How to read this Cassini Main Engine Operating Box (oxidizer vs fuel tank pressures)?

Question

The extremely cool NASA JPL video Triumph at Saturn (Part I) is really worth a watch and/or listen.

At about 34:32 it covers the period just before SOI (Saturn Orbit Insertion, July 1, 2004, 02:48 UTC) when the fear of the engine not starting or burning long enough was maximum, the first images started coming in of Saturn's rings.

Earl Maize, Cassini-Huygens Deputy Program Manager (2003-2013) says

Something we've been preparing for four or five years, testing and testing, awfulizing all of the possible things that could go wrong. And this was one of those moments when you're either in orbit, or you're a billion dollar flyby.

During this voiceover, there is a cut to a projection of a slide showing "Cassini Main Engine Operating Box; Wide-Open PR1 (initial dm/dt = 3.34 g/s) w/ Optimal OP-2 Threshold ".

It shows a plot of oxidizer tank pressure versus fuel tank pressure. There are nested six-sided "boxes" (labeled "qual operating box" and "flight operating box") and a lot fo annotations.

Question: How to read this Cassini Main Engine Operating Box (oxidizer vs fuel tank pressures)?

What do the limits of each box mean, why are they six-sided, and (if possible) what do some of the other annotations indicate?

Answer 1

Partial answer covering only

what do some of the other annotations indicate?

• LV10 = Primary high-pressure latch valve: opened to provide nominal path for propellant tank pressurization - see yellow arrow in 2nd drawing
• PR1 = prime pressure regulator for propellant tank pressurization - see yellow arrow in 2nd drawing
• REA-A & B = Rocket Engine Assembly A & B, the main engines - bottom of first drawing
• SOI = Saturn Orbit Insertion

Source: Final Cassini Propulsion System In-Flight Characterization

The paper also contains a more detailed drawing of the "flight operating box" from the slide in the question. I suspect the full answer to the question can be found in this paper and in Initial Cassini Propulsion System In-Flight Characterization, but I have to go to bed.

Answer 2

Luckily I've just been reading the Haynes Owner's Workshop Manual for the Cassini/Huygens mission. The story is rather involved and is described on pp. 120-121 with the actual Saturn orbital injection (SOI) burn described on p. 141. The Cassini propulsion system actually had two separate parts. The big burns, like SOI, were performed using the 445N bipropellant engines. A separate monopropellant hydrazine system was built for attitude control using small thrusters. Personal opinion: I've seen a lot of propulsion system designs in my career, and this may well be the most complicated ever.

The biprop system was designed to use a pressure regulator to maintain a constant pressure in the tanks during burns. That ensures constant thrust from the engines. The pressure regulator is essentially a valve connected to a device which sense pressure downstream of the regulator. If the pressure is too low, the valve opens, and vice versa. Normally the regulator valve has a soft seat because that makes it easier to get a good seal when the regulator is supposed to be closed. However, JPL was worried about slow extrusion of the soft seat, and they instead went with a hard seat. The risk they took was that debris could get on the valve seat and cause the regulator to leak. And that's exactly what happened. The regulator leaked slowly, but not so little they could ignore it. Helium was used to pressurize the tanks, and the helium tank pressure was over 900 psi, far above what the propellant tanks could withstand. If the regulator leak wasn't somehow stopped, the tanks would rupture, ending the mission.

JPL had included valves upstream of the regulator (between the regulator and the helium tank. One was a latch valve (called LV10), which essentially is either open or closed. They used the latch valve to stop the flow of helium into the tanks. By opening the latch valve for a certain period of time, they could let just enough helium into the tanks to perform the burn. And that's essentially how they did the SOI burn.

Now for the diagram. First, it graphs the allowable range of propellant tank operating pressures. Normally, when a regulated system performs a major burn, the tank pressures would stay constant, and plotted on this graph, the burn's profile would be a single point. However, due to the regulator problem, Cassini tank pressures changed. If LV10 were opened, the tank pressures would rise. The diagonal line with the call-outs is the trajectory of tank pressures during the SOI burn. It starts in middle ("start here"). They start by opening LV10, and both tank pressures go up, following the diagonal line to the upper right. The SOI burn starts. The helium is coming in faster than the propellant is going out, so the pressures continue to rise. It looks like they alternated the two engines (REA-A and REA-B, rocket engine assembly). Eventually they got to tank pressures of 325 psi and closed LV10, stopping the flow of helium. But the SOI burn continued, so the tank pressures began falling. They then followed the diagonal line down to SOI end and stoped in the middle of the flight envelope.

The top and right bounds appear to be the maximum tank pressure allowable without rupturing the tanks. They clearly exceeded those bounds, but I'm certain JPL did exhaustive testing to convince themselves they had enough margin beyond the qual test limits.

The lower bounds on the tank pressure are (I think) to ensure enough thrust from the engines (thrust drops with tank pressure). The diagonal limits are probably to ensure that the ratio between fuel and oxidizer is acceptable. Biprop engines work best at a certain mixture ratio, and they can tolerate certain excursions. Too large an excursion, and the engine can fail or degrade.

There are two call-outs which need explaining, and they are both limits on what the onboard software will allow. One is OP-2 trip, the other is over-thrust. Spacecraft software will monitor telemetry to try to prevent failures; JPL calls this fault protection (FP). Those two call-outs show where the flight software will intervene to stop the burn - which you don't want to happen. And the graph shows it shouldn't.

Finally, the subtitle of the graph. "Wide-open PR" means they are assuming the worst case condition of the regulator being fully open and not slowing the flow of helium at all. The dm/dt value is the assumed helium mass flow rate.

Answer 3

Thanks to @Organic Marble's first "archeological clearing and digging", in particular for providing links to the two papers by Todd Barber, we can now try to get to the global picture.

Let’s rewatch part of the video related to this sequence. At 30:40 in the video, Charles Elaghi recounted how the mishaps of another probe, Mars Observer, were on everybody’s mind. The cause of that failure was identified as a valve malfunction during the pressurization of the bipropellant tanks. Then we were told by the Deputy Program Manager, Earl Maize , how they did numerous tests, « awfulizing all the possible things that could go wrong ». Just after that, we have the screenshot showing the diagram of interest.

It is logical to deduce that its purpose is to illustrate the « awfulizing » methodology. We can interpret the polygons (« boxes ») as the safe areas, one for the purpose of qualification (« the QUAL OPERATING BOX »), which is naturally less conservative than the inner « FLIGHT OPERATING BOX ». Note that the « SOI start » and « SOI end » operating points are inside this smaller box. The other operating points seem to be a hypothetical « out-of-spec » scenario and the corresponding sequence for automatic fault protection and recovery actions by Cassini. That is, if by bad luck they had a malfunction of the type encountered by Mars Observer, they would have a solution for Cassini to recover from such.

Note the « OP-2 trip @324 psia ». « OP » is for Over-Pressure. We know this thanks to a sentence in the Critical Events Readiness Review, pointed to in the comments by @Chis C and @gerrit. On page 5 of the said document, Bullet 3 reads:

A waiver may be required if the overpressure threshold OP-2 is raised above the qualification level of the propulsion system.

So they had put in a safety « fuze » to safeguard against tanks overpressure. It seems plausible that there is a sequence of valves opening/closing as well as engines firing/shutting down to bring the pressure points to within the prescribed safety inner box, and not miss the narrow SOI time window.

Somebody with in-depth knowledge of how bipropellant rockets work may complement the interpretations above.