Redundancy

I have redundant altimeters set up with separate power sources in my bay, but both going through a single switch as a safe/off.
Am I defeating the redundancy by doing this, or once armed at the pad I shouldn’t worry about the one switch failing somehow?

The deployment logic and charges are redundant, but now your switch (and potentially your power source) is single-point failure.

It'll work most of the time. There just may come day when it doesn't (I have several single alt rockets that do well enough)

In opinion the switch is the weakest link in the chain nowadays.

Can I use two switches? Is that still acceptable for a safe/off for an L3 certification flight? This is all practice for that inevitably.

dbpeirce said:

Can I use two switches? Is that still acceptable for a safe/off for an L3 certification flight? This is all practice for that inevitably.

Click to expand...

Absolutely. (NAR used to have you put a switch on the pyro connections themselves)

As it looks like you have some knowledgeable people answering your question, let me interject this:

[Humor on]Great, another redundancy thread.[Humor off]

We now return you to the subject at hand.

KennB said:

As it looks like you have some knowledgeable people answering your question, let me interject this:

[Humor on]Great, another redundancy thread.[Humor off]

We now return you to the subject at hand.

Click to expand...

Good one

dbpeirce said:

I have redundant altimeters set up with separate power sources in my bay, but both going through a single switch as a safe/off.
Am I defeating the redundancy by doing this, or once armed at the pad I shouldn’t worry about the one switch failing somehow?

Click to expand...

If you are doing a redundant setup, duplicate everything so that you have 2 operational systems that are completely independent of each other.

rewilfert said:

If you are doing a redundant setup, duplicate everything so that you have 2 operational systems that are completely independent of each other.

Click to expand...

That’s what I was thinking but I just wasn’t sure if two switches still was ok as a safety for level 3. Sounds like it is so I’m going to figure out how to get another switch on the sled.
Thanks guys.

jderimig said:

In opinion the switch is the weakest link in the chain nowadays.

Click to expand...

+1

Nytrunner said:

NAR used to have you put a switch on the pyro connections themselves)

Click to expand...

I believe the NAR rule STILL requires that, at least as I interpret it...

"2.4 The capability must exist to externally disarm all pyrotechnic devices on-board the rocket.
In this context, ‘disarm’ means the ability to physically break the connection between a
pyrotechnic system and its power source. Simply turning off the device controlling the
pyrotechnic(s) may not be sufficient." --National Association of Rocketry Level 3 High Power Certification Requirements, Nov 2012 [Current as of this post]
If enforced, that rule, to my way of thinking, actually ADDS to the risk of a recovery system fault, calling for double the wiring, switches, soldering, connectors, etc, that might fail, causing an electric match to lose continuity with the altimeters' apogee and/or main outputs. That's why I plan to do my L3 under Tripoli, who have no such double-redundancy requirement. Turning off each altimeter with its own switch is sufficient under the TRA's L3 certification requirements.

At some point, well-intentioned but overly complex safety measures become self-defeating.

The NAR rules no longer require a switch on each pyro circuit...as long as powering off the altimeters is done in such a way to remove power from the whole system. For example my RRC3 and Eggtimer Quark both were switched on and off via one leg of the battery (the RRC3's switch terminal was jumpered ON with a piece of wire), when the screw switches were open there was no path for electricity to go from the batteries through the altimeters to the pyro, hence no need for pyro switches. Both Cris Erving and Jim Amos approved and concurred that the method I used would work as planned with their respective products.

GlueckAuf said:

I believe the NAR rule STILL requires that, at least as I interpret it...

"2.4 The capability must exist to externally disarm all pyrotechnic devices on-board the rocket.
In this context, ‘disarm’ means the ability to physically break the connection between a
pyrotechnic system and its power source. Simply turning off the device controlling the
pyrotechnic(s) may not be sufficient." --National Association of Rocketry Level 3 High Power Certification Requirements, Nov 2012 [Current as of this post]
If enforced, that rule, to my way of thinking, actually ADDS to the risk of a recovery system fault, calling for double the wiring, switches, soldering, connectors, etc, that might fail, causing an electric match to lose continuity with the altimeters' apogee and/or main outputs. That's why I plan to do my L3 under Tripoli, who have no such double-redundancy requirement. Turning off each altimeter with its own switch is sufficient under the TRA's L3 certification requirements.

