Are Glass Panels Really Unsafe

Just about any thread relative to Glass panels will usually contain a post or 2 about their being a safety issue. I must admit that long ago I felt the same. After several years of flying behind them now I am not so sure they are any less safe than the steam guages they replace. But how can we know for sure?

If they were unsafe it seems to me that there would ,by now, be evidence in the NTSB database. I made the assumption thet the most unsafe would be in the uncertified versions in experimentals and since Vans designs far and away represent the bulk of experimentals I further assumed that evaluation of the NTSB database relative to RVs would be representative.

I further decided that a true safety issue would result in a fatal accident and would most likely occur in IMC.

Review of all RV fatals in IMC from 1985-2005 revealed 11 fatal accidents none of which could be attributed to failure of either an EFIS or Steam guage.


Between 1983 and 2005 there were 102 fatals involving RVs in both VMC and IMC (these include the 11 mentioned above) Once again I could find no suggestion that the accidents had anything to do with a malfunctioning or failed EFIS or steam guage.


Does this tell us that Glass is at least as safe as steam guages or is my sample size too small or skewed.

How many of you out there have had a failure or malfunction of an EFIS or a steam guage that you felt put you in serious jeopardy?

Good Research Milt!

I hadn't gone back and looked at any of the statistics, but for the past couple of years, I've made it a daily habit top check the preliminary accident reports on the FAA web site. I don't recall seeing much that said "this guy lost control in IMC because his gauges quit". (Granted, these are preliminary reports....)

However, we all know of some high-profile cases of aircraft loss of control due to vacuum pump failures (or why else would Hannafin keep sending out those dire warning letters to certified airplane owners), and I guess I lost 3 vacuum pumps in all the years I owned my Grumman (fortunately, in VMC conditions).

There may not be enough statistical evidence yet to be definitive, but anecdotally, I don't think theres anything to support the contention that glass panels aren't safe (as long as they are well thought out for failure tolerance)!

Paul

Milt:

One thing that I think a *lot* of people forget though is that every digital radio in your panel has a processor and is running code...yes...even that SL-30 driving your LOC/GS indicator in your panel! So the fundamental question isn't one of whether or not something is running code...it's a question of the methodology and testing of the code! Some of the EFIS manufacturers have great processes in place and others have really crummy processes and release very questionable code.

every digital radio in your panel has a processor and is running code...yes...even that SL-30 driving your LOC/GS indicator in your panel

Click to expand...

Thats a really good point that never had occurred to me.

Sounds like a good argument to start if you make or sell conventional aircraft instruments!!

Electrical worries

I have posted several time on my problem with having dual glass panels. I for one never wanted to give the perception that glass is somehow less reliable than steam gages. Heck, I do that kind of work for a living! The thrust of my argument was that two glass panels does not make it a good backup for the same reason that having two gyros attached to the same vacuum pump don't. If it shares a common failure point it is not a fully redundant system.
Please cut me some slack with the comments of dual bus, dual alternators, etc. You are always somewhat dependent on how well the designer of the electronic device protects the integrity of the dual power system! I for one have a bad habit of voiding warranties by investigating the guts of my embedded devices. Some are top notch, others are down right scary!
I have always felt that backup systems should have as little as possible in common with your primary system. To that end, tried and true vacuum instruments while possibly less reliable than glass, would be my choice to backup the newest whiz bang glass system. After all, the only thing they would share is the airframe.
NTSB may not give you the whole story. My guess is that most of us weekend aviators avoid IFR so a failure of instrumentation is not nearly as critical for us as for commercial operators that fly in everything.

If you are flying VFR then glass panels are only unsafe to the extent that they distract you from what is going on outside the airplane.

Glass panels add quite a bit of safety for IFR flight in terms of improved situational awareness, weather information, etc. They detract from safety in that they introduce hundreds of potential failure modes.

But don't worry. I'm sure Dynon or any one of the other low volume manufacturers selling uncertified gear to experimental builders is performing adequate testing on their thousands of lines of code with an operating system probably built for dishwashers, using busses with asynchronous interrupts making calls to chipsets with coded firmware into which they have zero visibility.

But they do make you feel just like the big boys (. . .except that the big boys are flying with avionics suites that Honeywell spent up to a thousand man-years developing.)

John Allen
No steam in my airplane, bult plenty of analog guages

Milt:

Your title is a bit leading, sort of like the question: "Is it true you *Do certain stuff" any more?".

Couldn't resist.

Jekyll

PS: I'm not implying in any way that the line refers to Milt!

Discrete instruments does not guarantee safety.

Who's to say that the testing of conventional aircraft instruments is any better than the testing of microprocessor based instruments and the related software testing? From what I have heard on this forum, several of the instruments that Van's sells are not that good, and have a high failure rate.

The real problem with the EFIS systems is not that the software or hardware is poorly tested. The problem is how many instruments are taken out when a single software bug occurs. Of course, there is no simple answer, because a SW bug could just affect a single instrument on a display, or it could lockup the whole display.

Of course, the fact that a single HW/SW problem could take out a whole slew of instruments does not neccessarily make an EFIS less safe. The probablility of that occurance has to be weighted against he increased safety factor from not having to scan a whole panel, because the information is concentrated in a single compressed area. The single point failure problem logically means you need to have some sort of backup if you are going to fly IFR. With the compactness of an EFIS, you have the option of having two or even more of these guys, which may increase your safety margin .vs. analog gauges. Not that common to see a panel with multiple GH's, ASI's, ALT's, etc, but it is becoming increasingly common to see three GRT's in a panel.

This argument could go on forever. Until we see a rash of airplanes falling out of the sky with EFIS failures, I see no safety problem with using an all-glass panel. I think the only safety problem is the pilot's tendency to watch the screen all of the time, rather than look outside the windows. Fortunately, there is a lot of space out there, and there's no indication that this is that big of a problem. Then, again, how would we know if it was a problem?

Tracy.

Well....

My RV9A has two EFIS, four GPS units, Elec. Turn & bank, Alt. ASI, SL30, engine monitor, and a partridge in a pare tree.

My Cessna has GX60 GPS, MK12D nav/comm and round gauges including traditional nav heads for the radios.

I am a low time IFR pilot and am not current, but if for some (life-and-death) reason I had to fly IFR tonight. I would do it in the Cessna.

So far I just don't have the confidence in the new stuff. The EFIS don't agree with each other and I don't always get the same effect when making setting adjustments. I think that most of my problems are operator error, but there is just a lot of capability. I hope to get better at understanding what the EFIS wants from me and at some point have it serve my needs instead of the other way around. In the RV I spend to much time trying to get thinks to happen the way I think that they should.

I do love the engine monitor in my RV. I can really get a feel for what the engine is doing, as opposed to my Cessna with only one EGT.

