Back to Incidents Registry
NTSB-MOT-2019-0310FAA REGISTRYCommercial Aviation

Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces

Incident Failure Topology Brief
Catastrophic (Level 5)Sev 10.0/10

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Failure Invariant Breach
Aerodynamic lock-out of physical manual override
Absent Safety Recovery Mechanism
Dual-sensor cross-check and single-activation control limiter
Domain De-Aliasing & Jargon Stripping
Raw Domain Record (Subjective Narrative)

Six minutes after takeoff from Addis Ababa, Boeing 737 MAX 8 flight ET-302 suffered an AOA sensor failure. MCAS activated repeatedly, trimming stabilizer nose-down 2.5 degrees on each cycle. The flight crew executed Boeing emergency memory checklist and turned off electric trim cutout switches, but manual trim wheel forces were physically unmovable due to high aerodynamic elevator blowout loads at 375 knots, resulting in terrain collision.

PatternDB Invariant Representation

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Causal Failure Topology & State Vectors
4 Sequential Invariant Breaches
STEP 01DEGRADE
Left_AoA_Vane

Failed upon rotation, feeding max 75° nose-high reading to flight control computer

Vector: Single sensor hardware failure
STEP 02DEGRADE
MCAS_Software

Commanded four consecutive 10-second stabilizer nose-down cycles

Vector: Unbounded coupled feedback cycle
STEP 03DEGRADE
Flight_Crew

Flipped STAB TRIM CUTOUT switches to CUTOFF as per Boeing bulletin

Vector: Manual override procedure execution
STEP 04RUPTURE
Manual_Trim_Wheel

Froze solid due to 375-knot aerodynamic elevator blow-by load; aircraft pitched into ground at 500 knots

Vector: Aerodynamic lock-out of physical manual override
Decision Nodes Involved
MCAS Flight Augmentation Software
Captain
First Officer
Telemetry Channels
Left Angle-of-Attack Vane Resolver
Stab Trim Cutout Switches
Constraint Boundaries Breached
Airframe Velocity Envelope & Manual Mechanical Control Wheel Movability (< 40 lbs force)
Official Regulatory Audit Citation
FAA RegistryNTSB-MOT-2019-0310
Incident Official DateMar 10, 2019
Quantified Systemic Loss157 Fatalities & Worldwide Boeing 737 MAX Fleet Grounding
Primary Investigation Transcripts:

"The manual trim wheel could not be physically turned by two adult pilots pulling together due to aerodynamic forces."

Immutable Archive RecordVerify at FAA Primary Database

Cross-Domain Invariant Twin Failures (52)

Cross-Domain Invariant Twin
100% Topological MatchΔ 0.000
NTSB-MOT-2019-0310Commercial Aviation
Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Source Authority:FAA
NTSB-FAA-2018-1029Commercial Aviation
Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Source Authority:FAA
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.078
NTSB-MOT-2019-0310Commercial Aviation
Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Source Authority:FAA
IAEA-INSAG-7-1986Nuclear Power Generation
Chernobyl Unit 4: Positive Void Coefficient & Safety Interlock Disablement

Decision_Nodes disabled safety Constraint_Boundaries to complete operational proxy test. Control rod design contained inverted transient reactivity vector (graphite displacers), triggering explosive nuclear thermal divergence.

Source Authority:DOE
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.074
NTSB-MOT-2019-0310Commercial Aviation
Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Source Authority:FAA
FDA-AE-1986-0321Biomedical Devices & Radiation Oncology
Therac-25: Software Race Condition & 25,000-Rad Lethal Radiation Overdoses

Physical hardware interlock Constraint_Boundaries were removed in favor of software flags. High-speed user input triggered an unhandled race condition in concurrent Decision_Nodes, firing maximum raw energy into biological nodes.

Source Authority:FDA
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare