Pull Pins Outlawed!

[sylvie369]

I don't need to ask questions on things I already know how to do. I don't need to ask questions that I already know the answers to. I've been flying rockets, single stage, clusters and multistage rockets since before the were electronics for things like staging. Re-read all of the posts in this thread,

Reread mine. You dodged the point, which was that you claimed expertise but demonstrated a lack of it. Again, if you knew this stuff so well, you would not have posted that rather serious and basic mistake, one that clearly indicates that you have some basic level learning to do before you're ready to fly high power multistage.

As for your "just opinion" slogan, that's not doing for you what you seem to think it's doing. You got the facts wrong. That's not "just opinion", it's a fact. You're not helping yourself by chanting "that's just your opinion" every time someone points out your mistakes. It may comfort you, but that's about it.

[JoeG]

Just looked at the 2012 Tripoli Safety Code and saw this:
2-12.6 A rocket motor shall not be ignited by any of the following:
a. A switch that uses mercury.
b. “Pull wires” that disconnect or complete a circuit.
c. “Pressure roller” switches

I don't know if I've been getting away with this for long-is this new? I'm bummed because I have a Xavien 'Fist' and a bunch of pull pin sets from Programmin' Pete. Looks like g-switches and timers from now on. I support the Mercury switch elimination but I do like microswitches for some uses. Does this mean burn wires too?

Getting back to the initial post..........

Note that the NEW Tripoli HPSC has been posted two days ago and guess what's missing. That's right. Pull pins. The Tripoli board has listened to arguments for and against and has removed pull pins from the prohibited methods. At least for the time being.

From Tripoli High Power Safety Code on the website:

Appendix A - Additional Tripoli Rulings
A-1 NFPA 1127 was adopted by the Tripoli Board of Directors as the Tripoli Safety Code. (Tripoli Report, April 1994, Tripoli Board Minutes, New Orleans, 21 January 1994, Motion 13.) Since this adoption, the code has gone through some revisions. Such is the way with codes – they are constantly undergoing change to improve and update them when safety prompts, or when the federal regulations change or are reinterpreted
A-2 All Tripoli members who participate in Association activities shall follow the Tripoli Certification Standards.
A-3 Any Board action(s), with regard to safety, made previous to or after publication of this document shall be a part of the Tripoli Safety Code.
A-4 Increased descent rates for rocket activities conducted at the Black Rock Desert venue are acceptable if needed to insure a controlled descent to remain inside the FAA approved Dispersion Area.
A-5 Rockets with more than 1280ns of total impulse must use active recovery mechanisms.
A-6 A rocket motor shall not be ignited by using:
a. A switch that uses mercury.
b. “Pressure roller” switches

Mercury and pressure roller switches still are on the list however. Probably for good reason.


Thanks to a board of directors that listens to the input from the members.

[kruland]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

[cwbullet]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

This makes sense. Instead of focusing on what we can't change, let's look for other options. Sure, it is painful to change, but I think this will end up being safer.

[troj]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

Except that some will interpret that literally and require a switch in place of separated wires.

-Kevin

[kruland]

Except that some will interpret that literally and require a switch in place of separated wires.

-Kevin

Kevin,

Sorry I don't understand - probably because I haven't seen or done enough in this hobby - but that doesn't matter. The intention is there is some way for the pyro to be disabled, and it must be disabled all the time except for at some specific listed times.

Kevin

[jadebox]

This makes sense. Instead of focusing on what we can't change, let's look for other options. Sure, it is painful to change, but I think this will end up being safer.

I realize it's not practical and there are reasons for rules against specific practices, but I wish it were possible for rules to be written that specify the desired goal, not specific ways to achieve the goal. Most any time you specifically forbid something, you affect someone who was using that technique in an safe and effective manner.

I'm pleased that the no pull-pins requirement was removed. I've been working on plans to build the Sheri's Hot Rockets Saturn V kit that I have as a five-motor cluster. I want to only fire the four outboard motors once the larger center motor has ignited. But, I don't want to air start the outer motors using a timer because the commercial timers I've looked at don't fire until at least .5 seconds after lift-off and that puts the rocket a little too high up for realism.

A pull-pin seems to be the best solution. On the other hand, I see the danger in using a pull-pin or switch. To avoid the possibility of the pull-switch igniting the motors unexpectedly, I've considered building a simple timer circuit that will hook to the leads from the launch controller and only arm the pull-switch from the time the launch button is pressed to a few seconds after it is released.

