SlideShare utilise les cookies pour améliorer les fonctionnalités et les performances, et également pour vous montrer des publicités pertinentes. Si vous continuez à naviguer sur ce site, vous acceptez l’utilisation de cookies. Consultez nos Conditions d’utilisation et notre Politique de confidentialité.
SlideShare utilise les cookies pour améliorer les fonctionnalités et les performances, et également pour vous montrer des publicités pertinentes. Si vous continuez à naviguer sur ce site, vous acceptez l’utilisation de cookies. Consultez notre Politique de confidentialité et nos Conditions d’utilisation pour en savoir plus.
Electrical Systems inMissiles and spacevehicles Now that space operations have become a reality, it is appropriate to review the accomplishments of the past and to discuss what must be done in the future to insure the operational readiness of our large carrier vehicle systems. Well-planned overall systems engineering is the key to this task, with electrical systems engineering playing a major subsidiary role. When missiles were introduced on a relatively large scale some 25 years ago overall electrical systems engineering did not exist as such, although with theV2 missile the systems approach was being utilized for the first time. In those days the designers of the propulsion system provided for the systems electrical needs by maintaining the required start and cutoff sequence. The designers of the guidance and control system worked their own electrical system and took care of the electrical equipment needed for the checkout and launch operations. Missiles resulting from this parallel design effort were operational; but to. build, checkout, and prepare them for Launching was very expensive and time consuming. Relatively early in the research and development phase of the V2 program the entire system was evaluated for large-scale production. This evaluation showed that it was impossible to supply all the electrical components needed to achieve the requested production rates. For the first time, this created the need for a coordinated overall systems approach which considered checkout equipment and the missile as one system. Duplication of functional components, signals, power sources, etc., was avoided to simplify the system as much as possible. The requirements placed on the overall system created the need for a systems engineer who was required to have a thorough knowledge of the various subsystems, their operation, and functions. A philosophy was established which has been followed since: "Keep the missile system simple; wherever possible, keep components out of the missile, especially if they only function during pre- flight checkouts." Under these conditions, the entire V2 system was redesigned. 1
Aside from production considerations,operational simplicity was of major concern. Checkout and launch operationsduring the research and development phase were carried out by the designersthemselves or by high-caliber, technically trained personnel. In combatapplication, the system being operated by troops had to be self-checking andautomated in its launch sequence. The V2 system at the end of World War II wasa classical example of functional simplicity with a minimum amount ofcomponents. The actual launch operation was simplified to only two pushbuttons:one to start the launch sequence, and one to start the full flow of propellants. Theentire launch sequence was self-checking and returned the system to a safecondition if a malfunction was sensed during this time before launch. Alloperational missile systems today essentially follow this pattern of operationalsequence.In-flight instrumentation systems were refined more and more after World war II,and missile behavior as well as environmental conditions during the entire flightphase were observed through radio links. This possibility of telemetry coverageopened a new area for missile" design engineers to obtain valuable data for furtherstudy programs. Theoretical data could be hardened by actual data, and valuescould be obtained for the anticipated new missile programs. Within the last 15years, the measuring program expanded from between 30 and 40 measurements tobetween 500 and 600 measurements per test flight. All these measuring programshad to be incorporated into the overall system in such a way as to not interferewith the standard system necessary for proper flight performance. A malfunctionin the instrumentation system should not influence in any way the behavior of thestandard system. However, the instrumentation system was required to function aslong as possible to record catastrophic failures, such as fire in the engine area,control failures, etc., that would eventually lead to a flight failure. This systems-approach worked very satisfactorily in programs like Redstone, Jupiter, andPershing. There were few failures which could not be explained. The telemetryrecords gave perfect coverage and usually a quick explanation.As the missile systems expanded in size and complexity, the checkout time andthe time required for launch readiness also increased. The" constant changes fromone missile to a more advanced missile demanded exacting checkout, test, andfiring procedures. Event sequencing had to be dictated that could be achieved onlyby designing all tests and sequence events into the system. Whenever possible, thehuman element was eliminated in all critical phases of checkout and launch. Thiseffort was well spent, judging from the results of the various missile programs ofthe last 5 years. It is not a major problem today to prepare a satellite on a certainday, or even hour of the day, for firing and injection into orbit. It- is taken for 2
