Excellent posts by JTO and Engines. For those who haven’t read the evidence, the point with the Chinook RTS was that the Switch On Only clearance applied to the ENTIRE Nav and Comms systems; brought about primarily because there was no supporting certification to even permit the FADEC to be fitted to the aircraft, because its Safety Critical Software did not have a Certificate of Design.
Forget for a moment about the hundreds of anomalies found by Boscombe; it was far more basic than that. There was no certificate, therefore it wasn’t allowed within a country mile of a production standard aircraft. End of. Controller Aircraft reflected this in his CA Release of November 1993. The AAIB confirmed the software standard remained in this condition (“positively dangerous”) at the time of the accident.
The regulations stated that ACAS was NOT permitted to sign an RTS and grant authority to fly operationally against such an Interim CAR. He did. Lord Philip confirmed the Switch On Only clearance was “mandated” (i.e. not permitted to rely in any way whatsoever on those items which were SOO). The CAR and supporting papers (Oct/Nov 1993) described an aircraft that was over two years away from sufficient maturity to fly operationally. A legal RTS was only issued in 1996, confirming this.
As JTO so rightly says, this was down to the integrity of key individuals. As those individuals had the same degree of control over all RAF aircraft (and some of them, like Alcock, over all MoD aircraft), then the failure was systemic. Until resolved, it remains so. It has not been resolved – again, JTO cites ongoing failures in DE&S. As I’ve said before, I look at the DE&S hierarchy and equate certain fatal accidents to names. The MAA will never change this cultural problem until those individuals and, I submit, anyone trained or influenced by them, are gone.
As the evidence to Philip describes, a Switch On Only clearance is designed to apply to, for example, a known airworthy build standard to which you add, say, a single radio. The SOO applies to that one radio. In simple terms, if you switch it on and it causes an EMC problem, then you know if you switch it off again you revert to a known safe configuration. At no point could the ZD576 pilots revert to a known safe configuration. Thus, the "gross negligence" was committed long before 2.6.94.
The very fact Boscombe felt the need to apply it to entire systems like Nav and Comms is indicative of (a) gross immaturity of design and (b) the pressure being applied by the RAF to declare it airworthy. One could criticise the Superintendent at Boscombe for not refusing, but I think he did the right thing – issued an Interim report “in the form of a CAR” and firmly stated the aircraft was not airworthy. After that, he would not conceive ACAS being foolish enough to turn that round as an operational RTS.
If the MAA or MoD are to address such behaviour, then they need to cite examples. This means criticising retired VSOs. They won’t.
Last edited by tucumseh; 9th Nov 2012 at 06:14.