Mark ở vũ trụ khácVIMark học AI
Mark ở vũ trụ khác · Another Universe Anatomy of a Disaster · Aviation · Design and risk governance

Boeing 737 MAX

21° 346

Lion Air 610 · 29 Oct 2018 · Java Sea  |  Ethiopian 302 · 10 Mar 2019 · Ejere, Ethiopia

What happenedtwo new airliners dove nose-first, less than five months apart
Loss346 people: 189 and 157
Root causeMCAS relied on one sensor, and pilots were not told it existed
Main sourcesUS House Sept 2020, KNKT Oct 2019, EAIB Dec 2022
Re-read in 1 minute

Essence

One sensorMCAS read angle of attack from exactly one sensor. A bad sensor made the plane push its own nose down.
The 4-second assumptionThe design assumed pilots respond in 4 seconds. A Boeing test pilot took more than 10.
Struck from the manualMCAS was removed from the pilots' operations manual. Most did not know it was on board.
"No extra training" pressureThe sales goal: 737 pilots could fly the MAX without simulator training.
Not just the pilotsThe crews made errors, but inside a trap built by the design and by missing information.

Source: Final Committee Report, US House Committee on Transportation and Infrastructure (Sept 2020), pp. 13, 21, 24–25; FAA return-to-service summary (Nov 2020), pp. 20–23.

Part 1

The question of the case

An old-line planemaker, the world's most powerful certification authority, and a system so small it was left out of the manual. How did an unchecked assumption pass through every layer of review, and why, after the first crash, did the second one still happen?

2011–2017AssumptionThe MAX had to be similar enough to the old 737 to avoid simulator training. MCAS was added, then made stronger.
→
29 Oct 2018Lion Air 610A sensor 21° off. MCAS pushed the nose down more than 20 times. 189 dead.
→
10 Mar 2019Ethiopian 302An emergency directive was already out. Control was still lost within 6 minutes. 157 dead.

Source: US House (2020), pp. 5, 9, 24; KNKT (2019), p. xviii; EAIB (2022), pp. 17–18.

Part 2

What happened

Local times, converted from the UTC times in the Indonesian (KNKT) and Ethiopian (EAIB) reports.

Both flights on one minute scale. Lion Air 610: takeoff 06:20; in minute 2 the first automatic nose-down trim; from minute 5 to 9 repeated MCAS activations countered by the captain; at minute 10 the first officer takes control; at minute 11 the dive and loss of radar contact. Ethiopian 302: takeoff 08:38; 10 seconds later the left sensor reads 74.5 degrees; MCAS first at minute 1.5; crew cuts out electric trim at minute 2; overspeed at minute 3; electric trim back on at minute 4.6, MCAS a fourth time; recording ends at minute 5. Lion Air 610Jakarta, 06:20 takeoff "flight control problem" first nose-down trim 20+ MCAS activations · captain trims back FO takes control ~12 min · 189 people Ethiopian 302Addis Ababa, 08:38 AOA 74.5° MCAS 1 trim cutout overspeed back on ~6 min · 157 people 024681012 min
The second crash was twice as fast. On ET302 the crew cut out electric trim as the post-Lion Air directive said, but the manual trim wheel would not turn at high speed; they switched electric trim back on and MCAS fired a fourth time.Source: KNKT (2019), section 1.1, pp. 19–27 (UTC+7); EAIB (2022), section 1.1, pp. 20–30 (UTC+3). US House (2020), p. 5, says Lion Air crashed "13 minutes after takeoff"; KNKT's times give about 12 minutes.
8 Mar 2017 · CertifiedThe 737 MAX is the 12th derivative of the 737 (first certified 1967). Entered service May 2017.
28 Oct 2018, evening · The flight the night beforeThe left angle-of-attack sensor, just replaced in Denpasar, is 21° off. MCAS fires; the stick shaker runs the whole flight. A deadheading pilot in the jump seat suggests cutting out electric trim. The tech log does not record the cutout.
29 Oct 2018, 06:20 · Lion Air 610Same aircraft. The crew does not know about the night before. 189 dead.
7 Nov 2018 · FAA emergency directiveTells crews to use the "runaway stabilizer" procedure in a similar situation.
10 Mar 2019, 08:38 · Ethiopian 302The left sensor reads 74.5° right after takeoff. 157 dead.
13 Mar 2019 · GroundedThe FAA grounds the 737 MAX, three days after the second crash. It returns to service on 18 Nov 2020.