granted that the entire. system is reliable enough to meet a specified countdowntime. It cannot always be assumed, however, that a missile takes off from itslaunch pad and stays on its prescribed trajectory. Special precautions arenecessary as directed by the safety officer of the missile range.An entirely independent and redundant system has been designed over the years asa tool for the safety officer to maintain full control over the missile. He must beable at any time during the propelled flight phase to cutoff thrust or to destroy theentire missile if he decides that this is necessary for safety reasons. This systemmust work under any condition possible in the flying missile such as powerfailure, structure breakup, or other failures. The various requirements in theknown missile program, such as 15-min readiness, automation to any degree, andself-checking of subsystems and components, lead to standardization andrefinement of the entire system to achieve reliability. Only after the achievementof this reliability was it possible to plan for the placing of man into space.Project Mercury was established and funded based on reliable missile systems.The primary missions of Project Mercury are the orbiting of manned capsulesaround the Earth, the study of mans capabilities in space flight, and the safe returnof the capsules and their occupants to the surface. The program was divided intotwo main phases: (1) to use the modified Redstone carrier for suborbitalunmanned and manned capsule flights to help qualify the Mercury capsule in aspace environment, and (2) to carry out unmanned and manned orbital flights withthe qualified Mercury capsule being boosted by an Atlas ICBM.It was necessary to analyze the entire flight history of the two systems to establisha malfunction study that showed where systems improvements were desirable andpossible. Parallel to this study, an abort-sensing philosophy was established toprovide, during the total countdown and flight, the utmost in safe abort for theman in the capsule and for the launch crew at the pad.A new design aspect entered the overall systems design; this was the concernabout the man. Electrical checkout and functional circuits, well established inprevious flights, had to be reanalyzed and redesigned because the safety of ahuman life was involved. Automatic abort sensing during the countdown andcarrier vehicle flight was to be incorporated into an existing system. Since twoindependent systems were involved, carrier vehicle and capsule, close technicalcoordination was essential. In the preflight condition, up to liftoff, anymalfunction had to result in the "safing" of the entire system or ,ejection of thecapsule from the carrier rocket. It was necessary to make all abort systemsredundant and operational under all possible conditions. After liftoff, the range 3
safety officers requirements added to the complexity of the system.Abort had to be possible over radio link at all times from the ground; the astronautalso had the ability to abort the mission. It was necessary to develop automaticabort sensing devices for the space carrier vehicle such as: 1. Attitude error sensors for pitch, roll, and yaw axes. 2. Angular velocity sensors for pitch, roll, and yaw. 3. Control voltage detectors to sense voltage failure. 4. Combustion chamber pressure switches to sense engine performance.All these sensing devices could activate a common abort bus for both carrier vehicle and capsule. Elaborate tests were performed with the system to qualify allcomponents and circuits for the stringent requirements.The Mercury-Redstones three, successful, unmanned, test flights and two,successfu1, manned, suborbital flights indicate that the systems approach is soundand that the concepts in systems design are advanced enough to be applied tolarger space vehicles.The experience gained in many missile systems over the past years was carefullyapplied to the present systems such as Saturn. The Saturn, a large multistage,space carrier vehicle, demands an extremely well-coordinated engineering anddesign effort to fit all stages into one workable system. Overall systems designdirection and standardization, within stages, are absolutely necessary. The firstblock of Saturn vehicle wi1l show what this effort means.The electrical interconnect diagram of the Saturn first stage shows the breakdowninto 16 major areas. This breakdown was selected as a logical division intosubassemblies and, in some cases, into subsystems. The interconnection diagramdepicts the vehicle integration scheme and illustrates to some degree thecomplexity of the present Saturn electrical network; it is shown in Fig. 29.1.The electrical system used in Block One Saturn vehicles serves to supply powerfor the operating and switching functions needed by the various vehiclesubsystems. Primary vehicle power is provided by the main batteries, which inmany cases furnish the necessary power directly through the distributors to theelectrically operated components. In other cases, battery power is converted intoother voltages and frequencies by power supplies and routed to the subsystems 4
