Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Boeing 737 MAX: MCAS and the Cost of Certification Assumptions

Overview

On October 29, 2018, Lion Air Flight 610, a Boeing 737 MAX 8, crashed into the Java Sea about eleven minutes after departing Jakarta, killing all 189 people aboard. Less than five months later, on March 10, 2019, Ethiopian Airlines Flight 302, also a 737 MAX 8, crashed roughly six minutes after takeoff from Addis Ababa, killing all 157 aboard. In both accidents the Maneuvering Characteristics Augmentation System (MCAS), an automatic nose-down trim function Boeing added to the MAX to offset the pitch behavior of its larger, more forward-mounted engines, received erroneous data from a single angle-of-attack (AOA) sensor and commanded repeated nose-down stabilizer trim. The flight crews countered with their own trim inputs, but each countermeasure reset MCAS for another command, and the accumulating nose-down mistrim outstripped what the elevators could hold. The AOA disagree alert that would have named the underlying sensor fault was inactive on both aircraft because it was gated behind an optional cockpit package. This case examines the failure mechanism, the certification drift that allowed a safety-relevant function to grow beyond its reviewed scope, and the organizational factors that kept crews, regulators, and even senior leadership uninformed. It draws on the NTSB safety report ASR-19/01 (2019), the KNKT final report on Lion Air 610 (2019), the FAA-commissioned Joint Authorities Technical Review summary (2020), the U.S. House Transportation and Infrastructure Committee final report (2020), and the U.S. Department of Justice deferred prosecution agreement (2021).

What Happened

On October 29, 2018, Lion Air Flight 610, a 737 MAX 8 registered PK-LQP, departed Jakarta and crashed into the Java Sea about eleven minutes later; there were no survivors among the 189 aboard (KNKT final report, 2019). The investigation found that the aircraft’s left AOA vane had been replaced at a maintenance facility shortly before the accident and that the full calibration and verification steps required by the procedure had not been carried out, leaving the vane reading roughly twenty degrees high from the start of the flight (KNKT final report, 2019). On the previous day, the same aircraft had flown with a similar AOA fault, and the crew landed safely after a deadheading, off-duty MAX pilot advised cutting the electric stabilizer trim. The accident crew, who had never been told MCAS existed, fought repeated nose-down trim without cutting that trim out in time, and the aircraft dove into the sea.

The response to the first crash was procedural rather than structural. Boeing issued an Operations Manual Bulletin in early November 2018, followed by an FAA Emergency Airworthiness Directive, both advising crews how to recognize and respond to uncommanded nose-down stabilizer trim. Interpretation: these notices assumed crews would diagnose the failure within seconds using existing checklists, an assumption that was never validated and that the second accident would falsify.

On March 10, 2019, Ethiopian Airlines Flight 302, a 737 MAX 8 registered ET-AVJ, departed Addis Ababa for Nairobi and crashed about six minutes after takeoff near Bishoftu, killing all 157 aboard. The left AOA vane failed in flight and read erroneously high while the right vane remained plausible; after flap retraction, MCAS began commanding nose-down trim, and the crew’s opposing electric trim inputs reset the system for further commands (Ethiopian investigation reports; NTSB participation). The crew performed the stabilizer trim cutout, but with the nose already far down and airspeed high, manual trimming could not recover the aircraft.

Within days of the second crash, most aviation regulators had grounded the MAX, and on March 13, 2019 the FAA issued an Emergency Order of Prohibition grounding all 737-8 and 737-9 aircraft, making the grounding worldwide. The FAA permitted return to service on November 18, 2020, after mandated design changes, flight-manual revisions, and new training requirements (FAA return-to-service summary, 2020). In between, the aircraft sat at airports worldwide while the largest certification review in commercial aviation history proceeded.

