Appendix 1
A1-4 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) In this model:
PFU is the probability of being in the full-up state with regard to undetectable failures in the lightning protective elements.
P1 is the probability of having undetected failures in the lightning components of one of the two channels.
P2 is the probability of having detected failures in one of the two channels.
P3 is the probability of having undetected failures in the lightning protective components of both channels.
P4 is the probability of having detected failures in one of the two channels and having undetected failures in the lightning components of the other channel.
r is the failure rate for undetectable failure in the lightning components of one channel.
R is the failure rate for detectable failures in a channel. The reciprocal of R is the MTBF for detected failures in a channel.
1FAIL-LOTC represents the failure rate from the state where one unit has a detected failure to the loss-of-thrust-control (system) failure state.
is the repair rate for channels with a detected failure. It is equal to 1/TREPAIR. Hence, it is not assumed that a channel with a detected failure is repaired immediately. That channel is allowed to remain in service for TREPAIR flight hours before repair is required.
is the rate for lightning strikes that are of sufficient magnitude to cause the unit(s) to fail, if there are undetectable failures in the lightning protective elements of the unit(s).
In the model pictured, the system repairs itself from the “one unit with failed lightning protection elements” to the full-up state either via: (1) A detected failure in that unit, which causes the unit to get pulled for repair (at which time the protective circuitry is confirmed to be inoperative and repaired) or (2) A lightning strike strong enough to cause the unit to fail, which causes it to be pulled for repair.
Appendix 1
A1-5 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) The steady state Markov model equations (eq.) to be solved to obtain the average failure rate of the system are:
Conservation Eq. PFU + P1 + P2 + P3 + P4 + PLOTC = 1 P1 State Eq. 2r*PFU + (*P4)Note1 = ( + 2R + r)*P1 Note 1. If both channels are in the same unit, the *P4 is not in this equation.
P2 State Eq. 2R*PFU + ( + R)*P1 = ( + 1FAIL-LOTC + r)*P2 P3 State Eq. r*P1 = ( + 2R)*P3 P4 State Eq. R*P2 + 2R*P3 = ( + + 1FAIL-LOTC)*P4 The failure rate of the system is:
1FAIL-LOTC *(P2 + P4)/PFU + *(P3 + P4)/PFU LOTC = ------------------------------------------------------------ 1 + (P1 + P2 + P3 + P4)/PFU The first term in the numerator represents those system failures caused by having random components, which affect the LOTC rate, fail in both channels. The second term represents system failures caused by lightning strikes of sufficient magnitude to cause the system to fail if there are undetected failures in one channel of the system combined with detected failures in the other channel or undetected failures in the lightning protective components of channels.
Calculations were based on the following data, where it is assumed that one percent of a channel’s detectable failure rate represents the undetectable failure of elements providing lightning protection:
R = 50*10-6 failures per hour r = 0.5*10-6 failures per hour 1FAIL-LOTC = 34*10-6 events/hr.
= varied from 100 up to 800 events/hour in increments of 100 hours.
= varied from 1/2500 to 1/37500 events/hour in increments of 5000 hours.
Appendix 1
A1-6 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Results for the case where both channels are in the same unit are shown in Figure 3 as a function of the lightning strike rate for repair rates of 125, 200 and 350 hours. The data shows that the impact of lightning strikes increases when the mean-time-between-lightning-strikes (MTBLS) decrease. Thus, the MTBLS for the remaining plots is set at 2500 hours. This is very conservative, as the MTBLS for severe lightning strikes (estimated) is expected to be approximately 15,000 hours or greater.
2.00E-07
4.00E-07
6.00E-07
8.00E-07
1.00E-06
1.20E-06
1.40E-06
1.60E-06 2500 7500 12500 17500 22500 27500 32500 37500 Failures per hour Mean Time Between Lightning Strikes Figure 3--System Failure Rate vs. Mean Time Between Lightning Strikes Both Channels in Same Box Trep(ave) = 200 hrs., Random only Trep(ave) = 125 hrs., Random only Trep(ave) = 125 hrs., Random + Lightning Trep(ave) = 200 hrs., Random + Lightning Trep(ave) = 350 hrs., Random + Lightning Trep(ave) = 350 hrs., Random only
Appendix 1 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Figure 4 represents the case of both channels in the same unit, and it shows the average system failure rate as a function of the repair interval in hours. The repair interval is the allowed dispatch interval for operation with one unit having detected faults in components that lead to an LOTC event. The MTBLS is fixed at 2500 hours.
Figure 4--Redundant Electronics Failure Rate as a function of Repair Hours with Lightning Strikes Fixed at 2500 hours
- channels in same box
3.00E -06 -
2.00E -06 System Failure Rate 1.50E -06 Random + Lightning Strike Failure Rate 90-3001
• Random Failure Rate Only 20-3009
0.00E +00 - 100 200 300 400 500 600 700 800 Repair Time in Hours The data shows that the effect on the overall average system failure rate caused by lightning strikes is quite small. The repair rate or allowable time for dispatching with one channel having detected faults has a much greater impact.
