4 ms·

> ...the flaws that led to Denver's death were the work of the builder, and had nothing to do with Burt Rutan [the original designer]. These flaws led from the

> ...the flaws that led to Denver's death were the work of the builder, and had nothing to do with Burt Rutan [the original designer]. These flaws led from the builder's sincere desire to improve on Rutan's work, a goal that could actually be said to have been accomplished from an engineering perspective, even if it did kill the pilot. > We in the PC and web worlds have a lot to learn from this, too. We have a lot of bad design floating around that is just as perverse as fuel valves that face the wrong way, hidden behind firewalls... I agree that we have a lot of bad design in the PC and Web worlds, but I don't think that's the conclusion I'd draw at the end of the article. It seems like this a lesson about an engineer changing the design during implementation without understanding (or while misunderstanding) the original design. Chesterton's fuel valve.

Yizahi 4y ago
I would say that engineer may have a perfectly valid reason to do it, and it may be even a better overall decision, as was indeed in this case, preventing fuel pipes in the cockpit as I understood from the article. What is often lacking is testing of significant changes before giving final result to the user. And that, together with writing documentation and training is often deemed uninteresting and boring by engineer rich teams. "Community will fill up gaps" is often heard. Well maybe. And maybe community will write an accident analysis after something bad has happened.
- cduzz 4y ago
  This highlights the importance of SOPs, training, checklists etc. What's the value of a unit-less fuel gauge? Why not a warning light or two per tank and / or a calibrated fuel gauge? If you want to move the fuel hoses out of the cabin (good plan!) move the fuel hoses out of the cabin but leave the interface in place and make it electrical; put the mechanical switch in the difficult to find place and update the SOP to include "if the remote fuel switch fails use the mechanical switch in this difficult to reach location" Engineering around edge cases is hard. Which is just simply saying "engineering is hard". Doing things without addressing edge cases is just craft.
  - WalterBright 4y ago
    This kind of thing is where experience makes the difference. You're not going to learn these kinds of things in college.
    - xenophonf 4y ago
      My college engineering curriculum dedicated an entire class to the topic of failure modes, edge cases, testing, SOPs, etc., and it was something professors in multiple departments took pains to teach us (and warn us about)—even in the humanities and arts. Hell, even just putting units on everything was something my teachers drilled into us since grade school. That education has informed every aspect of my professional practice. Now that I am old, an important part of what I do is teaching others what I've learned, because if experience has taught me anything, it's that people don't just magically figure things out. Formal education and mentorship are as vital to my younger colleagues' success as they were to mine.
      - WalterBright 4y ago
        Sounds like a good class.
- mikeryan 4y ago
  The testing bit is kind of huge. With most computer UI usability is fairly easy to test and, obviously, failures far less consequential. I also wonder if the builder also made a faulty assumption that the plane would be flown mostly by experienced pilots in which case they may not have done a great job anticipating edge cases.
  - JohnFen 4y ago
    > With most computer UI usability is fairly easy to test If that's the case, why are computer user interfaces generally so bad?
    - srehell 4y ago
      Because a ton of software shops don't care about UI testing. They don't budget time or money for it, or they don't even know they need to be doing it.
    - dfxm12 4y ago
      Some user interfaces are bad by design, ala dark patterns.
    - mikeryan 4y ago
