Not all Redundancy is Created Equal!- part 1

[Hartstoc]

Originally Posted by lr172

Given that the bulk of the GA fleet utilizes this design, can you site some numbers related to how often this scenario occurs?

Larry

Larty- I cannot disagree that the standard setup has a good service history, but most things can be improved upon. It is the parallel nature of the boost and mechanical pumps that concern me most. What I?m trying to do here is look for traits that associate with good redundant design, a healthy conversation for this crowd to be having, methinks!- Otis

[Hartstoc]

Originally Posted by Bicyclops

>an essential-loads bus should never be separated from the battery by switches or relays.<

You do want to be able to turn off the E-buss when you secure the airplane. Gonna have to have a switch.

I ran a fusible link protected wire from each of my 2 batteries to 2 switches. These 2P2T switches are: OFF,E-BUSS,ON. The ON position closes a battery contactor which allows charging, starting, etc.. My dual electronic ignitions are similarly provisioned - fusible link - breaker - switch - ignition.

>it should not be possible to inadvertently discharge both batteries in a twin battery system before discovering an alternator failure.<

I have a single alternator with a flashing low volts light high on the panel to alert me of charging system failure. My procedure in an alternator out situation would be to move one battery switch to the E-BUSS position and turn the other one OFF so as to save it for later.

Ed Holyoke

Actually, I DON?T want the bus for truely essential loads to ever get turned off, but each such load (there are five on my plane) is CBprotected and switched from the ELB. All of those switches must be turned off at the conclusion of each flight. The ultimate ELB is the battery post itself, obviously always?on?! Otis

[Brantel]

Interesting you are planning EarthX batteries. Seems they break a few of your requirements.

[snopercod]

Originally Posted by Hartstoc

Most electric pumps have very tiny checkvalves built in

You can get them with or without the check valve. I'd have to look at the specs on my Facet Gold-Flo boost pump but it's supposed to be "free flow". Since I have a header tank, my engine should continue running should both my fuel pumps fail.

[JonJay]

Originally Posted by snopercod

You can get them with or without the check valve. I'd have to look at the specs on my Facet Gold-Flo boost pump but it's supposed to be "free flow". Since I have a header tank, my engine should continue running should both my fuel pumps fail.

Gravity - hasn?t failed yet!

Not an option for most RV?s, ....or is it?

[Hartstoc]

Originally Posted by Brantel

Interesting you are planning EarthX batteries. Seems they break a few of your requirements.

Not sure what you mean, there will be two of them in a simple, symmetrical, parallel-isolated, system. I’ll be posting part two with a clear presentation of this within a couple of days, please take a look at it.

Also, I’m not suggesting that any of ththese things are “requirements” as such, just trying to identify factors that are generally desirable in a redundant system. It is more a matter of degree- my hope is that a subsystem that features as many of these traits as possible is truely redundant.

I wrestled with “symmetry” somewhat because, as one person said, identical systems may invite identical failures, but I think when you see my battery system you will appreciate why I kept symmetry in as a positive trait.- Otis

[Deuelly]

So, you've figured out the best redundant system in the world. Granted it added a little complexity and a few more failure points but it was worth the risk. Now your flying along all fat, dumb and happy when, BOOMMMMM, everything goes dark and silent. Lightning just took out the super redundant system.

It's good to add redundancy but keep it simple. Always know that your super redundant system may still fail in an instant.

Also, remember that completely separate systems can require more pilot load on preflight and run-up. That turns the pilot into a higher risk failure mode then normal.

[keitht]

Interesting that the discussion departed from a philosophical discussion about redundancy to specific system examples without looking to attach actual demonstrated failure modes and failure rates to the required function availability.
This really is a subject that needs to be addressed from a mathematical and logical perspective based on probability of an event occuring and the consequences of that event coupled with any mitigation for dealing with the failure. Plotting probability of a system failure against the consequences of that failure as a function of severity results in areas of the graph where no redundancy is required and areas where even a single layer of redundancy is not adequate to mitigate the risk. Dual dissimilar redundancy generally doesnt have the risk of concurrent common mode failures even though the overall failure rate of one path may be significantly higher than other path. The time of exposure to the failure and the time of exposure after the first failure when using the redundant path is the more important consideration in that situation. There are a number of good books on the subject of system design that do a deep dive into failure modes and effects, redundancy, monitoring and reliability.
I would be interested in a numbers based discussion if anyone is interested.
KT

[lr172]

Originally Posted by Hartstoc

Larty- I cannot disagree that the standard setup has a good service history, but most things can be improved upon. It is the parallel nature of the boost and mechanical pumps that concern me most. What I?m trying to do here is look for traits that associate with good redundant design, a healthy conversation for this crowd to be having, methinks!- Otis

I would argue that the boost / mech setup is very serial in nature, not parallel. While your approach is interesting, you must also look at all factors. The common setup can run on either the electrical or engine drive. That is a high value scenario. Going pure electric introduces risk over a system that spreads it's redundancy across power sources. Lots of things can occur that would leave your pump without electrons.

Larry

[Brantel]

Originally Posted by Hartstoc

Not sure what you mean, there will be two of them in a simple, symmetrical, parallel-isolated, system. I’ll be posting part two with a clear presentation of this within a couple of days, please take a look at it.

Also, I’m not suggesting that any of ththese things are “requirements” as such, just trying to identify factors that are generally desirable in a redundant system. It is more a matter of degree- my hope is that a subsystem that features as many of these traits as possible is truely redundant.

I wrestled with “symmetry” somewhat because, as one person said, identical systems may invite identical failures, but I think when you see my battery system you will appreciate why I kept symmetry in as a positive trait.- Otis

The BMS system....

It has electronics and some sort of micro controller built into it. Guess what, that requires firmware/software and you guessed it, both batteries will be the same.

There are eight fault light errors listed in the manual. Some of them require up to thirty minutes of monitoring to determine meaning.

There are at least two abnormal conditions where the BMS will disconnect the battery from the bus. Likely taking out both of them at the same time.

So far #1, #2, and #3 have not met your examples....

PS, this not a slam against EarthX. I will likely be using them in my RV-10 and would have one in my RV-7 if it were not for I need the weight where it is and I don’t want one mounted on the engine side of the firewall.