NASA Office of Logic Design

NASA Office of Logic Design

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.


NASA SP-504: Space Shuttle Avionics System

Section 3  Navigation

Several issues and design choices were addressed in arriving at the Space Shuttle navigation system baseline. One of the most controversial was the selection of an inertial measurement system. The two options considered were a system with triply redundant, mechanically gimballed platforms, and a strapdown approach, which included six skewed gyro / accelerometer pairs oriented to provide multiple fault detection and isolation capability. At the time, several gimballed systems that could meet Space Shuttle requirements with some modification were in production. Although no six-gyro strapdown systems were in production, one existing design was fairly mature, and this approach appeared to offer significant advantages from a system redundancy aspect. The final selection of a gimballed system was based on such factors as maturity, the number of near-production designs available, and the predicted cost of the respective gyros.

Triple redundancy was baselined in this area because early analyses indicated that a system with three IMU's could achieve full FO/FS fault tolerance. The first failure in such a system would be detected and isolated in the standard manner by comparisons among the three units. The scheme proposed to isolate the second failure is shown in simplified, two-dimensional form in figure 3-7. It involved skewing the inertial platform alignment of each unit with respect to the others so that each gyro and accelerometer in the system would sense inputs. about or along a unique axis. By this means, an input sensed by a single gyro or accelerometer in one platform could be compared with a composite value constructed from components along the same axis sensed by a combination of instruments in the other platform. By making a series of such comparisons with different combinations of sensors, it appeared possible to identify a malfunctioning instrument. As the system matured, however, and analyses and test data accrued, it became apparent that certain obscure failures at the dual-redundancy level could not be isolated. Therefore, a number of attempts were made to raise the redundancy level to four. The problem was complicated, however, by the fact that the IMU's and the star trackers used for their alignment had to be mounted on a common, rigid structural member in a location which would provide the required optical look angles and adequate clearance for doors and associated mechanisms. The location which had been chosen, just forward of the cockpit with the star tracker door openings in the upper left area of the fuselage, was optimum but unfortunately did not contain enough volume to accommodate a fourth unit of the size then available. One alternate location, on the upper corners of the forward payload bay bulkhead, was briefly examined but discarded because of alignment problems and the difficulty in providing an adequate structural mount. Another alternative, in which an additional IMU would have been mounted inverted under the existing structure, would have forced the relocation of other equipment with excessive cost. Therefore, the decision was made to keep the triply redundant baseline but to make every attempt to reduce the probability of exposure to a second failure to an acceptable level. One measure taken was to exploit the use of IMU BITE to the maximum. This measure alone provided the capability to detect as many as 90 percent of all failures. Another technique, used during entry, was to integrate rate gyro outputs to provide an additional attitude reference. The result, when considered in terms of the relatively short periods of exposure during ascent and entry and of the remote possibility that a second failure would be of the precise type which would escape detection, was considered to be a safe and satisfactory system.


Figure 3-7. - Skewed IMU approach

The selection of an on-orbit navigation system also proved to be a difficult process especially in view of the Orbiter autonomy requirement. No operational sensor or system which could meet accuracy, coverage, and autonomy requirements was available. The Department of Defense (DOD) Global Positioning System (GPS) was only in the initial phase of development, and no assurance could then be given that the project would be completed. Several other concepts were investigated, including one called the precision ranging system (PRS), which would have used onboard distance measuring devices operating with a network of transponders distributed on the ground at strategic locations around the world and in the vicinity of the landing sites. Several studies conducted showed that, given the required number and locations of transponders, a FRS could easily meet all Space Shuttle navigation accuracy requirements. To adopt such a system, however, meant that NASA would have to install and maintain the dedicated worldwide network.

In another concept, the RF emissions from ground-based radars located around the world would have been tracked to obtain angular data from which a state vector could have been constructed. This system also had promise but would have required the development of onboard electronics equipment which was extremely sophisticated for the time. The technique finally chosen was to make the ground-Orbiter-ground communications link coherent and thereby to provide the capability to precisely measure the Doppler shift in the carrier frequency and to obtain an accurate time history of relative range rate between the spacecraft and a ground station. From this information, the vehicle state vector could be constructed. The system was originally mechanized so that the Doppler information could be extracted both on the ground and onboard. Later in the program, the ground was made prime for on-orbit navigation and the onboard capability was deleted. The realization of autonomous on-orbit navigation was left to the GPS.

The issues involved with rendezvous navigation concerned both performance and mechanization. No definitive rendezvous targets or their characteristics existed; therefore, radar performance requirements were difficult to specify. Finally, after much debate, it was decided that the capability should be provided to acquire range and angle data from both cooperative and uncooperative targets and that the performance should be that reasonably available from state-of-the-art solid- state devices. The mechanization finally chosen was to incorporate the radar in the Ku-band communications system, which required a high-gain directable antenna and other components which could service both radar and communications functions.

The system selected to provide navigation for the postblackout entry phase was the DOD tactical air navigation system network. This choice was made only after much deliberation because tacan performance was neither documented nor specified above 12.2 to 15.2 kilometers (40 000 to 50 000 feet) and the Space Shuttle requirement extended to an altitude of approximately 42.7 kilometers (140 000 feet). Analytic performance predictions and laboratory test results indicated that performance would be satisfactory, however, and three off-the-shelf transceivers, modified as necessary to interface with the onboard data processing system, were baselined. Triple redundancy was considered adequate because of the short period of exposure and because the ground could provide some assistance if two failures occurred.

The predominant navigation aids in place at the time for the final approach and landing phase were the FAA ILS and the USAF ground-controlled approach (GCA) system; however, both the performance and the coverage provided by these systems were deemed inadequate for the type of approach to be flown by the Space Shuttle. The FAA was considering an upgrade to a precision microwave landing system, but no firm schedule existed. Precision microwave systems also under development by DOD would meet Space Shuttle performance and coverage requirements, and a variation of one of these was chosen, again modified to interface with the DPS. Triple redundancy was considered sufficient for this system also, both because of the short exposure and because the pilot could take over visually under most expected conditions.


Home - NASA Office of Logic Design
Last Revised: February 03, 2010
Digital Engineering Institute
Web Grunt: Richard Katz
NACA Seal