Hi Circuitflyer,
I understand your concern and I will have a private conversation but, I bear the responsibility and will not publicly pass blame or criticize the manufacturer. This is the exact reason for the arming plug. We can't assume that any timer is completely shut down unless the power is cut off.
Tom
Right - and it's even worse than just the timer. There are at least *dozens* of "states" stored in he controller that could either start the timer, start the motor at full power, stop it in flight, etc, if they glitch on or off. And there have been numerous cases where it did just that.
These sorts of glitches are part of the inherent nature of low--level logic states (i.e. stored "bits" in some sort of processor, computer chip, or other signal that has extremely high impedance and low voltages). That's essentially everything that is a logical circuit, rather than the high-power output section.
These glitches cannot be avoided entirely, they will happen, and the more sophisticated the processor or circuit, the more of them there are and the more prone they are to it. You computer wouldn't run 10 minutes without a glitch, and if a single glitch stopped it, it would be completely unusable. In your computer there are methods to correct for these glitches in most of the places they occur - look up EDAC or "error correcting code" to find more.
As noted, this phenomenon is inherent and essentially unavoidable, and this is the reason this rule is worded the way it is - remove primary power to the motor with a mechanical connector/plug, etc. It guarantees that it cannot spool up unexpectedly. there is no power to make it run, whether it's a glitch, inadvertent poke of the start switch, a failure of the circuit itself, etc
It was pointed out during the awards ceremony that this was a classic case of "abnormal procedure", where something unplanned and unpracticed happened, and a step was skipped in the aftermath (i.e. plug remained in). But, like most accidents, it required a second failure before anything happened - also accidentally hitting the switch. The rule and idea behind it was to protect us from a single failure, This was actually two, and if you start looking at combinations of failures, it rapidly becomes impractical, so, this was a rare case of a dual nearly simultaneous failure that led to a serious issue.
After having 36 hours watching the fine North American scenery rolling by to think about it, I think this is one of those cases of "random failure, no action required", and I can't think of anything reasonable in rules/guidelines to preclude this sort of situation.
Brett