PEC TRIPLE REDUNDANT TRANSMIT INHIBIT               18 Oct 2002
---------------------------------------------------------------
                                                         WB4APR

Since PECsat is deployed and recovered via EVA and there will
be other EVA's, the transmitter on PCsat must have a triple 
redundant, double fault tolerant transmit inhibit.  

The original PCsat design had no transmit inhibits.  Even if all 
beacons and bulletins are off, it will still always respond to
a command initiation sequence with the command challenge 
password transmission.  Thus we need additional mechanisms to 
add redundant inhibits.  But by definition, any inhibits to 
transmission, disables the primary command link as well.

DESIGN APPROACH:  PECsat deploys with TX inhibited by firmware, 
defaults, timers and hardware switches.  It has dual redundant 
receivers and TNC's (command decoders).  The following must be 
in place before PECsat can transmit:

1) EVA PLUG:  There is a triple circuit EVA plug that must be
inserted to connect the PEC power system to the transmitter 
system.

2) SWITCH:  During deployment and recovery, there is a mechanical 
electrical power ON/OFF switch that can only be activated when the 
PEC enclosure is opened.  The EVA Astronaut activates this switch.
This switch is also required to prevent the EVA plug from making
a powered connection.

3) The PEC rechargable batteries are initially uncharged.

4) PECsat's transmitter and power system are designed with a net
negative power budget.  If any combination of events causes a
permanent TRANSMIT-ON condition, then in under 4 hours, the
PECsat batteries will be depleated and transmissions will cease.
constant TRANSMIT-ON current can not be met under solar power 
alone.

5) The power-up and RESET defaults of PECsat all default to
transmitters OFF.  A watch-dog timer resets PECsat to defaults
(TX inhibited) after 96 hours of no command actions.

6) Under normal command access, PECsat can be commanded to defaults
which is the TRANSMIT OFF condition from either the TNCA or TNCB
command channels.  Both the A and B TNC's can also command a 
hardware RESET on the other TNC in case of latchup.

7) We could if necessaary add a DTMF back-door decoders that can 
RESET PECsat to defaults


ACTIVATION:

To activate PECsat transmitters, the following conditions must be met:

1) The two clamshell halves of PECsat must be OPEN.  

2) The EVA plug must be inserted with the ON/OFF switch in OFF.

3) The MANUAL ON/OFF switch may then be switched to the ON position.

4) A 30 minute to 8 hour one-time timer must TIME-OUT.

5) It must receive a valid command system initiate logon sequence
from only the designated command station.  If the station is valid
and a loggon attempt is made, then PECsat will respond (transmit)
back the loggon password challenge.

6) If the command station responds to the challenge with the proper
real-time derived password that matches the challenge, then the
command station may further activate PECsat routine telemetry and/
or user RELAY transmissions.

Bob Bruninga
USNA Satellite Lab Engineer