PSAS/ Lv2LaunchTowerIgniter

Launch Tower Igniter Circuit

The launch tower igniter circuit is a key component in a safety-critical launch system. The circuit is the final element that triggers rocket motor ignition. For adequate safety it must prevent unintended launch events.

The design is fairly simple (see diagram below). The motor igniter is a wire filament coated with pyrogenic compounds. When a moderately large current (~1A) passes through the igniter, the igniter acts like a powerful match, igniting the main motor propellant. The current is provided by a small lead acid gel-cell battery whose sole function is to provide ignition current.

Assuming that all other electrical connections are in place, a complete ignition circuit requires 4 independent conditions be fulfilled.

By design, the 4 prerequisites for launch are satisfied by 3 mostly independent systems.

The LTR is controlled from the launch control center via the Launch Control Computer (LCC) and a wireless link to the Launch Tower Computer (LTC). Because launch control attempts to maintain an overview of events during launch, the LTR provides a useful safety factor against accidental launch.

The Rocket_Ready signal is produced by the rocket vehicle via the on board Flight Computer (FC). Rocket_Ready is only asserted after the vehicle receives launch authorization from launch control, after internal self-checks are passed, and after a pre-set delay and warning period have expired.

The final two launch prerequisites come from only one person, the Motor Master (MM), who is delegated final responsibility for launch tower safety checks and who must manually make the final electrical hook up to the motor igniter.

Operating Details

Prior to final motor hook up, the motor igniter is NOT inserted into the motor.

Since the final motor hook up must be done while working close to the motor, care has been taken to insure that the motor circuit is incapable of firing the igniter until everyone has left the launch area. (A full list of the sequence of steps taken appears below.)

The first safety measure is to communicate with Launch Control (LC) to determine if motor hook up should proceed, and to be sure launch control is aware that the motor will soon be hooked up.

To minimize risk the launch area must be clear of all personnel other than the motor master prior to beginning motor hook up.

Before any actual hook up is done the ignition circuit is checked to be sure it is in the expected state.

The first check is that the banana shorting jumper is firmly in place. The shorting jumper is situated in the circuit so that any attempted actuation of the igniter while the jumper is in will be prevented, and further, the replaceable cartridge fuse will be opened.

We think that opening the fuse if there is a fault is a good idea. The open fuse serves as a detectable record of an ignition circuit fault. If the fuse is open it is an indication that something has gone wrong in the ignition system and an adequate explanation must be found before an actual launch attempt is made.

It is worth noting that even if the shorting jumper was not firmly in place and the ignition cable was somehow energized, there would still be an incomplete path in the overall ignition circuit so long as the shorting jumper was not placed in the away box. Part of the protocol dictates that there is only one one shorting jumper present in the launch area. Therefore a local check that the shorting jumper is present in the LTC enclosure shorting block also verifies that the away box circuit is open and the overall ignition circuit is incomplete.

Similarly, if the motor box and igniter junction box are interchanged, the away box still functions to break the overall circuit and the system is not rendered unsafe.

The second check is that the manual arm switch is in the OFF position. When the manual switch is off there is no intentional electrical path from any battery positive to the igniter cable.

Assuming that the switch and jumper are properly configured, the MM can proceed to the motor box. The alligator clip cable should be connected to the motor box by the 12V Anderson powerpole (APP12) connector and the voltage indicating lamp should be dark before connecting the alligator clips to the motor igniter.

The indicating lamp is a 17cd green LED in an opaque viewing tube. Running at 10mA it is bright enough to be seen in desert sunlight yet it only draws 20mA at 20V, less than the no-fire current of the motor igniter. The LED is connected through a bridge rectifier so it will indicate voltage of any polarity.

Some thought went into the question of whether it is better to first connect the alligator clips to the igniter and then connect the alligator cable via the APP12 or to have the cable already connected before the final alligator clip-on. So far we think it's better to do the alligator clipping last. The reasons for this are that the only apparent extra dangers in clipping last seem to arise from the possibility that the igniter circuit is prematurely energized, which we have done a lot to prevent. Whereas the un-terminated clips could possibly be subject to RF pickup, or static build up, and although components could be added to the alligator cable to address these problems the alligator cable is subject to frequent abuse, and any provisions made may not be reliable, whereas the motor box includes a well protected 1kΩ 1/2W bleeder resistor.