      I probably answered that in my second bit. There’s little (perceived) downside risk in “bad” UI. So not enough people do it. I don’t think it’s a fluke that a lot of site optimization tools are focused at e-commerce apps and sites where the stakes are a bit more tangible.
  - Damogran6 4y ago
    John Denver WAS an experienced pilot. Experience can only go so far to make up for the unexpected.
    - mikeryan 4y ago
      True, that being said though, he had only gotten the plane the day before and practiced a few touch and go landings with it when he got it. This was his first "real" flight in this plane.
- squokko 4y ago
  You don't just get to override Burt Rutan's design because you have a "perfectly valid reason to do it." For something like an aircraft you need to prove beyond a reasonable doubt that your way is better and you've thought of everything he did, or build it to spec.
  - Zak 4y ago
    It's an experimental amateur-built aircraft. The builder gets to do nearly anything they want to do (usually) even if it's a bad idea, and most of them have minor changes from the original plans. The design change was possibly an improvement when the only user was the builder who was intimately familiar with its design, but ended up being a disaster when someone else tried to use it under stress.
  - cameldrv 4y ago
    You do, and this is why the FAA makes you put EXPERIMENTAL in big letters in the cockpit. If you want proof beyond a reasonable doubt that the plane is safe, get a certified aircraft. IMO the FAA strikes an excellent balance between allowing people to make crazy flying contraptions that can be dangerous, yet also keeping the civilian flying population safe. One place where there can be some unanticipated risk though is, like in this case, a homebuilt aircraft that's sold to a non-builder. In any case though, in my opinion, the primary cause of the accident was not the fuel selector, it was John Denver's lack of preflight. He took off with very little gas in the plane, and virtually none on the tank he had selected for takeoff.
- toss1 4y ago
  If you want to make a change, you must solve the WHOLE problem, not just the part you want to solve. You need to make that valve easy to operate, operate in a sensible way (flip right to the right fuel tank, not left tank, have a 'both' setting, etc.), and make it ergonomically work. In this case, the ergonomic issue could have been solved with a "dead pedal" right next to the right rudder. This is a fixed surface adjacent to the pedal in the cockpit wall you can put your foot on and press. There is one to the left of the clutch in most well-setup sportscars. With this, the pilot could press and reach around without any input on the rudders. But, this "builder" couldn't be bothered to actually solve the problem and he killed a bunch of the pilots using his update, including John Denver. Criminal, if you ask me.
KennyBlanken 4y ago
It's not a misunderstanding of the original design. It's ignoring it completely. It's someone unqualified to be making engineering decisions engaging in an absurd level of optimization for one rare (to the point of being nonexistant) risk, to the point that they made a valve that is part of near constant use in many planes...nearly impossible to see or reach. Alternating what tank you draw from is part of normal aircraft operation because otherwise you end up with balance issues. Making that valve require contorting oneself and fully deflecting a flight control surface is so asinine it defies belief. I don't even understand how the builder thought this was a risk in the first place. Fuel lines are always at a minimum protected if not run outside the cockpit, ie firewalled.
- buildsjets 4y ago
  That's not true at all. My airplane, which is a Part 23 certified, factory-built aircraft that was made by Grumman-American, has numerous fuel lines running through the cockpit, and none of them have any fire protection on them, not even firesleeving. They are made from aluminum and copper, which are not considered intrinsically fireproof. That's also the case for every Piper and Cessna aircraft that I have worked on, which are typically older CAR-3 certified designs.