-- Roger

[jadebox]

"A-5 Rockets with more than 1280ns of total impulse must use active recovery mechanisms."

I know a few people who aren't going to be happy about that one.

-- Roger

[cwbullet]

I guess this means no more saucers on large motors. Am I reading this correct? That hurts Art Applewhite.

[troj]

Sorry I don't understand - probably because I haven't seen or done enough in this hobby - but that doesn't matter. The intention is there is some way for the pyro to be disabled, and it must be disabled all the time except for at some specific listed times.

Trust me, if the wording says a "switch" then there will be those who will literally require a switch, or they won't sign off as an RSO, certifier, etc. When it's pointed out that the intention is that a physical disconnect be provided, they'll put to the specific word "switch" and say "tough petunias".

-Kevin

[troj]

I guess this means no more saucers on large motors. Am I reading this correct? That hurts Art Applewhite.

No, it doesn't mean no saucers. It just means you have to have active recovery on them -- no more free-fall.

-Kevin

[cwbullet]

No, it doesn't mean no saucers. It just means you have to have active recovery on them -- no more free-fall.

-Kevin

So, kevin does this mean saucers must have a streamer or parachute?

[jadebox]

So, kevin does this mean saucers must have a streamer or parachute?

They'll have to add a "mustache." :-)

The photo I posted is of one of Marc's saucers that he launched at the NEFAR launch. I'm not really sure what size motor it used, but I'm sure we've seem him launch saucers on motors larger than a K. He's launched many of them and they go up ... slowly ... and they come down ... slowly ... near the pads. They've never gone high enough to come down anywhere near people or any property.

-- Roger

[cwbullet]

Same here. I have never seen them come down hear property. Well that rule sour most experimental and 6 grain xl motors because of the lack of a delay. I saw one eco of a flight of on a CTI K300. It went forever (for a saucer) and gently returned to earth. Very majestic flights. I am working on a 36 inch saucer, but will not finish it if this is the case.

[UhClem]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

4.13.7 The function of firing circuits and onboard energetics shall be inhibited until the high power rocket is in the launching position.
4.13.8 The function of firing circuits and onboard energetics shall be inhibited prior to removing the high power rocket from the launching position.

Will be in the 2013 edition of NFPA 1127 which should be published any day now.

[luke strawwalker]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

EXACTLY!!!! We have a winner!!!

All this other BS about pull pins, roller switches, breakwires, and mercury switches is just dancing around the central issue... that the initiators activated by electronics in flight for either staging, motor starts, or ejection or separation charges should ALL be REQUIRED to have circuit isolation between the firing electronics and the actual initiator either by a circuit shorting or circuit opening isolation switch of whatever type until the rocket is loaded on the pad, hooked up, and ready to fly, PERIOD.

Nearly every HPR accident I've seen (with the exception of staging failures) would have been prevented by the use of just such initiator isolation devices had they been properly used...

Later! OL JR

[luke strawwalker]

I realize it's not practical and there are reasons for rules against specific practices, but I wish it were possible for rules to be written that specify the desired goal, not specific ways to achieve the goal. Most any time you specifically forbid something, you affect someone who was using that technique in an safe and effective manner.

I'm pleased that the no pull-pins requirement was removed. I've been working on plans to build the Sheri's Hot Rockets Saturn V kit that I have as a five-motor cluster. I want to only fire the four outboard motors once the larger center motor has ignited. But, I don't want to air start the outer motors using a timer because the commercial timers I've looked at don't fire until at least .5 seconds after lift-off and that puts the rocket a little too high up for realism.

A pull-pin seems to be the best solution. On the other hand, I see the danger in using a pull-pin or switch. To avoid the possibility of the pull-switch igniting the motors unexpectedly, I've considered building a simple timer circuit that will hook to the leads from the launch controller and only arm the pull-switch from the time the launch button is pressed to a few seconds after it is released.

-- Roger

Why not have a separate "safety pin" that shorts or opens the outboard ignitor circuits while on the pad, until the rocket is actually ready for launch?? One of those "remove before flight" pins that actually opens the outboard ignitor circuit by either isolating the power supply from the ignitors or opens the ignitor lead between the pull pin for the outboards and the actual ignitors??

