Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01 NASA Engineering and Safety Center Technical Bulletin No. 20-01

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs in 

the configuration shown in Fig. 1 to latch the incoming signal that 

was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause. 

The circuit used to capture 

the state of fire control signals 

in Fig. 1 sets the F/F on the 

positive edge of the clock line. 

Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three 

undesirable features: (1) the D input is preloaded by connecting 

it directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanism to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve 

this design. The preferred method would be to qualify the data 

signal. This is possible if the source of the signal is coming from 

a circuit that can also 

produce a qualifying 

data strobe indicating 

that the data is valid. For 

example, if the signals 

come from a microcontroller (as was the 

case with the system 

that misfired) two output ports could be used 

in the configuration as 

shown in Fig. 2.

This circuit has the advantage that the F/F will only be set when 

DATA is coincident with the positive edge of the STROBE; at 

other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2πRC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or the 

design should include an external 

Schmitt trigger. 

Alternately, a debouncer (i.e. LCT6994) shown in Fig. 4 can 

be used as a low-pass filter. A delay value can be set with an 

external resistor network as shown.

In this configuration, the input signal must be stable for 100ms

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, 

the noise floor during tests should not reach 1⁄2 the threshold 

voltage (6 dB) required to activate the devices.

References

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Background

Recent designs of pyro control circuits utilized D Flip-Flops (F/Fs) 

to latch critical signals that must persist after loss of main power. 

These F/Fs and subsequent logic, control the MOSFETs used to 

fire the pyro initiator. These designs used discrete D-type F/Fs 

in the configuration shown in Fig. 1 to latch the incoming signal 

that was applied to the clock line (CP) input.

One circuit inadvertently fired 

a pyro during a pyro shock 

test and the sensitivity of this 

configuration was deemed to 

be a contributor to root cause.

The circuit used to capture 

the state of fire control signals in Fig. 1 sets the F/F on 

the positive edge of the clock 

line. Clock inputs on F/Fs are edge-triggered and can respond to 

very fast pulses. The problem with this design approach is that 

noise on the clock line can set the F/F. The design has three undesirable features: (1) the D input is preloaded by connecting it 

directly to Vcc, (2) there is susceptibility to high frequency noise 

as the CP input can respond to nanosecond pulses, and (3) there 

is no mechanisms to limit or qualify the clock input to reduce the 

window of when noise could affect the circuit. Alternate design 

approaches can reduce the sensitivity of this circuit.

Recommended Design Best Practices

A number of simple enhancements can be made to improve this 

design. The preferred method would be to qualify the data signal. 

This is possible if the source of the signal is coming from a circuit 

that can also produce 

a qualifying data strobe 

indicating that the data 

is valid. For example, if 

the signals come from a 

microcontroller (as was 

the case with the system that misfired) two 

output ports could be 

used in the configuration as shown in Fig. 2.

This circuit has the advantage that the F/F will only be set 

when DATA is coincident with the positive edge of the STROBE; 

at other times the F/F will be immune to noise. In pyro control 

systems that use a 2-phase ARM and FIRE control approach, 

the ARM control can potentially be used on the DATA input and 

the FIRE control can be used to latch the DATA on the STROBE 

input. When a DATA/STROBE configuration is not possible other 

techniques can be used to improve noise immunity.

A simple RC low pass filter shown in Fig. 3 can be added to the 

clock line in Fig. 1. This will attenuate noise above the cutoff 

frequency (fc) where fc=1/ (2 π RC). A word of caution with this 

approach, some F/Fs will not operate properly if the clock edge 

transitions too slowly. One should use a F/F (i.e. 74LVC1G74) 

with a Schmitt trigger on the 

clock input that can tolerate 

a slow clock rise time, or 

the design should include an 

external Schmitt trigger. 

Alternately a debouncer (i.e. LCT6994) shown in Fig. 4 can used 

as a low-pass filter. A delay value can be set with an external 

resistor network as shown.

In this configuration, the input signal must be stable for 100ms 

before the output changes; short pulses are ignored (filtered). 

For this to be effective, the debouncer and F/F of Fig.1 should 

be located near each other to minimize the signal path. It is also 

possible to apply a combination of techniques to ensure correct 

data latching. Lastly, confirming the design noise margin, either 

by test or via analysis when test is impractical, to inadvertent 

firing is important in a system where an inadvertent fire is 

catastrophic. This margin should be on critical control inputs in 

thresholding logic ahead of the fire control inhibit semiconductor 

switches. Per specifications that date back to MIL-STD-1576, the 

noise floor during tests does should not reach 1⁄2 the threshold 

voltage (6 dB) to activate the devices. 

References 

1. LTC6994 Datasheet, Linear Technologies

2. 74LVC1G74-Q100 Datasheet, Nexperia

Latching Safety Critical Signals in Pyrotechnic Circuits

In recent designs of safety-critical pyro control circuitry, latching circuits, used to store the state of control 

signals, have been found to have sensitivity to noise that could lead to inadvertent firing. This technical 

bulletin describes the sensitive circuit, and provides best practice recommendations to improve the design.

NASA Engineering and Safety Center Technical Bulletin No. 20-02

National Aeronautics and Space Administration

www.nasa.gov For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov. 

NASA Engineering and Safety Center Technical Bulletin No. 20-01

For information contact Dr. Robert F. Hodson, robert.f.hodson@nasa.gov.

04/01/2020