In parallel with vehicle and test stand preparations for a second Green Run Hot-Fire test later in February, the NASA Space Launch System (SLS) Program and Core Stage prime contractor Boeing are reviewing rule changes for the full, eight-minute firing.
The Core Stage hardware and software executed the first-ever final countdown, engine start, and “plus count” firing well past T0 in the first test on January 16, but some pre-test predictions by analytical models did not match the integrated system behavior leading to the stage’s first-ever safe shutdown before critical test objectives could be attempted or completed.
SLS engineers will re-calibrate models and predictions with data from the first test to adjust some of the ground rule parameters, which will be uploaded to the vehicle’s flight computers ahead of the second test-firing.
Aggressive gimbaling test trips hydraulic system limits
The first test on January 16 ended after only one minute when a high-speed gimbaling test drove the stage’s hydraulic systems outside conservative ground rules intended to protect the vehicle, which will go on to fly the first SLS launch on Artemis 1.
The SLS Core Stage Green Run is a design verification campaign that has seen the program’s first flight article in the B-2 Stand at Stennis for over a year. The final two of eight test cases operated the fully-active stage under final countdown, liftoff, and ascent conditions for the first time in the program.
When the vehicle flies on its debut Artemis 1 mission, only a large stream of data will remain for analysis; this Green Run campaign is only planned to be conducted once, so it provides a unique opportunity without committing to flight yet to perform up-close and more invasive examinations of the stage before, during, and after a static firing.
The static test-firing on January 16 also provided the SLS Core Stage team with their first opportunity to validate their current assumptions and predictions about how the vehicle would behave as an integrated stage in launch-like conditions. The partially-completed test-firing demonstrated the beginning and ending of a static-fire, but was stopped after only a minute of run-time on the engines.
The four Core Stage engines were started at T-6.6 seconds as they will be during a launch. After the simulated liftoff at T0, they throttled up to the new SLS full power setting of 109%. At T+60 seconds, the first of three test objectives started with the stage’s hydraulic thrust vector control (TVC) system gimbaling all four engines simultaneously.
The first “power steering” test in the Hot-Fire had the stage turning its proverbial steering wheel as fast as possible at the top end of the stage’s gimbal requirements. When in motion, it’s generally a bad idea to make the sharpest turn you can while moving at high speed, but given the opportunity in a static test stand, the controlled laboratory experiments would help evaluate the real-world behavior of the firing stage.
The stage’s four veteran Aerojet Rocketdyne RS-25 engines were running again for the first time since fulfilling their duties during their last Space Shuttle launches, but it was the first time a Core Stage was firing them in an SLS environment. Objectives of the static gimbal tests included running the TVC systems and the hydraulics supporting them within their designed operating envelope, but closer to the outside than the middle for some parameters.
One second after the first “TVC check” started, test limits were violated, and as programmed, the SLS flight computers running at the top of the Core Stage shut down the engines, aborting the rest of the Hot-Fire.
“It was actually two parameters, low hydraulic reservoir fill percentage and a low hydraulic return pressure or suction pressure. And the combination of those two initiated the CAPU (Core Auxiliary Power Unit) to shutdown,” Jonathan Looser, NASA SLS Core Stage Propulsion Lead, said, referring to hydraulic system 2. “It is believed that the gimbal test is what pushed us below the lower limit that caused the shut down. And that gimbal test is intentionally stressing the hydraulic system to its maximum required rate, and that drove us just below the lower limit.”
Credit: Brady Kenniston for NSF.
(Photo Caption: The flight article for Artemis 1, Core Stage-1, fires in the B-2 position of the B Test Stand at Stennis Space Center on January 16. The Hot-Fire was cut short after 67 seconds of engine runtime when the stage’s hydraulic performance fell below conservative limits just as the engines were being aggressively gimbaled for the first time in the test.)
The three flight computers run a special Core Stage-only, Green Run variation of the NASA-developed SLS flight software, and the Mission and Fault Management algorithms in the software look at data from different avionics boxes distributed throughout the stage. There are four Thrust Vector Control Actuator Controllers (TAC) in the engine section, with one paired with each hydraulic system.
“These particular [parameters], they flow through the TAC, so we see them as the flight software interrogates the TAC either with commands and just general health and status information every 20 milliseconds or 50 Hertz,” Dan Mitchell, NASA’s Technical Lead for SLS Avionics and Software Engineering, said.
The hydraulic system limit violations triggered a flurry of activity and commands, with the shutdown of CAPU 2 triggering commands to both compensate for the capability lost and to shutdown the engines and abort the test. For the Hot-Fire test, the commands to abort were issued in the processing cycle just 20 milliseconds after the auxiliary power unit was shutdown.
“We got the indication of those two violations, we initiated first the safing of CAPU 2 and then quickly followed in the next [processing] frame with beginning the safing of the stage itself, which includes sending shutdown commands to the engines,” Mitchell explained.
The hydraulics in the stage are used for both the TVC power steering and for controlling the engine power settings. The Core Stage has redundancy in its TVC hydraulics, so when CAPU 2 was shutdown, the speed of two of the other CAPUs was increased to handle the gimbaling needs of four engines with only three CAPUs.
“[With] the cross-strapping between the TVC actuators, you can lose one whole system and the adjacent systems will [compensate],” Looser noted. “Immediately after that, as a part of the logic of the adjoining two systems, CAPUs 1 and 3, those systems increased to 105%. And that’s part of the redundancy in the system that the adjoining hydraulic systems can take over and power the actuators for the system that has been shut down.”
In contrast, the hydraulics for engine valve control for engine start, throttling, and shutdown are not cross-strapped between the four systems. When CAPU 2 was shutdown, there was no immediate effect on hydraulic power control for Engine 2, but there could have been an eventual impact if the test continued.