That would seem to make the most sense and be the safest to me... if for any reason the rocket needed to be removed from the pad, that remove before flight pin would be the first one reinserted... Thus opening the outboard ignitor circuit and preventing firing even if the pull pin should be dislodged accidentally.

Later! OL JR

[cwbullet]

I do not understand it, but I will abide by it. I will have to find a way to convert my rockets.

[G_T]

Pretty much any safety critical device should have two independent steps required for the action to be possible. I thought that was pretty much standard engineering practice. It always has been for the systems I've worked on. It appears what happened here is much like what happens too often in engineering. Instead of a good requirements spec, we get design by requirements.

Gerald

[cwbullet]

Pretty much any safety critical device should have two independent steps required for the action to be possible. I thought that was pretty much standard engineering practice. It always has been for the systems I've worked on. It appears what happened here is much like what happens too often in engineering. Instead of a good requirements spec, we get design by requirements.

Unfortunately, that also makes more to go wrong when you add a step of complexity.

[jadebox]

Why not have a separate "safety pin" that shorts or opens the outboard ignitor circuits while on the pad, until the rocket is actually ready for launch?? One of those "remove before flight" pins that actually opens the outboard ignitor circuit by either isolating the power supply from the ignitors or opens the ignitor lead between the pull pin for the outboards and the actual ignitors??

That would seem to make the most sense and be the safest to me... if for any reason the rocket needed to be removed from the pad, that remove before flight pin would be the first one reinserted... Thus opening the outboard ignitor circuit and preventing firing even if the pull pin should be dislodged accidentally.

I would do that in addition to the extra timer I described.

Although it's a remote possibility, I want to ensure that the motors won't be ignited if someone else fools with the rocket on the pad. I would know that it is necessary to disarm the outboards, but others wouldn't. The extra circuit would also protect against other unlikely things like something accidently snagging the wire connecting to the pull-pin.

-- Roger

[G_T]

There may be 4 actions required to fire the first stage motor. Connecting the igniter leads. Setting the safety interlock at the pads to armed. Setting the safety interlock at the launch control board to armed. Hitting the fire button. It takes multiple failures to accidentally fire the motor.

It is easy to get into a situation where, for a second stage motor, there is only one action required to fire. Arming the electronics. If something goes wrong with the single device, the motor can be fired automatically at any time once power is available to the device, while one or more people are in close proximity. I would like to have seen a requirement something along the lines of: "The circuitry for arming and igniting an upper stage motor in a high power rocket shall be designed such that the failure of any single electronics device cannot by itself cause the unintentional ignition of the motor". Then leave the methods up to the developer of the rocket, and the approval of the RSO. Then we can develop good practices, that can change with technology. This affords maximum opportunity to engineer solutions while stating the required outcome.

Gerald

[jadebox]

I would like to have seen a requirement something along the lines of: "The circuitry for arming and igniting an upper stage motor in a high power rocket shall be designed such that the failure of any single electronics device cannot by itself cause the unintentional ignition of the motor". Then leave the methods up to the developer of the rocket, and the approval of the RSO. Then we can develop good practices, that can change with technology. This affords maximum opportunity to engineer solutions while stating the required outcome.

That's what I was getting at. A good requirement should clearly state the intent of the requirement and shouldn't dictate design. But, I know from experience, that it's hard to write good requirements. :-)

As a practical matter, though, it's easier for RSO's in the field to apply a rule that states "no left-handed widgets may be used."

-- Roger

[cerving]

It seems a pruden modification to the safty code would have been to include a requirement that all pyrotechnic circuits include a manual switch which disables them (either through shorting or removal of power). And that the switch must be in the "safe" position whenever the rocket is not vertical and on the rod/rail.

In my humble opinion, TRA/NAR should REQUIRE that airstart igniters be short-circuited until immediately before launch. Better to fry an output transistor on your altimeter than to fry your face if it should go off unexpectedly at the pad.

Of course, as has been previously stated, this DOES add one more level of complexity... so does having a keyswitch and a warning siren on the launch controller. Safety is everything.

[luke strawwalker]

In my humble opinion, TRA/NAR should REQUIRE that airstart igniters be short-circuited until immediately before launch. Better to fry an output transistor on your altimeter than to fry your face if it should go off unexpectedly at the pad.

