(YASA-CS-75966) SIMUL.9'ICS STUD? O ? GX.

IYXN1 N75-75419
BOCST AECBT SITU4TICNS (Chance V o u g h t COrp.)
70 P

-----
Unclas
C0/98 23569
.
-----t I ENT I A 1
0N F O

SIMULATOR STUDY
OF
GEMM l3OC+STABORT SITUATIONS
f ' -\
L-,
NASA Contract No. NASS-255
Report No. 00.51
Judy 1962

Prepared by:

Manager, Life Sciences

Manager R&D Section

-t0.N fDI E NT IA 1 -J
 FOREWORC.

The basic objective of this study wits to obtain a qualitative eval-

uation of the pilot's ability to observe displays of contingency informa-
tion and reliably make abort decisions in the Gemini spacecraft. The
results of the study are so reported in this document. However, in the
interest of providing a brief but still comprehensive report, the follow-
ing obtained quantitative data used in further substantiation of the re-
sults have been omitted from this document. This information may be
obtained upon request from the study cont:ractor.
-- Typical vibrations experienced by two subjects during
the establishment of the vibration profile as reported
herein.
-- Per cent successes vs. the total number of runs simu-
lated for each malfunction problem.
-- Per cent error score by subject by malfunction run.
-- Subjective evaluation of response cues by subject.
-- A iypical randomization schedule of runs for one sub-
ject.

-- 23
The standard deviations of the means f a each of the
malfunction runs simulated,
-- Asults
brief description of the application of the study re-
to the population o€ astronauts in general and to
modified cockpit designs.

i
 TABLE O F C0NTE:NTS
Page No.
1.0 SUMMARY.. ........................ 1
2.0 TNTRODUCTION. * . e 2
2.1
2.2
Statement of the Problem . . . . . . .........
Objectives and Scope of the Program
......... 2
2
3.0 METHOD.. . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. I Titan Il Malfunction Analysis . . . . . . . . . . . . . 3
3.2 ExperimentalDesign . . . . . . . . . . . . . . . . . 4
3.3 Subjects . . . . . . . . . . . . . . . . . . . . . . . . 5
3.4 Experimental Procedure ................ 5

4.0 MECHANIZATION OF SIMULATION .... ...... 7

4 . 1 The Instrument Panel . . . . . . . . . . . . . . . . .
4.2 Computer-Flight Simulator Arrangement .......
7
4.3 Programming the Standard Booist Trajectory .....
9
13
4.4 Programming the Malfunction E!uns . . . . . . . . . . 13
5.0 RESULTSANDDTSCUSSION. . . . . . . . . . . . . . . . . 16
5 . 1 Results of Individual Simulated Runs . . . . . . . . . 17
5.2 Abort Mode Selection Response . . . . . . . . . . . . 28
5.3 Automatic vs. Manual Abort . . . . . . . . . . . . . . 28
5.4 Proposed A b o r t Monitoring Panel Displays . . . . . . 28

6.0 CONCLUSIONS. ....................... 31

Appendix A, Theoretical Analysis of A b o r t Situations - Titan II

ii
 LIST OF FIGURES AND TABLES
Figure No. Page No.
1. tnstrument Panel Used in Study ...... ..... . 8
i 2. Vibration Program . . . . . . . . . . . . . . . . . . . 11
3. Noise Program. . . . . , . . . . . . . . . . . . . . . 12
4. Proposed Abort Monitoring Panel . . . . . . . . . . . 30

Table No.
1. Type and Number of Malfunction Runs Simulated .. . 3
2. Response Time Summary . . . . . . ... . . ... . 32

iii
 1.0 SUMMARY
-_-.--

Results of the Gemini Boost Abort Simulation Study indicate that

pilot monitoring of the booster systems with manual abort capability is a
logical extension of aircraft piloting arid escape procedures. Critical booster
malfunctions were readily apparent through multiple cues such as linear or
angular accelerations, noise, and cockpit displays.
In contrast to aircraft practice, the study showed that escape from
rocket-launched spacecraft is more straightforward because the precise r e -
lations between time, dynamic pressure, altitude, and staging events enables
definite predetermined abort procedures.
An important aspect of the manual. abort study was the elimination
of inadvertent and hazardous aborts which would have resulted from malfunc-
tioning automatic sensor circuits or sensor limits which, to avoid complex
instrumentation nonlinearities, were set too conservatively (e. g., fuel and
oxidizer pressure MDS settings). Additional gains in reliability and simplic-
ity should be realized by eliminating the spacecraft and booster automatic
sequential systems and providing manual control of the events after the mal-
function begins.
There were only a few malfunctioris which required an extremely
fast reaction time. The study showed that nianual abort was possible within
i one second of the onset of such failures.

1
 2.0 INTRORUCTION
---
2.1 Statement of the Problem
The ability of the Gemini pilot to observe displays of contingency
information and reliably make abort decisions should influence the design of
the malfunction detection and escape initiation system and the integration of
man in the overall system. Furthermore, the effectiveness of these systems
reflect directly on the safety of the pilot and h i s ability to recover the space-
craft from conditions of emergency. It could also have a direct bearing on
achieving an overall abort system of minimum complexity and maximum r e -
liability. In pursuit of these objectives the initial simulation study reported
herein was conducted to obtain a qualitacive indication of pilot responses to a
variety of abort situations which could occur during the boost phase of a
Gemini mission. The investigation was conducted in response to NASA Con-
tract No. N A S 9-255.
2.2 Objectives and Scope of the---Program
The basic objective of the program was to obtain a qualitative eval-
uation of the pilot's ability to read and interpret displays of contingency infor
rnation and their associated sound and motion cues, and make proper abort
-
decisions. Specifically, measurements were taken of the pilot's total re-
sponse time to interpret a display presentation and to actuate a 'P" ring
simulating abort initiation. The study was an open loop type in that the sub-
ject did not control the flight path or motion of the simulator in any way. His
basic task was to monitor the displays, make decisions in the face of impend-
ing catastrophies, and actuate an abort handle, simulating escape from the
vehicle either by seat ejection or capsule escape. His only other task was
to position a mode selector switch to either seat or capsule escape.
A l l simulated abort situations were extracted from the results of
an analysis of failure modes of Titan TI. It should be emphasized that both
the booster and spacecraft hardware were i n the design phase at the time
this study w a s conducted. Subsequently, several of the design features,
operational procedures, and cockpit displaq s have been changed.
In establishing the pilot response times required for abort action,
it was necessary to make several assumptions regarding vehicle dynamics.
These assumptions may be pessimistic based on actual vehicle performance
data.

2
 3.0 METHOD

3.1 Titan n Malfunction Analysis-

To determine the most desirable abort situations to be simulated
during the study, a thorough malfunction anzlysis of failure modes of a Titan
n booster was conducted, based on data presented in References 1, 2, and 3.
Each failure mode was analyzed to show the series of events which take
place in r e a l time from the onset of the malfunction to catastrophe, the latter
being defined as a "fire ball". The results of this theoretical analysis are
presented in Appendix A.
From the analysis, eight major types of malfunctions were selected
for investigation through simulation. Variations in the modes of failure within
each type of malfunction resulted in the programming of a total of 23 distinct
malfunction runs to ensure a reasonable sampling of pilot behavior in response
to the more critical failures. In addition, a no-malfunction normal boost run
w a s included which is not shown in the table below. These runs, listed as
follows, were verified by the NASA prior to executing the experiment.
TABLE I
TYPE AND NUMBER OF MALFUNCTION RUNS SIMULATED
Problem* Type of MalCunction No. of Run2
~ ~- ~- ~

1-1 Partial loss of thrust - one engine 1.

