Boeing 737 MAX — MCAS-linked Lion Air and Ethiopian Airlines crashes

1. Episode summary

After Airbus launched the A320neo in December 2010 and American Airlines defected to a mixed Airbus-Boeing narrowbody order in July 2011, Boeing's board approved a re-engined derivative of the 737 on 30 August 2011 rather than design a clean-sheet replacement. The larger LEAP-1B engines had to be mounted further forward and higher on the existing airframe, which altered the aircraft's pitch behaviour at high angles of attack. Boeing's engineering response was a software function, the Maneuvering Characteristics Augmentation System (MCAS), designed to push the nose down automatically when the aircraft approached a stall. During development MCAS's authority was expanded from 0.6 to 2.5 degrees of stabiliser deflection per activation and its trigger was reduced to a single angle-of-attack (AOA) sensor. Boeing did not describe MCAS in the flight manual or in differences training, having emphasised to regulators and customers that the MAX required minimal new-type training relative to the 737 NG. On 29 October 2018 Lion Air flight JT610 crashed into the Java Sea, killing 189, after repeated uncommanded nose-down MCAS activations driven by a miscalibrated AOA sensor. On 10 March 2019 Ethiopian Airlines flight ET302 crashed near Bishoftu, killing 157, in a sequence the investigation traced again to MCAS acting on erroneous AOA data. Regulators worldwide grounded the MAX for nearly two years. The strategic question the episode turned on: could Boeing produce a safety-critical control-law change on an existing airframe, under competitive and schedule pressure, without reopening the training-and-certification posture it had promised its customers?

2. Sources

Primary:

1. Komite Nasional Keselamatan Transportasi (KNKT/NTSC, Republic of Indonesia), Final Aircraft Accident Investigation Report — PK-LQP, Boeing 737-8 (MAX), Lion Air Flight JT610, KNKT.18.10.35.04, published 25 October 2019 (esp. §1.18 Organisational and Management Information; §3 Conclusions — nine contributing factors).
2. Aircraft Accident Investigation Bureau, Ministry of Transport and Logistics, Federal Democratic Republic of Ethiopia, Aircraft Accident Investigation Final Report — ET-AVJ, Boeing 737-8 MAX, Ethiopian Airlines Flight ET302, Report No. AI-01/19, issued 23 December 2022 (§3 Probable Cause; §4 Contributing Factors).
3. U.S. House Committee on Transportation and Infrastructure (Chairs DeFazio and Larsen), The Design, Development & Certification of the Boeing 737 MAX — Final Committee Report, 116th Congress, September 2020 (five central themes, including "Production Pressures," "Faulty Design and Performance Assumptions," "Culture of Concealment," "Conflicted Representation," and "Boeing's Influence Over the FAA's Oversight Structure").
4. U.S. Department of Justice, United States v. The Boeing Company — Deferred Prosecution Agreement and Criminal Information (one count of conspiracy to defraud the United States), Northern District of Texas, filed 7 January 2021 (§IV Statement of Facts, re: concealment of MCAS changes from FAA Aircraft Evaluation Group by Boeing's 737 MAX Chief Technical Pilot).
5. Joint Authorities Technical Review (JATR) Team, Boeing 737 MAX Flight Control System — Observations, Findings, and Recommendations, submitted to the FAA 11 October 2019 (findings on MCAS certification process, single-AOA-sensor architecture, and the treatment of MCAS as a change to an existing flight-control function).

Secondary (with justification):

1. Dominic Gates, "The inside story of MCAS: How Boeing's 737 MAX system gained power and lost safeguards," The Seattle Times, 25 June 2019 — investigative reconstruction drawing on internal Boeing and FAA documents and engineer interviews; part of the paper's Pulitzer-recognised MAX coverage. Synthesises engineering-design timeline that primary reports summarise more tersely.
2. Peter Robison, Flying Blind: The 737 MAX Tragedy and the Fall of Boeing (Doubleday, 2021) — book-length investigative account based on Bloomberg reporting, sourced from Boeing and FAA personnel across the programme; synthesises business-pressure narrative alongside engineering detail.
3. "Boeing's Fatal Flaw," FRONTLINE/PBS × The New York Times, broadcast 14 September 2021 (co-reported by Rory Kennedy and NYT staff) — documentary investigation combining whistleblower testimony, internal-document review, and contemporaneous reporting; used here for synthesis of cockpit-procedural and training-posture evidence.

