Revision to Tripoli Rule Regarding Wireless Remote Switches

The Rocketry Forum

Help Support The Rocketry Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
Status
Not open for further replies.
Stake the end of the screw and you will get a screw that when backed out to the staked end will neither back out fully and get lost, nor will it vibrate closed easily.

Still looking at different designs and use cases. Obviously they aren’t uniform in implementation or use. And there are more cases and uses in the field than people may realize.

One of the things I’ve taken away from this whole discussion is that my definition of ‘disconnected’ doesn’t seem to be in line.

I consider an altimeter or charge to be connected to an energy source if it’s going through a mechanical switch. If it’s connected to (-) or common or ground on one side, and isolated by a SPST switch on the other - it’s not the same as the battery being disconnected and in your pocket. It’s a matter of technology, not ‘connectedness’.

But apparently I have a minority view, and my mentoring and certification didn’t catch and correct it.
 
All devices which control staging or energetic charges must be physically disconnected from power or must have their initiators mechanically disconnected from potential power sources while being transported or when presented for pre-flight inspection.

It sounds like the real intent is that power must be disconnected by a device that prevents unintentional activation of the circuit. I 100% agree with that message and it sounds like no one is objecting to having the altimeter powered off.

I think the issue is singling out solid state switches. There have been many examples above of mechanical disconnects that are probably more prone to accidental activation. Especially bare wires hanging out waiting to be twisted or pull-pin switches with excessively long "Remove Before Flight" tags that get unintentionally yanked out. It would also be nice to see the entire event chain addressed. Modern altimeters with remote arming and multi-sensor launch detection are far safer than older alternatives. It might be more useful to see recommended best practices for safe prep and flying (like your example of taping down pull pins) instead of a couple of examples of what not to do. The safety code will never be able to explicitly prohibit every unsafe combination of hardware and actions.

I'm very glad that TRA is at least having the conversation. Thank you Steve and the rest of the board. We have the experts to make the right decisions and it will only take one public event before we loose that privilege and get a rule that really doesn't make sense handed down from some other source. Plus, I do like having all of my fingers.
 
I like hardware that is designed to prevent or minimize the potential for user error.

The Eggtimer Quantum users guide says that the battery polarity does not matter. There is no way to hook up the battery backwards and accideentally fire the charges. The hardware prevents that kind of user error.

It also says that when the battery is first connected, the unit always comes on in an unarmed state, meaning that there are 2 solid state switches isolating the firing circuits, both of which would have to fail independently to accidentally fire the charges. The hardware prevents the user error of leaving the switch in the closed position before connecting the battery.

In order to arm it, the unit requires you to connect to the WiFi signal created by the unit, and then open a web interface, type in an arming code and click ARM. I’m not saying it’s impossible to do all that and then do something you are not supposed to do afterward, like hammer in your chute, but it does prevent not understanding you have armed the unit, And it prevents accidentally arming it by jiggling a switch closed, snagging a pull pin on something, or touching 2 wires together.

My understanding (and I’m not sure I completely understand this) is that even after user arms the unit, at least one leg of the firing circuits is not actually armed until certain conditions are met. The altimeter needs to detect the launch, and then it needs to detect the slow-speed condition before apogee before arming that leg. Then the second leg is closed when it is actually time to fire. I don’t know if this is correct, but it sounds like the design prevents the kinds of mistakes that could cause the unit to fire accidentally. For example, if the user were to arm the unit and then hammer in the chutes, would that actually trigger all the conditions needed to close both legs of the circuit and fire the charges? It seems like it protects against that.
 
I like hardware that is designed to prevent or minimize the potential for user error.

The Eggtimer Quantum users guide says that the battery polarity does not matter. There is no way to hook up the battery backwards and accideentally fire the charges. The hardware prevents that kind of user error.