5 ( l s t stage)
n-1, 2 Total loss of thrust - one engine 2
(1st stage)
n1-1, 2 Total loss of thrust - both engines 2
(1st stage)
IV-2, 3 Hardover engine (1st stage) 2
v-1, 2, 3 Staging failures 3
VI-1, 2, 3, 5, Tank (fuel and LOX) pressure a
6, 7, 8, 11 losses
Vm-1 D C power failure 1
IX-1, 2, 3, 4 Instrument warning light failures 4
-
TOTAL NUMBER OF RUNS 23
*n....m
r l u u ~ac i r ~ &-e
s identified as shown in Coiumn i, 'f'abie A-i,
Appendix A

3
 The selection of malfunction runs :L) be simulated was based on (a)
their probability of occurrence, (b) their severity i f they occurred, and (c)
pilot response time requirements. I n relation to the third criterion, those
runs on which the data indicated the pilot could clearly diagnose his situation
and abort at "leisure" were eliminated. A counter clockwise roll malfunction
following lift-off in which the pilot has at least 14 seconds to abort, is one
example. There was one run eliminated in which the analysis showed a r e -
quired response time of 0.02 seconds which is unquestionably beyond human
capability. This was the case of a hardover engine gimble just of€ the launch
pad.
It should be pointed out that all runs requiring stage 2 fuel and
LOX monitoring during first stage burning (Problems VI-4, 9, 10, and 12,
Table A-1, Appendix A ) were eliminated on the basis of information received
from the NASA subsequent to the theoretical malfunction analysis and while
the initial experimental runs were being conducted. Malfunction data was not
available to determine the possible modes of failure of the second stage while
in operation thus precluding the simulation of any such failures during the
study .
3.2 Experimental Design
The basic scheduling unit f o r each pilot participating in the program
was forty trial runs per day. These forty trial runs were composed of: (a)
a minimum of one run each of the 23 ma1funci:ron runs, (b) a repeat of certain
runs judged to be most serious or probable, and (c) four normal boost runs.
A l l runs were randomly distributed €or each individual pilot such that the sub-
ject had no way of knowing which problem would be presented next. Since the
experimental design placed no restrictions on the order of occurrence of any
particular problem, a multiple presentation :run might follow itself.
Measuring the pilot's total response time from malfunction onset
until the D-ring had completed its travel -- signifying completion of the abort
action, was central to the study. Equally important was to obtain a measure
of h i s ability to make the correct decision €or each simulated malfunction,
i. e. to determine whether or not an abort w a s required. Results of both
these measures for all subjects a r e reported in the Results and Discussion
section of this report.
F
3 -,t"
The simulation set-up w a s programmed hat.- t he pilot could
n&S&rt (i. e., terminate) a normal boost or a malfunction run which w a s 1

not pro_erammed to result in Catastrophe. w e n though he erroneously pulled

the D-ring, the boost continued. 'If the decision to abort was correct, the
pilot's activation of the abort handle stopped the computer which terminated
the action of all displays, noise, vibration, etc. and returned the gondola
(Le. , cockpit) to its launch position. If the subject did not respond to a mal-
function which was programmed to result i n catstrophe, the run continued
from five to eight seconds beyond the catastrophe limit where it was termin-
ated by the experimental controller. The subject was then immediately
notified of his decision error. In all cases where the pilot pulled the D-ring
in response to a malfunction catastrophic run, his total response time from
.
malfunction onset w a s recorded by the compucer flexowriter Immediately
after the run, this time was also reported verbally to the subject together

4
 with the time that was available for execui:ing abort. The experimenter was
then required to re-load the computer i n preparation for the next r u n by posi-
tioning a re-set switch on his control console.
The experimental controller was supplied with a simplified console
containing a minimum number of switches, indicating devices, a clock, etc.,
for controlling the study; plus a communications system which included both
head phones and a loud speaker system for communicating with the subjects
and a tape recorder for recording pilot's comments,
No information or advice was advanced to the subject on any run
once the run had started, except Problem 1-1, Partial Loss of Thrust of one
--
first stage engine and its couterpart run, Problem X-1, a Light Malfunction.
Near the end of the experiment it was decided that confirmation on these low
altitude malfunctions from ground control would be realistic. Thus, when
the pilot reported chamber pressure light onset and asked for confirmation
or denial of loss of thrust, the controller replied ltaffirmlli f the abort con-
dition was 1-1, and "deny" i f the situation w a s IX-1.
3.3 Subjects
Subjects participating in the study were three Mereary Astronauts,
two engineer-pilots from NASA, and one Vought test pilot, making a total of
i six in all. Several weeks before the experimental runs began all subjects
were furnished pre-experimental study material as shown in Appendix A.
Upon arrival at Vought they were introduced to the situation in which they
would participate and encouraged to ask questions. It was felt they should be
as familiar as possible with the experimental environment since they did not
have sufficient time for thorough pretraining. The sole type of information
withheld was the order i n which experimental runs would be administered,
the type and number of abort and non-abort malfunctions to be presented,
and how many normal boosts they would receive.
After completing his experimental runs, the Vought test pilot sup-
plemented the information given to the subjects during the inter-trial interval
with more technical data where he deemed it necessary thus enhancing the
information input to the subjects.
3.4 Experimental Procedure
To further acquaint each subject with the simulator set-up, the
instrument panel, the noise and motion cues, etc., and their interaction, a
series of representative runs were presented prior to the beginning of the
experimental schedule. The fixed pretraining program presented to all pilots
consisted of two normal boosts followed by Runs 1-1, II-1, m-I, IV-2, v-2,
V-3, VI-1, VI-2, VI-5, VI-6, VT-8, VI-11, Vm-1, and IX-2 in the order pre-
sented. A l l were identified before the fact to each subject. At his request
any of the runs were repeated.
F O l l O W h i the pretraining session, a measure was taken of the time
required by each subject to pull the D-ring. For this test the subject was
seated in a horizontal position and secured in the cockpit with only the lap
belt. He was instructed to pull the D-ring a.s rapidly as possible each time

5
the "No Stage" light came one. The interlight inteinal was variable (ranging
from 10 seconds to 1.5 minutes) thus no exymtation of the light onset could
be formed by the subject. The right went off when the D-ring was pulled. A
mean basic resrwnse t m e for all six subjects of 0.42 seconds- (with a range
o M 5 6 to 0.45 seconds) was m e a s u r e d .
Following this measurement, the experimental runs began by first
presenting a normal boost to the subject to restore a conceptual picture of
the indications and cues of the "eventless" run. The pre-boost procedure
for all experimental runs w a s exactly the same:
(1) Subjects were advised by intercom that "Control is go".

(2) Subjects responded that the "Cockpit is go" meaning that the
digital timer on the panel w a s r e s e t to zero, the escape mode selector switch
was in the Seat Eject Position, and the subject was ready for the next trial
run.
(3) The experimental controller positioned a T-IO switch on the
control console while simultaneously saying "T-10and counting". A timer
set at 10 seconds from time zero was started by the T-10 switch. At T-3
seconds the computer started through its program beginning with a simu-
lated ignition of the booster provided by a noise tape. Lift-off was initiated
at T+ 0 with an increase in noise simulation and a rapid gross pitch increase
of the gondola.

6
 4.0 MECHAMZA'170N C)F SIMULATtON

The hardware components for the simulation consisted of a combi-

nation analog-digital computer, a moving base cockpit simulator and selected
physiological measuring equipment. The cockpit simulator contained an in-
strument panel, seat vibrator, high fidelity noise reproducing equipment, D -
ring abort handle, and a horizon-starfield projector. In the interest of
clarity of understanding, the instrument parrel is discussed first.
4.1 The Instrument Panel
Figure 1 shows the instrument panel conliguration used in the study.
Only those instruments which were thought to be necessary in making abort/
non-abort decisions were provided. They a r e described as follows:
-
Attitude Display This display was simulated by a cathode ray tube
tracing pips for a horizon line, roll degrees, pitch degrees, and pitch, yaw,
and roll rates. Limits for all rates were red lined on the scale indicators
for both first and second stage. In addition, the warning lights associated
with each of the rate displays lighted up the moment the indication exceeded
the redlined limits. These respective rate lights were set to flash on above
4.0°/sec. for the first stage pitch and yaw and l@/sec. in the second stage,
The roll r a t e light flashed on at 12'/sec. in both stages. A separate dial was
provided immediately below the main attitude display for indicating yaw de-
grees.
-
Tank Pressure Displays Tank pressure indicators (marked 1 and
2) were used for monitoring both first and second stage booster liquid oxygen
and fuel tank gaseous pressures. * The associated pressure warning light
came on whenever the pressure in either the LOX or fuel tanks went below a
given psi.
-
Chamber Pressure Indicators These lights were programmed to
go off when engine combustion chamber pressure reached 65 per cent of nor-
mal thrust. The Chamber 2 Light was programmed to stay on throughout
first stage boost. Under normal operating conditions the Stage 1 Chamber
Light remained off.
Clock - The clock was not operative during the study. A digital
seconds counter (not shown) was substituted and mounted above the Abort Mode
Switch.
Abort Mode Switch - This switch which was placed in the "Seat"
position before each boost was re-positioned to the "Capsule" escape mode
by the pilot at T+100 seconds. The subject was required to report his change
of mode during each flight.
-
Accelerometer This dial, graduated i n g-units, displayed the
amount of axhl ixxekiaticm programmed to be acting on tne vehicie during
boost.

