HondaJet: Not A Steam Gage In Sight

[Larry Dighera]

http://world.honda.com/HondaJet/Styling/FlightDeck/
· All information, from flight and engine instrumentation to
navigation, communication, terrain and traffic data, is uniquely
integrated and digitally presented on the dual, large-format, high-
resolution primary flight displays and the multifunction display


· The HondaJet cockpit configuration provides a high degree of
integration for enhanced situational awareness, functionality, ease of
operation, redundancy, and flight safety.

[Neil Gould]

Recently, Larry Dighera > posted:

> http://world.honda.com/HondaJet/Styling/FlightDeck/
> · All information, from flight and engine instrumentation to
> navigation, communication, terrain and traffic data, is uniquely
> integrated and digitally presented on the dual, large-format, high-
> resolution primary flight displays and the multifunction display
>
>
> · The HondaJet cockpit configuration provides a high degree of
> integration for enhanced situational awareness, functionality, ease of
> operation, redundancy, and flight safety.
>
It will be interesting to see how this one is FAA-certified. Power failure
would be a worst-case scenario, so I'd be surprised if this plane lacked
multiple power sources, but a lightning hit could be a problem.

Neil

[Mxsmanic]

Larry Dighera writes:

> http://world.honda.com/HondaJet/Styling/FlightDeck/
> · All information, from flight and engine instrumentation to
> navigation, communication, terrain and traffic data, is uniquely
> integrated and digitally presented on the dual, large-format, high-
> resolution primary flight displays and the multifunction display

I'll let someone else earn the red badge of courage flying this
aircraft. After twenty years, if there haven't been too many
accidents, maybe it can be considered safe.

I notice in the photo gallery, the only mention of safety shows a
photo of an emergency exit. There are zillions of pictures of the
cabin, but only one of the flight deck. Clearly, the audience is the
rich businessman and the pilots are merely servants.

> The HondaJet cockpit configuration provides a high degree of
> integration for enhanced situational awareness, functionality, ease of
> operation, redundancy, and flight safety.

I don't know about the last part, but time will tell.

When did Honda become a significant name in aviation?

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Gig 601XL Builder]

"Mxsmanic" > wrote in message
...
>
> I don't know about the last part, .......>

Truer words have never been written.

> When did Honda become a significant name in aviation?
>

Pretty much the day they said they were going to build an airplane. Thought
it could be argued it was when they said they were going to build an
airplane engine.

[Mortimer Schnerd, RN[_2_]]

Mxsmanic wrote:
> I'll let someone else earn the red badge of courage flying this
> aircraft. After twenty years, if there haven't been too many
> accidents, maybe it can be considered safe.
>


Numbnuts, you let someone else earn the red badge of current flying ANY
aircraft.



--
Mortimer Schnerd, RN
mschnerdatcarolina.rr.com

[Bucky]

Neil Gould wrote:
> It will be interesting to see how this one is FAA-certified. Power failure
> would be a worst-case scenario, so I'd be surprised if this plane lacked
> multiple power sources, but a lightning hit could be a problem.

I thought modern jets don't have steam gauges as backups anymore.

[Larry Dighera]

On 19 Oct 2006 16:15:29 -0700, "Bucky" > wrote in
. com>:

>Neil Gould wrote:
>> It will be interesting to see how this one is FAA-certified. Power failure
>> would be a worst-case scenario, so I'd be surprised if this plane lacked
>> multiple power sources, but a lightning hit could be a problem.
>
>I thought modern jets don't have steam gauges as backups anymore.

What do you do when the electrical system fails?

[john smith]

In article >,
Larry Dighera > wrote:

> On 19 Oct 2006 16:15:29 -0700, "Bucky" > wrote in
> . com>:
>
> >Neil Gould wrote:
> >> It will be interesting to see how this one is FAA-certified. Power failure
> >> would be a worst-case scenario, so I'd be surprised if this plane lacked
> >> multiple power sources, but a lightning hit could be a problem.
> >
> >I thought modern jets don't have steam gauges as backups anymore.
>
> What do you do when the electrical system fails?

Peanut gauges are electric, but they have their own power, independent
supply.

[Mark]

Larry Dighera wrote:
> What do you do when the electrical system fails?

Kiss your arse good-bye!.

[Mxsmanic]

Mortimer Schnerd, RN writes:

> Numbnuts, you let someone else earn the red badge of current flying ANY
> aircraft.

Some aircraft are safer than others.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Bucky]

Larry Dighera wrote:
> What do you do when the electrical system fails?

I found this article on the Airbus 320, which has an all glass cockpit:

"The energy supply is backed up in several ways. Along with one
generator per engine, a third generator is powered by the APU. A fourth
power supply is available by extending a little fan generator into the
airstream. The chances of experiencing a complete power loss in an A320
are calculated to be at around one in one trillion. Should this happen,
the above mentioned mechanical system of the rudder and the elevator
trim ensure a safe landing."

http://www.flug-revue.rotor.com/FRheft/FRH9709/FR9709a.htm

[Neil Gould]

Recently, Bucky > posted:

> Larry Dighera wrote:
>> What do you do when the electrical system fails?
>
> I found this article on the Airbus 320, which has an all glass
> cockpit:
>
> "The energy supply is backed up in several ways. Along with one
> generator per engine, a third generator is powered by the APU. A
> fourth power supply is available by extending a little fan generator
> into the airstream. The chances of experiencing a complete power loss
> in an A320 are calculated to be at around one in one trillion. Should
> this happen, the above mentioned mechanical system of the rudder and
> the elevator trim ensure a safe landing."
>
> http://www.flug-revue.rotor.com/FRheft/FRH9709/FR9709a.htm
>
That's all well and good for the failure modes of the on-board generators.
How did they protect against the power surge that a lightning hit could
impose that could take out the PFDs?

Neil

[Jay B]

Mxsmanic wrote:
> Mortimer Schnerd, RN writes:
>
> > Numbnuts, you let someone else earn the red badge of current flying ANY
> > aircraft.
>
> Some aircraft are safer than others.
>
> --
> Transpose mxsmanic and gmail to reach me by e-mail.

And most here are smarter than one...

Jay Beckman
PP-ASEL
Chandler, AZ

[Al G[_1_]]

"Mxsmanic" > wrote in message
...
> Mortimer Schnerd, RN writes:
>
>> Numbnuts, you let someone else earn the red badge of current flying ANY
>> aircraft.
>
> Some aircraft are safer than others.
>
And you know this how?

Not exactly the voice of experience.

While there will always be discussions on the relative merits and
safety of one design over another, these will be discussions of informed
opinion, for which you are singulary unqualified. In other words, until
you've tried an airplane, you lack credibility when you offer your
speculation.

Al G CFIAMI 2069297

[Al G[_1_]]

"Bucky" > wrote in message
oups.com...
> Larry Dighera wrote:
>> What do you do when the electrical system fails?
>
> I found this article on the Airbus 320, which has an all glass cockpit:
>
> "The energy supply is backed up in several ways. Along with one
> generator per engine, a third generator is powered by the APU. A fourth
> power supply is available by extending a little fan generator into the
> airstream. The chances of experiencing a complete power loss in an A320
> are calculated to be at around one in one trillion. Should this happen,
> the above mentioned mechanical system of the rudder and the elevator
> trim ensure a safe landing."
>
> http://www.flug-revue.rotor.com/FRheft/FRH9709/FR9709a.htm
>

Didn't a G5 lose ALL 5 Honeywell MFD's at the same time last year?
As I remember, it was the second time it had happened. An all "Black" glass
cockpit.


Al G

[Bob Noel]

In article >, "Al G" >
wrote:

> Didn't a G5 lose ALL 5 Honeywell MFD's at the same time last year?
> As I remember, it was the second time it had happened. An all "Black" glass
> cockpit.

But kind of takes the concept of a dark cockpit a little too far. ;-)

--
Bob Noel
Looking for a sig the
lawyers will hate

[Mxsmanic]

Bucky writes:

> The chances of experiencing a complete power loss in an A320
> are calculated to be at around one in one trillion.

There isn't any way to accurately calculate probabilities of the order
of one in a trillion when dealing with physical systems. Estimates
are often off by many orders of magnitude.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Mxsmanic]

Al G writes:

> And you know this how?

By looking at design features and failure modes, and accidents. For
example, the original de Havilland Comet was unsafe.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Larry Dighera]

On Thu, 19 Oct 2006 16:37:08 GMT, "Neil Gould"
> wrote in
>:

>Recently, Larry Dighera > posted:
>
>> http://world.honda.com/HondaJet/Styling/FlightDeck/
[...]
>It will be interesting to see how this one is FAA-certified. Power failure
>would be a worst-case scenario, so I'd be surprised if this plane lacked
>multiple power sources, but a lightning hit could be a problem.
>

If the glass cockpit is engineered anything like the Garmin system
installed in the Cessna 172S, that went into an infinite re-boot loop
while en route from Greenland to Iceland causing the loss of all
communications, navigation, flight instruments, fuel gages, autopilot
etc., it would only take a malfunction affecting the main CPU to
create a serious hazard.

