By Jason Hendricks, Brett Porter, and Lee Cotter
The U.S. Navy is deploying a new ejection-seat sequencer that will catapult a pilot and co-pilot (and their seats) out of a damaged F/A-18, F-14, or T-45 jet aircraft within 0.2 seconds from the time the ejection handle is pulled. A complex, triple-redundant digital sequencer senses just the right speed and altitude and then deploys a parachute, which is contained within the ejection seat, to ensure pilot safety.
The project, which was a team effort of Martin Baker, Teledyne Electronic Safety Products, Ada Core Technologies, and the U.S. Navy, is known as FAST — short for Future Advanced Sequencer Technology. The ejection seat is formally the Navy Aircrew Common Ejection Seat (NACES) and is controlled by the electronic FAST sequencer.
The first NACES sequencer was the first digital electronic controller for a production ejection seat; pyrotechnic or mechanical devices activated by mechanical (clockwork) timers — supplemented in a few cases by pyrotechnic timers — controlled all previous seats. The digital electronic device offers precise timing control of automatic seat functions and responds well to a wide range of ejection conditions.
The NACES FAST sequencer, de-signed using all commercial off-the-shelf (COTS) components and the Ada software programming language, replaces the original NACES sequencer. The FAST digital sequencer cost is half its predecessor's cost.
How the ejection seat works
The main structure of the NACES ejection seat comprises two vertical beams located at the rear to which all the other major subassemblies are attached. The sitting platform, or bucket, mounts on the front of the beams. The seat attaches to the aircraft cockpit via the ejection catapult, positioned between the main beams.
The catapult propels the seat from the cockpit when the pilot initiates the ejection. The seat operates by pyrotechnically pressuring a two-part telescopic tube, which the process forces apart. The outer part remains with the aircraft and the inner piston ejects with the seat.
This action accelerates the seat to 55 feet per second — or 37.5 miles per hour — in 180 milliseconds. A solid-propellant rocket motor attached to the underside of the seat ignites as the seat separates from the aircraft. Forty milliseconds after the seat leaves the aircraft, a seat drogue deploys to stabilize the seat and to provide rapid deceleration.
At a time determined by ejection flight conditions, the drogue jettisons, the main parachute deploys, and the crewman is released from the seat. The parachute inflates rapidly and slows the crewman to a safe velocity for landing.
The digital sequencer
The electronic seat sequencer controls the automatic functions of the seat after it has left the aircraft. When the ejection initiates, thermal batteries power up the sequencer. Seat-mounted sensors within the sequencer measure the flight conditions of speed and altitude as soon as the seat separates from the aircraft. The sequencer uses this information to determine the appropriate automatic sequence timings and activates the seat devices by electrically initiating pyrotechnic cartridges.
Sequencing requirements are primarily a function of the initial ejection conditions of air speed and pressure altitude. Under many situations, the sequencer further modifies the sequence timings in response to the actual progress of the ejection. This not only ensures highly optimized seat performance, but also provides a degree of resiliency to unlikely and unexpected events that could otherwise compromise crew recovery.
Dual-redundant electrical start switches operated by pyrotechnic gas pressure form an important safety feature. The sequencer senses switch operation and then executes an ejection sequence to preclude inadvertent initiation of the seat pyrotechnic devices until the seat has physically departed the aircraft.
The first step is drogue deployment. As the seat separates from the aircraft during ejection, the sequencer at a fixed moment initiates drogue deployment in all ejections. Just after the drogue deploys, the sequencer's onboard sensors record the seat deceleration (due to aerodynamic drag), the pitot-tube pressure, and the base pressure behind the seat. These measurements enable the sequencer to determine the ejection speed and pressure altitude conditions.
Airspeed/altitude determine operation
There are four modes of operation related to ejection airspeed/altitude. The first is zero/zero mode. This pertains to low-speed/low-pressure-altitude ejection conditions, where the aircraft is moving as quickly as 90 knots at altitudes below 18,000 feet. In zero/zero mode, the main parachute deploys as quickly as possible after ejection to keep the pilot from hitting the ground at dangerously high speeds.
