Apollo 17 ascent module liftoff

[JayUtah]

Okay, I found it.  Although I've misplaced the schematic that the verbal description refers to.

Staging circuitry is low-level transistor-relay logic, as was used in most of Apollo's life-critical components.  The initiating signal is the FIRE signal generated by ABORT STAGE control panel pushbutton or the computer, ORed with the APS FIRE signal.  So if, for any reason, the APS engine ignites, state separation is also initiated automatically.

Immediately two sets of pyros fire:  the deadfacing pyros and the structural connection pyros.  So yes, the stages are mechanically separated immediately, although whether this is before or after APS ignition depends on which signal initiated the staging sequence.  But ABORT STAGE bypasses the MASTER ARM switch and initiates the APS firing sequence as well, so LM liftoff via ABORT STAGE energizes both inputs of the staging sequence OR input circuit -- eventually.  Another example of the doggedly redundant wiring in the critical systems.

15-20 milliseconds later, the umbilical-disconnect guillotine pyros fire.  So those of you worried about whether the ascent stage would slide or fall off the descent stage have only 2 hundredths of a second to make your case.

The delay is required in any case to allow deadfacing to complete, regardless of whether the APS has already received the ignition signal.  Since the APS would likely not be producing significant exhaust within the 20 milliseconds, there would not likely be any adverse effect of having the descent stage still attached.  Even though the guillotine blade is non-conducting, the physical severing of non-deadfaced components may damage ascent-stage components.  Hence it must occur even at the risk of APS blowback.

The staging circuitry also outputs additional signals to ensure the ascent stage is properly switched over to ascent-stage electrical power, water, and other services.

[ka9q]

I looked at the schematics (block diagrams, actually) last night and saw much of the same.

Pushing the ABORT STAGE button arms the pyro system (if MASTER ARM isn't already on) and fires the helium, fuel and oxidizer pyros to pressurize the APS (if they haven't already been fired). It also sends a signal to some electronics (or relays) called the CES but I haven't yet found the details for that device.

The CES in turn issues the actual staging command. First, four sets of separation pyros (one set in each quad) are fired, the interstage electrical circuits are interrupted (deadfaced) and an RC timer is started. After the timer expires, it removes power from the now-fired pyros and starts a second timer. When that timer expires, it fires the guillotine cutters.

The values of R and C aren't specified, but the text says both timers have the same period, 15-20 ms. That means the guillotine cutters are fired 30-40 ms after the separation pyros and deadfacing switches. There doesn't appear to be any way to slow down the sequence or to fire only some of the separation pyros.

So this still doesn't resolve the question of when staging actually occurs during the ascent sequence because we don't know what the CES box does. (Remember the ABORT STAGE button signal goes into that box, and the actual staging signal comes back out). But I'm inclined to think that staging does not occur immediately because there's a second switch, labeled simply STAGE FIRE/SAFE (and covered with a big bold switchguard) that would directly generate an immediate staging sequence, bypassing the CES, and if that's what they wanted they probably would have used it.

And if ABORT STAGE doesn't cause immediate staging, it's not clear to me what purpose is served by pushing it. The commander has already pressurized the APS manually by turning on MASTER ARM and flipping the Ascent He Press switch to FIRE after selecting one or both helium tanks. The fuel and oxidizer valves are fired at the same time.

Every time I look at these diagrams I'm amazed to see all those relays, diodes and simple transistor circuits and I'm reminded that pretty much all of Apollo looked like that. And I think of how unreliable an electromechanical device like a relay can be, and I can see how the designers went to extreme lengths to detect failures and provide workarounds. E.g., the actual pyro firing relays are all double-throw so that the pyro bridgewires are shorted until the relay operates. The pyro circuit does not share a common ground with the rest of the systems. Zillions of connections to the caution and warning system and to telemetry discretes are used to (hopefully) detect stuck relays and/or switches so that, for example, a stuck firing relay can be detected before somebody turns on MASTER ARM and fires a pyro unintentionally. A single "logical" diode is sometimes constructed from four diodes in series-parallel so any one failure (short or open) will not prevent proper operation. And of course just about everything is duplicated -- two sets of firing relay circuits, two explosive device batteries, two pyros on (most) valves, bolts and cutters, and so on. But there are still single points of failure that couldn't be detected until too late.

Although I would design this system very differently today, using modern technology, a lot can be learned by studying Apollo about anticipating failures, protecting against their devastating consequences (like a pyro firing prematurely) and providing workarounds. It's still relevant.

