Navigation and Flight Management

Avionics Overview

• Backup Flight Control
• Computer Data Bus Network
• Data Bus Isolation Amplifiers
• Data Processing System
•  
• General-Purpose Computers
• Mass Memory Units
• Master Events Controllers
• Master Timing Unit
• Multifunction CRT Display System
• Multiplexers/Demultiplexers
• Software

Dedicated Display Systems

• Overview
• Alpha Mach Indicator
• Altitude/Vertical Velocity Indicators
• Attitude Director Indicator
• Flight Control System Push Button Indicators
• G-Meter
• Head-up Display
• Horizontal Situation Indicator
• RCS Command Lights

Guidance, Navigation and Control

• Overview
• Accelerometer Assemblies
• Air Data System
• Crewman Optical Alignment Sight
• Microwave Scan Beam Landing System
• Orbiter Rate Gyro Assemblies
• Radar Altimeter
• Rendezvous Thrusting Maneuvers
• RHC/Panel Enable/Inhibit
• Solid Rocket Booster Rate Gyro Assemblies
• Star Trackers
• Surface Position Indicator
• TACAN

Avionics Overview - Controls, or assists in controlling, most of the shuttle systems.

The space shuttle avionics system controls, or assists in controlling, most of the shuttle systems. Its functions include automatic determination of the vehicle's status and operational readiness; implementation sequencing and control for the solid rocket boosters and external tank during launch and ascent; performance monitoring; digital data processing; communications and tracking; payload and system management; guidance, navigation and control; and electrical power distribution for the orbiter, external tank and solid rocket boosters.

Automatic vehicle flight control can be used for every phase of the mission except docking, which is a manual operation performed by the flight crew. Manual control-referred to as the control stick steering mode-also is available at all times as a flight crew option.

The avionics equipment is arranged to facilitate checkout, access and replacement with minimal disturbance to other systems. Almost all electrical and electronic equipment is installed in three areas of the orbiter: the flight deck, the three avionics equipment bays in the middeck of the orbiter crew compartment and the three avionics equipment bays in the orbiter aft fuselage. The flight deck of the orbiter crew compartment is the center of avionics activity, both in flight and on the ground. Before launch, the orbiter avionics system is linked to ground support equipment through umbilical connections.

The space shuttle avionics system consists of more than 300 major electronic black boxes located throughout the vehicle, connected by more than 300 miles of electrical wiring. There are approximately 120,400 wire segments and 6,491 connectors in the vehicle. The wiring and connectors weigh approximately 7,000 pounds, wiring alone weighing approximately 4,600 pounds. Total weight of the black boxes, wiring and connectors is approximately 17,116 pounds.

The black boxes are connected to a set of five general-purpose computers through common party lines called data buses. The black boxes offer dual or triple redundancy for every function.

The avionics are designed to withstand multiple failures through redundant hardware and software (computer programs) managed by the complex of five computers; this arrangement is called a fail-operational/fail-safe capability. Fail-operational performance means that, after one failure in a system, redundancy management allows the vehicle to continue on its mission. Fail-safe means that after a second failure, the vehicle still is capable of returning to a landing site safely.

Data Processing System - The vehicle relies on computerized control and monitoring for successful performance.

Software - DPS software is divided into two major groups: system software and applications software.

DPS software is divided into two major groups, system software and applications software. The two software program groups are combined to form a memory configuration for a specific mission phase. The software programs are written in HAL/S (high-order assembly language/shuttle) especially developed for real-time space flight applications.

The system software is the GPC operating software that controls the interfaces among the computers and the rest of the DPS. It is loaded into the computer when it is first initialized. It always resides in the GPC main memory and is common to all memory configurations. The system software controls the GPC input and output, loads new memory configurations, keeps time, monitors discretes into the GPCs and performs many other functions required for the DPS to operate. The system software has nothing to do with orbiter systems or systems management software.

The system software consists of three sets of programs: the flight computer operating program (the executive) that controls the processors, monitors key system parameters, allocates computer resources, provides for orderly program interrupts for higher priority activities and updates computer memory; the user interface programs that provide instructions for processing flight crew commands or requests; and the system control program that initializes each GPC and arranges for multi-GPC operation during flight-critical phases. The system software program tells the general-purpose computers how to perform and how to communicate with other equipment.

One of the system software responsibilities is to manage the GPC input and output operations, which includes assigning computers as commanders and listeners on the data buses and exercising the logic involved in sending commands to these data buses at specified rates and upon request from the applications software.

The applications software contains (1) specific software programs for vehicle guidance, navigation and control required for launch, ascent to orbit, maneuvering in orbit, entry and landing on a runway; (2) systems management programs with instructions for loading memories in the space shuttle main engine computers and for checking the vehicle instrumentation system, aiding in vehicle subsystem checkout, ascertaining that flight crew displays and controls perform properly and updating inertial measurement unit state vectors; (3) payload processing programs with instructions for controlling and monitoring orbiter payload systems that can be revised depending on the nature of the payload; and (4) vehicle checkout programs needed to handle data management, performance monitoring, special processing, and display and control processing.

The applications software performs the actual duties required to fly and operate the vehicle. To conserve main memory, the applications software is divided into three major functions: guidance, navigation and control; systems management; and payload. Each GPC operates in one major function at a time, and usually more than one computer is in the GN&C; major function simultaneously for redundancy.

The highest level of the applications software is the operational sequence required to perform part of a mission phase. Each OPS is a set of unique software that must be loaded separately into a GPC from the mass memory units. Therefore, all the software residing in a GPC at any time consists of system software and an OPS. An OPS can be further subdivided into groups called major modes, each representing a portion of the OPS mission phase.

During the transition from one OPS to another, the flight crew requests a new set of applications software to be loaded in from the MMU. Every OPS transition is initiated by the flight crew. An exception is GN&C; OPS 1, which is divided into six major modes and contains the OPS 6 return-to-launch-site abort, since there would not be time to load in new software for an RTLS. When an OPS transition is requested, the redundant OPS overlay contains all major modes of that sequence.

Each major mode has with it an associated CRT display, called an OPS display, that provides the flight crew with information concerning the current portion of the mission phase and allows flight crew interaction. There are three levels of CRT displays. Certain portions of each OPS display can be manipulated by flight crew keyboard input (or ground link) to view and modify system parameters and enter data. The specialist function of the OPS software is a block of displays associated with one or more operational sequences and enabled by the flight crew to monitor and modify system parameters through keyboard entries. The display function of the OPS software is a block of displays associated with one OPS or more. These displays are for parameter monitoring only (no modification capability) and are called from the keyboard.

The principal software used to operate the vehicle during a mission is the primary avionics software system. It contains all the programming needed to fly the vehicle through all phases of the mission and manage all vehicle and payload systems.

Since the ascent and entry phases of flight are so critical, four of the five GPCs are loaded with the same PASS software and perform all GN&C; functions simultaneously and redundantly. As a safety measure, the fifth GPC contains a different set of software, programmed by a company different from the PASS developer, designed to take control of the vehicle if a generic error in the PASS software or other multiple errors should cause a loss of vehicle control. This software is called the backup flight system. In the less dynamic phases of on-orbit operations, the BFS is not required.

GPCs running together in the same GN&C; OPS are part of a redundant set performing identical tasks from the same inputs and producing identical outputs. Therefore, any data bus assigned to a commanding GN&C; GPC is heard by all members of the redundant set (except the instrumentation buses because each GPC has only one dedicated bus connected to it). These transmissions include all CRT inputs and mass memory transactions, as well as flight-critical data. Thus, if one or more GPCs in the redundant set fail, the remaining computers can continue operating in GN&C.; Each GPC performs about 325,000 operations per second during critical phases.

Each computer in a redundant set operates in synchronized steps and cross-checks results of processing about 440 times per second. Synchronization refers to the software scheme used to ensure simultaneous intercomputer communications of necessary GPC status information among the primary avionics computers. If a GPC operating in a redundant set fails to meet two redundant synchronization codes in a row, the remaining computers will vote it out of the redundant set. Or if a GPC has a problem with its multiplexer interface adapter receiver during two successive reads of response data and does not receive any data while the other members of the redundant set do not receive the data, they in turn will vote the GPC out of the set. A failed GPC is halted as soon as possible.

GPC failure votes are annunciated in a number of ways. The GPC status matrix on panel O1 is a 5-by-5 matrix of lights. For example, if GPC 2 sends out a failure vote against GPC 3, the second white light in the third column is illuminated. The yellow diagonal lights from upper left to lower right are self-failure votes. Whenever a GPC receives two or more failure votes from other GPCs, it illuminates its own yellow light and resets any failure votes that it made against other GPCs (any white lights in its row are extinguished). Any time a yellow matrix light is illuminated, the GPC red caution and warning light on panel F7 is illuminated, in addition to master alarm illumination, and a GPC fault message is displayed on the CRT.
 

General-Purpose Computers - Five identical computers aboard the orbiter control vehicle systems.

Five identical general-purpose computers aboard the orbiter control space shuttle vehicle systems. Each GPC is composed of two separate units, a central processor unit and an input/output processor. All five GPCs are IBM AP-101 computers. Each CPU and IOP contains a memory area for storing software and data. These memory areas are collectively referred to as the GPC's main memory.

The central processor controls access to GPC main memory for data storage and software execution and executes instructions to control vehicle systems and manipulate data. In other words, the CPU is the ''number cruncher'' that computes and controls computer functions.

The IOP formats and transmits commands to the vehicle systems, receives and validates response data from the vehicle systems and maintains the status of interfaces with the CPU and the other GPCs.

The IOP of each computer has 24 independent processors, each of which controls 24 data buses used to transmit serial digital data between the GPCs and vehicle systems, and secondary channels between the telemetry system and units that collect instrumentation data. The 24 data buses are connected to each IOP by multiplexer interface adapters that receive, convert and validate the serial data in response to discrete signals calling for available data to be transmitted or received from vehicle hardware.

During the receive mode, the multiplexer interface adapter validates the received data (notifying the IOP control logic when an error is detected) and reformats the data. During the receive mode, its transmitter is inhibited unless that particular GPC is in command of that data bus.

During the transmit mode, a multiplexer interface adapter transmits and receives 28-bit command/data words over the computer data buses. When transmitting, the MIA adds the appropriate parity and synchronization code bits to the data, reformats the data, and sends the information out over the data bus. In this mode, the MIA's receiver and transmitters are enabled.

The first three bits of the 28-bit word provide synchronization and indicate whether the information is a command or data. The next five bits identify the destination or source of the information. For command words, 19 bits identify the data transfer or operations to be performed; for data words, 16 of the 19 bits contain the data and three bits define the word validity. The last bit of each word is for an odd parity error test.

The main memory of each GPC is non-volatile (the software is retained when power is interrupted). The memory capacity of each CPU is 81,920 words, and the memory capacity of each IOP is 24,576 words; thus, the CPU and IOP constitute a total of 106,496 words.

The hardware controls for the GPCs are located on panel O6. Each computer reads the position of its corresponding output , initial program load and mode switches from discrete input lines that go directly to the GPC. Each GPC also has an output and mode talkback indicator on panel O6 that are driven from GPC output discretes.

Each GPC power on , off switch is a guarded switch. Positioning a switch to on provides the computer with triply redundant power (not through a discrete) by three essential buses-ESS1BC, 2AC and 3AB-which run through the GPC power switch. The essential bus power is transferred to remote power controllers, which permits main bus power from the three main buses (MNA, MNB and MNC) to power the GPC. There are three RPCs for the IOP and three for the CPU; thus, any GPC will function normally, even if two main or essential buses are lost.

Each computer uses over 600 watts of power. GPCs 1 and 4 are located in forward middeck avionics bay 1, GPCs 2 and 5 are located in forward middeck avionics bay 2, and GPC 3 is located in aft middeck avionics bay 3. The GPCs receive forced-air cooling from an avionics bay fan. There are two fans in each avionics bay but only one is powered at a time. If both fans in an avionics bay fail, the computers will overheat and could not be relied on to operate properly for more than 20 minutes if the initial condition is warm.

Each GPC output switch is a guarded switch with backup , normal and terminate positions. The output switch provides a hardware override to the GPC that precludes that GPC from outputting (transmitting) on the flight-critical buses. The switches for the primary avionics GN&C; GPCs are positioned to normal , which permits them to output (transmit). The backup flight system GPC switch is positioned to backup, which precludes it from outputting until it is engaged. The switch for a GPC designated on orbit to be a systems management computer is positioned to terminate since the GPC is not to command anything on the flight-critical buses.

The output talkback indicator above each output switch on panel O6 indicates gray if that GPC output is enabled and barberpole if it is not.

Each GPC receives run , stby , or halt discrete inputs from its mode switch on panel O6, which determines whether that GPC can process software. The mode switch is lever-locked in the run position. The halt position for a GPC initiates a hardware-controlled state in which no software can be executed. A GPC that fails to synchronize with others is moded to halt as soon as possible to prevent the failed computer from outputting erroneous commands. The mode talkback indicator above the mode switch for that GPC indicates barberpole when that computer is in halt.

In standby, a GPC is also in a state in which no software can be executed but is in a software-controlled state. The stby discrete allows an orderly startup or shutdown of processing. It is necessary, as a matter of procedure, for a GPC that is shifting from run to halt to be temporarily (more than one second) in the standby mode before going to halt since the standby mode allows for an orderly software cleanup and allows a GPC to be correctly initialized without an initial program load. If a GPC is moded from run to halt without pausing in standby, it may not perform its functions correctly upon being remoded to run. There is no stby indication on the mode talkback indicator above the mode switch; however, it would indicate barberpole in the transition from run to standby and run from standby to halt.

The run position permits a GPC to support its normal processing of all active software and assigned vehicle operations. Whenever a computer is moded from standby or halt to run, it initializes itself to a state in which only system software is processed (called OPS 0). If a GPC is in another OPS before being moded out of run and the initial program has not been loaded since, that software still resides in main memory; but it will not begin processing until that OPS is recalled by flight crew keyboard entry. The mode talkback indicator always reads run when that GPC switch is in run and the computer has not failed.

Placing the backup flight system GPC in standby does not stop BFS software processing or preclude BFS engagement; it only prevents the BFS from commanding.

The IPL push button indicator for a GPC on panel O6 activates the initial program load command discrete input when depressed. When the input is received, that GPC initiates an IPL from whichever mass memory unit is specified by the IPL source , MMU 1 , MMU 2 , off switch on panel O6. The talkback indicator above the mode switch for that GPC indicates IPL.

