On the evening of October 28, 2018, a Boeing 737 MAX 8 took off from Denpasar, Bali, bound for Jakarta, as Lion Air Flight 43. The airplane was two months old. Almost immediately, it started lying to its crew.
At rotation, the captain's control column began to shake. The stick shaker is the airplane's most primitive alarm: a violent vibration that means you are about to stall, the wing is about to stop flying. At the same time the captain's instruments showed IAS DISAGREE, the airspeed on his side no longer matching the airspeed on the other. And then, three times, the airplane did something nobody had commanded: it trimmed its own nose down, pushing toward the ground, all by itself.
The two pilots flying did not solve it. A third pilot did. Riding in the cockpit jumpseat that night was an off-duty captain, deadheading to Jakarta, who watched the stabilizer trim wheel spin on its own and recognized the pattern for what it most resembled: a runaway stabilizer, a known failure with a known, memorized response. He told the crew to move the two STAB TRIM switches to CUT OUT. They did. The uncommanded trimming stopped instantly. The crew flew the rest of the way to Jakarta trimming the airplane by hand, and landed safely, with every person on board alive.
Indonesia's KNKT investigation later established why the airplane had gone strange. The day before, engineers in Denpasar had replaced the left angle of attack sensor, the small vane on the outside of the nose that measures the angle at which the wing meets the air. The replacement sensor, a repaired unit, carried a 21 degree bias inside it. The installation test did not detect it. So the airplane's left side believed the nose was pointed far higher than it was, and a brand-new piece of Boeing software, reading that one sensor and no other, believed it too, and acted on the belief by pushing the nose down.
Here is the part that should be printed on a card and taped above every maintenance desk and every incident channel on Earth. The crew that survived that flight wrote up the malfunctions when they landed, but the write-up did not include the stick shaker, and it did not include the fact that they had cut out the stabilizer trim. Read the KNKT report and you can watch the information die in the handoff: the Jakarta engineers, working from an incomplete log entry, flushed an air data module and cleaned an electrical connector, reasonable work aimed at the problems they had been told about. Then they released the airplane.
The next morning, October 29, 2018, the same airplane departed Jakarta as Lion Air Flight 610. This time there was no third pilot.
The decision
To understand what happened next you have to understand the bet Boeing made years earlier, because MCAS was not a mistake in the sense of a typo. It was a solution to a business problem, and by the standards of the business problem, it worked beautifully right up until it killed people.
The 737 airframe dates to the 1960s. When Airbus announced a re-engined version of its competing A320 with dramatically better fuel burn, Boeing faced a choice: design a new airplane, which takes a decade, or hang bigger engines on the old one, again. It chose the engines. The new LEAP-1B engines were larger than the ones before, and to fit them under a wing that sits low to the ground, they were mounted higher and farther forward on the wing. In that position, at high angles of attack, the engine nacelles themselves generate lift, ahead of the wing, and the airplane develops a tendency to pitch up.
A pitch-up tendency at high angle of attack is a handling quality problem, and handling qualities are certification territory. Boeing's commercial promise, the whole economic point of the MAX, was that it would fly like the previous 737, the NG, so that airlines could treat it as the same airplane: same type rating, same pilot pool, minimal retraining. Boeing's contract with its launch customer, Southwest Airlines, put a number on that promise: if the FAA required simulator training for transitioning pilots, Boeing would discount each delivered airplane by at least one million dollars. Multiply by the order book and you get a nine-figure incentive to solve an aerodynamics problem without ever letting it become a training problem.
So the pitch-up was solved in software. The Maneuvering Characteristics Augmentation System would watch the angle of attack and, when it got high, automatically trim the stabilizer to push the nose down, making the MAX handle like the NG at exactly the corner of the envelope where it otherwise would not. The pilot would feel nothing unusual. That was the design goal: the pilot would feel nothing at all.
As first drawn, MCAS was a small system for a narrow corner: high speed, high angle of attack, commanding at most 0.6 degrees of stabilizer movement. Then, in 2016, flight testing showed the handling problem also existed at lower speeds, and MCAS grew. Its authority rose to 2.5 degrees per activation. It could fire, reset, and fire again. Its operating envelope widened. And through all of that growth, one property never changed: it listened to a single angle of attack sensor. The airplane carries two. On any given flight, MCAS took the word of one of them, alternately assigned, with no vote, no comparison, no cross-check. A sensor is a mechanical vane on the outside of a jet. Vanes get bent, get miscalibrated, get struck by birds. This is not exotic knowledge; it is why airplanes carry two.