Source: US House (2020), pp. 5, 8–9, 13; KNKT (2019), pp. xviii, 36–37; EAIB (2022), p. 21; US comments on the EAIB report (NTSB, 2022), pp. 3, 7 (Emergency AD 2018-23-51); FAA (18 Nov 2020).

Post 1

What happened

346 peoplethe night before12 and 6 minutes
Post 2

Why

MCAS4-second assumptionwho knew what"bad pilots"?
Post 3

Work lesson

assumption logsingle point of failureusers must know
Part 3

Why: five layers of cause

The House committee wrote that the crashes "were not the result of a singular failure", but "the horrific culmination" of faulty technical assumptions by Boeing's engineers, a lack of transparency by Boeing's management, and "grossly insufficient oversight" by the FAA.

Source: US House (2020), p. 6.

Technical layer: MCAS and one sensor

Maneuvering Characteristics Augmentation SystemFAA 2020, pp. 9–23
The MCAS loop. Larger engines, mounted higher and further forward, make the control column feel lighter at high angle of attack. MCAS reads one angle-of-attack sensor. If it reads high, the computer moves the horizontal stabilizer nose-down at 0.27 degrees per second, up to 2.5 degrees. If the pilot trims back, MCAS fires again a few seconds later. The other sensor is not used as a cross-check. AOA sensorleft: 21° off(Lion Air) right sensornot cross-checked flight control computer"high AOA: nose down" horizontal stabilizer0.27°/s, up to 2.5° pilot trims back → repeats seconds later Why MCAS: bigger, more forward engines made the column feel "lighter … than the regulations allow".
A small system, two big assumptions. The original design used one sensor and could fire repeatedly. The 2020 fix compares both sensors (more than 5.5° apart means no MCAS), fires once, and is limited so the pilot can always overpower it with the column.Source: FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), pp. 9–10, 20–24, 28; 21° bias: KNKT (2019), p. xviii.

Assumption layer: 4 seconds and more than 10

pilot response assumptionHouse, pp. 13–14, 24–25; JATR, p. 14
Response time. Federal guidance assumes pilots respond within 4 seconds: 1 second to recognise, 3 to act. In November 2012 a Boeing test pilot in a simulator took more than 10 seconds and called the condition catastrophic. On the real aircraft the stick shaker and airspeed and altitude disagree alerts were going off at the same time. 0246810 s design assumption 1 s recognise3 s act 4 seconds Boeing test pilot, 2012 more than 10 s · "catastrophic" On the real aircraft at once: stick shaker · IAS disagree · ALT disagree
The 2012 finding appeared in at least six internal Boeing documents (2015–2018). At least four Boeing authorized representatives knew and did not tell the FAA. The committee concluded Boeing expected pilots, "who were largely unaware that the system existed", to cope when it failed.Source: US House (2020), pp. 13–14, 24–25; JATR (11 Oct 2019), p. 14, observation O2.8-A ("recognition time is assumed to be 1 second, and reaction time … 3 seconds"); simultaneous alerts: KNKT (2019), p. xviii.

Information layer: who knew what

culture of concealmentHouse, pp. 20–25; DOJ 2021

Boeing knew

March 2016: MCAS redesigned, stronger at low speed (p. 20). 2015: an engineer asked whether MCAS was "vulnerable to single AOA sensor failures" (p. 21). August 2017: found the AOA DISAGREE alert was inoperable on more than 80% of the fleet, deferred the fix to 2020 (pp. 22–24).