During non-critical flight periods in orbit, only one or two GPCs are used for GN&C; tasks and another for systems management and payload operations.

A GPC on orbit can also be ''freeze-dried;'' that is, it can be loaded with the software for a particular memory configuration and then moded to standby. It can then be moded to halt and powered off. Since the GPCs have non-volatile memory, the software is retained. Before an OPS transition to the loaded memory configuration, the freeze-dried GPC can be moded back to run and the appropriate OPS requested.

A simplex GPC is one in run and not a member of the redundant set, such as the BFS GPC. Systems management and payload major functions are always in a simplex GPC.

A failed GPC can be hardware-initiated, stand-alone-memory-dumped by switching the powered computer to terminate and halt and then selecting the number of the failed GPC on the GPC memory dump rotary switch on panel M042F in the crew compartment middeck. Then the GPC is moded to standby to start the dump, which takes three minutes.

Each CPU is 7.62 inches high, 10.2 inches wide and 19.55 inches long; it weighs 57 pounds. The IOPs are the same size and weight as the CPUs.

The new upgraded general-purpose computers, AP-101S from IBM, will replace the existing GPCs, AP-101B, aboard the space shuttle orbiters in mid-1990.

The upgraded GPCs allow NASA to incorporate more capabilities into the space shuttle orbiters and apply more advanced computer technologies than were available when the orbiter was first designed. The new design began in January 1984, whereas the older GPC design began in January 1972.

The upgraded computers provide 2.5 times the existing memory capacity and up to three times the existing processor speed with minimum impact on flight software. The upgraded GPCs are half the size and approximately half the weight of the old GPCs, and they require less power to operate.

The upgraded GPCs consist of a central processor unit and an input/output processor in one avionics box instead of the two separate CPU and IOP avionics boxes of the old GPCs. The upgraded GPC can perform more than 1 million benchmark tests per second in comparison to the older GPC's 400,000 operations per second. The upgraded GPCs have a semiconductor memory of 256,000 32-bit words; the older GPCs have a core memory of up to 104,000 32-bit words.

The upgraded GPCs have volatile memory, but each GPC contains a battery pack to preserve the software when the GPC is powered off.

The initial predicted reliability of the upgraded GPCs is 6,000 hours mean time between failures, with a projected growth to 10,000 hours mean time between failures. The mean time between failures for the older GPCs is 5,200 hours-more than five times better than the original reliability estimate of 1,000 hours.

The AP-101S avionics box is 19.55 inches long, 7.62 inches high and 10.2 inches wide, the same as one of the two previous GPC avionics boxes. Each of the five upgraded GPCs aboard the orbiter weighs 64 pounds, in comparison to 114 pounds for the two units of the older GPCs. This change reduces the weight of the orbiter's avionics by approximately 300 pounds and frees a volume of approximately 4.35 cubic feet in the orbiter avionics bays. The older GPCs require 650 watts of electrical power versus 550 watts for the upgraded units.

Thorough testing, documentation and integration, including minor modifications to flight software, were performed by IBM and NASA's Shuttle Avionics Integration Laboratory in NASA's Avionics Engineering Laboratory at the Johnson Space Center.

Mass Memory Units - Computing functions for all mission phases requires about 400,000 words of computer memory.

There are two mass memory units aboard the orbiter. Each is a coaxially mounted, reel-to-reel digital magnetic tape storage device for GPC software and orbiter systems data that can be written to or read from. The MMU tape is 602 feet long and 0.5 of an inch wide and has nine tracks (eight data tracks and one control track). These tracks are divided into files and subfiles for finding particular locations.

Computing functions for all mission phases requires approximately 400,000 words of computer memory. The orbiter GPCs are loaded with different memory groups from the MMUs containing the desired program. In this way, software can be stored in MMUs and loaded into the GPCs when actually needed.

To fit the required software into the available GPC memory space, programs are subdivided into nine memory groups corre sponding to functions executed during specific flight and checkout phases. Thus, in addition to the central memory in the GPCs themselves, 34 million bytes of information can be stored in each of the two mass memory units. Critical programs and data are loaded in both MMUs and protected from erasure.

The principal function of the MMU, besides storing the basic flight software, is to store background formats for certain CRT displays and the checkpoints that are written periodically to save system data in case the systems management GPC fails.

MMU operations are controlled by logic and the read and write electronics that activate the proper tape heads (read or write/erase) and validate the data.

Each MMU interfaces with its mass memory data bus through multiplexer interface adapters, which function like the GPCs. Each mass memory data bus is connected to all five computers; however, each MMU is connected to only one mass memory data bus. All MMU operations are on an on-demand basis only.

The mass memory units are an advanced form of data storage that fills the gap between slow-access drives of high storage capacity and discs or drums with fast access but relatively low storage capacity.

The power switches are located on panel O14 for MMU 1 and panel O15 for MMU 2. The MMU 1 switch positioned to on allows control bus power to activate an RPC, which allows MNA power to MMU 1. The MMU 2 switch positioned to on operates in a similar manner with MNB power. A mass memory unit uses 20 watts of power in standby and 50 watts when the tape is moving.

MMU 1 is located in crew compartment middeck avionics bay 1, and MMU 2 is in avionics bay 2. Each unit is cooled by water coolant loop cold plates. Each MMU is 7.6 inches high, 11.6 inches wide and 15 inches long and weighs 22 pounds.

Multifunction CRT Display System - Displays on the flight deck allow onboard monitoring of systems, software processing and manual control for crew data and software manipulation.

The MCDS on the orbiter crew compartment flight deck allows onboard monitoring of orbiter systems, computer software processing and manual control for flight crew data and software manipulation.

Master Timing Unit - The GPC complex requires an accurate time source because its software uses GMT to schedule processing.

The GPC complex requires a stable, accurate time source because its software uses Greenwich Mean Time to schedule processing. Each GPC uses the master timing unit to update its internal clock. The MTU provides precise frequency outputs for various timing and synchronization purposes to the GPC complex and many other orbiter subsystems. Its three time accumulators provide GMT and mission elapsed time, which can be updated by external control. The accumulator's timing is in days, hours, minutes, seconds, and milliseconds up to one year.

The master timing unit is a stable, crystal-controlled frequency source that uses two oscillators for redundancy. The signals from one of the two oscillators are passed through signal shapers and frequency drivers to the three GMT/MET accumulators.

The MTU outputs serial digital time data (GMT/MET) on demand to the GPCs through the accumulators. The GPCs use this information for their reference time and indirectly for time-tagging GN&C; and systems management processing. The MTU also provides continuous digital timing outputs to drive the four digital timers in the crew compartment-two mission timers and two event timers. In addition, the MTU also provides signals to the pulse code modulation master units, payload signal processor and FM signal processor, as well as various payloads.

The GPCs start by using MTU accumulator 1 as their time source. Every second, each GPC checks the accumulator time against its own internal time. If the time is within tolerance (less than one millisecond), the GPC updates its internal clock to the time of the accumulator, which is more accurate, and continues to use that accumulator. However, if the time is out of tolerance, the GPC will try the other MTU accumulators and then the lowest numbered GPC until it finds a successful comparison.

The GPCs do not use the mission elapsed time that they receive from the master timing unit because flag compute MET on the basis of current GMT and lift-off time.

The master timing unit is redundantly powered by the MTU A and MTU B circuit breakers on panel O13. The master timing unit OSC 1, auto, OSC 2 switch on panel O6 controls the MTU. When the switch is in auto and a time signal from the MTU is out of tolerance, the MTU automatically switches to the other oscillator. Normally, the MTU is activated by oscillator 1 with the switch in auto . The OSC 1 or OSC 2 position, manually selects OSC 1 or OSC 2.

The MTU is located in crew compartment middeck avionics bay 3B and is cooled by a water coolant loop cold plate. The only hardware displays associated with the MTU are the mission and event timers. The mission timers are located on panels O3 and A4. They can display either GMT or MET in response to the GMT or MET switch positions. The forward event timer is on panel F7 and its control switches are on panel C2. The aft event timer is on panel A4 and its control switches are on panel A6.

The master timing unit contractor is Westinghouse Electric Corp., Systems Development Division, Baltimore, Md.

Computer Data Bus Network - Network is divided into specific groups that perform specific functions.

The orbiter computer data bus network consists of a group of twisted, shielded wire pairs (data buses) that support the transfer of serial digital commands from the GPCs to vehicle hardware and vehicle systems data to the GPCs. The computer data bus network is divided into specific groups that perform specific functions.

Multiplexers/Demultiplexers - DPS MDMs convert and format serial digital GPC commands into separate commands for various vehicle system hardware.

There are 23 multiplexers/demultiplexers aboard the orbiter; 16 are part of the DPS, connected directly to the GPCs and named according to their location in the vehicle and hardware interface. The remaining seven MDMs are part of the vehicle instrumentation system and send vehicle instrumentation data to the pulse code modulation master unit.

The data processing system MDMs consist of flight-critical forward MDMs 1 through 4, flight-critical aft MDMs 1 through 4, payload MDMs 1 and 2, SRB launch left MDMs 1 and 2 and launch right MDMs 1 and 2, and GSE/LPS launch forward 1 and launch aft 1.

Of the seven operational instrumentation MDMs, four are located forward (OF1, OF2, OF3 and OF4) and three are located aft (OA1, OA2 and OA3).

The system software in each redundant set of GPCs activates a GN&C; executive program and issues commands to the bus and MDM to provide a set of input data. Each MDM receives the command from the GPC assigned to it, acquires the requested data from the GN&C; hardware wired to it and sends the data to the GPCs.

The DPS MDMs convert and format serial digital GPC commands into separate parallel discrete, digital and analog commands for various vehicle system hardware. This operation is called demultiplexing. The MDMs also multiplex, or convert, and format the discrete, digital and analog data from vehicle systems into serial digital data for transmission to the GPCs. Each MDM has two redundant multiplexer interface adapters that function the same as the GPC MIAs and are connected to two data buses. The MDM's other functional interface is its connection to the appropriate vehicle system hardware by hard-wired lines.

When the sets of GN&C; hardware data arrive at the GPCs through the MDMs and data buses, the information is generally not in the proper format, units or form for use by flight control, guidance or navigation. A subsystem operating program for each type of hardware processes the data to make it usable by GN&C; software. These programs contain the software necessary for hardware operation, activation, self-testing and moding. The level of redundancy varies from two to four, depending on the particular unit. The software that processes data from redundant GN&C; hardware is called redundancy management. It performs two functions: (1) selecting, from redundant sets of hardware data, one set of data for use by flight control, guidance and navigation and (2) detecting out-of-tolerance data, identifying the faulty unit and announcing the failure to the flight crew and to the data collection software.

In the case of four redundant hardware units, the redundancy management software uses three and holds the fourth in reserve. It utilizes a middle value select until one of the three is bad and then uses the fourth. If one of the remaining three is lost, the software downmodes to two and uses the average of two. If one of the remaining two is lost, the software downmodes to one and passes only the data it receives.

The three main engine interface units between the GPCs and the three main engine controllers accept GPC main engine commands, reformat them and transfer them to each main engine controller. In return, the EIUs accept data from the main engine controller, reformat it and transfer it to GPCs and operational instrumentation. Main engine functions, such as ignition, gimbaling, throttling and shutdown, are controlled by each main engine controller internally through inputs from the guidance equations that are computed in the orbiter GPCs.

Each flight-critical data bus is connected to a flight forward and flight aft MDM. Each MDM has two MIAs, or ports, and each port has a channel through which the GPCs can communicate with an MDM; however, the FC data buses can interface with only one MIA port at a time. Port moding is the software method used to control the MIA port that is used in an MDM. Initially, these MDMs operate with MIA port 1; if a failure occurs in MIA port 1, the flight crew can select MIA port 2. Since port moding involves a pair of buses, both MDMs must be ported at the same time. The control of all other units connected to the affected data buses is unaffected by port moding.

Payload data bus 1 is normally connected to the primary MIA port of payload MDM 1 and payload data bus 2 is connected to the primary MIA port of payload MDM 2. Payload data bus 1 can be connected to the secondary MIA port of payload MDM 2 and payload data bus 2 can be connected to the secondary MIA port of payload MDM 1 by flight crew selection.

The two launch data buses are also connected to dual MDM MIA ports. The flight crew cannot switch these ports; however, if an input/output error is detected on LF1 or LA1 during ascent, an automatic switchover occurs.

The only hardware controls for the MDMs are the MDM FC and MDM PL power switches on panel O6. These are on/off switches that provide or remove power for the four aft and four forward flight-critical MDMs and PL1, PL2 and PL3 MDMs. The PL3 MDM switch is unwired and is not used. There are no flight crew controls for the SRB MDMs.

Each MDM is redundantly powered by two main buses. The power switches control bus power for activation of a remote power controller for main power bus to an MDM. The main buses power separate power supplies in the MDM. Loss of either the main bus or MDM power supply does not cause a loss of function because each power supply powers both channels in the MDM. Turning power off to an MDM resets all the commands to subsystems.

The SRB MDMs receive power through SRB buses A and B; they are tied to the orbiter main buses and controlled by the master events controller circuitry. The launch forward and aft MDMs receive their power through the preflight test buses.

The FF1, PL1 and LF1 MDMs are located in the forward avionics bays and are cooled by water coolant loop cold plates. LA1 and the FA MDMs are in the aft avionics bays and are cooled by Freon coolant loop cold plates. MDMs LL1, LL2, LR1 and LR2 located in the SRBs are cooled by passive cold plates.

Modules and cards in an MDM depend on the hardware components accessed by that type of MDM. An FF MDM and an FA MDM are not interchangeable. However, one FF MDM may be interchanged with another or one payload MDM with another.

Each MDM is 13 by 10 by 7 inches and weighs 36.7 pounds. MDMs use less than 80 watts of power.

The MDM contractor is Honeywell Inc., Sperry Space Systems Division, Phoenix, Ariz.

Master Events Controllers - Send signals to arm and safe pyrotechnics during SRB/ET separation.

The two master events controllers under GPC control send signals to arm and safe pyrotechnics and command and fire pyrotechnics during the solid rocket booster/external tank separation process and the orbiter/external tank separation process. The MEC contractor is Rockwell International, Autonetics Group, Anaheim, Calif.

Data Bus Isolation Amplifiers - Interfacing devices for the GSE/LPS and SRB MDMs.

