Cows ‘
Shuffling risk down the line -’
Cows, Gordon,
Conventional risk is judged on past outcome, probability vs severity.
‘Future’ risk (certification) has to be judged on the likely-hood of a failure (system safety analysis). If trim can runaway however unlikely, then experts judge of the severity of outcome - manufacturer and certification.
Historically, the mitigation for trim runaway in the 737 appears to have been based on pilot recognition and intervention - inhibit then use manual wheel trim, thus reducing the outcome severity (ex 707 procedure?)
It also appears that the possibility extreme out of trim conditions was recognised, where the tail forces exceed those which allow manual trim. Thus there was an additional procedure requiring large, high stick force elevator inputs to raise the nose, then releasing the elevator input (adverse load), thence the reduced tail load enables manual trim. (To what extent was this flight tested)
The assumptions and procedure appear to have been carried forward for later 737 variants; assuming that certification validated these against aircraft aerodynamic and engine changes (and smaller trim wheel - NG).
This process appears to have further extrapolated for the MAX, but again the extent of certification checks on the effect of (significant) changes is not known.
The outcome of recent accidents suggest that the assumptions relating to large out of trim conditions in the MAX are inappropriate - recognition and intervention (were these aspects considered, checked, or flight tested in the MAX).
Thus the risk associated with trim runway in the MAX appear to be significantly higher that originally judged.
Reviewing the MAX trim system might conclude that runaway is an unacceptable failure mode where recover depends on human intervention; these aspects are independent of MCAS malfunction or modification.