It also says that when the battery is first connected, the unit always comes on in an unarmed state, meaning that there are 2 solid state switches isolating the firing circuits, both of which would have to fail independently to accidentally fire the charges. The hardware prevents the user error of leaving the switch in the closed position before connecting the battery.

In order to arm it, the unit requires you to connect to the WiFi signal created by the unit, and then open a web interface, type in an arming code and click ARM. I’m not saying it’s impossible to do all that and then do something you are not supposed to do afterward, like hammer in your chute, but it does prevent not understanding you have armed the unit, And it prevents accidentally arming it by jiggling a switch closed, snagging a pull pin on something, or touching 2 wires together.

My understanding (and I’m not sure I completely understand this) is that even after user arms the unit, at least one leg of the firing circuits is not actually armed until certain conditions are met. The altimeter needs to detect the launch, and then it needs to detect the slow-speed condition before apogee before arming that leg. Then the second leg is closed when it is actually time to fire. I don’t know if this is correct, but it sounds like the design prevents the kinds of mistakes that could cause the unit to fire accidentally. For example, if the user were to arm the unit and then hammer in the chutes, would that actually trigger all the conditions needed to close both legs of the circuit and fire the charges? It seems like it protects against that.

Thirsty, I was going to reply and argue the other side - why everything that makes the Quantum more mistake proof is actually it’s Achilles Heel.

I can make the case (but I don’t believe it) for the Quantum- but in doing so, it refutes the case against the WiFi switch, magnetic switches, and Proton.

So I’m going to shut up, rather than parody the decision.
 
If there ends up being a meeting of the minds between the BOD, hardware/software manufacturers and safety/test people, I’d like to be part of it.
 
Well, if the unit is designed not to power up, at all, with reversed polarity, problem solved, right ?

Dave F.

Yes. I know of at least one altimeter that is designed that way..;)

I suggest that any device, capable of firing a pyrotechnic charge, should be designed in such a manner that the unit will not power up, if polarity is reversed.

Dave F.
 
I suggest that any device, capable of firing a pyrotechnic charge, should be designed in such a manner that the unit will not power up, if polarity is reversed.

Dave F.
What about devices that are designed to work regardless of the polarity of the power source connection?

I'm not trying to be a jerk but requirements need to be worded very carefully. I think the intent of what you meant was ....

Any device, connected to an energetic initiator, must not be capable of inadvertent or uncommanded initiation in the event that power is connected incorrectly.
 
Last edited:
I got a PM from a TAP yesterday that said, in part:
“As an RSO I have always been uncomfortable with energized electronics even if they are not “armed”.

I'd just like to point out that nothing in the revised rules will prevent someone from bringing a rocket to the RSO table or transporting a rocket around the launch site with energized electronics. Unless I am mistaken, if a mechanical switch is installed between the electronics and the energetic initiator and that switch is open then the electronics could be powered on and fully comply with the revised rules.
 
I chose to make the announcement in as many places as I could in order to get the word out, but that makes it difficult to participate in all of the discussions that follow. This is what I posted yesterday on the TRA forum, which I would encourage everyone in Tripoli to follow. There we have slightly more freedom to discuss internal business (although that hasn’t been part of this discussion).

This wasn't a sudden decision, even though it might seem so to those affected by it. As I've explained before it included bits and pieces of discussions held online, in person with people, conversations with other board members, several emails back and forth among board members, and finally a motion, discussion, second and vote during the most recent board meeting.

Why not allow a "grace period?" That's simple. Once we (on the board) have agreed that something has the potential to be dangerous, we have a responsibility to do something. Delaying our response to a possibly unsafe condition could be negligent. I think the question asked by the family of an injured person would go like this: "You knew about this and still allowed it to continue?" I don't want to have to answer that question. Yes, it is inconvenient and I am sorry for that. Sometimes safety related things are. I'm old enough to remember people complaining mightily about safety belts.