Technical Mechanism

MCAS existed because of the engines. To compete with the re-engined A320neo, Boeing fitted the MAX with larger LEAP-1B engines mounted higher and further forward under the wing. At elevated angles of attack, the engine nacelles contribute lift ahead of the center of gravity, producing a pitch-up tendency that could make the MAX’s handling diverge from the earlier 737 NG. MCAS addressed this by adding automatic nose-down stabilizer trim at high AOA so that the MAX would meet the FAA’s handling characteristics requirements and preserve column feel familiar to NG pilots (FAA return-to-service summary, 2020). Interpretation: the House Committee report (2020) and contemporaneous reporting indicate that the desire to avoid a simulator-training requirement for a new type drove the requirement that the MAX handle like its predecessor, which in turn shaped MCAS into a function Boeing judged too minor to highlight.

The implemented system was narrower in perception than in consequence. MCAS activated on a single AOA sensor’s value, with no comparison against the second vane that the airframe carried; on both accident flights it used the captain’s-side sensor. Each activation commanded incremental nose-down stabilizer trim, up to a maximum of about 2.5 degrees, and successive activations could accumulate (FAA return-to-service summary, 2020). Later MCAS revisions had expanded the system’s authority and its permitted range of activation relative to the version first reviewed, without a corresponding re-review (JATR summary, 2020).

The failure mode was a closed loop that treated resistance as recovery. When a faulty vane read persistently high, MCAS commanded nose-down trim; when the crew responded with electric nose-up trim, releasing the trim switch reset MCAS, which then commanded again about five seconds later (FAA return-to-service summary, 2020). Each cycle drove the stabilizer further nose-down, until the accumulated mistrim exceeded what elevator authority — and eventually manual trim against aerodynamic load at high airspeed — could counter. The crews thus performed exactly the intuitive response, and every application of it re-armed the hazard.

The failure was also opaque at the moment it mattered. The AOA disagree alert, which compares the two vanes and would have pointed directly to a sensor fault, was a standard feature in Boeing’s requirements but shipped activated only for airlines that purchased the optional AOA indicator package; it was inactive on both accident aircraft (Boeing statement on the AOA Disagree alert, May 2019; NTSB ASR-19/01, 2019). The crews saw a stick shaker, airspeed and altitude disagreements, and repeated uncommanded trim, but no indication that named the root cause. Interpretation: the alerting picture presented five symptoms of one fault while withholding the single diagnostic that explained all of them.

Contributing Factors

The first factor is a single point of failure in a safety-relevant control loop. MCAS made automatic, repeated, powerful stabilizer commands based on one sensor, when an independent second sensor was available on the airframe. Redundant hardware existed; the software simply never compared the inputs. The NTSB’s participation in both investigations produced ASR-19/01 (2019), which concluded that accident pilot responses were not consistent with the assumptions about pilot recognition and response used in the safety assessments, and that assumptions used in such assessments require validation.

The second factor is a safety diagnostic sold as an option. The AOA disagree alert was defined as a standard feature but implemented as dependent on a separately priced cockpit package, and it was inactive on both accident aircraft (Boeing statement, May 2019). Interpretation: this followed a broader pattern in which options changed failure behavior, so two airlines flying the identical type had flight decks that behaved differently under the same fault. The KNKT final report (2019) also documented the maintenance side of the trigger: the accident aircraft’s AOA vane had been replaced days earlier without the full calibration procedure, meaning a plausible hardware fault existed before the aircraft ever left the gate.

The third factor is certification drift. MCAS was originally framed as a minor handling-qualifications function with limited authority, analogous in review weight to a yaw damper, and it was certified on that basis; later revisions increased its authority and activation range without a corresponding re-review (JATR summary, 2020). The safety assessment relied on an assumption that flight crews would recognize and counter uncommanded nose-down trim within seconds, an assumption the NTSB found inconsistent with observed pilot behavior (NTSB ASR-19/01, 2019). The House Committee report (September 2020) concluded that production pressure, cost and schedule incentives, and incomplete disclosure to the FAA and to pilots ran through the program’s development and certification.