[ka9q]

I found the details of the CES logic. It's in the GNC subsystem. It generates the staging signal together with commands to open the propellant valves to the ascent engine. This means the engine valves are opened at the same moment that the stage separation pyros are fired, and before the guillotine cutters (because of the time delay between the two).

Two sets of valves must operate before the propellants actually enter the engine. One is a set of actuator isolation valves that allow pressurized fuel (AZ50) to enter the pilot valves where it is used as a hydraulic fluid. The second are the coils in the pilot valves themselves that allow the pressurized fuel to actually push the pilot valves open and let the propellants enter the engine. Both sets of valves are opened simultaneously. The mechanical design of the valves provides a ~50 ms oxidizer lead to prevent hard starts.

So basically it's a race, and there's no easy way to tell just from the circuit diagram whether significant ascent engine chamber pressure builds before the stages have been separated and the cables cut.

What's a little strange is that I can't see how the computer can actually fire the ascent engine unless the manual START button was pressed since the last time the manual STOP button was pressed -- and then the engine would fire as soon as it's armed. Either I'm missing something or there's an error in the diagram.

Edited to add: I think I figured it out. Relay K22-1 is a strange one -- it appears to have three sets of coils, two in a latching (set/reset) configuration and a third that is either a second latching coil or an independent actuating coil. This third coil is energized when the ascent engine is manually armed so that a final arming relay can also be turned on. At that point, the automatic ascent engine-on relay will start the engine.

[ka9q]

Staging circuitry is low-level transistor-relay logic, as was used in most of Apollo's life-critical components.  The initiating signal is the FIRE signal generated by ABORT STAGE control panel pushbutton or the computer, ORed with the APS FIRE signal.  So if, for any reason, the APS engine ignites, state separation is also initiated automatically.

The ABORT STAGE button does not directly stage the LM or start the APS. It sends a signal to the CES (in the GNC section) which in turn sends a signal back.

Immediately two sets of pyros fire:  the deadfacing pyros and the structural connection pyros.  So yes, the stages are mechanically separated immediately, although whether this is before or after APS ignition depends on which signal initiated the staging sequence.

Actually, staging always occurs simultaneously with first APS start, except in the unlikely case that staging was manually initiated with the normally-unused STAGE switch (not ABORT STAGE).

But ABORT STAGE bypasses the MASTER ARM switch and initiates the APS firing sequence as well, so LM liftoff via ABORT STAGE energizes both inputs of the staging sequence OR input circuit -- eventually.  Another example of the doggedly redundant wiring in the critical systems.

Yes, pressing ABORT STAGE will arm the ascent engine if it hasn't already been manually armed but not for 400 milliseconds. But then the START button must be manually pressed to actually start the engine, or the ENGINE ARM switch must be moved to ASCENT to allow the computer to start the engine.

Or at least this is how it looks from the diagram. I'll check the descent abort procedures to see if this is the case, because that would be the one time you'd push the ABORT STAGE button without the ascent engine being manually armed (because the descent engine is manually armed instead).

[Kiwi]

What initially looks slightly odd turns out to be exactly what you'd expect once you look at all the minutiae.

That line deserves this:

What initially looks slightly odd turns out to be exactly what you'd expect once you look at all the minutiae.
HeadLikeARock, ApolloHoax Forum
http://www.apollohoax.net/forum/index.php?topic=655.msg22193#msg22193



If only hoax-believers could see that too.

And a big thank you to all contributors to this very informative thread.

[JayUtah]

Or at least this is how it looks from the diagram.

I'd love to see those diagrams.  My source is the LM operations handbook, which refers to diagrams but does not provide them.  So when it says, "energize the K3 relay," I have to imagine what the circuit looks like.

[JayUtah]

It also sends a signal to some electronics (or relays) called the CES but I haven't yet found the details for that device.

Control Electronics Section.  It's the agglomeration of all the control logic for arming and firing any of the rocket motors.

When that timer expires, it fires the guillotine cutters.

That second timer is covered in the sequence description, but I missed it on my first reading.

And I think of how unreliable an electromechanical device like a relay can be, and I can see how the designers went to extreme lengths to detect failures and provide workarounds.

The irony is that in the 1960s those techniques were the ones considered well understood and reliable (at the system level).  The redundancy etc. you see is the expression of that understanding.  The Apollo designers were working from a 30-year experience base in relay-based logic.

