD

Contingency abort
RTLS Contingency
2 OMS 2/orbit OMS burn
OPS 1 RCS burn
3 OMS burn monitor
OMS failures
4 ADI err/rate switch (ASC)
ADI err/rate switch (ENT)
5 Ascent/entry spec
6 Speedbrake command
7 Entry alpha
Ascent ADI-nominal
8 AOA deorbit burn (2 engine)
AOA deorbit burn (1 engine)
9 AOA deorbit burn (RCS0
10 (XXX) TAL redesignation
(XXX) TAL redesignation
11 (XXX) TAL redesignation
12 Ascent/abort summary
Emergency Egress
Escape Panel Egress
GPC/FCS Channel config
Panel R14
LOC Breakup
* Hinged Card

CARD
FRONT

CARD
BACK

X
X

Flight Plan
The Flight Plan is a flight-specific book that
contains summary timelines for the orbiter
(launch through landing) and payloads. It also
contains the detailed nominal and contingency
timelines for the overall mission, including key
ground support, crew, orbiter, and payload
systems operations. The Flight Plan may also
contain the Attitude Timeline if the number of
attitude changes warrants its inclusion. There
are no Flight Plan cue cards. The Flight Plan is
the controlling document for the Digital
Autopilot (DAP) Book, which is stowed in one
of the pilots FDF lockers.

X
X

Deorbit Preparation Book

X
X
X

The Deorbit Preparation Book (Deorbit Prep)

contains a summary and detailed timeline for
nominal deorbit preparation procedures that
begin about 4 hours prior to the deorbit burn.
The
book
also
contains
contingency
modifications to these procedures and the steps
to back out of deorbit preparation should a
waveoff be required. Additionally, this book
contains a pictorial of the entry switch list,
nominal and contingency deorbit preparation
procedures for payload bay door closure, and
backup flight system (BFS) deorbit preparation
notes. There are no cue cards controlled by the
Deorbit Prep book.

X
X
X
X
X
*
*
*

X
X
X
X
X
X
X

X
X

X
X

Ascent Cue Card

There are five Ascent and Entry Flip Books that
are controlled by the Ascent/Entry Systems
Procedures Book in the Off-Nominal group of
FDF.

3.1-1

3. FLIGHT DATA FILE

3.1 Control Documents

USA007587
Rev. A

Entry Checklist
The Entry Checklist (Generic and Flight
Supplement) becomes the controlling document
about 43 minutes prior to the deorbit burn. This
checklist contains pre-deorbit burn, post-burn,
entry, and post-landing procedures. Entry Cue
Cards are also controlled by the Entry Checklist.

CARD

Deorbit burn flight rules

One orbit late available
RTLS Contingency
Deorbit burn monitor
OMS failures
Deorbit burn (RCS)
*
Deorbit burn (2 engine)
*
Deorbit burn (1 engine)
Deorbit burn (mixed xfeed)
*
Unbalanced propellant deorbit burn
Entry control
Entry maneuvers (EI-5 - V=10K)
Entry maneuvers (V=7K - STOP)/
Orbiter Xwind limits
Entry no/go checklist
ADTA mgmt; no comm TACAN mgmt; nav
delta pad; bailout mode 8; postlanding
mode 5
Mach/alpha

2
3
4

5
6
7

* Hinged Card

Entry Cue Cards

3. FLIGHT DATA FILE

3.1 Control Documents

3.1-2

CARD
FRON
T

CARD
BACK

X
X
X
X
X
X
X
X
X
X
X

X
X

X
X

USA007587
Rev. A

3.2

system (RMS) manifested. These documents

contain the RMS and RMS/payload nominal,
backup, and contingency procedures. They also
contain CCTV data for the RMS television
cameras (along with the Photo/TV Checklist)
and RMS-related EVA procedures. The PDRS
document controls two standard cue cards.
Their purpose is to quickly safe the payload,
orbiter, or RMS from failures that affect end
effector operations and, if possible, to complete
successfully the mission deploy or retrieval
objective.

SUPPORT DOCUMENTS

CONTENTS
Orbit Operations Checklist .................
Photo/TV Checklist .............................
Payload Deployment and Retrieval
System Operations Checklist ...
Extravehicular Activity Checklists ....
Rendezvous Checklist .........................
Payload Operations Checklist ............
Deploy Checklist ..................................
Additional Support Documents.........

3.2-1
3.2-1
3.2-1
3.2-1
3.2-1
3.2-2
3.2-2
3.2-2

Extravehicular Activity Checklists

The generic documents and flight supplements

within this group are bound together for
training and flight rather than integrated.

Orbit Operations Checklist

The Orbit Operations (Orbit Ops) Checklist
contains the procedures for on-orbit operation
of orbiter systems, pre-sleep and postsleep
periods, detailed test objectives (DTOs), and
separation maneuvers. Cue cards are controlled
by the Orbit Ops Checklist, which provide
procedures for saving data in the modular
memory units (MMUs), a directory of general
purpose computer (GPC) specialist function
(SPEC) and display (DISP) assignments, and
procedures for fuel cell purging.

The Extravehicular Activity (EVA) Generic and

Flight Supplement Checklists are flown for
planned EVAs or for payloads that have EVA
backup procedures. These checklists contain all
the procedures for EVA preparation through
post-EVA. Also included are extravehicular
mobility unit (EMU) maintenance, recharging,
and malfunction procedures, plus EMU
contingency data and airlock nominal and
emergency procedures. Two cue cards are
controlled through the EVA Checklist. They
contain procedures for orbiter airlock
depressurization/repressurization and EMU
leak check data. The EVA Checklist also
controls the EVA cuff checklist worn on the
EMU sleeve.

Rendezvous Checklist

Photo/TV Checklist
The Photo/TV Checklist contains the procedures
for still, motion picture, and closed circuit
television
(CCTV)
camera
configuration
(including camcorder). It also contains camera
setup, activation, and deactivation procedures for
photo/TV scenes, camera displays and controls,
and camera malfunctions. Photo/TV Cue Cards
detail nominal procedures for the use of the
CCTV system, video tape recorder (VTR), ET
photography and film use. (Examples of cue
cards are in Section 2.3.)

Payload Deployment and Retrieval

System Operations Checklist
The Payload Deployment and Retrieval System
(PDRS) Operations Checklist Generic and Flight
Supplement documents fly only on shuttle
missions that have the remote manipulator

A Rendezvous (RNDZ) Checklist is flown for

missions involving a planned rendezvous and
for flights that involve an RMS deploy with a
planned contingency rendezvous revisit. This
checklist contains a rendezvous flight profile
diagram, a flight rules summary, a deploy
timeline (if appropriate), a rendezvous timeline,
contingency operations, rendezvous OMS burn
procedures, and reference data regarding the
DAP, relative motion, targeting, and operation
of onboard piloting tools. For missions to the
ISS, the Androgynous Peripheral Docking
System (APDS) nominal procedures, offnominal procedures, and docking sequence cue
card are included. The Rendezvous Checklist
also controls several cue cards: RCS burn,
RNDZ propellant PAD, Proximity Operations
Procedures, Ku Radar Rendezvous Operations,
Nominal Radar Angles & Camera Angles
Ranging Chart, and an RMS End Effector

3.2-1

3. FLIGHT DATA FILE

3.2 Support Documents

USA007587
Rev. A
Camera Overlay (for aid in flyaround of the
free-flying payload.)
During the rendezvous phase of a flight
(typically the three orbits immediately before
and including) grapple or docking, the
Rendezvous
Checklist
is
the
primary
controlling document. For use during RMS
deploys, the Rendezvous Checklist contains the
deploy timeline, which includes references to
the PDRS Checklist.

Payload Operations Checklist

The Payload Operations (PL OPS) Checklist is a
flight-specific document that contains payload
systems procedures for on-orbit operations
through deorbit preparation. There may be
mission/payload-specific cue cards associated
with this book. For complex payload missions,
a Payload Systems Data and Malfunction (PL
SYS) Book may be flown. This book contains
payload-specific
malfunction
procedures,
reference information, and payload drawings
requested by the crew.

Deploy Checklist
The Deploy Checklist is also a flight-specific
book with the payload identified in the title.
This document covers all phases of deploy from
payload checkout through deploy (including
RMS procedures), and orbiter separation
activities. The checklist also contains deploy
flight rules, backup, contingency, and jettison
procedures, forward RCS data, and payloadcritical action responses. The number and types
of Deploy cue cards flown are payload specific.

Additional Support Documents

There may be additional support documents
and associated cue cards flown to support
unique mission requirements. The Cue Cards
and Procedural Decals Book is published and
distributed for ground use. It does not fly on
the orbiter. It is the controlling document for
decals and cue cards that do not reside in other
publications.
Additionally, this document
dictates guidelines and constraints for the
fabrication of all cue cards and CCTV overlays
and provides diagrams for the placement of
flight deck cue cards for various mission
phases.

CDR flip
card back

PLT OVHD flip book

CDR ascent flip book

Ascent ADI
MACH/
ADI error/rate switch

PLT flip card back

PLT ascent flip book
MACH/a
Ascent ADI
PLT window flip book
ADI error/rate switch
Ascent/entry SPEC

CDR window
flip book
Fire/smoke

Speed brake

Power

Trim/OSC
OMS burn monitor
OMS 2/orbit OMS
burn CG calculator
(PLT only)

Trim/OSC
OMS burn monitor
OMS 2/orbit OMS burn
ASC/RTLS/TAL restring
ET SEP

MPS
Cue Cards

GPC/FCS

Not shown: Escape PNL egress (back of CDR seat)

Mode 1 and 5 egress (back of PLT seat and on middeck)
Teleprinter (above L9 if flown)
Contingency Abort

Flight Deck Ascent Cue Card Placement

3. FLIGHT DATA FILE
3.2 Support Documents

3.2-2

798.cvs

USA007587
Rev. A

3.3

the Entry PCL (minus the ascent-specific pages)

to assist MS2 in supporting the CDR/PLT
during these critical phases of flight. These
pages are printed on white stock to differentiate
them from the PCL data.

OFF-NOMINAL DOCUMENTS

CONTENTS
Pocket Checklists..................................
Ascent/Entry Systems Procedures
Book.............................................
Systems Abort Once Around Book....
Malfunction Procedures Book ............
In-Flight Maintenance Checklist ........
Payload Systems Data and
Malfunction Procedures Book .
Medical Checklist.................................
Contingency Deorbit Preparation
Book.............................................

3.3-1

Systems Abort Once Around Book

3.3-1
3.3-1
3.3-1
3.3-1

The Systems Abort Once Around (SYS AOA)

Book contains time-critical steps for the loss of
two Freon or water loops precipitating an AOA.
Initial steps for the loss of Freon loops or water
loops are in the CDRs Flip Book and in the
front of the MS2s Ascent PCL. This document
also contains deorbit burn monitor procedures,
post-burn actions, entry maneuver procedures,
and panel configurations.

3.3-1
3.3-2
3.3-2

Pocket Checklists
Some of the documents in the Off-Nominal
section of the FDF contain critical procedures that
must be performed within 5 minutes. The three
pocket checklists (PCLs) (Ascent, Orbit, and
Entry) and associated cue cards contain these
critical data. The PCLs are readily distinguished
by the yellow card stock used for the pages. The
Ascent PCL contains procedures that safe
systems for continued flight. It also contains
orbiter systems powerdown procedures.
At the initiation of the post insertion phase, the
Orbit PCL is utilized. This PCL contains critical
orbiter systems malfunction responses and
powerdown procedures. The orbit PCL often
refers to the orbiter Malfunction Procedures
(MAL) Book for detailed troubleshooting.
The Entry PCL contains critical contingency
systems malfunction responses that allow safe
continuation of the pre-deorbit through early
entry phases along with orbiter systems
powerdown procedures.

Ascent/Entry Systems Procedures Book

The Ascent/Entry Systems Procedures Book
does not fly as a standalone document. It is the
control source for the CDR and PLT Ascent/
Entry Flip Books and Cue Cards. The first nine
sections of this document are replications of all
the Ascent/Entry Flip Books (excluding Ascent
Flip Books) and Cue Cards. They are added to
the front of the MS2s Ascent PCL and again to

Malfunction Procedures Book

The MAL Book is a large document dealing
with diagnostic steps used to identify, isolate,
and correct orbiter systems malfunctions
subsequent to quick response procedures or
noncritical system problems.
For orbiter
malfunctions not covered in the Orbit PCL, the
MAL Book is the prime reference.
The
procedures in the MAL Book are applicable for
on-orbit operations only. They may be flown
electronically or in hardcopy.

In-Flight Maintenance Checklist

The In-Flight Maintenance (IFM) Checklist
contains repair/reconfiguration procedures for
critical systems, and layouts of orbiter system
components. There is also a Standby Supplement available in Mission Control that contains
additional procedures.

Payload Systems Data and Malfunction

Procedures Book
The Payload Systems Data and Malfunction
Procedures (PL SYS DATA) Book is a flightspecific document that contains both offnominal procedures and reference information
for the missions payloads; it includes DPS
displays, systems schematics, malfunction
diagnostic flow, critical equipment lost with
multiplexer/demultiplexer (MDM) failures, and
photographs of payloads in the PLB.

3.3-1

3. FLIGHT DATA FILE

3.3 Off-Nominal Documents

USA007587
Rev. A

Medical Checklist

Contingency Deorbit Preparation Book

The Medical (MED) Checklist Generic contains

emergency medical procedures, medical
techniques with illustrations, and equipment/
medicine stowage. There are two cue cards
associated with the MED Checklist. They are
the MEDICATION DATA LOG, which is used
to track medication usage from the Shuttle
Orbiter Medical System (SOMS) and the
AIRWAY ILMA (Intubating Laryngeal Mask
Airway) cue card. The ILMA cue card provides
procedures on how to establish an open airway
on an incapacitated crewmember.

The Contingency Deorbit Preparation (CONT

Deorbit PREP) Book contains procedures and
the switch list for emergency deorbit during
orbits 2 or 3. It also contains the deorbit
procedures used for loss of the flash evaporator,
two fuel cells, two water loops, or two Freon
loops. Although this document has no cue
cards, landing site charts and other appropriate
data are added to flight copies for crew
convenience.

3. FLIGHT DATA FILE

3.3 Off-Nominal Documents

3.3-2

USA007587
Rev. A

3.4

Data Processing System Dictionary

REFERENCE DOCUMENTS

The Data Processing System Dictionary (DPS

DICT) contains a compendium and explanation
of all DPS displays onboard the orbiter. It also
has program notes on software limitations and
peculiarities with corrective instructions. It is
no longer flown as a piece of FDF, but is still
updated for use on the ground.

CONTENTS
Reference Data Book............................
Systems Data Book...............................
Data Processing System
Dictionary ...................................
Payload Systems Data/
Malfunction Book ......................
Maps and Charts Book ........................

3.4-1
3.4-1
3.4-1
3.4-1
3.4-1

Payload Systems Data/Malfunction Book

Reference Data Book

The Reference Data (REF DATA) Book contains
lists of critical inoperative equipment with the
loss of a bus or subbus and an ac/dc power
outlet chart.
There are also lists of
input/output (I/O) GPC parameters lost when
selective MDMs are inoperative. Additionally,
there is a list of all fault messages, C/W and
fault detection and annunciation (FDA) tables,
and a complete stowage list for crew
equipment, clothing, and Flight Data File (FDF).
User notes that were formerly a part of the DPS
Dictionary have also been added.

The Payload Systems Data/Malfunction (PL

SYS DATA/MAL) Book, detailed in the OffNominal section, can also be considered a
reference document because of some of the
payload-related data it contains.

Maps and Charts Book

The Maps and Charts Book contains landing
charts, an orbit map (with a movable 3revolution groundtrack), star charts, and a
World Atlas. The World Atlas also contains a
list of Earth sites for observation and
photography. Although the Maps and Charts
Book controls these media, they are stowed as
separate items on the flight deck and middeck.

Systems Data Book

The Systems Data Book (SYS DATA) is a large
document containing selected schematics of
most orbiter systems and structures taken
directly from the Space Shuttle Systems
Handbook. These schematics are augmented by
photographs of major components and
structures.

3.4-1

3. FLIGHT DATA FILE

3.4 Reference Documents

USA007587
Rev. A

This page intentionally left blank

3. FLIGHT DATA FILE

3.4 Reference Documents

3.4-2

USA007587
Rev. A

3.5

launch date, after the Cargo Integration Review

(CIR). Preliminary documents are not under
the formal change control of the CPCB.
Accordingly, they are under continual
development, and changes may be made
informally by any cognizant individual by
working through the book manager.

OPERATIONAL USE

CONTENTS
FDF Fabrication ....................................
Preliminaries.........................................
Basic ......................................................
482 ......................................................
Final ......................................................
Flight ......................................................

3.5-1
3.5-1
3.5-1
3.5-2
3.5-3
3.5-3

,
/
()

FDF Fabrication
Materials acquired for the fabrication of Flight
Data File (FDF) articles or for in-flight supplies
fall under four categories:

Printed material (print shop products,

photos, maps)
Commercial materials (paper boards, pens,
markers, ring binders)

Considering the tremendous volume of critical

information being presented in the shuttle FDF,
it is essential that special symbols be used to
abbreviate procedures.

Preliminaries
Development of the FDF for a mission normally
starts about 1 year prior to the launch date. The
preliminary work for payloads may start as
much as 2 years prior to launch. The earliest
FDF official publications (typically the Flight
Plan and payload related books) are designated
as Preliminary documents. These books are
published approximately 8 months prior to the

or chevron read exit

checkmarkread verify ... or check... or check with...

plus followed by space then valueread as add

plus followed by value without spaceread as positive

minus followed by space then valueread as mathematical subtract

minus followed by value without spaceread as negative

up arrowupper limit exceeded

down arrowlower limit exceeded

deltaread change

double dotindicates that preceding data is to be highlighted in flight

book
vertical lineread ...or...between alternate conditional statements

* *
* *
* *

vertical barin page margin to indicate change in procedure since last

publication
dotted boxencloses alternate or optional steps
vertical starsbrackets contingency steps
box DPS display callout

Certified and approved materials with

Federal Stock Numbers purchased through
the JSC Stores Stock Catalog

These items used by FDF Operations must be in

compliance with current safety, reliability, and
quality assurance (QA) standards, or in receipt
of a Material Usage Agreement (MUA) waiver.
Annex E of the CPMP identifies the documents
containing these standards and describes the
physical dimensions of all JSC fabricated FDF
items used onboard the orbiter.

slashread..and/or...
parenthesesread...or...

>>

JSC components (edge labels, map frames,

accessory bags)

commaread..and...

boxread block n which refers to corresponding block of procedures

FDF Symbols

Basic
Approximately 4 months prior to the launch
date, the Basic editions of all flight-specific/
supplement FDF are published. The documents
are now under the configuration control of the
CPCB and all changes must be requested
through formal channels that include approval
by cognizant personnel. Generic documents are
also subject to these formal change
requirements, although their publication cycles
are independent of mission cycles. Only those
Generic books that incorporate temporary
flight-specific pages will normally require
changes during the FDF preparation for a
specific mission. About 3 weeks after the
publication of the Basic FDF document, a Flight
Operations Review (FOR) is held at JSC. The
FOR is a formal review of payload related
documents that the flight crew and ground
controllers will use for training and flight. It
also provides a forum to verify that authorized
customer requirements have been met and that

3.5-1

3. FLIGHT DATA FILE

3.5 Operational Use

USA007587
Rev. A
safety and shuttle operational requirements
related to payload operations are correct.
Representatives from the Flight Crew
Operations
and
Mission
Operations
Directorates, Shuttle Integration and Operations
Office, customer personnel, and other NASA
personnel, as required, are invited to attend.
These representatives may submit Discrepancy
Notice (DN) forms regarding additions (for
existing
requirements),
deletions,
or
modifications to any FDF document under
review for that specific flight. The DNs are
evaluated by the book manager who
recommends
approval,
disapproval,
or
withdrawal to the FOR preboard.
DNs
recommended for disapproval or withdrawal
will be reviewed in splinter meetings as
required. Final action on all of the DNs is taken
by the formal FOR board, which is chaired by
the Manager, Space Shuttle Integration and
Operations, and made up of management
personnel representing the mission payload(s)
and NASA directorates. DNs receiving an
approval will usually be incorporated into the
next publication cycle of the appropriate
document. If the data are critical to crew
training, the material will be immediately
incorporated into all pertinent training
documents via simulation packages (Sim Pacs).

deletions to the quantities of FDF documents

and supplies they wish to have onboard.

482 Start

Initiator_Org
Internal Review

Stop
482

Group and
Branch Chief

PMO
Processing

Override

CPCB
Rep

Evaluators
FDF
Manager
Disposition

Book
Manager

Record Implementation

Implement
Change

Initiator
Verify
Implement
usa007587_799r1.cvx

482 Flow

482
Subsequent to the FOR, changes to FDF must be
made via a Crew Procedures Change Request,
JSC Form 482-B. The 482 process is detailed in
CPMP Annex B. As before, anyone may submit
a 482 requesting a change to a particular FDF
document.
The 482 will be reviewed by
cognizant personnel and approved or
disapproved. Disapproval by anyone in the
review process causes the 482 to be
dispositioned by the CPCB.
There is an
appellate process for 482s disapproved at the
CPCB through the appropriate Level II board.
An alternative method of changing minor FDF
material is available via an EZ 482. This form
requires much less review and fewer signatures,
but its use is quite limited and only available
from the book manager.
Approximately 4 months prior to flight, the
crew determines the allowable additions and
3. FLIGHT DATA FILE
3.5 Operational Use

3.5-2

Initiator
(Book Mgr)
Member and
* CPCB
Flight Director

coordination required
only if after Crew FDF
Review

FDF
Management
Office

Book Mgr

FDF Ops
(File Original in
Master 482 File
- FDF Office )

Distribution
(Limited)

usa007587_800r1.cnv

EZ 482 Flow

USA007587
Rev. A

Final
Approximately 6 weeks prior to flight, the Final
versions of flight-specific/supplement FDF
documents are published. Changes can still be
made to the FDF after publication of the Final
version via a 482. Changes that affect a small
percentage of the pages in a book will normally
be implemented with a Page Change Notice
(PCN). When more than one half of the pages
must be reprinted, or many affected pages are
scattered throughout a book, a complete
revision (REV) will be printed.
Other
authorized changes may be implemented via an
Errata Pack. These changes may be pen and ink
modifications or reprints of a particular page.
Technical modifications of the flight documents
by the crew during their review will be
promulgated in an Errata Pack subsequent to
the completion of a 482. A duplicate copy of the
FDF is available to the crew while they are in
quarantine at JSC. The prime and an identical
backup set of the FDF are configured for flight
and shipped to KSC separately.

Flight
The crew has access to the backup copy of the
FDF while in the crew quarters at KSC. On
launch day, FDF representatives turn over the
carry-on FDF to the astronaut support person
(ASP), who installs the appropriate FDF
documents for launch. The suit technicians lay
out the other carry-on FDF for the crew to stow
in their FDF bags. After the crew has ingressed,
the ASP makes the final installations and
adjustments of the cue cards, flip books, and
checklists. Although the number can vary
slightly for a particular mission or crew, at
launch there are about 7 copies of the 3 ascent
related checklists, 5 flip books, and 34 cue cards
out/mounted for the crews use. The checklists
are attached to lanyards, while the cue cards
and flip books are affixed with Velcro.
Additional cue cards and checklists are readily
available to the crew in the CDR/PLTs FDF

containers and the MSs FDF bags for certain

low probability contingencies. The CDR and
PLT post insertion checklists are also stowed in
the FDF containers.
Approximately 1 hour after launch, when the
crew transitions to the Post Insertion Checklist,
MS 3 retrieves selected FDF from a middeck
locker. Items not needed right away are usually
placed in a stowage bag on the back of the CDR
or PLTs seat. At this time, ascent-related
material is stowed in a helmet bag and placed
into a return to Houston stowage bag.
Subsequent to Mission Controls GO for orbit
ops, the crew may unstow additional FDF as
required. FDF control during the on-orbit
phase of the mission is basically a crew
decision. There are certain contingency FDF
documents (CONT Deorbit, Entry, Entry PCL)
that should be readily available. Others may be
mounted in a convenient place in the orbiter,
stowed in a temporary location, or stowed in
the FDF locker. Prior to the last sleep cycle, the
crew will begin the stowage of on-orbit oriented
FDF. During the deorbit preparation phase, the
crew stows the remainder of their on-orbit FDF
and installs the Deorbit and Entry Cue Cards,
Flip Books, and Checklists.
After landing, the ASP enters the orbiter and
collects the Deorbit and Entry FDF and places
them in return to Houston bags with the
other FDF. They are returned to Houston with
the crew. Kneeboard cards and other items of
importance to the crew are collected by the suit
technicians and returned to Houston as soon as
possible. During postflight debriefings, the
crew has access to the flown FDF, kneeboard
cards, and microcassettes to help reconstruct
events of the mission. The flown FDF is copied
onto microfiche and after 6 months it is
transferred to the National Archives in
Washington, DC. The backup copies are reused
if feasible, or destroyed. The crew may request
portions of the backup material as mementos.

3.5-3

3. FLIGHT DATA FILE

3.5 Operational Use

USA007587
Rev. A
SOFTWARE
FLIGHT
PHASE

EVENT
MEMORY
CONFIG

A
S
C
E
N
T

O
R
B
I
T

E
N
T
R
Y

FLIGHT DATA FILE

MAJOR MODE * *
GNC

SYSTEMS
MGMT

FLIGHT PROCEDURE

TROUBLESHOOTING
PROCEDURES*

Precount

901

--

Terminal Count

101

--

First Stage

102

--

Second Stage

103

--

Orbital Insertion

104

--

105

--

Ascent Checklist
Cue Cards

Ascent Pocket Checklist

Orbit Circularization
Post-Insertion Coast

106

--

Post-Insertion Checklist

Orbit Pocket Checklist

STS Malfunction Procedure

--

RTLS 2nd Stage

601

Glide RTLS-1

602

Ascent Checklist

Ascent Flip Book

Cue Cards

Ascent Flip Book

Glide-RTLS-2

603

Orbit Coast

201

---

Orbital Maneuver

202

--

On-Orbit Checkout

801

--

Orbit Operations

4, 5

--

201, 401

Payload Bay Door Operations

Post Insertion Checklist

Flight Plan
Orbit Operations Checklist
Payload Checklists
Deorbit Preparation
Checklist

CDR Flip Book

Pilot Flip Book
Pilot Overhead Flip Book
Cue Cards

CDR Flip Book

Pilot Flip Book
Pilot Overhead Flip Book
Cue Cards

Orbit Pocket Checklist

Cue Cards
STS Malfunction Procedures

4, 5

--

202, 402

Predeorbit Coast

301

--

Deorbit Maneuver

302

--

Preentry Monitor

303

--

Entry Checklist
Cue Cards

Entry Pocket Checklist

Cue Cards

Early Entry

304

--

Cue Cards

CDR Flip Book

Pilot Flip Book

TAEM/Landing

305

--

Post-Landing

901

--

Entry Checklist

Pilot Overhead Flip Book

Cue Cards

Deorbit Preparation Checklist

Entry Checklist

During ascent and entry, the Mission Specialist uses the Ascent/Entry Systems procedures.

**

Major modes separated by a dashed line have automatic transitions from one to the next. Major Mode discussion is in Section 2.6, Data Processing
System

Shuttle Mission Overview

3. FLIGHT DATA FILE

3.5 Operational Use

3.5-4

Shuttle Mission Overview

USA007587
Rev. A

3.5-5

3. FLIGHT DATA FILE

3.5 Operational Use

USA007587
Rev. A

This page intentionally left blank

3. FLIGHT DATA FILE

3.5 Operational Use

3.5-6

USA007587
Rev. A

4.

This section delineates limitations for selected

orbiter systems, equipment, and operations. It
is not all inclusive. Limitations that the flight
crew should be aware of have been
emphasized. It must be noted that operations
up to and including the given limits for one
system may cause a violation of the limits for
another. An example would be flying at the
flight control system maximum allowable knots
equivalent airspeed (KEAS). This KEAS would
overspeed the landing gear with a lower
maximum allowable KEAS.

OPERATING LIMITATIONS

CONTENTS
4.1
4.2
4.3
4.4

INSTRUMENT MARKINGS....
ENGINE LIMITATIONS ..........
AIRSPEED LIMITATIONS ......
ANGLE OF ATTACK
LIMITATIONS ...........................
4.5 SIDESLIP LIMITATIONS.........
4.6 LANDING WEIGHT
LIMITATIONS ...........................
4.7 DESCENT RATE
LIMITATIONS ...........................
4.8 CENTER OF GRAVITY
LIMITATIONS ...........................
4.9 ACCELERATION
LIMITATIONS ...........................
4.10 WEATHER LIMITATIONS......

4.1-1
4.2-1
4.3-1
4.4-1
4.5-1
4.6-1
4.7-1
4.8-1
4.9-1
4.10-1

Limitations are those measurable or detectable operational limits, which

if exceeded, will affect crew safety or result in performance degradation.

4-1

4. OPERATING LIMITATIONS

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS

4-2

USA007587
Rev. A

4.1

Subsystem Status MEDS Display

INSTRUMENT MARKINGS

The meters on panels F7 and F8 have been

removed and replaced with a MEDS display.
The following parameters can be viewed by
depressing the SUBSYSTEM STATUS key on
the MEDS toolbar and then selecting the appropriate subsystem (OMS/RCS, HYD/APU, SPI).

CONTENTS
Description............................................
Panel F9 Meters ....................................
Panel O1 Meters ...................................
Panel O2 Meters ...................................
Panel O3 Meters ...................................

4.1-1
4.1-5
4.1-6
4.1-9
4.1-11

Normal operating ranges are

indicated by:

Description
Instrument markings reflect the normal range
(green) and upper/lower limits (red). Caution
and warning alarms/tones will normally sound
at the points marked in red. In some cases an
SM alert will sound prior to the limits on the
meters being reached. The meter indications in
this section are arbitrary and are not intended to
reflect actual flight conditions. For MEDS,
vehicles, see section 2.18, MEDS for OMS/MPS,
HYD/APU, SPI, and Flight Instruments.

= GREEN

High/low limits are indicated

by:
0

287

431

575

OMS
L
XXXX

143

143

11

719

M PS
R
XXXX

He
TK
P

PN EU
XXXX

= RED

863

C /1
XXXX

L/2
XXXX

1007

R /3
XXXX

1151

10

He
TAN K
P

TAN K
P

287

XXXX

3
431

XXXX

N2
TK
P

XXXX

XXXX

XXXX

XXXX

He
R EG A
P

R EG
P

14
575

Alpha/Mach Indicator

L
XXXX

The MEDS alpha tape displays a maximum liftto-drag (L/D) diamond. The diamond position
is a linear interpolation of table values. For
Mach 0.95, the diamond is fixed at 10.5.

R
XXXX

EN G M AN F
LO 2
LH 2
XXXX
XXXX

719

P
SI
A

Pc
%

C /1
XXXX

L/2
XXXX

Pc
%

R /3
XXXX

13
12

Pc
%

863

The MEDS alpha tape also displays a green bar

indicating maximum and minimum alpha limits
on entry.
The maximum and minimum
positions are a linear interpolation of a table of
values based on the current flight rule limits.

15

L OMS He TK PRESS meter

16

17

18

19

8 L ENG He TK PRESS meter

15 LO2 ENG MANF PRESS meter

16 LH2 ENG MANF PRESS meter

R OMS He TK PRESS meter

9 C ENG He TK PRESS meter

3 L OMS N2 TK PRESS meter

10 R ENG He TK PRESS meter

17 L ENG Pc meter

4 R OMS N2 TK PRESS meter

11 PNEU He REG PRESS meter

18 C ENG Pc meter

5 L OMS Pc meter

12 L ENG He REG PRESS meter

19 R ENG Pc meter

6 R OMS Pc meter

13 C ENG He REG PRESS meter

7 PNEU He TK PRESS meter

14 R ENG He REG PRESS meter

1078.CNV

OMS/MPS MEDS Display

OMS PRESS Pc Meter
The left and right Pc (thrust chamber pressure)
is measured by a sensor that is routed through a
dedicated signal conditioner (DSC) before being
displayed on the OMS/MPS display and sent to
the GPCs.
OMS PRESS N2/He Tank Meter

Entry PFD
with Alpha Tape Markings

Separate N2 and He pressure sensors (left and

right) are wired through a DSC to the
OMS/MPS display and GPCs.
Redundant
pressure sensors provide the pressure readings
for N2 and He on the GNC SYS SUMM 2
display.
4.1-1

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A
Meter

Meter Marking(s)

Marking Explanation(s)

OMS He TK P
(L, R)

<1500 psia (red)

Low limit (Class 3 C/W)

OMS N2 TK P
(L, R)

<1200 psia (red)

Low limit (Class 3 C/W)

OMS Pc %
(L, R)

95 - 110% Pc (white)

Normal operating range

<80% Pc (red)

Low limit (Class 2 C/W)

72% Pc allowed during ullage
blowdown

>116% (appx)

Off-scale high (Class 2 C/W)

A value of 160 is displayed in red
and the Pc box goes red

MPS HE TANK P
(C, L, R)

<1150 psia (red)

Low limit (Class 2 C/W)

MPS HE REG A P
(C, L, R)

>810 psia (red)

High limit (Class 2 C/W)

<680 psia (red)

Low limit (Class 2 C/W)

MPS Pc %
(C, L, R)

65 - 109% Pc (white)

Normal operating range

(104% Pc is the nominal maximum
with power available up to 109% Pc)

MPS PNEU TANK P

<3800 psia (red)

High limit (Class 3 C/W)

MPS PNEU REG P

>810 psia (red)

High limit (Class 3 C/W)

<700 psia (red)

Low limit (Class 3 C/W)

>249 psia (red)

High limit (Class 2 C/W)

45-175 psia (green)

Normal operating range for LO2

>60 psia (red)

High limit (Class 2 C/W)

30-45 psia (green)

Normal operating range for LH2

MPS ENG MANF LO2

MPS ENG MANF LH2

MPS PRESS Pc Meter

WARNING

The left, center, and right Pc (thrust chamber

pressure) are measured by a sensor that is
wired via the GPCs through flight forward (FF)
multiplexer/demultiplexer (MDM) 2, 1, or 3
respectively, to the OMS/MPS display. Power
failure of an FF MDM or a data path failure will
cause the affected Pc meter to drop to zero.
GPC failure and some FF MDM failures can
cause the affected Pc reading to freeze.

MPS performance has not been verified in

flight beyond a power level of 104 percent.

4. OPERATING LIMITATIONS
4.1 Instrument Markings

4.1-2

WARNING
MDM power failure can cause MPS Pc
indication to drop to zero. Confirm engine
failure with acceleration cues, MPS He
consumption, or MCC call.

USA007587
Rev. A
MPS PRESS ENG MANF Meter

system manifold. Data are sent directly to the

OMS/MPS display and through an MDM to the
GPCs for display on BFS GNC SYS SUMM 1.

The LO2 and LH2 manifold pressures are

measured by a single transducer in each LO2
and LH2 line between the ET and SSMEs.
The data are sent directly to the OMS/MPS
display and through an MDM to the BFS GNC
SYS SUMM 1 display.

The Pneumatic regulator, Left, Center, and Right

He Regulator A pressures are measured by a
single sensor downstream of each regulator. Data
are sent directly to the OMS/MPS display and
through an MDM to the GPCs for display on BFS
GNC SYS SUMM 1.

MPS PRESS HELIUM and PNEU Meters

The pneumatic, left, center, and right He tank
pressures are measured by a single sensor in each

APU
1
XXX

2
XXX

3
XXX

FUEL
QTY
%

1
XXXX

2
XXXX

3
XXXX

XXXX

XXXX

XXXX

2
XXXX

3
XXXX

FUEL
P

XXX

XXX

XXX

H2 O
QTY
%

OIL
IN TEMP
F

HYDRAULIC
1
XXX

2
XXX

3
XXX

1
XXXX

QTY
%

PRESS
L

1092.CV5

HYD/APU MEDS Display

4.1-3

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A
Meter
Hydraulic Pressure

Hydraulic Quantity

Fuel Quantity

Fuel Pressure

Water Quantity

Meter Marking(s)

Marking Explanation(s)

2900 - 3200 psia (green)

Normal operating range

2400 psia (red)

Low limit (Class 2 C/W)

500 - 1000 psia (green)

Normal low pressure operating

range

40 - 80% (green)

Normal operating range

>95 or <40% (red)

SM alert sounds

>20% (green)

Normal operating range

<20% (red)

SM alert sounds at 20%

50 - 370 (green)

Normal operating range; however, it

would require multiple failures
before the pressure could reach 50.
SM alert sounds at 100 and 350 psia

110 psia (red)

Low limit for hot restart

>40% (green)

Normal operating range

<40% (red)

SM alert sounds at 40%

Hydraulic Pressure Meter

Fuel Quantity

Three sensors in each hydraulic system measure

the fluid pressure. The A sensor is wired
through a DSC to the HYDRAULIC PRESSURE
meter (HYD/APU MEDS display), while the
B sensor provides inputs for the SM SYS
SUMM 2, SPEC 87 APU/HYD, and SPEC 87
HYD THERMAL displays. Mission Control has
access to the data from the C sensor via
downlist data. All three sensors are used for
priority rate limiting (PRL). PRL status is
available on the OVERRIDE (SPEC 51) display.

Fuel quantity is determined by a pressure/

volume/temperature (PVT) calculation performed by the onboard computers. The calculated quantity is output to the HYD/APU
display and to DPS displays SM SYS SUMM 2
and SPEC 86 APU/HYD.

Hydraulic Quantity Meter

A sensor located in each of the three hydraulic
reservoirs provides the information displayed
on the HYDRAULIC QUANTITY meter and on
the SM SYS SUMM 2 and SPEC 86 APU/HYD
displays. Data is sent to the meter and GPCs
via a DSC. It is also sent to the GPCs via an
orbiter instrumentation MDM.

4. OPERATING LIMITATIONS
4.1 Instrument Markings

Fuel Pressure
There are two sensors: one on the N2 side and
one on the fuel side. Both go to the SPEC 86
APU/HYD display, but only the N2 side sensor
goes to the meter via a DSC.
WSB H2O Quantity
The H2O quantity is determined by a PVT
calculation based on H2O tank pressure and
temperature transducer readings as well as GN2
tank pressure and temperature transducer
readings. The calculated quantity is output to
the HYD/APU display and to the SM SYS
SUMM 2 and SPEC 86 APU/HYD displays.

4.1-4

USA007587
Rev. A
Oil Temperature

DC VOLTS Meter

Oil temperature in the three APUs is measured

by sensors located upstream and downstream
of the water spray boilers. Data from the downstream sensor (OIL IN T) is routed to the OIL IN
TEMP meter (HYD/APU MEDS display) via a
DSC. The SM SYS SUMM 2 and SPEC 86
APU/HYD displays show data from both
sensors (OIL IN T and OIL OUT T).

DC voltage is read directly at each fuel cell,

main bus, and essential bus. The data is routed
to the meter and to the SM SYS SUMM 1, SPEC
67 ELECTRIC, and SPEC 69 FUEL CELLS
displays.

METER MARKINGS(S)

MARKING EXPLANATION(S)

50 - 70 F (green)

Normal operating range when APUs

are off

200 - 270 F (green)

Normal operating range when APUs

are off

290 F (red)

High limit (Class 2 C/W)

Panel F9 Meters
AC VOLTS Meter
AC phase voltage (A, B, and C) is read directly
at each of the three buses. There is no AC
AMPS meter for the AC system that monitors
AC current. The data is sent to this meter and
to the SM SYS SUMM 1 and SM SPEC 67
ELECTRIC displays.

DC VOLTS Meter
METER MARKINGS(S)

MARKING EXPLANATION(S)

28 32 (green)

Normal operating range (SM alert at

32.5)

26.4 (red)

Low limit (Class 2 C/W)

DC AMPS/SIG STR Meter

AC VOLTS Meter
METER MARKINGS(S)

MARKING EXPLANATION(S)

115 119 (green)

Normal operating range

123 (red)

High limit (Class 2 C/W)

108 (red)

Low limit (Class 2 C/W)

A current sensor for each of the three fuel cells

provides an input to the DC AMPS/SIG STR
Meter. (SIG STR refers to S-band signal
strength that is also monitored on this meter.)
Essential and main bus current are not
monitored. The data also appear on the SM SYS
SUMM 1, SPEC 67 ELECTRIC, and SPEC 69
FUEL CELLS displays.

4.1-5

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A

DC AMPS/SIG STR Meter

METER MARKINGS(S)
90 350 A (green)

MARKING EXPLANATION(S)
Normal operating range

AIR TEMP, H2O PUMP OUT PRESS Meter

Panel O1 Meters

METER MARKINGS(S)

AIR TEMP, H2O PUMP OUT

PRESS Meter

50 60 F (green)

Temperature data from a sensor downstream

from the cabin heat exchanger are sent directly
to the dual function AIR TEMP Meter and are
also available on the SM SYS SUMM 1 and
SPEC 66 ENVIRONMENT displays.
Avionics Bay Air Temperature

Sensors in water loops 1 and 2 send data to this

meter via a DSC and to the SM SYS SUMM 2
and SPEC 88 APU/ENVIRON THERM displays
via an MDM. Certain preconditions must exist
for the C/W system to activate at the values
listed below. Those preconditions are found in
the FDF Reference Data book.

Temperature data from a sensor located

downstream of the avionics bay fans are sent
directly to the AIR TEMP Meter. These data are
also available on the SM SYS SUMM 2 and
SPEC 66 ENVIRONMENT displays.
METER MARKINGS(S)

MARKING EXPLANATION(S)
Normal operating range
High limit for avionics bay air temp
(Class 2 C/W)

4. OPERATING LIMITATIONS
4.1 Instrument Markings

Normal operating range

H2O Pump Out Pressure

Cabin Heat Exchanger Air Temperature

75 110 F (green)
130 F (red)

MARKING EXPLANATION(S)

4.1-6

METER MARKINGS(S)
Loop 1
55 65 psia (green)
79.5 (unmarked)
19.5 Psia (red)
Loop 2
55 65 psia (green)
81 psia (red)
45 psia (red)

MARKING EXPLANATION(S)
Normal operating range
High limit (Class 2 C/W)
Low limit (Class 2 C/W)
Normal operating range
High limit (Class 2 C/W)
Low limit (Class 2 C/W)

USA007587
Rev. A
NOTE

METER MARKINGS(S)

SM alerts will occur at 75 psia (high) and

50 or 20 psia (low), depending on preconditions for both loops.
FREON FLOW,
EVAP OUT TEMP Meter
Flow
A sensor located upstream from the H2O/
Freon Interchanger in Freon Loops 1 and 2
provides a readout of Freon interchanger flow
directly to the meter and to the SM SYS SUMM
2 and SPEC 88 APU/ENVIRON THERM
displays.

MARKING EXPLANATION(S)

2300 2500 psia

(green)

Normal operating range (Flow

Proportioning Valve in Payload (PL),
SM alert at 1300 psia)

1400 2200 psia

(green)

Normal operating range (Flow

Proportioning Valve in Interchanger
(ICH), SM alert at 1950 psia)
[Change pending to meter markings
to reflect C/W limits]

1200 psia (red)

Low limit (Class 2 C/W)

Bypass

Radiator

Evaporator Out Temperature

A sensor located downstream from the flash
evaporator in each Freon Loop 1 and 2 provides
data directly to the meter and to the SM SYS
SUMM 2 and SPEC 88 APU/ENVIRON
THERM displays.
METER MARKINGS(S)

MARKING EXPLANATION(S)

38 40 F (green)

Normal operating range

65 F (red)

High limit (Class 2 C/W)

32 F (red)

Low limit (Class 2 C/W)

CABIN dP/dT PSIA/MIN,

O2/N2 FLOW Meter
Cabin dP/dT
The indication on this meter is a direct readout
of the dP/dT sensor.
The data are also
transmitted to the SM SYS SUMM 1 and SPEC
66 ENVIRONMENT displays.
The DPS
displays also contain an additional backup
dP/dT supplied by computations.
O2/N2 Flow
An O2 and N2 flow sensor in the two pressure
control systems (four total) send data directly to
the O2/N2 FLOW Meter. The readings are also
available on the SM SYS SUMM 1 and SPEC 66
ENVIRONMENT displays.
METER MARKINGS(S)

FREON FLOW, EVAP OUT TEMP Meter

4.1-7

MARKING EXPLANATION(S)

0.0 0.75 pph (green)

Normal operating range

4.9 pph (red)

High limit (Class 2 C/W)

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A

CABIN PRESS, PPO2 Meter

METER MARKINGS(S)

CABIN dP/dT PSIA/MIN,

O2/N2 FLOW Meter
METER MARKINGS(S)

MARKING EXPLANATION(S)

14.3 14.7 psia

(green)

Normal operating range

15.2 psia (red)

High limit (Class 2 C/W)

13.8 psia (red)

Low limit (Class 2 C/W)

MARKING EXPLANATION(S)

0.0 psia (green)

Normal operating range

-0.08 psia (red)

Low limit (Class 2 C/W)

PPO2
Dual selectable sensors (A or B) send data
directly to this meter and for the SM SYS
SUMM 1 and SPEC 66 ENVIRONMENT
displays.

CABIN PRESS, PPO2 Meter

Cabin Pressure

METER MARKINGS(S)

A cabin pressure sensor provides a direct indication for this meter and for the SM SYS SUMM 1
and SPEC 66 ENVIRONMENT displays. (The
airlock pressure on the CRT ENVIRONMENT
display can be used as a backup.)

4. OPERATING LIMITATIONS
4.1 Instrument Markings

4.1-8

MARKING EXPLANATION(S)

2.95 3.45 psia

(green)

Normal operating range

3.6 psia (red)

High limit (Class 2 C/W)

2.7 psia (red)

Low limit (Class 2 C/W)

USA007587
Rev. A
CRYO O2 PRESS Meter

Panel O2 Meters
CRYO O2 HTR ASSY TEMP Meter
A temperature sensor in each of the eight O2
tank heater assemblies monitors the temperature of warmed O2 and sends the data via a
DSC to this meter and the SM SYS SUMM 2 and
SPEC 68 CRYO SYSTEM displays.

One sensor for each of the O2 tanks provides

pressure data via a DSC to the meter and SM
program while another sensor (heater
controller) sends data to the SM SYS SUMM 2
and SPEC 68 CRYO SYSTEM displays.

CRYO O2 PRESS Meter

METER MARKINGS(S)

MARKING EXPLANATION(S)

802 930 psia (green)

Normal operating range

985 psia (red)

High limit (Class 2 C/W)

540 psia (red)

Low limit (Class 2 C/W)

CRYO O2 HTR ASSY TEMP Meter

METER MARKINGS(S)

NOTE

MARKING EXPLANATION(S)

-300 +200 F
(green)

Normal operating range

+349 F (red)

High limit (Class 2 C/W)

SM alerts occur at 960 psia (high) and 575

psia (low), with heaters not in AUTO or
740 psia (low) with A or B heater in
AUTO.

NOTE
For OV-105, the METER TANK SELECT
switch will show HTRS 1 and 2 for tank 5
as well.

CRYO H2 PRESS Meter

One sensor for each H2 tank provides pressure
data to the meter via a DSC and SM software,
while another sensor (heater controller) sends
data to the SM SYS SUMM 2 and SPEC 68
CRYO SYSTEM displays.
4.1-9

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A

CRYO H2 PRESS Meter

CRYO FUEL CELL STACK TEMP Meter

NOTE

METER MARKINGS(S)

Tank 5 SELECT position is included on

OV-105.
METER MARKINGS(S)

MARKING EXPLANATION(S)

200 250 psia (green)

Normal operating range

293.8 psia (red)

High limit (Class 2 C/W)

153 psia (red)

Low limit (Class 2 C/W)

MARKING EXPLANATION(S)

190 225 F (green)

Normal operating range

243.7 F (red)

High limit (Class 2 C/W)

172.5 F (red)

Low limit (Class 2 C/W)

NOTE
SM alerts occur at:

NOTE

High

SM alerts occur at 283 psia (high) and 165

psia (low) with heaters not in AUTO, or
189.8 psia (low) with A or B heater in
AUTO.

(1) 212 F

180 F

Less than 3.5 kW

(2) 222 F

190 F

3.5 - 7.5 kW

(3) 238 F

198 F

More than 7.5 kW

CRYO FUEL CELL

STACK TEMP Meter
A sensor in each of the three fuel cell systems
measures the temperature of the coolant leaving
the fuel cell stack and sends the data via a DSC
to this meter and the SM SYS SUMM 1 and
SPEC 69 FUEL CELLS displays.
4. OPERATING LIMITATIONS
4.1 Instrument Markings

4.1-10

Low

If FC Output is:

USA007587
Rev. A
RCS Pressure

Panel O3 Meters

RCS oxidizer, fuel, and helium (X10) pressures

are displayed for the left, forward, and right
systems by way of dual sensors. One sensor
sends data via a DSC to the meter and the SPEC
23 RCS display, while the other routes data via
a DSC to the GNC SYS SUMM 2 display. RCS
pressure limits/normal ranges are marked on
the left side of the meters and are identical for
oxidizer and fuel.

RCS/OMS PRESS LEFT/FWD/

RIGHT OXID, FUEL Meter

NOTE
There are no He limits marked on the
meters. An SM alert is generated if He
pressure reaches 500 psia (low).
OMS Pressure
OMS oxidizer and fuel pressures are displayed
for the left and right systems by way of a single
sensor in each tank. The sensors send data via a
DSC to the meters and the GNC SYS SUMM 2
display. OMS limits/normal ranges are marked
on the right side of the meters and are identical
for oxidizer and fuel.
RCS/OMS PRESS LEFT/FWD/RIGHT OXID,
FUEL Meter
METER MARKINGS(S)

MARKING EXPLANATION(S)

235 255 psia (green)

Normal operating range

312 psia (red)

High limit (Class 2 C/W)

200 psia (red)

Low limit (Class 2 C/W)

4.1-11

METER MARKINGS(S)

MARKING EXPLANATION(S)

245 255 psia (green)

Normal operating range

284 psia (red)

High limit (Class 3 C/W; Class 2 and

BFS C/W at 288 psia)

232 psia (red)

Low limit (Class 2 hardware C/W;

software 234 psia)

4. OPERATING LIMITATIONS
4.1 Instrument Markings

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.1 Instrument Markings

4.1-12

USA007587
Rev. A

4.2

SSME Temperature

ENGINE LIMITATIONS

CONTENTS
Space Shuttle Main Engines
(SSMEs) .......................................
Orbital Maneuvering System
(OMS) Engines ...........................
Reaction Control System (RCS) Jets ..

4.2-1
4.2-2
4.2-3

Space Shuttle Main Engines (SSMEs)

Power
The SSMEs are designed to operate from 65
percent Pc to 109 percent Pc above 8,700 MSL.
The GPCs can command the engines only
within this Pc range. The following chart shows
minimum Pcs for altitudes below 20,000 ft.
MSL. The engines are limited to 736 seconds of
operation in the range of 65 percent to 104
percent Pc.
WARNING

Engine Power Level (%)

Shuttle MPS in flight performance has not

been verified beyond a power level of 104
percent Pc.

109
100

Acceptable
operating
range

80
60
40

65% at 8,700 Ft

20
0

5,000

10,000

15,000

20,000

Altitude (ft)
Minimum throttle vs. Altitude constraint
Minimum main engine
power level
(%RPL)
90.0
82.0
76.0
68.0
65.0

Altitude above
sea level
(ft)
0
2,500
5,000
7,500
> 8,700
823.cvs

Pc Chart

Mission Control Center (MCC) personnel

monitor three critical engine temperatures:
high pressure fuel turbopump (HPFT) high
temperature, high pressure oxidizer turbopump
(HPOT) high temperature, and HPOT low
temperature. Temperatures exceeding any of
their limits will result in a main engine
shutdown, unless the crew has manually
inhibited the shutdown limits via the MAIN
ENGINE LIMIT SHUTDN switch. The red
Main Engine STATUS light will illuminate,
regardless of the position of the switch, if any
one of these limits is exceeded. The crew has
insight into the GO2 OUT T (outlet
temperature), which is found on BFS GNC SYS
SUMM 1. This temperature varies directly with
engine power levels and can be used by the
crew to determine if the engine is failed. An SM
alert is annunciated when this value drops
below 125.
Propellant Pressure
MCC personnel monitor two critical pressures
that are not available on crew displays: HPOT
intermediate seal purge pressure-low and main
combustion chamber pressure-low. Pressures
exceeding any of their limits will result in a
main engine shutdown, unless the crew has
manually inhibited the shutdown limits; the red
ME STATUS light will illuminate regardless of
the position of the switch. In addition to the
main propulsion system (MPS) manifold LH2
and LO2 pressure limits indicated on the ENG
MANF meter (MEDS OMS/MPS display), an
SM alert will sound if MPS ULL P (ullage
pressure), on BFS GNC SYS SUMM 1, for LH2
or
LO2
reaches
the
indicated
maximums/minimums: LH2 34.0 psi/28.0 psi,
LO2 29 psi/0 psi. The crew has insight into the
GH2 OUT P (outlet pressure), which is found
on BFS GNC SYS SUMM 1. This pressure
varies directly with the engine power level and
can be used by the crew to determine if the
engine is failed. An SM alert is annunciated
when this value drops below 1050 psi.
Engine Nozzle Position
The MPS nozzles have sufficient dynamic
envelope such that they can collide with one

4.2-1

4. OPERATING LIMITATIONS
4.2 Engine Limitations

USA007587
Rev. A
another, OMS engine nozzles or pods (upper
SSME), or the body flap (lower SSMEs). The
crew cannot monitor this envelope.
Post
MECO, the GPCs will position the nozzles to
prevent interference and control entry heating
on the lower engine nozzles. SODB Vol 1,
section 3, and The Shuttle Performance Analysis
Databook (SPAD), Chapter 6, graphically depict
the nozzle envelopes.
MPS He Pressure
The first indication of a He leak will be an SM
alert annunciated when the He dp/dt exceeds
20 psi for three BFS cycles. The He dp/dt,
along with other MPS He pressures, is available
on BFS SYS SUMM 1 (He dp/dt is only
available in OPS 1). In addition, MPS He TK P
(tank pressures) and REG P. A (regulator A
pressures) are also available on the MEDS
OMS/MPS display.

Orbital Maneuvering System (OMS)

Engines

C&W for Main Engine He Pressure

ME He Tanks low

1150

Regs low

679

Regs high

810

Pneu He tank low

3800

Accum low

700

greater than 1500 psia and that it must go into

hydraulic lockup below 1100 psia. The loss of
hydraulic pressure (any pressure below 1500
psia) will initially send the engine valves into
soft lockup. Soft lockup implies that none of
the five engine valves has failed their channel A
and B actuator position checks. If no new
throttle commands are being executed, it may
take up to 1 minute for the valves to fail their
actuator checks.
If hydraulic pressure is
recovered prior to failure of the position checks,
the engine can come out of soft lockup and
normal engine operation can resume. A hard
hydraulic lockup will occur when any of the
five engine valves fail their channel A and B
actuator position checks. The controller software will then command all the valves to their
last commanded position before the lockup
occurred. The crew will see the corresponding
amber MAIN ENGINE STATUS light illuminate
and an MPS HYD (L,C,R) message.

Engine Chamber Pressure

SSME AC Power
SSME controller operation requires that all
three ac phases and voltages must not fall
below 100 volts RMS (root mean square) for
longer than 500 msec. Should this happen,
channel switchover (A to B) or engine
shutdown will occur.
Engine Electric Lockup
An electric lockup will occur if the main engine
controller loses both channels of Pc or fuel flow
meter data. This will cause the controller to
maintain the last commanded throttle position.
The crew will see the corresponding amber
MAIN ENGINE STATUS light illuminate and
an MPS ELEC (L,R,C) message.
Engine Hydraulic Lockup

There is no maximum Pc for the OMS engines

due to the stoichiometry of the fuel/oxidizer
mixture. Except during ullage blowdown, the
OMS Pc should never fall below 80 percent.
Operation with low Pc may cause engine
damage or combustion instability.
Engine Operations
The engines are not rated for use below 70K feet
due to exhaust flow separation and damage to
the nozzles. With normal engine shutdown
purge the following limitations apply: (1)
engine firings of less than 2 seconds are
prohibited due to possible propellant freezing
or hard starts; (2) the minimum engine off-time
between firings is 240 seconds for normal
operations and 30 seconds for launch abort
operations (15-second minimum burn) due to
possible propellant freezing or hard starts.
Without normal engine shutdown purge, the
off-time increases to 10 minutes (for burns more
than 10 seconds).

The engine design specifications state that the

engine must operate if hydraulic pressure is
4. OPERATING LIMITATIONS
4.2 Engine Limitations

4.2-2

USA007587
Rev. A

Reaction Control System (RCS) Jets

CAUTION

Jet Operations

OMS engines must never be interconnected

to use RCS propellant during OMS burns
due to the smaller volume of the RCS tanks
and the large propellant flow required by
the OMS engines. RCS propellant tank
damage will result.

Engine Temperature
The only OMS temperature monitored is the
fuel injector temperature. This temperature is
used to assess engine burn stability.
A fault message will be generated if the fuel
injector temperature in either OMS pod exceeds
260 F (indicative of low or high fuel inlet
pressure).

The maximum nominal firing duration for

forward and aft primary jets is 150 seconds, or
300 (-X forward RCS) and 800 (+X aft RCS)
seconds for contingencies. Verniers are limited
to 275 seconds in any 24-hour period. The
GPCs will limit the number of simultaneous jet
firings. The limit varies from 4 to 7 jets per pod,
depending on propellant quantity, flight phase
(mated coast, ET Sep, dump, etc.), and abort
mode (norm, RTLS, TAL, etc.). A nominal ET
separation requires the use of RCS from all
three pods. On entry, the aft RCS roll jets are
deactivated at a q-bar of 10 psf, the pitch jets at
q-bar of 40 psf, and the yaw jets at Mach 1.
ET SEPARATION RCS REQUIREMENTS
Jet
Group

Engine Propellant
If the OMS propellant quantity is less than 11
percent, an RCS settling burn should be
accomplished prior to OMS ignition. OMS
propellant quantity should be less than 22
percent to remain within the structural limit
for landing.

Minimum Requirements
Nominal

RTLS

FWD down

AFT left

AFT right

AFT up

1/side

2/side

AFT down

1/side

2/side

FWD yaw

1/side

ET Separation Chart

Engine Nozzle Position

Jet Propellant

If a nozzle moves more than 0.7 from its

stowed position, a fault message will be
generated to the ground and crew. If MCC is
satisfied that it has moved more than 1.5
inboard or up during the maximum q-bar
regime of ascent, the OMS engine will not
be fired.

The propellant tanks are not usable if pressure

is less than 185 psi. During ascent and orbit
(also entry when g-load is low) the maximum
allowable pressure differential between tanks
prior to initiating a crossfeed is 80 psi. When
acceleration is between 0 and 1.5 gs, the
maximum differential is 55 psi. The maximum
acceleration for initiating a crossfeed is 1.5 g. A
minimum of 1175 lb , or 53 percent total aft
RCS, is required for entry with a c.g. 1095 in.
For c.g. >1095, 1375 lb, or 62 percent total
ARCS, is redlined.

Engine N2 Pressure
The minimum nitrogen pressure for starting an
OMS engine is 299 psi (254 psi for contingencies
though abnormal start could occur).
The
maximum number of starts that can be
supported with the N2 system is 17.

RCS He Tank Pressure

The He tanks are considered lost if pressure is
less than 456 psi.

4.2-3

4. OPERATING LIMITATIONS
4.2 Engine Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.2 Engine Limitations

4.2-4

USA007587
Rev. A

4.3

mum airspeed limit is 486 KEAS. This is the

ultimate limit for both flight control and the
orbiter structure.

AIRSPEED LIMITATIONS

CONTENTS
Ascent ....................................................
Entry ......................................................
Landing..................................................

4.3-1
4.3-1
4.3-2

Ascent
The maximum airspeed (based on the q-bar
limit of 819 psf) for the shuttle fleet is 492 knots
equivalent airspeed (KEAS) where KEAS =
q bar x 17.18 (see figure below). These
limits are based on thermal protection system
(TPS) constraints. Flight design planning for
each mission keeps the vehicles airspeed (via
q-bar) below about 475 KEAS.

The minimum guidance and control airspeed

for Mach less than 5.0 is 163 KEAS. The
minimum practical airspeed below Mach 2.5 is
based on not flying on the back side of the L/D
curve. Although control is acceptable on the
back side of the L/D curve, there is no reason to
fly in this region. The only reason to fly slow is
to stretch to the runway if low energy, and
flying on the back side is not optimum for
stretching. Minimum airspeed (max L/D),
which is a function of weight and Mach, is
about 190 to 220 KEAS. The minimum airspeed
is available on the bottom line of the VERT SIT
display; however, a better technique is to
monitor maximum L/D alpha (diamond on the
alpha tape).

There is no official minimum airspeed for

ascent.

CAUTION
On a TAL, the VERT SIT may give the
lightweight minimum airspeed when the
TAL weight is heavy. This is because there
is only one set of OPS 3 VERT SITs and
flight software is always set to the EOM
weight.

820
800
Mach

750
0-0.8
0.9
1.0
1.05
1.10
1.15
1.25
1.40
1.55
1.80
2.10
2.20
2.50

700

650

600

0.80

1.0

Q (PSF)
103, 104
600
675
740
763
779
790
804
815
819
813
790
779
743

1.5
Mach Number

2.0

2.5

usa007587_828r2.cvx

TAEM guidance will limit minimum airspeed.

Unlike maximum airspeed, the gains for
minimum airspeed are not set so low that the
minimum airspeed will never be reached.
TAEM guidance will very effectively fly
maximum L/D if it needs to stretch to reach
a runway.

Source: NSTS 08934, SODB, Vol. I

Dynamic Pressure vs. Mach Number

Entry
The maximum certified airspeed during entry is
also a function of q-bar, which varies during the
descent profile. It reaches a maximum value at
350 psf or 321 KEAS. This protects for the
actual limit of 333 KEAS by accounting for air
data system and gauge tolerances. If the
maximum flight control limit is exceeded, it is
possible for the orbiter to go unstable in
roll/yaw. For contingency aborts, the maxi4.3-1

4. OPERATING LIMITATIONS
4.3 Airspeed Limitations

USA007587
Rev. A

Landing

WARNING

Maximum airspeed for lowering the gear is 312

KEAS, based on landing gear structural limits.

TAEM guidance must have air data to

perform airspeed limiting. If air data is not
incorporated to TAEM (G&C on SPEC 50),
the crew must fly pitch attitude limits
(theta limits) to avoid violating airspeed
limits. See section 7.4 for more details.
Minimum airspeed is further limited by an
uncontrollable pitch-up divergence. This pitchup divergence always occurs at a slower speed
than maximum L/D; however, at Mach 1.5 the
limit is close to maximum L/D. The airspeed
pitch-up divergence is not available onboard.
Alpha must be monitored to avoid a pitch-up
divergence. See section 4.4.

Maximum speed at landing is based on the 225

knots ground speed (KGS) certified tire speed
limit. To protect against this tire limit, the
maximum predicted ground speed at the T/D
evaluation velocity should not exceed 214 kt.
Short field speed brake may be used to achieve
the 11 kt pad. This pad was based on errors in
the air data system, changing winds, and
landing dispersions. Full 3 sigma protection
does not always exist for this limit, nor does it
exist for the minimum airspeed associated with
the tailscrape.

4 0 0 .0

3 5 0 .0
S tr u c tu r a l li m it
3 0 0 .0

Q B A R ( p s f)

2 5 0 .0

2 0 0 .0
M a xim u m
G N & C L i m it

1 5 0 .0

1 0 0 .0
M in i m u m G N & C L i m it

5 0 .0

0 .0
28.0

24.0

20.0

16.0

12.0
Vr e l ( K fp s )

Entry Dynamic Pressure Envelope

4. OPERATING LIMITATIONS
4.3 Airspeed Limitations

4.3-2

6.0

4.0

0.0
829 .c vs

USA007587
Rev. A
60 0

50 0

Q B A R ( p s f)

40 0

S tr u ctu r a l L im it
30 0

20 0

M a x im u m
G N & C L i m it

10 0

M i n im u m G N &C L i m it

0 .0
8.0

7.0

6.0

5.0

4.0

3.0

Vr e l ( K fp s )

2.0

1.0

0.0
830 .c vs

RTLS Dynamic Pressure Envelope

Minimum airspeed at touchdown is limited by

body flap scrape. This limit is protected by not
landing slower than the targeted landing speed.
For minimum airspeed, flight design protects
for the crew landing 10 knots slow. The term
"energy reserve" is often used to indicate the
amount of time that the crew can delay
touchdown and not scrape the body flap. See
orbit landing speed restrictions chart.
Derotation speed is limited by main gear
loading for maximum speed and nose gear
loading for minimum airspeed. The current
technique is to derotate at 185 KGS using the
beep trim on the RHC. Beep trim derotation
may be delayed to no slower than 165 KEAS.

Maximum airspeed for drag chute deploy is 230

KEAS. Above this velocity, the drag chute
shear pin will fail. This protects the orbiter
from an inadvertent deploy on final. Minimum
deploy speed is 80 KEAS.
Nominal drag chute jettison speed is 60 KGS;
however, the drag chute must be jettisoned by 40
KGS to protect the main engine nozzle. If ground
speed goes below 40 knots, the drag chute should
not be jettisoned

4.3-3

4. OPERATING LIMITATIONS
4.3 Airspeed Limitations

USA007587
Rev. A
240
Orbiter capability limit

Limited to 225 KGS maximum

Maximum

Touchdown velocity (KEAS)

220
OVEI spec limit
200

Minimum

Nose gear loads constraint

180

DBF = 0.0 deg

Tailscrape angle
160

DBF = 11.7 deg

Orbiter design spec

140

120
170

180

190

200

210

220

230

Orbiter landing weight (1000 lb)

OVEI = Orbiter vehicle end item.

Orbiter Landing Speed Restrictions

4. OPERATING LIMITATIONS
4.3 Airspeed Limitations

4.3-4

240

250

260
824.cvs

USA007587
Rev. A

4.4

The MEDS alpha tape displays the maximum

L/D alpha as a magenta and black diamond for
Mach 3.0. The tape also displays a green band
denoting the maximum/minimum alpha range
for Mach 2.5.

ANGLE OF ATTACK
LIMITATIONS

CONTENTS
Entry ......................................................

4.4-1

The Mach 1, 2, and 3 values are listed on the

Entry Alpha cue card. The subsonic value is not
listed in the FDF.

Entry
The following tables from Flight Rule A4-207,
Entry Limits, list the normal angle of attack
limits for the orbiter during entry.
50
40

Alpha (deg)

The maximum alpha for the orbiter during

entry is designed to protect the TPS, maintain
control in the three axes, meet structural
requirements
during
venting,
ensure
aerosurface hinge moments remain within
limits, and keep the orbiter within guidance
limits. Consequently, the alpha limits may be
well below the maximum/minimum usable
alphas.
The maximum L/D alphas for various Mach
numbers are:
Mach

Max L/D

17

15

12

Subsonic

10.5

30

1
20

10
0

Notes:

9 10 11

25

Mach Number
1
2
3
4

Flight control system design requirement

Cn dynamic
Venting, hinge moment
Guidance requirement
825.cvs

Orbiter Design Angle of Attack Limits

Angle of Attack (deg)

40

Back side
of power curve

Front side
of power curve

l P rof ile
Nomina

30

Max L/D

20

10

10

Mach Number
Orbiter flies back side of power curve (increasing alpha implies
increasing L/D) at Mach > 3.5
Orbiter flies front side of power curve at Mach < 3.5
Thermal or q-bar constraints prevent flying max L/D alphas until Mach 3
826.cvs

Orbiter Nominal Angle of Attack Profile

4.4-1

4. OPERATING LIMITATIONS
4.4 Angle of Attack Limitations

USA007587
Rev. A
TAEM I/F Mach 2.5
45

Angle of attack (deg)

40
35
30

Max. alpha

25

Nom. alpha

20

Min. alpha

15
10
5
0

10

15

20

25

Mach number

Angle of Attack Boundaries - MM 304 Only

Angle of attack (deg)

25
20
15

Max. alpha

10

Min. alpha

5
0
-5

0.5

1.5

2.5

Mach number
826b.cvs

Angle of Attack Boundaries - MM 305 Only

Mach

Max Alpha

Min Alpha

Mach

Max Alpha

Min Alpha

2.5
3.2
3.5
5.0
8.0
9.6
11.4
25.0

18.0
20.8
22.0
28.0
40.0
44.0
44.0
44.0

6.0
8.2
12.0
16.0
28.9
33.0
36.0
36.0

0.0
0.2
0.
0.6
0.8
1.1
2.0
2.5

20.0

-4.0
-4.0
0.0

4. OPERATING LIMITATIONS
4.4 Angle of Attack Limitations

4.4-2

20.0
15.0
15.0
18.0

4.0
4.0
6.0

USA007587
Rev. A

4.5

SIDESLIP LIMITATIONS

Numerous sideslip, , limitations for the

various ascent flight phases (SRB separation, ET
separation, aborts, etc.) are available in the
Shuttle Performance Assessment Databook
(SPAD). During the high dynamic pressure
phase of the ascent, the maximum sideslip
angle is also a function of angle of attack.
Typically, the maximum allowable ranges
from 3 to 6.

During entry, the maximum sideslip angle is

5. Also during entry (2< Mach <12), the crew,
by using the Roll Trim switch, will manually
trim to reduce RCS jet firings if steady state
sideslip exceeds 2, one or more yaw jets fire
continuously, or if scaled Ay (sensed lateral
acceleration) exceeds the two-jet capability.

4.5-1

4. OPERATING LIMITATIONS
4.5 Sideslip Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.5 Sideslip Limitations

4.5-2

USA007587
Rev. A

4.6

restrictions. Any flight with a manifest that

results in an intact abort or end of mission
(EOM) landing weight greater than the certified
limits must have a waiver specifying the limit
for that flight. Approval of the waiver will be
based on a case-by-case thermal analysis of the
entry trajectory.

LANDING WEIGHT
LIMITATIONS

CONTENTS
Maximum Landing Weight ................

4.6-1

The following table lists orbiter maximum

landing weights for ascent aborts and EOM.

Maximum Landing Weight

Landing weight limits are reduced for higher
inclination flights because of orbiter thermal

Inclination
28.5

39.0

51.6

57.0

RTLS

248k lb

248k lb

245k lb

242k lb

TAL

248k lb

248k lb

244k lb

241k lb

AOA/ATO

248k lb

248k lb

242k lb

239k lb

EOM

233k lb

233k lb

233k lb

233k lb

Flight Phase

Source: NSTS 07700, Vol. X, Book 1

4.6-1

4. OPERATING LIMITATIONS
4.6 Landing Weight Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.6 Landing Weight Limitations

4.6-2

USA007587
Rev. A

DESCENT RATE LIMITATIONS

10
M a i n G e a r S in k S p e e d ( ft/s e c )

4.7

CONTENTS
Main Gear Touchdown .......................
Nose Gear Touchdown........................

4.7-1
4.7-1

Main Gear Touchdown

The orbiter was designed to withstand the loads
developed from landing at the maximum sink
rates shown in the following figure. The
maximum allowable sink rate is a function of
orbiter gross landing weight and crosswind.
Crosswinds reduce the allowable sink rate.
The type of payload returned in the payload
bay also establishes the maximum allowable
sink rate at main gear touchdown. The second
graph shows the limit for crosswind and sink
speed for the main gear for returnable and nonreturnable payloads.

4
8
12
16
C r o s s w in d V e lo c ity ( K T S )

20

833

Landing Sink Rate vs. Crosswind Velocity

Nose Gear Touchdown

The maximum rate of descent at nose gear
touchdown must not exceed 11.5 fps (9.9 per
second) or the rate needed to prevent nose gear
vertical loads in excess of 90,000 lb.
(Operational rates of descent average 5 fps.)

9.6 fp s 21 1 K

10

9.0
Cro ss w in d = 0 kn ots

Forward
Xcg constraint 1

8.0

Pitch Rate (D eg/Sec)

Ma in G e ar S in k R a te (fp s)

10 .0

Nor
ma
Re t l la n d
in
u rn
a b le g w ei
gh
pay
load t 207,
00
32,
000 0 lb
lb
Ab o r t l a n d in
g w e ig h t 2
40,000 lb
N o n - re t u r n
a b le p a yloa
d 6 5,0 0 0 lb

7.0
6.0

6.0 fp s

5.0
4.0
20 0

6 fp s
24 0 K

21 1 K

5 fp s
24 0 K
Cro ss w in d = 20 kno ts

21 0

22 0

23 0

24 0

25 0

7
Mass Mom ent (F T-LB) = (1172.3 - Xcg)*W /12
W = W eight in pounds
Xcg in inches

6
5
1.1

26 0

Gro ss W e igh ts (K L B S)

1.2

1.3

1.4

1.5

1.6

1.7

Mass Mom ent (MF T-LB )

1 Maxim um sink rate restricted to 8.4 fps

for Xcg forward of 1076.7 inches

1.8

1.9

1090.cv5

Nose Gear Slapdown Pitch Rate Limit

83 2. cv 5

Source: NSTS 08934, SODB, Vol. V

Main Gear Sink Rate

4.7-1

4. OPERATING LIMITATIONS
4.7 Descent Rate Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.7 Descent Rate Limitations

4.7-2

USA007587
Rev. A

4.8

within limits. This is most easily accomplished

via the forward RCS propellant dump and OMS
propellant wasting during the deorbit burn.

CENTER OF GRAVITY
LIMITATIONS

The orbiter X and Y c.g. limits are shown in the

following figure. Mission planning for abort
propellant dumps will ensure an adequate c.g.
margin for intact aborts. Real-time mission
management of orbiter consumables; i.e., cryo,
propellant, water, will ensure the EOM c.g. is

The Z axis c.g. must be within the limits of 360.0

to 384.0 inches at entry interface (approximately
400,000 ft).

Source: Flight Rule A4.1.4-3

4.8-1

4. OPERATING LIMITATIONS
4.8 Center of Gravity Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.8 Center of Gravity Limitations

4.8-2

USA007587
Rev. A
For rolling maneuvers, the maximum normal
load factor is reduced by approximately 1
percent for every degree per second of roll rate,
down to a maximum of Nz of 80 percent of the
symmetrical load limit at 20 deg/sec roll rate.
For example, at 5 deg/sec roll rate, the Nz
maximum is 95 percent of the symmetrical load
limit.

ACCELERATION LIMITATIONS

CONTENTS
Ascent ....................................................
Entry ......................................................
Vn Diagrams .........................................

4.9-1
4.9-1
4.9-1

Vn Diagrams

For orbiter Mach numbers less than 5.0 and

weights less than, or equal to 211,000 lb, the
maximum symmetrical Nz is 2.5 g.
The
following graph shows the allowable Nz for
various gross weights.
The negative
acceleration limit is -1.0 g for Mach numbers
less than 3.0 and is 0.0 g for Mach numbers
greater than 3.0.

ee
d

ee
d

0
-1

50

100

150

Nz
200

Sp
e) ee
d
iv

(D

Li

it

Fl
el
Le
v

VA

VS
0

ig
ht

M
an
n

ax

ig

ee
d

CL

es

eu

ax

ve

Sp

Sp

Nz = 2.5

Entry

Sp

+3.11 g/-0.00 g
+0.18 g/-0.18 g
+0.73 g/-0.06 g

ll

Nx =
Ny =
Nz =

The following Vn diagram demonstrates the

acceleration limits in the TAEM region of entry.

ta

The orbiter is constrained to the following

translational accelerations during ascent.

Ascent

Limit Maneuver Load Factor, Nz (g)

4.9

VH
250

300

VL

350

400

Equivalent Airspeed (knots)

836.cvs

3
2.5
2
Lo 1.5
ad
Fa 1
cto
0.5
rg

2.12

4.563 = (9.778x10-3 x W)

Max. Certified
Min. Certified

0
-1.823 + (3.90x10-3 x W)

-0.5
-1
-1.5
180

-0.85
190

200

210
220
230
W, Landing Weight (klb)

240

250

260
1089

Orbiter Operational Maneuver Limits

4.9-1

4. OPERATING LIMITATIONS
4.9 Acceleration Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.9 Acceleration Limitations

4.9-2

USA007587
Rev. A

4.10

WEATHER LIMITATIONS

Weather limitations for launch, abort landing,

and end of mission landing are presented below
(Ref. FR A2-6).
Ceiling/Visibility (k ft)/(SM)
KSC, EDW,

Concrete

Redundant
MLS
8/5
(WX recon
required)

Night
Lakebed

RTLS, TAL

Concrete

No MLS

10/7

Day

NOR, AOA
Daily PLS
selection
(all sites)

Single-String
MLS

Day

NO-GO
10/7
15/7

Night
5/4 RTLS
5/5 TAL
(WX recon
required)

Day
Night

ACLS/ECAL/ELS

NO-GO
10/7
NO-GO

8/5

0/0
10/7

Predeorbit: One APU failed or

attempt two APUs procedure
Ceiling and Visibility Limits

Surface Wind (Knots)

and Turbulence
RTLS

Cross
Peak

Head
Peak

Tail
AVG

Tail
Peak

Gust

Turb

15*

25

10

15

10

MOD

Day

EOM, TAL, AOA,

daily PLS selection

15

Night

EOM, TAL, AOA,

daily PLS selection

12

Crosswind DTO

10
15

Nominal drag chute deploy

15

Landing CDR FD19

12

Predeorbit: One APU failed or

attempt two APUs procedure

10

LGT

N/A
15
*Requires an STA evaluation to 17 knots and a GO from the STA pilot.
ECAL/ELS

Surface Winds and Turbulence Limits

4.10-1

4. OPERATING LIMITATIONS
4.10 Weather Limitations

USA007587
Rev. A

Thunderstorm, Lightning, and

Precipitation Proximity Limits
(n. mi.)

Tstorm (including attached

nontransparent
anvils) and
lightning

Prelaunch
(RTLS,
TAL)

Radial from
center of prime
runway

>20

Lateral along
approach path
out to 30 n. mi.

>10

Cumulus clouds
produced by
smoke/fire up to
1 hour after
detaching

>30

>15

Radial from
center of prime
runway

>15

Lateral along
approach path
out to 30 n. mi.

>5

>20

>20

>15

>10

>5

>2
>20

Lateral along
approach path
out to 30 n. mi.

>10

>30

>15
N/A

>20

Vertical from top

of cloud

>2

Lateral along
approach path

>0

Thunderstorm, Lightning, and Precipitation

4.10 Weather Limitations

>5

N/A

Radial from
center of prime
runway

4. OPERATING LIMITATIONS

ELS, ECAL,
ACLS

>2

Vertical from top

of cloud

Precipitation

Redesig
Criteria

None at site

Vertical from top

of cloud

Detached
nontransparent
anvil <3 hours
old

Predeorbit
(EOM
Daily PLS)
Prelaunch
(AOA)

4.10-2

>5

N/A

USA007587
Rev. A

Shuttle Launch Wind Limits

34

34

34
34
340

34
34

34
34

N
350 0/360 010

34
020

330

34
030
040

320

050

310

34

34
LCC
30

300

060

30

28
290

28

27

26

070

280

080

W 270

90 E

260

100

27

26

26

110

250

25

26
120

240
25
24

24

130

230
140

220

150

210

22

22

200

190

21

180 170
S

20

21

160
20
20

20

20

20
837.cvs

Launch Commit Constraint (60-ft winds at the pad)

4.10-3

4. OPERATING LIMITATIONS
4.10 Weather Limitations

USA007587
Rev. A

This page intentionally left blank

4. OPERATING LIMITATIONS
4.10 Weather Limitations

4.10-4

USA007587
Rev. A

5.

This section summarizes nominal procedures

for a generic space shuttle mission. More
detailed procedures may be found in the
Astronaut Support Personnel Book, the various
Flight Procedures Handbooks (FPH), and Flight
Data File (FDF) documents. The FPH documents also contain rationales for the various
procedures listed herein. For flight-specific
training, refer to the applicable FDF checklists/
cue cards.

NORMAL PROCEDURES
SUMMARY

CONTENTS
5.1
5.2
5.3
5.4
5.5

PRELAUNCH .................................. 5.1-1

ASCENT ........................................... 5.2-1
ORBIT................................................ 5.3-1
ENTRY .............................................. 5.4-1
POSTLANDING .............................. 5.5-1

5-1

5. NORMAL PROCEDURES SUMMARY

USA007587
Rev. A

This page intentionally left blank

5. NORMAL PROCEDURES SUMMARY

5-2

USA007587
Rev. A

5.1

ECLSS Freon coolant loop payload heat exchanger flow verification,

navigation
aids
activation, and C/W memory
clearing.

PRELAUNCH

CONTENTS
Prelaunch Procedures..........................

5.1-1

Prelaunch Procedures

L-4:55

Crew wakeup.

L-4:25

Crew breakfast and photo opportunity.

L-3:55

CDR, PLT, MS2 get weather

briefing. MS1/3 (PSs) don flight
clothing and equipment.

L-3:45

CDR, PLT, MS2 don flight clothing

and equipment.

L-3:15

Crew departs for the Pad.

L-2:45

Crew arrives at the White Room;

ASP verifies CDR and PLT
launch/entry suit (LES)/flight
equipment is properly configured
before seat ingress, assists with
ingress and installation of ascent
FDF, monitors CDR/PLT communication air-to-ground checks,
assists with post-ingress switch
reconfiguration, and coordinates
the C/W and intercom volume
adjustment; as the MSs ingress,
the ASP verifies their LES/flight
equipment configuration and
assists ingress and communication
hook up and checks.

L-1:45

ASP verifies all non-flight equipment is removed from the crew

compartment, terminates communication with the Launch Control
Center (LCC), and egresses.

L-2:00

After the hatch is closed, a cabin

leak check is performed. The cabin
is pressurized to 16.7 psi and then
vented to ambient when the check
is complete over the next 48
minutes.

Hr:Min (approx)
L-33:00

Astronaut
support
personnel
(ASP) conduct communications
checks with the launch team.
Caution and warning (C/W)
volumes are adjusted so the air-toground communication can be
heard over the C/W tone. UHF
Guard is checked, and headset
interface units (HIUs) are checked
for proper operation, along with
intercom (ICOM) loops A and B.
If the ICOM recorder has been
manifested, it is installed and
tested.

L-18:30

ASP ensures crew module has

been vacuumed and performs
ascent switch list configuration.

L-16:30

The backup ASP conducts a check

of the middeck and flight deck
and installs certain cue cards,
flipbooks, and checklists.

L-12:45

The backup ASP adjusts CDR and

PLT seats to the full down and aft
position and then configures all
seats for launch. Rotational hand
controllers (RHCs) are adjusted,
and SBTCs are set full forward.

L- 8:15

Pad is cleared for tanking.

L-5:35

ASP reports panel ABORT light

status when initiated by the Flight
Director.

L-5:30

ASP Checklist is initiated. Checklist

includes
communications
check,
potable/supply
water
quantity adjustment, LiOH canister installation, air sample, preingress switch reconfiguration,
5.1-1

5. NORMAL PROCEDURES SUMMARY

5.1 Prelaunch

USA007587
Rev. A
L-1:22

CDR prepares for the primary avionics software system (PASS)/

backup flight system (BFS)
transfer. The LCC will perform
the transfer via uplink.

