Redundant dual deploy, when do you consider it 'necessary'?

[OzHybrid]

I am neutral on that one. But I am an advocate for using the same fc as a backup if you are going to use 2. Become an expert on one and use that. I also understand that is a controversial opinion and I am ok with that.

You can't really say "But I ask you, in your illustrative example of the aerospace company you work for, if that company's flight computer was designed and assembled by just one person, without multi-party design reviews, would you still consider that redundant system if more that one was installed in a customer's product? " and say you're neutral and the flight computer for the redundancy should be the same as the primary.
I'm uncertain what your actual position is from these 2 opposite positions you've taken.

I own a MARSA4 and like it. I also own an ALTS2 50k and like that too. (it's a pity they're no longer made.) I have a pair of Telemetrum2 computers that have GPS which I bought for record compliance at one time which I'm neutral on. Pros and cons, but they have GPS.
I would advocate 2 different computers completely independent of each other. My 2c. YMMV.

 

[jderimig]

Not quite. Having 20 components where 10 will do - you are correct
Having two systems, each with 10 components, where system 2 can backup system 1 is MORE reliable.



Agree! And why going overboard (like 100X per my previous post) gets to a point of diminishing returns.

You can't really say "But I ask you, in your illustrative example of the aerospace company you work for, if that company's flight computer was designed and assembled by just one person, without multi-party design reviews, would you still consider that redundant system if more that one was installed in a customer's product? " and say you're neutral and the flight computer for the redundancy should be the same as the primary.
I'm uncertain what your actual position is from these 2 opposite positions you've taken.

I own a MARSA4 and like it. I also own an ALTS2 50k and like that too. (it's a pity they're no longer made.) I have a pair of Telemetrum2 computers that have GPS which I bought for record compliance at one time which I'm neutral on. Pros and cons, but they have GPS.
I would advocate 2 different computers completely independent of each other. My 2c. YMMV.

Norman, I see your point now, clever.

I maintain there is no true redundancy this hobby practice (for the most part) no matter how many diverse altimeters one decides to stuff in their rocket. All those systems share a single point of failure, which is the system integrator.

As far as diverse combination of flight computers, sure. I would especially be wary of new platforms. Bugs and sensitive use cases tend to reveal themselves in the field with time on their own schedule.

Back to Marsa, since you brought it up , that platform was introduced in 2008. The hardware platform is robust, firmware has been continuously updated (34 builds on the Marsa4 and 26 on the Marsa54L), that is a pretty robust system, 14 years of use and 1000's of customer flights does that. So I do not worry about anyone using 2 of those in a rocket.

But I wouldn't make that recommendation right away with any new platform that I might introduce.

 

[FredA]

All those systems share a single point of failure, which is the system integrator.

Yep - Pilot errors.
Use two and wire and program them BOTH the same way is the USUAL "redundant system" rocket people use.
Double the opportunity for pilot errors.
While this does provide some coverage for HW faults - but they don't really occur UNLESS YOU ABUSED the electronics in some what like leaving them outside (lost) for months.

Redundancy for the stuff that does fail --- ematches and ejection charges -- that's what you want and all you want.

 

[Grog6]

I've seen a lot of discussion of wire termination, and seen several posts that are actually Worst case solutions.
I'm not calling anyone out, but I was responsible for doing just that, in both nuclear and medical electronics for the last 35 years.
I have some suggestions.
1. The industry has already solved the wire termination game, AMP crimp contacts, crimped correctly, rarely fail. Get the PDF off their website, and follow it. even Those of you who have used those can benefit by reading the pdf. Most people use them improperly, from what I've seen over the years.
For smaller things, I use Molex pins and housings, they are good at handling vibration and G's.
2. For wires going into terminal blocks, use wire ferrules from amp; precompressing the wires keeps it from loosening up.
If anyone cares, I can furnish links. Never solder wires. You need a strain relief, or the wire breaks right at the solder. thats why the industry developed better solutions.
3. Heat shrink tubing makes a good strain relief.
Buy a good ratcheting crimp tool to insure quality of your crimps. I have a paladin tool, that will accept several sets of dies in the front; it will do everything with the proper die.

