In 2017, Boeing introduced the 737 MAX with larger, repositioned engines that altered the aircraft's aerodynamic characteristics. To compensate, engineers installed the Maneuvering Characteristics Augmentation System (MCAS) — an automated flight control system designed to push the nose down if sensors detected an excessive angle of attack. Boeing told regulators the system had limited authority and would rarely activate. In reality, MCAS could activate repeatedly based on a single sensor, override pilot inputs, and command nose-down movements strong enough to make the aircraft unflyable. Boeing did not mention MCAS in pilot manuals or training materials. On October 29, 2018, Lion Air Flight 610 crashed into the Java Sea, killing 189. On March 10, 2019, Ethiopian Airlines Flight 302 crashed six minutes after takeoff, killing 157. Both crashes followed the same sequence: erroneous angle-of-attack sensor data triggered MCAS, pilots fought the system, the aircraft entered an unrecoverable dive.
On August 30, 2011, Boeing announced the 737 MAX program at the Farnborough International Airshow. The decision ended an internal debate that had consumed the company for more than a year: should Boeing design an all-new single-aisle aircraft to replace the 737, or re-engine the existing design with more fuel-efficient powerplants? The new aircraft option would cost an estimated $15 to $20 billion and take a decade to develop. The re-engining approach could deliver aircraft to customers by 2017 at a fraction of the cost.
Airbus had already made its choice. In December 2010, the European manufacturer launched the A320neo — "new engine option" — offering 15% better fuel efficiency than existing A320 models. American Airlines, a Boeing stronghold that had not ordered Airbus aircraft in more than a decade, placed an order for 460 Airbus jets including 130 A320neos. The defection shocked Boeing's executive suite.
Boeing chose speed and cost over clean-sheet design. The 737 MAX would use CFM International's new LEAP-1B engines — high-bypass turbofans promising fuel efficiency comparable to the A320neo. Southwest Airlines, operating the world's largest 737 fleet, committed to 150 aircraft with options for 150 more. The business case depended on a critical promise: the MAX would require minimal pilot retraining beyond the 737NG. For airlines like Southwest, whose single-fleet business model depended on operational simplicity, extensive retraining requirements would destroy the aircraft's economic value.
The larger engines created an aerodynamic problem. Mounted further forward, they changed the aircraft's center of pressure. During certain flight conditions — particularly high angles of attack at low speeds with flaps retracted — the forward engine position generated additional lift ahead of the center of gravity. This produced a pitch-up moment that could cause the aircraft to increase its angle of attack without pilot input, potentially leading to an aerodynamic stall.
Previous 737 variants did not exhibit this handling characteristic. If the MAX felt different to fly, if its pitch behavior diverged from decades of 737 control feel, pilots would require extensive retraining including simulator sessions. Boeing had promised customers that wouldn't be necessary.
The solution was a software system called MCAS — the Maneuvering Characteristics Augmentation System.
MCAS was designed to activate automatically when sensors detected flight conditions where the pitch-up tendency might occur: high angle of attack, flaps retracted, autopilot off. When triggered, the system would command the horizontal stabilizer to move nose-down, counteracting the pitch-up moment and making the MAX feel like previous 737 models.
The system's development and implementation produced decisions that would later prove fatal. MCAS relied on data from angle-of-attack sensors — vane-like devices on the aircraft's fuselage that measure the angle between the oncoming airflow and the aircraft's longitudinal axis. The 737 MAX, like previous 737 models, had two angle-of-attack sensors, one on each side of the forward fuselage.
Boeing engineers designed MCAS to receive input from only one sensor at a time. The system alternated between the left and right sensors on successive flights. There was no comparison logic. If the active sensor provided erroneous data indicating a high angle of attack when the aircraft was actually in normal flight, MCAS would activate based on that single false reading. The system had no mechanism to cross-check the reading against the second sensor, against other aircraft instruments, or against basic flight logic.