[cjcampbell]

Neil Gould wrote:
> Recently, Larry Dighera > posted:
>
> > http://world.honda.com/HondaJet/Styling/FlightDeck/
> > · All information, from flight and engine instrumentation to
> > navigation, communication, terrain and traffic data, is uniquely
> > integrated and digitally presented on the dual, large-format, high-
> > resolution primary flight displays and the multifunction display
> >
> >
> > · The HondaJet cockpit configuration provides a high degree of
> > integration for enhanced situational awareness, functionality, ease of
> > operation, redundancy, and flight safety.
> >
> It will be interesting to see how this one is FAA-certified. Power failure
> would be a worst-case scenario, so I'd be surprised if this plane lacked
> multiple power sources, but a lightning hit could be a problem.

It might surprise you, but a vacuum pump is not required for FAA
certification. There are quite a number of airplanes out there flying
without them, including most airliners. Many general aviation planes
are all electric. A vacuum pump is a *liability* not a backup system.

Complete power failure in a jet is not a good thing anyway. Many jets
and turboprops could not survive it, not least because it means
complete loss of flight controls.

[cjcampbell]

Larry Dighera wrote:
> http://world.honda.com/HondaJet/Styling/FlightDeck/
> · All information, from flight and engine instrumentation to
> navigation, communication, terrain and traffic data, is uniquely
> integrated and digitally presented on the dual, large-format, high-
> resolution primary flight displays and the multifunction display
>
>
> · The HondaJet cockpit configuration provides a high degree of
> integration for enhanced situational awareness, functionality, ease of
> operation, redundancy, and flight safety.

Diamond aircraft are also all-electric, as well as nearly all jets and
turboprops.

Look, the only thing the vacuum pump runs in most planes that have one
is the attitude indicator and sometimes the DG, and it is far more
failure-prone than the electrical system. Not everybody designs planes
as if they were Cessna Skyhawks or Piper Tripacers. Those planes have
vacuum systems because they are cheap, not because they give you added
redundancy. Some manufacturers have had the gall to tell you that
putting unreliable systems on an airplane increases safety, but it
obviously does not. An enormous amount of instrument training is
devoted to failures of the vacuum system and people die anyway.
Technology has advanced somewhat since the 1950s. Given the enormous
number of lawsuits against manufacturers of vacuum pumps it is only a
matter of time before they disappear entirely. The true function of a
vaccum pump is to fail at the worst possible moment.

You talk about the failure of the power system on a Cessna 172S on a
long over-water ferry flight as if the plane was designed for that type
of flying. Ferry pilots ought to know that theirs is a high-risk
business. The battery backup on a 172S is perfectly adequate to get you
down safely in 99.9% of flights. If you choose to fly ANY plane where a
failure can put in a situation where you cannot recover, that is your
choice, but it is not the fault of the airplane or its designers. If
you choose to fly single-engine or single pilot IFR at night over the
mountains or long distances over water, that is your choice. But don't
complain that someone did not give you an 'out' when trouble happens.

[Capt.Doug]

>"Bucky" wrote in message>I found this article on the Airbus 320, which has
an all glass cockpit:

All glass, except the back-up altimeter and back-up airspeed indicator,
which are mechanical. The back-up attitude indicator has an internal battery
which is normally recharged by the aircraft's system. The FADECs are self
powered but the EICAS is not.

Many steam gauge airplanes will have indicator failures following the loss
of all electricity because the air reference instruments get data from an
air data computer and can't function in a stand-alone mode. Before RVSM ,
many airplanes had purely mechanical air reference instruments on the
co-pilot's side, but now most of those operate on a second air data
computer.

> "The energy supply is backed up in several ways. Along with one
> generator per engine, a third generator is powered by the APU. A fourth
> power supply is available by extending a little fan generator into the
> airstream. The chances of experiencing a complete power loss in an A320
> are calculated to be at around one in one trillion.

And yet, it did happen recently. A loss of all display units has happened a
number of times.

>Should this happen,
> the above mentioned mechanical system of the rudder and the elevator
> trim ensure a safe landing."

All well and good if one is in VMC conditions. Even then, the landing will
be 'eventful'. In the simulator, in VMC conditions, only 50% get on the
runway without damage and many of those don't stop on the runway. And good
luck finding an airport in the first place without the IRS, GPS, VOR, ADF,
or ATC.

D.

[Neil Gould]

Recently, cjcampbell > posted:

> Neil Gould wrote:
>> Recently, Larry Dighera > posted:
>>
>>> http://world.honda.com/HondaJet/Styling/FlightDeck/
>>> · All information, from flight and engine instrumentation to
>>> navigation, communication, terrain and traffic data, is uniquely
>>> integrated and digitally presented on the dual, large-format, high-
>>> resolution primary flight displays and the multifunction display
>>>
>>>
>>> · The HondaJet cockpit configuration provides a high degree of
>>> integration for enhanced situational awareness, functionality, ease
>>> of operation, redundancy, and flight safety.
>>>
>> It will be interesting to see how this one is FAA-certified. Power
>> failure would be a worst-case scenario, so I'd be surprised if this
>> plane lacked multiple power sources, but a lightning hit could be a
>> problem.
>
> It might surprise you, but a vacuum pump is not required for FAA
> certification. There are quite a number of airplanes out there flying
> without them, including most airliners. Many general aviation planes
> are all electric. A vacuum pump is a *liability* not a backup system.
>
Well, not only does this not surprise me, it isn't news. ;-) Having
experienced a vacuum pump failure, and knowing the relatively short MTBF
of those units, it is not a matter of *whether* they'll fail, but when.

> Complete power failure in a jet is not a good thing anyway. Many jets
> and turboprops could not survive it, not least because it means
> complete loss of flight controls.
>
Understandable. In the case of this plane, I don't know whether the flight
controls are electric or hydraulic, but I'd hope that in either case
they'd have backups for normal power issues (failed generators, etc.) and
be robust enough to withstand the power surge from a lightning hit.
However, PFD circuits may not survive such a hit, so it made me think
about what I'd do as a pilot of one of these planes, and the answer was
pretty simple: keep a Garmin 496 in the "glove box"! ;-)

Neil

[Larry Dighera]

On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
> wrote in
om>:

>You talk about the failure of the power system on a Cessna 172S on a
>long over-water ferry flight as if the plane was designed for that type
>of flying. Ferry pilots ought to know that theirs is a high-risk
>business. The battery backup on a 172S is perfectly adequate to get you
>down safely in 99.9% of flights. If you choose to fly ANY plane where a
>failure can put in a situation where you cannot recover, that is your
>choice, but it is not the fault of the airplane or its designers. If
>you choose to fly single-engine or single pilot IFR at night over the
>mountains or long distances over water, that is your choice. But don't
>complain that someone did not give you an 'out' when trouble happens.

Pilots should be made aware of the potential magnitude of the failure
mode when the glass cockpit goes into infinite re-boot mode. All
communications, navigation, autopilot, etc are lost. I doubt many who
fly behind such equipment are aware of that.

[cjcampbell]

Larry Dighera wrote:
> On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
> > wrote in
> om>:
>
> >You talk about the failure of the power system on a Cessna 172S on a
> >long over-water ferry flight as if the plane was designed for that type
> >of flying. Ferry pilots ought to know that theirs is a high-risk
> >business. The battery backup on a 172S is perfectly adequate to get you
> >down safely in 99.9% of flights. If you choose to fly ANY plane where a
> >failure can put in a situation where you cannot recover, that is your
> >choice, but it is not the fault of the airplane or its designers. If
> >you choose to fly single-engine or single pilot IFR at night over the
> >mountains or long distances over water, that is your choice. But don't
> >complain that someone did not give you an 'out' when trouble happens.
>
> Pilots should be made aware of the potential magnitude of the failure
> mode when the glass cockpit goes into infinite re-boot mode. All
> communications, navigation, autopilot, etc are lost. I doubt many who
> fly behind such equipment are aware of that.

It is in the emergency procedures. Pilots should be aware of those.

[Larry Dighera]

On 24 Oct 2006 18:08:11 -0700, "cjcampbell"
> wrote in
m>:

>
>Larry Dighera wrote:
>> On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
>> > wrote in
>> om>:

>> Pilots should be made aware of the potential magnitude of the failure
>> mode when the glass cockpit goes into infinite re-boot mode. All
>> communications, navigation, autopilot, etc are lost. I doubt many who
>> fly behind such equipment are aware of that.
>
>It is in the emergency procedures. Pilots should be aware of those.

Are you able to provide the specific wording from the C-172S POH that
mentions that only ASI, AI, VSI, Alt. and magnetic compass steam gages
will be available in the event of glass cockpit failure, and also
mentions that the autopilot, radio communications, fuel gages, and
navigation systems will become inoperative?

[Jim Macklin]

http://www.garmin.com/support/userManual.jsp
G1000: Cessna Nav III:

a.. Cockpit Reference Guide, Rev. A, Oct, 2005 |
Download (3.53 MB)
b.. Cockpit Reference Guide (Cessna Nav III), Rev. B, Jul,
2005 | Download (4.43 MB)
c.. Cockpit Reference Guide Addendum (Cessna Nav III),
Rev. A, Jul, 2005 | Download (24 KB)
d.. Pilot's Guide, Rev. A, Nov, 2005 | Download (8.67
MB)
"Larry Dighera" > wrote in message
...
| On 24 Oct 2006 18:08:11 -0700, "cjcampbell"
| > wrote in
| m>:
|
| >
| >Larry Dighera wrote:
| >> On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
| >> > wrote in
| >> om>:
|
| >> Pilots should be made aware of the potential magnitude
of the failure
| >> mode when the glass cockpit goes into infinite re-boot
mode. All
| >> communications, navigation, autopilot, etc are lost. I
doubt many who
| >> fly behind such equipment are aware of that.
| >
| >It is in the emergency procedures. Pilots should be aware
of those.
|
| Are you able to provide the specific wording from the
C-172S POH that
| mentions that only ASI, AI, VSI, Alt. and magnetic compass
steam gages
| will be available in the event of glass cockpit failure,
and also
| mentions that the autopilot, radio communications, fuel
gages, and
| navigation systems will become inoperative?