L-1:20

CDR places the OMS ENG

switches to ARM/PRESS for GN2
pressurization. The PLT takes the
WSB GN2 supply to OPEN to
provide N2 pressurization to the
WSB.

L-1:15

All crewmembers conduct an A/G

voice check with MCC and receive
updates to ascent/abort data.

L-1:10

Planned 10-minute launch hold at

T-20 min

L-1:00

PASS OPS 1 load is initiated and

GNC FAULT is displayed on IDP
1 while C/W is cleared.

Min:Sec (approx)
L-58:30

CDR transitions BFS to OPS 1.

L-57:00

PLT conducts horizontal situation

configuration for TAL sites and
RTLS to KSC. When this activity
is complete, the PLT configures for
OMS interconnect with PASS and
BFS.

L-56:00

PLT performs the MPS He

reconfiguration by opening He
and pneumatic isolation valves.

L-49:00

Planned 40-minute launch hold at

T-9 min.

L-30:00

A ground-controlled fuel cell

purge takes place about this time.

L-25:00

The OMS/RCS crossfeed valves

are configured for launch by the
Launch Processing System.

L-17:00

PLT clears the F7 C/W lights with

the C/W MEM switch on C3.

T-9:00

GO for launch given, and event

timers started.

5. NORMAL PROCEDURES SUMMARY

5.1 Prelaunch

T-8:00

PLT connects essential buses to the

fuel cells.

T-7:30

Access arm retracts. Crew makes

final checks on seat positions, suit
closures, and restraints.

T-6:15

PLT performs APU prestart and

verifies three gray READY TO
START talkbacks.
IDP 1-3
displays are GNC LAUNCH
TRAJ, GNC SYS SUMM 1, AND
BFS, SM SYS SUMM 2. IDP 4
typically displays BFS SM SYS
SUMM 2.

T-5:00

Pilot starts APUs and verifies

normal pressure. CDR turns off
flash evaporator feedline heaters.

T-3:25

Main engine nozzles are gimbaled

during the next 30 sec. The crew
may feel the motion/vibration.

T-2:30

PLT clears the hardware and

software.

T-2:00

All crewmembers start O2 flow

and close their visors.

T-0:07

Ignition sequence for main

engines begins. Crew monitors
Pcs increase.

T-0:03

Crew monitors main engines,

which should have Pcs above 90
percent.

5.1-2

USA007587
Rev. A

5.2

heads-down
ascent
attitude.
Crew monitors and engages the
BFS if maneuver not begun when
required or not properly completed. CDR/PLT select LVLH on
ADI ATTITUDE switch.

ASCENT

CONTENTS
Powered Flight .....................................
OMS Burns ............................................
Post Insertion ........................................

5.2-1
5.2-3
5.2-5

0:20 or 0:30
(flight
specific)

Powered Flight
Min:Sec (approx)
T-0:00

SRB ignition, software transitions

to MM 102, main engines at ~100
percent Pc, and event timer counts
up from zero. Throughout ascent
phase, the crew monitors vehicle
performance using DPS and
dedicated displays intervening as
required/directed by MCC. The
crew also uses the Flight
Instruments, ADI, No-Comm
Ascent Abort Mode Boundaries,
and Contingency Abort cue cards,
to monitor the ascent trajectory
and maintain awareness of abort
options. Cue cards are used for
malfunctions procedures.

1:00

Crew monitors main engines

throttling back up to ~104 percent.
Manual throttle may be selected if
required.

1:30

Maximum q-bar phase is passed.

Control stick steering (CSS) may
now be selected in lieu of BFS
Engage if PASS guidance is not
nominal.

2:00

ASCENT TRAJ display will

indicate PC <50 when both SRB
Pc's drop below 50 psi. SRB
separation should occur shortly
thereafter (no later than MET
2:20). During SRB separation, all
three upfiring jets in the forward
RCS fire to protect the cockpit
windows from SRB debris (Forward
Window Protect). When the SRBs
are separated, GNC changes to
MM 103. BFS commands flash
evaporator system (FES) on via
payload buses.

Typical displays used during

ascent are PASS and BFS ASCENT
TRAJ 1/2, PASS and BFS GNC SYS
SUMM 1. BFS GNC SYS SUMM 2
and BFS SM SYS SUMM 1/2 are
used as required.
Mission Elapsed Time (MET)
Min:Sec (approx)
0:01

Ensure that FCS (pitch

roll/yaw) are still in Auto. If
select Auto.
Otherwise
Engage may be required for
program at 0:07.

0:04

If 104 percent is programmed for

launch, at a velocity of 60 fps, the
main engines are commanded to
that level.

0:07

At a velocity 127 fps, the vehicle

rolls, yaws, and pitches to the

Crew monitors main engines

throttling down to limit maximum
flight dynamic pressure and to
adjust for off-nominal performance. Throttle level can vary,
depending on flight design and
SRB performance.

and
not,
BFS
roll

5.2-1

Post-SRB separation, the crew

checks that PASS and BFS
TMECOs converge to expected
values to verify performance of
Ascent Guidance.

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

USA007587
Rev. A
Beginning with STS-87, an RTHU
is performed during nominal
ascent to allow an early handup
from MILA to TDRS east in
anticipation that the Bermuda
ground station will close. The Iloaded RTHU relative velocity of
12,200 fps is converted to inertial
velocity for use in the checklist
because this is the cue card
available onboard. The roll maneuver is performed at 5 deg/sec
and is accompanied by a pitch
attitude change of 20 to 30 as the
vehicle rolls about the X-body
axis, changing the thrust vector
direction.

OMS Assist
MM 103
transition +
10 seconds

An OMS assist burn during

nominal
ascent
may
be
manifested on some performancecritical missions. A 4000-lb OMS
assist burn takes about 1:42 to
complete and provides a 250-lb
performance gain. For OMS assist
flights, SPEC 51 will display the
manual dump quantity and timer
until the OMS assist initiates.
Then, the OMS assist information
will be displayed. For a 4000-lb
OMS assist, SPEC 51 will display
15% for the Item 9 quantity and
1:42 for the initial dump time to
go (OMS DUMP TTG). The crew
should verify the OMS assist by
monitoring the OMS Pc on the
OMS/MPS display and OMS
quantity. When the OMS assist
completes, TTG should display 0.
For OMS assist missions, if an
ATO abort is selected pre-MECO,
the Item 9 quantity will reflect the
calculated ATO abort dump
quantity plus the OMS assist
quantity.
However, TTG will
reflect any amount of OMS assist
completed. In other words, if the
OMS assist completed, TTG
would only reflect the ATO dump
because the dump time during the
OMS assist has already been
decremented.

3:00

Crew verifies the flash evaporator

is working properly (T < 60 F and
decreasing on EVAP OUT T
overhead meter).

Roll to
Heads Up
(RTHU)

28.5 inclination RTHU at

VI = 13.6 K (Vrel 12,200 fps)

7:30

S-band PM communications is
reconfigured from STDN-HI to
TDRS mode via a stored program
command in the BFS GPC.

~8:25

Main engine cutoff (MECO)

occurs. Crew cues are that the
main engine Pc on the OMS/MPS
display drop to zero, the MAIN
ENGINE STATUS lights illuminate red, and the cutoff bug on the
PASS and BFS ASCENT TRAJ 2
indicates MECO velocity. MECO
time may vary, depending on
flight profile, but should match
simulation time.

39.0 inclination RTHU at

VI = 13.4 K (Vrel 12,200 fps)
51.6 inclination RTHU at
VI = 13.2 K (Vrel 12,200 fps)
K (Vrel 12,200 fps)

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

5.2-2

USA007587
Rev. A
Post MECO

The MECO velocity should be

approximately 25,820 fps. The
crew verifies ORBITAL DAP
lights illuminated, indicating
MECO confirmed. The crew also
verifies
external
tank
(ET)
separation
(MAIN
ENGINE
STATUS lights extinguish). If ET
separation is inhibited, the crew
must null rate(s) (if >0.7/sec). If
rates are null and the ET SEP
inhibit remains, the crew must
assume a feedline disconnect
failure. The ascent checklist will
cleanly direct this operation.
Meanwhile, a -Z translation
occurs and GNC transitions to
MM 104 at completion of this -Z
translation. At MM 104 plus 2
seconds (if a prescribed HA has
been achieved), the crew will
translate in the plus X direction
for a prescribed length of time to
assist external tank photography.
Once in MM 104, the crew refers
to the Ascent Pocket Checklist for
malfunction procedures.
The
crew verifies OMS 1/2 targeting,
using current orbit HA and HP
displayed on GNC OMS 1 MNVR
EXEC, to determine if an OMS 1
burn is required.

and available for DI OMS 1 if required due to a large underspeed.

The OMS 1 Burn cue card and the
OMS 1 Burn Monitor cue card are
referenced for normal OMS 1 burn
procedures and malfunctions that
occur during the burn.
Crew selects INRTL on ADI
ATTITUDE switch and begins the
automatic maneuver to burn attitude if OMS 1 burn is required.
When in the proper attitude, the
error needles should be centered
and ADI inertial attitude should
match burn attitude on the MNVR
display. VGOs should be crosschecked for proper burn attitude
and guidance.
MECO
Min:Sec (approx)
+1:45

IDP 1 in GNC OMS 1 MNVR

EXEC, IDP 2 in SYS SUMM 1, and
IDP 3 BFS, GNC SYS SUMM 2.
+2:00

For a nominal MECO (OMS 1 not

required), the crew proceeds to
the POST OMS 1 tab in the Ascent
Pocket Checklist.
From there,
FDF assists the crew in stepping
through procedures required
during the transition from
powered flight to the OMS 2 Burn.
Required steps during this timeframe include the ET PHOTO
MANEUVER and powered flight
systems management steps, all of
which are orchestrated in the
Ascent Pocket Checklist.

OMS 1 targets appear on GNC

OMS 1 MNVR EXEC displays.
The burn is executed for SI OMS 1

OMS 1 ignition. Crew monitors

burn (OMS Pc ~100 percent, engine control valves ~100 percent,
He pressure decreasing slowly,
engine inlet pressure drops to
~200 psi, OMS quantity decreases
~15 sec after ignition, delta VTOT
decrementing nominally) and
prepares to respond in case of an
off-nominal burn; burn duration
~2:30. Two seconds after end of
burn, the CDR places the OMS
ENG switches to OFF and trims
out any delta V residuals in the X
and Z directions using the THC.
If DI (or if OMS 1 is MECO +6
min or more), the MPS propellant
dump is automatically initiated at
MECO +2 min.

OMS Burns
SI

EXEC key must be pressed on

CDR/PLT keyboard within 15 sec
of OMS TIG to enable burn.

DI or SI The crew performs the tasks in the

Post OMS 1 Post OMS 1 procedures section of
the Ascent Checklist. CDR and

5.2-3

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

USA007587
Rev. A
PLT turn FLT CNTLR POWER
switches (2) OFF to prevent
inadvertent inputs to the RHCs
(which can initiate manual DAP).

targets verified (PASS and BFS).

PLT secures MPS engine power
and performs GH2 inerting.
PLT closes
doors.

NOTE
Taking FLT CNTLR POWER switches to
ON or OFF may cause the DAP to
downmode from Auto to Manual. Power
surges in the system can be confused with
an RHC input, causing the DAP to
downmode.

the

ET

umbilical

CAUTION
ET centerline latches must be stowed prior to
door closure to prevent door drive mechanism
damage. GH2 inerting must be done prior to ET
umbilical closure because the GH2 is vented into the
ET door cavity.

MET
PLT prepares OMS for the burn
by verifying proper valve configurations.

Min:Sec (approx)
12:55

PLT verifies the BODY FLAP

pushbutton light is out (light
extinguishes at the end of a
timer). During that time, the MPS
dump should have completed
(~2:00 duration). The hydraulic
MPS/TVC isolation valves are
closed, and APU shutdown is then
performed after checking with
MCC.
CDR takes the FES Primary
Controller to ON from the GPC
position and reenables the FES
feedline heaters prior to the OPS 2
transition and securing BFS. PLT
takes the cryo O2 tank 1 and 2 B
heaters to AUTO.
MS1 takes the APU tank, fuel line,
and H2O line heaters to A auto
for freeze protection.
PLT sets the AC BUS SNSR
switches to the AUTO TRIP position. They were in MONITOR
during ascent to prevent SSME
loss due to inadvertent bus trip.
CDR/PLT modes GPCs to MM
105 for the OMS 2 burn.

CDR, PLT set ADI ATTITUDE to

INRTL position and maneuver to
the burn attitude.
OMS 2 Burn
TIG
Min:Sec (approx)
-5:00

CDR, PLT make final verification

of burn attitude, engine selection,
DAP selection, OMS gimbal trim,
He PRESS/VAP ISOL valve
positions, and activate their FLT
CNTLR POWER.
TIG
Min:Sec (approx)
-2:00

CDR/PLT set OMS ENG switches

to ARM/PRESS and verify the
engine press valves are open.

-0:15

CDR/PLT
initiates
EXEC
command to perform burn. There
is no need for the crew to correct
attitude errors prior to OMS 2
ignition because OMS engine
thrust vector control (TVC) will
fly the vehicle to the proper

CDR/PLT loads OMS 2 targets as

required and OMS gimbal trim
data (OMS 1 trim remains until
changed. Gimbals do not move
until 15 sec before burn); OMS
5. NORMAL PROCEDURES SUMMARY
5.2 Ascent

Crew transitions to OMS 2 Burn

and Burn Monitor cue cards for
procedural reference.

5.2-4

USA007587
Rev. A
attitude. OMS TVC can be used
to take out attitude errors up to
the maximum error limit for OMS
ignition to occur.
(Limit is
variable as a function of
remaining V and attitude error;
however, an attitude error 90
guarantees ignition cutoff.)
00:30-00:60
(00:42
nominal
for DI)

CDR, PLT monitor OMS 2 burn,

Pcs (~100 percent), delta VTOT
and time to go (TGO) decreasing,
bipropellant valves (100 percent),
and perigee increasing.
Crew
prepares to complete burn with
single engine or RCS if failures
occur. Burn duration is ~2 min
for 160 n. mi. circular orbit (based
on nominal ascent).

OMS 2 Cutoff

Post Insertion
The Post Insertion Checklist is used for nominal
procedures. The Orbit Pocket Checklist and
Malfunction
Book
are
references
for
malfunctions.
During post insertion the
following activities must be accomplished to
prepare for on-orbit operations:
(1) Reconfigure to on-orbit software and
GPC configuration.
(2) Activate radiators.
(3) Open payload bay doors.
(4) Doff and stow LES, reconfigure
cockpit for orbit operations.
MET
Day/Hr:Min (approx)

+2 sec

CDR/PLT secure OMS engines (2

sec delay for purge) and trim all
axes residuals <2 fps (<0.2 fps for
orbit critical burns).

Post OMS 2

The crew returns to the Ascent

Post OMS 2 section of the Ascent
Checklist for nominal procedures
and the Ascent Pocket Checklist
for malfunctions.
CDR/PLT
secure FLT CNTLR POWER and
verify the DAP is in AUTO.

0/0:55

CDR performs an OMS TVC

gimbal check (secondary then
primary checks are conducted to
verify operations prior to on-orbit
use).
PLT reconfigures OMS and RCS
valves for on-orbit operations.
CDR/PLT change to MM 106.
Crew stows ascent related FDF
and unstows the Post Insertion
Checklist,
Orbit
Operations
Checklist and Pocket Checklist,
cue cards, and the orbiter
Malfunction Book.

CDR/PLT reconfigure the GPCs.

Guidance,
Navigation,
and
Control On-orbit software (GNC
OPS 2) is loaded into GPCs 1 and
2. Systems management (SM)
software is loaded into GPC 4.
GNC OPS 2 data are loaded into
GPC 3 and freeze dried (taken
off line to preserve an independent source of data) while GPC 5
retains BFS software but is placed
in HALT. With SM software
loaded, uplink control for S-band
and TDRSS is given to the SM
computer. Because only three
IDPs can be assigned to the
PASS, IDP 3 is de-assigned, and
IDP 4 (powered up during MS aft
flight deck configuration) is
assigned to 4.
Pulse-code
modulation
master
unit
(PCMMU) formats are loaded for
on-orbit high and low data rate
telemetry. Displays are called up
as required, but the crew must be
careful to avoid assigning all
three IDPs to the same GPC; e.g.,
do not use all three IDPs for SM.
Mission/payload
specialists
egress seats during this period.

5.2-5

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

USA007587
Rev. A
MSs perform the following
functions on the middeck:

Install UV filter on hatch

window.

Repressurize water supply

tank A and activate the
airlock heaters.

Unstow
and
configure
headsets and microphones.

Configure middeck audio

distribution unit (ADU) and
speaker box.

Stow ascent FDF in return

to Houston bags and
unstow on-orbit FDF.

Close appropriate
breakers.

An MS begins flight deck

configuration to include: open
cabin vent and cabin vent
isolation cbs (to preclude
accidental venting), activate the
OMS and RCS heaters, which will
keep them at 55 to 90 F
(A-heater
in
AUTOMATIC,
B-heater OFF), and activate APU
lube oil heaters. Although the
APU
gas
generator
bed
temperatures will remain warm
until about MET 6:00, a caution is
included at this point to monitor
the APU fuel pump outlet and
bypass line temperatures and
activate the gas gen/fuel pump
heaters if required.
Aft
flight deck
communication
configuration is accomplished,
S-band
communication
is
configured for TDRSS at the high
rate, R15 cbs are closed as
required, ascent thrust vector
control, engine interface units,
and master event controllers for

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

MET
Day/Hr:Min (approx)
0/1:00

MSs unstow and activate the

payload
general
support
computers (PGSCs).

0/1:05

PLT configures the payload

electrical buses on the flight deck
(payload dependent) while other
buses are powered via the middeck
panels.

0/1:08

Crew configures and activates

the galley and waste containment
system (WCS).

0/1:10

Flight deck audio is reconfigured

from headsets to speaker and
handheld mic operations.

0/1:12

PLT executes an automatic

maneuver to the PLBD opening
attitude -ZLV with a flightspecific bias.
This is a time
critical action; DAP A/AUTO/ALT
are selected.

0/1:18

CDR activates the radiators by

placing both the RADIATOR
BYPASS
VALVE
MODE
and RADIATOR CONTROLLER
LOOP 1 and 2 switches (two
each) to AUTO, AUTO A. CDR
then takes the Freon RADIATOR
ISOLATION MODE switch to
AUTO. It takes 90 seconds for the
radiator startup sequence.

0/1:20

An MS sets up the aft panel

PAYLOAD BAY FLOOD switches
as required (given possible
payload limitations) for PLBD
opening. Lights require ~3 min
for full bright). If the CCTV is to
be used for PLBD opening, it will
be activated at this time.

circuit

These
activities
may
be
accomplished piecemeal during
the next hour.
0/0:59

the main engines are secured,

and the display driver units
(DDUs) cbs for the aft flight
controllers and displays are
closed.

5.2-6

USA007587
Rev. A
0/1:28

0/1:36

MS2 initiates automatic PLBD

opening with the SM PL BAY
DOORS display and switches on
panel R13L. Centerline latches
take ~20 sec, forward and aft
bulkhead latches take ~30 sec,
and each door (starboard then
port) opens in ~63 sec. After the
doors are open and power
removed from them, display SM
ANTENNA is usually selected
for IDP 4 when other displays are
not required. The MCC will
uplink table maintenance block
updates (TMBU) as required.
If there are no known problems
with the major orbiter systems, the
MCC will issue a GO for orbit
operations. Ku-band antenna is
deployed (~23 sec) and activated.
Ku-band signal strength is shown
on the SM OPS 201 Antenna
display and panel A1U meter.

0/1:37

CDR, PLT egress seats; all crew

doff and stow launch/entry suits
(LES). During this time, the MCC
uplinks the orbiter state vector
and RCS quantity compensations.

0/1:45

The crew installs the quick-don

masks (QDMs) into the various
O2 quick disconnects now that
the LES are no longer used.

0/1:52

0/1:56

CDR
selects
the
SM
88
APU/ENVIRON THERM display, and if Freon loops are
operating nominally as they
should by this point (Freon loop
radiator out temp <60 F), secures
the flash evaporator and turns
the high load evaporator off.

GNC UNIV PTG display.

0/1:57

An MS opens the supply H2O

dump isolation valve to ensure
redundant dump path, and then
configures other tank valves as
needed for mission requirements
(water transfer, etc.).

0/2:02

MS on the middeck configures

the airlock for ingress. Ductwork
and booster fans are set up to
provide air flow into the airlock.

0/2:03

PLT activates the APU steam

vent heaters to remove any
possible ice formation on the
water spray boiler (WSB) vent
openings.

MET
Day/Hr:Min (approx)
0/0:2:05

MS/PS seats are removed and

stowed.

0/2:10

After go for vernier operations

from MCC, CDR verifies use of
vernier jets is safe (radiators
operating and FES hi-load off)
and activates verniers on MCC
call. DAP selection is typically
A/AUTO/VERN.

0/2:12

Crew configures controls for onorbit operations by using panel

diagrams in the Post Insertion
Checklist that depict switch
positions.

0/2:21

PLT performs the hydraulic

thermal conditioning enable steps
in the Orbit Operations Checklist,
which allows the GPCs to operate
hydraulic circulation pumps
when pressures or temperatures
are below set limits.

The CDR powers on the star

trackers and both star tracker
doors are opened (6 to 12 sec.).
CDR selects GNC 22 S TRK/
COAS CNTL display and
activates the star trackers. SPEC
21 is then called up to initiate the
calculations for the IMU delta
angles, and then returned to
5.2-7

Note: Payload electrical constraints may alter this activity.

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

USA007587
Rev. A
0/2:24

MS resets C/W system from

ascent to on-orbit operations.
Limits for some systems are
changed
while
others
are
inhibited.

0/2:29

Fuel cell performance is plotted

using the FUEL CELL VI
PERFORMANCE PLOT.

5. NORMAL PROCEDURES SUMMARY

5.2 Ascent

5.2-8

USA007587
Rev. A

5.3

ORBIT

0/2:45

IMU alignment (S TRK) using

Star Data is accomplished. GNC
UNIVERSAL POINTING, GNC
21 IMU ALIGN, and GNC 22
S TRK/COAS CNTL displays are
used for this activity.

0/3:10

Aft controller checkout initiated

in each axis with the output
verified on the GNC 25 RM
ORBIT display.

0/3:45

APU steam vent heaters are

secured (initiated at MET 2 hr).
APU gas generator and fuel
pump heaters (A) are placed in
AUTO at panel A12 to keep the
generator bed 360 to 425 F and
the fuel pump 80 to 95 F (the B
heaters are used mid-mission to
exercise the redundant system).

0/3:50

CRYO O2 tank heater sensor

check is accomplished to verify
short circuit protection for the O2
tank heaters (SM 68 CRYO
SYSTEM display).

0/4:00

Unless there is an FD1 deploy or

other
mission-specific
requirement, the first on-orbit
meal is prepared and eaten at this
time.

(various
times)

Crew begins payload activities.

These activities may include
payload
deploy,
Spacehab
activation, or secondary experiment activation, depending on
the type of mission.

0/8:00

Presleep activities begin 3 hr

(2:15 for dual-shift operations)
before the sleep period (can be
shortened to 2 hr for single shift
and 1:30 for dual-shift operations
if required). Presleep activities
on the flight deck include:

CONTENTS
Orbit Operations ..................................
OMS (RCS) Burns.................................
Rendezvous...........................................
Last Full On-Orbit Day........................

5.3-1
5.3-4
5.3-4
5.3-8

Orbit Operations
This section summarizes typical orbit
operations for METs 0/2:30 through 0/22:00.
Activities
occurring
after
0/6:30
are
representative of subsequent flight days until
the last full on-orbit day.
Note: Actual activities and times will vary
from mission to mission.
D/H:M (approx)
0/2:30

0/2:35

Crew completes post insertion

activity. Post Insertion Checklist
is stowed, and crew refers to the
Flight Plan for nominal activities.
FD1 EZ activities are begun; i.e.,
lamp test, smoke detection
circuit test, pressure control
system (PCS) setup, Compound
Specific Analyzer - Combustion
Products (CSA-CP) ops, and
orbiter cabin air cleaner (OCAC)
filter cleaning. The Photo/TV
Checklist is unstowed, and
camera assembly is begun.
Other equipment required for
flight day (FD) 1 activities is
unstowed and set up. The
assembly power converter units
(APCUs) are activated, if needed.
If the remote manipulator system
(RMS) is flown, initial activation
procedures begin at about this
time. RMS AC cbs are closed,
power is applied to the
manipulator controller interface
unit, RMS shoulder brace is
released, heaters are activated,
and, if required by payload
operations or constraints, the arm
is deployed.

Configure cryo heaters and

manifold valves as directed by
MCC.

5.3-1

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

USA007587
Rev. A
Install O2 bleed orifice. Note:
This may be done postsleep,
depending on PPO2 levels.
Update SM checkpoints.
Set CRT timer for crew wake
up and C/W alert tone
duration.

Configure
communications
panels and lighting.
0/9:50

APU gas generator and fuel

pump heaters (A) are activated
at panel A12 along with the APU
tank/fuel line/H2O system (A)
heaters (3) (B heaters off).

0/11:00

Sleep period is scheduled to

begin no later than 16 hr after the
crews launch day wakeup (4:55
prior to launch) but can be
extended up to 2 hr if unexpected launch holds occur. The
sleep period is scheduled for 8 hr
but can be shortened to 6 hr if
required.

0/19:00

The postsleep period begins

about 8 hr after the start of the
sleep period and extends for 3 hr
for single-shift operations (1:30
for dual shift) but may be
shortened to 2 hr (1:15 dual shift)
if required.

Adjust the cabin temperature

control as required.
Configure active PCS O2/N2
controller to OPEN to avoid
nuisance "FLOW" alarms
while sleeping (14.7 config
only).
Power down unnecessary
electrical equipment (IDPs, TV
power, TV cameras, VTR,
cabin and PLB lights, DDUs).
Install window shades/filters.
Remove power from primary
reaction jet drivers (8) to
preclude primary jet ON
failures.

Middeck postsleep activities include:

Reconfigure lighting and communications panels.

Maneuver to sleep attitude.

Replace CO2 absorber (one of

two canisters is replaced).

Minor payload or experiment

related activity can be scheduled
during the presleep, if required.

Install O2 bleed orifice (first

postsleep) to increase O2 to
the middeck, if not installed
presleep.

Presleep activities on the middeck include:

Food preparation and cleanup
for the evening meal.
CO2 absorber (LiOH) replacement (one of two canisters is
replaced).
General housekeeping
WCS cleaning.

Prepare meals and clean up.

General housekeeping.
Postsleep flight deck activities include:
Reconfigure lighting, window
shades,
communications
panels and instruments, and
the SM Alert tone duration.

and

Set up next days equipment

(if practical).

Power on IDPs (3).

Write/record mission notes.

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

5.3-2

USA007587
Rev. A
Adjust cabin temperature (if
required).

1/00:00

Manually purge fuel cells (FD 1

only to save ground turn-around
time). Use SM 69 FUEL CELLS
display to monitor purge. All
other purges will be uplinked
from MCC.

1/01:00

The day prior to docking, the

crew performs a series of
procedures to intialize, verify,
and configure the docking
system. When the procedures are
complete, the system is powered
back down.

1/5:00

PLT runs the Fuel Cell

Monitoring System (FCMS), a
PGSC program that monitors the
health of the fuel cells to a level
of detail that Mission Control
cannot see. The data is collected
into a text file and downlinked
for analysis.

3/00:00

Conduct supply and/or waste

water dump, monitored using
SM 66 ENVIRONMENT display
(purges and dumps are not
accomplished during star tracker
use
due
to
possible
contamination).
The
dumps
make room for new water that is
being produced.

4/00:00

Mid-mission, the crew will

reconfigure various systems for
even usage, including heaters
(water, hydraulic, etc.) from A to
B, PCS from 1 to 2, and cabin
temperature controller from 1 to
2.

Reonfigure active PCS O2/N2

controller back to AUTO.
Configure OMS/RCS interconnect as required to preserve aft RCS propellant.
Power primary RJD drivers
(8) ON.
Configure cryo heater/manifold valves per MCC instructtions.
0/22:00

The crew begins a full workday

on orbit with their flight-specific
activities. Each day, photo/TV
scenes are activated per the
P/TV Checklist. Normally, the
crew downlinks live TV of flight
deck or middeck activities once
each day. At a minimum, a VTR
dump of crew activities is downlinked. When the PLB cameras
are not required for flight requirements, MCC occasionally asks to
control the cameras and conduct
Earth viewing. MCC will not
activate cabin cameras without
prior crew coordination. Once
during a 4-day mission (twice for
longer flights) the avionics filters
are cleaned. Also, the operating
humidity separator is checked for
water accumulation about every
12 hours during the first few onorbit days. Once each flight day
(the morning of likely/scheduled
EVAs and entry day), each
crewmember has an opportunity
to communicate privately with a
flight surgeon during a private
medical conference (PMC).

5.3-3

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

USA007587
Rev. A

OMS (RCS) Burns

Rendezvous

OMS/RCS burns are used on orbit to raise or

lower the orbital altitude, for rendezvous
phasing, and deorbit. The burn may be done
with one or both OMS engines or the RCS,
depending on the delta V required. Propellant
for the burn can come from either OMS pod or
the RCS system. OMS BURN cue cards (OMS2/ORBIT OMS BURNS (2) and OMS BURN
MONITOR (2)) are installed on the forward
panels for the burn. On-orbit burns require OPS
202 (302 for entry) with GNC ORBIT MNVR
EXEC and GNC SYS SUMM 2 displays.
Procedures for on-orbit OMS/RCS burns are
similar to those discussed in the OMS 2 section.
Burn target data is normally uplinked by MCC
and loaded automatically. If delta V total >6 fps,
an OMS burn will be required. If delta V total is
>4 and <6 fps, a +X RCS burn is used (thereby
limiting the amount of forward RCS burned). If
the delta V total <4 fps, the burn is multi-axis
(RCS) with no maneuver to burn attitude.

This section summarizes the major events that

occur during the final phases of a rendezvous.
Flight-specific rendezvous procedures are
located in the Rendezvous Checklist. The phase
elapsed time (PET) below is referenced to target
intercept (Ti) TIG.
PET is used to track
rendezvous events and normally is displayed
on the DPS display. Actual times will vary,
depending on flight profile.
NH Burn (not shown) NH is a groundtargeted height adjust burn. This burn is
accommodated in the checklist, if necessary on
the day of rendezvous. (This burn may be
executed prior to the day of rendezvous).
NC Burns The NC burns are phasing
maneuvers used to initiate or modify the
rendezvous approach (closing rate). They are
ground-targeted burns, the last of which is
designed to place the orbiter 8 n. mi. behind the
target (Ti point) in one (or two) revs.

Orbit Rendezvous Profile

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

5.3-4

USA007587
Rev. A

Orbit Post Ti Profile

Star Tracker NAV After the final NC burn,
the crew maneuvers the orbiter to a -Z (-Y)
target track attitude, which will point the
desired Star Tracker (ST) at the target to
provide relative navigation data. The ST angle
data will be used to improve the onboard filter
(FLTR) state vector.
NCC Burn This is the first onboard targeted
burn. It uses the filter state vector updated by
the star tracker data. This is a corrective
combination burn that will try to create a node
at and correct the transfer to the Ti point, 1200
feet below and 48,600 feet (8 n. mi.) behind the
target.
Radar NAV The rendezvous radar is expected
to lock on at a range of approximately 150 kft.
The radar provides range and range rate data,
in addition to the angle data. The FLTR vector
with the ST data is saved to the propagated

vector (FLTR to PROP transfer) prior to taking

the Radar data to nav. This will protect the
vector with the star tracker data from possible
problems with the radar data.
Ti Burn The Ti burn initiates the final
(transition) phase of rendezvous. It is targeted
onboard using the updated FLTR vector. Ti is
primarily a posigrade phasing burn designed to
place the orbiter at the MC4 position (900 feet
behind and 1800 feet below the target).
Targeting to MC4 has been shown to reduce the
dispersions at MC4 and, therefore, reduce the
dispersions at manual takeover.
RADAR/S TRK NAV During this portion of
the profile, the orbiter will be in a -Z (-Y) target
track attitude. NAV will be updated with radar
or ST data. This data will be used to target the
four midcourse correction burns and perform
the out-of-plane null.

5.3-5

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

USA007587
Rev. A

Orbit Terminal Phase and R-bar Approach

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

5.3-6

USA007587
Rev. A

Orbit Terminal Phase and V-bar Approach

5.3-7

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

USA007587
Rev. A
MC1 Burn The MC1 burn will trim any
dispersions left over from the Ti burn, taking
advantage of more sensor data. MC1 targets to
the MC4 position.
Planar Null The next task is to monitor the
GNC 33 REL NAV display closely to watch for
the point when the out-of-plane distance
between the two orbits (Y) becomes zero (nodal
crossing).The NODE time on SPEC 33 will give
the crew an estimate of when this will occur. At
this point, the crew will null the rate (Y-DOT),
which will put the orbiter in the same orbital
plane as the target.
MC2 Burn This is a special burn because it is
based upon the elevation angle to the target, not
on a time. The burn TIG can change so the burn
will occur at the desired elevation angle. The
MC2 burn sets up the standard trajectory and
reduces the dispersions at MC3. MC3 and MC4
Burns The MC3 burn also targets to MC4 and,
typically, is just a trim burn similar to MC1.
The MC4 burn targets to 600 feet on the +R-bar.
This burn should coast the orbiter to the
desired range on the +R-bar. In the nominal
case, MC4 will be mostly a non-zero +X burn.
Manual Phase Post-MC4, the orbiter is on a
coasting trajectory to the 600-foot point on the
+R-bar.
An attitude maneuver will be
performed to put the orbiter in the +R-bar
attitude by the time it reaches the R-bar.
R-dot corrections (braking gates) will be
performed.

NOTE
For a more detailed overview of
rendezvous, see the RNDZ CONCEPTS
computer based training lesson.

Last Full On-Orbit Day

The last full on orbit day includes nominal
flight day activities plus general cabin stowage,
FCS checkout, RCS hot fire, and those unique
procedures that must be accomplished prior to
transition to the Deorbit Prep Checklist (-04:00
TIG). Before presleep activities, the crew conducts entry planning and stows the Ku-band
antenna.
Presleep and postsleep activities are nominal,
with the exception of the continuation of
general cabin stowage.
Additionally, fluid
loading preparation (four 8 oz containers per
person) and cabin air samples may be
accomplished in the postsleep period or deorbit
preparation.
The flight control system is
checked for proper entry operation (also saves
ground test time). The test (conducted in two
parts) is accomplished with an APU (MCC
designated), but may be done with a circulation
pump, if required.
FCS Checkout, Part 1
FCS checkout Part 1 consists of the following
activities:

Flight-Specific Final Approaches (Covered in

detail during Prox Ops lessons)
R-bar: Fly up the +R-bar from the 600-foot
point.
TORRA: Fly to the +R-bar until 600 feet,
then transition to the R-bar at twice orbit
rate.
TORVA: Fly to the +R-bar until 600 feet,
then transition to the +V-bar at twice orbit
rate.
INERTIAL: Orbiter maintains inertial attitude hold during final approach to target.

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

5.3-8

Power on FCS sensors and controls prior

to the transition to OPS 8. Aerosurface
amplifiers (ASAs) must be ON prior to
GNC OPS 8 if an APU is used and OFF
if a circulation pump is used.
Event timer is set to count up (to track
APU ON time).
Hydraulic thermal conditioning is
terminated and the APU is prepared for
operation.
ON MCC GO, the selected APU is
brought on line in low pressure and
event timer is started.

USA007587
Rev. A
If APU operation is nominal, normal
pressure is selected for actuator
checkout (SM 87 HYD THERMAL
display).
Proper elevon switching valve operation
should be noted.

Surface drive is initiated (some surfaces

may not drive properly right away due
to cold hydraulic fluid). Test should be
complete in about 30 sec.

A secondary actuator check is initiated

to test the bypass feature of the
actuators. When the test is complete,
the APU is shut down and hydraulic
thermal conditioning is re-enabled (if
required). Expect a marked structural
vibration when ports pop during the
secondary actuator check.
FCS Checkout, Part 2
Part 2 of the FCS checkout begins with a sensor
test (GNC 40 SENSOR TEST). The orbiter is
placed in free drift. The crew then initiates the
sensor tests (accelerometer assemblies (AAs),
microwave landing system (MLS), Tactical Air
Navigation (TACAN), radar altimeter, rate gyro
assemblies (RGA), and air data transducer
assemblies (ADTA)). Sensors failing the test will
be deselected for entry.

Following the sensor test, the FCS mode/

channel switch test is conducted. These procedures verify FCS switch contacts and all entrycritical switches (flight controller power
required). Next a test of the nose wheel steering
system is performed. The next series of procedures verify proper operation of controllers and
their associated switches (left and right).
Finally the DDUs and head-up displays (HUDs)
are tested and adjusted for entry. When the
FCS checkout is complete, the DPS is returned
to GNC OPS 2 (G8 to G2 transition), and all
entry equipment is secured.
RCS Hot Fire
This test is conducted to verify the operation of
seldom used RCS jets (thereby decreasing
ground turnaround time). Manual DAP is
selected and the orbiter is verified/placed in
free drift. Each RCS jet is tested (GNC 23 RCS
display) and the results noted (3 sec delay
between pulses to allow time for a fault
message and 30 sec delay if a failure is
annunciated).
When the Hot Fire test is
complete, the vehicle is placed in inertial hold to
allow damping of rates before returning to the
required attitude. RJDs, DDUs, and MDMs are
then secured as required.

5.3-9

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

USA007587
Rev. A

This page intentionally left blank

5. NORMAL PROCEDURES SUMMARY

5.3 Orbit

5.3-10

USA007587
Rev. A

5.4

ENTRY

CONTENTS
Deorbit Preparation ................................... 5.4-1
Deorbit Burn ............................................... 5.4-3
Entry Interface ............................................ 5.4-5
Terminal Area Energy
Management (TAEM) ..................... 5.4-6
Approach and Landing ............................. 5.4-7

-3:30
to
-2:30

MS
performs
payload
deactivation/entry preparation in this
timeframe, as required.

-3:27

DPS is configured for deorbit

preparation. The BFS is woken up to
ensure it has interface to the forward
IDPs.

-3:25

PLT activates APU water boiler steam

vent heaters (at least 2 hr before APU
start) and terminates hyd thermal
conditioning.
PLT prepares for
hydraulic repressurization of the main
engine thrust vector controls (engine
bells must be properly stowed to
prevent thermal damage).

-3:15

CDR, PLT power up FCS, DDUs and

navigation aids for entry (RGAs and
ASAs must be on prior to OPS 3
transition).

-3:10

Crew begins Entry Switch List

verification by comparing crew
compartment switch positions with
diagrams in the Deorbit Prep book.

-2:55

CDR initiates radiator bypass to retain

Freon coldsoak.
Alternate FES
controllers are checked out to save
ground test time. PLBDs will not be
closed until this checkout and until
Freon temperatures are down to 39 F.
Primary RCS jets are used because FES
Hi Load vent forces are too strong for
vernier jets. H2O crossover valve is
verified open to allow all water tanks to
feed the FES equally.

-2:51

MS prepares for PLBD closing: PLB

lights
activated
(as
required),
cameras/video recorder readied, RMS
TV camera positioned and RMS
heaters secured (if RMS flown).

-2:40

Crew closes PLBDs using SM PL BAY

DOORS display on IDP 4 (SM OPS 2).

Deorbit Preparation
TIG
Hr:Min (approx)
-4:00

-3:56

The crew transitions to the Deorbit

Prep
Checklist
for
nominal
procedures. PLT sets CRT timer for
deorbit TIG using the GNC 2 TIME
display and SM timer.
CDR initiates radiator coldsoak by
placing RAD CNTLR OUT TEMP
switch to the HI position and
activating topping FES to minimize
propulsive venting.
Vehicle is
maneuvered to "tail sun" attitude (-X
SI) for the coldsoak. The H2O Loop
Bypass controllers are checked out
and the H2O loops are configured for
entry.

-3:50

MSs continue entry stowage along

with entry airlock configuration.

-3:48

Ku-band antenna is stowed (if not

already accomplished in last presleep
period).

-3:45

Radiators are stowed (if deployed).

-3:42

Compute N2 quantity (for entry cabin

leaks) and identify depleted H2 tanks
(for burn cards).

-3:35

Specialists install
containers.

seats

and

FDF

5.4-1

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

USA007587
Rev. A

Hr:Min (approx)

Communications
panels
are
configured to provide maximum
redundancy.

-2:25

Aft Flight Deck

TIG

-2:23

--2:16

MS performs post-PLBD closing

procedures, which include securing
PLB
lights,
deactivating/stowing
cameras, and taping down foot
restraints (to prevent tripping during
egress).

Secure hydraulic heaters.

CDR monitors auto maneuver to

attitude
suitable
for
S-band
communications if required. Crew
may go to deorbit attitude, depending
on flight profile and TDRS position.

Open Ku-band circuit breakers.

Set up DTV for entry.

Connect an LES communications
cable (dC Utility Power MN C).

Middeck
Configure communications panel
for entry.

CDR, PLT configure DPS (three

phases) to place GPCs 1, 2, 3, and 4 in
PASS OPS 3 and GPC 5 in BFS OPS 3.
Prior to OPS 3 transition, entry TFLs
are loaded and SM Checkpoint Initiate
is performed to update the FDA in
case a wave-off is required. Once in
OPS 3, the crew refers to the Entry
Pocket Checklist for malfunction
procedures.

-1:58

MS deactivates star tracker and closes

doors.

-1:55

CDR, PLT, MSs perform entry switch

list configuration and verification at
this time. The following items will be
performed or verified:

Pressure control system (PCS) is

configured for N2 water tank ullage
pressure.
Close 14.7 cabin regulators (protects
N2 if leak occurs)
Close O2 regulators (so O2 flow
goes only to LES).
Remove and stow bleed orifice.
-1:42

CDR receives MCC readup of PADs

(OMS propellant PAD, deorbit/
entry/land
PAD,
and
deorbit
maneuver PAD). The current state
vector, and deorbit targets are also
uplinked. Crew can use PGSC (SPOC)
to determine targets and c.g. if
required.

-1:40

FES control is given to the BFS.

Freon loop RADIATOR ISOLATION MODE switch is taken to
OFF. Cb's for HUM SEP and IMU
FAN signal conditioners are
opened.

MS enables MPS helium system

pressure C/W (assists crew in
isolating failed open regulator).
Hydraulic system C/W parameters for
low pressure are activated (alarm will
sound immediately since APUs are
OFF).

-1:39

Crew conducts entry review

required (15 min alloted).

One O2/N2 valve is opened in case

of a cabin leak.

-1:24

CDR, PLT don LESs.

Forward Flight Deck

Electrical power to brakes, brake
heaters, anti-skid, and nose wheel
steering (NWS) is applied.
Verniers are secured.

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

5.4-2

as

USA007587
Rev. A
TIG

CDR, PLT conduct horizontal situation

configuration using GNC 50 HORIZ
SIT; BFS GNC 50 HORIZ SIT; and GNC
51 OVERRIDE for both PASS and BFS.

Hr:Min (approx)
-1:10

Specialists don LESs.

-1:06

Final IMU alignment is performed by

CDR to reset RM threshold prior to
deorbit burn. This maximizes IMU
RM,
two-level
attitude
failure
detection.

-1:04

Crew begins fluid loading (containers

filled in post-sleep). This helps
prevent orthostatic intolerance upon
exposure to gravity.

PLT initiates OMS burn preparation,

which includes checking engine trims
and placing OMS and RCS valve
switches in the pre-burn configuration.
MS3 removes and stows side hatch UV
filter, locking device, and Pyro Box
Safing pin.
-0:25

PLT performs vent door closure with

the GNC 51 OVERRIDE display.

-0:59

CDR, PLT ingress seats.

-0:57

CDR, PLT remove HUD covers.

CDR, PLT receive final deorbit

update/uplink if required. MS1 and
MS2 ingress their seats.

-0:53

Crew performs LES pressure integrity

check.

CDR proceeds to OPS 302 and

GO/NO-GO is given for deorbit burn.

-0:50

Crew doffs and stows

communications headsets.

-0:33

MS deactivates WCS and galley.

on-orbit

-0:15

CDR initiates maneuver to deorbit burn

attitude on OMS MNVR EXEC display.
CDR, PLT verify ADI switches in
proper positions. MS places OMS/RCS
heater switches in proper configuration
for entry.

-0:05

PLT performs single APU start. One

APU must be operating in low pressure
prior to the burn. First APU start procedures vary, depending on weather.
CDR verifies orbiter is in the deorbit
burn attitude 5. The crew transitions
to the Deorbit Burn cue card for
nominal procedures, and the Burn
Monitor cue card for malfunction
procedures. The Deorbit Burn Flight
Rules cue card should be consulted
prior to executing the burn.

Deorbit Burn
-1:03

All begin fluid loading per individual

prescription.

-0:55

CDR, PLT perform

integrity check.

-0:47

CDR, PLT stow all unnecessary FDF

items and transition to the Entry
Checklist for the nominal procedures.

-0:46

CDR, PLT receive final deorbit

update/uplink. Deorbit flight rules are
verified with MCC. Exact time may
vary.

-0:40

LES

pressure

CDR performs OMS TVC gimbal check

(during AOS), using OMS MNVR
EXEC display.

Deorbit Burn
TIG
Min:Sec (approx)
-5:00

PLT initiates APU pre-start procedures

(during AOS). BFS, SM SYS SUMM 2 is
used to check APU status.

5.4-3

Once on the Deorbit Burn cue cards,

CDR and PLT ensure OMS He
switches, ADI switches, and FLT
CNTRL PWR are in the proper burn
configuration.

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

USA007587
Rev. A
-2:00

CDR takes OMS ENG switches to

ARM/PRESS in preparation for the
burn.

-0:15

CDR hits EXEC key to trigger OMS

ignition.

0:00

Deorbit burn TIG. CDR, PLT monitor

the burn using delta VTOT, VGO, TGO,
and Hp from GNC OMS MNVR EXEC.
BFS GNC SYS SUMM 2 display is used
for OMS systems data.
Section 7
discusses deorbit burn monitoring and
downmoding.

EI
Min:Sec (approx)
-20:00

CDR starts a secondary actuator

check, if not already done during FCS
checkout and time allows, using GNC
53 CONTROLS, BFS SM SYS SUMM 2,
and GNC DEORB MNVR COAST
displays.

-18:00

PLT performs forward RCS dump

with GNC 23 RCS, GNC DEORB
MNVR COAST, and GNC SYS SUMM
2 displays. Dump times for various
forward RCS quantities are listed in
the Entry Checklist.
It takes 90
seconds to dump 50 percent forward
RCS with 4 jets (twice as long using a
2 jet dump).

As burn termination nears (TGO going

to 0), crew monitors current perigee
(HP) approaching targeted HP and
delta VTOT approaching 0. Deorbit
OMS burn time varies with orbital
altitude. Typical burn times are 2-3
minutes. During the burn, the Deorbit
Burn Monitor cue card is used for
malfunction procedures.

The forward RCS is always dumped

unless needed for c.g. control. This
reduces the hazard to the crew if a
hard landing is made.

OMS Cutoff
+2
sec

If nominal burn, CDR secures OMS

engines following the automatic purge
and trims residual X and Z velocities (<2
fps for steep targets and -0.5 fps for
shallow ones). The crew returns to the
Entry Checklist Post Deorbit Burn
section for nominal procedures and to
the
Entry
Pocket
Checklist
for
malfunction procedures.
PLT
performs
OMS/RCS
reconfiguration by verifying the proper
position of RCS switches and closing
OMS HE and crossfeed valves; MS stows
PGSC (SPOC).
CDR proceeds to OPS 303, verifies the
proper attitude, and initiates maneuver
to the EI -5 min attitude. CDR also
conducts OMS gimbal powerdown
verifying after gimbals have driven to
the proper entry position.

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

CDR, PLT perform entry switch

checks (using GNC 51 OVERRIDE)
and exercise brake pedals.
-13:00

PLT starts remaining two APUs,

verifies nominal performance, then
switches all three APUs to normal
pressure in preparation for the SSME
hydraulic repress.
PLT performs main engine hydraulic
system repressurization to ensure the
nozzles are properly stowed.

-11:00

If required, PLT initiates hydraulic

fluid conditioning on MCCs call and
monitors surface position indicators
for aerosurface cycling.
Crew makes burn report to MCC and
updates new state vector if required.
All crew members inflate anti-g suits if
desired.

-6:00

5.4-4

The crew transitions to the Entry

Maneuver cue card for nominal entry
procedures.

USA007587
Rev. A
-5:00

-3:00

CDR transitions GPCs to OPS 304

when verified at EI-5 attitude. Crew
switches to AESP for malfunction
procedures.

+6:10
-26:04

Maximum
surface
temperature
region begins (Mach 24 to 19). Actual
drag should be within .5 fps2 of
orbiter bug drag.

Program test inputs (PTIs) are enabled

on SPEC 50 when applicable.

+8:04
-24:10

Pitch RCS jets deactivated at q-bar =

40.

PLT verifies FWD RCS MANIFOLD

ISOLATION valve switches (4) are
closed (unless forward RCS PTIs are
scheduled).

+11:49
-20:25

At drag = 11 fps2, drag H updates

begin in NAV filter. Crew monitors
data on GNC 50 HORIZ SIT display.

+13:40
-18:34

First roll reversal is issued by

guidance when azimuth error (delta
AZ) = 10.5. Occurs at a flightspecific velocity between 23,000 and
6,200 fps, depending on crossrange.

Entry Interface
+ = Time from EI
= Time to touchdown
Min:Sec (approx)
+0:00
-32:14

Orbiter reaches EI (400,000 ft) at an

Earth relative velocity (V) of ~24,600
fps and descent rate (H-dot) of ~500
fps. The crew compares ADI, AMI,
and AVVI data to Entry cue card
data. ENTRY TRAJ (1 - 5), HORIZ
SIT, and GNC SYS SUMM 1 displays
are monitored. The BFS ENTRY
TRAJ display is available to compare
PASS and BFS guidance. The PLT
can call up BFS SYS SUMM displays
as desired to check system operation.

+2:39
-29:35

Automatic elevon trim begins at a

q-bar = 0.5 psf.

+3:32
-28:42

Aerosurface control begins at q-bar =

2.0 psf. CDR, PLT monitor elevon
and aileron deflection angles on
surface position indicator.

+4:45
-27:29

Closed loop guidance initiated (CLG

Init) at q-bar = ~8 psf or drag = ~3
Guidance box appears on
fps2.
ENTRY TRAJ to indicate closed loop
guidance.

+5:00
27:14

Roll RCS jets deactivated at q-bar = 10

psf.

+5:18
-26:56

First non-zero bank command issued

by guidance at H-dot -240 ft/sec
(CLG Init plus 15 to 30 sec).

Note:

1 k fps = Mach 1.0

+14:42
-17:32
V = 19 k fps
(Mach = 19)
Alt = 215 k ft

The PLT checks that the

MPS TVC isolation valves
are closed. Pitch and roll
RCS activity lights are
reconfigured when q-bar =
50 psf to indicate RCS
saturation.

+15:51
-16:23
V =17 k fps
(Mach = 17)
Alt = 200 k ft

PASS
and
BFS
TRAJ
displays mode to ENTRY
TRAJ 2.

+17:00
-15:14
VREL = 15 k fps
(Mach = 15)
Alt = 185 k ft

NAVAID power is verified

and I/O RESET performed.
This ensures NAVAIDs will
warm up before they are
required (in case they were
off due to a powerdown).

+17:57
-14:17
V =14 k fps
(Mach = 14)
Alt = 182 k ft

PASS and BFS ENTRY TRAJ

mode to ENTRY TRAJ 3.
Drag is up to 33 fps2 and Gs
up to 1.5.

REL

REL

REL

5.4-5

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

USA007587
Rev. A
+18:57
-13:17
VREL=12 k fps
(Mach = 12)
Alt = 176 k ft

Radiator coldsoak usage is

initiated in preparation for
the FES becoming inactive:
Radiator bypass valves (2)
are placed in automatic and
radiator controller loops (2)
are put in AUTO B(A).
CDR
and
monitoring
saturation.

PASS and BFS ENTRY TRAJ

mode to ENTRY TRAJ 4.
Alpha and drag start to
ramp down, but Gs stay up
over 1.3.

+20:03
-12:11
VREL=10 k fps
(Mach = 10)
Alt = 150 k ft

Speedbrake
percent.

+21:00
-11:14
VRc= 8.0 k fps
(Mach = 8)

SSME repositioning for drag

chute deploy.
If GPC
annunciates SSME REPOS
FAIL, drag chute is emergency deploy only.

+21:34
-10:40
V =7.5 k fps
(Mach = 7.5)
Alt = 144 k ft

MCC has sufficient tracking

for state vector update. This
time can vary depending on
ground track and tracking
station performance.

+22:00
-10:14
V =7 k fps
(Mach = 7)
Alt = 138 k ft

MCC and the crew compare

TACAN data to NAV. If
acceptable, MCC tells the
crew to take TACAN. GNC
50 HORIZ SIT display is
used to check TACAN
errors and accept TACAN
data for use by the NAV
filter.

+22:41
-09:33
V =6 k fps
(Mach = 6)
Alt = 131 k ft

PASS and BFS ENTRY TRAJ

displays mode to GNC
ENTRY TRAJ 5.

REL

REL

opens

to

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

Air
data
probes
are
deployed. CDR, PLT begin
aileron and rudder trim
monitoring. The crew can
check for good probe deploy
discretes by noting the
absence of OFF flags on the
AMI and AVVI tapes when
the AIR DATA select switch
is taken from NAV to LEFT
then RIGHT. This does not
apply if the BFS is engaged.
The BFS does not support
OFF flags.
Air data
information will not be valid
until Mach is <3.5.

+25:00
-07:14
(Mach = 3.4)
Alt = 95 k ft

Using GNC 51 OVRD, GNC

50
HORIZ SIT,
and
instrument tapes the crew
checks air data is close to
NAV. MCC will give a GO
to take air data to NAV
and/or G&C using Items 25
and 28 on GNC 50 HORIZ
SIT.

+25:30
-06:44
(Mach = 2.6)
Alt = 83 k ft

PLT ensures APUs operating

in
the
best
possible
configuration for landing based
on any previous failures.
CDR, PLT activate HUDs.

REL

PLT
begin
for
aileron

+19:20
-12:54
VREL=10.5 k fps
(Mach = 10.5)
Alt = 167 k ft

REL

+23:30
-08:44
V = 5 k fps
(Mach = 5)
Alt = 120 k ft

81

Terminal Area Energy Management

(TAEM)
+25:40
-06:34
(Mach = 2.5)
Alt = 81 k ft

+25:55
-06:19
(Mach = 2.4)
Alt = 80 k ft

5.4-6

PLT verifies air data incorporated into guidance. If not,

the CDR must take CSS control to avoid a transient when
air data is incorporated. Software transitions automatically to OPS 305. Guidance
enters TAEM phase. VERT
SIT 1 displays replace PASS
and BFS ENTRY TRAJ displays.
Forward, aft, and midbody
compartment vents open.

USA007587
Rev. A
+26:50
-05:24
(Mach = 2.0)
Alt = 75 k ft

Air
data
must
be
incorporated to Guidance and
Control or the crew must stay
within theta limits as shown
on the ADI or on the VERT
SIT display.

+30:00
-02:14
280 KEAS
Alt = 15 k ft

WARNING
If low energy, or flying a big heading
alignment cone (HAC) (>~325) and
air data is not incorporated, TAEM
guidance
will
command
an
uncontrollable pitch up between
Mach 1.0 and 1.5. The CDR will fly
pitch CSS at M <2.0 and monitor
theta limits.
+27:53
-04:21
(Mach = 1.0)
Alt = 54 k ft

RCS yaw jets are deactivated.

+28:17
-03:57
(Mach = 0.9)
Alt = 46 k ft

CDR selects pitch, roll, and

yaw (R/Y) CSS. Speedbrake
commanded versus actual
position is verified. Speed
brake is now controlling
energy. PLT flight controller
is verified ON. This switch
must be on for NWS to work.
NWS is verified in system 1.

+29:00
-03:14
(Mach = 0.7)
Alt = 32 k ft

MS2 monitors MLS acquisition. All residuals and ratios

disappear from PASS GNC 50
HORIZ SIT upon MLS acquisition and an overbright MLS
will appear in the middle right
of the display. CDR and PLT
check PAPIs and HUD
overlays on runway to evaluate NAV state.
De-clutter
HUDs as required.
Crew
starts landing comm protocol.

Approach and Landing

+31:00
-1:14
300 KEAS (18 and 20 OGS)
Alt = 12 k ft
CDR and PLT monitor outer
glide slope (OGS) and verify
with the PAPIs. At 10,000 ft
crew verifies Approach and
Landing guidance (flashing
A/L on VERT SIT display),
body flap to TRAIL, and LES
visors down (KSC).

PLT verifies landing gear

extend isolation valve is open
(occurs at M=0.8). PASS and
BFS VERT SIT displays
transition to VERT SIT 2. PLT
and CDR monitor PASS and
BFS GNC 50 HORIZ SIT for
HAC acquisition. The glide
slope indicator (GSI) is now
accurate enough to use.

+31:24
-0:50
300 KEAS
Alt = 5 k ft

PLT compares radar ALT 1

vs. 2.

+31:35
-0:39
300 KEAS
Alt = 3 k ft

MS2 checks speed brake

command percent (actual will
lag).

31:41
-0:33
300 KEAS
Alt = 2 k ft

CDR initiates preflare and

begins transition onto ball
bar. PLT arms landing gear
on call from CDR.

+31:51
-00:23
297 KEAS
Alt = 500 ft

Shuttle will be lined up on

ball bar. MS2 checks speed
brake
command
percent
(second smart speed brake
reset).

+31:54
-0:20
288 KEAS
Alt = 300 ft

PLT deploys the landing gear

on call from CDR. PLT/MS2
check gear indications down.

5.4-7

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

USA007587
Rev. A
+32:04
-0:10
261 KEAS
Alt = 30-80 ft

Final flare begins.

+32:14
-00:00
195 or 205
KEAS

Main gear touchdown (195

KEAS GW <220,000 lb). CDR
controls drift with rudder,
maintains wings level with
RHC. PLT and MS check
speed brake opening. PLT
checks HUD display for
WOW lock on (WOWLON)
(HUD reconfigures and airspeed moves to upper left
corner of the display). Also,
the velocity vector disappears.

+32:15
+00:01
195 KEAS

PLT deploys drag chute on

call from CDR. 195 KEAS.

+32:16
+00:02
185 KEAS

CDR initiates beep trim

derotation, which targets 1.5
deg/sec.

+32:24
+00:10
145 to 155
KEAS

Nose gear touchdown (HUD

reconfigures with a "G" showing up by the groundspeed).
MS2 selects SRB SEP to
AUTO/MAN or ET SEP to
MAN and depresses the corresponding pushbutton to
backup automatic discretes
for elevon load relief, NWS,
and anti-skid circuitry. CDR
maintains or slowly and judiciously corrects to centerline
with NWS. MS checks elevons down (makes sure they
have load relief) and NWS
FAIL and anti-skid fail lights
off. MS calls "NWS FAIL" as
necessary. (If no load relief,
RHC full forward. If NWS
FAIL light comes on, steer
with rudder, RHC, and
brakes. NWS2 may be available.)

5. NORMAL PROCEDURES SUMMARY

5.4. Entry

+32:34
+00:20

CDR checks ground speed

and decel on HUD. Post
midfield, CDR applies brakes
at 140 knots ground speed
(KGS) or 5000 feet runway
remaining, whichever occurs
first. If 140 KGS is reached
first, nominal braking profile
is used
This deceleration
profile is typically 8 to 10
At 5000 feet of
ft/sec2.
runway remaining, if groundspeed is greater than 140
knots, CDR applies maximum
braking.

+32:46
+00:32
60 KGS
(20 kts)

PLT jettisons drag chute on

CDR call.

+32:50
00:36
40 KGS

CDR reduces braking to less

than 6 ft/sec2 until wheelstop.

+32:56
+00:42

Orbiter stops; CDR reports

wheels stop to MCC. Crew
transitions to Post Landing
Procedures in the Entry
Checklist.
At wheel stop,
speed brake is closed.

5.4-8

USA007587
Rev. A

5.5

GPC 1 and informs MS to proceed with MS

System Deactivation Procedures (LRU and
APU heater deactivation, RCS/OMS
heaters turned OFF).

POSTLANDING
CDR takes NWS, flight controller power,
and HUD power off. PLT checks that APU
auto shutdown is enabled and speed select
is in norm. PLT takes HUD power off.

PLT performs vent door purge positioning

and RCS/OMS valve test.

CDR and PLT safe RCS/OMS,

deactivate air data probe heaters.

Convoy personnel open hatch.

CDR, PLT, and MS safe the drag chute and

landing gear.

PLT, after notifying MCC, opens the ET

umbilical doors. PLT initiates hydraulic
load test on MCC call.

Flight Surgeon enters cabin for health

check. ASP, suit tech, and Shuttle Processing Contract Spacecraft Operator (SPC
SCO) enter the cabin to assist with egress
and removal of experiments and early
return items.

CDR performs DPS transition to GNC OPS

901 on MCC call.

CDR, MS, (PS) egress seats.

MS, PS
retrieve "return to Houston bags."

CDR performs the radiator reconfig and

activates the NH3 boiler, as required (MCC
call or C/W). Typically, this is done out of
order from the rest of the postlanding
procedures based on cooling requirements and
frequently is done very early in the postlanding time frame.

CDR, PLT, MS, (PS) egress orbiter to begin

postlanding activities.
After medical
evaluations, showers, visits with family
and postlanding medical data collection,
the crew returns to Houston. Normal
return to Houston occurs 6 to 9 hours after
landing.

PLT sets body flap to trail and performs

main engine reposition with PASS OPS 9
display GNC 105 TCS CONTROL. PLT
also performs APU/HYD shutdown after
main engine repositioning is complete.

ASP removes special FDF but retains some

entry related FDF until handover to KSC.

ASP hands vehicle over to SPC SCO when

MCC (Houston flight) hands off to Orbiter
Test Conductor (OTC).

and

CDR performs PCS deactivation. With a

GO for extended powerup from MCC,
CDR/PLT begin system deactivation.
CDR secures GPCs 2-4 reassigning strings
to

5.5-1

5. NORMAL PROCEDURES SUMMARY

5.5 Postlanding

USA007587
Rev. A

This page intentionally left blank

5. NORMAL PROCEDURES SUMMARY

5.5 Postlanding

5.5-2

USA007587
Rev. A
the Launch Control Center (LCC) while on the
pad and postlanding, and from the Mission
Control Center (MCC) during all flight phases.
Both the LCC and MCC have an enormous
amount of data at their disposal. With the
highly trained Launch Team and Flight Team
working together with the crew, most
emergencies can be quickly identified and
proper actions started.

6. EMERGENCY PROCEDURES
CONTENTS
6.1

LAUNCH ABORT MODES

AND RATIONALE ...................
6.2 ASCENT ABORTS.....................
6.3 RETURN TO LAUNCH
SITE .............................................
6.4 TRANSOCEANIC ABORT
LANDING ..................................
6.5 ABORT ONCE AROUND........
6.6 ABORT TO ORBIT ....................
6.7 CONTINGENCY ABORT ........
6.8 SYSTEMS FAILURES................
6.9 MULTIPLE FAILURE
SCENARIOS...............................
6.10 SWITCH AND PANEL
CAUTIONS ................................
6.11 SYSTEMS FAILURE
SUMMARY.................................

6.1-1
6.2-1
6.3-1

There are three levels of protection to prevent

loss of a shuttle because of failures: component
failure prevention, vehicle design, and training.

6.4-1
6.5-1
6.6-1
6.7-1
6.8-1

Component failure prevention is accomplished

through a stringent process of equipment
design, qualification tests, maintenance, checkout, quality control, and proper operation.

6.9-1

The shuttle is designed to a fail-ops/fail-safe

philosophy. This means that loss of any one
component can be tolerated without compromising the mission, and loss of a second component will not result in loss of vehicle or crew.
Obviously, this requires redundant systems and
system components. Managing this redundancy adds to shuttle complexity.

6.10-1
6.11-1

This section covers critical failures to which the

crew must react expeditiously. Both performance-related and system failures are presented.
Critical system failures are those requiring a
response within 5 minutes to safe the system or
restore its function. Performance-related failures may result in an abort, depending upon
the severity. Launch and ascent aborts are
discussed in detail.

The third level of protection is the human

element: crew, MCC, and LCC training. In
order to quickly and correctly respond to
performance or systems problems, as well as
complex multiple failures, the flight crew and
ground crews must be experts on shuttle
systems and how to control them. Prior to
flight, both the ground teams and the crew
participate in many hours of intense simulations to improve their teamwork and knowledge of shuttle systems. A stringent certification process is also in place to ensure qualified
and current personnel in all disciplines.

The emergency procedures in this section are

designed to be general in nature and not flight
specific. Detailed procedures are available in
Flight Data File (FDF) checklists. It is very
important that crewmembers learn to recognize
failures and react properly. Failure identification is the key. Only through study, training,
and practice will a crewmember achieve the
desired degree of proficiency prior to flight.

Failures tend to fall into two general categories,

single component and multiple.

In some areas, actual crew operations are

described, along with monitoring and control
devices. This is particularly important for aborts,
where dynamic flight cues, instruments, and cue
cards must be rapidly interpreted. Some abort
rationale is also included to ensure the
crewmember understands various abort modes.

For single-component failures, patience is

important. Shuttle design should allow time to
properly analyze what has happened and what
steps are necessary to regain the lost component
or to optimize remaining systems to protect
against additional failures. A common error
among inexperienced personnel is to act too
quickly, do the wrong thing, and make the
situation worse.

The key to most emergencies is to utilize all

information available, including inputs from
6-1

6. EMERGENCY PROCEDURES

USA007587
Rev. A
again, reacting too quickly can jeopardize
vehicle integrity.

Multiple failures are more difficult to deal with,

because reaction time must be short, and
procedures may not be explicit. Most FDF
procedures are written considering a maximum
of two failures. To avoid burdensome complexity and to maintain credibility, this is the
only way to realistically tailor procedures to a
vehicle as complex as the shuttle. The result is
that a specific procedure may not be available to
guide the crew, or several procedures must be
combined or executed in rapid succession. For
these cases, the crew and ground teams must
rely on their knowledge and training. Once

6. EMERGENCY PROCEDURES

To cope with potential failures in a dynamic

environment, such as ascent or entry, the flight
crew must constantly keep in mind their current
status and mentally prepare for potential
additional failures before they occur.
This
staying ahead of the airplane philosophy,
along with system reconfiguration for
optimization and built-in graceful degradation of
systems, enhances the chances of a successful
outcome when multiple failures are encountered.

6-2

USA007587
Rev. A

6.1

LAUNCH ABORT MODES AND

RATIONALE

CONTENTS
Mode 1 Unaided Egress/Escape......
Mode 2 Aided Escape ........................
Mode 3 Aided Escape ........................
Mode 4 Aided Escape ........................

6.1-1
6.1-1
6.1-2
6.1-2

A shuttle launch may be scrubbed or aborted up

to solid rocket booster (SRB) ignition.
Normally, launch scrubs prior to space shuttle
main engine (SSME) start are followed by an
orderly safing procedure and crew egress,
assisted by the closeout crew. A fully fueled
shuttle on the launch pad may present an
extremely hazardous situation if toxic vapors,
fire, or structural damage are present. A launch
abort after SSME start is automatically
controlled by the ground launch sequencer
(GLS). The most serious hazard here is the
presence of excess hydrogen, resulting in a
hydrogen fire, which is invisible to the eye and
very dangerous. This situation occurred during
a launch attempt for STS-41D.
In the event of an emergency at the launch pad,
the NASA Test Director (NTD), who mans a
console in the Launch Control Center (LCC)
firing room, is in command. Priority is flight
and ground crew egress and escape, followed
by preventing destruction of the shuttle,
facilities, complex, and support equipment.
Should an abnormal event occur that terminates
a flight or prelaunch operation and results in
substantial damage to the shuttle and/or injury
to personnel, the NTD will declare a contingency
situation. This alerts fire and rescue personnel
and puts in motion pre-planned procedures to
minimize further damage and injuries.
The NTD may also initiate action if an emergency
condition exists that requires immediate action to
prevent loss of life or destruction of equipment.
In preparation for a potential emergency
condition, a hazardous condition may be
declared if there is a threat to personnel health or
safety. A hazardous condition may develop into
an emergency condition.

Depending upon the severity of the situation on

the launch pad, an emergency egress/escape
may be required to evacuate personnel. The
shuttle program has classified four launch pad
escape modes that are preplanned and
rehearsed by the flight crew, closeout crew, and
all launch pad personnel. Defining these modes
prior to the development of an emergency
condition or contingency situation ensures
standard procedures can be followed and
minimizes risk of additional injury and damage.

Mode 1 Unaided Egress/Escape

This escape mode may be initiated by the NTD
or flight crew. The NTD will direct that the
orbiter access arm (OAA) be returned to its
position at the crew module hatch.
The
fire/rescue crew will be dispatched if the NTD
decides it is safe to do so. Escape from the
shuttle vehicle and the pad is performed by the
crew. This procedure is practiced in trainers
and mockups in Houston and rehearsed during
terminal countdown demonstration test (TCDT)
at KSC. Because crew complement varies from
flight to flight, each crew must develop their
own particular procedures. Using a buddy
system is strongly recommended. Egressing the
shuttle along the OAA and across the pad 195 ft
level to the slidewire baskets through the water
deluge fire suppression system is a hazardous
operation. Given the very real potential of fire,
toxic vapors, and explosion, flight crews must
be well-trained and prepared.

Mode 2 Aided Escape

Aided escape is initiated by the NTD, flight
crew, or closeout crew. This mode is used when
the closeout crew is still on the pad. The
closeout crew leader is responsible for ensuring
that all personnel egress from the shuttle and
proceed along the prescribed escape route to a
safe area.
The NTD will also alert the
fire/rescue crew. Injured personnel will be
assisted/carried along the escape route, and
basic first aid will be rendered if required. The
closeout crew leader keeps the NTD informed
of medical conditions and egress/escape
progress.

6.1-1

6. EMERGENCY PROCEDURES
6.1 Launch Abort Modes and Rationale

USA007587
Rev. A

Mode 3 Aided Escape

Initiated by the NTD or flight crew, this mode is
used after the closeout crew has departed, and a
contingency occurs that requires assistance.
The OAA is repositioned, and the fire/rescue
crew proceeds to the pad to assist the flight
crew. The actual egress/escape is similar to the
Mode 2 operation, except the fire/rescue crew
substitutes for the closeout crew.

Mode 4 Aided Escape

This mode is initiated by the NTD, closeout
crew, or flight crew. It involves a contingency

6. EMERGENCY PROCEDURES
6.1 Launch Abort Modes and Rationale

where one or more members of the closeout

crew or flight crew are trapped or injured.
Rescue and escape are performed by the
fire/rescue crew, assisted by the closeout crew
and flight crew. Use of all seven slidewire
baskets may be required. Personnel accountability is critical.
In summary, launch aborts may range from a
scrub/turnaround to a complex rescue scenario.
Crews must be very familiar with all hardware
and procedures. This requires training and
practice. Prior to any launch pad evolution, a
careful review of emergency procedures is
warranted.

6.1-2

USA007587
Rev. A

6.2

If even a low orbit cannot be achieved, an abort

once around (AOA) may be used. The orbiter is
placed into a suborbital trajectory leading to a
landing after a single revolution around the
Earth.

ASCENT ABORTS

CONTENTS
Performance Aborts ................................ 6.2-1
Systems Aborts ........................................ 6.2-4
Range Safety ............................................ 6.2-4
Events that require an ascent abort can be
generally grouped into performance and systems failures. Flight Rules that govern these
two types of scenarios are incorporated into
various real-time MCC calls, along with the NO
COMM MODE BOUNDARIES and the SYS
FLIGHT RULES cue cards.

Performance Aborts
The amount of performance lost when a shuttle
engine loses thrust or fails is directly related to
the time of the problem. Early engine degradation or failure while the shuttle is heavy with
fuel may preclude achieving a safe orbit. Late
engine problems may result in no underspeed
at all. Fortunately, it is not necessary to fly all
the way to main engine cutoff (MECO) to find
out how large the underspeed will be. By using
a computer program called the abort region
determinator (ARD), MCC can predict the
underspeed that will result from any performance problem. Thus, the MCC can immediately
determine whether the desired or even a safe
orbit can be achieved. If a safe orbit cannot be
achieved, some type of abort will be required.
There are two basic types of ascent abort modes,
intact and contingency.
Intact aborts are
designed to provide a safe return of the orbiter
to a planned landing site. Contingency aborts
are designed to permit crew survival following
more severe failures when an intact abort is not
possible. A contingency abort could result in
either a landing at an East Coast Abort Landing
(ECAL) site or in a crew bailout over the ocean.
The intact aborts will be discussed here.
Contingency aborts are discussed in section 6.7.
For cases where the orbiter comes close to
achieving normal orbit, the abort might simply
consist of going to a lower, but perfectly safe,
orbit. This is called an abort to orbit (ATO).

The next available abort mode, if performance

does not permit an AOA, is a transoceanic abort
landing (TAL), which results in landing on a
runway in Europe or Africa.
Finally, for intact aborts, if an engine fails after
lift-off and before TAL is possible, a return to
launch site (RTLS) abort would be performed.
During powered flight, the crew tracks vehicle
present abort capability by MCC voice calls. If
communications are lost, the NO COMM
MODE BOUNDARIES card provides a summary of ascent abort mode capability.

NO COMM MODE BOUNDARIES Cue Card

This card does not reflect off-nominal performance such as a stuck throttle. Only the ARD can
calculate abort mode boundaries based on
actual performance. The ARD takes real-time
performance into account when predicting realtime mode boundaries.
The abort mode boundaries are flight specific.
Times change significantly because of
differences in mass properties, environmental
modeling, and performance characteristics.
Boundary names may also change.
For

6.2-1

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

USA007587
Rev. A
example, some missions will not have a Press to
ATO boundary. Also, TAL sites are mission
specific. Higher inclination flights require a
different philosophy of calls and checklist mode
boundaries than lower inclination flights.

The constraints on design underspeed are ET

impact, minimum performance, minimum
altitude, contingency c.g. envelope protection,
and minimum net positive suction pressure
(NPSP) for the main engines.

What follows is a generic discussion of mode

boundaries. Flight-specific data is available from the
Flight Dynamics Officers (FDO).

Press to MECO

Two-Engine TAL
TWO-ENGINE TAL is the earliest inertial
velocity (VI), at which AUTO guidance, using
only two SSMEs, will achieve the desired
MECO targets to the designated TAL landing
site.
An engine failure prior to this point will most
likely mean an RTLS.
Even after this point, RTLS capability is still
available. TAL, however, is typically preferred
for engine failures in this overlap region.
Single-engine completion capability is attained
much earlier for TAL than RTLS, and the TAL
profile is not as dynamic as the RTLS profile.
On the other hand, in cases of severe systems
failures that require the crew to land as soon as
possible, an RTLS may be preferred over TAL.
Negative Return
NEGATIVE RETURN represents the last
opportunity to abort RTLS and still achieve the
desired MECO targets. Past this VI, the orbiter
will have too much downrange energy to
successfully return to KSC.
An engine failure past Negative Return will
most likely mean a TAL.
Press to ATO
This boundary represents the earliest VI at which
AUTO guidance can achieve the design
underspeed at MECO with only two SSMEs.
This typically requires having to abort ATO and
performing a pre-MECO OMS dump to reduce
vehicle weight and improve ascent performance.
An engine failure prior to this point will most
like mean a TAL.

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

Like Press to ATO, this boundary also represents

the earliest VI at which AUTO guidance can
achieve the design underspeed at MECO with
only two SSMEs. The difference here is that the
vehicle now has enough velocity that no abort is
necessary and a pre-MECO OMS dump will not
be required.
An engine failure prior to this point will most
likely mean an ATO.
SE OPS 3 109
The single-engine (SE) OPS 3 boundary
represents the point in the ascent where two
engines can fail and the flight will continue the
ascent to MECO for an OPS 3 entry instead of
an OPS 6 entry. It also represents the dividing
line between two Contigency Abort procedures:
CONT 2 OUT SECOND and CONT 2 OUT
DROOP (see section 6.7).
The SE OPS 3 boundary is a function of
Bermuda/east coast abort landing (BDA/
ECAL) capability, emergency landing site (ELS)
capability, and the ability to target a TAL or ELS
without descending below 265,000 feet during
powered flight (minimum droop altitude).
Going below the minimum droop altitude
violates ET heating constraints, and loss of
vehicle is expected. Although European ELSs
can be used for determining the SE OPS 3
boundary, typical ELSs are islands well short of
the planned TAL site, such that single-engine
runway capability occurs as early as possible in
the powered trajectory.
Depending on
inclination, the island runways used are Lajes,
Azores; Las Palmas, Canary Islands; and
Amilcar Cabral, Cape Verde Islands.
In case droop capability comes before the last
possible BDA/ECAL opportunity, SE OPS 3
will be called on at the earliest of the following:
last BDA/ECAL, first ELS, or single-engine
limits to an augmented contingency landing site
(ACLS).

6.2-2

USA007587
Rev. A
In any case, capability to a runway exists for all
these boundaries.
If BDA/ECAL capability does not overlap
droop capability or there is no BDA/ECAL
capability, the SE OPS 3 boundary may not
ensure runway capability because the boundary
will be called solely on the minimum droop
altitude, without regard to TAL/ELS runway
capability. A bailout likely will be necessary.
Single Engine TAL (104)

TAL REDEZ
SE OPS 3 and SINGLE ENGINE TAL both
assume simultaneous engine failures. With
staggered engine failures, these mode
boundaries shift, depending on when the
failures occur.
The
flight
crew
uses
the
TAL
REDESIGNATION cue card to determine the
new mode boundaries after the first SSME
failure.

This boundary represents the earliest VI where

AUTO guidance can achieve the desired TAL
targets line after two simultaneous engine
failures.
Two engines failing prior to this point will most
likely mean a Contingency Abort.
Single Engine Press
This boundary represent the earliest VI after
which AUTO guidance can achieve the critical
underspeed after two simultaneous engine
failures.
Two engines failing prior to this point will most
likely mean a TAL.
Critical underspeed is the same as design
underspeed, excluding the ET impact and NPSP
constraints. Other criteria may be found in the
Flight Rules.

ZZA TAL REDESIGNATION Cue Card

For example:
With three engines running, SE OPS 3 and
SE TAL will occur at a VI of 12,100 fps and
14,200 fps, respectively.

Last Pre-MECO TAL

This boundary (not normally called out by
MCC) represents the last opportunity to abort
TAL pre-MECO and still achieve the proper
TAL targets.
If a TAL is desired after this point, the crew will
need to manually command MECO before a
certain VI (mission dependent), and then
perform a post-MECO TAL.

If an engine fails at a VI = 6000 fps, the new

SE OPS 3 and SE TAL boundaries would be
at a VI of 10,900 fps and 17,100 fps,
respectively.
These velocities assume a 109% or 104% throttle,
as specified in parentheses.

Last TAL
This boundary (also not normally called out by
MCC) represents the highest MECO velocity
after which a TAL or ELS site is no longer an
option. After this point, an AOA or certain
high-energy procedures may be invoked.
6.2-3

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

USA007587
Rev. A

Systems Aborts

Freon Loops

The SYS FLIGHT RULES cue card summarizes

the Flight Rules requiring RTLS and TAL
selection in response to critical systems failures.
In most cases, additional insight provided by
MCC is necessary to accurately and fully
diagnose a failure and select the best response.
In the event of sudden multiple failures, help by
MCC is critical. For COMM loss, however, only
the SYS FLIGHT RULES cue card is available.

Losing both Freon loops will eventually result

in loss of all three fuel cells due to lack of
cooling. Since this is time critical, RTLS is
preferable over TAL.
Main Buses
Two main bus failures preclude ET door
closure.
Since TAL entry trajectories are
thermally severe, RTLS is preferred. If RTLS is
no longer possible (past NEGATIVE RETURN),
pressing uphill is preferable to TAL.
Thermal Window Pane
An abort is required for the outer forward windshield
or side hatch thermal window pane. An RTLS abort
is selected to minimize the thermal stresses on the
remaining windowpanes and surrounding structure.
Entry heat loads are less on an RTLS than on other
abort modes or during a normal landing. This choice
provides a better chance of the remaining panes and
surrounding structure surviving entry.

SYS FLIGHT RULES Card

Range Safety

OMS Capability
A severe loss of OMS capability (e.g. leaking
propellant or helium) can make it impossible to
continue uphill and subsequently deorbit. If
total OMS capability is lost while still in
powered flight, a TAL would be required.
APU/HYD
With the impending loss of all hydraulics, a
trajectory option with minimum time to the
ground is desired. This enhances the potential
to land prior to a complete loss of hydraulics.
Cabin Leak
Loss of cabin pressure integrity impacts both
breathing oxygen and equipment cooling. A
minimum time to the ground option is required.
Cryo
Loss of cryo O2 or H2 will result in a loss of fuel
cells and all electrical power. A minimum time
to the ground option is required.

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

Launch vehicles convert vast amounts of

chemical potential energy into equally vast
amounts of kinetic energy to put their payloads
into orbit. Despite all planning, design, and
tests, the possibility that a malfunction could
cause a vehicle to fly out of control toward a
populated area must be considered. Range
Safetys function is to terminate flights that are
far enough out of normal bounds to endanger
populated areas. During first stage, this is
accomplished by remotely detonating explosive
charges aboard the SRBs. During second stage,
the responsibility for range safety is on the
MCC/crew, with inputs from Range Safety at
KSC.
To protect populated areas, impact limit lines
are drawn around them. No lethal piece of a
vehicle can land behind an impact limit line.
Since termination would have to occur well
before an impact limit line is reached, destruct
lines are drawn inside the boundaries of the
impact limit lines. A vehicle passing outside
the boundaries of the destruct line would be
subject to termination.

6.2-4

USA007587
Rev. A
Controllability

In second stage, the options are:

During first-stage, trajectory deviations may

lead to a violation of a destruct line by a shuttle
that is still under control. It may be possible to
return the vehicle toward its nominal trajectory
or to safely execute an abort. Therefore, the
Flight Director (FD) and Flight Dynamics
Officer (FDO) are in voice communication with
the Flight Control Officer (FCO) (formerly
Range Safety Officer) during ascent. If the FCO
detects a violation, the FDO and FD are
immediately informed. The FD must determine
whether the shuttle is controllable or
uncontrollable, and inform the FCO. As long as
the FD declares the shuttle controllable, the
FCO takes no action to terminate the flight for
trajectory deviations alone.