Data bus isolation amplifiers are the interfacing devices for the GSE/LPS and the SRB MDMs. They transmit or receive multiplexed data in either direction. The amplifiers enable multiplexed communications over the longer data bus cables that connect the orbiter and GSE/LPS. The receiving section of the amplifiers detects low-level coded signals, discriminates against noise and decodes the signal to standard digital data at a very low bit error rate; the transmit section of the amplifiers then re-encodes the data and retransmits it at full amplitude and low noise.

Data bus couplers couple the vehicle multiplexed data and control signals from the data bus and cable studs connected to the various electronic units. The couplers also perform impedance matching on the data bus, line termination, dc isolation and noise rejection.

Each data bus isolation amplifier is 7 by 6 by 5 inches and weighs 7.5 pounds. Each data bus coupler is 1 cubic inch in size and weighs less than 1 ounce. The contractor for the data bus isolation amplifiers and data bus couplers is Singer Electronics Systems Division, Little Falls, N.J.

Backup Flight Control - The fifth GPC, loaded with different software, provides backup in case primary GPCs fail.

Even though the four primary avionics software system GPCs control all GN&C; functions during the critical phases of the mission, there is always a possibility that a generic failure could cause loss of vehicle control. Thus, the fifth GPC is loaded with different software created by a different company than the PASS developer. This different software is the backup flight system. To take over control of the vehicle, the BFS monitors the PASS GPCs to keep track of the current state of the vehicle. If required, the BFS can take over control of the vehicle upon the press of a button. The BFS also performs the systems management functions during ascent and entry because the PASS GPCs are operating in GN&C.; BFS software is always loaded into GPC 5 before flight, but any of the five GPCs could be made the BFS GPC if necessary.

The BFS interface programs, events and applications controllers, and GN&C; are provided by the Charles Stark Draper Laboratory Inc., Cambridge, Mass. The remainder of the software, as well as the integration of the total backup flight control system, is provided by Intermetrics and Rockwell International. The GN&C; software is written in HAL/S by Intermetrics of Boston, Mass.

Since the BFS is intended to be used only in a contingency, its programming is much simpler than that of the PASS. Only the software necessary to complete ascent or entry safely, maintain vehicle control in orbit and perform systems management functions during ascent and entry is included. Thus, all the software used by the BFS can fit into one GPC and never needs to access mass memory. For added protection, the BFS software is loaded into the MMUs in case of a BFS GPC failure.

The BFS, like PASS, consists of system software and applications software. System software in the BFS performs basically the same functions as it does in PASS. These functions include time management, PASS/BFS interface, multifunction CRT display system, input/output, uplink/downlink and engage/disengage control. The system software is always operating when the BFS GPC is not in halt.

Applications software in the BFS has different major functions, GN&C; and systems management; but all of its applications software resides in main memory at one time, and the BFS can process software in both major functions simultaneously. The GN&C; functions of the BFS, designed as a backup capability, support the ascent phase beginning at major mode 102 and the deorbit/entry phase beginning at major mode 301. In addition, the various ascent abort modes are supported by the BFS. The BFS provides only limited support for on-orbit operations through major modes 106 or 301. Because the BFS is designed to monitor everything the PASS does during ascent and entry, it has the same major modes as the PASS in OPS 1, 3 and 6.

The BFS systems management contains software to support the ascent and entry phases of the mission. Whenever the BFS GPC is in the run or standby mode, it runs continuously; however, the BFS does not control the payload buses in standby. The systems management major function in the BFS is not associated with any operational sequence.

Even though the five general-purpose computers and their switches are identical, the GPC mode switch on panel O6 works differently for a GPC loaded with BFS. Since halt is a hardware-controlled state, no software is executed. The standby mode in the BFS GPC is totally different from its corollary in the PASS GPCs. When the BFS GPC is in standby, all normal software is executed as if the BFS were in run, the only difference being that BFS command of the payload data buses is inhibited in standby. The BFS is normally put in run for ascent and entry and in standby whenever a PASS systems management GPC is operating. If the BFS is in standby or run, it takes control of the flight-critical and payload data buses if engaged. The mode talkback indicator on panel O6 indicates run if the BFS GPC is in run or standby and displays a barberpole if the BFS is in halt or has failed.

The BFS is synchronized with PASS so that it can track the PASS and keep up with its flow of commands and data. Synchronization and tracking take place during OPS 1, 3 and 6. During this time, the BFS listens over the flight-critical data buses to the requests for data by PASS and to the data coming back. The BFS depends on the PASS GPCs for all of its GN&C; data and must be synchronized with the PASS GPCs so that it will know when to receive GN&C; data over the FC buses. When the BFS is in sync and listening to at least two strings, it is said to be tracking PASS. As long as the BFS is in this mode, it maintains the current state vector and all other information necessary to fly the vehicle in case the flight crew needs to engage it. The BFS uses the same master timing unit source as PASS and keeps track of Greenwich Mean Time over the flight-critical buses for synchronization.

The BFS also monitors some inputs to PASS CRTs and updates its own GN&C; parameters accordingly. When the BFS GPC is tracking the PASS GPCs, it cannot command over the FC buses but may listen to FC inputs through the listen mode.

The BFS GPC controls its own instrumentation/PCMMU data bus. The BFS GPC intercomputer communication data bus is not used to transmit status or data to the other GPCs; and the MMU data buses are not used except during initial program load and MMU assignment, which use the same IPL source switch used for PASS IPL.

A major difference between the PASS and BFS is that the BFS can be shifted into OPS 1 or 3 at any time, even in the middle of ascent or entry.

The BFC lights on panels F2 and F4 remain unlighted as long as PASS is in control and the BFS is tracking. The lights flash if the BFS loses track of the PASS and stands alone. The flight crew must then decide whether to engage the BFS or try to initiate BFS tracking again by a reset. When BFS is engaged and in control of the flight-critical buses, the BFC lights are illuminated and stay on until the BFC is disengaged.

Since the BFS does not operate in a redundant set, its discrete inputs and outputs, which are fail votes from and against other GPCs, are not enabled; thus, the GPC matrix status light on panel O1 for the BFS GPC does not function as it does in PASS. The BFS can illuminate its own light on the GPC matrix status panel if the watchdog timer in the BFS GPC times out or if the BFS GPC does not complete its cyclic processing.

To engage the BFS, which is considered a last resort to save the vehicle, the crew presses a BFS engage momentary push button located on the commander's or pilot's rotational hand controller. As long as the RHC is powered and the BFS GPC output switch is in backup on panel O6, depressing the engage push button on the RHC engages the BFS and causes PASS to relinquish control during ascent or entry. There are three contacts in each engage push button, and all three contacts must be made to engage the BFS. The signals from the RHC are sent to the backup flight controller, which handles the engagement logic.

When the BFS is engaged, the BFC lights on panels F2 and F4 are illuminated; the BFS output talkback indicator on panel O6 turns gray; all PASS GPC output and mode talkback indicators on panel O6 display a barberpole; the BFS controls the CRTs selected by the BFS CRT select switch on panel C3; big X and poll fail appear on the remaining CRTs; and all four GPC status matrix indicators for PASS GPCs are illuminated on panel O1.

When the BFS is disengaged and the BFC CRT switch on panel O3 is positioned to on, the BFS commands the first CRT indicated by the BFC CRT select switch. The BFC CRT select switch positions on panel C3 are 1 + 2 , 2 + 3 and 3+1. When the BFS is engaged, it assumes control of the second CRT as well.

If the BFS is engaged during ascent, the PASS GPCs can be recovered on orbit to continue a normal mission. This procedure takes about two hours, since the PASS inertial measurement unit reference must be re-established. To disengage the BFS after all PASS GPCs have been hardware-dumped and software-loaded, the PASS GPCs must be taken to GN&C; OPS 3. Positioning the BFC disengage momentary switch on panel F6 to the up position disengages the BFS. The switch sends a signal to the BFC that resets the engage discretes to the GPCs. The BFS then releases control of the flight-critical buses as well as the payload buses if it is in standby, and the PASS GPCs assume command.

Indications of the PASS engagement and BFS disengagement are as follows: BFC lights on panels F2 and F4 are out, BFS output talkback indicator on panel O6 displays a barberpole, PASS output talkback indicators on panel O6 are gray and BFS release/PASS control appears on the CRT. After disengagement, the PASS and BFS GPCs return to their normal pre-engaged state.

If the BFS is engaged, there is no manual thrust vector control or manual throttling capability during first- and second-stage ascent. If the BFS is engaged during entry, the speed brake is positioned using the speed brake/thrust controller and the body flap is positioned manually. The BFC system also augments the control stick steering mode of maneuvering the vehicle with the commander's rotational hand controller.

The software of the BFC system is processed only for the commander's attitude director indicator, horizontal situation indicator and RHC. The BFC system supplies attitude errors on the CRT trajectory display, whereas PASS supplies attitude errors to the ADIs; however, when the BFC system is engaged, the errors on the CRT are blanked.

Guidance, Navigation and Control

Overview - GNC software commands effect vehicle control and provide sensor data needed to compute these commands.

Guidance, navigation and control software command the GN&C; system to effect vehicle control and to provide the sensor and controller data needed to compute these commands. The process involves three steps: guidance equipment and software first compute the orbiter location required to satisfy mission requirements, navigation then tracks the vehicle's actual location, and flight control then transports the orbiter to the required location.

A redundant set of four orbiter general-purpose computers forms the primary avionics software system; a fifth GPC is used as the backup flight system.

The GPCs interface with the various systems through the orbiter's flight forward and flight aft multiplexers/demultiplexers. The data buses serve as a conduit for signals going to and from the various sensors that provide velocity and attitude information as well as for signals traveling to and from the orbiter propulsion systems, orbiter aerodynamic control surfaces, and displays and controls.

The GN&C; system consists of two operational modes: auto and manual (control stick steering). In the automatic mode, the primary avionics software system essentially allows the GPCs to fly the vehicle; the flight crew simply selects the various operational sequences. The flight crew may control the vehicle in the control stick steering mode using hand controls, such as the rotational hand controller, translational hand controller, speed brake/thrust controller and rudder pedals. The translational hand controller is available only for the commander, but both the commander and pilot have a rotational hand controller.

In the control stick steering mode, flight crew commands must still pass through and be issued by the GPCs. There are no direct mechanical links between the flight crew and the orbiter's various propulsion systems or aerodynamic surfaces; the orbiter is an entirely digitally controlled, fly-by-wire vehicle.

During launch and ascent, most of the GN&C; commands are directed to gimbal the three space shuttle main engines and solid rocket boosters to maintain thrust vector control through the vehicle's center of gravity at a time when the amount of consumables is changing rapidly. In addition, the GN&C; controls SSME throttling for maximum aerodynamic loading of the vehicle during ascent-referred to as max q-and to maintain an acceleration of no greater than 3 g's during the ascent phase. To circularize the orbit and perform on-orbit and deorbit maneuvers, the GN&C; commands the orbital maneuvering system engines. At external tank separation, on orbit and during portions of entry, GN&C; controls commands to the reaction control system. In atmospheric flight, GN&C; controls the orbiter aerodynamic flight control surfaces.

Functions of GN&C; software include flight control, guidance, navigation, hardware data processing and flight crew display. Specific function tasks and their associated GN&C; hardware vary with each mission phase.

Vehicle control is maintained and in-flight trajectory changes are made during powered flight by firing and gimbaling engines. During atmospheric flight, these functions are performed by deflecting aerosurfaces. Flight control computes and issues the engine fire and gimbal commands and aerosurface deflection commands.

Flight control includes attitude processing, steering, thrust vector control and digital autopilots. Flight control receives vehicle dynamics commands (attitudes, rates and accelerations) from guidance software or flight crew controllers and processes them for conversion to effector commands (engine fire, gimbal or aerosurface). Flight control output commands are based on errors for stability augmentation. The errors are the difference between the commanded attitude, aerosurface position, body rate or body acceleration and the actual attitude, position, rate or acceleration.

Actual attitude is derived from inertial measurement unit angles, aerosurface position is provided by feedback transducers in the aerosurface servoamplifiers, body rates are sensed by rate gyro assemblies, and accelerations are sensed by accelerometer assemblies. In atmospheric flight, flight control adjusts control sensitivity based on air data parameters derived from local pressures sensed by air data probes and performs turn coordination using body attitude angles derived from IMU angles. Thus, GN&C; hardware required to support flight control is a function of the mission phase.

The guidance steering commands used by the flight control software are augmented by the guidance software or are manually commanded by the hand controller or speed brake/thrust controller. When flight control software uses the steering commands computed by guidance software, it is termed automatic guidance; when the flight crew is controlling the vehicle by hand, it is called control stick steering. The commands computed by guidance are those required to get from the current state (position and velocity) to a desired state (specified by target conditions, attitude, airspeed and runway centerline). The steering commands consist of translational and rotational angles, rates and accelerations. Guidance receives the current state from navigation software. The desired state or targets are part of the initialized software load and some may be changed manually in flight.

The navigation system maintains an accurate estimate of vehicle position and velocity, referred to as a state vector. From position, attitude and velocity, other parameters (acceleration, angle of attack) are calculated for use in guidance and for display to the crew. The current state vector is mathematically determined from the previous state vector by integrating the equations of motion using vehicle acceleration as sensed by the IMUs and/or computed from gravity and drag models. The alignment of the IMU and, hence, the accuracy of the resulting state vector deteriorate as a function of time. Celestial navigation instruments (star trackers and crewman optical alignment sight) are used to maintain IMU alignment in orbit. For entry, the accuracy of the IMU-derived state vector is, however, insufficient for either guidance or the flight crew to bring the spacecraft to a pinpoint landing. Therefore, data from other navigation sensors-air data system, tactical air navigation, microwave scan beam landing system and radar altimeter-is blended into the state vector at different phases of entry to provide the necessary accuracy. The three IMUs maintain an inertial reference and provide velocity changes until the microwave scan beam landing system is acquired. Navigation-derived air data are needed during entry as inputs to guidance, flight control and flight crew dedicated displays. Such data are provided by tactical air navigation, which supplies range and bearing measurements beginning at 160,000 feet; the air data system provides information at about Mach 3. Tactical air navigation is used until the microwave scan beam landing system is acquired or an altitude of 1,500 feet is reached if MSBLS is not available.

