Technology test bed engine real-time failure control

The Real-Time Failure Control (RTFC) program involves development of a failure detection algorithm, for the Space Shuttle Main Engine (SSME). This failure detection approach is signal-based and entails monitoring SSME measurement signals based on predetermined as well as on-line computed mean and standard deviation values. Twenty-four engine measurements are monitored in the algorithm and provisions are made to add more parameters if needed. Each of the first values of every measurement signal at the algorithm start is checked against safety limits placed around a pre-computed engine-to-engine mean value (MV) with a bandwidth equal to a given multiple of the pre-computed standard deviation (SD). If several parameters are out of the bounds of these limits a failure is signaled. During the first two seconds (after algorithm start) a moving average (MA) and a SD is computed on-line in real-time. The moving average of each parameter is computed by averaging the incoming signal measurement with the four most recent previous signal measurements. The moving average is updated at every sampling interval (40 msec) and is checked against a similar safety band around the initial signal value for each parameter. If several anomalies are registered, a failure is signaled by the algorithm. At the end of the two-second interval the MA is fixed as the mean value for the rest of the algorithm operation and a safety band is placed above and below this value equal to a multiple of the computed SD. However, the safety band is adjusted by adjusting the mean value when propellant tank repressurization and venting take place. 'Influence Coefficients' are used to make the necessary adjustments to the safety limits of those parameters that are affected by repressurization and venting or valve closure and opening. The MA is, in both cases, continuously updated and checked against the safety band. Once more, if several parameters exceed the limits a failure is signaled. At the start of every scheduled power transient the algorithm is stopped. It is re-initiated after two seconds from the termination of the power transient and the process is repeated. The final report is divided into four major sections. The most encompassing of all is the discussion section that has sub-sections on: (1) RTFC algorithm development, (2) RTFC simulations; (3) RTFC current limitations; and (4) enhancements planned for.