State vector update

ATO selection

Select CSS

TAL or RTLS selection

Engage BFS

SSME manual cutoff. For loss of

comm, FCO will send the ARM
command as a cue for manual MECO

Options are listed in order of priority. The

priorities are established such that higher
priority options preserve lower priority options
and involve fewer new dangers to the crew and
shuttle when possible.

Range Safety Limit Avoidance

A deviation from nominal trajectory that is
large enough to warrant FCO action must be
corrected. First-stage options are:

State vector update

Select CSS (after 90 seconds MET)

Engage BFS

6.2-5

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

USA007587
Rev. A

This page intentionally left blank

6. EMERGENCY PROCEDURES
6.2 Ascent Aborts

6.2-6

USA007587
Rev. A

6.3

RETURN TO LAUNCH SITE

CONTENTS
Powered RTLS ......................................
Gliding RTLS ........................................

6.3-2
6.3-6

RTLS abort is designed to provide intact abort

capability for a suborbital return of the shuttle
to the KSC Shuttle Landing Facility (SLF). An
RTLS abort may be declared for an engine
failure after lift-off and prior to NEGATIVE
RETURN.
In order to reach the SLF, the shuttle must
reverse course and fly back the way it came.
The turn to reverse course is called powered
pitch around (PPA). Timing of this maneuver is
critical. Engines must be shut down when the
shuttle has exactly enough speed and altitude to
glide to the SLF runway.
Also, for safe
separation, the ET must have no more than 2%
propellant remaining. Excessive propellant will
slosh and could cause the ET and shuttle to
collide.
500

Selection of an RTLS abort is driven by several

factors. Heat loading on the ET restricts RTLS
selection to no earlier than 2 minutes 30 seconds
(2+30) after lift-off. For RTLS systems aborts,
selection occurs at 3 minutes 40 seconds. Abort
overlap allows either an RTLS or a TAL to be
selected. When RTLS/TAL overlap exists, TAL
may be the preferred mode, since a second
engine failure can be accepted much earlier and
still make the runway. Also, the powered flight
phase of RTLS is several minutes longer, causing
more exposure to some types of MPS/SSME
failures. An RTLS however, gets the orbiter back
on the ground sooner and is not as thermally
stressful as a TAL.
Once the decision is made to initiate an RTLS
abort, MCC will direct the crew to Abort
RTLS. The FD will also turn on the ABORT
light on panel F6, using a switch on their
console, as a backup to the voice call. Onboard,
moving the ABORT MODE rotary switch to
RTLS and depressing the Abort pushbutton
reconfigures GNC software to RTLS. As a
backup, the crew can enter OPS 601 PRO on any
PASS keyboard.

Powered RTLS
Fuel dissipation
35 to 60 pitch

Pitch around
V = 5 to 7.2

Altitu d e (k ft)

400

Flyb a ck
45 to 6 5
pitch
No m inal lau n ch
traje cto ry

300

200

MECO

Abort initiation
RTLS
glide

Pitchdown
V = 5.2 to 5.45

ET SEP

SRB staging

100

Start "g" control

V = 5.8
TAEM
V = 3.2

Nominal entry
trajectory

ET trajectory

0
Landing

50

100

150

20 0

250

30 0

35 0

40 0

Lift-Off

Ra n g e to L a n d in g S ite (N M )
V = VREL (K FPS)

844 .cv5

Typical RTLS Profile

6.3-1

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

USA007587
Rev. A

RTLS Pre-MECO Procedures

Powered RTLS
Powered RTLS (PRTLS) begins when the abort
is initiated and terminates at MECO. PRTLS
guidance is designed to deliver the shuttle
to a MECO location at the proper altitude
(I-load), flight path angle, and speed (function
of range).
Guidance during PRTLS is closed loop.
Computed MECO conditions are compared to
desired MECO targets to determine a miss
vector. This vector is then used to compute
corrections in steering and throttle commands.
The crew monitors guidance using cue cards
and DPS displays.
Should guidance not converge, the crew will see
GUID INHB on the RTLS TRAJ display.
MCC, in conjunction with the crew, will request
CSS takeover if guidance does not converge
within a reasonable time.
The primary display for PRTLS is RTLS TRAJ.
Some of the information on this display comes
directly from NAV and is independent of
guidance.

PASS RTLS TRAJ Display

The central portion of the display is a plot of
altitude versus horizontal component of VREL,
with the zero-velocity point at the end of the
top trajectory line to the left of the screen
midpoint. Shuttle position is plotted with a
triangle. Predictors are generated to show 30and 60-second positions. Trajectory lines are
approximations of a generic set of high and low
dispersed trajectories for an engine out at lift-off
and just before negative return.
On the left side of the BFS ASC TRAJ, there is a
scale for delta H dot and angle of attack ().
The delta H dot scale is not used operationally
and is not trained. The scale is intended to

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

6.3-2

USA007587
Rev. A
provide a fly to indication for controlling
altitude rate during the RTLS profile. However,
this scale is referenced to a canned RTLS profile
and, therefore, is not useful in most cases. The
alpha scale is just a graphical representation of
the NAV-derived angle of attack. This scale
also is not used operationally and, therefore, is
not trained. The middle of the scale has a mark
at -4, which was intended to provide a
reference during ET SEP while trying to
maintain an AOA of -4 for separation.
However, the desired angle of attack for ET SEP
is now -2, so the scale does not provide a good
visual cue for the separation.
Two guidelines at the left end of the lower
TRAJ line depict the q-bar limit for ET SEP. The
shuttle symbol should be between these two
lines, while approaching MECO. The lower line
represents q-bar at 1 psf and the upper line
represents q-bar at 2 psf.
A delta range scale at the top of the display
represents current glide range. Near MECO,
the cutoff bug moves from right to left, passing
the pitchdown points for 3-engine (PD3) and
2-engine (PD) PRTLS. The cutoff (CO) point
indicates where MECO should occur to obtain
proper glide range to the runway.
Digital readouts present useful data for
monitoring performance. Additional readouts
on the BFS RTLS TRAJ present computed
values of sideslip (beta), angle of attack (alpha),
total vehicle acceleration, attitude errors, and
computed throttle command.

To function properly, guidance needs to know

the shuttles speed and time when an engine
fails. Normally, the GPCs will capture this
data, but the crew should also note the time.
This becomes important later to determine key
trajectory parameters.
NOTE
If CSS flight control is selected, manual
throttle control must also be selected.
This will require manual throttle down
and shutdown.
Fuel Dissipation
After abort selection, the first phase is fuel
dissipation. During fuel dissipation, the shuttle
continues heading downrange at a fixed inertial
thrust direction. Cyclical computations are performed to determine the proper time to initiate
turnaround. Should the abort be declared near
the NEGATIVE RETURN boundary, pitcharound may occur immediately with no fuel
dissipation.
For the crew to fly fuel dissipation phase
in CSS, they must know the proper pitch angle
(theta) and when to pitch around. Using the
engine fail time, the RTLS cue card
UNCONVERGED GUIDANCE TABLE is
entered and the appropriate theta and
pitcharound
propellant
remaining
are
determined.
Theta is chosen to minimize
altitude loss while heading away from the
runway. Once set, it remains constant through
the fuel dissipation phase.
Powered Pitch Around
This turn changes shuttle attitude from headsdown going away from the launch site to headsup pointing toward the launch site by an
approximately 60 to 70 pitchdown maneuver.
Until zero relative velocity is reached, the
shuttle is still moving away from the launch
site. Powered pitch around is performed at 10
per second pitch rate in AUTO. This is a
dramatic maneuver and is designed to prevent
lofting while passing through vertical
orientation.

BFS RTLS TRAJ 2 Display

6.3-3

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

USA007587
Rev. A
Timing of powered pitch around is critical and
must occur within a certain interval to ensure
the shuttle arrives at MECO with the proper
amount of fuel remaining and the proper
energy. The crew monitors guidance using the
GUID % to go on the RTLS TRAJ 2 display. The
percentage displayed is the percent deviation of
the predicted final mass from the RTLS mass
target. When the percentage equals zero, PPA
should occur.

R T LS D U M P
Abort Select
Pre
MECO

1 2 4

0 9 9

2 0 8 sec

:00

q > 20
and MM 602

MM 602 + :20
Post
MECO
:00

2 OMS

:03

FRCS
Null Dump

RCS 4 + X

0 8 8 sec:00

0 1 0 sec
848.cvs

RTLS/TAL Dumps
When the dump is complete, OMS/RCS valves
are automatically reconfigured by the GPCs in
preparation for MECO. If required procedurally,
the crew can secure one or both OMS engines by
placing the ARM/PRESS switch in OFF.

NOTE
It is much better to pitch around slightly
early than slightly late as late pitcharounds may result in not reaching a
nominal RTLS MECO state.
OMS Dump
OMS propellant onboard at launch is mission
specific. Because the propellant is stored in
tanks located near the back end of the shuttle, it
causes the c.g. to be considerably aft of the point
at which the shuttle is designed to fly. For
aborts such as RTLS, this excess propellant is
dumped.

Dump time-to-go (TTG) counts down to zero

during RTLS dumps. During the dump, the
interconnect can be inhibited or enabled by
toggling ITEM 5.

The dump is actually a burn, using the OMS

engines and possibly the aft RCS jets. For interconnected dumps, valves are reconfigured by
the GPCs to allow OMS propellant to be burned
through the RCS jets. When RTLS is selected,
the OMS engines begin burning immediately.
Smart Interconnect takes approximately 3
seconds to reconfigure and check the valves.
Some missions have interconnected-inhibited
dumps where the dump is through the OMS
engines only.
Normally, RTLS dumps are a combination of 2
OMS engines and 24 aft RCS jets. The jets used
are 4 +X jets and 20 null jets. The +X jets fire
directly aft and produce no significant
rotational movement. Null jets fire in opposite
directions so that they cancel each other out.
Dump times are mission specific and are
depicted on the RTLS/TAL DUMPS cue card.

6.3 Return to Launch Site

24/10 RCS (from OMS)

(If INCNCT 'ENA')

2 + 10 jets 2 + 24 jets

Should guidance be unconverged, the crew

should select CSS and manual throttle control
and pitch around manually at the appropriate
propellant remaining cue.

6. EMERGENCY PROCEDURES

2 OMS

OVERRIDE Display
Onboard failures, such as electrical or DPS
problems, can cause serious OMS/RCS valve
reconfiguration problems. Smart Interconnect Software should reconfigure the valves or
inhibit some or all of the jets to prevent any
serious problems.
Shuttle abort dumps are complex procedures and
must be executed correctly in a time-critical

6.3-4

USA007587
Rev. A
situation. Consult the Ascent/Aborts Flight
Procedures
Handbook
for
additional
information.
Flyback
This phase is part of PRTLS where the shuttle
points back toward the runway. Guidance
computes steering and throttle commands that
direct the shuttle along the proper trajectory.
Should CSS control be required, the crew
should stop the PPA maneuver at the initial
flyback theta, as determined from the RTLS PLT
UNCONVERGED GUIDANCE TABLE. The
shuttle pitch attitude must then be adjusted to
fly back along or parallel to the guidelines on
the RTLS TRAJ display.
WARNING
Do not allow the predictors to fall below
the lower guideline during flyback.
Recovery from this low altitude condition
may be impossible.

MECO and ET SEP

Because the MECO time has been fixed by the
GPCs, an attitude of alpha = -2 must be held
until the delta-R bug reaches the CO mark, and
the engines are shut down either by the GPCs
or manually. After shutdown, a mated coast
phase occurs for approximately 13 seconds.
During this phase, valves are closed, umbilicals
retracted, and electrical connections deadfaced.
The RCS jets control attitude.
The shuttle is then ready for ET SEP, which will
occur automatically, provided certain constraints are within limits.
DESIGN
TARGET

DESIGN
TOLERANCES

VEHICLE
LIMITS

Roll rate, P

1.25/sec

20 > P > -20

Pitch rate, Q

-.25/sec

0.5/sec

+.25 > Q > -20

Yaw rate, R

0/sec

0.5/sec

+20 > R > -20

Angle of attack,

-2

.05

-1.5 > > -89

Side slip angle,

+20 > > -20

Roll angle

None

RTLS ET Auto Separation Limits

In the area of high q-bar, the guidelines are very

important to avoid structural overload or ET
SEP problems. As the predictors reach the left
edge of the display, control theta to fly between
the guidelines until the delta-R bug begins to
move.
Powered Pitchdown
To satisfy altitude and flight path angle
constraints at MECO, a positive angle of attack
of about 30 is required. However, to safely
separate the ET, an alpha of -2 is necessary.
The transition between these attitudes is called
powered pitchdown.
The maneuver must be completed rapidly (5 to
8 per second) to avoid large sink rates, which
could cause overheating or overstressing.
Engines are throttled back to reduce trajectory
impact. Should CSS be required when the bug
reaches the appropriate pitchdown mark (PD3
or PD), the shuttle should be pitched down at 5
to 8 per second to alpha = -2. At this point the
crew should null beta. Simultaneously, the
engines are manually throttled to 67 percent.
These procedures are summarized on the RTLS
CDR and PLT cue cards.

These limits prevent separation in an unsafe

attitude, which might cause shuttle/ET
collision. If the parameters are not within
limits, an ET SEP inhibit suspends the
separation sequence until the out-of-limits is
corrected or 6 seconds expire, whichever occurs
first. The timer is necessary because of rapid qbar buildup, which makes a safe separation
impossible, regardless of attitude. Separation
can be commanded manually using the ET
SEPARATION switch and ET SEP pushbutton
on panel C3.
Immediately after ET SEP, the DAP performs a
translation and pitch maneuver to fly the
shuttle away from the ET. This is accomplished
by firing all of the shuttles downfiring jets. The
combination of four forward and six aft
downfiring jets results in a simultaneous
translation and rotation, which moves the
shuttle up and away from the ET. Once the
shuttle achieves an alpha +10 and time from
ET SEP 10 seconds, the GPCs mode to MM
602 and the glide portion of RTLS (GRTLS)
begins.
In CSS and manual throttle, a manual MECO
must be performed using the MAIN ENGINE

6.3-5

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

USA007587
Rev. A
SHUT DOWN pushbuttons on panel C3. The
alpha = -2 degree attitude must be maintained
until ET SEP. This will require a small negative
pitch rate due to H-dot increase, which causes
alpha to become more positive. The -Z translation maneuver will occur automatically unless
the CDR intervenes by moving the THC out of
detent. If this is done, a manual -Z maneuver
should be performed to ensure safe separation,
and the pitch up maneuver to alpha +10
must also be manually performed. Generally, it
is preferable to allow the DAP to perform these
maneuvers automatically.

The RTLS MPS dump starts immediately upon

transition to MM 602. LO2 is dumped through
the main oxidizer valves in the main engines
and the 8-inch fill/drain line on the starboard
side of the orbiter. LH2 is dumped through the
1.5-inch backup dump line and the 8-inch
fill/drain line on the orbiter port side aft. To
ensure a rapid LH2 dump, the LH2 manifold is
pressurized with helium.
The onboard software also allows a post-MECO
dump of RCS propellant through the RCS jets
to satisfy maximum tank landing weight
constraints and c.g. control.

Gliding RTLS

Guidance

The gliding portion of RTLS is very similar to

the final portions of entry, which are discussed
in detail in Section 7. Only significant differences are presented here.

During GRTLS, guidance manages the shuttles

energy state to arrive at the runway with
sufficient energy to complete a safe landing.
GRTLS guidance is divided into five phases:

Post-MECO Dumps

After MECO and ET SEP, the remaining MPS

propellants must be dumped to assist in c.g.
control and, for the liquid hydrogen, to reduce
potential fire hazard.
The MPS dump
sequences are very similar for the nominal,
TAL, and RTLS modes. The LO2 and LH2 are
dumped simultaneously to save time.

Alpha Recovery
NZ Hold
Alpha Transition
S-Turn
GRTLS TAEM

RTLS Post-MECO Procedures

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

6.3-6

USA007587
Rev. A
These phases provide for transition from a
ballistic trajectory, through hypersonic gliding
flight, to an energy management scheme
designed to make the runway.

phase. Guidance can be manually downmoded

to the straight-in or minimum entry point
(MEP) HAC if required due to low energy.
To fly the alpha transition in CSS, the display in
the upper left corner of VERT SIT 1 is used.
The shuttle symbol initially appears in this
portion of the display, which represents an
alpha versus Mach number profile. The dashed
line is the nominal profile, and the solid line is
the q-bar limit.

Alpha Recovery
Pullout from the ET SEP attitude must be
accomplished quickly before aerodynamic
forces build up to uncontrollable levels. To
accomplish this, the shuttle maneuvers to a
high (alpha = 50) angle of attack using both
RCS jets and aerodynamic controls.

The ENTRY ALPHA cue card can also be used

for alpha transition.
Since there are no
procedures to initiate S-turns manually,
ranging is accomplished by exercising the OTT
options described in Section 7. The MCC can
also request a GCA and accomplish S-turns by
asking the crew to fly appropriate bank angles
or headings.

Increasing dynamic pressure caused by the

shuttle falling into the atmosphere causes more
lift to be generated by the wings. The resultant
lift produces a Zaxis acceleration (N ). At
about 1.65 g, the DAP starts to reduce alpha to
hold an N of 2.2 gs. The shuttle N limit for
RTLS is 2.0 2.5 g's (based on the vehicle's
weight).
Z

Roll jets are secured at q-bar = 10. Pitch jets are

secured at q-bar = 40. Yaw jets are required
until Mach = 1.0. When KEAS = 77, the speed
brake is ramped open to about 81 percent to
enhance lateral stability by allowing the
elevons to be trimmed down. Below Mach =
0.95, the speed brake position is modulated by
GRTLS TAEM guidance.
NZ Hold
Alpha is smoothly decreased to maintain the
2.2 g limit until H-dot is greater than -320
ft/sec.
Excessive g-loading could cause
structural damage and also dissipate excessive
energy. The ADI pitch error needle displays N
error during this phase.

GRTLS Vertical Situation 1 Display

Note: Shuttle symbol appears only at one

location on the display at a time

Alpha Transition

S-Turn

Upon termination of N hold, alpha is changed

to conform to a profile that is a function of
Mach number. This profile provides the best
vehicle control until active ranging begins in
GRTLS TAEM. Also, a bank maneuver is
performed, either to null any heading errors to
the heading alignment cone (HAC) tangency
point, or to dissipate excess energy by turning
(S-turn) away from the HAC. The maximum
bank angle is 45. The ADI pitch error needle
displays alpha error during alpha transition

An S-turn can be initiated in GRTLS TAEM or

while still in alpha transition. S-turns increase
the distance to be flown, thus decreasing
energy. It is possible that more than one S-turn
would be required. Starting and stopping of
S-turns can be monitored using the E/W scale
on VERT SIT 1.

6.3-7

6. EMERGENCY PROCEDURES
6.3 Return to Launch Site

USA007587
Rev. A
GRTLS TAEM
This phase is essentially identical to normal
entry TAEM, which is discussed in detail in
Section 7. The main differences are that GRTLS
TAEM starts at Mach = 3.2 and an alpha
limiting corridor exists.
The MPS/TVC ISOL valves must be closed by
the crew before the low altitude/high
maneuvering regions of GRTLS TAEM to
prevent PRL. These valves must remain open
until MPS dump completion at approximately
Mach = 4.5.
To conserve power during ascent, the MLS
LRUs are powered off. They must be turned on
and communication established (I/O RESET) at
about 85 k ft during GRTLS.
RLS MM 601

Postlanding procedures are the same as

nominal end of mission, except that the
hydraulic load test is not performed.

RTLS Ascent Specific Notes

RTLS Flight Displays

RTLS abort verified by letter R adjacent

to MM field in upper-right corner
E

R
6.3 Return to Launch Site

6.3-8

Runway bearing pointer appears at RTLS

selection indicating bearing to the selected
abort runway
Tail of Runway bearing pointer shows
when heading away from the RTLS site

SPEC 50 Runway selection, Range to

runway in nm, and Az appear at RTLS
abort select

Compass Card displays magnetic heading

on a N, E, S, W reference

X-Trk, Inc and CDI are also blanked at

RTLS abort select

Mach/Velocity tape displays VI prior to

PPA, then VR post PPA

RLS MM 601

6. EMERGENCY PROCEDURES

Earth-Relative Velocity bearing pointer

and Beta digital readout are displayed on
an RTLS ascent (Inertial Velocity is
blanked)

USA007587
Rev. A

6.4

RCS jets interconnected to the OMS propellant

tanks. The OMS/RCS interconnects are determined preflight via I-loads for each abort
scenario. They may be enabled or inhibited by
the crew if required. Some OMS propellant will
be dumped in MM 304 prior to 0.05 g. This
dump is performed primarily to increase
separation from the ET.

TRANSOCEANIC ABORT
LANDING

CONTENTS
Nominal Transoceanic Abort
Landing.......................................
Post MECO Transoceanic Abort
Landing.......................................

6.4-1
6.4-3

The purpose of a transoceanic abort landing

(TAL) is to provide an intact abort capability for
single-engine failures between 2 ENGINE TAL
and PRESS TO ATO (MECO). It also offers an
intact option for two engine failures much
earlier than SINGLE ENGINE PRESS. TAL also
supports system aborts that occur after
NEGATIVE RETURN such as cabin leaks,
cooling problems, or OMS propellant loss.
During a TAL abort, the shuttle flies an entry
trajectory across the ocean to land on a missionspecific runway. Landing occurs approximately
40 minutes after launch.
Powered flight
guidance has the capability to target 13 different
landing sites, which are selected based on
runway length, weather, and orbital inclination.
Landing sites near the nominal ascent groundtrack are more efficient since crossranging
requirements are reduced. Typically, only three
TAL sites are supported for possible use on each
mission.

Nominal Transoceanic Abort Landing

TAL is selected prior to MECO by placing the
ABORT MODE rotary switch on panel F6 in
TAL and pressing the ABORT pushbutton. Item
entries on the OVERRIDE display (SPEC 51)
may also be used to select TAL should the
ABORT MODE switch fail. The crew should
note the title of the ASCENT TRAJ display
changes to TAL TRAJ and the MM 103T (flight
instruments upper right corner) as confirmation
that the TAL flag has been set. The shuttle
indicator (triangle) and predictors should
follow the upper trajectory line on the PASS and
BFS TAL TRAJ 2 displays.
Abort Dump
When TAL is selected, an abort dump begins
immediately.
OMS propellant is usually
dumped through the OMS engines plus 24 aft

If a TAL is initiated after an I-loaded velocity

(dependent on two or three engines remaining),
there will not be enough time to complete the
OMS dump. For these cases, the remaining
engines will be throttled down automatically to
67% to gain extra dump time.
The OMS dump should be stopped if helium
pressure decreases to 2,000 psi to ensure helium
will not be ingested into the RCS lines.
Guidance
At abort selection, TAL guidance begins
steering the shuttle toward the selected landing
site plane. Variable I-Y steering is used to bring
crossrange to the TAL site within acceptable
limits (approximately 500 n. mi.) at MECO.
The crew monitors guidance during TAL aborts
using the TAL CDR and TAL PLT cue cards.
It is important to verify, using SPEC 50, that the
correct landing site is selected.
Should a second engine fail during a TAL, the
OMS dump will continue through the OMS
engines, but the dump through the RCS will be
terminated. The crew must push the two failed
engine MAIN ENGINE SHUT DOWN
pushbuttons on panel C3 to set the safing flag.
The contingency dump must also be started
using SPEC 51.
Trajectory droop, along with guidance
convergence and main engine performance, are
the deciding factors in defining the earliest
single-engine TAL capability. Drooping below
the 265 k ft limit will result in either an
explosion due to ET heating or a loss of control.
If two engines fail near the SE OPS 3 109
boundary, the crew should throttle up to 109
percent. Droop guidance will engage and pitch
up to 60 on the ADI to minimize sink rate and
enable the shuttle to remain above 265 k ft.
When thrust-to-weight is greater than 1, the
shuttle will begin to climb and accelerate
downrange.

6.4-1

6. EMERGENCY PROCEDURES
6.4 Transoceanic Abort Landing

USA007587
Rev. A

TAL versus nominal Ascent

TAL PLT Procedures

TAL CDR Procedures

6. EMERGENCY PROCEDURES
6.4 Transoceanic Abort Landing

6.4-2

USA007587
Rev. A
To lessen ET heating effects and to put the
shuttle in the correct entry attitude at ET SEP, a
roll to heads up is performed at an I-loaded
reference velocity. If the shuttle is still in the
heads down attitude when TAL is selected, roll
to heads up will occur at the TAL I-loaded
velocity. If the shuttle has already performed
the nominal roll to heads up when TAL is
selected, it will remain in the heads up attitude
for the rest of powered flight. The roll is
performed at 5 per second.
TAL MECO occurs about 2,800 n. mi. from the
landing site. For inplane sites, very little
banking for azimuth control is necessary if
started as soon as possible after the first MM
304 pullout. Waiting to null out delta azimuth
until late in the entry can severely reduce
crossrange capability.
The MCC will recommend the best approach to
the field. An overhead approach is preferred.
OPS Transition
TAL is a unique abort in that it requires
transition to GNC OPS 3 after MECO and ET
SEP, which is time-critical.
The PASS
computers obtain this software from upper
memory.

they are extremely critical until correct entry

flight control is available.
Post-MECO Dumps
An MPS dump similar to the RTLS dump
begins automatically at MM 304. The TAL LH2
MPS dump is unpressurized.
Once in MM 304, the OMS dump restarts to
ensure separation with the ET. This dump adds
about 100 fps V to the shuttles energy.
(Several missions have used 200 fps V.) For
post-MECO TALs, the dump also ensures
orbiter landing weight, c.g., and tank landing
weight constraints are met.
The FRCS null jet dump typically starts at MM
304 to help control X c.g. location.
An aft RCS dump is commenced at VREL = 9 k
fps. This dump reduces aft propellant to meet
weight and c.g. constraints. The dump time is
an I-load, which is usually 88 seconds. Should
the aft RCS quantity be low, the dump can be
inhibited using SPEC 51. For missions with
forward X c.g. concerns, this dump will not be
performed.
Entry
MM 304 is very similar to a normal end-ofmission entry (discussed in detail in Section 7)
with the exception of the 43 initial angle of
attack flown during the TAL pullout phase
which protects for high wing leading edge
temperatures.

WARNING
To prevent loss of control, engage BFS and
type in OPS 301 PRO if the PASS does not
mode into OPS 3 within 68 seconds.

The 68 seconds mentioned above are a holdover

from when the OPS 3 software had to be loaded
from the mass memory units. The maximum
time it would take to try and load the software
after attempting both SSMMs is 6-8 seconds.
About 3 minutes are available to complete the
OPS transition between ET SEP and the start of
dynamic pressure buildup depending on the
altitude, flight path angle, and velocity at
MECO. This period is critical. The shuttle is
entering the atmosphere, and the TRANS DAP
is not designed for atmospheric flight. All
procedures must be completed quickly and
accurately. Ignore all systems problems unless

Post MECO Transoceanic Abort Landing

An intact abort capability is available between
VI ~21.5 to 23 k fps (mission specific) and AOA
capability by using the TAL entry software.
The abort is declared after MECO. For late
systems problems after last pre-MECO TAL, the
crew performs a manual MECO at the specified
velocity using the MAIN ENGINE SHUT
DOWN pushbuttons.

6.4-3

6. EMERGENCY PROCEDURES
6.4 Transoceanic Abort Landing

USA007587
Rev. A
procedure uses high angles of attack, prebank,
and OMS dumps to dissipate excess energy and
to allow the orbiter to land at a TAL site from
these MECO velocities. For inclinations >57
the only option in this situation is to abort to an
ELS or to bail out.

NOTE
For high inclination missions, a crewinitiated (MAN MECO) post-MECO TAL
is not an option. This is because, for high
inclination missions, the post-MECO TAL
landing sites are emergency landing sites
(ELSs), and the program has decided to
try for an AOA rather than land at an
ELS.

Post MECO Dump

MECO velocity takes into account the V due to

SSME tailoff. This number is flight specific and
depends upon inclination.
The boundaries chart shows approximate TAL
site coverage for a range of early MECO
conditions. Using the real time downrange
abort evaluator (DAE), the MCC will determine
the appropriate site and communicate data to
the crew. Cue card boundaries are used for loss
of communications.
High Energy TAL
MECO velocities between approximately 24.5 k
and 25.2 k fps may be too low for AOA
capability (especially if the OMS propellant has
been dumped) and too high for auto guidance
to make a TAL site. For inclinations <57, a
high-energy TAL procedure is available. This

6. EMERGENCY PROCEDURES
6.4 Transoceanic Abort Landing

The high-energy TAL post-MECO OMS dump

is similar to the TAL OMS dump.
Interconnected
dumps
are
performed
automatically only in indicated regions.
Guidance
Upon entry into MM 304, guidance will roll the
shuttle to heads up, if not there already.
The crew should verify that the proper runway
is selected. For low energy cases, low energy
logic is required until the shuttle is within the
trajectory lines on the ENTRY TRAJ display.
After runway selection is verified, and guidance
is converged, AUTO flight control may be
reselected. The remaining high-energy TAL
procedures are identical to the nominal TAL.

6.4-4

USA007587
Rev. A

6.5

After OMS-1, the desired OMS-2 targets are

selected on the MNVR EXEC display. Then the
software is moded to OPS 3 and the appropriate
OMS-2 (deorbit) targets are loaded and burned.
After the deorbit burn, an entry is flown that is
very similar to the nominal end of mission.

ABORT ONCE AROUND

CONTENTS
OMS-1 ....................................................
OMS-2 ....................................................
Entry ......................................................

6.5-1
6.5-3
6.5-4

OMS-1

The abort once around (AOA) abort mode is

used in cases where shuttle performance has
been lost to such an extent that it is impossible
to achieve a viable orbit, or not enough OMS
propellant is available to accomplish the OMS1, OMS-2, and deorbit burns. AOA may also be
used when a major systems failure makes it
necessary to land quickly.
In an AOA for a standard insertion, or a low
performance direct insertion, one OMS burn is
made to adjust the post MECO orbit such that a
second burn will result in the orbiter deorbiting
and landing at an AOA landing site. In an AOA
for a systems failure during a nominal
performance direct insertion, only the deorbit
burn is required. Landing occurs about 1 hour
and 45 minutes after lift-off.
There are two AOA trajectories with several
different options for each one, depending upon
the reason for performing an AOA: steep AOA
and shallow AOA.
Entry trajectory for the steep AOA is very
similar to a nominal entry and is the preferred
trajectory due to thermal considerations.
However, steep targets require more V and
therefore more propellant.
Shallow AOA
results in a flatter trajectory, which places the
shuttle closer to the skipout boundary and
thermal limits. This is less desirable, but
requires less OMS propellant, which is
important for severe underspeed cases or if both
OMS helium tanks have failed with propellant
quantities above max blowdown.

AOA can only be selected post MECO by crew

selection of an AOA target set on the OMS
MNVR display.
The OMS-1/2 targeting chart provides the crew
with information describing the appropriate
OMS-1/2 target sets as a function of MECO
underspeed. This cue card assumes no system
failures but does account for any ATO dump
performed pre-MECO. The crew obtains the
correct target set by calculating orbital energy
(HA + HP) and noting the amount of OMS
propellant remaining. Current HA + HP is
obtained from the OMS-1 MNVR EXEC display
after MM 104 transition.
The OMS 1/2 TGTING cue card should be used
in conjunction with the OMS-2 TARGETING
card, and worst case requirements will prevail.
For combinations of failures, MCC help will be
required. In any case, MCC is prime for all
target selections as long as COMM exists.
For all flights there is an ATO OMS-1 target set
that will allow either an ATO, AOA steep, AOA
shallow, or minimum perigee (MIN Hp) OMS2. This target set is referred to as the common
targets. The common targets can be burned,
and the decision to abort AOA may be delayed
until after OMS-1 for most cases. If AOA is
selected after OMS-1, the crew depresses the
hydraulic systems instead of shutting down the
APUs. This step avoids an APU shutdown and
restart. Running the APUs in LOW PRESS
instead of NORM PRESS will conserve APU
fuel for entry.

Execution of an AOA is determined by an MCC

call and by checking the OMS-1 target solution
against the OMS 1/2 TGTING cue card. If
required, OMS-1 targets are loaded and burned.

6.5-1

6. EMERGENCY PROCEDURES
6.5 Abort Once Around

USA007587
Rev. A

OMS 1/2 TGTING Cue Card

6. EMERGENCY PROCEDURES
6.5 Abort Once Around

6.5-2

USA007587
Rev. A

OMS 2 Targeting

OMS Required

OMS-2 Targeting and OMS Required

required) establishes a temporary
trajectory, OMS-2 is a deorbit burn.

OMS-2
After OMS-1 is burned, the OMS-2 TARGETING cue card is checked to determine the
appropriate OMS-2 targets. Additionally, the
OMS REQUIRED card is used to determine the
appropriate abort mode in the event of an OMS
propellant shortage or to confirm that sufficient
OMS propellant is available for completion of
the planned abort mode.
OMS targeting options are complex and vary
greatly from flight to flight. For a complete
explanation of targets, refer to the Ascent/
Aborts Flight Procedures Handbook.
For all AOA aborts, deorbit targets are called up
in OPS 1 and carried across the transition to
OPS 3. Targets are not loaded until after the
OPS 3 transition because of different guidance
targeting logic. Where the OMS-1 maneuver (if

orbital

AOA software computes the amount of excess

OMS that may be burned out of plane during
the deorbit maneuver. The crew can change
this amount through keyboard entries on the
OMS MNVR EXEC display.
Once the appropriate AOA OMS-2 targets are
loaded, burn TIG may need to be adjusted to
correct range from entry interface (REI). The
FDF checklist provides the procedure for TIG
adjust. The MCC may recommend a TIG that
has already been adjusted.
If the key-in AOA targets are used, an AOA
target set should still be called up in OPS 1
using Item 35 on the OMS MNVR display to
establish the AOA Kalman filter covariance

6.5-3

6. EMERGENCY PROCEDURES
6.5 Abort Once Around

USA007587
Rev. A
matrix. The key-in AOA targets can then be
entered and ultimately loaded in OPS 3.

Entry
After the OMS-2 burn, the orbiter is
maneuvered to an EI-5 attitude, which is similar
to the nominal entry attitude. If AOA shallow
targets were burned, a prebank will be required
to ensure atmospheric capture.

The software transition from OPS 1 to OPS 3

will automatically load landing site data for an
AOA. Included are data for the runways
shown on the HORIZ SIT SPEC 50, an
associated set of TACAN stations, and MLS data
for the primary and secondary runways.
Potential AOA landing sites are Edwards Air
Force Base, California; Kennedy Space Center,
Florida; and Northrup Strip, New Mexico. The
crew should verify that the appropriate site and
runway are selected.
The entry and landing phase of an AOA is
similar to the normal entry and landing
discussed in Section 7.

6. EMERGENCY PROCEDURES
6.5 Abort Once Around

6.5-4

USA007587
Rev. A

6.6

As with nominal trajectories, the crew monitors

ascent performance and keeps abreast of abort
mode capability using the NO COMM MODE
BOUNDARIES cue card, along with calls from
the MCC.

ABORT TO ORBIT

CONTENTS
Powered Flight .....................................
OMS-1 ....................................................
OMS-2 ....................................................

6.6-1
6.6-1
6.6-1

ATO aborts are designed to achieve a safe orbit

that is lower than the nominal orbit. This
requires less OMS propellant and allows time
for problem evaluation to determine whether an
early return is required or additional burns can
be performed to raise the orbit and continue the
mission. ATO may be selected for either a
performance shortfall or certain systems
failures.

Powered Flight
ATO is selected pre-MECO by using the
ABORT MODE rotary switch or by item entry
on SPEC 51. Primarily, pre-MECO ATO selection provides an OMS dump, switches to abort
MECO targets (often the same as nominal), and
may enable variable I-Y steering to freeze the
inclination. The OMS dump adds performance
by reducing weight and adding thrust.
Freezing the inclination increases performance
because in-plane is always the most fuel
efficient route to orbit.
Three I-Loaded variables will determine dump
size and inclination.
V_LIN - An ATO selected post V_LIN will
result in less than a full dump. The amount
dumped will, from there, ramp down to zero as
a function of velocity.
V_ZERO - An ATO selected post V_ZERO will
result in zero OMS propellant dumped.
V_MSSN_CNTN - An ATO selected post
V_MSSN_CNTN will result in the nominal
mission specific inclination.
That is, the
inclination will not be frozen as it has been
determined that a safe orbit can be archived
without an inclination adjustment.

ATO procedures during powered flight, with

the exception of the pre-MECO OMS dump, are
via the nominal ascent procedures in the ascent
checklist, which is discussed in Section 7.

OMS-1
If possible, ATO abort is declared after MECO
to ensure that other downmode options are
available as long as possible. ATO OMS-1
targets are automatically called up if an ATO is
declared either pre-MECO or pre-OMS 1. This
may be a common target set from which either
an AOA deorbit burn or an ATO circularization
burn can be performed at OMS-2. The final
decision can thus be delayed until after OMS-1
is completed.
OMS-1 targeting is performed using the same
procedures and cue cards as AOA. These are
discussed in Section 6.5. To provide a fuelefficient ATO or AOA burn, OMS-1 is initiated
at time to apogee (TTA) equals 2 minutes, but
no earlier than MECO + 2 minutes.

OMS-2
The ATO OMS-2 burn is performed using
nominal Ascent Checklist and cue card procedures. Proper targets are selected and loaded,
the shuttle is maneuvered to burn attitude, and
the burn is executed.
After completion of both ATO OMS burns, the
orbiter should be in approximately a 105 n. mi.
circular orbit. Once this safe orbit is attained,
mission operations may be continued for at
least 1 day. Additional burns may be used to
raise the orbit or the mission may be ended
early.
OMS-2 targeting for ATO is very similar to
AOA, which is discussed in Section 6.5.

6.6-1

6. EMERGENCY PROCEDURES
6.6 Abort to Orbit

USA007587
Rev. A
DAP: Auto
Throt: Auto
M/VI

03

33

ATO abort verified by letters ATO

adjacent to MM field in upper-right corner
of PFD and in the TRAJ 2 title.

Tgt Inc displayed to give indication of

variable IY steering for an ATO abort. ATO
abort with an SSME failed prior to
V_mission_continue I-load will freeze
steering to the current inclination.

30 5

06

33

12.6
12.56 -18.4

362 K

-64

350K

12

24 5
15

12.2
1

ATO Specific Notes

Y 000

12.8

12.4

MM: 103ATO
ATT: LVLH
H
H
20

R 180
5 P 017

21

KEAS
I

1.2 g

10

12

FLIGHT INSTRUMENT MENU

A/E
ORBIT
DATA
MEDS
MEDS FC2
PFD
PFD
BUS
MSG RST MSG ACK AUT
21

18

15

UP

Course-arrow (magenta) points to the

current target inclination, where 0 is
defined as the initial target inclination.

Tgt Inc 50.0

10

24

P2*
S1

-0.02

27

-1
0

Inc

0.1

30

X-Trk
33

Accel

PASS ATO TRAJ 2 Display

6. EMERGENCY PROCEDURES
6.6 Abort to Orbit

Inc and X-Trk digital readouts and CDI all

display essentially zero if ATO abort &
variable IY steering freeze to the current
inclination.

BFS ATO TRAJ 2 Display

6.6-2

USA007587
Rev. A

6.7

The PASS is moded to OPS 6 (RTLS) during

most contingency abort procedures. OPS 6
provides the entry guidance and flight control
needed for contingency aborts. The BFS does
not support contingency aborts because of
several restrictions, including no single-engine
roll control, no two- or three-engine-out
automated software, and no CSS until post-ET
separation.

CONTINGENCY ABORT

CONTENTS
Powered Flight ..................................... ..... 6.7-1
Three-Engine-Out Automation .......... ..... 6.7-2
ET Separation........................................ ..... 6.7-2
Entry ...................................................... ..... 6.7-3
During ascent, a contingency abort is performed
when the orbiters thrust-to-weight ratio is less
than that needed to achieve a safe orbit or an
intact abort, due to multiple engine failures.
The purpose of a contingency abort is to guide
the orbiter to a safe gliding flight condition,
where bailout or a landing can be performed.
Currently, two engine-out contingency aborts
are automated for both powered flight and the
entry pullout. Beginning with OI-25 threeengine-out contingency aborts were automated.
The OI-25 software has the capability to be "noopted"; reverting it back to manual contingency
abort procedures for ET separation and
maneuver to entry angle of attack until MM
602. However, this software is not expected to
be no-opted. Contingency abort procedures are
very dynamic flight modes that take the orbiter
to the limits of its structural and flight control
envelope. For certain cases, especially high
altitude and low velocity, the resultant entry
may not be survivable.
Contingency abort procedures are outlined on
the Contingency Abort cue cards.
These
procedures are designed to protect the orbiter
from exceeding certain limits:
Q-bar - 800 psf
NZ - 3.9 g
Elevon/body flap hinge moments
The procedures are separated into CONTINGENCY ABORT and RTLS CONTINGENCY
cue cards. They are further subdivided into
event timelines and color-coded for easier use.
For detailed procedures, the Ascent/Aborts
Flight Procedures Handbook or the Contingency Aborts 2102 Manual should be used.
This section describes the basic information
applicable to all contingency aborts, and is
divided into three major phases: Powered
Flight, ET Separation, and Entry.

Powered Flight
Should two SSMEs fail, the remaining thrust is
used to reduce entry sink rate. Different procedures are used, depending on when the engine
failure occurs. For early failures, when the
orbiter has a large positive H-dot, the thrust
vector is pointed toward the horizon to prevent
further lofting.
This increases downrange
velocity and helps reduce severity of the entry
pullout.
At an inertial velocity between
approximately 7,000 fps and 12,000 fps, a
vertical thrust vector is used to counter gravity
losses, which shallows the flight path angle and
improves entry conditions. At inertial velocities
greater than about 12,000 fps, the orbiter may
have enough energy to continue to a downrange site.
If two engines fail prior to the SE OPS 3
boundary while the orbiter is within a predetermined velocity envelope, yaw steering of
45 can be performed for an east coast abort
landing (ECAL) or Bermuda (BDA) landing.
High
inclination
missions
use
ECAL
procedures, while low and mid-inclination missions use BDA procedures. ECAL and BDA
landing sites are available during certain portions of ascent, should a contingency abort be
required. ECAL landing sites are strategically
located along the east coast of the United States.
These sites are available on missions with
inclinations greater than 50. On missions with
inclinations less than 40 Bermuda is available.
For due east missions, there is no capability to
land at Bermuda unless the vehicle is already
on a TAL abort that crosses the BDA window
(which is out of plane and north). The yaw
steering that occurs on these TALs provides the
plane change required to reduce the entry cross
range to Bermuda. The velocity for a BDA
landing is mission dependent but generally
ranges from 9 k fps to 12 k fps for BDA and 6 k
fps to 12 k fps for ECAL. The powered flight

6.7-1

6. EMERGENCY PROCEDURES
6.7 Contingency Abort

USA007587
Rev. A
yaw steering for these aborts is open loop.
There is no range-velocity (R-V) target line
being attempted, just a reduction in cross range
to the site. Yaw steering generally increases
entry pullout loads by approximately 0.1 g.

attack to ensure successful separation. This is

the same technique used for RTLS ET SEP. At
less than 2 psf, larger angles of attack are
acceptable, but the -Z translation is optimized to
help prevent recontact.

Powered flight is also used to dump OMS

propellant. This reduces weight and moves the
c.g. forward. Reducing weight decreases the
peak q-bar during pullout, while more forward
c.g.s reduce elevon and body flap deflection
required for pullout.
This helps prevent
aerosurface saturation and possible actuator
stall.

100

The heads-up roll orients the bottom of the

orbiter/ET into the velocity vector, which is
generally the attitude desired for ET SEP and
entry.

Three-Engine-Out Automation
Three-engine-out guidance initiates automatically when MECO confirmed is set and color is
displayed on the PFS Ascent/RTLS Traj; no
item entries are required. If no color is displayed, contingency guidance has determined
that either an OPS 3 entry or RTLS runway can
be reached without contingency maneuvering.
The primary goal is to maneuver to a safe ET
separation position, separate from the tank, and
subsequently maneuver to entry attitude via the
shortest path. The following events occur
automatically:
RTLS abort declaration (if not previously selected)
Maneuver to ET separation attitude (if
required)
ET separation
Post-separation -Z translation
Interconnected OMS dump (if required)
Inhibit FRCS dump (if required)
MM 602 transition

ET Separation
Safe ET SEP is a function of alpha and q-bar. As
the shuttle descends, q-bar increases and ET
SEP must be performed prior to 10 psf.
At pressures above 10 psf, the ET may recontact
the orbiter. Between 2 and 10 psf, the shuttle
must be at a small negative (about -2) angle of
6. EMERGENCY PROCEDURES
6.7 Contingency Abort

ET RECONTACT

SUCCSSFUL
ET SEP

20

859

High sink rates during many contingency abort

scenarios result in rapid entry into the atmosphere and, therefore, a rapid q-bar buildup. In
most of these cases, there is not enough time for
an RTLS-type PPD and a normal mated coast
separation sequence. A fast SEP is performed
instead, which takes about 5 seconds. This fast
SEP can be performed in one of seven ways,
depending on the vehicle attitude and q-bar at
the time SEP is required. The first is the immediate, manually initiated fast SEP where no time
is available to maneuver to a better attitude.
The second is an alpha -2 fast SEP where there
is time to achieve the attitude before q-bar
exceeds 10 psf. The third is rate fast SEP where
the separation is commanded while at a high
angle of attack and a -4 per second pitch rate.
This technique allows separation to be delayed
as long as possible and extends the time
available for powered flight. It is initiated
when EAS is greater than 10 and increasing (qbar of about 0.7 psf). The ET SEP occurs prior
to the 2 psf limit for high alpha separations.
Because the shuttle is near the alpha required
for entry, the -4 per second pitch rate needs
only to be slowed as the proper alpha is
reached. Maneuvering the shuttle to a negative
alpha for separation would require a second
pitch maneuver to recover back to the entry
alpha.
The pitch rate used for fast SEP is a compromise
between a rapid pitchdown and the need to

6.7-2

USA007587
Rev. A
maintain control and slow/reverse the rate after
SEP.

AMI pegs at 60, a maximum alpha of 58 is

used.

The fourth type of fast SEP is (SRB) PC < 50,

that is used only in first stage when the entire
stack (SRB and ET) is separated as a whole at
SRB thrust tail-off. The fifth is an attitudeindependent SEP where q-bar is low enough to
allow the separation to occur in any attitude
with zero rates. The sixth is the alpha 125
separation, used when high q-bar prevents a
pitchdown maneuver to alpha -2. In this case,
the vehicle is pitched up to an alpha of 125 for
ET separation, then pitched back down to entry
alpha. Last is the emergency separation, which is
commanded at KEAS >77 any time the maneuver
to ET separation attitude fails. This separation is
commanded immediately when EAS exceeds 77
knots, regardless of attitude and rates.

The body flap and speed brake are set during

the alpha recovery phase before the critical
pullout begins. The speed brake and body flap
affect hinge moment loads on the elevons. A
body flap versus mach schedule is developed
for each mission as a function of vehicle weight,
c.g. and OMS load. The speed brake is left in
auto unless the N hold is entered below mach
three. If below mach three, the crew opens the
speed brake to 65%.

The GPCs will automatically mode to MM 602

after structural separation, when close to entry
attitude or >77 KEAS. After MM 602 transition,
V is displayed as Mach number on the AMI.
REL

Entry

NZ Hold/Pullout
Orbiter H-dot will continue to decrease (more
negative trend) throughout alpha recovery until
sufficient q-bar and the resultant lift are
developed for equilibrium flight.
As lift
increases, N will also increase. When N = 1.0,
the orbiter is developing enough lift to support
its own weight, and H-dot will begin to increase
(more positive trend). The maximum negative
H-dot is a good indicator of the severity of the
entry. It is also used to calculate N required for
pullout, using the equation:
Z

The powered flight, mated coast, and ET SEP

portions of contingency aborts are designed to
deliver the orbiter to acceptable entry conditions
without loss of control. Entry phases include:

N target = -H-dot/1000 + 0.65 at N = 1.0.

Z

This N target is calculated by the GPCs and

displayed on VERT SIT. The N hold/pullout is
flown in AUTO, which significantly increases
chances of survival. N target is a compromise
between structural limits and q-bar limits. The
structural load factor limit is actually a function
of orbiter weight and wing root bending
moment, but the software currently will not
target more than 3.9 g. Simulator tests show
that q-bar over 800 psf often leads to loss of
control. However, this limit is scenario- and
mission-dependent.
Z

Alpha recovery
N hold/pullout
Alpha-Mach
ECAL/BDA landing or bailout

In general, reducing ET SEP altitude and H-dot

will improve entry conditions. Any errors
occurring in powered flight or ET SEP will
result in a more stressful entry.
Alpha Recovery
Upon ET SEP completion, the orbiter is
maneuvered to an alpha that maximizes lift and
drag in a manner similar to GRTLS. The appropriate alpha is a function of Mach number and
trim but lies in the range of 20 to 58.
In some cases, alpha recovery is accomplished by
stopping the -4 per second pitch rate at the
appropriate alpha. Because the alpha tape on the

Load factor continues to increase until within

approximately 0.4 g of N target. A pitchdown
is then initiated to hold N target. The AMI
acceleration tape is scaled in gs in MM 602,
with 10 = 1 g, 20 = 2 g, and 30 = 3 g. As alpha is
reduced while holding a constant g, q-bar will
continue to increase until after the sink rate is
stopped. When H-dot is positive, pullout is
complete, and g load is reduced. The crew can
then mode the body flap to AUTO and monitor
the alpha/Mach schedule.

6.7-3

6. EMERGENCY PROCEDURES
6.7 Contingency Abort

USA007587
Rev. A
The N hold/pullout is the most critical phase of
contingency aborts. Even if flown perfectly,
some
profiles
will
exceed
structural,
temperature, or flight control limits. Target N
must be accurately flown.

Automated ECAL

Most regions of the contingency abort profile

have adequate flight control margins.
However, there are some regions where even
flying the maximum structural load factor limit
during N hold will not prevent q-bar from
exceeding 800 psf, possibly stalling the elevons,
and losing control.
Z

Flight control gains were designed for a

maximum q-bar of 375 psf. Loss of control
results from a number of factors. In some cases,
aerodynamic moments are so large that the
orbiter rates cannot be controlled, even at
maximum aerosurface deflection and with
maximum jet firings. Additionally, in some
cases the aerosurface loads are so large that the
actuators cannot drive the surfaces. This is
called actuator stall. Sometimes these control
problems can be avoided by flying a higher glevel during pullout, but the best technique is to
follow the contingency abort procedures
explicitly and engage the AUTO system where it
has the capability to execute critical maneuvers.
Alpha-Mach
The crew monitors the alpha-mach phase by
making sure the vehicle is at the proper alpha
for the Mach number. This information is in a
table on the Contingency Abort Entry cue card.

6. EMERGENCY PROCEDURES
6.7 Contingency Abort

Starting with OI-28, Item 1 (centered at the

bottom of the MM 602 TRAJ) will
enable/disable the automated ECAL logic. This
item entry is initialized enabled (ENA) when
the contingency abort flag is ON, and will
require no action.
Entry ECAL energy and gs will be managed
with AUTO FCS in OPS 602 and 603 with pitch
and bank. For automated ECAL, the alpha
range is 20 to 58, while the bank range is 0 to
70.
Bailout
An attitude hold mode in MM 603 allows the
crew to stabilize the orbiter in gliding flight
using the AUTO DAP functions. It is armed
when Mach is less than 1.0, the ABORT MODE
rotary switch is placed to ATO, and the ABORT
pushbutton is pressed.
Guidance snapshots current airspeed and roll
angle and attempts to hold both constant. The
crew should stabilize the orbiter at 185 to 195
KEAS and zero roll angle, then abort MODE
switch to ATO, press ABORT PBI, and select
PITCH and ROLL/YAW AUTO.
If a new
airspeed or roll attitude is desired, select CSS,
fly to the appropriate parameters, and reselect
AUTO.
Once attitude hold is established, a middeck MS
depressurizes the crew module using the
emergency vent handle. When cabin pressure
is equalized, the hatch is jettisoned, the escape
pole is extended, and bailout is commenced.

6.7-4

USA007587
Rev. A

6.8

Because each mission is unique, one or more

Payload Systems procedures will be flown to
allow the crew to troubleshoot various payload
malfunctions.

SYSTEMS FAILURES

CONTENTS
APU/Hydraulics..................................
Communications ..................................
Cryo ......................................................
Data Processing System ......................
Environmental Control and Life
Support System..........................
Electrical Power System ......................
Guidance, Navigation, and Control ..
Mechanical ............................................
Main Propulsion System .....................
Orbital Maneuvering System/
Reaction Control System ..........

6.8-2
6.8-5
6.8-6
6.8-6

None of these procedures relieves the crew

from understanding how various orbiter and
payload systems work and what failures may
occur. This in-depth knowledge across a broad
range of systems allows a well-trained crew to
be confident that nearly all credible malfunctions can be handled without compromising
safety or mission success.

6.8-8
6.8-9
6.8-12
6.8-12
6.8-12

The philosophy behind all orbiter emergency

procedures separates into three categories:

6.8-14

Detect and confirm the malfunction.

Depending on flight phase, various Flight Data

File documents are used to diagnose, correct, and
reconfigure malfunctions of orbiter systems.

Ensure a safe configuration.

Attempt to correct the malfunction
or reconfigure to optimize remaining
systems.

Cue Cards
Pocket Checklists
Malfunction Book
Payload Systems
Dynamic phases of flight, such as ascent and
entry, do not allow leisurely identification and
correction of malfunctions. The CDR and PLT
flip books, along with the Ascent/Entry
Systems book are designed to allow quick
response to certain critical malfunctions in
order to safe the affected system.
Procedures in the Ascent, Orbit, and Entry
Pocket Checklists (PCL) are designed to safe
critical systems where malfunctions require a
response in less than 5 minutes. Three separate
books are used, since actions vary significantly,
depending upon the flight phase.
On orbit, with the exception of certain systems
such as cabin pressurization, most malfunctions
can be thoroughly investigated and isolated,
and backup systems can be activated. The
Malfunction Book provides step-by-step
procedures that have been developed to allow a
very structured, methodical approach to
correcting systems failures.

Many orbiter malfunctions are accompanied by

some type of caution and warning alarm. These
are designed to help the crew identify the
system involved and direct them to the correct
procedure. Almost all emergency procedures
titles reflect either a hardware caution and
warning light or a software fault detection
annunciation (FDA) message. It is extremely
important to confirm the malfunction with
whatever data is available. Sources of data may
include dedicated displays, related system
malfunctions, or an inventory of failed equipment. Mission Control is often able to provide
confirmation, since a great deal more data is
available on the ground, and highly trained and
knowledgeable controllers are dedicated to each
system.
Malfunction confirmation may be complicated
by previous failures. Also, the caution and
warning system cannot distinguish real failures
from sensor failures. Thus, identification of the
malfunction and selection of the correct procedure are sometimes difficult. Only through
study, training, and practice in simulators can
crewmembers develop the capability to quickly
and accurately detect and confirm malfunctions
in a vehicle as complex as the orbiter.

6.8-1

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
Once a malfunction has been identified and the
proper procedure selected, the crew takes
certain well-defined steps to put the orbiter into
a safe configuration. An example is pressing
the appropriate MAIN ENGINE SHUT DOWN
pushbuttons after a second engine failure to
establish single engine roll control. Due to the
redundancy of most onboard systems, no
immediate action should be required for most
single and many dual failures. However, if
multiple failures occur, there may be very little
time to switch to alternative systems or take the
necessary steps to prevent loss of control. In
multiple failure cases, the crew must keep in
mind the interaction of different systems and
prioritize their responses.

system will not be shut down until after MECO

to avoid interrupting hydraulic power to the
main engines. Loss of a hydraulic system in
powered flight will result in an SSME hydraulic
lockup. Loss of two hydraulic systems in
powered flight will result in two SSME
hydraulic lockups, one of which will have no
thrust vector control (TVC). Both cases would
then involve a pre-MECO SSME shutdown.
APU Failure
Pressure decrease on both the SPEC
page(s) and HYD/APU display
(independent sensors)
APU speed goes to zero

Most malfunction procedures involve correcting

a malfunction to recover lost capability or
remaining systems. In general, switching to
backup systems, interconnecting to components
of other systems, or securing some remaining
systems to reduce heat loads or power
consumption are methods used by the crew.
On orbit, it may be possible to perform in-flight
maintenance (IFM) to install replacement
components or reconfigure systems. An IFM
Checklist covers many of these pre-planned
activities. A dedicated team of IFM specialists
supports each mission and responds to MCC in
the event an IFM procedure is contemplated.
Mission Control also excels at developing new
procedures in real time to deal with unexpected
malfunctions. This capability is frequently
exercised during simulations.
This section discusses malfunction signatures
and confirming cues for some of the
malfunctions that may be encountered during
training and in flight. Brief summaries of actions
required for safing and reconfiguration are also
presented.
For more detailed malfunction
information, refer to Flight Data File books,
Flight Procedures Handbooks, and System
Workbooks.

APU SPD HI/LOW message

MASTER ALARM
APU OVERSPEED/UNDERSPEED light
on F7
Accumulator pressure decrease to ~2600
psia
HYD PRESS light on F7
To safe the system, the crew performs the APU
SHUTDOWN procedures to remove the start
command, close fuel tank isolation valves, and
remove power from the APU controller. The
remaining APUs may be taken to high speed
and auto shutdown inhibited, depending upon
flight phase.
If APU shutdown was due to an underspeed, a
restart may be attempted after completion of the
APU COOLDOWN procedure. An APU that
shut down due to a confirmed overspeed will
never be restarted. Only MCC can identify a false
overspeed, which would be a candidate for possible
restart.

APU/Hydraulics
The APU/HYD cue cards and PCL are used to
provide response to APU and HYD malfunctions. During ascent, actions are taken to
protect the main engines. Unless the APU or
hydraulic failure could cause a catastrophe, the
6. EMERGENCY PROCEDURES
6.8 Systems Failures

6.8-2

Hydraulic System Failure

Pressure decrease on both the SPEC
page(s) and HYD/APU display
(independent sensors)
APU speed good
MASTER ALARM
HYD PRESS light

USA007587
Rev. A
HYD PRESS message
Accumulator pressure drops to ~2600
psia
Two of the three pressure sensors in each
hydraulic system can be seen onboard. MCC
receives data from all three sensors. If the
hydraulic failure is confirmed, the APU will be
shut down to prevent additional damage. The
remaining APUs may be taken to high speed
and auto shutdown inhibited, depending on
flight phase.
Partial hydraulic failure due to a degraded
pump or line blockage may produce pressure
fluctuations. For ascent, the system is allowed
to operate as long as sufficient pressure is
available to keep a main engine from going into
hydraulic lockup (~1500 psi). During other
flight phases, the hydraulic system is taken to
low pressure in an attempt to restore stable
operation and to ensure that the aerosurface
switching valve has selected a good hydraulic
system for aerosurface actuation. If the system
is stable in low pressure, the APU is kept
running until an appropriate shutdown time. If
the system is required for critical functions such
as landing, the system may be returned to
normal pressure.
Hydraulic Leaks
Unexpected drop in reservoir quantity
SM ALERT
SM2 HYD QTY message
During powered flight, the system is left in
normal pressure to prevent SSME hydraulic
lockup. At other times, the system is taken to
low pressure to reduce leak rate. Normal
pressure may be reselected if required. MCC
determines leak rate and decides whether or not
the system may be returned to normal pressure.

Since fuel and nitrogen leaks are indistinguishable until very low levels are reached, crew
response is to assume a fuel leak (worst case).
No action is required pre-MECO unless the
APU shuts down. For other flight phases, the
APU is shut down and the fuel tank isolation
valves closed to attempt to isolate the leak. If
isolated, the APU is only started for critical
operations.
If non-isolatable, the APU is
restarted and run to fuel depletion. This prevents damage in the aft compartment from
leaking hydrazine, which is very corrosive.
Water Quantity Low
Abnormal decrease in water boiler
quantity
SM ALERT
SM2 W/B QTY message
Water spray boiler nitrogen or water leaks, as
well as excessive spraying by a faulty water
spray boiler controller or a faulty sensor (used in
the PVT calculation) can cause an abnormal
decrease in water boiler quantity.
MCC can detect excessive spraying, but in any
case, the crew should switch to the alternate
controller. If switching controllers does not
work, boiler power is cycled to reduce water
usage. MCC will determine when and if APU
shutdown is required, depending on mission
phase.
For a water leak, switching controllers will not
help, and APU cooling will be lost when the
quantity reaches zero. The APU will then
overheat within 4 minutes. Nitrogen leaks allow
cooling for a short time even after water quantity
reads zero. W/B QTY is a PVT calculation.
APU Shifts to High Speed
APU rpm increases to 113%

APU Fuel/Nitrogen Leaks

APU SPD HI Fault message

Unexpected decrease in fuel quantity

SM ALERT
SM2 APU FUEL QTY message
Difference in fuel quantity among APUs
Decrease in fuel pressure

SM ALERT
An APU shift to high speed can be caused by an
APU controller electronic malfunction or an
open failure of the Primary Control Valve. The
crew will take APU control to high-speed to
ensure proper controller logic for high-speed
6.8-3

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
control. The APU will be shut down as soon as
possible post MECO as long as two other APUs
are working properly. APU auto shutdown
must not be inhibited on an APU that has
shifted to high-speed since auto shutdown via
the fuel tank isolation valves is the only
protection from APU overspeed if both control
valves were to fail open.
Hydraulic Fluid/Lube Oil Overtemp

Pressure (or sensor) differences within a

particular hydraulic system may cause the PRL
software to be confused. MCC can see all three
sensors in each hydraulic system and will assist
the crew with proper actions. The first action is
to use confirming cues to determine if the APU
is running. Once APU status is known, the
crew should verify all good systems are selected
for PRL by executing appropriate item entries
on the OVERRIDE (SPEC 51) display.

High hydraulic fluid temp

Switching Valve Failure

High lube oil temp

MCC call

MASTER ALARM

Control problems

APU TEMP light on F7

SM ALERT
APU TEMP message
HYD RSVR T message
Excessive hydraulic fluid temperature (>230 F)
or lube oil temperature (>290 F) are signatures
of inadequate cooling. This may be caused by
mechanical problems or a water spray boiler
malfunction. The crew should switch boiler
controllers first. If APU temperatures decrease,
the problem was in the controller.
If
temperatures continue to rise, APU shutdown
may be required.
Shutdown and restart may be possible if the
APU is required for critical maneuvers.
Although the system is not limited in run time
for excessive hydraulic temperatures, the
system may be taken to low pressure or
shutdown in order to maintain the hydraulic
fluid below limits that may cause system seal
degradation if exceeded.
Priority Rate Limiting
Possible differing hydraulic pressure on
SPEC page(s) and HYD/APU display
SM ALERT
PRL DLMA message
APU accumulator pressure
APU speed

6. EMERGENCY PROCEDURES
6.8 Systems Failures

This failure can prevent the hydraulic systems

from operating a control surface. The crew can
cycle the affected system hydraulic pressure
between LOW and NORM to attempt to reset
the valve upon MCC direction. The other
option is to deselect one or more hydraulic system in the PRL software and operate on
reduced PRL rates. This will reduce the loads
on the good APU(s). This procedure is also
performed only at MCC direction.
Uncommanded Brake Pressure
Brake pressure greater than zero in
flight
SM ALERT
SM0 BRAKE P message
Since brake pressure is measured downstream
of the brake/skid control module, there is no
way to determine which hydraulic system is
responsible. Landing with pressure greater than
200 psi in the braking system can cause the
wheels to be locked at touchdown. This will
cause one or more tires to fail, resulting in
directional control problems and possible loss of
control. Nominally, none of the three brake
isolation valves will be open prior to weight on
wheels (WOW) or main gear touchdown.
Therefore, there should be no concern for this
problem. However, if the hydraulic system 2
brake isolation valve must be opened prior to
WOW for nose gear deploy redundancy, there is
potential to get uncommanded brake pressure.
To correct this problem, the PLT must close
brake isolation valve 2 as soon as possible after

6.8-4

USA007587
Rev. A
gear deploy and before WOW. This will allow
for the pressure to bleed down.
The crew should close the appropriate isolation
valves, then reopen them after nose gear touchdown. Since hydraulic system 1 supplies power
for nosewheel steering, this procedure is
modified for certain cases, and isolation valve 1
is reopened at main gear touchdown.

the S-BAND PM CONTROL switch to PANEL,

then back to COMMAND. This causes the Sband PM system to attempt to operate as
specified by the panel A1L switches. If this
corrects the problem, one of the originally
selected S-band subsystems has malfunctioned.
CAUTION
Panel A1L switches must be set up for the
current comm mode (including proper NSP
configurations).

Communications
The orbiter communications system is extensive
and complex. A great deal of redundancy
exists, and the system has been very reliable.
For normal operations, MCC commands system
reconfigurations. Loss of communication can
occur for reasons other than onboard
equipment, such as ground station or satellite
problems and antenna blockage. The crew
should consider this possibility as well as
their current communication mode, comm
panel configuration, and position over the
ground prior to executing lost communication
procedures.
ICOM Lost
Inability to communicate using ICOM
The procedure for ICOM lost will have the
backup audio terminal unit (ATU) selected via
the POSITIONS control switch. Positions with
backup ATU include commander (CDR/left),
pilot (PLT/right), mission specialist (MS), and
airlock (AL). At other positions, or if alternate
position doesn't regain ICOM, the alternate
audio central control unit is selected via panel
C3. If these actions do not regain ICOM, a
different ATU, crew communications umbilical
(CCU) connection, or headset/handheld mic
may be required to regain ICOM.
Comm Lost
ICOM operating properly

To troubleshoot antenna problems, manual

antenna selection is attempted, using the
SIGNAL STRENGTH meter and SM OPS 201
ANTENNA display. If comm is not restored,
the ANTENNA rotary switch on panel C3 is
returned to GPC.
Finally, the procedure provides steps to determine if MCC can uplink to a GNC GPC for state
vector updates. If there is no uplink, the crew
may have to deorbit without MCC direction to
preserve IMU alignment entry limits. If there is
uplink capability to the vehicle, an in-flight
maintenance procedure is available to bypass a
completely failed ACCU.
UHF Lost
Unable to communicate on UHF
The crew first turns off the UHF squelch system
to ensure good signal reception, then an
alternate ACCU power source is selected.
Three frequencies are available (259.7, 296.8,
and GUARD). All should be tried. GUARD is
an international UHF frequency that is only
used in emergencies.
Since the UHF antenna is located on the
orbiters belly, a roll to heads up is performed to
ensure optimum antenna gain.
Finally, the UHF power amplifier is turned off.
If successful, a low power transmit mode will
be available.

S-band comm lost on multiple panels

UHF comm status
The crew should first select ACCU alternate
power. If this is unsuccessful, S-band PM panel
C3 controls are verified and the crew switches

6.8-5

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A

Cryo

High tank pressure

The cryo O2 and H2 systems provide reactants

to the fuel cells from tanks under the payload
bay. The cryo O2 system also supplies oxygen
to the crew module for metabolic use and for
direct breathing while using the LES helmets.

High heater temperature

A failed on heater may result in high tank

temperature or pressure, requiring the affected
heater to be turned off. A failed off heater
can be a control problem or a failure of the
heater itself. MCC normally alerts the crew to
these conditions. Redundant heaters are used if
there is a heater problem. For control problems,
a manual heater control procedure can be used.

Leaks
MASTER ALARM
O2 (H2) PRESS light (F7 matrix)
SM ALERT
CRYO O2 (H2) MANF message
CRYO O2 (H2) PRES message

Failure of heaters in two tanks indicates a

paired logic problem. For this case, each tanks
heaters must be operated individually to
determine the location of the failure.

Decreasing tank pressure

Decreasing manifold pressure
MCC call
If a cryo leak is detected, its location must first
be determined, then steps must be taken to
isolate the leak. If pressure decreases in only
one tank, a tank leak is indicated. Check valves
should prevent the other tanks from losing cryo
through a leaking tank. Some cryo in the
leaking tank may still be usable, depending on
the leak rate. Mission duration may be affected.
A pressure decrease in all tanks requires closing
the manifold isolation valves to isolate the leak.
Once a potential leak area is isolated to a single
manifold, additional troubleshooting may allow
further isolation to either the PCS system or an
individual fuel cell. Should the leak be in the
manifold feeding a fuel cell or in the fuel cell
itself, a shutdown and powerdown may be
required. Mission duration may be affected,
depending on leak location and the mission
cryo quantity requirements.
Heater Problems
MASTER ALARM
O2 (H2) PRESS light (F7 matrix)
O2 HEATER TEMP light (F7 matrix)
CRYO O2 (H2) PRES message
CRYO O2 HTR message

Cryo heaters can fail on or off. A heater can

also have a short. If an O2 heater has a short, it
should cause the O2 current sensor logic to trip
and disable the heater.

Data Processing System

Hardware and software DPS problems are
normally detected by monitoring software and
annunciated by the C&W system.
Failure
signatures are shown in a table in this section.
Once the failure is identified, the appropriate
procedure is worked. The impact of a single
DPS failure in other systems is normally a loss
of redundancy rather than a loss of capability.
Key safing steps in each procedure are used to
prevent commands to good systems from bad
computers and prevent good computers from
using data from bad components. To correct
transient errors, an I/O RESET or power cycle is
attempted. For port-dependent failures, the
port mode procedure may allow communications to be resumed using alternate ports and a
different data bus.
During ascent or entry, when certain DPS
failures affect more than one flight-critical
string, the MULTI DATA PATH cue card is
used to identify failure effects and determine
crew actions. For some multiple failures, when
Flight Rules allow, the DPS can be reconfigured
using the RESTRING cue card. This procedure
allows good GPCs to take over flight-critical
buses and components that are lost after one or
more GPC failures.

High tank temperature

6. EMERGENCY PROCEDURES
6.8 Systems Failures

6.8-6

USA007587
Rev. A
CAUTION & WARNING
FAILURE
Fail to Sync

HARDWARE
GPC light
CAM lights

SOFTWARE

PROCEDURE

GPC Fail message

Down arrow on SYS SUMM
Failed GPC issues fail messages
against the good GPCs
GPC continues to drive its IDP

GPC Fail

COMMENTS
GPC continues to run and
send commands over the
data buses
Mode tb will be RUN and
Output tb is grey

Fail to Halt

BP Output tb
BP Mode tb
CAM lights
GPC light
Big X
Poll Fail

GPC Fail message

Down arrow on SYS SUMM

GPC Fail

Dead GPC, no commands

Fail to Quit

GPC light
CAM lights
Big X
Poll Fail

GPC Fail message

Down arrow on SYS SUMM

GPC Fail

Like fail to halt, except Mode

and Output tbs do not turn
barberpole (BP)

PASS Total Set

Split

All PASS GPCs stop talking to each other, each GPC

issues fail messages against the others, diagonal
CAM lights lit, BFS standalone

BFS Engage

Engage should be done with

10 sec for Ascent, 45 sec
for Entry

Generic PASS Fatal

Software Error

Fail to quit or halt on all four GPCs simultaneously/all

PASS driven IDPs Big X and poll fail/BFS standalone

BFS Engage

Engage should be done

within 10 sec for Ascent,
45 sec for Entry

Power Fail

Bp Output tb
Bp Mode tb
Big X
Poll Fail

GPC Fail message

Down arrow on SYS SUMM

GPC Fail

Like fail to halt, but no CAM

lights or F7 GPC light

I/O Term B fails on

Bp Output tb

Down arrow on SYS SUMM

for FF and FA
FF and FA I/O Error messages

GPC Fail

GPC running, but

commands inhibited on
flight critical data buses

Down arrow on SYS SUMM

for PL1 and PL2
PL1 and 2 I/O Error messages

BFS or SM
GPC Fail

GPC running, but

commands inhibited on
payload and launch data
buses

I/O Error message (PASS &

BFS) Down arrow on
PASS SYS SUMM
Down arrow on BFS SYS SUMM

MDM I/O Error

GPC good, MDM lost

I/O Term A fails on

MDM I/O Error at

MDM

Varies with MDM

MDM I/O Error at

GPC

Varies with MDM

PASS I/O Error message

BFS BCE String PASS message
Down arrow on PASS for
failed MDM
Ms on BFS SYS SUMM
for FF and FA

MDM I/O Error

Port mode will cause loss of

other MDM on string
(trade-off case)

Component
problems

Varies with
component

BCE String x message

Ms on PASS and BFS SYS
SUMM

BCE String X

Use Ref Data book to find

parameters lost and verify
signature

Varies with
MDM/DSC

Ms on SYS SUMM for MDM

Ls on SYS SUMM for DSC
I/O Error PCM annunciated by
BFS for PCM port problem or
MDM problem
PASS SM machine will
annunciate S62 BCE BYP OFX
or OA message

I/O Error PCM

omm.

OI MDM/DSC Fail

Port mode may recover

DPS Failure Signatures

6.8-7

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
Set Splits
Since the GPCs run in a redundant set during
ascent, entry, and some on-orbit operations, it is
possible for one or more PASS GPCs to split
apart from the rest of the set and continue
running. Various combinations are possible,
but in all cases it is imperative to determine if a
good PASS set exists. A good set must include:
1 IMU
2 RGAs
2 AAs
2 FCS channels

only be engaged for emergency situations for

total PASS failures.
Total BFS GPC failures present a signature similar
to a PASS GPC FAIL. The crew should see
barberpole OUTPUT and MODE talkbacks, a big
X on the BFS IDP, and a POLL FAIL message.
Actions for BFS failures are listed in the
appropriate FDF procedures. Since the BFS also
controls several systems during ascent and
entry, the crew may be required to take manual
control of communications or ECLSS equipment. The following table lists some commands
issued by the BFS:
SYSTEM

Restring or BFS engage is required if a good set

does not exist.

MAJOR MODE

FES on

103

NH3 on

603, 305

COMM

SPC to TDRS

104

Antenna
Other SPCs to
ground stations for
lost comm

Ops 1, 6, 3

NOTE
See section 6.9 for GPC set splits during
ascent.

COMMAND

ECLSS

Ops 1, 6, 3

BFS Commands Over Payload Buses

Environmental Control and Life Support

System

BFS Engage
For unrecoverable PASS failures, the BFS is
available to take over orbiter control. Monitoring of BFS and GNC systems status prior to
engage is required to ensure the BFS is capable
of control. For a successful BFS engage, the BFS
must have a good nav state and be able to
communicate with/command:

Environmental control and life support system

(ECLSS) malfunction procedures cover the four
subsystems of pressurization, air revitalization,
active thermal control, and supply/waste
water. Since the ECLSS is highly redundant,
the normal response to failures is to switch to
the alternate system.

1 IMU

Cabin Pressure

1 RGA
1 AA (for 1st stage)

Klaxon

2 FCS channels

MASTER ALARM

1 ADTA

Cabin pressure meter

dP/dt meter

BFS Failures
For most transient software failures, the BFS
will automatically attempt a software restart. If
this is successful, operations will continue, and
a GPC BITE message will be issued. A Halt
transient results in the BFS restarting in OPS 0,
and it must be moded to the appropriate OPS
by the crew. For these transient failures,
however, the BFS should be considered
suspect for engage. This means that it should

6. EMERGENCY PROCEDURES
6.8 Systems Failures

SM SYS SUMM
High O2 or N2 flow
CABIN ATM light (F7 matrix)
Crew reaction to cabin leaks consists of four basic
steps: assess magnitude of the leak, attempt leak
isolation through system reconfiguration, power
down, and prepare for deorbit.

6.8-8

USA007587
Rev. A
The crew first closes cabin relief isolation valves
and uses available data sources (DPS displays
and meters) to verify the leak. If a leak is
confirmed, the leak rate determines whether an
ascent abort or an emergency deorbit is
required. If enough time is available, additional
leak isolation procedures are attempted.
An unexpected cabin pressure increase could be
caused by either a PCS leak or a malfunction in
the PCS control system. Flight Data File procedures are used to secure the PCS and isolate
the failure. An early deorbit may be required
for a non-isolatable leak to prevent O2 or N2
depletion. PCS leaks may be either internal or
external to the crew module.
Pump/Fan Failures
Rapid drop in flow rate
Pressure differential in loop
Rising temperatures
MASTER ALARM
Hardware caution and warning
Fault messages
The normal response is to switch to an alternate
pump/fan. However, during powered flight,
only critical equipment will be swapped,
typically during post MECO. The Freon pump
and isolation valves are the most likely AC
powered equipment to be swapped to prevent
an abort. This avoids AC electrical transients,
with possible loss of the engine controllers.
Should avionics bay temperatures exceed limits,
activation of the alternate water loop is
permitted.
Water/Freon Leaks
Decrease in flow rate

Depletion of fluid makes the loop unavailable

for cooling. An early deorbit should be expected. On ascent, an abort may be required for
the loss of two H2O loops or two Freon loops.
Fire
Siren
Master alarm
SMOKE DETECTION lights on panel L1
Fault messages
Smoke concentration on DPS display
If a fire is confirmed by checking the smoke
concentration on the DPS display, the crew
must protect themselves with quick-don masks
(QDMs) if on orbit or by closing their visors and
going on suit O2 if during ascent or entry, then
taking steps to extinguish the fire. Either a
built-in or a portable Halon bottle is discharged
to extinguish the fire.
Once the fire is under control, the WCS charcoal
filter, ATCO, and LiOH canisters are used to
clear the cabin atmosphere of combustion
products.
If the crew cannot purify the
atmosphere to a safe level, then an early deorbit
will be required, since the orbiter N2 supply is
insufficient to maintain cabin PPO2 below
flammability limits for more than 4 to 8 hours
while the crew is wearing helmets and exhaling
oxygen-rich air.
Cooling Loss
Loss of one or more heat rejection systems
(radiators, FES, NH3 boiler) requires a reconfiguration to make up for lost cooling capability
while troubleshooting. A powerdown may be
required. For severe cooling loss, an early
deorbit may be performed.

Change in accumulator pressure

Electrical Power System

Decrease in pump delta pressure

The orbiter EPS configuration during all flight

phases is for all buses to be powered and
operating independently. Payload and other
considerations may mandate bus ties during orbit
operations. EPS malfunctions that require an
immediate response include reactant valves, fuel
cells, major DC buses, DC-AC inverters, and

MASTER ALARM
Hardware caution and warning
Fault messages

6.8-9

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
AC motors. Cryo-related problems are discussed
in the Cryo section.

BUS

MAST ALARM
Hardware caution & warning MAIN BUS
UNDERVOLT light and other lights on F7
matrix
Fault messages
MN volts = 0
IDP loss
FC amps = 0

FPC

MASTER ALARM
Hardware caution & warning AC VOLTAGE
light, FUEL CELL PUMP light
Fault messages
AC volts = 0
AC amps = 0
MN volts good
IDP loss
Pump/motors

AC

MASTER ALARM
Hardware caution & warning AC VOLTAGE
light, other F7 lights
Fault messages
AC volts low
AC amps low
Pumps/motors

ESS

MASTER ALARM
Hardware caution & warning
Fault messages
ESS volts low
Bus loss ID
FUEL CELL PUMP light on F7 matrix

CNTL

Control bus losses are difficult to diagnose.

The signature could range from no
indications to:
SM Alert
Fault messages, including
SM CNTL/ESS V
CNTL volts low
Bus loss ID
Equipment loss
Bus loss ID

Shorts
High amps
Low volts
Hardware caution and warning (F7
lights)
MASTER ALARM
Fault messages
DPS displays
F9 meter
For a confirmed short, power is removed from
the affected bus. Circuit protection equipment
built into the orbiter may also react to large
shorts by tripping RPCs, blowing fuses, or
popping circuit breakers.
Most bus shorts are characterized by high
current and low voltage. Each bus failure has a
particular signature that should be learned
through practice in failure recognition in the
Single System Trainer (SST). It is important to
be able to react quickly and correctly to
electrical shorts, particularly during critical
flight phases.

Panel/
Sub bus

Abbreviated Bus Loss Signatures

Fuel Cell Reactant Valves

CAUTION

MASTER ALARM

Never tie a good bus to a shorted bus while

executing malfunction procedures.

SM ALERT
FUEL CELL REAC light on panel F7

Bus Losses

FC REAC message
FC COOL P message

Bus loss ID in FDF

Fault messages
Hardware caution and warning
The following table is an abbreviated list of cues
for certain bus losses. When the bus loss is
confirmed, an attempt may be made to recover
the bus, depending on flight phase, criticality,
and the type of failure. If the bus cannot be
regained, FDF bus loss actions must be
completed to reconfigure and safe systems.

6. EMERGENCY PROCEDURES
6.8 Systems Failures

SIGNATURE

Main

If a reactant valve failure annunciates, the PLT

should quickly attempt to reopen the valve and
bus tie in order to prevent fuel cell loss and a
subsequent main bus loss. For confirmed
reactant valve failures, the affected fuel cell
must be shutdown. If an O2 or H2 reactant
valve fails closed, the fuel cell will fail from lack
of fuel within as little as 20 to 30 seconds,
depending on vehicle loading and cryo quantities.

6.8-10

USA007587
Rev. A
Fuel Cell Crossover

Fuel Cell Cooling Loss

MASTER ALARM

SM ALERT

FUEL CELL PUMP light (F7 matrix)

FC DELTA V message

FC PUMP message

Increasing STACK T and EXIT T

FC coolant pump P talkback barberpole

Decrease in FC volts

Fuel cell cooling can be lost for several reasons,

including: coolant pump failure, AC bus loss,
ECU failure, ESS bus loss, or a fuel cell coolant
leak. The fuel cell temperature signatures vary
with each failure, but in general, the fuel cell
must be secured within 9 minutes to prevent
stack overheating. To troubleshoot fuel cell
cooling problems, use the following rules of
thumb, although each is not applicable in all
cases.
If the coolant pump is not running, EXIT
T should increase if the H2 pump is
running.
If the coolant pump and the H2 pump are
not running, STACK T will decrease.
EXIT T will increase slightly and stabilize.
(Sensors are not reliable for the actual FC
Temperature without any flow.)
Combined coolant/H2 pump failures
may be an indication of an ECU malfunction, or an AC problem affecting
both motors.

The FC DELTA V procedure is used to bus tie

and safe the fuel cell.
Fuel Cell Shutdown
If a shutdown is required due to a failure
or malfunction, the FC SHUTDOWN procedure
is used. Upon completion, the appropriate
LOSS OF 1 FC powerdown should be
performed.
Should a second fuel cell shutdown be required,
the 2ND FC SHUTDN procedure is used. In
this case, some powerdown is required prior to
fuel cell shutdown to prevent excessive loads on
the single remaining fuel cell. During ascent,
one FC cannot support the load of three main
buses, so one main bus will have to be dropped.
As before, a LOSS OF 2ND FC powerdown
would be performed after the fuel cell is
shut down.
Dual Gas Regulator
SM ALERT

Steadily increasing STACK T and EXIT

T are indications of a real fuel cell cooling problem.
Fuel Cell Internal Short

FC COOL P message
Reduction or increase in coolant loop
pressure
Pressure that is either too high or too low will
cause the fuel cell to operate incorrectly, and a
shutdown will be required. The BUS TIE
procedure is used to prevent loss of an MN bus.
Time available before shutdown of the fuel cell
varies depending upon the severity of the
pressure problem.

