karn@eagle.UUCP (Phil Karn) (07/16/83)
As I mentioned several days ago, the first motor firing which occurred on 11 July had been programmed for 107 seconds; the motor actually fired for 190 seconds. The reason for this has been determined to be a design error in the Liquid Ignition Unit (LIU) on the OSCAR-10 satellite which somehow escaped being detected during extensive testing. The LIU is an autonomous hardware box which has direct control over the valves associated with the 400 Newton hypergolic liquid fuel kick motor. This motor burns a mixture of unsymmetrical dimethyl hydrazine (UDMH) and nitrogen tetroxide (N2O4), which are called "hypergolic" because they burn instantly on contact with each other without requiring a spark. The kick motor subsystem works as follows: A high pressure bottle mounted in one of the arms was loaded with about 400 bar (1 bar ~= 1 atmosphere) of helium. The output from this tank goes through a pyrotechnic valve to a regulator which produces approximately 14.5 bar. From the regulator the lines split and pass to the two fuel tanks. Each pressurization line contains another pyro valve and a check valve, preventing fluid in one tank from backing up into the other. Pickup tubes in each tank lead to the engine firing valve, which is mounted on the engine itself. Another helium line runs to the engine, as the relatively large fuel valve is actuated by helium pressure controlled by a smaller electric solenoid. The LIU functions (when its power has been turned on by computer command) by monitoring the computer-generated engineering beacon. Internal to the LIU are a set of PN (pseudo-random) sequence generators. In order to actually fire the valves or the motor, the computer must send the correct PN sequences, which are hundreds of bits long. These "keys" are not present in the software at launch and were loaded only shortly before motor burn. This feature makes it virtually impossible for the computer to crash in such a way as to fire the motor accidentally. The first job of the LIU is to fire the pyro valves (which can only be opened once and cannot subsequently be closed) thereby pressurizing the tanks. This was done successfully immediately before the first motor burn. The second job of the LIU is to open the engine control valve (firing the engine) for precisely timed intervals. Again, this is done by decoding the proper PN sequence, which was followed immediately by an 8-bit quantity giving the burn duration in 2.56 second units. This byte is extracted from an 8-bit serial-in-parallel-out shift register and parallel loaded into a pair of 4-bit up/down counters. The engine valve is opened, a clock derived from the beacon bit rate counts the counter down to zero, and the valve is closed. It turns out that an error in laying out the PC artwork in the LIU reversed the bit ordering between the shift register and the high order counter. I.e., instead of the bits being interpreted as 7 6 5 4 3 2 1 0, they were loaded as 4 5 6 7 3 2 1 0. The programmed burn count was hex 2A (42 decimal, or 107.52 seconds at 2.56 sec/count). This was permuted into 4A hex, or 190 seconds. We were quite lucky that a count with bit 4 high wasn't set, or the resulting burn would have depleted all our fuel. As it is, we can recover with the remaining fuel (about half) and attain an orbit fairly close to the originally planned one. Instead of an inclination of 57 degrees, we will be able to reach about 51, and the perigee height will probably be 2000-2200 km instead of 1500 km. We could bring the perigee back down to 1500 km "for free", but leaving it higher will help slow the precession of the apogee latitude which is otherwise increased by the low inclination. The net result of all this is that the apogee point will continue to occur in the northern hemisphere for only about 4-5 years instead of the originally planned 7. Score: ESA 1, AMSAT 1! Phil Karn, KA9Q Asst VP Engineering, AMSAT