In answer to the suggestion that we should provide data showing that the electronic devices are unsafe: No, we don't have to prove that a magnetic switch or any other kind of switch is unsafe before prohibiting the way something is used at one of our launches. It's up to the manufacturers to show how they are safe. Now before you go accusing me of saying these devices are unsafe, I'm not. I'm saying that they are being used in ways the board never anticipated when we approved the WiFi switch at LDRS 36. What sold us on the WiFi switch was security, optical isolation, the need to trigger two solid state devices and the fact that every time it powers up it's in the OFF position. We never anticipated that users would begin carrying rockets to the RSO table with the power to the WiFi switch on. We were thinking about the increased safety provided by the WiFi switch while putting the rocket on the rail and then arming it from a safer distance and not up on a ladder. We also never anticipated that other devices, such as the magnetic switch, would be assumed to be equivalent.

But we absolutely know that completely disconnecting the battery from the firing elements is safe and works in all instances, for all devices, without having to create special instructions for each. That's easier for our RSOs and Launch Directors.

Regarding the magnetic switch, I've heard from users who will not use them again and I've heard from people who bought one for every rocket they have. I've heard from Adrian that they come up in the last state they were in and I've heard from a few users that they come up with their outputs on every time power it applied. What is the actual power on status?

Some of you have complained that you've seen rockets fail during recovery and that is where we should place our worry. This isn't an "exclusive or"; we have plenty of worry to go around. Bad recoveries are a problem that need to be addressed, not by simply moving rockets further out, but by increasing the likelihood that a parachute comes out. But this is a case of comparing higher probability and low actual risk of injury against something that is lower probability but higher risk of injury. With proper range management, bad recoveries have an extremely low probability of striking someone, whereas when ejection charges go off or sustainer motors light with multiple people around, the probability of injury is much higher. When that happens in the spectator area or at the RSO table, the chance that there will be more people nearby is much higher. That is what this rule is intended to prevent - unexpected problems near other people. Somebody on TRF poked fun at this, claiming that he wasn't afraid of being struck by a plastic nose cone. I am, and I'm afraid of others being struck, even on small models. But it might not be the nose cone. It could be flash burns, eye damage, or hearing loss.

And finally, if you are seeing or hearing discharges at peoples tables while they are prepping, they are doing something wrong. To blame that on mechanical switches points to either using the wrong switch or using the switch wrong. All charges must be inhibited until at the pad and pointing up in a safe direction.

A friend I have yet to meet suggested today that we need to create some definitions and performance criteria specific to our hobby, against which we can evaluate switches (mechanical and electronic) used for rocketry. If we do that I would probably ask him to serve as chair and I would ask for the manufacturers of switches and avionics (specifically those which control energetics in rockets) to volunteer to serve on the committee under him. This would not be a quick process, but perhaps it would help our members. Other deliverables might be boilerplate wiring suggestions.

He also told me that I needed a new can of worms, having opened up this one. He's probably right.
Thank you for bringing more light to the process, Steve. By giving this explanation, I hope that you've shed more light on the process that was followed. I, for one, appreciate the information. In the future, I'd ask that when that sort of discussion starts on the Tripoli Forums that TRA representatives start spreading the word of the discussion on other venues in an attempt to get those affected involved in the discussion. As soon as I can free up some budget, I plan on renewing my lapsed membership and should start participating there, as well.

Just make sure when you buy your new can of worms, that you don't accidentally buy a can of whoop-ass instead. Some folks might get a touch riled if you have to open that on them. [grin]
 
I'd just like to point out that nothing in the revised rules will prevent someone from bringing a rocket to the RSO table or transporting a rocket around the launch site with energized electronics. Unless I am mistaken, if a mechanical switch is installed between the electronics and the energetic initiator and that switch is open then the electronics could be powered on and fully comply with the revised rules.

That’s true, but I think he wouldn’t be bothered by that. I’m not going to expect that every email written to me include every logical variation of a concept.
 
