Revision to Tripoli Rule Regarding Wireless Remote Switches

jbr said:

I posted the pdf, I can lead you to specs, I can't guarantee that you read them

no load means no load LOL, if you test the switch several times you have decreased the life of it

Click to expand...

Yes, I read the specs, as I said, I linked the same data sheet nearly a hundred posts back in this thread. In fact, I was a reliability engineer for years early in my career testing none other than electrical switches for AT&T Bell Labs so specs and MTBF data from the DoD matter to me. Of course, as with anything, you need to decide if you will operate within the parameters of the spec. If you are one that is constantly flipping (rotating in this case) the switch back and forth, then that switch is not for you. Me personally, I test everything on the bench and only hook up the switch as I'm buttoning up the av-bay and am off to the RSO table and pad. I build many high power designs and only fly any one rocket 5 to 10 times top in its lifetime. As I said in post #524, I would never hit 300 cycles in the next 3 decades with any one rocket, heck, the way I like to build, it may be 3 of my lifetimes.

Let’s see… my batteries are hooked up and I have completed all my continuity checks using the WiFi switches without the e-matches in BP and they were fine. I have turned off WiFi switches for both altimeters and physically disconnected from energetics as I use redundant dual deployment. I then load BP with e-matches inserted and have followed my procedure to the letter. The clock is ticking. I’m now ready to assemble my rocket with shear pins where appropriate. It is 103 degrees in the desert. Time is limited for the WiFi switches depending on the batteries used. I get in line, then I have to prove to the RSO (she is tough!) I have a physical disconnect somewhere between the batteries and the energetics. Then move to the LCO desk to get approved and assigned a launch pad, move to the pad when available, complete the connection to the energetics, assemble the rocket with shear pins, mount on the launch pad, (avoiding the stares of my comrades), arm the energetics, check for continuity (yeah, still have it!), install the igniter and get it launched within a limited time frame.

Even though it is the flyer’s responsibility, the most difficult part will be proving to the RSO that there is in fact a physical disconnect depending on the type of disconnect used. In my case I will have disconnected wires between the altimeters and the energetics to show the RSO with the nose cone separated from the rocket. As others have noted their challenges are greater.

I’ve tried to keep up with the 600+ posts but it appears it is up to each club as to if and how they will administer or even try to enforce the ruling. I’m sure it will be enforced for certifications by TAPS but otherwise….

Stan

boatgeek said:

Really lousy safe ladder use though. Get thee two steps down!

I really like the idea of a joint NAR/TRA committee on what "inhibit" means, safe switch use, etc. I'd be glad to join if it would be helpful (aka post a call for volunteers on TRF in addition to other channels).

One thing that bothers me slightly about using the 2-stage Q motor CATO as an exemplar of why we need the switching is that (IMHO) switching wasn't the real issue. A much bigger issue was that the sustainer ignition electronics were armed while the rocket was still being assembled and was horizontal on the pad. And there wasn't a tilt/velocity lockout on the staging timer. I'll step two rungs down off my soapbox now.

Click to expand...

I was about to say "Cadet! What in the name of Ulysses S Grant are you doing on the top step of that ladder?!?!?!" myself!

Steve Shannon said:

The document describing inhibits that the air force uses requires two independent inhibits when the chance of injuries is higher and three independent inhibits when there’s a good chance of a fatality if the energetics blow or a rocket motor ignites.

Click to expand...

I think the new rule mirrors those policies... my guess is that for motors they use head-end ignition, so removing the igniter until it's ready to launch essentially accomplishes that particular inhibit.

Speaknoevil said:

Yes, I read the specs, as I said, I linked the same data sheet nearly a hundred posts back in this thread. In fact, I was a reliability engineer for years early in my career testing none other than electrical switches for AT&T Bell Labs so specs and MTBF data from the DoD matter to me. Of course, as with anything, you need to decide if you will operate within the parameters of the spec. If you are one that is constantly flipping (rotating in this case) the switch back and forth, then that switch is not for you. Me personally, I test everything on the bench and only hook up the switch as I'm buttoning up the av-bay and am off to the RSO table and pad. I build many high power designs and only fly any one rocket 5 to 10 times top in its lifetime. As I said in post #524, I would never hit 300 cycles in the next 3 decades with any one rocket, heck, the way I like to build, it may be 3 of my lifetimes.

