Pyrotechnic charges are initiated using e.g. the NASA Standard Detonator Standard Detonator or the NASA Standard Initiator. I don't know the exact specs, but I assume that these will be driven with a few amps in the kV range (detonator), or 28V (initiator).

The computer commanding the operation will use CMOS technology with gate oxide thicknesses in the nanometre range, Transistor, these are very fragile and could fail in any manner, open, shorted, stuck low/high, random oscillations etc. Also failures can affect a single or multiple pins of an IO group.

A similar argument holds for the amplification circuit that will transform the logic output level to the power required for the initiator, great care has to be taken that no fault can accidentally trigger the initiator.

For example, this circuit to control a lightbulb would be a very bad choice to launch a rocket, a single failure of the microcontroller or the MOSFET would lead to an uncommanded ignition lightbulb switch.

A related question explains that the SRB used a mechanical lock to move the initiator out of the way, but that only moves the problem, as a simple fault could still rotate the barrier.

Also, mechanical arm devices are probably too heavy and bulky to be used everywhere

My question is: What kind of electronic circuits are used to translate the output of a logic board into an initiation signal?

What techniques are used to make them fail-safe, such that a single logic failure, stuck gate etc. doesn't cause a disaster?


5 Answers 5


This excerpt from the Space Shuttle Systems Handbook Volume 2, drawing 13.1, (pdf page 200) shows a typical shuttle pyro circuit. (This one happens to be for the nose gear assist thruster, but they were all similar.)

enter image description here

The large rectangular box towards the right of the schematic is the Pyro Initiator Controller. You can see how the Arm and Fire 2 commands end up providing the power to the exploding bridgewire in the device (hexagon 7) and the Fire 1 command provides the ground (hexagon 8).

A single component failing ON, even the final AND gate for the power, or the final op-amp for the ground, would not cause the device to detonate.


In some cases, a pyrotechnic initiator may be designed to require a higher voltage than would normally exist anywhere anything connected to it. Consider the circuit at https://tinyurl.com/2p7xs8td (Falstad simulator link). To blow the right fuse, it is necessary to briefly close the left switch repeatedly until the voltage reaches about 120 volts, and then close the right switch. If the left switch is held closed for too long, the left side fuse will blow and the circuit will be permanently inoperable. If the right side switch is closed before the voltage has reached about 120 volts, the left side fuse will blow without having transferred enough energy to blow the right side fuse. If the voltage exceeds 150 volts, the spark gap will fire, draining the capacitor voltage to a safe level while blowing the left side fuse.

Note that not only is the circuit designed in such a way that no single-point failure could cause an erroneous trigger, but it's also designed in such a way that building up and transferring enough energy to quickly blow the right-side fuse would require a particular sequence of switch closures of proper durations. While the left side fuse and spark gap are designed to reduce the possible range of errant switch-closure patterns that might blow the right side fuse, the need for a sequence of switch closures is enforced not by part of the circuitry, but rather by the lack of circuitry that could produce the required voltage any other way.

Some pyrotechnic initiators need to be designed to be able to fire instantly, without delay, but in cases where the required timing can be predicted in advance, a circuit which stores energy in a cap just before the scheduled initiation can be made inherently fail-safe, even in the presence of many simultaneous failures, prior to the start of the charge cycle.

Note that there are many situations where a failed pyrotechnic initiation can cause mission failure, so if there were only one initiator the "fail safe" condition wouldn't necessarily be safe. On the other hand, it's a lot easier to design a mission to survive if a pyrotechnic initiator fails to fire when required (e.g. by having redundant initiators) than to survive a pyrotechnic is initiated when it shouldn't be. The circuit shown here is designed to be a simple demonstration of the underlying principles; real designs would be much more complicated for a variety of reasons.


STS-113 Mission Overview

The solid rocket motor ignition commands are sent by the orbiter computers through the MECs to the safe and arm device NSDs in each SRB. A PIC single-channel capacitor discharge device controls the firing of each pyrotechnic device. Three signals must be present simultaneously for the PIC to generate the pyro firing output. These signals--arm, fire 1 and fire 2--originate in the orbiter general-purpose computers and are transmitted to the MECs. The MECs reformat them to 28-volt dc signals for the PICs. The arm signal charges the PIC capacitor to 40 volts dc (minimum of 20 volts dc).

The actual circuit in use is not far from your Arduino example: the STS SRB has two switches in series that requires two signals to fully trigger, and there's one more signal needed to turn on the power supply (charge the capacitor) before firing. This three-wire approach would (help) prevent accidental firing.