Low fuel cell volts

Low MN volts
Reduced FC amps
Increasing STACK T
Increased reactant flow

Powerdowns

Fuel cell performance degraded

For this case, the MN BUS UNDERVOLT
procedure is used. The fuel cell is shut down
after dropping the affected bus.
For a
confirmed fuel cell short, the main bus may be
regained using the BUS TIE procedure. (Long
form, volts <20.)

Powerdowns are performed to reduce electrical

power consumption and reduce heat loads. The
appropriate ascent, orbit, or entry FDF
procedure is used.
These procedures are
designed specifically for each flight phase.

6.8-11

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A

Guidance, Navigation, and Control

The most serious failures in GNC systems are
those that affect flight control. It is imperative
that the crew manage channels for the flight
control system. Failures in the flight control
systems can rapidly deteriorate into a loss
of control.
FCS Channel
MASTER ALARM
FCS CHANNEL light on panel F7
FCS CH message
Down arrow on GNC SYS SUMM
Down arrows on SPEC 53 CONTROLS
display
MCC call
Due to system redundancy, no action is
required for the first failure. A second failure
on the same effector requires the crew to place
the remaining channels to OVERRIDE. This
prevents a good channel from being bypassed
in the event of a third failure.
Sensor Failures/Dilemmas

Since many of these systems are critical for

entry, it is important to understand each system
and troubleshoot correctly.
Motor Failure
All orbiter mechanical systems have two motors
for redundancy, and all systems can drive with
just one motor. Motor failures can occur due to
power failures, control logic failures, software
failures, or jams. Failure of a single motor
doubles actuation time for the system. Failure
of
both
motors
precludes
actuation.
Workarounds, IFM, and, as a last resort, EVA
procedures are available to restore capabilities
on some systems.
Indicators
Microswitch failures can prevent automatic
system operation or give false indications
of a malfunction.
Individual readouts of
paired microswitches on most mechanical
systems allow the crew or MCC to determine
actual status of the system and its associated
talkback indicators.

Main Propulsion System

Down arrow, ?, or M on GNC SYS

SUMM

MPS failures during ascent can cause degraded

performance that may result in an abort.
Most cue card procedures must be executed
quickly to safe systems and protect against
additional failures. Close crew coordination is
required, especially where an ascent abort must
be executed.

Down arrow, ?, or M on sensor

displays

Engine Failure

SM ALERT or Master Alarm

Fault message

For single sensor failures or commfaults,

redundancy should allow the good systems to
continue to provide data without impacting
control system performance. A second or third
failure may confuse the selection filter,
requiring crew intervention.
MCC can
generally resolve sensor dilemmas quickly,
using the additional data available in the
telemetry stream.

Mechanical
Malfunctions in orbiter mechanically actuated
systems such as payload bay doors and latches
can be electrical, mechanical, or DPS related.
6. EMERGENCY PROCEDURES
6.8 Systems Failures

6.8-12

MASTER ALARM
Red MAIN ENGINE STATUS light on
panel F7
SSME FAIL message
Pc goes to zero
Change in acceleration
Reduced helium flow. (Helium flow
increases during shutdown and then
decreases to zero post shutdown)
MCC call

USA007587
Rev. A
Data Path Failure

The most important step following an engine

failure is to ensure the GPCs know that an
engine has failed. This is checked by verifying
that an SSME FAIL message has annunciated.
If the SSME FAIL message has not been
annunciated, the crew must push the
appropriate MAIN ENGINE SHUT DOWN
pushbutton to mode guidance.

Engine Pc goes to zero

SM ALERT
SSME DATA message
Amber MAIN ENGINE STATUS light on
panel F7

For any SSME failure, the PLT places the AC

BUS SENSOR switches to the off position. This
prevents the AC bus sensors from erroneously
taking an AC bus offline, which would impact
the engine controllers of the remaining engines.
Helium Leak
SM ALERT
MPS HE message
HE dP/dt > 20
Down arrow on BFS GNC SYS SUMM 1
HE tank pressure lower than other
engine tanks

Acceleration cues
Helium flow
MCC call
The onboard software automatically inhibits
limits for a data path failure. If the engine is
still running, the crew re-enables limits and
should assume a command path failure also
exists (which requires a pre-MECO engine
shutdown), unless told otherwise by MCC. If
the engine has failed, the shutdown pushbutton
must be pressed to mode guidance for the
engine failure.
Stuck Throttle

HE Reg A or B (may be present)

SM ALERT

Early in ascent, a cue card isolation procedure is

used to secure one helium leg at a time. If the
leak is isolated, the bad valve is kept closed and
MCC evaluates the remaining helium to
determine if a safe shutdown will occur at
MECO. It may be necessary to interconnect the
pneumatic helium system. Failures later in
ascent may require a shutdown using the
shutdown pushbutton only if there is
insufficient time for leak isolation.
A
pushbutton shutdown requires less helium than
a pneumatic shutdown, since hydraulic
pressure is used to actuate some SSME valves.
If a leak cannot be isolated, helium from a
previously failed engine may be used as a
source of additional helium to prevent a second
engine failure. The engine will fail when
helium is depleted. Limits must be enabled to
ensure a safe shutdown.
An early crewinitiated shutdown could also be required,
depending on leak rate. MCC will analyze leak
rate and recommend action if comm is available. Without comm, the crew uses the procedures on the MPS cue card.

Amber MAIN ENGINE STATUS light on

panel F7
Static engine Pc
MPS CMD (HYD, ELEC) message
MCC call
Procedures for a stuck throttle are found on the
MPS CMD/HYD/ELEC cue card. An SSME
shutdown will be performed to protect for
either SSME constraints for net positive suction
pressure (NPSP) or to stay within the 3-g
constraints. When this shutdown occurs varies
for nominal ascent, TAL, and RTLS. However,
it usually occurs about 30 seconds before
MECO, to preserve the maximum amount of
performance.
Engines with command path failures must
always be shut down manually using the MPS
controller AC power switches. After shutdown,
the shutdown pushbutton is depressed to set
discretes that allow the software to recognize an
engine failure.
This is called an AC/PB
shutdown.

6.8-13

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
A single engine with a hydraulic or electric
lockup will be shut down via the pushbutton
only if three engines are running.
For multiple stuck throttles, the crew will
address them in the following priority:
1.
2.
3.

Command path failure

Hydraulic lockup
Electric lockup

A failure of the software to confirm MECO

prevents an auto ET SEP. The crew can set a
MECO confirm flag in the software by
simultaneously pushing all three engine
shutdown pushbuttons, providing no other
failures have occurred. The MECO confirm flag
may also be set by manually moding the
software via an OPS 104 PRO.

Orbital Maneuvering System/

Reaction Control System

ET SEP Inhibit
MAIN ENGINE STATUS lights remain
on panel F7
SM ALERT
SEP INH message

Failures in the OMS/RCS are handled using

procedures tailored for the current flight phase.
For ascent, achieving a safe orbit while
maintaining deorbit propellant margins is the
primary concern. On orbit, maintaining at least
two deorbit capabilities drive the procedures.
During entry, vehicle control is paramount.

This malfunction can be caused by excessive

rates or a feedline disconnect failure. If rates
are the problem, the crew damps them
manually and allows the automatic separation
sequence to occur. Feedline disconnect failures
require the crew to execute a manual separation
6 minutes after MECO.
For performance
problems or aborts, a separation may be
performed sooner.

Leaks
Helium pressure decrease
Propellant quantity decrease
MCC call
MASTER ALARM
OMS or RCS light on panel F7

ET SEP Switch

Leak message

SM ALERT
ET SEP MAN message
ET SEP AUTO message (RTLS, TAL)
The software automatically defaults to a crewinitiated ET SEP if this switch fails to MANUAL,
except for RTLS and TAL aborts, where the
default is AUTO. The switch is overridden
using an item number on SPEC 51.
MECO Confirm

No auto ET SEP

Glareshield DAP lights remain on

Panel C3 ORBITAL DAP lights remain

off

No software mode transition

6. EMERGENCY PROCEDURES
6.8 Systems Failures

Leaks must first be confirmed, using

independent
DPS
display
and
meter
indications, since sensor failures may cause
false annunciation. Once confirmed, the crew
attempts to isolate the leak by securing the
affected system. Control requirements drive the
procedure to be used.
Helium tank leaks are identified by a continual
helium pressure decrease after the system has
been secured. For this case, propellant is
burned from the affected system to achieve
blowdown capability.
The point of max
blowdown (39% OMS quantity, 22% RCS
quantity) allows the optimum use of the system
once all the helium is depleted.
A helium leg leak can be identified by the
helium pressure stabilizing after the system has
been secured. In this case, the helium isolation

6.8-14

USA007587
Rev. A
valves are manually operated to maintain pressure in the propellant tanks.
If propellant tank pressure continues to
decrease when the system is secured, a tank
leak is indicated. (RCS tank leaks in MM 304
are identified by propellant tank pressure
diverging from good tank when the system is
secured.) The system should be used as long as
possible. Then a crossfeed is established to the
other system prior to tank depletion. A burn
may be performed to deplete the affected
propellant tank, preventing leakage into the
OMS/RCS pod where the corrosive propellants
could damage other systems.
RCS manifold leaks and leg leaks are indicated
by a pressure drop in the individual manifold
or manifold pairs after leak isolation.
In
general, the leaking manifold/leg will be left
secured and operations will be continued using
the good systems.

still available for use through the remaining

OMS engine and/or RCS jets (i.e. ENG FAIL) or
has been lost along with the engine (i.e., PRPLT
FAIL).
RCS Jet Failures
MASTER ALARM
RCS light on panel F7
RCS JET FAIL message
GNC SYS SUMM indications
SPEC 23 RCS display indications
Jets can fail off, on, or leak. False annunciations
may also occur.
For a failed on jet, the RCS manifold must be
quickly secured to prevent propellant depletion.
If the failure was real, pressure will decrease in
the affected manifold.
A single failed off jet usually has no major
effect, since the RCS jets have a great deal of
redundancy. The remaining jets take over per
the software jet select priority. If the failure is
false, the jet may be reselected so that the DAP
will attempt to fire it again.

Regulator Failed High

Pressure increase in OMS/RCS system
MASTER ALARM
OMS or RCS light on panel F7

Helium isolation valves are closed per the

appropriate procedure and troubleshooting
performed to isolate the bad regulator.

When a jet fail leak is annunciated, the crew

and MCC examine available data to determine
if the leak is real or an instrumentation problem. For actual leaks, the appropriate manifold
is secured only if the leak is large enough to
cause a quantity divergence.

OMS Engine/Propellant Failure

Interconnect/Crossfeed

OMS or RCS TK P message

MASTER ALARM
Drop in OMS Pc and/or increase in
OMS injector temperature
Reduced acceleration
Down arrow on MNVR display
OMS PC message
OMS light on panel F7
Depending on flight phase, the appropriate
OMS BURN MONITOR cue card is used. If the
problem is real (i.e. not a sensor failure), the
crew must use engine inlet pressures to
determine whether the affect OMS propellant is

Crossfeed valves and lines allow crossfeeds

between the left and right OMS and the left and
right RCS. The crossfeed valves and lines also
allow the OMS and RCS to be interconnected.
During OPS 1 and 3, placing the OMS/RCS
switches in GPC allows the software to
automatically reconfigure these valves and
establish OMS/RCS interconnects for abort
dumps and RCS crossfeed for large RCS leaks.
For ascent abort dumps, the software will
automatically configure the OMS/RCS valves
to support interconnected flow, if required. The
software will also automatically reconfigure the
systems for DPS and electrical failures. With

6.8-15

6. EMERGENCY PROCEDURES
6.8 Systems Failures

USA007587
Rev. A
multiple failures, however, the software may
inadvertently leave the OMS and RCS in a bad
configuration once the abort dump is complete.
In such cases, the crew will need to manually
reconfigure the OMS and RCS to prevent
inadvertent propellant depletion or loss of
control.
When the systems are being operated in an
interconnect or crossfeed mode, failure isolation
becomes much more complex. If conditions
permit, it is better to secure the OMS/RCS
systems entirely prior to attempting troubleshooting procedures.
OMS Gimbal
MASTER ALARM

Either a gimbal failure or its data path caused

this annunciation. For either case, operation on
the secondary gimbal is initiated. A second
gimbal failure may require shutting down the
OMS engine if control problems exist. Should
the OMS engine be pointed near the orbiters
c.g., then the RCS and the remaining OMS
engine may be able to maintain control.
A gimbal failure that occurs prior to a burn will
require the crew to use remaining gimbal
system to park the affected engine through the
c.g. Gimbal power is then removed via an item
entry on the MNVR display. The procedure
protects against the loss of the secondary
gimbals which could render the OMS engine
unusable.

OMS TVC light on panel F7

OMS GMBL message
Downmode to secondary gimbal

6. EMERGENCY PROCEDURES
6.8 Systems Failures

6.8-16

USA007587
Rev. A

6.9

ullage pressure sensors. Consequently, LH2

ullage pressure suddenly reads 12.0, and LO2
ullage pressure reads 0.0 for the affected engine.

MULTIPLE FAILURE
SCENARIOS

CONTENTS
MPS He Leak with APC/ALC
Failure .........................................
Set Splits During Ascent......................
Stuck Throttle in the Bucket................
Second Hydraulic Failure and 1
SSME Failed ...............................
Two APUs/Hydraulic Systems .........
APU 1 and Multiple Prox Box
Failures........................................
Two Freon/Water Loops ....................
Total Loss of FES ..................................
Total Loss of FES with BFS Failure....
Two Fuel Cells ......................................
Both OMS Engines ...............................
OMS/RCS Leak with DPS/EPS
Failures........................................
Cryo Leak with Failed Manifold
Valve ...........................................
BFS Self Engage ....................................

Set Splits During Ascent

GPC set splits during ascent (2V1V1 or 2V2) can
cause control problems, inhibit ET SEP, or cause
MPS command and data path problems.
Because of this, should a set split occur during
ascent, BFS engage may be required to prevent
a loss of control, to regain throttling, or ensure a
safe ET SEP. Flight Rules permit reconfiguring
the PASS GPCs after the set split if certain very
specific conditions are met. However, because
of time criticality during powered ascent, there
may not be enough time to reconfigure the set
to ensure vehicle safety. In these cases, a BFS
engage should be performed.

6.9-1
6.9-1
6.9-1
6.9-1
6.9-1
6.9-2
6.9-2
6.9-2
6.9-2
6.9-2
6.9-2

Stuck Throttle in the Bucket

6.9-2
6.9-3
6.9-3

This section briefly describes multiple failures

that may be encountered during training.
Although the potential for these failures in
flight is very low, they allow flight crews and
MCC personnel to exercise their knowledge of
orbiter systems. For each case, crew actions are
noted after the multiple failure is discussed.

MPS He Leak with APC/ALC Failure

A failure of APC 4 (5,6) or ALC 1 (2,3) causes
the A helium isolation valve on the C(L,R)
main engine, respectively, to close. Should the
crew then close the B helium isolation valve
on the affected engine (e.g., in working the
helium leak isolation steps), the engine would
be starved of helium and possibly experience a
catastrophic shutdown.
With an APC/ALC failure during powered
flight, helium leak isolation must not be
performed on the affected engine. A helpful
cue that an APC/ALC has failed is the ullage
pressure indication directly below the helium
dP/dt readout on BFS GNC SYS SUMM 1.
With an APC/ALC down, power is taken away
from the signal conditioners for the LH2/LO2

For cases when an SSME throttle is stuck while

still in the bucket (due to a MPS CMD, HYD,
ELEC), it may be possible to continue into orbit,
depending on throttle level and actual
performance. (More than likely, a pre-MECO
OMS dump would be required.) If uphill
capability is lost, MCC may call for a TAL (or
even an RTLS). This is a real-time call that can
be made only by the MCC using the abort
region determinator (ARD). A restring may
also be performed in some cases if it will
recover the stuck throttle.

Second Hydraulic Failure and 1 SSME

Failed
Loss of two APUs or hydraulic systems during
ascent causes a loss of TVC on one SSME. If
another engine fails, the non-gimbaling engine
may have to be shut down also to prevent loss
of control. Simulations have demonstrated a
high probability of control problems with two
engines running and one non-gimbaling.

Two APUs/Hydraulic Systems

Loss of two hydraulic systems during powered
flight will result in two SSMEs experiencing
MPS hydraulic lockups, one of which has also
lost ATVC capability. Steps will be taken to
protect flight control against the next failure,

6.9-1

6. EMERGENCY PROCEDURES
6.9 Multiple Failure Scenarios

USA007587
Rev. A
and a pre-MECO engine shutdown will be
required to protect 3-g constraints.
Loss of two hydraulic systems will also affect
flight control for glided flight, since aerosurface
rates are reduced. Abrupt maneuvers should
be avoided to prevent control system
saturation.

APU 1 and Multiple Prox Box Failures

Either hydraulic system 1 or one of the two
landing gear proximity boxes is required to
deploy the landing gear. APU 1 provides
power for hydraulic system 1, which performs
hydraulic gear deploy. Pyrotechnic backup is
provided by either prox box. One of these three
systems is required for a successful gear deploy.
If two of these systems are failed, attempts will
be made to recover at least one of them by
repowering failed buses, resetting RPCs/circuit
breakers, or restarting APU 1. Failure of both
prox boxes results in all landing gear talkbacks
remaining barberpoled.
Gear deployment
verification may not be possible via physical
cues.

Bailout is preferred over a gear-up

landing attempt.

Two Freon/Water Loops

Loss of cooling capability requires an
emergency deorbit. Procedures are contained
in the FDF CONTINGENCY DEORBIT PREP or
the SYSTEMS AOA books for losses during
ascent. It is extremely important to understand
the related powerdown procedures for these
cases and perform them expeditiously.
Successful entry and landing depend on proper
execution of the powerdowns.

In order to accomplish emergency payload bay

door opening with BFS failed, it will be
necessary to either IPL a new BFS machine
using the BFS GPC IPL procedure in the Ascent
Pocket Checklist or transition a PASS GPC to
SM OPS 2 using nominal post insertion
procedures. MCC and the crew will work
together to pick the best course of action
depending on the time available, progress
through post insertion when failures occur, and
other system failures.

Two Fuel Cells

Both OMS Engines

Assuming OMS propellant is still usable via
OMS/RCS interconnect, the RCS jets are used to
perform the remaining ascent and deorbit
burns.
A staged deorbit burn using
aerobraking to provide some of the deorbit
deceleration may be performed, so as to not
overburn the jets.

OMS/RCS Leak with DPS/EPS Failures

Total Loss of FES

Complete loss of the FES during ascent requires
an emergency payload bay door opening to
obtain adequate cooling. Either the BFS or an
SM GPC is used, depending on urgency and
what other malfunctions are present.

6.9 Multiple Failure Scenarios

Total Loss of FES with BFS Failure

On orbit, all three main buses may be tied upon

completion of the LOSS OF 2 FC POWERDOWN. During ascent or entry, the cue card or
Pocket Checklist powerdown is performed, but
one main bus will remain unpowered to
prevent overloading the remaining fuel cell.

NOTE

6. EMERGENCY PROCEDURES

If the FES has failed on orbit, the payload bay

doors will be closed as late as safely possible
prior to entry. The ammonia boiler will be
activated as soon as possible for cooling during
entry. Minimum acceleration of 0.05 g is
required for ammonia boiler operation (around
400 k). Due to entry heating and lack of cooling
with a FES failure, orbiter temperatures will rise
to high levels between payload bay door closing
and ammonia boiler activation.

Electrical failures affect the capability to operate

the motor-driven OMS/RCS valves, and DPS
failures take away crew insight and affect
software commands to the valves. If time
permits, the OMS/RCS sliderule is used to
determine which valves are operational for
various failures.
Some workarounds are
available. These are coordinated through MCC.

6.9-2

USA007587
Rev. A
For some control bus failures, it is possible to
actuate OMS/RCS valves using GPC commands. The master crossfeed, automatic crossfeed, or a software read/write procedure is
used to command the valve.
MDM failures can cause the GPCs to lose RCS
status information. This may result in good jets
being declared failed or unavailable by the RM
software. Using item entries on SPEC 23, it may
be possible to override the software to the
correct status and regain RCS jets or prevent
firing a failed jet or jets on a failed manifold.

Cryo Leak with Failed Manifold Valve

A bus tie and fuel cell shutdown may be
required to isolate the leak. The PCS systems
may also be secured individually to assist in
leak isolation. The manifold valve may be

closed if the failed bus can be temporarily

powered or an IFM performed. If the valve
cannot be closed or the leak isolated, then two
fuel cells will be lost when the cryo H2 or O2 is
depleted. Emergency deorbit or ascent abort
may be required, depending on leak rate.

BFS Self Engage

This scenario can occur as a result of multiple
BFS GPC and Backup Flight Controller failures,
or with only one failure and crew action.
Certain failure modes of the Backup Flight
Controller and the BFS GPC can put the BFS
one failure away from self engage. Should this
occur, the crew must be aware that moving the
BFS OUTPUT switch out of BACKUP could
result in a self engage. This is a condition
where the BFS engages but the PASS does not
shut down.

6.9-3

6. EMERGENCY PROCEDURES
6.9 Multiple Failure Scenarios

USA007587
Rev. A

This page intentionally left blank

6. EMERGENCY PROCEDURES
6.9 Multiple Failure Scenarios

6.9-4

USA007587
Rev. A

6.10

IDP/CRT Power Switch

SWITCH AND PANEL

CAUTIONS

The IDP/CRT POWER switches on panel C2 are

adjacent to the MAJOR FUNC switch. This makes
it relatively easy to power off an IDP when
intending to switch major functions. If this
occurs, simply power the IDP back ON, inform
MCC of the incorrect switch throw, and continue.

CONTENTS
MPS Switches........................................
Fuel Cell Reactant Valves....................
IDP/CRT Power Switch ......................
GPC/MDM ...........................................
PLB Mech Power/Enable....................
HYD Press and APU Controller Power
Switches ......................................
OMS Kit .................................................

6.10-1
6.10-1
6.10-1
6.10-1
6.10-1

GPC/MDM

6.10-1
6.10-1

Because the design of some orbiter controls

is very similar, when they are placed in
close proximity, inadvertent actuation can
occur. Training, along with close attention
during high workload tasks, will minimize
these problems.
This section discusses
several potential areas where crewmembers
should exercise caution to avoid pitfalls. By
being aware that these situations exist,
crewmembers
can
execute
time-critical
procedures confidently.

MPS Switches
The six ENGINE POWER switches and the six
He ISOLATION switches are located in adjacent
rows on panel R2. The switches are very
similar, except for a yellow band around the six
power switches. Caution should be exercised
during MPS helium leak isolation or SSME
shutdown procedures.

During dynamic ascent and entry, the GPC and

MDM switches on panel O6 are very difficult to
reach. They are also hard for the CDR to see
when wearing a launch/entry suit helmet.
When executing DPS malfunction procedures, it
is important to ensure the correct switch is
actuated. One technique is to have the MS2
verify that the CDR has selected the correct
switch prior to actuation. Powering off the
wrong MDM or moding the incorrect GPC can
leave you critical to a single failure.

PLB Mech Power/Enable

These switches are located adjacent to each other
on panel R13L and perform entirely different
functions. Because of their similar nomenclature
and same appearance, they are easily confused.
The PL BAY DOOR SYS ENABLE switches are
used during PLBD opening/closing. The PL
BAY MECH PWR SYS switches are used for
other mechanical systems in the PLB (such as
radiators, PRLAs, RMS, etc). A careful procedure
crosscheck will avoid problems.

HYD Press and APU Controller Power

Switches

Fuel Cell Reactant Valves

Because of panel design, which represents
a schematic of the PRSD and FC systems,
the FUEL CELL REAC valve switches are
arranged in a 1-3-2 order (1 on top, 3 in
the middle, 2 on the bottom) on panel R1.
Closing the incorrect reactant valve results in
the loss of a second fuel cell and possibly two
main buses.

The HYD MAIN PUMP and APU CNTLR PWR

switches look similar and are in adjacent rows on
panel R2. It is easy to confuse these two switches
during the APU shutdown procedure or when
taking a hydraulic system to LOW PRESS.

OMS Kit
OMS KIT switches are on the left side of panel
O8. It is easy to confuse the OMS KIT switches
with the LEFT OMS switches. The OMS KIT
switches are inoperative.

6.10-1

6. EMERGENCY PROCEDURES
6.10 Switch and Panel Cautions

USA007587
Rev. A

This page intentionally left blank

6. EMERGENCY PROCEDURES
6.10 Switch and Panel Cautions

6.10-2

USA007587
Rev. A

6.11

SYSTEMS FAILURE SUMMARY

This section summarizes actual, in-flight

failures that have occurred in the shuttle
program.
It includes major systems and
selected repeat failures important to the crew.

The purpose is to give crewmembers a feel for

the type and severity of equipment failures and
their potential impact on operations. Complete
lists of anomalies and failures for both flight
and ground operations are available from the
Orbiter Project Office.

6.11-1

6. EMERGENCY PROCEDURES
6.11 Systems Failure Summary

USA007587
Rev. A
SYSTEM

FAILURE

CAUSE

APU lube oil temp high

WSB ice

Two APUs underspeed shutdown

Hydrazine leak and fire

APU shifted to high speed

Failed control valve

Hydraulic leak on entry

Leak in pump hose

APU underspeed - FCS checkout

Valve contamination

Loss of KU antenna gimbal and stow control

Loose screw and circuit burnout

TAGS jam

Paper jam

CRYO

O2 leak

PCS O2 restrictor installed backwards

DPS

GPC 2 quit

CPU timing

RS split

Chip problem

BFS failed pre-launch

Failed string tracking

GPC 1 and 2 failed

Contamination

GPC 5 failed

Engage term errors

GPC 4 failed on orbit

Failed to sync; changed on orbit

MDM OF3 failed pre-launch

Component contamination

MDM port failure

Power supply fail

MDM failure pre-launch

I/O errors

MDM card problems

Card fail

FES shutdown

Ice, temp transducer, or thermal transient

FES failure to come out of standby

Freon flow degrade
Airlock equalization valve would not depress (for EVA)

Controller failure
Debris
Debris

Hum Sep signal conditioner B circuit breaker popped

Wire bundles short

TAGS cable arcing

Cable short

Fuel cell 1 failed

H2 pump fail due to blockage

Fuel cells produced excessive hydrogen

H2 entrainment in new filter screen

High drift rates

IMU failed

APU/HYD

COMM

ECLSS

EPS

GNC

Mechanical
Systems

MPS

Fuel cell coolant pump single phase AC short

Wire damage

IMU cage

IMU failed

Power supply failed (9)

Spurious IMU accelerometer output

Accelerometer component shift

3 deg/sec vehicle yaw rate during crew sleep

Bad state vector uplink

Radar altimeter loss of lock/intermittent lock/fail

Transmission system malfunction

TACAN no lock, up or biases

Low receiver sensitivity

Air data problems

PLBD would not close

Thermal warping

Brake damage on landing

Inadequate brake capability

Thermal blanket and PLBD seal dislodged

Unknown; venting suspected

Pad abort after SSME start

Engine valve slow to open

Launch scrub

Various component failure,

including H2 leakage

14,000 lb of LO2 drained from ET pre-launch.

Launch held due to strange LO2 temp
indications in engine

Operator error

Orbiter ET/SRB structural breakup

Right SRB lower field joint burnthrough

SSME failed (auto shutdown) ATO

OMS/RCS

Failed sensor

OMS cracks discovered post flight

Launch stresses

Left OMS pod burnthrough

APU detonation and fire

Loss of verniers

F5L and F5R leak

RCS jet failed off

OX valve failed/clogged Pc tube/

main poppet stuck/He ingestion

RCS jet failed leak

Leaks

RCS Reg leak

Helium leaks

Systems Failure Summary Chart

6. EMERGENCY PROCEDURES
6.11 Systems Failure Summary

6.11-2

USA007587
Rev. A

7.

For each flight phase (ascent, orbit, entry),

manual control techniques are presented, along
with information on vehicle handling qualities,
performance monitoring, and takeover criteria.

TRAJECTORY MANAGEMENT
AND FLIGHT
CHARACTERISTICS

CONTENTS
7.1
7.2
7.3
7.4

ASCENT .....................................
ORBIT..........................................
ENTRY ........................................
TERMINAL AREA ENERGY
MANAGEMENT AND
APPROACH, LANDING, AND
ROLLOUT (OPS 305) ................

For detailed information on these subjects,

consult the appropriate Flight Procedures
Handbooks, Flight Data Files, or Flight Rules.

7.1-1
7.2-1
7.3-1

Each subsection discusses the primary controls

and displays used during each flight phase.
When used, external devices, such as runway
lighting, ball-bar, and aimpoints, are integrated
with the flight crew techniques in order to
present a coordinated picture to the
crewmember.

7.4-1

This section presents space shuttle flight

characteristics and trajectory management
during powered flight, on orbit, reentry into the
atmosphere, approach, landing, and rollout.
Some guidance and navigation information is
included so the crewmember will be acquainted
with the parameters that are important in
Much of the
influencing flight control.
information was supplied by crewmembers who
Additional
have flown the space shuttle.
information was derived from simulator runs in
the Shuttle Mission Simulator, Shuttle Engineering
Simulator, and Vertical Motion Simulator.

Where the backup flight system (BFS) differs

from the primary avionics system software
(PASS), (also called primary flight system
(PFS)), BFS characteristics are discussed
separately. This generally applies to ascent and
entry flight phases, because the BFS has limited
capability on orbit.
Each subsection concludes with rules of thumb.

7-1

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS

USA007587
Rev. A

This page intentionally left blank

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS

7-2

USA007587
Rev. A

7.1

ASCENT

CONTENTS
Powered Flight ........................................... 7.1-1
Insertion OMS Burns ................................. 7.1-8
Backup Flight System ................................ 7.1-9
Sensory Cues............................................... 7.1-10
Ascent Rules of Thumb ............................. 7.1-12

Powered Flight
During powered flight, the crew monitors
orbiter performance and system status using
dedicated displays, DPS displays, and cue
cards. This section describes the displays used,
the monitoring task, takeover criteria, and
manual control.

PASS Ascent TRAJ 1

DPS Displays
Several types of DPS displays are used to
monitor vehicle performance during powered
flight. For a more detailed description of the
displays presented here, refer to the Flight
Procedures Handbook and DPS Dictionary.
GNC TRAJ Displays
In first stage, the PASS and BFS ASCENT TRAJ 1
displays depict a nominal trajectory plot with
altitude on the y-axis and relative velocity
(VREL) on the X-axis. Altitude scale is from 0 to
170,000 ft and velocity from 0 to 5,000 fps. Tick
marks on the profile show attitude director
indicator (ADI) pitch attitudes at appropriate
reference points. Orbiter state (from NAV) is
displayed by a moving triangle with a 20 sec
predictor circle. An airspeed scale is marked
with speeds, and the current knots equivalent
airspeed (KEAS) is shown by a triangle. A
staging (STG) tick mark denotes maximum qbar for SRB SEP.
The PASS and BFS ASCENT TRAJ 1 display,
along with the ascent cue cards, are used to
monitor first-stage trajectory.

PASS Ascent TRAJ 2

PASS and BFS ASCENT TRAJ 2 displays are
automatically displayed at the transition to
major mode (MM) 103. The profile represents a
nominal second stage ascent with altitude vs
inertial velocity (VI) as the axes. Altitude scale
ranges from 140,000 to 525,000 ft and velocity
from 5,000 to 26,000 fps. Current altitude and
velocity data from NAV is indicated by a moving
triangle. Predicted states at 30- and 60-second
intervals are represented with moving circles. The
short line roughly parallel to the last part of the
profile represents a TAL TRAJ for an engine
failure at the earliest TAL opportunity. An
expanded VI scale from 25,000 to 26,000 fps
with a cutoff (CO) tick at the MECO velocity is

7.1-1

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
available at the top of the TRAJ displays. Current
V is indicated by a moving triangle driven by
NAV. The BFS ASCENT TRAJ 2 shows total load
factor (g) on a vertical scale, which ranges from
2.0 to 3.5 g with current value indicated by a
triangle.
I

during ascent. DPS displays are presented in

Appendix B.
OVERRIDE Display
The OVERRIDE display (SPEC 51) allows the
crew to deselect/reselect certain line replaceable
units (LRUs) to solve a redundancy
management (RM) dilemma or to force RM to
consider a previously deselected LRU. The
OVERRIDE display also contains various software switches that may be used to override
dedicated switch failures, controls for OMS and
reaction control system (RCS) dumps, and
several other additional functions.
Dedicated Displays
Dedicated displays are also used during ascent
to monitor shuttle performance.

BFS Ascent TRAJ 2

The orbiter symbol and predictors should track
the appropriate profile through MECO. Other
monitoring items are:

The attitude director indicator (ADI) displays

attitude, rates, and error information and is
used in combination with the DPS displays and
cue cards. ADI attitude depends upon the
position of the ADI ATTITUDE switch on panel
F6 or F8. Switch positions are:
REF: reference frame based on nominal
launch azimuth at lift-off (can be
redefined)

VI: used to monitor proper MECO

velocity
g: used to monitor throttling.

LVLH: Earth-referenced pitch/roll (local

vertical local horizontal)

NOTE

INRTL: referenced to Mean of 1950

(M50) inertial frame (see Section 2.13 for
reference frame definitions)

TRAJ DISPLAY titles change to include

the abort mode when an ascent abort is
executed.
GNC SYS SUMM Displays
GNC SYS SUMM displays are the principal
means of monitoring flight-critical systems.
They should be scanned frequently during
ascent to verify system status and aid in
determining causes for alarms. The BFS also
supports a THERMAL display and two SM SYS
SUMM displays. These are accessed by placing
the BFS IDP MAJ FUNC switch to SM. These
displays should also be scanned frequently to
detect impending system problems and are also
used to deal with orbiter systems problems
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

ADI rates are body rates driven by the rate gyro

assemblies (RGAs). Scaling depends on the
position of the ADI RATE switch. Switch
positions during powered flight are:
HIGH: 10 per second
MED: 5 per second
LOW: 1 per second
ADI errors are the difference between actual
and commanded body attitude. Scaling is
controlled by the ADI ERROR switch. Switch
positions during powered flight are:

7.1-2

USA007587
Rev. A
HIGH: 10

Heading of VI with respect to target insertion

plane is indicated by the secondary bearing

MED: 5
LOW: 1

Notes

The available scaling of ADI errors and rates is

used to tailor vehicle displays for the sensitivity
appropriate in each flight phase. If guidance is
unconverged, the error needles will be stowed.
An OFF flag is displayed for invalid or missing
data.

DAP: Auto
Throt: Auto
M/VI

R 180
5 P 016

Y 000
03

10

33

3
3

Inc

6
9

50

50

FLIGHT INSTRUMENT MENU

A/E
ORBIT
DATA
MEDS
MEDS FC2
PFD
PFD
BUS
MSG RST MSG ACK AUT
12

24

21

18

15

UP

Inc digital readout is the angular

difference between the current and
targeted inclinations.

The HSI compass card displays 0

through 360 counterclockwise while
heads-down (as shown), then inverts
clockwise after the roll to heads up
(RTHU).

7.10

27

P2*
S1

X-Trk 32.0
33

30

-1

X-Trk digital readout and CDI both

display lateral offset from the targeted
plane in n. mi.

Accel

1.0 g

2.0K

21

150K

R 0.3
Beta

Course-arrow (magenta) is pinned to 0

on the compass card to mark the
targeted inclination.

24 5
15

75

160 K 2105

12

KEAS

1.7

5.0K

MM: 103
ATT: LVLH

Earth-Relative Velocity bearing pointer

and Beta digital readout are displayed
until 2+30 MET or 200K altitude,
whichever comes first(-limiting
constraints released).

305

5
5.32
5.2

Inertial Velocity bearing pointer is

displayed throughout a nominal ascent.

33

06

5.4

Attitude Director Indicator

The horizontal situation indicator (HSI) is used
to monitor AUTO guidance and provide
information needed by the crew to fly
manually. HSIs provide a geometric view of
orbiter location with respect to various NAV
points. During powered flight, the HSI displays
data relative to the target insertion orbit.
North on the compass card is the desired
insertion plane. Heading of the body +X axis
with respect to desired insertion plane is read at
the lubber line. The difference between current
heading and north is vehicle yaw. A course
pointer indicates heading of VREL, while the
course deviation indicator shows estimated
sideslip (the angle between body X-axis and
VREL). The primary bearing pointer indicates
heading to the selected runway for TAL and
RTLS aborts only. It is not driven in first stage.

pointer.
The alpha/mach indicator (AMI) is driven by
NAV during powered flight. ALPHA displays
angle of attack, and ACCEL displays acceleration
(computed thrust/weight) in second stage. The
ALPHA tape is not driven in first stage.
M/VEL displays magnitude of VREL in first
stage, then VI in second stage, while equivalent
airspeed (EAS) shows equivalent airspeed
throughout powered flight. EAS is an indirect
indication of q-bar.
The altitude/vertical velocity indicator (AVVI)
is driven by NAV during powered flight. ALT
is displayed with respect to the selected
runway. ALT RATE (H-dot) is the radial
component of VI.

7.1-3

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
Pushbutton indicators on the glare shield on
panels F2 and F4 indicate status of PITCH,
ROLL/YAW, and SPD BK/THROT.
Lights
within the pushbuttons correspond to control
modes. The BODY FLAP pushbutton light also
indicates the status of the main propulsion
system (MPS) dump sequence post-MECO. The
light comes on when the MPS dump is started
and goes out when the dump is complete. All
other pushbuttons extinguish at space shuttle
main engine (SSME) zero thrust (MECO
confirmed +3.75 sec). The BFC light illuminates
when the BFS is engaged and flashes when the
BFS is standalone.
Powered Flight Monitoring
Sequential SSME start is monitored on the
chamber pressure (Pc) gauges on the OMS/MPS
MEDS display. After solid rocket booster (SRB)
ignition (about 7 seconds after SSME start) the
orbiter should perform a vertical rise for about 8
seconds, followed by a combination roll, pitch,

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

and yaw maneuver onto the launch azimuth.

Roll attitude on the ADI should be 180 upon
completion. Switch ADI ATT from REF to
LVLH after the roll is complete to obtain proper
pitch/roll attitude information. REF is used for
lift-offs to avoid large ADI movements at the
LVLH 90 pitch singularity.
Throughout first stage, the crew monitors the
parameters listed on the ASCENT ADI cue card
(especially attitude) and also vehicle rates.
Some deviation of the error needles during first
stage can be expected due to load relief, but the
error needles may not recenter precisely and
veto differences in the load relief flight software
and error needle display software logic.
Guidance will turn the vehicle into unexpected
winds to reduce aerodynamic loading during
the load relief phase. The crew will be briefed
on expected dynamic response prior to launch.

7.1-4

USA007587
Rev. A

ASCENT ADI
Cue Card
SSME throttle-down at 20 to 30 seconds and
throttle-up at about 60 seconds is monitored on
the Pc gauges.
Throttle command (T) is
displayed digitally on the ASCENT TRAJ.
Second stage follows SRB SEP. DPS displays
should change to MM 103, and AMI/AVVI
tapes display inertial velocity. Monitor closed
loop guidance convergence by noting that the
time of main engine cutoff (TMECO) on the
PASS and BFS ASCENT TRAJ displays is within
a few seconds of the expected MECO time.
The PASS and BFS ASCENT TRAJ 2 and the
dedicated displays are used to monitor the
trajectory during second stage. Continue to

compare displayed data with the ASCENT ADI

cue card.
The crew must be continuously aware of the
orbiters abort mode status. Boundaries are
monitored by Mission Control Center (MCC)
based on tracking data and projected vehicle
performance capability as computed by the
abort region determinator (ARD) program.
Boundaries are transmitted to the crew by the
capsule communicator (CAPCOM), but the
crew should use the NO COMM MODE
BOUNDARY cue card to maintain onboard
status if communications with MCC are lost.
Boundaries listed on the CONTINGENCY
ABORT cue cards should also be monitored.

7.1-5

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
off-nominal situations to preserve safety and
mission success. The Flight Rules define potential takeover criteria. These rules are built into
the Flight Data File cue cards and checklists.
The most serious situations involve control
problems. In many cases, these are time-critical
and an FCS downmode (control stick steering
(CSS) or BFS engage) must be rapidly
performed. Downmode is an onboard decision
that may be made for:
Impending loss of control
Failure of an expected maneuver to
occur
Unexplained attitude/rate excursions or
undamped oscillatory motions

NO COMM MODE BOUNDARY Cue Card

About 60 seconds before MECO, 3 g throttling
commences and is monitored on the Pc gauges
and DPS displays. MECO should be observed
at guidance predicted TMECO and near the
design MECO velocity on the AMI. All three
red MAIN ENGINE STATUS lights on panel F7
will come on for a nominal MECO, and the
ORBITAL DAP pushbutton lights on panel C3
will illuminate after MECO confirmed is set in
the GPC software.

If the roll maneuver is not initiated as

scheduled, auto guidance is considered no-go,
and a BFS engage should be performed.

AUTO ET SEP should occur at MECO +20

seconds and is indicated by the red MAIN
ENGINE STATUS lights going out. A SEP INH
message indicates vehicle rate in any axis
exceeds 0.7 per second or failure of a feedline
disconnect valve to close. For a rate exceedance,
wait for rates to damp, and separation (SEP)
will occur automatically. Feedline disconnect
failure is handled using cue card and checklist
procedures to perform a delayed ET sep.

CAUTION

After external tank separation (ET SEP), an

automatic -Z translation occurs to obtain
-4 ft/sec V and move the orbiter away from
the external tank. Upon completion, the crew
should observe software transition to MM 104
by the appearance of the MNVR displays on the
DPS displays.
Takeover Criteria
During powered flight, the crew should be
prepared to take whatever action is necessary in
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

Throughout first-stage flight, rate excursions

are a parameter requiring crew action. Prior to
90 seconds, if pitch or yaw rates exceed 5 per
second, the crew should engage BFS. After 90
seconds, the crew should select CSS, followed,
if necessary, by BFS engage.

With manual throttle control selected, an

automatic guided MECO will not occur. To
obtain the correct MECO velocity, the main
engines must be shut down manually. In
low performance cases, a low-level
shutdown may occur prior to the planned
MECO velocity.
After staging, if TMECO has not converged
within 10 seconds, MCC should be consulted.
In a NO COMM situation, CSS and manual
throttle should be selected.
To avoid violation of range safety limits, CSS
takeover may be required. MCC will provide
yaw steering commands to allow the crew to fly
away from limit lines. Trajectory deviations of
such magnitude to require takeover are
extremely unlikely. Potential causes are:

7.1-6

USA007587
Rev. A
Faulty onboard NAV

tracking or telemetry of current vehicle state. A

discussion of performance boundaries is
presented in Section 6.

Erroneous guidance
Launch day winds
SRB dispersions
Range safety agreements for first-stage
deviations allow for limit exceedance as long as
control is maintained.
As the orbiter approaches 3-g acceleration,
throttling commands and SSME throttle-down
should be observed. If this does not occur,
manual throttling must be performed using the
pilots speed brake/thrust controller (SBTC) to
ensure vehicle loads do not exceed design limit
constraints.
Any time the AUTO guidance is unacceptable
for vehicle attitude control, it should not be
allowed to control the main engines. Manual
throttle should be selected whenever CSS
takeover is initiated. Automatic guided MECO
is inhibited with manual throttles selected.
If MCC predicted TMECO is 2 seconds different
than onboard predicted TMECO, a manual
SSME shutdown will be initiated on the
ground-computed value.
The MCC abort region determinator (ARD)
program is the prime tool for determining abort
capabilities. The onboard NO COMM MODE
BOUNDARIES cue card lists inertial velocity
values that define flight design mode
boundaries computed prior to flight using
predicted ascent performance and including
ground rule flight performance reserves. The
ARD is a real-time computational system
designed to handle:
One or more SSME failures at any time
Performance dispersions visible in the
vehicle state
Performance dispersions not visible in
the vehicle state
SSME mixture ratio changes
Multiple or single-engine abort capabilities are
determined throughout ascent for any combination of these failures using ground radar

Should the translational hand controller (THC)

be moved out of detent post-MECO and prior to
the completion of the -Z ET SEP maneuver, the
maneuver will be inhibited (terminated if in
progress) with no moding to MM 104. If for
any reason the -Z maneuver is not completed
either automatically or manually, the crew can
manually mode to MM 104 by keying in OPS
104 PRO.
Manual Control
Select manual control during powered flight by
depressing the PITCH or the ROLL/YAW CSS
pushbutton indicator on the commander (CDR)
or pilot (PLT) eyebrow panel (F2 or F4).
Selecting any CSS pushbutton indicator gives
CSS in all axes to both the CDR and the PLT. To
reselect auto control, depress the PITCH or the
ROLL/YAW AUTO pushbutton indicator on the
CDR or PLT eyebrow panel (F2 or F4).
If CSS is selected, manual throttles will also be
selected on panel C3. The PLT can select manual
throttle by depressing the red button on the C3
SBTC and moving the lever to match the current
commanded throttle setting within 4 percent. As
the throttle level is matched, the AUTO SPD
BK/THROT lights extinguishes on the eyebrow
panels, and the MAN SPD BK/THROT light on
the PLT side eyebrow panel illuminates. SSME
throttling is then controlled by the PLTs SBTC.
The CDR manual throttle light does not
illuminate because manual throttling cannot be
accomplished from that side. Pushing the SPD
BK/THROT pushbutton on the C2 or C4 eyebrow
panel returns throttle control to the digital auto
pilot (DAP).
The control system in powered flight is rate
control, attitude hold, with a maximum rate of
about 12 per second in pitch and roll, and
about 6 per second in yaw. If both RHCs are
out of detent, the rates are summed.
To fly a nominal ascent to MECO in CSS, the
trajectory displays and the ASCENT ADI cue
card are the prime and secondary tools,
respectively. Displayed data are only as good as

7.1-7

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
the NAV state, so the crew must confirm NAV
state with MCC at takeover.
The ADI is primary for roll and is used to
maintain roll at 180 before the roll to heads up
(RTHU) cue and then 0 after the RTHU cue. The
ADI is secondary for pitch.

pushbuttons on panel C3 when the cutoff bug

meets the cutoff mark. Time of manual MECO
can be anticipated as the cutoff bug approaches
the cutoff mark. Push the SSME pbs ahead of
(lead) the MECO C/O cue by about 150 fps
(about a bug width) to allow for SSME tail off.
This procedure will result in the best possible VI
at MECO.

(Earth-Relative Velocity) bearing

The
pointer is primary for yaw in first stage. Placing
it on the lubber line (nose) creates the best
conditions for attach point loading and SRB SEP.
I

(Inertial Velocity) bearing pointer is

The
primary for yaw after SRB accelerations have
dissipated in second stage (MET 2:30). Placing
it on the lubber line (nose) creates the most
efficient yaw profile because it points to the most
in-plane heading.
The ASCENT TRAJ display is primary for pitch.
Steer to keep the current state bug (triangle) and
the two predictor bugs (circles) on the TRAJ line
while making small (less than 5) attitude
changes. Observe the results prior to making
each subsequent correction.
If BFS guidance is good, BFS roll pitch and yaw
digital information can also be used to fly the
ascent profile.
Because H-dot at MECO is extremely critical,
concentrate on controlling H-dot rather than
altitude within 90 seconds of MECO. Attempt
to achieve the nominal MECO H-dot shown on
the ASCENT ADI cue card. This will result in a
nominal gamma or flight path angle at MECO.
Errors of 100 fps are usually acceptable, while
a positive H-dot (and gamma) is always
required.

Insertion OMS Burns

Monitoring and Targeting
To monitor insertion OMS burns (OMS 1
and/or OMS 2), the MNVR EXEC display and
BFS GNC SYS SUMM 2 are used in addition to
the ADI. These displays are available in both
PASS and BFS in similar formats. The MNVR
EXEC display provides digital data to target
and monitor orbital maneuvering system (OMS)
burns. MNVR EXEC is an interactive display
requiring keyboard inputs from the crew, as
well as monitoring prior to and during burns.
Current HA and HP are used in conjunction
with the OMS 1/2 TGTING cue card to
determine which OMS targets should be used.
Each mission has a flight-specific card, which the
crew must understand thoroughly. The MNVR
display is described in detail in Section 2.18.
After the crew loads the appropriate targets, the
GPC software will compute a burn solution.
The target set and burn solution can be checked
by comparing data on the DPS display with the
expected solution listed in the OMS targeting
section of the ascent check list or OMS
maneuver pads.

Use the ASCENT ADI cue card to confirm

MECO velocity and H-dot.
CRM: As the CDR is flying CSS; the PLT
manages manual throttle control.
MS2
coordinates the CDR and PLT actions. Manual
throttle requires a manual MECO. Trajectory
monitoring is everyone's first duty. Roll to the
ADI, pitch to the TRAJ, and yaw to the HSI.
CSS requires manual throttle. Perform manual
shutdown by depressing all three shutdown
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

7.1-8

MNVR Display

USA007587
Rev. A
For a quick check, scan VTOT, TGO, apogee
altitude (HA) and perigee altitude (HP), burn
attitude, and time of ignition (TIG) to make sure
they are reasonable. Before executing a burn,
automatic maneuvers to the inertial burn
attitude may be performed using ITEM 27.
Prior to executing the burn, crosscheck the
attitude with the ADI and compare PFS and
BFS solutions.
NOTE
Burn attitudes on the MNVR display are
inertial, and the ADI MODE switch must
be in INRTL for a proper crosscheck of
orbiter burn attitude.

Manual Control
Takeover criteria and manual flight characteristics during insertion OMS burns are similar to
those encountered during deorbit burns. Refer to
Section 7.3 for a more detailed discussion of OMS
burn takeover criteria and flight characteristics.
Insertion OMS burns for ascent aborts are
discussed in Section 6.2.
Some special
situations encountered during insertion OMS
burns are discussed here.

Backup Flight System

The ADI is used for OMS burns in a similar

fashion to its use during powered flight. BFS
GNC SYS SUMM 2 is used to monitor the OMS
system during insertion OMS burns.

The BFS is unique software contained in a

single GPC that supports nominal ascent and
most shuttle aborts. The BFS can be engaged at
any time after lift-off. Once engaged, it is
irreversible until the orbiter is in orbit or back
on the ground.

Once the targets are loaded, and a solution is

available,
the
crew
follows
ASCENT
CHECKLIST/OMS Burn cue card procedures to
prepare for and execute the burn. When in the
correct burn attitude, error needles should be
centered, and the ADI inertial attitude and
commanded attitude on the MNVR display
should match.

BFS state vector degrades very rapidly during

powered flight if the BFS is standalone, since it
is propagated using the last known
accelerations from the inertial measurement
units (IMUs). Therefore, if the PASS were to
fail, BFS engage must be performed within 10
seconds to ensure the vehicle will remain under
control.

CAUTION

BFS engage criteria are listed in the Flight Rules

and summarized on the DPS cue cards. They
include:

If OMS 1 is required, maneuvering to burn

attitude should be delayed if the DAP has
failed to maintain the orbiter within 10 of
the ET SEP attitude during the -Z
translation. This will avoid recontact with
the ET.

Loss of redundant set

Provided perigee is high enough to remain in

orbit for a few revolutions, cutoff conditions of
an ascent OMS burn are relatively unconstrained compared to a deorbit burn. Achieving
the planned orbit is a mission success issue.
Reaching an orbit above minimum HP is a
safety issue. For failures during insertion OMS
burns, the crew will downmode from 2 OMS to
1 OMS to + X RCS to forward RCS as necessary
to reach at least minimum HP. Downmode
procedures are listed on the INSERTION OMS
BURN cue cards.

Loss of PASS capability to control the

vehicle due to general purpose computer
(GPC)/multiplexer/demultiplexer
(MDM)/ LRU failures
Loss of control
trajectory

due

to

Roll maneuver
scheduled

not

initiated

divergent
as

There are a number of functional differences

between the PASS and the BFS:

7.1-9

No manual control during powered

flight.
No manual throttling.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
BFS does not support contingency
aborts.

Post ET SEP, only AUTO -Z translation

is available.
In the TRANS DAP,
attitude maneuvers are manual only.

No single-engine roll control.

OMS burn attitude must be controlled

manually.

BFS runs pre-engage in parallel with

PASS although not in control of the
orbiter.

Sensory Cues
Prelaunch, SSME gimbal checks can be felt
through the shuttle structure.

BFS has only one memory load. Unique

ascent and entry requirements are
merged into one common set of
guidance requirements.

First stage is characterized by a rapid g buildup

to slightly over 2 g, accompanied by a great
deal of noise and vibration. Instruments and
DPS displays can be monitored, but precise
tasks are difficult.

When BFS is engaged, it takes command

of all flight-critical buses.
When BFS is engaged, two IDPs are
driven unless additional IDPs are
assigned with keyboard inputs.

SRB SEP results in a large amount of flame

across the windows from the SRB separation
motors. When the flame disappears, forward
windows appear to be coated with residue,
making them nearly opaque at certain Sun
angles.

The BFS can drive all four IDPs

simultaneously while the PASS is
limited to three.
BFS performs limited SM functions
while PASS GNC does not.

At SRB SEP, g-load undergoes a nearly

instantaneous reduction from 2.3 g to 1.0 g,
coupled with a significant reduction in noise
and vibration. Since the orbiter is above most
of the atmosphere, many crewmembers have
remarked that it seems to stop accelerating.

100.00
3g
Throttling

80.00
70.00
2 g's

60.00
SRB
Sep

50.00

}
Throttle
Bucket

40.00
30.00

273:5:46:30

273:5:45:27

273:5:44:24

273:5:43:21

273:5:42:18

273:5:41:15

273:5:40:12

273:5:36:00

0.00

SRB
Ignition
273:5:39:09

10.00

1g

273:5:39:06

20.00

273:5:37:03

Veh. Acc. V72L72988 ft/s2

3 g's

90.00

868.cvs

Vehicle Acceleration During Ascent

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

7.1-10

USA007587
Rev. A
During second stage, g-load builds very
gradually until 3 gs are reached and the SSMEs
throttle to maintain 3 g.
A good fit of the pressure suit and harness is
very important to avoid discomfort during
ascent, particularly at high g loads. Centrifuge
runs with actual flight equipment should be
performed to ensure proper adjustment.
Some crewmembers report that the eye position
in an actual orbiter differs from that
encountered in the SMS. Checking seat position
in an actual orbiter prior to flight is
recommended for first time flight deck
crewmembers.
MECO results in g-load decreasing rapidly to
zero.
Indication of MECO is limited to
observing the red SSME status lights, Pc meter
readings dropping to 0, and g-reduction.

Some crews have reported an audible thump at

ET SEP which could be caused by the explosive
severing of the forward attach fitting. Other
crews noted that ET SEP had occurred by
extinguishment of the SSME status lights.
When the forward RCS jets fire to perform the
-Z translation, their ignition is accompanied by
a loud boom (just like cannons according to
some crewmembers).
Aft jets produce a
noticeable structural vibration, but no sound.
The OMS engines do not produce sounds, but
the thrust can be noted by unrestrained objects
translating aft in the cabin.
Night launches are a special case. The SRB and
SSME plumes appear to reflect off the air
molecules and produce a pulsing light that is
most pronounced through the overhead
windows, but can be seen through the front
windows also.

7.1-11

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

USA007587
Rev. A
Monitor guidance convergence by observing
PASS and BFS TMECOs converging to
expected time.

Ascent Rules of Thumb

At L/O, check Auto FCS.
Monitor roll program on the ADI and BFS
ASCENT TRAJ display.
Before L/O +90 seconds, BFS engage is the
crews only option for loss of guidance
and/or control. After 90 seconds, the crew
can try CSS.
Monitor the trajectory on the ASCENT ADI
cue card and the PASS and BFS TRAJ
displays. The shuttle bug and predictors
should follow the nominal trajectory line.
Also monitor the HSI for the inertial velocity
to be in the desired orbit insertion plane.

If the crew takes CSS, they should take

manual throttles. If the crew takes manual
throttles, manual shutdown is required unless
a low level shutdown occurs due to low
performance. The cue for MECO is the
MECO cutoff bug on the PASS or BFS
ASCENT TRAJ 2 display, or planned MECO VI
minus 150 fps.
Use OMS 1 TGTING cue card for system
problems and OMS 1/2 TGTING cue card for
performance problems to determine proper
OMS 1 and 2 targets.
CSS means manual throttle and manual
throttle means manual MECO.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.1 Ascent

7.1-12

USA007587
Rev. A

7.2

Tail Sun

ORBIT

Another inertial attitude, but with the -X axis

pointed toward the Sun. This is one of the
coldest attitudes.

CONTENTS
Attitude Control ...................................
Translation ............................................
Rendezvous/Proximity Operations ..
Orbit Rules of Thumb..........................

7.2-1
7.2-5
7.2-6
7.2-12

Nose Sun
Opposite to tail Sun. A semi-cold attitude used
to cool the aft section of the orbiter or to warm
the nose area, particularly the nose wheelwell.

Attitude Control
Orbiter attitude is primarily controlled automatically using either inertial attitude hold or
track mode. The universal pointing (UNIV
PTG) display, combined with the digital
autopilot (DAP) display and control panel C3
are used for automatic attitude control. For
manual attitude control, the RHC is also used.
Orbit flight control software includes the RCS
DAP, OMS TVC DAP, an attitude processor to
calculate vehicle attitude, and logic to govern
which DAP is selected. Attitudes calculated by
the attitude processor are displayed on the ADI
and UNIV PTG. Vehicle attitude is used by the
DAP to determine attitude and rate errors.
As part of mission planning, an attitude
timeline (ATL) is generated. While the Flight
Plan is being developed, the ATL is also
developed using information about payloads,
experiments, and other constraints. An ATL is
produced for both the Basic and Final versions
of the Flight Plan. When complete, the ATL is
incorporated into the Flight Plan, although it is
not usually flown.
Missions with large
numbers of time-critical maneuvers may carry
the ATL onboard and use it to perform
maneuvers.
Common Attitudes
While each shuttle mission is unique, some
attitudes are used frequently and are described
briefly in this section.
Top/Bottom Sun
These are inertial attitudes that point either the
+Z or -Z body axis at the Sun. They are normally
used for thermal control of payloads. Obviously,
a rotation angle about the pointing axis must be
defined to constrain the attitude. This is usually
flight-specific and is driven by look angles,
communications coverage, or other constraints.

Deorbit Prep Tail Sun

A special case of the tail Sun attitude designed
to cold soak the radiators prior to entry. This
is a track attitude using body vector of pitch =
184, yaw = 0, and OMICRON either 90 or 270.
Tail Sun Rotation
The coldest attitude for the payload bay. This is
an inertial attitude that keeps the -X axis
pointed at the Sun while phasing rotation to
keep the payload bay pointed away from the
Earth. It is used for thermal bending tests or to
meet specific payload requirements.
Passive Thermal Control (PTC)
This is another inertial attitude rotation about
the + or -X axis, but it maintains the Sun in the
Y-Z plane. The result is even warming of the
orbiter. PTC is sometimes called the barbecue
mode. It is used to meet various payload
thermal constraints.
Gravity Gradient
A stable attitude controlled by balancing
differential gravitational and aerodynamic forces.
The RCS is not used. Combined forces are very
small, and only a few stable attitudes exist.
These are difficult to establish and vary
according to altitude, inclination, time of year,
and many other variables. Gravity gradient is
used to conserve propellant or to inhibit RCS
firings during certain payload tests and
experiments.
Local Vertical Local Horizontal (LVLH)
This attitude maintains a constant orbiter
orientation to the earth. Typically, the Z axis is
pointed at the center of the earth with the

7.2-1

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A
-X axis pointed in the direction of the velocity
vector. This attitude (payload bay to the earth,
tail into the wind) provides excellent extended
earth viewing for the crew and PLB
experiments.
Displays
Attitude data for the attitude processor are
provided by the inertial measurement units
(IMUs). Rate data are derived from the IMUs
by dividing attitude delta by the time interval
between attitude measurements.
ADIs provide an analog attitude display
relative to three selectable reference frames.
These are selectable via the ADI ATTITUDE
switch. Inertial (INRTL) and reference (REF)
positions represent inertial reference frames.
Local
vertical/local
horizontal
(LVLH)
represents the orbiter in a fixed position relative
to a rotating reference frame.
In addition to the forward ADIs, which always
operate in the +X sense, the aft ADI may
operate in either a -X or -Z sense. Selection is
made using the ADI SENSE switch. This allows
proper orientation, depending on whether the
crewmember is viewing through the payload
bay (-X) windows (W 9/10) or the overhead (-Z)
windows (W 7/8).
The ADIs also display attitude errors that are
calculated from the difference between current
attitude and required attitude.
The error
needles are mechanized to indicate a fly-to
sense (i.e. the direction in which to maneuver to
null the errors). Rate needles are also fly-to (i.e.
the direction in which to maneuver to null the
sensed rates).
Control
Attitude control on-orbit is provided by the RCS.
The RCS is designed to control the orbiter
independently in each of three axes. Minimum
on/off cycle time for the jets is 80 milliseconds.
Vernier jets (25 lb thrust) are normally used on
orbit for attitude control since the primary jets
(870 lb thrust) use more propellant for fine
attitude control. Primary jets are used for
translation and higher rate attitude maneuvers.
ALT PRCS DAP uses the primary jets but limits
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

the number, duration, and spacing of jet firings to

achieve attitude control and RMS loading similar
to vernier jets.
OI-23 added notch filter capability. Simply
stated, notch filtering allows the crew to select
different frequencies to attenuate. This new
capability was driven by the previous need for
extensive preflight stability analysis in regard to
the acceptable RMS/payload position envelope.
Without notch filtering, the DAP may tend to
excite rather than damp attitude oscillations
caused by an unstable RMS/payload position.
For OMS burns, the OMS TVC DAP controls
OMS engine gimballing, allowing OMS engine
thrust vectors to be independently pointed
several degrees in any direction relative to the
orbiter c.g. This allows complete attitude control
with the OMS engines alone during normal twoengine burns. For single-engine OMS burns, the
RCS is used for roll control. The OMS TVC DAP
also contains an RCS wraparound capability.
If the attitude error exceeds 10 in pitch or yaw,
or 5 in roll during an OMS burn, RCS jets are
fired to correct the attitude.
DAP Configuration
The DAP uses current attitude to determine
attitude and rate errors.
Rotation rates and deadbands are functions of DAP
configuration. Values may be changed on orbit
using SPEC 20 DAP CONFIG. For convenience,
each planned DAP configuration is assigned a
number. The crew uses these numbers, which are
called out in flight data file procedures, to select the
proper DAP mode for maneuvers. Typically,
DAP A has lower rates and larger deadbands than
DAP B, making it more propellant conservative.
However, the various DAPs are configured in any
number of ways to meet mission objectives.
Attitude Control
Rotation and pointing maneuvers are required
to achieve correct attitudes for deployments, onorbit burns, star tracker operations, thermal
control, flyarounds during proximity operations, and pointing.
The RCS controls rotation independently in three
axes. Jets are appropriately located and oriented

7.2-2

USA007587
Rev. A
to provide this control. Two independent sets of
jets, primary (PRI) and vernier (VERN) are
capable of attitude control. Most on-orbit rotation
maneuvers are performed with the VERN jets.

error in any axis is the SPEC 20 attitude

deadband (ATT DB). Total error, displayed on
UNIV PTG, is the difference between required
and current attitude. Allowable rate error in
any axis is specified by the rate deadband
(RATE DB) on SPEC 20. When the flight control
software determines the orbiter is at the
required attitude, attitude hold is initiated.
NOTE
Manually maneuvering away from a
commanded
attitude
is
possible.
However, the DAP will return the orbiter
to the commanded attitude when AUTO
is reselected.
Track

UNIV PTG Display

The UNIV PTG display is used to control
automatic attitude maneuvers input by the
crew. By entering data on the UNIV PTG
display, the crew can command automatic
maneuvers to point a specific body axis at a
specified target, maneuver to a predetermined
attitude, rotate about a specified body axis, or
maintain attitude hold. The UNIV PTG display
also shows attitude information, errors, and
completion time for current maneuvers. Types
of automatic attitude maneuvers are presented
in the following summaries.
To perform an automatic maneuver, the crew
first enters the required data on the UNIV PTG
display for the desired maneuver. To start the
maneuver at a set time, that time is also entered
on the UNIV PTG display. After checking the
data, the crew enters an Item 18, 19, or 20, as
appropriate, to start the maneuver. With AUTO
DAP selected, an auto maneuver will begin at
the set time or as soon as Item 18, 19, or 20 is
entered if the maneuver start time is in the past.
Item 21 is used to cancel a maneuver.
Maneuver
The maneuver (MNVR) option is used to
maneuver the orbiter from current attitude to a
new inertial attitude specified on UNIV PTG.
AUTO maneuvers are three-axis at the rate
specified on SPEC 20. Maximum acceptable

The track (TRK) option is by far the most

complex in universal pointing software. There
are six subcases: orbital object tracking, center
of Earth, Earth-relative target, center of Sun,
celestial target (e.g., planet, Moon), and
navigation star target. Each subcase is selected
by a target ID (TGT ID) on UNIV PTG. The
TGT ID is the line of sight or target vector from
the orbiter c.g. to one of the defined targets.
The track option is used in conjunction with a
body pointing vector, which is centered at the
orbiter c.g. and is defined by a pitch and yaw
combination. These angles are referenced to the
orbiter +X axis.
Track software allows the crew to point a
specified body vector at one of the defined
targets. Attitude is not completely constrained
until body orientation about the body pointing
vector has been specified. Rotation about the
body pointing vector is called OMICRON. By
selecting a pitch, yaw, and OMICRON, a body
pointing vector and the orbiters orientation
with respect to that vector are specified.
When a TRK option is initiated, TRK software
performs a three-axis maneuver at the rate
specified by the current DAP, then begins active
track of the target. TRK subcases perform the
following functions:

7.2-3

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A
Orbital object tracking (TGT ID = 1)

Celestial target (TGT ID = 5)

State vectors of the orbiter and another orbiting

target are used to determine a relative target
vector. The target state vector is maintained by
the REL NAV software. This mode is used
post-deploy to track a payload. It is also used
extensively during rendezvous operations.

RA and DEC of a desired celestial object are

entered. TRK will then point the defined body
vector at this target and commence tracking it.
An astronomical target can be tracked in this
mode to point specific instruments. It may also
be used during payload deployment to provide
illumination or shading.

NOTE

Navigation star target (TGT ID = 11-110)

It is important to have REL NAV (RNDZ

NAV) enabled (SPEC 33, ITEM 1) prior to
tracking another orbiting body. It is also
important to disable a TGT ID = 1 prior to
an OPS transition. Although UNIV PTG
remains active in OPS 8, REL NAV does
not. Excessive fuel usage could occur due
to universal pointing chasing a stale state
vector.

TRK software contains the RA and DEC of 100

navigation stars that are defined by a number
(11-110).
Selecting a particular star and
defining a body vector allows TRK to point the
body vector at the star and track it. Obviously,
this mode can be used for star sightings. It may
also be used to point instruments.
Rotation

Center of Earth (TGT ID = 2)

Selected body vector is pointed at the Earth,
with orientation specified by OMICRON, and
maintained. This is, in effect, an LVLH attitude
hold, requiring the orbiter to establish a small
rotation rate that matches orbital rate. Center of
Earth tracking is frequently used on orbit for
normal operations that do not require specific
attitudes.

The rotation (ROT) option takes the body vector

defined by pitch and yaw and initiates a rate
(specified on DAP CONFIG, SPEC 20) about it,
while holding that axis in an inertial attitude.
NOTE
Transitioning to OPS 8 with an active
rotation continues the rotation. Ensure
correct DISC RATE is selected prior to
transition, since neither UNIV PTG nor
DAP CONFIG (SPEC 20) is available.

Earth-relative target (TGT ID = 3)

Latitude, longitude, and altitude of an Earth
target are entered on UNIV PTG.
This
determines target line of sight from the orbiter.
TRK maintains this attitude.
Latitude and
longitude are entered in degrees. Altitude is
entered in nautical miles. Typically, primary jets
will be required to maintain this track as the
orbiter flies over the target.
Center of Sun (TGT ID = 4)
Present values of right ascension (RA) and
declination (DEC) are used to determine line of
sight to the center of the Sun. TRK then
maintains the proper attitude. RA and DEC on
the UNIV PTG display are updated with each
new recall of TGT ID=4 as the Sun RA and DEC
change.
This mode is used primarily for
thermal control.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

Cancel
Executing the cancel (CNCL) item on UNIV
PTG snapshots and maintains current inertial
attitude. All other current and future options
(MNVR, TRK, ROT) are terminated. CNCL is
selected automatically when entering OPS 2
from any OPS except OPS 8. Otherwise, the
crew must select CNCL via an ITEM entry.
Manual Attitude Control
The RHC controls roll, pitch, and yaw
movements on orbit with the OMS and RCS.
Flight characteristics depend totally on DAP
configuration. Various DAP configurations have
been optimized for certain tasks, using off-line
simulation. With the DAP mode in INRTL, and
DISC RATE selected on panel C3 or A6U,

7.2-4

USA007587
Rev. A
deflecting the RHC out of detent fires
appropriate RCS jets until an angular rate is
achieved in that axis equal to the rate specified in
the DAP CONFIG display (SPEC 20). Different
rates may be specified for DAP A and B, and for
PRI or VERN jets. When the rate is achieved, the
jets are turned off until the RHC is returned to
detent or deflected in another axis. Jets also fire
to maintain attitude or rates within selected DAP
CONFIG deadbands. Returning the RHC to
detent snapshots the attitude, and jets are fired to
stop rates and hold the snapshot attitude.
Deflecting the RHC beyond the soft stop causes
jets to fire continuously, producing a constant
angular acceleration.
When the RHC is
repositioned inside the soft stop, jets are turned
off, but rates continue until the RHC is returned
to detent.
With PULSE selected, RHC deflection fires jets
to achieve the angular rate change specified by
rotational pulse (ROT PLS) on SPEC 20. PULSE
is also a free drift mode.
High Rate Attitude Maneuvers
To quickly maneuver to attitude in an
emergency, a high maneuver rate may be
required.
With the appropriate DAP
ROTATION in DISC, bump the RHC past the
soft stop and back within the soft stop several
times until the desired rate is achieved, being
careful not to let the RHC return to detent. Stop
the maneuver by returning the RHC to the
detent. It will be necessary to lead the desired
attitude by an amount proportional to the
rotation rate.
Flying Techniques for COAS /HUD
Calibrations and HUD IMU Alignments
To perform a HUD (or COAS) calibration or
IMU alignment using the HUD, the orbiter must
be maneuvered manually to align the HUD test
pattern (or COAS reticle) with a preselected
star. The largest portion of the maneuver will
be performed using a coarse control DAP with
rates and deadbands selected to minimize
maneuver time without exceeding propellant
allotments.

Once the star is near the proper location in the

HUD test pattern, the crew must switch to a
DAP optimized for fine attitude control. A
vernier DAP will provide the finest attitude
control with minimum fuel consumption.
Patience is very important when attempting to
properly locate the star in the HUD test pattern.
After making an RHC input, wait until
movement is noticed, and the star is near the
desired position before releasing the RHC. This
will minimize jet firings and fuel consumption.
The coarse control DAP will usually allow
higher maneuver rates than the fine control
DAP. The higher rates require more time to
start and stop so pilots will notice a requirement
to lead RHC inputs when using the coarse
control DAP (i.e., return the RHC to the center
detent slightly before the star reaches the
desired position in the HUD).

Translation
Orbit translation maneuvers can be conducted
using the OMS engines or RCS jets. The OMS
engines are usually used for larger maneuvers.
Burn targets for preplanned orbit OMS or RCS
burns are normally transmitted to the crew
from Mission Control. The crew will then load
those (or verify auto-loaded) targets and
execute the burn at the appropriate time.
OMS/RCS burn monitoring and control for
orbit burns is similar to that discussed in
Section 7.3.
RCS Translation
The RCS is used to control translation when
small velocity changes are required.
For
example, the RCS might be used for the initial
maneuvers used to separate from a payload
after deploy. In these situations, the CDR/PLT
uses the THC and DAP panel to transmit
control commands to the GPCs and ultimately
to the RCS jets.
Translation flight characteristics depend on
DAP panel configuration and the DAP
parameters listed on the DAP CONFIG display.
DAP parameters are optimized for planned
tasks preflight, using off-line simulation.
THC deflection with PULSE selected on the
ORBITAL DAP panel fires jets to cause a

7.2-5

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A
velocity change as specified on SPEC 20.
Selecting NORM allows continuous acceleration
as long as the THC is deflected. HIGH Z is a
submode available for +Z translations only.
Selection of this submode fires all nine upfiring
jets and should be used only in an emergency.
LOW Z is a submode that allows +Z translations
by firing +X and -X jets simultaneously to
minimize payload/Space Station pluming.
LOW Z translations also affect pitch and roll,
since upfiring jets are inhibited. There are
significant translational cross-coupling effects in
this mode.

Rendezvous/Proximity Operations
Rendezvous and proximity operations require
coordinated attitude and translation maneuvers
to join with or maintain a position relative to
another orbiting object. This section covers
some of the tasks and problem areas
encountered during rendezvous and proximity
operations along with some suggested techniques. The normal rendezvous sequence is
presented in the orbit mission events summary
in Section 5. For a more detailed discussion of
Rendezvous/Proximity Operations, refer to the
Rendezcous Concepts CBT Lesson.
Plume Impingement
For translations near targets, there is a concern
about contamination and also the induced body
rates and torques caused by an RCS jet plume
striking the target. Certain types of payloads
may be sensitive to propellant contamination.
For example, a payload with delicate optical
equipment could be damaged by the plume from
an RCS jet at a short distance. Selecting which
jets to fire, as well as distance and orientation of
the orbiter with respect to the target, may be
adjusted to reduce contamination.
Nearly all payloads are sensitive to the force
and resultant body rates/torques caused by an
RCS jet firing at close range. Usually, a sphere
of influence is identified, and no upfiring jet
firings at the target are allowed within it;
typically, 200 ft to grapple range for small
payloads and 1000 ft. for large payloads and
stations.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

Braking Techniques
Braking is used to reduce relative velocity
between the orbiter and a target. Three techniques will be discussed: Norm Z, Low Z, and
orbital mechanics effects.
Norm Z braking uses upfiring jets to generate
braking in a +Z direction. Since the jets
pointing toward the target provide the braking
force, plume impingement is a concern.
Low Z reduces plume impingement by using
the cant of the +X jets and scarfing (design of
the nozzle) of the -X jets to produce a resultant
force in the +Z direction. Low Z braking can
use up to 12 times the amount of propellant as
Norm Z. This mode should only be used where
plume impingement must be minimized. When
in Low Z, Y-axis jet firings induce higher
closing rates, requiring expensive braking
maneuvers.
CAUTION
Due to cross-coupling effects, minimize Yaxis translations when flying in low Z
mode (increases closure).
Orbital mechanics may provide small separation forces for various approaches. This may be
used effectively for plume-sensitive targets and
to help minimize propellant usage. The best
illustration of this concept is the +R-bar
approach, where natural braking (slowing of
the orbiter) lessens the requirement for
+Z thrusting.
Stationkeeping
Stationkeeping is the technique used to
maintain the orbiter at a desired relative
position, attitude, and attitude rate with respect
to a target vehicle. When stable in a stationkeeping position, the crew has time to obtain
navigation information and determine and set
up approach maneuvers. Stationkeeping most
commonly is performed on the targets velocity
vector (V-bar) or the radius vector of the target
to the center of the Earth (R-bar).
V-bar stationkeeping can be accomplished
either ahead of (+V-bar) or behind (-V bar) the
target. For a given range V-bar stationkeeping

7.2-6

USA007587
Rev. A
uses less prop than R-bar stationkeeping since
both the orbiter and the target are nearly in the
same orbit.

Target
+ V-bar

-----

------

- V-bar

This is an unstable configuration, since orbital

mechanics effects will result in the orbiter and
target changing their relative positions over an
extended period. R-bar stationkeeping is more
complex and requires higher propellant usage.
About 0.5 lb/ft range per rev, above and
beyond V-bar usage, is required (600 ft. = 400
lb/orbit).
Stationkeeping position is maintained using the
COAS, rendezvous radar, lasers, and CCTV
triangulation. The crew must judge when attitude and translation corrections are necessary
and make corrections manually. Typically,
attitude is controlled by UNIV PTG so the crew
has only translation corrections to maintain
position.

Earth

For convenience, stationkeeping operations are

classified by range (close in, short, medium, and
long). There are significant differences between
techniques used at different ranges.

869.cvs

V-Bar Stationkeeping
This results in the most efficient type of
stationkeeping because minimal propellant is
required to maintain the orbiter at the same
altitude and coplanar with the target. At about
600 ft on the V-bar, position can be maintained
for about 100 pounds of propellant per orbit,
using optimum techniques.

RANGE

DISTANCE

Close in

35 - 200 ft

Short

200 - 1000 ft

Medium

8 miles

Long

40 miles

Stationkeeping Ranges

_____

Similarly, R-bar stationkeeping can occur either

below (+R-bar) or above (-R-bar) the target.

- R

______

Target
+ R

Earth

870.cvs

R-Bar Stationkeeping

7.2-7

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A
Close In
Close in techniques are required after the orbiter
has achieved a stable position near the target.
Alignment with the desired target axis may or
may not have been completed.
Orbital
mechanics effects are minimal, and flying is done
using a combination of out-the-window and
CCTV cues. Most payloads will use Low Z
operations in this area.
NOTE
Low Z requirements are defined for each
rendezvous mission so may vary from
these generalized descriptions. Close in
stationkeeping requires constant attention
by the crew. A flyaround or matching the
targets rates may be required to affect a
capture.

These require visual translation guidance

techniques that can be described by three types of
targets: inertially stabilized, fixed in LVLH frame,
and arbitrary rate.
Inertially stabilized targets usually have some
type of control system or are spin-stabilized. To
keep the same relative geometry, the orbiter
must also maintain inertial hold. This requires
a constant translation to stay in the desired
orientation to the target and maintain the
desired range. Procedurally, UNIV PTG and
the DAP: INRTL are used to automatically
maintain inertial hold, while the crew uses the
THC to maintain the Z orbiter axis pointed at
the target at the desired range.

Short Range
Short range techniques are used after the orbiter is
positioned on the desired target axis or
immediately after target deploy.
Orbital
mechanics effects cannot be ignored, and plume
impingement must be considered for larger
payloads (HST, Station). The primary tasks are
matching attitude rates and translating to
maintain correct relative position on the desired
target axis.
Z
Z
X
X

2
Earth

Earth

Z
Stationkeeping WRT inertially stabilized target

Inertial Stationkeeping

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

7.2-8

872.cvs

USA007587
Rev. A
Z
1

X
X
2

4
Earth

Orbiter stays in same LVLH

position (on target V-bar)

X
3
Z

Stationkeeping WRT target rotating in inertial frame

at orbital rate (i.e., target attitude fixed relative to
LVLH frame)

873.cvs

LVLH Stationkeeping
Some targets may be maintaining a constant
attitude relative to the LVLH reference frame
and therefore rotating in the inertial frame at
orbit rate. The target may have an active or
passive (gravity gradient) control system.

approaches a boundary, a maneuver is

performed to drive it back to the center. This is
repeated as required. Orbital mechanics effects
can be used to maintain the football with
minimal maneuvering required.

The orbiter maintains a fixed position and

attitude with respect to the targets LVLH
reference frame. Procedurally, UNIV PTG or
LVLH is used to automatically control attitude,
and translation is controlled manually. Since
LVLH stationkeeping is much more stable than
inertial, fewer translation inputs are required to
maintain position.

Long Range

Should the target lose its control system,

causing it to rotate at an arbitrary rate about a
principal axis of inertia, stationkeeping becomes
more difficult. Either an inertial or LVLH mode
may be used, depending on the situation.
Medium Range
Medium range stationkeeping may be required
during
long-term
payload
checkout/
troubleshooting or recovery from an orbiter
malfunction. Burns are targeted by MCC or
onboard using NAV state data.
Attitude
maneuvers are performed using the AUTO
DAP.
The radar should provide relative
position information. One technique, called a
football, attempts to keep the orbiter within
some predefined boundary centered at some
range on the V-bar.
When the orbiter

Long range stationkeeping is typically done at 40

n. mi. (or greater). This is usually done to
support a possible rendezvous at some later time
in the mission (similar to HST deploy). This
stationkeeping is usually maintained by ground
targeted coelliptic (NSR burns) and is done on
the V-bar.
Prox Ops Techniques
Whenever possible, use the DAP and UNIV
PTG to automatically maintain attitude. Select
vernier jets for attitude control to conserve fuel.
Aim for an ideal target position in the -Z
COAS reticle. Typically this is in the lower half
of the COAS to keep the CGs close.

7.2-9

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A
The orbiter will continue pointing a specified
body vector (usually -Z) at the target. In
contrast to a flyaround, which requires the
orbiter to actually fly around the target in an
inertial sense, a transition involves moving the
orbiter around the target in a target-centered,
rotating LVLH reference frame without regard
to the targets inertial attitude. Transitions can
be completed by placing the orbiter in inertial
attitude hold with the -Z axis pointed toward
the target (inertial stationkeeping), or by
pitching the orbiter (tail up or tail down).

+
+
+
+
+

10
+ _ + _ + _ + _ + _ _ _ + _ + _ + _ + _ +}

+
+
+
+

1 degree

874.cvs

COAS Sight Picture

Translate using the THC to maintain this
position.
Small inputs and patience
are
essential. When rates are low, use the smallest
translational pulse size available. Use vernier
jets for attitude control. Maintain the payload
in an imaginary box, sized to reflect attitude
deadbands, about the ideal position and
translate only when the target moves out of a
self-imposed box which is about two times that
attitude deadbands.
NOTE
It is more important to null the rates in
the COAS (keep it stationary) than to
drive it to the ideal position.
This will reduce fuel consumption and take
maximum advantage of orbital mechanics effects.
Use radar and REL NAV (SPEC 33) to maintain
distance and range rate.
NOTE
The tendency is to focus on keeping target
position fixed in the COAS. A good scan
and crew coordination are necessary to
control range rate and maintain distance.
Transition
Transitions are maneuvers that maintain the
orbiter at a constant distance from the target
while it moves from one position to another.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

Flying a transition from the +V-bar to the -R-bar

(90 of the orbit) using a pitch maneuver is
similar to inertial stationkeeping for of an
orbit. Which transition is selected depends on
propellant or time/lighting concerns.
Separation
Translating away from another object requires
establishing an opening rate between the
bodies. Usually, relative state vectors are well
known, and a planned sequence can be
followed to minimize propellant usage.
However, payload sensitivity to plume
impingement and payload control system
characteristics tend to complicate separation
maneuvers. Long- and short-term recontact
must be considered; therefore, some separation
sequences
require
multiple
separation
maneuvers. Separation is usually performed in
two stages. A small separation burn (< 1 fps) is
performed to start opening, then a larger burn
is performed when the orbiter is further away.
Cross-Coupling Effects
Because the thrust of the RCS jets is not through
the orbiter c.g., commanded translation/
rotation maneuvers in one axis tend to induce
motion in other axes, which is called crosscoupling; it can have a significant impact
during rendezvous manual phase and
proximity operations.
With the orbiter on the target V-bar, tail-toEarth, and payload bay toward target, the crew
should be aware of cross-coupling effects, as
follows:

7.2-10

USA007587
Rev. A
NORM ROLL: Affects every degree of
freedom. Much worse in LOW Z than
NORM Z .
NORM X:
Induces braking (+Z)
translations, and pitch cross-coupling.
When flying Prox Ops, use the 1 to 5
Rule: 1 +Z input for every 5 X inputs.
NORM -Z: Significant +X translation.
LOW Z +Z:
negative pitch cross
coupling, translation pulse may loose
half its force due to counteraction of
attitude firings when in attitude hold.