During rendezvous and proximity operations, the onboard navigation system maintains the state vectors of both the orbiter and target vehicle. During close operations (separation of less than 15 miles), these two state vectors must be very accurate in order to maintain an accurate relative state vector. Rendezvous radar measurements (range and range rate) are used for a separation of about 15 miles to 100 feet to provide the necessary relative state vector accuracy. When two vehicles are separated by less than 100 feet, the flight crew relies primarily on visual monitoring (aft and overhead windows and closed-circuit television).

In summary, GN&C; hardware sensors used by navigation include IMUs, star trackers, the crewman optical alignment sight, tactical air navigation, air data system, microwave scan beam landing system, radar altimeter and rendezvous radar. The GN&C; hardware sensors used by the flight control system are accelerometer assemblies, orbiter rate gyro assemblies, solid rocket booster rate gyro assemblies, controllers and aerosurface servoamplifiers.

Star Trackers - Two star tracker units are part of the navigation system.

The star tracker system is part of the orbiter's navigation system. Its two units are located just forward and to the left of the commander's plus X window in a well outside the pressurized crew compartment-an extension of the navigation base on which the IMUs are mounted. The star trackers are slightly inclined off the vehicle's negative Y and negative Z axes, for which they are named. The star trackers are used to align the IMUs on board the orbiter as well as to track targets and provide line-of-sight vectors for rendezvous calculations.

Alignment of the IMUs is required approximately every 12 hours to correct IMU drift, within one to two hours before major on-orbit thrusting duration or after a crewman optical alignment sight IMU alignment. IMU alignment is accomplished by using the star trackers to measure the line-of-sight vector to at least two stars. With this information, the GPC calculates the orientation between these stars and the orbiter to define the orbiter's attitude. A comparison of this attitude with the attitude measured by the IMU provides the correction factor necessary to null the IMU error.

The GPC memory contains inertial information for 50 stars chosen for their brightness and their ability to provide complete sky coverage.

The star trackers are oriented so that the optical axis of the negative Z star tracker is pointed approximately along the negative Z axis of the orbiter and the optical axis of the negative Y star tracker is pointed approximately along the negative Y axis of the orbiter. Since the navigation base provides the mount for the IMUs and star trackers, the star tracker line of sight is referenced to the navigation base and the orbiter coordinate system; thus, the GPC knows where the star tracker is pointed and its orientation with respect to the IMUs.

Each star tracker has a door to protect it during ascent and entry. The doors are opened on orbit to permit use of the star trackers.

To enable the star tracker doors to open, the star tracker power minus Y and minus Z switches on panel O6 must be positioned to on. The star tracker door control sys 1 and sys 2 switches on panel O6 control one three-phase ac motor on each door. Positioning the sys 1 switch to open controls motor control logic and drives the minus Y and minus Z star tracker door by electromechanical actuators to the open position. Limit switches stop the motors when the doors are open and control a talkback indicator above the sys 1 switch. The talkback indicator indicates when the doors are open. Setting the sys 2 switch to open controls a redundant ac motor and electromechanical actuators to open the minus Y and minus Z star tracker door, and limit switches stop the motors when the doors are open and control the talkback indicator above the sys 2 switch in the same manner as for system 1. Positioning the sys 1 switch to close drives the minus Y and minus Z door closed; the talkback indicator above the switch indicates cl. The door opening or closing time with two motors is six seconds; with one motor, it is 12 seconds. Setting the sys 2 switch to close drives the system 2 motors and closes the minus Y and minus Z door; the talkback indicator above the switch indicates cl . The indicators indicate barberpole when a door is between open or closed. The off position of the sys 1 or 2 switch removes power from the corresponding motor control logic circuitry.

The difference between the inertial attitudes defined by the star tracker and the IMU is processed by software and results in IMU torquing angles. If the IMU gimbals are physically torqued or the matrix defining its orientation is recomputed, the effects of the IMU gyro drift are removed and the IMU is restored to its inertial attitude. If the IMU alignment is in error by more than 1.4 degrees, the star tracker is unable to acquire and track stars. In this case, the crewman optical alignment sight must be used to realign the IMUs to within 1.4 degrees; the star trackers can then be used to realign the IMUs more precisely. The star tracker cannot be used if the IMU alignment error is greater than 1.4 degrees because the angles the star tracker is given for searching are based on current knowledge of the orbiter attitude, which is based on IMU gimbal angles. If that attitude is greatly in error, the star tracker may acquire and track the wrong star.

In addition to aligning the IMUs, the star trackers can be used to provide angular data from the orbiter to a target. This capability can be used during rendezvous or proximity operations with a target satellite.

The star tracker includes a light shade assembly and an electronics assembly mounted on top of the navigation base. The light shade assembly defines the tracker field of view (10 degrees square). Its shutter mechanism may be opened manually by the crew using an entry on the cathode ray tube display, or it can be opened and closed automatically by a bright object sensor or target suppress software. The bright object sensor reacts before a bright object, such as the sun or moon, can damage the star tracker (the sensor has a larger field of view than the star tracker shutter). The target suppress software reacts to a broad light source (such as the sunlit Earth), which may not trip the bright object sensor but could produce overall illumination large enough to cause photo currents larger than desired.

The electronics assembly contains an image dissector tube mounted on the underside of the navigation base. The star tracker itself does not move-the field of view is scanned electronically. The star tracker may be commanded to scan the entire field of view or a smaller offset field of view (1 degree square) about a point defined by horizontal and vertical offsets. An object is tracked when the proper intensity and the correct location are sensed. Star tracker outputs are the horizontal and vertical position within the field of view of the object being tracked and its intensity.

There is no redundancy management for the star tracker assemblies; they operate independently, and either can do the whole task. They can be operated either separately or concurrently.

The star tracker subsystem operating program, or SOP, supports the modes that are commanded manually: self-test, star track, target track, break track and term/idle. Self-test consists of software and hardware tests. In the star track mode, the star tracker does an offset scan search for the star, acquires it and tracks it. The star may be selected by the flight crew or GPC; in either case, field-of-view and occultation checks are made. Target track is the same as star track, but the flight crew must specify the target and its threshold. Break track forces the star tracker to stop tracking a star and to perform a search scan from the current location to track the next star it acquires. In the term/idle mode, the star tracker continues its operation, but all star tracker software processing ceases.

In addition, the star tracker SOP maintains the star table. When a star tracker has acquired and tracked a star and the data has passed software checks, the star identification, time tag and line-of-sight vector are stored. The identification and time elapsed since time tag are displayed in the star table. When two or three stars are in the table, the angular difference between their line-of-sight vectors is displayed. The difference between the star tracker and star catalog angular differences is displayed as an error. The star tracker SOP selects line-of-sight vectors of two stars in the star table for IMU alignment and outputs an align ena discrete. Align ena signifies that the star data meets certain criteria that allows the repositioning of the IMU inertial platforms. The software selects the star pair whose angular difference is closest to 90 degrees or the pair whose elapsed time of entry into the table is less than 60 minutes. The flight crew may manually override the SOP selection or clear the table if desired.

The SOP also determines and displays star tracker status.

The contractor for the star trackers is Ball Brothers, Boulder, Colo.

Crewman Optical Alignment Sight - Used if IMU alignment is in error more than 1.4 degrees.

The crewman optical alignment sight is used if inertial measurement unit alignment is in error by more than 1.4 degrees, rendering the star tracker unable to acquire and track stars. The COAS must be used to realign the IMUs to within 1.4 degrees. The star trackers can then be used to realign the IMUs more precisely.

The COAS is mounted at the commander's station so the crew can check for proper attitude orientation during ascent and deorbit thrusting periods. For on-orbit operations, the COAS at the commander's station is removed and installed next to the aft flight deck overhead right minus Z window.

The COAS is an optical device with a reticle projected on a combining glass that is focused on infinity. The reticle consists of 10-degree-wide vertical and horizontal cross hairs with 1-degree marks and an elevation scale on the right side of minus 10 to 31.5 degrees. A light bulb with variable brightness illuminates the reticle. The COAS requires 115-volt ac power for reticle illumination. The COAS is 9.5 by 6 by 4.3 inches and weighs 2.5 pounds.

After mounting the COAS at the aft flight station, the flight crew member must manually maneuver the orbiter until the selected star is in the field of view. The crew member maneuvers the orbiter so that the star crosses the center of the reticle. At the instant of the crossing, the crew member makes a mark by depressing the most convenient att ref push button; the three att ref push buttons are located on panels F6, F8 and A6. At the time of the mark, software stores the gimbal angles of the three IMUs. This process can be repeated if the accuracy of the star's centering is in doubt. When the crew member feels a good mark has been taken, the software is notified to accept it. Good marks for two stars are required for an IMU alignment. The separation between the two stars should be between 60 and 120 degrees.

By knowing the star being sighted and the COAS's location and mounting relationship in the orbiter, software can determine a line-of-sight vector from the COAS to the star in an inertial coordinate system. Line-of-sight vectors to two stars define the attitude of the orbiter in inertial space. This attitude can be compared to the attitude defined by the IMUs and can be realigned to the more correct orientation by the COAS sightings if the IMUs are in error.

The COAS's mounting relative to the navigation base on which the IMUs are mounted is calibrated before launch. The constants are stored in software, and COAS line-of-sight vectors are based on known relationships between the COAS line of sight and the navigation base.

COAS can also be used to visually track targets during proximity operations or to visually verify tracking of the correct star by the minus Z star tracker.

COAS data processing is accomplished in the star tracker SOP. This SOP accepts and stores crew inputs on COAS location, star identification or calibration mode; accepts marks; computes and stores the line-of-sight vectors; enables IMU alignment when two marks have been accepted; and computes, updates and provides display data.

TACAN - Determine slant range and magnetic bearing to ground station.

The onboard tactical air navigation units determine slant range and magnetic bearing of the orbiter to a TACAN or VHF omnirange TACAN ground station.

The ground-based TACAN and VHF omnirange TACAN stations constitute a global navigation system for military and civilian aircraft operating at L-band frequencies (1 gigahertz).

The orbiter is equipped with three TACAN sets that operate redundantly. Each TACAN has two antennas: one on the orbiter's lower forward fuselage and one on the orbiter's upper forward fuselage. The antennas are covered with reusable thermal protection system tiles.

The onboard TACAN sets are used for external navigation and for the orbiter during the entry phase and return-to-launch-site abort. Normally, several ground stations will be used after leaving L-band communications blackout and during the terminal area energy management phases. TACAN's maximum range is 400 nautical miles (460 statute miles).

Each ground station has an assigned frequency (L-band) and a three-letter Morse code identification. The ground station transmits on one of 252 (126X, 126Y) preselected frequencies (channels) that correspond to the frequencies the onboard TACAN sets are capable of receiving. These frequencies are spaced at 63-MHz intervals.

The TACAN ground station beacon continuously transmits pulse pairs on its assigned frequency. The orbiter TACAN receivers pick up these pulse pairs, and the TACAN data processors decode them to compute bearing. The onboard TACAN sets detect the phase angle between magnetic north and the position of the orbiter with respect to the ground station. The ground beacon is omnidirectional; when the orbiter is over the ground station, or nearly so, it is in a cone of confusion. Within this cone, bearing is unusable.

Periodically, the onboard TACAN sets emit an interrogation pulse that causes the selected TACAN ground station to respond with distance-measuring equipment pulses. The slant range (orbiter to ground station) is computed by the onboard TACAN sets by measuring the elapsed time from interrogation to valid reply and subtracting known system delays. As the orbiter approaches a ground TACAN station, the range decreases. After a course has been selected, the onboard TACAN sets derive concise deviation data.

The range and bearing data are used to update the state vector position components after the data are transformed by the TACANs in the entry phase (or return to launch site) by navigation and for display on the horizontal situation indicators on panels F6 and F8, as well as for display of raw TACAN data on the cathode ray tube.

Each of the onboard TACANs has an ant sel switch on panel O7. In the auto position, the onboard GPCs automatically select the upper L-band antenna or lower L-band antenna for that TACAN. The upper and lower positions of each TACAN ant sel switch allow the flight crew to select the upper or lower L-band antenna manually.

Each of the onboard TACANs is controlled by its mode rotary switch on panel O7. The modes are off, receive, transmit and receive, and GPC. In the GPC mode, the onboard GPCs control TACAN ground station channel selection automatically, and both bearing and range are processed by hardware and software. In the transmit and receive mode, both bearing and range are processed by hardware and software, but TACAN ground station channels are selected manually using the four thumbwheels for that TACAN on panel O7. The first three thumbwheels (left to right) select the channel (frequency), and the fourth selects the X or Y. In the receive mode, only bearing is received and processed by the hardware; the thumbwheels for that TACAN would be used to select the channel.

Approximately every 37 seconds, the selected ground TACAN station transmits its three-letter identification to the onboard TACAN. In order for the Morse code identification to be verified by the commander and pilot, TACAN ID audio controls are located on panel O5 for the commander and panel O9 for the pilot. The TACAN on/off switch is positioned to on to transmit the TACAN identification. The TACAN 1 , 2 and 3 switch selects the onboard TACAN that will transmit the TACAN identification code, and the TACAN on/off switch is positioned to on to transmit the code to the orbiter's audio system, thus the commander and pilot. Volume TACAN thumbwheels on panels O5 and O9 control the volume setting of the TACAN identification code to the commander and pilot.

In the GPC mode, 10 TACAN ground stations are programmed into the software and are divided into three geometric regions: the acquisition region (three stations), the navigation region (six stations), and the landing site region (one station).

During orbital operations, landing sites are grouped into minitable and maxitable programs. The maxitable programs provide data sets that support a broad range of trajectories for contingency deorbits and enable reselection of runway and navigation and data sets for those deorbits. The minitable consists of three runways determined by the flight crew, one of which is initialized as a primary runway. The minitable is transferred from entry operations and becomes unchangeable. Entry guidance is targeted from one of the three runways selected by the crew, initialized with the primary runway for the well-defined trajectory and nominal end-of-mission data sets. Since the TACAN units are placed in groups of 10 and 10 TACAN units from one group (primary) form the TACAN half of the minitable, the secondary and alternate runways should be from the same group as the primary runway to assure TACAN coverage.

The acquisition region is the area in which the onboard TACAN sets automatically begin searching for a range lock-on of three ground stations at approximately 160,000 feet. After one TACAN acquires a range lock, the other two will lock on to the same ground station. When at least two TACAN sets lock on, TACAN range and bearing are used by navigation to update state vector until microwave scan beam landing system selection and acquisition at approximately 18,000 feet.

