Safety state machine

Rev A is prototype hardware and is not flight qualified.

States

SAFE → QUALIFY → ARMED → FIRING → LOCKOUT

Any detected fault forces FAULT.

State	Meaning
SAFE	ARM jumper absent; charge and fire outputs held off
QUALIFY	Jumper present; power is checked through a qualification delay
ARMED	Firing bank charges; orientation is watched for the apogee criterion after the post-arm inhibit
FIRING	A single firing pulse
LOCKOUT	No further firing until reset
FAULT	Entered from any state when a fault is detected

Arming conditions

Arming requires all of:

• The physical ARM jumper
• Stable power and capacitor readings
• A qualification delay
• A post-arm inhibit

A single firing pulse is followed by lockout until reset.

The hardware interlock

The state machine is firmware, and firmware can be wrong. The ARM jumper therefore sits underneath it, in hardware: both the charge command and the fire command pass through separate AND gates whose second input is the ARM header. With the jumper removed, the firing bank cannot be charged and the output cannot be fired, whatever the firmware does.

The firing charger is also supplied only from the battery rail, so USB power alone cannot charge the firing bank.