Electronic Safe and Arm Device (ESAD)

Applications

Configurations

All the device nomenclatures listed below are “In-Line” electronic safe and arms which utilize high voltage EFI technology. On the left is a list of acronyms to help clarify some of the confusion around the naming of these devices. All HV safe and arms use very similar internal circuitry and logic but tend to have different acronyms assigned based on what function they are performing. There are three common ways the safe and arm can be configured.

#1. Close coupled EFI system. This should be a single package that has the safe and arm circuitry and logic, the high voltage generation circuitry and the firing switch all co-located in a single package. The EFI is either directly mated with are welded into that package.

#2. Remote EFI and high voltage flex configuration. This has a single unit which contains the safe in our logic, the safe and arm circuitry, the high voltage generation, and the firing switch. But the EFI is now connectorized and in place on the end of a strip line. These are a special configuration because the fire pulse passes through the strip line and the inductance and losses in that strip line must be considered, thus the distance must be kept as short as possible. These types of devices are common in a flight termination system where the exporting furniture can be detached up to 12 inches from the safe and arm.

#3 Remote EFI and firing circuitry. More common for the distributed fusing systems, where the inductance and the short distance is not a concern. In this case, the Safe and Arm contains the safe and arm logic, the safe and arm circuitry, and the high voltage generation. We move the firing switch and the high voltage capacitor to a remote location with the EFI. We can connect those with a simple high voltage twisted pair. In this configuration, the EFI is moved much further away from the safe and arm logic.

All the device nomenclatures listed below are “In-Line” electronic safe and arms which utilize high voltage EFI technology. This list of acronyms can be confusing due to their similarity. To better understand each one, please see below. The high voltage portions use very similar internal circuitry and logic, but the devices tend to have a different acronym used to define them based on the function they perform. Even though all the systems are very similar, if it’s being used for rocket motor ignition, its often called an EISD. If its used for fuzing, it’s often called an Electronic Safe and Arm Fuze (ESAF). If its a Flight termination system, or a hand-emplaced ordnance system, it is sometimes called an Electronic Safe and Arm Device (ESAD) or Electronic Arm Fire Device (EAFD). Essentially, they’re all variations of the same thing, simply different acronyms based on the system in which they are being used.

Acronyms

• eISD/EISD – Electronic Ignition Safety Device
• eSAD/ESAD – Electronic Safe and Arm Device
• eSAF/ESAF – Electronic Safe and Arm Fuze
• eAFD/EAFD – Electronic Arm Fire Device

Three Common Implementations

There are also serval ways to implement a HV SAD in a system and each is convenient for different reasons

Specifications

Electrical Characteristics

Logic power
Wide voltage input range options 5v – 36v

Arming power
Internal regulation of power inputs for logic and arming circuits

Power requirements
Pre-Armed quiescent current <70mA
Arming peak current variable from (100mA @ 100ms arming time) to (1.2A @ 10ms arming time)
Post-Armed quiescent current <100mA

Two static switches & one dynamic switch:
• Factory selectable separation timers
• Accelerometers
• Breakwire (umbilical disconnect)
• Event sequence and timeout
• Flight battery switch detection
• Additional custom configurations available

Interface

Electronic Safe and Arm Device Single and Dual Outputs

Quite often we are asked “Which of these ESADs do you have off the shelf and are already qualified to MIL-STDs?” Although we’ve sent many devices through those mil specs and qualified them to those mil specs. It’s a difficult question to answer due to the fact the high level military specifications don’t get into the details of what signals you have available on your vehicle, what interfaces are available or the environments of your particular vehicle. And that’s not to mention the different opinions of the various safety boards will have on one of these devices depending on it’s use.

Specification Questions

Question: What is a Safe and Arm Device?
Answer: A Safe and Arm Device (SAD) controls the initiation of a pyrotechnic device such that the energetic output is fired only when commanded and is safe at all other times. It’s a device that prevents inadvertent arming or firing of a pyrotechnic event and makes the system is insensitive to environmental stimulus, such as fires, electro-magnetic fields, stray voltages and  electro-static discharge.

Question: What does ESAD mean?
Answer: Electronic Safe and Arm Device.

Question: How does an ESAD work?
Answer: An Electronic Safe and Arm Device uses an insensitive secondary explosive which is directly initiated with a high velocity detonation impact. The high velocity flyer is generated by discharging very high current (>1000A) through a small reactive semiconductor which then explodes and propels a tiny flyer at velocities greater the 3000m/s into the explosive pellet.

Question: Can you provide an LEEFI?
Answer: Yes, we manufacture LEEFIs and also work closely with other LEEFI manufactures to provide the complete safety system.

Question: Can I buy one off the shelf?
Answer: Possibly, if your program is able to adapt to the features of an existing design. If not our modular design approach allows us to adapt to your program requirements while minimizing NRE.

Question: Do you have a publicly available drawing?
Answer: No, each ESAD is unique to the platform on which it flies. We have a system data sheet which covers the features and functionalities available.