When the distance to the landing site is approximately 120 nautical miles (138 statute miles), the TACAN begins the navigation region of interrogating the six navigation stations. As the spacecraft progresses, the distance to the remaining stations is computed. The next-nearest station is automatically selected when the spacecraft is closer to it than to the previous locked-on station. Only one station is interrogated when the distance to the landing site is less than approximately 20 nautical miles (23 statute miles). Again, the TACAN sets will automatically switch from the last locked-on navigation region station to begin searching for the landing site station. TACAN azimuth and range are provided on the horizontal situation indicator. TACAN range and bearing cannot be used to produce a good estimate of the altitude position component, so navigation uses barometric altitude derived from the air data system probes, which are deployed by the fight crew at approximately Mach 3.

If the microwave scan beam landing system is not acquired, TACAN data can be used until an altitude of 1,500 feet. When runways with MSBLS are acquired, MSBLS operation can be automatic. The flight crew is provided with the controls and displays necessary to evaluate MSBLS performance and take over manually if required. The runways with MSBLS must be in the primary or secondary slot in the minitable for the minitable to copy the MSBLS data. The maxitable is an initial-loaded table of 18 runway data sets and MSBLS data for runways and 50 TACAN data sets. In orbital operations, the landing site function provides the capability to transfer data from the maxitable to the minitable.

TACAN data is processed in the TACAN subsystem operating program, which converts range and bearing to units of feet and radians.

TACAN redundancy management consists of processing and mid-value-selecting range and bearing data. The three TACAN sets are compared to determine if a significant difference is detected. When all three TACAN sets are good, redundancy management selects middle values of range and bearing. If one of the two parameters is out of tolerance, the remaining two will average that parameter. If a fault is verified, the SM alert light is illuminated, and a cathode ray tube fault message occurs for the applicable TACAN set.

The three convection-cooled TACAN sets are located in the orbiter crew compartment middeck avionics bays. Each set is 7.62 inches high, 7.62 inches wide and 12.53 inches long and weighs 30 pounds.

The TACAN contractor is Hoffman Electronics Corporation, Navigation Communication System Division, El Monte, Calif.

Air Data System - Provides information on the movement of the orbiter in the air mass.

Two air data probes are located on the left and right sides of the orbiter's forward lower fuselage. During the ascent, on-orbit, deorbit and initial entry heat load environment phases, the probes are stowed inside the forward lower fuselage. The air data probe (except for the probe itself) is covered by thermal protection system tiles while in the stowed position. At approximately Mach 3, the air data probes are deployed.

The air data system provides information on the movement of the orbiter in the air mass (flight environment).

The air data system senses air pressures related to spacecraft movement through the atmosphere to update navigation state vector in altitude; provide guidance in calculating steering and speed brake commands; and update flight control law computations and provide display data for the commander's and pilot's alpha Mach indicators, altitude/vertical velocity indicators and CRTs. The AMIs display essential flight parameters relative to the spacecraft's travel in the air mass, such as angle of attack (alpha), acceleration, Mach/velocity and knots equivalent airspeed. The altitude/vertical velocity indicators display such essential flight parameters as radar altitude, barometric altitude, altitude rate and altitude acceleration.

Each probe is independently deployed by an actuator consisting of two ac motors connected to rotary electromechanical actuator and limit switches. Each probe is controlled by its air data probe switch on panel C3. To deploy the air data probes, the left and right switches are positioned to deploy. The redundant motors for each probe drive the probe to the deployed position. When the probe is fully deployed, limit switches remove electrical power from the motors. Deployment time is 15 seconds for two-motor operation and 30 seconds for single-motor operation. The deploy position deploys the probe without electrical heaters. The deploy/heat position also deploys the air data probes with heaters powered.

The air data probe stow left and right switches on panel C3 are used during ground turnaround operations to stow the respective probe. Positioning the respective switch to enable and positioning the corresponding air data probe switch to stow stows the corresponding air data probe. The air data probe stow inhibit position opens the ac motor circuits, disables the stow and protects microswitches.

Each air data probe has four pressure-port sensors and two temperature sensors. The pressures sensed are static pressure, total pressure, angle-of-attack upper pressure and angle-of-attack lower pressure. The four pressures are sensed at ports on each probe: static pressure at the side, total pressure at the front and angle-of-attack lower near the bottom front. The probe-sensed pressures are connected by a set of pneumatic lines to two air data transducer assemblies. The two temperature sensors are installed on each probe and are wired to an ADTA. The pressures sensed by the left probe are connected by pneumatic tubing to ADTAs 1 and 3. Those sensed by the right probe are connected to ADTAs 2 and 4. Temperatures and sensed pressure from the probes are sent to the same ADTAs.

Within each ADTA, the pressure signals are directed to four transducers, and the temperature signal is directed to a bridge. The pressure transducer analogs are converted to digital data by digital-processor-controlled counters. The temperature signal is converted by an analog-to-digital converter. The digital processor corrects errors, linearizes the pressure data and converts the temperature bridge data to temperatures in degrees centigrade. These data are sent to the digital output device, which converts the signals into serial digital format, and then to the onboard computers to update the navigation state vector. The data are also sent to the commander's and pilot's altitude/vertical velocity indicators, alpha Mach indicators and CRT.

The ADTA SOP uses ADTA data to compute angle of attack, Mach number (M), equivalent airspeed (EAS), true airspeed (TAS), dynamic pressure (q), barometric altitude (h) and altitude rate ( . h ).

The altitude/vertical velocity indicators and alpha Mach indicators are located on panels F6 and F8 for the commander and pilot, respectively. The information to be displayed on the commander's AVVI and AMI is controlled by the commander's air data switch on panel F6, and the pilot's AVVI and AMI data are controlled by the pilot's air data switch on panel F8. When the commander's or pilot's switch is positioned to nav , the AVVIs and AMIs receive information from the navigation attitude processor. When the air data probes are deployed, the commander's and pilot's switches can be positioned to left or right to receive information from the corresponding air data probe.

The AVVIs display altitude deceleration ( alt accel ) in feet per second squared, rate in feet per second, navigation/air data system (nav/ADS) in feet and radar ( rdr ) altitude in feet. The AVVI's altitude acceleration indicator remains on the navigation attitude processor from the IMUs. In addition, the radar altimeters on the AVVIs will not receive information until the orbiter reaches an altitude of 5,000 feet.

The AMIs display angle of attack ( alpha ) in degrees, acceleration (accel) in feet per second squared, Mach number or velocity (M/vel) in feet per second and equivalent airspeed ( EAS ) in knots. The AMI's acceleration indicator remains on the navigation attitude processor from the IMUs.

All but the alpha indicators (a moving drum) and the altitude acceleration indicators (a moving pointer displayed against a fixed line) are moving tapes behind fixed lines. The AMI's angle-of-attack indicator reads from minus 18 to plus 60 degrees, the acceleration indicator from minus 50 to plus 100 feet per second squared, the Mach/velocity indicator from Mach zero to 4 and 4,000 to 27,000 feet per second, and equivalent airspeed from zero to 500 knots. The AVVIs read altitude acceleration from minus 13.3 to plus 13.3 feet per second squared, altitude rate from minus 2,940 to plus 2,940 feet per second, altitude from minus 1,100 to plus 400,000 feet and then changes scale to plus 40 to plus 165 nautical miles (barometric altitude), and radar altitude from zero to plus 9,000 feet.

Failure warning flags are provided for all four scales on the AVVIs and AMIs. The flags appear in the event of a malfunction in the indicator or in received data. In the event of power failure, all four flags appear.

The four computers compare the pressure readings from the four ADTAs for error. If all the pressure readings compare within a specified value, one set of pressure readings from each probe is summed, averaged and sent to the software. If one or more pressure signals of a set of probe pressure readings fail, the failed set's data flow from that ADTA to the averager is interrupted, and the software will receive data from the other ADTA of that probe. If both probe sets fail, the software operates on data from the two ADTAs connected to the other probe. The best total temperature from all four ADTAs is sent to the software. A fault detection will illuminate the air data red caution and warning light on panel F7, the backup caution and warning alarm light, and the master alarm and will also sound the audible tone and generate a fault message on the CRT. A communication fault will illuminate the SM alert light.

The four ADTAs are located in the orbiter crew compartment middeck forward avionics bays and are convection cooled. Each is 4.87 inches high, 21.25 inches long and 4.37 inches wide and weighs 19.2 pounds.

The air data probe sensor contractor is Rosemount Inc., Eden Prairie, Minn. The air data transducer assembly contractor is AirResearch Manufacturing Co., Garrett Corp., Torrance, Calif. The contractor for the air data probe deploy system is Ellanef, Corona, N.Y.

Microwave Scan Beam Landing System - Used during landing phase to determine slant range, azimuth and elevation to landing runway.

The three onboard microwave scan beam landing systems are airborne Ku-band receiver/transmitter navigation and landing aids with decoding and computational capabilities. The MSBLS units determine slant range, azimuth and elevation to the ground stations alongside the landing runway. MSBLS is used during terminal area energy management, the approach and landing flight phases and return-to-launch-site aborts. When the channel (specific frequency) associated with the target runway approach is selected, the orbiter's MSBLS units receive elevation from the glide slope ground portion and azimuth and slant range from the azimuth/distance-measuring equipment ground station.

The orbiter is equipped with three independent MSBLS sets, each consisting of a Ku-band receiver/transmitter and decoder. Data computation capabilities determine elevation angle, azimuth angle and orbiter range with respect to the MSBLS ground station. The MSBLS provides highly accurate three-dimensional navigation position information to the orbiter to compute state vector components for steering commands that maintain the orbiter on its proper flight trajectory. The three orbiter Ku-band antennas are located on the upper forward fuselage nose. The three MSBLS and decoder assemblies are located in the crew compartment middeck avionics bays and are convection cooled.

The ground portion of the MSBLS consists of two shelters: an elevation shelter and an azimuth/distance-measuring equipment shelter. The elevation shelter is located near the projected touchdown point, with the azimuth/DME shelter located near the far end of the runway. Both ends of the runway are instrumented to enable landing in either direction.

The MSBLS ground station signals are acquired when the orbiter is close to the landing site and has turned on its final leg. This usually occurs on or near the heading alignment cylinder, about 8 to 12 nautical miles (9 to 13 statute miles) from touchdown at an altitude of approximately 18,000 feet.

Final tracking occurs at the terminal area energy management ''autoland'' interface at approximately 10,000 feet altitude and 8 nautical miles (9 statute miles) from the azimuth/DME station.

The MSBLS angle and range data are used to compute steering commands until the orbiter is over the runway approach threshold, at an altitude of approximately 100 feet. If the autoland system is used, it may be overridden by the commander or pilot at any time using the control stick steering mode.

The commander's and pilot's horizontal situation indicators display the orbiter's position with respect to the runway. Elevation and azimuth are shown relative to a GPC-derived glide slope on a glide slope indicator; course deviation needles and range are displayed on a mileage indicator. When the orbiter is over the runway threshold, the radar altimeter is used to provide elevation (pitch) guidance. Azimuth/DME data are used during the landing rollout.

The three orbiter MSBLS sets operate on a common channel during the landing phase. The MSBLS ground station transmits a DME solicit pulse. The onboard MSBLS receiver responds with a DME interrogation pulse. The ground equipment responds by transmitting a return pulse. A decoder in the onboard MSBLS decodes the pulses to determine range, azimuth and elevation. Range is a function of the elapsed time between interrogation pulse transmission and signal return. Azimuth pulses are returned in pairs. The spacing between the two pulses in a pair identifies the pair as azimuth and indicates which side of the runway the orbiter is on; spacing between pulse pairs defines the angular position from runway centerline. The spacing between the two pulses in a pair identifies the pair as elevation, and the spacing between pulse pairs defines the angular position of the orbiter above the runway.

The elevation beam is 1.3 to 29 degrees high and 25 degrees to the left and right of the runway. The azimuth/DME beam is zero to 23 degrees high and 13.5 degrees to the left and right of the runway.

Each RF assembly routes range, azimuth and elevation information in RF form to its decoder assembly, which processes the information and converts it to digital words for transmission to the onboard GN&C; via the multiplexers/demultiplexers for the GPCs.

Elevation, azimuth and range data from the MSBLS are used by the GN&C; system from the time of acquisition until the runway approach threshold is reached. After that point, the azimuth and range data are used to control rollout. Altitude data are provided separately by the orbiter's radar altimeter.

Since the azimuth/DME shelters are at the far ends of the runway, the MSBLS can provide useful data until the orbiter is stopped. Azimuth data give position in relation to the runway centerline, while the DME gives the distance from the orbiter to the end of the runway.

Each MSBLS has an on/off power switch on panel O8 and on the channel (frequency) selection thumbwheel on panel O8. Positioning the MLS 1, 2 and 3 switch provides power to the corresponding microwave scan beam landing system. MSBLS 1 receives power from main bus A, MSBLS 2 from main bus B and MSBLS 3 from main bus C. Positioning the channel 1 , 2 and 3 thumbwheels selects the frequency (channel) for the ground station at the selected runway for the corresponding MSBLS.

Redundancy management mid-value-selects azimuth and elevation angles for processing navigation data. The three MSBLS sets are compared to identify any significant differences among them.

When data from all three MSBLS sets are valid, redundancy management selects middle values of three ranges, azimuths and elevations. In the event that only two MSBLS sets are valid, the two ranges, azimuths and elevations are averaged. If only one MSBLS set is valid, its range, azimuth and elevation are passed for display. When a fault is detected, the SM alert light is illuminated, and a CRT fault message is shown.

Each MSBLS decoder assembly is 8.25 inches high, 5 inches wide and 16.16 inches long and weighs 17.5 pounds. The RF assembly is 7 inches high, 3.5 inches wide and 10.25 inches long and weighs 6 pounds.

The MSBLS contractor is Eaton Corp., AIL Division, Farmingdale, N.Y.

Radar Altimeter - Measure absolute altitude from the orbiter to nearest terrain within beamwidth of orbiter's antennas.

The two radar altimeters on board the orbiter measure absolute altitude from the orbiter to the nearest terrain within the beamwidth of the orbiter's antennas.

The RAs constitute a low-altitude terrain-tracking and altitude-sensing system based on the precise time it takes an electromagnetic energy pulse to travel from the orbiter to the nearest object on the ground below and return during altitude rate changes of as much as 2,000 feet per second. This enables tracking of mountain or cliff sides ahead or alongside the orbiter if these obstacles are nearer than the ground below and warns of rapid changes in absolute altitude.