[Stefan]

Larry Dighera schrieb:

> Are you able to provide the specific wording from the C-172S POH that
> mentions that only ASI, AI, VSI, Alt. and magnetic compass steam gages
> will be available in the event of glass cockpit failure, and also
> mentions that the autopilot, radio communications, fuel gages, and
> navigation systems will become inoperative?

I don't need a scientific degree in logic to understand even without
reading the POH that when the screen goes black, all those nifty things
which were on that very screen before are, well, not available anymore.

Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic compass
steam gages" for decades, so what's the big deal. I agree that a backup
radio would be nice, though. (Which would perfectly double as a
navigation aid using VDF.)

Stefan

[Larry Dighera]

>"Larry Dighera" > wrote in message
...
>| On 24 Oct 2006 18:08:11 -0700, "cjcampbell"
>| > wrote in
>| m>:
>|
>| >
>| >Larry Dighera wrote:
>| >> On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
>| >> > wrote in
>| >> om>:
>|
>| >> Pilots should be made aware of the potential magnitude
>| >> of the failure mode when the glass cockpit goes into infinite re-boot
>| >> mode. All communications, navigation, autopilot, etc are lost. I
>| >> doubt many who fly behind such equipment are aware of that.
>| >
>| >It is in the emergency procedures. Pilots should be aware of those.
>|
>| Are you able to provide the specific wording from the C-172S POH that
>| mentions that only ASI, AI, VSI, Alt. and magnetic compass steam gages
>| will be available in the event of glass cockpit failure, and also
>| mentions that the autopilot, radio communications, fuel gages, and
>| navigation systems will become inoperative?
>

On Wed, 25 Oct 2006 06:26:41 -0500, "Jim Macklin"
> wrote in
>:

> http://www.garmin.com/support/userManual.jsp
>G1000: Cessna Nav III:

I found the links to the documents you mentioned below on this page:


http://www.garmin.com/support/userManual.jsp?market=1&subcategory=All&product=All

>
> a.. Cockpit Reference Guide, Rev. A, Oct, 2005 |
>Download (3.53 MB)


http://www.garmin.com/manuals/G1000:CessnaNavIII_CockpitReferenceGuide.pdf
G1000 Cockpit Reference Guide for the Cessna Nav III

While it does contain 14 warning messages, it contains no
reference to emergency procedures.


> b.. Cockpit Reference Guide (Cessna Nav III), Rev. B, Jul,
>2005 | Download (4.43 MB)


http://www.garmin.com/manuals/G1000:CessnaNavIII_CockpitReferenceGuide_CessnaNav III_.pdf
G1000 cockpit reference guide for the Cessna Nav III

While it does contain 14 warning messages, it contains no
reference to emergency procedures.


> c.. Cockpit Reference Guide Addendum (Cessna Nav III),
>Rev. A, Jul, 2005 | Download (24 KB)


http://www.garmin.com/manuals/G1000:CessnaNavIII_CockpitReferenceGuideAddendum_C essnaNavIII_.pdf

This two paragraph note is irrelevant to this discussion


> d.. Pilot's Guide, Rev. A, Nov, 2005 | Download (8.67 MB)

http://www.garmin.com/manuals/G1000:CessnaNavIII_PilotsGuide.pdf
G1000 Pilot’s Guide for Cessna Nav III

While it does contain 7 warning messages, it contains no
reference to emergency procedures.

Page 1-10 contains this note:

NOTE: Please see the Aircraft Flight Manual
(AFM) for specific procedures concerning
avionics power application and emergency
power supply operation.


So it would appear that those documents fail to provide the pilot with
information relating to the complete loss of radio communications,
navigation systems, autopilot, engine gages, ... in the event the
G1000 becomes inoperative.

Thanks for the information you provided, but it doesn't seem to
contain any emergency procedures; those must be in the Cessna C-172S
POH.

I'd still like to see the quote that informs the pilot, that complete
loss of radio communications, navigation systems, autopilot, engine
gages, ... will occur in the event the G1000 becomes inoperative. If
that is only implied, not specifically stated, it should be amended,
in my opinion.

[Larry Dighera]

On Wed, 25 Oct 2006 14:37:05 +0200, Stefan >
wrote in >:

>Larry Dighera schrieb:
>
>> Are you able to provide the specific wording from the C-172S POH that
>> mentions that only ASI, AI, VSI, Alt. and magnetic compass steam gages
>> will be available in the event of glass cockpit failure, and also
>> mentions that the autopilot, radio communications, fuel gages, and
>> navigation systems will become inoperative?
>
>I don't need a scientific degree in logic to understand even without
>reading the POH that when the screen goes black, all those nifty things
>which were on that very screen before are, well, not available anymore.

True. But I wasn't aware that the autopilot wouldn't even work as a
wing leveler.

>Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic compass
>steam gages" for decades, so what's the big deal.

They usually had some sort of fuel gage.

>I agree that a backup radio would be nice, though. (Which would perfectly
>double as a navigation aid using VDF.)
>

Agreed. It is vital to carry portable comm and nav equipment on IFR
flights. What is VDF? I presume the 'DF' refers to direction
finding, but what's the 'V' stand for?

[Stefan]

Larry Dighera schrieb:

> They usually had some sort of fuel gage.

They usually had a wrist watch, just as every pilot should. (Lesson 1:
Never trust the fuel gauges, always calculate your estimated fuel flow.)

> Agreed. It is vital to carry portable comm and nav equipment on IFR
> flights. What is VDF? I presume the 'DF' refers to direction
> finding, but what's the 'V' stand for?

VHF Direction Finding station. Or, in plain languge, when you talk to a
controller, his radio displays the direction from where those
electromagnetic waves originate. Just "request QTE" (or QDR or QDM,
whichever you prefer (Q-codes, anybody?)), and you know on which
"radial" from that ATC facility you are. (I don't know about the USA,
but here in Europe pretty much every ATC facility is VDF equipped.)

Stefan

[Mxsmanic]

cjcampbell writes:

> It is in the emergency procedures.

Is it? If there is a procedure for it, why is it still happening in
the first place?

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Mxsmanic]

Stefan writes:

> I don't need a scientific degree in logic to understand even without
> reading the POH that when the screen goes black, all those nifty things
> which were on that very screen before are, well, not available anymore.

However, without a background in IT, a pilot might easily fail to
realize that the screen could go black in the first place. After all,
steam gauges don't disappear in a puff of smoke, so why would anyone
intuitively assume that a glass cockpit would?

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Neil Gould]

Recently, Mxsmanic > posted:

> Stefan writes:
>
>> I don't need a scientific degree in logic to understand even without
>> reading the POH that when the screen goes black, all those nifty
>> things which were on that very screen before are, well, not
>> available anymore.
>
> However, without a background in IT, a pilot might easily fail to
> realize that the screen could go black in the first place. After all,
> steam gauges don't disappear in a puff of smoke, so why would anyone
> intuitively assume that a glass cockpit would?
>
Some steam gauge failures can be far more insidious than a glass panel
going blank.

Pilots are trained in the operation of the aircraft, and the POH would
make it clear that this is one of many possibilities. If one is
sufficiently grounded in the principles and operation of their aircraft,
no more information is necessary. If they aren't, the chances of passing
the requirements for a certificate are pretty slim.

Neil

[Gig 601XL Builder]

"Mxsmanic" > wrote in message
...
> Stefan writes:
>
>> I don't need a scientific degree in logic to understand even without
>> reading the POH that when the screen goes black, all those nifty things
>> which were on that very screen before are, well, not available anymore.
>
> However, without a background in IT, a pilot might easily fail to
> realize that the screen could go black in the first place. After all,
> steam gauges don't disappear in a puff of smoke, so why would anyone
> intuitively assume that a glass cockpit would?
>

I wish some steam gauges would just go black instead of their normal failure
mode which is to slowly die over a period that can be weeks.

[cjcampbell]

Larry Dighera wrote:
> On 24 Oct 2006 18:08:11 -0700, "cjcampbell"
> > wrote in
> m>:
>
> >
> >Larry Dighera wrote:
> >> On 22 Oct 2006 17:37:29 -0700, "cjcampbell"
> >> > wrote in
> >> om>:
>
> >> Pilots should be made aware of the potential magnitude of the failure
> >> mode when the glass cockpit goes into infinite re-boot mode. All
> >> communications, navigation, autopilot, etc are lost. I doubt many who
> >> fly behind such equipment are aware of that.
> >
> >It is in the emergency procedures. Pilots should be aware of those.
>
> Are you able to provide the specific wording from the C-172S POH that
> mentions that only ASI, AI, VSI, Alt. and magnetic compass steam gages
> will be available in the event of glass cockpit failure, and also
> mentions that the autopilot, radio communications, fuel gages, and
> navigation systems will become inoperative?