"The FAA's 2017 Flight Standardization Board Report for the MAX stated: 'The aircraft can be safely operated with one AOA sensor inoperative.' This was true. But the report did not address what happens when one sensor is operative but providing catastrophically wrong data — which is what killed 346 people."
House Committee on Transportation and Infrastructure — Final Report, September 2020During the MAX certification process from 2012 to 2017, Boeing made incremental changes to MCAS that fundamentally altered its behavior. In the initial design presented to the FAA, MCAS had authority to move the horizontal stabilizer 0.6 degrees per activation and would activate only once per high angle-of-attack event. The final implementation allowed 2.5 degrees of movement — more than four times the original authority — and could reactivate every five seconds if the triggering condition persisted.
Boeing did not conduct a new safety assessment for these changes. The company's internal safety analysis classified MCAS as equivalent to existing systems, despite its unprecedented authority and activation logic.
More significantly, Boeing did not inform pilots that MCAS existed.
The system was not mentioned in the flight crew operations manual. It was not included in pilot training materials. Airlines purchasing the MAX received differences training between the 737NG and 737 MAX that consisted of a one-hour iPad session with no simulator requirement. MCAS was not part of that training.
Internal Boeing emails released during congressional investigations showed this omission was deliberate. Boeing's chief technical pilot Mark Forkner successfully lobbied the FAA to remove references to MCAS from pilot training materials, arguing the system was similar to existing speed trim systems and didn't require special callout. The goal was maintaining Boeing's promise of minimal retraining — and avoiding simulator mandates that would impose costs on airline customers and reduce the MAX's competitive appeal.
Lion Air Flight 610 departed Jakarta's Soekarno-Hatta International Airport at 6:20 AM local time on October 29, 2018, bound for Pangkal Pinang on the Indonesian island of Bangka. The aircraft was a 737 MAX 8 registered as PK-LQP, delivered new to Lion Air less than three months earlier. Captain Bhavye Suneja, 31, had 6,028 total flight hours. First Officer Harvino, 41, had 5,174 hours. There were 189 people on board.
Two seconds after liftoff, the captain's angle-of-attack sensor began providing erroneous data, indicating the aircraft's nose was 20 degrees higher than its actual position. The captain's stick shaker — a device that vibrates the control column to warn of an impending stall — activated and continued throughout the flight. MCAS received the false high angle-of-attack reading and activated, commanding nose-down stabilizer trim.
The pilots pulled back on their control columns, counteracting the nose-down command. MCAS reactivated five seconds later. Then again. And again.
The cockpit voice recorder captured the captain asking the first officer to check the quick reference handbook — the emergency procedures manual. But the Boeing flight crew operations manual contained no reference to MCAS. There was a procedure for "runaway stabilizer" that instructed pilots to disable the electric trim system, but identifying the emergency as runaway stabilizer required recognizing that uncommanded trim movements were occurring — a challenging diagnosis in the high-workload environment of departure with a stick shaker rattling and conflicting instrument readings.
At 6:32 AM, 11 minutes after takeoff, the aircraft entered a high-speed dive. It struck the Java Sea at approximately 450 knots, killing all 189 people on board. The impact destroyed the aircraft. Indonesian Navy divers recovered the flight data recorder on November 1 and the cockpit voice recorder on January 14, 2019, from the seafloor at a depth of approximately 100 feet.
Investigation revealed a critical detail: the previous flight on the same aircraft, the night before the crash, had experienced identical problems. The off-duty pilot riding in the cockpit jumpsuit recognized that the pilots were fighting uncommanded trim and instructed them to disable the electric stabilizer trim system using cutout switches on the center pedestal. This allowed manual trim control, and the flight landed safely in Jakarta. Maintenance records showed that the faulty angle-of-attack sensor had been replaced three times in the four days before the crash, but ground testing did not replicate the in-flight failure mode.
On November 7, 2018, nine days after the crash, the FAA issued an Emergency Airworthiness Directive. The directive required revisions to flight manual procedures and reiterated guidance for dealing with erroneous angle-of-attack data, but it did not ground the MAX fleet or require Boeing to inform pilots specifically about MCAS beyond the emergency procedure reference. The FAA stated that simulator training was not necessary.