Vernier jets, when used for attitude control,

induce their own cross-coupling effects. Even
though verniers produce much smaller forces
than primary jets, their geometry is even more
awkward. All vernier firings induce translational cross-coupling in the -Z direction. This
can induce significant downtrack errors in
orbiter position that are important during
rendezvous over long periods. This verneffect can cause unwanted closure during prox
ops.

LOW Z Y: In attitude hold, major closing (-Z) rates induced, more than half the
size of commanded Y-axis translation.

NOTE
The crew must closely monitor R-dot
using all ranging devices (CCTV, radar,
laser, COAS) to avoid undesirable closing
rates.

ROLL/PITCH deadbanding:
using
Primary jets, induces a small opening
(+Z) rate. In LOW Z, causes a major
closing (-Z rate).
Minus pitch also
produces a significant +X translation
when in LOW Z.
TAIL ONLY: A control mode used to
conserve forward RCS propellant. Pitch
maneuvers induce a powerful Z
translation and a significant +X
translation. Yaw induces a powerful Y
translation and noticeable X and Z
translations. All other control mode
effects are identical to normal control
(NOSE and TAIL).
NOSE ONLY: For pitch, translational
effects are mirror image of TAIL ONLY,
except no X effects.
Yaw is also
opposite
to
TAIL
ONLY,
but
significantly reduced. (NOSE-ONLY is
rarely used.)
These effects point out the requirements for
patience after performing translation pulses.
Crewmembers should learn how to separate
translational motion from deadbanding (keep
ADI needles and UNIV PTG in your scan) Cross
coupling must be understood. Techniques are
developed through practice in simulation
facilities.

7.2-11

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

USA007587
Rev. A

Orbit Rules of Thumb

In propellant-limited situations, use the
following guidelines:
Use Verns for attitude hold and ALT
DAP for attitude maneuvers.
To conserve forward RCS, use TAIL
ONLY control mode.
Prox Ops
Null rates (all axis)
Null out of plane velocity at the
node
Do not confuse deadbanding with
translation
Anticipate (do not fight) orbital
mechanics effects
Range rate is the most important
parameter

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.2 Orbit

7.2-12

USA007587
Rev. A

7.3

ENTRY

CONTENTS
Overview of Entry Flying Tasks ........
Deorbit Burn .........................................
Entry ......................................................
Backup Flight System ..........................
Sensory Cues.........................................
Ground Controlled Approach............
Entry Rules of Thumb .........................

7.3-1
7.3-1
7.3-4
7.3-12
7.3-12
7.3-13
7.3-14

Navigation errors
L/D dispersions
Atmosphere variations
Winds
Deorbit execution errors
GNC failures
Degraded performance

Any of these conditions, if left uncorrected,

could lead to unrecoverable range problems or
loss of vehicle control.

Overview of Entry Flying Tasks

The entry phase of flight covers the transition
from Earth orbit to the end of landing rollout.
Guidance phases for portions of the entry
phase are deorbit burn guidance, entry guidance,
TAEM guidance, and approach/land guidance.
Monitoring
Crew monitoring of performance is required
throughout entry. This subsection presents the
information necessary to monitor and control
the vehicle during the deorbit burn and entry
phases of guidance. This task consists of
monitoring vehicle displays to determine if
guidance, navigation, and flight control are
performing correctly and taking action, if
required, to ensure a safe landing. An in-depth
knowledge of how these systems work, along
with an understanding of the reference
trajectory and orbiter flight control system
(FCS) will enable crewmembers to recognize
off-nominal situations and correct them before
serious performance or control problems
develop.
Takeover
Takeover rules and criteria are described in the
Flight Rules.
Interpretation of onboard
information will aid the crew in their
assessment of when to manually intervene.
From the available information, the crew
assesses the performance of the automatic
guidance system and remains prepared to take
over with manual guidance for off-nominal
situations. Some of the conditions requiring
crew takeover are:

Guidance and flight control perform well. It is

highly unlikely manual takeover will be
required. MCC is also available to help with a
ground controlled approach (GCA).
Manual Control
In some instances, the crew will be required to
take manual control and fly the orbiter. The
Deorbit Burn and Entry sections contain the
basic principles for CSS flying, although these
portions of the flight profile are normally flown
in AUTO. Manual flight control is the normal
mode of operation from .96 Mach until the
completion of rollout. (This portion of the flight
profile is discussed in detail in Section 7.4.)
Self-generated guidance based on navigation
information will be discussed, but if guidance is
good, flying the error needles in CSS will result
in the most consistent tracking of the planned
entry trajectory.

Deorbit Burn
Monitoring
Normally, the deorbit burn will be flown in
AUTO using both OMS engines. The OMS
engines are gimballed to control orbiter attitude
in all three axes. Capability exists to downmode
from both OMS engines to one OMS engine, to
the aft +X RCS jets, or to the forward -X RCS jets.
The burn time of ignition (TIG) is selected to
protect for one OMS engine failure at TIG or at
any time during the burn. A single OMS engine
can control pitch and yaw, but roll must be
controlled by the RCS. If flight control does not
recognize the OMS engine failure, control will be
sloppy but acceptable. Deorbit burns using the
RCS only must be flown manually.

7.3-1

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
The DEORBIT BURN, DEORBIT BURN
MONITOR, and the DEORBIT BURN FLIGHT
RULES cue cards are used to determine the
required actions for malfunctions affecting the
burn. The philosophy embodied in these cards is
to either safely complete the burn or stop the burn
above a safe altitude.
The ADI error needles are used to monitor
guidance and control during deorbit burns. The
body axis burn velocity components (VGOX,
VGOY, and VGOZ), along with TGO and
VTOT, should also be cross checked.

An SM alert and DAP DNMODE RHC

message will annunciate with OI-28 and subs
software.
NOTE
Propellant-wasting, out-of-plane deorbit
burns will have a PEG 7 delta VY (LVLH)
component. If no propellant is wasted
then the PEG 7 delta VY is typically zero.
OMS burn thrust vector control (TVC) is
calculated independently from the ADI error
needles.
OMS TVC gimbals the OMS engines to
null vehicle rates and point sensed
thrust in the desired VTOT direction.
ADI error needles display vehicle
attitude error from the attitude that
would point the net thrust through the
c.g., as defined by the trim angles, and
in the desired VTOT direction. If trim
angles are incorrect or flight control
does not recognize an engine failure, the
ADI error needles will not display
correct error information.

DEORB MNVR Display

Monitoring the VGOs in addition to the error
needles provides insight into the status of
guidance during the burn. The TTG field will
blank when the orbiter is in burn attitude. The
VGOx prior to TIG will be 80% of Vtot when
the vehicle is in burn attitude. To monitor burn
progress, the crew can watch VGOs, HA, and
HP during the burn. The VGOs display how
much V is left to go in orbiter body axis
coordinates. For any OMS or RCS burn, most
of the burn should be in the appropriate X
direction.
HP will gradually increase or
decrease, depending on whether the OMS burn
is posigrade or retrograde. For deorbit burns,
HP should always decrease.

For a +X RCS burn, the ADI error needles are

correct, as long as flight control recognizes that
it is an RCS burn. Error needles are never
correct for a -X RCS burn.
Approaching cutoff, the crew should monitor
current HP approaching targeted HP, TGO
approaching zero, and VTOT approaching
zero. If TGO goes to zero, and the OMS engines
do not cut off (chamber pressure zero and
engine valves closed), the OMS engine switches
should be turned OFF to prevent an overburn.

WARNING
Since the flight controller power is ON, the
RHC is hot during an OMS burn. The
DAP will mode to manual (INRTL) if the
RHC is bumped. The message DAP
DNMODE RHC will be annunciated.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

7.3-2

USA007587
Rev. A
on the MNVR display or downmode to MAN
DAP and maneuver back to ignition attitude.
The deorbit burn attitude is entered in a
controlled, timely manner, and the burn can be
postponed for an unacceptable attitude error.

NOTE
OMS guidance will cut off, based on
VGOX. If out of attitude, there will be
large residuals in VGOY or VGOZ after
the burn is complete. VGOZ residuals
should be trimmed by the CDR using the
THC, per the Deorbit Burn cue card
procedure.
If an early cutoff occurs, the appropriate
procedure from the Deorbit Burn cue card
should be executed to achieve deorbit targets.
OMS propellant, aft RCS, forward RCS, and
prebank may be used to recover the underburn.
If the underburn magnitude exceeds RCS and
prebank capability, landing site redesignation
may be required.
For more detailed
information on OMS burn downmoding,
consult the appropriate Flight Procedures
Handbook.
Takeover
Deorbit burns are normally flown in AUTO
flight control and are started and stopped by
GPC commands. Duration of the burn, as well
as maintaining proper attitude during the burn,
are the two most important criteria.
If while perigee is still above SAFE HP a failure
occurs that severely impacts OMS capability,
the crew will stop the burn.
SAFE HP
guarantees at least 24 hours of orbit time, which
MCC can use to properly retarget the deorbit
burn and assess the impacts of the failure.
On the other hand, if the failure occurs below
SAFE HP, the crew must do what they can to
complete the deorbit burn, which includes
using the aft and forward RCS and possibly a
recovery prebank.
Given a normal doerbit burn, EI targets will be
met within allowable tolerances if the post burn
residual V is within 2 fps. Specifically, a 2 fps
underburn equates to a 30 nautical mile (n. mi.)
energy error at EI, which is well within
guidance capability.
A 3 attitude deadband is used in the TRANS
DAP. Attitude error or deviation greater than
3 prior to the burn indicates a flight control
malfunction. The crew should check ITEM 27

Deadband in the TVC DAP is very small. If

ignition has occurred, a manual takeover
should be performed for unexplained deviations greater than 5.
NOTE
Engine out transients may cause a
momentary attitude deviation greater
than 10. These transients are an excellent
confirmation of an engine out. Manual
takeover should not be required.
Manual Control
Fly the error needles or the ADI REF ball if
available. Cross-check the VGO components.
During OMS TVC DAP attitude maneuvers,
keep rates reasonable (less than 2 deg/sec).
Approximate VGO component fractions of
DVTOT depend on the type of burn. If only one
OMS engine is used, yaw the vehicle about 10
into the good engine. Normally, manual flight
control during an OMS burn requires very few
RHC inputs once the guidance needles are
centered, and the TVC DAP begins attitude hold.
For an RCS-only burn, the attitude deadband is
3, and the burn is flown manually using the
RHC for attitude control and the THC for the
burn with four +X aft RCS jets.
One technique for +X RCS burns is called the
Patterson Maneuver.
Here, the crew first
maneuvers the vehicle to the proper burn
attitude, as displayed on the MNVR EXEC
display. Then they pitch the nose up 3 high.
So, when they start the burn with the THC, the
vehicle will pitch down to the correct attitude,
since aft RCS jets are above the c.g., and the 3
deadband will hold it there. A variation on the
technique is to start the burn in attitude, allow
the vehicle to pitch down toward the 3
deadband limit, then pitch up 6 to the other side
of the deadband. The vehicle will slowly pitch
back down and hold the desired attitude.

7.3-3

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
It is also acceptable to just keep the needles
centered using small RHC inputs. This technique requires constant inputs in pitch and will
use more propellant to hold attitude, but is
easier to remember than the Patterson maneuver. For short RCS burns, the extra propellant
usage is minimal.

2.5 g Nominal
Load Boundary

Drag Acceleration
ft/sec 2

50

The VGO ratio table below lists appropriate ratios

of VGOX,Y,Z to VTOT for different burn
maneuvers.

40

Surface
Temperature
Boundary

30

342 lb/ft 2
Dynamic
Pressure
Boundary

20
10
0

Zero Bank Equilibrium

Glide Boundary

35

30

25

20

15

10

Relative Speed - Thousands of FPS

879.cvs

VGOx
VGOy
VGOz

BOTH
OMS

L (R)
OMS

+X
RCS

-X
RCS

1
0
1/4

1
1/5 (-1/5)
1/4

1
0
1/6

-1
0
1/3

Entry Trajectory Constraints

VGO Ratios
NOTE
A BFS OMS burn is targeted in the same
manner as PASS, but must be flown
manually.

Entry
Monitoring
During the entry phase, guidance provides
steering commands for trajectory control from
initial penetration of the atmosphere (about
400,000 ft) at a range of about 4100 n. mi. from
the landing site, until TAEM (2500 fps, about
60 n. mi. from landing site at an altitude of
about 80,000 ft). The primary objectives of entry
guidance are:

Entry navigation (NAV) computes the orbiters

position, velocity, and distance/direction to the
landing site. NAV also computes Mach, q-bar,
and alpha. There are numerous interfaces
between NAV and flight control. The crew
optimizes NAV performance by accepting or
inhibiting five types of sensed data: drag-H,
TACAN, air data, MLS, and GPS. Bad NAV
information can cause flight control problems,
since NAV information is used to tailor flight
control for the varying flight regimes
encountered. Mission Control monitors navigation performance during entry using tracking
data. TACAN and air data should not be
accepted to NAV, or air data accepted to G&C
without a go from Mission Control, unless
communication capability is lost.
WARNING
Large NAV errors can cause loss of vehicle
control, because NAV data are used to
select control effectors and set control
gains.

Guide the orbiter along a path that

prevents exceeding structural, thermal,
and stability design limits.
Deliver the orbiter to a satisfactory
energy state and vehicle attitude at
initiation of TAEM guidance.
Entry guidance is based on drag control. The
correct drag level is calculated, based on Mach
(velocity) and range. Bank is then used to
control lift until the desired drag is established.
Entry trajectory constraints are shown in the
following chart.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

Dedicated instruments, DPS displays, and cue

cards are available to assist the crew in
monitoring entry performance.
The ADI,
alpha/Mach indicator (AMI), and the
altitude/vertical velocity indicator (AVVI) are
the primary dedicated instruments for
monitoring entry performance. Five ENTRY
TRAJ displays are available for monitoring
entry guidance. ENTRY cue cards are used as
references to compare actual and predicted
performance.

7.3-4

USA007587
Rev. A
After the deorbit burn, the crew transitions to
MM 303 and maneuvers to the EI-5 attitude that
was uplinked with the deorbit targets and
voiced up in the DEL PAD.
During the early part of entry, the RCS
command lights are a good indication of DAP
activity. If the crew transitions to MM 304 at
EI-5, the vehicle will be very close to attitude,
and only occasional jet firings will occur as
attitude drifts back and forth between DAP
deadbands. If the crew is late transitioning to
MM 304, or if an attitude error has been
allowed to develop while working system
problems, a large number of jet firings can
occur. Up to 250 lb of RCS propellant can be
wasted. Crews should closely check that the
orbiter is in the proper attitude prior to MM
304.
From q-bar = 0 to q-bar = 0.5, the RCS only is
used for attitude control. From q-bar = 0.5
(12 KEAS) to q-bar = 8.0 (48 KEAS), the elevons
will trim in response to pitch jet firings. At
q-bar = 2.0 (24 KEAS), the elevons are used for
control. At q-bar = 40 (109 KEAS), the pitch jets
are turned off.
At q-bar = 10 (54 KEAS), the roll jets are
deactivated. Yaw jets continue to fire for bank
control until Mach is less than 1.0. Yaw jets
should fire from both pods at a similar rate
(symmetric firings).
At q-bar = 50 (122 KEAS), the RCS PITCH and
ROLL activity lights are reconfigured. Illumination
of the PITCH light indicates elevon or aileron rate
saturation. Three or more yaw jet commands turn
on the ROLL light. The yaw jets are terminated at
Mach 1. The PITCH jet light will continue to
indicate elevon and aileron rate saturation.

Orbiter performance during bank maneuvers is

the pilots cue to dynamic stability characteristics. The two most important factors the crew
must monitor are YAW jet activity lights and
roll rate. The first roll command is at 3 deg/sec;
subsequent roll reversals are commanded at 5
deg/sec.
The rate of roll maneuvers is
important to minimize H-dot and drag
excursions. Prompt execution of roll commands
will minimize the bank angle required to
establish the desired drag profile.
Using the ADI, AMI, and AVVI, in conjunction
with the ENTRY ALPHA cue card, allows the
crew to monitor vehicle performance relative to
pre-mission planned trajectory.
Comparing
alpha, range, altitude, H-dot, and roll reference to
actual values is a good crosscheck on guidance.
The data on this card is flight (and planned
entry) specific, but most of the data is useful on
any entry.
The only data that changes
significantly is the direction of Rref (reference roll
angle). The magnitude of Rref does not change
much.
ENTRY ALPHA Cue Card
Five DPS displays are the primary displays for
entry monitoring or manually flying entry.
ENTRY TRAJ 1 appears at MM 304 (OPS 304
PRO). TRAJ 2 through 5 appear at predetermined velocity breakpoints. Each display is a
continuation of the previous one.
In the center of the ENTRY TRAJ display there
is a dynamic plot of velocity (Y-axis) vs. range
(X-axis). An orbiter bug is placed on this
display as a function of range and velocity. The
dashed drag lines are used to determine the
desired drag for the current range and velocity.
Interpolation is required. For example, the
orbiter bug on TRAJ 1 shows desired drag of
14 fpss.

7.3-5

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
30 41 /
D
50 50

45

ENT RY TRAJ 1

1 BI AS[ ]
D REF 1 4.
40 q
4 0.
AZ +1 3.

40

L O ENRGY
3 0 3 I NH

35

20

0
8
7
7

3 04 1 /
D
45
50

01 0/ 18 : 36 : 2 4
00 0/ 0 0: 12 : 2 4
10 D
8D
6D

20 D

ENT RY T RAJ 4

1 BI AS [ ]
D REF 26 .
40 q
1 97 .
AZ + 15 .

40

15 D

35

LO ENRGY
3 0 3 I NH

30

20

0 10 / 18 : 4 5: 4 1
0 0 0/ 00 : 2 1: 4 5
4 0D 3 0D

0
4
6
1

25 D

- 16 0

- 40

30

10

25

0
- 180
RESUME

NY
NY TRI M
AI L
RUD
ZERO H BI
H BI AS
REF
ROL L REF
CMD

- 10 0

. 00 0
. 00 0
R0 . 1
0. 0
AS 2
0
- 1 04
L 61
L 63

25

45

ENT RY T RAJ 2
4 5D

40

LO ENRGY
3 0 3 I NH

35

20

0
- 2 75

L . 0 02
. 0 00
L 0. 6
0. 0
AS 2
- 40
- 28 7
R 54
R 50

RESUME

54 1

529

1 BI AS [ ]
D REF 30 .
40 q
97 .
AZ + 6 .

10

20

ENTRYTRAJ4Display(Mach10Mach5)

ENTRY TRAJ 1 Display (Mach 25-Mach 17)

3 04 1 /
D
50
50

NY
NY T RI M
2 0D AI L
RUD
Z ERO H BI
H BI AS
REF
ROL L REF
- 2 30
CMD

0
7
6
4

3 04 1 /
D
30
50

1 0 10 / 18 : 4 0: 5 6
0 0 0/ 00 : 1 6: 5 7
3 5 D 25 D 20 D

25

15 D

1 BI AS [ ]
D REF 23 .
40 q
1 94 .
AZ + 6 .

20

LO ENRGY
3 0 3 I NH

15

20

ENT RY T RAJ 5

0 10 / 18 : 4 7: 29
00 0/ 00 : 2 3: 30
30 D 2 0D

0
1
2
5

- 27 5

30

10

25

0
- 1 25

- 1 90

NY
NY T RI M
AI L
RUD
Z ERO H BI
H BI AS
REF
ROL L REF
CMD

RESUME

R. 0 1 0
. 0 00
L 0. 2
0. 0
AS 2
5
- 11 6
L 64
L 58

10

40

- 2 45

1 BI AS [ ]
D REF 33 .
40 q
1 33 .
AZ - 8 .
LO ENRGY
3 0 3 I NH

30

20

20

ENT RY T RAJ 3

1
4 5D

- 2 75

. 0 00
. 0 00
L 0. 1
L 0. 2
AS 2
0
- 26 8
L 42
L 43
542

53 0

35

25

0
RESUME

ENTRY TRAJ 5 Display (Mach 5-Mach 2.5)

ENTRY TRAJ 2 Display (Mach 17-Mach 14)

3 04 1 /
D
45
50

10

NY
NY T RI M
AI L
RUD
Z ERO H BI
H BI AS
REF
ROLL REF
CMD

0 10 / 18 : 4 3: 1 8
0 0 0/ 00 : 1 9: 2 2
35 D 2 5 D

NOTE
On TRAJ 4 and 5, the orbiter bug is placed
by energy (E/W) vs. range. This difference
does not change the operational use of the
displays.

0
0
9
9

NOTE

10

0
- 2 10

NY
NY T RI M
20
AI L
RUD
Z ERO H BI
H BI AS
REF
ROL L REF
- 1 30
CMD

I / 0 RESET EXEC

. 0 00
. 0 00
L 2. 3
0. 0
AS 2
- 42
- 22 4
L 63
L 62
54 0

ENTRY TRAJ 3 Display (Mach 14-Mach 10)

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

Desired, reference, and commanded drag

are interchangeable terms; they mean the
same thing.
The entry guidance algorithm is also running
real time to calculate desired drag. The output
of this algorithm is indicated by the arrow on
the drag scale (left side of the ENTRY TRAJ
display). Remember, the arrow points to where
you want to be.

7.3-6

USA007587
Rev. A
The current drag, as sensed by the IMUs, is
displayed as a triangle on the TRAJ display.
Guidance commands a roll angle that will
dump lift as required to achieve the desired
drag. H-dot control is an essential part of this
operation. Guidance will bank until it sees an
acceptable H-dot, then bank to an H-double-dot
that equals zero to maintain this H-dot.
The desired H-dot is a function of reference
H-dot and drag error. Reference H-dot is the
H-dot required to maintain desired drag. If
current drag is less than reference drag,
guidance will fly to a higher H-dot (more
negative).
Guidance displays reference H-dot on the lower
right corner of the TRAJ display. The crew can
also look directly below the orbiter bug and
read a rough estimate of reference H-dot at the
bottom of the TRAJ display.
Entry guidance will also modulate alpha to
remove drag errors. By changing alpha 3,
guidance can instantly change the drag by
about 10 percent (3 degree modulation is the
limit). Alpha modulation is much faster than
roll control.
If guidance is using alpha
modulation to remove drag errors, it will roll to
achieve an H-dot that will eventually put the
orbiter in the correct air density. In a few
minutes, the drag error will be removed
without using alpha modulation.
As the orbiter bug proceeds down the trajectory
lines, it leaves triangular trailers every 15
guidance cycles (28.8 sec) that are used for trend
analysis. For ENTRY TRAJ 3, 4, and 5, the
trailers are displayed every 8 guidance cycles
(15.36 sec). Only six trailers can be displayed at
one time.
A guidance box appears upon initiation of
closed loop guidance and moves relative to the
shuttle symbol to reflect drag errors (D-DREF).
The guidance box leaves trailer dots. Ideally,
the nose of the shuttle symbol will be inside the
box, and a dot will be located in every triangle.
The first roll command will be visible on the
TRAJ display shortly after the initiation of
closed loop guidance. Timely execution of the
first roll command will minimize the bank angle
required to establish desired drag.

If the guidance box is to the left of the shuttle

symbol, drag is too small (you will land long)
and the guidance trend is toward high energy.
The opposite condition indicates drag is too high.
Alpha is monitored on the Ascent/Entry Flight
Displays (AFD) and on the ENTRY TRAJ
displays.
These parameters should be
compared with the values on the ENTRY
ALPHA cue card.
ENTRY TRAJ displays
reference alpha (computed by guidance) via an
arrow and nav-derived (actual) alpha by a
triangle. Normally, these overlay each other.
However, guidance will add small biases to
alpha to remove drag errors. If the ADI pitch
error needle is centered and the alpha triangle is
offset from the arrow, it is an indication of alpha
modulation. Alpha modulation is expected
during and after a roll reversal.
Heading error is defined as delta azimuth (DEL
AZ or AZ on the ENTRY TRAJ displays) and
is the angle between the velocity vector and the
great circle direction to the runway. DEL AZ is
displayed on the HSI as the difference between
the H pointer and the lubber line. There is
also a digital value of DEL AZ right next to the
HSI and on the ENTRY TRAJ displays. Bank
angle controls drag, and therefore energy,
during entry. Because the bank angle causes
the orbiter to continually turn, a crossrange
capability of approximately 750 n. mi. can be
obtained. This gives the orbiter the advantage
of using landing sites that are not directly under
the orbital groundtrack. Roll reversals are
performed to keep DEL AZ within limits. The
velocities at which the reversals occur are a
function of crossrange.
Several onboard indicators alert the crew that a
roll reversal is needed: on the ENTRY TRAJ,
the orbiter bug and phugoid damper start
flashing; on the HSI, the box surrounding the
digital DEL AZ value turns red and flashes; on
the ADI, the roll error needle indications a full
scale deflection. The first roll reversal will
occur at a DEL AZ of 10.5. Subsequent roll
reversals occur at a DEL AZ of 17.5 until Mach
= 4 when DEL AZ limit ramps to 10.0 by Mach
2.8.
The ENTRY MANEUVERS cue card itemizes
important events that the crew must monitor
during entry.
Off-nominal activities are

7.3-7

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
indicated by asterisks (*). Crew action items are
keyed to velocity. Items to be verified only are
marked with a check ()..
See section 5.4 for more detail on this card.

low energy may not be able to bring DEL AZ

back in. The crew should select R/Y CSS and
initiate the first roll reversal when DEL AZ = 5.
AUTO flight control may be reengaged after
completion of the first roll reversal.

NOTE

Delta State Update

V in Kft/sec is equal to Mach; e.g.,

V=10K=Mach 10.
Automatic program test inputs (PTIs) may be
included as part of entry trajectories to obtain
aero data postflight. These data are used to
further define the aerodynamic characteristics
of the shuttle, help expand the operational
envelope, and reduce aero data base
uncertainties. PTIs are executed automatically
by the entry DAP and are input into the flight
controls downstream of gains and filters so that
a known control deflection or jet firing can be
made. The crew enables PTIs on SPEC 50, and
flight control must be in AUTO. Execution of
PTIs is monitored on the SPI and GNC SYS
SUMM 1 for control deflections, by the RCS
activity lights for jet firings, and by data on the
PTI Monitor Cue Card.
Normal vehicle
performance parameters also must be
continuously monitored to ensure there is no
trajectory degradation introduced by the PTIs.
Takeover
The entry trajectory is normally flown in AUTO
until subsonic, when the crew modes to CSS.
Upon moding the GPCs to MM 304, dedicated
displays and ENTRY TRAJ displays become
available. DAP controls for the AEROJET DAP
are located on each eyebrow panel. Manual
takeover can be executed using the pushbuttons
or by moving the RHC more than 7 out of
detent.
NOTE

If the NAV state of the orbiter goes bad on

entry, data from the GPS unit will be forced to
update the orbiter state vector. MCC can uplink
a good state vector (position and velocity). This
is normally done by using the command uplink.
If both GPS and the command uplink are not
available, the delta state will be read up on the
voice uplink, and the crew will have to enter the
values on SPEC 50.
The crew must also take manual control (CSS)
before a velocity uplink is incorporated into
the GPCs. MCC will remind the crew when to
take CSS.
Undesirable Transients
Prior to any event capable of introducing an
unwanted transient into the flight control
system, such as a delta state update that
includes a velocity component, the crew should
select CSS to prevent undesirable transients.
Automatic flight control may be reengaged
upon completion of the event and reconvergence of the guidance needles.
Entry Control Cue Card
The ENTRY CONTROL cue card contains three
procedures that cover possible DAP problems
during entry.
ARCS QTY (L + R) <10%

Low Energy

The procedure applies when the total ARCS

quantity drops below 10 percent during entry.
With available propellant so low, steps are
taken to conserve what propellant is left for
those times when RCS jets are really needed to
maintain attitude control.

A ROLL REF down arrow on the ENTRY

TRAJ display indicates a low energy condition.
In addition to the down arrow, a fault message
will be generated. If DEL AZ is allowed to go
out to 10.5, the small roll angles required to fly

The crew takes no action until q-bar is more

than 20 psf or if RCS jets start failing due to
propellant depletion, whichever occurs first. At
that time, the crew moves the ENTRY MODE
switch on panel L2 to NO Y JET (No Yaw Jet)

During entry, moding to CSS is separate

for the pitch axis and roll/yaw axes. It is
possible to be in CSS pitch control and
AUTO roll/yaw or vice versa.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

7.3-8

USA007587
Rev. A
and select the FIXED elevon schedule on their
displays. NO Y JET (which becomes certified at
q-bar = 20 psf) forces the Entry DAP to use the
aerosurfaces rather than the yaw jets to perform
banking maneuvers. With the FIXED elevon
schedule, the elevons tend to deflect further into
the airstream, becoming more effective.
WARNING

WARNING
Never trim the ailerons back until the
rudder is active at Mach 5. Otherwise, RCS
propellant is needlessly wasted in trying to
trim the vehicle rates.

AIL TRIM 3
This procedure applies when the crew notes
that the aileron trim starts exceeding 3 during
entry. The trim function of the Entry DAP is
dangerously close to becoming saturated, which
could then lead to control issues with the
vehicle.

Selecting NO Y JET will automatically

downmode flight control to CSS in the R/Y
axis. Crew must manually fly the vehicle,
using the ADI error needles and other
indicators.
If at any point the crew experiences control
problems, and as long as propellant remains,
they can move the ENTRY MODE switch back
to AUTO and use the RCS jets to try to regain
control. Once control is re-established, the crew
goes back to NO Y JET to again conserve
propellant.

ENTRY MODE Switch on Panel L2

Below Mach 6, the aerosurfaces should have
enough authority to adequately control the
vehicle the rest of the way down. The crew can
at this point take both the ENTRY MODE
switch and the R/Y axis back to AUTO.
Below Mach 5, the crew trims the ailerons to
1. This forces the rudder to pick up the trim
load, freeing the elevons to better maneuver the
vehicle.

The software limit for aileron trim is 3 for the

Baseline DAP (default for TAL) and 5 for Wrap
DAP (default EOM). So, the first thing the crew
does is to ensure that Wrap DAP is enabled.
If aileron trim goes on to saturate at 5, the crew
next raises the body flap. This causes the
elevons to move down further into the
airstream, becoming more effective.
Then
below Mach 13 (where changing dynamics on
the vehicle will more than likely lead to control
issues), the crew will manually fly alpha to as
close to 30 as allowed by thermal constraints.
Engineering studies show that alpha 30 is the
most
optimum
angle
of
attack
for
controllability. If the crew is already in CSS due
to having the ENTRY MODE switch in NO Y
JET, they will need to limit their maneuvering
rates, as the elevons are already having
difficulty maintaining control
Below Mach 5, the crew trims the ailerons to
1. This forces the rudder to pick up the trim
load, freeing the elevons to better maneuver the
vehicle.
Below Mach 2, the crew returns the body flap to
AUTO for the transonic region and approach
and land transition.
High Freq OSC or Surf/Jet Cycle
High frequency oscillations can be due to any
number of reasons: bent airframe, incorrect
bending filters, improper gains, etc. The crew

7.3-9

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
may observe these oscillations on the SPI or the
ADI rate needles. A yaw jet limit cycle may also
occur.
The procedure first ensures that the correct
body bending filter is in use. The DAP includes
bending filters in all axes that protect the DAP
from coupling with the orbiter structure in a
resonant oscillation.
If the bending filter
constants were wrong, oscillations can occur.
If the condition persists, then the problem may
be with AUTO. The crew takes CSS and
manually flies the vehicle.
If the condition still persists, then perhaps the
DAP is overcontrolling the vehicle. The crew
moves the ENTRY MODE switch to LO GAIN,
which cuts the Entry DAP gains in half.

unnecessary RCS jet firings. Overly aggressive

control during entry can cause depletion of
available RCS propellant. The MED position of
the ADI ERROR switch is recommended for
entry.
Use 6 deg/sec roll rate (full RHC deflection to
the hard stop) to perform a roll reversal. A
good cue to stop the roll reversal maneuver is
H-double dot passing through zero. Returning
the RHC to detent at this point will result in a
smooth reduction in bank rate with final bank
angle very close to roll command. A 6 deg/sec
roll rate will minimize H-dot and drag excursions during the reversal. A gentle roll reversal
at less than 6 deg/sec roll rate can require the
use of large bank angles to recapture the
desired drag profile.
WARNING

If at any time the oscillations stop, the crew can

return everything back to AUTO. If, on the
other hand, the oscillations continue, the crew
must continue as best they can in CSS.

Monitor DEL AZ carefully when flying

R/Y CSS, especially at lower velocity.
Azimuth errors can quickly make it
impossible to reach the desired landing
area.

Manual Control
WARNING

A good instrument crosscheck of actual drag

(DACT), reference drag (DREF), bank angle, H-dot,
and H-double dot is required when flying a CSS
entry.

If possible, do not downmode to CSS

without consulting MCC. Deviations from
the desired entry drag profile can cause
violation of thermal limits or failure to
reach the planned landing site.

The following is a summary of tasks required

during a CSS entry:

After closed loop guidance, the first bank

command should be in the direction of the
landing site (H pointer on the HSI). This
maneuver is usually done in AUTO. It should
occur at an H-dot of -240 fps.

Fly scheduled alpha per the cue card or

ENTRY TRAJ.
Bank as required to maintain H-dot
H-dot REF +20 (DACT - DREF)

If CSS is required, move the RHC to about half

deflection, watch the roll rate needle on the
ADI, and bank at about 3 deg/sec. Prompt
execution of the first roll command will
minimize the bank angle required to establish
the entry profile.
To fly the most fuel-efficient entry, closely
monitor the guidance needles, and always
center the pitch needle first. Keep rates small
and try not to start and stop the rate more often
than necessary.
Minimize the number of
discrete
RHC
movements
to
reduce
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

Perform roll reversals based on DEL AZ

(10.5 for first reversal, 17.5 for
subsequent reversals) to Mach = 4. The
DEL AZ limit then ramps down to 10 at
Mach 2.8.
No Yaw Jet/RCS Critical Entry
The hypersonic handling characteristics of the
orbiter are very different when in NO Y JET. The
primary difference is the time required to start
and stop roll rates. This difference is so great that
the flight control system automatically

7.3-10

USA007587
Rev. A
downmodes to R/Y CSS when NO Y JET is select,
requiring the crew to fly manually
When in NO Y JET, the flight control system
uses adverse yaw to start and stop a bank. The
crew will see this by an initial roll opposite the
commanded direction.
This adverse yaw
decreases with Mach. By Mach 5, the rudder
becomes active and the orbiter flies much better.
When performing roll reversals, it is important
to use the recommended 6 deg/sec roll rate to
minimize altitude descent rate and drag fluctuations. A gentle roll rate of less than 6 deg/sec
may feel more comfortable, but the trajectory
dispersions it will cause will make the ride
uncomfortable later.
To initiate a roll reversal in NO Y JET, the RHC
should be moved smoothly to establish a roll rate
of 6 deg/sec. To stop a roll reversal, a large lead
is required to prevent overshooting the desired
bank angle. This lead varies with Mach. The
following is a list of typical lead angles required
to capture the desired bank from a 6 deg/sec roll.
The roll is stopped by centering the RHC.
Mach
>22
22-7
<7

Lead Angle (deg)

55
35
15

After the roll reversal, the roll needle should be

kept centered. Control will be sloppy, so the
needle cannot be kept perfectly centered. It
takes a lot of work. It helps to try and lead the
roll needle by monitoring H-dot and predicting
what guidance is going to do next.
For
example, if guidance is commanding to a large
negative H-dot, you can expect that guidance
will command a roll out of bank in the near
future. Developing good skills in flying manual
entries helps in predicting what guidance will
do next.
NOTE
Do not compensate for the sloppy control
by lagging behind the needles. Adding
lag to the system will cause large, lowfrequency oscillations in H-dot and drag.
The most critical region of a NO Y JET entry is
between Mach 12 and Mach 8, where control
margins are smallest.
This is empirically
derived from 6 degree-of-freedom simulations.

With the aero uncertainties present today, a

control problem is not expected in the NO Y JET
mode. If control problems are encountered at
any velocity, and RCS control is still an option,
reenable the yaw jets by returning the ENTRY
MODE switch to AUTO. Once control is
restored, and the orbiter is in a stable attitude,
return to the NO Y JET mode.
Off Nominal Trajectory Control
Should the orbiter be outside the DPS-displayed
nominal energy envelope, for whatever reason,
corrections are necessary to recover. Both the
high and low energy cases are discussed from a
manual control point of view.
High Energy Recovery
If the orbiter is very high energy on entry,
guidance will calculate a drag that is larger than
the orbiter can withstand. This can be seen
when the orbiter bug is to the left of the high
energy line on the ENTRY TRAJ display. The
high energy line is the solid line furthest to the
left on the TRAJ display. In this case, the crew
must take CSS and manually fly to the
maximum drag that the orbiter can withstand.
The details of this procedure are beyond the
scope of the SCOM, and are taught in the Entry
Guidance Workbook, CBT, and classes.
WARNING
It is very easy to overshoot maximum drag
while flying high energy entries. It is better
to be high energy at TAEM interface than
to be at TAEM interface without wings.
Low Energy Recovery
If the orbiter bug is to the right of the low
energy line, guidance is calculating a drag that
is smaller than the orbiter can sustain. In this
case, the orbiter must fly into air that is so thin
that there is not enough lift. The low energy
line is the farthest right line on the ENTRY
TRAJ display.

7.3-11

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A
If on a TAL abort, the crew should enable LOW
ENERGY logic on the TRAJ display. Low
energy logic automatically flies a bank angle of
approximately 2.2 times delta azimuth. It also
varies alpha between 42 and 25, which
optimizes range/crossrange capability while
protecting
orbiter
thermal
limitations.
Although this software will function on an end
of mission (EOM) return, it is not certified.

but all three axes are switched when DISC

RATE or PULSE is selected.

If low energy on an EOM, the crew should take

CSS. In pitch, fly alpha low (3 below the alpha
arrow on the ENTRY TRAJ display), in roll fly
2.2 times DEL AZ.

BFS does not support PTIs. Upon entering MM

304, flight control mode is CSS through
landing/rollout.

3 04 1 /

D
50
50

45

ENT RY T RAJ 2

1 BI AS [ ]
D REF 3 0 .
40 q
97 .
AZ + 6 .

40

L O ENRGY
3 0 3 I NH

35

20

30

25

1 0 10 / 18 : 4 0: 56
00 0/ 00 : 1 6: 57
35 D 25 D 20 D

4 5D
0
7
6
4

15 D

10

0
- 1 25

- 1 90

NY
NY T RI M
AI L
RUD
Z ERO H BI
H BI AS
REF
ROL L REF
CMD

RESUME

Entry

The BFS maintains only one state vector during

entry. Redundancy management is performed
on most systems, but in a simpler manner than
PASS. BFS is also set up to accept air data to
G&C immediately upon engage. If air data has
not been previously accepted in PASS, the crew
should inhibit air data to G&C upon BFS engage.
There is no digital DEL AZ output in BFS.
However, the crew still has the HSI with its digital
output and the H pointer with respect to the
lubber line.

R. 0 1 0
. 0 00
L 0. 2
0. 0
AS 2
5
- 11 6
L 64
L 58

Sensory Cues

53 0

ENTRY TRAJ 2 Display

Backup Flight System

The backup flight system (BFS) is capable of
performing nearly all of the primary flight
system functions (controlled by PASS software)
during deorbit, entry, approach, and landing.
This section presents the major differences,
from the flight crew viewpoint, between the two
systems.
Differences in handling qualities
between the PASS and the BFS are very small in
the training simulators, and no large differences
are expected if BFS is engaged onboard the
orbiter. A moderate control transient should be
expected when BFS is engaged.
Deorbit
Automatic maneuvers are not available in BFS.
The crew must manually fly to deorbit burn
attitude using the error needles, MNVR EXEC
display, and ADI attitude. The TRANS DAP
supports both DISC RATE and PULSE modes,
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

During the burn, attitude must be maintained

manually using the ADI error needles and REF
ball. Upon completion of the burn, the maneuver to EI-5 attitude is a manual maneuver.

During the night portion of an entry, the

glowing plasma sheath around the vehicle can
be observed through the orbiter windows. The
pulsing light has not interfered with tasks
inside the vehicle. The plasma glow is less
visible during daylight portions of entry and
may not be noticeable.
Returning from orbit, some crewmembers have
reported increased sensitivity to g as it builds
during entry. One crewmember observed that
when you hit a quarter g on entry, it seems like
two gs in the T-38. Crewmembers should be
aware that their ability to perform entry tasks
may be degraded from that experienced in the
SMS during training. Keep in mind that Gs stay
around 1.3 until Mach 2.5.
Roll reversals on entry will feel different than
pure roll maneuvers in a conventional aircraft
due to the orbiters entry angle of attack. Pilots
will probably notice the yaw rate required
during the bank change as much as the roll rate.

7.3-12

USA007587
Rev. A
Some mission specialists have stated that they
could barely feel the roll reversals.
At high Mach numbers, a slight vehicle buffet
may be noticed as well as some light structural
vibration as dynamic pressure increases during
entry.

Ground Controlled Approach

Although GCA techniques are available, they are
emergency alternatives only. Control should be
quickly returned to auto when conditions permit.
During entry, trajectory is monitored via the
Tracking and Data Relay Satellite (TDRS) and
ground radars. Should the trajectory diverge and
approach energy limits, a GCA will be performed.
MCC, via the CAPCOM, will provide the crew
with bank attitude, heading, airspeed, and
speed brake information.

During TAEM, a more conventional technique of

heading to control ground track and airspeed to
control energy is used. Fly both pitch and roll/
yaw in CSS. Perform turns using 30 bank angle
unless MCC requests a steeper bank. Control
airspeed by modulating alpha and bank angle.
Final approach GCAs are similar to traditional
airplane GCAs. Heading information controls
alignment with the runway centerline, and
position information references glide slope.
Speed brake is used to control airspeed.
Off-nominal energy situations could be caused
by incorporating erroneous navigation data into
guidance or selecting an incorrect landing site.
If this is the case, the GCA will be used to
control the entry profile until NAV can be
updated via a ground uplink or a manual state
vector update. Once the NAV state is correct,
MCC will terminate the GCA and call for a
return to AUTO flight control.

WARNING
On a high energy GCA, the crew should
help monitor Gs. If the crew thinks that the
current bank angle is leading to an over-g,
the crew should call MCC and roll out of
bank to not exceed Nz limit (2.0 to 2.5 gs,
depending on orbiter weight.
ImportantH-dot leads an over g. An H-dot of
about -300 fps will maintain about 2.0 gs. If Hdot is bigger (more negative) than about
-300 fps, and Gs are headed up to the limit (~2.0
- 2.5 gs), roll angle should be decreased. MCC
should be notified before roll angle is
decreased.
GCAs are divided into three phases, based on
energy: high velocity (Mach 10 - Mach 3),
TAEM (Mach 3 - Mach 0.9), and final approach.
Criteria for electing to perform a GCA depend
upon guidances capability to achieve a nominal
trajectory by Mach 5.
In the high velocity phase, MCC provides bank
magnitude information to control drag and
bank direction to control crossrange. To keep
workload under control, fly roll/yaw CSS and
pitch, speed brake, and body flap AUTO.

7.3-13

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

USA007587
Rev. A

Entry Rules of Thumb

2 OMS: TGO VTOT/2.
1 OMS: TGO VTOT.

The shuttle bug superimposed on

guidance box superimposed on nominal
trajectory line

RCS: TGO 1.7 x VTOT.

Actual drag equal to reference drag

Adjust H-dot reference 20 ft/sec for every

1 fps2 of drag error. [H-dot ~ H-dotREF + 20
(DACT - DREF)]

Appropriate bank angle, H-dot, range

and altitude

As an approximation, 1 of bank change

produces 0.7 ft/sec2 H-double-dot change.
However, there is no lag in the H-double-dot
tape. You can roll until the H-double-dot
tape reads the desired value.

Attempt to contact MCC before taking CSS.

If you must take CSS:

A 3 change in alpha produces a 10 percent

drag change.
First bank (H-dot capture) should occur at an
H-dot approximately -240 ft/sec.
Monitor the trajectory on the ENTRY ALPHA
cue card, and the PASS and BFS TRAJ
displays:

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.3 Entry

7.3-14

Control range by controlling drag.

Control drag by controlling H-dot.
Control H-dot by controlling H-doubledot.
Control H-double-dot by controlling roll
angle.
Control everything slowly by small
corrections.

USA007587
Rev. A

7.4

TAEM and approach/landing guidance

trajectories allow the orbiter to handle a large
variety of dispersions. Certain specified ground
rules and constraints such as weight, c.g.,
aerodynamic limits, distance past runway
threshold, velocity, altitude rates, lateral rates,
and energy margin must be observed to ensure
guidance is capable of directing the orbiter to a
safe landing. Mission Control monitors these
limits closely. Carefully following guidance
commands (error needles) will generally
provide the crew the best chance for coping
with environmental dispersions.

TERMINAL AREA ENERGY

MANAGEMENT AND
APPROACH, LANDING, AND
ROLLOUT (OPS 305)

CONTENTS
Definition and Overview .....................
Terminal Area Energy Management..
Heading Alignment Cone....................
Outer Glideslope ...................................
Preflare....................................................
Inner Glideslope ....................................
Touchdown ............................................
Derotation ..............................................
Rollout ....................................................
Handling Qualities................................
Wind Effects on Trajectory ..................
Backup Flight System ...........................
Off-Nominal Approaches ....................
Sensory Cues..........................................
Autoland.................................................
Terminal Area Energy Management
and Approach, Landing, and
Rollout Rules of Thumb ............

7.4-1
7.4-1
7.4-8
7.4-9
7.4-14
7.4-15
7.4-16
7.4-18
7.4-19
7.4-20
7.4-22
7.4-23
7.4-24
7.4-25
7.4-25

TAEM is divided into four phases: S-turn,

acquisition, heading alignment, and prefinal.
Approach and landing trajectories are divided
into five segments: trajectory capture, outer
glideslope (OGS), preflare and inner glideslope
(IGS), final flare, and touchdown. TAEM and
approach and landing regions are jointly
designed to allow the orbiter to land safely.
This
section
presents
information
for
monitoring and takeover during the early
portions of TAEM and then details the manual
flying tasks during each segment of the
trajectory.

7.4-28

Definition and Overview

This section presents information required to
pilot the orbiter from an Earth-relative velocity
(Vrel) of 2500 fps (Mach 3.2 for RTLS), where
terminal area energy management (TAEM)
begins, all the way through approach, landing,
and rollout on the runway. TAEM guidance
provides information to the pilot and guides the
orbiter until the transition to approach/landing
guidance at an altitude of 5000 to 10,000 feet.
Derotation and rollout logic take over after the
orbiter touches down on the runway. Procedural
information
for
the
TAEM
and
approach/landing
guidance
phases
are
contained in the Entry Checklist and cue cards.
Pilots sometimes refer to the flight phase from
.95 Mach to touchdown as the approach and
landing phase of flight. This is the phase of flight
in which the crew normally controls the vehicle
manually (CSS) and in which the Shuttle
Training Aircraft operates. By this definition, the
approach and landing portion of the trajectory
includes both subsonic TAEM guidance and the
approach/landing guidance regions.

General information on handling qualities,

flight control surfaces, priority rate limiting
(PRL), winds, limits, BFS, sensory cues, and
autoland is presented at the end of this section.

Terminal Area Energy Management

Monitoring
TAEM guidance is initiated automatically as the
orbiter decelerates through Vrel = 2500 fps
(Mach 2.5, Mach 3.2 for RTLS). This normally
occurs at about 82,000 ft altitude and about
60 n. mi. from the runway. The crew should note
transition to MM 305 (MM 603 for RTLS) and
appearance of the VERT SIT displays. Head-up
display (HUD) symbology also appears at TAEM
interface. TAEM guidance controls the orbiter by
flying an altitude vs. range profile (glideslope).
TAEM also has energy and airspeed limiting
features (and angle of attack for RTLS).
The outputs of TAEM guidance are functions of
errors from these profiles. The validity of the
output commands depends upon the accuracy of

7.4-1

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
NAV and air data. Guidance is only as good as
the NAV state.

NOTE
Energy can be dissipated very rapidly.
Ensure a high energy condition exists
(MCC or visual) if an S-turn is triggered.

TAEM Guidance
TAEM guidance operates by phases. S-turn, if
required, dissipates energy by turning away
from the HAC until energy conditions allow a
nominal approach. Acquisition turns the orbiter until its ground track is pointed at the HAC.

WP-1

NEP
12,000 ft

Tracking the HAC

Guidance uses an algorithm for roll command
that is a function of error with respect to HAC
radius (R) and the rate of change of distance to
the center of the HAC (R-dot). The horizontal
situation indicator (HSI) bearing pointers
marked H and C are referenced to the HAC
tangency point and HAC center, respectively, as
computed by Area Nav. Wind magnitude
affects HAC tracking. Roll angle is larger when
flying with a tailwind and smaller with a
headwind. On average, the HAC roll angle is
45.

42,000 ft

Prefinal

886.cvs

Heading Alignment Cone (HAC) Profile

Heading alignment turns around the HAC until
the orbiter is near the runway centerline.
Prefinal transitions from the HAC to the runway centerline.
Outputs of TAEM guidance are:
Pitch command (Nz)
Roll command
Speed brake command
At TAEM interface, if vehicle energy is too high
and the HAC turn angle is <200 (for OPS 3
entries), an S-turn will be commanded. During
the S-turn, the orbiter will fly a constant bank
angle of 30 for end-of-mission (45 for RTLS)
until the total energy/weight decreases to
nominal +10,000 ft. Acquisition phase is then
resumed, and the orbiter turns back toward the
HAC tangency point.
Between Mach 0.95 and 14,000 ft, the speed
brake is controlling energy. Below 9000 ft, it is
controlling airspeed to 300 KEAS. The logic is
blended between 14,000 and 9000 ft.

When the orbiter is approximately 6.8 miles

away from the runway, or below an altitude of
7000 feet, guidance transitions to prefinal. At
prefinal, the roll error needle may become very
sensitive. The crew should either aggressively
fly the roll needle or manually fly to the
runway. Lagging the needles will only add to
the oscillation of the roll error needles.
If the orbiter is flying into a headwind when
prefinal starts, the roll needle may command a
roll to wings level. This is more likely in the
STA, which is not usually flying as fast as the
orbiter does at this point. This rollout is due to
a small Y-dot, where Y-dot is the closure rate to
the runway center line.
At prefinal, the flight director marker changes
from a square to a circle. It also points to the
orbiters velocity vector at this time.
Overshooting the runway centerline may cause
the course deviation indicator (CDI) and the
glideslope indicator (GSI) on the HSI to
disappear momentarily. Area Nav thinks the
orbiter wants to go around another HAC. This
will clear itself momentarily. Although not
required, the crew can ensure having a GSI by
placing the HSI SELECT MODE switch on panel

7. TRAJECTORY MANAGEMENT
7.4-2
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
F6 or F8 to APPROACH. This will force the GSI
to display deviation from final approach glide
path.

NOTES
It is essential not to confuse glideslope
and energy. TAEM guidance does certain
things based on energy (mainly move the
speed brake) and certain things based on
glideslope. There are also glideslope
displays and energy displays. People
often use these terms interchangeably.

Pitch Commands
The output of the TAEM pitch channel is a delta
NZ command which is sent to flight control. If
the orbiter is down to two AAs, it is fail critical
(i.e., one more failure will cause bad NZ
feedback). In this case, the crew will fly pitch
CSS and closely monitor the pitch error needles
by cross-checking the other data.
The crew has a great deal of data to monitor to
make sure the pitch channel of TAEM is
working correctly. There are five different
sources of glideslope (altitude) information.
Glideslope
data source

Type of
glideslope

Type of HAC

Scaling

GSI on HSI

Reference

Spiral

5000 ft till about

Prefinal, then 1000 ft

Orbiter bug on
VERT SIT

Nominal

Spiral

Scale: 30K to 100K

GSI on HUD

Reference

Spiral

5000 ft till 10,000 ft

then a linear ramp
down of scaling to 500
ft at 5000 ft altitude

Vertical scale
on PASS
SPEC 50
HORIZ SIT

Reference

Spiral

5000 ft until Prefinal,

then 1000 ft

ADI pitch rate

pointer

Reference

Spiral

5000 ft until Prefinal,

then 1000 ft

TAEM limits the supersonic roll limit to

30 to protect the ground from a large
sonic boom. The HAC cannot be flown at
30. If supersonic on the HAC, crew
intervention is required to go over 30.
Large HAC Turn Angles (300)
Several unusual things happen with a large
HAC turn angle. A large HAC turn angle is
typically >~325.
First, TAEM guidance will command an energy
dump, a pull-up maneuver, and a pull-up
recovery maneuver. The crew has very little
insight into what is happening inside of
guidance. In general, the vehicle will pitch
down for the energy dump, pitch up to get
subsonic, and then pitch down to recover. The
crew must faithfully fly the pitch error needles
until 270 on the HAC. At this time, a normal
instrument scan may be used.

Glideslope Parameters
In addition to glideslope information, the crew
must monitor energy and airspeed.
Both
energy and airspeed are used in the pitch
channel. In addition to the onboard displays,
MCC is calling energy based on radar
tracking data. This data must be incorporated
by the crew. Before HAC intercept, MCC
measures energy and calls energy. On the
HAC, MCC measures glideslope (altitude) and
will make calls based on the following:

< 1000 ft altitude error ON

1000 to 2000 ft altitude error slightly high

or low

>2000 ft altitude error high or low

WARNING
The pull-up maneuver is performed in
TAEM by lowering maximum airspeed to
about 200 KEAS. If TAEM does not have
air data, it will command an uncontrollable
pitch up at about Mach 1.3.
Second, the crew will have very little time
flying before HAC intercept on an entry with a
large HAC turn angle.
Displays
The primary glideslope/energy displays for
TAEM are the vertical situation displays
(VERT SIT 1 and VERT SIT 2). The VERT SIT
plot is scaled with altitude on the Y-axis and
guidance determined range (range to fly) to

7.4-3

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
the runway on the X-axis. Three trajectory
guidelines represent maximum airspeed,
nominal, and maximum lift-to-drag (L/D)
ratio. Numerical values along the lines are
EASs that should be flown to maintain that
reference. An orbiter symbol shows current
altitude versus range (glideslope).
Pitch
attitude of the orbiter (bug) symbol indicates
H-dot. Use of theta limits is discussed later in
this section.
The HSI is driven by Area Nav, which does
calculations independent of shuttle guidance
and navigation. This gives the crew a source of
navigation processed differently from the
onboard state vector and based only on data
taken from GPS, TACAN or MLS (microwave
landing system). The HSI and Area Nav are
driven according to the HSI SELECT SOURCE
switches on panels F6 and F8. There are three
options available: NAV (NAV state vector to
Area Nav), TACAN (raw (TACAN data to Area
Nav), and MLS (raw MLS data to Area Nav).
For 3-string GPS vehicles, the TACAN option
above is replaced with GPS (i.e raw GPS data to
Area Nav). An additional switch allows
selection of the individual TACAN or MLS LRU
(1, 2, or 3).

During TAEM, the HSI H bearing pointer

indicates the bearing toward the HAC tangency
point called way point 1 (WP1), and the C
bearing pointer indicates bearing to the center
of the HAC. Range displayed on the HSI
corresponds to range to the runway via the
HAC (e.g., KSC15) and range to the HAC center
(HAC-C). Range to the runway can be varied
by changing the HAC using ITEM 6 and 7 on
SPEC 50. Both the SPEC 50 and HSI HACs are
imaginary inverted cones tangent to the runway
centerline at 12,000 ft altitude and nominally
centered approximately 7 n. mi. from the
runway threshold. For low energy situations,
the crew can shift the HAC to a point
approximately 4 n. mi. from the threshold by
executing ITEM 7. The point where the HAC is
tangent to the runway centerline is called the
entry point. For a nominal HAC configuration,
the entry point is called the nominal entry point
(NEP). Executing ITEM 7 repositions the HAC
to a minimum entry point (MEP), which is
tangent to the runway centerline at 6000 ft.
ITEM 6 allows selection of an overhead
(OVHD) approach or a straight-in (STRT)
approach. This allows the crew to position the
HAC on either side of the runway centerline.
OVHD/STRT and NEP/MEP can be combined
to define four HACs that are available to the
crew for energy management purposes.
Guidance is always initialized to the OVHD
NEP HAC.

VERT SIT 1 Display (PFS/BFS)

7. TRAJECTORY MANAGEMENT
7.4-4
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
270 HAC turn
OVHD STIN saves ~ 13 n. mi.
NEP MEP saves ~ 3 n. mi.

Right overhead
Left straight-in

180 HAC turn

OVHD STIN SAVES 0 n. mi.
NEP MEP gains 6 n. mi.

360 HAC turn

OVHD STIN gains 20 n. mi.
NEP MEP gains 0 n. mi.
NEP

MEP

Left overhead
Right straight-in
7 n. mi
from runway
12,000 ft alt.

4 n. mi.
from runway
6,000 ft. alt.
887.cvs

HAC Turns

5K
H

AZ

12

15

KSC15

21

1o

60.1
HAC-C
39.8
5K

24
W

30

33

This part not visible on the A/E PFD

Horizontal Situation Indicator in TAEM

7.4-5

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
triangle shows the calculated energy of the
vehicle relative to the design trajectory.
Overbright lines above and below the center
NOM indication show 8000 ft high and 4000 ft
low on total specific energy. If the pointer is
between the +8000 and -4000 ft marks, TAEM is
controlling glideslope. If out of this band,
TAEM is controlling energy.

1107.cnv

HSI SELECT Switches on Panels F6 and F8

These are energy status lines, not altitude. As

with the glideslope indicator, E/W assumes a
proper ground track will be flown. A high E/W
bug means high energy. A high HSI glideslope
pointer indicates low altitude on the glideslope.

NOTE

Theta limits
scale label

Within 35 n. mi. of the runway, switching

between OVHD/STRT is not recommended. The heading error generated by a
downmode could nullify any energy gains.
The GSI on the HSI displays calculated altitude
error computed by Area Navigation. Note that
this is not a guidance computation. The scale is
2500 ft per dot until Area Nav transitions to
Approach (usually within 2.5 of Course
Deviation), then it becomes 500 ft per dot.
Crewmembers can force this scale change by
selecting APPROACH on the HSI SELECT
MODE switch on panel F6 or F8. With the HSI
MODE switch in ENTRY, HSI mode, auto
switching from TAEM to Approach will occur
under the following conditions:
Orbiter altitude is less than 18,018 ft for
NEP (12,000 ft for MEP), and the absolute value of the CDI is less than 2.5.
Orbiter altitude is less than 12,018 ft for
NEP (6000 ft for MEP) irrespective of
CDI value).
Data presented by the glideslope indicator are
calculated assuming the orbiter will fly from its
present position, over the proper ground track
trajectory, to touchdown.
The GSI shows altitude error only, not energy
error. Similarly, on the VERT SIT displays, the
vertical scale is altitude, not energy.
The E/W scale (E/W = units in feet) on VERT
SIT 1 and 2 is displayed above 20,000 ft AGL. A

Maximum pitch
angle limit
NOSE HIGH
+8000 ft total E/W
Nominal total E/W
-4000 ft total E/W

E/W

STN

NOM

Pitch angle
Minimum pitch
angle limit
NOSE LO

Total energy/weight
scale label

S-Turn
Current 'NAV derived'
total energy/weight
Nominal energy
label

Overhead to straight-in
energy downmode
NEP to MEP
energy downmode
890.cvs

E/W Scale on VERT SIT 1

Above the nominal energy marks is a mark
labeled STN (S-turn). When vehicle energy,
represented by the triangle, is above the STN
mark, guidance may command an S-turn to
dissipate energy. Near the bottom of the scale is
another mark labeled MEP. Energy below this
mark triggers an SW TO MEP message. An
arrow on the bottom half of the scale marks the
straight-in (STRT) energy level. Below this
mark, an OTT ST IN message is triggered.
The arrow disappears at 45 n. mi. range,
signifying that a downmode to STRT will
probably produce a longer range-to-go.
For low energy situations, it is best to try the
STRT downmode first. This avoids a short OGS
prior to preflare. If energy is still below the
MEP mark, try the MEP downmode. The best
downmoding option is a function of the HAC
turn angle. For example, downmoding from an
OVHD to STRT-IN within 180 has little effect.

7. TRAJECTORY MANAGEMENT
7.4-6
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
Unfortunately, the energy pointer is not very
useful in deciding if the orbiter can make the
runway.
The orbiter bug combined with
airspeed must be used. If the orbiter bug is on
the low line on the VERT SIT and the orbiter is
currently flying maximum L/D, then the
runway will barely be reached on a no-wind
day. If the orbiter bug is on the high line on the
VERT SIT and the orbiter is currently flying
maximum airspeed, then the runway will barely
be reached on a no-wind day.
Both the high and low lines assume that no
downmode is made.
An S-turn, selecting
straight-in, selecting MEP, or selecting a different runway will all have large changes to the
range flown to the runway.
NOTE
Take CSS before evaluating different
downmodes so that the displays can be
assessed without committing a turn in the
new direction.
If the downmode is
accepted, AUTO flight control can be
resumed.
In summary, crew concerns during TAEM are:
Remaining within critical flight control
and structural limits (q-bar, NZ, beta,
roll angle, angle of attack)
Ensuring timely and accurate data are
input to the NAV state
Maintaining E/W within limits required
to achieve A/L interface
Monitoring critical systems
Keeping pace with increasing workload
Takeover
In addition to the takeover conditions discussed
in the Entry section, the crew must downmode
to pitch CSS if air data has not been taken to
guidance and control (G&C) prior to Mach 2.5
(ITEM 28 on SPEC 50 HORIZ SIT). Since TAEM
guidance tries to set up an altitude/range
profile, a transient is possible if NAV altitude is
incorrect prior to air data being incorporated. A

step change in FCS gains is also possible due to

Mach, alpha, and q-bar errors. If air data is not
incorporated into G&C by Mach 2, the crew
must go CSS and fly theta limits. Flying theta
limits is discussed later in this section.
Manual Control
The easiest way to fly TAEM manually is to
precisely fly the guidance needles on the ADI.
Each tick mark in pitch is the equivalent to a
0.25g error, and each roll tick mark is a 5 roll
error. Maintaining even a one tick mark error
over an extended period of time can cause large
errors in the trajectory.
During the supersonic portion of TAEM, the
pilots main goal is to guide the orbiter to the
edge of the HAC on the glideslope with the
correct amount of energy. As with the rest of
entry, closely following guidance provides the
best chance for coping with environmental
dispersionsif guidance is working correctly.
If NAV is bad (guidance is also bad),
TACAN/GPS data can be taken directly to the
HSI and the Area Nav HAC can be flown
(mentioned earlier in this section).
With good NAV, put the H pointer on the
HSI on the lubber line (the predictors will point
at the HAC on SPEC 50).
The most precise pitch control indicator is the
orbiter bug on the VERT SIT. Pitch up and
down until an H-dot that drives the orbiter bug
back to the nominal line is achieved. Make sure
not to fly slower than max L/D or faster than
maximum airspeed. Max L/D is best flown by
using max L/D alpha. L/D alpha is not a
function of weight and roll angle and responds
much faster than airspeed.
The maximum airspeed of the orbiter is now
333 KEAS. TAEM and the displays still have
the old limit of 305 KEAS supersonic built in.
Because of worst case air data errors, it is
recommended not to go over 321 KEAS (actual
indicated airspeed).
If very low, fly maximum range alpha (max
L/D) and change the HAC or runway selection
if required. Back up navigation with real world
visual cues if weather permits.

7.4-7

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
In extreme cases where guidance and
navigation are bad, a GCA, along with the view
out the windows, can be used to arrive
overhead the field for landing.
GCA
procedures are discussed in Section 7.3.

NOTE
Any delay in following the guidance
commanded roll on the HAC can result in
going below glideslope, even if the
guidance needles are flown perfectly after
the delay.

Manual control during the subsonic portion of

TAEM is discussed later in this section.

Heading Alignment Cone

The HAC is intercepted at various altitudes,
depending on HAC turn angle. The altitude
varies between about 50,000 ft for a 360 HAC
to 20,000 ft for a 90 HAC (straight in). The
SPEC 50 HORIZ SIT horizontal scale and the
ADI roll rate pointer provide a HAC turn
prediction or countdown.
A proper lead is the easiest way to keep the roll
guidance needle centered. Leading the HAC
turn correctly will quickly establish the orbiter
on the HAC without calling for more than 45
bank nominally or up to a maximum of 60 with
a strong tailwind. As long as NAV and
guidance are good, closely following guidance
on the HAC will optimize the chances of
staying within vehicle g limitations and
countering wind effects.
HSI glideslope data (GSI) can also be used to
maintain situational awareness while flying the
HAC in order to anticipate guidance commands
and minimize deviations from the reference
altitude profile.
The circle displayed on SPEC 50 is based on the
instantaneous radius of the HAC at the orbiters
current position. For large HAC turn angles,
the extended runway centerline initially will be
projected inside, rather than tangent to, the
SPEC 50 circle. As the orbiter continues around
the HAC, the circle will become tangent to the
runway extended centerline.
Since the
displayed circle is based on the instantaneous
HAC radius, there will be a very slight
trajectory error if the predictor dots are overlaid
on the circle. For most situations, these errors
are small and do not affect the usefulness of the
SPEC 50 display. To fly precisely on the HAC
requires that the guidance predictor dots be
maintained slightly inside the SPEC 50 circle.

The SPEC 50 HORIZ SIT and ADI rate pointer

scales for crosstrack error and glideslope error
may also be used to fly the HAC. Keeping the
reference triangle or pointer centered on the
scales ensures flying the reference trajectory.
HAC Options
Profile options are included in the guidance and
navigation system to improve low energy
situations. The options include:
Straight-in approach
HAC shrink (spiral adjust)
MEP
Selecting the straight-in approach option on
SPEC 50 will reduce the HAC turn angle to 180
or less. When guidance computes the orbiter to
be well below glideslope, a HAC shrink is
invoked automatically by TAEM guidance. The
HAC radius shrinks, allowing the orbiter to fly
a shorter approach profile. The final HAC
radius is normally 14,000 feet but the HAC can
shrink to a final radius of 5,000 feet if necessary.
NOTE
A HAC shrink will occur only if the
remaining HAC turn angle is greater than
90 and the orbiter is on the HAC.
The MEP option moves the HAC center point
3 n. mi. closer to the runway. MEP is selected
by ITEM 7 on SPEC 50.
Range savings using these options vary as a
function of HAC turn angle.
None of the options are nominal procedures.
They are used only when the orbiter is in a low
energy situation.

7. TRAJECTORY MANAGEMENT
7.4-8
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
R 001
10s P 344
Y 000

20

0
Straight in
Range saved
(n. mi.)

03

5K

33

10

30 1.2g

06

0
MEP

33

0
360

270

180

33

Overhead HAC turn angle

(deg)

33

12

24 1.2g

892.cvs

15

Range Saved vs. HAC Turn Angle

Default Air Data and Theta Limits

Operationally, do not exceed 50 angle of

bank during theta limits. Bank angles
greater than 57 will exceed maximum
and/or minimum theta limits.

ADI in TAEM with Theta Limits Bracket

WARNING
No warning is provided when pitch up
alpha limits are exceeded. Crewmembers
should closely monitor theta limits and air
speed to prevent loss of control. The pitch
error needle will command past this limit if
in a low energy situation or approaching a
HAC greater than 300. Mach 1.5 to 1.0 is
the most critical phase.

Although default air data ensures that the flight

control gains are set correctly, it essentially
removes the airspeed limiting features on
TAEM. Default air data will never tell TAEM it
is flying too slow or too fast.
Theta limits are a set of pitch attitude limits that
keep the orbiter between minimum and maximum airspeeds. Vehicle pitch attitude, as well
as the NOSE HI and NOSE LO limits, is
displayed on the VERT SIT display. Also, a
theta limits bracket (green) appears on the ADI
if ADTA is not taken to G&C or if ADTA is in
dilemma, and Mach <2.0. The ADI theta limits
bracket is dynamic and contracts/expands
according to bank angle. A 50 bank angle limit
is imposed when flying theta limits. With no air
data to G&C, theta limits apply from 1500 fps
(2000 fps operational constraint) until rolling
out on final.

5K

If air data has not been incorporated to G&C by

Mach 1.5, default air data values will be used to
set DAP parameters. Default air data should
ensure adequate flight control for a safe
landing, although flying qualities might be
degraded.

NOTE

21

NOTE
Theta limits and a tailwind combination
can rapidly cause a low energy situation,
requiring aggressive corrections. This is
one of the situations where the crew will
take the last ADTA data, if available,
rather than fly theta limits.

Outer Glideslope
The OGS is an equilibrium glide path that
provides sufficient energy at preflare for a safe
landing. Sufficient energy includes:
Having enough energy to compensate
for deceleration between preflare and
touchdown

7.4-9

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
Allowing a minimum of 5 seconds of
stable flight time on the IGS for the pilot
to make final corrections
To provide sufficient energy at preflare, the
OGS design must handle both high and low
energy dispersions over the entire weight span
of the orbiter. The OGS is a sloped-line segment
that intercepts the ground at the aim point.

Light Weight
Outer Glide Slopes
20

Guidance and Control

For Vehicle
Weights Between
180,000 & 220,000 lbs

X-zero
6,500'
Close-in
7,500'
Nominal

893.cvs

OGS Profile
Time to correct trajectory dispersions is
provided by the altitude at which the OGS is
acquired. Nominally, this occurs at 12,000 ft.
Transition from TAEM to A/L guidance
normally occurs at 10,000 ft, but if the transition
criteria have not been satisfied by 5000 ft, A/L
transition is forced. The criteria for transition
from TAEM to A/L get tighter as altitude
decreases. This allows A/L equations to cycle
through initial transients and time for the rate
terms to reach their damping values.
TAEM TO APPROACH/LAND TRANSITION CRITERIA
10,000 FT
<4
DEG

FLIGHT PATH ANGLE ERROR

5000 FT
< 0.5
DEG

< 1000

FT

CROSSRANGE ERROR

< 100

FT

< 1000

FT

ALTITUDE ERROR

< 50

FT

PSF

DYNAMIC PRESSURE
ERROR

< 24

PSF

< 24

(288-312 KEAS)

while maintaining sufficient speed brake reserve

to cope with winds and trajectory dispersions.
Since both high and low energy dispersions are
possible, GSs were selected that resulted in a
speed brake setting of 65 percent for midrange
weights. One of the reasons for not forcing A/L
guidance until 5000 ft is that TAEM has direct
q-bar control limits that will keep the orbiter on
the front side of the L/D curve.

(288-312 KEAS)

TAEM to A/L Transition Criteria

Guidance attempts to maintain the referencealtitude-range profile by computing a normal

acceleration command to guide the orbiter
along the selected OGS trajectory. The NZ
command is converted to a pitch command and
displayed on the ADI and HUD. If the pitch
command results in a velocity that is different
than 300 KEAS, the speed brake responds to
correct the velocity error.
Leaving the speed brake in AUTO allows
guidance to reposition it, as required, to
maintain the reference 300 KEAS velocity.
The body flap, if in AUTO, is commanded to
retract to the trail position (34% on SPI) on the
first A/L guidance pass.
Navigation
Upon receiving good data from the groundbased MLS, preland navigation is begun.
Unlike entry NAV, preland NAV maintains
only one state vector, but executes twice as fast
(every 1.92 sec vs. 3.84 sec).
The MLS provides extremely accurate azimuth,
range, and elevation, which correct the onboard
NAV state. Typical errors are about 5 ft
altitude, 21 ft downtrack, and 17 ft crosstrack
when processing MLS data.

Reference velocity on the OGS is 300 KEAS for

all vehicle weights. This velocity is required to
compensate for the expected deceleration on the
IGS. The design goal is to fly as fast as possible
while remaining within maximum airspeed
limits (333 KEAS)/q-bar (375 psf).
A 20 OGS is used for lightweight vehicles and
an 18 OGS for heavyweight vehicles. The
design goal was to fly as shallow as possible
7. TRAJECTORY MANAGEMENT
7.4-10
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

NOTE
Both range and azimuth data good
flags are required to process MLS data.
Without an elevation data good flag,
azimuth and range are still processed, but
if either the azimuth or the range data
good indicator is lost, all MLS processing ceases.

USA007587
Rev. A
If MLS data are lost for any reason (above 1500
ft) after processing has begun, TACAN and
ADTA information will again become available
to NAV until 1500 ft and 500 ft respectively. If
MLS data are lost below 1500 ft, ADTA altitude
processing is not possible.
NOTE
With TACAN data in FORCE mode, MLS
data cannot be processed.
Smart Speed Brake Logic
To control orbiter touchdown energy, the speed
brake is retracted at 3000 ft to a value calculated
by onboard guidance that will target the
remaining velocity profile to a fixed touchdown
energy. The calculated speed brake position is a
function of:

Wind speed
Vehicle weight
Velocity error
Density altitude
Aim point (if applicable)
Short field speed brake option (if
applicable)

This position is maintained until 500 ft where

the A/L guidance calculates an adjustment to
the retract angle. This adjustment is based on
any changes in winds and predicted density
altitude since the 3000 ft calculation. No more
adjustments are made until touchdown. The
500 ft adjustment altitude was selected because
the time to fly from 3000 to 500 ft is approximately the same time it takes to fly from 500 ft
to touchdown.
This allows time for the
adjustment to have an effect on the vehicle
energy state.
When the close-in aim point is selected, 1000 ft
are directly added to the downrange total. The
idea is to keep the same touchdown energy
target even though the geometry has been
shifted in by 1000 ft. This lets the vehicle
respond to atmospheric conditions that
required the close-in aim point.
Selecting the short field option on SPEC 50
forces Autoland guidance to dissipate an
additional 1000 ft of touchdown energy. The

energy dissipation is achieved by carrying an

additional 12 to 13 of speed brake from 3000 ft
altitude to touchdown. When this option is
used, the pilot lands the orbiter 10 KEAS slower
than the planned touchdown velocity and
maintains the same nominal 2500 ft touchdown
range. From an energy point of view, the
additional 1000 ft of dissipated downrange can
be converted to a velocity 10 KEAS slower than
nominal touchdown velocity.
The short field speed brake retract option may
also be used on all missions if the touchdown
ground speed is predicted to be greater than the
flight rule limit (214 knots). Using the short
field option for this reason will be decided by
the flight director and will require an item 39
entry by the crew. The goal is to provide
additional margin from the 225 KGS certified
tire speed limit. It is for this safety concern and
for common training procedures that when the
short field option is used, the crew should land
10 knots slower rather than 1000 ft shorter.
The short field option may be selected for
TAL/ECAL runways to ensure an adequate
rollout margin. In the case of heavyweight
abort landings at runways with useable length
of less than 11,000 ft, the CDR will target
touchdown for 205 KEAS at 1500 ft down the
runway.
An additional speed brake option, selected with
an ITEM 39 on SPEC 50, is the emergency
landing site (ELS) speed brake. ELS speed
brake will be selected for heavyweight landings
on runways with a usable length of less than
8500 ft.
ELS speed brake dissipates an
additional 1500 ft of energy over the short field
option. For landings with ELS speed brake
selected, the CDR targets 195 KEAS at 1000 ft.
The maximum allowable nominal speed brake
command at 500 ft is 50 percent, because of
degradation of orbiter handling qualities near
touchdown. This maximum limit is 80 percent
when the short field, or ELS option, is selected.
After the speed brake setting is adjusted at
500 ft, the guidance command remains constant
until the weight-on-wheels signal is sent to the
GPCs. When this signal is latched, the speed
brake is commanded to full open.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-11

USA007587
Rev. A
Visual Aids
Aim Points
The OGS aim point location was determined by
energy requirements for landing and geometry
constraints for transition between the two
glideslopes.
Distance from preflare to
touchdown
is
proportional
to
orbiter
deceleration time. This distance is directly
related to aim point location.
The nominal aim point is located 7500 ft from
the runway threshold. A close-in aim point is
located 6500 ft from the runway threshold. Use
of the close-in aim point provides an immediate
energy increase by moving the OGS intercept
point 1000 ft closer to the runway.
The nominal aim point is a rectangle, whereas
the close-in aim point is a triangle. Colors are
chosen to contrast with the local terrain. Aim
points on lakebeds and light-color terrain are

3,000 ft

usually black. For tree- or vegetation-covered

terrain, aim points are usually white. A dark
background is preferred for the precision
approach path indicator (PAPI) lights, which
are placed on each aim point.
PAPI Lights
The PAPI lights define the OGS. On a nominal
approach, the crew should see two red and two
white lights (20 GS).
For heavyweight
landings, an 18 GS is flown (three red and one
white PAPI.
Three intensity settings are available for the
PAPI lights: day, dusk, and night.
At fixed installations such as Kennedy Space
Center and some Edwards and Northrup
runways, intensity is controllable from the
tower. Portable PAPIs must be adjusted at the
aim point.

Portable approach light system

240 ft
100 ft

Aim point
4 PAPI lights, 40 ft spacing
110 ft
2 strobe lights

6,500 ft

Close-in aim point

240 ft
100 ft
4 PAPI lights, 40 ft spacing
(nominal aim point)

7,500 ft

895.cvs

Aim Points

7. TRAJECTORY MANAGEMENT
7.4-12
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A

23
21
20 OGS-1
19
18 OGS-2
17

23 and above

21 to 23

19 to 21
Runway
17 to 19
Aim Point
Designed to look like
equilateral triangle
when on glideslope

17 and below

White
Red
Light Legend

896.cvs

PAPI Light Diagram

Techniques
When established on the OGS, the HUD
runway should overlay the actual runway.
Differences indicate the amount of NAV error.
If the overlay is good, then NAV and guidance
should be good, and declutter level one or two
may be selected and the guidance symbol
followed.
If excessive NAV error exists,
declutter but do not follow guidance. The HUD
gamma reference marks should lie next to the
aim point if the vehicle is on the proper
trajectory.
Without a HUD, use the ADI error needles as
long as the NAV state is good. With MLS data,
the NAV state will generally be very good. Use
of TACAN only will produce errors requiring
the pilot to fly the OGS primarily using the
HUD and external references.
Since the PAPI lights only show an
instantaneous GS status, they must be
continuously monitored for trends.
If the
onboard NAV state is reasonably good, and the
crew tracked guidance around the HAC, energy
should be close to nominal, and the HUD
velocity vector should be positioned near the
aim point after rolling wings level on final. If
the PAPI lights are not operational, use the
rectangle on the ground at the nominal aim
point (or the triangle at the close aim point), and

align the gamma reference marks on the HUD

with the appropriate aim point on the ground.
Night approaches should be considered
instrument approaches. Due to lack of outside
references, bank control is more difficult. Sink
rate is not apparent until after preflare.
The speed brake is left in AUTO mode for the
approach. This allows automatic guidance to
command the speed brake to control airspeed
on the OGS to 300 KEAS. There are failure
modes that may fail the speed brake in any
position from full open to full closed.
With speed brake stuck closed, lowering the
landing gear early results in equivalent drag of
60 percent speed brake.
Stuck open speed brake can be compensated for
by flying a steeper OGS with an adjusted aim
point closer to the runway.
If a higher than nominal altitude condition
exists at rollout (GSI full deflection), the CDR
must make an immediate and aggressive
pushover to reacquire the proper flightpath to
ensure the transition to A/L occurs as early as
possible.
If the BFS is engaged, it is even more imperative
that the CDR make an early attempt to correct
to the proper glidepath, since the BFS has no
A/L guidance mode.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-13

USA007587
Rev. A
CAUTION
When rolling onto the OGS with excess
altitude, TAEM prefinal guidance gains
may not be aggressive enough to command
the orbiter back into the A/L envelope. If
guidance is followed, the resulting flightpath will parallel the reference OGS with
the aim point displaced down the runway.
When A/L is forced (not later than 5000 ft
AGL), guidance will give aggressive pitch
commands to try to reacquire the OGS. If
followed, these commands could result in
an excessive dive angle requiring as much
as a 2.0 g pullout for the preflare maneuver.
This can be avoided if the CDR closely
monitors the HSI GSI while flying the HAC
and bearing in mind that the ADI pitch
steering needle provides a much more
noticeable indication of NZ command than
the HUD.

Since the speed brake is retracted at 3000 ft and

preflare nominally occurs at 2000 ft, the
orbiters velocity will increase about 10 KEAS.
As flight path angle nears the minimum steady
state value (-12), velocity will begin to
decrease.
Techniques
There is a strong tendency, especially with
inexperienced pilots, to be too aggressive in the
preflare or to anticipate the maneuver, ending
up high and slow. This tendency is aggravated
at night, when closure rate and depth
perception cues are reduced.
CAUTION
The preflare is a gentle maneuver. Early
and/or aggressive preflare may result in a
high and slow inner glideslope from which
a hard landing can occur.

Preflare
The preflare maneuver is used to transition
from the OGS to the IGS. Flight path geometry
is a sector of a circle tangent to the OGS and an
exponential to the IGS. H-dot of about 190 fps
must be reduced to less than 3 fps at touchdown. Preflare reduces H-dot to about 12 fps,
with the remainder taken out in final flare.
Pullup is about 1.35 g.

Note: Not drawn to scale

Utilizing the HUD flare markers will generally

result in good preflare maneuvers. Approaching 1000 ft to 800 ft, use the ball bar to intercept
the IGS at about 300 ft. Without a HUD, the ball
bar is the best reference during preflare.
For some low energy cases, delaying preflare to
as late as 1000 ft may help to correct the
situation. Perform a flare maneuver that results
in a landing with a very minimal amount of
IGS. Stuck open speed brake (greater than 60
percent) will require a more aggressive preflare
with very little time on the IGS.
CAUTION

Radius

Failure to anticipate the rapid airspeed

decay during preflare with stuck open
speed brake (more than 60 percent) may
result in high sink rate landings.

Pullup circle

Decay
altitude
Inner
glideslope
Exponential
range

Exponential
to the IGS

Runway centerline
Threshold

IGS
intercept
897.cvs

Preflare Geometry

Use crab angle to control drift due to crosswind

during the preflare. A significant change in
crab angle during preflare should be expected
due to the large change in airspeed and altitude
during the maneuver.