The FAA knew part of it

JATR: the FAA "had inadequate awareness of the MCAS function", and MCAS "was not evaluated as a complete and integrated function" (pp. VII–VIII). Boeing admitted two of its technical pilots deceived the FAA's training evaluation group about MCAS (DOJ).

Pilots did not know

References to MCAS were removed from the flight crew operations manual, with FAA approval (p. 21). The Lion Air 610 crew did not know about the night before, because the tech log did not record the trim cutout (KNKT, p. xviii).

Source: US House (2020), pp. 20–25; JATR (2019), pp. VII–VIII; US Department of Justice press release, 7 Jan 2021; KNKT (2019), p. xviii.

Pressure layer: "no simulator needed"

production pressureHouse, pp. 16–17, 24, 26
Three numbers about pressure. 2011 contract with Southwest: at least 1 million dollars off each aircraft if the FAA required simulator training. Boeing anticipated 16 hours of computer-based training; the FAA estimated about 2. Internal 2016 survey: 39 percent of Boeing authorized representatives perceived undue pressure. $1 million off each aircraftfor Southwest if simulatortraining required (2011) 16 → ~2 hours computer-based training:Boeing expected 16,FAA estimated ~2 39% of Boeing authorizedrepresentatives felt"undue pressure" (2016)
A business goal became a design constraint. In 2012 Boeing cut 2,000 hours of avionics regression testing and 8,000 hours of engineering-cab simulator work. Adding a new system to the manual could trigger extra training, which the whole programme wanted to avoid.Source: US House (2020), p. 16 (39% survey), 17 (testing hours cut), 24 (Southwest contract), 26 (16 hours and 2 hours).

Human layer: the crews, and where the reports disagree

crew performanceKNKT §3; EAIB; NTSB 2022–2023
QuestionEthiopian report (EAIB, Dec 2022)US (NTSB) and French (BEA) teams
Main causerepeated MCAS nose-down from a bad sensoragree MCAS belongs in the probable cause
Was it recoverable"unrecoverable"controllable if procedures were followed
Thrust and speedcrew actions not analysedthrust stayed at full, overspeed "played a significant role"
Why the sensor failedunexplained electrical faultvane sheared by a foreign object, "most likely a bird"

Source: US comments on the EAIB draft report (published by NTSB 27 Dec 2022), pp. 2–3, 6–7; NTSB press release 24 Jan 2023; EAIB conclusions and BEA comments (3 Jan 2023) as summarised by Flightradar24 and Fear of Landing (secondary).

The Indonesian report says it plainly: the ninth of its nine contributing factors is the crew's manual handling, non-normal checklist execution and cockpit communication, issues that "had previously been identified during training and reappeared during the accident flight". The other eight are about design, certification, the sensor, maintenance and information.

Source: KNKT (2019), section 3.2 "Contributing factors" (p. 215 per the table of contents); wording via secondary summaries.

Part 4

Fact check: what is true and what is myth

13 things often said about the 737 MAX, checked against the original records. Tap a row to see why.

SOLIDMCAS relied on a single angle-of-attack sensor

Confirmed in the FAA's return-to-service summary (p. 20). KNKT lists it as a contributing factor. The fix uses both sensors.

SOLIDPilots were not told MCAS existed

MCAS was removed from the flight crew operations manual with FAA approval; the committee says pilots were "largely unaware that the system existed" (House, pp. 13, 21). Boeing sent MCAS information to all operators only on 10 Nov 2018, after Lion Air (NTSB, Jan 2023, p. 7).

SOLIDThe "AOA disagree" alert did not work on most aircraft

It was wrongly tied to an optional extra, so it was "inoperable on more than 80 percent of the MAX aircraft". Boeing found this in August 2017 and deferred the fix to 2020 (House, pp. 22–24). Neither Lion Air nor Ethiopian had it (KNKT; EAIB, p. 55).

SOLIDThe flight the night before hit the same fault and survived

The crew cut out electric trim on a deadheading pilot's suggestion but did not record it in the tech log (KNKT, pp. xviii, 36; House, pp. 8–9). The situation was survivable, but the information never reached the next morning's crew.