*All Stage 2 monitorin functions were subsequently eliminated during the

f.
study 4 see Section 0).
 -
I-

8
I

-
Velocity Indicator The main dial of this instrument was graduated
in 10 fps increments while the inset dial was graduated in 100 fps units.
-
Altimeter Used only as an indication of mission status, the main
dial w a s graduated in I, 000 ft. increments while the inset dial was graduated
in 10,000 ft. units.
-
Fire Bolts This indicator was programmed to come on at simu-
lated staging, T +148.0 seconds. Tt was asscmed that the signal which ener-
gized this light also ignited the second stage.
-
No Stage This light was set to come on 2. I seconds following
activation of the Fire Bolts light or 1.4 seccnds after the Chamber 2 Pressure
light went off i f separation of the two s t a e s had failed to take place. It was
assumed that activation was initiated by a timing circuit which w a s physically
interrupted by separation of the two stages.
-
D. C. Power This light came on whenever B.C. power for the
vehicle controls fell below 26 volts D. C.
-
Abort Indicator This complex came on whenever the D-ring
reached the top of its travel as an indication to the pilot that he had pulled the
D-ring to i t s limit and whether or not the mode of abort was correct. This
light was used for film recording.
The panel had no internal illumination and so depended upon am-
bient lighting. With the exception of the g r e e n FLre Bolts light, all warning
lights were red.
4.2 Computer - Flight Simulator Arrangement
The following is a description of the computer -flight simulator set-
up, the equipment used, cockpit motions, noise generation equipment, etc.
-
Drive Mechanisms for Instruments and Warning Lights The alti-
tude, velocity, acceleration, heading and tank pressure instruments as shown
in Figure 1 were syncro driven. This was accomplished by appropriate digital
to analog conversion of the time variant driving functions. The analog signal
positioned the shaft of a servo on which was mounted the driving coil of the
synchro. Signals for the warning lights were converted to analog voltage
levels which were sufficient to throw a relay; the relay then provided 28 volts
D. C. to operate the light. The signals for the three angular rate warning
lights were directly dependent on the rate time functions and were produced
by means of a biased absolute value circuit built up with operational ampli-
fiers, semi-conductors, potentiometers and relays. The CRT display re-
quired analog signals for pitch, pitch rate, roll, roll rate and yaw rate. A
time sharing technique was employed to produce all of these indications with
a single CRT.
Cnckpit Motions - The mnkg bas:; sirn-dzihr cockpit used in this
study had three degrees of freedom in pitch, roll, and yaw with displacement
capabilities which corresponded to the small erturbations of the normal
.p
flight path. A gross pitch rotation of f 1000 rom the horizontal permitted

9
a reasonable simulation of the direction of axial accelerations. The cockpit
motions and seat vibrations were accomplished by hydraulic servos driven
by analog signals. Figure 2, which was patlerned after an Atlas MA-2 /-
flight spectrum supplied by NASA as a guide, illustrates the oscillations Y S .
time which were applied during the standard boost run. The basic sinusoidal
signals were built up with operational amplifiers and potentiometers and were
switched in and out using time data from the digital computer. Peak accelera-
tions, a s shown, were measured with accelerometers attached to the cockpit
seat. Additional steady state or sinusoidal accelerations as required for
simulating those motions relating to vehicle rnalfunctions were applied to the
pitch and yaw parameters. Roll accelerations associated with the malfunc-
tions were considered too small to be of any reasonable consequence.
For the standard boost profile (Figure 2), a vehicle lift-off dis-
turbance of 3 cps occurred in pitch, roll, and yaw as well as longitudinally,
for one second. From T + 3 seconds to T + 17 seconds a 5 cps vibration
occurred in pitch, roll, and yaw. The pitch vibration (effected through the
seat) peaked at 0.4 g. Also during the T + 9 to T + 17 time interval, a 5
cps vibration occurred along the longitudinal axis and peaked at 0.3 g.
From T + 80 to T +lo5 seconds a :Icps oscillation occurred in
pitch, roll, yaw, and longitudinally which represented an instability in the
vehicle during high "q" flight. At T +149 seconds a mild oscillation (1 cps
at 0.05 g) occurred for one second in pitch and yaw representing a disturb-
ance caused by stage separation. Throughout all simulated flights the seat
vibrator maintained a low amplitude 20 cps vibration representing an assumed
structural "noise".
The gross pitch was rotated up to 570 from the horizontiil for the
launch position which produced the sensation of the pilot 1 'ng on his back
2
ready for boost. At lift-off it was rotated from 57O to 75 within one second
producing the sensation of thrust on the pilot. The cockpit then continued to
rotate up to 900. With an abrupt change in axial acceleration (staging, partial
loss of thrust, etc.) i t rotated downward a portion of the way, but then re-
turned to + 900 as a function of the washout. With a total loss of thrust the
cockpit rotated down to the horizontal (00:)position in approximately three
seconds and remained in this position.
Noise Generation - The combination OP engine and aerodynamic
noise was simulated by a high fidelity speaker system located in the dome sur-
rounding the cockpit. Most of the noise contained frequencies between 50 and
2000 cps with the low frequency noise ranging from 100 to 150 cps. The maxi-
mum intensity level inside the closed cockpit near the pilot's head w a s 104 db.
Figure 3 shows the history of noise level vs. time for the standard boost where
104 db occurred at maximum llq". Corresponding deviations were programmed
as applicable for each malfunction run.
Instrumentation of Seat and Pilot - In the interest of pilot safety and
to establish the vibration profile (Figure 2), instrumentation of the cockpit
seat and the pilot w a s included during the simulator set-up and shakedown.
This was done to determine the frequencies and levels of vibrational acceler-
ations applied to the simulator seat, to determine the frequencies and levels
of vibrational accelerations imposed on the pilot at various locations due to

10

. ..
13
 0

8
c
the applied forcing functicn, and to permit visual display of pertinent "safety
of flight" data for monitoring by a qualified physician. Measurements of in-
terest to this program were: (a) seat accelerations (vertical, lateral and
longitudinal) with seat in launch positi.on, (11) vertical and lateral accelera-
tions imposed on the pilot's body, head, chest, and hips, and (c) the pilot's
electrocardiograph (EKG)monitored between his chest and his forehead.
After establishing the vibration profile and following an analysis by
two qualified physicians of the early bioinstrumentation results, it was de-
cided to dispense with all pilot instrumentation during the experiment proper.
However, seat vibrations were monitored throughout the program to ensure
the profile remained fixed.
Typical vibration accelerations experienced by subjects during the
initial runs, while not reported in this study, are available upon request.
-
Horizon-star field Projector The simulator had a horizon/starfield
projector driven by the computer which could be used by the pilot for visual
orientation to the horizon. However, early in the experiment it became appar-
ent the subjects' undivided attention was required on the instrument panel,
thus the projector proved to be of little value to the study.
4.3 Programming the Standard Boost Trajectory
\

The data used in programming this standard boost trajectory in-

cluded the vibration and noise spectrum previously discussed and informa-
tion extracted from References l, 2, and 3. The latter information is shown
in the form of curves in Figures 6-1, 6-2, 6-3, 6-4, 10-1, and 10-2 of Appen-
dix A. These curves were generated by the digital computer to drive the cock-
pit instruments as a function of time. Yaw and yaw rates were zero for the
normal trajectory. However, signals driving the pitch, roll, and yaw rate
indicators during malfunction deviations from the normal profile (i. e., angu-
lar rates and displacements) were referenced to the vehicle body axes,
The pitch program was represented with respect to the local hori-
zontal. The basic data was extracted from a 105 N.M. altitude direct injec-
tion into circular orbit of a Titan launched at 900 E. Limits of the axial load
factor ranged from 1.3 g's at lilt-off to 7.3 g 's (maximum).
4.4 Programming the Malfunctions Runs
The following is a description of the computer-flight simulator pro-
gramming of the malfunction runs. Reference should be made to Table A-I
(Appendix A ) and its supporting figures for a more detailed discussion,
(1) Problem 1-1, Partial Loss of Thrust - One Engine (1st Stage)
The assumption w a s made that a malfunction began at T + 2.0
seconds resulting in one first stage engine dropping to 65% of its maximum
thrust at T + 7 . 0 seconds. The instrument panel indication w a s a Chamber I
Light at T + 7.0 seconds and a fall-off of the G meter from normal (Figure
1-1). Simultaneously, there was a reduction in noise and the moving base
(cockpit) was rotated down somewhat to reduce the back-to-chest force.