The House Transportation Committee's final report, published in September 2020 after an eighteen-month investigation, documents what happened to the safety analysis while the system quadrupled in power: Boeing, in the committee's words, failed to reevaluate the redesigned system or perform the failure analyses the growth demanded. The analysis that did exist rested on an assumption about the humans: that pilots confronted with uncommanded nose-down trim would recognize it and respond within about four seconds. MCAS was not classified as safety-critical, a classification that would have brought heavier scrutiny. And the certification itself ran substantially through delegation, with Boeing employees performing FAA functions under the Organization Designation Authorization program. The committee's verdict on the oversight was blunt: grossly insufficient.
Then there is the manual. Hours after the expanded MCAS was approved, Boeing asked the FAA to remove references to MCAS from the Flight Crew Operations Manual, and the FAA agreed. The officials who approved the removal, the committee found, did not yet know the system had been redesigned. So the finished product shipped with this configuration: a system powerful enough to fly the airplane into the ground in increments, driven by one sensor, absent from the documentation, absent from training, and designed, on purpose, to be invisible when it worked.
One more component deserves its own sentence, because it is the purest distillation of the whole affair. The 737 MAX was designed with an AOA DISAGREE alert, a cockpit message that tells the crew the two angle of attack sensors are contradicting each other. On most delivered airplanes, it did not work. Through a software dependency Boeing had not intended, the alert only functioned on airplanes whose airlines had purchased an optional extra display feature. Boeing discovered this in 2017. The alert was left broken, and airlines were not told, until after the first crash. The one instrument that could have told two flight crews, in plain language, your sensor is lying to you, was an unbundled option, and the bundle had not been purchased.
The two flights
Lion Air 610 first, stated plainly, because 189 people deserve plain statement before analysis.
The flight data recorder showed the left and right angle of attack readings differing by about 20 degrees from takeoff, the fingerprint of the miscalibrated sensor installed the day before. The captain's stick shaker activated at rotation and shook for nearly the entire flight, a false stall warning screaming through every other problem. Once the flaps came up, MCAS, reading the bad sensor, began trimming nose-down in ten-second pushes. The captain countered each push with his own trim switches, more than twenty exchanges, a man arm-wrestling software that did not tire and did not explain itself. He handed control to the first officer and took over the radios and the checklists, hunting for a procedure for a system he did not know existed. The crew reported a flight control problem and asked air traffic control to confirm what altitude and speed the radar showed, because they could no longer trust what their own instruments said. About twelve minutes after takeoff, the airplane went into the Java Sea at high speed. All 189 people on board were killed.
Five months later, Ethiopian Airlines Flight 302 departed Addis Ababa for Nairobi on March 10, 2019. By then the world knew about MCAS. Boeing and the FAA had issued guidance after Lion Air pointing crews to the runaway stabilizer procedure. The Ethiopian crew had it, and used it, and it was not enough.
Seconds after liftoff, the left angle of attack value swung to 74.5 degrees. The right sensor read 15.3. A 59 degree disagreement between two instruments measuring the same air, and the disagree alert, still, did not appear. The stick shaker fired. MCAS fired. The crew countered with electric trim, then did exactly what the post-Lion Air guidance told them to do: they put the stabilizer trim switches to CUT OUT, and the recorder shows a subsequent MCAS command producing no stabilizer movement at all, the cutout working precisely as designed. What defeated them was physics and sequence. The throttles had stayed at takeoff power, the airplane was accelerating through speeds where the air loads on the mis-trimmed stabilizer became enormous, and at those loads the manual trim wheel could not move the stabilizer back. The crew restored electric trim to regain the ability to move it, and five seconds later MCAS, still reading one broken sensor, fired a fourth time and drove the stabilizer down again. Six minutes after takeoff, the airplane struck the ground southeast of Addis Ababa. All 157 people on board were killed.
Between them, the two crews were handed four failures, any one of which was survivable and all four of which together were not: a sensor that could lie, a system that believed it absolutely, a manual that concealed the system, and an alert that could have exposed the lie, sold as an option and broken in the fleet. The jumpseat captain over Bali is the control experiment that proves the crews were not the variable. Same airplane, same fault, same night air: the difference between landing in Jakarta and the Java Sea was one person who happened to be in the cockpit, happened to recognize the pattern, and happened to know about two switches. A safety case that depends on a knowledgeable passenger is not a safety case. It is a coincidence with good seats.
The reckoning, and the fix
Three days after ET302, on March 13, 2019, the 737 MAX was grounded worldwide, the FAA last among the major regulators. It stayed grounded for about twenty months, the longest grounding of a U.S. aircraft type in history. The FAA's own risk assessment after Lion Air, conducted while the fleet was still flying, had estimated that if MCAS went unfixed it could cause as many as fifteen more crashes over the life of the fleet. In January 2021, Boeing entered a deferred prosecution agreement with the Department of Justice on a charge of conspiracy to defraud the United States, specifically the FAA's Aircraft Evaluation Group, the office responsible for pilot training requirements. The agreement totaled more than $2.5 billion: $243.6 million as a criminal penalty, $1.77 billion in compensation to airline customers, and $500 million for a fund for the families of the 346 people killed. The department's statement said Boeing employees had chosen, in its words, the path of profit over candor.