 

[cautery]

1. The industry has already solved the wire termination game, AMP crimp contacts, crimped correctly, rarely fail. Get the PDF off their website, and follow it. even Those of you who have used those can benefit by reading the pdf. Most people use them improperly, from what I've seen over the years.
For smaller things, I use Molex pins and housings, they are good at handling vibration and G's.
2. For wires going into terminal blocks, use wire ferrules from amp; precompressing the wires keeps it from loosening up.
If anyone cares, I can furnish links. Never solder wires. You need a strain relief, or the wire breaks right at the solder. thats why the industry developed better solutions.
3. Heat shrink tubing makes a good strain relief.
Buy a good ratcheting crimp tool to insure quality of your crimps. I have a paladin tool, that will accept several sets of dies in the front; it will do everything with the proper die.

Thank you! I'd love to have the PDF you reference, and anything else. I am always in the market for more information about cabling, termination, et al.
I am a big believer in biting the bullet and purchasing the correct tooling for whatever termination, et al. job you need to accomplish.

I still have a huge stock of MOLEX stuff and tools that I hardly ever use now... But I have it if I ever do need it again!

Crimp ferrules for end of wire termination for terminal block use is a requirement. Just received a new box of ferrules from 30-10 AWG....
I keep an extensive collection of shrink tube.... 2:1 thru 4:1, with and without adhesive lining, etc, etc.... Same with braided coverings, et al.

 

[FlyBy01]

I consider redundant altermiters necessary when I will cry if my $1,000 plus dollar rocket comes in ballistic because I cheaped out $60 to $100 bucks.

 

[Grog6]

Here we go, this has all the important stuff:https://www.ttieurope.com/content/d.../1473-TE-Connectivity-Good-Crimping-v3Web.pdf

 

[Grog6]

http://engineering3.org/wp-content/uploads/2016/05/E3-Crimping-Molex-Connectors.pdf

 

[OverTheTop]

My 6” ultimate wildman went up at Airfest this year, a soldered wire came loose from the terminal block on the primary RRC3. The primary apogee charge did not fire.

Do not tin wires that are going into screw terminals. The solder creeps under pressure and the pressure applied reduces. There is also a failure mechanism where the solder wicks up the wire and creates a fracture point where it stops, due to vibration. The best way is to crimp a bootlace ferrule on the stranded wire, then screw into the terminal. You can pick up a ferrule crimper and a few hundred ferruls for about $20.

No one has mentioned the benefits of using “partial redundancy”

That is how I generally fly. Drogue/NC is done by a single computer and dual redundant charges. Main has two altimeters with redundant charges that are sufficient to blow of the nosecone as well as blowing out the main (single-ended dual deploy). I have a similar technique to reduce the mumber of altimeter and pyro batteries, providing redundancy without going excessive.

Fact: PROPERLY done, a crimped/soldered connection is superior to crimp only or solder only.
Problem is that SOME "amateur radio operators" do not have the skills required or use an improper technique.

A properly done crimp connection is far superior in a vibration environment than a soldered connection for reasons I mentioned in my first paragraph. I used to work on trams and there are thousands and thousands of quick-connect and ring lug terminals involved in the control and auxiliary wiring. All are crimped and soldering is not allowed. Never had a failure across the fleet in the six year I was there. You must have the correct terminal, the correct wire and the correct tool used correctly.

Crimping and soldering can have a MINOR improvement in connection resistance but it is only worth considering, IMHO, in very exceptional circumstances and when constant high currents are involved. It usually highlights a design that should have been done differently in the first place from my experience. If done, the connection still needs support past the point where the solder stops wicking up the multistrand, with something like heatshrink tubing or mechanical support if it is in a moving environment.

 

[OverTheTop]

Here we go, this has all the important stuff:https://www.ttieurope.com/content/d.../1473-TE-Connectivity-Good-Crimping-v3Web.pdf

Nice document for general circulation .

You forgot to mention IPC-620 standard
https://whma.org/ipcwhma-a-620/This is a really enlightening read if you can get your hands on a copy.

 

[FredA]

I put one FC in a rocket for "life."
It is never removed.
I ask FC vendors if I can buy without screw term headers - some will do that for me which is awesome.
If I can't get them that way, I'll often remove the headers.
I'll solder my stranded and double-tinned colored ribbon cable to the headers and provide strain relief.
The pyro outputs go to a 4PDT switch - soldered - and continue out the bulkheads.
So the only terminals in the system are a set of 4-posistion terminal blocks on the outside of the two bulkheads.