Thank you for bringing more light to the process, Steve. By giving this explanation, I hope that you've shed more light on the process that was followed. I, for one, appreciate the information. In the future, I'd ask that when that sort of discussion starts on the Tripoli Forums that TRA representatives start spreading the word of the discussion on other venues in an attempt to get those affected involved in the discussion. As soon as I can free up some budget, I plan on renewing my lapsed membership and should start participating there, as well.

Just make sure when you buy your new can of worms, that you don't accidentally buy a can of whoop-ass instead. Some folks might get a touch riled if you have to open that on them. [grin]

A free can of whoop-ass comes with every can of worms, but usually I think I’m the one on the receiving end! [emoji856]
 
I’ll get right to the point.

The problem here is failure to recognize the Abilene Paradox.

It’s not a bunch of stuffy old geezers making up a rule because they fear technology. Stuffy old geezers are awesome. My Tripoli mentor is one ( sorry Gus) my dad is one, even the Eggtimer guy is one. Don’t feel bad Cris, anybody over 25 is old to me.

The TRA BOD is attempting to solve a problem that doesn’t exist by adding an additional failure point. (told 'ya I'd get right to the point)
The BOD is a small group of people. Very nice people, well intentioned people, but a small group. They lack the diversity inherent in a larger group. This is the key to the problem.

The BOD believes adding a mechanical disconnect increases safety, when it is a proven fact that added complexity increases the chance of failure. By their own admission they have no proof of failure. Think about this – Tripoli tests and certifies rocket motors and publishes the results. – What testing have you done regarding the failure of the wifi devices, and where are the published results?

One thing we have proof of – mechanical connections are subject to G-forces and other modes of failure. We already know as a proven fact ballistic recovery has occurred due to a failed mechanical connection or switch.

I am very much aware of the dangerous nature of our high-power rocketry activities and I happily agree with rules that help make things safer. Unfortunately, I believe this mechanical disconnect rule is a step backwards and has the potential to increases chance of failure and accidents.

I am a member – along with my entire family- of both TRA and NAR, and will continue to support both organizations fully. (I may not always agree with everything... but you have my unwavering support)

The only thing this rule will change for me – I will not be flying any wifi enabled rockets at the TRA launches I attend.

I’ll fly my most advanced (wifi enabled) rockets only at NAR launches.

- that's my stance and my belief, at least for now. Being a kid Rocket Scientist (key word "scientist") I am open to any evidence that proves otherwise.

... If you read this far, thanks for giving me my soapbox.
 
The back n forth on this topic is enlightening. Sabrina's analysis hits the mark for me, especially about adding more moving mechanical parts.

Back in post #297, I asked a question about dual-battery setups, where one battery powers the altimeter, and the second battery provides power to the deployment channels in my case for Eggtimer Proton and Quantum devices. In my setup, power to the deployment channels has a mechanical switch in between the battery and the deployment inputs on the devices. Dave was quick to reply that he thinks the setup follows the intent of the rule, despite power being applied to the altimeter's computer.

Steve - is this setup compliant with the new rule? Yes, I agree that it's up to the RSO to make the final call, but I don't want to approach the RSO looking for an argument.
 
The rule requires breaking any source of power to the energetics, not the electronics themselves. It is permissible to physically cut power to the deployment circuit.
 
I’ll get right to the point.

The problem here is failure to recognize the Abilene Paradox.

It’s not a bunch of stuffy old geezers making up a rule because they fear technology. Stuffy old geezers are awesome. My Tripoli mentor is one ( sorry Gus) my dad is one, even the Eggtimer guy is one. Don’t feel bad Cris, anybody over 25 is old to me.

The TRA BOD is attempting to solve a problem that doesn’t exist by adding an additional failure point. (told 'ya I'd get right to the point)
The BOD is a small group of people. Very nice people, well intentioned people, but a small group. They lack the diversity inherent in a larger group. This is the key to the problem.