Kent

Having spent some time in the soup very recently (2.5 IMC on Monday), this is fresh on my mind. I don't mind flying approaches but I can't stand enroute IFR. The whole time I just sit there waiting for the screen to go black. It never has, but I still can't help thinking about it. And that's no different than the old vacuum gyros I used to fly behind...I've had vacuum failures and that's no fun. Whatever it is I'm using for attitude reference, I constantly assume it's about to go T.U. on me...glass or not.

I'm comfortable flying IMC behind glass -- because my particular panel has proven itself worthy to me over many flying hours. My next airplane will have glass, and that will have to prove itself to me all over again. It's a trust thing.

Even though I do trust my current panel, you couldn't get me to fly in IMC without some semblance of redundancy. For each of us that's a subjective thing, but for me it means a secondary indication of bank, old school altimeter, airspeed, and VSI. Marginal but not insignificant additional comfort is provided with the 496's "panel" view.

It's like anything else...

If you need it or you die, then you need a backup (steam gauges, backup EFIS, etc). Even if the backup is a cheap piece of junk, as long as it's working when you leave the ground the SYSTEM relibility soars into the stratosphere.

If you don't need it to live, then it's pretty irrelavent, isn't it? When it fails it's just a nuisance from a time/$$$ point of view.

Long term, the relibility of any one item can't ever be depended on...statistics won't help you when your's happens to be the 1 in a million. It doesn't even make sense to talk about the reliability of any one piece of equipment. In truth, the chance of failure is either be 0 or 1 (it WILL or it WON'T fail) and you've no way of knowing for that particular box. You can only talk about the behavior of groups when dealing with statistics.

Nearly any conglomeration of instruments can be made reliable enough to trust your life to them with just a little bit of thoughful design.

That said, if I had to guess I would guess that a redundant glass panel w/2 batteries and redundant electrical busses would blow away vacuum gauges in a head to head test of SYSTEM relibility. Also consider that vacuum gauges fail in insidious ways (slowly drifting AI, for example). Glass panel will probably just lock up, crash or go blank.

jcoloccia said:

...Also consider that vacuum gauges fail in insidious ways (slowly drifting AI, for example). Glass panel will probably just lock up, crash or go blank.

Click to expand...

That's what I thought until my EFIS failed by showing a slowly increasing bank and pitch during level flight. Pretty much exactly how a vacuum AI would fail.

Just goes blank

John brings up another element I failed to address. Analog systems are more prone to failure but their failure modes are less likely to be useless. Digital systems are very reliable but when they do fail it's normally in a way that makes them little more than balast.
Not being up on the new systems, do they share more than a need for electricity? Dual screens sharing a single brain or across the same sensors sounds like a bad idea if this is suppose to be a backup.

What is your opinion?

Well, this is an extremely timely thread for me. I am working on the initial setup of my panel now. I have been talking with Stein of SteinAir on the phone and via email in the past week to discuss my needs.

Stein, if you are reading this post, this is another one of those gentle nudges you mentioned I should use to keep you reminded that you need to work on my project!

I have a kit that was started by another individual who had already purchased all of his instruments for a standard instrument panel. Therefore, I already have

• RC Allen Vacuum Attitude Gyro http://aircraftspruce.com/catalog/inpages/rcallenagvac.php

• RC Allen Vacuum DG http://aircraftspruce.com/catalog/inpages/rcallendgvac.php

• Falcon Alt http://aircraftspruce.com/catalog/inpages/sensitive_altimeter.php

• Falcon dual range TAS http://aircraftspruce.com/catalog/inpages/import_trueasi.php

• Falcon VSI http://aircraftspruce.com/catalog/inpages/falconvertspeed.php

• SIRS Navigator Compass http://aircraftspruce.com/catalog/inpages/sirs_compass2.php

• a slew of Van's engine instruments (but no CHT or EGT instruments)

My plans are to install

• Dual GRT EFIS/EMS http://grtavionics.com/efis_horizond_series_1.htm

• Garmin 496 GPS https://buy.garmin.com/shop/shop.do?pID=6426&locale=en_US

• Garmin/Apollo SL40 Comm Radio https://buy.garmin.com/shop/shop.do?cID=197&pID=6440

• Garmin GTX 330 Mode S Transponder https://buy.garmin.com/shop/shop.do?cID=198&pID=201

• TruTrak Digiflight II VSGV autopilot http://www.trutrakflightsystems.com/instruments_digiflight_2_VSGV.htm

• Advanced AOA Sport http://www.advanced-flight-systems.com/Products/AOA/aoa.html

So I would appreciate opinions on backups for my glass panel. I have already planned to install the Altimeter, True Airspeed Indicator and Compass. Should I install the Directional Gyro? The Attitude Gyro? The VSI? If any one or combination of these would be best, which one(s) could I leave out? What is the value of each of these if my flying intent is VFR with enough instrumentation to help me in case of inadvertent flight into IFR conditions?

All of these instruments are new (never removed from the packaging except for visual inspection). I would think I can sell the instruments I do not use which would help cover some of the costs of my planned panel. But which ones should I keep and which ones should I sell?

I would appreciate any and all feedback as I try to decide these matters.

This is all a bit moot

to me at least.

It really comes down to the question....Is having a vacuum pump controlling two VITAL pieces of cockpit information any better/worse than an EFIS?

Add to that there is a path of sensible redundancy....I.e use an independant autopilot (prefereably with a TC head display) then I think it is clear which is the preferable option.

I.e unless you believe a complete electrical system failure (remember at least one of the EFIS's is probably battery backed up) is more likely than a vacuum failure then the modern approach with the backup strategy described above is the way to go.

I think I am more comfortable with the likelyhood of a blank screen when it goes "phut" than when the gyros slowly tumble and hopefully you'll catch it before you die.


In my HUGE IFR experience (I got my ticket at Spring Break!) I haven't flown any mechanical gyro's...i.e the EFIS is all I know so that helps with my comfort level for sure.

Besides, mechanical gyro's don't like acro...Not problem with the EFIS.

Cheers

Frank 7a

Human Factors

I have written at length on other threads about designing any panel system (glass or steam) with backups for all the functions that you need to stay alive. It's not about the solution that you decided to use, it is about the functionality that you build in, and how you assure that the function is available. I always assume that any single box or wire can fail - then I ask "what am I going to do when it does?" The bottom line for me is that I have redundant nav bases in the EFIS and autopilot, and backup power sources with busses that can be separated. IF I take a massive lightning strike, and IF that strike wipes out all the electronics, then I could be in trouble - and that is what I cal an accepted risk. Given the demonstrated unreliability of steam gauges, I think my overall functional reliability is much higher than in any GA plane I'[ve flown before.