Not at this time, being in the Philippines and not having any manuals
with me at all. However, it is in the G1000 manual, which is part of
the airplane's operator's manuals.

[cjcampbell]

Larry Dighera wrote:

> >
> >I don't need a scientific degree in logic to understand even without
> >reading the POH that when the screen goes black, all those nifty things
> >which were on that very screen before are, well, not available anymore.
>
> True. But I wasn't aware that the autopilot wouldn't even work as a
> wing leveler.
>

Whatever made you think that it would? The autopilot is obviously
electrical.

> >Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic compass
> >steam gages" for decades, so what's the big deal.
>
> They usually had some sort of fuel gage.
>

The fuel gauges in Skyhawks have been electrical for decades. We have
been losing them in power failures for more than thirty years.

> >I agree that a backup radio would be nice, though. (Which would perfectly
> >double as a navigation aid using VDF.)
> >
>
> Agreed. It is vital to carry portable comm and nav equipment on IFR
> flights. What is VDF? I presume the 'DF' refers to direction
> finding, but what's the 'V' stand for?

[cjcampbell]

Mxsmanic wrote:
> Stefan writes:
>
> > I don't need a scientific degree in logic to understand even without
> > reading the POH that when the screen goes black, all those nifty things
> > which were on that very screen before are, well, not available anymore.
>
> However, without a background in IT, a pilot might easily fail to
> realize that the screen could go black in the first place. After all,
> steam gauges don't disappear in a puff of smoke, so why would anyone
> intuitively assume that a glass cockpit would?
>

Most people know that the TV set turns off when the power goes out. You
would have to be incredibly stupid to not know that the panels will go
off in a power failure. Besides, the POH specifically points it out,
and the plane has a backup battery and the POH tells you how long the
screens will continue to operate on the backup battery.


> --
> Transpose mxsmanic and gmail to reach me by e-mail.

[cjcampbell]

Mxsmanic wrote:
> cjcampbell writes:
>
> > It is in the emergency procedures.
>
> Is it? If there is a procedure for it, why is it still happening in
> the first place?
>

People who fly real airplanes know that anything can break. It is part
of the training. A good pilot constantly asks himself, "If this thing
that I am using quits working, what will I do?" A good pilot also knows
at any moment where he would land in an emergency. It is a favorite
question instructors like to ask their students; or we just yank the
throttle and ask the student, "So, where you gonna land?"


> --
> Transpose mxsmanic and gmail to reach me by e-mail.

[Larry Dighera]

On 25 Oct 2006 18:24:50 -0700, "cjcampbell"
> wrote in
. com>:

>However, it is in the G1000 manual, which is part of
>the airplane's operator's manuals.

I wasn't able to find it on the Garmin web site?

[Larry Dighera]

On 25 Oct 2006 18:28:57 -0700, "cjcampbell"
> wrote in
. com>:

>
>Larry Dighera wrote:
>
>> >
>> >I don't need a scientific degree in logic to understand even without
>> >reading the POH that when the screen goes black, all those nifty things
>> >which were on that very screen before are, well, not available anymore.
>>
>> True. But I wasn't aware that the autopilot wouldn't even work as a
>> wing leveler.
>>
>
>Whatever made you think that it would? The autopilot is obviously
>electrical.
>

In the scenario I have in mind (Mr. Rhine's recent ferry trip), he
didn't lose electrical power. The G1000 went into infinite re-boot
mode.

>> >Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic compass
>> >steam gages" for decades, so what's the big deal.
>>
>> They usually had some sort of fuel gage.
>>
>
>The fuel gauges in Skyhawks have been electrical for decades. We have
>been losing them in power failures for more than thirty years.

Despite the electrical system being operational, the fuel gages are
part of the non-functional G1000.

[cjcampbell]

Larry Dighera wrote:
> On 25 Oct 2006 18:24:50 -0700, "cjcampbell"
> > wrote in
> . com>:
>
> >However, it is in the G1000 manual, which is part of
> >the airplane's operator's manuals.
>
> I wasn't able to find it on the Garmin web site?

No. Garmin charges an arm, a leg, and a kidney for manuals for the
G1000.

[Sylvain]

cjcampbell wrote:

> No. Garmin charges an arm, a leg, and a kidney for manuals for the
> G1000.

they sell you a CD with the simulator and documentation for just
the price of postage. May be are you underselling your arm,
leg and kidneys?

--Sylvain

[cjcampbell]

Sylvain wrote:
> cjcampbell wrote:
>
> > No. Garmin charges an arm, a leg, and a kidney for manuals for the
> > G1000.
>
> they sell you a CD with the simulator and documentation for just
> the price of postage. May be are you underselling your arm,
> leg and kidneys?

No, no. They ain't worth all that much.

They must have started doing that after I left for the Philippines.

[Neil Gould]

Recently, Larry Dighera > posted:

> On 25 Oct 2006 18:28:57 -0700, "cjcampbell"
> > wrote in
> . com>:
>
>>
>> Larry Dighera wrote:
>>
>>>>
>>>> I don't need a scientific degree in logic to understand even
>>>> without reading the POH that when the screen goes black, all those
>>>> nifty things which were on that very screen before are, well, not
>>>> available anymore.
>>>
>>> True. But I wasn't aware that the autopilot wouldn't even work as a
>>> wing leveler.
>>>
>>
>> Whatever made you think that it would? The autopilot is obviously
>> electrical.
>>
>
> In the scenario I have in mind (Mr. Rhine's recent ferry trip), he
> didn't lose electrical power. The G1000 went into infinite re-boot
> mode.
>
I'm not so sure that this is a "mode" of the G1000, but that's beside the
point. If faced with that condition, I would have simply shut the thing
off so as not to be annoyed and distracted by the "reboot light show".
Afterwards, one just follows POH procedure for total G1000 failure mode.
Not a big deal.

>>>> Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic
>>>> compass steam gages" for decades, so what's the big deal.
>>>
>>> They usually had some sort of fuel gage.
>>>
>>
>> The fuel gauges in Skyhawks have been electrical for decades. We have
>> been losing them in power failures for more than thirty years.
>
> Despite the electrical system being operational, the fuel gages are
> part of the non-functional G1000.
>
I always consider the fuel gauges as feeding questionable information.
They are often not very accurate in the range between "full" and "zero".
Also, the same fuel levels can result in different gauge readings from one
plane to another. A clock is a much better "fuel gauge", as long as the
fuel system is intact. If there's a fuel leak, then either above scenario
can bite you just as badly.

Neil

[Larry Dighera]

On Thu, 26 Oct 2006 11:14:44 GMT, "Neil Gould"
> wrote in
>:

>Recently, Larry Dighera > posted:
>
>> On 25 Oct 2006 18:28:57 -0700, "cjcampbell"
>> > wrote in
>> . com>:
>>
>>>
>>> Larry Dighera wrote:
>>>
>>>>>
>>>>> I don't need a scientific degree in logic to understand even
>>>>> without reading the POH that when the screen goes black, all those
>>>>> nifty things which were on that very screen before are, well, not
>>>>> available anymore.
>>>>
>>>> True. But I wasn't aware that the autopilot wouldn't even work as a
>>>> wing leveler.
>>>>
>>>
>>> Whatever made you think that it would? The autopilot is obviously
>>> electrical.
>>>
>>
>> In the scenario I have in mind (Mr. Rhine's recent ferry trip), he
>> didn't lose electrical power. The G1000 went into infinite re-boot
>> mode.
>>
>I'm not so sure that this is a "mode" of the G1000, but that's beside the
>point.

If Mr. Rhine's narrative is to be believed, there is empirical
evidence that supports such a "failure" mode, and that may be part of
the point I'm pursuing.

For example, in the event the G1000 becomes inoperative (let's say its
circuit breaker won't reset), without affecting the function of the
balance of the aircraft's electrical system, why couldn't the (most
likely) electrically driven AI be fitted with an encoder to drive the
autopilot (sans Nav capability, of course)? If I were in IMC, and
lost the G1000's communications, navigational, flight and systems
instrumentation, I'd surely appreciate the opportunity the autopilot
would afford, to read some emergency procedures, and tend to duties
with which I'd probably be saturated initially. That might be
difficult to accomplish expediently without the autopilot while flying
partial panel IFR. (Could you still squawk 7600?)

I guess it boils down to an aversion to "having all the eggs in a
single basket." To me, that raises a red hazard flag calling the
systems engineering forethought into question. Perhaps I don't know
enough about the particulars of the system, or the emergency
procedures in place, but it seems obvious that something as small as a
stray alpha particle or static discharge could precipitate a sudden
and massive loss of functionality.

Suddenly you'd be piloting a Jenny in the clouds with *only* a map and
compass. :-) This exciting, twenty-first century technological
advancement in avionics seems to come with a "time machine" capable of
transporting a pilot back to the nineteenth century days of
barnstorming and flying the mail.

>If faced with that condition, I would have simply shut the thing
>off so as not to be annoyed and distracted by the "reboot light show".
>Afterwards, one just follows POH procedure for total G1000 failure mode.
>Not a big deal.

That is a reasonable response. Apparently the G1000 would operate for
a while between re-boots, so Mr. Rhine may have had some motivation to
view those glowing screens for a few miles at a time while over the
chilly Atlantic.