The BOD believes adding a mechanical disconnect increases safety, when it is a proven fact that added complexity increases the chance of failure. By their own admission they have no proof of failure. Think about this – Tripoli tests and certifies rocket motors and publishes the results. – What testing have you done regarding the failure of the wifi devices, and where are the published results?

One thing we have proof of – mechanical connections are subject to G-forces and other modes of failure. We already know as a proven fact ballistic recovery has occurred due to a failed mechanical connection or switch.

I am very much aware of the dangerous nature of our high-power rocketry activities and I happily agree with rules that help make things safer. Unfortunately, I believe this mechanical disconnect rule is a step backwards and has the potential to increases chance of failure and accidents.

I am a member – along with my entire family- of both TRA and NAR, and will continue to support both organizations fully. (I may not always agree with everything... but you have my unwavering support)

The only thing this rule will change for me – I will not be flying any wifi enabled rockets at the TRA launches I attend.

I’ll fly my most advanced (wifi enabled) rockets only at NAR launches.

- that's my stance and my belief, at least for now. Being a kid Rocket Scientist (key word "scientist") I am open to any evidence that proves otherwise.

... If you read this far, thanks for giving me my soapbox.
Sabrina, I'm going to refer you to Steve's very thoughtful reply to my objection to the process. Evidently, this wasn't made in a vacuum, nor was it small group. From what I've read so far, the BOD thinking is more along the lines of "We can't prove that this is a valid safety issue, but it might be. Enough anecdotal evidence is present to raise concerns. Therefore, better safe than sorry. Place a moratorium on non-mechanical disconnects until we can perform the due diligence."

It's a risk-management decision. Once the spectre of a problem is raised, the BOD has to decide whether or not to act. If they fail to act and an incident occurs, they open up the entire organization to liability problems if the insurance carrier refuses to cover an incident because the failure occurred and BOD did nothing to prevent. If they act and an incident occurs, TRA liability remains covered, as they did something to mitigate negative outcomes.

Now, is it the optimal way of handling the situation? Maybe, but probably not. What is the optimal ruling? That's what the BOD is trying to gain time to figure out.

Sabrina, you're absolutely right that adding complexity tends to reduce reliability. Notice I said "tends" to reduce reliability. It's not always a given. More of a rule of thumb to follow that will get you good results most of the time. I have supported large midrange server farms in my past life. Sometimes you have to add *lots* of complexity in order to increase reliability. So KISS is a good maxim, but it's not a law of nature. It's not a proven fact. Sometimes complex systems require complex safeguards.

Redundancy does a *lot* to handle reliability. I'm not talking about putting two switches on the same altimeter/ejection charge chain, but two recovery chains, both independent of each other. After all, it's required for an L3 cert, why not incorporate in smaller projects where there's room and enough of a mass budget to allow the second recovery chain?

We're also forgetting that a lot of those "coming in ballistic" events occurred not because all mechanical switches are unreliable, but because the switches chosen were not suited for the environment in which they were placed. In other words, it was a design failure. Design it right with the right parts, and you improve reliability. Pick any old part without knowing how it will perform under the stresses you place on it, and you could end up with catastrophe.

From Steve's reply to me, sounds like we'll be getting a certification process. I look forward to seeing the results.
 
Let’s back up and ask a more basic question. In prior posts I’ve been taken to task for not knowing that commercial fireworks regulations require a mechanical switch and of course the same would apply to us. But in another post it was made clear that our hobby is not to be confused with fireworks, and effort is made to make sure the two are not conflated.

When/where/who/how was it decided that our ejection charges should be handled under the same rules as commercial fireworks? The justification for the rule change is based on the commercial fireworks rules, in spite that we aren’t fireworks. Is the only safe option for a 2 gram ejection charge the same rules that are applied to commercial fireworks?