But reliability, redundancy, and backups aside, we should be looking at the advantages of glass - if it gave us the same functionality as steam gauges, what would be the motivation to go with the expensive stuff? The answer is that the functionality is orders of magnitude beyond what discrete gauges can give. It's a question of integration and providing data in a much more intuitive form. Flying an approach with a discrete gyro, a separate nav head, a separate ADI, altimeter, etc....requires you to draw and update a mental map - your brain is engaged in synthesizing the raw data and determining how it all goes together. A good EFIS moving map display puts this all together for you and shows you a picture. Taking the map processing function out of your brain allows you to stay thinking at a much higher level and this is a great safety enhancement.

I'm talking, of course, about Human Factors - making the man/machine interface more meaningful and intuitive. Sticking with antique representations of data when more integrated solutions are available is so 20th century.....

(Of course, I have seen some non-intuitive glass cockpit displays as well....good design is critical if you want enhanced functionality!)

Paul

Orders of Magnitude and then some.

Paul I am glad you brought up the obvious, because it looked as if it was going to remain a debate about back up systems. Glass is all about:

Engine history line graphs
3D display of surrounding traffic
Electronic charts that show you moving through your flight plan
Winds aloft graphical display
Integrated fuel computers, that take into account present conditions to predict range
3D view of the mountains around you
A real-time updated glide circle that compensates for wind conditions
EFIS-autopilot that can fly a transition, approach, missed approach, and holding area hands off except throttle
Overview of runways and taxiways of public airports
real time, graphical display of Pireps, Metars, Turbulance warnings, Icing warnings, TFRs
Terrain awareness graphics
3D flight HITS
Auto G Meter in PFD
All Jepp data for the destination at the twist of a knob
look up and send new frequencies to your radio with a knob twist or two
voice prompts for traffic, engine parameters, terrain and airspeed

Those are just some, but not all the things that make Glass much safer than steam. Yes you do need backups, no matter what system you use. Those of us that plan to venture into IFR all have them or it would not be legal much less wise. Digital technology is a long needed boost to pilot awareness of his environment. The pilots ability to use this flood of information to his best advantage will always vary from pilot to pilot. There are many six pack fliers who still cant operate their GPS, so we will never get away from the human factor no matter what technology you fly.

My backup...

Hi all.

Alot of good thoughts and info in this tread!

I'm installing a AFS 3500 EFIS in my RV-7 (day/night VFR plane) and have also bought their internal battery backup. (1 hr duration)
They are great people to work with by the way!

As a backup I was first planning to install a conventional altimeter and airspeed, but changed my mind.
My backup now will be is the traditional "sixpack" of instruments which can be displayed on a single page on my Garmin 296.
These instruments ofcourse is GPS-based and the airspeed for example will be GS.
Also the 296 will not display a real artifical horizon, only a turn & bank instrument sort of.

I'm building as light and simple as possible (don't we all?)and I think this sixpack together with a mag compass is good enough backup for my day/night VFR plane.

Just my 2 cents from Norway.

Regards Alf Olav Frog

Plenty of good suggestions and ideas on equipment...but what about the single point of failure that is the Nut Holding The Stick?

If the NHTS fails, all else fails with him, and I believe the NHTS has an abysmal reliability record, far worse than the yuckiest panels. To mitigate that, the KISS principle needs a high level of integration into a panel. All the bells and whistles in the world on the finest displays and steamers won't save the NHTS if he CFITs or unCFITs whilst madley button pushing, throwing switches, suppressing vertigo and that suddenly loose feeling between his loins, in transitioning to whatever's left of the panel IF a widget fails.

Perhaps my aging curve has finally crossed my airmanship and skills curve, but I find that under stress even remembering to push the transfer button on the frequency select can be a challenge. Keep in mind that it takes a pilot to crash, or save, an almost perfectly good airplane.

Get out there and practice on whatever you install!

John Siebold
Boise, ID

An interesting observation and challenging question.
As I run MGL Avionics you will say I am biased and you would be right.

In my humble opinion, a good glass cockpit is more reliable than the instruments it replaces. It's an easy conclusion. Taking our Enigma as a classic example, you are replacing many dozens of instruments. Granted, without the EFIS you would not even have many of these instruments.

But - and this is a big but. Having all your eggs in one basket is not a good idea. While most EFIS failures, like their mechanical counterparts will affect only one of the instruments (in most cases anyway), there are failures that can result in a dark screen. The most simple of these may be a failed display backlight. All the great electronics and then a simple lamp fails and you see nothing...

That is why even a big airliner fitted with a glass deck will have some form of backup stuck somewhere, quite aside from multiple MFD capable systems.

So the answer is easy - what do you need to fly your aircraft at a minimum ? Once you answer this you know what your backup should be.

BTW, we make a super low cost 3.5" hole instrument that contains almost a complete EFIS with everything you need and even a bit of Engine stuff. It runs of a small 9V battery for hours. It's the ideal backup if you want to save money, weight and panel space (never mind complication). It's called a Flight II. Have a quick look at www.MGLAvionics.co.za - download the manual to see exactly what it can do.

Rainier
CEO MGL Avionics

Kinda of a sensational question

N395V said:

I am not so sure they are any less safe than the steam gauges they replace. But how can we know for sure?

If they were unsafe it seems to me that there would ,by now, be evidence in the NTSB database.

I further decided that a true safety issue would result in a fatal accident and would most likely occur in IMC.

Review of all RV fatal in IMC from 1985-2005 revealed 11 fatal accidents none of which could be attributed to failure of either an EFIS or Steam guage.

Between 1983 and 2005 there were 102 fatals involving RVs in both VMC and IMC (these include the 11 mentioned above) Once again I could find no suggestion that the accidents had anything to do with a malfunctioning or failed EFIS or steam guage.

Does this tell us that Glass is at least as safe as steam guages or is my sample size too small or skewed.

How many of you out there have had a failure or malfunction of an EFIS or a steam guage that you felt put you in serious jeopardy?

Click to expand...

Hummmmm please don't tell my +225 passengers and crew who I fly over oceans with a glass cockpit.

I would be really hard to determine if "glass" caused accidents? Chance is if it was the case it would be loss of electrical power. Was there a NTSB's finding? NTSB would have a hard time as well. People can look at perfectly functioning instruments and lose control.

I think the real debate: Are "experimental" non TSO'ed glass instruments as reliable as TSO'ed glass. I say reliable not safe, because the installation and pilot make it safe or unsafe, at least in IMC.

"Glass" has been around for 25 years or more. The space between the ears is most of the issue. Yes as an amateur builder you can fly IMC with glass and no redundancy, unlike an air-transport, but it does not have to be that way. Really all panels for IMC should have backup, right. Its not required by the regs for homebuilts. If a pilot flys his stand alone GRT, DYNON or BMA with no back up in IMC, than its an accident waiting to happen.

There are many accidents with "classic panels" when the vacumn pump failed and the pilot could not keep it upright on "partial panel" or just screwed up.

"Glass" is safe, flying can be dangerous.

Not really so sensational a question...

Hi -

I am an avionics software architect and an RV builder.