Questions to Consider

• What is your application, to help us understand what the device is meant to accomplish?
• Which one of our devices is closest to your application?
• Do you already know which specification applies, and what’s the platform of the vehicle?
• Do you know whether pyrotechnic output is deflagrating or detonating?
• Is it a bulk destruct charge?
• Do you require transfer lines?
• What are your envelope and power restrictions do you need to keep live batteries in this design doesn’t need to be extremely low power?
• Do you need the ability to co-locate the entire device in one area?
• Does it need to be separated in one of those other configurations?
• When is the arming occurring? Before launch or arm after launch? On a rocket motor ignition it’s always before or prior to launch. On things like fuses and FTS it is usually arm after launch and changes the types of inhibits we use.
• Do you have redundancy requirements?
• Does this need to be a dual output, or will it be multiple SADs?
• Do you know the environmental requirements?
• Do we know the max predicted environments to temp, shock, vibe, or any EMI, EMP, radiation?
• Are there any special qualification time requirements or time frame?

With this information when discussing options, we can help to chose a device that would have the largest “Qualification by Analysis” or “Qualification by Similarity” as possible to minimize the scope of the qualification effort.

FAQ's

• Can the arming signals for a Safe and Arm Device, say for rocket motor ignition, be actual arm commands or do they have to be environmental events?

  An arm event or inhibit can certainly be a discrete command from a user or a flight computer. However, environmental events are more unique and therefore fundamentally safer. A safety board for example wouldn’t want you to have Arm Event 1 and Arm Event 2 be the same discrete arming signal, they would want the two signals to be different and unique in some way. Ultimately, the safety board involved has the last say on which signals should be used for arming.

• Can the electronic S & A send fire commands to high voltage as well as low voltage initiations and also detonate as well as deflagrate?

  As far as low voltage and high voltage, if this system requires a high voltage safe and arm in the first place, the safety critical portion of that system must remain high voltage. But the systems do have the ability to fire low voltage initiators. An example of this would be a flight termination system which is initiating a bulk destruct charge.

• For FTS applications that require arming before first motion, would terminate command prior to liftoff result in destructive output on the launch pad?

  That’s typically not true on tactical systems, so a tactical missile that has a flight termination system (FTS) is normally going to launch and arm after first motion. However, some commercial launch vehicles or orbital launch payloads require arming on the pad to verify the arm state before launch and the requirements around whether you are capable of terminating on the pad fall on the particular range safety group you’re dealing with to determine that requirement. Sometimes the burden of that requirement will move to the flight termination receiver instead. So strictly, the answer would be, yes. If we’re armed on the pad and you send a terminate command, it will terminate. The flight termination receiver controls when that terminate command can be received. In other versions, we will include an inhibit, which allows the unit to arm on the ground and would not allow it to fire on the ground. However, when you include a feature like that it will undergo a lot of scrutiny from the Range Safety Group because that feature becomes a reliability question during flight. What if that feature never reactivated on launch night and you’re flying a dead FTS? If that burden of safety is on the safe and arm, there’s additional qual effort around ensuring that feature won’t malfunction. Or you can leave the safe and arm simple, where it will always terminate when it receives the terminate command and put that burden on the flight termination receiver.

• Can the unit be commanded back to the safe state? And what if I abort?

  This applies to the situation where you may be arming before first motion on a pad. The most common way is by allowing the unit to power down and safe itself. If armed, but launch is aborted, simply remove power. After the unit powers down, the internal bleed resistors will bleed the energy off the firing capacitor and will return it to a safe state. Then, upon power on it re-performs power on Reset and the Power On Self-Test. A return to safe has never been included on a warhead or FTS because, once you have the intent to launch and are flying, the ability to suddenly safe during flight is not desired. This feature would only be added to an FTS on an arm-on-the-pad configuration, which is another feature to be reviewed by the Range Safety Group.

• For systems that are armed after first motion but prior to rocket motor engine ignition, do you recommend using ESAD outputs for inhibiting engine ignition or a separate device for the engine inhibit?

  In the case of a captive carry program which drops the vehicle off of the wing of an aircraft, the flight termination system is usually required to arm after separation but before ignition of the propulsive system. The ESAD’s are capable of providing an inhibit that prevents the activation of the propulsive system (usually a rocket motor). This output is typically a low voltage power source that drives a relay or switch. Most Range Safety Groups will allow the ESAD to control this type of inhibit. The ESAD output that is intended to initiate the flight termination destruct charges still needs to be a high voltage EFI, but outputs whose purpose is to inhibit the rocket motor ignition until after verification of an armed state need not be high voltage and can certainly be controlled by the ESAD.

• Do we have keep alive capability? And if so, what are some typical durations?

  We’ve implemented keep alive in several of our laser safe and arms. Our high voltage safe and arms have used keep alive in a variety of flight termination vehicles. The most common duration is a two second keep alive. Anything between 0 and 2 seconds typically has a significant margin on it. Most of our heritage products are at the two second mark. A keep alive feature can remove the requirement for the vehicle to have dedicated flight termination batteries

• What are some of the typical vibration and shock environments these devices can meet?

  Each device is qualified to the specification based on the environments of the vehicle that it was intended for. These safe and arms have been on aircraft captive carry environments, launch vehicle environments, tactical launch vehicle environments, and have been deployed in subsea and space.