I have a copy of the QRH Runaway Stabilizer NNC (my
bold):
Condition: Uncommanded stabilizer trim movement occurs continuously
From the FDR traces, the failure mode does not appear at face value to meet the NNC condition statement. The adverse trim will stop for 5 seconds after pilot manual electric trim. This is an
intermittent uncommanded trim mode,
not continuous (as per NNC condition statement). Was this taken into account with the failure mode analysis?
In the failure mode analysis, would this condition statement be true for the single point failure (AoA signal) to be classified only as a major hazard, given that it could also generate an intermittent trim movement under some conditions (flaps up), continuous stick shaker AND UAS simultaneously.
In other words, with the design of this MCAS system, a single point failure has created a very complex scenario. Did Boeing actually consider the combined interactions of each of these outcomes in totality or individually when classifying the hazard? I would view the resultant accident as an indication of failure of the failure mode analysis. Why was the analysis flawed, that is the big question.
While you are contemplating this, try putting up with what this crew had to endure while they were trying to figure out what was going on.