HondaJet: Not A Steam Gage In Sight

Recently, Larry Dighera posted:

On Fri, 27 Oct 2006 16:21:49 GMT, "Neil Gould"
wrote in
:

Recently, Larry Dighera posted:

On Fri, 27 Oct 2006 14:10:18 GMT, "Neil Gould"
wrote in

After all, why would it be reasonable to suspect that fuel would be
venting from tanks that were shut off, supposedly taking them out
of the system,

If the prudent pilot of a transatlantic flight has invested the time
required to familiarize himself with the design and operation of the
aircraft's fuel system upon which his safety depends for the over
water portion of his course, prior to departure, he would know, that
the wing tanks remain in the system regardless of the position of
the fuel selector and fuel shutoff valves.

and that the "fix" would be to disregard the specific
instructions on the use of the aux tank?

If the prudent pilot of a transatlantic flight has invested the time
required to familiarize himself with the design and operation of the
aircraft's fuel system upon which his safety depends for the over
water portion of his course, he would have a good chance of figuring
out what was occurring, IMO. I know I would have thoroughly
scrutinized the POH, and mentally analyzed the function of the fuel
system and its modifications, before departing.

So, in essence, you are saying that Mr. Rhine's main problem was
that he didn't reverse-engineer the installations of the aux tank
and electronics, because had he done that, he would have known that
the instructions for the use of the aux tank were eroneous and that
there were problems with the electronics.

I'm not saying anything about Mr. Rhine being wrong.

I didn't say that you said anything about Mr. Rhine being wrong.

Frankly, I think that would be beyond many (if not most)
pilots' capabilities.

If a pilot is incapable of understanding his aircraft's fuel system,
he should not be certified to fly it.

It isn't a matter of being capable of understanding the aircraft's fuel
system, One can be clearly capable of understanding it without being able
to verify the correctness of the information that lead to the
understanding. In Mr. Rhine's case, I'm sure he could understand the
misinformation that he was given, as it was not all that complex. But, it
was quite wrong, and that was the root of the problem.

Given your own predisposition towards thinking that
the G1000's failure was in a problem of its design (e.g. calling Mr.
Rhine's failure experience a "mode") rather than a side-effect of a
botched installation of unrelated panel components, I think it may be
unreasonable to think that the average pilot could analyze such a
situation any better than Mr. Rhine did.

I fail to understand how the Garmin G1000's continuous re-boot mode
can be seen as anything other than a failure mode. If Garmin had
conceived of a modular, fault tolerant design, such a failure mode may
not have occurred.

There is no such thing, and that exact reboot experience (it's not a MODE)
could be expected if the problem was a munged power source by virtue of
either an intermittent ground or overtaxed supply that drops the available
current below the required amount.

The average pilot doesn't fly solo across the Atlantic, so I'm not
sure your opinion is relevant.

You are the one who repeatedly brings it up. In

The most recent C172 that I've flown was our club's C172SP. I would
not call its construction as being conducive to such an analysis by
anyone other than an A&P.

Does not the POH contain a fuel system schematic diagram and theory of
operation information? It shouldn't be beyond the average pilot's
ability to comprehend that information.

As above, if that information is wrong, then the value of that
understanding is nil. The information provided to Mr. Rhine regarding the
aux tank was wrong, according to his report, so the problem was not one of
comprehension.

Since the instructions included by the installer of the
aux tanks were clearly wrong, the only way to understand the actual
installation of the aux tank and its impact on the C172's fuel system
would be to take the plane apart.

The ONLY way? Please. Why couldn't one request a similar aux fuel
system schematic diagram and theory of operation information as
contained in the POH from the aux tank STC holder.

You are proposing exactly what Mr. Rhine did; trusted the accuracy of the
information he was given. That doesn't verify the installation or impact
on the existing fuel system.

I did not have the impression that this was one of Mr. Rhine's
options.

A pilot always has the option of requesting more information, no?

A volume of misinformation is useless. I don't see why this is such a
difficult concept to grasp.

Neil

On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera
wrote:

I fail to understand how the Garmin G1000's continuous re-boot mode
can be seen as anything other than a failure mode. If Garmin had
conceived of a modular, fault tolerant design, such a failure mode may
not have occurred.

The G1000 is modular and I doubt would have been certified if it
wasn't fault tolerant. The question here is whether that testing
included fault tolerance from outside hacks into the system like the
reported mickey-mouse entertainment system install.

Since the instructions included by the installer of the
aux tanks were clearly wrong, the only way to understand the actual
installation of the aux tank and its impact on the C172's fuel system
would be to take the plane apart.

The ONLY way? Please. Why couldn't one request a similar aux fuel
system schematic diagram and theory of operation information as
contained in the POH from the aux tank STC holder.

I did not have the impression that this was one of Mr. Rhine's options.

A pilot always has the option of requesting more information, no?