Tertiary (flagged):

1. Bromfield, M. A. & Jamieson, J., "Lion Air JT610 Boeing 737 MAX 8 accident — human factors perspective," University of Birmingham preprint, 2022 — flagged tertiary, used only as a frame for human-factors vocabulary; no load-bearing factual claim rests on it.

3. OTA narrative

Observe. The pitch-behaviour problem that motivated MCAS was itself a legitimate observation: engineers correctly detected that the larger, forward-mounted LEAP-1B changed the aircraft's stick-force gradient at high angles of attack, and they produced a control-law fix rather than ignoring it. The observation that failed was a different one — the observation of MCAS's own failure modes during development. Internal Boeing simulator work surfaced the system's behaviour under spurious AOA input (a test pilot taking more than ten seconds to diagnose and respond to an uncommanded activation, as documented in the House Committee report and the DOJ Statement of Facts), and chief technical pilot messages in 2016 flagged the function as "running rampant" in the simulator. Those signals were observed but were not escalated into the certification record, the flight manual, or differences training. Observe is a root-cause phase in this episode, and it is classified Wrong at the easy end of the task-difficulty axis: surfacing a known in-house simulator anomaly on a safety-critical control law to the regulator and to pilot training was a routine move for the commercial-aviation OEM peer group, not a novel interpretive feat.

Think. The reasoning apparatus compounded the observation failure rather than catching it. The safety assessment treated MCAS as an incremental change to an existing speed-trim function, reasoned from a catastrophic-failure probability that assumed four-second pilot recognition of runaway stabiliser, and concluded that a single-AOA-sensor architecture met certification requirements — a chain the JATR report and the Indonesian NTSC final report both identify as resting on incorrect assumptions about flight-crew response and on an incomplete review of multiple simultaneous flight-deck effects. Reasoning also produced the programme-level judgement that MCAS should not appear in the flight manual or in differences training, a judgement tied to the commercial commitment that the MAX not trigger simulator training for 737 NG pilots. The correct framework — that a new, high-authority, repeatedly-activating pitch-control function derived from a single sensor is a hazardous failure and must be disclosed to pilots and to the regulator's Aircraft Evaluation Group — existed in the industry's own certification literature and in Boeing's prior-generation practice. It was not applied. The reasoning failure is therefore the principal root cause of the outcome and is classified Easy-Wrong Think.

Act. Execution carried the flawed reasoning into the field rather than saving the case from it. Boeing's Chief Technical Pilot requested that MCAS be removed from the flight manual, and, per the DOJ Statement of Facts, concealed the expansion of MCAS's low-speed authority from the FAA Aircraft Evaluation Group after it was no longer accurate to describe the system in the original terms. Production and delivery proceeded; pilot conversion training did not include MCAS; the single-sensor architecture shipped on every MAX. When Lion Air's AOA-sensor failure occurred in October 2018 and the Ethiopian crew met the same failure mode in March 2019, they found aircraft whose certification and training posture had been set by those earlier acts. Act is a root-cause phase in this episode. It is classified Wrong at the easy end of the difficulty axis: truthful disclosure to the regulator and inclusion of a new high-authority automated pitch function in the flight manual and differences training were routine moves for the commercial-aviation OEM peer group, not execution requiring new capability. Act and Observe both carried weight alongside the Think failure; the failures reinforced each other rather than one carrying a clean signal through.

4. Modality evidence

Direction. The board's 30 August 2011 approval of a re-engined 737 derivative over a clean-sheet replacement was a specific, dated, attributable strategic choice, made in direct response to the December 2010 A320neo launch and American Airlines' July 2011 mixed-fleet order (House Committee final report; Robison, Flying Blind). Paired with this, the programme-level commitment communicated to launch customers — that the MAX would not trigger simulator training for 737 NG pilots — was an explicit strategic posture that bound downstream engineering, certification, and training decisions, and was tracked internally as a rebate-bearing contractual commitment (DOJ Statement of Facts; House Committee report). Directional intent was therefore public, dated, and attributable to identifiable executives and the board.