Even non-TSOed experimental (i.e, hobbyist quality) glass panels are probably going to give so many additional features and capabilities such that the safety quality during normal operation greatly offsets the small chances that it could malfunction somehow and lead to an accident. Even a simple moving map display would seem to so greatly aid situational awareness that it would have to lead to a safer flight.

Most of the software failures I can imagine a glass cockpit exhibiting would be obvious to the pilot. If the power is lost, you have a blank screen. If the CPU goes you have a blank screen. Or perhaps a frozen screen. Or a scrambled screen. If the airspeed suddenly indicates 9000 mph or the altitude is -8000 feet you know something is wrong. As long as the pilot knows the system is failing and has a good backup system the problem is not so bad.

But there are some possible software errors that might not be so obvious - what if the airspeed is indicating 20 knots higher than it actually is on approach? That could be fatal. Or what if tempuratures indicate normal when they are overheated? Or what if the altitude is showing lower than it actually is - that could be a problem while trying to fly under class B. In other words, the big problem is making sure that the pilot is never presented with wrong information. No informaton is a nuisance, wrong information can be fatal.

What are the chances of experimental glass systems doing these things? I don't know, but I'd have to say that the software required to implement them in the first place isn't really rocket science - I been doing it for 20 years. And having worked on things like airliner software it doesn't take much to figure out ways that the system can check itself for errors and at least shutdown or blank individual instruments if it happens to find an error in its own operation. Whether or not the developer of the experimental flight display took this kind of care remains to be seen. Even so, I'd have to say that I suspect that hardware failures (power supply or sensors) are much more likely to cause a problem than the software logic.

Do you want to trust your life to hobbyist quality avionics in IFR conditions? You tell me. On what would you base your confidence that the product you are using was engineered well? The flashy pictures on the manufacturers webpage? I might fly my own software, but then I know exactly what I did in the software to ensure it will operate correctly.

George wrote: "Hummmmm please don't tell my +225 passengers and crew who I fly over oceans with a glass cockpit." You can't really make that comparison. While the flight displays that you see in GA or experimental aircraft may seem impressive they are nowhere near the sophistication and reliability of the latest airliner avionics. I doubt that any experimental or GA flight displays come anywhere close to what is being designed into modern airliner avionics systems (do they have triple redundant processors with high integrity RAM? ARINC 653 partitioned operating systems? I don't think so... I seem to remember in a job interview that Avidyne claims to use Windows NT in their MFD product)

My advice? Put in all the glass panels you want, just make sure you have a set of backup steam gauges as well and then have the vigilance as a pilot to keep checking that the glass agrees with the steam gauges.

Just my two cents.

RK

gmcjetpilot said:

...you can fly IMC with glass and no redundancy, like an air-transport

Click to expand...

Hi George - I was wondering if you could expand on the "no redundancy" in air transport. I find this discussion very interesting...

Thanks,

dave

IFR rated pilot worth his salt should

Ralph Kramden: Loved you on the Honeymooners. You make a good point, but for the record I'm not comparing air transport triple redundancy, fault detection, fail safe design and mandatory independent backup systems (power and instruments) to anything, it was a joke.

My comment about it being sensational question was the way Milt phrased it, are they Safe. Of course they are safe with common sense. My point is the human, aka pilot, and their ability to deal with failure (hard or soft) of the EFIS is key, as you point out.

Assume they will fail. Any thing that can fail and cause a crash should have back up.

You bring up one very important point, a soft failure, the EFIS Lies to you!

ANY IFR RATED PILOT KNOWS THE # 1 RULE OF ATTITUDE INSTRUMENT FLIGHT:

-Cross check (key and basic, basic, basic)
-Interpret
-Control

Make your panel so you have the ability to cross-check the big things, attitude, heading, airspeed and altitude. Now the debate of whether dual EFIS is a good cross-check or mechanical pitot/static and gyro instruments are the only acceptable back-up is another story. I think KIT plane has a good article on this on news stands now. I don't get it, just glanced at it.

Ralph Kramden said:

Hi -
I am an avionics software architect and an RV builder.

Even a simple moving map display would seem to so greatly aid situational awareness that it would have to lead to a safer flight.

As long as the pilot knows the system is failing and has a good backup system the problem is not so bad.

But there are some possible software errors that might not be so obvious - No informaton is a nuisance, wrong information can be fatal.

What are the chances of experimental glass systems doing these things?

Do you want to trust your life to hobbyist quality avionics in IFR conditions? You tell me.

George wrote: "Hummmmm please don't tell my +225 passengers and crew who I fly over oceans with a glass cockpit." You can't really make that comparison. While the flight displays that you see in GA or experimental aircraft may seem impressive they are nowhere near the sophistication and reliability of the latest airliner avionics.

My advice? Put in all the glass panels you want, just make sure you have a set of backup steam gauges as well and then have the vigilance as a pilot to keep checking that the glass agrees with the steam gauges.

Just my two cents. RK

Click to expand...

Probably not after initial failures and before aging

All manufacturers reduce testing to save cost and schedule. Things get delivered that have failures ready to happen. Even when testing is rigorous it is not and cannot be exhaustive so some functions have never been completely tested by anyone even after a large number of units are in the fleet. An aggressive tester can always "Break" a complex system. However, after the boxes are used a while, the failures caused by manufacturing will usually drop off to a reasonable level.

You as the builder are creating a unique system in your airplane and you or someone you hire must integrate and test that particular combination of boxes and power and signal interfaces. I doubt that many thorough I&T programs are conducted of these complex systems before flight. This is a case where the builder adds risk to save cost and schedule. Here again, after the system is used for a while failures caused by the system configuration will usually drop off to a reasonable level.

No one knows everything there is to know about the operation of any complex box. Operational failures will occur because of misconceptions, ignorance, breakage, power loss, physical incompatibility between the operator and the system (eyesight, hearing, fat fingers, etc.). However, after some time is acquired operating the system a subset of essential functions will be learned and the operator and the system will get along most of the time early in the system life.

Anything that needs to be maintained will not be maintained at the required level. Software processes and databases will not be updated reliably and boxes will only be tested, validated, calibrated and repaired when the function or performance becomes so degraded that they are unusable.

Most manufacturers leading the industry will not be in business five years from now and ones that survive will not want to support old products. Memory devices, micro devices, "glass" display media, etc. will cease to be manufactured and some will resort to electronic canabalism. Software configuration control will not be maintained either in the data, executables or the build envirement that will allow long term survival of specific software based systems.

There is no doubt a safe period for the usage of specific glass panels in a specific system somewhere after all the new fumbling of the manufacturers, the builders and the operators and before the glass panels are in service too long.

Bob Axsom

Assume it will fail

It has been said many times, but I believe the bottom line is that you have to assume it will fail, and make appropriate plans.