Of course, as has been previously stated, this DOES add one more level of complexity... so does having a keyswitch and a warning siren on the launch controller. Safety is everything.

Agree...I'd go one better and require that BP ejection charges be similarly isolated until on the pad and ready for liftoff as well...

Not like "remove before flight" pins are anything new... and it's not THAT complicated... they should also be required to be RE-INSERTED prior to ANY work being performed on the rocket in the event of a misfire or other problem requiring correction before launch. IMHO... Later! OL JR

[cjl]

In my humble opinion, TRA/NAR should REQUIRE that airstart igniters be short-circuited until immediately before launch. Better to fry an output transistor on your altimeter than to fry your face if it should go off unexpectedly at the pad.

Of course, as has been previously stated, this DOES add one more level of complexity... so does having a keyswitch and a warning siren on the launch controller. Safety is everything.

Disconnected would make more sense than shorted - depending on the details of the short, as well as the details of the pyro system, a fully shorted low-current igniter (such as the ones provided with CTI motors) could still fire, despite the short. I would always advocate disconnecting the airstart igniter until immediately before launch (via a switch of some kind).

[DM1975]

I agree with safety at all levels but adding complexity to a process that has proven to be safe, such as the above mentioned black powder ejection charges is just adding more points of failure as well. If disabling the power to the altimeter keeps the charges from firing then why add additional redundant points that add more chances of failure?

Sure your black powder charges have added separation from the power source, but you now have trippeled the likelihood of a failure at those points and made the odds of a ballistic recovery more likely. Something like that coming down in a crowd to me would seem more dangerous than an ejection charge possibly going off on the pad.

I am speaking specifically about the mention of ejection charges by Luke Strawwalker and not air start, mercury switches, or pull cords. Am I just reading this wrong?

[cjl]

I agree with safety at all levels but adding complexity to a process that has proven to be safe, such as the above mentioned black powder ejection charges is just adding more points of failure as well. If disabling the power to the altimeter keeps the charges from firing then why add additional redundant points that add more chances of failure?

Sure your black powder charges have added separation from the power source, but you now have trippeled the likelihood of a failure at those points and made the odds of a ballistic recovery more likely. Something like that coming down in a crowd to me would seem more dangerous than an ejection charge possibly going off on the pad.

I am speaking specifically about the mention of ejection charges by Luke Strawwalker and not air start, mercury switches, or pull cords. Am I just reading this wrong?

I absolutely agree with all of this. In my opinion, adding additional failure points to the ejection system to slightly reduce the chance of inadvertent firing is a very bad thing, as the consequences for a failure are much worse than the consequences of accidental early deployment. Airstarts or staged motors on the other hand are the opposite. If an airstart fails to ignite, the consequence isn't terribly severe - the rocket just doesn't go as high. However, if an airstart or second stage ignites inadvertently, as was demonstrated at LDRS a few years ago, the consequences are severe.

Basically, I am an advocate of only using a single switch per altimeter for deployment charges, but I am also an advocate of having a second switch to disconnect the igniter for airstarts or staging (along with intelligent ignition logic that will only ignite the motor if the flight is performing close to nominally).

[DM1975]

I do not have enough knowledge about staging high power rocket to advocate one way or another, I'll trust leadership on that. It sounds logical though.

[jadebox]

In my opinion, adding additional failure points to the ejection system to slightly reduce the chance of inadvertent firing is a very bad thing, as the consequences for a failure are much worse than the consequences of accidental early deployment.

I agree. It's more important to ensure that the recovery system deploys during the flight.

I think, though, it is important to keep people away from the rocket as the electronics are turned on. I often see people (including kids) who aren't directly involved hanging around while we are setting up our rockets. I think we need to be careful and do more about controlling that.

I had the ejection charges go off on the pad when I was setting up a 12-foot rocket. As I disconnected the altimeter after it beeped out the wrong number of connections, the main charge fired and the nosecone shot a few feet in the air. It fell between the two people helping me set up the rocket. It had a couple of pounds of weight in it, so it could have caused a serious injury if it had hit them or me. A second later, the apogee charge blew separating the main part of the rocket and covering me with black soot. I was standing atop a six-foot ladder while all this happened. Fortunately, no one was hurt.

Now, I ask everyone else to step away as I arm the altimeter.

-- Roger