SOLIDBoeing knew pilots could take more than 10 seconds to respond

From a November 2012 simulator test, recorded in at least six internal documents from 2015 to 2018 (House, pp. 24–25).

SOLIDAvoiding simulator training was a commercial goal

2011 Southwest contract: at least $1 million off each aircraft if the FAA required simulator training; a July 2014 Boeing press release said none would be needed (House, pp. 24, 26).

CAUTIONThe pilots did nothing wrong

KNKT names the Lion Air crew's manual handling, checklist execution and communication as a factor. For ET302 the US team points to thrust left at full power leading to overspeed, and to the crew switching electric trim back on against the procedure (pp. 6–7). The ET302 first officer had 207 hours on the 737 (House, p. 10). The errors were real, but made amid simultaneous alarms, with a system they had never been taught.

CAUTION"It was a software bug"

The software did what it was designed to do. The flaw was in the design and its assumptions: one sensor, repeated activation, pilots not told, and a system "not evaluated as a complete and integrated function" (JATR, p. VIII).

CAUTIONA bird broke the ET302 sensor

The NTSB concluded the vane separated after hitting a foreign object, "most likely a bird", and says this evidence was left out of the final report. The EAIB blames an electrical fault. The two agencies disagree; unresolved.

CAUTIONThe FAA predicted 15 more crashes and let the plane fly

An internal FAA risk analysis dated 3 Dec 2018 estimated up to 15 fatal crashes over the fleet's lifetime without an MCAS fix. It was released at a House hearing in Dec 2019; I could only read it through press reports (CNBC), so it is marked secondary.

FALSE"It was just bad foreign pilots; US pilots would not have crashed"

Boeing's own test pilot took more than 10 seconds. The two Lion Air pilots had over 5,100 and 4,200 hours on the 737. The president of the American Airlines pilots' union told Congress that claiming this would not happen to US-trained pilots "is presumptuous and not supported by fact" (House, pp. 10–11, 24–25). After the crashes, the FAA changed the design, training and manuals for every pilot, US pilots included.

FALSEAfter Lion Air, pilots were fully trained on MCAS

They received an emergency directive and a manual bulletin (Nov 2018). The flap position needed for MCAS to activate was not in Boeing's bulletin or the FAA directive (NTSB, Jan 2023, p. 6). Mandatory MCAS training came only in Nov 2020 (FAA, pp. 11, 14).

FALSE"Boeing paid a $2.5 billion fine"

The 7 Jan 2021 deferred prosecution agreement was worth over $2.5 billion, but the criminal penalty was $243.6 million. $1.77 billion went to airline customers and $500 million to a fund for victims' families (US Department of Justice).

Part 5

Assessment

Scores are Mark's assessment based on the sources in Part 8, not figures from a study.

Avoidable
5/5
Warnings in advance
4/5
Transparent investigation
3/5
Lessons retained
2/5
Done right afterwards
  • MCAS uses two sensors and fires once
  • Disagree alert standard, training mandatory
  • House released internal records; independent international JATR
Not done right
  • The second crash happened despite warnings after the first
  • Ethiopian and US investigators could not agree
  • 2024: a door plug blew out on Alaska Airlines 1282

Source: FAA (Nov 2020), pp. 11, 14, 24; NTSB investigation DCA24MA063 (Alaska 1282, 5 Jan 2024): probable cause Boeing's failure to provide adequate training, guidance and oversight; the four bolts securing the plug were not located.

Not one mistake, but an assumption carried through every layer of review without anyone checking it again, while the people who most needed to know were not told.

More: why the second crash still happened

After Lion Air, Boeing and the FAA chose a procedural patch: remind pilots of the existing "runaway stabilizer" procedure. Meanwhile, the FAA's own internal analysis estimated the risk remained high (secondary source). The aircraft kept flying while Boeing worked on a software fix.