I don't trust computers and I really don't trust software, but I do find that they are very useful when they are working. In the cockpit I try to get as much utility out of them as I can, but I always keep in mind that they can stop working correctly at any instant.

How safe should it be?

Just to add a point or two. It seems to me that all the cross-checking that you would need to do in an experimental glass panel system sort of negates its usefullness. Do you trust it or don't you, and my point is that you ought to be able to trust it with your life. You shouldn't have to be crosschecking with another system - the system you are flying should be doing that for you.

OK, ok, we are talking about RVs flying most of the time in daylight VFR. The glass panels out there will do just fine, I am sure. Have fun and watch the pretty pictures. And the way most of the non-professional pilots are trained we would be expecting to be ready to switch over to a partial panel at any moment in IFR flight. So the need for super-reliability in the RV is not there quite as much as in the airliner. But if it's an instrument and you are looking at it for flight decisionmaking it really (*really*) needs to be trustworthy standing all on it's own.

But you know who has to have had guts? Those F-111 or B-1 aircrews that have/had the terrain following defensive systems. If they got an indication of a missile lock on or something they press a button and take their hands off the controls while the airplane dives from high altitude to treetop level and follows the terrain - presumably in the dark and perhaps in IMC. Whether or not those systems deserved the trust they received, I would not know. But imagine how much they are trusting the system to function correctly without their intervention.

What am I putting in my RV? A classy looking six pack and some sort of color GPS. If I had an extra $10,000 (and I don't!) I'd like to get a Garmin 430 and the ADS-B enabled transponder.

Hope I am not rambling too much. For me there is the simple joyful hobby of flying a simple airplane and then there are the technical aspects of designing cutting edge avionics for airliners. Sometimes its hard for me to separate the two approaches to flying.

RK

Ralph Kramden said:

Just to add a point or two. It seems to me that all the cross-checking that you would need to do in an experimental glass panel system sort of negates its usefullness. Do you trust it or don't you, and my point is that you ought to be able to trust it with your life. You shouldn't have to be crosschecking with another system - the system you are flying should be doing that for you.
RK

Click to expand...

The whole point is that the six pack is NO more perfect in this way than the efis. And it is harder to cross check accurately and it's failures are IMHO more insidious and accident prone that the efis failure. Why do you think so many new planes are going without a vacuum pump and instead have redundant electrical systems????

When working, the efis will keep you out of trouble more often by giving a more complete and intuitive "picture" for situational awareness. When failed, I'm in the blank/locked up screen camp as far as expected failure modes i.e. pretty obvious rather than deadly little lies.

Six pack is far less intuitive when working as far as big picture and when it goes can be subtle and confusing rather than obvious as it goes T's U.

Regardless there must be backups and there must be the ability to cross check. My efis backup will most likely be an electric AI, mechanical Alt and VSI and so when I'm "partial panel" I'll be as well off as the six packers on full panel????? What am I missing here??

Oh, and as far as I can see the efis is pretty close in price if not better than a vacuum pump and six pack when you get them both installed and flying.

Oh, and also, I've heard of vacuum pump drive shafts shearing and taking down the whole engine along with the instruments. That sounds like all kinds of fun.

Ralph Kramden said:

snipped

OK, ok, we are talking about RVs flying most of the time in daylight VFR. The glass panels out there will do just fine, I am sure. Have fun and watch the pretty pictures.

snipped

What am I putting in my RV? A classy looking six pack and some sort of color GPS. If I had an extra $10,000 (and I don't!) I'd like to get a Garmin 430 and the ADS-B enabled transponder.

Click to expand...

Compare the "pretty picture" display, especially with a weather overlay on a Garmin 496 handheld, and you might night want the 430 anymore. The 430 looks so "medieval" in regards to screen resolution, color, and clarity.

Glass Panel Safety

I have depended on my GRT EFIS and 430W many times in IMC and have done several approaches to minimums. The screens have gone black only once (over the Sea of Cortez). It was a broken terminal at the alternator and the battery lasted about 20 minutes before the all-glass panel went blank....no electricity, no panel! I have since installed a backup alternator for added insurance. It is a spline-driven 20-amp alternator installed where the right mag would normally be located (had I not installed a Light Speed ignition on one side). I did it because of another possibility of alternator failure or broken wire and ALSO -- if my belt-driven alternator suffers a broken belt while I'm 1,000 miles from home at a remote airport, I don't have to worry about any delay for pulling my prop to replace the belt or any delay for shipping in a new alternator. I flip the rocker switch from primary to secondary alternator and fly home to get it fixed.

Theory vs. Data vs. Experience

Gentleman/women...this is a most interesting thread. Please indulge my thinking here. In my line of work, far outside of aviation, I have observed three forces that influence decision-making. They are all important and valuable. They are all fallible and they are all subject to interpretation. Decisions arise out of the synthesis of the three.

1.) Theory: For example...in this case...theoretical EFIS software benefits vs. theoretical software downfalls. Integrated information & presentation of information, internal circuit redundancy, etc. vs. potential "hobbyist" level engineering, electrical system dependancy, etc.

2.) Personal Experience: Individual pilots flying glass panels in various situations and with varying levels of experience and in various conditions. One's experience here profoundly and appropriately influence one's perspective on the glass panel topic.

3.) Data: In this case the thread started out with a brief analysis of NTSB data on fatal RV incidents and their relationship to glass panels. This is, in my line of work, called "outcomes data." There are all kinds of objective data, of course, and outcomes data, useful as it may be, are only one type. Data is open to interpretation and, in my line of work, often goes in circles over the years with opposing recomendations based on opposing data coming out every few years. Also, data presentation is manipulated based on the interests of varying parties

Anyway...responses in the thread have commented on data (what little there is at this point), but have been heavy on glass panel theory and heavy on experience-based opinions. I wish to add to the conversation the Cirrus safety record. I came across this a couple of months ago in a Richard Collins column in Flying Magazine.

Paraphrasing and simplifying greatly, it is my impression that the Cirrus "safety" record, taken as a whole, has so far come in just about THE SAME as that of older "steam guage" aircraft in the similar power/speed class....Bonanzas, 210's, Comanches, etc. This in spite of the latest in certified, redundant glass panel goodies AND the presence of the BRS parachute, AND the absence of the complexity of retractable gear.

In other words, the outcomes data, as it relates to the Cirrus, would SEEM to imply that all of the latest glass panel goodies have NOT provided a significant safety benefit. Of course this is a complicated topic and there are all sorts of variables such as pilot experience and differing airframes to consider before reaching any conclusions. But I'd be interested in some comment on this.

Dan Vandenberg
RV-9A Tail kit just arrived...

djvdb63 said:

Gentleman...this is a most interesting thread. Please indulge my thinking here.
Paraphrasing greatly, it is my impression that the Cirrus "safety" record so far has come in just about THE SAME as that of older "steam guage" aircraft in the similar power/speed class....Bonanzas, 210's, Comanches, etc. This in spite of the latest in certified, redundant glass panel goodies AND the presence of the BRS parachute, AND the absence of the complexity of retractable gear.