Of course we follow the usual practice of shorting and twisting the motor igniter leads. The leads are only un-shorted when the final connection to the alligator clips is made. The alligator clips are also connected to each other until clipped to the igniter. This arrangement is slightly easier on the cable during handling, but more importantly it doubles for the shorting jumper in the event of a fault.

Also it seems better to connect the alligator cable to the motor box in the relatively calm environment present during setup and save the alligator clips for the final, stressful, connections.

If all is well, the motor igniter can be inserted and the alligator clips attached. Once the clips are on, the motor master should swiftly but calmly move to the LTC enclosure. At the enclosure the MM first sets the manual arm switch to ON, and then removes the banana shorting jumper.

The sequence, switch, then jumper, is intentional. As previously mentioned, a fault at this stage might blow the fuse, and thereby trigger an investigation, but very probably it will not result in an ignition event because the shorting bar will not be in place at the away box.

Once the manual arm switch is set ON and the shorting jumper is in hand, the MM moves to the away box, which is at the end of a 50ft orange cord. It is desirable that a vehicle be parked near the away box interposed between the box and the tower. The vehicle provides both cover and a quick way to leave the vicinity once the shorting jumper is in the away box. It would also be a good idea to protect the extension cord from damage in case it gets run over. A flag with a stick might be helpful here. The away box includes a voltage indicating lamp. If the lamp is on it is very likely that inserting the shorting jumper will trigger an ignition event.

When it appears safe the motor master may insert the shorting jumper into the away box. Once the jumper is in the away box there is a continuing small chance that the motor will ignite prematurely. The shorting bar should never be placed in the away box if motor ignition is likely to hurt someone or is otherwise unacceptable.

From this point on no one should approach the tower area without first removing the banana shorting jumper from the away box. If the tower itself is approached the first thing to be done is to insert the shorting jumper into the LTC enclosure and then immediately switch the manual arming switch to OFF. In most circumstances the alligator clips should then be detached from the motor igniter, and possibly the motor igniter removed from the motor.

Things That Still Need Work

The motor igniters need to be better characterized. What are their no-fire / all-fire currents? What is the expected range of igniter terminal resistance? Is a current greater than the all-fire current required for best ignition efficiency?

Since the motor igniters are not well characterized, it cannot be said with certainty that the shorting jumper would hold the ignition cable voltage low enough to prevent ignition. The design at present somewhat works around this by leaving the circuit open until the away box circuit is completed, but we really should both know and test that the shorted fault voltage is low enough. Perhaps a resistor could be added in the ignition battery lead. The resistor would limit the current into the shorting jumper and possibly also protect the relays.

More eyeballs on the safety critical procedures.

Perhaps an RF shorting capacitor should be added to the motor box?

Probably should move the fuse (see diagram) to between the ignition battery and the 1st relay. Thus the fuse would protect the relays from shorts inside the enclosure as well as downstream.

The manual arm switch should ground its 2nd pole so that the OFF switch state hard-grounds the hot ignition lead.

Launch Tower Ignition Circuit Critical Steps:

Setup

  1. Setup Launch Tower Computer (LTC) enclosure with Manual Arm Switch in OFF position, and Banana Shorting Jumper inserted into LTC enclosure shorting block
  2. Lay out ignition extension cable (with the three attached junction boxes) so the motor box is about 7 feet from the nozzle, the away box is as far as practical away from the rocket, and the middle junction box is connected to the LTC igniter cable by the 12V Anderson powerpole connector.

Final Electrical Hook Up
(Only one person (the Motor Master) performs the following steps ending with the final electrical connection to the motor)

  1. Contact Launch control to verify that the systems state is appropriate for the motor to be connected
  2. Verify that launch area is clear of any other personnel
  3. Verify that the Banana Shorting Jumper is well placed in the shorting block
  4. Verify that the Manual Arm Switch is OFF
  5. Verify that the motor box indicator lamp is dark
  6. Verify the alligator clips are connected in the motor box
  7. Connect the alligator clips to the motor igniter
  8. Switch the Manual Arm Switch to ON
  9. Remove the Banana Shorting Jumper from the shorting block
  10. Move to the away box
  11. Final check that the area is clear of any other personnel
  12. Insert the Banana Shorting Jumper in the away box banana jack
  13. Leave the launch area

Launch sequence

  1. The Rocket Ready Relay (RRR) board closes its relay (on a signal from the rocket via the umbilical cord).
  2. Launch Tower Relay (LTR) board closes its relay (on a signal from the launch control software via the LTC).