13
CONFIDENTIAL
(2) Problems II-1 and 2, Total Loss of Thrust - One Engine (1st
Stage
In both of these malfunction r u n s , one beginning at T + 2.0
seconds and the other at T + 15.0 seconds, i t w a s assumed that once the mal-
h c t i o n began, the engine thrust dropped to 65% of maximum in 0.3 seconds
atwhich time the Chamber 1 Light flashed cln. The accelerometer reading
dropped ab~upttyas shown b Figure 2- 1, the moving base rotated down rapidly,
and the noise hvef was reductxi by ow-ha&
(3.)Problems Eli- 1 andl 2,, T o i d I f i s . nf, Thrust
Engines
- Both b t Stage
--
TWO rum d this type were d~muAak& one sharting at T+4.9,
seconds and the other a8 T + 70s 0 seconds. With t k owe8 ~ithe maltunction,
the axial acceleration and noise dropped to zero imme&ateg. In each case
the Chamber 1 Light came on at 0.3 seC0nd.s lolbwing the malfunction onset.
In the latter run, attitude deviation from mrmak was substantial resulting in
a Pitch Rate Light coming on at T + '2 3.0 seconds (Figure 3-k).
(4) Problems IV-2 and 3, Hardover Engine Nozzle
For both cases of the hardovar engine gixubk Bailure it w a s
assumed a non-oscillatory attitude divergence would result. In one case the
malfunction began at T+ 47.0 seconds and in the other a0 T+ 6Q. 0 seconds.
For both cases, the respective Rate Lights came on 0.2 seconds following
onset of the malfunction. Respective pitch, yaw, and roU angular displace-
ments were programmed into the moving base in accordance with data shown
in Figures 4-2 and 4--3. Axial acceleration was assumed to be normal €or
both cases.
(5) Problems V-1, 2, and 3, Staging Failures
In the interest of clarity, the normal operating sequence €or
the panel lights during staging was as follows:
Chamber 1 - off all the time
Chamber 2 - on at ?' = 0, off at 148.7 sec.
Fire Bolts - on at 1 4 8 0 sec., off at 153.0 sec.
No Stage - off a l l the time
Problem V-1 was concerned with a premature light-off of the
second stage at T + 140.0 seconds. The theoretical analysis showed that if
the second stage ignited before the bolts had blown, a catastrophe (fire ball)
would occur in about -2Jl-sec-onds. Panel indications were the Pressure 2
-
Li ht went off at T+ 140.7 seconds at which time the engine had reached 4 .--
655 of its thrust; the Fire Bolts Light never came on; and the No Stage Light -- I

came on at T + 142.1 seconds.

Problem V-2 w a s a case of the bolts firing prematurely at
T + 110.0 seconds with aerodynamic forces causing the stages to separate.
Panel indications were the Fire Bolts Light came on at T + 110.0 seconds
and a pitch and pitch rate divergent oscillation with the associated Rate

14 c ONFlDENIl A1
 CONFIDENTIAL
Warning Light. The Rate Light "blinked" the first time at T + 117.4 seconds,
and went off at T +117.6 seconds and came on again (and remained on) at
T + 118.4 seconds. Test subjects were instructed to observe the rate display
when such a malfunction occurred and to abart when its associated rate light
came'on the first time. _- .-

Problem V-3 concerned the case of bolts failing to fire at nor-

mal staging, i.e., at T + 148.0 seconds. The stage two engine ignited on
schedule thus the Chamber 2 Light went off at T + 148.7 seconds. The Fire -
Bolts Light never came on. However, the N o Stage Light w a s set to come on -
at T + 150.1 seconds. The axial acceleration dropped to zero at T +148.0
seconds and remained so -- even though the second stage ignited, since the
stages were still attached.
(6) Problems VI-1, 2, 3, 5, 6, 7 , 8, and 11, Tank Pressure
Losses (lst Stage)
There were two panel indications for each tank pressure loss
malfunction to warn the pilot. The Pressure Light came on when the pressure
dropped to the malfunction detection system (MDS)sensor setting (as shown
in Figures 6-1, 6-2, 6-3, and 6-4), and the tank pressure instrument gage
indicated a subnormal level during a pressure or Euel leak. The time at
which these various malfunctions began v a r i e d from T +O.O seconds €or four
runs to T + 10.0, T + 20.0, T +30.0, to T + !60.0 seconds. Four the the eight
r u n s (Problems VI-2, 5, 7, and 11) did not require an abort because the pres-
sure level never reached the catastrophe limit aithough the Pressure Light
came on. The remaining runs required abort action, however. In all cases
the assumption w a s made that a tank pressure loss did not affect the respec-
tive engine thrust.
('7) Problem Vm-1, D. C . Power Failure (lst Stage)
This malfunction run assumed a D.C. power failure in the first
stage, starting at T + 12.0 seconds, which resulted in a loss of attitude con-
trol of the vehicle. The first cockpit indication w a s a D. C. Power Light at
T + 12.0 seconds followed by a Yaw Rate Light at T +12.50 seconds. The
yaw rate display also diverged and was accompanied by a yaw acceleration
motion.
(8) Problems K - 1 , 2, 3, and 4, Instrument Light Failures
Instrument light failures were programmed as follows: a
Chamber 1 Pressure Light at T+ 2.0 seconds; a Tank 1 Pressure Light at
T + 40.0 seconds; a Pitch Rate Light at T + 60.0 seconds; and a Yaw Rate
Light at T +148.0 seconds. When these f a i l x e s occurred without backup
information, the pilot was expected to correctly diagnose the situation and
refrain from aborting the mission.

25
CONFIDENTIAL
 5 . 0 RESULTS A N D DTSCUSSION

The results obtained from this investigation a r e presented in Table

2. The first part of the table shows pilots' #actualresponse times and decis-
ions compared with the required response times. The right-hand portion of
this table also contains a numerical summar*yof the results. A discussion
of the results in this table is presented in the following pages in the form of
a review of each separate problem o r group of similar problems. A short
summary of the pertinent factors relating to each problem is tabulated at
the outset since it is important to understand all the factors entering into the
decisions and response times.
Where applicable, there is a discussion of possible vehicle modi-
fications in areas such as instrumentation presentation, abort procedures,
design, etc. Accordingly, this test series is considered a step in the itera-
tive process of arriving at final design decisions.
It is emphasized that one of the ground rules in setting up the series
of test runs, was that the pilot was not to respond to a single malfunction cue,
but w a s to verify h i s initial observation of the possible malfunction with a
second confirming piece of information. The response time, both the re-
quired and the actual, was that from the initial onset of the malfunction to
the time that the abort action was completed or should have been completed
by the pilot (Le., to the closing of the contact upon pulling the D-ring).
It should be kept in mind in reviewing the results that extensive
training would, in all probability, assist in improving response times which
would be of considerable value in cases where these times a r e marginal.
While some "pretraining" was included, it is not the equivalent of the com-
prehensive training program that Gemini pilots will receive.
In reviewing marginal cases it should be noted that the "required
response times" were the result of certain assumptions used in the theoret-
ical analysis as shown in Appendix A, and m.ay, in some cases, be on the
conservative side. In these cases a more rigorous analysis of the abort mal-
function sequence might result in a more favorable comparison. The required
response times are certainly not accurate to the hundredths of a second as
shown in Table 2. These numbers resulted from the subtraction of an esti-
mated "abort sequencing time" (estimated at 0.28 seconds) from the nominal
time increment derived in Appendix A.

