Not all Redundancy is Created Equal!- part 1

[Carl Froehlich]

Originally Posted by Walt

Not sure I agree with that conclusion.

A glass panel with all primary flight instruments and engine functions supported by both the standard single battery/switch electrical system AND a backup battery power source in the event the primary system fails, seems pretty redundant to me.

Add to that a stand alone instrument like the G5 with it own internal battery pretty much seals the deal for IFR redundancy.

With the above we've also been able to eliminate the multiple relays switches and diodes your system requires for "redundancy".

And I would venture to guess that the MTBF of my single switch system is quite a bit higher than your multiple relay/diode system.

As Stein would say, just my 2c

Walt,

As you state, you are using three batteries to mitigate system faults - so you demonstrate my main point.

I use only two batteries but have redundant paths to get power from either or both batteries to either side of the panel. Standard 30 amp relays (two primary and two alternate) provide the needed paths - so your MTBF comment is not applicable. My set up also provides power to the NAV/COMM, transponder, flaps, autopilot, trim and such for uninterrupted full IFR flight. Does your EFIS back battery or G5 backup battery do that?

A single battery, if properly maintained and not abused, is a very reliable source of power. The hardest faults to protect against are associated with getting that power to where you need it. So single battery master relay or single avionics master switch, no matter what quality or MTBF, are to be avoided. Overlay this with faults associated with common connections. I note with concern many people just assume a wire junction is never an issue. I know of a Mooney and a twin (two engines, two alternators, two batteries) that lost everything because of a high resistance contact.

To correct a point, in my two battery, single alternator set up I do not use any diodes for power distribution.

But as we all know, to each his own. I established my tolerance level of risk for IFR flight. I recommend every builder do the same.

Carl

[David Paule]

Originally Posted by DanH

....There is no reason to be concerned with how often it fails if each failure is benign.....

Still, it would be a good thing if there were some ability to identify the part that failed, and since the failure is benign by design, identify that a failure has occurred at all.

In many cases that'll be obvious. In certain cases it won't be.

Dave

[Walt]

Originally Posted by Carl Froehlich

Walt,

As you state, you are using three batteries to mitigate system faults - so you demonstrate my main point.

I use only two batteries but have redundant paths to get power from either or both batteries to either side of the panel. Standard 30 amp relays (two primary and two alternate) provide the needed paths - so your MTBF comment is not applicable. My set up also provides power to the NAV/COMM, transponder, flaps, autopilot, trim and such for uninterrupted full IFR flight. Does your EFIS back battery or G5 backup battery do that?

A single battery, if properly maintained and not abused, is a very reliable source of power. The hardest faults to protect against are associated with getting that power to where you need it. So single battery master relay or single avionics master switch, no matter what quality or MTBF, are to be avoided. Overlay this with faults associated with common connections. I note with concern many people just assume a wire junction is never an issue. I know of a Mooney and a twin (two engines, two alternators, two batteries) that lost everything because of a high resistance contact.

To correct a point, in my two battery, single alternator set up I do not use any diodes for power distribution.

But as we all know, to each his own. I established my tolerance level of risk for IFR flight. I recommend every builder do the same.

Carl

So you have 4 relays and 2 contactors with how many switches controlling this system?

If you have 2 separate busses then your assumption must be that the buss itself and associated equipment on it can never have a fault and you're really just swapping power sources to those busses? What happens if you short/open one of those 'vital' busses, does everything continue to work?

The complexity of a full- up dual buss system with the associated cross tie relays and switches IMO just add to the number of failure points with little to offer for me to safely terminate a flight in the event of a power failure.

Honestly I think my single (mil-spec) relay and toggle switch work pretty good, and I'll bet my 3 batteries weigh much less than your 2 main batteries.

The back-up power source for my main instruments has one switch, no relays. Auto switch-over in the event the main power source fails.
The G5 obviously has no switches or relays.

I'm not trying to persuade anyone that my way is better, I'm just trying to let folks know (new builders especially) that the RV is not the space shuttle and you can keep it simple and not fall out of the sky.

[pjc]

Originally Posted by DanH

Keith, can you recommend a particular book on the subject, suitable for the lay person?

Dan,
There are indeed (many) books already written on formal FMEA methods, they don?t need to be recreated on the fly. This may be more than you are looking for, but this textbook is a pretty comprehensive general reference (if expensive).

https://www.amazon.com/Effective-FME...90FJWJMVZCJYSZ

Originally Posted by DanH

In the context of homebuilders wiring systems, I'm written and illustrated that they should ignore the probability of failure, and concentrate on the effect of failure. I'd love to see how the two are properly combined, but my concern for such an approach in the EAB world is the classic GIGO problem...we have no good way to establish probability. Most of what we work with has no established failure rate, just an avalanche of marketing claims, so estimates of probability tend to be little more than opinion and belief. It works for religion, but it is not a basis for engineering.

