Not all Redundancy is Created Equal!- part 1

[keitht]

I would agree that getting ?actual? failure rate data is quite difficult unless you have access to the database that most large aerospace companies maintain (which I don?t). However there is an approach that works. Looking a generic parts and assigning a failure rate number that looks reasonable on a comparative basis.
For example
Good quality double pole manual switch 1E-6 per hour
Single Diode ( correctly rated) 1E-9 per hour
Contactor type relay (master bus switch) 1E-5 per hour
Large PFD (HDX, G5) 1E-5 per hour ( range could be 1E-4 to 1E-7 depending on failure modes.
This is just a short list but you get the approach.
Looking at failure modes has to be part of the process too.
Failure rates considered so far are the mature failure rates ( bottom of the bathtub curve). Burn in (infant mortality)and end of life failures will be quite different rates and modes. Failures that are a cascading consequence of a primary failure have to be considered. Eg. alternator over voltage resultant from a alternator regulator failure that takes out a primary flight display (PFD), ADAHRS etc. so the level of protection for bus overvoltage may need to be 1E-9 per hour depending on if you are planning on flying hard IFR at night. This would certainly require at least two independent levels of protection that need to be checked on a regular basis so the period of exposure to latent failures is kept under control.
I would say that doing this kind of work for the first time will be a steep learning curve and I have found that those accustomed to doing it have a particular mindset that takes time and experience to aquire just like those experienced in mechanical engineering design can look at a design and indicate where the design can be trimmed and where the weak spots are.
I am designing an electrical system for an RV-7 with IO-360B1B dual Pmag with 60 amp belt driven alternator and gear driven 30 amp alternator, single oddessy battery, dual HDX with Dynon backup batteries, dual ADAHRS, dual GPS, autopilot, GNC255, GTR200 (gentlemans IFR). I ended up very close to the Bob Nuckolls figure Z12 design. Bob had really thought it through and presents a well balanced design that if implemented with good quality components and materials will get the job done. I am a firm believer in leveraging off what already exists, is available and comes from a reputable source with a known track record. I would encourage the approach of starting from a known proven baseline and iterating from there or just going with the known proven.

KT

[444TX]

Originally Posted by gasman

A total EFI failure can be backed up for under $100.00

Hint........ http://www.vansairforce.com/communit...ht=dave+anders

This backup system is not new or innovative. Similar systems were installed on Cessna 185s used for missionary work. I had read about it years ago, but recently have not been able to find any information. My neighbor has a missionary friend who flew 185s who said the systems were removed on their planes and had resulted in an accident when a pilot attempted to test fly the system.

Not a system for the average guy. Dave Anders is far from average. (read: takes 5 seconds "now", pull breakers, flip 2 switches, throttle for mixture control)

Is this a real backup for EFI and IFR. Yes and no. It does not solve the "engine bus" for EFI design issue. You need a running electric pump or design a mechanical pump backup system. At least one ignition must be working. Requires detailed understanding of the system. Has high pilot workload reuirement. Need real life testing. This is not realistic for most builders.

I enjoy reading about all the things that Dave, Dan and Ross are doing, but they make it look easy. Are they realistic for an even above average builder? I vote no. Time, diligence, testing, knowledge, evaluation, fabricating, rebuilding, research, repeat, etc. are all required, at the same time.

George Meketa

[gasman]

Originally Posted by johnbright

Need another hint please.

Here you go...... http://www.vansairforce.com/communit...&postcount=140

From Dave Anders.....

I do have a totally separate fuel source if for any reason I lose the injector circuit or ECU or both if I even had a bus failure.

I have a separate fuel line from the your fuel plenum to a fuel solenoid valve on the plenum side of the throttle body behind the butterfly that feeds a 6.3 gph Mister from McMaster Carr, so all I need to stay in the air is 1 working ignition (either), 1 working fuel pump (either) and either the main or backup battery which can be isolated from the main bus.

I have shut down everything in the air and tested the system. It draws about 3 amps at low rpm and at 7500? it trues about 190 mph. At that rate I?ll run a out of fuel before I have to land. Well that may be an exaggeration because I only flew about 100 miles that way and it was doing fine on just the main battery. Of course, the throttle becomes the mixture control. It takes me about 5 seconds now pulling breakers and flipping 2 switches to effect the change and I have practiced that."

[rmartingt]

Originally Posted by 444TX

Is this a real backup for EFI and IFR. Yes and no. It does not solve the "engine bus" for EFI design issue. You need a running electric pump or design a mechanical pump backup system. At least one ignition must be working. Requires detailed understanding of the system. Has high pilot workload reuirement. Need real life testing. This is not realistic for most builders.