7. TRAJECTORY MANAGEMENT
7.4-14
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A

Inner Glideslope
Transition to the IGS begins at 300 ft. Once the
landing gear is deployed, and the orbiter is on
the IGS, deceleration is fairly constant at 4
KEAS per sec. Each additional second the
orbiter remains airborne results in a 4 knot
slower touchdown velocity. The 1.5 IGS was
designed to give the pilot at least 5 sec of stable
flight before final flare.
Once stabilized on the inner glideslope, since
the orbiter is decelerating, some pitch attitude
changes will be required to maintain the desired
trajectory.
Landing Gear
The landing gear creates a great deal of aero
dynamic drag, which can significantly alter
touchdown energy.
The landing gear is
deployed on an altitude cue by the pilot who is
not flying the approach. Current flight procedures are to arm the gear at preflare (2000 ft)
and lower the gear at 300 100 ft. The design
requirement is to have the gear down and
locked at least 5 sec before touchdown. Gear
deploy should not be delayed below 200 ft. A
100 ft difference in gear deploy altitude equals
about 250 ft of touchdown energy. A nominal
300 ft deploy is assumed in landing energy
predictions.
Final Flare
The final flare maneuver reduces H-dot on the
IGS to an acceptable value at touchdown. Final
flare should be a smooth increase in pitch
attitude started at an altitude high enough to
result in a timely decrease in H-dot before
touchdown. Strive to touch down 2000-3000
feet down the runway at a safe rate of descent.

Shoot for an airspeed within +5 to -10 knots of

the target airspeed.
Maximum H-dot at touchdown was designed to
protect the main gear struts from unacceptable
loadings.
Each strut can withstand up to
207,000 lb, although the actual H-dot limit varies
from 6 to 9 fps as a function of vehicle weight
and crosswind.
A very important factor in reducing H-dot is the
powerful aerodynamic ground effect of the
orbiter. This effect grows as altitude decreases,
increasing L/D by about 25 percent. Minimize
RHC inputs prior to touchdown, and expect
ground effect to cushion sink rate.
The 1.5 IGS used by guidance is a compromise.
It does not require a large maneuver to land, yet
maintains a reasonable ground clearance when
coming out of preflare.
Techniques
A negative handling quality of the orbiter is that
initial vehicle response to pitch control inputs is
backwards from the desired performance. This
is due to relative locations of the c.g.,
aerodynamic center, control surfaces, and the
pilots seat. For example, a pitchup command
from the RHC causes an upward elevon
deflection. The up elevon initially causes a
decrease in lift (approximately 2000 lb per
degree), and the wheels actually move closer to
the ground at a faster rate. The expected
positive lift increment will not occur until the
orbiter has rotated to a higher angle of attack.
CAUTION
Attempting to reduce H-dot may actually
increase the rate, and, if timed incorrectly,
can result in an early touchdown.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-15

USA007587
Rev. A
2200 ft
7500 ft

500 ft

BALL
light (white)

BA R
lights (red)

15 ft spacing
50 ft

PAPI lights

2500 ft
898.cvs

Ball Bar Geometry

Pilot eye height just prior to landing is nearly
constant. Therefore, out-the-window cues are
poor indicators of actual H or H-dot after
control inputs.
The HUD should be used to monitor pitch
attitude and make precise adjustments both on
the IGS and for final flare. For no-HUD
approaches, use the far end of the runway or
the horizon, since pitch attitude changes are
very difficult to see due to a lack of references.
A bang-bang technique of pitch attitude
corrections on the IGS has proven to be effective
for some pilots. Small pitch inputs are made,
and the RHC is quickly returned to detent.
After each input (or series of inputs for larger
corrections), wait until the effect is apparent
before making another correction.
This
technique is less effective as landing weight
increases and c.g. moves forward.
Ball Bar
The ball bar defines a 1.5 GS. Overlaying the
center of the ball across the center of the bar
results in a threshold crossing height of 26 ft.
Normal guidance profile changes due to winds
will result in some difference in threshold
crossing heights. Try to shoot for 20-30 feet
threshold crossing height during training.
Touchdown rectangles on the runway surface
may also be used. The leading edges of the
marks are 2500 ft from the threshold, and the

marks are 200 ft long and 40 ft wide. Aiming

the orbiter straight toward the marks from ball
bar intercept until final flare results in good IGS
control and safe threshold crossing heights.
This technique is especially helpful for no-HUD
approaches.
For the final flare, matching digital altitude and
digital airspeed on the HUD (40, 240 . . . 30, 230
. . . 20, 220) will result in a smooth maneuver
from the IGS to touchdown.

Touchdown
A/L trajectory was designed to result in
touchdowns about 2500 ft past the runway
threshold at a safe speed and sink rate.
The same touchdown speeds are usually
targeted by the pilot when flying CSS to
provide a more consistent energy reserve and
orbiter pitch attitude at touchdown. Energy
reserve is the time (in sec) that the orbiter could
have flown until pitch attitude reached
tailscrape angle (15). Energy reserve varies
with weight, since heavier vehicles must fly
faster than lighter vehicles in order to produce
aerodynamic lift equal to weight. Consistent
energy reserve and consistent pitch attitude are
very important factors that help pilots land with
sink rates within vehicle limits. With nominal
speed brake selected target touchdown speed is
195 KEAS for weights less than or equal to
222,000 lb and 205 KEAS for weights greater
than 222,000 lb.

7. TRAJECTORY MANAGEMENT
7.4-16
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
T/D velocity by vehicle weight
(KEAS)

T/D
Point
(ft)

< 200 K

200 K - 222 K

> 222 K

> 245 K

Nominal

2500

195*

195

205

205

Short field - for tire speed margin

2500

185

185

195

205 @
1500 ft

Speed brake selection

Short field - for runway length

1500

195

195

205

205

ELS

1000

n/a

n/a

195

195

* 185 KEAS is acceptable for certain touchdown energy cases.

Touchdown Targets
Energy Reserve/Tailscrape
Starting with STS-50, the speed brake (in
AUTO) targets 2500 ft at 195 KEAS touchdown
energy for lightweight vehicles and 205 KEAS
for heavyweight vehicles. A rough rule of
thumb is 90 ft of touchdown distance
corresponds to 1 knot of airspeed.
ENERGY RESERVE =

VTailscrape - VTouchdown
DecelerationAvg

Variations in touchdown energy of 500 feet

due to the factors listed above are not unusual.
Pilots should strive to touch down 2000-3000
feet down the runway at a safe rate of descent
within +5/-10 knots of the target airspeed,
allowing touchdown airspeed to vary slightly
with touchdown energy dispersions. Minimal
RHC activity prior to touchdown is desired to
preclude pilot induced oscillations.
For crosswind landings, use crab angle to
control drift. Maintain the required crab angle
all the way to touchdown.
Weight on Wheels Discretes and Flight
Control Moding

15 deg
(for the body flap
in trail)
TAILSCRAPE The maximum pitch attitude (deg) the
vehicle can land at and not scrape the tail (body flap).
ENERGY RESERVE The time (sec) the vehicle
could have continued flying after touchdown until the
tailscrape condition.
899.cvs

The most significant

touchdown energy are:

factors

influencing

Winds
Density altitude
Vehicle weight
Velocity error at 3000 ft
Off-nominal factors such as landing gear deploy
altitude, GNC air data errors, tile damage, stuck
speed brake, and NAV errors may also be
significant.

At touchdown, the weight on wheels (WOW)

discrete must be set to properly mode flight
control for derotation and rollout. WOW is
automatically set by the combination of wheel
speed sensors and squat switches (weight on
wheels sensors) in the main landing gear struts.
Weight on nose gear (WONG) discretes are set
by the squat switches in the nose gear. The
crew can set the WOW/WONG discretes
manually by selecting the SRB or ET
SEPARATION MAN mode and depressing the
appropriate pushbutton. Procedurally the SRB
Sep switch is favored over the ET Sep switch
because the SRB Sep switch is a single toggle
switch and the ET Sep switch is an over-center
lever lock switch. This makes the SRB Sep
switch easier and quicker to operate.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-17

USA007587
Rev. A

SRB SEPARATION and ET SEPARATION

Switches and Pushbuttons on Panel C3

CAUTION
Failure to set the WOW/WONG discrete
allows the DAP to remain in A/L mode.
Flight control gains are not optimized for
derotation and rollout and may cause
control problems. Braking and nose wheel
steering will not be available.
Crews are trained to routinely set WOW/
WONG manually at nose gear touchdown to
protect for a WOW and/or WONG discrete
failure.
WARNING
Do not attempt to set WOW/WONG
manually prior to nose gear touchdown. If
set in the air and pitch attitude is less than
0, as on the OGS, the WOW/WONG flags
are set true, including elevon load relief.
Elevon load relief drives the elevons to the
10 down position, causing an abrupt pitch
down maneuver. Additionally the pitch
axis modes to AUTO and the RHC pitch
CSS downmode angle opens to 21.7. This
requires full aft RHC to mode back to CSS
and recover from the pitch down. If a
manual SEP pushbutton is depressed at
main gear touchdown, the rollout discrete
will be set when pitch attitude decreases
below 0. Elevon load relief would cause
excessive rates on the nose gear strut at
slapdown.

Once the WOW discrete is set, the speed brake

opens to 100 percent to help slow down the
vehicle. The WOW discrete also sets flat turn
and HUD discretes, which cause mode changes
in the aerojet DAP. In the roll/yaw channel,
when WOW is set, rudder trim and aileron trim
freeze, and auto load balancing becomes active.
Auto load balancing uses aileron commands
generated through the roll channel to balance
loads on the main tires. These commands are
computed as a function of true airspeed, lateral
acceleration, and vehicle yaw rate. Also at main
gear touchdown, lateral acceleration feedback
and rudder trim loops are opened. In CSS,
pitch axis information drives only the ADI error
needles. Brake isolation valves are opened
allowing the main wheel brakes to operate.
Operationally, braking is delayed until after
WONG, past midfield, and less than 140 KGS.

Derotation
There are two phases of the derotation portion
of orbiter landings, attitude hold and the
derotation maneuver itself. Both are important
and are discussed separately for clarity.
Attitude Hold
This phase is designed to reduce maximum
loads on the main landing gear. Pitch attitude
is held constant until EAS decreases to 185
KEAS, when beep trim is used to perform the
derotation.
This speed was selected as a
compromise between maximum load on the
main gear, maximum load on the nose gear,
time between touchdown and start of
derotation, and the need to have the nose gear
on the runway surface in time to start braking.
Derotation Maneuver
Derotation is accomplished by the CDR pushing
the RHC trim switch (the beep trim switch)
forward at 185 KEAS. The beep trim switch
ramps up to a commanded 1.5 deg/sec rate and
gives a smooth derotation. The manual backup
derotation maneuver will be used if beep trim is
inoperable or inhibited. The recommended
pitch rate in CSS is 1 to 2 deg/sec. Input the
derotation command smoothly over a period of
1 to 2 seconds.

7. TRAJECTORY MANAGEMENT
7.4-18
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
Derotation must be commenced at the proper
speed and the pitch rate maintained throughout
the maneuver. Attempts to significantly slow or
stop the pitchdown rate can cause dangerous
pilot-induced oscillation (PIO).
Executing a manual derotation requires good
crew coordination and must be practiced in the
simulator. The pilot not flying the approach
and landing should call out airspeeds, with a
derotate statement at 185 KEAS. A positive
nosedown command must be input and held
with the RHC to generate the desired 1 to
2 deg/sec pitch rate.
When pitch rate is
established, callouts of down at 1, down at
1-1/2, . . . are very helpful in maintaining a
constant rate until nose gear touchdown. The
pitch rate needle on the ADI is the best source
of this information. The onset rate of the
derotation rate command is critical for
minimizing main gear loading during and after
derotation. Too quick an onset can result in
main gear oscillations and load spikes that go
over the max limit. Too slow an onset can result
in high nose gear loads. Heavy gross weight
landings on lakebeds (high rolling friction
coefficient) are the most difficult to control.
CAUTION
Derotation is a critical maneuver. Do not
delay derotation, especially on lakebeds at
heavy gross weight.
Loss of elevon
effectiveness can cause hard nose gear
slapdowns and possible structural damage.
Derotation must also be initiated at the
proper rate. If the derotation command is
input too quickly, main gear loads may be
exceeded at high landing weights due to
strut oscillations. If the derotation is input
too slowly or at the wrong rate, nose gear
limit loads may be exceeded.

limited to 42 M ft-lb for end of mission

landings. If predicted brake energy exceeds
these values, runway redesignation will be
considered.
Note that crosswinds directly increase resulting
brake energy when differential braking is used
for lateral control during rollout.
Short field speed brake may be selected on
SPEC 50 to achieve required rollout margin or
brake energy limits. This software logic adjusts
the speed brake retract function to target a
touchdown velocity 10 KEAS slower at 2500 ft
past the threshold for all weights.
Coast
Coast phase begins when the weight on nose
gear (WONG) signal is set. Elevons are moved
automatically from the position required to
control derotation to 10 down in order to
reduce loads on the main landing gear. The
crew should monitor auto load relief on the SPI.
If it does not occur, WOW/WONG should be
set manually with the SRB Sep switch and
pushbutton. WONG also sets the RHC to half
the original gains.

WARNING
Failure to perform load relief can cause
unacceptably high loads on the main gear,
resulting in potential tire failures and loss
of control.

Deceleration on the runway during coast is

about the same 4 KEAS per sec as on the IGS.
Nose Wheel Steering

Rollout
Two phases of rollout are coast and braking.
Rollout margin and brake energy limits are
defined to ensure the orbiter can stop prior to
the end of the runway. Generally, high-energy
rollout margin is considered to be 2000 ft and is
measured either from the end of the runway or
the end of the usable overrun. Brake energy is

HUD rollout discrete and groundspeed enable

are nominally set at nose gear touchdown.
Nose wheel steering (NWS) is available once
ground speed enable is set. Steering may be
accomplished with differential braking, rudder
inputs (above 100 KGS), or NWS. Two modes
of NWS are available:
1.

NWS 1(2): Rudder pedal deflections

incorporated as biases to NY feedback.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-19

USA007587
Rev. A
2.

OFF: No steering commands; nose

wheels caster.
Braking

The start of braking is normally determined by

groundspeed, although distance remaining on
the runway is also considered. Braking begins
when groundspeed is less than 140 KGS and the
orbiter has passed the midfield point, or if
distance remaining is less than 5000 ft.
Deceleration rate of 8 to 10 fps2 should be
maintained until below 40 KGS where the rate
is decreased to about 6 fps2. Maximum braking
is applied if distance remaining is less than 5000
ft at more than 140 KGS.
Barrier
The barrier net system has been removed from
all runways.
Techniques
NWS should be used for directional control and
brakes used for stopping unless differential
braking is required. NWS operations in NWS
1(2) are crisp and responsive with no tendency
to overshoot or overcontrol.

Rollout performance is best demonstrated in the

vertical motion simulator (VMS) at NASA Ames
Research Center. NWS and tire failures are
realistically modeled, allowing crewmembers to
experience actual orbiter dynamics while
making corrections. Crew coordination and
skills are practiced in the Shuttle Mission
Simulator (SMS). Crewmembers should ensure
that different rolling friction coefficients and
wind conditions are seen, as well as appropriate
system failures that disable or downgrade the
NWS system.

Handling Qualities
The space shuttle DAP is a rate command
system. When the RHC is moved from detent,
aerosurfaces are deflected to command a bank
or pitch rate. Due to control requirements
during high speed flight, the aerosurfaces are
very large and can generate large rates, even
with a heavyweight vehicle. Smooth control
inputs will minimize transients and the initial
tendency to overcontrol.

The NOSE WHEEL STEERING switch on panel

L2 has an extension device mounted on the
shaft to make it easier to locate.
If NWS 1 fails during rollout, NWS 2 may be
selected, however it is susceptible to the same
failure and become inoperative.
With NWS in NWS 1 (2) , the orbiter will tend to
turn into a crosswind during rollout. With
NWS in caster (OFF), the orbiter will tend to
turn away from a crosswind.
If a tire failure occurs during rollout, the orbiter
will turn toward the failed tire. When the
turning moments due to crosswind and tire
failure are in the same direction, large control
inputs will be required to maintain runway
centerline. When the turning moments are in
opposite directions, smaller control inputs will
be required, and pilots must be careful not to
overcontrol.

NOSE WHEEL STEERING

Switch on Panel L2
Control harmony is excellent in all axes, with
crisp response and essentially deadband
damping. Returning the RHC to detent reduces
vehicle rates to zero (plus or minus rate
deadbands). Control surfaces remain active and
will attempt to maintain attitude.

7. TRAJECTORY MANAGEMENT
7.4-20
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
The shuttle training aircraft (STA) is an
extremely accurate simulator of orbiter flying
qualities below 35,000 ft altitude. Training for
high and low energy cases in the STA will
prepare crewmembers to handle the actual
vehicle from about the 180 point on the HAC.
The STA also has the capability to demonstrate
navigation state errors up to 6500 ft short, 2000
ft long, and 1,200 ft laterally from the desired
touchdown point.

commands, resulting in high or low energy or a

flight control transient at a critical moment. At
3000 ft AGL, the speed brake is retracted
automatically to a computed value based on
wind, weight, density altitude, velocity error,
aim point, and short field option. At 500 ft
AGL, guidance can command a final
adjustment of the speed brake position based on
density altitude and wind velocity.

Elevons

ELEVONS
DEG

During subsonic flight, all four elevons are

commanded up and down simultaneously for
pitch control. For roll control, the elevons are
commanded differentially, similar to ailerons on
a conventional aircraft.

CAUTION

BODY FLAP
%

RUDDER-DEG

30

20

10

10

20

30

0
-30

L RUD

R RUD

20
-20

AILERON-DEG

40

-10

60

Body Flap
The body flap is used to trim the elevons during
entry and TAEM. When guidance transitions to
the A/L phase, the body flap is commanded to
trail. Normally, the body flap is operated in
AUTO. If the body flap is not in AUTO, the
crew should return to AUTO or manually
position the body flap to trail at A/L transition.

TE UP

+10

80

+20

100

L AIL

R AIL
SPEEDBRAKE %
ACTUAL

20

40

60

COMMAND

TE DW

080
80 100

080

1132.cnv

Surface Position Indicator

The speed brake is normally operated in AUTO
throughout approach and landing. Speed brake
position and command are displayed on the SPI
and the HUD.

The body flap is a large control surface and

exerts a powerful pitching moment on the
vehicle. Proper positioning is required to
ensure adequate control margins.

WARNING
The speed brake is a very powerful drag
device. Overlooking a stuck speed brake or
neglecting to retract the speed brake when
operating in MAN can result in
dangerously low energy.

Speed Brake
Although energy is controlled primarily by
bank angle and the resulting drag in hypersonic
and supersonic flight, the speed brake is the
primary energy control device in subsonic
flight. A/L guidance modulates the speed
brake to control airspeed, when operated in
AUTO. Speed brake position is constrained to a
lower limit of 15 to prevent physical binding of
mechanical linkages when the rudder is
deflected.
Manual control of the speed brake may be taken
if guidance or NAV is questionable.
For
example, erroneous air data could cause flight
control to generate erroneous position

Rudder
Corrected body roll rate is used in the DAP yaw
channel as a yawing rate error to generate
rudder commands. This essentially provides
turn coordination. Rudder pedal deflection
serves only to bias the NY feedback. Since
rudder deflection is largely a function of the
automatic stability loops, crewmember rudder
pedal input should not be required prior to
touchdown.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-21

USA007587
Rev. A
Trim
Automatic trim loops in the shuttle flight
control system work very well, and although
manual capability is available, it is not usually
required in the approach and landing flight
phase. One exception is after a BFS engage. In
this case, the trim values initialize at zero, and
the pilot can help the flight control system
return to a trimmed condition more quickly by
trimming manually.
Priority Rate Limiting

Using item numbers, the crew can place PRL in

automatic systems management, deselect a
system,
or
invoke
manual
systems
management. A failed system is indicated by a
down arrow in the system status column.
Failed systems are not used by PRL. Loss of
hydraulic pressure information can cause a PRL
dilemma and a question mark (?) is displayed
next to the affected system. When a dilemma is
declared, PRL leaves the system status as it was
prior to the dilemma. The crew can then either
manually deselect or reselect the system after
determining its real status using other cues.

All aerosurfaces (except the body flap) are rate

command limited by priority rate limiting (PRL)
software.
This allows full advantage of
available hydraulic system power while not
overloading the hydraulic systems.
Rate
command limits vary as a function of the
number of hydraulic systems available.
Simulations have shown that vehicle control is
adequate with reduced rate limits, but pilots
should be aware that control could
be
degraded in aggressive maneuvers. Beep trim
derotation will be used to prevent elevon
saturation and high nose gear slapdown loads.
HYD
SYS

ELEVONS AILERONS

SPEED
BRAKE

PRL STAT/MGMT ON OVERRIDE

SPEC 51 Display

RUDDER

13.9

13.9

5.47 (OP), 6.06 (CL)

7.0

20.0

20.0

6.1 (OP), 10.86 (CL)

12.0

20.0

20.0

6.1 (OP), 10.86 (CL)

14.0

PRL Rate Limits in Degrees per Second

Automatic PRL normally requires little crew
interaction. Hydraulic pressure from all three
sensors in each system is sent to the GPCs via
flight aft (FA) multiplexer/demultiplexers
(MDMs). A hydraulic subsystem operating
program (HYD SOP) provides redundancy
management (RM) for fault detection and
isolation of failed transducers. A selection filter
generates one pressure from each system.

Wind Effects on Trajectory

Winds affect the orbiters capability to fly the
desired HAC trajectory and can result in high or
low energy situations if not handled correctly.
Since the onboard navigation and guidance
systems cannot predict winds, the crew must be
prepared to anticipate high wind conditions
and compensate for them. Information on wind
speed and direction is passed to the crew prior
to the deorbit burn.
This information is
updated as required during entry. Data are
provided for the following altitudes:

HYD SOP declares a hydraulic system failed if

the selected system pressure drops below
1760 psi.
Fail flags are provided to PRL
software, which then rate-limits aerosurface
commands based on number of good systems.
PRL status and management are on SPEC 51.

7. TRAJECTORY MANAGEMENT
7.4-22
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A

ALTITUDE
50K
38K
28K
20K
12K
7K
3K
1K
SURF

KEAS. Large sink rates and hard landings may

result.

HAC
POSITION

Crosswinds

270
180
90
FINAL

Use crab angle to control lateral drift due to

crosswind from outer glideslope intercept until
touchdown. Expect a noticeable change in crab
angle during preflare and on the inner
glideslope due to the large changes in velocity
and the change in wind speed as altitude
decreases.

Wind Data Table

The current speed brake energy-control logic in
TAEM guidance compensates for wind
conditions prior to and on the HAC to maintain a
nominal energy profile.
Manual flying
techniques should not be required to counter
wind conditions. Normal piloting techniques,
flying the guidance needles, should be sufficient.
Wind data is obtained by the Flight Dynamics
Officer (FDO) in the MCC from the NASA
meteorologists. Wind data is forecast based on
balloon data and later compared to winds
observed by the STA weather aircraft. Since the
wind conditions that can cause low energy have
much more serious consequences, they are
discussed in more detail here.
Constant Headwind
For a given reference airspeed, any headwind
greater than zero will result in less kinetic
energy (less ground speed) than the no wind or
tailwind case.
Sudden Headwind Increase
For a given initial energy state, a headwind
shear will cause more drag and greater energy
loss, until the pilot compensates for the
immediate drag increase.

Post touchdown, align the fuselage with the

runway to reduce nose gear side loads at nose
gear touchdown. During rollout, the orbiter
will tend to turn into a crosswind with NWS in
NWS 1(2). With NWS inactive, the orbiter will
tend to turn away from a crosswind.
Limits
Headwind, tailwind, and crosswind limits are
listed in the Flight Rules and summarized in the
Limits section of this manual. These limits are
conservative and are based on simulator, wind
tunnel, and actual flight data. End of mission
runways are selected so that all parameters are
within limits.

Backup Flight System

The BFS is capable of performing nearly all of
the primary flight system functions during
TAEM, approach, and landing. This section
presents the major differences, from the flight
crew viewpoint, between the two systems.
Differences in handling qualities between the
PASS and the BFS are very small in the training
simulators, and no large differences are
expected if BFS is engaged onboard the orbiter.
A moderate control transient should be
expected when BFS is engaged.

Tailwind Below 50 Feet

The BFS does not support PTIs. Flight control

mode is CSS from engage through landing
rollout.

Tailwinds, or reduction in headwinds, are

normally favorable in a glider because of the
reduction of drag. However, at less than about
50 ft, the beneficial effects of drag reduction,
integrated over such a short period of time, are
outweighed by the sudden loss of available
energy caused by the instantaneous decrease in

The BFS maintains only one state vector during

entry. Redundancy management is performed
on most systems, but in a simpler manner than
PASS. BFS is also set up to accept air data to
G&C immediately upon engage. If air data has
not been previously accepted in PFS, the crew
should inhibit air data to G&C after BFS engage.
7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-23

USA007587
Rev. A
MLS is not supported. Guidance terminates in
BFS at 2000 ft, ADI error needles are stowed, and
the speed brake is commanded closed at 2000 ft.
On a BFS approach to landing, the crew must
manually set the speed brake to the DEL PAD
setting at 3000 ft and then open the speed brake
to 100% at main gear touchdown.

Off-Nominal Approaches
This section briefly summarizes the procedures
used to correct problems typically encountered
during training. More detailed information is
available in the Approach and Landing Flight
Procedures Handbook.
Navigation Errors
A bad navigation state can put the orbiter in a
high or low energy condition. If the error is
detected early in entry or TAEM, Mission Control
will declare a GCA and provide guidance to the
landing site until the navigation state can be
corrected with GPS, a state vector uplink, or
manual state vector update.
If errors are
observed after the field is in sight, pilots can use
visual cues in addition to MCC calls to fly to the
runway.
Known Tire Fail / Leak
Landing with a known flat or leaking main gear
tire requires special landing techniques to try to
save the remaining tire on the strut. Landing on
a concrete runway (KSC or EDW) is preferred
over lakebed runways due to better vehicle
handling qualities on the concrete in the event of
both tires failing on the same strut. Approach to
the runway should be made with the crosswind,
if any, coming from the same side as the failed
tire. At touchdown this reduces the load on the
remaining good tire due to the vehicle tendency
to roll away from the crosswind.

At main gear touchdown the crew should mode

the pitch axis to AUTO. This will allow an
automatic derotation to begin at 180 KEAS. The
drag chute should be deployed at 185 KEAS to
coordinate the timing of chute disreef and max
gear load during derotation.
At nose gear touchdown the CDR should
command a maximum roll, with the RHC, away
from the failed tire. This causes the elevons on
the wing with the failed tire to move down as
much as possible, further relieving the load on
the remaining good tire on that strut.
During rollout, the crew should be prepared to
use NWS and differential braking, on the good
wheels, for directional control.
FAILED TIRE TECHNIQUE
Post-MGTD

P - AUTO

185 KEAS

Deploy drag chute

180 KEAS

Auto derotation

NGTD

Max RHC roll away

from failed tire
Single APU Landing

Fly a nominal approach. At 3000 ft manually set

the speed brake to the DELPAD setting. Do not
adjust the speed brake at 500 ft. Do not open the
speed brake at main gear touchdown. This
prevents the speed brake from taking hydaulic
flow from the elevons during high hydraulic
flow demand flight activites - gear deploy,
touchdown, derotation.

7. TRAJECTORY MANAGEMENT
7.4-24
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
Stuck Speed Brake
Procedures for stuck speed brake approaches
vary with speed brake setting and are summarized in the following table. These procedures
depend on detection of the stuck speed brake
prior to the HAC, where energy can be adjusted
more easily without using the speed brake. The
Stuck Speed Brake procedure is not a published crew
procedure and, as such, is not found in the Flight
Data File (FDF). This is an on-console procedure for
the Guidance Procedures Officer (GPO) in the event
it is needed.
SB Setting
(stuck)
701

TAEM
M <0.95 1 dot Hi on
GSI (use pitch)
Nominal gear deploy
(If EDW, select MEP)

51 - 69

AUTO P, R/Y
Nominal gear deploy

40 - 50

AUTO P, R/Y
@ 300 EAS, deploy
gear

<402

A/L

Selected
Aimpoint
3000 ft

Fly needles
Keep EAS <321
(by pitch)
Close-in

AUTO P, R/Y
@ M=0.95, deploy
gear

For high headwinds at HAC I/C delay MEP until M=1.5 (EDW);
CSS at M=1.5 and fly max. L/D until M<0.95; use pitch to fly 1 dot
hi; fly 4000 ft inside HAC.
2
If speed brake stuck closed, consider nominal aimpoint if landing
at KSC.

When returning from orbit, crewmembers should

be aware of the potential for some change in
vestibular sensations. Head movements will
tend to make these changes more noticeable.
Flight crewmembers should avoid exaggerated
head movements during landing to reduce the
possibility of disorientation.
Sun glare and residue on the windows from the
SRB separation motors can reduce visibility
during landing, especially at low Sun angles.
Gear deploy causes very little structural vibration and may be difficult to detect.
The orbiter landing gear absorbs touchdown
loads very well, and for low sink rate landings,
it may be difficult to feel touchdown. The first
cue to the middeck crewmembers that the
orbiter has landed may be the beginning of
derotation followed by nose gear touchdown.
For some flights, depending on runway surface,
vehicle weight, and center of gravity, derotation
and nose gear touchdown could be quite
dramatic.

Stuck Speed Brake Procedures

Early Gear Deploy
If the gear is deployed early (on the HAC),
3000-ft altitude, manually close the speed brake.
In general, if the auto speed brake retract
command is less then 30 percent, expect to land
short/slow. If the auto retract command is
greater than 40 percent, expect to land long. At
main gear touchdown, open the speed brake to
100%.

Sensory Cues
Most crewmembers report a fairly smooth ride
throughout TAEM to landing, with the
exception of some buffet during the transonic
region. On final, the orbiter responds very little
to turbulence in comparison to the STA due to
the orbiters higher wing loading.

After returning from orbit, crewmembers need

to be aware that some degree of decreased
balance and coordination, as well as dizziness,
may be experienced when getting out of their
seats. Studies are in progress to quantify these
effects and improve current countermeasures.
At present, crewmembers should exercise
caution when leaving their seats and preparing
for egress.

Autoland
Although the orbiter has been certified for
hands-off automatic landings, this capability
has not been verified. Simulations indicate that
performance is acceptable under reasonable
wind conditions for most weight and c.g.
combinations.
Although the orbiter may be flown in AUTO for
the entire approach and landing, CSS control
until MLS acquisition is recommended. This is
due to possible transients as the NAV state is
updated by MLS data. A runway equipped
with MLS is required for autoland.

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-25

USA007587
Rev. A
Based on SMS and STA data, the autoland
system tightly controls azimuth and elevation
tracking during the approach. Corrections may
be abrupt if not close to the nominal trajectory
when AUTO is selected.
As with any automatic control system, the
crews task is to monitor the approach and take
over manually if performance is not acceptable
or to recover from system failures. Since there
is no onboard independent monitor, the crews
visual perception of the approach determines
takeover criteria. This may differ somewhat
among crewmembers and requires a significant
number of automatic approaches in the SMS
and STA to achieve a reasonable level of
proficiency. Both the HUD and ADI should be
monitored during the approach.
Splitting
crewmember duties between the pilots has
proven to be an effective method of monitoring
autoland performance.

Techniques
After OGS intercept, MLS acquisition, and A/L
transition,
engage
AUTO
PITCH
and
ROLL/YAW. Attempt to have ADI error needles
centered or tracking toward the center position
prior to engagement. Should a takeover be
required, the CSS PITCH and ROLL/YAW
pushbuttons should be used to downmode.
This avoids undesirable transients caused by a
hot-stick downmode. Takeover should be
performed only during stable flight conditions,
if possible. A manual takeover on the OGS or
IGS is much less demanding than during a
dynamic phase of the approach such as preflare.
With good autoland performance, the crew
should only be required to lower the gear at
300 ft and apply brakes after nose wheel
touchdown. Rollout guidance is provided by
the MLS and lateral control by the NWS.

CAUTION
Pilots must use extreme care when executing
a manual takeover from automatic flight
control after commencement of pre-flare.
Very little time exists before touchdown to
damp vehicle attitude transients which may
be induced by the takeover.

7. TRAJECTORY MANAGEMENT
7.4-26
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A
PAPI
7500 FT

PAPI
6500 FT

MARKING AIM PT.

7500 FT
6500
FT

BALL

TACAN

TACAN

RWY

MLS

(NOMINAL)

(CLOSE-IN)

BAR

(PRIMARY)

(BACKUP)

EDW 17L

JR CH 6

EDW 111
(SS)

PMD 92
(SS)

REMARKS

EDW 23L

Threshold & TD MK

EDW 35R

Threshold & TD MK

EDW 05R

Threshold & TD MK

JR CH 6

Threshold & TD MK
XENON

EDW 15
EDW 33

Threshold & TD MK

EDW 22

SR CH 8

XENON **

EDW 04

Underrun unusable/
displaced threshold
XENON **

EDW 18L

Threshold & TD MK
XENON **

KSC 15

SR CH 8

TTS 59Y
(DS)

COF 97
(DS)

XENON

KSC 33

SR CH 6

SNG 121Y
(SS)

HMN 92
(SS)

XENON

NOR 17

JR CH 6

NOR 23

NOR 35

NOR 05

BEN 36

SR CH 6

BEN 18

MRN 20

SR CH 6

ZZA 30

SR CH 6

BYD 32

2JRS CH 6

HNL 08R

JR CH 6

GUA 06L

JR CH6

XENON

BEN 118
(DS)

CBA 116
(DME)

XENON

MRN 100
(SS)

AOG 23
(DS)

XENON **

ZZA 64
(DS)

MLA 58
(DME)

XENON **

BYD 121Y
(DS)

BJ 76
(DME)

XENON **

HNL 95

CKH 86

XENON **

UAM 54

UNZ 100

XENON **

NOTE
THIS CHART REFLECTS CAPABILITIES AND CONFIGURATIONS WHICH ARE DEPENDENT ON MISSION CHARACTERISTICS; i.e.,
INCLINATION, AND DAY VS NIGHT RTLS, TAL, AOA CASES. * SURVEYED POINTS WHERE PAPI LIGHTS/BALL BAR CAN BE
INSTALLED. ** XENON lights can be installed at these locations for mission requirements. AIM POINT MARKING @ 6500 FT IS A
TRIANGLE, 7500 FT MARKING IS A RECTANGLE. (2) SINGLE GENERATOR ONLY. (DS) REFERS TO DUAL STRING TACAN
TRANSPONDERS, (SS) IS A SINGLE STRING UNIT.

Navaids/Landing Aids Hi/Low Inclination

7. TRAJECTORY MANAGEMENT
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

7.4-27

USA007587
Rev. A

Terminal Area Energy Management and

Approach, Landing, and Rollout Rules of
Thumb
A 100 ft difference in gear deploy altitude
equals about 250 ft of touchdown energy.
Gear deploy should not be delayed past
200 feet altitude.
90 ft of touchdown distance corresponds to
1 knot of airspeed.
TAEM guidance uses pitch to control
glideslope, bank angle to control ground
track, and speed brake to control energy
above about 14,000 ft and airspeed below this
altitude.
Overhead HAC with NEP allows the most
downmode options for energy.
Fly theta limits at Mach 2 (NLT Mach 1.5) if
air data is not incorporated to G&C.
Maximum bank angle is 50.
OGS is 20 lightweight (<222,000 lb) and 18
heavyweight (>222,000 lb). Aim point is 7500
ft nominal and 6500 close in. Touchdown
speed is 205 knots heavyweight and 195
knots lightweight. When short field speed
brake is selected, touch down 10 knots
slower than nominal.
Deploy the drag chute at 195 KEAS (after
main gear touchdown). Start the derotation
at 185 KEAS using beep trim. At nose gear
touchdown,
manually
back
up
WOW/WONG by taking the SRB SEP switch
to MAN and pushing the pushbutton.

During training, pilots should strive for a

threshold crossing height of 20 - 30 feet on
nominal approaches. Touchdown goals are
airspeed within +5/-10 knots of the target
value, sink rate within structural limits,
negligible lateral drift, and minimal RHC
activity. A good target value for sink rate is
3 fps or less, ensuring ample margin before
violating limits.
With NWS in NWS 1(2), the orbiter will tend
to turn into a crosswind. With NWS OFF, the
orbiter will tend to turn away from a
crosswind.
If the orbiter is landing with a known failed
tire special landing techniques were
developed to try to save the second tire on
that axle.
If both main gear tires fail on one side, the
orbiter will tend to turn toward that side.
The turning moment due to crosswind can
either reinforce or reduce this effect, as will
the drag chute due to weathervane effects.
If the turning moments due to tire failure and
crosswind are in the same directions, large
control inputs will probably be required.
If the turning moments due to tire failure and
crosswind are in opposite directions, the
control inputs required to counteract tire
failure will be reduced. In this situation,
pilots must be careful not to overcontrol. A
good rule of thumb is to be more cautious
with the rudder pedal, matching the
crosswind turning tendency.
Flight Rules call for landing with an existing
crosswind on the same side as a known or
expected bad tire.

7. TRAJECTORY MANAGEMENT
7.4-28
AND FLIGHT CHARACTERISTICS
7.4 TAEM and Approach, Landing, and Rollout

USA007587
Rev. A

8.

coordination among team members. The duties

and coordination functions discussed in this
section are typical of the responsibilities
assigned by the CDR and the Flight and Launch
Directors. Specific assignments will vary from
mission to mission.

INTEGRATED OPERATIONS

CONTENTS
8.1
8.2
8.3
8.4
8.5
8.6
8.7
8.8

FLIGHT CREW DUTIES AND

COORDINATION .....................
WORKING WITH
MISSION CONTROL................
PRELAUNCH ............................
LAUNCH....................................
ASCENT .....................................
ORBIT..........................................
ENTRY ........................................
POSTLANDING ........................

8.1-1

Preplanned decisions that have been approved

by the Space Shuttle Program are published in
the Flight Rules and Launch Commit Criteria.
These are designed to minimize the amount of
real-time discussions when off-nominal situations occur. The Flight Rules also serve as the
basis for real-time decisions. Rules are developed using system performance capabilities
documented in the Shuttle Operational Data
Book (SODB), along with program certified
capability. Where circumstances do not allow
staying within the operating base (SODB +
certified capability), the Mission Management
Team (MMT) may choose to take any necessary
action to ensure the safety of the crew and
shuttle.

8.2-1
8.3-1
8.4-1
8.5-1
8.6-1
8.7-1
8.8-1

The most successful teams are those that have

learned to work together and know each others
responsibilities, strengths, and weaknesses. In a
system as complex as the space shuttle, the
Mission Control Center (MCC), the Launch
Control Center (LCC), and the flight crew must
work as an integrated team with each part
supporting and contributing to the performance
of the other.

During prelaunch and flight operations, the

MMT chairman is responsible for near-real-time
policy decision. The launch team and the flight
teams consult with the MMT chairman as soon
as possible whenever operations outside the
shuttle operating base are required.

Each team member must be completely aware

of his or her responsibilities and realize that
safety and mission success depend on proper

8-1

8. INTEGRATED OPERATIONS

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS

8-2

USA007587
Rev. A

8.1

tion.
To ensure the trajectory is being
monitored, especially during the early portion
of crew training, the CDR could verbally ask the
pilot to watch the gauges. As training progresses, crews gain an understanding of when
another crewmember requires assistance and
usually provide backup without being asked.

FLIGHT CREW DUTIES AND

COORDINATION

CONTENTS
Dynamic Flight Phases ........................
Orbit Phase............................................
Intercom Protocol.................................

8.1-1
8.1-1
8.1-2

Dynamic Flight Phases

For a shuttle flight crew to work well together,
each crewmember needs to have his or her job
clearly defined. This definition includes the
tasks assigned and when they are to be
performed. Individual responsibilities will be
assigned by the mission commander based on
mission requirements. One way in which
duties might be divided for dynamic flight
phases is summarized in the following table.
POSITION

PRIMARY

SECONDARY

CDR

Trajectory/Nav
Abort Boundaries *
DPS
ECLSS
Nominal Timeline
Navaids **
Mission Success
Mission Safety
Voice Transmissions
to MCC

Communications
Flight Control Channels
OMS
RCS
Contingency Abort
Boundaries *

PLT

MPS
EPS
APU/HYD
OMS
RCS
Flight Control Channels

Trajectory/Nav
Navaids **
Mission Success
Mission Safety
Voice Transmissions
to MCC

MS2

Overhead Panels
Overhead Gauges
Communications

Abort Boundaries *
Navaids **
Nominal Timeline
Reference Data

MS1

Contingency Abort
Boundaries **
Photography
Reference Data

Nominal Timeline
Overhead Panels
Overhead Gauges

MS3

Stowage
Middeck Panels/Actions

Photography

Another way crews work together is to monitor

keyboard entries and switch throws. By allowing someone else to check a keyboard entry
before it is fed to the GPCs or check that the
correct switch is being actuated before it is
moved, crewmembers can greatly reduce the
chance of errors. For crewmembers to provide
a good crosscheck for each others activities,
they must remain together as they work
nominal and malfunction procedures. Calling
out page numbers, procedural titles, and step
numbers will help everyone follow through the
procedures.
During dynamic flight phases, or any time
when dealing with several malfunctions, it may
be best to divide into groups or detail
individuals to separate tasks to successfully
deal with all problems in a timely manner. The
CDR usually takes the lead in assigning tasks.
As the proficiency of crews increases,
crewmembers often assume responsibility
without being formally assigned by the CDR.
Whenever groups/ individuals begin working
separate problems, they should attempt to
periodically update the other members of the
crew on their progress. This is especially
critical when the problems being worked are
interrelated. The CDR and PLT must exercise
care to ensure that at least one member of the
crew monitors the vehicle trajectory and
maintains awareness of the nominal timeline
when their attention is drawn to different
problems.

Orbit Phase

* Ascent only
** Entry only

Flight Crew Duties for Dynamic Flight Phases

It is critical for the crew to lay out responsibilities early during training and follow their plan.
As malfunctions occur, the division of
responsibilities may change. For example, the
PLT may have to concentrate on the trajectory
while the CDR deals with an ECLSS malfunc-

On orbit tasks are usually less time critical and

responsibilities are redistributed as necessary.
It is important that more than one crewmember
is trained for each flight task to protect for the
occasion when the prime crewmember might be
ill or busy with another task.
Mission
specialists
usually
assume
the
prime
responsibility for major payload activities. For
Spacehab flights, the senior mission specialist
will be assigned as the Payload Commander

8.1-1

8. INTEGRATED OPERATIONS
8.1 Flight Crew Duties and Coordination

USA007587
Rev. A
and
charged with successful payload
operations. The following table lists a sample
division of duties for the orbit phase.
POSITION

CDR

PLT

MS1

PS2

MS2

EVA

MS3

PS2

EVENT
MLS to state vector

IVA

MEDIC

IFM

EARTH OBS

PHOTO/TV

Prime Payload

MS

~5 K ft

PLT

Radar altimeter, 1 & 2 check good

4K ft

PLT

4,000

3K ft

PLT
MS

3000
Boards ___%

2K ft

PLT
CDR
PLT

2,000, Preflare next

Preflare, arm the gear
Gear is armed with a light

Secondary
Payloads

DTO XXX

DSO XXX

1,000 ft ___kts(PLT call max EAS in preflare)

PLT

500

400 ft

PLT

400

300 ft

CDR
PLT
MS

Gear down
Gear coming
Boards ___%, gear is down

PLT

___ft, ___ knots (steady rhythm)

PLT
CDR

Touchdown
Drag chute (if abort landing or high energy.)

On-Orbit Division of Responsibilities

Intercom Protocol
During ascent or entry most crews have a
standard protocol of voice callouts to help them
keep track of mission events. Typical callouts
and associated displays for ascent and entry are
listed in the following tables.
MET
00:00

EVENT
SRB Ignition

00:30

Throttle Bucket

PLT:
Throttle down

01:00

Throttle Up

PLT:
Three at 104

02:12

SRB Sep

DCR:
Pc < 50, Sep, 103, TMECOs
converged

CALLOUT
DCR:
Lift-off/102

08:00

MECO -30 sec

DCR:
Coming up on MECO

08:32

MECO

DCR:
MECO, MECO confirm, ET sep, 104,
check targets

10:32

MECO +2:00

PLT
Dump/start

Ascent Displays and Callouts

8.1 Flight Crew Duties and Coordination

195 KEAS

CDR

Drag chute

185 KEAS

PLT

185 Derotate

Derotation

PLT

Pitch rate ___(Report at a regular cadence

during derotation. Target 1-2 per sec).

Nosegear TD

PLT
MS

WOW set (Manual by depressing SRB SEP PB)

Load relief (or no load relief)
NWS Fail - (if NWS light is on)

Midfield

PLT

Midfield

5K ft remaining

PLT

5,000 ft remaining

140
130
120
110
100

PLT

___ft, ___ (Decel reading)

2
(Target 6-8 ft/sec )

90
80
70
60
50
60 kts (20)

--KGS

CDR

Chute (drag chute jettison)

40 kts

PLT

40 kts, ease off

Wheels Stopped

CDR

Wheels Stopped

Landing Comm Protocol

MS2:
EVAP OUT t coming down

8. INTEGRATED OPERATIONS

--ft

1 Prime
2 Backup

03:00

PLT

500 ft

300
200
100

70

50

40

30

20

10

5
TD

Approach & land, BF trail

1K ft

CALL

A/L

EVA 2

CREWMEMBER
MS
MLS

8.1-2

USA007587
Rev. A

8.2

of information to the crew via the CAPCOM or

uplink commands.

WORKING WITH MISSION

CONTROL

Operations Monitoring and Control

CONTENTS
MCC Resources ....................................
Operations Monitoring and
Control ........................................
Air-to-Ground Voice
Communications .......................
Telemetry Uplink .................................

Optimum MCC performance depends on

successful receipt of telemetry and tracking data.
Orbiter DPS or instrumentation failures, as well as
communications failures, can quickly degrade the
amount of assistance available from the ground.
If possible, the CAPCOM will inform the crew
whenever downlist data is lost or regained.

8.2-1
8.2-1
8.2-2
8.2-3

To work well together, the flight crew and MCC

must be aware of each other's capabilities.
Integrated simulations, where members practice
their roles on an actual mission, are one way in
which the team members learn about each
other. Another way is for members of the flight
crew to observe in MCC during integrated
simulations and for Flight Controllers to ride
along and observe flight crews operating in the
Shuttle Mission Simulator (SMS).

MCC Resources
While visiting MCC, crewmembers will notice
that an immense amount of downlist data is
available for Flight Controllers to analyze the
performance of orbiter systems and follow
mission activities.
The downlist data is
formatted on various displays with orbiter DPS
keyboard entries, fault messages, and switch
discretes available, as well as numerical
parameters. Many of the parameters in the
downlist data stream are not displayed onboard
the orbiter. The flight control team also has
access to inputs from the customer, direction
from NASA management, weather observations
and forecasts, engineering test data and
analysis, systems performance histories, and
radar tracking data.
To properly utilize this data, personnel are
divided into groups concentrating on specific
vehicle systems or operational functions, with
each group led by a Flight Controller. The
Flight Controllers pass information and
recommendations over the intercom voice loops
to the Flight Director. The Flight Director uses
the information to make decisions on the proper
conduct of the mission, and manages the flow

To track the crew's progress through the

nominal timeline, Flight Controllers observe
individual crew keyboard entries and switch
throws via MCC displays. It is usually possible
for the ground to follow the crew's progress
without voice calls, but an occasional status call
can be helpful. The crew can also help the
ground by closely following the nominal
timeline and by loading maneuvers with future
start times well before they are required.
MCC will try to anticipate points in the timeline
where an MCC GO is required for the crew to
proceed, and call before the crew reaches that
point. If the crew reaches a point where an
MCC GO is required before MCC calls, they
should ask for a GO.
When malfunctions occur, the controllers in
MCC will usually see a trend develop in their
data before the crew hears an onboard alarm.
Whenever possible, and especially on orbit,
MCC will attempt to warn the crew and advise
a course of action before a fault message occurs.
For failures that occur more rapidly, the crew
will see a fault message first and the ground
will see the problem a few seconds later in the
telemetry data stream. After a few seconds to
diagnose the problem, the responsible Flight
Controller will advise the Flight Director on the
proper course of action. On direction from the
Flight Director, the CAPCOM will then relay
the necessary information to the crew. Usually
this transmission will include instructions to
follow a procedure in the FDF, specific switch
actions, or information on why a false alarm
occurred. CAPCOMs will strive to use the
precise FDF procedural titles and the same
switch nomenclature listed on orbiter panels to
minimize confusion. If the situation permits,

8.2-1

8. INTEGRATED OPERATIONS
8.2 Working with Mission Control

USA007587
Rev. A
the CAPCOM will also try to pass to the crew
the rationale for the decisions that have been
made, especially those involving resources not
available to the crew.

Shutting down a main engine, APU, or

fuel cell, or taking electrical buses off
line unless previously directed by
MCC.

Air-to-Ground Voice Communications

Reporting engine failure, fire, DPS set

splits, or flight control problems.
(These problems may not be immediately apparent in downlist data.)

Reporting any problem the crew desires

MCC to give immediate attention.

Calling MCC prior to MDM port

mode/power cycle.

Changing telemetry formats.

Switching
PCMMU.

Reporting headset, CCU, or ATU

problems.

Flight crews should be aware that the

monitoring of crew voice calls is given very
high priority in MCC. Whenever the crew calls
on air-to-ground, all discussions cease on the
Flight Director's loop in order to concentrate on
the crew's transmission. Crew calls to inform
MCC of fault messages or advise the ground on
progress through normal procedures can
interrupt information flow in MCC. Advisory
calls on progress through nominal procedures
should be reserved for periods of reduced
communications activity or for when the
ground is having problems with downlist data.
For confirmation of noncritical system
problems, one plan that works well is to wait 15
to 20 seconds after the appearance of a
noncritical fault message before calling the
ground. This allows the ground time to digest
the problem and call the crew, without
interruption. Waiting for MCC to make the first
call when noncritical fault messages occur
should result in the quickest possible problem
confirmation.
Of course, flight crew calls can be extremely
helpful when MCC is experiencing data
problems or when failures occur which require
immediate attention. A crew call in these
instances will focus MCC's attention on the
problem brought up by the crew. Following are
some appropriate calls to MCC that are not
specifically required by procedure:
Acknowledging MCC transmissions.

Reporting deviations from the timeline

or from a procedure.

Beginning/Ending
postinsertion,
deorbit prep, or major payload activities.

Beginning/Ending malfunction procedures. (This call is generally not made

for critical malfunctions or during
periods of high workload.)

Beginning major DPS reconfigurations

or cockpit switch configurations.

8. INTEGRATED OPERATIONS
8.2 Working with Mission Control

to

alternate

ACCU

or

If practical, flight crews should obtain MCC

confirmation of a malfunction before working a
malfunction procedure. By the same token,
crews should call MCC whenever beginning a
malfunction procedure for deviating from the
nominal timeline without MCC direction, if the
pace of activities and communication status
permits. During periods of high activity, MCC
will assume that the flight crew is prioritizing
problems and automatically working the
necessary malfunction procedures as problems
arise. In these cases, MCC will save voice
confirmation and direction to work malfunction
procedures for the most critical problems.
To minimize verbiage and confusion, standard
phraseology is frequently used in calls between
the orbiter and MCC. Some of these calls are
summarized in the table on the next page.
Standard abort mode boundary calls are
presented in Section 6, Emergency Procedures.
Unplanned downmodes to manual flight
control should be discussed with MCC if time
and flight control performance permit.
Aborts or redesignation of landing site/runway
should only be performed at the direction of
MCC if air-to-ground communication is
available. If air-to-ground communication is
not available, or if mission safety is in question,

8.2-2

USA007587
Rev. A
the CDR assumes ultimate authority for mission
decisions. In this case, the crew will use
onboard procedures and flight rule summaries
to take whatever action is required to safely
conclude the mission.
CALL

MEANING

Roger

Your transmission has been received.

Wilco

Will comply with received instructions.

Say again/repeat

Repeat your last transmission.

Read back

Repeat the list of information just

transmitted.

Good read-back

The information just repeated was correct.

Stand by

Wait, we will have an answer or be ready

to listen shortly.

Stand by on the xx
procedure

Wait, we will have a plan of

procedure/action soon, do not execute the
xx procedure.

Hold

Stop executing the mentioned procedure

at the current step.

You are go for

You have permission to execute

The xx system is
go

The xx system is working adequately.

Expect ratty comm

due to

Expect degraded communication due to

in the blind

We cant hear you, but were transmitting,

hoping that you can hear us.

Lost data

MCC has lost vehicle downlink data,

expect reduced MCC troubleshooting
assistance.

Regained data

MCC has regained downlist data.

UHF only

MCC or orbiter transmitting or receiving on

UHF only. May also mean loss of orbiter
downlink data.

Comm check

Voice communication check, acknowledge

and describe quality of transmission.

LOS

Loss of signal/without comm. Sometimes

used to mean star/object no longer in
view.

AOS

Acquisition of signal/good comm. Sometimes used to mean star/object in view.

Abort

Execute theabort mode. MCC will also

uplink an abort light.

Take TACAN

Accept TACAN for use by NAV software.

Take Air Data

Accept Air Data information for use by

NAV and GNC software.

GoCSS

Take pitch and/or roll/yaw CSS as called.

GoAuto

Return to Auto Pitch and/or Roll/Yaw flight

control. For Orbit Ops, select Auto DAP.

Check DAP

Ensure the DAP mode matches the mode

mentioned in call.

Telemetry Uplink
In addition to voice communication, MCC has
the capability to electronically uplink information to the orbiter. This capability is frequently
used to reduce crew workload, uplink large
amounts of information, or to uplink information where accuracy is critical. Crews may
request that MCC uplink information rather
than using a voice transmission if they feel it
would be beneficial and if there is sufficient
time for the ground to prepare the uplink. In
extreme cases, the MCC also has the capability
to uplink keyboard entries to the orbiter GPCs
in the form of DEU equivalent uplinks.
Common uplink information is shown below:

Communication system configuration

commands.

State vector updates.

Table maintenance block updates

(TMBU) to alter software caution and
warning limits.

IMU compensation.

OMS burn targets.

Alternate landing site information.

TIPS messages for daily execute

packages. Contains flight plan and
procedural changes, amplifying information, news from home, systems, and
consumables status.

Unscheduled TIPS messages containing information not conveniently

passed using voice transmission.

Standard Air-to-Ground Voice Calls

8.2-3

8. INTEGRATED OPERATIONS
8.2 Working with Mission Control

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.2 Working with Mission Control

8.2-4

USA007587
Rev. A

8.3

members are responsible for their scheduled

events.

PRELAUNCH

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................
Launch Control Center........................

Mission Control Center

8.3-1
8.3-1
8.3-1

Prelaunch activities begin at KSC with the start

of the launch countdown. Relative to the
responsibilities of the flight crew as they relate
to the LCC and MCC teams, prelaunch is
considered to start at flight crew arrival at KSC.

Flight Crew
Crew activities at KSC are outlined in a letter
promulgated by the Director of Flight Crew
Operations Directorate (FCOD). All activities
are coordinated by the FCOD Vehicle Integration Test Office. Each mission has different
timelines, and activities vary among pilots,
mission specialists, and payload specialists.
The flight crew is subject to Health Stabilization
Plan restrictions. These limit direct contact to a
small group of individuals who are especially
badged as Primary Contacts. Thus, exposure of
the crew to communicable diseases with short
incubation periods is minimized.
Typical activities for the flight crew at KSC
include:

Shuttle systems briefing

Countdown status briefing
STA flights
Weather briefing
FDF review
Preflight physical exam
Equipment checks
T-38 flights

Unless mission requirements dictate a different

timeline, the crew will arrive at KSC 3 days
prior to launch. Circadian shifts are performed
during this period, except for flights requiring
large shifts and 24-hour operations. Those
crews start their circadian shift prior to
departing Houston.
Crew activities are conducted per a relaxed
timeline until the actual launch day, when the
schedule is tightly controlled. Basically, crew

The MCC is in a monitor mode for most of the

launch countdown. Active participation is required for communication checks, weather
coordination, and inputs to the Mission
Management Team (MMT) on shuttle systems
anomalies.
Flight controllers and MCC support personnel
are responsible for their own readiness for flight.
This includes console and computer systems
configuration and checks.
All necessary
materials required to support flight operations
are positioned. The MCC shift teams usually
begin their circadian shift during the countdown.

Launch Control Center

LCC personnel man consoles around the clock
once the launch countdown commences. Each
shuttle and ground system is monitored by one
or more members of the launch team. The countdown is managed by an Orbiter Test Conductor
(OTC)
who
has
responsibility
for
accomplishment of all steps listed in the
countdown Operations and Maintenance
Instructions (OMI). Prelaunch OMIs implement
checkout requirements designed to demonstrate
operation of all testable subsystems within
prescribed limits. The launch countdown OMI is
performed under strict quality control. Any
deviation is documented and must be accounted
for, either by repair, replacement, or a waiver
from the MMT. In certain areas, launch may be
permitted with equipment losses, provided they
are well understood to be isolated occurrences
and not symptomatic of a generic problem.
LCC responsibilities include the conduct of the
countdown OMI under the OTCs direction,
systems monitoring, test and checkout, recording any deviations, making recommendations
on system problems, and ensuring any
violations of the Launch Commit Criteria are
brought to the attention of the Launch Director.
The launch team is stationed in one of the firing
rooms of the Launch Control Center building at
KSC.

8.3-1

8. INTEGRATED OPERATIONS
8.3 Prelaunch

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.3 Prelaunch

8.3-2

USA007587
Rev. A

8.4

LAUNCH

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................
Launch Control Center........................

8.4-1
8.4-2
8.4-2

Shuttle launches are complex interactive tasks,

where each member of the LCC, MCC, and
flight crew performs an integral part. For
purposes of discussing responsibilities of each
element, launch activities are considered to start
at flight crew ingress into the shuttle.

Flight Crew
The flight crew enters the orbiter about 2 hours
45 minutes before launch. Prior to ingress, final
weather and systems briefings are conducted
and the crew dons their advanced crew escape
system (ACES) suits.
Ingress is accomplished with the assistance of a
suit technician and an astronaut support person
(ASP).
These individuals are part of the
closeout crew who perform final shuttle checks
on the launch pad.

The LCC has the capability to transmit to the

crew using A/G 1, A/G 2, or A/A loops.
Normally, only one loop is used at a time. The
MCC transmits simultaneously on all three
loops.
Occasionally, this causes an echo
because of different time delays. The crew
should report this phenomenon to MCC
because the delays can be adjusted in real time
to remove the echo. Normally the LCC OIS 212
loop, which is used for the direction of launch
activities, will be patched into the A/G loop for
the crew to monitor.
The LCC also has the capability to talk and
listen on ICOM 1 and ICOM 2. Transmission on
these loops is restricted to a small number of
consoles in the Firing Room. If the LCC enables
a patch, the entire launch team can receive
ICOM conversation. This patch is normally
disabled. ICOM is used only as an emergency
backup to the A/G and A/A loops. The ICOM
loops are routed through the T-0 umbilical.
A/G and A/A loops are RF transmissions
through the MILA ground station.
Weather aircraft observations may be patched
directly into one of the RF loops if necessary.
This will allow the shuttle crew to communicate
directly with the weather aircraft crew.

Upon completion of ingress, activities are

governed by the FDF Ascent Checklist, which
summarizes crew tasks from the countdown
OMI. These activities are presented in Section
5.

Certain other consoles in the LCC have the

capability to transmit directly to the crew.
These include the Launch Director, Landing
Recovery Director, and Shuttle Operations
Director.

Crew responsibilities include responding to

LCC and MCC requests per the checklist.
Emergency procedures are discussed in
Section 6.

All voice loops are recorded continuously. This

includes both ICOM loops, all three RF loops,
and all LCC/MCC channels.

As the launch countdown progresses, crewmembers will be asked to configure certain

systems and make various keyboard entries.
This direction will come from the OTC via airto-ground loops. The NASA Test Director
(NTD) may also communicate with the crew via
air-to-ground loops, especially if an off-nominal
situation occurs. MCC inputs are voiced to the
crew by the CAPCOM, who also utilizes the airto-ground loops. The crew normally uses air to
ground to respond to LCC or MCC calls during
the launch count.

The maximum time the crew will remain in the

shuttle in the event of a launch scrub is 5 hours
15 minutes, excluding safing and egress time.
This allows 2-1/2 hours of hold time after the
earliest planned launch time.
Prior to actuation of any shuttle switches or
controls other than those called out in the
checklist, the crew should inform the OTC. This
will prevent the LCC team from recording an
unplanned configuration change that could cause
a launch hold. This is particularly important in
the final minutes of the countdown.

8.4-1

8. INTEGRATED OPERATIONS
8.4 Launch

USA007587
Rev. A

Mission Control Center

TIME TO
LAUNCH

The MCC Flight Director is responsible for

calling a launch hold for all problems that
jeopardize the ability to safely monitor and
recover the shuttle and crew after launch. This
includes problems in:

MCC
Spacecraft tracking and data network
Landing area facilities
Abort landing area weather

In addition, the Flight Director is responsible

for overall control of the MCC command uplink
capability.
Individual flight controllers are responsible for
monitoring their systems and interfacing in real
time with their counterparts in the LCC.

Launch Control Center

The LCC Launch Director is responsible for
giving the launch team the final go for launch.
A formal poll of all elements is taken by the
chairman of the MMT during a planned countdown hold at T-9 minutes. If all elements are
go, the Launch Director is given permission to
proceed with the launch countdown.
The Launch Director is also responsible for
making a decision on weather acceptability at
the launch pad for ascent trajectory.
When the countdown clock is restarted at T-9
minutes, all operations are under control of a
computer system called the ground launch
sequencer (GLS). Shuttle systems are automatically configured and monitored by the GLS.
Preplanned hold points for troubleshooting are
available in the final 9 minutes of the
countdown. These hold points, called GLS
milestones, allow the countdown clock to be
restarted without recycling back to some
previous time. GLS milestones are shown in the
following table.

8. INTEGRATED OPERATIONS
8.4 Launch

EVENT

9 min

GLS sequence start

7 min 30 sec

Access arm retract

5 min

APU start

4 min

Purge sequence 4

2 min 55 sec

LOX pressurization

1 min 57 sec

LH2 terminals replenish

31 sec

Go for RSLS auto sequence

If a hold command is issued between T-9

minutes and T-31 seconds, the countdown clock
will be restarted upon successful resolution of
the problem without a GO survey made of all
elements. After T-31 seconds, only a cutoff is
available. Cutoff will result in a recycle to T-20
minutes.
Depending on launch window,
another launch attempt may be possible.
At T-31 seconds, the GLS issues a command to
the onboard GPC Redundant Set Launch
Sequencer (RSLS) software. This command, GO
FOR AUTO SEQUENCE START, enables the
RSLS to reconfigure certain onboard systems
such as the vent doors, start the main engines,
and issue the SRB ignition commands.
Throughout this period, the GLS continuously
monitors various system parameters and will
issue an automatic cutoff should the Launch
Commit Criteria be violated.
If a cutoff command is issued, the RSLS will
automatically shift control back to the GLS. A
program is then automatically started, which
safes the shuttle systems. If this GLS safing
program does not run automatically, then LCC
controllers safe the systems manually by issuing
appropriate commands.
Throughout the countdown, individual LCC
controllers are responsible for monitoring their
systems and executing commands per the
countdown OMI. Any deviations or anomalies
are reported to the OTC.

8.4-2

USA007587
Rev. A

8.5

MCC has the prime responsibility for abort

mode determination, since the abort region
determinator (ARD) program can assess shuttle
abort capabilities in real time. Data from
independent ground radar tracking, along with
telemetry of the current onboard state, is used
in the ARD.

ASCENT

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................

8.5-1
8.5-1

The ascent flight phase starts at SRB ignition and

continues through OMS-2 cutoff. This is one of
the most dynamic phases of a shuttle flight.

Flight Crew
The flight crew is responsible for monitoring
vehicle performance and systems and executing
procedures on the nominal timeline. Flight crew
and MCC coordination is most critical in this
phase of flight because of the time-critical nature
of most activities. General crew and MCC
coordination is discussed in Sections 8.1 and 8.2.

Mission Control Center

The Flight Director is responsible for overall
direction of shuttle flights from SRB ignition until
crew egress after landing. The Flight Director,
after analysis of the flight condition, may choose
to take any necessary real-time action required to
ensure the safety of the crew and shuttle.

Each flight controller on the MCC team has

specific responsibilities, based on discipline.
For example, the Booster Officer monitors SRB,
SSME, and MPS performance and informs
the Flight Director of malfunctions and
recommended actions.
Many voice loops are used within the MCC. All
controllers have a responsibility to monitor the
Flight Director loop and air-to-ground loops, in
addition to their own internal and external
communication loops. Because the workload
can be quite high during off-nominal situations,
the crew can help by minimizing air-to-ground
calls when possible. Also, allowing time for the
MCC to formulate an action, coordinate it
among several disciplines, and transmit it back
to the crew prior to making additional
transmission will aid in MCC/crew teamwork.

8.5-1

8. INTEGRATED OPERATIONS
8.5 Ascent

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.5 Ascent

8.5-2

USA007587
Rev. A

8.6

Mission Control Center

ORBIT

The MCC is responsible for onboard navigation

maintenance. Adequate navigation and maneuver definition will be maintained onboard to
provide runway landing capability after loss of
communication.
The Flight Rules specify
navigation state requirements.

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................

8.6-1
8.6-1

The orbit flight phase starts at OMS-2 cutoff and

continues through deorbit burn ignition.
Nearly all mission objectives are accomplished
during the orbit phase.

Flight Crew
The crew is responsible for monitoring vehicle
systems and executing the nominal timeline.
Operating primary and secondary payloads is
the major user of available time. This is the
most benign portion of a shuttle mission in that
time is usually available to perform in-depth
troubleshooting of any malfunctions. Crews
and MCC will take advantage of the available
time to thoroughly troubleshoot malfunctions.
General crew and MCC coordination is
discussed in Sections 8.1 and 8.2.
Execution of on-orbit tasks, as called out in the
Flight Plan and other FDF documents, is the
responsibility of the crew. Some tasks must be
accomplished on a very strict timeline.
Deployment of a payload or experiment
operations fall into this category.
Other
activities are not time critical. For example,
crew exercise can be accomplished on a not-tointerfere basis.
Based on preflight assignments and training,
each
crewmember
will
have
certain
responsibilities. Most crews designate backup
crewmembers for critical activities.
These
backup crewmembers receive nearly all of the
training that the prime crewmember receives.
This policy provides the necessary redundancy
that might be required in the event of
unforeseen circumstances, such as an injured
crewmember or an unplanned contingency. A
typical list of duty assignments is shown in
Section 8.1.

Individual flight controllers monitor onboard

systems and make recommendations to the
Flight Director for any changes or reconfiguration. In some cases, uplink commands may
be used to perform certain tasks such as
antenna management or limit changes (to
prevent nuisance alarms).
The Flight Activities Officer and the Payloads
Officer are responsible for tracking the Flight
Plan and payload activities, respectively. When
there is a remote Payload Operations Control
Center (POCC), responsibility for the major
payload activity (such as Spacehab) resides
with the POCC Director. Other payloads, such
as middeck experiments, are still controlled by
the MCC Payloads Officer. Changes to the
Flight Plan, updates to the orbiter attitude and
pointing, and replanning are the responsibility
of the Flight Activities Officer.
The Integrated Communications Officer (INCO)
in the MCC is responsible for operation of the
MCC and shuttle command system. Status of
the communications link and the command
system is included in this responsibility. The
INCO is the designated control point and
representative of the Flight Director for
approval of all types of commands, including
those sent to payloads. With the exception of
routine communications systems commands
and nonhazardous commands, most command
uplinks directly affect the systems being used
by the flight crew for control of the orbiter or
payload. To ensure that the flight crew has
current shuttle and payload system status, if
communication
is
lost,
MCC
has
a
responsibility to inform the flight crew when
command uplinks are transmitted. Typically,
several hundred commands are sent during
each mission.
The majority of these are
transparent to the crew and do not require
coordination.

8.6-1

8. INTEGRATED OPERATIONS
8.6 Orbit

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.6 Orbit

8.6-2

USA007587
Rev. A

8.7

Mission Control Center

ENTRY

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................

8.7-1
8.7-1

The second dynamic phase of a shuttle mission

is entry. For purposes of discussing team
responsibilities, entry activities are considered
to start at deorbit burn ignition and continue
through rollout.

Flight Crew
The crew is responsible for monitoring vehicle
trajectory and systems and execution of the
nominal timeline. The pace of activities during
entry is generally not as severe as that
experienced during ascent until the beginning of
TAEM. Depending on inclination and altitude,
communication with MCC may not be available
for the deorbit burn and part of entry. Crews
should be mentally prepared to carry out mission
activities without MCC assistance during the
deorbit burn and early portion of entry.
Crew duty assignments during entry are similar
to those for ascent. General crew coordination
and working with MCC are discussed in
Sections 8.1 and 8.2.

MCC has the prime responsibility for deorbit

burn targets. Factors in the selection include
shuttle systems status, consumables, c.g.
control, weather, and other landing site
information. Although the crew has onboard
capability to generate deorbit targets in an
emergency, the MCC team, with their extensive
capability, will normally calculate and uplink
planned targets.
Upon completion of the deorbit burn, MCC is
responsible for monitoring the entry trajectory
and status of the onboard systems. Should a
malfunction occur and be confirmed by the
MCC, the crew is expected to work the
appropriate cue card or pocket checklist
procedure with no further direction. Activities
outside the published procedures will be
requested by the MCC.
If the trajectory diverges and approaches energy
limits, the Flight Dynamics Officer will perform
a ground controlled approach (GCA).
Procedures are discussed in Section 7.3.
The communication workload during entry is
similar to ascent with numerous loops in use.
The crew can help to simplify the process by
minimizing air-to-ground calls and allowing
time for the MCC to develop a coordinated
decision.

8.7-1

8. INTEGRATED OPERATIONS
8.7 Entry

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.7 Entry

8.7-2

USA007587
Rev. A

8.8

Mission Control Center

POSTLANDING

CONTENTS
Flight Crew ...........................................
Mission Control Center .......................
Launch Control Center........................

8.8-1
8.8-1
8.8-1

Postlanding activities start at completion of

rollout and continue through crew egress. The
LCC and convoy commander have certain
responsibilities during this phase.

Flight Crew
After wheels stop, crew activities are controlled
by the FDF Entry Checklist which summarizes
crew procedures from the postlanding OMI.
Normal activities include shuttle safing and
systems reconfiguration for extended power up.
These are described in Section 5, Normal
Procedures.
The crew responds to MCC requests for
activities outside the normal procedures. For
example, certain reconfiguration procedures
might be modified because of previous systems
failures.
Communication with the convoy commander is
established shortly after wheels stop. The
convoy commander controls postlanding
activities in the vicinity of the shuttle and can
pass information about hazardous situations to
the flight crew.

The MCC retains responsibility for orbiter

systems until crew egress or ground support
equipment (GSE) cooling activation, whichever
occurs later. At this time the Flight Director
hands over control to the responsible NASA
Kennedy Space Center (KSC) ground
operations representative. For KSC landings,
this representative will be the Landing
Recovery Director (LRD); at DFRC/Edwards
AFB it will be the NASA Convoy Commander
(NCC); and at the White Sands Space Harbor
(WSSH) or any TAL site, it will be the Ground
Operations Manager (GOM). Should MCC
voice and telemetry be lost, or if an emergency
crew egress is required, handover to the
LRD/NCC/GOM (as appropriate) will be
accomplished ASAP.
While the MCC is controlling ground
operations, flight controllers are responsible for
monitoring their systems and interfacing in real
time with their counterparts in the LCC.

Launch Control Center

Until handover, the LCC monitors the progress
of shuttle safing and reconfiguration. LCC data
monitoring is available to the LRD/NCC (KSC
and DFRC only) if loss of MCC system insight
and communications capability occurs. In this
case, handover will occur ASAP so that normal
postlanding operations can continue. Should
LCC monitoring capability be lost, the MCC
will continue to support until LCC capability is
regained or the shuttle is powered down.
Once handover is complete, the LRD (if KSC) or
NCC (if DFRC) or GOM (if WSSH or TAL) have
responsibility for all shuttle activities. The OTC
coordinates
completion
of
postlanding
procedures and preparation for turnaround
operations.

8.8-1

8. INTEGRATED OPERATIONS
8.8 Postlanding

USA007587
Rev. A

This page intentionally left blank

8. INTEGRATED OPERATIONS
8.8 Postlanding

8.8-2

USA007587
Rev. A

9.

also included. The information presented is

accurate but is usually derived from
representative 28.5 and 57 missions. It is not
intended for mission planning. The information
is presented only for the purpose of broadening
the crew's fundamental understanding of the
vehicle's performance capabilities during each
flight phase under the stated conditions.
Mission-specific questions or requests for more
detailed explanations should be referred to the
appropriate Flight Design and Dynamics
Division (DM) personnel.

PERFORMANCE

CONTENTS
9.1
9.2
9.3

ASCENT .....................................
ORBIT..........................................
ENTRY (OPS 304)......................

9.1-1
9.2-1
9.3-1

This section contains information regarding the

performance capability of the space shuttle
during ascent, orbit, and entry (EI to wheels
stop). Some performance related material is

9-1

9. PERFORMANCE

USA007587
Rev. A

This page intentionally left blank

9. PERFORMANCE

9-2

USA007587
Rev. A

9.1

Payload

ASCENT

The graphs below indicate the maximum

weight payload that can be launched to a
particular circular orbit with a 28.5 or 57
inclination. Also shown is the higher altitude
capability of a direct insertion versus standard
insertion mission profile, as well as the
performance increase available using 109
percent versus 104 percent main engine power.

CONTENTS
Payload ..................................................
Launch Window...................................
Squatcheloids........................................
Main Engines ........................................
Altitude, Velocity, and Dynamic
Pressure.......................................
MECO Targets ......................................
ET Impact ..............................................
Abort Mode Boundaries......................
Minimum Safe Orbit............................

9.1-1
9.1-2
9.1-3
9.1-5
9.1-5
9.1-8
9.1-8
9.1-9
9.1-9

70
109% SSME
Power Level

Cargo Weight (Klbs)

60
50

104% SSME
Power Level

40
30
20

Standard
Insertion

Direct
Insertion

10
0
100

140

180

220

260

300

340

380

Circular Orbit Altitude (NM)

914.cvs

Cargo Weight vs. Circular Orbital Altitude 28.5 Inclination

70

Cargo Weight (K lbs)

60
50

109% SSME
Power Level

40

104% SSME
Power Level

30
20
10

Standard
Insertion

0
100

140

180

Direct
Insertion
220

260

300

340

380

Circular Orbit Altitude (NM)

915.cvs

Cargo Weight vs. Circular Orbital Altitude 57 Inclination

9.1-1

9. PERFORMANCE
9.1 Ascent

USA007587
Rev. A

Launch Window
The launch window for a ground-up
rendezvous mission must satisfy several
constraints. A major factor determining the
window is ensuring that the orbiter has
sufficient performance capability (plus reserves)
to achieve a coplanar orbit. The chart at the
right (for a 51.6 mission) indicates the
additional performance required if the launch
occurs other than at the "in-plane" time. Also
shown is available propellant that allows a
10-minute window.

the window. The P indicates the performance

degrade for launch holds inside of MPS drainback. Also shown is the STS-114 mission that
has two panes inside of their window on this
day. A very close look at the chart will show
launch time is January 17 (the 017th day of the
year) at 03:11:13 GMT at the in-plane point
Pane 1. Further, a move from Pane 1 to Pane 2
is planned after 3 minutes and 18 seconds if in a
launch hold. Pane 2 will close 7 minutes and 47
seconds after the Pane 1 in-plane point. Pane 2
closes (which would equate to a launch scrub
for that day) at 017/03:19:00.

The launch window developed for each shuttle

mission delineates the period in which the
orbiter can be launched without violating
shuttle and/or payload constraints. Whenever
possible, launch windows will protect daylight
(sunset + 15 min) for abort and end-of-mission
(EOM) landings. The following chart depict the
launch windows for a shuttle to ISS mission.
The launch windows for STS-121 is constrained
by many factors as shown.
This Rendezvous Mission Performance chart for
STS-114 shows approximately 2000 pounds fuel
in flight performance reserve (FPR) when
launching mid-window, or in-plane. Launching
other than in-plane creates the need to steer to
the rendezvous plane, which uses additional
fuel. To be exact, 2003.80 pounds of additional
fuel is required to launch at the open or close of

9. PERFORMANCE
9.1 Ascent

9.1-2

Rendezvous Mission Performance, STS-114

USA007587
Rev. A

Launch Windows for STS-121

Squatcheloids
Squatcheloids are curves that define the q-alpha
(product of dynamic pressure (q)) and angle of
attack (alpha) and q-beta (product of dynamic
pressure) and sideslip angle (beta) limits of the
orbiter first stage ascent. These q-alpha and
q-beta limits are determined by the design
limits of various orbiter structural components.
The graphs show three representative
squatcheloids for Mach 0.6, 1.25, and 2.20.

9.1-3

9. PERFORMANCE
9.1 Ascent

1400
1200
1000
80 0
X
60 0
40 0
X
20 0
X
0.0
-200
X
-400
-600
-800 X
-1000
-1200 X
-1400
-1600
-1800 X
-2000
-2200 X
-2400
-2600
X
-2800
-3000
X
-3200
X
-3400
-3600
-3800
-4000
-3000
-2000

X X

IVBC-3

X
X
X

Flight Envelope
Restricted to

q-Alpha (PSF-Degrees)

q-Alpha (PSF-Degrees)

USA007587
Rev. A

X
X

Vertic al
T ail

Verti c al
Tai l

X
X
X
X

-1000

X
0.0

1000

2000

3000

-200
-400
X X X X
IVBC-3
X
-600
X
X
-800
X
X
-1000
-1200
X
Wi ng
X
-1400
X
-1600
Flight Envelope
X
-1800
Restricted to
X
-2000
X
-2200
-2400
X
Ver ti c al
X
-2600
T ai l
-2800
X
-3000 X
Vertic al
-3200
Tai l
-3400 X
X
-3600
-3800
X
-4000 X
-4200
X
-4400
X
-4600
X
-4800
X
-5000
X
X
-5200
X
-5400
X
X
-5600
X
X X X
-5800
-3000
-2000 -1000
0.0
1000
2000
3000

q-Beta (PSF-Degrees)
q-Beta (PSF-Degrees)

X Integrated vehicle baseline configuration -3

(IVBC -3) Loads analysis

X Integrated vehicle baseline configuration -3

(IVBC -3) loads analysis

Composite allowable flight contstraints

(Greenlines), Nov 1989

Composite allowable flight contraints

(Greenlines), Nov 1989

C ons t rai nt Env el ope Li m i t at i ons

0 Ascent Only
0 Estimated, based on V6.0 margins
0 Aero surfaces only
0 For IVBC-3 ground rules, constraints: Other
nominal trajectory criteria may alter constraint
env elope
0 Vertical tail loads ensure 1.4 safety factor

C ons t r ai nt Env el ope Li m i t at i ons

0 Ascent only
0 Estimated, based on V6.0 margins
0 Aero surfaces only
0 For IVBC-3 ground rules, constraints: Other
nominal trajectory criteria may alter
constraint envelope
0 Vertical tail loads ensure 1.4 safety factor

920.cvs

921.cvs

Mach = 0.60 Restricted Squatcheloid and

IVBC-3 Loads Squatcheloid

9. PERFORMANCE
9.1 Ascent

Mach = 1.25 Restricted Squatcheloid and

IVBC-3 Loads Squatcheloid

9.1-4

q-Alpha (PSF-Degrees)

USA007587
Rev. A
2600
2400
2200
2000
1800
1600
X
1400
X
1200
1000
80 0
X
60 0
40 0
X
20 0
X
0.0
-200
X
-400
-600
X
-800
-1000
-1200
-1400
X
-1600
X
-1800
-2000
-2200
-2400
-2600
-3000 -2000

X X

X X

The chart below shows the difference between

planned and actual MPS propellant usage for
several shuttle missions.

IVBC-3
X
X

Flight envelope
restricted to

Delta Performance
6,000
5168 lbs
4,000

X
X

Verti c al
T ai l

FPR
4985 lbs

X
X

Verti c al
T ail

2,000

8
7

5
(2,000)

51I

-4985 lbs
-4652 lbs
FPR

51F

(6,000)
0

X
X

X X
X X
-1000
0.0

10

15

20

25

30

Note: FPR re-evaluated after each six missions.

X
1000

2000

3000

More
fuel
used

31

34

41B

-5168 lbs

32

30

41C

(4,000)

26

Less
fuel
used

61C
29
61A

51A 51B
41D
51G

4652 lbs

61B

41G
51D

923.cvs

Main Engine Actual vs. Predicted Performance

q-Beta (PSF-Degrees)

One percent MPS propellant is approximately

equal to 15,310 lb of LO2/LH2.

X Integrated vehicle baseline configuration -3

(IVBC -3) loads analysis
Composite allowable flight contraints
(Greenlines), Nov 1989

Altitude, Velocity, and Dynamic Pressure

C ons t r ai nt Env el ope Li m it at i ons

0 Ascent only
0 Estimated, based on V6.0 margins
0 Aero surfaces only
0 For IVBC-3 ground rules, constraints: other
nominal trajectory criteria may alter
constraint envelope
0 Vertical tail loads ensure 1.4 safety factor

The following three charts depict ascent

altitude, velocity, and dynamic pressure as a
function of MET for actual 28.5 and 57
missions.
922.cvs

Mach = 2.20 Restricted Squatcheloid and IVBC

Loads Squatcheloid

400

9.1-5

200
MECO

Prior to each mission, after day-of-launch winds

and propellant loadings are known, the main
engine propellant at MECO is calculated
(including dispersions). The Space Shuttle Program Flight Performance Reserve (FPR) is the
difference between propellant loaded and
propellant required for the ascent profile. The
FPR normally used for mission planning is
4652 lb.
The FPR must be positive when
recalculated on launch day using measured
wind data.

Alt (K ft)

300

Main Engines

100

0
0

4
5
MET (min)

28. 5
57.0
924.cvs

Ascent Altitude vs. MET

9. PERFORMANCE
9.1 Ascent

USA007587
Rev. A
30

20

15

10

VI

MECO

SRB SEP

Velocity (K FPS)

25

5
V REL
0
0

MET (min)

9
28.5
57.0
925.cvs

Ascent Velocity vs. MET

Dynamic Pressure Q-Bar (PSF)

800
700
600
500
400
300
200
100
0
0

:30

1:00

1:30
MET (min)

Ascent Dynamic Pressure vs. MET

9. PERFORMANCE
9.1 Ascent

9.1-6

2:00

2:30

USA007587
Rev. A
1.8

350

Inertial Flight Path Angle (deg)

1.6

330

1.4

310

1.3

280
270

1.2

Apogee
Altitudes
(NMI)

250

1.1
222
1.0
202
0.9
182
0.8
162
0.7
0.6
25700

25800

25900

26000

26100

26200

26300

26400

Inertial Velocity (FPS)

927.cvs

Direct Insertion MECO Target Line 28.5

1.8
350

1.6
Inertial Flight Path Angle (deg)

208

330

1.4

310
1.3
280

180
1.2
270
160

1.1

250

1.0

230

140
0.9
0.8

Apogee
Altitudes
(NMI)

208
120

0.7
103
0.6
25700

25800

25900

26000

26100

26200

26300

26400

Inertial Velocity (FPS)

928.cvs

Direct Insertion MECO Target Line 57

9.1-7

9. PERFORMANCE
9.1 Ascent

USA007587
Rev. A

MECO Targets

ET Impact

The direct insertion MECO target line charts

depict the inertial velocity and inertial flight
path angle required for various apogee altitudes
for 28.5 and 57 missions.