through the distributors.The entire integrating electrical network consists of cables and distributor boxes.Integration of the subsystems requires approximately 500 cable assemblies andnine distributors, since almost all components are served through distributors. Thissystem guarantees a high degree of flexibility to incorporate design changes. Theentire system can be built and checked out on the bench prior to assembly into thevehicle. This means a high assurance of quality and reliability, since accessi- bilityprior to vehicle assembly is provided.The Block One Saturn subsystems are established as follows:1. Electrical power. The electrical power system consists of two 28-v batteriessupplying two independent busses; one bus handles all Fig. 29.1 Electrical interconnect diagram for first stage of Saturn.steady loads, the other bus all variable loads. The steady loads are mainly the 5
secondary power supplies, such as 5-v supplies for measuring voltage and the 60-vpower supply for control components. The variable loads are heaters, relays,valves and cooling equipment. Each battery will carry its total load during flightafter power switch-over from ground supply shortly before ignition of the engines.2. Pressurization. The propellant tanks are pressurized by two pressurizingsystems. Fuel tank pressurization is controlled by valves in the manifold systemwhich regulate the nitrogen gas supply with pressure switches. The fuel tanks areinitially pressurized by the ground system prior to ignition. Pressure level ismaintained during powered flight by pressure switch sensing, which activatesrequired valves in a controlled sequence as fuel is consumed.The liquid oxygen tanks are initially pressurized by a ground pressure supply.After ignition, liquid oxygen is gasified by running it through a heat exchanger.The gas then maintains the desired pressure within the liquid oxygen tanks.Mechanical vent valves relieve excess pressure through the preset valve. Thesetanks may be electrically vented from the blockhouse at any time prior to liftoff.3.. Engine start and cutoff. The fuel and oxidizer are fed to the engine by turbine-powered pumps. Initial turbine momentum is given by the turbine spinner, whichis started by squibs ignited by an electrical signal from the ground equipment. Theturbine spinner is sustained by fuel and oxidizer burning in the gas generator.After initial startup, fuel pressure maintains engine operation. The eight Saturnengines are started with the ground equipment in a staggered sequence pattern.Only two engines are ignited simultaneously. The four groups of two engines areignited 100 msec apart. All engines are nonitored for combustion and proper buildup of hydraulic fluid pressure needed for engine gimbaling. These criteria aremonitored for 3.3 sec to ensure that all eight engines are running properly and thathydraulic pressure is maintained.Only if these indications are satisfactory does the ground support equipment(GSE) continue the launch sequence with the thrust-commit signal. This signaldeenergizes a relay in the vehicle to energize the one-engine out bus. Energizingthis bus enables the: vehicle to give cutoff automatically to one engine if the thrustfalls below the specified limits. When one engine is cut off prior to liftoff, theremaining engines are also cut off in a given, patterned sequence. Should thethrust of any engine drop below the specified limits during the first 10 sec offlight, that engine will be cut off, and the engine out circuits will be deactivated toprevent the other engines from being cut off because of low thrust. This circuit isreactivated at 1iftoff-p1us-10-sec so that the other engines with low thrust may becut off. Emergency cutoff may be given from the ground by radio link, throughthe destruct command receivers, any time after liftoff. This signal will switch allengines 6
off at once. Normal cutoff sequence is provided by liquid level sensors in the fueland oxidizer tanks. When fuel and oxidizer consumption reaches a preset lowlevel, the cutoff for the four inboard engines is triggered. Derived from this signal6 sec later, the outboard engines are also cut off. In the engine cutoff sequence,circuitry is provided to insure that there are more than two outboard enginesrunning at one time.4. Flight sequencing. The program device is the source of all inflight sequenceevents. It provides accurate time pulses to initiate and execute guidance, control,and sequenced functions. The program device is a precise, six-channel, magnetictape recorder, of which three channels are presently used: a. One channel provides the tilt program. b. One channel initiates telemeter inflight calibration. c. One channel stimulates the overall vehicle sequencing.The program device is started from zero at liftoff, relating all sequence events ofthe channels to liftoff as the time base. Shortly before