Not all Redundancy is Created Equal!- part 1

[BMC_Dave]

Originally Posted by vic syracuse

One buss, with one main battery, 2 alternators, and the backup battery for the EFIS really all you need. The G5 has its own backup battery as someone mentioned.

Vic

Finally see my electrical plan described, yay! And here I was thinking I needed completely separate and redundant cross-fed busses... Not really, I know better, but someone new to all this could be easily scared into spending thousands to add a bunch of failure points reading some of these posts.

[Hartstoc]

Originally Posted by keitht

Interesting that the discussion departed from a philosophical discussion about redundancy to specific system examples without looking to attach actual demonstrated failure modes and failure rates to the required function availability.
This really is a subject that needs to be addressed from a mathematical and logical perspective based on probability of an event occuring and the consequences of that event coupled with any mitigation for dealing with the failure. Plotting probability of a system failure against the consequences of that failure as a function of severity results in areas of the graph where no redundancy is required and areas where even a single layer of redundancy is not adequate to mitigate the risk. Dual dissimilar redundancy generally doesnt have the risk of concurrent common mode failures even though the overall failure rate of one path may be significantly higher than other path. The time of exposure to the failure and the time of exposure after the first failure when using the redundant path is the more important consideration in that situation. There are a number of good books on the subject of system design that do a deep dive into failure modes and effects, redundancy, monitoring and reliability.
I would be interested in a numbers based discussion if anyone is interested.
KT

You rock!- Otis

[Hartstoc]

GREAT discussion here, folks! Thank you all!

My contention here with respect to electrical redundancy is that the advent of high power-density batteries has changed the whole ball game where electrons are concerned, and some new thinking is in order to properly take advantage of it. One personal conclusion- dual batteries now make more sense than dual alternators, and dual both makes no sense at all. I don?t expect everone to agree, though!

In case anyone has not noticed, I published Part 2 of this thread, which offers an approach to dual batteries and essential loads management that I have been working on for a long time and am now installing in my bird. Discussion there has already led me to one modification, so take another look at the schematic if you were an early visitor there.

Here is the link- Otis

http://www.vansairforce.com/communit...d.php?t=170109

[Walt]

Originally Posted by vic syracuse

I almost hate to jump into this one, but it’s kind of hard for me to stay out of it. ��

Simplicity is good at the end of the day. Battery technology is far much better than it used to be. The odyssey and EarthX batteries rarely fail in flight if properly cared for.

One buss, with one main battery, 2 alternators, and the backup battery for the EFIS really all you need. The G5 has its own backup battery as someone mentioned. So does the DYNON D3, which I place on the panel for instrument departures.

If you want a separate avionics buss, use a mil spec switch or a good relay. I do have a bypass switch wire directly to the battery just in case the relay should fail but have never ever used it.

For those with electronic ignitions, closely follow the manufacturers installation instructions.

I’ve used this same architecture on over a dozen airplanes, and never had a failure. It’s simple, robust, and the next owner can understand it as well.

Just my opinions here. But I really hate to see all of the complexity being added to some of our systems that we really just need to be simple and reliable. And done right.

Vic

As usual, Vic and I are in total agreement.

I pretty much make my living off replacing RV panels, we know from experience of what we speak.

[RV7A Flyer]

Originally Posted by Paul 5r4

Now the probability of failure thought. What are the chances of.....
1. alternator failure (in actual IMC). Yes, I know, if it fails that's exactly when it would!
2. after the alt fails, what is the probability of having a switch/relay direct from the battery to each electrical buss fail at the same time.

So stop right there...you are now designing at DUAL-fault tolerant system. This gets to one of the baseline requirements for any sort of fault protection engineering: Is the system required to be single-fault tolerant, dual-fault tolerant? Is it required fail-safe, or fail-operational? And so forth.

The OP listed a bunch of quality attributes that may get traded around to reach the design solution, but what are the underlying *requirements*?

Do we really design our aircraft to be dual-fault tolerant, fail-operational? That can be a very large undertaking if applied across the board.

[RV7A Flyer]

Originally Posted by DanH

Effective FMEAs: Achieving Safe, Reliable, and Economical Products and Processes using Failure Mode and Effects Analysis

Failure Mode and Effect. Sure sounds familiar.

Also, Fault Tree Analysis is a good method if done well...you end up with all potential fault causes, and then a choice to either mitigate them or accept them as SPF exceptions.

[kblack]

Vic, Walt:

I agree w/ the approach you have taken, and built my RV-7 along these lines. It has PlanePower main and backup alternators with the field on the backup supplied via a fused panel switch that is turned ON to verify operation before turning on the main alternator. I do have an Essential Bus that can be brought up via a fused panel switch if the main bus feed is OFF for some reason. So, I have the diode you guys would rather see omitted.

I was planning on building my -10 the same way, but am starting to rethink a couple of things.

Questions I'm hoping the forum will address:

1. Essential Bus - I like it, but I also do not like using a diode to tie it the main bus. Thoughts on simply using a SPDT switch or relay to select either main bus or fused battery feed to the Essential Bus? I guess this is essentially the same as an Avionics Bus configuration mentioned by Vic, except I have a couple of things on there in addition to avionics.

2. LiFePo4 Battery - I am considering an EarthX ETX-900-VNT for the main ships battery. After studying the technology, I am concerned about the consequences of a complete shutoff caused by the internal protection circuits - a failure mode not enjoyed by lead-acid batteries. This would lead to a system with no battery sink and possible alternator over-voltage. Big concern, or no? If a concern, what are some viable options?