There might be a technical foul at these term-blocks in that I'm screw-compressing the stranded and double-tinned ribbon wires, but I loop the wires around the screws, tighten well, then epoxy down that whole side of the term block.
This is minor - remember, this circuit gets a 1-sec pulse and 50% contact (under vibration) will still fire the match.
The other side of the term blocks connect to the ematches which is solid core and should be fine for one flight.

Hundreds of flights done this way and only ONE electrical failure and that was when the ematch wire broke right at the term-block on an air-start channel where you are hard-pressed to provide backup in a HEI system.

 

[rocketman328]

So one of my rocket buddies and I were discussing redundant dual deploy yesterday. We defined it as a dual deploy set-up with 2 independent switch/battery/computer/deployment charge systems.

From there, neither of us really had a good threshold of when or why we considered it necessary, or preferred. LiPo batteries are getting smaller, switches easier to incorporate, and flight computers are (generally) getting smaller and gaining function (even if availability of certain product lines are currently curtailed due to chip shortages).

I've done dual systems in rockets as small as 2.6 inch, and it was challenging. After that project I find that 3" and 4" rocket avionics bays are positively cavernous, with huge amounts of real estate on the bay lids!

Then there's the expense. Conservatively all the components for a single systems are in the neighborhood of $100 on up to pretty much as much money as you want to spend.

What's YOUR criteria for using 2 systems in your rockets? Is it size of the rocket? Weight? Power level? Altitude level expected? Expense of the project?

ETA: I'm a dual redundant nut case having retrofitted most of my dual deploy fleet to redundant systems ever since having a REALLY EPIC bad run of orange wire ematches fail, and have switched over to MJG firewire initiators and Altus Easy Minis as they're readily available, and 2 of them fit into the av bay sled real estate of my previously preferred RRC3s.

Dual Deploy with backup (Two redundant systems) has become standard operating procedure for me, the smallest airframes I fly any more are 4". My projects are getting larger and more costly, so recovery in a priority. At launches I attend I see a large number of failures on single systems, I think largely due to human error. I fly primarily Missleworks Devices and have found reliability to be very good.

 

[Grog6]

I have a shelf full of IPC documents; I try not to quote from them in public, lol.
One of my best designs violates the spacing requirements badly, but has achieved an aql of below 0.01% over ~300k units, running at 1350V. But they provide a good guide to best practices.

 

[firemanup]

Do not tin wires that are going into screw terminals. The solder creeps under pressure and the pressure applied reduces. There is also a failure mechanism where the solder wicks up the wire and creates a fracture point where it stops, due to vibration. The best way is to crimp a bootlace ferrule on the stranded wire, then screw into the terminal. You can pick up a ferrule crimper and a few hundred ferruls for about $20.

I didn’t.

 

[OverTheTop]

I have a shelf full of IPC documents; I try not to quote from them in public, lol.

Maybe I shouldn't admit that I like reading them. Maybe it is all the pictures I like.

One of my best designs violates the spacing requirements badly, but has achieved an aql of below 0.01% over ~300k units, running at 1350V. But they provide a good guide to best practices.

Guidelines are just that, allowed to be tweaked when necessity requires sometimes. We do what we need to do within our allowable constraints. Regulatory requirements, say the EN61010-1 safety specification, are another kettle of kipper and can't be exceeded.

 

[les]

While this does provide some coverage for HW faults - but they don't really occur UNLESS YOU ABUSED the electronics in some what like leaving them outside (lost) for months.

Sorry - I disagree. You've never had anything electronic act up (without abusing it)?

Again, based on the products my company sells, HW faults do occur. Bad parts from the factory, ESD damage, bad solder joint, tin whiskers (if lead free solder, and most new components now come pre-tinned with lead free solder now), and even SEU can cause a HW fault. And the list of possible failure modes/causes is a LOT longer. Our production test and environmental stress screening catches most before shipping, but we get a fair stream of field returns. And again, our vendors do not do the same level of analysis/testing.