Click to expand...

each of us is different
I have a 4" broadsword upscale that I love to launch and the crowd loves it also
it currently has 81 flights on it
had I used the afore mentioned switches, given minimum 2 turns to test and 2 turns to arm, it would be well past the 300 lifetime
and I have seen the switch fail after 10 or 20, maybe that was user failure

I can cad design and either cnc mill or 3d print just about any parts I need, so I am doing that

Frederocket said:

There in lies the problem, cheap junk switches. That also goes for some of the slide switches I have seen used.

Click to expand...

For better or worse, this certainly does seem to be suffering from mission creep. I thought the initial issue was the safety of solid state switches vs. mechanically open switches. But that seems like a long time ago - now it's moved on to specific switches, and even the number of inhibits required. From formally defining the word inhibit based on what the commercial fireworks guys use, we're now looking at military and NASA documents for guidance.

Not sure where it ends.


Tony

Very simple... any energetic MUST have a physical break until you get to the pad. Where you put it, how you do it, what kind of switch you use is up to you... as long as you have one.

cerving said:

Very simple... any energetic MUST have a physical break until you get to the pad. Where you put it, how you do it, what kind of switch you use is up to you... as long as you have one.

Click to expand...

Thank you Cris. May I have your permission to use that?

cerving said:

Very simple... any energetic MUST have a physical break until you get to the pad. Where you put it, how you do it, what kind of switch you use is up to you... as long as you have one.

Click to expand...

Would you please come out with a kit for this. wifi switch with a mechanical disconnect.

Steve Shannon said:

Thank you Cris. May I have your permission to use that?

Click to expand...

You got it mister!

MGL said:

Would you please come out with a kit for this. wifi switch with a mechanical disconnect.

Click to expand...

That would be turning lemons into lemonade, wouldn't it?

cerving said:

Very simple... any energetic MUST have a physical break until you get to the pad.

Click to expand...

To the pad or to some designated prep area whose exact nature has never been described.

Final connection of power to your energetics must be done while the rocket is in the upright position on the pad. If you have only one arming mechanism (the physical switch) then you have to do it on the rail. If you have multiple arming mechanisms (i.e. a physical break AND a wireless switch of some sort) then you are allowed to close the physical "switch" prior to raising the rocket on the rail.

cerving said:

Final connection of power to your energetics must be done while the rocket is in the upright position on the pad.

Click to expand...

Huh? Not helping. When can I attach the battery to my wireless switch with no mechanical switch present? I refuse to put the battery into my disassembled avbay at the pad, so there has to be some provision for a safe area "on the range" where this can be done.

You could do that, of course... disconnecting the battery is the physical break. Your club would have to designate an area somewhere around the pads for "final assembly". Honestly, I think that's a big hassle, and the other flyers will probably give you the stink eye for holding up their launches... I know that I get a little self-conscious when I'm doing something complex and it takes a lot of time at the pad, after everybody else has left.

cerving said:

Your club would have to designate an area somewhere around the pads for "final assembly".

Click to expand...

The key question is what "somewhere around the pads" means. To be useful, it has to be far enough from the pads to not close the range, and far enough from the flightline to not constitute a hazard to whoever the rule is intended to protect.

That's up to the TRA BoD and prefects to decide.

cerving said:

Thinking about it on the drive home (this is LA after all, so you generally have a lot of time to think in traffic), I think I misspoke. Most deployment failures are not mechanical... they're PROCUDURAL. Things like: Not properly arming the altimeter (was that two beeps or three?); forgetting the powder in the wells; not closing quick links; being in a hurry and stuffing the chute in too tight; not checking the shock cords for damage after each flight; etc...

Click to expand...

cerving said:

Very simple... any energetic MUST have a physical break until you get to the pad. Where you put it, how you do it, what kind of switch you use is up to you... as long as you have one.

Click to expand...

cerving said:

Final connection of power to your energetics must be done while the rocket is in the upright position on the pad. If you have only one arming mechanism (the physical switch) then you have to do it on the rail. If you have multiple arming mechanisms (i.e. a physical break AND a wireless switch of some sort) then you are allowed to close the physical "switch" prior to raising the rocket on the rail.

Click to expand...