Basic logic 101. Where's the fuel from the aux tank going? Anyone
really think anyone would have plumbed it so that the engine would
have the option to draw directly from the aux tank rather than a relay
through another tank, like any other remote aux fuel tank? Especially
where this is a temporary long-range ferry tank setup, not a permanent
extra tank. I don't think you would need to rip the aircraft apart to
see how a temporary aux ferry tank is plumbed, but not having seen one
I can't say how obvious it would have been.

In article ,
Peter Clark wrote:

The G1000 is modular and I doubt would have been certified if it
wasn't fault tolerant.

fyi - fault tolerant is not a required characteristic for certification.

In fact, errors/bugs/"features" are permitted in certified systems so
long as they are (1) are not hazardous and (2) still allow the system
to meet its intended function. Also, a system reset can be a valid response
to faults in certified systems (which is definitely NOT fault tolerant).

The question here is whether that testing
included fault tolerance from outside hacks into the system like the
reported mickey-mouse entertainment system install.

Whether such testing would be required for certification is dependent
on the level of criticality of the system

--
Bob Noel
Looking for a sig the
lawyers will hate

On Sat, 28 Oct 2006 18:58:11 -0400, Peter Clark
wrote in
:

On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera
wrote:

I fail to understand how the Garmin G1000's continuous re-boot mode
can be seen as anything other than a failure mode. If Garmin had
conceived of a modular, fault tolerant design, such a failure mode may
not have occurred.

The G1000 is modular

Perhaps. But, the modules are not independent. It would seem that an
error in one can precipitate complete system failure. That's a far
cry from traditional non-glass-cockpit instrumentation,
communications, and navigation equipment with which an anomaly in one
only causes limited failure, instead of virtually total failure.

and I doubt would have been certified if it
wasn't fault tolerant. The question here is whether that testing
included fault tolerance from outside hacks into the system like the
reported mickey-mouse entertainment system install.

To which particular "reported mickey-mouse entertainment system
install" are you referring?

Since the instructions included by the installer of the
aux tanks were clearly wrong, the only way to understand the actual
installation of the aux tank and its impact on the C172's fuel system
would be to take the plane apart.

The ONLY way? Please. Why couldn't one request a similar aux fuel
system schematic diagram and theory of operation information as
contained in the POH from the aux tank STC holder.

I did not have the impression that this was one of Mr. Rhine's options.

A pilot always has the option of requesting more information, no?

Basic logic 101. Where's the fuel from the aux tank going? Anyone
really think anyone would have plumbed it so that the engine would
have the option to draw directly from the aux tank rather than a relay
through another tank, like any other remote aux fuel tank?

I'm not sure I completely understand what you're trying to convey
above. In Mr. Rhine's case, the engine was able to draw fuel directly
from the aux-tank.

Especiall where this is a temporary long-range ferry tank setup, not a permanent
extra tank. I don't think you would need to rip the aircraft apart to
see how a temporary aux ferry tank is plumbed, but not having seen one
I can't say how obvious it would have been.

An aux-fuel system schematic and written theory of operation should
have been part of the 337.

Recently, Larry Dighera posted:

On Sat, 28 Oct 2006 18:58:11 -0400, Peter Clark

On Sat, 28 Oct 2006 17:10:18 GMT, Larry Dighera
wrote:

I fail to understand how the Garmin G1000's continuous re-boot mode
can be seen as anything other than a failure mode. If Garmin had
conceived of a modular, fault tolerant design, such a failure mode
may not have occurred.

The G1000 is modular

Perhaps. But, the modules are not independent. It would seem that an
error in one can precipitate complete system failure. That's a far
cry from traditional non-glass-cockpit instrumentation,
communications, and navigation equipment with which an anomaly in one
only causes limited failure, instead of virtually total failure.

That is a downside to the unified PFDs, although I don't understand why
the comm system should be tied into it in such a way that it can fail when
the PFD goes down. I would really like a more definitive source for the
system than just Mr. Rhine's experience, as there are other plausible
explanations for his experience that have little to do with the design of
the avionics.

and I doubt would have been certified if it
wasn't fault tolerant. The question here is whether that testing
included fault tolerance from outside hacks into the system like the
reported mickey-mouse entertainment system install.

To which particular "reported mickey-mouse entertainment system
install" are you referring?

I couldn't find the original post in this newsgroup, but I did find one
that quoted the original:

NW_Pilot wrote:
"The chances of myself refering or using this company for tanking is slim
I did not pick this company the customer did and the customer was not
happy with their services anyway they did a **** poor job at cutting the
panel when they installed the ADF and PS eng. entertainment system. (I
could have done a better job with a hack saw and a drill) and the painting
on the Horton kit they installed looked like orange peal!"

Since the instructions included by the installer of the
aux tanks were clearly wrong, the only way to understand the actual
installation of the aux tank and its impact on the C172's fuel
system would be to take the plane apart.

The ONLY way? Please. Why couldn't one request a similar aux fuel
system schematic diagram and theory of operation information as
contained in the POH from the aux tank STC holder.