Scoring note (zero-modality rationale): the directional layer described in this subsection is acknowledged in the §4 evidence as present and specific but is not load-bearing for the strategic failure causation of the episode — the operative failure causation mechanism was located in Structure, Processes, Culture rather than in the directional choice itself. Direction is therefore recorded at zero per cent on the rationale of modality acknowledged in narrative but not load-bearing for the strategic value created in the episode. Categorisation under METHODOLOGY-ota-scoring-v4.md §5: modality acknowledged in narrative but not load-bearing.

Structure. The certification architecture for the MAX ran through Boeing's Organization Designation Authorization (ODA): Boeing employees acting as Authorized Representatives performed findings of compliance on Boeing's own design on behalf of the FAA, with FAA Aircraft Evaluation Group (AEG) sitting separately as the body responsible for flight-manual and training-differences determinations (JATR report, §§ on certification process and delegation; House Committee report, "Boeing's Influence Over the FAA's Oversight Structure"). Reporting lines for the 737 MAX Chief Technical Pilot placed authorship of pilot-training posture and liaison with AEG within the same programme organisation whose schedule and commercial commitments were at stake (DOJ Statement of Facts; House Committee report, "Conflicted Representation"). The JATR further observed that the treatment of MCAS as a change to an existing speed-trim function meant the function was not routed through the organisational path that would have triggered a fresh system-safety review at the higher authority level eventually implemented.

Processes. The system-safety assessment process classified MCAS against a catastrophic-failure probability that assumed a four-second pilot recognition-and-response time for uncommanded stabiliser movement, and treated a single-AOA-sensor architecture as meeting certification requirements on that basis (JATR findings; KNKT final report §1.18 and §3). The differences-training determination process did not re-open when MCAS's low-speed authority was expanded from 0.6 to 2.5 degrees per activation and its trigger was reduced to a single sensor (Seattle Times, "The inside story of MCAS"; DOJ Statement of Facts). The JATR identified the incomplete multi-flight-deck-effect review and the non-escalation of in-house simulator findings into the certification record as process-level observations, not individual-error observations.

Capability. Boeing retained deep capability in transport-category aircraft engineering, including the specific competences — control-law design, system-safety assessment methodology, simulator modelling, flight-test instrumentation — that the MCAS problem called on; the House Committee report and Robison both document that internal engineers identified MCAS's failure behaviour and its aerodynamic scope changes during development. The 2016 chief technical pilot messages describing MCAS as "running rampant" in the simulator indicate that the diagnostic capability to see the problem was present in the programme (House Committee report; DOJ Statement of Facts). The capability gap the episode surfaces is narrower: translating in-house simulator observations into escalation to AEG and into flight-manual and differences-training content.

Scoring note (zero-modality rationale): the capability described in this subsection is recorded at zero per cent in the modality weights on the rationale of insufficient causal weight — the §4 evidence establishes that Boeing 737 MAX possessed the technical and operational capability the situation required; the failure mechanism was located in Structure, Processes, Culture rather than in a capability gap. The capability is acknowledged as present in the narrative but does not carry standalone weight in the failure attribution. Categorisation under METHODOLOGY-ota-scoring-v4.md §5 "Zero-modality rationale rule": insufficient causal weight.

Culture. Multiple primary investigations characterise the programme-level cultural pathway as one in which schedule, training-commitment preservation, and cost pressures suppressed internal safety dissent and shaped disclosure behaviour toward the regulator (House Committee report, "Production Pressures" and "Culture of Concealment"; DOJ Statement of Facts, describing concealment of MCAS's expanded authority from FAA AEG; FRONTLINE/NYT, "Boeing's Fatal Flaw," on engineer and pilot testimony). Internal messages captured in the House Committee record and the DOJ filing reflect engineers and pilots raising concerns about MCAS, training posture, and production pace that were not converted into programme-level corrective action before entry into service. Robison's reconstruction situates the MAX programme within a longer post-McDonnell-Douglas-merger cultural shift in which financial and schedule metrics displaced the earlier engineering-led norm set, a framing corroborated by named engineer testimony in the House record.