I do think one point to consider - look at other consumer electronics; cell phone, TV, PC. Those are powered on and used multiple hours a day (if not 24/7).
Compared to that, our electronics are powered on and used for typically an hour or two (depends on how quickly the range is loading/launching) once every few weeks/months/years? So the probability of failure compared to power on time is very low, but not zero.

I also can't recall ever seeing anyone prepping their rocket on the field using an ESD strap. How many use a properly grounded strap (and ESD protected work surface) when building their sled? ESD damage alone can be a significant cause of an unexpected HW fault....

It is all going to come down to personal preference and risk an individual is willing to accept, plus accepting the risk they place on others attending and on rocketry in general. I've had a big rocket (not mine) come in ballistic and crash less than 50' from me. It was interesting feeling the shock wave through the ground. Not certain what the cause was - the rocket was fairly buried in the ground. But if a rocket causes significant damage (hit a car) or worse (hit a person) because "redundancy is not worth while", well......

 

[Grog6]

I wonder if it would kill my stratologger cf to underfill all the chips, and coat it with Humaseal?
It makes the board hold a bit more heat, so it can kill higher power stuff.
The military's properly done boards are good to over 200g's.
Anyone know who to ask?

 

[Grog6]

Sorry - I disagree. You've never had anything electronic act up (without abusing it)?

Again, based on the products my company sells, HW faults do occur. Bad parts from the factory, ESD damage, bad solder joint, tin whiskers (if lead free solder, and most new components now come pre-tinned with lead free solder now), and even SEU can cause a HW fault. And the list of possible failure modes/causes is a LOT longer. Our production test and environmental stress screening catches most before shipping, but we get a fair stream of field returns. And again, our vendors do not do the same level of analysis/testing.

I do think one point to consider - look at other consumer electronics; cell phone, TV, PC. Those are powered on and used multiple hours a day (if not 24/7).
Compared to that, our electronics are powered on and used for typically an hour or two (depends on how quickly the range is loading/launching) once every few weeks/months/years? So the probability of failure compared to power on time is very low, but not zero.

I also can't recall ever seeing anyone prepping their rocket on the field using an ESD strap. How many use a properly grounded strap (and ESD protected work surface) when building their sled? ESD damage alone can be a significant cause of an unexpected HW fault....

It is all going to come down to personal preference and risk an individual is willing to accept, plus accepting the risk they place on others attending and on rocketry in general. I've had a big rocket (not mine) come in ballistic and crash less than 50' from me. It was interesting feeling the shock wave through the ground. Not certain what the cause was - the rocket was fairly buried in the ground. But if a rocket causes significant damage (hit a car) or worse (hit a person) because "redundancy is not worth while", well......

There are ways to ameliorate ESD problems, which, I have found are the worst when the air is cold and dry, and everyone is wearing nylon filled with goosedown.
I learned suddenly and indeliably on a service trip as I touched an equipment rack, and it dropped me like 440, lol.
I've never been hit that hard. I turned to the other guy, and said "Foundit!"lets get the hell out of here!"
We built a computer-based leak detection equipment, and it was locking up. Hell, it about locked ME up.

Esd is easier to deal with now than it was 20 years ago; look into x2y caps, a tiny one on every lead that goes to a connector, series resistors, inductors if resistors wont work, large ground planes all the way to the edge of the board, with a low ac impedance across the voltage plane is will give time for the on chip protection turn on, and keep the chips from being damaged. underfill makes rework hard, but it increases the g tolerance considerably.
Acrylic humaseal is reworkable, and protects against most physical damage.
Also, a production tip I learned 30 years ago:if you take your new production, test power-on, and if functional, leave powered on for 48 hours, at 80C. Don't leave them running a loop, just powered on.
If they passed testingafter that then we knew they were into the 'bathtub', and not on the edge. "bathtub curve" is a reliability curve. leading edge is the infant mortality, other edge is wear out.
Don't get me started on halt/hass.

 

[Grog6]

Those of you that launch when it's cold and dry out could do a service for your club by buying a box of the very cheap wrist straps, and donate them to the club. attach the grounds to the launcher platform, if it's metal.

 

[Grog6]

BTW, @les. unless you sell in china or the eu, you don't have to go lead free.
We could ship a half ton to germany, as long as it was labelled shielding.