[Dugaru]

Originally Posted by vic syracuse

I?ve used this same architecture on over a dozen airplanes, and never had a failure. It?s simple, robust, and the next owner can understand it as well.

I'm not an electrical engineer, I don't play one one TV, and I didn't spend last night at a Holiday Inn Express.

BUT, perhaps for these very reasons, I actually am a guy who experienced a completely dead panel during an IFR flight (in VMC) one dark-but-not-stormy night a few months back. My adventures were detailed in a previous thread. My key discoveries, for what they're worth:

- Vic makes some important points above. For example, I was a subsequent owner who didn't sufficiently understand the builder's electrical setup. I probably would have spared myself some headaches if I had understood it better.

- A Garmin G5 with built-in battery (or the Dynon, etc. equivalent) is a HUGELY useful gadget in terms of redundancy. I experienced basically zero safety-of-flight drama thanks to the G5 running on its own battery. Didn't even need to turn on my headlamp flashlight. After my experience I can't fathom why anyone would install a G5 or the equivalent WITHOUT the backup battery. If anyone is out there considering doing that, please don't.
These gadgets solve a ton of potential problems when they have their own power.

- Throw in an iPad with its own GPS running Foreflight (or the equivalent) and you are giving up almost nothing in terms of navigation and situational awareness, even with the rest of the panel napping.

- Here's a redundancy issue that never occurred to me: I carried a handheld radio dutifully, every flight, for years. For redundancy, of course. But I discovered that night that a Yaesu handheld with a "half" battery indication may receive just fine, while being unable to *transmit* anything. As luck would have it, I just harumphed on that very topic in a different thread!

And I discovered that transmitting is a really big deal at night! Forget talking to ATC, although that would obviously be nice. You ALSO need to turn on the lights somewhere, or else go barreling silently into a Class C or worse, looking for light gun signals. Yikes.

So, my (potentially ignorant) ideas re: redundancy?

1. Garmin G5 or equivalent with built-in backup battery
2. iPad with GPS running Foreflight, or equivalent, with a USB battery pack
3. For night flight: TWO handheld radios. Seriously, I really needed another radio!

[Hartstoc]

Originally Posted by kblack

Vic, Walt:

I agree w/ the approach you have taken, and built my RV-7 along these lines. It has PlanePower main and backup alternators with the field on the backup supplied via a fused panel switch that is turned ON to verify operation before turning on the main alternator. I do have an Essential Bus that can be brought up via a fused panel switch if the main bus feed is OFF for some reason. So, I have the diode you guys would rather see omitted.

I was planning on building my -10 the same way, but am starting to rethink a couple of things.

Questions I'm hoping the forum will address:

1. Essential Bus - I like it, but I also do not like using a diode to tie it the main bus. Thoughts on simply using a SPDT switch or relay to select either main bus or fused battery feed to the Essential Bus? I guess this is essentially the same as an Avionics Bus configuration mentioned by Vic, except I have a couple of things on there in addition to avionics.

2. LiFePo4 Battery - I am considering an EarthX ETX-900-VNT for the main ships battery. After studying the technology, I am concerned about the consequences of a complete shutoff caused by the internal protection circuits - a failure mode not enjoyed by lead-acid batteries. This would lead to a system with no battery sink and possible alternator over-voltage. Big concern, or no? If a concern, what are some viable options?

1-The reason for charging of the reserve battery via a diode is to eliminate the possibility inadvertantly discharging both batteries in the event of an un-noticed alternator failure, leaving you up the creek in an electron-dependant airplane. Try turning off the alternator field some time with all your lights and avionics working and observe how fast the battery can run down, it is breathtaking In the design I present in part 2, the twin batteries are utterly interchangeable, but there is always one being charged directly off the main bus, and the other being charged via a Schottky diode, which does have a small forward voltage drop. Switching their roles during a long flight is routine and easy, though.

2- this is the main reason my airplane will have two of them- fortunately they weigh only about five pounds each! Please take a look at part 2 if you have not done so- Otis

[Walt]

Originally Posted by kblack

Vic, Walt:

I agree w/ the approach you have taken, and built my RV-7 along these lines. It has PlanePower main and backup alternators with the field on the backup supplied via a fused panel switch that is turned ON to verify operation before turning on the main alternator. I do have an Essential Bus that can be brought up via a fused panel switch if the main bus feed is OFF for some reason. So, I have the diode you guys would rather see omitted.

I was planning on building my -10 the same way, but am starting to rethink a couple of things.

Questions I'm hoping the forum will address:

1. Essential Bus - I like it, but I also do not like using a diode to tie it the main bus. Thoughts on simply using a SPDT switch or relay to select either main bus or fused battery feed to the Essential Bus? I guess this is essentially the same as an Avionics Bus configuration mentioned by Vic, except I have a couple of things on there in addition to avionics.

2. LiFePo4 Battery - I am considering an EarthX ETX-900-VNT for the main ships battery. After studying the technology, I am concerned about the consequences of a complete shutoff caused by the internal protection circuits - a failure mode not enjoyed by lead-acid batteries. This would lead to a system with no battery sink and possible alternator over-voltage. Big concern, or no? If a concern, what are some viable options?

My thoughts:
Ess buss was designed as an easy way to load shed, I can do that myself by turning off unnecessary equip.
LiFePo, the risk is not worth the weight saving to me.
B&C primary and back-up alternators is my power of choice, BU alt is always 'on' (turn off the main in flight occasionally to check it).