TCS (Terminal Countdown Sequencer)

This page is still under development.

[edit] Apollo 17 Malfunction

At T-167 seconds the Terminal Countdown Sequencer (TCS) failed to issue the "S-IVB LOX Tank Pressurization" command. When it was visually observed that the S-IVB LOX Tank was not being pressurized, the console operator initiated action to manually control S-IVB LOX Tank Pressurization. The tank was pressurized, but because an interlock relay was not energized when the TCS failed to issue the T-167 second command, a countdown hold was experienced at T-30 seconds.^[1]

Schmitt: (Oral History 2000) Somewhere in the deep dark past of computer programming, a programmer had told the final sequencing checks that the computer was going to do — to look to see if a signal to pressurize a booster oxygen tank had been sent. Not whether it had been received and acted upon, but had the signal been sent.

Schmitt: (Oral History 2000) Well, when they went through that particular point where that signal was supposed to have been sent and the tank pressurized, the signal didn't get sent. The computer didn't send the signal, but the person in the launch control center saw that that didn't happen and just pressed a button and pressurized the tank. So everything was fine, but the computer didn't know it. When they went through the final sequence, the computer saw that that signal hadn't been sent, and it said "Hold."

Schmitt: (Oral History 2000) So the computer just shut everything down. That's what you want them to do, it's just that it was programmed wrong. Garbage in, garbage out. So what they did, they actually went into the launch computers, tracked down that point and hard-wired around that particular sensor so that the next time the computer went through, it would believe that the signal had been sent. Sure enough, it believed it, and off we went. We were two hours and forty minutes late, but, nevertheless, we were on our way.

When Jack refers to the "programmer", he means the 1960's version — the TCS used relay logic, not software, so the "program" was the wires connecting the relays together. And when he says "hard-wired around the sensor", he means that literally.

[edit] Leaky Diodes

Investigation of this failure at KSC discovered two failed diodes in the TCS logic circuitry, one of which inhibited the T-167 second S-IVB LOX Tank Pressurization command. Excessive reverse current leakage through the partially shorted diodes caused intermittent operation of TCS outputs.

The two failed diodes had been in service six years. Each TCS contains 1,827 of these diodes with approximately 1500 of these capable of causing a launch hold or scrub if they failed between CDDT and launch. Of 2,196 similar diodes tested, 7 additional diodes exhibited reverse current leakage in excess of the specification. Extensive analysis of the diodes that failed along with a number of non-failed diodes from the same printed circuit boards found most probable cause of failure was contamination in microscopic cracks in the semiconductor chips.

The "Work-Around" for Apollo 17 would not be acceptable if a TCS problem occurred during the Skylab-2, -3, and -4, and ASTP countdowns due to the short launch windows. Therefore, pads 39A and Pad 39B were modified to provide three TCS's in each launch vehicle, rather than the present one, with voting logic so that any two of the three TCS's will assure that the proper signals are provided. This reduced the probability of a false command being initiated and also assured that no single electrical failure would result in loss of the proper terminal countdown command.

A block diagram of the automated preflight checkout hardware for the Saturn launch vehicle. (From IBM, SLCC Programming System)

Typical firing room layout during the Saturn era. Nearly 250 engineers would crowd this area during a countdown. (From IBM, SLCC Programming System)

[edit] Launch Processing Computers

Dual computers were needed on LC-39^[2], since the computer could not accurately process analog signals from the launch vehicle five kilometers away. The slave computer in LC-39 was housed on the mobile launcher. Dual data links, running beneath the crawlerway, tied it to the 110A computer in the launch control center. Magnetic tapes and other related equipment were moved back from the mobile launcher to the control center, to be available even during hazardous pad activities. The mobile launcher's computer tied in with the Saturn V vehicle, its peripheral equipment (line printer, card reader-punch, magnetic tapes), the launch control center computer via the data link, and the range clock system. Commands to the launch vehicle went through a discrete output system which employed triple-modular redundancy to minimize errors. Approximately 2,000 test responses returned from the Saturn V. A remote control capability in the control center allowed engineers to continue Saturn tests in the event of a computer breakdown on the mobile launcher. The RCA 110As in the control center had even more interfaces; their data channels controlled signals to and from peripheral equipment, control consoles, the dual data links to the pad, digital data systems of the launch vehicle, computer display systems, the spacecraft computer system, and the countdown clock system.^[3]

References

1. ↑ Apollo 17 Saturn V Flight Evaluation, Section 3.0 Launch Operations
2. ↑ Saturn V computer complex Template:Citation
3. ↑ Richard Dutton and William Jafferis, "Utilization of Saturn/Apollo Control and Checkout System for Prelaunch Checkout and Launch Operations," paper read at New York Univ., Project SETE, 24-28 July 1967, pp. 3-34 through 3-43; Medlock interview; Thompson interview.
4. ↑ MEMORANDUM RM-4785-NASA JANUARY 1966: SURVEY OF SATURN/APOLLO CHECKOUT AUTOMATION, SPRING, 1965, DETAILED DESCRIPTION L. T. Mast, V. Mayper and C. Pilniek, Section G-12, page 33
5. ↑ Template:Citation NAS 1.26182505; NASA-CR-182505; NASW-3714 http://ntrs.nasa.gov/search.jsp?R=615437&id=1&qs=Ntt