PAT-5501-COUP-MCASARCHETYPE: Coupled Feedback Oscillation
Single-Sensor Flight Control Trim Runaway
Sub-Type: Automated Angle-of-Attack Nose-Down Command Loop
VEC:AUTH:0.89•COUP:0.96•LAT:0.72•OVR:0.94
Authority Gradient
0.89
Feedback Coupling
0.96
Telemetry Latency
0.72
Override Suppression
0.94
Structural Pattern Audit Brief
Critical Multi-Node (Level 4)PAT-5501-COUP-MCAS
Flight augmentation software (MCAS) repeatedly trims stabilizer nose-down based on a single faulty angle-of-attack vane, overwhelming manual pilot yoke counter-effort.
Failure Invariant Breach
Defective_AoA_Vane -> MCAS_Logic (Unbounded Trim Cycle) -> Flight_Surfaces (Overcoming Pilot Muscle)
Absent Safety Recovery Mechanism
Dual-sensor cross-check and single-activation control limiter
Fundamental Invariant Rules
INV-01:Flight control software must never command structural trim beyond human physical recovery limits using unvalidated single-sensor inputs.
Engineered Resilience & Mitigation Strategies
MIT-01:Mandatory triple-modular redundancy on all flight control sensor inputs
MIT-02:Software control authority capped below manual mechanical trim override capacity
Canonical Incident Manifestations (2)
NTSB-FAA-2018-1029Commercial Aviation
Lion Air Flight 610: MCAS Angle-of-Attack Runaway Oscillation & Pilot Muscle Fatigue
Automated stabilization routine commanded persistent state modifications driven by single corrupted sensor. Human Decision_Node counter-actions were repeatedly overridden by recurring loop iterations until physical control buffer depleted.
FAA RegistryInspect Dossier →
NTSB-MOT-2019-0310Commercial Aviation
Ethiopian Airlines Flight 302: MCAS Repeated Activation & Unrecoverable Manual Trim Forces
Automated feedback loop repeatedly forced control surfaces into extreme deflection. When human Decision_Nodes disabled electrical automation, aerodynamic airload physics locked manual mechanical override, depleting altitude Buffer_Reserve.
FAA RegistryInspect Dossier →