calculated inboard enginecutoff, the program device is stopped and restarted at the actual, inboard enginecutoff signal. This provides a new time base for the upper-stage operationalsequence based on inboard engine cutoff. This has the advantage of eliminatingthe tolerances of carrier vehicle performance; cutoff predictions are theoreticalvalues only. All overall vehicle sequencing stimulated by the program device isexecuted by the flight sequencer; a chain of relays respond to pulses from theprogram device.5. Control. The heart of the control system is the stabilized platform and itsexecuting equipment. The stabilized platform serves as inflight reference forsignals to the control system. The control system senses and corrects vehicleinflight inaccuracies through null- seeking devices that continuously compareactual flight information with the programmed flight path. The signals and valuesderived from the stabilized platform are transmitted to the control computer. Thecontrol computer in turn translates these signals into control signals. The outputsignals are executed by hydraulic servo actuators, which gimbal the four controlengines accordingly.6. Inflight cooling. To assure proper operation of some inflight equipment withinthe given tolerances, an inflight cooling system regulates the temperature withinthe pressurized canisters where this equipment is housed.7. Heating. The air required by the air-bearing gyros is heated to maintain thestringent tolerances of the platform. A temperature sensing device monitors andmaintains this temperature within the preset limits as the stabilized platform is inoperation. The angle-of-attack meters used with the control system are also heated 7
to prevent icing during flight.8. Tracking. The Saturn tracking equipment consists of two radar units, Udop,Azusa, and their associated antennas. The equipment is powered and operatedthrough vehicle circuitry. There are four continuously burning lights tracked byCZR cameras for a period after liftoff. The flight sequencer turns the lights offafter the vehicle is out of camera reach.9. Telemetering. The Saturn vehicle carries eight telemeter links which are used totransmit about 600 measurements back to ground rf receiving stations. Thesemeasurements are routed and signal-conditioned from all areas of the vehicle tothe proper telemetry channel for transmission.These short descriptions of the major areas to be combined into one overall systemindicate the necessity of well-defined technical system coordination. A thoroughknowledge of the systems functional operation is essential for the systemsdesigner. The design must provide not only reliable, and in some areas redundant,operation during the flight application, but also the means of complete functionalcheckout after completion of assembly, preflight, and launch operations.Before entering the area of ground checkout equipment, a few words, should besaid about some features in the vehicle system. Since eight engines have to beoperated during the propelled flight phase, the probability of one engine failurecannot be overlooked. The engine start and cutoff sequences have been describedbefore. If one engine is lost due to some malfunction, a hazardous condition maybe created for the overall system. Since combustion chamber pressure is sensed asthe criterion for proper engine behavior, this indication is utilized to cut a.particular engine off. The eight engines are in individual compartments, and a firein one compartment should be localized to that area. All propellant supply will beshut off properly by sequence; however, a fire or minor explosion may destroy allelectrical lines in this engine compartment. The design provides short circuitprotection; one short of any operational electrical line to another or to the vehiclestructure below the fire wall will not affect the rest of the system. All measuringpickups in each engine area are also fed by its own measuring power supply.These pickups are protected by line resistors to maintain operation in this troubledarea as long as possible while not affecting the measurements in other areas of thevehicle.All circuits for vehicle destruction are completely redundant, from power sourceto explosive train. For future application, an exploding bridgewire system will beintroduced for all ordnance items as substitutes for the present sensitive squibs in 8
which elaborate protective circuitry complicates the system unnecessarily.The function of the ground checkout system for the Saturn is not a new concept.As in previous projects, it is still designed to checkoutall vehicle circuits in various Subsystem tests. All subsystems are checked out andqualified, then the overall system is operated with the same equipment, bypassingall inapplicable subsystems test circuits. The overall systems test, if fullyautomated in itself, creates signals in the ground checkout equipment and returnsthe resultant stimulus for the next step in the automated process. This method willconsider all critical functions during the countdown, and a failure at any point ofthe sequence will stop the countdown and return the system to a safe condition.Since the complexity of the entire system is considerably increased compared