>>>>> Besides, pilots flew with "only ASI, AI, VSI, Alt. and magnetic
>>>>> compass steam gages" for decades, so what's the big deal.
>>>>
>>>> They usually had some sort of fuel gage.
>>>>
>>>
>>> The fuel gauges in Skyhawks have been electrical for decades. We have
>>> been losing them in power failures for more than thirty years.

True. It was a poor choice for an example of the massive loss of
instrument display that occurs when the G1000 goes down in a C-172.
The HondaJet must surely have some instrumentation hidden behind a
panel someplace, or the FAA wouldn't certify it, right?

>> Despite the electrical system being operational, the fuel gages are
>> part of the non-functional G1000.
>>
>I always consider the fuel gauges as feeding questionable information.
>They are often not very accurate in the range between "full" and "zero".
>Also, the same fuel levels can result in different gauge readings from one
>plane to another.

All very true, and if a needle is bouncing, there's a good chance that
gage's tank's got fuel in it.

>A clock is a much better "fuel gauge", as long as the
>fuel system is intact.

I wonder if there's a mechanical clock or if the clock's integrated in
the G1000 too?

>If there's a fuel leak, then either above scenario can bite you just as badly.

Right.

And if you've got fuel coming out the overflow/vent, and aux-tank fuel
system modifications, you might value those gages more than normal to
help diagnose the cause of a malfunction.

[Mxsmanic]

Neil Gould writes:

> Some steam gauge failures can be far more insidious than a glass panel
> going blank.

So? The fact remains that the failure modes for computer equipment
are very different.

> Pilots are trained in the operation of the aircraft, and the POH would
> make it clear that this is one of many possibilities. If one is
> sufficiently grounded in the principles and operation of their aircraft,
> no more information is necessary. If they aren't, the chances of passing
> the requirements for a certificate are pretty slim.

I think they could pass the requirements with flying colors and still
have absolutely no clue about the failure modes of the G1000. Even
the people who certified it probably have no clue. It's just too
different, at least right now.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Mxsmanic]

cjcampbell writes:

> Most people know that the TV set turns off when the power goes out. You
> would have to be incredibly stupid to not know that the panels will go
> off in a power failure.

I'm talking about a reboot, not a power failure.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Mxsmanic]

cjcampbell writes:

> People who fly real airplanes know that anything can break. It is part
> of the training.

I don't have the pilots in mind. I'm thinking of the vendor. If he
had the time and knowledge to create an emergency procedure, he had
the time and knowledge to fix the bug that can cause a reboot in the
first place, which would be far more responsible than simply
documenting it and forgetting about it.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Neil Gould]

Recently, Larry Dighera > posted:

> On Thu, 26 Oct 2006 11:14:44 GMT, "Neil Gould" wrote:
>> Recently, Larry Dighera > posted:
>>
>>> In the scenario I have in mind (Mr. Rhine's recent ferry trip), he
>>> didn't lose electrical power. The G1000 went into infinite re-boot
>>> mode.
>>>
>> I'm not so sure that this is a "mode" of the G1000, but that's
>> beside the point.
>
> If Mr. Rhine's narrative is to be believed, there is empirical
> evidence that supports such a "failure" mode, and that may be part of
> the point I'm pursuing.
>
It's not an issue of believing Mr. Rhine; the issue is that we don't know
that his experience was due to anything one might reasonably associate
with the G1000. As I've said before, I'd be more than suspicious of the
folks that modified the panel, given that there are definite design issues
with their aux tank and the quality of job they did installing the
entertainment system. The G1000 may have simply been the most visible
indicator of their hack job.

> For example, in the event the G1000 becomes inoperative (let's say its
> circuit breaker won't reset), without affecting the function of the
> balance of the aircraft's electrical system, why couldn't the (most
> likely) electrically driven AI be fitted with an encoder to drive the
> autopilot (sans Nav capability, of course)?
>
Can you buy an electric AI with an encoder that will interface with an
autopilot? If so, that might be a mod that you want to pay for. If not...

> I guess it boils down to an aversion to "having all the eggs in a
> single basket." To me, that raises a red hazard flag calling the
> systems engineering forethought into question. Perhaps I don't know
> enough about the particulars of the system, or the emergency
> procedures in place, but it seems obvious that something as small as a
> stray alpha particle or static discharge could precipitate a sudden
> and massive loss of functionality.
>
To some extent, it's up to the owner to satisfy their level of comfort.
For example, I wouldn't want to fly a lot of IFR with only one radio.
Since owners can easily arrange their own backups for such things, I don't
see it as a big deal that you don't get it "off the shelf". You simply
learn the weaknesses of the system and make decisions about modifications
that make you feel more comfortable.

>> If faced with that condition, I would have simply shut the thing
>> off so as not to be annoyed and distracted by the "reboot light
>> show". Afterwards, one just follows POH procedure for total G1000
>> failure mode.
>> Not a big deal.
>
> That is a reasonable response. Apparently the G1000 would operate for
> a while between re-boots, so Mr. Rhine may have had some motivation to
> view those glowing screens for a few miles at a time while over the
> chilly Atlantic.
>
I wouldn't trust the information that was being displayed if it was
constantly rebooting, anyway. Better to not be misled or confused.

>>> Despite the electrical system being operational, the fuel gages are
>>> part of the non-functional G1000.
>>>
>> I always consider the fuel gauges as feeding questionable
>> information.
>> They are often not very accurate in the range between "full" and
>> "zero". Also, the same fuel levels can result in different gauge
>> readings from one plane to another.
>
> All very true, and if a needle is bouncing, there's a good chance that
> gage's tank's got fuel in it.
>
>> A clock is a much better "fuel gauge", as long as the
>> fuel system is intact.
>
> I wonder if there's a mechanical clock or if the clock's integrated in
> the G1000 too?
>
Nothing stops one from wearing a watch. I don't rely on the clocks in the
plane. If they are functional, it saves you the trouble of looking at your
watch. ;-)

>> If there's a fuel leak, then either above scenario can bite you just
>> as badly.
>
> Right.
>
> And if you've got fuel coming out the overflow/vent, and aux-tank fuel
> system modifications, you might value those gages more than normal to
> help diagnose the cause of a malfunction.
>
While that seems reasonable on the surface, the question is what are you
going to do about it? Let's at least acknowledge that ferrying a GA plane
across the Atlantic is an unusual event. Mr. Rhine survived because he was
prepared for the level of problem he faced, but if he had lost too much
fuel to make it to safety, that backup radio would be more important than
a fuel gauge. He probably wouldn't have been able to fix the problem en
route.

Neil

[Larry Dighera]

On Thu, 26 Oct 2006 20:21:49 GMT, "Neil Gould"
> wrote in
>:

>He probably wouldn't have been able to fix the problem en
>route.

As the fix was to burn fuel from the wing tanks before switching to
the aux tank, it seems possible to have done it en route.

[cjcampbell]

Mxsmanic wrote:
> cjcampbell writes:
>
> > Most people know that the TV set turns off when the power goes out. You
> > would have to be incredibly stupid to not know that the panels will go
> > off in a power failure.
>
> I'm talking about a reboot, not a power failure.

The emergency procedures address that. IIRC you shut the thing off,
wait something like 30 seconds, then restart. What happens after that
depends on the aircraft and the installation. It is possible that the
rebooting can be stopped by simply pulling the circuit breaker of the
offending unit, leaving the rest of the system operational. One of the
advantages of the G1000 over earlier, similar systems like Avidyne is
that you can shut it off and then restart it while still in the air.
This is a vast improvement over the earlier systems which, once you
shut them off, had no way of restarting themselves while the aircraft
was moving.

[cjcampbell]

Mxsmanic wrote:
> cjcampbell writes:
>
> > People who fly real airplanes know that anything can break. It is part
> > of the training.
>
> I don't have the pilots in mind. I'm thinking of the vendor. If he
> had the time and knowledge to create an emergency procedure, he had
> the time and knowledge to fix the bug that can cause a reboot in the
> first place, which would be far more responsible than simply
> documenting it and forgetting about it.

You are a child, yet. Things don't work that way. The vendor comes up
with emergency procedures for every conceivable scenario. The
manufacturer knows that almost anything is possible, even though it
never shows up in development and testing, and tries to cover all
possible bases. Garmin certainly did not intentionally release
defective units.

[Neil Gould]

Recently, Larry Dighera > posted:

> On Thu, 26 Oct 2006 20:21:49 GMT, "Neil Gould"
> > wrote in
> >:
>
>> He probably wouldn't have been able to fix the problem en
>> route.
>
> As the fix was to burn fuel from the wing tanks before switching to
> the aux tank, it seems possible to have done it en route.
>
IIRC, that procedure was opposite the instructions for the use of the aux
tank. As he wasn't able to get out and take a look at what was happening
en route, that would not have been a viable option because if the
instructions were correct (which he found out after the fact that they
weren't), it would have killed him.

Neil

[Larry Dighera]

On Fri, 27 Oct 2006 10:19:40 GMT, "Neil Gould"
> wrote in
>:

>Recently, Larry Dighera > posted:
>
>> On Thu, 26 Oct 2006 20:21:49 GMT, "Neil Gould"
>> > wrote in
>> >:
>>
>>> He probably wouldn't have been able to fix the problem en
>>> route.
>>
>> As the fix was to burn fuel from the wing tanks before switching to
>> the aux tank, it seems possible to have done it en route.
>>
>IIRC, that procedure was opposite the instructions for the use of the aux
>tank. As he wasn't able to get out and take a look at what was happening
>en route, that would not have been a viable option because if the
>instructions were correct (which he found out after the fact that they
>weren't), it would have killed him.