On ET302 the crew did cut out electric trim, but by then the aircraft was so fast and so far out of trim that the wheel would not turn. The procedure was written for a "cleaner" situation than the real one. Another untested assumption.

Source: EAIB (2022), pp. 26–30; US comments (2022), pp. 6–7; CNBC, 11 Dec 2019, on the FAA's TARAM analysis.

Part 6

Work lesson: write your assumptions down, and ask who needs to know

For any design you hand to others: a product feature, an internal process, an AI model, a plan.

Four steps: write each assumption as one line, record who tested it and with what data, re-check every assumption when the design changes, and list who needs to know. 1 · write it down"users respond in 4 s"one line, one number 2 · who tested it, howreal test: over 10 sbad results must go up 3 · design changes, re-checkMCAS stronger in 2016do old assumptions hold? 4 · who needs to knowend users firstdon't hide it to skip training An assumption nobody wrote down is one nobody can re-check.
Each step matches one failure in the 737 MAX story. A 4-second assumption, a 10-second result that did not change the design, MCAS made stronger without a full re-evaluation, and pilots who were never told.Source: US House (2020), pp. 13, 20–25; JATR (2019), p. VIII.
Find the single point of failureAsk: if just this one data source is wrong, what happens? One sensor, one API, one approver.
Don't hide things to avoid teaching themIf "no training needed" is a goal, make sure it never becomes a reason not to tell.
A mid-course change is a new designEach time scope grows, re-check the whole list of assumptions, not just the part you changed.
Log the near missThe night-before flight was saved, but no one wrote down how. Record the save, too.
These crashes are demonstrable evidence that our current system of aircraft design and certification has failed us.Captain Chesley Sullenberger, testimony to the US House (June 2019), quoted in the committee report, pp. 11–12.
Part 7

Further reading

US House Committee on Transportation and Infrastructure, The Design, Development & Certification of the Boeing 737 MAX (2020)The 25-page executive summary alone tells the whole story, with quotes from internal documents.
JATR, Boeing 737 MAX Flight Control System (2019)Nine international aviation authorities review the certification process. Dry but very clear.
KNKT report on PK-LQP (2019) and EAIB report on ET-AVJ (2022), with the NTSB commentsRead both sides to see how investigators can read the same data two ways.
Anatomy of a Disaster #09: Fukushima Daiichi (2011)A warning of a higher tsunami existed beforehand, but was set aside as too costly.
Part 8

Original sources

Primary documents first. Where only a secondary source exists, the Fact check says so.

  1. Committee on Transportation and Infrastructure, US House of Representatives, Final Committee Report: The Design, Development & Certification of the Boeing 737 MAX, Sept 2020. transportation.house.gov
  2. KNKT (Indonesia), Aircraft Accident Investigation Report, Boeing 737-8 (MAX) PK-LQP, final report, Oct 2019. PDF copy
  3. EAIB (Ethiopia), Investigation Report on Accident to the B737-8 (MAX) ET-AVJ, final report, 23 Dec 2022. bea.aero
  4. NTSB, comments of the US accredited representative on the EAIB draft report (Mar 2022, published 27 Dec 2022) and "Response to EAIB final report" (Jan 2023). ntsb.gov
  5. JATR, Boeing 737 MAX Flight Control System: Observations, Findings, and Recommendations, 11 Oct 2019. PDF
  6. FAA, Summary of the FAA's Review of the Boeing 737 MAX, 18 Nov 2020. faa.gov
  7. US Department of Justice, "Boeing Charged with 737 Max Fraud Conspiracy and Agrees to Pay over $2.5 Billion", 7 Jan 2021. justice.gov
  8. NTSB, investigation DCA24MA063 (Alaska Airlines 1282), 2025. ntsb.gov
  9. Secondary sources: CNBC, 11 Dec 2019 (FAA TARAM analysis); Flightradar24 and Fear of Landing (summaries of the EAIB conclusions and BEA comments); Jakarta Post, 25 Oct 2019 (KNKT contributing factors).