Ethiopian Airlines Flight 302 departed Addis Ababa's Bole International Airport at 8:38 AM local time on March 10, 2019, bound for Nairobi. The aircraft was a 737 MAX 8 registered as ET-AVJ, delivered to Ethiopian Airlines four months earlier. Captain Yared Getachew had 8,122 total flight hours including 103 on the MAX. First Officer Ahmed Nur Mohammod Nur had 361 total hours including 56 on the MAX. There were 157 people on board from 35 countries.
Immediately after takeoff, the captain's angle-of-attack sensor began providing erroneous data. The stick shaker activated. MCAS triggered based on the false reading, commanding nose-down stabilizer trim. The pilots recognized the emergency more quickly than the Lion Air crew — they had the benefit of the Lion Air accident investigation and Boeing's subsequent emergency procedures bulletin. At 8:40 AM, approximately two minutes after takeoff, the captain stated "stab trim cut out" on the cockpit voice recorder. The pilots followed Boeing's emergency procedure, flipping the cutout switches to disable the electric stabilizer trim system.
But the aircraft was already in a compromised state. MCAS had commanded the horizontal stabilizer to its nearly full nose-down position. The aircraft was accelerating in a dive. At those speeds — the aircraft reached approximately 575 knots before impact — the aerodynamic forces on the stabilizer were enormous. The pilots attempted to manually retrim the aircraft using the mechanical trim wheels on the center pedestal, but the forces were too great. They could not move the wheels.
The cockpit voice recorder captured the pilots' struggle. At 8:43 AM, five minutes after takeoff, the captain re-enabled the electric trim system — likely attempting to use electric trim to move the stabilizer since manual trim was not working. This reactivated MCAS, which immediately commanded additional nose-down trim. At 8:44 AM, the aircraft impacted the ground in a nearly vertical dive near the town of Bishoftu, approximately 40 miles southeast of Addis Ababa. The impact created a crater 32 feet deep. There were no survivors.
Within hours of the Ethiopian crash, aviation authorities began grounding the 737 MAX. China's Civil Aviation Administration issued an emergency directive on March 11, grounding all MAX aircraft operating in Chinese airspace. Indonesia, Ethiopia, Singapore, Australia, Malaysia, and the European Union Aviation Safety Agency followed. By March 12, more than 50 countries had grounded the MAX.
The FAA did not act immediately. On March 11 and 12, the agency issued statements affirming the MAX's airworthiness and stating there was no basis for grounding the fleet. Airlines continued operating MAX flights in US airspace while the aircraft was banned across most of the world. On March 13, following additional satellite data analysis and facing pressure from Congress, the FAA reversed its position and issued an Emergency Order of Prohibition grounding all 737 MAX aircraft.
The grounding would last 20 months — the longest in modern aviation history. At the time of grounding, there were 387 MAX aircraft in service worldwide with approximately 4,700 additional aircraft on order. Boeing immediately halted MAX deliveries. In January 2020, the company suspended MAX production entirely.
The financial impact was severe. Boeing reported operating losses of $12.8 billion in 2019 and $11.9 billion in 2020. The company disclosed approximately $20 billion in cumulative costs related to the MAX grounding, including compensation to airline customers, production costs for aircraft that could not be delivered, and engineering costs for required design changes.
The House Committee on Transportation and Infrastructure launched an investigation in March 2019, shortly after the Ethiopian crash. Over 18 months, the committee interviewed Boeing employees, FAA officials, and whistleblowers, and obtained more than 600,000 pages of internal documents including emails and instant messages between Boeing employees.
The documents revealed the extent of Boeing's knowledge about MCAS and the deliberate decisions to minimize its profile during certification and pilot training.
In February 2016, chief technical pilot Mark Forkner sent an instant message to a colleague expressing concern about MCAS behavior during simulator testing. "So I basically lied to the regulators (unknowingly)," Forkner wrote, adding "It wasn't a oversight [sic]" and asking "Granted, I suck at flying, but even this was egregious." The message indicated Forkner had discovered MCAS was activating in flight conditions different from what he had described to the FAA.
