|
|
Two guys were talking in a bar located in the
penthouse of a skyscraper. One of them, a bookish fellow with heavy
framed glasses, claims that the wind currents on the west side of the
building are so strong that they will suspended a man in mid air. The
other man is incredulous and equates the claim to bovine excrement (not
his exact words). A bet is placed and both men step out of the bar onto
the the western balcony. The first man vaults the railing and, sure
enough, hovers as the wind whips his clothing. The second man, amazed
by this fluke of nature says: "I have got to try that!", vaults the
railing and promptly falls 78 stories to his death. The bartender, no
stranger to this drama, utters under his breath "That Clark Kent is a
real jerk."
The superior pilot uses his superior judgment to avoid situations that
require his superior skills.
If you ignore the irrelevant ad hominem attacks, Paul's situation
provides an excellent example of an important consideration, that the
pilot is an integral part of the aircraft safety system and that not
all pilots are equal. Paul's panel is a reflection of the pilot and
embodies what he considers necessary for the man to machine interface.
Even though it has several critical flaws it is considered by Paul to
have an acceptable level of safety. We can assume that given his
exposure to risk as a test pilot and from the fact he is still with us
that he is either very good or very lucky. I don't like trusting luck
so lets assume he is a very good pilot who can deal with emergency
situations with steely alacrity. It can be inferred from his postings
that he would not argue with this assessment. Because of his skills,
Paul has a higher tolerance for risk than the average pilot, as he can
successfully deal with an emergency situation where others could not.
Paul's risk assessments may be valid for other pilots IF they possess
his skill level. On the other hand, Paul's confidence may have blinded
him to significant, and easily mitigated, risk exposure.
Batteries do not generate power, they store it for later use.
Unfortunately there is no reliable and accurate way to determine the
actual amount of usable energy available in a battery. If your system
depends on a having a certain amount of available energy and there is
no practical way to verify the availability of that energy then your
system has a significant shortcoming (npi). It would be better to
reduce the size of the secondary battery and install a secondary
alternator as the alternator (or dynamo) can supply electrons at a
fixed rate as long as the engine turns.
If you take the "batteries of unknown energy quantity" out of the
equation then Paul's entire airplane hangs by a single 22 gauge
alternator field wire. Cut that wire and the engine stops, the panel
goes dark and you loose ALL of your instruments.
Consider the following hypothetical but easily possible scenario.
An airplane just like Paul's is being serviced at an FBO in California.
During the service two important things happen, the batteries are
exhausted during the Pitot Static and transponder checks and, while
retrieving a dropped screw, the mechanic leans on and loosens the field
lead on the back of the alternator. The service takes longer than
planned and the pilot is anxious to make a business meeting in Denver
so the plane is started with a ground power unit. The pilot makes three
circuits in the pattern as a "test flight" and departs for Centennial
Field.
50 miles west of Eagle CO at FL240 the low voltage warning light comes
on. The pilot cycles the alternator field breaker, sheds load and
checks weather at the nearby airports. Everything west of the front
range is IMC but his destination is clear. Previous testing has shown
that he has a 45 minute duration when running on the essential bus,
more than enough to get over the last of the cumulous granite.
10 minutes later, over Eagle, the buss voltage has dropped below 9
volts (the DO160E specified emergency operation lower limit) and the
panel starts to go dark. The pilot keys the mic to declare an emergency
but the additional load of the transmitter kills the last of his
avionics. He is now at 17,000' MSL flying over 14,000' mountain peaks,
hard IMC and only his slip indicator and whisky compass are working. No
engine, no horizon, no airspeed, no altimeter, no GPS, no
communication. It is the check ride from Hell. The NTSB reports that a
post crash fire made determining the cause of the accident impossible.
What really happened is that the ground power jack could only charge
one of the batteries (diode isolation) and that single battery only
received a partial charge. The loosened field lead introduced a series
resistance into the field winding limiting the alternator output to 11
amps, enough to keep the voltage monitoring system happy but not enough
to charge the battery. The resistance at the field lead caused local
heating and the termination failed, causing the low voltage warning to
finally trip. The pilot assumed he had a full charge when in fact he
only had 15% battery capacity available.
Every element of the above scenario has actually happened. Without
using my imagination I simply assembled the elements into an accident
"chain" for illustrative purposes.
In many cases failures are not failures at all but rather unforeseen
interactions of various components. To illustrate:
Paul's statement << the Dynon <snip> was good
enough for the fine
ENGINEERS at Scaled when WE flew SS1 to space, it never failed >> is factually accurate but may not tell the
entire story. I have read several accounts where on one of the test
flights (May 13th?) the system went dark due to a failure of the
display dimming control. So while it can be said that the display did
not fail, the system did functionally fail as the pilot could not see
the display. The engineers did not foresee that an open circuit on the
dimmer would cause the display to go to minimum brightness. The default
state should have been full bright. Paul's spin is a case of "The
operation was a success but the patient died".
Another example comes from Fossett's GlobalFlyer. During high altitude
flight tests the aircraft encountered temperatures significantly below
IACO standard temperatures for that altitude. The software engineers
did not consider this condition so when the OAT reported -60C the
software interpreted this as an unreasonable value beyond the normal
range and flagged the OAT as "Failed". This caused the Air Data
Computer to set its warning flag which caused the AHRS to fail and the
EFIS display to go all blue. An unexpected reading took down the entire
EFIS system. The fix was to increase the "good value" range and to
introduce a function where if there was an actual OAT failure the ADC
would consult a table and use the IACO standard temperature for that
altitude.
My perspective is quite different than Paul's. Paul has spent his
carrier working with the best. The best pilots, engineers and mechanics
with multi-million dollar budgets building, testing and flying mission
specific aircraft. My time has been spent designing systems that must
function across a broad spectrum of aircraft that may have been built
by owners with less than rocket scientist skills and flown by low time
pilots who don't have a team of engineers and mechanics backing them
up. Paul's experience allows him to plan for the best. Years of experience with thousands of systems in hundreds
of different types of aircraft dictate that I MUST assume the worst. Paul may indeed have Superman's flying skills. He has
stared down Danger and has chunks or Risk in his stool. I applaud his
service to this country and his achievements as a pilot and engineer.
But none of that qualifies him to tell a homebuilder where the line of
acceptable risk is drawn or to invite them to vault the handrail. Only
the builder/pilot can make that call. I would argue it is better to err
on the side of safety.
Some truisms to consider:
Good old fashioned and ugly aneroid altimeters and airspeed indicators
have no use for electrons.
Spinning mass gyroscopes laugh at induced lighting pulses.
One small standby alternator will produce infinitely more electrons
than a battery of any size.
"Designed to meet TSO / DO160 / DO178" is a LONG way from "Tested and
qualified to TSO / DO160 / DO178".
When things get bad, "useful" beats "pretty" every time.
An electronic device is NOT intrinsically more reliable than its
mechanical analog.
"All glass is good" is a statement of faith, not fact.
Wishing all a prosperous and safe New Year.
Regards
Brent Regan
|
|