16
 5.1 --
Result of Individual Simulated .Runs

Problem 1-1 Partial Loss of Thrust -- One Engine (1st Stage)

I Time Sec. I Cues
~-
Available 1
c
I I
Malfunction begins T+2.O Gradual loss axial accel. feel
Gradual decrease axial accel.
instr .
Gradual reduction in noise

I Axial accel. readinn reduced

I
from 1.3 g to 1.~1 g
Noise further reduced I
Required completion of abort
act ion
T + 11.72
I
-
Required Response Time
(sec.) 9.12 -
Mean Pilot Response Time
(sec.) 6.88*

From Table 2 it can be seen that i n all eight cases where- abort was
correctly elected it was accomplished w i t h i n m r-equired time.
-- -
The pilots indicated they used the light and loss of axial-accelera-
tion feel as the main cues. In five cases the pilots were generally unable to
detect the initial cues in the time period T + 2.0 to T + 7.0 and hence were
not responsive to the Chamber Light as the abort signal and looked for addi-
tional cues. The problem, therefore, is not one of reaction response time
(all who elected to abort made it satisfactorily), but one of obtaining confir-
mtion that the Chamber Pressure Light was correct.
It i s noted that 4.72 seconds was available from the Chamber Light
to abort action. It has been determined in discussion with NASA personnel
that this time would permit verification of loss of thrust by the control center
and confirmation to the pilot.
-

* Mean R.T. for those runs where pilot aborted.

17
Mal function begins T + 2.G
Rapid decrease axial accel.
instr .
T+2.3 Chamber light comes on
Axial accel. reading reduced
from 1.3 g to 0.65 g
Significant reduction in noise
Required completion of T +6.02
abort action

A l l pilots accomplished this test satisfactorily. Pilots indicated

they were responsive to the light, acceleration feel and a greater response
to the sound cue than in 1-1. This test points up the discussion above for
1-1 since, while the required response time was significantly less, all aborts
were within the required time due mainly to the sharper definition of confirm-
ing cues. This sharper definition resulted from total loss of thrust of one
engine compared to gradual loss of thrust in 1-1.

ProhEem I€-2 Total Loss Thrust - One Engine (Ist Stage)

I
h

Time Sec.
r

instr.
' T +15.3 Chamber light comes on
Axid accel. reading reduced
€ram 2.4 g to 0.7 g
Significaat reduction in noise
Required completion of T+32.Q2
abort act ion

This problem is similar to 11- 1 except it occurs at T + 15 sec. in-

stead of T + 2 sec. The greater altitude gives more room for a longer re-
sponse time. With the adequate cues available, all pilots made aborts satis-
factorily. The mean response times were actually lower than for IT-1 per-
haps due to being in a portion of the boost where no other motions existed and
the motion cues produced by the malfunction were more easily identified.

18
 Problem nl-1 Total Loss Thrust - 130th Engines (1st Stage)

c
Malfunction begins
I Time Sec. I
I I
Cues Available
Abrupt loss axial accel. feel
I
Chamber light comes on
Axial acceleration reading reduced
from 1.3 a to 0
Required completion T + 5.22
of abort action

Problem m-2 Total Loss Thrust - 130th Engines (1st Stage)

Time Sec. I Cues Available
~~ I
dalfunction begins T + 70.0 Abrupt Loss axial accel. feel
Abrupt *decreaseaxial accel. instr.
Pitch rate divergence starts
T+70.3 Chamber light comes on
Axial accel. reading reduced from
2.0 g to 0
Complete reduction in noise
T+71.0 Pitch rate light comes on
equired completion T+71.62
f abort action
Required Response Time Mean Pilot Response Time
(sec.) = 1.62 (sec. ) = 0.89

This run was similar to III-1 except it occurred later in boost

(T + 70). Again well defined cues permitted ,311 pilots to complete abort in
time. ?d~i-e iise of noise cues than in X I - i was reported by piiots. Because
of high flight dynamic pressure, pitch rate divergence was encountered in
this case. However, rate cue was not mentioned by the pilots and the rate
warning light came late compared to other cues and was probably not used.
Mean res nse times for both m-1and nT-2 were less than those for 1-1,
u-1, and!-2 due to very sharp loss of thrust acceleration and noise.

19
 Problem N-2 Hardover Engine Gimbal (1st Stage)
(uivergence 111 y a w )

Malfunction begins
1 Tine Sec. I
T + 47.0
Cues Available
Divergent yaw rate inst.
I
Saw [email protected] feel
Yaw rsde light comes on
T+47.2
Divergent yaw angle in str
Yawing: acceleration €eel
.
Divergent yaw rate inst.
Required completion T + 48.02
of abort action

Problem IV-3 Hardover Engine Gimbal (lst Stage)

(Divergence in Fitch)

Malfunction begins T+ 60.0 Divergent pitch rate instr. .

Pitching acceleration feel
T+60.2 Pitch rate light comes on
Divergent pitch angle instr.
Pitching acceleration feel
Divergent pitch rate instr.
Required completion T + 60.62
af abort action I
I

Required Response Time Mean Pilot Response Time

(sec.) = 0.62 (sec. ) :1. 26* ,

Both of these cases are similar and can be discussed together.

Table 2 shows that while the correct decision was made in all but one of the
27 runs simulated, only one abort was made within the required time. It
was recognized when the experiment was set up that the short required re-
sponse times could probabZy not be met. This is especially so in view of
the mean basic response times of 0.42 sec. discussed in Section 3.
Despite the required short response times, the pilots reported
that they were responsive to the rate instruments and the angular accelera-
tion feel in addition to the rate limit lights.
* Mean R.T. for those runs where pilot aborted

20
 CONFIDENTIAL
During the preparation of the esperiment it w a s learned that the
engine manufacturer expects to reconfigure t.ne nozzle control system so that
hardover engine malfunctions will have a negligible probability of occurrence.
However, it was agreed with NASA that such failures would be included in the
experiment in order that data would be obtained on what the pilot could do.
Note that the mean response time of the subjects who elected abort is only of
the order of 0.6 sec. longer than the required time. Should the revision in
the control system to prevent hardover gimbal malfunctions prove unsatis-
factory, the pilot response times in Table 2 should be of assistance in analy-
s e s to determine the degree of potential. hazard.

Problem V-1 Staging - Premature Light Off of 2nd Stage

>
Time Sec. I Cues Available
Malfunction begins T + 140.0 None
T + 140.7 Pressure Chamber Light 2 goes off
(befcbre scheduled T + 148.7)
T + 142. I No Stage Light comes on
Required completion T + 142.42
~ of abort action

Table 2 shows that, while all pilots made correct decision, only
four of eleven runs were within the required response time. The primary
problem was the lack of an adequately timed secondary cue to verify the
Chamber Light "off" signal. In this circumstance there was no change in
acceleration, the increase in engine noise was probahly not discernable,
and the pilot had nothing to confirm the correctness of the Chamber Pres-
sure Light. A solution would be to provide a second indication such as a
fire-in-the-hole sensor and display system. It is suggested that the use of
fiber optics (light pipes) be investigated as a possible source of hardware
for such a display device to provide immediate malfunction confirmation.
Some form of interlock is also a possible solution, but there is
reason to question whether a fire-in-the-hole is actually catastrophic. It . . .
is understood that one case has already occurred in which the 2nd stage
burned away from the first stage and successfully continued the mission. ,;.
There is little reason to doubt that the scores on these 11 trials -

would all have been positive, had a fire-in-the-hole display been available.

21
C O N F I D E N T I A1
I

Problem V-2 Staging - Bolts Fire Prematurely

Cues Available
Malfunction starts light comes on
(before scheduled T + 148)
-
Oscillarion pitch rate instr.
&,ate liaht on
T + 117; 6
T + 118.4 I Pitch rate light off
Pitch rate light
- - on
pitch rate instr.
Required completion
of abort action
Re uired Response Time
I

Mean Pilot Response Time

-2
0

&ec.) :8.72 (sec.)= 7.55 ,; - -. _ _

c -- -
* _ - - -,'.
/

The reference documents state that an abort is not necessarily re-

quired if the bolts fire prematurely. The case used in the experiment as-
sumed that a divergent pitch oscillation occurred requiring an abort.
Table 2 shows that d s f the test subjects aborted-without wait-
to see if an abort would be required-*Tlffh'ig procedure were be foUG% ~

. in practice, there would be no problem aborting in time, but an unnecessary

abort could result. The other subjects waited for the pitch oscillation to
diverge to limit pitch rate before aborting. One subject responded to the
first wink of the rate warning light and aborted successfully, but the others
waited for the second flash and lost one second of the available time. It is
felt that after more training the pilots could be expected to abort satisfac-
torily.
Another consideration in this case is that an arbitrary rate of di-
vergence on the oscillation w a s assumed. An analysis should be made to
determine what effects can actually be anticipated and then use a pilot re-
sponse time of one second to determine if catastrophe wouldotxur. The
experiment showed that the subjects were able to execute abort in 0.8 to
1.0 second after obtaining the decisive display information.

