X-Virus-Scanned: clean according to Sophos on Logan.com
Return-Path: <marv@lancaironline.net>
Sender: <marv@lancaironline.net>
To: lml@lancaironline.net
Date: Thu, 23 Aug 2007 07:40:02 -0400
Message-ID: <redirect-2279986@logan.com>
X-Original-Return-Path: <brent@regandesigns.com>
Received: from wind.imbris.com ([216.18.130.7] verified)
  by logan.com (CommuniGate Pro SMTP 5.1.11)
  with ESMTPS id 2279544 for lml@lancaironline.net; Thu, 23 Aug 2007 00:36:59 -0400
Received-SPF: none
 receiver=logan.com; client-ip=216.18.130.7; envelope-from=brent@regandesigns.com
Received: from [192.168.1.100] (cbl-238-80.conceptcable.com [207.170.238.80] (may be forged))
	(authenticated bits=0)
	by wind.imbris.com (8.12.11/8.12.11.S) with ESMTP id l7N4aFX6061578
	for <lml@lancaironline.net>; Wed, 22 Aug 2007 21:36:15 -0700 (PDT)
	(envelope-from brent@regandesigns.com)
X-Original-Message-ID: <46CD0EBE.2040002@regandesigns.com>
X-Original-Date: Wed, 22 Aug 2007 21:36:14 -0700
From: Brent Regan <brent@regandesigns.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax)
X-Accept-Language: en-us, en
MIME-Version: 1.0
X-Original-To: Lancair Mailing List <lml@lancaironline.net>
Subject: Re: fallability in the digital age
Content-Type: multipart/alternative;
 boundary="------------020300040107090000040404"

This is a multi-part message in MIME format.
--------------020300040107090000040404
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Colyn writes:
<<Yesterday I was out for a lark and the screen display gradually 
disintegrated just like in the movie "the matrix".     I hadn't 
internalized how dependent I was on this piece of equipment until it 
wasn't there.  <snip> Anyway, maybe Brent can correct me, but I assume 
if a Garmin can break, a Chelton can break.
I hope you Chelton drivers are ready for it when it happens.>>

Brent agrees with you! Brent understands that anything can, and 
therefore will, break and you MUST have a plan for when that happens. 
That is why the Chelton systems are designed as  recursively redundant 
units. Each display is identical to the others and the architecture of 
the communication ports is such that if one screen dies then the next 
one automatically steps up and takes over.  So you do not need to hope, 
Chelton drivers ARE prepared if a display goes Tango Uniform. Two 
redundant screens beat one big screen every time.

Even if you do everything right , there are still unseen forces at work. 
Our planet is constantly being bombarded with high energy particles 
(Cosmic Rays). When one of these particles hits a memory cell just right 
it can cause it to flip (google "single event upset"). If the right cell 
flips it can cause the processor to hang or crash. While this does not 
happen very often, there are billions of memory cells and the Cosmic Ray 
flux increases dramatically with altitude. This is why we designed the 
Chelton systems with Error Correcting Code (ECC) RAM. I know of no other 
system available to the experimental market  that has ECC RAM. In 
addition, all Chelton systems (and sub systems and sensors) have 
independent hardware watchdogs that reset the entire system in the event 
of the flight software hanging or crashing.

On the topic of software,  in flight mode the Chelton systems do not 
have or use an "operating system". The Level A certified flight code 
does all the required functions. It even gives the BIOS the boot after 
boot. Certifying a Microsoft or Linux style OS to level A would be about 
as easy as making water that wasn't wet. Chelton does use a DOS -like 
environment only in ground maintenance mode.

The next thing to worry about is a total aircraft power failure.  All 
electronics require power so if you take the power away..... This is why 
smart builders have standby gauges IN THE SCAN and those gauges are the 
good old fashioned mechanical ones. They operate on different physics 
than the fancy glass and will likely survive whatever kills the 
computers. Don't forget a UPS for the standbys. Harry League has a great 
example of a nicely arranged panel. Harry, how about a picture? I know 
you are camera shy.

