ECO sensor issues strike again – STS-122 moves to January

by Chris Bergin

Due to a fault with LH2 ECO (Engine Cut Off) sensor #3, NASA has scrubbed the second launch attempt of STS-122. Engineers later carried out a four hour test on the sensors and feedthrough connector in a version of a tanking test.

Within a few hours of the scrub, media at the launch site were informed NASA has officially changed the NET (No Earlier Than) launch date to January 2, 2008, as troubleshooting efforts cancel out the December launch window.

**The most comprehensive collection of Shuttle, Ares, Orion and ISS related presentations and mission documentation, plus expansive daily processing documentation and updates are available to download on L2 **

L2: STS-122 to STS-127 documentation already available.

STS-122 L2 Special NOW LIVE. **Click here for sample of L2 menu and content**

**STS-122 Special: 12 MOD Flight Readiness Review (FRR) Presentations, Baselines and Mission Overviews. 17 Shuttle FRR Presentations. Payload Presentations and vast amounts of live, uploaded images and presentations. Installation Movies (several) – already 1100 megabytes strong**

**LIVE updates on Atlantis STS-122 COUNTDOWN Launch Attempt 2**

**Click here for FRR overview articles: Article 1Article 2** 

Tanking and countdown:

Go for tanking. Tanking began at around 5:55am Eastern. LH2 and LOX in slow fill. Fast fill to follow, along with the first SIM test of the sensors.

FAILURE of ECO sensor: ‘Just applied the SIM commands to all 4 LH2 ECOs and the LH2 5 percent. A few seconds later LH2 ECO #3 failed open circuit wet,’ noted L2 information.

Also, LOX ECO Number 3 was noted as failed ‘DRY’ not long after the LH2 ECO failure, which would be a new issue. Engineers are checking if it was a SIM failure, or a PSB (Point Sensor Box) dry transition range issue.’

As evaluations continued on the LOX ECO 3 sensor, engineers noted this is being classed as a possible independent SIM command console issue and not a sensor fault.


The LOX Tank is completely drained, while the LH2 tank has been drained back to just below the 5 percent level. Following the return of the sensors to their dry state, the tank was drained for a further 60 seconds.

This test has a duration of four hours and will be used to aid evaluations on the feedthrough connectors and ECO sensors.

Test now complete. Waiting for results – with focus on the connector.

RSS mate this evening, with the pad in launch config untill tomorrow. 6:45am Monday: Take pad out of launch config and install work access.

Pre-Attempt Article: (Based on a multitude of MMT information and presentations on L2):

Protecting against failures:

NASA has finalized procedures and rationale for STS-122, following the decision to make a launch attempt on Sunday, with huge amounts of flight history and data making up the team effort to ensure all the bases are covered in the event of ECO system issues during launch.

The Mission Management Team (MMT) are near the end of their meeting to finalize their procedures, which would first hope that the sensors work during the tanking and countdown, and then follow a strict monitoring process during the eight and half minute ride to orbit.

The presentations collated for the MMT show strong rationale to safely carry out the launch, even in the event of sensor failures during launch and ascent.

This is backed up by flight history that shows the low level sensors would only be required in the event of a problem with the SSMEs (Space Shuttle Main Engines), the MPS (Main Propulsion System), or the External Tank – which resulted in a leak, or additional use of liquid hydrogen.

This was outlined in a presentation that asked the question: ‘Effect of LH2 propellant without a Low Level Cut Off (LLCO) system?’

‘Only Orbiter MPS failure mode resulting in need for LH2 LLCO is leakage. Orbiter MPS has never had a flight environment induced LH2 system leak in the history of the Program,’ noted the presentation. ‘Cryogenic leakage in LH2 system have been induced by system rework during ground processing or in the integrated MPS by External Tank disconnect hardware at the LH2 umbilical.

‘What types of SSME anomalies can lead to propellant depletion? And, what’s the likelihood of occurrence? Most off-nominal engine conditions (leak downstream of engine fuel flowmeter, turbine degradation, injector performance loss, etc) result in increased LOX flowrate that would result in a Low Level Cutoff due to LOX depletion.’

Specific to Atlantis and STS-122, engineering data concluded that the possibility of such a leakage during launch would be extremely low.

‘STS-122 pre-flight checks and cryo load performance (minus recirc activation) validates system integrity for present mission. No leakage indicated. Recent OV-104 flight data indicates no leakage. Likelihood of Orbiter MPS LH2 leakage causing a requirement for LH2 LLCO is extremely low.’

On the ET side, the obvious issue would be a leak of propellant from the tank, a scenario which would be highly undesirable in the first place – classed by a hazard report as ‘Improbable Catastrophic.’

