Terminal Count

Probably the most heart stopping moments in spaceflight occur at the final stages of a countdown to liftoff.  Will it go or not?  What happens once the engines start?  Success or failure or just wait for another day?  I lived through a number of shuttle launches – and launch attempts – and every time I watch a rocket launch – of any kind – when the clock ticks down to the final minute my heart starts racing.

For the Space Shuttle there were a series of documents which detailed how launch operations were conducted.  The most famous was S0007 (pronounced ‘Sue Seven’ or sometimes ‘S triple balls seven’).  The entire document came in five volumes.  In the days when we worked in paper, it took five 2-inch-thick binders to hold it all.  Every step was numbered and the responsible party was named for each step.  Most of my career was “Houston Flight” and I would answer to the NASA Test Director or the NASA Launch Director or the NASA Operations Manager on their communications ‘loops’ as required. 

In my Flight Director reference book was a copy – shown above – of Figure 13-3 ‘RSLS and GLS Interaction T-38 Seconds to T-0’.  Chockablock with important stuff because a lot happened in those last seconds.  At the final stages, it was all on automatic with the computers in control.

Two programs, the GLS (Ground Launch Sequencer) and the onboard RSLS (Redundant Set Launch Sequencer) played the final duet.  People were just observers, along for the ride.  There were folks that could stop the countdown if they found necessary, which happened several times for the odd items that were not monitored or controlled by the GLS and RSLS.  Memorably were the launch scrubs caused by the hazardous gas detection system (Haz Gas).  Almost everything required by the Launch Commit Criteria was automatically monitored. 

Onboard the Space Shuttle there were five General Purpose Computers.  For the launch phase, computer #5 was running the Backup Flight System.  The BFS was there to take over if there was a total failure of the ‘redundant set’.  The BFS did not have the command capability to launch the shuttle and was really only in listen mode prior to liftoff.  Computers 1 through 4 were all running the same software at the same time in lock step; they comprised the ‘Redundant Set’.  The RSLS was only one of many programs running in the ‘redundant set’ computers during the prelaunch phase also known as Major Mode 101.  To continue to launch – and fly safely – all four computers had to agree.  If any one got out of sync or gave an incorrect command, or failed to listen to the others, the RSLS would detect that and issue a hold so that no launch would occur. 

On the chart the top half details what the RSLS is doing and the bottom half details what the GLS is doing.  Commands could be given once or ‘continuously’ (every computer cycle) for a given period of time.  Likewise, telemetry of critical items could be checked (verified) once or ‘continuously’ (CFVY) every computer cycle of 40 milliseconds for a specified period of time.

Time across the bottom starting at T-50 seconds with the first item:  a command that the GLS automatically commanded the big Liquid Oxygen and Liquid Hydrogen Fill & Drain Valves to close.  The ET should be completely full of propellant and no more would be added.  Looking a little later on the chart at T-34 seconds, the GLS would verify that those valves actually closed.  As always for any verification that failed, an automatic hold would be issued. 

Getting back to the time scale at the bottom, in big bold letters at T-31 seconds was the notation: “LAST AVAILABLE HOLD POINT”.  To this day, whenever I am watching the countdown of any vehicle, whether it matters to that system or not, my heartrate picks up significantly at T-31 seconds.  Like Pavlov’s dog I am conditioned to respond. 

There is also an interesting note in the box: “Onboard RSLS TBO Clock Stops Decrementing at T-6.6 sec; GND Clock continues.”  The RSLS countdown time displayed to the crew notoriously stopped at the command for main engine start.  After that point things either happened – or not -so quickly that human response did not come into play.

In the RSLS section is the long box “CVFY NO SSME 1,2, or 3 PAD DATA PATH FAIL, CHANNEL FAIL, or CONTROL FAILURE (EH, HL, OR MCF AND LIMIT EXCEED)” Each Space Shuttle Main Engine had two computers – prime and backup – which controlled the functions of the engine.  The Redundant Set had to have good data and command links with the SSME controllers – no data path fails.  Each SSME controller had to report that there were no failures in the control channels to its engine valves, and no detected major component failures (MCF), no redline exceedances either high or low on any engine temperature or pressure.  That is a lot to check on every 40 milliseconds from T-20 minutes all the way to T-0. 

Next, we will look at the detailed commands and verifications second by second. 