At some point, well-intentioned but overly complex safety measures become self-defeating.

Click to expand...

GlueckAuf said:

I believe the NAR rule STILL requires that, at least as I interpret it...

"2.4 The capability must exist to externally disarm all pyrotechnic devices on-board the rocket.
In this context, ‘disarm’ means the ability to physically break the connection between a
pyrotechnic system and its power source. Simply turning off the device controlling the
pyrotechnic(s) may not be sufficient." --National Association of Rocketry Level 3 High Power Certification Requirements, Nov 2012 [Current as of this post]
If enforced, that rule, to my way of thinking, actually ADDS to the risk of a recovery system fault, calling for double the wiring, switches, soldering, connectors, etc, that might fail, causing an electric match to lose continuity with the altimeters' apogee and/or main outputs. That's why I plan to do my L3 under Tripoli, who have no such double-redundancy requirement. Turning off each altimeter with its own switch is sufficient under the TRA's L3 certification requirements.

At some point, well-intentioned but overly complex safety measures become self-defeating.

Click to expand...

I am happy to have you do your L3 with Tripoli, but the NAR L3 cert rule doesn’t mean what you think. I participated in the L3CC discussion that led to the wording that concerns you. What it means is that each altimeter must have a physical switch in series between the battery and the electric match. That’s all it means. Additional switches on the output of the altimeter are not required if you have a switch between the battery and the altimeter. Some altimeters like the rrc2 had a set of switch terminals that could be used to completely remove power from the altimeter circuit. That’s also acceptable. The sentence about simply turning off the device being insufficient was intended to limit devices which have a soft power switch that leaves the altimeter in an idle mode while still consuming a small amount of power, much as your television waits for a command from the remote. The concern was that such a device could be accidentally triggered too easily.

GlueckAuf said:

I believe the NAR rule STILL requires that, at least as I interpret it...

"2.4 The capability must exist to externally disarm all pyrotechnic devices on-board the rocket.
In this context, ‘disarm’ means the ability to physically break the connection between a
pyrotechnic system and its power source. Simply turning off the device controlling the
pyrotechnic(s) may not be sufficient." --National Association of Rocketry Level 3 High Power Certification Requirements, Nov 2012 [Current as of this post]
If enforced, that rule, to my way of thinking, actually ADDS to the risk of a recovery system fault, calling for double the wiring, switches, soldering, connectors, etc, that might fail, causing an electric match to lose continuity with the altimeters' apogee and/or main outputs. That's why I plan to do my L3 under Tripoli, who have no such double-redundancy requirement. Turning off each altimeter with its own switch is sufficient under the TRA's L3 certification requirements.

At some point, well-intentioned but overly complex safety measures become self-defeating.

Click to expand...

I think most interpret this to require a switch between the battery and the altimeter, as well as a power switch for the altimeter.

As Paul Harvey often said, now we know "the REST of the story." Thanks for the clarification.

But has there ever been a soft power switch employed on a commercially-available dual deployment altimeter? Would the Featherweight magnetic switch used in tandem with a conventional DD altimeter constitute a soft power switch? It draws a small bit of current at all times, whether switched on or off, to sense the magnet that opens and closes it. And the switching it does is apparently a fully electronic function, not a physical one like those employing a lever, disc, or rod that opens or closes two physical electrical contacts.

GlueckAuf said:

As Paul Harvey often said, now we know "the REST of the story." Thanks for the clarification.

But has there ever been a soft power switch employed on a commercially-available dual deployment altimeter? Would the Featherweight magnetic switch used in tandem with a conventional DD altimeter constitute a soft power switch? It draws a small bit of current at all times, whether switched on or off, to sense the magnet that opens and closes it. And the switching it does is apparently a fully electronic function, not a physical one like those employing a lever, disc, or rod that opens or closes two physical electrical contacts.