*Note: These e a r l y aborts resulted in the unrealistic mean pilot response

time as shown. ,' 0 - \

22
CONflDENTl A1
Problem V-3 Staging - Solts Fail to Fire

Time Sec. Cues Available

Malfunction begins T + 148.0 1st stage axial acceleration feel drops
to 0
Fire Bolts light does not come on (as
normally expected)
T + 148.7 . Chamber 2 Light goes off
- .-
No axial accel. feel -
T + 150.1 No Light comes on
Required completion T + 150.42
of abort action

Since there w a s 2.42 seconds response time available it was deemed

advisable for the pilot to delay the abort as long as he could to allow the bolts
to fire in the event of a momentary hang fire. Thus, a No Stage timer light
was put on the panel and set for 2.1 seconds after fire bolts signal was initi-
ated. This allowed the pilot only 0.32 secorids to respond after the No Stage
Light came on.
Table 2 shows that 16 of the 22 trials were accomplished satisfac-
torily. In these-cases the pilots did not waif. for the No Stage Light. The
six trials in which3.FiSpirotsTiaxea r e s u l ~ e d - l n ~ ~ t e - - ~-'The
r t s . delay caused
by the No Stage Light is not advisable and the light should be eliminated.
The preferred approach to this problem is to provide a manual
override for firing the bolts if the automatic system fails.
The same discussion as in V - I applies here relative to the real
hazard of *lfire-in-the-hole" and the desirability of a warning signal for this
situation.
Had all pilots responded to Chamber 2 Light going off with Fire
Bolts Light being off, or i f a definite fire-in-the-hole signal had been avail-
able in addition, all pilots could have made this run satisfactorily.
_-- - -. - .

. .

23
C O N f IDENTI Al.
. .
 Problem VI - Tank Pressure Loss (Stage 1 - Oxidizer)
koblem Malfunction
-
Tank Light
-
Req'd Completion Req'd.
-Mean
start On of Abort Action R.T. Pilot
Sec. Sec. Sec. Sec. R. T.
- -
-
*- 1 T+O T + 2.0
-
T +
--------
3.22 3.22
Sec.
2.73
VI- 2 T+O T + 10.5 NAR*
VI- 6 T +10 T+12.3 T + 14.72 4.72 3.65
VI-7 T + 20 T + 24.5
VI-8 T +30 T+31.4 4.46
-
* NAR - No abort required
The above cases of oxidizer tank pressure losses are considered
as a group. Figure 6-2 of Appendix A should be consulted to review the pres-
sure rate variations.. Problems VI-2 and VI-7 are more slowly varying and
level off above the limit pressure shown in Figure 6-2 and therefore do not.
require abort. In the other three cases the pressure losses are more rapid
and all require abort. The pressure loss is sufficient in all cases that the
MDS warning signal.comes on. The pilot was required to conpare rate of
the normal pressure decrease and rapidity of approach to limit pressure.
The MDS light was an additional one.
Table 2 shows that the NAR roblems were correctly interpreted
in 9 out of 10 cases. In those runs (35frequiring abort 28 were in time, 6
not in time, and one no abort. Of those not in time the e r r o r s were quite
--
small the greatest being 0.054 sec. Genlerally, the e r r o r s made in these
latter cases were not caused by failure to observe the malfunction or by not
reacting quickly enough, but rather by indecision as to whether or not the
pressure loss would really require abort.
It was the opinion of the pilots that since the limit pressure in
Stage 1 oxidizer tanks is a linear and symmetrical function of time (from 0
to 2 psi and back to 0) adequate training would enable making proper and
timely decisions in all cases.

24
 Problem VI - Tank Pressure Loss ( S a ge € - Fuel)

Problem Malfunction Tank Light Rt!q'd Completion Req'd. Mean '

start On o f Abort Action R.T. Pilot
Sec. Sec . Sec. Sec. R.T.
- Sec.

VI-3 T+0 T +4.0 T + 6;72 6.72 4.97

---------
VI-5 T+O
T 20*olon::
++ 29.0 oEf
NAR*

VI- 11 T + 60 T + 108.5 --------- NAR*

* s

Figure 6-1 of Appendix A further illustrates these cases OC fuel

tank pressure bss showing the rate at whic.h pressure falls. VI-5 is a slowly
varying loss which just dips below the MDS warning signal and then levels
off just above the M D S setting requiring no abort. VI-11 is also a slowly
varying pressure loss that does not reach the limit pressure and hence no
abort is necessary. VI-3 is a rapid loss that requires abort.
Table 2 shows that all r u n s of VI-3 were performed within re-
quired time except one which was only 0.02 sec. late. A l l the no abort runs
were per formed satisfactorily .
It is important to note that there were 23 runs in VI-2, 5, 7, and
11 in which the MDS as an automatic abort signal would have caused unneces-
sary aborts while the pilots correctly decided not to abort 22 times.

25
 Problem VIII- 1 D. C. Power Failure (1st Stage)

I I 1
Malfunction Begins ITime Sec. I Cues Available
I I
Malfunction begins T + 12.0 :D. C. Power Light comes on
Divergent yaw rate instr.
‘Yawing accel. feel

Rate Light comes on

Divergent yaw angle instr.
‘Yawing accel. feel
Divergent yaw rate instr.

Req’d completion
of abort action
I I J

Required Response Time Mean Pilot Response Time

(Sec.) = 2.72 (Sec.) = 2.19

The results of Table 2 show that in. 5 out of the 7 runs this situa-
tion w a s handled satisfactorily. One of the misses was only 0.01 sec. late;
the other w a s 73% slower than the slowest of the other pilots. What caused
the one pilot to be 1.26 see. late aborting is not known, but it is believed
that with adequate training all pilots could a k r t in time.

26
 Problem M - Warning Light Failures

Problem Warning Malfunction Cues Available

Light starts
Malfunction Sec.

M-1 Chamber 1 T + 2.0 No decrease in noise, axial

Pressure accel. feel, or axial accel.
instr .
IX-2 Tank 1 T+ 40.0 Tank pressure increasing
Pressure (in normal boost fashion)
E-
3 Pitch T + 60.0 No instr. indication of pitch
Rate rate of angle
No pitching accel. feel
E-4 Yaw T + 148.0 No instr. indication of yaw
Rate rate of angle '

No yawing accel. feel*

1 I I 3
*However there w a s a mild oscillation at T + 149.0 (1 cps at 0.05 g) con-
tinuing for one second which occurred during normal staging.

A l l of these were problems representing erroneous warning light

indications in which no abort was required. In most cases there were cues
available to confirm that the light was malfu.nctioning. Table 2 shows that
for cases (such a s rX-2) where the confirming cue w a s contrastingly clear
(pressure increasing when light would indicate decreasing) correct decisions
were made in all cases. In other cases a number of incorrect decisions were
made. It is believed that some of the incorrect decisions relating to the
M - 4 were caused by the programmed mild oscillation representing a dis-
turbance caused by stage separation.
The pilots generally Eelt that more experience (training3 with this
particular type of malfunction would permit them to handle these situations
satisfactorily .

27
5.2 Abort Mode Selection Response
While not recorded in Table 2 the results of the abort mode selec-
tion task should be reported. As pointed out in "Experimental Procedures"
(Section 3.0), all pilots were instructed to change from seat ejectim to cap-
sule abort mode at Approximately T + 100 siecs. bydlipping-the mode-switdh
on the instrument panel. They were given .no addition& ,instructions.on.this
during the boost and were expected to accompli$h:this.task along .withitheir
duties of monitoring for possible .boost malfunctions. #It#is considered signi-
ficant that in the (23 runs:that .extended beycindithe'ff + 1QO second Dimit,, .a31
pilots responded to this ,taektaorreotlly.
5.3 Automatic YS. :Manual Abmt
The scope of ;thisstudy :toIobtaina qualitative evaluation of
manual abort reliability, An analysis .a€Ithe automatic abort system reli-
ability for direct companisan was:begondethe scope of the s6 idy. However,
some of the cases of Oxidioer and Rue1 Tank Pressure Loss are examples
of an inadequate automatic abort sensing system, even when the system is
functioning correctly. &It.is believed that a thorough analysis including both + ., .
reliability for aborting when required and not aborting when not required , ,-I

will show the overall hazard to be greater with an automatic abort system -
than with a manual abort system. 4 .. '
5.4 Proposed Abort Monitoring Panel Displays . .. <.'