Effect, on the other hand, can be established with some precision. If we fully examine the effect of each potential problem, it becomes possible to design for benign failure. There is no reason to be concerned with how often it fails if each failure is benign. And given enough time, everything fails anyway...100% probability.

While I agree absolute failure probabilities are generally difficult (expensive) to estimate (obtain), it is OFTEN the case that relative probabilities can be usefully obtained inexpensively. Simple FMEAs might simply use 1-3-5 or 1-6-9 relative probabilities to derive useful insights and point to the (relatively) most significant aspects of a particular design.

Arbitrary (binary) assumptions such as every part will fail with probability one, and every failure is (only) either benign or catastrophic, lead to some absurd conclusions.
Examples include: Never fly single engine over terrain without accessible landing sites (e.g Mountains or water) - because the engine WILL fail with catastrophic consequence. Or use only the CHEAPEST switches even when failure is not benign ? no sense in fancy, reliable MIL-Spec parts if our design assumes they WILL fail and we must accommodate that failure in the design (with added expense and complexity).

The decisions of most of us (single engine day VFR over mountains is ok, and better switches are worth paying for in ?important? applications) are inconsistent with the shortcut analysis we are attempting.

What I miss most in these discussions is a specific definition of acceptable post failure degraded operation. It seems many of us have different DESIGN criteria, in which case, different DESIGNS are to be expected. For example, do we require:
1). No loss of life? - just get me out of the IMC and on the ground
2). No property damage? - let me get down on an airport surface nearby
3). No impact on planned flight? - Must be able to continue to planned destination or alternate
4). No impact on current flight mission? - Must be able to continue to original destination
5). Must be able to continue until some predictable secondary failure (e.g.fuel exhaustion) ?
6). Must remain dispatchable (and legal) to return to home base?

And which ?added? demands can be made on the pilot?
- autopilot out of service?
- must use old school individual backup gauges?
- must reconfigure electrical loads manually ?
- must lower the gear manually ?
- must land without flaps ?

Peter

[DanH]

Originally Posted by pjc

Dan,
There are indeed (many) books already written on formal FMEA methods, they don?t need to be recreated on the fly. This may be more than you are looking for, but this textbook is a pretty comprehensive general reference (if expensive).

https://www.amazon.com/Effective-FME...90FJWJMVZCJYSZ

Effective FMEAs: Achieving Safe, Reliable, and Economical Products and Processes using Failure Mode and Effects Analysis

Failure Mode and Effect. Sure sounds familiar.

[snoop9erdog]

Originally Posted by Walt

So you have 4 relays and 2 contactors with how many switches controlling this system?

If you have 2 separate busses then your assumption must be that the buss itself and associated equipment on it can never have a fault and you're really just swapping power sources to those busses? What happens if you short/open one of those 'vital' busses, does everything continue to work?

The complexity of a full- up dual buss system with the associated cross tie relays and switches IMO just add to the number of failure points with little to offer for me to safely terminate a flight in the event of a power failure.

Honestly I think my single (mil-spec) relay and toggle switch work pretty good, and I'll bet my 3 batteries weigh much less than your 2 main batteries.

The back-up power source for my main instruments has one switch, no relays. Auto switch-over in the event the main power source fails.
The G5 obviously has no switches or relays.

I'm not trying to persuade anyone that my way is better, I'm just trying to let folks know (new builders especially) that the RV is not the space shuttle and you can keep it simple and not fall out of the sky.

Right on Mr. Walt. I came to the conclusion that a single battery, single Alternator, a single switch backup TCW IBBS (8 amps for an hour +) to run my efis and associated navigation, plus a G5 backup battery to keep the dirty side down........I will likely have a catastrophic bladder failure before my single engine fan up front runs out of dinosaur or electrons.

[DanH]

Originally Posted by pjc

Arbitrary (binary) assumptions such as every part will fail with probability one, and every failure is (only) either benign or catastrophic, lead to some absurd conclusions.
Examples include: Never fly single engine over terrain without accessible landing sites (e.g Mountains or water) - because the engine WILL fail with catastrophic consequence.

Nothing absurd at all. Simple mode and effect would indicate a failure over the mountains could be critical. It is why a pilot might consider a different route, just as the designer might consider a different wiring approach.

We do this sort of analysis naturally. The pilot may choose to fly over the mountains, but he did the analysis. The key here is that he made a guess at probability only after considering mode and effect.

[Waiex-guy]

There?s a parallel thread for battery specific claims of knowledge...which will make it easier to retrace in the future. Having said that.....