The two independent RAs consist of a transmitter and receiver antenna. The systems can operate simultaneously without affecting each other. The four C-band antennas are located on the lower forward fuselage. The two receiver/transmitters are located in the middeck forward avionics bays and are convection cooled.

Each RA transmits a C-band (4,300 MHz modulated at 8.5 kHz) pulse through its transmitting antenna. The signal is reflected by the nearest terrain, and the leading edge of the return radar echo is locked on by the RA through its receiving antenna. The altitude outputs by the RA are analog voltages that are proportional to the elapsed time required for the ground pulse to return, which is a function of height or distance to the nearest terrain. The range output of the RA is from zero to 5,000 feet. The RA will not lock on if the orbiter has large pitch or roll angles.

The onboard GPCs process the data for the autoland mode and touchdown guidance after the orbiter has crossed the runway threshold from an altitude of 100 feet down to touchdown. If the autoland mode is not used, the GPCs process the data for display on the commander's and pilot's altitude/vertical velocity meters from 5,000 feet.

The commander and pilot can select RA 1 or 2 for display on their respective AVVI. The commander's radar al tm 1 and 2 switch is located on panel F7, and the pilot's switch is located on panel F8. The radar altimeter on/off 1 and 2 power switches are on panel O8. Positioning radar altimeter 1 to on provides electrical power to RA 1 from main bus A; positioning radar altimeter 2 to on provides electrical power to RA 2 from main bus B.

The display scale on the commander's and pilot's AVVI raw data recorder indicators ranges from 5,000 to zero feet. Altitude is displayed on a moving tape. Above 9,000 feet, the scale will be pegged. At 1,500 feet, the raw data recorder indicator changes scale. The RA off flag will appear if there is a loss of power, loss of lock, data good-bad or after three communications faults.

Because there are only two radar altimeters on board the orbiter, the altitude data from the two units are averaged in redundancy management when the radar altimeter is used for the autoland mode.

Each radar altimeter receiver/transmitter measures 3.13 inches high, 7.41 inches long and 3.83 inches wide and weighs 4.5 pounds.

The radar altimeter contractor is Honeywell Inc., Minneapolis, Minn.

Accelerometer Assemblies - Sense vehicle acceleration along lateral and vertical axes.

There are four accelerometer assemblies aboard the orbiter, each containing two identical single-axis accelerometers, one of which senses vehicle acceleration along the lateral (left and right) vehicle Y axis while the other senses vehicle acceleration along the vertical (normal, yaw and pitch) Z axis.

The AAs provide feedback to the flight control system concerning acceleration errors, which are used to augment stability during first-stage ascent, aborts and entry; elevon load relief during first-stage ascent; and computation of steering errors for display on the commander's and pilot's attitude director indicators during terminal area energy management and approach and landing phases.

The lateral acceleration readings enable the flight control system to null side forces during both ascent and entry. The normal acceleration readings indicate the need to relieve the load on the wings during ascent. During entry, the normal acceleration measurements cue guidance at the proper time to begin ranging. During the latter stages of entry, these measurements provide feedback for guidance to control sink rate. In contrast, the accelerometers within the IMUs measure three accelerations used in navigation to calculate state vector changes.

Each accelerometer consists of a pendulum suspended so that its base is in a permanent magnetic field between two torquer magnets. A lamp is beamed through an opening in one of the torquer magnets; photodiodes are located on both sides of the other torquer magnet. When acceleration deflects the pendulum toward one photodiode, the resulting light imbalance on the two photodiodes causes a differential voltage, which increases the magnetic field on one of the torquer magnets to return the pendulum to an offset position. The magnitude of the current that is required to accomplish this is proportional to the acceleration. The polarity of the differential voltage depends on the direction of the pendulum's movement, which is opposite to the direction of acceleration. The only difference between the lateral and normal accelerometers is the position in which they are mounted within the assembly. When the acceleration is removed, the pendulum returns to the null position. The maximum output for a lateral accelerometer is plus or minus 1 g; for a normal accelerometer, the maximum output is plus or minus 4 g.

The accelerations transmitted to the forward MDMs are voltages proportional to the sensed acceleration. These accelerations are multiplexed and sent to the GPCs, where an accelerometer assembly subsystem operating program converts the eight accelerometer output voltages to gravitational units. This data is also sent to the CRTs and attitude director indicator error needles during entry.

The accelerometer assemblies provide fail-operational redundancy during both ascent and entry. The four AAs employ a quad mid value software scheme to select the best data for redundancy management and failure detection.

Accelerometer 1 is powered from main bus A through the accel 1 circuit breaker on panel O14. Accelerometer 2 is powered from main bus B through the accel 2 circuit breaker on panel O15. Accelerometer 3 is controlled by the accel 3 on/off switch on panel O16. When the switch is positioned to on, power from control buses controls remote power controllers, which supplies main bus A and main bus C to accelerometer 3. The accel 4 on/off switch on panel O15 operates similarly, except that accelerometer 4 receives power from main bus B and main bus C. The accelerometers are turned off once on orbit and on again before entry.

An RGA/accel red caution and warning light on panel F7 will be illuminated if an accelerometer fails.

The four AAs are located in crew compartment middeck forward avionics bays 1 and 2. The AAs are convection cooled and require a five-minute warm-up period.

The accelerometer contractor is Honeywell Inc., Clearwater, Fla.

Orbiter Rate Gyro Assemblies - Used by flight control system to sense roll, pitch and yaw rates during ascent and entry.

The orbiter rate gyro assemblies are used by the flight control system during ascent, entry and aborts as feedbacks to final rate errors that are used to augment stability and for display on the commander's and pilot's attitude director indicator rate needles on panels F6 and F8. The four orbiter RGAs are referred to as RGAs 1, 2, 3 and 4.

The RGAs sense roll rates (about the X axis), pitch rates (about the Y axis) and yaw rates (about the Z axis). These rates are used by the flight control system to augment stability during both ascent and entry.

Each RGA contains three identical single-degree-of-freedom rate gyros so that each gyro senses rotation about one of the vehicle axes. Thus, each RGA contains one gyro-sensing roll rate (about the X axis), one gyro-sensing pitch rate (about the Y axis) and one gyro-sensing yaw rate (about the Z axis).

Each gyro has three axes. A motor forces the gyro to rotate about its spin axis. When the vehicle rotates about the gyro input axis, a torque results in a rotation about the output axis. An electrical voltage proportional to the angular deflection about the output axis-representing vehicle rate about the input axis-is generated and transmitted through the flight aft MDMs to the GPCs and RGA SOP. This same voltage is used within the RGA to generate a counteracting torque that prevents excessive gimbal movement about the output axis. The maximum output for roll rate gyros is plus or minus 40 degrees per second; for the pitch and yaw gyros, the maximum output is plus or minus 20 degrees per second.

The RGA SOP converts the voltage rate into units of degrees per second.

The RGA 1, 2, 3 and 4 on/off power switches are located on panels O14, O15, O16 and O15, respectively. The redundant power supplies for RGAs 1 and 4 prevent the loss of more than one rate gyro assembly if main bus power is lost.

The RGAs remain off on orbit except during flight control system checkout to conserve power.

The RGAs afford fail-operational redundancy during both ascent and entry. A quad mid value software scheme selects the best data for use in redundancy management and failure detection.

The RGA/accel red caution and warning light on panel F7 will be illuminated to inform the flight crew of an RGA failure.

The RGAs are located on the aft bulkhead below the floor of the payload bay. They are mounted on cold plates for cooling by the Freon-21 coolant loops. The RGAs require a five-minute warm-up time.

The RGA contractor is Northrop Corp., Electronics Division, Norwood, Mass.

Solid Rocket Booster Rate Gyro Assemblies - Used as feedback to find rate errors from liftoff to SRB separation.

The solid rocket booster RGAs are used exclusively during first-stage ascent as feedback to find rate errors from lift-off to two to three seconds before SRB separation. There are three RGAs on each SRB, each containing two identical single-degree-of-freedom rate gyros for sensing rates in the vehicle pitch and yaw axes similar in function to the orbiter RGAs. The maximum outputs for the SRB RGAs are 10 degrees per second.

The SRB RGAs sense pitch and yaw rates, but not roll rates, during the first stage of ascent. Because the SRBs are more rigid than the orbiter body, these rates are less vulnerable to errors created by structural bending. They are thus particularly useful in thrust vector control.

The three RGAs in each SRB are mounted on the forward ring within the forward skirt near the SRB-external tank attach point.

The SRB RGA SOP converts the 12 voltages representing a rate into units of degrees per second. These rates are used by the flight control system during first-stage ascent as feedback to identify rate errors, which are used for stability augmentation. The pitch and yaw axes and a combination of rate, attitude and acceleration signals are blended to provide a common signal to the space shuttle main engines and SRB thrust vector control during first stage. In the roll axis, rate and attitude are summed to provide a common signal to the SSMEs and SRB thrust vector control.

Each of the SRB RGAs is hard-wired to a flight aft MDM to the GPCs through flight-critical buses 5, 6 and 7. In the GPCs, the SOP applies the rate compensation equation to each of the left or right pitch and yaw rates. The compensated rate signals are sent to redundancy management, where the mid value software scheme selects the best data for use and failure detection.

The SRB RGAs are commanded to null and switched out of the flight control system two to three seconds before SRB separation; SRB yaw and pitch rate data are then replaced with orbiter pitch and yaw RGA data.

The RGA/accel red caution and warning light on panel F7 will be illuminated to inform the flight crew of an RGA failure.

The RGA contractor is Northrop Corp., Electronics Division, Norwood, Mass.

RHC/Panel Enable/Inhibit - Provide signals to GPCs, prohibiting execution of related software commands while RHC is active.

The dual-redundant trim RHC/panel enable/inhibit switches on panel F3 provide signals to the GPCs, prohibiting software execution of the associated RHC and panel trim switch inputs while in the inhibit position. The enable position is not wired to the GPCs, permitting the RHC and panel trim switch inputs, which allows trimming.

When the trim RHC/panel switch on the left side of panel F3 is in enable, the commander's RHC trim switches command vehicle pitch and roll rates in major modes 304 and 305 (entry) and major modes 602 and 603 (return to launch site). The three trim switches on panel L2 for the commander are used to move the aerosurfaces in roll, pitch and yaw.

When the trim RHC/panel switch on the right side of panel F3 is in enable, the pilot's RHC trim switches command vehicle pitch and roll rates in major modes 304, 305, 602 and 603. The three trim switches on panel C3 for the pilot are used to move the aerosurfaces in roll, pitch and yaw.

Redundancy management processes the two sets of switches. If two switches generate opposing commands, the resultant trim command in that axis is zero.

Rendezvous Thrusting Maneuvers - OMS/RCS thrusting periods can be used to correct or modify the orbit as required.

Following insertion, a spacecraft's orbit is essentially fixed, although effects, such as venting and atmospheric drag, can cause orbital perturbations. OMS or RCS thrusting periods can be used to correct or modify the orbit, as required, for mission operations. The direction and magnitude of the thrusting period, as well as the time of application, determine the resulting shape of the orbit.

A posigrade thrusting period increases the speed at the point of application and will raise every point of the orbit except the thrusting point. A retrograde thrusting period decreases the speed at the point of application and will lower every point of the orbit except the thrusting point.

An out-of-plane thrusting period alters the inclination of the spacecraft's orbital plane. It does not change the vehicle's period of orbit or height above the Earth.

A radial thrusting period is one in which the thrust is applied in a direction perpendicular to the spacecraft's velocity vector and in the vehicle's orbital plane. With the vehicle in a circular orbit, a radial thrusting period would be applied along the radius vector either toward or away from the center of the Earth.

Dedicated Display Systems

Overview - Provide the flight crew with data required to fly the vehicle manually or to monitor automatic FCS performance.

The dedicated displays provide the flight crew with information required to fly the vehicle manually or to monitor automatic flight control system performance. The data on the dedicated displays may be generated by the navigation or the flight control system software or more directly by one of the navigation sensors. The dedicated displays are located in front of the commander's and pilot's seats and on the aft flight deck panel by the aft-facing windows.

The dedicated displays are the attitude director indicators on panels F6, F8 and A1; horizontal situation indicators on panels F6 and F8; alpha Mach indicators on panels F6 and F8; altitude/vertical velocity indicators on panels F6 and F8; surface position indicator on panel F7; reaction control system activity lights on panel F6; g-meter on panel F7; and head-up display on the glare-shield in front of the commander's and pilot's seats.

Not all of the dedicated displays are available in every operational sequence or major mode. Their availability is related to the requirements of each flight phase.

The display driver unit is an electronic mechanism that connects the general-purpose computers and the primary flight displays. The DDU receives data signals from the computers and decodes them to drive the dedicated displays. The unit also provides dc and ac power for the ADIs and the rotational and translational hand controllers. It contains logic for setting flags on the dedicated instruments for such items as data dropouts and failure to synchronize. The orbiter contains three DDUs: one at the commander's station, one at the pilot's station and one at the aft station.

All display parameters, regardless of their origin, are ultimately processed through the dedicated display processor software (except for the g-meter, which is totally self-contained). The display parameters are then routed to the respective displays through either a DDU or multiplexer/demultiplexer; DDUs send data to the ADI, HSI, AMI and AVVI displays, while MDMs provide data for the SPI and RCS activity lights.

There are three display driver units. One interfaces with the ADI, HSI, AVVI and AMI displays on panel F6 at the commander's station, and the second interfaces with the same instruments on panel F8 at the pilot's station. The third unit interfaces with the ADI at the aft flight station.

Associated with each DDU is a data bus select switch. The commander's switch is on panel F6, and the pilot's is on panel F8. The select switch for the aft flight station is on panel A6. Positions 1, 2, 3 and 4 allow the flight crew to select any one of four forward flight-critical data buses (FC1 through 4) as the data source for that DDU and its dedicated displays. Because the flight-critical data buses are dedicated to specific orbiter general-purpose computers, the data bus select switch also provides a means of assessing the health of individual computers, if they are assigned to FC1, 2, 3 or 4.

The commander's attitude director indicator is powered from the main bus A and B DDU circuit breakers on panels O14 and O15 through DDU 1 power supply D, which provides ac and dc power. The pilot's ADI is powered from the main B and C DDU circuit breakers on panels O15 and O16 through DDU 2 power supply D, which also provides ac and dc power. The aft flight station ADI is powered from the main A and C DDU circuit breakers on panels O14 and O16 through DDU 3 power supply D, which provides ac and dc power.