withother known systems, new methods of manufacturing are being established. Therack and panel concept was introduced to build up the entire system by use ofmodules. Distribution racks were designed on which standardized connectors arewired to an IBM patchboard. This results in standardization and a high degree offlexibility. The connectors will receive either an incoming or an outgoing cable.They will also receive standardized relay modules, diode modules, resistormodules, transistor modules, etc. Standardized modules and the racks with theconnectors can be fabricated in quantity long before circuit definition. After thesystem circuits are established and detailed design is finished, the IBM patchworkwill interconnect all modules. This patchboard can be defined late in the scheduleto incorporate all design refinements or changes. In the area of control panels thissystem cannot be adapted readily; however, standardization of panels andcomponents has been maintained throughout the program and stages involved sofar. This has considerably shortened the design and manufacturing time, as well aslowering the cost.For the present, the same equipment used for checkout will be used for stage staticfirings as well as for final checkout at the manufacturing site and launch site. Theconcept, as described, will serve the overall Saturn system as long as it stays withthe present scheme of operation. The system proved itself to be extremelysatisfactory at the first Saturn firing; no technical difficulties arose during thecountdown and inflight operation. .The problem of increased distance between launch pad and blockhouse willdictate a different overall scheme for several reasons. The main reason is thesafety distance in the case of a mishap. This and other considerations, such asincreased firing density, quicker checkout, and better data retrieval, lead into anew scheme of vehicle electrical systems for the single stage as well as for the 9
assembled configuration. A scheme will be chosen to standardize stage checkoutat the manufacturers site for all stages of the system, and to continue to launchoperations. The scheme will make use of a digital method and the automation ofall system checks.The question may arise as to the necessity of automating to this degree, since thepresent automated countdown has worked satisfactorily. Before going into thismajor effort of generating a sophisticated automatic system, the advantages anddisadvantages should be discussed. If a properly operating system is assumed, thebiggest advantage to be gained will be improvement of the overall systemsreliability, and an overall time saving for various phases of testing and launchpreparation. The human error can be eliminated in the checkout procedure.Standardized testing will occur throughout the vehicle test program and completetest results will be printed out and available for design improvement studies. Sincerunning time utilized for the testing procedure will be cut to a minimum, theeffective mean time-to-failure ratio for the vehicle will be increased.Once a system is correctly automated, more thorough testing can be achieved inmuch less time than in the manual case. Therefore, the confidence of firingpersonnel in the flight hardware can be increased. When a system failure has beennoted, the exact condition under which the failure occurred can be easilyduplicated. More complete data can be gathered at the instant of failure to aid introuble-shooting and fault isolation. The anticipated schedules for Saturn flightswill require automation of the checkout procedures to save time and to make thebest use of personnel.Since the advantages have been reviewed, we can now look at the disadvantagesand the reasons of failure of some known automated systems. The firstdisadvantage is the complexity introduced in an overall system by addingautomated features. The complexity in many cases has been generated, notbecause it was required, but rather because of conditions under which the designoccurred. Lack of confidence in the system on part of the user in many cases hasbeen another disadvantage for automated systems. Inadequate learning time forthe user has resulted because of poor planning and crash program conditions. Oneof the major reasons for automatic checkout system failures has been inadequateplanning in the area of checkout program generation -- those instructions inmachine language that tell each component exactly what to do. More than oneprogram has resulted in capable, but ignorant, checkout hardware.Another item that should not be overlooked is the degeneration of operatorknowledge about the total system in the presence of working automation. Asystem may work so well that the operators lose touch with the actual process 10