“You have enough pressure in reservoirs and the accumulators [that] if you shut down [a CAPU], the system continues with that hydraulic system for some period of time before you lose the ability to control that engine,” Looser said. “It would go into a hydraulic lockup and you would have to pneumatically shut down that engine.”
“For the ground test, we went directly into [engine] shutdown. And so it didn’t matter for the ground test, but in flight it would depend on when that failure occurred,” Looser added, speaking about the difference between the test parameters and what would have happened had this situation developed in flight.
During the January 16 test, while the hydraulics were being used to gimbal the engines as fast as required, the engines were also set for the first throttle down of the test at T+65 seconds, from 109% power level to 95%. But the stage didn’t get that far, with shutdown occurring at T+61.2 seconds.
Looser noted that the program believes the vehicle performed well, but not necessarily as predicted in some areas. “All four [hydraulic] systems behaved very similarly in terms of the data on the pressures and the reservoir levels,” he said. “System 2 just happened to be the one that triggered the limit, but it was not anomalous compared to the other three systems.”
“What we believe is that there’s nothing anomalous about the way that the TVC system is behaving, it’s a matter of seeing all four systems operate together in a launch-type environment and learning how that operates compared to how we’d predicted in our models and looking at how we can adjust some of those parameters for a future test. But there’s no indication that system 2 or any of the other three systems had any anomalous behavior in terms of how the hardware operated.”
⚠️ Vroom Vroom ⚠️
Before @NASA_SLS and @NASA_Orion can lift off, it must first make the 4.2-mile trek from the Vehicle Assembly Building to Launch Pad 39B. Teams are working to ensure the crawlerway is able to support the weight for the #Artemis I mission https://t.co/SFP1HApjBA pic.twitter.com/moFuMS5nap
— NASA's Kennedy Space Center (@NASAKennedy) February 4, 2021
Analytical modeling and pre-test predictions were based on data from individual component and some subsystem testing, but the January Hot-Fire test was the first time the stage’s high-energy systems were used with the all-up integrated system. Going into the test with “known unknowns,” NASA SLS and Boeing chose to err on the side of safety.
“As the team sets the limits for all these different pieces of hardware, they use test data, they use engineering judgment, and [they] walk the fine line between making sure that the first time we use any of this hardware we have sufficient protection to keep the stage in a safe configuration but also to let it operate through the test regime,” John Shannon, Boeing’s SLS vice president and program manager, said in a post-test media teleconference on January 19.
“I think there’s a judgment call in there for how you set those parameters to ensure that the stage remains in a good configuration for a further test or a launch. And we do default in the test to making sure that the hardware stays in good shape.”
Anchoring the models, updating limit parameters
After reviewing the data for two weeks after the test, NASA decided to repeat the Hot-Fire test, tentatively in late-February, in order to try to achieve important test objectives that couldn’t be started or completed the first time. Although there is a desire to minimize the “wear and tear” on the Core Stage and RS-25 engine flight hardware, there is enough margin to continue testing and repeat the Hot-Fire.
“Running a longer hot fire is the right thing to do for our customer and for the astronauts who will fly future SLS rockets,” Shannon said in a company feature. “Doing so will not add significant risk to this Artemis I flight hardware, while providing important data to support the upcoming launch and the certification of all future core stages.”
Mitchell added: “We really wanted to get more MPS (Main Propulsion System) data, we really wanted to get more TVC integrated performance and especially our GN&C (Guidance Navigation and Control) guys are really interested and really looking in detail at the TVC system so that they can validate their control algorithms and, if necessary, make any tweaks to those. If they have to make any tweaks, it would be most likely to some of the control algorithm gains, which again are parameters.”
(Credit: NASA TV)
(Photo caption: All four RS-25 engines fire in the B2 test stand at Stennis on January 16 as part of the first Hot-Fire test of the Green Run campaign. A second static-firing will aim to gather data on a full-duration, eight minute firing of the engines and test of the stage’s ability in order to certify the SLS Core Stage for flight.)
The full-duration Hot-Fire test plan has three gimbaling test objectives; after the first TVC check was completed, a longer frequency response test was planned beginning at T+2 minutes 30 seconds to provide data that could be incorporated into the current GN&C models. The second TVC check would then be conducted just before the end of a full-duration burn, followed by a test objective to allow the low-level engine cutoff sensors to trigger engine shutdown.
A low-level cutoff would alert the stage controller and flight software logic that liquid oxygen is running low, triggering an engine shutdown to ensure the correct propellant (liquid hydrogen) and oxidizer (liquid oxygen) ratios are maintained for proper engine shutdown.
Typically, in flight, the Core Stage will shutdown its engines before propellant depletion based on navigation and velocity targets.
During these checks, the stage simultaneously drives all four engines in small circles at the maximum required gimbal rate; in the frequency response test, the stage swings the four engines in sinusoidal patterns at different magnitudes to measure the stage’s dynamic structural response.
NASA and Boeing SLS engineers are working on adjusting some of the testing limits based on what was learned from the first test-firing. Data from the test has helped better “anchor” and calibrate analytical models with the stage’s live performance.
“We have anomaly resolution teams that are looking at some of the various issues that we encountered during the test and there’s one specific to this issue [with the hydraulic system parameters],” Looser said on January 28.
“They’ve been plugging that real data from the test from those 67 seconds of runtime back into the models and the predictions with the goal of updating the limits for … another test. Those parameters are all easily adjustable so that as we re-run those models and see how conservative some of our earlier assumptions and predictions were compared to how the system operates and what the real requirements are, we can adjust those.”