Redundant, reliable power for EFI and associated components doesn't have to be a "high pilot workload". Feed your engine bus right off the batteries through diodes. Separate circuits for each critical component so one failure doesn't take them all down. Done right, the failures aren't that different workload-wise from a failure on a mechanical system. In fact, it's been proposed that this should be a design goal.

I'd also argue that it's no longer "not realistic for most builders". Engine buses and power for EFI (as well as the pros and cons for EFI itself) have been discussed ad nauseum here on VAF, and as more builders blaze that trail and document their work, the community will eventually gain a couple of thought-out documented systems to implement.

[DanH]

Originally Posted by keitht

I would agree that getting “actual” failure rate data is quite difficult unless you have access to the database that most large aerospace companies maintain (which I don’t). However there is an approach that works. Looking a generic parts and assigning a failure rate number that looks reasonable on a comparative basis.

Keith, clarify for me please. Using the "looks reasonable on a comparative basis" approach, the actual rate numbers are basically an educated guess, the real goal being to write down what you believe to be fair comparisons between component choices?

For example, you offered...

Single Diode ( correctly rated) 1E-9 per hour
Contactor type relay (master bus switch) 1E-5 per hour

...which would be one in a billion vs one in 100,000, or put another way, the fail rate for a diode is 10,000 times better than for a contactor?

[rv6ejguy]

Of course we should strive to make our primary electrical system as reliable as possible through good design and choice of components however, the risk assessment doesn't doesn't mean much if that system fails and there is no backup. You'll still be in a pickle...

That Mil Spec switch rated for 100,000 cycles still could fail the 200th time you use it.

With regards to electrically dependent aircraft, we've had 24 years supplying and supporting them and based on tech and feedback over that time, the #1 cause of no electrons flowing is poor wiring practices- ground and power connections/ bad crimps, #2 is routing near sharp and hot stuff with inadequate thermal and chafe protection, #3 poor strain relief and support. Switch gear stuff is well down the list in causing issues.

Pick all the high dollar components you want but more important is HOW the electrical system is put together.

[keitht]

Dan,
The failure rate spread between a single diode and a mechanical switch is in that order. MIL- HBDK-217 F is, I believe the last version published of the bible for component failure rate calculation based on component, package style, environment and derating. MIL - HDBK - 217 is available on line but is generally not used anymore - the calculated numbers give a prediction that may be too pessimissive in some cases and the MIL method has fallen out of favor. It is worth looking at it on line to get a feel for the process used and the spread of numbers across component types.

Rv6ejguy,
I agree - a component could fail way outside of its predicted failure rate range (in either direction) but the probability is that it will not unless there is a flaw or large variability in the manufacturing processes used. That premise and the expectation that component failures are independent events and not related form the basis for most design solutions. The FMEA that is performed and the probability of each category of failure and the consequences of that failure are reviewed on the chart of probability versus consequences. If the consequences are insignificant then the probability (from a safety viewpoint) could be high that the event will occur. It may not be acceptable from a customer viewpoint but we are primarily concerned with availability and safety. Conversly if the consequences are serious then the probability must be small - very serious, then much smaller. Getting struck by lightning,having a wing spar failure or having the engine stop making noise are all good examples - very low probability - very serious consequences. Some days its not a good idea to get out of bed.

KT

[DanH]

Originally Posted by keitht

Dan,
The failure rate spread between a single diode and a mechanical switch is in that order. MIL- HBDK-217 F is, I believe the last version published of the bible for component failure rate calculation based on component, package style, environment and derating. MIL - HDBK - 217 is available on line but is generally not used anymore - the calculated numbers give a prediction that may be too pessimissive in some cases and the MIL method has fallen out of favor. It is worth looking at it on line to get a feel for the process used and the spread of numbers across component types.

Yep, available here:

https://snebulos.mit.edu/projects/re...7F-Notice2.pdf

Some of the differences in failure rate are surprising, although to be fair, the book deals with MIL spec stuff, not necessarily the same as what is available to the EAB market.

Example base rates, 10^6

toggle switches 0.10

fuses 0.01

thermal circuit breakers 0.34

The FMEA that is performed and the probability of each category of failure and the consequences of that failure are reviewed on the chart of probability versus consequences. If the consequences are insignificant then the probability (from a safety viewpoint) could be high that the event will occur. It may not be acceptable from a customer viewpoint but we are primarily concerned with availability and safety. Conversly if the consequences are serious then the probability must be small - very serious, then much smaller. Getting struck by lightning,having a wing spar failure or having the engine stop making noise are all good examples - very low probability - very serious consequences. Some days its not a good idea to get out of bed. KT

Thanks Keith. For now I may stick with teaching straight wire-by-wire failure mode and effect, without probability, just because it is simple. God knows, it's hard enough getting folks to do any analysis at all. As you say, if design review leads to choices with insignificant failure consequence, probability is not a big deal. Buy good quality components, assemble carefully, go fly.

