Mailing List lml@lancaironline.net Message #39111
From: <Sky2high@aol.com>
Sender: <marv@lancaironline.net>
Subject: Re: [LML] System level reliability
Date: Thu, 21 Dec 2006 17:05:37 -0500
To: <lml>
In a message dated 12/21/2006 1:44:38 A.M. Central Standard Time, fredmoreno@optusnet.com.au writes:

I originally ordered my engine with dual Lightspeed ignition systems and designed my electrical supply system accordingly.  I have since learned that Lightspeed no longer ships dual ignition systems, and only recommends a single Lightspeed and a single magneto as backup.  It was reported to me that the problem was NOT the Lightspeed ignition systems, but rather the LACK of reliability with experimental aircraft power systems.  Apparently too many forced landings have occurred because of total electrical failures.

Fred,
 
Well, I am ready to comment.
 
This morning I sent the following email to Klaus:
<<<<<<<<<<
 
Klaus,
 
It was reported on the Lancair Mail List that Light Speed Engineering is no longer shipping/selling dual ignition systems and only recommends a single system with a mag backup because of too many experimental aircraft's unreliable electrical systems.
 
I find this hard to believe.
 
Can you tell me if this is true?
 
Scott Krueger
Lancair 320 N92EX, Dual Plasma III System with crank sensor, Essential bus arrangement and backup battery for the primary ignition.
1st Place, 2006 Air Venture Cup Race Formula RG Red Division. 232.8 mph.
1st Place, 2006 Redmond 100 (Lancair factory), 320 Division and beat 6 of the 7 360 powered Lancairs, 242 mph.
>>>>>>>>>>>>>>>>
His reply was just received:
{{{{{{{{{{{{{{{{{
Thanks for letting me know and also for your support on the List(s). I can't monitor them and set things straight, that would be a full time job. 
There was a concern for a while when we had a few sensor failures on the Continentals used on Lancairs. The engine builder would set up the proper clearance per our instructions, test run the engine and deliver it. The proud owner would then install his own baffeling between the case and our mounting bracket. This would reduce the clearance to the point that the sensors could get damaged. 
We are now shipping all Direct Crank Sensor boards with the new "Skip plate" that will protect the sensors when there is interference. This makes the DCS board practically indestructible.
Now that we have these components available, we are shipping single and dual Plasma Systems on a daily basis. There never was an issue with the Lycoming engines.
Please see the service bulletin on our web page also.

Keep up the good work.

Klaus Savier
Light Speed Engineering
P.O. Box 549
416 E. Santa Maria St. #15
Santa Paula, CA 93060
Tel: (805) 933-3299  Fax: (805) 525-0199
}}}}}}}}}}}}}}}}}}}}}}}}}}
 
The lack of reliability is sometimes in the reporting of problems, causes and solutions.  Here it was the failure of the builders to understand the TCM engine package that was bought and the importance of the sensor position. 
 
I have no problem with my dual LSE ignition by relying on the Essential Bus distribution system and a backup battery for 1/2 of the ignition system in case there is some weird sort of unforeseen total electrical failure.  That is also why the header tank is automatically maintained with at least 8 gallons of fuel at all times as it is the single non selectable 100LL source for the engine. 

It would be interesting to know the causes of total electrical system failures in experimental aircraft, but we shall probably never know.  My guess: a combination of poor system architecture coupled with poor workmanship standards on things like connectors, couplings, joints, wire chaffing protection and such.

Is that because you already know the causes and consequences of TOTAL electrical failures in STC SEL aircraft, like Cessnas?  From my perspective, they are the same except that an experimental builder has the opportunity to do better and often does.  Elder* Cessna aircraft (I have some experience) use crappy components and connectors and are frequently full of architecture and design shortcuts used to save MONEY, not lives.  Of course, it would cost even more money to improve those faults that become known.  It seems that the most frequent total electrical system loss in an old standard aircraft is usually because of alternator failure and complete battery depletion - not usually seen in time by the pilot because there were no idiot lights like "ALT OUT".  Instead there has been reliance on scanning the ammeter (if present).  Everybody includes the obscurely placed ammeter in their 30 second scan, don't they? 
 
*Elder aircraft = those produced before modern competition (like Cirrus, Columbia, Diamond, etc.) began to appear.    

The correct approach to system architecture has been demonstrated by the FAA approval of all-electric single engine night/IFR airplanes such as Columbia.  I attach (which I have done before) the system architecture for the Columbia from the pilot’s operating handbook.  You can go to the www.fly-columbia.com web site and download the POH, a PDF document, for a cleaner copy.