The airplane that returned to service on November 18, 2020 was required to be a different machine in the specific ways that matter:
- MCAS now reads both angle of attack sensors and compares them continuously. If the two disagree by more than 5.5 degrees, the system disables itself for the remainder of the flight and tells the crew it has done so. One sensor can no longer vote alone.
- MCAS can activate only once per high angle of attack event. The repeated, ratcheting nose-down commands that consumed both crews are designed out.
- Its authority is limited so that pilots can always overpower it with the control column alone. The human is stronger than the software, permanently, as a certification requirement rather than a hope.
- The AOA DISAGREE alert is standard equipment on every airplane. Not an option. Not a bundle.
- The flight manual documents the system, the procedures were revised, and MAX pilots now complete simulator training that includes MCAS and the runaway stabilizer scenario their predecessors were never shown.
- Each stored airplane required a sensor system test and an operational readiness flight before carrying passengers again.
Read that list slowly and notice what it is: it is the original design review, conducted after the fact, at retail price. Every item on it was available in 2016 for the cost of engineering time and an awkward conversation about training requirements.
The lesson
Our studio builds software with crews of automated workers, so we read this record the way you read a report about your own house. The lessons are not aviation lessons. They are systems lessons, and they transfer without translation.
First: a single sensor with authority is a single point of failure wearing a uniform. Redundancy is not having two of something. Redundancy is the comparison between the two, wired to a consequence. The MAX had two vanes on the nose the whole time. What it lacked was anyone, human or software, whose job was to notice when they disagreed and to care. In our own systems we have a version of this rule: no result counts until it is verified at the destination by something other than the thing that produced it. One claim, one independent check, or it did not happen.
Second: automation that hides itself deletes the operator's last move. Every safety argument for MCAS quietly assumed a pilot who would diagnose, in seconds, a system whose existence had been deliberately kept from him, behaving in a way that resembled a different, older failure. Concealment is not a neutral documentation choice. It is a load-bearing assumption, and it failed under load. If your system can take consequential action, the operator's mental model of it is part of the control loop. A wrong model is a broken component, as surely as a bent vane.
Third: delegated certification is a trust boundary, and trust boundaries do not care what industry they are in. The FAA delegated, Boeing attested, and the attestation pipeline worked exactly like any API that accepts a client's word for its own compliance: it returned success for everything submitted to it, including a hazard analysis for a system that no longer existed in its analyzed form. Verification that is performed by the party being verified is not verification. It is a signature collection exercise, and the signatures were impeccable.
And the last one, the one from the jumpseat. The information that saved Flight 43 existed, in full, twelve hours before Flight 610, inside the same airline, attached to the same tail number. It died in a logbook omission, a sentence nobody wrote down. Systems rarely fail because nobody knew. They fail because the person who knew could not get the knowledge across a boundary: a shift change, a form with the wrong fields, a report that left out the embarrassing part. Write the whole observation down. Especially the embarrassing part. Especially the part where you reached for the cutout switches.
Sources, for the record: U.S. House Committee on Transportation and Infrastructure, The Boeing 737 MAX Aircraft: Costs, Consequences, and Lessons from Its Design, Development, and Certification, Final Committee Report (September 2020), on the single-sensor design, the 0.6 to 2.5 degree growth, the four-second pilot response assumption, the FCOM removal, the Southwest training clause, and the delegation findings. KNKT, Aircraft Accident Investigation Report, Lion Air Flight 610 (October 2019), on the sensor replacement, the 21 degree bias, Flight 43 and the jumpseat intervention, the maintenance log omission, and the accident sequence. Ethiopian Civil Aviation Authority, Final Report on Ethiopian Airlines Flight 302 (December 2022), on the 74.5 degree AOA excursion, the cutout sequence, and the final MCAS activation. FAA, Summary of the FAA's Review of the Boeing 737 MAX (November 18, 2020), on the return-to-service design changes. U.S. Department of Justice, deferred prosecution agreement with The Boeing Company (January 7, 2021), on the fraud charge and the payment figures.
346 people are dead because one sensor was allowed to outvote everyone: the second sensor, the pilots, the manual, and eventually the regulator. The fix, when it finally came, was almost insultingly simple. Ask the second sensor. Tell the pilots. Let the human win. Engineering is full of problems that are actually hard; this was never one of them, and the record shows it, line by line, in the investigators' own words. The hard part was never the engineering. The hard part was a building full of smart people deciding, one reasonable meeting at a time, that none of it needed to be said out loud.