{"id":9901,"date":"2015-05-09T14:41:55","date_gmt":"2015-05-09T21:41:55","guid":{"rendered":"http:\/\/cafe.foundation\/blog\/?p=9901"},"modified":"2015-05-09T14:41:55","modified_gmt":"2015-05-09T21:41:55","slug":"eas-ix-mike-ricci-explains-pwb-safety","status":"publish","type":"post","link":"http:\/\/cafe.foundation\/blog\/eas-ix-mike-ricci-explains-pwb-safety\/","title":{"rendered":"EAS IX: Mike Ricci Explains PWB, Safety"},"content":{"rendered":"

Dreamliner battery nightmares have troubled the dreams of electric flight for the past two years.\u00a0 Michael Ricci<\/a>, Vice President of Engineering with LaunchPoint Technologies<\/a>, gave attendees at this year\u2019s Electric Aircraft Symposium a crash course (pun intended) in the many types of failure modes electric aircraft face.\u00a0 Luckily, he also provided ways to mitigate and eliminate those failure modes.<\/p>\n

\"Michael<\/a>

Michael Ricci of LaunchPoint Technologies explains Propulsion by Wire (PBW) to EAS IX attendees<\/p><\/div>\n

He introduced a concept called \u201cPropulsion by Wire\u201d (PBW), the main thrust for electric aircraft and roughly akin to the commonly discussed \u201cFly by Wire\u201d concept.\u00a0 Asking what product specifications for electric propulsion will look like, he answered his own rhetorical question with the technical requirements for reasonable interaction, a useful user interface, airworthiness, and safety.<\/p>\n

Starting with the last issue first, safety (which should always come first), we need to be able to continue safe flight after a single component failure.\u00a0 There are some surprising, counter-intuitive things at work here.\u00a0 Depending on whether we start with a qualitative hazard analysis or a quantitative fault tree analysis, we want to design systems that don\u2019t become catastrophic when one component fails.\u00a0 Aircraft have structural redundancies to prevent total overall failure when one item is damaged.\u00a0 That kind of design thinking allowed bomber crews to make it home in aircraft missing large pieces, and even enabled Captain Sullenberger and First Officer Skiles to make a water landing in the Hudson River after their Airbus collided with a large flock of Canada Geese.<\/p>\n

A Failure Mode, Effects, and Criticality Analysis (FMECA)\u00a0looks at single points of failure, and in aircraft, according to Mike, strive for a low failure rate of 10-7, or one failure per hundred million flight hours.\u00a0 That would seem close to perfection, but isn\u2019t realizable in the real world.\u00a0 The perfect part, even with demonstrated reliability, works with other components.\u00a0 An engine is a good example.\u00a0 Combining groups of components with 10-5 (one failure in 100,000 hour) reliability might give an aggregate for the complete engine of 10-4, an order of magnitude less reliable than each of the individual components.\u00a0 Lycoming engine components, according to Mike, run between 10-4 (one failure in 10,000 hours) and 10-5 \u00a0(one in 100,000 hours). \u00a0These are not always total engine stoppers, but may reduce performance or lead to the necessity to find an alternative airport.<\/p>\n

Following FMECA, designers often use FTA, failure or fault tree analysis, seeing what the failure of one component might take with it.\u00a0 The combined analyses help account for the reliability we enjoy with modern mechanical engines, and we like to think electric motors are simpler and more reliable than their mechanical counterparts, but how do we help promote high reliability?<\/p>\n

Mike suggested the use of built in tests and power-on self-tests as part of a modern approach to making electric aircraft safe.\u00a0 Such systems would check and detect latent failures, and if failures did occur, make second failures improbable.<\/p>\n

He premised a bus or channel that had a mean time between failure (MTBF) of 3,000 hours, and populated that channel with various electrical components.\u00a0 Such systems would have line replaceable units (LRUs) that would be swapped out easily, even before failure, but as predicted by their MTBF lifetimes.\u00a0 With \u201credundant everything,\u201d even low reliability components can achieve high system reliability:\u00a0 N+1 or N+2 electric tail rotors, for instance.<\/p>\n

This may include using roughly equivalent components from different manufacturers, or different models from the same manufacturer.\u00a0 Such approaches can use a democratic version of artificial intelligence, with different controllers \u201cvoting\u201d on a next state or modulating function.\u00a0 Because, in current design trends, every component has associated software, a single-event upset in the software or embedded firmware could have far-reaching consequences.<\/p>\n

Mike suggested reviewing material in Michael Barr\u2019s web site<\/a>, with his presentation on Killer Apps, software glitches that have caused at least 30 deaths in the three examples given.\u00a0 Flying by software means that the software has to be redundant and rely on an architecture that prevents any one failure from bringing an airplane down.\u00a0 This type of fault-tolerant computing is necessary to prevent the kinds of accidents brought on by faulty software \u2013 such as one hybrid car\u2019s unintended acceleration issues a few years ago.<\/p>\n

There will always be pilot errors and mechanical failures, but electrical and software control systems will be called to attain an even higher standard.\u00a0 Such systems need to be able to isolate faults to prevent damage to other parts of the system, to identify bugs before they become active, and to maintain the stability of the bus or channel that connects everything.<\/p>\n

He had some practical ideas for the design of such systems, such as avoiding long leads, where inductance can cause problems.\u00a0 He noted that over-voltage destroys components and can lead to battery pack failures.\u00a0 Such steps help, but high reliability takes time to validate, unfortunately.\u00a0 That\u2019s where his most counter-intuitive thought summarized much of the talk \u2013 using redundant, lower-reliability components in combination can offer reliability while allowing speedier testing.<\/p>\n