Figure 4 shows an instrument panel designed to incorporate the

conclusions of this experiment. It is intended to show the simplest group.
ing of display parameters required for monitoring abort contingencies.
A l l of the parameters which had any value in detecting, interpreting, and
deciding the need for abort during the experiment are included. Those para-
meters used in the experiment, but which had no real bearing on the abort
monitoring task, have been eliminated.
The fuel and oxidizer pressure giig.es are time shared bet ween
the first and second stages*. After T + 140 seconds the first stage tanks
do not require monitoring. Switching to second stage tanks at T+ 140 seconds
leaves 8 seconds prior to light-off of second stage engines and allows suffi-
cient time for aborting prior to staging in the evcnt second stage tanks a r e
below limit pressure. The "bugs" shown 0x1 these pressure gages are used
to show second stage tank catastrophe limits. This assumes that these
limits a r e large values and variable with t h e . The "bugs" are driven by
clock-cam mechanisms.
Each segment of the two dial gages contain red edge lighting for
advisory warning that the particular parameter is abnormal.

*Information received subsequent to the experiment indicates that both

first and second stage tanks must be monitored durir.g first stage operation.
Therefore time sharing is not possible and two gages are required.

28
 The Chamber 1 and Chamber 2 lights (red) are to indicate when
chamber pressure is below 65% of normal. The Fire Bolts light (green)
indicates that the staging bolts have blown. The Fire-in-the-Hole-light
(red) is the display for a secondary, heat sensing system to confirm the
Chamber 2 light in the event of a fire-in-the-hole. The D.C. power light
(red) indicates when D. C. power is below limit.

29
30
 6.0 CONCLIJSIONS
,
From this study it is concluded that:
(1) Pilot monitoring of the boost systems with manual abort
I
capability i s a logical extension of aircraft piloting and escape procedures.

- (2) Critical booster malfunctions were readily apparent through

multiple cues such as linear or angular acceleration, noise, and cockpit
displays.
(3) Tank pressure and body axis rate gages provide vital analog
trend information.
,
(4) With adequate cue(s), manual abort is possible within one
second of the onset of a maMunction.

31
O N C
4 -

--
-I
4

r a * 0 C c n,

In v .f .c- 0 0 N N
x
d

1
Yra
a
0
N

?
0
$ '? 5 2
( \ I + * + * + . * + + + n + l i

1
C N
? ?
d

F4

r-
f

rl a + a n

0
t
?
t
N
94

In
a
- 4
4 4
 REFERENCES
(1) Cooke, C. Malfunctioii Detection Svstern Design
sag, yna Soar Step
Contract A&$G47)-6
Re part Confidential.
e Martin
10.

(2) Space Systems Division Malfunctioii Detection System Trade

Study, T.N. LV-6, Gemini Program
Launch Vehicle System, The Martin
Marietta Cor ration.
80
Report Cord'i entia.
(3) Space Systems Division Evaluation of Guidance and Controls
Redundancv and Backup Schemes
- ' A , Gemini Program d u n c h
TLzCkvSy!jtem, The Martin Marietta
Corporation.
Report Confidential.

33
 0 Nf I D E NT 1A 1
=-I

APPENDIX A

GEMINI BOOST ABORT STUDY

Theoretical Analysis of Abort Situations - Titan II

A- 1
-mmF-f-At-
\
70 N f I D EN TI A 1
1. Booster Failures - General
To facilitate the analysis of the atlort situations during the boost
phase, a study was initially made of booster rocket failures. The prime
source for this information was a Vought Document AST/EIR- 13441, which
presents the number of successes and failures of the various rocket firings
from Cape Canaveral and elsewhere. Of those firings which resulted in
failure, the suspected cause of the failure was tabulated. These data were
accumulated from 202 firings dating from 9-24-58 to 8-9-60. It was deter-
mined that the booster failures were distributed, in general, in the follow-
ing pattern:
Launch (first 10 sec.) 19.5%
High ‘*q” region 7.9
Thrust termination and separation 33.3
2nd stage malfunctions -
39.3
100. a
Another distribution of the failures was made according to the
type of malunfction which occurred and is presented below:
Partial loss of engine thrust 2.8%
Complete thrust term inat ion 30.5
Hardover engine 2.8
Tank pressurization loss 25.0
Attitude control 30.5
=agw - 8.4
100.0%
2. Titan II Malfunction
With this background information, the documents referenced in
the report pertaining to the Titan II booster system were studied for various
abort possibilities. The probabilities of various malfunctions were tabu-
lated as follows: (Reference 2)

Stage I Stage ll -
Total
Tank collapse ,013046 .013046
Hardware thrust vector .004608 .002450 .007058
No. sep. bolt release .003622 .003622
Thrust termination .003096 .005814 ,008910
Engine ‘I: fail to stop .000386 .000386
Early sep. bolt release .000007 .000007
Early staging initiation .001851 .00185 1
No staging initiation .000267 .000267
As 8 result cf these studies, the L U L A U W L I l g rypes o f malfunctions
L----

were analyzed in detail as a source of data on. which to base a selected

number of experimental r u n s (see text):

A- 2
e- C 0 N F I 0 E N T I A t---
- CONFIDENTIAL
I. Partial loss of thrust of one engine 3 cases
TI, Total loss of thrust of one engine 3 cases
TIL Total loss of thrust of both engines 4 cases
TV. Hardover engine gimble 3 cases
V, Staging failures 3 cases
VI. Tank pressure loss 12 cases
Vn. Counter-clockwise roll 2 cases
Vm. D.C. power failure 3 cases
IX Instrument light failures 4 cases

Total Number o f Situations 37 cases

A comprehensive breakdown of these 37 failures divided into their
9 different classifications is presented in the Master List of Abort Situations
(Table A-1).
Some runs did not involve any emergency condition; some had con-
ditions which, because of their indicated nature o r the time at which they
occurred,did not require an abort. A l l times shown in the table, with the
exception of the "Required Response Times" --which are shown from the
moment of onset of the malfunction, a r e from time zero. Onsets of the
appropriate warning lights are shown, and .where appropriate, quantitative
displays are keyed to an abnormal time-history plot of the failure. The
column entitled "Time Malfunctions Begins'' gives the time (actual o r esti-
mated) when failure occurred. The time at which a qualitative (warning
light) indication of the failure was displayed is indicated in the appropriate
column under "Lights". The "Abort By" column is the time at which catas-
trophe (i. e., fire ball) or breakup of the vehicle would occur; the pilot must
have separated from the vehicle by this time. Thus, the time shown in the
"Required Response Time" column was determined as follows:

RTReqd= ' TCatastrophe - Time Malfunction Begins -

TRT of escape system*
Some of the situations do not require a short response time. These
are denoted N.D.R. T. or "No Definite Response Time" since the pilot could
abort at 'leisure".
3. Examples of Typical Abort Situations
Some typical examples of abort situations, showing the manner in
which they were analyzed, a r e presented as follows (see Table A - 1 and
supporting figures)"
Example (1): Problem m-1,Total Loss of Thrust at T +4.0
Analysis of Problem: A t T+ 4.0 a malfunction occurs which causes
both boost engines to shut down. The chamber pressure drops to its 65%
level in 0.3 sec. which causes the Chamber Pressure Light to come on at
T + 4 . 3 (Figures 3-2). At the same time the subject should experience a
cessation of G-loading. This provides a secondary indication of thrust
*In this study the RT of the escape system isassumed to be 0.28 sec.