 

[FredA]

Human-Body Model ESD protection is standard on every pin of every IC made in the last 20 years with the exception of super high-frequency inputs....which we don't have in our cheapy FC's.
You have to try hard to fry a part.

At work, I make and sell 100's of thousands of devices a year with a lifetime warranty to users who know nothing about electronics. Designed to take a beating....1000's of G's.... We've found ONE defective part that failed during factory test that was initially good.....in the last two years.

Properly designed electronics do not fail - the mechanical parts do.

 

[FlyBy01]

Human-Body Model ESD protection is standard on every pin of every IC made in the last 20 years with the exception of super high-frequency inputs....which we don't have in our cheapy FC's.
You have to try hard to fry a part.

At work, I make and sell 100's of thousands of devices a year with a lifetime warranty to users who know nothing about electronics. Designed to take a beating....1000's of G's.... We've found ONE defective part in the last two years.

Properly designed electronics do not fail - the mechanical parts do.

When are you starting an altimeter company for rocketry?

 

[mccordmw]

I out together two eggfinders for redundant deployment. They are on a sled that fits in a 3 inch avionics bay. When I fly larger, the same sled slides into an adapter to fit in my bays that range from 4 to 6 to 8 inches in diameter.

I consider it a personal mandatory safety margin.

 

[Grog6]

I can't agree with the premise that properly designed electronics won't fail. I've designed many circuits that could not withstand being shorted, or even dirty, in some cases. High voltage is merciless, and diodes won't withstand a Bertran HVPS.
2kv@100mA will clean the board off, lol.
Some of the most expensive opamps I've ever bought die if the - supply goes away. That's a wonderful fact to discover after you ship 50, lol.

 

[Orien]

I'm building my first fiberglass kit (2.6" Madcow AGM Pike) that will hit 2 miles and go supersonic on the biggest 38mm J's. That's the smallest airframe I've used since I built an Aerotech Initiator when I was 14 (I'm 45 now). I was concerned about getting everything to fit on the small bulkheads as it was a really tight squeeze to get all the redundant components on my 3" Firestick XL. Then I stumbled across SMT quite by accident and ordered a 65mm redundant av bay. It's quite the piece of engineering:


As for me, I'm for redundancy. The cost is, what, $50 for an RRC2L? I invest a lot of thought, time, care, and cash into these things. I don't like the idea of my rocket's survival ultimately depending on one little cheap ematch firing. I'm really surprised there's so much opposition to it, honestly.

 

[jderimig]

I can't agree with the premise that properly designed electronics won't fail. I've designed many circuits that could not withstand being shorted, or even dirty, in some cases. High voltage is merciless, and diodes won't withstand a Bertran HVPS.
2kv@100mA will clean the board off, lol.
Some of the most expensive opamps I've ever bought die if the - supply goes away. That's a wonderful fact to discover after you ship 50, lol.

Most PCB failures when they occur are infant mortality, either a defect in production or assembly. Under current industry quality control best practice that reliability is better than "4-9, .9999" reliability. Better than that if a HASS or burn-in SOP is followed. After that the flat part of the bathtub curve is usually at an MTBF in the hundreds of years. Of course all that goes out the window if component specified operating specifications are exceeded.

Compare that with the rest of the rocket system commonly practiced in this hobby. A 1-9 reliability for that is doing well. So yes strive to get your electronics to 2-99 reliabilty, but after that your focus might have better return somewhere else in the chain.

 

[OverTheTop]

Some of the most expensive opamps I've ever bought die if the - supply goes away.

OPA627?

 

[Grog6]

yes,Among others; the opa128lm is/ was? a low noise opamp;the fb res was a gigohm. we were reading currents at the 1e-15A range.It doesn't say a thing about it on the datasheet.
All that family do that, op27,177,etc

 

[OverTheTop]

We blew a number of OPA627s up developing an extremely sensitive, accurate and linear photodiode amplifier. Look at the opamp the wrong way and it would cease operating. I think they were $65 each about 20 years ago when we developed the product. Still selling it and that amplifier never blows now . It is still the same opamp it was years ago, it just schooled us on treating it properly during the design process. Those opamps are down to $45 now.

 

[Grog6]

The last Photodiode amp I worked with had 48 channels and 48x12 bit adc's witha HV opamp setting the hv bias on each one.And an asic and fpga...