My point it, that if the fuel gages were operational, and the pilot
observed anomalous fuel venting from the wing tanks while crossing the
Atlantic Ocean, he may have reasoned, that drawing fuel from the wing
tanks might have been preferable to jettisoning it overboard despite
the erroneous aux-tank operating instructions.

[Neil Gould]

Recently, Larry Dighera > posted:

> On Fri, 27 Oct 2006 10:19:40 GMT, "Neil Gould"
> > wrote in
> >:
>
>> Recently, Larry Dighera > posted:
>>
>>> On Thu, 26 Oct 2006 20:21:49 GMT, "Neil Gould"
>>> > wrote in
>>> >:
>>>
>>>> He probably wouldn't have been able to fix the problem en
>>>> route.
>>>
>>> As the fix was to burn fuel from the wing tanks before switching to
>>> the aux tank, it seems possible to have done it en route.
>>>
>> IIRC, that procedure was opposite the instructions for the use of
>> the aux tank. As he wasn't able to get out and take a look at what
>> was happening en route, that would not have been a viable option
>> because if the instructions were correct (which he found out after
>> the fact that they weren't), it would have killed him.
>
> My point it, that if the fuel gages were operational, and the pilot
> observed anomalous fuel venting from the wing tanks while crossing the
> Atlantic Ocean, he may have reasoned, that drawing fuel from the wing
> tanks might have been preferable to jettisoning it overboard despite
> the erroneous aux-tank operating instructions.
>
I understand your point, but that's a pretty big "if", IMO. First, the
pilot would have to "observe anomalous fuel venting". Is this possible?
Next, the pilot would have to reason why the fuel was venting, and I don't
see how that would have been possible. It would seem as likely that the
conclusion would be that there was some problem with the main tanks, and
thus more reliance on the aux tank, aggravating the problem, etc. After
all, why would it be reasonable to suspect that fuel would be venting from
tanks that were shut off, supposedly taking them out of the system, and
that the "fix" would be to disregard the specific instructions on the use
of the aux tank? I think Mr. Rhine's analysis of his circumstances and
choice of action were right on, as the relevant information was only
obtained after-the-fact.

Neil

[Larry Dighera]

On Fri, 27 Oct 2006 14:10:18 GMT, "Neil Gould"
> wrote in
>:

>Recently, Larry Dighera > posted:
>
>> On Fri, 27 Oct 2006 10:19:40 GMT, "Neil Gould"
>> > wrote in
>> >:
>>
>>> Recently, Larry Dighera > posted:
>>>
>>>> On Thu, 26 Oct 2006 20:21:49 GMT, "Neil Gould"
>>>> > wrote in
>>>> >:
>>>>
>>>>> He probably wouldn't have been able to fix the problem en
>>>>> route.
>>>>
>>>> As the fix was to burn fuel from the wing tanks before switching to
>>>> the aux tank, it seems possible to have done it en route.
>>>>
>>> IIRC, that procedure was opposite the instructions for the use of
>>> the aux tank. As he wasn't able to get out and take a look at what
>>> was happening en route, that would not have been a viable option
>>> because if the instructions were correct (which he found out after
>>> the fact that they weren't), it would have killed him.
>>
>> My point it, that if the fuel gages were operational, and the pilot
>> observed anomalous fuel venting from the wing tanks while crossing the
>> Atlantic Ocean, he may have reasoned, that drawing fuel from the wing
>> tanks might have been preferable to jettisoning it overboard despite
>> the erroneous aux-tank operating instructions.
>>
>I understand your point, but that's a pretty big "if", IMO. First, the
>pilot would have to "observe anomalous fuel venting". Is this possible?

Apparently it's not only possible, it actually occurred. You need to
read Mr. Rhine's narrative:
http://www.alexisparkinn.com/nwpilot's_tranatlantic_flight.htm

Upon reaching FL095 I was on top and looked to my left -- and
really got scared!!! The aircraft vent was venting a large amount
of fuel out into space! Thank you, Cessna for the under-wing
courtesy lights!

>Next, the pilot would have to reason why the fuel was venting, and I don't
>see how that would have been possible.

Really? Surely your powers of deduction are capable of reasoning,
that fuel is exiting the vent because the tank is full.

>It would seem as likely that the conclusion would be that there was some
>problem with the main tanks,

That conclusion would be partially correct; they were over full.

>and thus more reliance on the aux tank, aggravating the problem, etc.

Alternatively, an insightful pilot might have reasoned, that burning
fuel from over full tanks might alleviate the over full condition.

>After all, why would it be reasonable to suspect that fuel would be
>venting from tanks that were shut off, supposedly taking them out of
>the system,

If the prudent pilot of a transatlantic flight has invested the time
required to familiarize himself with the design and operation of the
aircraft's fuel system upon which his safety depends for the over
water portion of his course, prior to departure, he would know, that
the wing tanks remain in the system regardless of the position of the
fuel selector and fuel shutoff valves.

>and that the "fix" would be to disregard the specific
>instructions on the use of the aux tank?

If the prudent pilot of a transatlantic flight has invested the time
required to familiarize himself with the design and operation of the
aircraft's fuel system upon which his safety depends for the over
water portion of his course, he would have a good chance of figuring
out what was occurring, IMO. I know I would have thoroughly
scrutinized the POH, and mentally analyzed the function of the fuel
system and its modifications, before departing.

>I think Mr. Rhine's analysis of his circumstances and
>choice of action were right on, as the relevant information was only
>obtained after-the-fact.

I'm not questioning Mr. Rhine's action when he realized he had a
problem. There is little question, even if the cause had been
reasoned out, that it would be prudent to get back on the ground
pronto.

But I believe, that a pilot who had analyzed the fuel system's
operation before departure, would have had a good chance of, not only
diagnosing the cause of the fuel venting in flight, but questioning
the functionality of the fuel system modification before departure.

[Neil Gould]

Recently, Larry Dighera > posted:

> On Fri, 27 Oct 2006 14:10:18 GMT, "Neil Gould"
> > wrote in
>
>> After all, why would it be reasonable to suspect that fuel would be
>> venting from tanks that were shut off, supposedly taking them out of
>> the system,
>
> If the prudent pilot of a transatlantic flight has invested the time
> required to familiarize himself with the design and operation of the
> aircraft's fuel system upon which his safety depends for the over
> water portion of his course, prior to departure, he would know, that
> the wing tanks remain in the system regardless of the position of the
> fuel selector and fuel shutoff valves.
>
>> and that the "fix" would be to disregard the specific
>> instructions on the use of the aux tank?
>
> If the prudent pilot of a transatlantic flight has invested the time
> required to familiarize himself with the design and operation of the
> aircraft's fuel system upon which his safety depends for the over
> water portion of his course, he would have a good chance of figuring
> out what was occurring, IMO. I know I would have thoroughly
> scrutinized the POH, and mentally analyzed the function of the fuel
> system and its modifications, before departing.
>
So, in essence, you are saying that Mr. Rhine's main problem was that he
didn't reverse-engineer the installations of the aux tank and electronics,
because had he done that, he would have known that the instructions for
the use of the aux tank were eroneous and that there were problems with
the electronics. Frankly, I think that would be beyond many (if not most)
pilots' capabilities. Given your own predisposition towards thinking that
the G1000's failure was in a problem of its design (e.g. calling Mr.
Rhine's failure experience a "mode") rather than a side-effect of a
botched installation of unrelated panel components, I think it may be
unreasonable to think that the average pilot could analyze such a
situation any better than Mr. Rhine did.

The most recent C172 that I've flown was our club's C172SP. I would not
call its construction as being conducive to such an analysis by anyone
other than an A&P. Since the instructions included by the installer of the
aux tanks were clearly wrong, the only way to understand the actual
installation of the aux tank and its impact on the C172's fuel system
would be to take the plane apart. I did not have the impression that this
was one of Mr. Rhine's options.

Neil

[Mxsmanic]

cjcampbell writes:

> You are a child, yet. Things don't work that way.

That doesn't mean that they can't.

It's possible to build reliable software systems. Unfortunately,
people have been conditioned to accept catastrophic errors in software
systems as if they were unavoidable realities rather than simply the
avoidable result of carelessness. And they are usually unwilling to
pay the cost of error-free systems, anyway, even if it misking risking
their own lives to save money. But many of them don't realize the
actual magnitude of the risks they are accepting.

Software bugs are not imposed by Mother Nature or the laws of physics;
they are the result of poor design and construction, just like
physical engineering defects. There is no excuse for them in
safety-of-life applications, and companies should be held liable for
their reckless mistakes in building safety-of-life applications that
contain dangerous bugs.

> The vendor comes up with emergency procedures for every
> conceivable scenario.

The catastrophic software failures are often those that the vendor has
not bothered to imagine. It is the unhandled exception that causes
the catastrophic failure.

> Garmin certainly did not intentionally release defective units.