The GLS deactivates the SRB joint heaters – which were added after Challenger – at T-50 seconds.  At T-40 seconds the GLS cuts ground power to the Space Shuttle so that all the electricity must come from the onboard fuel cells.  Also, at T-40 seconds the GLS verifies that the Gaseous Vent Arm (GVA or the ‘beanie cap’) is fully retracted out of the way.  That beanie cap is on a long arm that stretches out over the nose of the External Tank to remove any vapors.  On the very last shuttle launch, STS-135, the indicator that the GVA was out of the way failed so we had a scary – but short – hold while people in the firing room manually confirmed it was out of the way. 

At T-31 we pass the last hold point – anything after that will be a launch scrub.  At T-31 seconds the GLS sends “LPS Go for auto sequence start”.  Launch Processing System is a generic term for the entirety of the ground system; the ‘auto sequence’ is the RSLS which takes precedence at that point. 

At T-30 seconds the GLS commands the hydraulic power units in the base of the solid rocket boosters to get ready to start; the actual start command comes at T-28 seconds. 

The RSLS, at T-28 seconds is doing a one-time check to see if it received the LPS Go for auto sequence start.  At T-27 seconds the RSLS starts another software sequence to open the orbiter vent doors.  Why?  As the shuttle launches, the outside air pressure decreases with altitude; there are motor actuated doors all along the sides of the shuttle that open to allow the pressure to equalize.  Otherwise, the structure would pop at some point.  Not be good.  Prior to launch, all the orbiter cavities are flooded with dry nitrogen gas to prevent any flammable leaks from catching fire.  Opening the vent doors too early would allow oxygen to get inside and the fire hazard would increase.  T-27 seconds allows all the doors to be fully opened if both electrical motors on each door function properly, operating on just one of the two redundant motors takes longer to open the doors.  If any motor doesn’t work, that door may not be fully open at liftoff and there was a huge debate early in the program about whether that would be OK.  Down at T-7 seconds the RSLS checks to see if all the vent doors are open.  We decided to scrub the launch if any vent door motor failed rather than start opening the doors before the last hold point at T-31 seconds and risk oxygen intrusion during a hold.  More than one flight held at T-31 seconds, there was never a vent door motor failure, so that proved to be a good decision that avoided potential fire hazards. 

At T-26 seconds the GLS commands the Liquid Hydrogen High Point Bleed valve to closed.  It would be bad to lift off with a leak in the LH2 system.   The GLS verifies that valve is closed at T-12 seconds. 

Then there is a blessed five seconds of calm.  It is the last quiet period before everything starts happening, seemingly all at once.

At T-21 seconds the GLS commands the SRB gimbal test.  With the hydraulics pressured up, those big nozzles are swiveled back and forth to make sure they work properly.  Starting at the same time the GLS begins continuously verifying that the SRB hydraulic turbines are running at the proper speed.  There are two turbines in each booster for full redundancy in flight but we decided not to launch unless both were working properly.  I don’t ever recall an SRB hydraulic unit failing in flight (they only run for about 2 and ½ minutes) but when I was the Shuttle Program Manager and found out that there had never been a test with only one turbine running, I mandated that one of the ground test firings in Utah shut down one of the two turbines and measure the gimbal response.  It worked fine.  That test only cost $2 million – which is a story for another day. 

At T-18 seconds the RSLS commands the safe and arm devices – which prevent an inadvertent pyrotechnic event – to arm.  This is for the SRB ignition and the ground umbilical release.  Hazardous phase truly initiated at this point. 

By T-16 seconds the SRB gimbal test should be complete and the nozzles back down at the null position for liftoff so the GLS starts continuously verifying that position down to T-0.  Also, at T-16 seconds the GLS activates the water deluge on the pad, the so called ‘sound suppression’ system.  This has different modes and the first activation is the ‘pre liftoff’ mode which is a trickle compared with what happens immediately after liftoff.

At T-15 seconds the RSLS begins continuously checking that all the pyrotechnic initiator capacitors are fully charged and ready to function.  Also starting at T-15 seconds the RSLS starts continuously checking that all the onboard computers have good data coming in from all over the vehicle (no MDM Return Word bypass). 

At T-12.5 seconds:  the RSLS starts continuously commanding valves in the Liquid Oxygen system that recirculate fluid to open, this continues every 40 milliseconds down to engine start time.  At T-9.5 seconds the RSLS checks to see if those valves are open. 

At T-12 seconds the GLS is also busy; it commands valves to close to terminate the helium fill going to the orbiter and the GLS also does a one-time check to verify that the rudder/speedbrake is in the launch position, the GLS locks down its command system to the SRBs and immediately removes any inhibits that were set.