While I am on a rant, here are some glass myths that need to die:

"The best instrument panel would be a 42" plasma monitor." Bigger is not 
intrinsically better. This is coming from someone who is just under two 
meters tall and a hundred kilos (bet you didn't know they could stack 
sh*t that high).  What is better is to have the critical flight 
information as clearly as practical is the smallest visual arc. Fix your 
vision on this point * and see how may words you can read around it 
without moving your gaze.  You get an idea as to the small size of the 
fovea cenrtralis. Flight information needs to be clear and concise. When 
a big screen goes dark, all you have is a big loud nuthen, unless it 
also controls your radios.

"Detailed terrain graphics is a good thing."  Detailed graphics hog 
resources. Resources that would be better used to provide a faster frame 
rate, storing a larger terrain database,  processing sensor data and 
performing useful housekeeping tasks like checking the validity of 
incoming data and the accuracy of displayed data. Besides, the FAA is 
very particular about display colors. Getting them to accept the graded 
sky was a big push. Displaying photo realistic terrain is a non-starter. 
How are you going to guarantee that the terrain "pattern" will not form 
a "symbol" that could be interpreted by the pilot as "false or 
misleading" information.  As with animals in clouds or the face on Mars, 
the brain wants to make sense from chaos. The last thing you need is a  
Rorschach EFIS. You can avoid an ugly brown mountain just as easily as a 
pretty textured hillock.  It would be a shame if the processor crashed 
while painting that pretty picture and the last thing to go through your 
aesthetically pleased mind was the rudder.

"We are introducing our new EFIS. It will be certified in 6 months and 
cost 5 grand." The only this that gets through the FAA in 6 months or 
less is coffee and doughnuts.  Not only is getting certification hard, 
it is getting harder as the FAA is getting smarter...er...well.. more 
experienced.  Graphics processors and programmable logic devices now 
raise enough red flags to make Lenin feel homesick. It would take at 
least 2 years and 3-5M$ to certify an all new EFIS and the software to 
run it. If you sold a 1,000 units then you would need to allocate $5K 
per unit just for amortized certification costs. Add cost of goods, 
marketing , overhead, insurance ..... and operate at a modest 50% gross 
margin and all of a sudden $30K per screen seems pretty reasonable.  If 
it seems too good to be true......

With the nearly ubiquitous availability of industrial single board 
computers, high brightness color displays, RC model AHRS and flight 
simulation software, an EFIS that draws slack jawed oglers at trade 
shows can be built by any idiot, and they frequently are.  But aren't 
idiots a valued resource? After all, doesn't every village need one?  
Yes Timmy, but would you trust your life to one?

Speaking as an idiot  who did those very things, thirteen long years 
ago,  trust me when I say  "Don't trust what you hear or read."

Follow these rules, even if I am wrong it can't hurt:

Believe nothing a marketing person tells you.
Fly before you buy.
If it is a "future upgrade" assume it will never happen.
Plan for when it breaks.