Click to expand...

I don’t know of others, but G-Wiz had an altimeter that had a pull to arm pin integrated into the altimeter circuit somehow. It would have required an additional switch.

Thanks Steve. Can you advise me on TRA's position on the Featherweight magnetic switch's appropriateness for an L3 attempt? I plan to use two of them in my L3 rocket's avionics bay to provide the required redundancy, mounted on opposite corners as shown so activating one doesn't trip the other.

GlueckAuf said:

Thanks Steve. Can you advise me on TRA's position on the Featherweight magnetic switch's appropriateness for an L3 attempt? I plan to use two of them in my L3 rocket's avionics bay to provide the required redundancy, mounted on opposite corners as shown so activating one doesn't trip the other.
View attachment 390390

Click to expand...

I’ll indirectly answer. At LDRS 36 the board voted to allow the Eggfinder WiFi switch without an external power switch in L3 certification flights because it was requested and because of two important characteristics:
1. The default mode of the WiFi switch is power off. That makes it more difficult for a person to accidentally power up their electronics while preparing their rocket.
2. Cris Erving had explained to me how his circuit used two solid state switches which must both be switched in order for the output to be on.
Nobody requested an approval of the magnetic switch, but my understanding is that its default state is power on. That’s better for recovery perhaps but could lead to accidents in the preparation area or at the pad. I honestly don’t know much more about the magnetic switch but without Adrian specifically requesting it to be approved and providing supporting data like Cris did the board has not approved it.

There is one scenario where you need an additional switch between the altimeter and the e-match: If the altimeter has a capacitor which can fire the e-match even if the battery is disconnected.

I had mag-switches in my L3, TRA, they are much saver than mechanical switches in my opinion.

Nytrunner said:

Absolutely. (NAR used to have you put a switch on the pyro connections themselves)

Click to expand...

Oh cripes. I remember those days and recommended if anyone wanted to L3, do it with Tripoli and NAR was simply stupidhead about switches on every ematch.
That was simply idiotic and I’m glad they eventually saw the error in their ways/thinking. Kurt

thomas said:

There is one scenario where you need an additional switch between the altimeter and the e-match: If the altimeter has a capacitor which can fire the e-match even if the battery is disconnected.

I had mag-switches in my L3, TRA, they are much saver than mechanical switches in my opinion.

Click to expand...

Nope,

Except if you are using a low current, augmented ematch based igniter for a second stage motor. In that case, I’d ask around with folks who do staging for best practices as I don’t have an answer that satisfies me. I like the remote activation that Egg Timer products have. For ejection charges, don’t bother. If you have a problem with a live rocket, turn off the altimeter and wait several minutes and any capacitor will self discharge in a bit of time.

The only thing one had to handle like a “bomb” was the old Galejs MAD (Magnetic Anomaly Detection) unit that used the earths magnetic field to determine the rocket attitude to blow an ematch. I had several igniter failures and I went to the pad with a full face shield, turned off the unit, gingerly lifted up the nosecone and disconnected one leg of the ematch from the unit. Put in the new igniter, reattached the ematch (apogee only rocket) put the nosecone back in, all the while, while keeping it upright and go back to launching. Or course, I turned it back on! The Zeptomag MAG unit had a G switch so once activated, it doesn’t arm until a certain number of G’s were placed on the unit. Best darned/safe MAD unit out there. I just checked, it’s still available at: https://www.tindie.com/products/ZeptoBit/zeptomag/

Oh, I want to add with a modestly sized rocket like the ASP 38mm motored WAC Corporal. One can put a MAD unit in the nosecone coupler (secure it with some screws) and use a Jolly Logic chute release to have a low velocity apogee ejection and then do the main unfurling with the Jolly Logic device. Don’t have to worry about the ejection/smoke delay timing with a MAD unit. You just have to try to achieve a close to straight up launch. Tip here is at a large venue with a lower powered motor, point the rocket a couple of degrees downwind and it will weathercock to a lower velocity apogee deployment. Stick your rocket on a simulator and play with it. A few degrees downwind will lead to a curving up side of a flight to a near low velocity apogee deployment. I avoid pointing any rocket into the wind except a modroc
Kurt