Other messages showed Boeing employees mocking FAA representatives. In one exchange, employees referred to an FAA engineer as a "clown." In another, after the FAA questioned Boeing's analysis, an employee wrote "I want to stress that this is what the FAA will accept. In an important decision, the one we work with the FAA to reach."
"Boeing's culture had changed. The message was: Don't rock the boat. Don't bring bad news. The commercial airplane division operated under extraordinary pressure to meet production schedules and deliver aircraft. In that environment, safety concerns became obstacles to be managed rather than problems to be solved."
Testimony of Ed Pierson, Former Boeing Senior Manager — House Transportation Committee hearing, October 2019Internal emails showed Boeing's strategy for avoiding simulator training requirements. In June 2017, two months before the first MAX delivery, a Boeing manager wrote to colleagues about discussions with Southwest Airlines: "We are going to push back very hard on [simulator training] at SWA. It will be very difficult to get back to zero after accumulating a requirement with any one customer."
The committee's final report, released September 16, 2020, concluded: "The MAX crashes were not the result of a singular failure, technical mistake, or mismanaged event. They were the horrific culmination of a series of faulty technical assumptions by Boeing's engineers, a lack of transparency on the part of Boeing's management, and grossly insufficient oversight by the FAA."
The congressional investigation documented systematic failures in FAA oversight during the MAX certification. Under the Organization Designation Authorization (ODA) program, Boeing employees acting as designated representatives performed approximately 95% of the certification work, with FAA engineers providing oversight. By the MAX certification period, a single FAA engineer with responsibility for multiple Boeing programs served as the primary point of contact for MAX flight controls certification.
FAA managers had pressured line engineers to defer to Boeing's analysis and maintain certification schedules. When FAA engineers raised concerns about Boeing's safety assessments, management directed them to accept Boeing's conclusions. In one documented case, an FAA engineer questioned Boeing's analysis of MCAS failure modes. Boeing argued that pilots would recognize and respond to MCAS malfunctions within three seconds — an assumption not based on simulator testing or human factors research. The FAA accepted Boeing's analysis.
The relationship between Boeing and the FAA had become what the House Committee called "too cozy." Email traffic showed Boeing employees communicating with FAA officials using informal language suggesting personal relationships that blurred professional boundaries. Boeing leveraged these relationships to push for certification decisions favorable to the company's schedule and cost objectives.
After the Ethiopian crash, international regulators lost confidence in the FAA's judgment. The European Union Aviation Safety Agency, Transport Canada, and other authorities announced they would conduct their own independent reviews of Boeing's design changes rather than accepting FAA certification. This represented a historic breakdown in the international mutual recognition system that had governed aviation safety for decades.
In January 2021, Boeing entered into a deferred prosecution agreement with the Department of Justice, admitting that Boeing employees had deceived the FAA's Aircraft Evaluation Group during the MAX certification process. The company accepted responsibility for conspiring to defraud the United States.
Under the agreement, Boeing paid $2.5 billion in total: a $243.6 million criminal monetary penalty, $1.77 billion in compensation to airline customers who had ordered MAX aircraft, and $500 million to establish a fund compensating the families of the 346 people killed in the crashes. The agreement allowed Boeing to avoid formal criminal conviction, which would have jeopardized the company's status as a federal contractor eligible for Department of Defense contracts worth billions annually.
Families of crash victims objected to the settlement, arguing the DOJ had violated their rights under the Crime Victims' Rights Act by not consulting them before reaching the agreement. In 2023, they petitioned Federal Judge Reed O'Connor to void the deferred prosecution agreement. The case remained pending as of 2024.