A-3
GONflDENTIAl
termination. Unless abort is executed before T +5.5 secs. the pilot will
hit the ground with the chute closed. The difference between T + 5.5 and
the first indication of malfunction(Chamber Pressure Light at T + 4.3) is
1.2 seconds. Subtracting from this time delay that time interval from the
initiation of abort to actual escape separation (0.28 sec.) , the pilot has 0.92
seconds to respond to the light and pull the Wring, or he must have completed
his response within 1.22 seconds from t.he time of malfunction onset.
Example (3): Problem V- 1, E a r l y Stage II Ignition at T + 140
The Stage TI Chamber Pressure Light goes off at T + 140. 7 indica-
ting that the Stage II engine has ignited and has reached 65% of thrust. There
is no abnormal acceleration since the two sections remain connected. The
No-Stage Light indicating this fact comes on at T + 142.1 (1.4 sec. later).
Abort separation must be complete by T + 142.7 since at this time it is
assumed the Stage IX blast has burned through the Stage I heat shield a d
has caused an explosion in the Stage I tanks. The subject h a s 0.32 sec. to
respond to the No-Stage Light o r 2.42 sec. to complete his response from
the instant of malfunction onset.
Example (4):Problem V-2, Staging Bolts Blow Early at T + 110
In this case the Fire Bolts Light comes on at T+ 110. An immedi-
ate abort may not be necessary unless a divergent vehicle attitude is encoun-
tered. In this problem the vehicle is given a divergent pitch oscillation
(Figure 5-1) which exceeds the 4 deg/sec. rate threshold (P.tch Rate Light)
at T + 117.4. It then immediately falls below the threshold at T + 117.6 and
again exceeds it at T + 118.4. This is due l:o the fact that the booster is
oscillating. The vehicle w i l l disintegrate at T+ 119.0, therefore the sub-
ject h w a total of 8.72 sec. to respond after the Fire Bolts Light c o m e on,
o r 1.32 sec. after the Pitch Rate Light Conies on €or the Eirst time.
Example (5): Problem V-3, Staging Bolts Fail to Blow at Staging
(T+ 148)
This time the Fire Bolts Light does not come on at T+ 148, i . e . ,
when 1st stage thrust terminates. The Stage II goes ahead and ignites, which
presents the problem. This fact is indicated by the normal operation of the
Stage II Chamber Pressure Light going off .at T+ 148.7. The No-Stage Light
comes on 1.4 sec. later at T + 150.1 which is the indication for the subject
to immediately pull up the D-ring. The subject h a s 1.72 seconds to respond
after the Chamber Pressure Light goes off or 2.42 seconds after the time
the malfgnction begins.
Example (6): Problem VI-2, Tang Pressure Loss
A malfunction GCCIUS at T+ 0 which causes the oxidizer pressure
to slowly drop below normal (Figure 6-2). The Tank Pressure Light conies
on at T + 10.5. In this problem the p r e s s u r e never becomes sufficiently low
to cause tank collapse, hence no abort is required (NAR).

A- 4
-. - I:0 N f ID E N TI A 1
CONFIDE N T I A 1
Example (7):Problem VI-6, Tank Pressure Loss
A malfunction occurs at T + 10 which causes a rather rapid fall
off of oxidizer pressure. The Tank Pressure Light will come on at T+12.3.
The pressure reaches a point which causes tank collapse and explosion at
T +15.0. The subject has 2.42 seconds to react to the light or he h a s a
total response time from malfunction onset of 4.72 seconds.
It must be pointed out that in both examples 6 and 7 the Oxidizer
Tank Pressure Light comes on at about the same time (10.5 and 12.3 seconds,
respectively). The subject has no direct way of knowing when the malfunction
occurred. Hence, the only way he can differentiate between the two (one
requires abort and the other no abort) is to monitor the rate at which the
pressure is falling below normal and discriminate between the rapid rate
of an impending abort situation and the slower rate of problem 6. Further
studies should be made in this area to determine an adequate means for the
pilot to discriminate between the abort and 110 abort pressure losses.
Example (8): Problem Vm, D.C. Power Failure
It w a s assumed that i f the D. C. power source fails to give the
proper voltage, a warning light will be energized. It w a s further assumed
that one of the most immediate effects of this malfunction was a loss in
attitude control of the vehicle (i. e., engine position control). In this case
.
the D.C. power warning light is followed by a divergence of the attitude and
attitude rates from normal. In one case (Figure 8-1)the attitude rate is
sufficiently ragid to exceed the rate threshold and gives a warning light.
Problem area M is concerned with light malfunctions; i. e., the
light comes on when no maifunction has occurred. This required the subject
to monitor secondary sources of informatiori before making an abort decision.
One of the ihajor objectives of the study was to identify those cases in which
the subject would not have sufficient time to perform this information pro-
cessing judgemental task.
It i s believed the above limited examples of problems taken from
Table A-I will be sufficient to acquaint the reader with the method and
approach taken in analyzing the many possible booster malfunctions.

A-5
~ CONflDENTlAt
+ + + + + + +
Ul
z
E!
c
a
3
e
si
c
0:
s
a
LL
0
I-
'"
-I
K
w
c
m
c
=E

6
'c
Z
8
c
I
<
w
d
a
l-

+ + + - + + + + + + + .+
UINFIDENTIAL

W
z
0

I-
LL
0

J
3
I
Y

c
I
c

a
A-
-- GONFlDENTlAl
CONFIDENTIAL

FIGURE 2 - 1 PROBLEM II - 1,2,8 3 TOTAL LOSS OF -

THRUST ONE ENGINE

-C O N F l D E N T 1 A 1 .
 CONFlDENTlA 1

A- 10
CONFIDENTIAL

Li
w
v)
I
w
-c
I

A-11
+ CONFIDENTIAL

u
w
in \"
I zn
s
Y
I

w
c
a
CL:
-
a
r
U
-
I-
n.

FIGURE 4-1 PROBLEM IV-1 HARDOVER ENGINE @ T = 0

A- 12
CONFIDENTIAL

sn U
W
Y
(3
I W
h
n
3
Y

-I
'-3
Y

w
I-
<
e

47 48
TIME - SEC.

FIGURE 4-2 PROBLEM IV-2 HARDOVER ENGINE (YAW) 6 T + 47

CONFIOENTIAL
A- 13
C 0 N FIUENTIA 1

I
W
rt- E
w
w
x
a
4
I

A- 14
- CONFlDEN~lAl
CONFIDENTIAL

-
0
c

+
I-
ce,
*
-l
U
Io a
c
c
w

vl
I-
ij l
l
W 0
v)
m
I c1
W
r I
c1
'p 4
c
c c
v)

A- 15 - I~ONFIDENTIAL
CONFIDENT1A1

N
I
L n

A- 16 - I: 0 N FID E N TI A 1
CONFIDENTIAL

8,
w
t3
4
L c
- .
5
¶E
w
I -I
m
0
a
0.
c
I

G O N F l D E N T l A1
C O N F I D E N T I A L z! z

Y
z
a
I-

W
c3
a

I
w
4
m
0
U

A- 18 -- C O N F I D E N T I A L
- CONFIDENTIAL

A- 19 CONFIDENTIAL
CONFIDENTIAL

A-20
CONFIDENTIAL
CONFIDENTIAL

e
I w
w c
z
I
c a
0
V
c

A-21
- CONFIDENTIAL
C O N F l O E N T l A1

z
3
0
U

(Y

I'
h
w

A-22
- GONFlDENTlAl
GONflDENTlA 1

0:
w

-
I-
u
z
3
w o
I
.v

~ CONFIDENTIAL
CONFIDENTIAL

35

30

25

20

15

10

10

IS
cj
w
n 20
I
3.
W 25
J
c3
30

35

40

45

50
12 13 14 15
TIME - SEC.

FIGURE 8 -1 PROBLEM Vlll -1 D. C. POWE:?FAILURE AT T + 12 SEC.

A- 24
CONFIDENTIAL
CONFIDENTIAL

U'
w
v,
\
c3
w
n
-:
'Y
C
UJ
I-
6
p:

8
-
I-
n

sn
I
A
0
Y

w
J
(3
z
4
r
U
t
LL

TIME - SEC.
FIGURE 8-2 PROBLEM VIII-2 D.C. POWER FAILURE T + 95.0 SEC.

A-25 CONfIOENTl A1
I C O N F I D E N T 1 A1

TIME - SEC.

FIGURE 8 -3 PROBLEM Vlll -3 D. C. POWER FAILURE AT T i 148.5 SEC.

A- 26
- CONFIDENTIAL
CONFIDENTIAL

t:
c -2.0
n
I
*0,
w
I-
4 -1.0
K
X
U
-
c
a
0

-1

-2

-3

s
a
-4
I
Q
w -5
-I'
0
5 -6
I
U
,c -7
n

-8

-9

- 10

148.5 151 152 153 154 155

TlME - SEC.

FIGURE 8 -4 PROBLEM Vlll -3 D. C. POWER FAILURE AT T + 148.5 SEC.

A- 27
- CONFlOENTlAl
CONFlOENll A1
z
0

A- 28
CONflDENTl A1
GONFIDENTIAL

A-29
CONFIDENTIAL