Security and dependability of computer systems - esercitazione Sharpe

K3 RG1

regulator

Inert gas check

valve CV1 Relief

valve RV2

Propellant tank

with bladder

PT1

S3 Relief

valve RV3

Thruster isolation

valve

IV2

S2 Timer relay Relief valve

RV4

K6 Thrust chamber inlet

K5 valve

K4 IV3

Catalyst

Fault Tree Handbook with Aerospace Applications Version 1.1

Figure 11-1. Monopropellant Propulsion System

The system uses hydrogen peroxide (H O ) that passes over a catalyst and decomposes into

2 2

The system uses hydrogen peroxide (H O ) that passes over a catalyst and

2 2

byproducts of oxygen, water, and heat to create an expanding gas producing a thrust that changes

decomposes into byproducts of oxygen, water, and heat to create an expanding gas

the spacecraft velocity. The propellant system component nomenclature is listed in Table 11-1.

producing a thrust that changes the spacecraft velocity. The propellant system

Chapter 11, Monopropellant Propulsion System Example 127

component nomenclature is listed in Table 1.

Table 11-1. Propellant System Nomenclature

TK1 – Propellant Storage Tank PT1- Propellant Tank 1

RV1 – Relief Valve 1 K1 – Arming Relay K1

RV2 – Relief Valve 2 K2 – Firing Protection Relay

RV3 – Relief Valve 3 K3 – Arming Relay

RV4 – Relief Valve 4 K4 – Firing Relay

IV1 – Isolation Valve 1 K5 – Firing Relay

IV2 – Isolation Valve 2 K6 – Timing Relay

IV3 – Isolation Valve 3 S1 – Arming Switch

RG1 – Regulator 1 S2 – Firing Switch

CV1 – Check Valve 1 S3 – Emergency Cutoff Switch

The system consists of a reservoir TK1 of inert gas that is fed through an isolation valve IV1 to a

pressure regulator RG1. The pressure regulator RG1 senses pressure downstream and opens or

closes to control the pressure at a constant level. A check valve, CV1 allows passage of the inert

gas to the Propellant Tank PT1. Separating the inert gas from the propellant is a bladder that

collapses as propellant is depleted. Propellant is forced through a feed line to the Thruster

Table 1

The system consists of a reservoir TK1 of inert gas that is fed through an isolation

valve IV1 to a pressure regulator RG1. The pressure regulator RG1 senses pressure

downstream and opens or closes to control the pressure at a constant level. A check

valve, CV1 allows passage of the inert gas to the Propellant Tank PT1. Separating the

inert gas from the propellant is a bladder that collapses as propellant is depleted.

Propellant is forced through a feed line to the Thruster Isolation Valve IV2 and then

to the Thrust Chamber Inlet Valve IV3. For the Thruster to fire, the system must first

be armed, by opening IV1 and IV2. After the system is armed, a command is sent to

IV3, to open, allowing H O into the thrust chamber. As the propellant passes over the

2 2

catalyst, it decomposes producing the byproducts and heat and the expanding gas that

creates the thrust. The relief valves RV1-4 are available to dump propellant overboard

should an overpressure condition occur in any part of the system.

The electrical command system controls the arming and thrusting of the propellant

system. To arm the system, switch S1 is momentarily depressed, allowing

electromotive force (emf) to activate relay switches K1, K2 and K3, and open valves

IV1 and IV2. K1 closes and sustains the emf through the arming circuit. K2

momentarily opens to preclude the inadvertent firing of the system during the

transition to the armed mode, and closes when S1 is released. K3 closes in the firing

circuit. The system is now armed with power supplied to sustain IV1 and IV2 in the

open position.

When firing switch S2 is momentarily depressed, K4 closes sustaining the firing

circuit. K5 closes completing the circuit for K6, which begins timing to a

predetermined time for the thruster to fire. The completed circuit opens IV3 and

thrusting begins. When K6 times out, it momentarily opens breaking the arming

circuit and opening K1. Power is removed from the IV1 and IV2 relays and both

valves are spring-loaded closed. K3 opens breaking the firing circuit,

which opens K4 and K5. IV3 is spring-loaded closed, and the system is in now in the

dormant mode. Should K6 fail and remain closed after timing out, the system can be

shut down manually by depressing S3, which breaks the arming circuit, opening K1

and closing IV1 and IV2. The firing circuit relay switch K3 will open breaking the

firing circuit, which causes K4 and K5 to open. When K5 opens, IV3 will be spring-

loaded closed, and the system will be in the dormant mode. System operational

configurations are summarized in Figure 3.