L3 update in NAR E-Rocketeer

[n3tjm]

Some good news for NAR members seeking their L3

[FONT=Arial,Helvetica,sans-serif]There are now very few differences between the technical requirements of our procedures for Level 1 through Level 3 high power certification and those of Tripoli Rocketry Association. Both associations made changes to reach this common point: for example, TRA added a dual-altimeter requirement for L3 cert flights and we removed the "6-switch" or "shunt" requirement for how to disarm pyrotechnics for L3 cert flights. [/FONT]

 

[sailmike]

Oh cool, a little less complexity. Do the requirements say specifically what kind of altimeters they have to be? I'm thinking that the second altimeter could be just an altitude reader with no ejection capability.

Mike

 

[MarkM]

Oh cool, a little less complexity. Do the requirements say specifically what kind of altimeters they have to be? I'm thinking that the second altimeter could be just an altitude reader with no ejection capability.

Mike

That's not a wise configuration. The purpose of the two altimeter requirement is to provide deployment redundancy. Both need to have ejection capability. If one altimeter doesn't fire the ejection charges, the hopes are the other will and save the rocket. A second altimeter with reader only capability is pointless in terms of redundancy.

On my L3 attempt, one of my altimeters didn't fire the apogee. The backup did and saved the flight. Both did fire their mains. If I had used a altitude reader only, I may have failed my L3.

 

[ben_ullman]

Oh cool, a little less complexity. Do the requirements say specifically what kind of altimeters they have to be? I'm thinking that the second altimeter could be just an altitude reader with no ejection capability.

Mike

My thinking is buy two altimeters like an ARTS and a MAWD (great combo) and that way you have two great altimters that you can run single in smaller rockets and double in the larger ones.

Right now Team Ullmans owns:
2 ARTS
2 MAWD
1 HA45
1 Missileworks RRC2 new
2 PML Co pilots
1 ARTS GPS system

These plus a walston all make flying the larger projects easy. The ARTS have great data capabilities on them to tell me how my EX motor preformed.

Ben

 

[cherokeej]

Oh cool, a little less complexity. Do the requirements say specifically what kind of altimeters they have to be? I'm thinking that the second altimeter could be just an altitude reader with no ejection capability.

Mike

I don't think you'll be getting any signatures on your paperwork with that configuration, Mike.

The requirement is, and always has been, redundant deployment mechanisms for L3 cert attempts. The biggest part of the change is to the wording that currently requires switches between the outputs of altimeters, accelerometers, timers, or other computer/controllers, and the e-matches inside the deployment charges.

(Please notice all of those were plural.)

You will still be required to have redundancy in your deployment control. That pretty much means a primary system, and a complete back-up system for ejecting your recovery. The specific configuration will be between you and your L3CC rep. But I don't know any of the guys on the committee that would approve a flight with only one altimeter hooked up for deployment.

I know I won't.

James

 

[TWRackers]

I read the revised L3 requirements, and without comparing the before and after versions, I don't see the major difference. The new version still seems to require that there be a means to externally switch out the pyros from the electronics. The version dated 2/14/2009 states:

2.4 The capability must exist to externally disarm all pyrotechnic devices on-board the rocket. In this context, ‘disarm’ means the ability to physically break the connection between a pyrotechnic system and its power source. Simply turning off the device controlling the pyrotechnic(s) may not be sufficient.

I see no mention of "shunts" here, so is that the change? If so, then little has really changed as far as I can see; you still need one or more switches (you could use a multi-pole-single-throw) to open the circuits to the pyros.

So as I read it, you still need a switch or switches to power the altimeters on/off, plus a switch or switches to open/close the pyro connections.

Personally, I'm sticking with my current design (see attached), with one minor revision: separate apogee charges instead of two e-matches sharing one charge. The only difference between switching out the pyros or shunting them is the use of the normally-open contact on each lever switch.

Am I worried about switch failures causing a recovery failure? Not really, I'd have to have certain combinations of failures to prevent recovery. The only real single point of failure would be the ARRD failing to release, and from what I've heard, their more common failure mode is releasing too soon.