Sorry, I cannot trust that the FAA knows any better than an experimental aircraft builder that actually built his/her airplane and studied available information on how-to-do-it.  Uh, aircraft built for personal education and recreational use (I know I have read that phrase somewhere).  Yes, the current FAA requirements seem better - maybe they learned something from experimental builders.  I know Cessna has for their LSA entry.
 
I concur with most of your succeeding points - one should consider the environment and mission of the plane and its systems when one is designing in safety and redundancy - to some reasonable level.  One of the things the builder cannot fix with hardware is the loss of life from serious lapses of judgement, training and knowledge in the other single-point failure, the pilot. 
 
Thanks for the brain tickler,
 
Scott Krueger AKA Grayhawk
Lancair N92EX IO320 SB 89/96
Aurora, IL (KARR)

A man has got to know his limitations.
 
 
As noted elsewhere, the key to best reliability is redundancy and absence of single point failures that by themselves can bring you to grief. 

Common (and not so common) single point electrical failure sources can include

  • batteries,
  • relays,
  • circuit breakers,
  • wire terminations,
  • chaffed wires causing tripped circuit breakers,
  • attachment nuts or screws coming off,
  • vibration-induced mechanical failures of attachments and structures,
  • etc.  

 If the probability of a single point failure is one in one thousand per flight hour (vacuum pumps are worse), the probability of two such independent failures occurring in the same hour is one in one million.  Here we presume the failures are not linked.   Linkage might include two alternators driven by a common belt, a lightning strike, failure of the crankshaft, etc.  

My recollection is that FAR 23 requires a quantitative safety case to be made that shows the probability of a failure or set of failures causing loss of aircraft is less than one in ten million.  I presume that the Columbia electrical system was able to satisfy this type of analytical scrutiny.  Thus the architecture used offers us an excellent starting point to design our own systems for maximum safety and reliability. 

I tried to simplify Columbia diagram with the sketch attached.  Please forgive my lack of Autocad drafting skill.  The sketch suggests a simplified architecture that builders might start with as a basis for their electrical power distribution systems.  I would suggest that we kick it around a bit, and then perhaps somebody with greater skills than mine can generate a clean drawing that includes the collective wisdom gathered from multiple inputs.  It could then be referred to in the community as a well-conceived starting point for electrical system design. 

Some notes: Diode feed of avionics buss and essential buss provides automatic supply of power in the event of a buss failure, but the pilot could remain unaware of the bus failure because of this automatic operation.  Therefore, I believe that an integral element must be pilot notification of a buss failure via a low voltage alarm.  

In my case, electrical system design started with the recommendations of Bob Nuckolls’ in Aeroelectric Connection.  I then revised it to incorporate some of the features of the Columbia system, modified to reflect limitations and options on my own aircraft.   

As an example, Columbia carries two large alternators.  My IO-550 is configured to carry one large alternator (70 amp) and one smaller B&C alternator (20 amps).  So I use the big alternator on the A buss and connect the high current stuff like hydraulic pump, landing lights and such, and put smaller loads on the B buss.  If the A buss fails (alternator failure, for example) I know immediately to shed load to get the total system load under 20 amps to prevent the excess being drawn from the B battery.  During the load shedding, I can keep the airplane upright at night in IFR because the essential instruments remain operational throughout the event.  For my airplane, this includes the Chelton primary flight display, back up instruments (including RC Allen electric attitude indicator) and their night lighting, and the single Lightspeed ignition system.   

I would not treat a single buss failure as an emergency, but I would put the airplane on the ground ASAP before another failure occurs.   Going back to the earlier example, if you are working with one in one thousand failure rates, and one system dies, then the chances of the rest of the system dying is one in one thousand in the next flight hour, not one in one million.  One in a million applies to both systems failing (a total system failure) in the same flight hour.  So when one system fails, you have used a good portion of your nine lives already.  Conserve those that are left.   

Personally I think one in one thousand is lousy odds, so it is time to put the airplane on the ground quickly when the odds have slid this far as would happen if one system fails. 

As another adaptation, a lot of folks here are using Chelton flight displays.  When equipped with the Pinpoint GADAHRS and magnetic sensing units, you will find that they are designed to permit dual independent power supplies from separate busses.  So you can connect only one of these supply lines to the essential buss (forgetting the other) or (preferably) connect each individual supply line to each buss to get as close as possible to the electrical supply (battery and alternator). 

With our complex and high performance experimental aircraft, I think it is high time to propose some “experimental standards” for system designs that provide enhanced reliability.  I would suggest that some attention to the electrical system design and development of a “recommended electrical architecture” is a good place to start.  

Your comments, please.

 
Subscribe (FEED) Subscribe (DIGEST) Subscribe (INDEX) Unsubscribe Mail to Listmaster