In other words, the outcomes data, as it relates to the Cirrus, would SEEM to imply that all of the latest glass panel goodies have not provided a significant safety benefit. Of course this is a complicated topic and there are all sorts of variable such as pilot experience to consider. But I'd be interested in some comment on this.

Dan Vandenberg
RV-9A Tail kit just arrived...

Click to expand...

Hi Dan.

This is of great interest to me, as I regularly fly an EFIS-equipped SR22, and an EFIS-equipped RV-8.

One factor that skews the experience in Cirri is the very high rate of IFR utilization.

If you look at total airframes, the rates look very similar (in fact the Cirrus appears to be better than the latest glass-panel 182s IIRC) but when you look at IFR hours, the Cirrus rate/hour drops.

Go on flight aware at any random time, and search to see how many Cirrus SR2x aircraft are in the IFR system at any given time, and then search for Cessna 210s, or BE33/35 etc.) You'll find the Cirri overrepresented almost every time.

It's also interesting to search for RV-8 or HXA--We XGA pilots seem to very rarely file and fly IFR, in spite of the apparently widespread installation of IFR equipment in our airplanes.

Another interesting thing that has generated much discussion is the odd pattern of Cirrus accidents. Until recently, none had been in the summer. The most dangerous time to fly a Cirrus, by far, is in the winter. This has generated a lot of discussion about icing (most of the airplanes are ice-protected but don't have FIKI certification) an CO incapacitation with heater use (which doesn't seem to be the issue. This is of course very different from the normal GA accident distribution.

I don't know the answers, but there are certainly a lot of interesting questions presented.

djvdb63 said:

In other words, the outcomes data, as it relates to the Cirrus, would SEEM to imply that all of the latest glass panel goodies have not provided a significant safety benefit. Of course this is a complicated topic and there are all sorts of variable such as pilot experience and differing airframes to consider. But I'd be interested in some comment on this.

Click to expand...

Research farther into the benefits of color moving map GPS with terrain/obstacle avoidance, satellite weather, and airport runway diagrams with the aircraft's position; as well as 3D terrain representations being more common in the near future.

What's going to happen? Most likely, a whole lot less --- controlled flight into terrain situations; and a few less "wrong runway" accidents.

That WILL be the added safety benfit as the years go by!

L.Adamson

flyeyes said:

One factor that skews the experience in Cirri is the very high rate of IFR utilization.

Click to expand...

Could it be that the extraordinary capabilities of modern certified glass panels have encouraged greater risk-taking...therefore canceling out any "safety" benefit?

djvdb63 said:

Could it be that the extraordinary capabilities of modern certified glass panels have encouraged greater risk-taking...therefore canceling out any "safety" benefit?

Click to expand...

Maybe because the computer say "Yes I can" doesn't nessecerily mean that the rest of the airplane can

At the outset of this post let me say I do not think glass panels are unsafe and actually now prefer them to staem gauges.

The picture below was taken yesterday near KLIT.

I am doing Beta Testing for BMA on software that has not been released to the public on the G4 Sport (the large unit)

Contrary to what some think the software BMA releases has been extensively tested by many hours of flight prior to release. Obviously this version needs some work.

2 hrs into the flight this is what I saw.
1. note the lite is level
2. the sport is showing a turn
3. the headings are different even though they share the same magnetometer
4. The IAS and TAS are different
5. The standard steam guage gyro is TU which happened on the first flight of the aircraft.

Granted this is experimental software but just think if you were in the soup what would you do?

New School verses Old School


Humm the needle is left and the ADF..... "the head will fall and the tail will rise..... relative bearing + plus actual heading +/- crab........
angle of the dangle........where is that chart..........duha!.......its folded wrong.........what is the MSA in this area?...........


Clearly having situational awareness, data, weather, terrain & obstacle clearance and
accurate nav any where is all goodness, as long as it does not go dark, and when it does
go dark (which you should assume can happen) can you keep flying with out split-S'ing
into the ground. So keep your old school skill, you may need it someday.

Great Post Milt. What would you do? Can you lose two EFIS at the same time? Lightning strike? When I was an evil flight instructor, I would do some Frasca simulator training (actually I required they fly the sim because you can do things safely and efficiently you can't do in a plane, IMC or Hood). I would fail the vacumn pump on the procedure turn out bound. If they did not cross check the TC/T&B they would lose control by the time they turned inbound as the gyros spooled down. After that lesson they watched or keep the T&B/TC in their scan, and the vacumn gauge became part of their scan as well. The T&B/TC may be super old school, a one trick pony (rate of turn/yaw) but that's the charm. Cross check is key, but what do you do when you get conflicting information. Better get a tie-breaker in the panel. Yikes!

It is how you use the information! <G>

http://www.theregister.co.uk/2007/05/11/satnav_crash/

John Clark
RV8 N18U "Sunshine"
KSBA

So which one do you believe? And why?

N395V said:

. . .

2 hrs into the flight this is what I saw.
1. note the lite is level
2. the sport is showing a turn
3. the headings are different even though they share the same magnetometer
4. The IAS and TAS are different
5. The standard steam guage gyro is TU which happened on the first flight of the aircraft.

Granted this is experimental software but just think if you were in the soup what would you do?

Click to expand...

OK, this is exactly the sort of thing I worry about. Suppose you are in the soup and you have these two systems telling you these two different stories. What now?

My not so profound point is that having an instrument that can give bad information is a bad thing whether it is a steam gauge or a glass panel. If I were designing an avionics system and were intending for it to be used in IMC then I think I would be wanting it to have airliner-like triple redundancy and reliability. I doubt that currently marketed panels for experimental aircraft are even close to the needed reliability.

Of course, steam gauges are well known for their unreliability. So in my mind neither system is good for prolonged flight in IMC. Going up or down through cloud layers maybe, but for long periods of no visual reference to the horizon or for approaches to near minimums I doubt either system (steam gauge or glass) is really "safe enough".

Yes, yes, I know thousands of pilots having been flying IFR with steam gauges for many decades and are perfectly comfortable about it. For my flying I have not yet seen a system I can afford that I feel comfortable about trusting for sustained IFR flight. Even if I built my own I would still be worried about the quality of the sensors. That's just me. But then all I do is recreational flying - I don't have to go if I don't want to.

If you are comfortable with the level of safety you setup gives you, then don't let me discourage you.

Have fun

RK

N395V said:

At the outset of this post let me say I do not think glass panels are unsafe and actually now prefer them to staem gauges.

The picture below was taken yesterday near KLIT.

I am doing Beta Testing for BMA on software that has not been released to the public on the G4 Sport (the large unit)

Contrary to what some think the software BMA releases has been extensively tested by many hours of flight prior to release. Obviously this version needs some work.