Yizahi 4y ago

I would say that engineer may have a perfectly valid reason to do it, and it may be even a better overall decision, as was indeed in this case, preventing fuel pipes in the cockpit as I understood from the article. What is often lacking is testing of significant changes before giving final result to the user. And that, together with writing documentation and training is often deemed uninteresting and boring by engineer rich teams. "Community will fill up gaps" is often heard. Well maybe. And maybe community will write an accident analysis after something bad has happened.

cduzz 4y ago
This highlights the importance of SOPs, training, checklists etc. What's the value of a unit-less fuel gauge? Why not a warning light or two per tank and / or a calibrated fuel gauge? If you want to move the fuel hoses out of the cabin (good plan!) move the fuel hoses out of the cabin but leave the interface in place and make it electrical; put the mechanical switch in the difficult to find place and update the SOP to include "if the remote fuel switch fails use the mechanical switch in this difficult to reach location" Engineering around edge cases is hard. Which is just simply saying "engineering is hard". Doing things without addressing edge cases is just craft.
- WalterBright 4y ago
  This kind of thing is where experience makes the difference. You're not going to learn these kinds of things in college.
  - xenophonf 4y ago
    My college engineering curriculum dedicated an entire class to the topic of failure modes, edge cases, testing, SOPs, etc., and it was something professors in multiple departments took pains to teach us (and warn us about)—even in the humanities and arts. Hell, even just putting units on everything was something my teachers drilled into us since grade school. That education has informed every aspect of my professional practice. Now that I am old, an important part of what I do is teaching others what I've learned, because if experience has taught me anything, it's that people don't just magically figure things out. Formal education and mentorship are as vital to my younger colleagues' success as they were to mine.
    - WalterBright 4y ago
      Sounds like a good class.
mikeryan 4y ago
The testing bit is kind of huge. With most computer UI usability is fairly easy to test and, obviously, failures far less consequential. I also wonder if the builder also made a faulty assumption that the plane would be flown mostly by experienced pilots in which case they may not have done a great job anticipating edge cases.
- JohnFen 4y ago
  > With most computer UI usability is fairly easy to test If that's the case, why are computer user interfaces generally so bad?
  - srehell 4y ago
    Because a ton of software shops don't care about UI testing. They don't budget time or money for it, or they don't even know they need to be doing it.
  - dfxm12 4y ago
    Some user interfaces are bad by design, ala dark patterns.
  - mikeryan 4y ago
    I probably answered that in my second bit. There’s little (perceived) downside risk in “bad” UI. So not enough people do it. I don’t think it’s a fluke that a lot of site optimization tools are focused at e-commerce apps and sites where the stakes are a bit more tangible.
- Damogran6 4y ago
  John Denver WAS an experienced pilot. Experience can only go so far to make up for the unexpected.
  - mikeryan 4y ago
    True, that being said though, he had only gotten the plane the day before and practiced a few touch and go landings with it when he got it. This was his first "real" flight in this plane.
squokko 4y ago
You don't just get to override Burt Rutan's design because you have a "perfectly valid reason to do it." For something like an aircraft you need to prove beyond a reasonable doubt that your way is better and you've thought of everything he did, or build it to spec.
- Zak 4y ago
  It's an experimental amateur-built aircraft. The builder gets to do nearly anything they want to do (usually) even if it's a bad idea, and most of them have minor changes from the original plans. The design change was possibly an improvement when the only user was the builder who was intimately familiar with its design, but ended up being a disaster when someone else tried to use it under stress.
- cameldrv 4y ago
  You do, and this is why the FAA makes you put EXPERIMENTAL in big letters in the cockpit. If you want proof beyond a reasonable doubt that the plane is safe, get a certified aircraft. IMO the FAA strikes an excellent balance between allowing people to make crazy flying contraptions that can be dangerous, yet also keeping the civilian flying population safe. One place where there can be some unanticipated risk though is, like in this case, a homebuilt aircraft that's sold to a non-builder. In any case though, in my opinion, the primary cause of the accident was not the fuel selector, it was John Denver's lack of preflight. He took off with very little gas in the plane, and virtually none on the tank he had selected for takeoff.
toss1 4y ago
If you want to make a change, you must solve the WHOLE problem, not just the part you want to solve. You need to make that valve easy to operate, operate in a sensible way (flip right to the right fuel tank, not left tank, have a 'both' setting, etc.), and make it ergonomically work. In this case, the ergonomic issue could have been solved with a "dead pedal" right next to the right rudder. This is a fixed surface adjacent to the pedal in the cockpit wall you can put your foot on and press. There is one to the left of the clutch in most well-setup sportscars. With this, the pilot could press and reach around without any input on the rudders. But, this "builder" couldn't be bothered to actually solve the problem and he killed a bunch of the pilots using his update, including John Denver. Criminal, if you ask me.

KennyBlanken 4y ago

It's not a misunderstanding of the original design. It's ignoring it completely. It's someone unqualified to be making engineering decisions engaging in an absurd level of optimization for one rare (to the point of being nonexistant) risk, to the point that they made a valve that is part of near constant use in many planes...nearly impossible to see or reach. Alternating what tank you draw from is part of normal aircraft operation because otherwise you end up with balance issues. Making that valve require contorting oneself and fully deflecting a flight control surface is so asinine it defies belief. I don't even understand how the builder thought this was a risk in the first place. Fuel lines are always at a minimum protected if not run outside the cockpit, ie firewalled.

buildsjets 4y ago
That's not true at all. My airplane, which is a Part 23 certified, factory-built aircraft that was made by Grumman-American, has numerous fuel lines running through the cockpit, and none of them have any fire protection on them, not even firesleeving. They are made from aluminum and copper, which are not considered intrinsically fireproof. That's also the case for every Piper and Cessna aircraft that I have worked on, which are typically older CAR-3 certified designs.