Current status on the LM DPS engine gimbal caution light problem

FA/Manager for IM Apollo Spacecraft ProgramOCT 30 196767-PA-T-99APA/Chief, Apollo Data Priority CoordinationCurrent status on the LM DPS engine gimbal caution light problem

1. This memorandum is to report the results of a very brief investigation into the adequacy of the LM Descent Propulsion System (DPS) engine gimbal caution light. Briefly, this light comes on if a difference between the gimbal drive signal and the gimbal response signal from the Y or Z axis trim malfunction logic is sensed. This signal is enabled only if the descent engine is armed. Once the gimbal caution light is on, the crew must determine if there is a display failure or a true gimbal failure. The basic question involved is whether or not practical procedures can be established utilizing only the existing spacecraft systems to make this decision during a lunar landing maneuver, or if some sort of modification if necessary in either the spacecraft hardware or computer program. The specific change most frequently requested is the addition of gimbal angle position indicators on the cockpit dashboard.

2. In summary, the MSC consensus is that probably crew and ground proce- dures can be developed and certainly insufficient justification exists right now to establish a mandatory requirement for any modification to spacecraft systems. Work is now being initiated to develop these proce- dures in detail.

3. The rest of this memo just fills in some background and there is no need for you to read any further except for your own amusement.

4. The problem For some time, a year or more, Flight Crew and Flight Control people have been concerned that the engine gimbal caution light provided a single cue for a mission abort situation. It was felt that the crew should be able to assess the situation and take proper action independently of MCC where actual gimbal angle deflection information is available via tele- metry. This assumption was made not so much to guard against communica- tion failure as in recognition of the fact that the probable time lag between the event and receipt of MCC advice is between 10 and 15 seconds. At least one formal attempt to improve this onboard capability was made early this year during a LM-2 (manned) review at which it was requested that some means be provided for verifying descent gimbal drive electronic assembly (GDA) failure. It was noted that the present design could result in mission abort with no actual systems failure. This was turned down and G&C was given the action item of establishing some procedural substitute by April 18, 1967, possible with the help of MIT. MIT facilities were not available for that purpose and recently Ken Cox (G&C) has taken steps to obtain assistance at Grumman utilizing their hybrid simulation facility.

5. Possible Solutions Considered On October 23 and 24, Flight Crew, Flight Control, MPAD and G&CD people reviewed the situation. In addition to defining some tentative ways of using the existing design (discussed in some detail later), possible changes to spacecraft systems were discussed which we ultimately eliminated as not presently justifiable. They included the addition of new LGC DSKY displays such as jet rate number (an indication of the extent of RCS jet activity) and/or the addition of direct readout of gimbal position in the cockpit. The latter would be provided through use of the existing gimbal angle sensing potentiometer or by a completely redundant system. There was also a question of whether new cockpit indicators would be needed or it existing indicators could be used such as the cross pointer which is already required for display of forward and lateral velocity in this phase of the mission or the FDAI needles which are also used to display attitude error and/or attitude rates.

6. Tentative Procedures with Existing Design It is anticipated that the procedures are different depending on how far into the Descent braking phase of the mission we have gotten.

a. Early in descent, when the situation is relatively non-time critical, there are two schools of thought. One is, when the light comes on, the crew would do nothing immediately. If the engine gimbals are truly running away the turning moments would eventually exceed the capability of the RCS to maintain attitude and the spacecraft would begin to rotate. Given this “second cue,” the crew would immediately switch to manual throttle control, dropping thrust to 10% which is within the capability of the RCS to maintain attitude, and would disable the gimbal drive motors. An abort would be necessary. If the gimbals are frozen or working correctly (false light indication) the mission phase would be continued. The alternate proposal is that the crew would immediately deactivate the gimbal drive motors when the light comes on and await advice from the ground as to the situation. It was felt that his might permit continuing on to the landing with either frozen or run away gimbals if sufficient RCS propellant was available to provide all necessary attitude and steering control with no further movement of the DPS engine gimbals. (Of course, this would necessitate a capability on the ground of predicting adequacy of the RCS propellant through the rest of the lunar operation.) If the ground determines that the failure was in the warning circuitry as opposed to the gimbals, they would advise re- activating them immediately.

b. During the latter stages of the Descent braking maneuver, proba- bly some time following high gate when the situation is time critical, the action would always be to deactivate the engine gimbal as soon as the light comes on. This is obviously necessary in order to prevent loss of space- craft attitude control due to a runaway gimbal which could create a serious crew safety situation. Mission rules would govern whether to proceed on to landing or to abort dependent on the situation—time, position, velocity gimbal misalignment, fuel remaining, etc. This, even runaway gimbals may not force an abort provided thrust is not aligned too far from the cg.

7. To complete the record, it should be noted that the LGC does receive an in-bit indicating the DPS gimbal failure at the same time the gimbal caution light is turned on, but it is currently programmed to ignore this signal and to continue sending steering commands to the DPS gimbal motors. If the crew disables the gimbal motors, a signal is also sent to the LGC which immediately stops sending commands to the DPS gimbal drive. (In fact, I might as well pass on something we learned, although it's not particularly pertinent to this matter, namely at any time the DPS is thrusting, provided the crew has not disabled the gimbal drive, the digital autopilot always attempts to keep the DPS thrust vector aligned through the spacecraft cg, even when the manual mode has been selected for attitude control.)

8. It is obvious we have not heard the end of this matter. At the least, detailed crew and ground procedures must be precisely defined. However, based on discussions we have had, I would be very surprised if the basic conclusion noted in paragraph 2 above turns out to be wrong.