Not all Redundancy is Created Equal!- part 1

[Brantel]

Originally Posted by Hartstoc

1-The reason for charging of the reserve battery via a diode is to eliminate the possibility inadvertantly discharging both batteries in the event of an un-noticed alternator failure, leaving you up the creek in an electron-dependant airplane. Try turning off the alternator field some time with all your lights and avionics working and observe how fast the battery can run down, it is breathtaking In the design I present in part 2, the twin batteries are utterly interchangeable, but there is always one being charged directly off the main bus, and the other being charged via a Schottky diode, which does have a small forward voltage drop. Switching their roles during a long flight is routine and easy, though.

2- this is the main reason my airplane will have two of them- fortunately they weigh only about five pounds each! Please take a look at part 2 if you have not done so- Otis

Most properly configured and installed EMS equipped airplanes will alert the pilot within 30 seconds of the charging system going off line. Mine will almost instantly.

[keitht]

In reply to Dan H requesting a reading list for books on the subject. Sorry for my delay in replying - I was on my way home after attending build school and building the engine for my RV-7A (IO-360 with dual Pmags) in Kamloops with Aerosport Power. Great experience! Great people! and I learned a lot.

Here is a list to work from.

Systems Reliability Theory: models, statistical methods and applications by Raus & Hoyland published 2003

Mission Critical and Safety Critical Systems Handbook.

NASA Systems Engineering Handbook. 1995 revised in 2007 and 2013. An excellent tome aimed at new graduates and working design engineers.

Fault tolerant Design by Dubrova

Reliability, Maintainability and Risk by Smith 2005

Introduction to Reliability Engineering by E. Lewis 1987

BTW - I completely agree with Walt and Vic. Very sage advice!

The art of good engineering is in balancing the compromises that are necessary. At a large Kite factory I worked for up here in the pacific northwest there was a saying that was often heard during system design reviews " The system needs to be as simple as possible but no simpler than necessary".
Another approach that works well during preliminary design when fleshing out a system is to work backwards from the system availability requirement towards the individual blocks in the diagram and then putting some placeholder generic target failure rates in the blocks. Then looking at typical components and likely achievable failure rates. E.g. in some applications a cheap radio shack switch with a relatively high failure rate will meet the requirement in other locations a full mil spec switch with defined performance and much lower failure rate is necessary. I am not advocating using cheap poor quality switches but you get the point. Where you can't make the numbers with the highest quality components then is the time to consider redundancy, path monitoring and the method of switching from one path to the alternate. A point to always consider is that two parallel paths with individual failure rates of 1: 1million hrs (1E-8 per hr) with a control switch selecting the active path with a failure rate of 1E-3 results in the system having a failure rate of approx 1E-3 so switch reliability, system monitoring and failure modes are very important. I always aimed for a failure rate for the monitor at least an order of magnitude lower (and preferably a much lower failure rate) than the path being monitored.
At the end of the day we are operating a single engine airplane with a demonstrable very reliable powerplant (only those of us using aircraft specific engines) but still having single point failures (most notably the quality of the fuel) so the electrical system needs to be at least as reliable as the powerplant and preferably a order or two more reliable. So this forms the basis for a starting point for designing the electrical system using the "working backward" method if you should choose to consider that approach. My guess is you will converge quite rapidly on the advice provided by Walt and Vic.

KT

[444TX]

We have a new problem that must be worked out and solved. The new system to be designed and perfected, as well as possible, is the "Engine Bus".

Many here desiring to install electronic fuel injection are chasing the innovation without looking at all the potential pitfalls that come with it. What are the benefits of the EFI system over a carburetor or mechanical fuel injection. I will argue, considering the risks, that there are none for 90+% here.

Many risks with little reward. Do builders planning EFI and IFR recognize this? We must keep the engine running. Fuel in the tanks should be the limiting factor, not battery reserve capacity.

George Meketa

[gasman]

Originally Posted by 444TX

We have a new problem that must be worked out and solved. The new system to be designed and perfected, as well as possible, is the "Engine Bus".

Many here desiring to install electronic fuel injection are chasing the innovation without looking at all the potential pitfalls that come with it. What are the benefits of the EFI system over a carburetor or mechanical fuel injection. I will argue, considering the risks, that there are none for 90+% here.

Many risks with little reward. Do builders planning EFI and IFR recognize this? We must keep the engine running. Fuel in the tanks should be the limiting factor, not battery reserve capacity.

George Meketa

A total EFI failure can be backed up for under $100.00

Hint........ http://www.vansairforce.com/communit...&postcount=140

[DanH]

Originally Posted by keitht

In reply to Dan H requesting a reading list for books on the subject.

Thank you, much appreciated.

Another approach that works well during preliminary design when fleshing out a system is to work backwards from the system availability requirement towards the individual blocks in the diagram and then putting some placeholder generic target failure rates in the blocks. Then looking at typical components and likely achievable failure rates.

In the EAB world, it's very difficult to find realistic failure rate information. Lots of opinion, vendor claims, and marketing, but not much actual data. How would the average builder establish "likely achievable failure rates"?

[rv6ejguy]

Originally Posted by DanH

In the EAB world, it's very difficult to find realistic failure rate information. Lots of opinion, vendor claims, and marketing, but not much actual data. How would the average builder establish "likely achievable failure rates"?

+1 on Dan's comment here. In the end, I recommend you have a simple, manually activated way to get backup power to your critical systems using the minimum number of components (connections, switches, relays, diodes, contactors etc.)

I'd approach it from the angle that the primary system WILL fail at some point. Design with that thought in mind. I see these discussions often recommending overly complex designs for backup power and trying to estimate MTBF using unavailable data. The more parts that are there can often mean decreased reliability.

[Carl Froehlich]

Originally Posted by DanH

SNIP...
In the EAB world, it's very difficult to find realistic failure rate information. Lots of opinion, vendor claims, and marketing, but not much actual data. How would the average builder establish "likely achievable failure rates"?

Right on point.

While our airplanes are experimental, safety of flight should not be. If you don?t have data to determine likelihood of a component failure, then approach risk management by determining the outcome an any single component failure. This leads to:
- For my mission, can I live with the failure? If so then move on.
- If I cannot live with the failure, what design changes are needed to mitigate the failure?

Talking with people on such stuff I note with concern many limit application of this approach beyond the simplistic alternator failure.

Carl

[DanH]

Keith has been around the track a few laps. Let's hear him out.

[rv6ejguy]

Originally Posted by Carl Froehlich

Right on point.

While our airplanes are experimental, safety of flight should not be. If you don?t have data to determine likelihood of a component failure, then approach risk management by determining the outcome an any single component failure. This leads to:
- For my mission, can I live with the failure? If so then move on.
- If I cannot live with the failure, what design changes are needed to mitigate the failure?

Talking with people on such stuff I note with concern many limit application of this approach beyond the simplistic alternator failure.

Carl

I think we are talking about electrically dependent aircraft here, so you can't live with a failure of electrons flowing to the EI, EFI or electric fuel pumps -period. You better have a reliable backup system unless you want some glider practice.

[johnbright]

Originally Posted by gasman

A total EFI failure can be backed up for under $100.00

Hint........ http://www.vansairforce.com/communit...ht=dave+anders

Need another hint please.