Inadvertent Cable Cutter Firing

Mike Ross wrote:
ISS has similar command protection, believe it or not. One must
command-to-close one RPC downstream of the guillotine, close another
upstream, then remove the close-inhibit for the power RPC, and then close
that power RPC to get the whole thing to fire.


But if all those are controlled by software in the main station system,
it is quite different from the physical hardware switches on the shuttle
which are not controled by the same software.

The question to ask is whether the ground could trigger the contigency
undocking of the shuttle or whether one must phsycally be there to throw
the switches.

In the case of the station, there isn't much that the ground cannot do.

This problem reminds me of the early days of the A320. The FAA had
certified the plane based on existing testing programmes. But they had
not thought of verifying the software, verifying that changing cabin
temperature might disrupt thrittle control for engines etc etc.

When you have hardware sitches, then the decription given on how the
shuttle can fire its pyros to undock gives very good redundancy to
prevent accidental firing. If the switch physically cuts off power to
the pyros, then no amount of pressing buttons will work. But in a
software setting, if you get past the initial IF statements, you somehow
get past a whole bunch of IF statements to check that the right
switches have been thrown, you do get to the code that triggers the
mechanism. (or if the right values were deposited in the right locations
of memory causing all the IF statements to succeed).

One might need to have 2 separate computer systems and 2 separate
command data paths. One would control power to the unit, and one would
control the triggering. So a software glitch might cause the trigger to
deploy, but without power, it woudln't do anything. (or vice versa).

The ISS program is concerned enough about the possibility of the second
cable being inadvertently cut that they have made changes to the Russian EVA
#15 schedule to prevent it. On February 2nd the Increment 12 crew will
translate up to the Mobile Transport in Orlan Spacesuit to install a
mechanical restraint to the guillotine. They will use the new 85 foot US
Safety Tethers during the translation on the US segment...assuming the
Russians get happy with the use...its not quite certified yet...new
hardware. Anyway it should be an interesting EVA. We've never quite done
this before in Orlans.

Also during EVA #15 the crew will throw one of the life expired Orlan
spacesuits overboard. The suit will have a ham radio beacon in it which
will broadcast a congratulatory message to the Bauman Institute in
Moscow...some anniversary. Anyway, anyone in the world with a ham radio
should be able to tune in and hear the message for the few weeks that the
suit orbits....


"John Doe" wrote in message ...
Mike Ross wrote:
ISS has similar command protection, believe it or not. One must
command-to-close one RPC downstream of the guillotine, close another
upstream, then remove the close-inhibit for the power RPC, and then
close
that power RPC to get the whole thing to fire.


But if all those are controlled by software in the main station system,
it is quite different from the physical hardware switches on the shuttle
which are not controled by the same software.

The question to ask is whether the ground could trigger the contigency
undocking of the shuttle or whether one must phsycally be there to throw
the switches.

In the case of the station, there isn't much that the ground cannot do.

This problem reminds me of the early days of the A320. The FAA had
certified the plane based on existing testing programmes. But they had
not thought of verifying the software, verifying that changing cabin
temperature might disrupt thrittle control for engines etc etc.

When you have hardware sitches, then the decription given on how the
shuttle can fire its pyros to undock gives very good redundancy to
prevent accidental firing. If the switch physically cuts off power to
the pyros, then no amount of pressing buttons will work. But in a
software setting, if you get past the initial IF statements, you somehow
get past a whole bunch of IF statements to check that the right
switches have been thrown, you do get to the code that triggers the
mechanism. (or if the right values were deposited in the right locations
of memory causing all the IF statements to succeed).

One might need to have 2 separate computer systems and 2 separate
command data paths. One would control power to the unit, and one would
control the triggering. So a software glitch might cause the trigger to
deploy, but without power, it woudln't do anything. (or vice versa).

Chuck Fulcher wrote:
The ISS program is concerned enough about the possibility of the second
cable being inadvertently cut that they have made changes to the Russian EVA
#15 schedule to prevent it
[...]
Also during EVA #15 the crew will throw one of the life expired Orlan
spacesuits overboard.

Thanks for the update!

/dps