2 hrs into the flight this is what I saw.
1. note the lite is level
2. the sport is showing a turn
3. the headings are different even though they share the same magnetometer
4. The IAS and TAS are different
5. The standard steam guage gyro is TU which happened on the first flight of the aircraft.

Granted this is experimental software but just think if you were in the soup what would you do?

Click to expand...

Sorry, but I'm not quite sure what the point is here. If you're going to fly IFR:

1) If the ADI was known to be bad, shouldn't you at least placard it? Personally I would have yanked it and had it in the shop right after the failure.
2) Why would you fly IFR with BETA software loaded on the EFIS? Unless it's a late beta, nearing RC status, you're virtually guranteed to have problems.
3) You have a primary and secondary EFIS running off the same magnetometer. This single point of failure doesn't seem like such a good thing.
4) One could argue that having both EFIS from the same manufacturer also introduces additional risks (common software/hardware design defects) but that may be taking it a bit far. For me it would depend on the mfg.

-Rick

skikrazi said:

I have since installed a backup alternator for added insurance. It is a spline-driven 20-amp alternator installed where the right mag would normally be located (had I not installed a Light Speed ignition on one side).

Click to expand...

Perhaps the alternator you are referring to in the B+C SD20. It was my understanding that this alternator attached to the vacuum pump accessory pad.

You seem to be saying that yours is attached to the right magneto drive....is that correct. I haven't heard of that before. Did this installation require any special transition device.

And what model of RV did you instal this alternator in.

Sorry, but I'm not quite sure what the point is here. If you're going to fly IFR:

Click to expand...

Rick,

All of you comments are correct and cogent save one.

The point I was making was to the response that you need two units plus a 3rd backup of some type as a tie breaker to agree with one of the other 2 units. The photo above depicts 3 units each giving a different picture ie no tie breaker.

) If the ADI was known to be bad, shouldn't you at least placard it? Personally I would have yanked it and had it in the shop right after the failure.

Click to expand...

If you look closely at the picture you will note the red flag is out on the gyro that says OFF. Since I no longer fly IFR Ipulled the breaker and consider the off flag to be my placard. Since I do not plan to replace it I prefer it in the panel over an open hole or a patch inthe panel. To me aesthetics are important as I am trying to market the plane and kits. But you are correct it should be placarded or replaced.

Why would you fly IFR with BETA software loaded on the EFIS? Unless it's a late beta, nearing RC status, you're virtually guranteed to have problems.

Click to expand...

You wouldn't unless you were a fool or high on Marijuana. Once again This was VFR with a known Beta expecting a malfunction that occured. I wouldn't even fly Beta that was nearing RC status. Once again the point of the post was to suggest there is no guarantee in having a "tiebreaker" and that anaolg is not inherently more reliable than glass.

More on this in myresponse below to "what would you do?"

You have a primary and secondary EFIS running off the same magnetometer. This single point of failure doesn't seem like such a good thing.

Click to expand...

Once again you are absolutely correct if your plane is to fly IFR. I am now at a point where IFR is no longer fun and I seldom have to be anywhere at a time certain so about 4 months ago I made the decision to no longer fly IFR so single poin failur on heading is not a big issue and it got rid of the annoying 1 or 2 degree heading differencse between the 2 side by side EFISs. There is a second magnetometer stacked on top of the 1st one and wiring harness in place should someone wish to return to redundancy.

One could argue that having both EFIS from the same manufacturer also introduces additional risks (common software/hardware design defects) but that may be taking it a bit far. For me it would depend on the mfg.

Click to expand...

This is your only point where you and I have disagreement and it is a disagreement of opinion.

In my opinion if you think that the reliability of one manufacturer over another is such that you need systems from 2 different Mfgs then I would suggest you should not have one of the units in the first place.

Nothing is fool proof but the statistical probability of 2 totally separate systems going TU simultaneously is small save a lightning strike in which case I doubt 2 different mfgs would save you.

Les Featherston has I believe a Dynon and a GRT in his Harmon Rocket and took a lightning strike, both units went black but rebooted. A good argument for at least 1 mechanical gyro.

An additional point re manufacturer is:

The Gen 1 BMAs are very reliable and I have flown them a good bit of IFR.

The Gen 4s (in my opinion) still have a few bugs that need to be worked out and at least for now I do not consider them IFR reliable.

Milt. What would you do?

Click to expand...

Tough question George but I do have an answer. I must say thoughi don't know if in the soup as opposed to in my office I could think this clearly.

There is info available in the plane not shown in the photo to help with the decision process and knowledge of the plane, systems, and specific equipment helps.

1. The big efis attitude indicator shows a shallow descending left turn.
The trend tape disagrees and says altitude and vertical speed are increasing yet the digital altitude is constant and agrees with the small efis. Suggests the big EFIS is incorrect.

2. Big efis airspeed is low given power settings and fuel flow, little Efis airspeed is consistent with power settings and fuel flow. Suggest big efis is incorrect and little efis is correct.

3. Garmin 496 agrees with heading on little EFIS Suggest big efis is incorrect and little efis is correct.

4. Altitude on both EFISs is consistent and agrees with level altitude, Suggest big efis is incorrect and little efis is correct. and gyro is incorrect.

5. Heading info on little EFIS and Garmin is constant suggesting straight and level all suggesting little EFIS is reliable.


The Blue Mountains all have a "fast errect" (nothing to do with Viagra) function that wil quickly reset an errant gyro to level. So what I did was hold the plane level by little EFIS and pressed fast erect. Big efis then agreed with little EFIS for about 5 minutes.

I then inserted the memory stick with production software on it and rebooted the big esis.

As Rick mentioned above though the situation is such that I would never had ventured into IFR with unproven software and a TU gyro.

N395V said:

Rick, All of you comments are correct and cogent save one.

Click to expand...

Cogent ... sweet word. I'm going to start using that one!

Milt, given the scenario you describe it all makes sense. I just couldn't figure out what you were doing!

I know you're active on the BMA site (I lurk there) and it's great that you're willing to pitch in and help the effort. I've wanted to use BMA for about six years (they sure are pretty) but the G4 transition really scared me off. I believe they also had similar on-time delivery issues with the G3 (can't remember correctly since it's been so long) so I'm just not ready to give them my cash. One thing that kind of taints me for them probably deals with all the configuration issues people had with the early E1's before the engine pod. The early systems were so freaking configurable you had a chore in front of you just to decide WHAT you wanted it to do ... let alone figuring out how to get it to do it.

Anyway, my point about mixing EFIS from diff. mfgs isn't a 'dis on any one vendor but stems more from my own experience in SW development. A common practice is modularization and reuse of the code. The theory goes that if you write the code and debug it once then you can reuse it in later efforts and not face the same bugs again. Well, that's all well and good and in general works, but there can still be problems. Take the case with your G4 BMA Sport and G4 BMA Lite. They're different boxes, sure, but I can gurantee you that the code inside of them is 99% identical. This is great for BMA and their ability to deliver a robust product line, but if they have a bug that is common across the products it won't do you any good to have a backup... they'll both be bricks.