Steve Shannon said:

I’ll indirectly answer. At LDRS 36 the board voted to allow the Eggfinder WiFi switch without an external power switch in L3 certification flights because it was requested and because of two important characteristics:
1. The default mode of the WiFi switch is power off. That makes it more difficult for a person to accidentally power up their electronics while preparing their rocket.
2. CTI’s Erving had explained to me how his circuit used two solid state switches which must both be switched in order for the output to be on.
Nobody requested an approval of the magnetic switch, but my understanding is that its default state is power on. That’s better for recovery perhaps but could lead to accidents in the preparation area or at the pad. I honestly don’t know much more about the magnetic switch but without Adrian specifically requesting it to be approved and providing supporting data like Cris did the board has not approved it.

Click to expand...

Although the risk is low in my opinion that is a bit of a climb-down in safety. All the global certification bodies, UL, TUV, etc require the capability of electrical dead disconnection of any device that can injure you. Good practice would be to have a mechanical switch for deading the system during transport and prep at least.

John,
I think the engineering paradigm for the EggTimer wifi switch and or altimeter is sufficient. In fact, I suspect (and welcome comments) that if one has an EggTimer WiFi device on the firing circuit of a low current igniter of an upper stage, it would be ideally safe to have a good quality mechanical switch for safety’s sake on the battery to that device. In that way, the prep could go on with absolute safety with no power going to the device or switch period. Even though the WiFi switch is adequate enough, a firing circuit precludes an extra layer of safety of a good mechanical switch on the battery to said device.

At the risk of starting a firestorm, I don’t like unproven shunts. If one demonstrates the shunt can divert the extra current from the igniter and it functions as a fail safe modality in their installation, I’m ok with it. There are some demonstrations of parallel shunted ematches popping with the current level generated by a modest device. If one just plugs in a parallel wire/resistor and says it’s good without testing the failure mode, that’s B.S.

Get the rocket on the pad, Fire up the dedicated flight electronics (the ones controlling deployment only if used),
Close the switch power switch to the WiFi device controlling the upper stage low current igniter, step away and wirelessly arm the device. If the software on the phone/tablet gives the indication to ones satisfaction they’re good to go, fine. If one wants to run up and listen for the proper beep pattern they safely could if not satisfied with their display on their phone or tablet.

Now again for safety’s sake, if I was using an installation such as that, I’d wire up contained ematches on the ignition circuit and dry run it a few days before to make sure the hardware performs as expected. In that way more assurance is had that the installation is reliable.

Incidentally, are there any modern deployment electronics that fire ematches if the battery polarity is connected in reverse by accident? I was told in the past there were several units that would do that. In fact there are stories of people turning on correctly wired systems and charges blow due to an internal failure of sorts. These were rockets without Rf trackers too. I had a P6K altimeter that blew ematches even with a low powered Rf Beeline RDF tracker.

I zippered one rocket on ascent and yes I had the Mach delay on but it was a 38mm motored 4 inch diameter rocket that wasn’t going Mach. Rebuilt the rocket, had it up on the pad again ready to launch and the beeping stopped. Oh s#it! You got it, the apogee charge blew on the pad and the upper bay ended up on the ground. I didn’t get the key in fast enough to shut it down and the main charge blew thereafter. I built two P6K’s and never flew them again. Never had a nominal flight with one.

I consider it a good practice if one hasn’t flown a DD installation on a given rocket for a long time, it’s a good idea to power up the system with contained ematches (ematches in empty micro-centrifuge containers with no powder) and make sure their device arms properly before taking it out in the next few days to fly it. That will avoid the rare, random instance of a deployment device working on the last flight and then blowing the charges in your face on the next flight when you turn on the switch. Don’t laugh, I’ve seen guys report that happening here on TRF.
It’s rare but happens. A dry test I outline above will avoid that. Pop some contained ematches on the bench is no big deal. Blow ‘em off in your face at a launch is not recommended.

So I’ve been bit by Rf with poor tracker installations and by Rf interference in an old dated electronics device.
Be careful. I’m glad to report that the newer deployment devices made are much more resistant to Rf interference than the older ones. Something about “opto-isolation”. Make sure one reads the manual.
The one for my old AIM2 deployment altimeter recommends against using an Rf tracker with it. I use that for low flying rockets with visual recovery.

Kurt Savegnago

ksaves2 said:

John,
I think the engineering paradigm for the EggTimer wifi switch and or altimeter is sufficient. In fact, I suspect (and welcome comments) that if one has an EggTimer WiFi device on the firing circuit of a low current igniter of an upper stage,

Click to expand...

v

I am not arguing whether it is good enough or not. I am just saying that in industry it is verbotten not to be able to physically disconnect the source of energy that can activate a function that can injure somebody.

jderimig said:

Although the risk is low in my opinion that is a bit of a climb-down in safety. All the global certification bodies, UL, TUV, etc require the capability of electrical dead disconnection of any device that can injure you. Good practice would be to have a mechanical switch for deading the system during transport and prep at least.

Click to expand...

The Eggtimer Quantum and Proton both will allow you to add a mechanical switch between the deployment power and the battery if it's desired. Some TAP's require it, some do not. When I did my L3 with two Quantums, one of my two TAP's wanted a mechanical disconnect... I happily obliged him.

Steve Shannon said:

I’ll indirectly answer. At LDRS 36 the board voted to allow the Eggfinder WiFi switch without an external power switch in L3 certification flights because it was requested and because of two important characteristics:
1. The default mode of the WiFi switch is power off. That makes it more difficult for a person to accidentally power up their electronics while preparing their rocket.
2. Cris Erving had explained to me how his circuit used two solid state switches which must both be switched in order for the output to be on.
Nobody requested an approval of the magnetic switch, but my understanding is that its default state is power on. That’s better for recovery perhaps but could lead to accidents in the preparation area or at the pad. I honestly don’t know much more about the magnetic switch but without Adrian specifically requesting it to be approved and providing supporting data like Cris did the board has not approved it.

Click to expand...

I'm coming into this late, but I would like to request that the Featherweight magnetic switch be allowed for arming an altimeter's deployments for a level-3 cert flight or other flights.

I support the position that a well-designed system should prevent a deployment charge from firing prematurely until the rocket is vertical and armed at the pad, even if the altimeter has any hardware or software malfunction. This is normally done with a switch in series between the power source and the altimeter, which is open during prep and closed at the pad to arm the system. In the case of a magnetic switch, the following order of operations will guarantee the system is fault-tolerant throughout that process:

1. With no charges connected, connect the magnetic switch to the battery. This can be done days or weeks before launch. If the switch is on, then turn it off. The magnetic switch has an LED which shows when it is on, even if there is no altimeter connected to its output.
1b (optional step) Use the switch to turn on the altimeter to make sure it's ready to fly, and then power it off.
2. Connect the charges.
3. Go to the pad, and once the rocket is vertical, turn on the magnetic switch to arm the altimeter.

In answer to Steve's question, the Featherweight magnetic switch does not default to the on state. If power is disconnected and then re-connected, it will stay in the last commanded state for as long as it can "remember" what that state was. Although there isn't a fixed or guaranteed time that it will hold its state after power is removed, it's more than a few seconds, and usually it's weeks or even longer.

On a related topic, a high powered airstart is a significantly greater safety hazard than deployment charges. For high powered airstarts, I recommend requiring three series inhibits for two-fault tolerance, consistent with NASA safety requirements for catastrophic (i.e. life threatening) hazards, rather than 2 inhibits for single-fault tolerance for deployment charges. In other words, 2 independent failures can happen and the system will still be safe because the 3rd inhibit is intact. For my rockets, I add a separate mechanical switch in series with any of my airstart motor igniters, in addition to a magnetic switch and the altimeter itself. This way the rocket is safe in the prep area if up to 2 out of the 3 inhibits fail. Then when the rocket is vertical at the pad I can verify that the altimeter is working and the deployment charges are armed before arming the airstart. In my rockets I would not use a magnetic switch for more than one of the inhibits for an airstart, because an accidental exposure to a magnet (next to a pocket, for example) could turn on more than one magnetic switch at a time.

Adrian A said:

I'm coming into this late, but I would like to request that the Featherweight magnetic switch be allowed for arming an altimeter's deployments for a level-3 cert flight or other flights.

I support the position that a well-designed system should prevent a deployment charge from firing prematurely until the rocket is vertical and armed at the pad, even if the altimeter has any hardware or software malfunction. This is normally done with a switch in series between the power source and the altimeter, which is open during prep and closed at the pad to arm the system. In the case of a magnetic switch, the following order of operations will guarantee the system is fault-tolerant throughout that process:

1. With no charges connected, connect the magnetic switch to the battery. This can be done days or weeks before launch. If the switch is on, then turn it off. The magnetic switch has an LED which shows when it is on, even if there is no altimeter connected to its output.
1b (optional step) Use the switch to turn on the altimeter to make sure it's ready to fly, and then power it off.
2. Connect the charges.
3. Go to the pad, and once the rocket is vertical, turn on the magnetic switch to arm the altimeter.

In answer to Steve's question, the Featherweight magnetic switch does not default to the on state. If power is disconnected and then re-connected, it will stay in the last commanded state for as long as it can "remember" what that state was. Although there isn't a fixed or guaranteed time that it will hold its state after power is removed, it's more than a few seconds, and usually it's weeks or even longer.

On a related topic, a high powered airstart is a significantly greater safety hazard than deployment charges. For high powered airstarts, I recommend requiring three series inhibits for two-fault tolerance, consistent with NASA safety requirements for catastrophic (i.e. life threatening) hazards, rather than 2 inhibits for single-fault tolerance for deployment charges. In other words, 2 independent failures can happen and the system will still be safe because the 3rd inhibit is intact. For my rockets, I add a separate mechanical switch in series with any of my airstart motor igniters, in addition to a magnetic switch and the altimeter itself. This way the rocket is safe in the prep area if up to 2 out of the 3 inhibits fail. Then when the rocket is vertical at the pad I can verify that the altimeter is working and the deployment charges are armed before arming the airstart. In my rockets I would not use a magnetic switch for more than one of the inhibits for an airstart, because an accidental exposure to a magnet (next to a pocket, for example) could turn on more than one magnetic switch at a time.

Click to expand...

Adrian,
We’ll be happy to add it to the agenda if you submit your request to the board by using one of the contact links on the Tripoli website (https://www.tripoli.org/Leadership) or in person at the annual meeting at LDRS. Please include diagrams showing your recommendations for wiring.
I try to monitor TRF as time allows, but mostly for my own enjoyment. Sometimes I explain things here, like I did above.
Please forgive me, but I want to avoid creating an expectation that it’s an official channel for Tripoli. This will be my last term as president and I don’t want to leave a mess for the next one.
Steve

Steve Shannon said:

Adrian,
We’ll be happy to add it to the agenda if you submit your request to the board by using one of the contact links on the Tripoli website (https://www.tripoli.org/Leadership) or in person at the annual meeting at LDRS. Please include diagrams showing your recommendations for wiring.
I try to monitor TRF as time allows, but mostly for my own enjoyment. Sometimes I explain things here, like I did above.
Please forgive me, but I want to avoid creating an expectation that it’s an official channel for Tripoli. This will be my last term as president and I don’t want to leave a mess for the next one.
Steve

Click to expand...

I understand about following the process. Sorry to hear this is your last term as President. You have been a good one.

-Adrian

Adrian A said:

I understand about following the process. Sorry to hear this is your last term as President. You have been a good one.

-Adrian

Click to expand...

Thank you, Adrian. I just want to end on hopefully a high note (before I’m universally reviled!) [emoji851]
I have a fantastic Vice President and I believe he’ll be a great President.