For the record, ALT 1 is an RRC2-mini, and ALT2 is a MAWD. The lever switches will be mounted with their major planes perpendicular to the thrust axis of the rocket, so normal acceleration and deceleration can't induce spurious contact bounces. The screw terminals marked "switch" on each altimeter (not shown) are jumpered together.

 

[CTulanko]

So as I read it, you still need a switch or switches to power the altimeters on/off, plus a switch or switches to open/close the pyro connections....

Not true...by removing power from some altimeters via an external switch, you have removed the power source from the pyro's, as required and shunts/switches on the mathces would not be necessary; this is actually a positive move, as it decreases the number of points of failure.

However, it all depends on what you use for an Altimeter. Altimeters that have power for the electronics and seperate power for the matches would require a different configuration that may require pyro switches for safety. This is where the term "Simply turning off the device controlling the pyrotechnic(s) may not be sufficient. would come into play.

 

[UhClem]

Not true...by removing power from some altimeters via an external switch, you have removed the power source from the pyro's, as required and shunts/switches on the mathces would not be necessary; this is actually a positive move, as it decreases the number of points of failure.

This improves flight safety at the expense of ground safety.

All altimeters are subject to various failure modes that could result in the activation of their outputs immediately upon the application of power. There could be a sensor failure, or the microcontroller could be fried, and most subtle of all, no microcontroller that I know of guarantees glitch free operation of I/O pins at power up. The data sheets tell you how the I/O pins are configured after reset but are silent on what happens before that.

By including a switch between the power source and pyro outputs (some altimeters include a switch or the option of adding a switch) you can verify that the altimeter powers up and is operating normally before making the last connection that allows it to activate its ouptuts. This will not eliminate all failure modes but it does cover most of them.

The very small loss in reliability during flight (switches are in general very reliable) is more than compensated by the increase in safety on the ground.

 

[CTulanko]

You are correct, it does improve flight safety with a very small loss to ground safety. The L3CC and TAP members consider this to be the best choice for certifications, as it improves safety during the most critical point of the certification, the model's flight and recovery. Also note that you may still be required by your TAP or L3CC to use shunts, depending on the operation of your altimeters; this is up to the discretion of your certifier and is why I stated it as some altimeters, as it leaves it open for analysis. It also does not mean you cannot use shunt devices if you wish and that is between the flier and his certifier.

The potential loss in reliability is more critical during flight than on the ground, which is why the decision was made and I believe it brings both organizations in alignment and agreement with the most critical and dangerous part of the certification, the flight/recovery.

 

[TWRackers]

Not true...by removing power from some altimeters via an external switch, you have removed the power source from the pyro's, as required and shunts/switches on the mathces would not be necessary; this is actually a positive move, as it decreases the number of points of failure.

However, it all depends on what you use for an Altimeter. Altimeters that have power for the electronics and seperate power for the matches would require a different configuration that may require pyro switches for safety. This is where the term "Simply turning off the device controlling the pyrotechnic(s) may not be sufficient. would come into play.

I haven't seen any information for either of the altimeters I have which will tell me exactly where the circuit is de-energized if the "switch" terminals are used. How do you guard against residual charge stored in capacitors in the output stage of an altimeter? Without detailed information about how a specific altimeter is designed, I prefer to design my circuitry so that it will work safely and reliably without such detailed knowledge.

Has anyone ever done a good analysis of the relative failure probabilities of the components in a recovery system? I'd like to know if switches are as failure-prone as some believe. Seems like there are more likely points of failure in the system.

 

[TWRackers]

This improves flight safety at the expense of ground safety.

All altimeters are subject to various failure modes that could result in the activation of their outputs immediately upon the application of power. There could be a sensor failure, or the microcontroller could be fried, and most subtle of all, no microcontroller that I know of guarantees glitch free operation of I/O pins at power up. The data sheets tell you how the I/O pins are configured after reset but are silent on what happens before that.