The following map shows the projected ET impact

areas for 28.5 and 57 (<190 and >190 n. mi.)
standard and direct insertion missions given
nominal performance and a nominal ET separation.

ET Impact Areas

9. PERFORMANCE
9.1 Ascent

9.1-8

USA007587
Rev. A

Ascent/Abort Summary Cue Card

Abort Mode Boundaries

Minimum Safe Orbit

Abort mode boundaries can be discovered via

the Ascent/Abort Summary Cue Card. An
Ascent/Abort Summary Cue Card is created for
each mission. It is part of the Ascent Checklist
on pages 2-42 and CC 10-26 (unflown versions).
It can be found in its flown version on the
eyebrow panel (F-2 and F-4) just below the
HUD. It depicts the abort options available
from lift-off until MECO. This cue card will
direct the crew to the proper procedure after
one, two, or three main engine failures
(simultaneously) at any time during the
nominal profile. Locating inertial velocity or
MET of engine failure(s) along the bottom scale
will correspond to the appropriate abort mode
for that Vi/MET.

If the orbiter is inserted into an off-nominal

orbit, Mission Control will ensure that the
vehicle has sufficient orbital lifetime. The
lowest perigee that will guarantee the minimum
orbital lifetime is a function of apogee and the
delta time to the next prime deorbit
opportunity. Reference Flight Rule 4-51 for
more details.
The following chart shows
approximate time on orbit versus apogee and
perigee for low inclination insertion.

9.1-9

9. PERFORMANCE
9.1 Ascent

USA007587
Rev. A

130

Orbit Geometry
Inclination:
Entry Interface:

28.5 degrees
400,000 feet

Models
Atmosphere:
Geopotential
Drag
Solar Flux (10.7 cm):
Geomagnetic Index:

120

Vehicle Description
Weight:
Frontal Area:

110

MODIFIED JACCHIA 1970

GEM 10 TRUNCATED 7X7
CONSTANT AREA, Cd=2, K-factor=1.3
240E-22 watts/square meter/hz
4.0
200,000 pounds
2500 square feet, nominal, inertial hold

Software
Houston Operations Predictor/Estimator (HOPE) Version 2.6
Apogee and perigee altitudes match the MCC Vector Compare output

Perigee (NM)

100

FR
4-51

Key:
A
B
C
D
E
F

90

24 Hour Stay
12 Hour Stay
Commit to Planned Deorbit
12 Hour Stay (No Backup Deorbit)
Commit to Deorbit
12 Hours to Entry Interface

Time to EI (hrs)
(72)
(60)
(48)
(36)
(24)
(12)

80

70

60
80

100

150

200

250

300

350

Apogee (NM)
932.cvs

Minimum Safe HP vs. HA

9. PERFORMANCE
9.1 Ascent

9.1-10

USA007587
Rev. A

9.2

300

ORBIT

CONTENTS
250

9.2-1
9.2-1
9.2-1
9.2-2

200
Orbital Alt (min)

Drag ......................................................
Period.....................................................
Perturbations ........................................
OMS/RCS .............................................

Drag

100

50

Orbital Altitude (NM)

80

85

90
95
Orbital Period (min)

100

10

11

125

934.cvs

1 50

Orbital Drag Chute Coefficient (C D )

Aerodynamic drag is a factor that must be

considered when planning on-orbit performance capabilities. This is taken into account by
Mission Control in evaluating orbital lifetime.
The following chart indicates the incremental
velocities required to maintain a specified orbit
during a 24 hr period. Notice that the velocity
requirement is approaching 0 at 160 n. mi.
(nominal orbital altitude).

150

Orbital Period vs. Altitude

0
CD Average = 1.8

Perturbations

Weight = 180,000 lbs

Velocity = 26,000 FPS

While each orbital period takes approximately

87 - 96 minutes, the Earth has completed a
fraction of its full 360 rotation per day. That
fractional portion will cause subsequent
groundtracks to be displaced westward an
equivalent amount, based on this simple
formula:

0
0

10

20

30

40

50

60

70

Incremental Velocity Required to

Maintain Orbit (FPS per 24 hrs)
933.cvs

Aerodynamic Drag Effect On

Orbital Velocity Chart

Westward
Displacement
360 deg 1 hr period min =
deg
60 min
1 orbit
1 orbit
24 hr

Period
As orbital altitude increases, the time it takes
the shuttle to complete a full orbit also
increases, independent of inclination. The following chart plots these approximate times
(orbital periods) for various orbital altitudes.

Given an 87- to 96-minute range of periods,

each successive orbit will be displaced 21.75 to
24 west with about 22.5 nominal (160 n. mi.
orbit).

9.2-1

9. PERFORMANCE
9.2 Orbit

USA007587
Rev. A
If the orbiter's track were influenced only by the
period of the orbit, at the end of the 16th orbit
(90-minute period), the track would be expected
to go directly over the launch site. This does not
occur due to another force influencing the orbit.
Nodal regression will shift the track approximately 7.5 west (for a 28.5 X 160 n. mi. orbit)
each 24 hr. This force on the vehicle is caused by
the gravitational impact of the equatorial bulge.
The chart below depicts the nodal regression for
various low-Earth orbits. It can be seen that
higher orbital altitudes and inclinations diminish
the amount of the perturbation.
-9

100

-8

200

OMS/RCS
On orbit, the vehicle's performance capability is
dictated by the amount of usable OMS/RCS
propellant minus the amount required for
deorbit, entry, and reserve. This performance
capability can be maximized by using the most
efficient burns possible for mission accomplishment and attitude/altitude control. The charts
on the next page provide a convenient "quick
look" method for determining the performance
penalty for OMS/RCS use.

Nodal Regression (Deg per mean solar day)

Altitude (NM)

300
-7
500

-6
-5

1000

-4
-3
-2
-1
0
0

10

20

30

40

50

60

70

Orbital Inclination (deg)

935.cvs

Nodal Regression

9. PERFORMANCE
9.2 Orbit

9.2-2

USA007587
Rev. A

AVERAGE ORBITER ACCELERATION (FT/SEC)

1% OMS = 130 lbs propellant

RCS

1% RCS = 22 lbs propellant

+X

ORBITER
WEIGHT
(1000 LB)

180
200
220
240
260

-X

+Y

OMS
+Z

-Z

HIGH NORM NORM NORM HIGH NORM LOW

1
2
1, 2
1, 2
2
1, 2
2

HIGH NORM TWO

3
1, 2
ENG

0.61
0.55
0.50
0.46
0.42

0.98
0.88
0.80
0.72
0.65

DAP CODE

0.31
0.28
0.25
0.23
0.21

0.32
0.29
0.26
0.24
0.22

0.22
0.20
0.18
0.17
0.16

1.29
1.16
1.06
0.99
0.94

1 = TRANSITION

0.43
0.39
0.35
0.33
0.32

0.05
0.05
0.04
0.04
0.04

2 = ON ORBIT

0.61
0.55
0.50
0.46
0.42

2.14
1.93
1.75
1.60
1.48

ONE
ENG

1.07
0.97
0.88
0.80
0.74

3 = ET SEP ONLY

PROPELLANT USAGE TO START, MAINTAIN,

AND STOP A 115 DEGREE
ROTATION MANEUVER (LB)
AVERAGE ORBITER ACCELERATION
(DEG/SEC2 )
ROTATION
MANEUVER

+ Roll
+ Pitch
- Pitch
+ Yaw

NORM
PRCS

0.923
1.230
0.851
0.703

LOW PRCS
FWD

JETS

YRCS

AFT

0.696 0.534
0.478 0.373
0.449 0.242

PITCH

YAW

FWD

AFT

FWD

AFT

FWD

0.2
0.2
0.5
1.0
2.0

1.4
10.3
8.2
6.8
6.4

5.7
23.9
20.7
23.7
34.2

2.0
13.1
10.0
12.9
22.0

6.5
28.3
19.4
22.4
32.7

1.6
9.0
10.2
13.2
21.0

VRCS
PRCS
PRCS
PRCS
PRCS

0.021
0.019
0.008
0.014

ROLL

ROTATION
RATE
(DEG/SEC)

3-AXIS

AFT

FWD

AFT

8.3 2.0 9.6

20.3 8.8 20.2
21.0 10.6 18.2
24.1 16.5 26.9
36.6 30.2 45.5

PROPELLANT USAGE FOR TRANSLATION MANEUVERS (LB/FPS)

RCS
ORBITER C.G. SHIFT
FOR OMS/RCS USAGE

ORBITER
WEIGHT
(1000 LB)

INCHES/100 LB
X
c.g.

Y
c.g.

FRCS -0.36
ARCS +0.11
OMS +0.13

0
0.04
0.04

0.2
0.2
0.5
1.0
2.0

+X

-X

+Y

+Z

+ Z (LOW)

FWD

AFT

FWD

AFT

FWD

AFT

FWD

AFT

FWD

AFT

0.5
0.5
0.5
0.5
0.5

20.8
23.1
25.4
27.7
30.0

19.6
21.8
24.0
26.2
28.4

4.1
5.1
6.1
7.1
8.1

8.6
9.3
10.0
10.7
11.4

25.2
27.4
29.6
31.8
34.0

7.5
8.1
8.7
9.3
9.9

12.5
14.1
15.7
17.3
18.9

140.0
159.0
178.0
197.0
216.0

117.0
132.0
147.0
162.0
177.0

-Z
FWD

AFT

OMS

10.5
11.3
12.1
12.9
13.7

18.9
21.2
23.5
25.8
28.1

17.9
19.8
21.8
23.8
25.8

PRIMARY RCS THRUSTERS PROPELLANT USAGE (LB/HOUR)

(ATTITUDE DEADBANDS = 3.5 DEG/AXIS)

+Y

+X

100 NM
FWD

AFT

FWD

X-pop inertial
Y-pop inertial
Z-pop inertial
X-pop -Z-LV
Y-pop -Z-LV
-X sol inertial
-Z sol inertial
X-PSL PTC

10.5
11.0
8.6
9.8
10.3
10.4
10.0
9.3

20.2
24.0
21.0
21.2
18.0
20.8
19.9
19.0

10.2
10.2
8.6
9.3
10.1
10.4
10.0
9.3

+Z

ENGINE

SPECIFIC
IMPULSE
(SEC)

THRUST
PER
ENGINE
(LB)

OMS
PRCS
VRCS

313.2
280.0
265.0

6000
870
24

120 NM

ORBITER
ORIENTATION

150 NM

200 NM

FWD

AFT

FWD

19.8 9.8
19.9 9.4
20.2 8.6
20.8 8.4
17.8 9.8
20.4 10.4
19.9 10.0
19.0 9.3

19.3
17.7
19.3
20.4
17.5
19.9
19.9
19.0

9.3
8.4
8.6
7.3
9.5
10.4
10.0
9.3

AFT

AFT

300 NM
FWD

AFT

18.6 8.8
15.7 7.6
18.5 8.6
19.8 6.0
17.1 9.1
19.4 10.4
19.9 10.0
19.0 9.3

18.0
14.6
18.0
19.0
16.5
19.0
19.9
19.0

VERNIER RCS THRUSTERS PROPELLANT USAGE (LB/HOUR)

(ATTITUDE DEADBANDS = 1.0 DEG/AXIS)

PROP
PROP
FLOW
MIXTURE
RATE
RATIO
(LB/SEC) (OX/FU)

19.16
3.11
0.09

1.65
1.60
1.60

100 NM

120 NM

150 NM

200 NM

ORBITER
ORIENTATION

FWD

AFT

FWD

AFT

FWD

AFT

FWD

X-pop inertial
Y-pop inertial
Z-pop inertial
X-pop -Z-LV
Y-pop -Z-LV
-X sol inertial
-Z sol inertial
X-PSL PTC

3.0
1.9
2.9
4.1
0.5
2.9
3.6
5.6

11.6
6.3
11.5
13.3
1.0
10.6
8.8
10.9

1.5
1.6
2.0
1.6
0.5
2.2
2.6
4.8

5.7
4.7
8.1
5.1
0.8
7.7
5.5
7.2

0.9
1.5
1.6
0.7
0.5
1.8
2.3
4.2

3.8
4.5
6.8
1.3
0.7
6.7
4.8
4.9

0.7
1.4
1.5
0.4
0.5
1.8
2.2
3.8

AFT

3.0
4.3
6.5
0.6
0.6
6.5
4.7
3.4

300 NM
FWD

0.6
1.3
1.4
0.4
0.5
1.8
2.2
4.3

AFT

2.8
3.9
5.9
0.4
0.5
6.1
4.5
3.6

usa007587_936r1.cvx

OMS/RCS Estimated Performance

9.2-3

9. PERFORMANCE
9.2 Orbit

USA007587
Rev. A

This page intentionally left blank

9. PERFORMANCE
9.2 Orbit

9.2-4

USA007587
Rev. A

9.3

descent, as the vehicles mach and alpha

decrease, maximum drag is limited by g
(~ Mach 16) and eventually q-bar (~ Mach 5),
thereby limiting downrange reduction.

ENTRY (OPS 304)

CONTENTS
Downrange/Crossrange .....................
Trajectory...............................................
Entry History ........................................
Entry RCS Use Data .............................
Rollout/Braking ...................................
Loss of Braking .....................................
Rollout History .....................................
Performance Rules of Thumb.............

9.3-1
9.3-2
9.3-2
9.3-2
9.3-6
9.3-6
9.3-6
9.3-12

In the event of an emergency deorbit, the

orbiters crossrange capability becomes a
significant factor. The following charts list the
dispersed and undispersed crossrange limits for
28.5 and 57 missions at the stated entry
weights. The dispersed crossrange limits protect for 3-sigma entry dispersions. However, for
an emergency deorbit, the crew could deorbit to
a landing site that is within the undispersed
crossrange limit if there were no site within the
dispersed limit.

Downrange/Crossrange
TAL, emergency deorbit, or a waveoff to the
secondary landing site can result in missioncritical assessments of the orbiters downrange
and crossrange capabilities. Once the orbiter
has committed to its descent, only a carefully
flown profile can put it on the runway safely.
The orbiter begins entry at EI (400,000 ft) on
average 4,176 n. mi. from the landing site.
Given a crossrange situation of about 500 n. mi.
(414 n. mi. being the average), the vehicle has
the ability to stretch the descent approximately
800 n. mi. downrange by flying a lower drag
profile. TPS thermal constraints prevent the
use of lower angles of attack. The orbiter
remains in the equilibrium glide phase longer,
likely bypassing the constant drag phase
altogether. If the crossrange requirement is
reduced below this arbitrary (but realistic)
number, the downrange can be increased
slightly.
The downrange can be reduced by approximately 1,100 n. mi. (again given a 500 n. mi.
crossrange) by flying higher drag profile. This
results in higher temperatures on the TPS as the
vehicle descends more quickly into the atmosphere. TPS thermal constraints are the initial
limiting factor in this profile. During the

9.3-1

RANGE
N. MI.

Dispersed
crossrange limits

Ascending, left

753

Descending, left

753

28.5,
160 n. mi. orbit, 197 k lb

APPROACH
DIRECTION

RANGE
N. MI.

Dispersed
crossrange limits

Ascending, left

815

Descending, left

815

28.5,
160 n. mi. orbit, 197 k lb

APPROACH
DIRECTION
Ascending, left

RANGE
N. MI.
774

Ascending, right

828

Descending, left

781

Descending,
right

818

APPROACH
DIRECTION

APPROACH
DIRECTION
Ascending, left

RANGE
N. MI.
850

Ascending, right

904

Descending, left

857

Descending,
right

894

Dispersed
crossrange limits
57,
160 n. mi. orbit, 217 k lb

Undispersed
crossrange limits
57,
160 n. mi. orbit, 217 k lb

9. PERFORMANCE
9.3 Entry

USA007587
Rev. A

Trajectory
The following chart plots nominal performance
in terms of altitude, VREL, q-bar, flight path
angle, g, and alpha against time from EI.

Entry History
The following table lists flight history performance and performance related data for the first
74 space shuttle missions.

Entry RCS Use Data

Typically,
the
orbiter
deorbits
with
approximately 50 percent aft RCS (ARCS)
propellant in each pod (~1100 lb). Prior to OI-26

600

60

240

500

50

200

400
Altitude
h
300
~1000 ft
200

40
Relative
Velocity
30
VREL
~1000 FPS
20

160
Dynamic
Pressure
120
q
~PSF
80

100

10

40

0
0

and wraparound DAP, RCS propellant use

during entry averaged about 13 percent (600 lb)
of full ARCS tanks. Since the implementation of
wrap DAP, aft RCS usage has averaged 16
percent (350 lb) total aft usage.
Certain
missions are selected to conduct Program Test
Inputs (PTIs), which are modifications to flight
control software to collect entry performance
data. In addition to nominal RCS use, other jet
firings are used to collect RCS PTI data or to
correct for aerosurface PTIs.
Missions
conducting PTIs will typically use in excess of
23 percent (1000 lb) of full ARCS tanks during
entry. Analysis of actual versus predicted use is
ongoing.

h
G

60

2.4

60

50

2.0

50

40

Flight Path
Angle
30
~Degrees
20

1.6

40

10

0.4

10

0
400 800 1200 1600 2000

Total
Load
1.2 Factor,
G
0.8

Angle of
Attack
30

~Degrees
20

Time from Entry (400,000 ft)

t ~ Seconds
938.cvs

Orbiter Entry Trajectory

9. PERFORMANCE
9.3 Entry

9.3-2

Orbit Entry Trajectory

USA007587
Rev. A

9.3-3

9. PERFORMANCE
9.3 Entry

Orbit Entry Trajectory (continued)

USA007587
Rev. A

9. PERFORMANCE
9.3 Entry

9.3-4

Orbit Entry Trajectory (concluded)

USA007587
Rev. A

9.3-5

9. PERFORMANCE
9.3 Entry

USA007587
Rev. A

Rollout/Braking
The design rollout figure depicts a nominal
touchdown to wheels stop profile for a 15 K ft
runway.

Loss of Braking
Some general comments can be made about the
impact of the drag chute. The 40 ft partially
reefed chute deployed 75 ft behind the lower
trailing edge of the vertical tail can reduce the
orbiters stopping distance 2.5K to 3.5K ft. It
provides increased directional control with two
blown tires (NWS engaged) and in the absence
of NWS will greatly reduce the speed at which
the vehicle departs the runway. It also will
significantly reduce the speed at which a heavy
weight orbiter engages the barrier at a TAL site.

The structural carbon brakes, while not

dramatically reducing the braking distance (300
to 500 ft), substantially improve the energy
absorption
capability
over
the
old
beryllium/carbon brakes. Vibration induced
brake damage and heat damage (including heat
induced blown tires) has been virtually
eliminated. All orbiters are equipped with
structural carbon brakes.

Rollout History
The Landing Rollout Flight History Table
reflects the landing environment and the
orbiters performance from main gear
touchdown to wheels stop for the first 97 shuttle
missions.

Design Profile for a 15000 ft Runway

R ol lo ut Ph a s es
Attit ude
Hold
(~8 )

Threshold

Derotation
(-2/sec)

19 5
180
KE A S
KE AS
Wowlon Derotate

Coasting
(~ -6 fps 2 )

140
KGS
Beg in
Braking

~160
KE A S
Wong

Braking
(-9 fps2 )

0
KGS
Wheels
Stop

(1) All runways with all

systems up
(2) No barrier with either
no nosewheel steering
or only 50% braking
Mim im u m
Rol lou t
Margi n
Required
2000 ft

2000 ft
(2)
Barrier

(1)

Underrun

Overrun
0
ft

10 00
ft

Mi nim um
T/D
Margi n
Required

2500
~4000
ft
ft
Nomi na l
T/D
Target

~6000
ft
Lo ad
Relief
Be gi n
Active
NWS

75 00
ft
No
Braking
Before
Midfield

9.3 Entry

10 K ~1 1K
ft
ft
Be gi n
Maximum
Braking
if V >
140 KGS

15000
ft
End of
Runway

941.cvs

Design Rollout Phases

9. PERFORMANCE

80 0
ft

9.3-6

USA007587
Rev. A

70

VTD = 225 kts

VTD = 240 kts

VTD = 208 kts

VBO = 205 kts

One stop
energy limit
VBO = 180 kts

50
VBO = 160 kts

VTD = 190 kts

40

VBO = 140 kts

Five stop
energy limit
30

Vehicle gross weight = 207,000 lb

20

V TD = velocity at touchdown (225 = tire limit)

VBO = velocity at "brakes on"

10
6

10

11

Rollout Distance from Touchdown (K ft)

942.cvs

Rollout Distance/Brake Energy

Flight rules define 50% loss

in braking to be 40% loss in
brake torque

Brakes on at 140 kgs

Sea level
2.0
Increase in Rollout Distance (1000 ft)

Brake Energy per Brake (ft-lb)

60

1.6

Surface wind
10 k Tailwind
0k
10 k Headwind

Loss in
Braking
50%

1.2

0.8

25%

0.4

0
180

12.5%

190

200

210

220

230

240

250

260

Weight (1000 lb)

943.cvs

Loss of Braking

9.3-7

9. PERFORMANCE
9.3 Entry

Landing Rollout Flight History Table

USA007587
Rev. A

9. PERFORMANCE
9.3 Entry

9.3-8

Landing Rollout Flight History Table (continued)

USA007587
Rev. A

9.3-9

9. PERFORMANCE

9.3 Entry

Landing Rollout Flight History Table (continued)

USA007587
Rev. A

9. PERFORMANCE

9.3 Entry

9.3-10

Landing Rollout Flight History Table (concluded)

USA007587
Rev. A

9.3-11

9. PERFORMANCE

9.3 Entry

USA007587
Rev. A

Performance Rules of Thumb

ASCENT
Ascent Performance Margin
Management Reserve Req. (lbs)
Pre Flight Design Requirements
Document = 3500
Flight Design Requirements
Document = 2500
Cargo Integration Review = 1500
Flight Planning Stowage
Review = 1500
FPR = 4652
ORBIT
1 hr launch delay = change in
orbital noon by 4 minutes
Ascending node
28.5 deg - 1st ascending node
is @ Long = 173.38 East
57 deg = 121.55 West
MISCELLANEOUS
Orbiters
OV103 - Discovery
OV104 - Atlantis
OV105 - Endeavor

DESCENT
Xcg Limits
FWD = 1076.7 in (RTLS = 1079.0 in)
AFT = 1109.0 in
CONT AFT = 1119.0 in
D/O Delta V's
Descending approach is worst case V
90 deg prebank will decrease V ~ 10 ft/s
(function of altitude)
If Xcg > 1091.5: 1 in Xcg = 2.2 miles
If Xcg < 1091.5: 1 in Xcg = 1.1 miles
As Xcg increases (more aft), XR decreases
1 nm XR = 5780 lbs EI weight
1 nm XR = 4.38 nm D/O altitude
As altitude and weight increase, XR increases
As inclination increases, XR increases (non-linear)
As temp increases, XR increases (non-linear)
Touchdown speeds
195 kts if TD weight < 222 k lbs
205 kts if TD weight > 222 k lbs

10 kts slower if short field speedbrake

guidance mode is used if 200 k lb < TD weight
245 k lbs

Min planned flt duration = 96 hours

Max/Min Beta Angle
Max = 23.5 + orbital inclination
Min = 23.5 - orbital inclination
Time
CDT = GMT - 5 hr
CST = GMT - 6 hr
Daylight savings time from
1st Sunday in April to
last Sunday in October

Derotation 185 KGS with beep trim (Prime)

or with RHC (manual ) derotation (Backup)

PROPELLANT
1 deg of plane change = 440 ft/s
OMS philosophy
1 ft/s = 21.8 lbs OMS @ 220 k lbs ~ 1/6%
1.78 ft/s = 1 nm
Maximum OMS load
OV103/4 = 25064 lbs
Min = 10800 lbs
Max OMS ballast = 4000 lbs
1% OMS = 130 lbs/side
Hard Ballast
OV103/104 - Bay 13
RCS philosophy
1 ft/s = 25 lbs (+ X) or 35 - 40 lbs
(multi axis) @ 220 k lbs
Max burn = 250 sec = 55 fps
Full FRCS = 2446 lbs
ET blowdown offload = 2225 lbs
Min FRCS - 1862 lbs
Full ARCS = 4970 lbs (over 100%)
1% ARCS = 22 lbs/side
IINTERCONNECT logic
If OMS < 14,000 lbs, I/C off
If OMS > 17,000 lbs, I/C on
If 14 k < OMS < 17 k, analysis req.
ECS - N2

Mass Moment
MM = TD Weight * (1172.3 - Xcg)/12
for medium lakebed runways
If MM > 1.47 M ft-lbs Concrete desire
If MM > 1.54 M ft-lbs Concrete required
Note: If TD Xcg not known, use
Xcg @ M = 3.5 + 1.5 in
Landing Weight Limits
EOM 233 k lbs
RTLS 242 - 248 k lbs *
TAL 241 - 248 k lbs *
AOA 233 - 240 k lbs *
(Abort limits a function of Inclination)
Noctilucent Clouds
If Inc > 50, do not enter on descending opportunity
June through August.

OV103/4
5.28 lbs/day for 4 person crew @ 14.7 psi
add .114 lbs/day for additional crewmember
3.66 lbs/day for 4 person crew @ 10.2 psi
add .079 lbs/day for additional crewmember

N2

Dry wt
83 lbm

Fully loaded wt
143 lbm
EPS

.09 lbm Hydrogen = 1 kwh

.7 lbm Oxygen = 1 kwh
.07 lbm Oxygen/hour = cabin leak rate

H2
O2

Dry wt
227 lbm
215 lbm

Fully loaded wt
319 lbm
996 lbm

RENDEZVOUS
1 deg of phasing/hour = 10 nm of height
1 deg of phasing = 60 nm
17.5 ft/s burn changes other side of orbit 10 nm
440 ft/s burn will change plane by 1 deg of wedge
1 deg of RAAN occurs for each relative lap

* Orbiter Engineering Memo VE3-90-096.

usa007587_945r1.cvx

9. PERFORMANCE
9.3 Entry

9.3-12

USA007587
Rev. A

APPENDIX A PANEL DIAGRAMS

CONTENTS
Forward
F1............................... A-2
F2............................... A-2
F3............................... A-2
F4............................... A-2
F5............................... A-3
F6............................... A-4
F7............................... A-5
F8............................... A-6
F9............................... A-7
Overhead
O1................................A-8
O2................................A-9
O3.............................. A-10
O5.............................. A-11
O6.............................. A-12
O7.............................. A-13
O8.............................. A-14
O9.............................. A-15
O13............................ A-16
O14............................ A-17
O15............................ A-18
O16............................ A-19
O17............................ A-20
O19............................ A-20
Left
L1 .............................. A-21
L2 .............................. A-22
L4 .............................. A-23
L5 .............................. A-24
L9 .............................. A-24
L11 ............................ A-25
L12U ......................... A-26
L12L .......................... A-27
L15 ............................ A-28

Center Console
C2.............................. A-29
C3.............................. A-30
C5.............................. A-31
C6.............................. A-31
C7.............................. A-31
Right
R1 .............................. A-32
R2 .............................. A-33
R4 .............................. A-34
R6 .............................. A-34
R7 .............................. A-35
R11U......................... A-36
R11L.......................... A-36
R10 ............................ A-37
R12U......................... A-37
R12L.......................... A-37
R13U......................... A-38
R13L.......................... A-39
R14 ............................ A-40
Aft
A1U .......................... A-41
A1L ........................... A-42
A1R........................... A-43
A2.............................. A-44
A3.............................. A-44
A4.............................. A-45
A6U .......................... A-45
A6L ........................... A-46
A7U .......................... A-46
A7L ........................... A-47
A8U .......................... A-48
A8L ........................... A-49
A11.......................A-49, 50
A12............................ A-51
A13 ........................... A-51
A14............................ A-52
A15.......................A-53, 54

A-1

Middeck
MA73C..................... A-55
MD24K..................... A-56
MD44F ..................... A-56
ML18F ...................... A-56
ML26C ..................... A-56
ML31C ..................... A-57
ML85E...................... A-57
ML86B...................... A-58
MO10W.................... A-59
MO13Q .................... A-60
MO29J ...................... A-61
MO30F ..................... A-61
MO32M.................... A-61
MO39M.................... A-61
MO42F ..................... A-62
MO51F ..................... A-62
MO52J ...................... A-63
MO58F ..................... A-63
MO62M.................... A-64
MO69M.................... A-64
MO63P ..................... A-64
WCS.......................... A-65
Thermal Impulse
Printer ...................... A-66
Airlock
AW18A .................... A-67
AW18D .................... A-67
AW18H .................... A-68
AW82A .................... A-69
AW82B ..................... A-69
AW82D .................... A-69
AW82H .................... A-70

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel F1

Panel F2

Panel F3

Panel F4
APPENDIX A: PANEL DIAGRAMS

A-2

USA007587
Rev. A

Panel F5

A-3

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel F6

APPENDIX A: PANEL DIAGRAMS

A-4

Panel F7

USA007587
Rev. A

A-5

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel F8

APPENDIX A: PANEL DIAGRAMS

A-6

USA007587
Rev. A

Panel F9

A-7

APPENDIX A: PANEL DIAGRAMS

Panel O1

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-8

USA007587
Rev. A

Panel O2

A-9

APPENDIX A: PANEL DIAGRAMS

Panel O3

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-10

Panel O5

USA007587
Rev. A

A-11

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel O6

APPENDIX A: PANEL DIAGRAMS

A-12

USA007587
Rev. A

Panel O7

A-13

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel O8

APPENDIX A: PANEL DIAGRAMS

A-14

Panel O9

USA007587
Rev. A

A-15

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel O13

APPENDIX A: PANEL DIAGRAMS

A-16

USA007587
Rev. A

Panel O14

A-17

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel O15

APPENDIX A: PANEL DIAGRAMS

A-18

USA007587
Rev. A

Panel O16

A-19

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel O17

Panel O19

APPENDIX A: PANEL DIAGRAMS

A-20

Panel L1

USA007587
Rev. A

A-21

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel L2

APPENDIX A: PANEL DIAGRAMS

A-22

Panel L4

USA007587
Rev. A

A-23

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel L5

Panel L9

APPENDIX A: PANEL DIAGRAMS

A-24

USA007587
Rev. A

Panel L11

A-25

APPENDIX A: PANEL DIAGRAMS

Panel L12U (Mission Dependent)

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-26

Panel L12L (Mission Dependent)

USA007587
Rev. A

A-27

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel L15

APPENDIX A: PANEL DIAGRAMS

A-28

Panel C2

USA007587
Rev. A

A-29

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel C3

APPENDIX A: PANEL DIAGRAMS

A-30

USA007587
Rev. A

Panel C5

Panel C6

Panel C7

A-31

APPENDIX A: PANEL DIAGRAMS

Panel R1

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-32

USA007587
Rev. A

Panel R2

A-33

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel R4

Panel R6

APPENDIX A: PANEL DIAGRAMS

A-34

USA007587
Rev. A

Panel R7

A-35

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel R11U

Panel R11L

APPENDIX A: PANEL DIAGRAMS

A-36

USA007587
Rev. A

Panel R10

Panels R12U and R12L (Mission Dependent)

A-37

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel R13U

APPENDIX A: PANEL DIAGRAMS

A-38

USA007587
Rev. A

Panel R13L

A-39

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel R14

APPENDIX A: PANEL DIAGRAMS

A-40

USA007587
Rev. A

Panel A1U

A-41

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A1L

APPENDIX A: PANEL DIAGRAMS

A-42

USA007587
Rev. A

Panel A1R

A-43

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A2

Panel A3

APPENDIX A: PANEL DIAGRAMS

A-44

USA007587
Rev. A

Panel A4

Panel A6U

A-45

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A6L

Panel A7U

APPENDIX A: PANEL DIAGRAMS

A-46

USA007587
Rev. A

Panel A7L, APDS Control Panel

A-47

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A8U

APPENDIX A: PANEL DIAGRAMS

A-48

USA007587
Rev. A

Panel A8L

Panel A11 (OV-103 and OV-104 only)

A-49

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A11
(OV-105 only)
APPENDIX A: PANEL DIAGRAMS

A-50

USA007587
Rev. A

Panel A12

Panel A13

A-51

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A
(OV-103 only)

Panel A14

APPENDIX A: PANEL DIAGRAMS

A-52

USA007587
Rev. A

Panel A15 (OV-104 only)

A-53

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel A15 (OV-103, 105 only)

APPENDIX A: PANEL DIAGRAMS

A-54

USA007587
Rev. A

Panel MA73C

A-55

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel MD44F
MD24K

Panel ML26C

Panel ML18F

APPENDIX A: PANEL DIAGRAMS

A-56

USA007587
Rev. A

Panel ML31C

Panel ML85E

A-57

APPENDIX A: PANEL DIAGRAMS

Panel ML86B

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-58

USA007587
Rev. A

Panel MO10W

A-59

APPENDIX A: PANEL DIAGRAMS

Panel MO13Q

USA007587
Rev. A

APPENDIX A: PANEL DIAGRAMS

A-60

USA007587
Rev. A

Panel MO30F

Panel MO29J

Panel MO39M

Panel MO32M

A-61

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel MO42F

Panel MO51F (OV-104, 105 only)

APPENDIX A: PANEL DIAGRAMS

A-62

USA007587
Rev. A

Panel MO52J

Panel MO58F

A-63

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel MO62M
Panel MO69M

Panel MO63P (OV-103, 104 only)

APPENDIX A: PANEL DIAGRAMS

A-64

USA007587
Rev. A

WCS

A-65

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Thermal Impulse Printer

APPENDIX A: PANEL DIAGRAMS

A-66

USA007587
Rev. A

Panel AW18A

Panel AW18D

A-67

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel AW18H

APPENDIX A: PANEL DIAGRAMS

A-68

USA007587
Rev. A

Panel AW82A

Panel AW82B

Panel AW82D

A-69

APPENDIX A: PANEL DIAGRAMS

USA007587
Rev. A

Panel AW82H

APPENDIX A: PANEL DIAGRAMS

A-70

USA007587
Rev. A

APPENDIX B DISPLAYS AND

CONTROLS

B-1

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A
Contents A - Alphabetical

APPENDIX B: DISPLAYS AND CONTROLS

B-2

USA007587
Rev. A
SPEC and DISP Displays

B-3

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

(D) Controls

(D) APU/HYD

APPENDIX B: DISPLAYS AND CONTROLS

B-4

USA007587
Rev. A

(D) ENTRY TRAJ 1 (BFS)

(D) DAP CONFIG

B-5

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

(D) ENTRY TRAJ 3 (BFS)

APPENDIX B: DISPLAYS AND CONTROLS

(D) ENTRY TRAJ 5 (BFS)

B-6

USA007587
Rev. A

(D) FAULT (BFS)

B-7

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

APPENDIX B: DISPLAYS AND CONTROLS

B-8

USA007587
Rev. A

B-9

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

APPENDIX B: DISPLAYS AND CONTROLS

B-10

USA007587
Rev. A

B-11

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

APPENDIX B: DISPLAYS AND CONTROLS

B-12

USA007587
Rev. A

B-13

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

APPENDIX B: DISPLAYS AND CONTROLS

B-14

USA007587
Rev. A

B-15

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A

APPENDIX B: DISPLAYS AND CONTROLS

B-16

USA007587
Rev. A

Notes

B-17

APPENDIX B: DISPLAYS AND CONTROLS

USA007587
Rev. A
Notes

APPENDIX B: DISPLAYS AND CONTROLS

Notes

B-18

USA007587
Rev. A

APU/HYD

APPENDIX C STUDY NOTES

General

CONTENTS
APU/HYD ............................................
Comm-Voice Data................................
Cryo ......................................................
DPS ......................................................
ECLSS.....................................................
EPS ......................................................
Ascent/Entry FCS ................................
GNC Sensors and Controllers ............
Instrumentation....................................
Mechanical Systems.............................
MPS ......................................................
OMS ......................................................
RCS ......................................................

Ascent: all APUs will be kept running

through MECO if possible.

C-1
C-4
C-4
C-5
C-6
C-7
C-9
C-12
C-15
C-16
C-16
C-20
C-23

Loss of one APU means hydraulic lock

on one engine.
Loss of two APUs means two SSMEs in
hydraulic lock plus loss of TVC for one
SSME.
Entry
Pre-TAEM, a sick APU (high oil
temperature, high hydraulic temperature, pump leak P, H2O leak) may be
manually shut down, cooled down, and
restarted near Mach 1 to support
landing.

This appendix contains a set of study notes

originally developed by Ron Grabe in
September 1989. They have been extensively
modified and updated over the years and
reviewed for technical content by the Training
Division.

Post-TAEM, APUs generally will be

kept running except for high oil temperature. An APU will be shut down for
high oil temperature if Mach >1. A
gearbox failure for high oil temperature
is not catastrophic.

The purpose of these notes is to provide

crewmembers with a set of critical need-toknow items that can be reviewed in their
entirety at one sitting. The notes are directed at
the PLT crew position, but should be useful for
other crewmembers as well.

Auto Shutdown
Controller will issue an auto shutdown
command, if auto shutdown is enabled, for
RPM less than 80% or above 129% (auto
shutdown is inhibited for the first 10.5
seconds after start to allow turbine spinup).

The Study Notes are organized alphabetically

by major system. Under each system heading,
notes on critical subsystems and malfunctions
are presented. The text is written in Flight Data
File shorthand using switch nomenclature and
DPS display terminology, which results in a
somewhat cryptic format. Although directed
primarily toward Generic and Flight-Specific
training, they should be readily understood by
crewmembers who have progressed through at
least part of Pilot Pool training.

Auto shutdown closes secondary fuel control

valve and fuel tank valves.
An APU with an underspeed shutdown is a
candidate for cooldown and restart.
APUs with confirmed overspeed shutdown
will not be restarted.

Preparation for Shuttle Mission Simulator

(SMS) training sessions is difficult due to the
complexity of the Space Shuttle and the many
flight phases that crewmembers are required to
understand. A quick review of these Study
Notes prior to SMS sessions should help make
training more productive.

If auto shutdown inhibited and APU speed is

confirmed above 129%, manual shutdown is
required as soon as possible.

C-1

APPENDIX C: STUDY NOTES

USA007587
Rev. A
Single APU Loss

Fuel Pump

Single APU loss will not affect nosewheel

steering (hydraulic system 1 is prime and
system 2 is backup).

Gear driven pump delivers fuel under

pressure post start.
APU PUMP LK P shows build-up of
leaking oil or fuel in catch bottle. Bottle
relieves overboard.

Single APU loss will not affect braking (loss

of APU 3 plus either 1 or 2 means half
brakes).

Cooling

Hyd system 1 is prime for main and nose

gear deploy. If APU 1 is lost, the landing
gear will be deployed with pyros. There is
no hydraulic backup to main landing gear
deploy, Hyd system 2 gives a hydraulic backup
to nose gear deploy only.

GG bed injectors cooled by separate H2O

injection system for re-start. H2O system not
used during normal ops.

Switching Valves

Cooling required for 3.5 minutes in INJECTOR

COOL prior to start. If no cooling of GG
injector apparent, do not perform restart.

Supply either primary or one of two back-up

hydraulic systems to the aerosurface
actuators.

If APU not started immediately following

cool-down, injector temperature will rise
again rapidly.

Valve status only visible on SPEC 86 (SM

OPS 2).

Common tank for all APUs. Total cooling

capacity is 21 minutes.

During FCS checkout, check active hydraulic

system selected.

Fuel pump and fuel control valves are cooled

passively by heat sinks and radiation shields.

Fuel Tank

Water spray boiler cools hydraulic and lube oil.

Supply supports about 110 minutes of

operations, enough for an AOA if the APUs
are taken to low pressure post-MECO.

Bypass valve isolates hydraulic cooling

feature when not required.
Two controllers (A and B) use common
water lines but have different spray
logic.

Nitrogen pre-charge required for start-up.

Different Hyd Pressure sensors are displayed
on the MEDS meter and SM SYS SUM 2.
Quantity (DPS display and MEDS meter) is a
PVT calculation.

Water quantity should not decrease

during ascent. Pre-charge in H2O boiler
immerses oil lines. No spraying until
MET about 8:00.

Isolation valves must be closed (de-powered)

when APU is not running. No fuel cooling of
solenoid valves.

PGME (an antifreeze) is present in the

cooling water to prevent the WSBs from
freezing.

Post APU shutdown, if fuel tank valve

temperature high, pull circuit breakers.

Hydraulic Accumulator
Maintains pressure of about 2600 psi when
APU not running (hydraulic pressure still
about 65 psi).

Solenoid short may overtemp valves

while APU is still running. Pull circuit
breaker for second valve in parallel.
Will keep APU running.

APPENDIX C: STUDY NOTES

Prevents hydraulic pump cavitation.

C-2

USA007587
Rev. A
Low accumulator pressure on orbit indicates
nitrogen leak or internal priority valve or
unloader valve failure.

PRL will show down arrow if declaring

system down.
SPEC 51 data:

Circulation Pump

AUT* means auto logic is active.

Two-stage pump. First stage low pressure,

high volume. Second stage high pressure, low
volume. High pressure fluid can be diverted
to repress accumulator.
Otherwise, high
pressure fluid mixes with low pressure fluid.

DES* means manual deselection (toggle

to reselect).
For PRL ? and system good, leave auto
logic selected.

On orbit, automatically turns on (when

pressure < 1960 psi) to maintain accumulator
pressure.

Subsequent transducer fail may require

deselect of auto logic and a manual
deselect or reselect.

Circ pumps keep hydraulic fluid moving for

thermal conditioning on orbit. Automatically
turn on for low hydraulic line temperatures.

For PRL down arrow and system good,

deselect auto logic to reinstate hydraulic
system into PRL.

Only one circ pump operates at a time in

GPC control for electrical loads considerations. The system with low accumulator
pressure has higher priority than the system
with low hydraulic line temperatures. For
thermal reasons, two circ pumps at a time are
OK if needed to recharge two accumulators.

Manual Shutdown
Used to back up auto shutdown.
Controller power off protects
uncommanded hot re-start.

against

Must identify over or underspeed shutdown

prior to controller power off (caution and
warning light extinguished).

Priority Rate Limiting

Software routine used to prevent overdemanding the available hydraulic systems
in the event one or more systems fail. It
ensures that the more important aerosurfaces
(e.g., elevons, rudder) are given hydraulic
pressure demand priority over the less
important aerosurfaces (e.g., speed brake and
body flap).

Ready-To-Start Talkback Gray

Low press selected.
H2O spray boiler ready.
APU fuel isolation valves open.

Gets 3 hydraulic pressure inputs from each

system.

GG bed temperature >190 degrees.

APU speed below 80%.

Crew can see 2 of the inputs on BFS SYS

SUMM and MEDS meter. MCC has access to
all three inputs.

Underspeed immediately after start is

probably caused by 10.5-second timer failure.
Auto shutdown is normally disabled during
first 10.5 seconds of start. AUTO SHUTDOWN to INHIBIT may allow start.

Crew can also see hydraulic accumulator

pressure that PRL does not see.
Use hydraulic accumulator pressure
and RPM to resolve dilemma.
Accumulator pressure = 3000 means
hydraulic system OK.

C-3

APPENDIX C: STUDY NOTES

USA007587
Rev. A

Comm-Voice Data

Crew can manually reconfigure the comm

system via switches on panel A1L and/or
by item entries on BFS G51.

General
PANEL/CMD on panel C3 switch passes
S-band control to system selected on aft
panel. One step total reconfiguration to
alternate system.

Encryptor, Transponder, and Power Amp

Power amp and preamp are not used if
configured for STDN low mode.

Normally, INCO manages system on LRU by

LRU basis. All LRUs are system 1/system 2
redundant.

Encryption is normally on uplink only.

Encryptor dedicated to one NSP.
selectable separately.

ACCU

Not

Bypass selected for encryption failure.

Routes all audio to ATUs.

NSP

No voice (ICOM and A/G), switch ACCUs.

Processes uplink and downlink (voice,

commands, and data), except UHF that
bypasses NSP.

CDR and PLT can talk to each other on same

ATU without an ACCU.

Failure means no S-band voice, commands or

data to/from ground.

Antenna Electronics Unit

Switches antenna per GPC or RTC command.

BCE STRG X NSP where X = active FF

MDM (1 or 3). Could be just command
failed. Check data/voice with MCC.

BFS commands for ascent and entry.

SM GPC command on orbit.

Cryo

Commands routed to antenna electronics 1/2

over PL MDM 1/2, respectively. No crossstrapping capability.

General
Separate transducers for DPS display and
overhead meters.

Manual selection available with loss of auto

select.

DPS display data goes off scale low for big

leaks.

Ascent/Entry Configuration
S-band system 2 active in STDN mode.

Heaters

STDN sites prime for comm.

Each tank has A and B heaters.

On orbit, 1 to 2 hour call up.

Separate controls/logic for O2 and H2 heaters.

A/G 1 and A/G 2 selected simo.

O2 heaters have two elements with two

current sensors per heater.

UHF T/R on A/A loop.

Crew insight into sensor status in OPS2 only.

TDRS available on ascent and TAL.

If any current sensor trips (short), that heater

is disabled.

On ascent, a stored program command

will mode to TDRS at L/O + 7:30.

Heater logic (applies separately to O2 and

H2).

APPENDIX C: STUDY NOTES

C-4

USA007587
Rev. A
Both tanks in a ganged pair must have
low P before heaters in either tank are
turned on.

switches also. It is good practice to always

pause slightly in each switch detent to ensure
the contacts are made and recognized by the
GPCs.

Only one high P is needed to turn both

heaters off.

Always clear the fault message line as soon

as messages have been seen. This will avoid
missing
annunciations
of
subsequent
failures.

During leak isolation, pressure in good

tank may prevent heaters in leaking tank
from coming on with both tanks heaters
enabled.

Resume SPECs and DISPs from IDPs when

not in use or prior to switching to another
major function on that IDP.

Control points for heaters:

H2 tank 1 and 2 pressure = 203 to 223

Hard assign IDPs (both PASS and BFS) via

PASS IDP keyboard (BFS will DK listen).
Dual DPS display commanders can be
caused by trying to assign an IDP to BFS that
a PASS GPC is still driving.

O2 tank 1 and 2 pressure = 811 to 846

Tank 3, 4, and 5 set points slightly higher
so tank 3, 4, and 5 will preferentially feed
on orbit with all tanks in AUTO.

When moding PASS GPCs into the common

set (i.e., STBY to RUN), always pause 10
seconds before making further switch throws
or item entries to avoid possible fail-to-sync
and ensure proper common set initialization.

Leaks
First step in ascent and entry cryo leak
procedure is to determine number of tanks
with pressure decreasing.
Only one tank leaking, leave configuration as is (manifold isolation valves
open). Leak is a tank leak. Isolating tank
will starve its fuel cell.

BFS Engage
Post BFS engage, check to ensure that all
active PASS GPCs have recognized the
engage (both MODE and OUTPUT talkbacks
are barberpole). If not, take the offending
GPC to HALT (or power it off) immediately
to avoid I/O problems on the flight-critical
strings.

If all tanks decreasing, close manifold

valves to isolate leak. Must react quickly
for large multi-tank leaks.

If leak internal to fuel cell 3, need to

reopen manifold valves ASAP. Manifold
3 does not have a relief valve.

Restringing
Deassign IDPs to avoid inadvertent entries.

DPS

Before OPS transitions and restrings, verify

the NBAT. Check proper MAJOR FUNCTION and GPC switch configuration.

General
It is important to be able to identify GPC
failures, for MCC often has little insight.
Crew information affects MCC analysis and
planning for subsequent failures (both DPS
and non DPS).

Ensure the correct memory configuration is

displayed prior to making NBAT changes.
Dynamic flight.

When using the GPC MODE switch, remove

your hand between positions. On past missions, there have been problems with the
switch being in two positions at the same time.
This problem can occur on other orbiter

Use the Restring cue card.

Take the failed GPC to HALT (or STBY,
HALT) prior to OPS MODE RECALL.

C-5

APPENDIX C: STUDY NOTES

USA007587
Rev. A
Deselect surface feedbacks prior to OPS
MODE RECALL. Reselect following OPS
MODE RECALL.

Treat simplex machines or undesired

set as failed GPCs. Work the GPC fail
procedure twice sequentially.

Follow OPS MODE RECALL with BFS

I/O RESET (or PRO to OPS 3 if TAL).

BFS engage required on ascent for

MPS commands if simplex machines
or undesired set cannot be taken to
HALT pre-MECO.

Avoid assignment of all three IDPs to the

same GPC, especially on orbit.

Restring may be performed with MCC

coordination, in accordance with
Flight Rules.

Keep hands off of everything during OPS

transitions, especially switches and IDP
keyboards.

Be prepared for BFS engage if sets

begin force fight or total set split.

Rules.
Always restring
capability.

to

regain

critical

BFS engage decisions for set splits.

On seeing multiple GPC fault and CAM
lights, call "SET SPLIT".

Powered flight. In general, you can

recover stuck throttle if necessary for
uphill performance.
Post MECO, pre ET SEP.
required for SEP.

Check BFS and PASS GNC SYS SUMM.

Recover jets

If BFS tracking 2 PASS GPCs, check them

for 1 IMU, 2 FCS channels, 1 RGA, and 1
AA. (Minimum for good PASS set.)

Pre OMS-1. Recover single OMS ignition

capability (delay burn). Regain critical
system insight (if engagable BFS still
available). Maintain single fault tolerance.

If BFS standalone, check PASS if time

permits. Time available is based on NAV
state without IMU data:
Powered flight - 10 seconds
Entry - 45 seconds
Orbit - plenty of time

Entry.
Regain vent door commands.
Regain nose wheel steering for abort
landing site or known directional control
problems during rollout. Maintain ASA
command and body flap command.

Distribute IDPs among different GPCs. On

orbit, ensure all IDPs are not assigned to the
SM GPC or a single GNC OPS GPC. Loss of
the GPC with all IDPs loses PASS DPS
display interface.

In general, port moding is preferred over

restring to regain lost capability.
Prior to EI-5, restring for any failed GPC.

ECLSS

Set Split

General

2 on 2 or 2 on 1 on 1 split during ascent

During ascent, only Freon pumps will be

swapped if lost, and then only to avoid RTLS or
TAL. All other fans and pumps are cooling
equipment that can wait until post-MECO.

Engage BFS.
If desired, the PASS set can be
reconfigured pre-MECO if BFS is tracking
and no additional complicating failures
are present, rather than engaging the BFS.

APPENDIX C: STUDY NOTES

All ECLSS data seen on the overhead meters

(panel O1) come from the same sensors as
seen on the DPS displays.

C-6

USA007587
Rev. A
NH3 Boiler A(B) control
temperature in Freon loop 1(2).

based

powered flight unless called

malfunction procedures or by MCC.

on

for

in

Loads that can be switched in powered

flight:

If no flow in Freon loop, must use NH3

boiler corresponding to good loop.

Avionics bay fans (only for 3-phase

motor stop)
Freon pumps (only to help determine
if RTLS or TAL is required)
H2O loops (only for Evap Out T Low)

If degraded flow in Freon loop, select

NH3 boiler for loop with degraded flow.
Control to the good loop but not the dead loop.
Cabin Pressure

AC bus sensors OFF on ascent to protect

SSMEs for:

First reaction to cabin leak is to close cabin

relief isolation valves one at a time.

Loss of first engine.

Double check leak indications with MCC.

May be due to cabin expansion or thermal
effects such as seen during First Stage.

Loss of SSME controller redundancy on

any engine.

N2/O2 leak into cabin will cause rise in cabin

pressure and for O2 leak, PPO2 will also rise
(O2 concentration available on orbit).

Loss of a single AC phase (takes down an

SSME controller on two engines).

dP/dt on meter and DPS display come from

dP/dt sensor.

When AC bus sensors are OFF, no hardware caution and warning lights will
illuminate (no AC VOLTS or AC
OVERLOAD light).

EQ dP/dt is calculated from cabin pressure

and dP/dt sensors by BFS and standardized to
a 14.7 psi cabin. EQ dP/dt is used when
available to make ascent abort decisions for
cabin leak. Backup dP/dt is also calculated
from cabin pressure, but not standardized for
a 14.7 cabin.

AC voltage high
Ride until MECO unless volts exceed 130,
or affected main engine controllers are
lost (MCC call).
Trip bus off line with AUTO TRIP
selection on bus sensor.

EPS

AC phase shift (three-phase motors stop)

General

Verified by normal volts and multi-phase

amps possibly slightly high.

Do not reset popped circuit protection device

(RPC or circuit breaker) without consulting
MCC.

Multiple three-phase motors fall off line:

fuel cell pump, Freon pump, H2O pump,
AC bay fans, etc.

For critical actions, MCC may call for

momentary reset of failed control or essential
bus while crew holds switch for affected
system in desired position (three finger
trick).

Take individual phases off line separately

to find bad phase.
If AC bus sensor in AUTO TRIP, AC phase
will be automatically disconnected for either
an AC overload or high AC volts.

AC Bus
Surge on AC bus can cause main engine
controller to trip off line. Avoid actuation or
switching of AC powered equipment during

C-7

APPENDIX C: STUDY NOTES

USA007587
Rev. A
If AC bus sensor in MONITOR, will get
hardware caution and warning, but will not
get AUTO TRIP feature.

Pressure should be sensed in 3 seconds.

Delta P talkback goes gray.
READY FOR LOAD talkback requires 30
second timer and good heaters.

AC bus sensor uses different transducer than

one feeding F9 meter or DPS display.

Delta P relay failure may prevent fuel cell

ECU from latching on fuel cell start
command. DELTA P talkback wont stay
gray. OK to hold START switch in
START. After 30 seconds, second relay
should latch command on (can release
START switch).

AC bus sensor needs to see rapid rise or delta

amps to issue an AC OVERLOAD indication.
Bus Tie Actions
If re-establishing power to a main bus (main
bus volts < 20), always unpower the AC
inverters before tying to a good bus (prevents
surges). Use long form bus tie procedure on
cue card.

Coolant pump failure stagnates coolant loop.

Stack T measured downstream of the stack
outlet. Will slowly decrease after coolant
pump failure.

If a tie results in a short, immediately untie.

Exit T measured in H2/H2O loop.

Never tie 3 main buses during powered

flight. OK post-MECO, on orbit, and entry.

If H2 pump running, exit T will

progressively increase after coolant pump
failure.

Never tie into a short.

Nine minutes of run time available after

first coolant pump failure, assuming
normal fuel loading.

Payload primary bus can be used to tie Main

B to Main C (back door bus tie), or connect
FC3 to Main C.

O2 is entirely consumed. H2 is circulated

continuously through power section and
condenser.

Do not bus tie in first stage for the first fuel cell
problem.
Fuel Cell

H2O is drawn out of stack by mixing with

H2.

Coolant pump and H2 pump both driven by

same AC bus and both pumps controlled by
fuel cell ECU and START/STOP switch.

H2O is separated at the H2/H2O pump.

Dual gas regulator maintains proper
pressure of reactants (about 60 psia). O2
pressure feeds coolant loop accumulator.

Coolant pump draws 0.5 amps, H2 pump

draws 0.3 amps.

Dual gas regulator problem indicated by

COOL P HIGH/LOW. Tie buses and
monitor fuel cell for degradation.

Coolant pump delta P indication.

Ground can see immediately if loss of fuel
cell coolant pump is real (stop/start to
check run current not required).

If O2 reactant valve closes, coolant

pressure will drop.

No comm, can stop fuel cell and check for

0.8 amp drop. This indicates both pumps
were running (bad sensor). Restart gives
full recovery (should see 0.8 amp
increase).

Failure of the H2/H2O pump will lead to fuel

cell flooding since water is not removed.
Ascent and entry: pH status fail followed
by slow degrade and exit temperature
decreasing may be first signatures of
flooding.

START switch sends pump start commands.

APPENDIX C: STUDY NOTES

C-8

USA007587
Rev. A
Indicated on orbit by H2 pump status fail.

FC RELIEF LINE HTR controls heaters on

each fuel cell relief line.

Crossover (uncontrolled O2 and H2 mixing).

rapidly

Each fuel cell relief line merges into one

common manifold that vents H2O
overboard.

Fuel cell delta volts increasing is a

warning.

Purge process pumps extra O2 and H2

through fuel cell.

Highly unlikely to happen

without warning signs.

PH high may occur, but not necessarily.

Removes contaminants.

Fuel cell degradation will eventually occur.

Excess O2 and H2 dumped overboard. All

three fuel cell purge lines merge into one
O2 and one H2 manifold.

Separate pH sensor for each fuel cell and

common sensor in H2O manifold.

Purge only one fuel cell at a time.

pHfail may indicate pending breakdown

of Fuel Cell matrix (fuel cell crossover).
Potential explosive mixing of H2 and O2.

Nominal load is 7 kw per fuel cell. For

powerdown operations, 13 kw OK on one
fuel cell for 4 hours, 12 kW OK continuously.

High fuel cell delta volts provides

confirming cue.

Main Bus Short

Assume matrix failure for pH fail and bus

tie as soon as possible. Problem may be
an H2/H2O pump failure.

Fuel cell will overheat in time. Amps high,

fuel cell and main volts low.

Common
pHsensor
can
confirm
individual fuel cell sensor. Will annunciate about 10 minutes after individual fuel
cell pH (common pH only seen by crew
on orbit).

Short before the fuel cell main bus switch

will have high amps and will not drop
when fuel cell is isolated from main bus.
Fuel cell and main volts will remain low.
Should be treated like a fuel cell short.

In normal configuration, redundantly

powered loads are load shared (also known
as dioded loads).

Fuel cell internal short. Amps low, fuel

cell and main volts low.
Fuel cell inadvertent disconnect. Amps
low (should be zero), fuel cell volts
greater than 32, main volts near zero. OK
to attempt reconnect.

Hot running fuel cell (real STACK T high)

will grab more than its share of the load.
Indication is high amps.

Ascent/Entry FCS

Flooding (real EXIT T low) will cause fuel

cell to shed load.

FCS Channels

Water output of all fuel cells feeds common

manifold.

Each FCS channel includes:

One GPC

Water expulsion for fuel cell is

preferentially: Tank A (primary), Tank B
(alternate), Dumped overboard (relief).

One FA MDM
Two black boxes (ASA and ATVC)
Sixteen servovalves

FC H20 LINE HTR controls heaters on

each fuel cell primary and alternate path.

One solenoid set for body flap

C-9

APPENDIX C: STUDY NOTES

USA007587
Rev. A
Always maintain at least two good FCS
channels and one good position feedback for
each aerosurface.

Switch actuation can result in momentary

loss of channel.

Port bypass means a servovalves isolation

valve (which is spring-loaded closed) is
commanded open. This allows hydraulic
fluid to flow freely past the servovalve,
making it ineffective.

Results in
bypassed.

OVERRIDE:
Supplies internal power to ASA and
ATVC.
Resets all ports on affected channel
(unless manually bypassed - aerosurface
ports only).
Inhibits port bypass due to high SEC P
on affected channel. (Can still bypass due
to internal power fail or from manual
bypass.)
AUTO:
Supplies internal power to ASA and
ATVC.
Allows ports to bypass due to high
SEC P.
OFF:
Interrupts internal power to ASA and
ATVC.

all

affected

ports

being

For ASAs, results in zero voltage

feedback being sent to GPCs. (Feedback
needs to be deselected, either manually or
by FDIR.)

FCS Channel Switches:

Assumes ASA switches (panels O14, O15,
O16) and ATVC switches (panel O17) are
ON.

ASA/ATVC Internal Power Fail:

No action required for single port bypass

with no other failures.
For two failures on the same actuator, take
remaining good channels to OVERRIDE.
Prevents a good channel from bypassing
(thus leaving only a bad channel) in the event
of a subsequent 1-on-1 force fight.
MCC may call to manually bypass a port (via
SPEC 53) if the port does not bypass on its
own or to prevent the port from resetting if
the affected FCS channel is subsequently
taken to OVERRIDE.
Position Feedbacks
Each aerosurface position feedback is
measured by four transducers (one per FCS
channel). SRB/SSME position feedback does
not use transducers, but rather is built into
the servovalve hardware.
Aerosurface feedbacks go to FDIR and
selection filter to determine aerosurface
position for GPC computations.
FDIR:

Bypasses all ports on channel (due to loss

of internal power fail).

Each aerosurface has its own FDIR.

For ASAs, causes zero voltage feedback to

go to FDIR/selection filter.

FDIR compares feedbacks against I-load

tolerances.
If a feedback exceeds
tolerances, FDIR will declare that
feedback invalid.

Pause 2 seconds between all FCS channel

switch position changes.

FDIR quits after first failure (i.e.,

manual or auto deselection, commfault).

Switches are break-before-make.

APPENDIX C: STUDY NOTES

FDIR will return if all failures removed

(i.e., feedbacks are reselected or if
commfaults are cleared).

C-10

USA007587
Rev. A
Selection Filter (excluding body flap):

Any OFF channel should have feedbacks

deselected. If channel is recovered, reselect
feedback after channel is taken to AUTO.

Selection filter schemes:

3 valid inputs

MVS

2 valid inputs

Average

1 valid input

Pass Thru

0 valid inputs

Last Value

Body Flap Differences

Body flap commanding goes across FCS
channels 1, 2, and 3 only.

Initially uses inputs across FCS channels

1, 2, and 3. Channel 4 is held in reserve.

Body flap feedback goes across all four FCS

channels.

If an input is declared invalid (either by

FDIR or by being manually deselected),
input from channel 4 is used in its place.

The APUs are hard assigned to the body flap

channels. An APU failure also means a lost
body flap channel.

Selection filter will downmode if a

feedback is either deselected or
commfaulted.

Body flap channels use solenoids instead of

servovalves, so there are no ports to bypass.

Selection filter will upmode if a feedback

is reselected or if the commfault is
removed.
BFS RM Differences:
BFS has no FDIR. Crew must manually
deselect bad feedbacks.
BFS selection filter uses an IMVS scheme
(i.e., uses feedbacks on all four channels).
BFS selection filter downmodes/upmodes
due to crew input only.
The ASAs combine position feedbacks and
GPC position commands to create position
error commands, which go toward moving
the servovalves.
A bad feedback can cause the affected
servovalve to force fight the others. If
SEC P exceeds limits, the affected port will
bypass. At the same time, if the feedback
itself exceeds tolerances, it will be declared
invalid by FDIR.

Body flap feedback goes through a QMVS

selection filter.
GPC/MDM Impacts to FCS Channels
GPC/MDM failures commfault port statuses.
Take affected FCS channel to OFF. This
causes all affected ports to bypass and avoids
possible force fights.
GPC/MDM failures commfault position
feedbacks. Deselect affected feedback. This
prevents GPCs from using a potentially bad
feedback if I/O is later restored.
After a restring, and one GPC has control
over two FCS channels, one channel is taken
to OFF, so that the GPCs control authority is
equal to that of the other GPCs.
BCE STRG X D failure will commfault
feedback on affected FCS channel, but
commanding across the affected FCS channel
remains good.

Feedback deselection on SPEC 53 deselects

all feedbacks on channel and terminates
FDIR on all aerosurfaces.

C-11

APPENDIX C: STUDY NOTES

USA007587
Rev. A
BFS selection filter downmodes/upmodes
due to crew input only.

GNC Sensors and Controllers

AAs and RGAs
AAs and RGAs go through an FDIR and
selection filter to determine values used for
GPC computations.

IMU
SPEC 21 shows IMU status.
OFF, BITE, blank in status field.

FDIR:

Mode designated by *: STBY (caged) or

OPER (operate)

FDIR compares AA and RGA values

against I-load tolerances.
If a value
exceeds tolerances, FDIR will declare that
AA or RGA invalid.

GPC send operate command through FF

MDMs.

FDIR quits after first failure (i.e., manual

or auto deselection, commfault).

IMU returns status (operate discrete) over

FF MDM card A.

FDIR will return if all failures removed

(i.e., AA or RGA is reselected or if the
commfault is cleared).

IMU returns digital data over FF MDM

serial I/O card

RGAs have an additional SMRD (spin

motor run detector) FDIR, which protects
against RGA power failures. SMRD quits
after the third deselection.

STBY and power off conditions available

on SPEC 21 after BCE STRG X IMU, but
not after FF MDM lost.
GPC or FF MDM port failure.
IMU will maintain operate command.
Commands and output of MDMs are
latched at last value.

Selection Filter:
Selection filter schemes:
4 valid inputs

IMVS

3 valid inputs

MVS

2 valid inputs

Average

1 valid input

Pass Thru

0 valid inputs

Last Value

IMU will operate without pulse torquing

compensation. Should maintain reasonable align for several hours.
FF power cycle.

Selection filter will downmode if an AA

or RGA is either deselected or
commfaulted.

IMUs can maintain OPER CMD LATCH

for approximately 8 seconds.
FF power fail.

Selection filter will upmode if the AA or

RGA is reselected or if the commfault is
removed.

In STBY, IMU spins down and cages.

BFS RM Differences:
BFS has no FDIR. Crew must manually
deselect failed AAs and RGAs.
BFS selection filter also uses an IMVS
scheme.

APPENDIX C: STUDY NOTES

IMU loses operate command and goes to

STBY (upon recovery of I/O).

C-12

FF 1,2,3 power failure signature (following I/O ERROR FF X) is loss of SSME

Pc tape (ascent). Deselect IMU PASS and
BFS after FF power fail (IMU will come
back caged when I/O regained). PASS
will automatically deselect a commfaulted
IMU in OPS 3.

USA007587
Rev. A
BCE STRG IMU.

IMU with BITE will fail RM if dilemma at

2 level.

Could be result of IMU losing power.

SPEC 21 (orbit and entry only) shows
IMU status OFF, mode STBY. An IMU
BITE/T message annunciated at the same
time is also a confirming cue for the IMU
power fail.
Could be loss of IMU data to the FF MDM
(serial I/O card down). Status and data
blank on SPEC 21. Mode will still show
operate, received over card A.

If IMU miscompare at 2 level and PASS

sees no BITE, IMU dilemma declared.
Manual deselection required to break
dilemma. Use MCC or deselect IMU.
BFS is prime selecting to break tie.
BFS RM and selection.
Only commfaults, power loss, hardware
BITE, and manual deselect will remove an
IMU from candidacy.

Standby mode.

Selection is MVS at 3 level.

If IMU has moded to STBY, it will begin

startup sequencing once the operate
discrete is restored.

Once downmoded to 2 level, BFS will

only upmode to 3 level if taken through
OPS 0 and up to OPS 3.

Transient power fail, causes startup

sequence which cages IMU (approximately 90 seconds).

Selection on downmode to 2 level is

lowest numbered IMU.

When IMU completes startup sequence

(caged), it will mode to operate and be
available to selection filter upon an I/O
reset. Hence, any caged IMU should be
deselected (PASS and BFS), if not already.

At 2 level, BFS can be taken off lowest

numbered IMU with deselect followed by
reselect.
BFS uses first deselected, last reselected
logic after MVS broken.

PASS selection filter.

Any IMU not commfaulted (M) or
deselected is a candidate.
An IMU in STBY is not a candidate.

IMU deselected for H/W BITE will not be

upmoded if other IMUs lost.
IMU dilemma.

Attitude selection is MVS at 3 level.

If MCC comm available, ask MCC which

IMU to deselect (PASS and BFS).

Downmode or upmode to 2 level.

Maintain previously selected if available.
Otherwise lowest numbered IMU.

No comm, deselect lowest numbered IMU

in PASS. BFS will use lowest numbered.
Let NAV run to determine which IMU is
better.

Velocity is MVS at 3 level (component

basis). Averaged at 2 level.

Navaids

PASS RM.
Either attitude or velocity fail removes
IMU from selection filter.
PASS will not RM fail an IMU for a BITE
(H/W or S/W) at 3 level.

For TACAN and ADTA management, talk to

MCC before incorporating. Without communication, use the NO COMM TACAN MGMT
and ADTA MGMT cue card.

C-13

APPENDIX C: STUDY NOTES

USA007587
Rev. A
RHC/THC/SBTC/RPTA

For THC, each direction (+X, -X, +Y,

-Y, +Z, -Z) has its own FDIR. A
failure in one direction has no impact
on the others.

Availability
RHC
L, R RHC: All OPS
A RHC:
OPS 2, 8
THC
L THC:
OPS 1 (post MECO)
OPS 2, 8
OPS 3 (MM 301-303)
A THC:
OPS 2, 8
SBTC
L SBTC:
OPS 3 (MM 304-305)
OPS 6 (MM 602-603)
R SBTC:
OPS 1 (MM 102-103)
OPS 3 (MM304-305)
OPS 6
L,R RPTA:
OPS 3 (MM304-305)

After second failure (excluding commfaults), FDIR will declare a dilemma.

Controller is no-opted.
For THC, dilemma affects only the
one direction. THC still works in
other directions.
For a dilemma, the affected FLT
CNTLR PWR is turned OFF to protect
against the next failure from clearing
the dilemma but resulting in a bad
input being processed.
Selection Filter
Selection filter schemes:

FF MDM Channelization
RHC
L RHC:
R RHC:
A RHC:
THC
L THC:
A THC:
SBTC
L SBTC:
R SBTC:
RPTA
L RPTA:
R RPTA:

FFs 1, 2, 3
FFs 2, 3, 4
FFs 1, 2, 3 (pitch, yaw)
FFs 1, 4, 3 (roll)

MVS (THC: 2/3 vote)

2 valid inputs

Ave (THC: 2/2 vote)

1 valid input

Pass Thru

0 valid inputs

Last Value

Selection filter will downmode if a

channel is manually deselected (via OPS
2,8), declared invalid by FDIR, or
commfaulted.

FFs 1, 2, 3
FFs 1, 2, 3

Selection filter will upmode if a channel is

either reselected (via OPS 2,8), the
channel is no longer invalid, or the
commfault is removed.

FFs 1, 2, 3
FFs 2, 3, 4

BFS RM Differences

FFs 1, 2, 3
FFs 2, 3, 4

Controllers not available during powered

flight with BFS engaged.

FDIR
FDIR compares channel inputs against
I-loaded tolerances. If an input exceeds
tolerances, FDIR will declare that channel
invalid.
For THC, FDIR performs 2/3 voting.
For RHC, a failure in a single axis
(pitch, yaw, roll) is enough for FDIR
to declare the channel invalid.

APPENDIX C: STUDY NOTES

3 valid inputs

C-14

BFS does not process R RPTA, but right

rudder pedals are mechanically linked
to left rudder pedals.
BFS has no FDIR.
BFS Selection Filter is always MVS and
cannot downmode.
No manual deselection, and BFS does
not recognize commfaults.

USA007587
Rev. A
Glided: All axes simo, or Pitch only, or
Roll/Yaw only

Taking manual throttles (PLT only):

Mash and hold the takeover button.

Appropriate CSS lights (P or R/Y) for

both CDR and PLT illuminates.

SPD BK/THROT light extinguishes for

both CDR and PLT.

On Ascent/Entry Flight Display, CSS

shows by the appropriate field (Pitch
or R/Y). Field is surrounded by a
yellow box if M>1 and not BFS
engaged.

Match the current throttle setting to

within 4%.
MAN
SPD
BK/THROT
illuminates for PLT only.

light

Hot Stick Downmode

Throt field on Ascent/Entry Flight

Display
shows
Man
and
is
surrounded by a yellow box.

Not available during powered flight.

Occurs when RHC is deflected by more
than 6.

Release the takeover button.

Triggers DAP DNMODE RHC fault

message.

Taking manual speedbrake:

Depress the takeover button. (No need to
match current setting.)

Aft Sense Switch (Panel A6)

Affects aft RHC and aft THC only.

SPD BK/THROT light:

Specifies whether RHC/THC commands

are oriented to either the -X or -Z orbiter
body axis.

MAN light illuminates for SBTC in

control.
Light extinguished for SBTC not in
control.
SB field on Ascent/Entry Flight
Display shows Man and is surrounded
by a yellow box.

Visual control reference based on line of

site.

Instrumentation
General
OI MDM loss results in parameters showing
Ms.

Manual attitude control:

Powered: All axes simo
Both P and R/Y CSS lights illuminates
for CDR and PLT.
DAP field on Ascent Entry Flight
Display
shows
CSS
and
is
surrounded by a yellow box.
Orbit: All axes simo
INRTL light illuminates on ORB DAP
panel.
DAP field on Ascent/Entry Flight
Display shows Inrtl, and is
surrounded by a yellow box (if not BFS
engaged).

OI Dedicated Signal Conditioner (DSC) loss

shows data on respective parameters as L.
Loss of OI MDM does not affect data to
meters, but some digital data may be lost.
DSC loss will affect most meters.
OI DSC loss section of REF DATA is accurate
only for DSC parameters, not MDMs.
Data
Runs through signal conditioners and/or
MDMs

C-15

OI MDM data is sent to the PCMMU

where the BFS and/or SM GPC can
retrieve it.

APPENDIX C: STUDY NOTES

USA007587
Rev. A
PCMMU swap reads alternate ports on OI
MDMs.

GNC GPCs receive OI data from sensors

and OI
MDMs.

DSCs

through

flight-critical
ET Doors
Close manually for uphill or AOA,
automatically for RTLS (MM602) or TAL
(MM304).

Mechanical Systems
General
ET doors and latches, vent doors, star tracker
doors, air data probes, payload bay doors
and latches, RMS latching gear, and payload
retention latches are powered by dual AC
motors linked through a differential.
One motor fail results in double actuation
time. Actuation times are listed in the
FDF.
Most actuators have dual microswitch
pairs for open and close indications.
Failed mid-motor controllers or popped
circuit breakers on MA73C are a frequent
cause of payload bay door, ET door, or vent
door single motor ops.
Payload Bay Doors
PL BAY DOOR SYS ENABLE switches only
enable payload bay doors. Other systems in
payload bay use PAYLOAD BAY MECH
POWER switches to allow operation.
PBD
CONFIG
message
means
a
microswitch is indicating differently than
required by software for auto operations.
Can occur any time during auto open/close
sequence.
May require manual door
operation.

When operating the doors in Manual mode,

stay in Manual (do not go back to Auto)
unless MCC or the procedures direct
otherwise.

PBD SEQ FAIL message caused by failure

of proper microswitch indications within
single motor actuation time. Can occur
during auto sequence.

A Dilemma (?) results from the software

seeing conflicting microswitch indications.
Can occur during Auto or Manual sequence.

Always double check doors closed before

AOA OPS 3 transition, or TAL flag set before
late TAL OPS3 transition: software command
on SPEC 51 is only available in MM104, 105,
and 106.

MPS
General
The amount of propellant (PRPLT) in the ET
is displayed, in percent, on the PASS
ASCENT TRAJ 2 display. This value is
calculated by PASS, not measured from the
ET.
The SSMEs at 104% throttles will consume
about 4% propellant per engine per minute
(i.e., 1% every 5 seconds with three engines
running).
Actual throttle setting in bucket will vary
with SRB performance.
Cold SRBs = shallow bucket
Hot SRBs = two-stage bucket
Take manual throttles whenever CSS is
taken.
Manual throttles means manual
MECO
(3 pb simo at BFS cutoff cue).
At fine count, engines are throttled back to
protect for a low level cut: 67% (for three
engines), 91% (for two or one engine).
Engine Failure
Indications of a failed engine:
Master alarm
Loss of acceleration

APPENDIX C: STUDY NOTES

C-16

USA007587
Rev. A
Data Path Failure

Fault messages:
SSME FAIL C(L,R)

Data path failure created when GPCs lose

both primary and secondary SSME data
coming from the main engine controller.

MPS H2 OUT P C(L,R) -- BFS only

MPS O2 OUT T C(L,R) -- BFS only
Helium dP/dt = 0

Must determine whether engine is still

running.

Pc meter = 0
Red status light (no red light if data path
failure exists)

If SSME has failed:

Use the pushbutton to mode guidance
and flight control, and to safe the SSME.

Ensure that the GPCs recognize failed engine

(i.e., check for SSME FAIL C(L,R) fault
message). If no message, use pushbutton to
mode guidance and flight control, and to safe
the SSME.

Work SSME FAIL/SHUTDN procedure.

If SSME is still running:

Work SSME FAIL/SHUTDN procedure:

Check with MCC about reenabling SSME

limits. (Limits on the other two engines
were automatically inhibited.)

AC Bus Sensors - OFF. (Prevents the AC

bus sensors from erroneously taking an
AC bus offline, which would impact the
engine controllers of the remaining
engines.)

Assume that the data path failure is also a

command path failure, unless MCC
explicitly says otherwise.

Check with MCC about reenabling SSME

limits. (Limits on the remaining engines
were automatically inhibited.)

Pc meter will be set to zero for engine with a

data path failure. Also, red status light will
not illuminate after engine shutdown.

If second SSME fail, the MPS 2% steps

apply, unless MCC says otherwise:

Hydraulic/Electric Lockup

At 2% prop remaining, manual throttle to

67%, then manual MECO at BFS cutoff
cue.

Hydraulic lockup caused when main engine

controller sees that one of the five hydraulic
valves in the SSME is not in the commanded
position.

Command Path Failure

Command path failure created when the
main engine controller does not receive two
out of three valid inputs from the GPCs.
GPC and electrical failures can impact SSME
commanding.
Use MPS 2 cue card to
evaluate.
Command path failure may not annunciate
until as late as 3-g throttling (when next
command from GPCs is issued).
Command path failures always require
manual shutdown pre-MECO via AC/pb.

Electric lockup caused when main engine

controller loses either Pc or fuel flow rate
data from the engine.
Loss of an APU will eventually cause a
hydraulic lockup. This may also cause a
MPS CMD C(L,R) fault message postMECO, during MPS dump.
When having to choose between shutting
down a hydraulic lockup and an electric
lockup, preference is given to the hydraulic
lockup (the sicker engine).
With two hydraulic systems failures, two
engines are in hydraulic lockup. In addition,
one of those two is also non-gimbaling.

C-17

APPENDIX C: STUDY NOTES

USA007587
Rev. A
Helium Leaks
Non-isolatable leak requires interconnect at
TK P < 1150 psi to extend run time.
Use pneumatic helium tank (i.e., leaking
ENG He ICNCT - IN OP).

Manual shutdown
pushbuttons.

typically

done

via

If pushbutton does not work, shutdown via

AC/pb. (Creates a data path failure on that
engine.)

Use helium from any failed SSME (i.e.,

failed ENG He ICNCT - OUT OP).

Shutdown with AC switches no-ops the MPS

LO2 dump for affected SSME. Manual LO2
inerting may be required.

MCC may call for interconnect at a TK P

other than 1150 psi.

SSME Pushbuttons

Return all helium interconnect switches to

GPC post ET SEP to support automatic
MPS dumping and inerting.

Pushing the SSME pushbutton generates two

commands in the GPCs:
SHUTDN command - Initiates SSME
shutdown

Crew assumes that non-isolatable leak will

not support zero-g shutdown at MECO.

SAFING command - In the presence of a

Data Path Failure, will set in motion three
things:

Manual shutdown via pushbutton

required pre-MECO.
(Requires less
helium than a zero-g shutdown.)
MCC may say shutdown not required,
depending on leak size.
APC4(5,6) or ALC1(2,3) Failures:
For ALC failure, BFS GNC SYS SUMM 1
shows the following:
ULL P LH2
12.0
LO2
0.0

Modes Guidance

2.

Modes Flight Control

3.

Closes the prevalves

Each pushbutton has two contacts.

Each contact powered by a CNTL bus.
Status of each contact carried to the GPCs
via an FF MDM.

For APC failure, along with the same

ULL P indications for an ALC failure,
there is also an SM2 APU SPD LO 1(2,3)
fault message.
C(L,R) He ISOL A has failed closed. Do
not attempt leak isolation steps.

1.

CNTL bus/FF MDM assignments are

printed on panel C3 below each
pushbutton.
Pushbutton Conditions:

Treat helium leaks on affected engine as

non-isolatable.

Fully Operational - There are no failures:

Pushbutton will generate both SHUTDN
command and SAFING command.

Pneumatic accumulator leak requires steps to

repress accumulator at 30 seconds before
MECO.

Commfaulted - One (not both) of the contacts

has an associated FF MDM that is
commfaulted:

Manual Shutdown

Pushbutton will only generate SAFING

command.

Manual shutdown cues of VI=23K (3-ENG),

24.5K (2-ENG), and 22.5K (TAL) correspond
roughly to 30 seconds before MECO.

APPENDIX C: STUDY NOTES

C-18

Pushbutton will NOT generate SHUTDN

command. Manual shutdown must be
done via AC/pb.

USA007587
Rev. A
For BFS, a commfaulted pushbutton will
NOT generate either command. (BFS
does not recognize commfaults.)

Status Lights / Pc Meters

Status Lights:

Broken - Either contact has an associated

CNTL bus that is failed, or either contact is
failed OP (i.e., some type of contamination):

Amber = Stuck throttle (command path

failure, hydraulic lockup, electric lockup)
or data path failure

Pushbutton will NOT generate either a

SHUTDN command nor a SAFING
command.

Red = Engine has shut down, or is

violating redlines (if limits are inhibited)

Pushbutton in dilemma when one contact

reads OP and the other contact reads CL;
ME SHDN SW C(L, R) fault message
generated.
Broken pushbutton can be used to generate
SAFING command, given the following:

MDMs assigned to status lights and Pc

meters:
Center:
Left:
Right:

FF1
FF2
FF3

Impacts from MDM failure:

Affected contact is either fixed (CNTL bus

is recovered or contamination clears).

MDM port failure:

indication.

Affected contact is commfaulted by

power cycling the associated FF MDM.
(Does not apply to BFS, because BFS does
not recognize commfaults.)

MDM power failure: Pc meter reads zero;

status light goes off (or stays off).

Latches current

Entry
MPS Helium Regulator Failure

MECO CONFIRMED Flag

Failure indications:

The MECO CONFIRMED flag can be set by

any of the following:

SM Alert
MPS He P C(L,R) message or MPS
PNEU REG message

3 Pcs < 30%

2 Pcs < 30% and a data path failure

MPS C&W light on F7 matrix (for Reg A

failure only)

3 SAFING commands (i.e., pressing all

three SSME pushbuttons)

Use BFS GNC SYS SUMM 1 or

OMS/MPS MEDS display to identify
failed reg, and close appropriate helium
isol valve.

OPS 104 PRO (OPS 602 PRO will not set

MECO CONFIRMED)
Fast ET sep
Crew sees that MECO CONFIRMED is set
when they see Orbit DAP lights turn on.
(Orbit DAP lights not driven on RTLS.)

A helium regulator failed open before

M=2.4 (i.e., before the vent doors are
commanded open) could be catastrophic,
due
to
an
overpressurized
aft
compartment.
During RTLS, due to additional helium
usage, MPS C&W light and fault messages
might occur also for low He TK Ps and for
low He REG Ps.