The fourth factor is that documentation and training were treated as afterthoughts rather than engineered safety controls. MCAS was not described in the flight crew operations manual, no simulator training was required, and pilots received only computer-based differences training that did not mention the system (House Committee report, 2020; Ethiopian investigation). The one crew known to have faced the fault successfully did so because a qualified MAX pilot happened to be aboard and knew the recovery. Interpretation: the undocumentation was not an oversight but a design constraint — describing MCAS would have undermined the training-economics rationale for its existence.

Blast Radius and Impact

The human cost was 346 lives across two accidents, 189 on Lion Air 610 and 157 on Ethiopian 302. Both aircraft dove from cruise-relevant altitudes within minutes of departure, and both crews were competent airline pilots flying an aircraft whose failure behavior they had never been taught. The accidents’ avoidability — demonstrated in reverse by the October 28 precursor flight — made them a lasting reference point in aviation safety discussions.

Operationally, the grounding froze the entire global MAX fleet, several hundred delivered aircraft (approximate figure), in place within days of the second crash. Airlines worldwide canceled thousands of flights and restructured schedules around aircraft they could not fly; Boeing halted MAX production in January 2020 while the fleet waited. Per company disclosures reported through 2020 and beyond, direct program costs — compensation, production disruption, and charges — exceeded twenty billion dollars, in addition to the loss of delivery revenue. The FAA allowed deliveries to resume in December 2020 after return-to-service approval.

Institutionally, the accidents triggered an unprecedented sequence of reviews and legal outcomes. The FAA-commissioned Joint Authorities Technical Review issued its summary in January 2020, finding that MCAS had grown beyond its reviewed scope; the House Committee’s September 2020 final report documented process, culture, and leadership failures; and the NTSB issued ASR-19/01 with recommendations targeting safety-assessment assumptions. On January 7, 2021, the U.S. Department of Justice charged Boeing with conspiracy to defraud the United States and resolved it through a deferred prosecution agreement with a total value of roughly 2.5 billion dollars, including a criminal monetary amount, compensation to airline customers, and a fund for crash-victim beneficiaries (U.S. Department of Justice press release, January 2021).

The reputational blast radius extended to the certification system itself. Congress, the JATR, and the press all examined whether the FAA’s delegation of certification work to the manufacturer could detect a function that had quietly become safety-critical. Public trust in both the manufacturer and the regulator became an explicit casualty, shaping subsequent certification-reform legislation (interpretation as to degree and durability).

What Changed

The aircraft changed first. Per the FAA return-to-service summary (2020), the redesigned MCAS reads both AOA sensors, compares their inputs, and disables itself on sensor disagreement; it permits only one activation per sensed high-AOA event; it can no longer be reset into further commands by the release of electric trim; and its commands are bounded to preserve the pilot’s ability to maneuver with the elevator. Each element of the redesign maps directly onto a defect of the original design: comparison replaces the single point of failure, bounding replaces unbounded accumulation, and honest state handling replaces the reset-on-resistance loop.

Training and documentation changed next. Simulator training became a requirement for the MAX type, the AOA disagree alert became standard equipment, and the flight manual and crew training materials now describe MCAS and its failure modes explicitly. The return-to-service regime included extensive FAA flight and simulator testing and evaluation of the proposed training with a globally diverse pilot group (FAA return-to-service summary, 2020). The contrast with the original program — where the system went unnamed in pilot-facing material — is the clearest measure of what the accidents forced.

The regulatory and legal environment changed as well. The JATR recommendations fed changes in how the FAA reviews manufacturer self-certification, and Congress enacted certification-reform legislation in December 2020 (the Aircraft Certification, Safety, and Accountability Act) requiring, among other things, enhanced FAA review of flight-critical systems on new or derivative aircraft. The DoJ deferred prosecution agreement imposed compliance and reporting obligations alongside its monetary terms. Interpretation: whether the cultural factors the House Committee documented are truly fixed remains the open question that later program controversies keep alive.

Lessons for Engineers

  1. Cross-check redundant inputs before acting on any single one. Two AOA vanes hung on the airframe; MCAS read one and commanded a powerful actuator on its word alone. Any safety-relevant decision made from a single sensor, flag, or service response — when an independent second source exists or could — is a defect waiting for a trigger.