At T-11 seconds the RSLS commands another software program in the onboard computers to start:  navigation.  The crew sees this as the ‘Eight ball’ display showing attitude goes to vertical.  At the same time the RSLS commands the main engine throttle settings to 100%.  The engines have not started yet, but when they do, they will aim to run at 100% of the rated power level.  For almost all of the shuttle flights ascent flight used 104% (or 104.5% for later flights) but the pad was only certified to 100% so the command to throttle up to 104% was one of the first things that the computers did after liftoff.

At T-10 seconds the GLS fires the ‘sparklers’ at the base of the launch pad to burn off any stray hydrogen vapors before the engines start.  Scrubbing at this point incurs about a week effort to replace those items.

Also, at T-10 seconds the GLS issues the ‘go for main engine start’ discrete.  We did a long study once that showed this was the last critical action of the GLS; a total failure of the ground computing system after this would not stop the shuttle from launching itself.  The RSLS is totally in charge now.

At T-9.5 seconds the RSLS sends ‘start enable’ to the main engines – get ready! At that same point the RSLS checks one time to see if each main engine indicates it is ready.  This is a complicated process that requires terminating liquid oxygen cooling to the engines – which occurred back at T-50 seconds when the valves were closed or really even earlier than this chart when LOX replenish was terminated.  The engines must be chilled to the right temperature for a smooth start and during replenish operations the engines are actually too cold.  When replenish ends, LOX from the External tank starts flowing into the cooling channels; this LOX is in the big 17-inch pipe coming down the outside of the ET.  Since it is outside, the LOX is actually a tad warmer than the LOX which was coming in from the ground tanks.  This allows the engines to warm up just enough so that the temperatures are in the ‘start box’.  When the main engine controller senses the right temperature, it issues the ‘engine ready’ discrete.  This what the RSLS is looking for.  On several flights where we were holding at T-31 seconds (after replenish was terminated) the engine temperature crept higher – out of the ‘start box’ and the engine ready discrete went away.  SCRUB!

Also, at T-9.5 seconds the RSLS starts continuously commanding the Liquid Hydrogen prevalves for each engine to open.  If they are closed, no fuel gets to the engine.  Continuously commanding those valves to the open position every 40 milliseconds until the engine starts.

A fraction later, at T-9.4 seconds the RSLS starts continuously commanding the Liquid Oxygen overboard bleed valves to close and continues this until the main engines start.  Remember the GLS had closed the equivalent on the liquid hydrogen side at T-26 seconds, an eternity ago.

At T-9 seconds the GLS deactivates the Liquid Hydrogen recirculation pumps and a second later at T-8 seconds the GLS shuts off its capability to command anything on the orbiter. 

At T-7 seconds the RSLS verifies that it has received the LPS go for engine start, and verifies that the LOX recirc valves are open, and starts continuous verification – for 0.4 seconds – that the engines are all in ‘engine ready’ mode, checks the vent door positions, and the prevalve positions and then the big show starts.

At T-6.6 seconds the RSLS issues the start commands to each engine:  engine 3, engine 2, engine 1 with 120 millisecond staggers.  The engine gimbals are commanded to override to prevent failures during the engine start transients.  From now to T-0 the RSLS will verify that no main engine controller has issued a ‘shutdown mode’ or ‘post shutdown mode’ discrete.  All the action turns to the main engine controllers which execute a tightly choreographed sequence of valve operations to safely start each engine and bring it up to 100% throttle.  Describing that sequence would take much longer than this paper. 

The forlorn GLS issues its last command to shut down the ground cooling units at T-6 seconds. 

At T-2 seconds the RSLS starts continuously checking to verify each main engine is reporting that it is running at greater than 90% throttle setting; there after the RSLS resets the engine gimbal commands to allow steering after launch to happen

At T-0 the last RSLS commands go out – fire the umbilical release pyros, fire the hold down post pyros, fire the ET vent arm disconnect pyros, and all in the same millisecond command window, fire the SRB ignition pyros.  Then reset all the controllers (Master Event Controllers – MEC) for the pyros.

As a flight director, I knew the next step – coming less than 40 milliseconds seconds after all those commands:  The onboard redundant set computer programs moded to the flight – first stage – phase; Major Mode 102.  The RSLS was done and turned off. 

A young Flight Director on console with the SOO7 document open on the console shelf – red binder.