Back to Incidents Registry
NTSB-FAA-2018-1029FAA REGISTRYCommercial Aviation

Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue

Incident Failure Topology Brief
Catastrophic (Level 5)Sev 10.0/10

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Failure Invariant Breach
Irreversible kinetic trajectory
Absent Safety Recovery Mechanism
Dual-sensor cross-check and single-activation control limiter
Domain De-Aliasing & Jargon Stripping
Raw Domain Record (Subjective Narrative)

Boeing 737 MAX 8 MCAS software received erroneous 21-degree nose-high angle-of-attack telemetry from a single defective vane. MCAS repeatedly commanded 10-second stabilizer nose-down trim pulses. Pilots counteracted manually over 20 times until mechanical trim resistance and muscle exhaustion caused high-speed ocean impact.

PatternDB Invariant Representation

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Causal Failure Topology & State Vectors
4 Sequential Invariant Breaches
STEP 01DEGRADE
Left_AoA_Sensor

Supplied +21° erroneous nose-up offset telemetry to FCC

Vector: Single sensor hardware fault
STEP 02DEGRADE
MCAS_Software_Logic

Commanded 2.5° nose-down stabilizer trim; reset timer each time pilot released trim switch

Vector: Unbounded coupled feedback loop
STEP 03DEGRADE
Flight_Crew

Executed 21 manual electric trim pulls against escalating aerodynamic loads

Vector: Physical muscle exhaustion
STEP 04RUPTURE
Aircraft_Flight_Path

Dived at 500 knots into the Java Sea (189 fatalities)

Vector: Irreversible kinetic trajectory
Decision Nodes Involved
MCAS Flight Control Software
Captain
First Officer
Telemetry Channels
Left Alpha Vane Resolver
Digital Air Data Computer (DADC)
Constraint Boundaries Breached
Aerodynamic Stall Margin & Maximum Pilot Physical Control Force (50 lbs)
Official Regulatory Audit Citation
FAA RegistryNTSB-FAA-2018-1029
Incident Official DateOct 29, 2018
Quantified Systemic Loss189 Fatalities & $20,000,000,000 Boeing 737 MAX Fleet Grounding
Primary Investigation Transcripts:

"The pilots were fighting a machine that reset its countdown timer and pushed the nose down again every 5 seconds."

Immutable Archive RecordVerify at FAA Primary Database

Cross-Domain Invariant Twin Failures (52)

Cross-Domain Invariant Twin
100% Topological MatchΔ 0.000
NTSB-FAA-2018-1029Commercial Aviation
Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Source Authority:FAA
NTSB-MOT-2019-0310Commercial Aviation
Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces

Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.

Source Authority:FAA
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.078
NTSB-FAA-2018-1029Commercial Aviation
Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Source Authority:FAA
IAEA-INSAG-7-1986Nuclear Power Generation
Chernobyl Unit 4: Positive Void Coefficient & Safety Interlock Disablement

Decision_Nodes disabled safety Constraint_Boundaries to complete operational proxy test. Control rod design contained inverted transient reactivity vector (graphite displacers), triggering explosive nuclear thermal divergence.

Source Authority:DOE
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare
Cross-Domain Invariant Twin
100% Topological MatchΔ 0.074
NTSB-FAA-2018-1029Commercial Aviation
Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue

Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.

Source Authority:FAA
FDA-AE-1986-0321Biomedical Devices & Radiation Oncology
Therac-25: Software Race Condition & 25,000-Rad Lethal Radiation Overdoses

Physical hardware interlock Constraint_Boundaries were removed in favor of software flags. High-speed user input triggered an unhandled race condition in concurrent Decision_Nodes, firing maximum raw energy into biological nodes.

Source Authority:FDA
Shared Failure Vector: Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Deep Compare