Speaknoevil
Well-Known Member
- Joined
- Mar 18, 2018
- Messages
- 1,144
- Reaction score
- 551
Revision to Tripoli Rule Regarding Wireless Remote Switches
- Thread starter Steve Shannon
- Start date
Help Support The Rocketry Forum:
- Status
Happy Flying
Speaknoevil
Well-Known Member
- Joined
- Mar 18, 2018
- Messages
- 1,144
- Reaction score
- 551
OK, moving on...
Achieving compliance! I am (at least was) showing up at 0-9-hundred hours tomorrow with a high quality jumper-to-header solution to extend my Altimax magnetic switch battery feed break point to an accessible location in the airframe (Amazon Prime is sometimes your friend). See, I may not agree, but I appreciate Tripoli and jump through hoops to comply. With the launch being rescheduled, now I have more time to test/verify.
Achieving compliance! I am (at least was) showing up at 0-9-hundred hours tomorrow with a high quality jumper-to-header solution to extend my Altimax magnetic switch battery feed break point to an accessible location in the airframe (Amazon Prime is sometimes your friend). See, I may not agree, but I appreciate Tripoli and jump through hoops to comply. With the launch being rescheduled, now I have more time to test/verify.
Tim, have a link? What’s that gonna do?
Speaknoevil
Well-Known Member
- Joined
- Mar 18, 2018
- Messages
- 1,144
- Reaction score
- 551
Yeah, I previously posted in this thread the magnetic switch I adopted years ago; frankly, just because of the risk of this very "touchy" issue raising it's ugly head. It is an Altimax magnetic switch sourced from Rocketronics in Germany. They have a header on their PCB that is normally jumpered, but is present for the sole purpose of disconnecting the battery. I have had good success with this vendor, but not sure of their stocking levels and if they may get overwhelmed with orders. It may be a bit higher to ship to the U.S., but I purchased half a dozen, so overhead was pretty minimal (at least 6 or 7 years ago when I bought). Here is the link: https://www.rocketronics.de/shop/en/altimax-magswitch.html.
NOTE: This magnetic switch works differently from the Featherweight design, and in my mind, is much more straightforward in its implementation and connection requirements; but it will take some adjustment to those familiar with the Featherweight product (i.e., read the instructions). Personally, I also like that there is a timing delay in turn on and turn off and it doesn't require a 3-dimensional passing of the magnet to activate/deactivate the switch; I have much more confidence in operating it consistently.
Last edited:
Cris, if you do get to the point of doing this, I have experience in DFMEA efforts and would be willing to help any way I can.
- Joined
- Jan 19, 2009
- Messages
- 3,442
- Reaction score
- 1,322
I would say the difference between a ground based pyrotechnic switch from one that flies, is the requirement for the flying switch to handle shock and vibration. There have been many posts in threads about failures with the Shruter rotary switches. Those switches are NOT meant to be constantly switched. They are meant to select a voltage level for a device and basically never changed. And with most (not all) people buying the cheapest switches they can get and not verifying specifications on shock and vibration ratings, I'm sure many other mechanical switches can and have failed. In fact, within this thread there are many references to such failures. Some may note that they have never had a failure, but many others have. And as others have noted and experienced, a failed mechanical switch can lead to a ballistic return. Perhaps there should be a listing of acceptable mechanical switches as well?
I also agree with the various comments as to what failures have occurred that have been related to electronic switches, such as the featherweight power perch. Data should be the driving force.
Finally, there should also have been a grace period to give people a chance to upgrade their equipment rather then the "effective immediately". I loved the power perch and will now have to rebuild both my av-bays and rework the airframes to provide access to the new mechanical switches. I know various people have discussed twist and tape, but unless you leave the wires outside, there then becomes no way to disarm the rocket if you run into an issue and need to pull the rocket off the pad.
- Joined
- Feb 3, 2012
- Messages
- 6,346
- Reaction score
- 5,558
Negative. They have performed as expected / intended.
- Joined
- Jun 16, 2011
- Messages
- 6,402
- Reaction score
- 2,693
Not here. I have two of them in my L3 rocket and they have worked flawlessly with M motors. They are controlling an Adept22 and a Stratologger CF.
I also have a quantum which has only had one flight but it works fine without any inadvertent issues.
- Joined
- Apr 4, 2015
- Messages
- 239
- Reaction score
- 163
Could I see these? It would be helpful.
Speaknoevil
Well-Known Member
- Joined
- Mar 18, 2018
- Messages
- 1,144
- Reaction score
- 551
Sure. Let me find the links.
- Joined
- Jan 3, 2011
- Messages
- 366
- Reaction score
- 50
Transporting rockets is done with battery’s disconnected. At assembly table just before launch the avbay is connected to battery’s. Wifi switch keeps power DEAD to Marsa. TRS syncs to satellites and ground unit and self verifies assembly (matches and batteries) are as intended. RSO HAPPENS AT ASSEMBLY TABLE. Out to pads, Arm, igniter. I trust these silicone switches 100%. I have NEVER had an issue. I have NEVER heard of an issue. I feel much SAFER not standing next to my rockets and arming from distance.
DAllen
Well-Known Member
Here's a way to do it without taping on the side that still allows easy disarming: Drill 2 holes for the twist wire. Put the wire out of one hole and twist together when ready to fly. Take the twisted pair and shove it into the other hole. Be careful when arranging the holes on the build so that the twisted pair does not poke anything on the inside. Now all you have a tiny hump of wire that can easily be pulled out and untwisted.
- Joined
- Aug 25, 2019
- Messages
- 6,154
- Reaction score
- 4,343
So, this is a reaction to a nonevent that, while it *may* happen, has *not* happened and it was implemented hastily with no apparent regard to the situation it puts members into.
I am not arguing for or against the rule being the right thing to do. I haven't flown in quite some time, so don't have the experience to weigh in on the safety issues involved. Instead, like many, many others who have posted on here, I am arguing against the process by which this rule was promulgated. TRA Board had a discussion that appears to have been, if not behind closed doors, not well-publicized. A decision was made that would affect many members. This is done instead of coming out and stating, "We're concerned about this issue, we'd like input/feedback on how to mitigate the potential problems." TRA Board issues a fiat declaring a change in rules that takes effect immediately rather than giving members a grace period to bring their vehicles into compliance.
Now, how I would propose TRA Board handle this:
1) Give all members a 90-day grace period to bring vehicles into compliance.
2) Publicly create a group to research the perceived safety issue and charged with coming up with a solution that both provides enhanced safety and causes the least burden necessary to members in order for them to come into compliance.
Members of the safety research group should be picked from both vendors/manufacturers (more than one vendor needs to be represented), and experienced fliers. After the solution is published, the group stays on as a permanent Electronics Safety Committee to continually evaluate new tech and provide recommendations. I am *not* advocating that the E.S.C. set forth any rules outlawing non-certified electronics. They are to simply evaluate whether a submitted piece of electronics, when used per instructions, meets minimum safety standards without further additions to the design.
Steve, you're in a position I do not envy. I understand the pressure you and the rest of the TRA board are under. However, this decision and its handling are in the style of a "OMG! We have to do something now before it all blows up in our face!" situation. You've not said anything that would indicate that was the case. When asked if there were reported incidents, you have consistently admitted there were none. While I've *tried* to read through all 12 pages of this thread, it's a daunting task and I may have missed something, but I don't recall seeing where you've indicated that it's that urgent for any other reasons, either. If I'm wrong, please correct me. Won't be the first time, certainly won't be the last.
In the end, Tripoli is a member organization. It exists solely and at the pleasure of its members. They can, if they choose, vote with their feet and go elsewhere (NAR). If enough do so because the board appears to be making decisions without regard to the members, then Tripoli ceases to exist. One event like this won't kill Tripoli, but its effects are cumulative.
And, no, do not nominate me for the committee. [grin]
What about a rocket using motor ejection for apogee with a wireless altimeter set to activate a cutter to deploy the main?
Inquiring minds ...
NikeMikey
Inquiring minds ...
NikeMikey
sl98
Well-Known Member
- Joined
- Dec 27, 2012
- Messages
- 575
- Reaction score
- 117
I have 2 WiFi switches. One powers up a TRS and the other powers up a Quark. Never had an issue with unintentional ground activation or inflight failure.
I also have 10 Quantums with a total of 62 flights. Most used has 18 flights. No unintentional ground activation or inflight failure.
I chose to make the announcement in as many places as I could in order to get the word out, but that makes it difficult to participate in all of the discussions that follow. This is what I posted yesterday on the TRA forum, which I would encourage everyone in Tripoli to follow. There we have slightly more freedom to discuss internal business (although that hasn’t been part of this discussion).
This wasn't a sudden decision, even though it might seem so to those affected by it. As I've explained before it included bits and pieces of discussions held online, in person with people, conversations with other board members, several emails back and forth among board members, and finally a motion, discussion, second and vote during the most recent board meeting.
Why not allow a "grace period?" That's simple. Once we (on the board) have agreed that something has the potential to be dangerous, we have a responsibility to do something. Delaying our response to a possibly unsafe condition could be negligent. I think the question asked by the family of an injured person would go like this: "You knew about this and still allowed it to continue?" I don't want to have to answer that question. Yes, it is inconvenient and I am sorry for that. Sometimes safety related things are. I'm old enough to remember people complaining mightily about safety belts.
In answer to the suggestion that we should provide data showing that the electronic devices are unsafe: No, we don't have to prove that a magnetic switch or any other kind of switch is unsafe before prohibiting the way something is used at one of our launches. It's up to the manufacturers to show how they are safe. Now before you go accusing me of saying these devices are unsafe, I'm not. I'm saying that they are being used in ways the board never anticipated when we approved the WiFi switch at LDRS 36. What sold us on the WiFi switch was security, optical isolation, the need to trigger two solid state devices and the fact that every time it powers up it's in the OFF position. We never anticipated that users would begin carrying rockets to the RSO table with the power to the WiFi switch on. We were thinking about the increased safety provided by the WiFi switch while putting the rocket on the rail and then arming it from a safer distance and not up on a ladder. We also never anticipated that other devices, such as the magnetic switch, would be assumed to be equivalent.
But we absolutely know that completely disconnecting the battery from the firing elements is safe and works in all instances, for all devices, without having to create special instructions for each. That's easier for our RSOs and Launch Directors.
Regarding the magnetic switch, I've heard from users who will not use them again and I've heard from people who bought one for every rocket they have. I've heard from Adrian that they come up in the last state they were in and I've heard from a few users that they come up with their outputs on every time power it applied. What is the actual power on status?
Some of you have complained that you've seen rockets fail during recovery and that is where we should place our worry. This isn't an "exclusive or"; we have plenty of worry to go around. Bad recoveries are a problem that need to be addressed, not by simply moving rockets further out, but by increasing the likelihood that a parachute comes out. But this is a case of comparing higher probability and low actual risk of injury against something that is lower probability but higher risk of injury. With proper range management, bad recoveries have an extremely low probability of striking someone, whereas when ejection charges go off or sustainer motors light with multiple people around, the probability of injury is much higher. When that happens in the spectator area or at the RSO table, the chance that there will be more people nearby is much higher. That is what this rule is intended to prevent - unexpected problems near other people. Somebody on TRF poked fun at this, claiming that he wasn't afraid of being struck by a plastic nose cone. I am, and I'm afraid of others being struck, even on small models. But it might not be the nose cone. It could be flash burns, eye damage, or hearing loss.
And finally, if you are seeing or hearing discharges at peoples tables while they are prepping, they are doing something wrong. To blame that on mechanical switches points to either using the wrong switch or using the switch wrong. All charges must be inhibited until at the pad and pointing up in a safe direction.
A friend I have yet to meet suggested today that we need to create some definitions and performance criteria specific to our hobby, against which we can evaluate switches (mechanical and electronic) used for rocketry. If we do that I would probably ask him to serve as chair and I would ask for the manufacturers of switches and avionics (specifically those which control energetics in rockets) to volunteer to serve on the committee under him. This would not be a quick process, but perhaps it would help our members. Other deliverables might be boilerplate wiring suggestions.
He also told me that I needed a new can of worms, having opened up this one. He's probably right.
Comparing safety practices to prevent unintended firing of energetics that are designed to be fired on the ground, while very simar, may not directly or entirely apply (or even be sufficient) to the safety practices needed to prevent unintended firing of energetics that are designed to be fired in flight. Our goal should be a design that sufficiently protects against unintended firing on the ground but also has a high reliability of firing when commanded in flight. I do think it's very useful to look at similarities with other hobbies/industries and determine if those practices should apply in amateur rocketry. But we need to be aware that a change to the system design to prevent unintended firing could lessen the probability of successful firing in flight.
Still confused... so are magnetic switches allowed or not?
- Joined
- Jan 23, 2009
- Messages
- 5,989
- Reaction score
- 4,097
Benchmarking is a very good idea. But I propose the benchmark should be other devices in industry that are intended to ignite explosive and energetic materials and emulate their safety standards.
And the benchmark is just not the switch, nor just the firing circuit but the end to end system.
According to everything I have read magnetic switches are not banned but they also do not meet the standard set forth by TRA for isolation of power from energetics. So if you have a design with battery -> magnetic switch -> altimeter -> charge OR battery -> altimeter -> magnetic switch -> charge then your rocket will not pass inspection at the RSO table. You would have to add a mechanical switch in series with your magnetic switch in the above two scenarios.
I don’t know your background, but less than two years ago I witnessed two different incidents involving rockets and ground preparations while batteries were connected. One resulted in a ride via helicopter to a burn center in California. It turned out to “only 2nd degree burns”, but I would prefer never to have to say “only 2nd degree burns” as though that’s acceptable. The other involved a Q motor in a sustainer that ignited, skidded horizontally a hundred feet and then catoed. When it ignited there were eight college students working on or near the rocket. Had the motor catoed immediately instead of skipping across the play I have no doubt we would have been dealing with fatalities.
I’m a firm believer in remote activation but I’m also a firm believer in completely de-energizing the circuit until the last possible moment. When I do staging I will be using pull pin switches using Omron or Honeywell micro switches which completely kill power to Eggtimer WiFi switches. I’ll keep the pull pins taped into the side of the rocket until I’m ready to pull them and then I’ll back up and arm the electronics using the WiFi switches. I believe that design satisfies the standards for two independent inhibits for each system that can cause injuries. If I were doing a large enough motor that could cause a fatal injury I would use three inhibits and in either case at least one of them would completely de-energize the power. A physical interruption of power is my understanding of the requirement and what I’ve found in other rocketry related range safety documents reinforces that. In no way do I believe my approach will reduce the reliability of my rocket.
I recognize that you are the messenger, and this is a tough message. Most of us have been in a similar position, perhaps not of this magnitude, so we can empathize with the position you're in.
Many of us want - and expect - decisions such as this one to be data-driven. This decision does not appear to have been made by a data-driven process unless I've missed something. When the TRA Board says that "Once we (on the board) have agreed that something has the potential to be dangerous, we have a responsibility to do something". How was that "danger" quantified? With all due respect to the TRA Board, I do not believe that it was. If there were incidents that could be pointed to that demonstrated a real problem in search of a solution, the reaction from most would be one of acceptance. This, unfortunately, appears to be a decision in search of a problem that, as best I can tell, does not exist. The question that I would ask of the TRA Board is to answer the question "What observed problem is being solved by this solution?" When that question can be answered with data to support it, the response from the community here will likely be a different one than the community is currently providing to the TRA Board.
<edit> Our messages crossed one another in the ether, and I see the examples you've provided. I trust that each of the examples you've provided were root-caused. What were those root-causes of the incidents? Were they related to a failure of the electronics, or by one or more bad decisions by the person involved? An aircraft rarely crashes because of a single catastrophic event. It happens due to a cascading series of events. So I get that deenergizing the rocket will serve as one way to break the cascading series of events, but there are no doubt others as well. </edit>
Last edited:
Not as a substitute for a physical switch.
- Joined
- Jan 23, 2009
- Messages
- 5,989
- Reaction score
- 4,097
Of course safety procedures should be revised as a response to an action. But if your safety policy is mostly reactive then your safety process is a failure. Case in point in the 737-MAX saga. And as I recall there was no incidents with pull-pin igniton until the incident at LDRS which disfigured a girl and had the potential to end the viability of TRA.
Safety implementation is an analysis process where each possible failure mode is identified and an appropriate preventative AND fault detection action is applied against each one.
That’s correct but you might be missing the point. Don’t even bring a system like that to the RSO table if it’s powered up.
I got a PM from a TAP yesterday that said, in part:
“As an RSO I have always been uncomfortable with energized electronics even if they are not “armed”.
I know this isn’t the same thing… however as an analogy nobody would want a loaded gun set down pointed at them even if the safety was on and there wasn’t a finger on the trigger.”
I'm certain that your experience in rocketry far outweighs mine. I've been flying LPR for several years on my own and am now just getting into club flying so I can get my HPR certification(s). That said, I have several decades of experience with design of equipment and complex systems, mostly automotive and aerospace. I have an extensive background in reliability and for about the last five years one of my responsibilities was airworthiness certification of various types of inhabited and unmanned aircraft. I actually feel silly putting all this out there because what I do or have done doesn't make me smart or wise but you asked so ....
I can tell you with 100% certainty that adding components to the design will have some affect on the reliability. More hardware == more failures, that is a fact. Now more hardware doesn't necessarily mean more loss of functionality depending on the system architecture. The architecture you described is basically identical to what I am now planning for my first AV bay. When I began researching AV bay construction I concluded that two things were important to me, remote arming and high reliability of ejection (dual altimeters). In my mind, remote arming is what will ensure that my charges won't go off on the ground when a potential safety hazard is present. So my primary deployment circuit would be: battery -> wifi switch -> altimeter -> charges. Now TRA is saying I need a mechanical switch in the power until my rocket is on the pad, that's fine and I understand that and I have no intention of not following the rules. But anyone who thinks that adding this additional switch into the circuit does not lessen the deployment reliability of the system is just incorrect. The reduction may be small (and possibly outweighed by an increase in safety on the ground) but there is a reduction in the deployment reliability. I could certainly replace the wifi switch with a mechanical switch and not increase the component count (there still would be a possible reliability impact, positive or negative, unless the two parts have identical reliability) but then I lose remote arming which is something I believe adds to the ground safety of my rocket.
- Status
