1.6 The Control Accelerometer and Its Backup

After this section you can: place, mount and back up the control sensor and an independent monitor, and say why it is the most checked channel on the test.

Every channel on a test reports. The control channel acts. The controller holds it to the profile and adjusts the drive to every shortfall and excess it reports (Chapter 3), so an error on any other channel is an error in the data, and an error on the control channel is an error in the test. That is why it is the most checked channel on the floor: proven first (1.1), mounted best, read most often, and backed up. What a control channel does in the loop, and how several are combined, is 4.1's subject. This section is the hardware: where the sensor goes, how it is mounted, and what stands beside it.

Where it goes is set by the requirement first. MIL-STD-810H Method 514.8, in paragraph 4.4.1b, has control accelerometers screw-mounted to the fixture near the interface with the test item, or at the location the specification was derived from, with every instrumentation location described in the test plan. The fixture's survey decides the exact point (the low-level measurement of the fixture's modes, bare and then with the article on, whose recipe is in 6.5). Its modal map, the fixture's mode shapes and nodal lines drawn on it, shows where the fixture moves the way the mounting points do and where it does not, and the control sensor goes where it represents the mounting points and never on a nodal line, where it would see little at that mode's frequency while the mounting points saw a peak.

How it is mounted follows from 1.4: on a stud, in a tapped hole designed into the fixture for it, on a flat, clean surface with a film of grease, at its datasheet torque, written down. The sensor is the best in the drawer for the job: a fresh certificate, a mounted resonance with the top of the band well inside the 5 percent fraction (1.3), a range that holds the full-level response at the interface with headroom, and a temperature rating for the chamber if there is one. Its cable takes the shortest route off the fixture, tied at intervals, with no connector in the moving part of the run that does not have to be there. Its sensitivity is entered from its certificate, read back through the chain by the calibrator check (1.7), and checked against the serial number on the sensor actually on the fixture.

Then the backup. MIL-STD-810H Method 514.8, in paragraph 4.2.1.1.1, calls single-point control "not recommended", because of the risk of a transducer failure or a calibration or scaling error on the one channel. 4.1 says single-point control is what most small-article tests use. Both statements are true, because they are about different things. 4.1's is about the motion: on a small fixture that moves as one piece through the band, one point represents all the mounting points, and averaging several says nothing more. 514.8's is about the sensor: one sensor is one place for the test to fail without anyone seeing it. A backup answers the standard's concern without changing the control strategy.

It takes one of three forms. The simplest is a second control-quality sensor beside the first, in its own tapped hole, on its own cable and its own input, with its sensitivity entered from its own certificate. It runs as a monitor, with alarm and abort limits (the levels at which the controller warns and at which it stops the test) around the control channel's reference, the level the profile asks for at each frequency (4.2), so that if the two disagree the test stops, and it is named in the procedure as the sensor that takes over control if the first one fails. The second is averaged control on two adjacent sensors, which the standard allows. It halves the effect of one sensor going wrong, which also means it halves the evidence: a channel reading double moves the average by half, and the controller holds the average in tolerance while one sensor is lying (4.1). Averaged control is a backup only if each channel is watched on its own. The third is the independent monitor.

The independent monitor is the second opinion of 1.1 at the control point. It is its own sensor, mounted beside the control sensor, on its own cable and its own conditioner, with its own sensitivity entered on a separate recorder that shares nothing with the controller: not the channel table, not the inputs, not the software. It does not act on the test unless somebody reads it or it carries its own limit. What it does is record what the table did, independently of the system whose behavior may be the question. When a test goes wrong, the controller's own record is a record of what the controller believed, and if the controller's input was the fault, that record is the one thing that cannot settle it. Recording it from the first excitation to the return to rest is Chapter 2's subject.

It is not the secondary level check of 4.2. That sensor belongs to the machine, sits on the armature and protects the machine by tripping it. The independent monitor belongs to the test and is evidence. A lab can have both, and on a test that matters it should.

The public case is NASA's. During the qualification of the HESSI spacecraft, a small solar observatory, a sine-burst run (a short burst of sine cycles) at minus 12 dB, a quarter of full level, delivered about 21 g, roughly ten times what was intended, and the investigation traced the cause to the test equipment, not the spacecraft. What let the investigators say what the shaker had actually done was an independent monitor accelerometer mounted next to the control accelerometer and recorded on a separate tape recorder (Worth and Phillips, Results of the HESSI Test Mishap Investigation, NASA). The report's recommendations included self-checks of the system at representative levels, a review of the transfer function and the drive before a burst is fired, and baseline runs of the equipment before the article arrives. Planning and running those checks belong to Chapter 12 and Chapter 14. This chapter's lesson from it is the sensor beside the control sensor, on a recorder of its own.

The sensor that was not the one in the table. A random test carried a limit channel on the article, at a bracket the analyst had asked be held below a response level, with a limit profile the controller would notch the drive to meet. (A limit channel is a response channel with a ceiling of its own against frequency; where it would pass that ceiling, the controller lowers the drive over just those frequencies, a notch, so the control falls below the profile there on purpose, 4.1.) The sensor on that channel had come out of the same drawer as the others and looked like them. It was a 10 mV/g unit kept for shock work, among 100 mV/g siblings, and the channel table carried 100 mV/g for it. The controller's checks all passed: the bias was in its window, a sensitivity was entered, the channel showed a signal. At the first low level the limit channel read a tenth of the bracket's real motion. The limit profile was never reached, no notch came, and the control plot sat in tolerance from end to end, because the control sensor was telling the truth and the limit sensor was quiet. The monitor beside the bracket, on its own recorder, read about ten times what the limit channel showed. The operator was reading it, as the procedure said to in the first minute of every level, and stopped the run at minus 12 dB. At a quarter of full-level amplitude, the bracket had seen a quarter of a response the limit was there to cut, which was inside what its owner allowed, and it went into the log and the report as a deviation. Had nobody been reading the monitor, the step to full level would have put the bracket's full unlimited response into the article with the controller reporting a limit channel well under its line. The lesson is the one this chapter keeps returning to: a wrong sensitivity on a limit or monitor channel does not look like a fault, it looks like a quiet channel, and only a second sensor that sees the same motion can say which one is lying.