Redundancy is still many people’s thinking (see sidebar) and some consider that simply having a switch to connect multiple buses together is a sound way to deal with alternator/battery failure. It might be “legal” but it is not good enough.
Regulations require little more than dual sources of power (sometimes interpreted as an alternator and a battery) and backup instruments with their own power (this can be as minimal as a small, dedicated battery). This is intended to ensure a level of redundancy for essential attitude, airspeed and altitude information. But Cirrus does not consider redundancy to be enough.
The Cirrus electrical system goes much further and protects essential equipment (PFD, autopilot, GPS, etc.) by isolating it from all other equipment. Power can be drawn from any alternator or battery but essential equipment cannot be compromised by some piece of non-essential equipment or physical short elsewhere in the system.
This introduces fault tolerance and robustness to the Cirrus electrical system.
Cirrus “all electric” airplanes have two alternators, two batteries and multiple buses for power distribution. Robust, fault tolerant design ensures that essential equipment is supported indefinitely even after multiple failures.
Why “redundant” isn’t enough:
Pilots have always learned that redundant systems are important; that “whatever can break, will” and having a backup for important items of equipment is essential. Nowhere is this more relevant today than electrical systems. The emergence of primary flight displays (PFDs), sophisticated autopilots and GPS means that losing electrical power is more than an inconvenience. It creates a critical problem.
However, this focus on component failure and backups is short-sighted. Component failure can lead to systemic collapse. Many small component failures create “shorts” of one sort or another. Selecting a redundant item simply means that piece of equipment will fail also. Most significantly, in some circumstances, alternator/battery failure can cause other alternators or batteries to fail if inter-connected. Leaving you without any power at all. This is the risk if you simply connect buses together after a power failure.
Why is all this necessary? Again, as discussed above, modern general aviation aircraft depend on reliable power for all instrumentation. It needs to be robust – and fault tolerant.
Cirrus introduces fault-tolerance and robustness into the equation (mainly automatically through smart design): if parts fail essential equipment is kept isolated from those failures. It is difficult to even imagine failure combinations that would cause the electrical system to collapse. Electrical systems with two alternators on one bus; or multiple bus systems that all connect together have excellent redundancy. They do, however, lack robustness and fault-tolerance