‘Propellant Leakage: Leakage must be of a quantity to overcome fuel bias (1063 lbm) and propellant loading dispersions. Leakage-related catastrophic hazard prior to SSME failure would be LH2 Tank Siphon dropout,’ added the presentation.

‘The ECO sensors are located high enough above the siphon rim so that if the ECO sensors were to initiate engine shutdown there is still some LH2 reserve left in the tank in excess of the normally expected residual. This is done to eliminate any chance of siphon dropout, which would result in a catastrophic LO2 rich engine shutdown and loss of vehicle.’

**Ride home through the fire, sparks and plasma of re-entry with Atlantis, Discovery and Endeavour. FIVE Stunning high quality 2hr, 355-400mb Camcorder and HUD videos – from payload bay closure – through re-entry with an astronaut held camcorder video – to post landing – several more videos showing landing from 90,000 ft also available and HUD videos from STA landings. Now includes HALO II Re-entry video, and re-entry videos from Gemini and Apollo (converted from 8mm)**

The other risk associated with a risk of running out of LH2 prior to the scheduled shutdown of the SSMEs is more controllable, due to being associated with an error during tanking and stable replenish on the pad – which would be spotted by controllers before launch.

‘Minor Contributors to early LH2 propellant depletion (accounted for in loading dispersions): Improper locations of upper LH2 liquid level sensors. Incorrect LH2 Liquid level at End of Replenish due to erratic indications on the upper level sensors (electrical circuit anomaly). Variations in manufacturing volume.’

The reason so much emphasis is being placed on not just the sensors, but the absolute requirement to avoid running out of propellant, relates to what would happen to the orbiter in such a scenario. Shuttle manager Wayne Hale referred to it as being a ‘bad day’ – in other words, the loss of the vehicle and crew.

‘SSME Integrated Hazard Analysis documents two catastrophic hazards, for which the controls are vehicle ECO sensors:

‘HPOTP Burnthrough, Rupture, Explosion: Fails to Detect Propellant Depletion (Mainstage Only): A vehicle failure to detect propellant depletion in mainstage can lead to engine failure from running out of propellant. Depletion of oxidizer propellant could reduce the inlet pressure to zero and cause pump overspeed.

‘HPFTP Burnthrough, Rupture, Fire: Fails to Detect Propellant Depletion (Mainstage Only): A vehicle failure to detect propellant depletion in mainstage can lead to engine failure from running out of propellant. Depletion of fuel propellant will reduce the inlet NPSP and may cause rotor overspeed.’

More ‘fuel’ in the tank:

All of the above scenarios are highly unlikely, backed up by another presentation that references the additional amount of propellant that is placed into the tank to mitigate certain scenarios that can cause increased depletion of LH2 or LOX.

‘Flight Performance Reserve (FPR): FPR is extra fuel and oxidizer carried to protect for expected variation in systems’ performance. It is a measure of our ability to predict performance under normal operating conditions,’ noted the presentation.

‘FPR is a statistical calculation based on the flight derived dispersions in the following systems: SSME Isp, Thrust, and Mixture Ratio, SRB Isp and Burn Rate, Performance Collector, MPS Loads, and Unmodelled Forces and Moments. Provides three sigma protection for consumption due to systems dispersions. (~99.95 percent probability)

‘FPR includes a fuel bias, designed to balance the effects of non-6:1 dispersions. With an optimal inventory on a zero margin day, the probabilities of an LH2 LLCO and an LO2 cut-off would be equal.’

However, FPR does not protect against major issues, such as nozzle leaks.

What NASA may opt to do is to take an option noted as APM (Ascent Performance Margin), which will see the loading of an addition 3,500lbm of propellant into the tank, on top of the FPR.

‘APM Provides Additional Protection. Having APM greater than 0 decreases the risk of a LLCO. Provides more propellant to be consumed on an off-nominal day. A mixture ratio shift just below the Level I minimum detectable shift requires increasing FPR 3500 lbs to ensure a guided MECO (3 sigma).’

Expanding further on the addition of extra propellant in the tank to help protect Atlantis from actually needing the back up of Low Level sensors, the presentation appears to intimate a recommendation of adding an additional 3,500lbm of propellant to the tank via the APM option. STS-122 will already add 2,561lbm as FPR ‘reserve’.

‘FPR and APM: Flight Performance Reserve (FPR) is reserved for systems dispersions. Calculated from dispersions seen in flight since STS-66. Excludes failure cases (e.g. STS-93 nozzle leak). Not intended for use to protect main engine performance cases or failure cases. Protects for a 99.95 percent probability of having a guided main engine cut-off (MECO).