Probably true, but that doesn't mean that it is blameless for defects.
There are still notions of due diligence and fiduciary duty, although
for some reason people seem reluctant to apply them to the software
industry, even though they might apply them ruthlessly in any other
comparable domain.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Larry Dighera]

On Fri, 27 Oct 2006 16:21:49 GMT, "Neil Gould"
> wrote in
>:

>Recently, Larry Dighera > posted:
>
>> On Fri, 27 Oct 2006 14:10:18 GMT, "Neil Gould"
>> > wrote in
>>
>>> After all, why would it be reasonable to suspect that fuel would be
>>> venting from tanks that were shut off, supposedly taking them out of
>>> the system,
>>
>> If the prudent pilot of a transatlantic flight has invested the time
>> required to familiarize himself with the design and operation of the
>> aircraft's fuel system upon which his safety depends for the over
>> water portion of his course, prior to departure, he would know, that
>> the wing tanks remain in the system regardless of the position of the
>> fuel selector and fuel shutoff valves.
>>
>>> and that the "fix" would be to disregard the specific
>>> instructions on the use of the aux tank?
>>
>> If the prudent pilot of a transatlantic flight has invested the time
>> required to familiarize himself with the design and operation of the
>> aircraft's fuel system upon which his safety depends for the over
>> water portion of his course, he would have a good chance of figuring
>> out what was occurring, IMO. I know I would have thoroughly
>> scrutinized the POH, and mentally analyzed the function of the fuel
>> system and its modifications, before departing.
>>
>So, in essence, you are saying that Mr. Rhine's main problem was that he
>didn't reverse-engineer the installations of the aux tank and electronics,
>because had he done that, he would have known that the instructions for
>the use of the aux tank were eroneous and that there were problems with
>the electronics.

I'm not saying anything about Mr. Rhine being wrong.

>Frankly, I think that would be beyond many (if not most)
>pilots' capabilities.

If a pilot is incapable of understanding his aircraft's fuel system,
he should not be certified to fly it.

>Given your own predisposition towards thinking that
>the G1000's failure was in a problem of its design (e.g. calling Mr.
>Rhine's failure experience a "mode") rather than a side-effect of a
>botched installation of unrelated panel components, I think it may be
>unreasonable to think that the average pilot could analyze such a
>situation any better than Mr. Rhine did.

I fail to understand how the Garmin G1000's continuous re-boot mode
can be seen as anything other than a failure mode. If Garmin had
conceived of a modular, fault tolerant design, such a failure mode may
not have occurred.

The average pilot doesn't fly solo across the Atlantic, so I'm not
sure your opinion is relevant.

>The most recent C172 that I've flown was our club's C172SP. I would not
>call its construction as being conducive to such an analysis by anyone
>other than an A&P.

Does not the POH contain a fuel system schematic diagram and theory of
operation information? It shouldn't be beyond the average pilot's
ability to comprehend that information.

>Since the instructions included by the installer of the
>aux tanks were clearly wrong, the only way to understand the actual
>installation of the aux tank and its impact on the C172's fuel system
>would be to take the plane apart.

The ONLY way? Please. Why couldn't one request a similar aux fuel
system schematic diagram and theory of operation information as
contained in the POH from the aux tank STC holder.

>I did not have the impression that this was one of Mr. Rhine's options.

A pilot always has the option of requesting more information, no?

[Neil Gould]

Recently, Larry Dighera > posted:

> On Fri, 27 Oct 2006 16:21:49 GMT, "Neil Gould"
> > wrote in
> >:
>
>> Recently, Larry Dighera > posted:
>>
>>> On Fri, 27 Oct 2006 14:10:18 GMT, "Neil Gould"
>>> > wrote in
>>>
>>>> After all, why would it be reasonable to suspect that fuel would be
>>>> venting from tanks that were shut off, supposedly taking them out
>>>> of the system,
>>>
>>> If the prudent pilot of a transatlantic flight has invested the time
>>> required to familiarize himself with the design and operation of the
>>> aircraft's fuel system upon which his safety depends for the over
>>> water portion of his course, prior to departure, he would know, that
>>> the wing tanks remain in the system regardless of the position of
>>> the fuel selector and fuel shutoff valves.
>>>
>>>> and that the "fix" would be to disregard the specific
>>>> instructions on the use of the aux tank?
>>>
>>> If the prudent pilot of a transatlantic flight has invested the time
>>> required to familiarize himself with the design and operation of the
>>> aircraft's fuel system upon which his safety depends for the over
>>> water portion of his course, he would have a good chance of figuring
>>> out what was occurring, IMO. I know I would have thoroughly
>>> scrutinized the POH, and mentally analyzed the function of the fuel
>>> system and its modifications, before departing.
>>>
>> So, in essence, you are saying that Mr. Rhine's main problem was
>> that he didn't reverse-engineer the installations of the aux tank
>> and electronics, because had he done that, he would have known that
>> the instructions for the use of the aux tank were eroneous and that
>> there were problems with the electronics.
>
> I'm not saying anything about Mr. Rhine being wrong.
>
I didn't say that you said anything about Mr. Rhine being wrong.

>> Frankly, I think that would be beyond many (if not most)
>> pilots' capabilities.
>
> If a pilot is incapable of understanding his aircraft's fuel system,
> he should not be certified to fly it.
>
It isn't a matter of being capable of understanding the aircraft's fuel
system, One can be clearly capable of understanding it without being able
to verify the correctness of the information that lead to the
understanding. In Mr. Rhine's case, I'm sure he could understand the
misinformation that he was given, as it was not all that complex. But, it
was quite wrong, and that was the root of the problem.

>> Given your own predisposition towards thinking that
>> the G1000's failure was in a problem of its design (e.g. calling Mr.
>> Rhine's failure experience a "mode") rather than a side-effect of a
>> botched installation of unrelated panel components, I think it may be
>> unreasonable to think that the average pilot could analyze such a
>> situation any better than Mr. Rhine did.
>
> I fail to understand how the Garmin G1000's continuous re-boot mode
> can be seen as anything other than a failure mode. If Garmin had
> conceived of a modular, fault tolerant design, such a failure mode may
> not have occurred.
>
There is no such thing, and that exact reboot experience (it's not a MODE)
could be expected if the problem was a munged power source by virtue of
either an intermittent ground or overtaxed supply that drops the available
current below the required amount.

> The average pilot doesn't fly solo across the Atlantic, so I'm not
> sure your opinion is relevant.
>
You are the one who repeatedly brings it up. In

>> The most recent C172 that I've flown was our club's C172SP. I would
>> not call its construction as being conducive to such an analysis by
>> anyone other than an A&P.
>
> Does not the POH contain a fuel system schematic diagram and theory of
> operation information? It shouldn't be beyond the average pilot's
> ability to comprehend that information.
>
As above, if that information is wrong, then the value of that
understanding is nil. The information provided to Mr. Rhine regarding the
aux tank was wrong, according to his report, so the problem was not one of
comprehension.

>> Since the instructions included by the installer of the
>> aux tanks were clearly wrong, the only way to understand the actual
>> installation of the aux tank and its impact on the C172's fuel system
>> would be to take the plane apart.
>
> The ONLY way? Please. Why couldn't one request a similar aux fuel
> system schematic diagram and theory of operation information as
> contained in the POH from the aux tank STC holder.
>
You are proposing exactly what Mr. Rhine did; trusted the accuracy of the
information he was given. That doesn't verify the installation or impact
on the existing fuel system.

>> I did not have the impression that this was one of Mr. Rhine's
>> options.
>
> A pilot always has the option of requesting more information, no?
>
A volume of misinformation is useless. I don't see why this is such a
difficult concept to grasp.

Neil

[Peter Clark]

On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera >
wrote:

>I fail to understand how the Garmin G1000's continuous re-boot mode
>can be seen as anything other than a failure mode. If Garmin had
>conceived of a modular, fault tolerant design, such a failure mode may
>not have occurred.

The G1000 is modular and I doubt would have been certified if it
wasn't fault tolerant. The question here is whether that testing
included fault tolerance from outside hacks into the system like the
reported mickey-mouse entertainment system install.

>>Since the instructions included by the installer of the
>>aux tanks were clearly wrong, the only way to understand the actual
>>installation of the aux tank and its impact on the C172's fuel system
>>would be to take the plane apart.
>
>The ONLY way? Please. Why couldn't one request a similar aux fuel
>system schematic diagram and theory of operation information as
>contained in the POH from the aux tank STC holder.
>
>>I did not have the impression that this was one of Mr. Rhine's options.
>
>A pilot always has the option of requesting more information, no?

Basic logic 101. Where's the fuel from the aux tank going? Anyone
really think anyone would have plumbed it so that the engine would
have the option to draw directly from the aux tank rather than a relay
through another tank, like any other remote aux fuel tank? Especially
where this is a temporary long-range ferry tank setup, not a permanent
extra tank. I don't think you would need to rip the aircraft apart to
see how a temporary aux ferry tank is plumbed, but not having seen one
I can't say how obvious it would have been.

[Bob Noel]

In article >,
Peter Clark > wrote:

> The G1000 is modular and I doubt would have been certified if it
> wasn't fault tolerant.

fyi - fault tolerant is not a required characteristic for certification.

In fact, errors/bugs/"features" are permitted in certified systems so
long as they are (1) are not hazardous and (2) still allow the system
to meet its intended function. Also, a system reset can be a valid response
to faults in certified systems (which is definitely NOT fault tolerant).

>The question here is whether that testing
> included fault tolerance from outside hacks into the system like the
> reported mickey-mouse entertainment system install.

