Engineers troubleshoot engine cutoff sensor woes

InTech, Apr 2008 by Strothman, Jim

Open circuits in the Shuttle Atlantis external tank's external electrical feed through a connector caused of false readings in the Engine Cutoff (ECO) sensor system, which led to the December launch delays of the European-built Columbus space laboratory.

Prior to the 7 February lift off, NASA formed a combined troubleshooting team involving multiple NASA centers to find the root cause and develop plans to fix the sensor system. The ECO system is one of several electronic sensor systems that protect the shuttle's main engines by triggering an engine shutdown in the event either liquid hydrogen or liquid oxygen fuel levels in the external tank run unexpectedly low.

The 6 December and 9 December anoma lies were not the first time shuttle engineers and launch team encountered ECO system problems. Similar head-scratching faulty readings occurred prior to three other space shuttle launches in 2005 and 2006.

Reports low fuel levels

The ECO sensors operate much like the "gas low" warning light in an automobile. When the fuel level drops below a sensor, that sensor sends a message to the orbiter's computer that it is dry.

The orbiter's computers poll the ECO sensors about 8-12 seconds prior to its planned main engine cutoff, which occurs about 8.5 minutes after launch.

If two of the four ECOs indicate dry, which means the tank is almost empty, the space shuttle main engines will be immediately shut down. If the main engines shut down prior to normal operating time, it could affect whether or not the shuttle reaches the appropriate orbit. Other motors-namely the Orbital Maneuvering System engines-have the capability to make up for a slightly early main engine cutoff, NASA said, but not one that occurs very early.

In the history of the Space Shuttle Program, the liquid hydrogen ECO system has never initiated an engine shutdown. NASA's own launch rules require three of four sensors working at launch time, although NASA said the shuttle has never lifted off without all four fully functioning.

Sensor system detailed

The ECO sensors in the liquid hydrogen section of the external tank include wiring, harnesses, a series of connectors, and point sensor box electronics in the orbiter. Sensors in the tank send electronic signals through wires to the point sensor box in the orbiter, which in turn transmits data signals to the orbiter's onboard computer system. The sensor wires lead to a feed through connector in the side of the tank. External cables run up the external tank (ET) vertical strut to the liquid hydrogen ET/orbiter interface. The circuit then routes inside the orbiter to the point sensor electronics box.

Four ECO sensors in the liquid hydrogen tank mount on a single, shock-isolated carrier plate four feet from the bottom of the tank. Similar ECO sensors on the liquid oxygen side are in the main propulsion system liquid oxygen feedline inside the orbiter.

Once propellant loading begins on launch day, the liquid hydrogen ECO sensors will read 'wet.' To demonstrate if they are functioning properly, the sensors are tested during tanking operations. When the fast fill stage of tanking begins, NASA's launch team sends an electronic command to force the sensors to read "dry." This simulated "dry" command is held until just after NASA enters a built-in "T-9 minutes" hold (nine minutes on the countdown clock). At that time, the "dry" command is removed, and the sensors are monitored to assure they are reading "wet."

Atlantis' woes

The Space Shuttle Atlantis (STS-122) 6 December launch attempt was postponed after two of the four liquid hydrogen tank ECO sensors gave false readings while Atlantis' external tank was being filled.

On 9 December, one of the four ECO sensors inside the liquid hydrogen section of the tank gave a false reading, causing another delay. NASA then modified its launch commit criteria to require all four sensors function properly.

After removing a layer of external tank foam insulation at the launch pad, the external plug and feed through connector were removed from the tank and shipped to Marshall Space Flight Center in Alabama to determine whether the failure could be recreated in a test facility using focused and limited nondestructive and destructive physical tests. The tests were configured to replicate tank chill down temperatures, loading pressures, and environmental conditions during the two launch attempts.

NASA engineers said all circuit anomalies experienced during testing were able to be repeated as seen during the two launch attempts and tanking test. Open circuits in the part that connects wires from the interior to the exterior of the liquid hydrogen tank, known as the feed-through plate, were identified as the culprit that caused false readings.

A modified connector was designed with the pins and sockets soldered together. A similar, but slightly redesigned, connector was to be used. Both the original and modified connector configurations were subjected to temperature, pressure, and vibration environments identical to those experienced during a shuttle launch.