May I respectfully request that you take another long drive in LA rush hour traffic...from the Quantum Manual:

think I will be wanting the updated quantum with a physical power switch which should be accessible from outside the ebay

the quantum does have the deployment electronic switch but has been deemed not good enough with the present ruling

I have started designing the 3d printed ebay for this but will have to wait for the final product to print it out since it may be a different size the the current product

such a waste of time and money designing and making the current one that I was going to use on my 2 stage

gavel said:

May I respectfully request that you take another long drive in LA rush hour traffic...from the Quantum Manual:

"The Quantum is different than every other altimeter that we’re aware of in that it switches both sides of the deployment outputs. Other altimeters have one lead of the igniters tied to a common battery lead (usually but not always “+”), and the igniter is fired by closing a switch on the other lead (usually but not always “-“) completing the circuit. The Quantum incorporates a MOSFET switch on the deployment power as well as the typical on/off switching of the deployment transistors, so that the igniters are essentially “dead” until you are almost at apogee in flight. The only way you can fire an igniter on the ground is with the test web page, which you cannot get into from the normal Quantum web pages. In addition, the Quantum will not self-arm… if you turn it on with ematches connected it will just sit there with the deployment power turned off until you arm it with your wireless device using the proper validation code.

What this means is that there is an electronic switch on the deployment power, interrupting the circuit and essentially satisfying the NAR/TRA L3 requirement for a switch disconnect on the deployment power until it’s armed. You can connect your battery/batteries with confidence at your work table, knowing that there’s no way to accidentally fire a deployment channel."​

Click to expand...

Something so reliable and using modern technology... Are you kidding me?! That's crazy talk!

sighhh...

gavel said:

What this means is that there is an electronic switch on the deployment power, interrupting the circuit and essentially satisfying the NAR/TRA L3 requirement for a switch disconnect on the deployment power until it’s armed. You can connect your battery/batteries with confidence at your work table, knowing that there’s no way to accidentally fire a deployment channel."[/INDENT]

Click to expand...

I understand what you are saying. I tend to agree with you as well. Yes Cris has designed a very foolproof device. However what if those MosFETs have gotten a static charge and have failed closed or whatever the cause is. Now you are down to a single point failure with no idea that it has happened. That single point could be another issue that could have the quantum think it has detected launch. Maybe that is you thinking you forgot to connect a quick link on a shock cord so you take the nose cone off or separate the AV-bay. This causes a pressure change. Boom you have deployment. This is the concern the TRA BoD has and why they have made this rule change. If they say it isn’t a problem and do nothing and then some gets hurt. The insurance will be all over that and we could lose our hobby. So better safe than sorry. It sucks but that is my perception of this change after reading every post so far.

davdue said:

However what if those MosFETs have gotten a static charge and have failed closed or whatever the cause is. Now you are down to a single point failure with no idea that it has happened. That single point could be another issue that could have the quantum think it has detected launch. Maybe that is you thinking you forgot to connect a quick link on a shock cord so you take the nose cone off or separate the AV-bay. This causes a pressure change. Boom you have deployment.

Click to expand...

Except since the altimeters in question support remote disarming as well, you shouldn't be opening the nosecone or AV-bay without having disarmed the altimeter first. And if you do twist & tuck or a pull-pin you may not have any way of disarming, so it's not necessarily any better. If you're worried about firing before arming, I'm also pretty sure these altimeters don't do launch-detect unless they're armed, so even if the MOSFET happened to be shorted-on it still wouldn't be looking for accel/baro changes yet to fire any charges until you did the arming step (the MOSFET really just ensures that any other single failure doesn't result in a firing). Now there's probably a good question there as to whether the altimeter could detect that the MOSFET had failed (basically a continuity check on the MOSFET), to lock out all functions (make a different sound, etc) if it detects a fault.

woferry said:

Except since the altimeters in question support remote disarming as well, you shouldn't be opening the nosecone or AV-bay without having disarmed the altimeter first. And if you do twist & tuck or a pull-pin you may not have any way of disarming, so it's not necessarily any better. If you're worried about firing before arming, I'm also pretty sure these altimeters don't do launch-detect unless they're armed, so even if the MOSFET happened to be shorted-on it still wouldn't be looking for accel/baro changes yet to fire any charges until you did the arming step (the MOSFET really just ensures that any other single failure doesn't result in a firing). Now there's probably a good question there as to whether the altimeter could detect that the MOSFET had failed (basically a continuity check on the MOSFET), to lock out all functions (make a different sound, etc) if it detects a fault.