In zero/zero mode, inhibiting drogue deployment is not possible because it is initiated before environmental sensing. As such, the drogue bridle releases before drogue lines are taught (as soon as the mode decision is made), which effectively disables the drogue phase.
Next is low (altitude) drogue mode with continuous sensing. In this mode, a seat stabilizing/retarding drogue phase occurs, which is required when the ejection occurs at either a significant airspeed or significant altitude.
The sensed acceleration, pitot pressure, and base pressure values help predict the parachute deployment time when the velocity of the seat has slowed such that peak parachute inflation loads will fall within required limits. The aim is to optimize seat performance by limiting the parachute inflation load to 17 gs at altitude between 0 and 8,000 feet, progressively reducing to 10 gs at 18,000 feet as the risk of terrain proximity diminishes.
Third is low (altitude) drogue mode with no continuous sensing. This mode is for ejections at altitudes below 18,000 feet with velocities that lie between the zero/zero mode and low drogue mode with continuous sensing. Although this mode uses a seat stabilizing/retarding drogue phase, unlike the low drogue with continuous sensing mode, the time at which the main parachute extraction occurs is based on predetermined timings calculated from the values of sensed ejection conditions.
Last comes high (altitude) drogue mode for ejections higher than 18,000 feet. In this mode, a drogue phase extends until the sequencer senses the seat has descended below the 18,000 feet, and then deploys the main parachute. This mode is intended to move the seat occupant to safe atmospheric conditions as quickly as possible.
In this mode, a minimum parachute deployment timing of 4.62 seconds from the start switch is enforced to cater for ejections occurring close to the mode boundary altitude, eliminating any possibility of parachute deployment at excessive airspeed.
Engineers at Teledyne Electronic Safety Products in Northridge, Calif. designed the sequencer hardware and worked together with experts at Ada Core Technologies in New York to design the sequencer software. Designers at Martin-Baker Aircraft Co. Ltd. in Higher Denham, Near Uxbridge, England, defined the operational requirements, event timings, and decision look-up table contents — the most critical elements in the design of the recovery algorithm.
The Ada programming environment provided the requisite reliability for this project, and because of its tightly generated object code, helped developers meet size constraints. Because it is easy to read/follow, it will be easier to make changes to the system for updates and maintenance.
Fault-tolerant sequencer
The sequencer hardware/software eliminates single-point failures by a triple-redundant hardware architecture that uses hardware/software–voting logic. Appropriate failure detection and correction measures help maintain the "no single-point failure" philosophy.
The sequencer comprises three microprocessor control channels, each essentially performing the same operations. Each channel has an electrical power supply, microprocessor, memory, inter-channel communications, sensors, signal communication elements (filtering, sampling, and A-D converters), hardware voters, and outputs.
The sequencer senses environmental parameters such as seat absolute base pressure (air pressure behind the seat), seat absolute pitot pressure, and acceleration in three axes. In addition, each channel senses the state of the two start switches.
The outputs are five high-current electrical squib-fire signals for initiation of electro-explosive devices mounted within the seat pyrotechnic cartridges. These include the drogue deployment device, drogue bridle-attachments release, parachute deployment device, primary and backup seat harness- attachments release, and backup seat harness-attachments release.
Each channel processes its own inputs and makes provisional decisions. The three channels then cross-compare their individual results to harmonize the outputs, and to protect against erroneous decisions made by a malfunctioning channel. Hardware voting provides a further level of protection against incorrect outputs by preventing one channel alone to initiate an electro-explosive device.
The NACES design was tested at extreme speeds and altitudes, as well as more benign conditions, and has been proven extremely reliable. The first production of the original NACES flew in U.S. Navy F-14D jet fighter in February 1990 and since that time, hundreds of seats have been delivered to the Navy, most of which are now in service.
Dr. Jason Hendricks is a systems engineer at Martin-Baker Aircraft Co. Ltd. in Higher Denham, Near Uxbridge, England. Brett Porter is a senior software engineer at Ada Core Technologies in New York. Lee Cotter manages new business and product development at Teledyne Electronic Safety Products in Northridge, Calif.