C-19

APPENDIX C: STUDY NOTES

USA007587
Rev. A

OMS

GN2 accumulator designed to preserve

enough nitrogen for at least one OMS
burn.

General

If the GN2 tank has failed but the GN2

accumulator
is
still
adequately
pressurized, the affected OMS engine is
reserved for the deorbit burn.

Nominally used for orbital transfers:

OMS 2 burn
Rendezvous burns

With an GN2 accumulator leak, the ball

valves cannot open once all the nitrogen
has leaked out, resulting in an OMS ENG
FAIL.

Deorbit burn
Supplemental uses:
OMS assist (flight specific)
Propellant source for aft RCS jets (via
interconnect)

Engine (OME)
Each engine provides about 6000 lb of
thrust.

Off-nominal uses:

OX flows straight into injector plate;

FU first flows through cooling jacket
before flowing into injector plate.

OMS 1 burn (in the event of severe ascent

performance problems)

Hypergolic reaction between OX and FU

in combustion chamber produces thrust.

Ascent abort dumps

OMS Subsystems

Gimbal Actuator

Helium Tank

Two actuators per engine (pitch and

yaw).

Provides pressurization to maintain

propellant flow to the OMS engines.

Two motors per actuator (PRI and SEC),

powered through the APC subbuses.

For helium tank leaks, procedures set up

an OMS burn to max blowdown in the
propellant tanks (Qty ~ 39%)

FF MDMs carry the ENA commands.

FA MDMs carry the position commands
and position feedbacks.

Propellant Tanks

Gimbals move to TRIM LOAD positions

at TIG-15 sec (but only if the delta is
greater than 0.4).

Stores the propellants:

OX = nitrogen tetroxide
FU = monomethyl hydrazine
At one time, engineers considered
providing for an OMS Kit (a
supplemental set of propellant tanks), but
this effort was later abandoned.
For propellant tank leaks, procedures set
up an OMS burn to depletion, rather than
let propellant accumulate in aft
compartment.

During OMS burns, TVC DAP gimbals

engines to keep the thrust vector pointed
through the c.g. (i.e., nulls IMU-sensed
rates).
Operationally, crew selects between PRI
and SEC gimbals twice (to ensure ZAP
command).
OMS/RCS interfaces
OMS and RCS use the same OX and FU.

Nitrogen Tank
Nitrogen used to open ball valves for the
burn. Post burn, nitrogen used to purge
fuel lines.

APPENDIX C: STUDY NOTES

C-20

OMS propellant can be used in one of

three ways:
Straight feed [i.e., L(R)OMS propellant
through L(R)OMS engine]

USA007587
Rev. A
Crossfeed
[i.e., L OMS propellant
through R OMS engine, or vice
versa]
Interconnect [i.e., L(R) OMS propellant
through Aft RCS jets]
Cannot interconnect RCS propellant to
OMS engine. (Could damage the RCS
tanks.)

% to V conversions:
1% of OMS ~ 5-6 ft/sec
1% of RCS ~ 1 ft/sec
Accelerations:

Cannot interconnect OMS to Fwd RCS.

At one time, engineers considered
providing for a Fwd RCS interconnect,
but this effort was later abandoned.

2 OMS:

~ 2 ft/sec2

1 OMS:

~ 1 ft/sec2

ARCS:

~ 0.6 ft/sec2

Flow rates:
20 lbs/sec/OME
10 lbs/sec/4+X ARCS

Heaters
Collection of pod heaters, panel heaters,
and line heaters, designed to prevent the
propellants from freezing.
Two circuits: A (typically used during
first half of mission) and B (typically
used during second half).

% to lb conversions:
1% of OMS ~ 130 lb of propellant
1% of RCS ~ 22 lb of propellant
VGO fraction of VTOT:

Caution: Simultaneously running both

A and B OMS pods heaters will
result in burnout of the heaters.

VGO X

OMS Quantity Gauging

2 OMS

1 OMS

ARCS

FRCS

+1

+1

+1

-1

VGO Y

1/5

VGO Z

+1/4

+1/4

+1/6

+1/3

ENG FAIL / PRPLT FAIL

OMS quantity determined via an electrical

probe that runs along the central axis of the
propellant tank.

L(R) OMS PC = OX Blockage

(aff OX IN P)

Gauging only updates when at least one

OMS engine is burning. Otherwise, quantity
readings are static.

L(R) OMS TEMP = FU Blockage

(aff FU IN P)
For OMS ENG FAIL:

Totalizer integrator:

OX(FU) IN P is now higher than steadystate inlet pressures.

Functions during first 15 sec of OMS burn

while propellant settles, after which
quantities are taken from probe.
Functions for an accumulated 108 sec
when propellant level is between 45% and
30% (the ungaugeable region), after
which quantities are taken from the aft
probe.

Engine lost, but propellant still available

through crossfeed or interconnect.
For OMS PRPLT FAIL:
OX(FU) IN P is now lower than steadystate inlet pressures.
Both engine and propellant lost (i.e.,
neither crossfeed nor interconnect are
available).

Assumes single engine flow rates.

Rules of Thumb
2 ft/sec ~ 1 n. mi.

C-21

APPENDIX C: STUDY NOTES

USA007587
Rev. A
OMS RM

Performing 2-ENG OMS Burns

Three events must happen before guidance

will downmode:

When burn starts:

Time the burn (in the event a manual
shutdown is required).
OMS Assist and ATO dumps should
also be timed. Backs up OMS quantity
gauging.
(Needed for OMS 1/2
Targeting.)
Check OMS Pc > 80%.
Check ball valves > 70%.
Note decreasing VTOT.
Monitor engine inlet pressures.
steady-state values.

Note

For first OMS FAIL (ENG or PRPLT):

If ENG FAIL, crossfeed at VTOT
remaining.

L(R) OMS Pc FAIL (Pc < 80%)

Loss of acceleration
L(R) OMS ENG - OFF
OMS on MNVR EXEC display triggered by
OMS Pc FAIL and loss of acceleration. (For
BFS, OMS triggered by OMS Pc FAIL only.)
If OMS Pc failed high prior to burn, OMS RM
will set the affected OMS Pc FAIL flag at
TIG - 15 sec. (Guidance can still downmode.)
Auto Downmode

Perform hot crossfeed (momentarily

tie tanks) to maintain good propellant
flow to remaining OMS engine.
If PRPLT FAIL during OMS 2 or orbit
burns, stop the burn (provided HP > MIN
HP).
If PRPLT FAIL during the deorbit burn,
will attempt a crossfeed only after good
propellant has run out. (Possibility of
blockage being downstream of crossfeed
T.)
For second OMS FAIL (ENG or PRPLT):
Interconnect good OMS propellant to
RCS.
Perform
hot
intereconnect
to
maintain good propellant flow to RCS
jets.
Determine RCS burn time using OMS%
vs. RCS V chart.
OMS quantity gauging not active
without an OMS engine burning.
Double burn time if only 2 +X jets (due
to RCS failures, FA1/FA2 failures, etc.).
If no good OMS propellant remains,
complete burn using RCS propellant (but
preserve enough for use during
deorbit/entry).

APPENDIX C: STUDY NOTES

C-22

Occurs when a certain CNTL bus fails

(specifically at Pnl C3), and subsequently
there is an OMS FAIL (ENG or PRPLT).
For L OMS:
For R OMS:

CNTL AB1 or AB2

CNTL CA1 or CA2

OMS RM into thinks L(R) OMS ENG

switch is in the OFF position.
Failure of CNTL AB1 or AB2 (CA1 or
CA2) puts the L(R) OMS ENG switch
in dilemma.
The OMS ENG default position when
in dilemma is OFF.
Crew assumes OMS is a PRPLT FAIL.
Failure signature looks like ENG
FAIL (ENG VLV 1 & 2 < 70%).
Guidance immediately downmodes
once it sees OMS Pc FAIL and loss of
acceleration.
(OMS ENG - OFF
already set in software, regardless of
actual switch position.)
Ball valves closed before crew can
diagnose ENG FAIL vs. PRPLT FAIL.
No GN2 purge post burn on affected
engine.
Software thinks OMS ENG switch is
in OFF, as opposed to ARM/PRESS.

USA007587
Rev. A
No Guidance Downmode

RCS

Two scenarios will prevent Guidance

from downmoding, even after the failed
OMS engine switch is taken to OFF.

General
Nominal uses:
Rotational and translational control of the
orbiter.

OMS Pc failed high during burn -- GPCs

will never see Pc < 80%, thus never
setting the OMS Pc FAIL flag. (Crew
can see OMS Pc off-scale high
indications on MEDS meter.)
MDM FA3(4) failures - Commfaults
L(R) OMS Pc, so GPCs will never see
OMS Pc < 80%, thus never setting
the OMS Pc FAIL flag. (Crew can
still see OMS Pc on MEDS meter.)

Small orbital transfers (V < 6 fps).

Aft RCS burns:
OPS 1/3: 4 +X jets
OPS 2:
2 +X jets
Fwd RCS burns: 2 -X jets
Forward window
SRB SEP.

protection

during

Off-nominal uses:

After first OMS FAIL:

Abort dumps
Single engine roll control (SERC)

TVC DAP will gimbal remaining engine

to keep thrust vector through c.g.

OMS burn completion

RCS wraparound

ADI error needles will be incorrect,

since they will still be based on a
two-engine attitude.
Guidance commands cut off too soon.
(Still thinks it has two OMS engines.)
Results in about a 6 ft/sec underburn.
After second OMS FAIL:

RCS deorbit burn

RCS Subsystems
Two identical, independent systems for OX
and FU. (OX and FU sides are overlaid on
FDF schematic.)
Helium Tanks

Stuck in TVC DAP (i.e., no downmode

to RCS). Causes sluggish control (i.e.,
sloppy DAP) because TVC DAP has
broader rate deadbands than RCS DAP.

One helium tank for OX; one helium tank

for FU.

TVC DAP will downmode to RCS DAP

when either:
TGO = 0,

Helium tank leaks.

Major mode change, or

Crew maneuvers vehicle 90 out
of attitude.

C-23

Helium provides pressurization to

maintain propellant flow to the RCS jets.
Ascent: Crossfeed from non-leaking
side to protect for ET SEP.
Orbit: Set up an RCS burn to max
blowdown in the propellant tanks
(~ 23%).
Entry: When helium has all leaked out,
crossfeed from non-leaking side to
maintain entry attitude control.

APPENDIX C: STUDY NOTES

USA007587
Rev. A
OMS/RCS interfaces

Propellant Tanks

RCS and OMS use the same OX and FU.

Store the propellants:

RCS jets can be used in one of three

configurations:

OX = nitrogen tetroxide
FU = monomethyl hydrazine

Straight feed [i.e., L(R) RCS propellant

feeding L(R) RCS jets]

Fwd RCS tanks designed to operate in

zero g only.

Crossfeed [i.e., L(R) RCS propellant

feeding all aft RCS jets]

Propellant tank leaks:

Interconnect
[i.e., OMS propellant
feeding all aft RCS jets]

Ascent: Crossfeed from non-leaking

side to protect for ET SEP.

Cannot interconnect RCS propellant to

OMS engine. (Could damage the RCS
tanks.)

Orbit: Set up an RCS burn to depletion

(rather than let propellant accumulate
in aft compartment).

Fwd RCS cannot crossfeed with Aft RCS,

nor can it interconnect to OMS.

Entry: When propellant has all leaked

out, crossfeed from non-leaking side
to maintain entry attitude control.

At one time, engineers considered

providing for a Fwd RCS interconnect,
but this effort was later abandoned.

Jets

Heaters

Two kind of jets: Primary and Vernier

Collection of pod heaters, panel heaters

and line heaters, designed to prevent the
propellants from freezing.

Primary jets:
Total of 38 jets:
14 Fwd; 12 aft left; 12 aft right

Two circuits:
A (typically used
during first half of mission) and B
(typically used during second half).

Used for coarse attitude control and

orbital translations.
Each jet produces 870 lb thrust.

Caution: Simultaneously running both

A and B OMS pods heaters will
result in burnout of the heaters.

Vernier jets:
Total of 6 jets:
2 Fwd; 2 aft left; 2 aft right

Collection of jet heaters (for each

manifold) to keep jet injectors at
operating temperatures.

Used for fine attitude control during

OPS 2/8 only.
Each jet produces 24 lb thrust.

RCS Quantity Gauging

Jet Nomenclature:

Quantity is calculated based on pressure,

volume,
and
temperature
(PVT)
relationships.

X Y Z
X = Pod: F (fwd) L (left), R (right)
Y = Manifold: 1, 2, 3, 4, 5
Z = Plume Direction: U (up), D (dwn),
L (left), R (right), F (fwd), A (aft)

A helium leak causes erroneous quantity

calculations.

Primary jets are on manifolds 1 through 4;

vernier jets are on manifold 5.

PVT calculations assume that helium

moves only from the helium tank into the
propellant tank.

All jets are non-gimbaling.

APPENDIX C: STUDY NOTES

C-24

USA007587
Rev. A
Long RCS burns can temporarily corrupt
quantity calculations.

Resetting RM (via PASS SPEC 23):

ITEM 45 (JET RESET) resets RM (i.e.,
clears FAIL OFF, ON, or LK) for all jets
that are not deselected.

Long RCS burns cause rapid temperature

drops in the helium tank, which impact the
PVT calculations.

DES INH once:

Places affected jet in last priority.

A difference of 9.5% between OX and FU

quantities will trigger F(L,R) RCS LEAK
fault message. Message will reannunciate
every 9.5% increment.

Prevents FAIL OFF or FAIL LK from

auto deselecting affect jet.
Does not reselect jet.

PASS Jet RM

DES INH twice (i.e., toggle RM) resets

RM and leaves affected jet in last priority.

Jet Failures
FAIL OFF - Jet commanded to fire, but no
rise in chamber pressure.

Impacts from BCE STRG X

BCE STRG X B impacts Fwd RCS;
BCE STRG X D affects Aft RCS.

FAIL ON - Jet fires, but with no fire

command issued.

Manifold status changes to CLM. (Jets

are not available.)

FAIL LK - Jet injector temperatures fall

below operating levels (possibly caused
by leaking propellant that is freezing on
the injectors).

GPCs can no longer annunciate FAIL

OFF, FAIL ON, or FAIL LK.
If jets needed for attitude control, crew
can override manifold status to OPM to
regain affected jets.

Jet Fail Limit

Initialized at two per pod.
modified via PASS SPEC 23.

Can be

BCE STRG X only takes away

feedback to the GPCs. Jets can still be
commanded to fire.

Applies only to PRI jets.

Applies only to jets that FAIL OFF or
FAIL LK.
Situations when a jet is no longer available:

BFS Jet RM Differences

No SPEC 23.

Manually deselected (PASS SPEC 23).

Auto deselected, due to either FAIL OFF
or FAIL LK (if still below jet fail limit).
FAIL ON is not auto deselected.

BFS annunciates FAIL OFF and FAIL ON

only when engaged.
BFS does not
annuniciate FAIL LK.
BFS does not show manifold status unless
engaged.

Manifold status is CL, resulting from:

1.

Taking MANF ISOL to CL.

2.

Overriding MANF STAT to CL on

PASS SPEC 23.

3.

Commfaulted manifold status.

4.

RCS manifold dilemma.

5.

JET FAIL ON, with AUTO MANF CL

enabled (OPS 2,8 only).

BFS will annunciate and auto deselect only

the first FAIL OFF, and only if it is not
previously FAIL ON.

C-25

BFS will simply annunciate subsequent

FAIL OFF jets.

APPENDIX C: STUDY NOTES

USA007587
Rev. A
Limits the number of jets that fire
simultaneously.

Reconfiguring RCS
Rules of Thumb
1.

Do not starve a jet.

2.

Do not feed a leak.

3.

Do not tie tanks.

The flow rate from a large number of jet

firings could damage the propellant
tank.
Throwing the MSTR XFEED switch will
limit simultaneous jet firings, even if
crossfeed was configured manually.

When securing RCS, work from bottom up.

1. Close manifolds.

Interconnected Abort Dumps

2. Close crossfeed valves (if applicable).

Assumes the GPC position for the AFT L,R RCS TK

ISOL and XFEED, as well as the L,R OMS XFEED.

3. Close tank isolations.

4. Close helium isolation.

For interconnected abort dumps, Smart

Interconnect will automatically reconfigure
OMS and RCS valves when dump is
initiated.

When reopening RCS, work from top down.

1. Open helium isolation.
2. Open tank isolations.

Interconnected dumps normally burn

2 OMS engines with all 24 aft RCS jets
(i.e., 2+24 dump).

3. Open crossfeed valves (if applicable).

4. Open manifolds.
Auto Crossfeed

If OMS or RCS valves do not configure

properly (due to DPS or EPS failures,
etc.), the dump will burn either:
2 OMS engines with 10 aft RCS jets
(i.e., 2+10 dump), or
2 OMS engines only, depending on
which valves are misconfigured.

Assumes AFT L,R RCS TK ISOL and XFEED are

in GPC position
Auto crossfeed sequence
Active in PASS OPS 1, 3, and 6.
If OX(FU) TK P < 220 psi, crossfeed from
other pod automatically established.
Triggers L(R) RCS XFEED fault
message.

Smart Interconnect will automatically

reconfigure OMS and RCS valves back to
straight feed when dump is complete.

Protects against He REG FAIL LOW.

MCC may call the crew to manually

reconfigure OMS and RCS post-dump.

Master crossfeed sequence

Available in PASS OPS 1, 3, and 6.
Reduces crossfeed from L(R) RCS to a
single switch throw.
Used especially for leaks during dynamic
flight.

APPENDIX C: STUDY NOTES

Certain DPS and EPS failures can result in

the OMS and RCS being left with tied
tanks post-dump.

C-26

USA007587
Rev. A
operating time are available before noncatastrophic bearing seizure occurs. The APU
should be able to support from Mach 1 to the
ground. Expect overtemp alarms, and MCC
should call for immediate shutdown after
wheels stopped.

APPENDIX D RULES OF THUMB

CONTENTS
APU/HYD ............................................
Ascent ....................................................
CCTV System........................................
Communications System ....................
C/W System .........................................
DPS ......................................................
ECLSS.....................................................
Entry ......................................................
EPS ......................................................
EVA ......................................................
GNC ......................................................
Landing/Deceleration System ...........
Lighting System....................................
Mechanical Systems.............................
MPS ......................................................
OMS ......................................................
Orbit ......................................................
PDRS ......................................................
RCS ......................................................
TAEM and A/L ....................................
Performance Rules of Thumb.............

D-1
D-1
D-1
D-2
D-2
D-2
D-3
D-3
D-4
D-4
D-4
D-5
D-5
D-5
D-5
D-6
D-7
D-9
D-10
D-11
D-12

Ascent
Monitor roll program on the ADI and BFS
ASCENT TRAJ display.
Before L/O +90 seconds, BFS engage is the
crews only option for loss of guidance and/or
control. After 90 seconds, the crew can try CSS.
Monitor the trajectory on the ASCENT ADI
cue card and the PASS and BFS ASCENT
TRAJ displays.
The Shuttle bug and
predictors should follow the nominal
trajectory line. Also monitor the HSI for the
inertial velocity to be in the desired orbit
insertion plane.
Monitor guidance convergence by observing
PASS and BFS TMECOs converging to
expected time.
If the crew takes CSS, they should take manual
throttles. If the crew takes manual throttles,
manual shutdown is required unless a low
level shutdown occurs due to low
performance. The cue for MECO is the BFS
MECO cutoff bug or planned MECO VI minus
150 fps.

This appendix is a compilation of the rules of

thumb from the body of this manual. Topics
are organized alphabetically keyed on
commonly used acronyms and abbreviations.

APU/HYD

Use OMS 1 TGTING cue card for system

problems and OMS 1/2 TGTING cue card for
performance problems to determine proper
OMS 1 and 2 targets.

APU fuel usage rates vary with loading, but

average 1% per minute (3 to 3.5 lb/minute).
Usage rates are reduced by about two thirds if
the hydraulic main pump is taken to low
pressure (HYD MAIN PUMP PRESS switch
on panel R2 set to LOW), as is done during
the abort once around deorbit coast period.

CCTV System
When the VCU is powered on, the crew must
wait 10 seconds before any CCTV commands
can be accepted. This time is used to
initialize the VCU.

The APU injector cooling tank shared by all

three APUs contains enough water for 21
minutes of continuous flow. This is enough
for six complete 3.5-minute injector cooling
cycles.

Always wait at least 10 seconds after

powering off a camera before powering it
back on. This gives the iris enough time to
fully close.

If all water spray boiler cooling is lost to the

lube oil after an APU reaches full operating
temperatures, only 4 to 5 minutes of

D-1

APPENDIX D: RULES OF THUMB

USA007587
Rev. A
Always wait at least 10 seconds after
switching from the RMS wrist camera to the
RMS elbow camera before switching back to
wrist, and vice versa. This gives the iris
enough time to fully close.

Also check the proper major function and

GPC switch configuration. Post OPS transitions and restrings, check good configuration
with SPEC 6.
Make sure you have the correct memory
configuration called up before you start
making NBAT changes.

Never leave a payload bay camera in a

manual mode (either semi- or full) while in
direct sunlight or any bright light. Damage
to the camera will result.

During OPS transitions, keep hands off

everything, including all switches and item
entries.

If neither you nor Mission Control is using a

camera for extended periods, power it off to
conserve energy and to keep it cool.

Always clear the Fault Message line as soon

as you have seen the message; otherwise, you
may miss subsequent annunciations from
other failures.

Communications System
When the TDRS has an elevation of greater
than +70 degrees or less than 60 degrees
relative to the orbiter (as shown on OPS 201),
there is a risk of degraded communications
as the orbiter nose or tail blocks line of sight
between the orbiter antenna and the TDRS.

Post BFS engage, check to ensure that all

active PASS GPCs have recognized the
engage (both MODE and OUTPUT talkbacks
are barberpole). If not, take the offending
GPC to HALT (or if this does not work,
power it OFF) immediately to avoid I/O
problems on the flight critical strings.

SM OPS 201 Antenna display shows an S-band

PM signal strength of 2.50 for the true received
signal strength of 0 indicated on the F9 and
A1U meters.

It is a very good idea to resume SPECs and

DISPs from IDPs when not using them or
before going to another major function on
that IDP.

C/W System
The SENSOR RESET switch on panel L1
should be pressed when smoke concentration
goes below 1.8. This prevents masking of
alarms.

When moding PASS GPCs into the common

set (i.e., STBY-RUN), always pause 10
seconds before making further switch throws
or item entries to avoid a possible fail-to-sync
and to ensure proper common set
initialization.

When panel R13U is not in use, the

PARAMETER SELECT thumbwheels should
be set to a value greater than 119.

It is important to be able to identify GPC

failures, for Mission Control often has little
insight. The information you provide will
affect Mission Control analysis and its ability
to plan for subsequent failures (both DPS and
non DPS).

Crewmembers should reset fault messages as

quickly as possible after review to avoid
covering other messages.
The fault summary should be reviewed
regularly to avoid missed fault messages.

Always hard assign IDPs (both PASS and

BFS) via PASS IDPs (BFS will DK listen).
You can cause dual commanders if you try to
assign BFS to an IDP that a PASS GPC is still
driving via a BFS IDP keyboard.

DPS
Always deassign IDPs from fail to sync GPCs
and reassign to good GPCs to avoid
inadvertent entries (NBATs/restrings, burn
targets, etc.).

Always distribute your IDPs among different

GPCs. On orbit, always be sure SM is not on
all IDPs at the same time; if you lose SM, you

Before OPS transitions and restrings, always

verify the appropriate NBAT is what you
want it to be; never assume that it is correct!

APPENDIX D: RULES OF THUMB

D-2

USA007587
Rev. A
also lose PASS DPS display interface. The
same applies for single GPC GNC OPS
configuration.

NH3 boiler supply is good for 35 minutes of

ground cooling for the first tank and 25 minutes
for the second tank.

When using the GPC MODE switch, always

take your hand off between positions. On
past missions, there have been problems with
the switch being in two positions at the same
time. This problem can occur on other
orbiter switches too. It is a good idea to
always pause slightly in each switch detent
to ensure the contacts are made and
recognized by the GPCs.

A single cryo O2 tank is good for about 2 to 3

days of orbit usage depending on crew size
and power level. H2 tanks are sized to match
O2 usage.
A single LiOH canister is usable for about 48
man-hours.
Choose the NH3 controller such that it is
controlling to the slow Freon loop but not a
dead loop.

The IDP/CRT SEL switch should always be

checked before making a keyboard entry,
and data should always be checked on the
DPS display scratch line before it is entered.

Entry
2 OMS: TGO VTOT/2.

When moving GPC mode switches from

RUN to STBY or STBY to RUN, refrain from
moving any other GPC monitored switches
or making keyboard entries for 10 seconds.

1 OMS: TGO VTOT.

RCS: TGO 1.7 VTOT.
Prior to the first bank, monitor vehicle
attitude at 0 degrees bank and 40 degrees
alpha.

ECLSS
NOTE

First bank (flight path angle capture) should

occur at a drag acceleration of approximately
3 fps2 and/or q-bar of approximately 8 psf.

Numbers presented here are for typical

orbit power and heat loads and may vary
significantly depending on attitude and
power loading.

Monitor the trajectory on the ENTRY

ALPHA cue card, and the PASS and BFS
TRAJ displays:

Supply water tanks fill at about 6.7 percent

per hour (if filling into a single tank),
depending on fuel cell load (.77 lb/kW hr
1.6 lb over 1%; 14 kW typical orbit power
load).

The Shuttle bug superimposed on guidance

box superimposed on nominal trajectory line.
Actual drag equal to reference drag.

Water tanks empty at about 100 percent per

hour for a water dump, about 50 percent per
hour when using the FES high load
evaporator for cooling with payload bay
doors closed, and about 16 percent per hour
when using the FES topping evaporator
for supply water dumps on orbit with the
doors open.

Appropriate bank angle, H-dot, range

and altitude.
For an off-nominal trajectory, check that
guidance is working to put the guidance box
back on the Shuttle bug (zero range error)
within the trajectory envelope.
Attempt to contact MCC before taking CSS.

On-orbit cold soak is good for 20 to 30

minutes of cooling.
Prelaunch Freon
conditioning is good for about 5 minutes of
cooling.

D-3

APPENDIX D: RULES OF THUMB

USA007587
Rev. A
A fuel cell hydrogen pump uses 0.3
amps/AC phase; a coolant pump uses 0.5
amps/AC phase.

If you must take CSS:

Control range by controlling drag.
Control drag by controlling H-dot.

EVA

Hdot Desired =
(Dcurrent - Dref) x 20 + Hdot Ref

Always use make before break tether

protocol.
Do not use the glove as a hammer.

Control H-dot by controlling H-double

dot.

EVA crewmember must remain tethered at

all times.

Control H-double dot by controlling

bank angle.

Slow and deliberate motion provides much

greater stability than quick, jerky motions.

Control everything slowly by small

corrections.

Body positioning is 90 percent of the task.

EPS

Each EVA crewmember should check out his

or her own EMU.

Never close a circuit breaker or reset an

RPC found out of configuration without
MCC coordination.

GNC
The PASS FDIR for the RGAs, AAs, and
aerosurfaces terminates after the first failure.
After the first failure, crew management of
the selection filter is required. For the BFS
selection filter, crew management is always
required. Proper selection filter management
is required for proper control.

Loss of cooling to a fuel cell requires crew

action within 9 minutes to prevent a
catastrophic loss of crew/vehicle due to
possible fuel cell fire and explosion.
Any interruption of continuous AC power
during ascent will result in the loss of main
engine controller redundancy.
Reconfiguration of AC powered equipment prior to
MECO should be avoided.

For FCS channel management:

Never have more active channels on
one GPC than another.

Never connect or reconnect power to a known

shorted or failed component; this includes
switch throws, circuit protection device
resets, or bus ties.

If there are two failures on the same

actuator, take the remaining FCS channels to OVERRIDE.
Always maintain two good commands
and one good feedback on each
aerosurface.

Fuel cell run limit prior to shutdown for loss

of cooling is 9 minutes at a 7 kW nominal
load. Run time varies inversely with fuel
cell load.

Delay 2 seconds between switch throws

when moving FCS CHANNEL switches.

Three oxygen and hydrogen tanks are good

for up to 8 days on orbit; five oxygen and
hydrogen tanks are good for up to 12 days
on orbit.
Duration varies with crew
complement and power load. SSPTS will
extend on-orbit duration by lowering fuel cell
loads.

APPENDIX D: RULES OF THUMB

Port bypass, or port pop, is a mechanical

means to avoid force fights; feedback
deselection is a software means to avoid
a bad input into the selection filter.
For ascent, only the pilots SBTC is active. To
get manual throttles, the pilot must depress
the TAKEOVER button and then match the

D-4

USA007587
Rev. A
For three engines at 104 percent, fuel consumption is about 1 percent propellant/
5 seconds. For three engines at 65 percent,
fuel consumption is about 1 percent/8
seconds.

commanded throttle setting. Manual rotational control is available only in PASS and
must be both pitch and roll/yaw.
For entry, both SBTCs are active. To get
manual speed brake, the CDR or pilot must
depress the TAKEOVER button.
Manual
rotational control is available in either pitch or
bank in PASS, and required in both axes in
BFS.

An SSME will consume approximately

4 percent propellant per engine per minute at
104 percent. Propellant remaining is displayed on the PASS ASCENT TRAJ 2 display
and is a guidance-calculated number.

For TACAN and ADTA management, talk to

MCC before incorporating.

Selecting max throttles greatly increases the

risk of a catastrophic failure occurring. As
such, max throttles are only used in cases of
severely degraded ascent performance.

Without communication, the crew will use

the NO-COMM TACAN MGMT and ADTA
MGMT cue card.

Five ways to set MECO confirmed are:

Landing/Deceleration System

3 Pcs < 30%

Landing gear should not be deployed at

equivalent airspeeds greater than 297 knots.

2 Pcs < 30% and a data path failure

3 SAFING commands (i.e., pressing all
three SSME pushbuttons)

1 knot of touchdown speed corresponds to

100 feet of distance.

OPS 104 PRO (OPS 602 PRO will not

set MECO CONFIRMED)
Fast ET sep

Lighting System

MAIN ENGINE SHUT DOWN Pushbuttons:

Power consumption of cockpit lighting can

be as much as 1 to 2 kW with all lights on.

With two good contacts, the pushbutton

will generate both the SHUTDN
command and the SAFING command.

When payload bay floodlights are turned off,

they should remain unpowered for 10 to 16
minutes prior to repowering.

With one commfaulted contact, the

pushbutton will only generate the
SAFING command.

When payload bay floodlights are turned on, they

should remain powered for 10 minutes prior to

unpowering.

With a broken contact (due to CNTL

bus or a contact failed OP), the
pushbutton is in dilemma and will not
generate the SHUTDN command nor
the SAFING command.

Mechanical Systems
Always use a timer when operating mechanical systems, noting either dual or single
motor time. Do not continue driving if
greater than the single motor time has
elapsed without the mechanism reaching the
desired state. If motion stops prematurely,
take the mechanism switch(es) to Stop.

A broken contact can be masked by a

commfault (via FF MDM power cycle)
so that the pushbutton can once again
generate the SAFING command.
A SAFING command, in the presence of
a Data Path Failure will set into motion
three things: 1) mode guidance, 2)
mode flight control, and 3) close the
prevalves.

MPS
Direct insertion MECO is usually close to
8 minutes 30 seconds.

D-5

APPENDIX D: RULES OF THUMB

USA007587
Rev. A
Actual throttle levels on the first stage
throttle bucket can vary due to SRB thrust
level dispersions. This is an artifact of first
stage adaptive guidance.

Because BFS does not recognize

commfaults, a commfaulted contact is
the same as a broken contact.
Do NOT use the MAIN ENGINE SHUT
DOWN pushbutton for these cases:

Loss of an APU means the affected engine is

in hydraulic lockup. Can also trigger MPS
CMD C(L,R) messages post-MECO during
MPS dump.

Data Path Failure + Commfaulted

button
Data Path Failure + Command Path
Failure

Manual shutdown cues of VI=23K (3-ENG),

24.5K (2-ENG), and 22.5K (TAL) correspond
roughly to 30 seconds before MECO.

SHUTDN command either not generated

(commfault) or is ignored by the controller
(command path failure).
SAFING command is generated. Coupled
with a Data Path Failure, this closes the
prevalves on a running engine, resulting in
catastrophic shutdown.

APC4(5,6) or ALC1(2,3) Failures:

For ALC failure, BFS GNC SYS SUMM 1
shows the following:
ULL P LH2
12.0
LO2
0.0

On panel R2, the MPS ENGINE POWER

switches (or AC switches) look very
similar to the He ISOLATION switches. Also,
both sets of switches are located close
together. Use caution.

For APC failure, along with the same

ULL P indications for an ALC failure,
there is also an SM2 APU SPD LO 1(2,3)
fault message.

A Command Path Failure must always be

shut down manually pre-MECO via AC/pb.

C(L,R) He ISOL A has failed closed. Do

not attempt leak isolation steps.

Throwing the AC switches to OFF creates a

Data Path Failure.

Treat helium leaks on affected engine as

non-isolatable.

OMS

An SSME FAIL C(L,R) message indicates

that the GNC software has recognized an
engine shut down.

1 percent of OMS propellant

= 6 fps V

An engine with a Data Path Failure will

never display a red MAIN ENGINE STATUS
light, even after shutdown.

= 3 n.m. Hp
= 130 lbs (80 lbs oxidizer, 50 lbs fuel)
uses 40 psi of helium for long burns.

Limits must be enabled on an engine when

the helium regulator pressure begins to
decay due to a helium leak. An SSME will
almost certainly fail catastrophically if there
is insufficient helium, and limit shutdown is
inhibited.

One OMS engine causes approximately 1 fps2

acceleration.
For OMS ignition, there must be power and
command to at least one coil on both control
valves.

With three SSMEs running, an hydraulic

lockup or electric lockup will be shut down
pre-MECO to protect NPSP in the event of a
low-level cutoff.

APPENDIX D: RULES OF THUMB

OMS TVC requires an enable discrete from the

FF MDM, and commands from the FA MDM.
FUEL INJECTOR TEMP message may be a
signature of a bad temperature transducer or
a fuel blockage.

D-6

USA007587
Rev. A
CHAMBER PRESSURE message may be a
signature of a bad pressure transducer or an
oxidizer blockage.

Out-of-Plane Null (OOPN): Usually

between MC1 and MC2, places target
and orbiter co-planar (Y = 0)

There are several failures that inop OMS FDI

(FA3(4) MDM commfault or Pc transducer
failed high).

Ti Delay: Places orbiter in a footballshaped holding pattern, posigrade (Ti

DVX +3 fps)

Always check redundant sources to confirm

any malfunction.

SOURCE OF ERRORS: Trajectory

Attitude maneuvers
coupling

An OMS engine failure post-MECO should be

signified by a down arrow on the MNVR
display.
Max
blowdown
on
approximately 39 percent.

the

OMS

and

jet

cross

Burn trims
Orbiter vents (APU, FES, etc.)

is

Drag uncertainties

1,000 lb of OMS (approximately 8 percent)

moves the X c.g. 1.5 inches aft and the Y c.g.
0.5 inches left or right.

STAR TRACKER PASS:

Deselect an IMU during ST pass to
reach 2-level (RM will prime select an
IMU for attitude)

Max OMS quantity for landing = 21 percent.

Monitor RESIDS < 0.05 (BREAK

TRACK if locked onto star or debris)

Orbit
In propellant-limited situations, use the
following guidelines:

Assumes on PROP vector, FDF

provides criteria to select FLTR vector

Stay in VERN as much as possible.

SOURCE OF ERRORS: Star Tracker Pass

To conserve forward RCS, use TAIL

ONLY control mode.

Prime selected IMU attitude problem

Either IMU accelerometer problems

During prox ops, when controlling outof-plane errors, start as early as

possible, wait for the node to make
inputs to null rates, watch the deadbands, and do not fight orbital
mechanics effects.

Star tracker bias

Maneuvers and length of time since last
state vector update
Marking on a star instead of the target

TRAJECTORY:

RADAR PASS:

NC: Sets up 1-rev transfer to Ti

Use radar if range <135 k (range

eclipsing at greater ranges)

NCC: 1st onboard targeted burn targets

the Ti point

Radar data verifies data from ST pass

Ti: Burn (usually posigrade) that sends

the orbiter into proximity with the
target, uses RADAR data

Procedure handles either FLTR or

PROP vector selected

MC1-4: Midcourse correction burns

D-7

APPENDIX D: RULES OF THUMB

USA007587
Rev. A
V >4 fps - +X RCS burn (maneuver to
attitude, then DAP:INTL)

Procedure provides criteria to select

FLTR vector or to do FLTR to PROP
vector transfer

V >6 fps - OMS burn (maneuver to

attitude, DAP:AUTO)

INH angles data and mode radar to

ATRK during maneuvers to burn
attitude

Posigrade burns: Thrust Vector Roll

(TVR) = 0

SOURCE OF ERRORS: RADAR Pass

Retrograde burns: TVR = 180

Range eclipsing
EL/AZ greater than 30 deg

For RCS burns, DAP TRANS: NORM

until VGO <1 fps then PULSE

Ku biases (range).

If VGO Z is positive: burn X, Y, Z

TARGETING:

If VGO Z is negative: burn Z, X, Y

Onboard targeting done on SPEC 34

PTG/DAP MANAGEMENT:

Load BASE TIME (Ti TIG) to TGT SET

#1

-Z target track until reaching the R-bar,

then +ZLV

Load and verify TGT SETs with ITEM

1+

A7/VERN Used for attitude hold (1

deg attitude deadband, 0.016 deg/sec
rotation rate)

Compute burn solutions with ITEM 28

B7/PRI Used for maneuvers (2 deg

attitude deadband, 0.5 deg/sec rotation
rate)

MC2 TIG based on elevation angle

constraint (rather than a particular
time), so MC2 TIG can change

TRANS pulse size = 0.1 fps during

RNDZ, .05 fps during prox ops

-3 and +7 minute TIG slip limits

MC2 TIG becomes the new BASE
TIME

SYSTEMS CONCERNS (single point):

GNC GPC FAIL:

NAV MANAGEMENT:

2 GNC GPCs are required for Ti and

PROX OPS

Always have a FLTR vector

Upon RNDZ NAV enable, PROP vector
is created and TGT vector begins propagating

RNDZ NAV is disabled when go

through OPS 0 (such as during
redundant set expansion or contraction). Only the FLTR vector is
saved when RNDZ NAV is disabled.
Restrings do not affect RNDZ NAV

Perform FLTR to PROP vector transfer

after new sensor acquisition
If commfault or suspect bad data, then
troubleshoot and ask questions
BURNS:
V <4 fps - Multi-axis RCS burn
(DAP:LVLH)

APPENDIX D: RULES OF THUMB

D-8

USA007587
Rev. A
CNCL pointing option (TGT ID = 1) before
RNDZ NAV disabled

In propellant-limited situations, use the

following guidelines:

MDM FF3:

Stay in VERN as much as possible

To conserve forward RCS, use TAIL
ONLY control mode

Loss of VERN jets

Loss of RADAR data to NAV (display
on Panel A2 is unaffected

During prox ops, when controlling

out-of-plane errors, start as early as
possible, wait for the node to make
inputs to null rates, watch the
deadbands, and do not fight orbital
mechanics effects

Loss of -Y star tracker

MDM FA1 or FA2:
Loss of VERN jets

PDRS

MDM FF1:

Whenever there are both talkbacks and DPS

displays that reflect microswitch status, they
should ALWAYS both be checked during
any operation affecting them.

Loss of -Z star tracker

PL 1:
Loss of automatic Ku pointing (Ku
modes: GPC and GDSG lost)

Whenever
troubleshooting
RMS
malfunctions in the long-form MAL book,
always READ AHEAD.
The MALs
sometimes may require an operator response
after the execution of the block, which is
listed in the next block, depending on the
path that is taken.

IMU 2 - Restring 1221 for IMU

redundancy
MISCELLANEOUS:
1 fps posigrade or retrograde =:

The hand controllers are rate-proportional

and are extremely sensitive. They should be
held in such a way that you can control the
full range of inputs without ever stopping to
rearrange your hand. Care must be taken to
not overcontrol the inputs. A good practice
is to slowly and steadily input a desired
command, wait patiently until you see the
reactions of that command on the arm, and
as the desired motion is achieved, slowly
back off the input. Ideally, you should reach
the axis detent at the same time the arm
achieves the desired position and attitude.

16 kft downtrack/rev
3.5 kft radial/0.5 rev
0.5 nm altitude change (HA or HP)
1 fps radial =:
3.5 kft downtrack/0.5 rev
900 ft radial/0.25 and 0.75 rev
(decoupled from the other axis)
1 fps Out of Plane = 900 ft/0.5 rev
(decoupled from the other axis)

MPM motion may cease during deployment

or stowage before the expected microswitches are made. This is due to the fact
that the last part of travel in either direction
is when the overcenter lock is locking.
Therefore, dont turn off the PORT RMS
switch when visible motion stops. Wait for
the microswitches.

LVLH rate = 0.06 deg/sec; 4 deg/min;

360 deg/90 min
Expending about 35-40 lb of RCS
propellant to maintain attitude results
in a cross-coupling of 1 fps in Z
direction

Practice safety habits, the most important of

which are brakes on, then power off (if

D-9

APPENDIX D: RULES OF THUMB

USA007587
Rev. A
required) for abnormal joint response and
use EE CC for abnormal EE ops during the
specified conditions.
During arm cradling, periodically check all
joint angles to make sure that joints that you
have already aligned to zero have not
moved.

RCS
1% RCS prop = 1 fps V.
1% RCS prop = 22 lb.
1,000 lbs of ARCS prop moves X c.g. 1.2 in, X
c.g. 0.4 in.
1,000 lbs of FRCS prop moves X c.g. 3.5 in.

CCTV cameras have a tendency to malfunction at the most inconvenient times. Expect
this and know how to perform all operations
without cameras.

FRCS max blowdown qty 22%.

Develop a scan pattern that encompasses

window, CCTV, and panel status.

Loss of a single downfiring vernier jet is loss

of vernier mode.

Always remember what the DAP should be

for the operations you are performing. In
addition, keep in mind the down mode
option for the DAP in case the arm enters an
unexpected singularity or reach limit.

If fuel tank pressure is 20 psi higher than the

oxidizer tank pressure, then verniers are
NO-GO.

Never rotate the MODE switch through

DIRECT while the brakes are on. This actually
puts the arm in mode, and sets you up for a
possible runaway if a SINGLE/ DIRECT DRIVE
switch failure occurs or is present.

ARCS max blowdown qty 24%.

Always secure the RCS from the manifolds to

the helium tanks.
Always open the RCS from the helium tanks
to the manifolds.

Verify the RATE switch setting by feel and

talkback status. This should be done EVERY
TIME prior to moving the arm, regardless of
mode.
Make sure you know the proper definitions
of
cradling,
stowing,
berthing,
mating, and installing.
Rates for berthing/unberthing:
Usually
maintain rates at about 0.01 to 0.02 ft/sec
between Z = 414 and -438. For Z < -438 (away
from the bay), rates can be increased
somewhat.
For berthing or unberthing of payloads with
keel trunnions: the keel pin enters/exits the
AKA when the longeron trunnions are at the
top of the built-in 8-inch PRLA guides.

APPENDIX D: RULES OF THUMB

D-10

USA007587
Rev. A

TAEM and A/L

A 100-ft-difference in gear deploy altitude
equals about 250 ft of touchdown energy.
Gear deploy should not be delayed past 200
feet altitude.
90 ft of touchdown distance corresponds to 1
knot of airspeed.
TAEM guidance uses pitch to control range,
bank angle to control ground track, and
speed brake to control q-bar.
Overhead HAC with NEP allows the most
downmode options for energy.
Fly theta limits at Mach < 2 (NLT Mach 1.5) if
air data is not incorporated to G&C. Maximum bank angle is 50 degrees.
OGS is 20 degrees lightweight (< 222,000 lb)
and 18 degrees heavyweight (> 222,000 lb).
Aimpoint is 7,500 ft nominal and 6,500 closein. Touchdown speed is 205 knots heavyweight and 195 knots lightweight.

With NWS in 1 or 2, the orbiter tends to turn

into a crosswind. With NWS OFF, the orbiter
will tend to turn away from a crosswind.
If the orbiter is landing with a known failed
tire, special landing techniques are used to
try to save the second tire on that axle.
If both main gear tires fail on one side, the
orbiter will tend to turn toward that side.
The turning moment due to crosswind can
either reinforce or reduce this effect, as will
the drag chute due to weathervane effects.
The orbiter will turn into the crosswind and
the drag chute will also cause the orbiter to
turn into the wind.
If the flat tire is on the upwind side, rudder
pedal input opposite the blown tire will be
required. If the flat tire is on the downwind
side, the effects are balanced and minimal
rudder input is required.
Flight Rules call for landing with an existing
crosswind on the same side as a known or
expected bad tire.

Chute deploy at 195 knots.

Start derotation with beep trim at 185 KEAS at
approx. 2 deg/sec. At nose gear touchdown,
manually back up WOW/WONG.
During training, pilots should strive for a
threshold crossing height of 25 to 30 feet on
nominal approaches. Touchdown goals are
airspeed within 5 knots of the target value,
sink rate within structural limits, negligible
lateral drift, and minimal RHC activity. A
good target value for sink rate is 3 fps or less,
insuring ample margin before violating limits.

D-11

APPENDIX D: RULES OF THUMB

USA007587
Rev. A

Performance Rules of Thumb

ASCENT
Ascent Performance Margin
Management Reserve Req. (lbs)
Pre Flight Design Requirements
Document = 3500
Flight Design Requirements
Document = 2500
Cargo Integration Review = 1500
Flight Planning Stowage
Review = 1500
FPR = 4652
ORBIT
1 hr launch delay = change in
orbital noon by 4 minutes
Ascending node
28.5 deg - 1st ascending node
is @ Long = 173.38 East
57 deg = 121.55 West
MISCELLANEOUS
Orbiters
OV103 - Discovery
OV104 - Atlantis
OV105 - Endeavor

DESCENT
Xcg Limits
FWD = 1076.7 in (RTLS = 1079.0 in)
AFT = 1109.0 in
CONT AFT = 1119.0 in
D/O Delta V's
Descending approach is worst case V
90 deg prebank will decrease V ~ 10 ft/s
(function of altitude)
If Xcg > 1091.5: 1 in Xcg = 2.2 miles
If Xcg < 1091.5: 1 in Xcg = 1.1 miles
As Xcg increases (more aft), XR decreases
1 nm XR = 5780 lbs EI weight
1 nm XR = 4.38 nm D/O altitude
As altitude and weight increase, XR increases
As inclination increases, XR increases (non-linear)
As temp increases, XR increases (non-linear)
Touchdown speeds
195 kts if TD weight < 222 k lbs
205 kts if TD weight > 222 k lbs

10 kts slower if short field speedbrake

guidance mode is used if 200 k lb < TD weight
245 k lbs

Min planned flt duration = 96 hours

Max/Min Beta Angle
Max = 23.5 + orbital inclination
Min = 23.5 - orbital inclination
Time
CDT = GMT - 5 hr
CST = GMT - 6 hr
Daylight savings time from
1st Sunday in April to
last Sunday in October

Derotation 185 KGS with beep trim (Prime)

or with RHC (manual ) derotation (Backup)

PROPELLANT
1 deg of plane change = 440 ft/s
OMS philosophy
1 ft/s = 21.8 lbs OMS @ 220 k lbs ~ 1/6%
1.78 ft/s = 1 nm
Maximum OMS load
OV103/4 = 25064 lbs
Min = 10800 lbs
Max OMS ballast = 4000 lbs
1% OMS = 130 lbs/side
Hard Ballast
OV103/104 - Bay 13
RCS philosophy
1 ft/s = 25 lbs (+ X) or 35 - 40 lbs
(multi axis) @ 220 k lbs
Max burn = 250 sec = 55 fps
Full FRCS = 2446 lbs
ET blowdown offload = 2225 lbs
Min FRCS - 1862 lbs
Full ARCS = 4970 lbs (over 100%)
1% ARCS = 22 lbs/side
IINTERCONNECT logic
If OMS < 14,000 lbs, I/C off
If OMS > 17,000 lbs, I/C on
If 14 k < OMS < 17 k, analysis req.
ECS - N2

Mass Moment
MM = TD Weight * (1172.3 - Xcg)/12
for medium lakebed runways
If MM > 1.47 M ft-lbs Concrete desire
If MM > 1.54 M ft-lbs Concrete required
Note: If TD Xcg not known, use
Xcg @ M = 3.5 + 1.5 in
Landing Weight Limits
EOM 233 k lbs
RTLS 242 - 248 k lbs *
TAL 241 - 248 k lbs *
AOA 233 - 240 k lbs *
(Abort limits a function of Inclination)
Noctilucent Clouds
If Inc > 50, do not enter on descending opportunity
June through August.

OV103/4
5.28 lbs/day for 4 person crew @ 14.7 psi
add .114 lbs/day for additional crewmember
3.66 lbs/day for 4 person crew @ 10.2 psi
add .079 lbs/day for additional crewmember

N2

Dry wt
83 lbm

Fully loaded wt
143 lbm
EPS

.09 lbm Hydrogen = 1 kwh

.7 lbm Oxygen = 1 kwh
.07 lbm Oxygen/hour = cabin leak rate

H2
O2

Dry wt
227 lbm
215 lbm

Fully loaded wt
319 lbm
996 lbm

RENDEZVOUS
1 deg of phasing/hour = 10 nm of height
1 deg of phasing = 60 nm
17.5 ft/s burn changes other side of orbit 10 nm
440 ft/s burn will change plane by 1 deg of wedge
1 deg of RAAN occurs for each relative lap

* Orbiter Engineering Memo VE3-90-096.

usa007587_945r1.cvx

APPENDIX D: RULES OF THUMB

D-12

USA007587
Rev. A, CPN-1

APPENDIX E OI UPDATES
CONTENTS
OI33SUMMARY .................................
ChangeRequests ...................................

No longer a need to perform OMS gimbal

selection twice on the Mnvr Exec Display as a
result of a gimbal failure or GPC/MDM loss
CR 93084: SPEC 60 Checkpoint Capability
Enhancement (PASS)

E1
E1

Adds SM Mass Memory assignment and checkpoint

retrieval item entries to SPEC 60 SM TABLE
MAINT Display.

OI-33 SUMMARY
OI-33 FSW, like the OI-32 FSW, adds numerous
capabilities as well as corrections to existing
capabilities. Most of the OI-33 CRs changed details
of flight software code but did not change how the
vehicle systems are monitored or operated by the
crew. Summarized below are the most operationally
significant/apparent functional changes of this OI.
The significant operational changes affect PASS
enhancements, OMS gimbal selection, ADI rate
pointer travel, GRTLS Alpha recovery, three-engineout SERC, ET SEP improvement, and adds SPEC 54
Bearing displays.

CR 93098A - Reverse Direction of ADI Rate

Pointer Travel (PASS and BFS)
ADI rate pointer direction of travel is reversed for all
flight phases, except when functioning as HAC
predictors during TAEM.

CR 93160: Year End Roll Over (YERO) Reset

(PASS)

Change Requests
CR 93073: PASS Non-Universal Enhancement
(PASS)

Allows in-flight reset to January 1 without an IPL

and complicated procedures while maintaining a
good state vector.

Changes I/O ERROR and BCE STRG messages to

Class 2 Caution and Warning (Master Alarm) from
Class 3 (SM Alert) when not detected by the entire
GPC redundant set.

CR 93174A - Improved GRTLS TAEM Alpha

Trap (PASS & BFS)
The alpha transition logic controlling the GRTLS
Alpha Recovery to Nz Hold flight phase is separated
into two I-loads, forming a transition hysteresis for
moding to Nz Hold.

CR 93074A - MM102 Three Out SERC (PASS)

Automatically enables Single Engine Roll Control
(SERC) when three SSMEs are recognized as failed
in first stage.

Rate pointers now move in the direction of

vehicle rotation, which means they are no longer
fly-to to null rates, instead they are fly-to to
establish rates.

Eliminates the need to manually initiate SERC

in 3 OUT First block on the Contingency
Abort Cue Card
Simplifies the Contingency Abort Cue Card by
combining the 3 OUT FIRST and 3 OUT
SECOND blocks into one procedural block,
now titled 3 OUT COLOR

The logic is armed when alpha increases above

45 and fired when it subsequently decreases
below 35.

The existing Nz trigger for the Nz Hold phase is

not changed with this CR.

This prevents premature moding to

reducing the likelihood of a CSS or
contingency that is induced early into
to difficulty controlling alpha when
Recovery post ET separation.

CR 93075D- Correct OMS ZAP Command

Timing (PASS and BFS)
Modifies the relationship between issuance of the Zap
command and OMS TVC gimbal selection.

E-1

Nz Hold by
3-engine-out
Nz Hold due
flying Alpha

USA007587
Rev. A, CPN-1
CR 93087E - RTLS ET Separation Improvements
(PASS and BFS)
Intact RTLS mated coast and ET separation
guidance and flight control are changed to increase
the success rate of RTLS ET separation. With a GPC
failure taking a manifold of jets in each pod, the
success rate improves to something greater than 84
percent with one sigma environment and systems
dispersions present.

Alpha target for RTLS MECO is 0 (vs. -2

previously).

After 11.3 sec of mated coast, DAP commands a

-0.8 deg/sec pitch rate that will result in an
alpha of approximately -2.8 for ET separation.

Speedbrake is commanded to 80 percent

immediately after MECO in MM601 (not
visible on the SPI until MM602, but can be
monitored on GNC SYS SUMM 1).

ET SEP INH message due to an out-of-limit

alpha is eliminated because the delay is changed
from 6 seconds to 2.2 seconds.

This display works in conjunction with the

ASCENT and ENTRY TRAJ displays to provide
trajectory situational awareness in both the
vertical and horizontal planes.

Improves real-time onboard assessment of

ascent, abort, and entry performance.

SPEC 54 has different formats for ascent and for

entry.

ASCENT BEARING
Available in OPS 1 and MM601 (SPEC 54
display will resume to TRAJ on transition
from OPS 1 to OPS 3 or 6).
Plots against two contiguous longitude vs.
geodetic latitude maps, including an inset
window extending the map further
downrange (latitude of larger map and
smaller inset map is contiguous). RTLS,
ELS, and TAL abort landing sites are
depicted on all the maps.

Remaining changes are internal to the DAP

(updated flight control laws to improve pitch
and roll control authority).

The desired target insertion plane is

depicted by a yellow line. If a TAL abort is
declared, a yellow crossrange-circle is also
shown centered on the selected TAL site on
the appropriate map.

Intact and POWERED CSS RTLS procedures

are updated to reflect the new MECO alpha
target
and
subsequent
mated
coast
maneuvering.

Dashed lines, representing the launch

azimuth groundtrack at the open and close
of the launch window, are also displayed,
extending out from KSC.

The MPS CMD/HYD/ELEC Cue Card was

updated to target engine shutdown when
applicable on an RTLS, at an alpha of +2
( = +2) (vs. -1 previously).

Current position of a yaw-oriented shuttle

is depicted with attached velocity vector
along with 30- and 60-second predictors.
Also displays an overbright + depicting
an instantaneous impact point (IIP) should
all three main engines fail at the current
time. Based on ballistic entry biased with
rudimentary approximation of entry
lift/drag effects for ECAL aborts.

CR 93090E - Bearing Displays - SPEC 54 (PASS)

Adds SPEC 54 to PASS GNC during ascent and
entry, a new phase tailored BEARING display
that provides a geographical representation of the
current and targeted trajectory in the horizontal
plane relative to multiple landing sites.
Additionally, a new item entry is added on the
ENTRY TRAJ display to allow range monitoring of
trajectory progress to two alternate sites, in addition
to the currently selected site.

ITEM 41 entry in the upper-left corner is

equivalent to the currently selected site on
SPEC 50; either SPEC 50 or 54 can be used
to alter the ITEM 41 selected site.
ITEMs 1 and 2 are alternate sites. They are
I-loaded to reflect two sites most closely
associated with the current selected site

E-2

USA007587
Rev. A, CPN-1
(ITEM 41), but can be altered manually by
the crew as desired.
Delta Az to the selected and alternate sites
is digitally displayed alongside the
identifier.
The following four figures depict typical
SPEC 54 ASCENT BEARING displays for
abort profiles.

TALAborttoMRNMap1

AscentATOTrajectoryMap1

TALAborttoMRNMap2

Ascent ATO Trajectory Map 2

E-3

USA007587
Rev. A, CPN-1

displayed to the selected and alternate sites

in the same manner that it is displayed on
the VERT SIT.

ENTRY BEARING
Available in OPS 3 and MM602, 603 (if
SPEC 54 ASCENT BEARING is selected
in MM601, it will automatically transition
to ENTRY BEARING upon transition to
MM602).

During OPS 3, the E/W scales are not

displayed at all. Energy assessment in that
case is available in MM304 only, using the
ENTRY TRAJ to depict range to the
alternate sites via ITEM 4.

ITEM 41 as well as alternate sites for

ITEMs 1 and 2 carry over from the
ASCENT BEARING.

During MM304, roll-reversal lines are also

shown on either side of the orbiter.

A bank-oriented shuttle is parked central to

the display.

The next three figures show typical ENTRY

BEARING displays for ECAL and TAL trajectories.
Thefourthfigureshowsanexampleofalowenergy
TAL MM304 ENTRY TRAJ with ITEM 4 enabled
foralternatesites.

An overbright + is also displayed off the

nose of the orbiter representing the IIP,
similar to the Ascent display. It is based on
ballistic entry biased with rudimentary
approximation of entry lift/drag effects for
ECAL aborts.
The selected and alternate sites are plotted
polar to the shuttles position using the
guidance-calculated range and current delta
azimuth. A yellow line connects the shuttle
to the selected site. Site-centric range rings
give an approximate indication of range to
the selected site.
NOTE
If the Delta Az is sufficiently large, that site
would not show in the field of view.
WARNING

ECAL Entry to Cherry Point (NKT) with high

Az - MM602 pre Nz Hold

The guidancecalculated range to a site with

largeDeltaAz(>~20)isinaccuratewhilethe
shuttle is wingslevel, which may make it look
like some sites are farther away than straight
geographic range would imply. This could
result in a range difference between that
displayedonSPEC54andthatdisplayedtothe
selected site on the Ascent/Entry Primary
FlightDisplay(AEPFD).

Delta Az is also shown digitally beneath site

identifiers for all three sites.
During MM602 (post Nz Hold) and
MM603, the energy-over-weight (E/W) is

E-4

USA007587
Rev. A, CPN-1

ECALEntrytoCherryPoint(NKT)withHigh
AzMM602PostNzHold

TALEntrytoMoron(MRN)MM304

ENTRYTRAJonLowEnergyTALwith
AlternateSites

E-5

USA007587
Rev. A, CPN-1

This page intentionally left blank

E-6

DRD NUMBER:

1.6.1.3-b

DOCUMENT NUMBER:

USA007587
REV. A, CPN-1

TITLE: Shuttle Crew Operations Manual (SCOM)

DS42

NASA-JSC
#AA
AD
#AF
#AP1
#AP3
*BV

*CA
#CA
CA
CA
*#CB
*CB
CC42
*#DA
DA712
*#DA72
DA723
*DA83
*#DM
DM33
DO
DO
DO3
#DO4
*DO45
DO5
DS
*#DS
DS2
DS4
DS6
DS22
DS23
*DS23
DS24

DS25

M. Coats (1)
E. M. Hawley
D. Leestma (1)
J. A. Hartsfield (1)
Branch Chief
J. A Hartsfield (1)
JSC-Spice ([email protected]
(1)
B. Jett (1)
J. Kavandi (1)
B. Kelly
K. Abotteen
All astronauts (90,50)
B. M. Hajek (1)
S. Nagel
P. Hill (1) (1)
J. Wall
J. Barckholtz (OPR)
(3) (1)
T. Hagin
MOD Library (2)
G. Oliver (1) (1)
TOPO Group Lead
W. L. Howorth
P. Beauregard
J. Heansly
Branch Chief
T. Baum
Branch Chief
S. A. Curtis (5)
Group Lead
L. P. DeLapp (2)
Branch Chief
R. A. Galpin
J. Azbell
S. Schaeffer (1) (1)
Branch Chief
J. P. Jason
Branch Chief
P. W. Felker
Branch Chief
J. L. Musler
DPS Group Lead
J. L. McDonald
Comm Group Lead
M. P. Patel
INCO Library
DPS Training Group
Lead
W. Barnett
COMM/NSS Training
Group Lead
N. Pierce

DS43
DS44
DS45

*DS45
DS62
DS63

DS65

DS66

* DS66
*DX
DX
DX2
DX3
DX4
HQ
#MG/SSP
*#MV6
*NC2
*#SD2
#SD24
*WR1

MMACS Group Lead

J. J. Dake
EGIL Group Lead
M. E. Friant, Jr.
EECOM Group Lead
D. E. Fasbender
Lead Shuttle Systems
Training
J. Orcutt
Tech Library
GN&C Group Lead
D. J. Gruber
Propulsion Systems
Group Lead
J. T. Campa
Booster Systems
Group Lead
E. J. Turcotte
Guidance and
Control/Prop Training
Group Lead
M. Sequeira
Book Manager
M. Hess (1)
S. Rainwater
Branch Chief
F. S. Markle
Branch Chief
A. R. Prince
Branch Chief
J. H. Cavallaro
M. Curie
MI&P (1)
MER Library (1) (1)
SSP Ops (1)
Training Manager (1)
(1)
BME Group (3)
Air Force Tech Lib (1)

USA-HOUSTON
*H10H-150
#USH100A
#USH-100A
#USH100A
*USH-121G

V. Atkins (1)
CEO (1)
COO (1)
Technology
Chief (1)
SPOC Tech
Library (1)

BNA-HOUSTON
#HS4-40

Program Chief
(4)

NASA-KSC

#SA-G2

(1)

* = HARD COPY
# = CD
ALL ELSE ELECTRONIC
Submit NASA distribution changes to JSC Shuttle Acquisition Data Management/BV, including initiator's name and phone
number, or e-mail [email protected] or call 281-244-8506. Submit USA distribution changes to USA Data
Management/USH-121E, or e-mail [email protected]. Most documents are available electronically via USA
Intranet Web (https://usa24.usa-spaceops.com/wdk/component/sels)

USA007587
Rev. A

CCTV Cameras ................................................ 2.3-2

CCTV System Summary .............................. 2.3-19
Circulation Pump and Heat
Exchanger .................................................... 2.1-19
Closed Circuit Television Subsystem ........ 2.23-3
Command and Data Subsystem ................. 2.23-2
Communications ............................................. 6.8-5
Communications System Rules of
Thumb ......................................................... 2.4-53
Communications System Summary ........... 2.4-44
Configuration Control Plan....................................i
Configurations .............................................. 2.23-1
Contingency Deorbit Preparation
Book ............................................................... 3.3-2
Crew Clothing/Worn Equipment ................ 2.5-1
Crew Compartment......................................... 1.2-3
Cryo .................................................................. 6.8-6
Cryo Leak with Failed Manifold Valve
......................................................................... 6.9-3

Abort Mode Boundaries.................................. 9.1-9

Active Thermal Control System .................. 2.9-22
Active Vent System ....................................... 2.17-2
Additional Support Documents .................... 3.2-2
Advanced Crew Escape Suit ....................... 2.10-4
Aft Fuselage .................................................... 1.2-10
Air Sampling System .................................... 2.5-15
Air-to-Ground Voice Communications
.......................................................................... 8.2-2
Alarms .............................................................. 2.2-2
Altitude, Velocity, and Dynamic
Pressure .......................................................... 9.1-5
Androgynous Peripheral Docking
System .......................................................... 2.19-2
APDS Avionics Overview ............................ 2.19-2
APDS Operational Sequences (OPS) .......... 2.19-6
Approach and Landing .................................. 5.4-7
APU 1 and Multiple Prox Box Failures ........ 6.9-1
APU Heaters .................................................. 2.1-11
APU/HYD Caution and Warning
Summary ..................................................... 2.1-23
APU/HYD Rules of Thumb ........................ 2.1-24
APU/HYD Summary Data .......................... 2.1-24
APU/Hydraulics ............................................. 6.8-2
Ascent .....................................................4.3-1, 4.9-1
Ascent Checklist .............................................. 3.1-1
Ascent Rules of Thumb ................................ 7.1-12
Ascent/Entry Systems Procedures
Book ................................................................ 3.3-1
Atmospheric Revitalization System ........... 2.9-12
Attitude Control .............................................. 7.2-1
Attitude Director Indicator (ADI) ................. 2.7-3
Audio Central Control Unit ......................... 2.4-29
Audio Communication Subsystem ............. 2.23-3
Audio Distribution System .......................... 2.4-27
Autoland ......................................................... 7.4-25

Data Bus Network .......................................... 2.6-7

Data Processing System ................................. 6.8-6
Data Processing System Dictionary ............. 3.4-1
Dedicated Display Systems Summary
Data .............................................................. 2.7-25
Definition and Overview ............................... 7.4-1
Deorbit Burn .......................................... 5.4-3, 7.3-1
Deorbit Prep ................................................ 2.16-35
Deorbit Preparation ........................................ 5.4-1
Deorbit Preparation Book .............................. 3.1-1
Deploy Checklist ............................................. 3.2-2
Derotation ...................................................... 7.4-18
Description ............ 2.1-1, 2.2-1, 2.3-1, 2.4-1, 2.5-1,
Description .......... 2.6-1, 2.7-1, 2.8-1, 2.9-1, 2.10-1,
Description ................. 2.12-1, 2.13-1, 2.14-1 .15-1,
Description .............. 2.16-1, 2.17-1, 2.18-1, 2.19-1,
Description ............. ,2.20-1, 2.21-1, 2.22-1, 2.23-1,
Description ..............................2.24-1, 2.25-1, 4.1-1
Device Driver Unit .......................................... 2.7-2
Digital Autopilot ......................................... 2.13-50
Downrange/Crossrange................................. 9.3-1
DPS Rules of Thumb .................................... 2.6-57
DPS Summary Data ...................................... 2.6-53
Drag ................................................................... 9.2-1
Drag Chute .................................................... 2.14-4
Dynamic Flight Phases ................................... 8.1-1

Backup Flight System ............. 7.1-8, 7.3-12,7.4-23

Basic .................................................................. 3.5-1
BFS Self Engage ............................................... 6.9-3
Body Flap ........................................................ 1.2-12
Both OMS ......................................................... 6.9-2

C/W Rules of Thumb ................................... 2.2-19

C/W Summary Data ..................................... 2.2-19
Cabin Cameras .............................................. 2.3-11
Cabin Vent and Side Hatch Jettison ......... 2.10-12
Caution and Warning ................................... 2.23-2
CCTV Camera Lens Control ........................ 2.3-10

ECLSS Caution and Warning

Summary ..................................................... 2.9-46
ECLSS Rules of Thumb ................................ 2.9-58
ECLSS Summary Data ................................. 2.9-47

I-1

INDEX

UA007587
Rev. A
Egress Pole System ..................................... 2.10-13
Electrical Power Distribution......................... 1.4-5
Electrical Power Distribution and
Control ......................................................... 2.8-20
Electrical Power Subsystem ........................ 2.23-2
Electrical Power System ............................... 6.8-10
Electronic Controller ...................................... 2.1-6
Emergency Egress Slide ............................. 2.10-13
Engines ........................................................... 2.18-3
Entry .........................................2.16-35, 4.3-1, 4.4-1
Entry .............................................4.9-1, 6.7-3, 7.3-4
Entry Checklist ................................................ 3.1-2
Entry History.................................................... 9.3-2
Entry Interface ................................................. 5.4-5
Entry RCS Use Data......................................... 9.3-2
Entry Rules of Thumb .................................. 7.3-14
Environmental Control and Life
Support System ............................................ 6.8-8
Environmental Control Subsystem ............ 2.23-3
EPS Caution and Warning Summary ........ 2.8-32
EPS Rules of Thumb ..................................... 2.8-38
EPS Summary Data ...................................... 2.8-38
Equipment ..................................................... 2.20-2
Escape Systems Summary Data ................ 2.10-22
ET Impact.......................................................... 9.1-8
ET Separation .................................................. 6.7-2
EVA Overview .............................................. 2.11-1
EVA Rules of Thumb ................................. 2.11-21
EVA Summary Data ................................... 2.11-21
EVA Support Equipment ........................... 2.11-14
Exercise Equipment ........................................ 2.5-4
Exterior Lighting ......................................... 2.15-14
External Airlock ................................ 2.11-9, 2.19-2
External Tank Umbilical Doors .................. 2.17-5
Extravehicular Activity Checklists ............... 3.2-1
Extravehicular Mobility Unit ...................... 2.11-2

Flight Crew ..............8.3-1, 8.4-1, 8.6-1, 8.7-1, 8.8-1

Flight Deck Interfaces ...................................2.23-2
Flight Instrument Tapes ...............................2.7-14
Flight Plan ........................................................3.1-1
Forward Fuselage.............................................1.2-1
Forward Fuselage and Crew
Compartment Windows...............................1.2-6
Fuel Cell Reactant Valves .............................6.10-1
Fuel Cell System ..............................................2.8-9
Fuel System ......................................................2.1-2

Galley ..............................................................2.12-1
Gas Generator and Turbine ...........................2.1-5
General Purpose Computers (GPCs) ............2.6-2
Gliding RTLS ...................................................6.3-6
GNC Caution and Warning Summary .....2.13-67
GNC Rules of Thumb .................................2.13-75
GNC Summary Data ...................................2.13-68
GPC/MDM ....................................................6.10-1
Ground Controlled Approach .....................7.3-12
Guidance, Navigation, and Control ...........6.8-12

Handling Qualities ........................................7.4-20

Hardware and Instrumentation .....................1.3-3
Heading Alignment Cone ..............................7.4-8
Head-Up Display (HUD) .............................2.7-21
Helium System ................... 2.16-19, 2.18-9, 2.22-9
Hold-Down Posts .............................................1.4-3
Horizontal Situation Indicator (HSI) ............2.7-8
Housekeeping Equipment .............................2.5-4
HYD Press and APU Controller Power
Switches .......................................................6.10-1
Hydraulic Accumulator ...............................2.1-19
Hydraulic Heaters .........................................2.1-21
Hydraulic Power Units....................................1.4-5
Hydraulic Reservoir ......................................2.1-19

F7 Light Summary ........................................ 2.2-20

Fault Detection and Identification ............ 2.18-22
Fault Message Summary ............................. 2.2-23
FDF Fabrication ............................................... 3.5-1
Final .................................................................. 3.5-3
Fire Suppression Subsystem ....................... 2.23-3
Flexible Containers ....................................... 2.24-4
Flight ................................................................. 3.5-3
Flight Control System Hardware ............. 2.13-28
Flight Control System Pushbutton
Indicators .................................................... 2.7-19

IDP/CRT Power Switch ...............................6.10-1

In-Flight Maintenance Checklist ...................3.3-1
Injector Cooling System ................................2.1-10
Inner Glideslope ............................................7.4-15
Insertion OMS Burns ......................................7.1-7
Instrumentation .............................................2.4-40
Intercom Protocol ............................................8.1-2
Interior Lighting ............................................2.15-1
Intertank ............................................................1.3-2

Jet System .......................................................2.22-3

INDEX

I-2

USA007587
Rev. A

Modular Memory Units ............................... 2.6-12

Monitors ......................................................... 2.3-14
MPS Caution and Warning Summary ..... 2.16-37
MPS He Leak with APC/ALC Failure ........ 6.9-1
MPS Hydraulic Systems ............................ 2.16-23
MPS Rules of Thumb .................................. 2.16-42
MPS Summary Data ................................... 2.16-39
MPS Switches ................................................ 6.10-1
Multifunction Electronic Display
System (MEDS) .......................................... 2.6-13
Multiplexers/Demultiplexers
(MDMs) ....................................................... 2.6-11

Ku-Band System ............................................ 2.4-13

Landing ............................................................. 4.3-2

Landing Gear ................................................. 2.14-1
Landing/Deceleration System Rules of
Thumb ........................................................ 2.14-17
Landing/Deceleration System
Summary Data .......................................... 2.14-17
Last Full On-Orbit Day ................................... 5.3-8
Launch and Landing Sites .............................. 1.1-5
Launch Control Center .............. 8.3-1, 8.4-2, 8.8-1
Launch Pad Egress Systems ........................ 2.10-1
Launch Window............................................... 9.1-2
Lighting System Rules of Thumb ............. 2.15-16
Lighting System Summary Data ............... 2.15-16
Liquid Hydrogen Tank ................................... 1.3-3
Liquid Oxygen Tank........................................ 1.3-2
Location Codes ................................................. 1.1-8
Loss of Braking ................................................. 9.3-6
Lubricating Oil ................................................ 2.1-5

Navigation Hardware .................................. 2.13-5

Nominal Mission Profile................................. 1.1-2
Nominal Transoceanic Abort Landing ........ 6.4-1
Nose Gear Touchdown .................................. 4.7-1
Nose Wheel Steering .................................... 2.14-9

Off-Nominal Approaches ............................ 7.4-24

OIU Display (SPEC 212) .............................. 2.4-27
OMS (RCS) Burns ........................................... 5.3-4
OMS Burns ....................................................... 5.2-3
OMS Caution and Warning Summary .... 2.18-24
OMS Kit .......................................................... 6.10-1
OMS Rules of Thumb ................................. 2.18-31
OMS Summary Data .................................. 2.18-31
OMS/RCS ......................................................... 9.2-2
OMS/RCS Leak with DPS/EPS
Failures .......................................................... 6.9-2
OMS-1 ............................................................... 6.6-1
OMS-2 ............................................................... 6.6-1
Operational Bioinstrumentation
System ......................................................... 2.5-13
Operational Notes of Interest ...................... 2.19-8
Operations ............... 2.1-21, 2.2-12, 2.6-30, 2.8-30,
Operations ........................2.9-43, 2.11-17, 2.13-57,
Operations ........................2.14-10, 2.16-282.18-23,
Operations .........................2.21-18, 2.22-16, 2.25-4
Operations Monitoring and Control ............ 8.2-1
Orbit .............................................................. 2.16-35
Orbit Operations ............................................. 5.3-1
Orbit Operations Checklist ............................ 3.2-1
Orbit Phase ...................................................... 8.1-1
Orbit Rules of Thumb .................................. 7.2-13
Orbital Maneuvering System (OMS)
Engines .......................................................... 4.2-2
Orbital Maneuvering
System/Reaction Control System ............ 6.8-14
Orbital Maneuvering
System/Reaction Control System
(OMS/RCS) Pods........................................ 1.2-11

Main Engines .................................................... 9.1-5

Main Gear Touchdown .................................. 4.7-1
Main Hydraulic Pump ................................. 2.1-16
Main Landing Gear Brakes .......................... 2.14-5
Main Propulsion System .............................. 6.8-12
Malfunction Detection ................................ 2.16-25
Malfunction Procedures Book ....................... 3.3-1
Manipulator Positioning Mechanism ....... 2.21-11
Maps and Charts Book ................................... 3.4-1
Master Timing Unit ....................................... 2.6-16
Maximum Landing Weight ........................... 4.6-1
MCC Resources ............................................... 8.2-1
MDU Configuration ...................................... 2.6-31
Mechanical ..................................................... 6.8-12
Mechanical Systems Rules of Thumb ....... 2.17-21
Mechanical Systems Summary Data ........ 2.17-18
MECO Targets .................................................. 9.1-8
Medical Checklist ............................................ 3.3-2
MEDS .............................................................. 2.6-25
Middeck Accommodations Rack ................ 2.24-6
Midfuselage ...................................................... 1.2-9
Minimum Safe Orbit........................................ 9.1-9
Mission Control Center ............ 8.3-1, 8.4-2, 8.5-1,
Mission Control Center ............. 8.6-1, 8.7-1, 8.8-1
Mode 1 Unaided Egress/Escape ................ 6.1-1
Mode 2 Aided Escape .................................. 6.1-1
Mode 3 Aided Escape .................................. 6.1-2
Mode 4 Aided Escape .................................. 6.1-2

I-3

INDEX

UA007587
Rev. A
Orbiter Ground Turnaround.......................... 1.1-6
Orbiter Passive Thermal Control................. 1.2-14
Outer Glideslope ............................................. 7.4-9
Overhead Escape Panel .............................. 2.10-18
Overview of Entry Flying Tasks ................... 7.3-1

Procedures for Bailout, Water

Survival, and Rescue ................................2.10-18
Program Documentation......................................iv
Propellant Management System
(PMS) ..........................................................2.16-13
Propellant Storage and Distribution .........2.18-12
Propellant System .........................................2.22-4

Pan/Tilt Units (PTUs) .................................. 2.3-11

Panel F9 Meters ............................................... 4.1-5
Panel O1 Meters .............................................. 4.1-6
Panel O2 Meters .............................................. 4.1-9
Panel O3 Meters ............................................ 4.1-11
Parachute Harness and Parachute ............. 2.10-6
Payload.............................................................. 9.1-1
Payload Bay Door System ........................... 2.17-9
Payload Communication System ............... 2.4-22
Payload Deployment and Retrieval
System Operations Checklist ..................... 3.2-1
Payload Operations Checklist ....................... 3.2-2
Payload Retention Mechanisms ............... 2.21-15
Payload Systems Data and
Malfunction Procedures Book .................... 3.3-1
Payload Systems Data/Malfunction
Book ............................................................... 3.4-1
PDRS Caution and Warning Summary
..................................................................... 2.21-23
PDRS Rules of Thumb ................................ 2.21-28
PDRS Summary Data ................................. 2.21-24
Performance Aborts ........................................ 6.2-1
Performance Rules of Thumb ...................... 9.3-12
Period ................................................................ 9.2-1
Personal Hygiene Provisions ........................ 2.5-1
Perturbations .................................................... 9.2-1
PFD Status Indicators ................................... 2.7-16
Photo/TV Checklist ........................................ 3.2-1
Photographic Equipment ............................... 2.5-8
PLB Mech Power/Enable ............................ 6.10-1
Pocket Checklists ............................................ 3.3-1
Post Insertion ..................................... 2.16-34, 5.2-5
Post Insertion Book ......................................... 3.1-1
Post MECO Transoceanic Abort
Landing ......................................................... 6.4-3
Power Reactants Storage and
Distribution System ..................................... 2.8-1
Powered Flight ................. 5.2-1, 6.6-1, 6.7-1, 7.1-1
Powered RTLS ................................................. 6.3-2
Preflare ........................................................... 7.4-14
Prelaunch Procedures .................................... 5.1-1
Preliminaries ................................................... 3.5-1
Pressure Control System ................................ 2.9-3
Primary Flight Display .................................. 2.7-3

INDEX

Radiation Equipment ....................................2.5-14

Range Safety .....................................................6.2-4
Range Safety System........................................1.4-7
Rapid Cabin Depressurization ....................2.2-11
RCS Caution and Warning Summary ......2.22-18
RCS Redundancy Management ................2.22-12
RCS Rules of Thumb ...................................2.22-25
RCS Summary Data ....................................2.22-25
Reach and Visibility Aids ...............................2.5-5
Reaction Control System (RCS) Jets ..............4.2-3
Reaction Control System Command
Lights ............................................................2.7-19
Reference Data Book .......................................3.4-1
Remote Manipulator System .......................2.21-1
Rendezvous ......................................................5.3-4
Rendezvous Checklist ....................................3.2-1
Rendezvous/Proximity Operations .............7.2-6
Restraints and Mobility Aids .........................2.5-5
Rigid Containers ............................................2.24-1
Rollout ............................................................7.4-19
Rollout History .................................................9.3-6
Rollout/Braking ...............................................9.3-6
RTLS Abort Propellant Dump
Sequence ....................................................2.16-35
Rules of Thumb .............................................7.4-28

S-Band Frequency Modulation ....................2.4-10

S-Band Phase Modulation ..............................2.4-2
Second Hydraulic Failure and 1 SSME
Failed ..............................................................6.9-1
Sensory Cues ......................... 7.1-10, 7.3-12, 7.4-25
Set Splits During Ascent .................................6.9-1
Shuttle Orbiter Medical System ..................2.5-10
Sighting Aids ...................................................2.5-9
Simplified Aid for EVA Rescue .................2.11-16
Sleeping Provisions .........................................2.5-1
Smoke Detection and Fire
Suppression ...................................................2.2-5
Software ..........................................................2.6-20
Space Shuttle Coordinate Reference
System .............................................................1.1-7

I-4

USA007587
Rev. A

Space Shuttle Main Engine

Controllers ................................................... 2.16-8
Space Shuttle Main Engines
(SSMEs) ..............................................2.16-3, 4.2-1
Space Shuttle Requirements ........................... 1.1-1
SPEC 60, SM Table Maintenance ................ 2.2-15
Squatcheloids.................................................... 9.1-3
SRB Descent and Recovery ............................. 1.4-8
SRB Ignition ...................................................... 1.4-4
SRB Rate Gyro Assemblies ............................. 1.4-6
SRB Separation ................................................. 1.4-7
Stowage Containers ........................................ 2.5-5
Stuck Throttle in the Bucket ........................... 6.9-1
Supply and Wastewater Systems ................ 2.9-34
Surface Position Indicator (SPI) .................. 2.7-17
Systems Abort Once Around Book ............... 3.3-1
Systems Aborts ................................................ 6.2-3
Systems Data Book .......................................... 3.4-1

Water Spray Boilers ...................................... 2.1-12

Wind Effects on Trajectory .......................... 7.4-22
Window Shades and Filters ........................ 2.5-10
Wing .................................................................. 1.2-7

TAL Abort Propellant Dump

Sequence .................................................... 2.16-36
Telemetry Uplink ............................................ 8.2-3
Terminal Area Energy Management ............ 7.4-1
Terminal Area Energy Management
(TAEM) .......................................................... 5.4-6
Terminal Area Energy Management
and Approach, Landing, and Rollout ...... 7.4-28
Thermal Control ............................2.18-19, 2.22-11
Thermal Protection System.................1.2-15, 1.3-3
Three-Engine-Out Automation ..................... 6.7-2
Thrust Vector Control...................................... 1.4-6
Thrust Vector Control (TVC) ..................... 2.18-20
Total Loss of FES ............................................. 6.9-2
Total Loss of FES with BFS Failure ............... 6.9-2
Touchdown .................................................... 7.4-16
Trajectory........................................................... 9.3-2
Translation ....................................................... 7.2-5
Truss Assembly ............................................. 2.19-2
TV Cue Card .................................................. 2.3-16
Two APUs/Hydraulic Systems .................... 6.9-1
Two Freon/Water Loops ............................... 6.9-2
Two Fuel Cells ................................................. 6.9-2

Ultrahigh Frequency Simplex System ........ 2.4-24

Vehicle Loss of Control/Breakup ............. 2.10-21

Vertical Tail..................................................... 1.2-13
Video Processing Equipment ........................ 2.3-6
Vn Diagrams .................................................... 4.9-1
Volume A - Pantry ........................................ 2.12-3
VTRs ................................................................ 2.3-13

I-5

INDEX

UA007587
Rev. A

This page intentionally left blank

INDEX

I-6