The instrument power flt MPS/off/flt switch on panel F6 supplies main bus A power to the commander's HSI, AMI and AVVI displays; the single SPI; and the main propulsion instruments when positioned to flt MPS . The instrument power on/off switch on panel F8 supplies main bus B power to the pilot's HSI, AMI and AVVI displays and the hydraulic and auxiliary power unit displays.

The RCS activity lights receive power from annunciator control assemblies.

The DDU contractor is Rockwell International, Collins Radio Group, Cedar Rapids, Iowa.

Attitude Director Indicator - Provide attitude data, including attitude rates and errors.

The commander's and pilot's ADIs are supported throughout the mission, while the aft ADI is active only during orbital operations. They give the crew attitude information as well as attitude rate and attitude errors, which can be read from the position of the pointers and needles. Each ADI has a set of switches by which the crew can select the mode or scale of the readout. The commander's switches are located on panel F6, the pilot's on panel F8 and the aft switches on panel A6.

The orbiter's attitude is displayed to the flight crew by an enclosed ball (sometimes called the eight ball) that is gimbaled to represent three degrees of freedom. The ball, covered with numbers indicating angle measurements (a zero is added as the last digit of each), moves in response to software-generated commands to depict the current orbiter attitude in terms of pitch, yaw and roll.

The ADI attitude select switch determines the unit's frame of reference: inrtl (inertial), LVLH (local vertical/local horizontal), and ref (reference). The inrtl position allows the flight crew to view the orbiter's attitude with respect to the inertial reference frame, useful in locating stars. The LVLH position shows the orbiter's attitude from an orbiter-centered rotating reference frame with respect to Earth. The ref position is primarily used to see the orbiter's attitude with respect to an inertial reference frame defined when the flight crew last depressed the att ref push button. It is useful when the crew flies back to a previous attitude or monitors a maneuvering system thrusting period for attitude excursions. The two forward switches are active during ascent, orbital and transition flight phases but have no effect during entry, the latter part of a return to launch site or phases when the backup flight system is driving the ADIs. The aft switch, like the aft ADI, is operational only in orbit.

Each attitude director indicator has a set of three rate pointers that provide a continuous readout of vehicle body rotational rates. Roll, pitch and yaw rates are displayed on the top, right and bottom pointers, respectively. The center mark on the graduated scale next to the pointers shows zero rates, while the rest of the marks indicate positive or negative rates. The adi rate switch for each indicator unit determines the magnitude of full-scale deflection. When this switch is positioned to high (the coarsest setting), the pointer at the end of the scale represents a rotation rate of 10 degrees per second. When the switch is positioned to med, a full-range deflection represents 5 degrees per second. In the low position (the finest setting), a pointer at either end of the scale is read at a rate of 1 degree per second. These pointers are ''fly to'' in the sense that the rotational hand controller must be moved in the same direction as the pointer to null a rate.

ADI rate readings are independent of the selected attitude reference. During ascent, the selected rates come directly from the solid rocket booster or orbiter rate gyros to the ADI processor for display on the rate pointers. During entry, only the pitch rate follows the direct route to the ADI display. The selected roll and yaw rates first flow through flight control, where they are processed and output to the ADI as stability roll and yaw rates. (This transformation is necessary because, in aerodynamic flight, control is achieved about stability axes, which in the cases of roll and yaw differ from body axes.)

Three needles on each attitude director indicator display vehicle attitude errors. These needles extend in front of the ADI ball, with roll, pitch and yaw arranged just as the rate pointers are. Like the rate indicators, each error needle has a background scale with graduation marks that allow the flight crew to read the magnitude of the attitude error. The errors are displayed with respect to the body-axis coordinate system and, thus, are independent of the selected reference frame of the attitude display.

The ADI error needles are driven by flight control outputs that show the difference between the required and current vehicle attitude. These needles are also ''fly to,'' meaning that the flight crew must maneuver in the direction of the needle to null the needle. For example, if the pitch error needle points down, the flight crew must manually pitch down to null the pitch attitude error. The amount of needle deflection indicating the number of degrees of attitude error depends upon the adi error switch for each ADI. In the high position, the error needles represent 10 degrees, med represents 5 degrees and low represents 1 degree.

At the aft flight station on panel A6, the aft sense switch allows the flight crew to use the aft ADI, RHC and translational hand controller in a minus X or minus Z control axis sense. These two options of the aft ADI and hand controllers correspond to the visual data out of the aft viewing (negative X) or overhead viewing (negative Z) windows.

Each ADI has a single flag labeled off on the left side of the display whenever any attitude drive signal is invalid. There are no flags for the rate and error needles; these indicators are driven out of view when they are invalid.

The ADI contractor is Lear Siegler, Grand Rapids, Mich.

Horizontal Situation Indicator - Displays a pictorial view of the vehicle's position.

The horizontal situation indicator for the commander and pilot displays a pictorial view of the vehicle's position with respect to various navigation points and shows a visual perspective of certain guidance, navigation and control parameters, such as directions, distances and course/glide path deviation. The flight crew uses this information to control or monitor vehicle performance. The HSIs are active during the entry and landing and ascent/RTLS phases.

Each HSI provides an independent source to compare with ascent and entry guidance, a means of assessing the health of individual navigation aids during entry and information needed by the flight crew to fly manual ascent, RTLS and entry.

Three switches are associated with each horizontal situation indicator. The commander's select switches are on panel F6 and the pilot's are on panel F8. The HSI select mode switch selects the mode-entry, TACAN or approach. The HSI select source switch selects TACAN, navigation or microwave scan beam landing system; its 1, 2, 3 switch selects the data source. When positioned to nav, the HSI is supplied with data from the navigation attitude processor and the 1, 2, 3 switch is not used. In TACAN, the HSI is supplied with data derived from the 1, 2, 3 switch, thus TACAN 1, 2 or 3. In MLS , the HSI is supplied with data derived from the 1, 2, 3 switch, thus MLS 1, 2 or 3.

Each HSI displays magnetic heading (compass card), selected course, runway magnetic course, course deviation, glide slope deviation, primary and secondary bearing, primary and secondary range, and flags to indicate validity.

Each HSI consists of a case-enclosed compass card measuring zero to 360 degrees. At the center of the compass card is an aircraft symbol, fixed with respect to the case and about which the compass card rotates.

The magnetic heading (the angle between magnetic north and vehicle direction measured clockwise from magnetic north) is displayed by the compass card and read under the lubber line located at the top of the indicator dial. (A lubber line is a fixed line on a compass aligned to the longitudinal axis of the craft.) The compass card is positioned at zero degrees (north) when the heading input is zero. When the heading point is increased, the compass card rotates counterclockwise.

The course pointer is driven with respect to the HSI case rather than the compass card. Therefore, a course input (from the DDU) of zero positions the pointer at the top lubber line, regardless of compass card position. To position the course pointer correctly with respect to the compass card scale, the software must subtract the vehicle magnetic heading from the runway azimuth angle (corrected to magnetic north). As this subtraction is done continuously, the course pointer appears to rotate with the compass card, remaining at the same scale position. An increase in the angle defining runway course results in a clockwise rotation of the course pointer.

Course deviation is an angular measurement of vehicle displacement from the extended runway centerline. On the HSI, course deviation is represented by the deflection of the deviation bar from the course pointer line. Full scale on the course deviation scale is plus or minus 10 degrees in terminal area energy management and plus or minus 2.5 degrees during approach and landing. The course deviation indicator is driven to zero during entry. When the course deviation input is zero, the deviation bar is aligned with the end of the course pointer. With the pointer in the top half of the compass card, an increase in course deviation to the left (right) causes the bar to deflect the right (left). Therefore, the course deviation indicator is a fly-to indicator for flying the vehicle to the extended runway centerline. Software processing also ensures that the CDI remains fly to, even when the orbiter is heading away from the runway.

In the TAEM example, at a range of 9 nautical miles (10 statute miles), the CDI would read about 7.5 degrees, with the extended runway centerline to the right of the orbiter. In course deviation geometry, if the orbiter is to the left of the runway, it must fly right (or if the orbiter is to the right of the runway, it must fly left) to reach the extended runway centerline. The corresponding course deviation bar would deflect to the right (or to the left in the latter case). The reference point at the end of the runway is the microwave landing system station. The sense of the CDI deflection is a function of vehicle position rather than vehicle heading.

Glide slope deviation, the distance of the vehicle above or below the desired glide slope, is indicated by the deflection of the glide slope pointer on the right side of the HSI. An increase in glide slope deviation above (below) the desired slope deflects the pointer downward (upward); the pointer is a fly-to indicator. In the HSI example, the pointer shows the vehicle to be below the desired glide slope by about 4,000 feet (in TAEM, each dot represents 2,500 feet).

The "desired glide slope" is actually only a conceptual term in HSI processing. At any instant, glide slope deviation is really the difference between the orbiter altitude and a reference altitude computed in the same fashion as the guidance reference altitude. Also included in the reference altitude equation are factors for a "heavy orbiter" and for high winds.

The GSI computation is not made during entry or below 1,500 feet during approach and landing; therefore, the pointer is stowed and the GSI flag is displayed during those intervals.

The primary and secondary bearing pointers display bearings relative to the compass card. These bearings are angles between the direction to true or magnetic north and to various reference points as viewed from the orbiter. For the bearing pointers to be valid, the compass card must be positioned in accordance with vehicle heading input data.

When the bearing inputs are zero, the pointers are at the top lubber line, regardless of compass card position. Like the course pointer, the bearing pointer drive commands are developed by subtracting the vehicle heading from the calculated bearing values. This allows the pointers to be driven with respect to the HSI case but still be at the correct index point on the compass card scale. When the bearing inputs are increased, the pointers rotate clockwise about the compass card. The pointer does not reverse when it passes through 360 degrees in either direction.

For example, if the primary bearing is 190 degrees and the secondary bearing is 245 degrees, the bearing reciprocals are always 180 degrees from (opposite) the pointers. The definition of primary and secondary bearing varies with the flight regime.

The HSI is capable of displaying two four-digit values in the upper left and right side of its face. These numbers are called primary and secondary range, respectively. Each display ranges from zero to 3,999 nautical miles (4,602 statute miles). While their meaning depends on the flight regime, both numbers represent range in nautical miles from the vehicle to various points relative to the primary and secondary runways. In the HSI example, the primary range is 9 nautical miles (10 statute miles); the barberpole in the secondary range slot is an invalid data indication.

The HSI has four flags- off, brg (bearing), GS (glide slope) and CDI-and two barberpole indications that can respond to separate DDU commands, identifying invalid data. Off indicates that the entire HSI display is invalid because of insufficient power. Brg indicates invalid course, primary bearing, and/or secondary bearing data. GS indicates invalid glide slope deviation. CDI indicates invalid course deviation data. Barberpole in the range slots indicates invalid primary or secondary range data.

When the HSI source switch is in nav , the entire HSI display is driven by navigation-derived data from the orbiter state vector. This makes the HSI display dependent on the same sources as the navigation software (IMU, selected air data, selected navigational aids), but the display is independent of guidance targeting parameters. As stated previously, when the TACAN/nav/MLS switch is in the nav position, the source 1, 2, 3 switch is not processed.

The TACAN or MLS position of the source switch should be used only when TACAN or MLS data are available. TACAN data can be acquired in Earth orbit but would be unavailable during blackout; therefore, TACAN is generally not selected until acquisition after blackout. MLS has a range of 20 nautical miles (23 statute miles) and is normally selected after the orbiter is on the heading alignment cylinder.

The glide slope deviation pointer is stowed when the entry mode is selected and the flag is displayed. The GSI in TAEM indicates deviation from guidance reference attitude in plus or minus 5,000 feet. The GSI in approach indicates guidance reference altitude for approach and landing in plus or minus 1,000 feet; it is not computed below 1,500 feet and the flag deploys.

In the entry mode, the compass card heading indicates the magnetic heading of the vehicle's relative velocity vector. In TAEM and approach, the compass card indicates magnetic heading of the body X axis.

In the entry mode, the course deviation indicator is a valid software zero with no flag. In TAEM, the CDI indicates the deviation from the extended runway centerline, plus or minus 10 degrees. In approach, the CDI indicates the deviation from the extended runway centerline, plus or minus 2.5 degrees.

In the entry mode, the primary bearing indicates the spherical bearing to way point 1 for the nominal entry point at the primary landing runway. The secondary bearing indicates the spherical bearing to WP-1 for the NEP to the secondary landing runway. In TAEM, the primary bearing indicates the bearing to WP-1 on selected HAC for the primary runway. The secondary bearing indicates the bearing to the center of the selected HAC for the primary runway. In approach, the primary and secondary bearings indicate the bearing to WP-2 at the primary runway.

In the entry mode, the primary range indicates the spherical surface range to WP-2 on the primary runway via WP-1 for NEP. The secondary range indicates the spherical surface range to WP-2 on the secondary runway via WP-1 for NEP. In TAEM, the primary range indicates the horizontal distance to WP-2 on the primary runway via WP-1. The secondary range indicates the horizontal distance to the center of the selected HAC for the primary runway. In approach, the primary and secondary ranges indicate the horizontal distance to WP-2 on the primary runway.

During ascent major modes 102 and 103 (first and second stage) and RTLS, the horizontal situation indicator provides information about the target insertion orbit. The compass card displays heading with respect to TIO, and north on the compass card points along the TIO plane. The heading of the body plus X axis with respect to the target insertion orbit is read at the lubber line.

The course pointer provides the heading of the Earth-relative velocity vector with respect to the TIO plane. The CDI deflection indicates the estimated sideslip angle, the angle between the body X axis and the relative velocity vector.

The primary bearing pointer during major modes 102 and 103 is fixed on the compass card at a predetermined value to provide a turnaround heading in the event of an RTLS abort. During RTLS major mode 601, the pointer indicates the heading to the landing site runway. The secondary bearing provides the heading of the inertial velocity vector with respect to the TIO plane.

The horizontal situation CRT display allows the flight crew to configure the software for nominal winds or high head winds. The software item entry determines the distance from the runway threshold to the intersection of the glide slope with the runway centerline. The high-wind entry pushes the intercept point close to the threshold. The distance selected is factored into the computation of reference altitude from which the GSI is derived.

The HSI contractor is Rockwell International, Collins Radio Group, Cedar Rapids, Iowa.