In October 2021, federal prosecutors charged Mark Forkner, Boeing's former chief technical pilot, with two counts of fraud involving aircraft parts in interstate commerce and four counts of wire fraud. The indictment alleged Forkner intentionally deceived the FAA about MCAS capabilities to minimize pilot training requirements. In March 2022, a jury in Fort Worth, Texas acquitted Forkner on all charges after approximately two hours of deliberation. Jurors later told reporters they believed Boeing's corporate structure and management decisions, not Forkner's individual actions, were responsible for the crashes.
No Boeing executives faced criminal charges. CEO Dennis Muilenburg was fired in December 2019 but departed with approximately $62 million in pension and stock benefits. He was subsequently prohibited from serving as an officer or director of a publicly traded company as part of an SEC settlement regarding his statements about the MAX after the Lion Air crash, but he faced no criminal liability.
The FAA published its final airworthiness directive for the 737 MAX in November 2020, requiring extensive design changes before the aircraft could return to service. The modifications included making MCAS receive input from both angle-of-attack sensors with comparison logic to detect disagreement, limiting MCAS to a single activation per triggering event, reducing MCAS's stabilizer trim authority, and implementing new flight crew alerting for angle-of-attack sensor disagreements.
Boeing also revised pilot training requirements. Airlines now had to provide computer-based training specifically covering MCAS operation and failures, and most operators elected to include simulator sessions demonstrating MCAS malfunctions — precisely the training Boeing had designed the original system to avoid.
FAA Administrator Stephen Dickson personally test-flew the modified MAX in September 2020 before signing the return-to-service approval. The aircraft resumed commercial operations in the United States in December 2020, nearly 21 months after the global grounding began. Other countries followed with their own approvals, though China — the first country to ground the MAX — did not approve its return until January 2023, almost four years after the Ethiopian crash.
The MAX has returned to service with hundreds of aircraft now operating worldwide, but questions about Boeing's safety culture persist. In January 2024, a door plug blew out of an Alaska Airlines 737 MAX 9 during flight, depressurizing the cabin. Investigation revealed that Boeing had delivered the aircraft without the four bolts required to secure the door plug — a quality control failure that raised new concerns about production oversight.
In October 2024, the Department of Justice announced that Boeing had breached the terms of its deferred prosecution agreement by failing to implement required compliance and ethics programs. This breach exposed Boeing to potential prosecution on the original conspiracy charge. As of 2025, that prosecution decision remained pending.
The 737 MAX crashes resulted from a system of interlocking failures: engineering decisions that prioritized cost and schedule over redundancy, a certification process compromised by conflicts of interest, regulatory oversight weakened by industry capture, and a corporate culture that suppressed dissent and treated safety concerns as obstacles to be managed.
MCAS itself was not inherently unsafe. Automated flight control systems are standard in modern aircraft. But MCAS as implemented — relying on a single sensor, capable of repeated activation, undisclosed to pilots, and lacking consideration of realistic failure modes — represented what accident investigators call a "latent failure": a design flaw waiting for the right combination of circumstances to produce catastrophe.
Those circumstances occurred twice within five months, killing 346 people. The crashes were preventable at multiple points: if Boeing had designed MCAS with redundant sensor inputs, if the company had disclosed the system to pilots and provided appropriate training, if the FAA had conducted independent verification of Boeing's safety analysis, if Boeing had grounded the fleet after Lion Air to investigate MCAS behavior rather than issuing an emergency procedures bulletin and continuing operations.
None of those decisions were made. The documentary record shows they were not made because Boeing's institutional incentives — delivering the MAX on schedule, avoiding training requirements that would reduce the aircraft's marketability, maintaining production rates that satisfied investors — conflicted with engineering conservatism and safety margins.
The 737 MAX case is now studied in engineering schools, business ethics courses, and regulatory policy seminars as an example of how organizational failure produces technological catastrophe. The aircraft has returned to service with modifications. The regulatory system has been reformed, though critics argue the reforms are inadequate. Boeing continues manufacturing aircraft.
The 346 people killed in the crashes — passengers who boarded flights expecting professional engineering, regulatory oversight, and corporate responsibility to keep them safe — remain the permanent evidence of what happens when those expectations are betrayed.