Malfunction Detection

There are three separate means of detecting malfunctions within the main propulsion system: the engine controllers, the caution and warning system and the GPCs.

The engine controller, through its network of sensors, has access to numerous engine operating parameters. A group of these parameters has been designated critical operating parameters, and special limits defined for these parameters are hard-wired and limit sensed within the caution and warning system. If a violation of any limit is detected, the caution and warning system will illuminate the red MPS caution and warning light on panel F7. The light will be illuminated by an MPS engine liquid oxygen manifold pressure above 249 psia; an MPS engine liquid hydrogen manifold pressure below 28 psia or above 60 psia; an MPS center, left or right helium pressure below 1,150 psia; an MPS center, left or right helium regulated pressure above 820 psia; or an MPS left, center or right helium delta pressure/delta time above 29 psia. Note that the flight crew can monitor the MPS press helium pneu, l, c, r meter on panel F7 when the switch is placed in the tank or reg position. The MPS press eng manf LO 2 , LH2 meter can also be monitored on panel F7. A number of the conditions will require crew action. For example, an MPS engine liquid hydrogen manifold pressure below the minimum setting will require the flight crew to pressurize the external liquid hydrogen tank by setting the LH2 ullage press switch on panel R2 to open , and a low helium pressure may require the flight crew to interconnect the pneumatic helium tank and the engine helium tanks using the MPS He interconnect valve switches on panel R2 for the engine helium system that is affected.

The engine controller also has a self-test feature that allows it to detect certain malfunctions involving its own sensors and control devices. For each of the three engines, a yellow main engine status left, ctr, right light (lower half) on panel F7 will be illuminated when the corresponding engine helium pressure is below 1,150 psia or regulated helium pressure is above 820 psia.

The lower half of the main engine status left, ctr, right light on panel F7 may also be illuminated by the SSME SOP (GPC- detected malfunctions). The yellow light may be illuminated due to an electronic hold, hydraulic lockup, loss of two or more command channels or command reject between the GPC and the SSME controller, or loss of both data channels from the SSME controller to the GPC of the corresponding engine. In an electronic hold for the affected SSME, loss of data from both pairs of the four fuel flow rate sensors and the four chamber pressure sensors will result in the propellant valve actuators being maintained electronically in the positions existing at the time the second sensor failed. (To fail both sensors in a pair, it is only necessary to fail one sensor.) In the case of either the hydraulic lockup or an electronic hold, all engine-throttling capability for the affected engine is lost; thus, subsequent throttling commands to that engine will not change the thrust level.

The red upper half of the main engine status left, ctr, right light on panel F7 will be illuminated if the corresponding engine's high-pressure oxidizer turbine's discharge temperature is above 1,760 degrees R, the main combustion chamber's pressure is below 1,000 psia, the high-pressure oxidizer turbopump's intermediate seal purge pressure is below 170 or above 650 psia, or the high-pressure oxidizer turbopump's secondary seal purge pressure is below 5 or above 85 psia. Because of the rapidity with which it is possible to exceed these limits, the engine controller has been programmed to sense the limits and automatically cut off the engine if the limits are exceeded. Although a shutdown as a result of violating operating limits is normally automatic, the flight crew can, if necessary, inhibit an automatic shutdown through the use of the main engine limit shut dn switch on panel C3. The switch has three positions: enable, auto and inhibit. The enable position allows only the first engine that violates operating limits to be shut down automatically. If either of the two remaining engines subsequently violates operating limits, it would be inhibited from automatically shutting down. The inhibit position inhibits all automatic shutdowns. The main engine shutdown left, ctr, right push buttons on panel C3 have spring-loaded covers (guards). When the guard is raised and the push button is depressed, the corresponding engine shuts down immediately.

The backup caution and warning processing of the orbiter GPCs can detect certain specified out-of-limit or fault conditions of the MPS. The backup C/W alarm light on panel F7 is illuminated, a fault message appears on all CRT displays, and an audio alarm sounds if the MPS engine liquid oxygen manifold pressure is zero or above 29 psia; the MPS engine liquid hydrogen manifold pressure is below 30 or above 46 psia; the MPS left, center or right helium pressure is below 1,150 psia; or the MPS regulated left, center or right helium pressure is below 680 or above 820 psia. This is identical to the parameter limit sensed by the caution and warning system; thus, the MPS red light on panel F7 will also be illuminated.

The SM alert indicator on panel F7 is illuminated, a fault message appears on all CRT displays, and an audio alarm is sounded when MPS malfunctions/conditions are detected by the SSME SOP or special systems-monitoring processing. The first four conditions are detected by the SSME SOP and are identical to those that illuminate the yellow lower light of the respective main engine status light on panel F7 due to electronic hold, hydraulic lockup, loss of two or more command channels or command reject between the GPC and the SSME controller, or loss of both data channels from the SSME controller to the orbiter GPC. The last four conditions are special systems-monitoring processing and illuminate the SM alert light on panel F7, sound an audio alarm and provide a fault message on all CRTs because of an external tank liquid hydrogen ullage pressure below 30 psia or above 46 psia or an external tank liquid oxygen ullage pressure of zero or above 29 psia. (Note that the main engine status lights on panel F7 will not be illuminated.)