To that point ... I was reading a story a couple months ago about the F-22's first operational deployment to JPN. There was a flight of those suckers including a few tankers heading west. When they crossed the international date line the systems on the Raptors went dark and they had to fly back to Hawaii under the direction of the tankers. Now, if those guys had been flying with redundant code from two different vendors (wild speculation on my part here to support my point ) ... the chances of one of them implementing that date transition code correctly would be a lot higher (two code bases == two sets on minds/eyes on the problem).

-Rick

the G4 transition really scared me off. I believe they also had similar on-time delivery issues with the G3 (can't remember correctly since it's been so long) so I'm just not ready to give them my cash. One thing that kind of taints me for them probably deals with all the configuration issues people had with the early E1's before the engine pod. The early systems were so freaking configurable you had a chore in front of you just to decide WHAT you wanted it to do ... let alone figuring out how to get it to do it.

Click to expand...

I really like the BMA product and the people at BMA but you hit their problem nail on the head. They just ain't good businessmen. The Gen 1 configurability was a real problem for many users but for me it was a dream because I could hook it up to about anything and make it work. The rush to compete with Dynon and GRT for out of the box plug and play is what did the G4s in reputation wise.

I am doing the Beta testing because I was the 1st sport flying and I fly more hours than most of the BMA sport owners. Plus it is fun having some small involvement in the development of a new gizmo. There is a thread on the BMA website available only to Beta testers and that is where most of my posts are BMA has (I think) about 12 active Beta testers flying daily with problems being resolved as fast as they are found.

So that nobody gets the wrong idea I am not paid by BMA, get no discounts from BMA, I am not a distributor for BMA and have absolutely no contractual relationship with them. I just love their people, their units, what they can do, and what they have the potential to do.

My whole purpose in starting this thread was to stimulate discussion about the safety of glass vs steam based on objective data rather than subjective emotional responses especially the usual rather love hate responses engendered by discussions about BMA.

My personal opinion is that glass is probably just as safe and reliable as anything else if used correctly and with appropriate backup of whatever kind.

I am encouraged to see Dynon and MGL reps participating in the forum discussions and wish BMA and GRT would spend a little more time chatting with us. Even if it borders on commercialism input about future developments and curent projects will help folks make their decisions.

I have found that a lot of problems pilots have fully utilizing their glass comes from lack of knowledge about the product in part due to really terrible users manuals.

This website is a great place to ask the MFGs questions if they would answer. As an industry they should not be relying on their customers to teach each other how to use their products. They need to be in the thick of these discussions.

Milt, how is the AP

I know that the G3's have problem with the AP not following the VOR or LOC correctly and I think that it is true with the G4's. Has this been addressed in the beta version you are using?

Rick, I am sure the the software between the Sport and Lite is 100% the same. There are differences between the G4, G3 and G2 software releases.

There are pros and cons to sticking with the same mfg. for two EFIS units. Although both units will have the same code in them, the amount of testing will have been greater (all think being equal, "what does that mean"), because it will have been exorcised on both products before being release.

We have the same situation where I work, with multiple products that run the same code. The QA burden goes way up, being that the software gets validated on each of the platforms.

The other consideration is not to upgrade the software in both units at the same time.

Kent

I think the external nav problem on the G3s has been addressed relative to VOR/ILS but not external GPS ie 430s

The problem being addresse in the G4 Betas is the terrain ADI, lockups, and getting the AP to track an ILS.

The G4 Downloads are all the same regardless of lite or sport but I believe the different units use some parts and ignore others so they in reality are not exact. They indeed have some testing Lite Betas and some testing Sport Betas.

I have 2 units in both of my planes and the Lite in each plane I keep 1 software version behind the main EFIS.

Now accepting orders for Tankers as backup navigation aids...

Hi friends,

N395V said:

So that nobody gets the wrong idea I am not paid by BMA, get no discounts from BMA, I am not a distributor for BMA and have absolutely no contractual relationship with them. I just love their people, their units, what they can do, and what they have the potential to do

Click to expand...

Well, I think you guys have brought very good examples, arguments and humor to the table. I don't see it as a BMA vs "the rest" thread. We (manufacturers) have all made (and will make) mistakes during BETA testing. Maybe this is not my place: but let's not give BMA a hard time. That is not what this thread is about. Is "glass" safe?! Is "glass" the real root of all evil??

I take my hat off to BMA for "tolerating" (for the lack of a better word) them being used as an example!

N395V said:

BMA and GRT would spend a little more time chatting with us

....

This website is a great place to ask the MFGs questions if they would answer. As an industry they should not be relying on their customers to teach each other how to use their products. They need to be in the thick of these discussions.

Click to expand...

It is not always easy to fight fires everywhere, develop products and take some time off to go flying...

But most important of all: you have to watch your step here! Or people will wash the floor with you!! We all have other websites/mailing lists/forums where it is a lot "safer" to respond to questions. There is a lot of tension here. In a perfect, peaceful, rivalry free world ... your request/need would have been easy to satisfy!



Back to the topic of the thread!

rickmellor said:

To that point ... I was reading a story a couple months ago about the F-22's first operational deployment to JPN. There was a flight of those suckers including a few tankers heading west. When they crossed the international date line the systems on the Raptors went dark and they had to fly back to Hawaii under the direction of the tankers. -Rick

Click to expand...

You got to be kidding me??! All the certification in the world ... and these guys had to bring millions of dollars back flying "blind"?? An incorrect screen is one thing, but a blank screen because of an "international date line", that is crazy!!



Lesson: tankers are useful navigation aids? (just a bit expensive)

With regards to some of the earlier posts... I vote for getting rid of pilots and engines: they cause the majority of accidents!



Regards,
Nicol.
... Engineer with MGL Avionics... having a look around after hours...

nicolcarstens said:

You got to be kidding me??! All the certification in the world ... and these guys had to bring millions of dollars back flying "blind"?? An incorrect screen is one thing, but a blank screen because of an "international date line", that is

Click to expand...

This event highlights one big weakness with the classical DO-178B approach to software certification. The classical DO-178B approach, as I understand it (I'm not a software engineer, but I've spent a lot of time talking to some), assumes that you have a perfect set of requirements for the software code, and it ensures that the code performs in accordance with the requirements. I'll bet a case of beer that the requirements for the software in the F-22 didn't mention a need to cross the international date line, as no one thought to explicitly mention that in the requirements.

Bottom line - you can only foresee the things that you foresee. No matter what standard the code is written to, there will be bugs that don't show up until it is in service, because no one foresaw this particular set of circumstance. Expect the unexpected. Have backups, or a fall back plan. Trust, but verify.