Electronic Circuits for Safe Initiation of Pyrotechnics?

Question

Pyrotechnic charges are initiated using e.g. the NASA Standard Detonator or the NASA Standard Initiator. I don't know the exact specs, but I assume that these will be driven with a few amps in the kV range (detonator), or 28V (initiator).

The computer commanding the operation will use CMOS technology with gate oxide thicknesses in the nanometre range, , these are very fragile and could fail in any manner, open, shorted, stuck low/high, random oscillations etc. Also failures can affect a single or multiple pins of an IO group.

A similar argument holds for the amplification circuit that will transform the logic output level to the power required for the initiator, great care has to be taken that no fault can accidentally trigger the initiator.

For example, this circuit to control a lightbulb would be a very bad choice to launch a rocket, a single failure of the microcontroller or the MOSFET would lead to an uncommanded ignition .

A related question explains that the SRB used a mechanical lock to move the initiator out of the way, but that only moves the problem, as a simple fault could still rotate the barrier.

Also, mechanical arm devices are probably too heavy and bulky to be used everywhere

My question is: What kind of electronic circuits are used to translate the output of a logic board into an initiation signal?

What techniques are used to make them fail-safe, such that a single logic failure, stuck gate etc. doesn't cause a disaster?

Answer 1

This excerpt from the Space Shuttle Systems Handbook Volume 2, drawing 13.1, (pdf page 200) shows a typical shuttle pyro circuit. (This one happens to be for the nose gear assist thruster, but they were all similar.)

The large rectangular box towards the right of the schematic is the Pyro Initiator Controller. You can see how the Arm and Fire 2 commands end up providing the power to the exploding bridgewire in the device (hexagon 7) and the Fire 1 command provides the ground (hexagon 8).

A single component failing ON, even the final AND gate for the power, or the final op-amp for the ground, would not cause the device to detonate.

Answer 2

In some cases, a pyrotechnic initiator may be designed to require a higher voltage than would normally exist anywhere anything connected to it. Consider the circuit at https://tinyurl.com/2p7xs8td (Falstad simulator link). To blow the right fuse, it is necessary to briefly close the left switch repeatedly until the voltage reaches about 120 volts, and then close the right switch. If the left switch is held closed for too long, the left side fuse will blow and the circuit will be permanently inoperable. If the right side switch is closed before the voltage has reached about 120 volts, the left side fuse will blow without having transferred enough energy to blow the right side fuse. If the voltage exceeds 150 volts, the spark gap will fire, draining the capacitor voltage to a safe level while blowing the left side fuse.

Note that not only is the circuit designed in such a way that no single-point failure could cause an erroneous trigger, but it's also designed in such a way that building up and transferring enough energy to quickly blow the right-side fuse would require a particular sequence of switch closures of proper durations. While the left side fuse and spark gap are designed to reduce the possible range of errant switch-closure patterns that might blow the right side fuse, the need for a sequence of switch closures is enforced not by part of the circuitry, but rather by the lack of circuitry that could produce the required voltage any other way.

Some pyrotechnic initiators need to be designed to be able to fire instantly, without delay, but in cases where the required timing can be predicted in advance, a circuit which stores energy in a cap just before the scheduled initiation can be made inherently fail-safe, even in the presence of many simultaneous failures, prior to the start of the charge cycle.

Note that there are many situations where a failed pyrotechnic initiation can cause mission failure, so if there were only one initiator the "fail safe" condition wouldn't necessarily be safe. On the other hand, it's a lot easier to design a mission to survive if a pyrotechnic initiator fails to fire when required (e.g. by having redundant initiators) than to survive a pyrotechnic is initiated when it shouldn't be. The circuit shown here is designed to be a simple demonstration of the underlying principles; real designs would be much more complicated for a variety of reasons.

Answer 3

STS-113 Mission Overview

The solid rocket motor ignition commands are sent by the orbiter computers through the MECs to the safe and arm device NSDs in each SRB. A PIC single-channel capacitor discharge device controls the firing of each pyrotechnic device. Three signals must be present simultaneously for the PIC to generate the pyro firing output. These signals--arm, fire 1 and fire 2--originate in the orbiter general-purpose computers and are transmitted to the MECs. The MECs reformat them to 28-volt dc signals for the PICs. The arm signal charges the PIC capacitor to 40 volts dc (minimum of 20 volts dc).

The actual circuit in use is not far from your Arduino example: the STS SRB has two switches in series that requires two signals to fully trigger, and there's one more signal needed to turn on the power supply (charge the capacitor) before firing. This three-wire approach would (help) prevent accidental firing.

Moreover, there are multiple computers to begin with, and multiple pyros at the end, so reliable firing is solved by even more redundancy.

Answer 4

I found an overview of firing circuits in the following document: Capacitance discharge system for ignition of Single Bridge Apollo Standard Initiators (SBASI). They all use the same concepts mentioned in the other answers, here they are for reference:

Viking Lander

HIT

Mansafe

Viking Orbiter

Space Shuttle

Answer 5

To complement what other people said in their answers, I'll add that electronic circuits used in space vehicles often don't employ normal components, but highly sophisticated radiation hardened devices.

Citing from Wikipedia:

Radiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation (particle radiation and high-energy electromagnetic radiation), especially for environments in outer space (especially beyond the low Earth orbit), around nuclear reactors and particle accelerators, or during nuclear accidents or nuclear warfare.

Most semiconductor electronic components are susceptible to radiation damage, and radiation-hardened (rad-hard) components are based on their non-hardened equivalents, with some design and manufacturing variations that reduce the susceptibility to radiation damage. Due to the extensive development and testing required to produce a radiation-tolerant design of a microelectronic chip, the technology of radiation-hardened chips tends to lag behind the most recent developments.

And here are the slides of a thesis which can be englightening on the subject: Gerardin, S. (2009). Ionizing Radiation Effects on Advanced CMOS Technologies.