Although I would design this system very differently today, using modern technology...

As would we all, and the overall approach is undoubtedly still relevant.  We can design according to the present evolution largely because the digital control techniques that were still considered somewhat experimental and unknown in the 1960s are now the status quo, precisely because we have that 40-year experience base since Apollo to fall back on.

I attended a presentation on theatrical automation a few years ago given by the guys who run Cirque du Soleil's show Ka in Las Vegas.  While they use COTS controllers and relatively standard techniques in industrial automation, the simple old tricks are still considered the safest.

[ka9q]

I'd love to see those diagrams.  My source is the LM operations handbook, which refers to diagrams but does not provide them.  So when it says, "energize the K3 relay," I have to imagine what the circuit looks like.

I was using the Apollo Operations Handbook Lunar Module LM 6 and Subsequent Volume I Subsystems Data, i.e., Apollo 12-14. Not sure where I found it, possibly through the NTRS. There's also one for LM 10 and Subsequent, i.e., the J-mission LMs, available through the ALSJ at https://www.hq.nasa.gov/alsj/LM10HandbookVol1.pdf but the diagrams are smaller and harder to read.

The ALSJ also has a better scan of just the GNC section of this document at https://www.hq.nasa.gov/alsj/LMA790-3-LM-2.1.pdf

In this latter document, see pages 2.1-39 and 2.1-40. The ABORT STAGE button also appears on 2.1-37  and 2.1-38 (Descent Engine Control) where it turns off the Descent Engine Override if it's on.

[JayUtah]

...but the diagrams are smaller and harder to read.

Or in some cases simply not provided.  BTW if you ever come across Vol. 2 of this publication, snag it immediately.  Lots of people are looking for it.

...where it turns off the Descent Engine Override if it's on.

Sensibly enough. 

You'd also need to wait for the thrust decay before staging.  There's a dead-man curve in the LM descent, where you're too low to abort without the sequence taking too long and you'll hit the ground.

[ajv]

BTW if you ever come across Vol. 2 of this publication, snag it immediately.  Lots of people are looking for it.

Do you mean the LM 10 and Subsequent specifically?

Because Volume II (Operational Procedures) of the LM 5 and Subsequent is on the CD that came with Sullivan's Virtual LM book and Volume II (Operational Procedures) of the LM 11 and Subsequent is on the Virtual AGC site.

[JayUtah]

Thanks, I'll check it out.

[JayUtah]

Do you mean the LM 10 and Subsequent specifically?

I need to double check with the people who were asking me, which exact volume is missing.  The request came from Rick Sternbach, whom some of you may know.  We occasionally exchange document finds, and I'm almost entirely certain he'd be well aware of the Apogee works on Apollo, and almost certainly of Scott Sullivan's work.  Honestly the question is so old I can't even remember which Apollo spacecraft it referred to.

[ka9q]

BTW if you ever come across Vol. 2 of this publication, snag it immediately.  Lots of people are looking for it.

How about Apollo Operations Handbook, Lunar Module, LM 11 and Subsequent, Volume II, Operational Procedures, available on the ALSJ as https://www.hq.nasa.gov/alsj/LM11HandbookVol2.pdf

You'd also need to wait for the thrust decay before staging.

I'd presume this is done in software by the PGNS or AGS, but there's a 400 ms timer in the CES, started by pushing the ABORT STAGE button, that arms the ascent engine if it isn't already armed, but only so it can be started with the START pushbutton. (I can't see any way for relay K22-1 to get energized except by pushing START or flipping ENGINE ARM to ASCENT.) Perhaps this is to force a wait for DPS thrust decay when an overly anxious astronaut pushes the START button too quickly after ABORT STAGE. As I said, I can't see any way for the computer to automatically start the APS after ABORT STAGE is pushed during descent, and that would seem to be a rather time-critical operation.

There's a dead-man curve in the LM descent, where you're too low to abort without the sequence taking too long and you'll hit the ground.

Right, as discussed extensively by Gene Kranz in his book.

[ka9q]

There were obviously several revisions of these handbooks, and while both volumes are available the versions don't necessarily match.

OTOH, we don't actually know that both volumes were always revised together. We need the revision histories.

[JayUtah]

The revision control index in the front suggests that each page and/or section was severally revisable.  No two LMs were exactly the same, but there is obviously a marked difference between the G-type and J-type spacecraft.