By including a switch between the power source and pyro outputs (some altimeters include a switch or the option of adding a switch) you can verify that the altimeter powers up and is operating normally before making the last connection that allows it to activate its ouptuts. This will not eliminate all failure modes but it does cover most of them.

The very small loss in reliability during flight (switches are in general very reliable) is more than compensated by the increase in safety on the ground.

If an altimeter doesn't see continuity on the outputs when it's powered up, will it still operate as normal if the circuits are closed AFTER power-up, or will it assume there is nothing to fire and thus inhibits the outputs? My guess: it probably depends on the model of the altimeter, and the answer for a given altimeter may not be in the documentation. I plan to test my alts without AND THEN with continuity.

 

[DMcCauley]

Lets come back to earth people.

A single altimeter and its associated power / arming switches are very reliable. Add an additional altimeter for redundancy and you have an extremely reliable recovery electronics system.

Many people like to "nit" about reliability in the altimeter / electronics portion of the recovery system, but the FACT is that compared to other portions of the recovery system, its magnitudes more reliable and for all intensive purposes can be neglected.

The number one failure in recovery systems is the actual harness itself. I've seen many hundreds of HPR flights using altimeters and then number 1 reason for failure i've seen is a recovery harness failing.

Altimeters / ejection charges are redundant, but the harness itself contains many single point failure nodes.

I think if people worried less about all this altimeter nonsense and concentrated more on designing and preparing their recovery harness, you'd have considerably more successful flights.

 

[TWRackers]

Lets come back to earth people.

A single altimeter and its associated power / arming switches are very reliable. Add an additional altimeter for redundancy and you have an extremely reliable recovery electronics system.

Many people like to "nit" about reliability in the altimeter / electronics portion of the recovery system, but the FACT is that compared to other portions of the recovery system, its magnitudes more reliable and for all intensive purposes can be neglected.

The number one failure in recovery systems is the actual harness itself. I've seen many hundreds of HPR flights using altimeters and then number 1 reason for failure i've seen is a recovery harness failing.

Altimeters / ejection charges are redundant, but the harness itself contains many single point failure nodes.

I think if people worried less about all this altimeter nonsense and concentrated more on designing and preparing their recovery harness, you'd have considerably more successful flights.

Well said, I agree completely. Electronics, barring component failures or poor solder joints, is very predictable. The recovery harnesses and chutes, however, border on chaos theory.

 

[WOOSHPREZ]

I'm happy to see that the L3CC committee has seen the light.

When I was preparing to do my L-3 I argued for this change.
Didn't happen back then and I flew my L-3 bird with seven switches on the side of it. The extra switch was because I flew a G wiz MC that has a disconnect for the Computer and a disconnect for the pyro battery.
As crowded as the electronics bay was it all worked fine.

Bringing the NAR L-3 certification requirements even with the TRA cert. requirements is a good thing. NAR has been scaring away L-3 cert attempts for years. I have seen many flyers join TRA just to do their L-3 flights.
This will keep them in house.

 

[UhClem]

Didn't happen back then and I flew my L-3 bird with seven switches on the side of it. The extra switch was because I flew a G wiz MC that has a disconnect for the Computer and a disconnect for the pyro battery.
As crowded as the electronics bay was it all worked fine.

The Gwiz pyro battery disconnect was sufficient to meet the NAR L3 requirements with no additional switches on the charges. The only time per charge switches are required is when the altimeter has no safe/arm provisions at all.

My NAR L3 rocket had four switches. Two for altimeter power and two for pyro power disconnect. I used an AltAcc2C with its safe/arm system and a RDAS compact with its pyro power switch option.

(The old requirements said "is not sufficient" instead of "may not be sufficient". A lot is being read into this very ambiguous change. But it isn't surprising as some thought the old rules required shunts.)

 

[sailmike]

Ok, ok ok, I got it, redundancy is very important. I was just wondering about the specific wording of the rules. Also, I tend to have a little bit more faith in electronics than I probably should. I am in college to be an electrical engineer, so maybe that has something to do with that.

I don't have the money for level 3 yet. When I do, I'll be back here to pick your brains.

Mike