‘FPR for this mission is 2651 lbm (6:1 ratio) + 1063 lbm fuel bias. Ascent Performance Margin (APM) – margin over and above the FPR. Currently estimated to be 1300 lbm for an inplane launch. Could go to 0 lbm for launch at window close. An additional 3500lbm above FPR is required to protect for an LH2 LLCO probability without the LLCO system.’

Flight History:

Flight history has been playing a major role in helping the MMT decide on the procedures open to them, with three flights highlighted where the tank had around a second of LH2 remaining in the tank – after which the ECO sensors would have kicked in and shut down the SSMEs.

‘Three recent flights highlight the limitations of MOD’s insight into real-time vehicle performance. The LH2 consumption was high on each flight due to small performance cases, loading errors, and software errors:

‘STS-78: Small SSME Pc Shift (Pc icing), C2 constant error, LH2 Loading error (drove change to future prop inventory).

‘STS-97: Small FFM case (Kf shift) (E2043), Nozzle hardware change w/o software change, LH2 loading error.

‘STS-108: Small FFM Case (Kf shift) (E2043) E2043 FFM removed from service.

‘In each case, the ET had ~1 to 1.5 seconds of LH2 remaining in the system, and the MOD team was not aware of the impending LH2 cut-off. The performance cases could have been larger but still undetectable (less than Level 1), resulting in an LH2 depletion (and catastrophic failure of 3 SSMEs without ECO sensors).’

MCC’s Role:

(Click image for video). Flight Controllers already have procedures in place for issues during ascent, with another presentation using the example of the eventful STS-93 launch, which saw a nozzle leak on an SSME, leading to the LOX ECO sensors flashing just prior to MECO, causing shutdown and a 15 foot per second underspeed.

‘How does MCC Respond To a SSME Performance Anomaly: SSME performance anomalies are component failures within the SSME that result in off nominal mixture ratio, thrust, or ISP.

‘The Booster Systems Officer in MCC provides an assessment of the SSME health/status based on Flight Rule defined criteria determine when a performance anomaly occurs. Each performance anomaly has predefined levels in the Flight Rule that are used to quantify the magnitude of the performance impacts.

‘Flight Rule criteria was established to prevent the MCC from inadvertently modeling a SSME performance anomaly that may not be real. A small vehicle underspeed is acceptable compared to over modeling the performance case forcing an un-necessary abort. SSME community and Shuttle Program all agreed on this criteria.

There are many off nominal SSME failure scenarios that can be observed and not meet the criteria level in the Flight Rules. STS-93 was an excellent example where we had a nozzle leak that was below the Flight Rule criteria and therefore was not modeled in the ARD.

‘Once an anomaly has been determined the Booster Officer provides the performance case ‘type’ and ‘level’ to the Flight Dynamics Officer who inputs this data to the Abort Region Determinator (ARD).

‘The ARD is a processor that uses the time of occurrence of the anomaly and magnitude of the anomaly as provided by the Booster Officer to estimate the real-time performance impact to the vehicle.

ARD (Abort Region Determinator) is used to provide an estimate of how the SSME performance anomaly affects the vehicle underspeed. ARD protects for a 2-sigma uncertainty against an under prediction of the underspeed.

‘Underspeed is key because without a LH2 LLCO protection system, a low mixture ratio performance case that results in an underspeed will result in LOCV (Loss of Vehicle and Crew),’ added the presentation.

‘Assuming we don’t have LLCO protection is 2-sigma adequate when protecting against LOCV? Flight Rules, MCC training, and how we utilize the Abort Region Determinator computations are all based on having an operational Engine Cutoff System.

‘The philosophy we operate under is to not worry about an underspeed condition other than one that would not provide uphill performance. Low Mixture Ratio performance anomalies that would have been an uphill/no action case will now result in a TAL abort.

The presentation also noted two Flight Rule Changes to be implemented, should Atlantis be given the green light to launch.

‘Two Real Time Flight Rule Changes will need to be implemented for STS-122. Use of ECO Voltage Instrumentation. Provides limits we use operationally to determine if sensor is failed dry.

‘Actions for Loss of LH2 LLCO protection. Provides guidance for actions required for loss of LLCO if less than 3-sigma FPR confidence is not available.’

L2 members: All documentation – from which the above article has quoted snippets – is available in full in the related L2 sections, updated live.

**STARLIGHT: NEW STS-117 MISSION REVIEW MUSIC VIDEO** – STS-118 Mission review video also available. 

(Video section is FREE, but you need to sign up as a member of the forum to enter the video section of the site. We only use your e-mail to send you your password. It will not be used for spam etc.)

Related Articles