  2. Safety-relevant diagnostics must never be pay-gated. The alert that named the root cause shipped as a purchasable option and was absent where it was needed. Feature flags, options, and configuration that change failure behavior are safety-relevant engineering decisions, not commercial ones.

  3. Software is not separate from systems engineering. MCAS was treated as a small handling tweak rather than as a flight-critical control function, and its hazard analysis was never revisited as the function grew. The hazard analysis must follow the function’s actual authority, not the authority it had when first reviewed.

  4. Certification drift is incremental by construction. Each MCAS revision was individually defensible; the accumulation — more authority, wider range, single-sensor dependence, reset-on-resistance — was never re-examined as a whole. Processes need explicit re-review triggers whenever a function’s scope, authority, or criticality grows beyond its last review.

  5. Undocumented automation converts recoverable faults into fatal ones. The October 28 precursor flight showed the fault was survivable when a crew knew what was happening; two accident crews did not, because no material told them MCAS existed. Automation transparency to operators is a safety requirement, not a courtesy.

  6. Documentation and training are engineered safety controls. Manuals, checklists, and simulator scenarios are as much part of the safety argument as sensors and actuators, and they deserve requirements, verification, and change control. A hazard mitigation that lives in human behavior must be built, tested, and maintained like any other mitigation.

  7. Validate assumptions about the humans in the loop. The safety assessment assumed pilots would diagnose and counter the failure within seconds; the NTSB found real pilot responses inconsistent with those assumptions (NTSB ASR-19/01, 2019). Interpretation: any model of human response embedded in a hazard analysis is a hypothesis to be tested, and the cheapest valid test — showing the system to representative operators — was never done.

Interview Questions

  1. A safety-critical actuator in your system is driven by one input, but an independent second input exists and is read elsewhere. Walk through the design change that makes single-source failure non-hazardous — thresholds, plausibility checks, fail-safe behavior, and verification — and explain what organizational condition allowed the MAX to ship without the equivalent.

  2. Your automated subsystem treats a human’s corrective action as a termination condition, resets, and retries the original harmful action. Describe two designs that eliminate this class of re-triggering loop, and connect each to the specific MCAS redesign item that addressed it.

  3. Your product has a diagnostic that names the root cause of a dangerous failure mode, and product management wants to sell it as a premium option. Construct the engineering argument that determines which diagnostics must never be optional, and identify where Boeing’s process failed on exactly this question.

  4. A hazard analysis classifies a failure as recoverable because it assumes operators recognize and respond within a few seconds. How would you validate, invalidate, or design around such an assumption, and what evidence would you require before signing your name to it?

  5. A single root-cause failure lights up five apparently unrelated alarms on a dashboard, none of which names the cause. Design the alerting hierarchy — which signal names the cause, which reflect symptoms, how aggregation works — using the Ethiopian 302 flight deck, where the disagree alert was missing and the rest of the picture obscured the fault, as your counterexample.

Key Takeaways

  • Two crashes, 346 deaths, and a twenty-month worldwide grounding traced to a system that read one sensor instead of two, treated pilot correction as a reset, and hid its own root-cause diagnostic behind a paid option.
  • The mechanism worth remembering is the reset-on-resistance loop: every countermeasure the crews applied re-armed the hazard within seconds. A hazard state must be exited on evidence the hazard is gone, never on evidence that someone fought back.
  • The certification failure was a failure of assumptions, not paperwork: unvalidated assumptions about pilot response and about the function’s own boundedness carried a flight-critical system through review (NTSB ASR-19/01, 2019; JATR summary, 2020).
  • The fix list is a checklist of classic engineering virtues — cross-check inputs, monitor for implausibility, bound authority, prevent self-resetting loops, and train for the failure — each mapping to a specific original defect (FAA return-to-service summary, 2020).
  • Configuration is behavior: two airlines flew the identical type into the same fault with different flight decks because of optional packages. Fleets are heterogeneous even when the type certificate is identical, so safety arguments must cover what was actually delivered.

Cross-References