Click to expand...

True. I was just quickly putting out an example of why the TRA BoD felt they needed to make this change. I offered to take an FMEA from Cris and finish the safety analysis to either prove that it’s not a problem or that it is a problem. With the physical disconnect that guarantees that you can have an inadvertent firing of the energetics.

At the risk of opening a whole new can of worms, I want to point out that TRA is now taken on the role of authorizing devices for remote arming. The use of unauthorized devices is not allowed. I think this is an unnecessary and unwise move.

TRA does not exercise similar authority over altimeters, launch control systems, launch pads, or even switches. Let device makers be responsible for designing and building safe products. This prescient has worked very well over the last 20+ years, why change?

Once TRA starts authorizing deployment devices, it assumes liability for accidents caused by poorly manufactured devices.

...Fred

gavel, obviously I will have to rewrite a fair amount of documentation for all of our wireless products. It takes time...

FredT said:

At the risk of opening a whole new can of worms, I want to point out that TRA is now taken on the role of authorizing devices for remote arming. The use of unauthorized devices is not allowed. I think this is an unnecessary and unwise move.

TRA does not exercise similar authority over altimeters, launch control systems, launch pads, or even switches. Let device makers be responsible for designing and building safe products. This prescient has worked very well over the last 20+ years, why change?

Once TRA starts authorizing deployment devices, it assumes liability for accidents caused by poorly manufactured devices.

...Fred

Click to expand...

Somewhere in the previous 623 posts (or one of the other forums where this has been discussed) I mentioned that Tripoli’s mistake was in starting a list of approved devices and that we intend to change that by getting the manufacturers involved in a meeting to try and establish some minimum performance requirements that we can all agree upon. Then it would be back to the manufacturers claiming compliance. If we had to we would prohibit the use of non-compliant devices, but I wouldn’t anticipate that to happen often because our manufacturers are rocketeers also.

davdue said:

True. I was just quickly putting out an example of why the TRA BoD felt they needed to make this change. I offered to take an FMEA from Cris and finish the safety analysis to either prove that it’s not a problem or that it is a problem. With the physical disconnect that guarantees that you can have an inadvertent firing of the energetics.

Click to expand...

Except you're assuming the physical disconnect never fails, while assuming that the MOSFET will. The whole scenario could just as easily be reversed, as has already been discussed several times on this thread. Mechanical things can fail also. And there are so many more home-brew options on the mechanical side (including the ones I'm thinking of to replace my magnetic switches, to come up with something that fits in the same approximate space).

cerving said:

gavel, obviously I will have to rewrite a fair amount of documentation for all of our wireless products. It takes time...

Click to expand...

I was not suggesting a rewrite. I was suggesting standing by your product.

gavel said:

I was not suggesting a rewrite. I was suggesting standing by your product.

Click to expand...

This response baffles me. Cris and the other manufacturers of solid state, firmware controlled switches have been very consistent in defending their designs. We (Tripoli) said that for now, we want a physical disconnection until taken out on the range. Seriously, I appreciate their patience and willingness to work with us to figure this out. In what way is this not “standing by his product?”

Does anybody remember this ruling from TRA vs BAFTE? "The agency's decision does not satisfy the standard for evaluating agency rulemaking because it was arbitrary and capricious, an abuse of discretion, or otherwise not in accordance with the law" If the Government decided that electronic switches were not an inhibit, I would want TRA to fight them. That is the club that I joined. From what I have read on this post, TRA membership does not want this rule change. Who does the BOD represent? There is no precedent or legal reason to make the rule change. It should be a recommendation. Allow RSOs to make the decisions regarding what they feel is safe and how to set up the range. Flyers have the burden to prove that their design is safe. All of the devices discussed in this thread can be used in a safe or unsafe manner depending on the flyers design and procedures (It is highly unlikely that a flyer would set off Wi-Fi enabled initiators using the test page, but possible). No burden or liability should be placed on any vendor of these products. They already work hard enough for marginal profits. Chris, your instructions are outstanding and do not need to be rewritten.