Tony
 
If you scroll up, there are multiple accounts of screw switches failing closed and powering up altimeters at unanticipated times. That’s not the same as setting off a charge - but it’s still a failure, and you are seeing multiple instances of it, specifically for screw switches. (And none for the WiFi solution and few for the magnetic switch. Just estimating relative rates. I understand that disconnecting power is the most absolute safe state. Carrying the battery out to the pad in a pocket is safest. It appears not all mechanical switches are equal.)

And use has to be included in any review. It was ‘unanticipated use’ that sparked this whole discussion.

I don't think they made good screw switches. I make my own. They have two threaded inserts that are connected by a stainless steel thread. One insert if positive and the other is negative. The screw connects the two and makes positive contact by threading into the second insert. If my switch is not closed, it is because a stainless steel screw magically stops conducting electricity or it was nto completely closed by the user.

My switches are essentially the same as Fingertech.
 
OK, for your military guys... what kind of switches do they use to arm air-to-air missiles before takeoff?
 
I don't think they made good screw switches.
FWIW, the screw switch failures I’ve had were with commercially available screw switches from a rocket vendor.

I sense a run on Fingertech switches. :) I looked online for a place to order just the contacts like what is in those and I couldn’t find them. I know several people planning to embed the Fingertech contacts directly into 3D printed sleds...it’d be great to find a supplier of similar contacts.
 
What about devices that are designed to work regardless of the polarity of the power source connection?

I'm not trying to be a jerk but requirements need to be worded very carefully. I think the intent of what you meant was ....

Any device, connected to an energetic initiator, must not be capable of inadvertent or uncommanded initiation in the event that power is connected incorrectly.

What I meant was requiring Manufacturers to design their units so as to be non-functional, if polarity is reversed. In other words it can't be connected incorrectly, since it would not power up, at all !

Dave F.
 
Let’s back up and ask a more basic question. In prior posts I’ve been taken to task for not knowing that commercial fireworks regulations require a mechanical switch and of course the same would apply to us. But in another post it was made clear that our hobby is not to be confused with fireworks, and effort is made to make sure the two are not conflated.

When/where/who/how was it decided that our ejection charges should be handled under the same rules as commercial fireworks? The justification for the rule change is based on the commercial fireworks rules, in spite that we aren’t fireworks. Is the only safe option for a 2 gram ejection charge the same rules that are applied to commercial fireworks?


Tony

I tried to answer this in the other thread you started. I can’t keep up with you. It’s like playing whack-a-mole. [emoji848]

Is model rocketry a subset of fireworks?
https://www.rocketryforum.com/index.php?threads/Is-model-rocketry-a-subset-of-fireworks?.157486/
 
Again, I ask.

What about a rocket using motor ejection for apogee with a wireless altimeter set to activate a cutter to deploy the main?

Inquiring minds ...

NikeMikey
 
Could I use a Eggfinder Switch to activate a server motor with arm attached to a mechanical toggle switch that would power up the other Eggfinder wifi switches I have attached to the flight computers? It lets me preassemble at my table, transport to RSO & then to the launch pad & mounted on the launch rail pointed vertical before I start the arming process?
 
Last edited:
Well, you've answered my question then. There was no ground testing, which would have quickly uncovered this error. Finding out a reverse-polarity mistake at the launch site - I just don't get that type of (non) thinking.

Ground testing in many cases will not test the electronics. In a lot of older simple altimeters like the adept22 do not have a test mode. The only way to get them to fire the charges is to simulate the rocket flight with a vacuum cleaner and reduce the pressure in the AV-bay. This is difficult to do without being right beside the rocket when the charges are fired.

Therefore, I just run a wire out of the static ports and connect it to a test harness I have created with a 9v battery and a push button to fire the ematch. However higher end altimeters and the eggtimer quantum (probably others I haven’t used) have the test mode.

No you are probably saying then how do you know the system is wired right. I test that by putting mini Christmas light bulbs in place of the ematch and then use the vacuum or just sucking on one of the static ports (for small diameter rockets).
 
Status
Not open for further replies.
Back
Top