I did not have the impression that this was one of Mr. Rhine's
options.

A pilot always has the option of requesting more information, no?

Basic logic 101. Where's the fuel from the aux tank going? Anyone
really think anyone would have plumbed it so that the engine would
have the option to draw directly from the aux tank rather than a
relay through another tank, like any other remote aux fuel tank?

I'm not sure I completely understand what you're trying to convey
above. In Mr. Rhine's case, the engine was able to draw fuel directly
from the aux-tank.

Disclaimer: I don't know what the typical practice is for installing aux
tanks. But, Peter's comment implies that it is normal to draw aux fuel
through another tank, rather than directly. If this had been done, the aux
tank arrangement couldn't have overpressurized the main tanks, causing
fuel to vent (see below).

Especiall where this is a temporary long-range ferry tank setup, not
a permanent extra tank. I don't think you would need to rip the
aircraft apart to see how a temporary aux ferry tank is plumbed,
but not having seen one I can't say how obvious it would have been.

An aux-fuel system schematic and written theory of operation should
have been part of the 337.

Perhaps they were, but they were incorrect:

NW_Pilot wrote:
"We finally figured out that the instructions for the ferry tank were not
correct, and really need to be changed before the company installing the
tank kills someone.

"The problem was the ferry tank's fuel return line was over pressurizing
the aircraft tanks, causing fuel to vent overboard. To prevent this, what
needed to be done was to FIRST run the aircraft's left tank down till it
was almost empty, THEN turn on the ferry tank.

"The instructions with the ferry tank said only to "Climb to altitude,
then switch to the ferry tank and turn off the aircraft fuel", then run it
till the fuel level hits a mark on the ferry tank's fuel level indicator.
These instructions turned out to be totally incorrect!"

Neil

Neil Gould writes:

That is a downside to the unified PFDs, although I don't understand why
the comm system should be tied into it in such a way that it can fail when
the PFD goes down.

There is a tendency today to tie everything into everything, without
adequate testing and without examination of all possible consequences,
interactions, and failure modes. Many people are blinded by the glitz
of what computers seem to be able to do, and immediately try to link
everything together, not realizing the new vulnerabilities that this
creates.

Things like certification don't help, because most organizations have
no idea how to certify these systems to begin with; the certifications
are thus worthless.

--
Transpose mxsmanic and gmail to reach me by e-mail.

"The problem was the ferry tank's fuel return line was over pressurizing
the aircraft tanks, causing fuel to vent overboard. To prevent this, what
needed to be done was to FIRST run the aircraft's left tank down till it
was almost empty, THEN turn on the ferry tank.

Yanno, now that I think of it, if these were the (presumably correct)
instructions that were given to =me=, my first question would be how do
I know that I can actually get gas out of the ferry tank? I want to
discover that I can't =before= takeoff, not three hundred miles out over
the Arctic Ocean when I finally turn the ferry tank on.

Jose
--
"Never trust anything that can think for itself, if you can't see where
it keeps its brain." (chapter 10 of book 3 - Harry Potter).
for Email, make the obvious change in the address.

Recently, Jose posted:

"The problem was the ferry tank's fuel return line was over
pressurizing the aircraft tanks, causing fuel to vent overboard. To
prevent this, what needed to be done was to FIRST run the aircraft's
left tank down till it was almost empty, THEN turn on the ferry tank.

Yanno, now that I think of it, if these were the (presumably correct)
instructions that were given to =me=, my first question would be how
do I know that I can actually get gas out of the ferry tank? I want
to discover that I can't =before= takeoff, not three hundred miles
out over the Arctic Ocean when I finally turn the ferry tank on.

How would you discover that before actually using the system? That is the
crux of the point I made earlier addressing what "Prudent Pilots" might
actually know. In most cases, we can only trust the documentation that we
are given.

Neil

How would you discover that before actually using the system?

I'm not sure which "that" you are referring to, and I think we are
asking different questions. My question is essentially how does one
preflight the system (to know that fuel is actually coming out of the
aux tank) if you can't use the aux tank until you are three hundred
miles out over the ocean?

If the (correct) instructions were to switch to the ferry tank right
away, then correct operation (or at least =some= operation) can be
verified while over land (and the regular tanks can be checked on the
ground).

If the =incorrect= instructions are given, then we are talking about a
completely different animal.

Jose
--
"Never trust anything that can think for itself, if you can't see where
it keeps its brain." (chapter 10 of book 3 - Harry Potter).
for Email, make the obvious change in the address.

Recently, Jose posted:

My question is essentially how does one
preflight the system (to know that fuel is actually coming out of the
aux tank) if you can't use the aux tank until you are three hundred
miles out over the ocean?

Ah. We are looking at different aspects of this. My question was how does
one preflight the system to know that the method of use doesn't cause
critical problems, as it did in this case. You got fuel from the aux
tank... but it pushed even more fuel overboard!

Neil