Moreover, there are multiple computers to begin with, and multiple pyros at the end, so reliable firing is solved by even more redundancy.


I found an overview of firing circuits in the following document: Capacitance discharge system for ignition of Single Bridge Apollo Standard Initiators (SBASI). They all use the same concepts mentioned in the other answers, here they are for reference:

Viking Lander

LPCA Circuit





Viking Orbiter

Viking Orbiter

Space Shuttle

Shuttle circuit

  • 2
    $\begingroup$ Thanks for the link to the interesting document. Looks like the shuttle design changed from this early concept - for example, there weren't any 'safing' commands in the flown version. But the general idea was the same - ARM charged the capacitor, FIRE 1 and FIRE 2 discharged it through the device. But instead of having one gate in the ground circuit, they had two in series in the power. $\endgroup$ Commented Oct 10, 2022 at 15:25
  • 2
    $\begingroup$ Good catch! I found one book that says that the Shuttle PIC is "frightfully expensive" "very heavy" (about 1lb, not counting enclosure, connectors etc.), so it must have a lot of extra components not shown in the overview schematic. I'll see if I can find any FMEA papers. $\endgroup$
    – latlon
    Commented Oct 10, 2022 at 16:35

To complement what other people said in their answers, I'll add that electronic circuits used in space vehicles often don't employ normal components, but highly sophisticated radiation hardened devices.

Citing from Wikipedia:

Radiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation (particle radiation and high-energy electromagnetic radiation), especially for environments in outer space (especially beyond the low Earth orbit), around nuclear reactors and particle accelerators, or during nuclear accidents or nuclear warfare.

Most semiconductor electronic components are susceptible to radiation damage, and radiation-hardened (rad-hard) components are based on their non-hardened equivalents, with some design and manufacturing variations that reduce the susceptibility to radiation damage. Due to the extensive development and testing required to produce a radiation-tolerant design of a microelectronic chip, the technology of radiation-hardened chips tends to lag behind the most recent developments.

And here are the slides of a thesis which can be englightening on the subject: Gerardin, S. (2009). Ionizing Radiation Effects on Advanced CMOS Technologies.

  • 1
    $\begingroup$ Are we sure this is true for auxiliary systems? For sure any flight computers but I'm curious about the little circuits/gadgets running different subsystems. $\endgroup$
    – johnDanger
    Commented Oct 11, 2022 at 1:13
  • $\begingroup$ @johnDanger Radiation hardening is a problem with any electronic circuit employed in space applications. It wouldn't make sense to use rad-hard components/techniques only on part of a system. Simplifying somewhat, a system is as weak as its weakest subsystem: what's the point of spending tenfold for main systems and then use normal industrial components for auxiliary systems? If an aux systems fails, it could lead to aborting the mission anyway, even if the mission could still be completed (but with much higher risks involved). $\endgroup$ Commented Oct 11, 2022 at 8:49
  • $\begingroup$ @johnDanger It is however possible, in principle, that some systems that aren't really going to hit the higher atmosphere (booster rockets?) could employ less robust electronics. IDK whether this would really amount to substantial savings, since I doubt non space-worthy part of a spaceship have so much electronics in them. OK, a camera + transmitter to film the detachment of the boosters maybe could be made with non rad-hard electronics, since it's not a vital part of the system and it isn't going into space anyway. $\endgroup$ Commented Oct 11, 2022 at 8:53
  • $\begingroup$ @johnDanger BTW, note that radiation hardening could be still achieved by heavy shielding. Hovewer,, since the cost of putting into orbit more mass is quite high, and electronics (even hardened electronics) costs tend to go down as technology advances, I doubt that nowadays it would be particularly cost-effective to use normal electronics + heavy shielding instead of hardened components + little (or no) shielding. $\endgroup$ Commented Oct 11, 2022 at 8:59
  • 2
    $\begingroup$ @johnDanger I found a paper that says that normal power MOSFETs don't change much under irradiation, onlinelibrary.wiley.com/doi/pdf/10.4218/etrij.05.0205.0031, but then there is a thesis about Single Event Gate Rupture, ntrs.nasa.gov/api/citations/20110011911/downloads/… . The equivalent for BJTs is called Single Event Burnout. I would love to see a full circuit diagram for the pyro initiation controller with the components they used. The board weights 1lb, it must have a lot of extra components. $\endgroup$
    – latlon
    Commented Oct 13, 2022 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.