That said, the information you're introducing appears to be very useful for the big picture choices...fuse vs CB, or diode vs contactor, for example.

[444TX]

Originally Posted by rmartingt

Redundant, reliable power for EFI and associated components doesn't have to be a "high pilot workload". Feed your engine bus right off the batteries through diodes. Separate circuits for each critical component so one failure doesn't take them all down. Done right, the failures aren't that different workload-wise from a failure on a mechanical system. In fact, it's been proposed that this should be a design goal.

I'd also argue that it's no longer "not realistic for most builders". Engine buses and power for EFI (as well as the pros and cons for EFI itself) have been discussed ad nauseum here on VAF, and as more builders blaze that trail and document their work, the community will eventually gain a couple of thought-out documented systems to implement.

My reply was about a backup fuel system that is used by Anders if the EFI goes down in his plane. While a simple system, it is not so simple to design and use.

I still strongly believe that if you have an EFI system there must be an ?engine bus? that is independent of the rest of the electrical system, except for the batteries. If you have smoke in the cockpit you can shut off the master and have only the engine bus connected to the main battery/batteries. The essential bus should be seperate.

I flew a friends RV8 and had a large amount of smoke roll out from under the panel at 10,500 feet over Houston. (Smoked wig/wag controller) When the master was shutoff there was no essential bus, thus no electric trim. I made an emergency landing in Beaumont. Go Land your plane with cruise trim. Now try it in simulated IFR conditions.

If there was EFI installed, with an electrical system designed like many describe here, there would be the choice of more smoke in the cockpit or no engine. Now fill your cockpit with smoke, shut the engine off and land under simulated IFR conditions.

There is a lot to be considered if EFI is installed. Reliable EFI system, independent and robust bus design, quality install, quality install supplies, system knowledge. This is not close to mature enough for the average builder. These bus (with EFI) designs proposed here are far too complex and/or not independent enough, plus battery capacity is not properly evaluated or tested. This is not experimenting for most, it is searching for modernization of an extremely reliable and efficient system without evaluating the responsibilities involved.

I have a friend with a nice G500 panel in his 206. He had two batteries and would keep one charged and switch them out every couple of months. I asked about his battery capacity and he felt comfortable; the plane always started fine. I talked him into capacity testing the batteries. One was 5% the other 10%. He had 3 and 6 minutes of battery reserve and was extremely suprised. How often do you properly test your battery? EFI changes everything. The battery is not optional, in an emergency it is essential.

It is obvious that most do not really know what they are getting into with EFI. The few here that do make it look so easy and safe that it lulls others to follow. I would love to have EFI in my plane and have the ability to do so safely, but know I will not want to spend the time necessary to properly install it, properly tune it and keep experimenting in an organized way to get the small advantages it gives over conventional fuel injection.

Engine only EFI bus, two properly sized and tested batteries with capacity for several hours of flight, two Honeywell TL double pole switches for bus power, two quality diodes to isolate batteries from each other, current limiters or large fuse link power from batteries, fuel pumps on breakers (not fuses), Honeywell TL switches for fuel pumps. This is a start for a robust system.

I am seeing a real safety issue with this and will continue to comment on it. Maybe not in the best way possible, but in the only way I know; sceptical and in search of safety.

This will soon be another dead thread in the archives. Then, on to the next EFI, all electric IFR, lithium battery, etc. thread. If not brought up again and again the things experienced people like Vic and Walt keep fighting for will be lost in the past. Do not blame us for ad nauseum.

George Meketa

[Walt]

Originally Posted by 444TX

There is a lot to be considered if EFI is installed. Reliable EFI system, independent and robust bus design, quality install, quality install supplies, system knowledge. This is not close to mature enough for the average builder. These bus (with EFI) designs proposed here are far too complex and/or not independent enough, plus battery capacity is not properly evaluated or tested. This is not experimenting for most, it is searching for modernization of an extremely reliable and efficient system without evaluating the responsibilities involved.

It is obvious that most do not really know what they are getting into with EFI. The few here that do make it look so easy and safe that it lulls others to follow. I would love to have EFI in my plane and have the ability to do so safely, but know I will not want to spend the time necessary to properly install it, properly tune it and keep experimenting in an organized way to get the small advantages it gives over conventional fuel injection.

I am seeing a real safety issue with this and will continue to comment on it. Maybe not in the best way possible, but in the only way I know; sceptical and in search of safety.

George Meketa

George -

I totally agree with you, I talk to lots of new builders who think they have to have the "latest and greatest" engine FI/ign system without really understanding what they are getting into.

I always ask what are the advantages vs risk, from where I sit the advantages are minimal with a substantial increase in risk (not to mention the increase in cost).