being carried out; when there is trouble, panic and lost time occur. Any wellthought-out automation program must consider and overcome thesedisadvantages.The state of the art in various types of checkout equipment, both analog anddigital, has greatly improved over the last few years. It is possible to obtainreliable conversion and processing equipment to work .with digital intelligence equipment of greater reliability than ever before. It is nowpossible to foresee a checkout system made up of existing equipment that isreliable and accurate. In the Saturn program it will be possible to have checkoutequipment operating in an air conditioned environment. It can be operated byengineering personnel and subjected to preventive maintenance, and it can achievethe reliability currently expected of industrial automation. Once a system isworking, it can be expected to continue to do so. An automatic checkout systemtailored specifically to the needs of the Saturn and Nova programs can begenerated with a high degree of confidence that the system will work properly.The following automation requirements should be followed for overall system: 1. The development must cover all foreseeable programs from Saturn C-1. through Nova. 2. The same technologies, in fact the same hardware wherever possible, should be used throughout the Saturn-Nova developments, just as vehicle technologies in hardware are being utilized from one vehicle configuration to another. 3. The hardware and techniques developed must fit into the plans and facilities of both the contractor and the launch site. 4. The system must provide for both manual and automatic operation in an either/or fashion until user confidence and training are adequate. 5. Maximum time should be provided for personnel training and systems design proofing. 6. The test programming of delivered hardware will be adequate and proven. 7. A systematic method of data processing must be developed to handle the large flow of test results and performance history generated by the automatic process.Before discussing the various checkout configurations and plans, it is necessary toclarify and define certain operations and test conditions. The vehiclemeasurements and controls are separated into: (1) operational measurements andcontrols used to prepare and launch the vehice; and (2) telemetry measurements 11
used to evaluate flight performance.Measurements of the state of the vehicle are needed for both vehicle operation andfor measuring programs. Such measurements go both to the operational equipmentand to the telemetry system. Prior to assembly, the stage also has operational andmeasuring and telemetry checkout requirements. Separate stage interface GSE isgenerated as an integral part of the stage design. The equipment may be no morethan a standard electrical distribution system or, in some cases, it may containcontrols and manual monitoring equipment. Some versions may have such itemsas analog to digital conversion equipment to allow proper mating with digitalground support equipment.Stage interface GSE is broken into two main categories: circuitry concerned withthe operational task, and circuitry utilized to manipulate and evaluate themeasuring and telemetry hardware. Here the stage and its interface GSE areconnected to the facility test equipment. Non-electrical stimuli, such as pressures,are fed directly from the facility test equipment to the vehicle. To properlysimulate upper and lower interfaces, stage substitutes are provided so that theentire operation can be evaluated. In the case of liquid propulsion stages, most ofthis operation would be concerned with evaluating and calibrating the outputs ofthe various measuring adapters contained within the stage. The futuredevelopment of an rf link can reduce the number of hard wires which travelthrough the stage interface GSE. Interface GSE for measuring and telemetrysystems will consist of electrical measurement stimulation circuitry and a set ofdigital acquisitional equipment.At the launch site all measuring and telemetry information can be receivedthrough an rf link from each stage or up to launch day through a coaxial cable toavoid radiation. All of the operational portions of the stage interface GSE areconnected to the operational and launch equipment, thus completing the circuitryrequired to prepare and launch the vehicle. The intelligence and comparison unitsto handle the operational measurements and controls of the vehicle system will bethe computer complex. The heart of this complex will be a medium-size general-purpose digital computer, which will handle the digital guidance equipment. Thecomputer will be expanded to handle the various types of analog and digitalequipment in operational checkout. It also will generate commands and data topreset and launch the vehicle.As soon as the digital guidance system is introduced in the present Saturn C-lconfiguration, automatic checkout equipment will be installed at the stagecontractor site as well as at the launch site. For a number of vehicles, the dualcapability of manual and automatic checkout possibilities will be available until 12
the new digital checkout system can be proven. By the time the Saturn C-4 configuration is ready to be launched, it will be mandatory that the new automatic checkout scheme with the digital mode be operational because the distances between launch site and control room are so great that no other method will be possible. Te new automatic system will demand an extreme amount of engineering discipline and enforcement of standardization at the stage contractors plant as well as at the launch site, to make the system reliable and to achieve our goal.Rajneesh Budania (ELECTRICAL ENG.) 13