Not all Redundancy is Created Equal!- part 1

[Paul 5r4]

Very interesting and timely thread as I'm in the middle of planning a panel upgrade to full IFR. You've introduced some interesting thoughts I've never considered. One of the previous post mentioned "Probability of failure." I am designing my electrical system around that thought.

One alternator and dual batteries and a split electrical buss, (per Carl Froehlich). I plan on direct lines from each battery to each electrical buss. Each line will pass through one relay. In event of failure of alt all I'll need to do is flip the switch closing those relays and I'll have battery power direct to each buss by each battery.

Now the probability of failure thought. What are the chances of.....
1. alternator failure (in actual IMC). Yes, I know, if it fails that's exactly when it would!
2. after the alt fails, what is the probability of having a switch/relay direct from the battery to each electrical buss fail at the same time.
3. in event of an actual switch/relay failure from number 2, there is ANOTHER separate battery providing power through a SEPARATE wire/switch/relay to each buss.

As for avionics, many now have some sort of internal/included battery to keep things working for a period of time in the event an electrical problem. Add to that two independently wired batteries to a split avionics buss which would give probably at the very least an hour of power to get to VFR or at least below the clouds. Probability of failure of everything??? I don't know but I fell not likely. The weakest link in my chain will probably be the pilots brain getting mushy. Looking at your redundancy criteria, as objective as possible, maybe I've met three of the five.

[bret]

I was going to say something intelligent until the lightning statement...?.Yip, that will change your plans in a hurry All electric here, separate buss for each ECM, coil, and pump, one alternator two batteries. Full dual EFII. After an alternator failure the big Earth X should keep things alive for over an hour, (landing by now), then with a 30A switch, a secondary BU 20 AH battery on my side of the firewall will keep the components running for another 1.5 hours, the Dynons each have their own BU battery also. The run up procedure includes testing the two ECMs, IGN coils, fuel pumps and batteries.

[Walt]

Just a quick reality check here...

Somehow I can't help but think many folks just overthink things and/or just prefer to make something so simple, complicated.

Our little aircraft still have only one engine. I know folks like to 'tinker', but the end result becomes a complicated aircraft that only the owner understands (will he recall how the system works if something goes wrong in the air years from now?, how about a future owner?)

This is basically the electrical system I use in my own aircraft and install in customers aircraft, sometime with a back-up alt sometimes not (Nuckolls VFR diagram).

https://bandc.com/wp-content/uploads...single_alt.pdf
Dual alt version is what I personally use (but without the battery/endurance bus):
https://bandc.com/wp-content/uploads...h_bom_revA.pdf

I prefer to have avionics bus so I add that with a simple Mil-spec switch off the main feed.

Primary instruments all run from a small back-up battery as the second power source.

Fuel in the tanks, magnetos (or one EI) and good ole constant flow FI is all the engine needs to keep running.

Use good workmanship, quality tools, Mil-spec switches, relays, wiring, connectors and the failure rate is 1 in a million.

That's it, simple rules the day.

[rocketman1988]

Unless you want more than a VFR toy...

[DanH]

Originally Posted by keitht

Interesting that the discussion departed from a philosophical discussion about redundancy to specific system examples without looking to attach actual demonstrated failure modes and failure rates to the required function availability.
This really is a subject that needs to be addressed from a mathematical and logical perspective based on probability of an event occuring and the consequences of that event coupled with any mitigation for dealing with the failure. Plotting probability of a system failure against the consequences of that failure as a function of severity results in areas of the graph where no redundancy is required and areas where even a single layer of redundancy is not adequate to mitigate the risk. Dual dissimilar redundancy generally doesnt have the risk of concurrent common mode failures even though the overall failure rate of one path may be significantly higher than other path. The time of exposure to the failure and the time of exposure after the first failure when using the redundant path is the more important consideration in that situation. There are a number of good books on the subject of system design that do a deep dive into failure modes and effects, redundancy, monitoring and reliability.
I would be interested in a numbers based discussion if anyone is interested.
KT

Keith, can you recommend a particular book on the subject, suitable for the lay person?

In the context of homebuilders wiring systems, I'm written and illustrated that they should ignore the probability of failure, and concentrate on the effect of failure. I'd love to see how the two are properly combined, but my concern for such an approach in the EAB world is the classic GIGO problem...we have no good way to establish probability. Most of what we work with has no established failure rate, just an avalanche of marketing claims, so estimates of probability tend to be little more than opinion and belief. It works for religion, but it is not a basis for engineering.

Effect, on the other hand, can be established with some precision. If we fully examine the effect of each potential problem, it becomes possible to design for benign failure. There is no reason to be concerned with how often it fails if each failure is benign. And given enough time, everything fails anyway...100% probability.

Here's an example. In the next ten flights, there will be ten failures, each benign enough that the pilot lands safely with no great effort. Or, (user choice), there will be nine flights with no failures and one flight with a failure resulting in unexpected engine stoppage.

Clearly the probability of failure is far lower when choosing the latter...but I bet very few would make that choice.

[Walt]

Originally Posted by rocketman1988

Unless you want more than a VFR toy...

Complex does not equal better/more reliable (which is my point), I fly IFR cross country quite a bit.

[DanH]

Originally Posted by rocketman1988

Unless you want more than a VFR toy...

Clearly you've never seen Walt's airplane.

[rocketman1988]

True, I have not.

I have also flown IFR with equipped with the "simple" tech he recommends, as well as far more complicated systems.

It all comes down to what each individual wants. There are plenty examples of each that are safe and reliable.

Build what you want, want what you build.

No more time to waste discussing this topic again...

[Carl Froehlich]

Originally Posted by DanH

. SNIP...
In the context of homebuilders wiring systems, I'm written and illustrated that they should ignore the probability of failure, and concentrate on the effect of failure. ...SNIP

Exactly correct - thanks again Dan for the injection of common sense.

Back in the day my paying job required understanding the impact of any failure, and systems/procedures to mitigate that impact. This discipline was the corner stone of safe operation of very complex systems.

Electrical power distribution need not be complicated, expensive or heavy. It does however need to reflect that few of us fly behind vacuum pump driven spinning iron gyros. This translates to simplistic single battery, single avionics switch type designs no longer supporting reliable IFR flight.

Carl

[Walt]

Originally Posted by Carl Froehlich

Electrical power distribution need not be complicated, expensive or heavy. It does however need to reflect that few of us fly behind vacuum pump driven spinning iron gyros. This translates to simplistic single battery, single avionics switch type designs no longer supporting reliable IFR flight.

Carl

Not sure I agree with that conclusion.

A glass panel with all primary flight instruments and engine functions supported by both the standard single battery/switch electrical system AND a backup battery power source in the event the primary system fails, seems pretty redundant to me.

Add to that a stand alone instrument like the G5 with it own internal battery pretty much seals the deal for IFR redundancy.

With the above we've also been able to eliminate the multiple relays switches and diodes your system requires for "redundancy".

And I would venture to guess that the MTBF of my single switch system is quite a bit higher than your multiple relay/diode system.

As Stein would say, just my 2c