NASA Office of Logic Design

NASA Office of Logic Design

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.

NASA SP-504: Space Shuttle Avionics System

Section 3  Flight Control

The circumstances which resulted in the choice of digital fly-by-wire control and the limitations on the use of manual direct modes have been described previously. Some other flight control areas which were at issue during the design phase included the following:

Specifications, requirements, and extensive treatments of response characteristics which would provide desired handling qualities for all types of aircraft were available in the Space Shuttle design era, but -all dealt with conventionally powered aircraft operating in the subsonic or low-supersonic flight regimes. No specifications which treated the requirements for an unpowered aircraft operating over the entire orbital entry through landing envelope were available. In an attempt to establish an integrated set of such requirements, NASA convened a Space. Shuttle Flying Qualities Symposium in early 1971 to solicit industrywide inputs and recommendations. These were subsequently published in a Space Shuttle Flying Qualities Specification and used as a guideline throughout the system development.

Some of the choices which directly affected the performance and stability of the control system included the selection of digital autopilot sampling rates and the minimum time delay or transport lag allowable between the receipt of inputs from manual controls and vehicle motion sensors and the issuance of commands to the control effectors. Because these factors were also fundamental drivers in the software design, particularly on the operating system, the selections had to be made very early in the program, well before substantive data on airframe performance and response characteristics became available. The digital autopilot experience base at the time was limited to that represented by the Apollo spacecraft, a vehicle which had no aircraft characteristics; therefore, the tendency was to take a conservative approach and set the sample rates very high - 50 and 100 hertz were typical values proposed. Because rates of this order would have imposed a severe strain on the computer/ software complex, the pressure from the data processing community was to lower them as much as possible. The rate finally chosen was 25 hertz, the same as for Apollo, with a transport lag limit of 20 milliseconds, values which preliminary analysis indicated would provide for the required phase stabilization margins.

The flight control sensors installed in the Orbiter included rate gyros mounted on the aft payload bay bulkhead and body-axis-oriented accelerometers located in the forward avionics bays. The system was configured initially with three of each, with the tiebreaker in the event of a second failure to be calculated using data from the inertial measurement units (IMUs), which were located in front of the forward bays. This concept proved unworkable for the rate gyros because the distance between the IMUs and the rate gyros and the structural dynamics involved prevented accurate transfer of the inertial data. The IMU outputs were also initially baselined to break a tie between diverging signals from the body-mounted accelerometers. Again, the concept proved unworkable even though the instruments were located in the same vicinity, and a fourth string of each sensor was eventually incorporated.

It was also difficult to find an acceptable location for the rate gyros in both the Orbiter and the SRB's. An ideal location would have been at the center of gravity, mounted on structure the motion of which represented the true rigid- body rotation about that point. The nearest viable structure which reasonably approximated these conditions was the aft bulkhead of the payload bay. Therefore, the initial location of the rate gyro assembly was a mount on each of the four corners of this bulkhead, physically separated as much as possible for redundancy isolation. Subsequent ground vibration tests uncovered local resonances which made these locations unacceptable. The mounting location was changed twice before the present position at the center base of the bulkhead finally proved acceptable. The desire for physical separation of the redundant sensors was abandoned in favor of dynamically identical signals to avoid compromising the redundancy management selection logic. The rate gyro mounts in the SRB's also had to be modified after vibration tests uncovered unpredicted structural modes.

The hydraulic actuators used to position the engine gimbals and the aerodynamic control surfaces were triply redundant input port devices in the initial baseline. It proved to be very difficult to interconnect four computer-generated commands to a three-port actuator in a manner which would preserve the FO/FS requirement. The most straightforward solution was to mechanize four input ports and this configuration was eventually selected.

Design of the entry flight control system was a long and difficult process. The Orbiter requirement was unique in the high-performance aircraft development process in that the entire dynamic range of the vehicle from hypersonic through subsonic speeds would be encountered on the first orbital flight. In contrast, in the normal aircraft development approach, the flight envelope is gradually expanded in small, carefully controlled steps. The process was complicated by large data base uncertainties in predicted aerodynamic performance, including control surface effectiveness and other key parameters; in structural bending information; and in potential interaction between the RCS thrusters and the aerodynamic control surfaces. The control concept which evolved used RCS thrusters exclusively during very early entry, then gradually blended in the aerodynamic control surfaces as they became effective - first roll then pitch, then yaw - until approximately Mach 3.5, when the thrusters were totally deactivated. Transitions between control laws, gain changes, etc., required because of the wide dynamic range, were scheduled on the assumption of best estimates of vehicle control response and performance obtained from the data base, using cues such as altitude, drag, and Mach number derived from the navigation and air data subsystems. Because of the data base uncertainties and because the systems used for cues had not yet been flight qualified (e.g., the air data system in particular was subject to large calibration uncertainties), a means for reacting in real time to off- nominal performance had to be provided to the crew. Three switches were installed for this purpose, each affording the opportunity to modify the system if anomalous performance was encountered. One switch opened the automatic guidance loop and reduced the flight control system gain by 6 decibels. Another selected a control law which did not require the use of yaw thrusters. The third provided the option of causing the transition from high to low angle of attack to occur either earlier or later than nominal.

Home - NASA Office of Logic Design
Last Revised: February 03, 2010
Digital Engineering Institute
Web Grunt: Richard Katz