Boeing 737 MAX MCAS crashes

A single sensor could push the nose down. The pilots were never told the system existed.

Tightly coupled systems where one small fault cascades and takes down the whole machine.

Room: Q3 Engineered
Year: 2018
Impact: 346 lives
Sector: Aviation
Region: Global
Category: Technological

Why this room

The MAX belongs in q3 because a system with authority over the aircraft's pitch trim was allowed to act on the input of a single angle-of-attack sensor with no cross-check and no redundancy, so the failure of one external vane propagated directly into repeated uncommanded nose-down commands. The designed mitigation for that failure was the flight crew, but the crew was not told the system existed and the AOA Disagree alert that would have signalled the sensor fault was inoperable on most of the delivered fleet, which removed the last decoupling layer between a small component fault and hull loss. Boeing also declined to classify MCAS as safety-critical, so the coupling was never subjected to the scrutiny that classification would have triggered: a small fault, a tightly coupled control path, and a severed human backstop.

The record

346 people were killed in the two crashes: Lion Air Flight 610 (29 October 2018, 189 dead) and Ethiopian Airlines Flight 302 (10 March 2019, 157 dead).certain
Boeing permitted MCAS to activate on input from a single angle-of-attack sensor and expected pilots, who were largely unaware the system existed, to mitigate any malfunction; it also failed to classify MCAS as a safety-critical system.certain
In 2015 a Boeing Authorized Representative raised the question of whether MCAS was 'vulnerable to single AOA sensor failure'; Boeing nonetheless allowed MCAS to operate off a single AOA sensor.certain
Boeing internal test data from 2012 showed a Boeing test pilot took more than 10 seconds to diagnose and respond to uncommanded MCAS activation in a simulator, a condition the pilot judged 'catastrophic'; Boeing concealed this from the FAA and its customers.certain
Boeing entered a deferred prosecution agreement with the DOJ in January 2021 to pay over USD 2.5 billion, having conspired to defraud the FAA in connection with the certification evaluation of MCAS; the criminal penalty component was USD 243.6 million.high

Sources

The book

This entry is one of 111 in the register. The full story, and what it cost the people who lived it, is in Risky Business by Claudia Zeisberger, David Munro and Joanna Reijgersberg-Siew.

Join the waiting list