Alpha Mach Indicator - Display vehicle angle of attack.

The two alpha Mach indicators are located next to the attitude director indicators on panels F6 and F8. The AMIs consists of four tape meters displaying angle of attack ( alpha ), vehicle acceleration (accel), vehicle velocity ( M/vel ) and equivalent airspeed ( EAS ). The two units are driven independently but can have the same data source.

Alpha displays vehicle angle of attack, defined as the angle between the vehicle plus X axis and the wind-relative velocity vector (negative wind vector). Alpha is displayed by a combination moving scale and moving pointer. For angles between minus 4 degrees and plus 28 degrees, the scale remains stationary and the pointer moves to the correct reading. For angles less than minus 4 degrees or greater than plus 28 degrees, the pointer stops (at minus 4 or plus 28 degrees) and the scale moves so that the correct reading is adjacent to the pointer. The alpha tape ranges from minus 18 to plus 60 degrees with no scale changes. The negative scale numbers (below zero) have no minus signs; the actual tape has black markings on a white background on the negative side and white markings on a black background on the positive side.

The accel scale displays vehicle drag acceleration, which is the deceleration along the flight path. This is a moving tape upon which acceleration is read at the fixed lubber line. The tape range is minus 50 to plus 100 with a scale change at zero feet per second squared. Minus signs are assumed on the accel scale also; the negative region has a black background and the positive side has a white background.

The M/vel scale displays Mach number or relative velocity. Mach number is the ratio of vehicle airspeed to the speed of sound in the same medium. Relative velocity in this case is the vehicle airspeed. The actual parameter displayed is always Mach number; the tape is simply rescaled above Mach 4 to read relative velocity in thousands of feet per second (above 2,000 feet per second, Mach number = V REL /1,000). The M/vel scale is a moving tape from which Mach/velocity is read at the fixed lubber line. The scale ranges from zero to 27 with a scale change at Mach 4.

The EAS scale is used to display equivalent airspeed. On the moving-tape scale, equivalent airspeed is read at the fixed lubber line. The tape range is zero to 500 knots, and scaling is 1 inch per 10 knots.

Each scale on the AMI displays an off flag if the indicator malfunctions, invalid data are received at the DDU or a power failure occurs (all flags appear).

The air data source select switch on panel F6 for the commander and panel F8 for the pilot determines the source of data for the AMI and altitude/vertical velocity indicator. The nav position of the air data switch ensures that the alpha , Mach and EAS on the AMI are the same parameters sent to guidance, flight control, navigation and other software users; accel comes from navigation software.

The left, right position of the air data switch selects predetermined data from the left or right air data probe assembly after deployment of the left and right air data probes at Mach 3 for alpha, M/vel and EAS display. Accel is always derived from navigation software during entry. It is driven to zero during terminal area energy management and approach and landing.

Altitude/Vertical Velocity Indicators - Displays vertical acceleration, vertical velocity, barometric altitude and radar altitude.

The altitude/vertical velocity indicators are located on panel F6 for the commander and panel F8 for the pilot. These indicators display vertical acceleration (alt accel), vertical velocity (alt rate), barometric altitude (alt) and radar altitude (rdr alt).

The alt accel indicator, which displays altitude acceleration of the vehicle, is read at the intersection of the moving pointer and the fixed scale. The scale range is minus 13.3 to 13.3 feet per second squared, and the scaling is 6.67 feet per second squared per inch. Software limits acceleration values to plus or minus 12.75 feet per second squared.

The alt rate scale displays vehicle altitude rate, which is read at the intersection of the moving tape and the fixed lubber line. The scale range is minus 2,940 to plus 2,940 feet per second with scale changes at minus 740 feet per second and plus 740 feet per second. The negative and positive regions are color-reversed: negative numbers are white on a black background and positive numbers are black on white.

The alt scale, a moving tape read against a fixed lubber line, displays the altitude of the vehicle above the runway (barometric altitude). The scale range is minus 1,100 feet to plus 165 nautical miles (189 statute miles), with scale changes at minus 100, zero, 500 feet and plus 100,000 feet. The scale is in feet from minus 1,100 to plus 400,000 and in nautical miles from plus 40 to plus 165 (46 to 189 statute miles). Feet and nautical miles overlap from plus 40 to plus 61 nautical miles (46 to 70 statute miles).

The rdr alt scale is a moving tape read against a fixed lubber line. It displays radar altitude (corrected to wheels) during major mode 305, below 9,000 feet (normally not locked in until below 5,000 feet; prior to radar altimeter lock-on, the meter is ''parked'' at 5,000 feet). The scale ranges from zero to 9,000 feet with a scale change at 1,500 feet. Each scale on the AVVI displays an off flag in the event of indicator malfunction, invalid data received at the DDU or power failure (all flags appear).

With the air data source switch in the nav position, the alt accel, alt rate, and alt scales are navigation-derived. The rdr alt indicator is controlled by the radar altm switch on panel F6 for the commander and panel F8 for the pilot. Radar altm positioned to 1 selects radar altimeter 1; 2 selects radar altimeter 2.

The air data switch is positioned to left or right to select the right or left air data probe, respectively, after air data probe deployment at Mach 3. The alt and alt rate scales receive information from the selected air data probe. Alt accel receives navigation data. The rdr alt scale receives data from the radar alt select switch.

Surface Position Indicator - Displays actual and commanded positions of elevons, body flap, rudder, aileron and speed brake.

The surface position indicator is a single display on panel F7 that is active during entry and during the entry portion of RTLS. The SPI displays the actual and commanded positions of the elevons, body flap, rudder, aileron and speed brake.

The four elevon position indicators show the elevon positions in the order of appearance as viewed from behind the vehicle (from left to right: left outboard, left inboard, right inboard, right outboard). The scales all range from plus 20 to minus 35 degrees, which are also the software limits to the elevon commands. The pointers are driven by four separate signals and can read different values, but normally the left pair is identical and the right pair is identical. Positive elevon is below the null line and negative is above.

The body flap scale reads body flap positions from zero to 100 percent of software-allowed travel. Zero percent corresponds to full up (minus 11.7 degrees); 100 percent corresponds to full down (plus 22.5 degrees). The small pointer at 35 percent is fixed and shows the trail position.

Rudder position is displayed as if viewed from the rear of the vehicle. Deflection to the left of center represents left rudder. The scale is plus 30 degrees (left) to minus 30 degrees (right), but software limits the rudder command to plus or minus 27.1 degrees.

The aileron display measures the effective aileron function of the elevons in combination. Aileron position equals the average of the left and right elevon divided by two. Deflection of the pointer to the right of center indicates a roll-right configuration (left elevons down, right elevons up) and vice versa. The scale is minus 5 to plus 5 degrees, with minus 5 at the left side. The aileron command can exceed plus or minus 5 degrees (maximum plus or minus 10 degrees), in which case the meter saturates at plus or minus 5 degrees.

The speed brake position indicator indicates the actual position on the upper scale and commanded position on the lower scale. The position ranges zero to 100 percent; zero percent is fully closed and 100 percent is fully open, which corresponds to 98 degrees with respect to the hinge lines. The small point at 25 percent is fixed and represents the point at which the speed brake surfaces and the remainder of the tail form a smooth wedge.

The speed brake command is scaled identically to position and has the same travel limits. It always represents the speed brake auto guidance command. The off flag is set only for internal meter problems or during OPS 8 display checkout.

Flight Control System Push Button Indicators - Transmit moding requests to digital autopilot.

These indicators are located on panel F2 for the commander and panel F4 for the pilot. The flight control system's push button light indicators transmit flight crew moding requests to the digital autopilot in the flight control software and reflect selection by illuminating the effective DAP state.

The push button light indicators are used to command and reflect the status of the pitch control mode. The pitch and roll/yaw indicators transmit moding requests to the digital autopilot and indicate the effective state of the pitch, roll and yaw DAP channels by lighting.

Auto indicates that control is automatic and no crew inputs are required. CSS is control stick steering; crew inputs are required but are smoothed by the DAP (stability augmentation, turn coordination).

The spd brk/throt (speed brake/throttle) push button light indicator has two separate lights, auto and man (manual), to indicate that the DAP speed brake channel is in the automatic or manual mode. The push button light indicator transmits only the auto request.

The body flap push button light indicator also has separate auto and man lights, indicating the state of the body flap channel. Like the spd brk/throt push button light indicator, the body flap indicator transmits only the auto request.

RCS Command Lights - Indicate RCS jet comands by axis and direction.

The reaction control system command lights on panel F6 are active during the entry and RTLS flight phases. Their primary function is to indicate RCS jet commands by axis and direction; secondary functions are to indicate when more than two yaw jets are commanded and when the elevon drive rate is saturated.

During major modes 301 through 304, up until the roll jets are no longer commanded (dynamic pressure exceeds 10 pounds per square foot), the roll l and r lights indicate that left or right roll commands have been issued by the DAP. The minimum light-on duration is extended so that the light can be seen even during minimum-impulse firings. When dynamic pressure is greater than or equal to 10 pounds per square foot, the roll lights are quiescent until 50 pounds per square foot, after which time both lights are illuminated whenever more than two yaw jets are commanded on.

The pitch u and d lights indicate up and down pitch jet commands until dynamic pressure equals 20 pounds per square foot, after which the pitch jets are no longer used. When dynamic pressure is 50 pounds per square foot or more, the pitch lights, like the roll lights, assume a new function: both light whenever the elevon surface drive rate exceeds 20 degrees per second (10 degrees per second if only one hydraulic system is left).

The yaw l and r lights function as yaw jet command indicators throughout entry until the yaw jets are disabled at Mach 1. The yaw lights have no other functions.

G-Meter - Senses linear acceleration along the Z axis of the vehicle.

The g-meter is a self-contained accelerometer and display unit mounted on panel F7. It senses linear acceleration along the Z axis (normal) of the vehicle. A mass weight in the unit is supported vertically by two guide rods and is constrained by a constant-rate helical spring. The inertial force of the mass is proportional to the inertial force of the vehicle and, hence, to the input acceleration, under conditions of constant acceleration. Displacement of the mass is translated to pointer displacement through a rack-and-pinion gear train whose output is linear with input acceleration. The display indicates acceleration from minus 2 g's to plus 4 g's. The g-meter requires no power and has no software interface. Like all the dedicated displays, it has an external variable incandescent lamp.

Head-up Display - Optical miniprocessor that cues the commander during final landing approach.

The head-up display is an optical miniprocessor that cues the commander and/or pilot during the final phase of entry and particularly in the final approach to the runway. With minimal movement of their eyes from the forward windows (head up) to the dedicated display instruments (head down), the commander and pilot can read data from HUDs located in front of them on their respective glareshields. The HUD displays the same data presented on several other instruments, including the ADI, SPI, AMI and AVVI.

The HUD allows out-of-the-window viewing by superimposing flight commands and information on a transparent combiner in the window's field of view. The baseline orbiter, like most commercial aircraft, presents conventional electromechanical display on a panel beneath the glareshield, which necessitates that the flight crew look down for information and then up to see out the window. During critical flight phases, particularly approach and landing, this is not an easy task. In the orbiter, with its unique vehicle dynamics and approach trajectories, this situation is even more difficult.

Since the orbiter is intended to be in service for several years, the addition of a HUD was considered appropriate. Most recent military aircraft include HUD systems, as do several European airliners. Additionally, since the display portion of some existing HUD systems could be easily installed in the orbiter, the HUD system requirements for the orbiter were patterned after existing hardware to minimize development costs.

While the display portion of the orbiter system could be similar to existing HUD systems, the drive electronics could not. Since the orbiter avionics systems are digital and minimal impact on the orbiter was paramount, the HUD drive electronics were designed to receive data from the orbiter data buses. Most existing HUD drive electronics use analog data or a combination analog/digital interface. In the orbiter system, the HUD drive electronics utilize, to the maximum extent possible, the same data that drive the existing electromechanical display devices.

The orbiter display device, designed by Kaiser Electronics of San Jose, Calif., uses a CRT to create the image, which is then projected through a series of lenses onto a combining glass (a system very similar to one they developed and produce for the Cobra jet aircraft). Certain orbiter design requirements, such as vertical viewing angles, brightness and unique mounting, dictated some changes from the Cobra configuration.

A HUD power on/off switch located on the left side of panel F3 provides and terminates electrical power to the commander's HUD. The same switch is also located on the right side of panel F3 for the pilot's HUD.

Each HUD is a single-string system but connected to two data buses for redundancy. It is an electronic/optical device with two sets of combiner glasses located above the glareshield in the direct line of sight of the commander and the pilot. Essential flight information for vehicle guidance and control during approach and landing is projected on the combiner glasses and collimated at infinity.

For example, looking through the HUD and out the window in the final phase of the preflare maneuver, the commander might see EAS = 280 knots (left scale), altitude = 500 feet (right scale), and orbiter heading ( + ) slightly to the left of runway centerline, which indicates a light crosswind from the left. The velocity vector symbol is just crossing the runway overrun. The guidance diamond is centered inside the velocity vector symbol. The flare triangles on the wing tips indicate that the pilot is following the flare command precisely. The lighted outline of the start of the runway zone appears at the top of the combiner. The HUD can display speed brake command and position; discrete messages, such as gear; and, during rollout, deceleration and wing-leveling parameters.

The images, generated by a small CRT and passed through a series of lenses, are displayed to the flight crew on the combiners as lighted symbology. The transmissiveness of the combiner allows the crew to look through it and see actual targets like the runway.

For instance, if the crew is conducting an instrument approach at 7,000 feet on the final approach course in a solid overcast, the base of which is at 5,000 feet, the lighted outline of the runway would be displayed on the combiner. However, when the orbiter exits the overcast at 5,000 feet, the lighted outline of the runway would be superimposed on the real runway. As the orbiter proceeds down the steep glide slope, the velocity vector is superimposed over the glide slope aim point. At preflare altitude, flare triangles move up to command the pullout. The pilot maintains the velocity vector symbol between the triangles. After a short period of stabilized flight on the shallow glide slope, the guidance diamond commands a pitch-up until the nose is about 8 degrees above the horizon, which is essentially the touchdown attitude. After touchdown, during the rollout phase, the crew maintains the approximate touchdown attitude, plus 6 degrees theta (nose above the horizon), until 180 knots equivalent airspeed and then commands a derotation maneuver.

The HUD has proved to be a valuable landing aid and is considered the primary pilot display during this critical flight phase.