Whether such testing would be required for certification is dependent
on the level of criticality of the system

--
Bob Noel
Looking for a sig the
lawyers will hate

[Larry Dighera]

On Sat, 28 Oct 2006 18:58:11 -0400, Peter Clark
> wrote in
>:

>On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera >
>wrote:
>
>>I fail to understand how the Garmin G1000's continuous re-boot mode
>>can be seen as anything other than a failure mode. If Garmin had
>>conceived of a modular, fault tolerant design, such a failure mode may
>>not have occurred.
>
>The G1000 is modular

Perhaps. But, the modules are not independent. It would seem that an
error in one can precipitate complete system failure. That's a far
cry from traditional non-glass-cockpit instrumentation,
communications, and navigation equipment with which an anomaly in one
only causes limited failure, instead of virtually total failure.

>and I doubt would have been certified if it
>wasn't fault tolerant. The question here is whether that testing
>included fault tolerance from outside hacks into the system like the
>reported mickey-mouse entertainment system install.

To which particular "reported mickey-mouse entertainment system
install" are you referring?

>>>Since the instructions included by the installer of the
>>>aux tanks were clearly wrong, the only way to understand the actual
>>>installation of the aux tank and its impact on the C172's fuel system
>>>would be to take the plane apart.
>>
>>The ONLY way? Please. Why couldn't one request a similar aux fuel
>>system schematic diagram and theory of operation information as
>>contained in the POH from the aux tank STC holder.
>>
>>>I did not have the impression that this was one of Mr. Rhine's options.
>>
>>A pilot always has the option of requesting more information, no?
>
>Basic logic 101. Where's the fuel from the aux tank going? Anyone
>really think anyone would have plumbed it so that the engine would
>have the option to draw directly from the aux tank rather than a relay
>through another tank, like any other remote aux fuel tank?

I'm not sure I completely understand what you're trying to convey
above. In Mr. Rhine's case, the engine was able to draw fuel directly
from the aux-tank.

>Especiall where this is a temporary long-range ferry tank setup, not a permanent
>extra tank. I don't think you would need to rip the aircraft apart to
>see how a temporary aux ferry tank is plumbed, but not having seen one
>I can't say how obvious it would have been.

An aux-fuel system schematic and written theory of operation should
have been part of the 337.

[Neil Gould]

Recently, Larry Dighera > posted:

> On Sat, 28 Oct 2006 18:58:11 -0400, Peter Clark
>
>> On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera >
>> wrote:
>>
>>> I fail to understand how the Garmin G1000's continuous re-boot mode
>>> can be seen as anything other than a failure mode. If Garmin had
>>> conceived of a modular, fault tolerant design, such a failure mode
>>> may not have occurred.
>>
>> The G1000 is modular
>
> Perhaps. But, the modules are not independent. It would seem that an
> error in one can precipitate complete system failure. That's a far
> cry from traditional non-glass-cockpit instrumentation,
> communications, and navigation equipment with which an anomaly in one
> only causes limited failure, instead of virtually total failure.
>
That is a downside to the unified PFDs, although I don't understand why
the comm system should be tied into it in such a way that it can fail when
the PFD goes down. I would really like a more definitive source for the
system than just Mr. Rhine's experience, as there are other plausible
explanations for his experience that have little to do with the design of
the avionics.

>> and I doubt would have been certified if it
>> wasn't fault tolerant. The question here is whether that testing
>> included fault tolerance from outside hacks into the system like the
>> reported mickey-mouse entertainment system install.
>
> To which particular "reported mickey-mouse entertainment system
> install" are you referring?
>
I couldn't find the original post in this newsgroup, but I did find one
that quoted the original:

NW_Pilot wrote:
"The chances of myself refering or using this company for tanking is slim
I did not pick this company the customer did and the customer was not
happy with their services anyway they did a **** poor job at cutting the
panel when they installed the ADF and PS eng. entertainment system. (I
could have done a better job with a hack saw and a drill) and the painting
on the Horton kit they installed looked like orange peal!"

>>>> Since the instructions included by the installer of the
>>>> aux tanks were clearly wrong, the only way to understand the actual
>>>> installation of the aux tank and its impact on the C172's fuel
>>>> system would be to take the plane apart.
>>>
>>> The ONLY way? Please. Why couldn't one request a similar aux fuel
>>> system schematic diagram and theory of operation information as
>>> contained in the POH from the aux tank STC holder.
>>>
>>>> I did not have the impression that this was one of Mr. Rhine's
>>>> options.
>>>
>>> A pilot always has the option of requesting more information, no?
>>
>> Basic logic 101. Where's the fuel from the aux tank going? Anyone
>> really think anyone would have plumbed it so that the engine would
>> have the option to draw directly from the aux tank rather than a
>> relay through another tank, like any other remote aux fuel tank?
>
> I'm not sure I completely understand what you're trying to convey
> above. In Mr. Rhine's case, the engine was able to draw fuel directly
> from the aux-tank.
>
Disclaimer: I don't know what the typical practice is for installing aux
tanks. But, Peter's comment implies that it is normal to draw aux fuel
through another tank, rather than directly. If this had been done, the aux
tank arrangement couldn't have overpressurized the main tanks, causing
fuel to vent (see below).

>> Especiall where this is a temporary long-range ferry tank setup, not
>> a permanent extra tank. I don't think you would need to rip the
>> aircraft apart to see how a temporary aux ferry tank is plumbed,
>> but not having seen one I can't say how obvious it would have been.
>
> An aux-fuel system schematic and written theory of operation should
> have been part of the 337.
>
Perhaps they were, but they were incorrect:

NW_Pilot wrote:
"We finally figured out that the instructions for the ferry tank were not
correct, and really need to be changed before the company installing the
tank kills someone.

"The problem was the ferry tank's fuel return line was over pressurizing
the aircraft tanks, causing fuel to vent overboard. To prevent this, what
needed to be done was to FIRST run the aircraft's left tank down till it
was almost empty, THEN turn on the ferry tank.

"The instructions with the ferry tank said only to "Climb to altitude,
then switch to the ferry tank and turn off the aircraft fuel", then run it
till the fuel level hits a mark on the ferry tank's fuel level indicator.
These instructions turned out to be totally incorrect!"

Neil

[Mxsmanic]

Neil Gould writes:

> That is a downside to the unified PFDs, although I don't understand why
> the comm system should be tied into it in such a way that it can fail when
> the PFD goes down.

There is a tendency today to tie everything into everything, without
adequate testing and without examination of all possible consequences,
interactions, and failure modes. Many people are blinded by the glitz
of what computers seem to be able to do, and immediately try to link
everything together, not realizing the new vulnerabilities that this
creates.

Things like certification don't help, because most organizations have
no idea how to certify these systems to begin with; the certifications
are thus worthless.

--
Transpose mxsmanic and gmail to reach me by e-mail.

[Jose[_1_]]

> "The problem was the ferry tank's fuel return line was over pressurizing
> the aircraft tanks, causing fuel to vent overboard. To prevent this, what
> needed to be done was to FIRST run the aircraft's left tank down till it
> was almost empty, THEN turn on the ferry tank.

Yanno, now that I think of it, if these were the (presumably correct)
instructions that were given to =me=, my first question would be how do
I know that I can actually get gas out of the ferry tank? I want to
discover that I can't =before= takeoff, not three hundred miles out over
the Arctic Ocean when I finally turn the ferry tank on.

Jose
--
"Never trust anything that can think for itself, if you can't see where
it keeps its brain." (chapter 10 of book 3 - Harry Potter).
for Email, make the obvious change in the address.

[Neil Gould]

Recently, Jose > posted:

>> "The problem was the ferry tank's fuel return line was over
>> pressurizing the aircraft tanks, causing fuel to vent overboard. To
>> prevent this, what needed to be done was to FIRST run the aircraft's
>> left tank down till it was almost empty, THEN turn on the ferry tank.
>
> Yanno, now that I think of it, if these were the (presumably correct)
> instructions that were given to =me=, my first question would be how
> do I know that I can actually get gas out of the ferry tank? I want
> to discover that I can't =before= takeoff, not three hundred miles
> out over the Arctic Ocean when I finally turn the ferry tank on.
>
How would you discover that before actually using the system? That is the
crux of the point I made earlier addressing what "Prudent Pilots" might
actually know. In most cases, we can only trust the documentation that we
are given.

Neil

[Jose[_1_]]

> How would you discover that before actually using the system?

I'm not sure which "that" you are referring to, and I think we are
asking different questions. My question is essentially how does one
preflight the system (to know that fuel is actually coming out of the
aux tank) if you can't use the aux tank until you are three hundred
miles out over the ocean?

If the (correct) instructions were to switch to the ferry tank right
away, then correct operation (or at least =some= operation) can be
verified while over land (and the regular tanks can be checked on the
ground).

If the =incorrect= instructions are given, then we are talking about a
completely different animal.

Jose
--
"Never trust anything that can think for itself, if you can't see where
it keeps its brain." (chapter 10 of book 3 - Harry Potter).
for Email, make the obvious change in the address.

[Neil Gould]

Recently, Jose > posted:

> My question is essentially how does one
> preflight the system (to know that fuel is actually coming out of the
> aux tank) if you can't use the aux tank until you are three hundred
> miles out over the ocean?
>
Ah. We are looking at different aspects of this. My question was how does
one preflight the system to know that the method of use doesn't cause
critical problems, as it did in this case. You got fuel from the aux
tank... but it pushed even more fuel overboard!

Neil