Regards
Brent Regan





--------------020300040107090000040404
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
  <title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<font face="Arial">Colyn writes:<br>
&lt;&lt;</font>Yesterday I was out for a lark and the screen display
gradually disintegrated just like in the movie "the matrix".&nbsp;&nbsp;&nbsp;&nbsp; I
hadn't internalized how dependent I was on this piece of equipment
until it wasn't there.&nbsp; &lt;snip&gt; Anyway, maybe Brent can correct
me, but I assume if a Garmin can break, a Chelton can break.
<br>
I hope you Chelton drivers are ready for it when it happens.&gt;&gt;<br>
<br>
Brent agrees with you! Brent understands that anything can, and
therefore will, break and you MUST have a plan for when that happens.
That is why the Chelton systems are designed as&nbsp; recursively redundant
units. Each display is identical to the others and the architecture of
the communication ports is such that if one screen dies then the next
one automatically steps up and takes over.&nbsp; So you do not need to hope,
Chelton drivers ARE prepared if a display goes Tango Uniform. Two
redundant screens beat one big screen every time.<br>
<br>
Even if you do everything right , there are still unseen forces at
work. Our planet is constantly being bombarded with high energy
particles (Cosmic Rays). When one of these particles hits a memory cell
just right it can cause it to flip (google "single event upset"). If
the right cell flips it can cause the processor to hang or crash. While
this does not happen very often, there are billions of memory cells and
the Cosmic Ray flux increases dramatically with altitude. This is why
we designed the Chelton systems with Error Correcting Code (ECC) RAM. I
know of no other system available to the experimental market&nbsp; that has
ECC RAM. In addition, all Chelton systems (and sub systems and sensors)
have independent hardware watchdogs that reset the entire system in the
event of the flight software hanging or crashing. <br>
<br>
On the topic of software,&nbsp; in flight mode the Chelton systems do not
have or use an "operating system". The Level A certified flight code
does all the required functions. It even gives the BIOS the boot after
boot. Certifying a Microsoft or Linux style OS to level A would be
about as easy as making water that wasn't wet. Chelton does use a DOS
-like environment only in ground maintenance mode.<br>
<br>
The next thing to worry about is a total aircraft power failure.&nbsp; All
electronics require power so if you take the power away..... This is
why smart builders have standby gauges IN THE SCAN and those gauges are
the good old fashioned mechanical ones. They operate on different
physics than the fancy glass and will likely survive whatever kills the
computers. Don't forget a UPS for the standbys. Harry League has a
great example of a nicely arranged panel. Harry, how about a picture? I
know you are camera shy.<br>
<br>
While I am on a rant, here are some glass myths that need to die:<br>
<br>
"The best instrument panel would be a 42" plasma monitor." Bigger is
not intrinsically better. This is coming from someone who is just under
two meters tall and a hundred kilos (bet you didn't know they could
stack sh*t that high).&nbsp; What <b>is</b> better is to have the critical
flight information as clearly as practical is the smallest visual arc.
Fix your vision on this point * and see how may words you can read
around it without moving your gaze.&nbsp; You get an idea as to the small
size of the fovea cenrtralis. Flight information needs to be clear and
concise. When a big screen goes dark, all you have is a big loud
nuthen, unless it also controls your radios. <br>
<br>
"Detailed terrain graphics is a good thing."&nbsp; Detailed graphics hog
resources. Resources that would be better used to provide a faster
frame rate, storing a larger terrain database,&nbsp; processing sensor data
and performing useful housekeeping tasks like checking the validity of
incoming data and the accuracy of displayed data. Besides, the FAA is
very particular about display colors. Getting them to accept the graded
sky was a big push. Displaying photo realistic terrain is a
non-starter. How are you going to guarantee that the terrain "pattern"
will not form a "symbol" that could be interpreted by the pilot as
"false or misleading" information.&nbsp; As with animals in clouds or the
face on Mars, the brain wants to make sense from chaos. The last thing
you need is a&nbsp; Rorschach EFIS. You can avoid an ugly brown mountain
just as easily as a pretty textured hillock.&nbsp; It would be a shame if
the processor crashed while painting that pretty picture and the last
thing to go through your aesthetically pleased mind was the rudder.<br>
<br>
"We are introducing our new EFIS. It will be certified in 6 months and
cost 5 grand." The only this that gets through the FAA in 6 months or
less is coffee and doughnuts.&nbsp; Not only is getting certification hard,
it is getting harder as the FAA is getting smarter...er...well.. more
experienced.&nbsp; Graphics processors and programmable logic devices now
raise enough red flags to make Lenin feel homesick. It would take at
least 2 years and 3-5M$ to certify an all new EFIS and the software to
run it. If you sold a 1,000 units then you would need to allocate $5K
per unit just for amortized certification costs. Add cost of goods,
marketing , overhead, insurance ..... and operate at a modest 50% gross
margin and all of a sudden $30K per screen seems pretty reasonable.&nbsp; If
it seems too good to be true......<br>
<br>
With the nearly ubiquitous availability of industrial single board
computers, high brightness color displays, RC model AHRS and flight
simulation software, an EFIS that draws slack jawed oglers at trade
shows can be built by any idiot, and they frequently are.&nbsp; But aren't
idiots a valued resource? After all, doesn't every village need one?&nbsp;
Yes Timmy, but would you trust your life to one?<br>
<br>
Speaking as an idiot&nbsp; who did those very things, thirteen long years
ago,&nbsp; trust me when I say&nbsp; "Don't trust what you hear or read." <br>
<br>
Follow these rules, even if I am wrong it can't hurt:<br>
<br>
Believe nothing a marketing person tells you.<br>
Fly before you buy.<br>
If it is a "future upgrade" assume it will never happen.<br>
Plan for when it breaks.<br>
<br>
Regards<br>
Brent Regan<br>
<br>
<br>
<br>
<br>
</body>
</html>

--------------020300040107090000040404--