A1-7
Appendix 1
A1-8 APPENDIX 1. AVERGAGE SYSTEM FAILURE RATE (Continued) Figure 5 shows the same data for a system configuration where the two channels have their own separate boxes. Similar to Figure 4, the data shows that the impact of having separate boxes for each channel has a negligible impact on the LOTC rate of the system as compared with the repair time, or allowed dispatch interval, for a failed unit.
0.00E+00
5.00E-07
1.00E-06
1.50E-06
2.00E-06
2.50E-06
3.00E-06 100 200 300 400 500 600 700 800 System Failure Rate Repair Time in Hours Figure 5--Redundant Electronics Failure Rate as a function of Repair Hours with Lightning Strikes Fixed at 2500 hours
- channels in separate boxes Random + Lightning Strike Failure Rate Random Failure Rate Only
Appendix 1
A1-9 Conclusion Both Figures 4 and 5 show that the unit repair time has a much greater influence than lightning strikes on the system’s LOTC. The contribution to the system failure rate from lightning strikes is less than one percent for any reasonable system repair rate.
Appendix 1
A1-10 TABLE 1—POTENTIAL PROBLEM AREAS AND VULNERABILITIES CONTRIBUTING
TO POSSIBLE DEGRADATION OF ELECTROMAGNETIC INTERFERENCE (EMI) AND
LIGHTNING PROTECTION OF ENGINE AND PROPELLER ELECTRONIC CONTROL
SYSTEMS FOR CONSIDERATION IN THE ESTABLISHMENT OF INSPECTION/MAINTENANCE FUNCTIONS:
I. Structures Integrity: (i.e., conductive current path; attenuation;
struts and wing fairings (composites); and;
how material is installed around bundles)
• structural parts bonding • galvanic action
• internal and external meshes • damage tolerance
• internal and external surface treatments (coatings)
• hydroscopic contamination (absorption of moisture)
• structural corrosion • gaskets and seals
• ground strap integrity • latches and hinges
• structural repairs • change of materials and material integrity
• aperture control (holes and slots) II. Installation, Location, and Routing Integrity:
(i.e., location of Electronic Control;
accuracy of cable routing; physical geometry and relation to structure, and; distance to ground)
• distance from ground plane • inappropriate repair/alteration
• proper cable retention • nonessential system installation
• routing wire path apertures • system to system proximity
• wear, fretting • changing zone threats
• rebundling/rerouting • ground and bonding integrity III. Wire and Bundling Shielding Integrity:
(i.e., integrity of cables; enclosures of Electronic Controls; meshes, and; actuators)
• connectors (EMI fingers in place, tight, and not damaged)
• gasket integrity
• backshells (in place and tight) • pin and socket security
• shield termination • wire abrasion or cold flowing
• shield corrosion • wire shorts to connector shell
• shield deformation/damage • wire shorts to conductors
• connector corrosion • wire count
• connector damage • cable dress/wire sleeves
• ground strap surface corrosion • element failures
• fastener security (tightness) • surge protection failures
• faying surface condition • isolation resistance/insulation breakdown
Appendix 1 A1-11 IV. Terminal Protection Device (TPD) Integrity:
(i.e., internal, on board, and external; EMI filters; transzorbs; Metal Oxide Varistors (MOV’s); and resistor elements)
• Silicon Avalanche Diode (SAD) failures (open, short, or shift)
• moisture and contamination
• solder joint integrity • EMI gasket deterioration
• tightness (during assembly) • cracked/damaged ferrites
• filter pin ground opening • inductance element defects (filters)
• MOV failure (open, short, or shift) • series resistance defects
• reverse leakage • corrosion
• capacitor element defects (filters) V. Circuit Design Integrity: (i.e., enclosures for circuits; ground plane;
isolation; AC/DC coupling; changes to circuit characteristics, and; effects on protection after functional failure)
• green wire repairs (jumper repair) • unterminated lines
• violation of approved parts list • cuts and jumpers
• inappropriate approved parts list • damage to ground planes
• grounding and bonding • corrosion to ground planes
• gaskets • component solder joint integrity
• component fault tolerance (operation with faults present)
VI. Grounding and Bonding Integrity: (i.e., ground straps in place; impedance bonding of connectors, and; protection device grounding)
• loose ground straps • damage to ground planes
• corrosion to connector shells • corrosion to ground planes
ADVISORY CIRCULAR FEEDBACK INFORMATION If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) complete the form online at https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx or (2) emailing this form to 9-AWA-AVS-AIR- DMO@faa.gov Subject: AC 33.4-3 Date: ___________ Please mark all appropriate line items:
An error (procedural or typographical) has been noted in paragraph _______ on page _______.
Recommend paragraph _______ on page _______ be changed as follows:
In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Other comments:
I would like to discuss the above. Please contact me.
Submitted by: _________________________________ Date: __________________