Carl, I think you are on the right track with two main batteries. In my opinion these backup batteries are expensive for what you get, which is very limited utility to....well, backup only. I question the reliability 13 months after install when you actually need it of this hidden battery that is supposedly always ready but probably only gets a real test once a year.

One question I do have. It seems a significant spike in voltage from let?s say a failure of the voltage regulator will shut down the earth X batteries. I?m sure you have over voltage protection, but it seems if that doesn?t protect you (another system sitting there for X months untested until you need it), you will zap both batts. Would it be worthwhile incorporating OV protection into each of the small feeder ?diode? relays? Are there other scenarios where having both batts connected for charge could result in loss of both?

[Carl Froehlich]

Gordon,

I recently recommended to a builder using EarthX to have multiple over voltage protection devices. My thinking:
- I?ve read the EarthX specifications on how they build into the battery over voltage protection. All well and good as this is a safety of flight issue.
- I?ve had a voltage regulator drift up in voltage on me, and the crowbar overvoltage circuit failed to trip the alternator. No harm done as the two PC-625 batteries just absorbed the excessive alternator output current for the few minutes it took me to figure out what was going on and to manually trip the alternator.
- Now let?s replay the same event with an EarthX battery. If my reading of the battery specifications is correct, the battery will trip off from the alternator in 2 seconds as terminal voltage exceeds 15.5vdc. So the battery is protected but now there is no sump to absorb the output of a runaway alternator. If memory serves this happened on an RV-8 using a non-EarthX battery and the panel saw voltages above 40vdc. The panel did not fair well.

So the point - two seconds is not adequate time for a pilot to recognize and take action, multiple crowbar over voltage protection schemes need to be incorporated as when you need this protection - you really need it. The function of the crowbar(s) is to trip off the alternator(s) as this is the only source that can create the overvoltage condition. Placement elsewhere thus makes no sense.

Parallel battery operation. Not a concern.

What happens if a battery goes bad? While unlikely (assuming the battery has not been abused) the first immediate action in my POH for any electrical issue is to open both battery master solenoids. This splits out the power to the panel and isolates any potential ?big current? event. Recovery from this is at pilot?s discretion as there is 1-3 hours of IFR flight battery reserve to provide analysis and action time.

Your comment on backup batteries is of interest (I do not use them). If asked I help any RV owners do maintenance. I alway check terminal voltage if a backup battery is used (most common is dual LightSpeed ignition installs). On more than one occasion I found the backup battery totally flat. While this fault is squarely on the shoulders of the owner, other than periodic checking there may be no outward warning of this must have backup failure to the pilot. I suspect after the thrill of flying hits some builders doing similar checks on backup systems may fall by the wayside.

Carl

[vic syracuse]

I almost hate to jump into this one, but it?s kind of hard for me to stay out of it. 😀

I get a fair number of airplanes that come to my shop due to electrical problems, and some are quite shocking. Some are downright dangerous and some border on criminal. Electrical systems seem to still be the weakest area for amateur aircraft builders. Many first timers get convinced they have to add all of these redundant systems, sometimes from reading all of the stuff on the various forums.

Safety through redundancy is not any good unless it is well executed. I?ve seen whole avionics busses run by an SD-8 alternator, and the owner not understanding why the backup battery on that second buss always needs charging when he lands. I?ve seen batteries in the back of the RV-10 without a master solenoid because they got convinced the solenoid is a failure point. So now they have a very large and unprotected wire from the battery to the firewall. Imagine the potential for a sparks and fire in the event of a crash, with no way to disconnect the battery.

I?ve seen the diodes used to separate the essential buss fail and cause smoke.

I?ve seen the backup battery for the electronic ignition have less than 2 volts on it because it was never wired properly to charge. Talk about a false sense of security. So for those of you with dual electronic ignition systems, make sure you check the backup failure on EVERY flight or run up.

Also seen way to many overflow tubes on pumps not installed. That doesn?t mean we should redesign the sytstem. We just need to install it correctly.

Simplicity is good at the end of the day. Battery technology is far much better than it used to be. The odyssey and EarthX batteries rarely fail in flight if properly cared for.

One buss, with one main battery, 2 alternators, and the backup battery for the EFIS really all you need. The G5 has its own backup battery as someone mentioned. So does the DYNON D3, which I place on the panel for instrument departures.

If you want a separate avionics buss, use a mil spec switch or a good relay. I do have a bypass switch wire directly to the battery just in case the relay should fail but have never ever used it.

For those with electronic ignitions, closely follow the manufacturers installation instructions.

I?ve used this same architecture on over a dozen airplanes, and never had a failure. It?s simple, robust, and the next owner can understand it as well.

Just my opinions here. But I really hate to see all of the complexity being added to some of our systems that we really just need to be simple and reliable. And done right.

Vic