Boeing
Boeing 737 MAX MCAS Design Failures
Estimated impact: $20B+ in direct costs; 346 lives lost
Boeing's 737 MAX featured the MCAS (Maneuvering Characteristics Augmentation System) that relied on a single angle-of-attack sensor with no redundancy. To avoid costly pilot retraining that would reduce the MAX's competitive advantage against Airbus, Boeing minimized MCAS disclosure to airlines and the FAA. Two crashes — Lion Air 610 (October 2018) and Ethiopian Airlines 302 (March 2019) — killed 346 people. The MAX was grounded worldwide for 20 months.
Decision context
Whether to design the 737 MAX MCAS system with redundant sensors and comprehensive pilot training, accepting higher costs and longer delivery timelines, or minimize changes to preserve the "no new type rating required" selling point.
Decision anatomy
Red = risk factor present · Green = protective factor present
The analysis below was produced from the pre-decision document only — no hindsight. This is what the platform would have surfaced if it had been running in 2011-08-01.
“Boeing's 2011 board presentation on the 737 MAX program (reconstructed from House Committee report): Boeing evaluated two options — a clean-sheet narrow-body design (est. $15-20B, 7-10 year timeline) vs. re-engining the existing 737 airframe with new LEAP engines (est. $3B, 3-5 year timeline). The board approved the re-engine approach in August 2011, citing: "Airbus is already taking orders for the A320neo. We cannot afford to cede the narrow-body market for a decade." Internal engineering memo (2012): "The larger LEAP engines change the aircraft's handling characteristics, particularly at high angles of attack. We recommend augmentation through a new flight control law." The MCAS system was designed as a "minor flight control modification" — framing that enabled Boeing to classify it as not requiring new type certification.”
Source: House Committee on Transportation and Infrastructure report (2020), Chapter 4; Boeing internal emails and memos cited in DOJ deferred prosecution agreement; FAA ODA audit findings
Red flags detectable at decision time
- Choosing 3-5 year timeline over 7-10 year timeline primarily due to competitive pressure — time pressure overriding engineering completeness
- Framing a flight control system change as "minor modification" to avoid regulatory scrutiny — classic framing effect
- Engineering team's recommendation for augmentation acknowledged the handling change but was not paired with redundancy requirements
- Unanimous board consensus with no documented dissent — 20 participants yet no one flagged the safety tradeoff explicitly
- "No new type rating" as a selling point — anchoring customer value proposition to pilot training avoidance rather than safety
Cognitive biases the platform would have flagged
Hypothetical analysis
DI Platform would flag: CRITICAL "Blind Sprint" toxic combination — time pressure + groupthink + planning fallacy. The decision to re-engine rather than design new is defensible, but the DOWNSTREAM framing of MCAS as "minor" is where catastrophic risk accumulates. Red flag: classifying a system that can override pilot control authority as a "minor modification" is the framing effect at its most dangerous. Second red flag: zero documented dissent among 20 participants on a safety-critical aerospace decision — in any healthy engineering culture, this unanimity itself is a warning sign. The platform would generate an IMMEDIATE ESCALATION: "This decision involves safety-of-flight systems where failure modes include loss of life. The combination of time pressure, framing effects, and unanimous consensus requires independent safety review outside the program management chain." Recommendation: Require dual-sensor redundancy as a non-negotiable design constraint before program approval.
What was visible, and when
Every event below was documentable before the outcome was known. The platform looks for signals like these in live memos.
- 2011-08American Airlines signals it will order Airbus A320neo unless Boeing responds — forcing Boeing to commit to re-engined 737 (MAX) rather than clean-sheet design.House Committee report, Ch. 2
- 2012Engineers discover larger CFM LEAP engines require mounting forward/higher — creates nose-up pitch tendency under certain conditions. MCAS is designed as a software fix.House Committee report, Ch. 3
- 2013Boeing internal decision to rely on a single Angle-of-Attack sensor for MCAS inputs (rather than both) to avoid triggering a new simulator training requirement.DOJ Deferred Prosecution Agreement, January 2021
- 2016-11Chief Technical Pilot Mark Forkner asks FAA to remove MCAS from the 737 MAX Flight Crew Operations Manual — approved.FAA correspondence, cited in House Committee report
- 2017-03-08FAA grants amended type certificate for 737 MAX — without requiring new simulator training.FAA Type Certificate, 737-8
- 2018-10-29Lion Air Flight 610 crashes into Java Sea, killing 189.KNKT (Indonesia) final report
- 2019-03-10Ethiopian Airlines Flight 302 crashes after takeoff, killing 157. Fleet grounded globally within 72 hours.EAIB Interim Report; FAA emergency order
- 2020-11-18FAA approves return to service after 20-month grounding and MCAS redesign to use both AoA sensors.FAA Airworthiness Directive 2020-24-02
- 2021-01-07DOJ Deferred Prosecution Agreement — Boeing agrees to $2.5B penalty for conspiracy to defraud the FAA.DOJ press release, January 7 2021
Primary-source quotes
Stakeholders and positions
Who advocated, who dissented, who was overruled, and who stayed silent — the most reliable single signal of decision-process quality.
Biases present in the decision
★ Primary driver · Severity estimated from bias type and decision outcome
Toxic combinations
What a bias-adjusted process would have done
Require dual-sensor AoA redundancy for MCAS from inception; disclose MCAS in the Flight Crew Operations Manual and require differences training for 737 NG pilots; escalate Curtis Ewbank's concerns to independent safety review outside the 737 MAX program office; separate the Boeing Designated Engineering Representative (DER) function from program schedule pressure; ground the fleet after Lion Air 610 pending root-cause analysis rather than after Ethiopian 302.
This is the clearest "framing effect kills people" case in the modern dataset. Classifying a flight-critical automated system as a "minor modification" to avoid simulator training is the bias in its most concrete form. The single-sensor design was knowable, documentable, and dissent was actively present — it was overridden by schedule/cost framing.
Reference class base rates
Across all 135 curated case studies in our library:
Lessons learned
- Framing a safety-critical system as a "minor change" to avoid regulatory scrutiny is the most dangerous form of the framing effect — it literally kills people.
- When engineers raised concerns about single-sensor dependency, organizational pressure to meet schedule and cost targets overrode safety culture.
- The planning fallacy of "we can ship on time with this simpler design" created a cascade of compromises that accumulated into catastrophic system failure.
Where the facts come from
- 01House Committee on Transportation & Infrastructure, "The Design, Development & Certification of the Boeing 737 MAX"(2020)
- 02DOJ Deferred Prosecution Agreement (U.S. v. The Boeing Company)(2021)
- 03KNKT (Indonesia NTSC) Aircraft Accident Investigation Report PK-LQP(2019)
- 04EAIB Interim Investigation Report ET-AVJ(2019)
- 05Netflix documentary "Downfall: The Case Against Boeing"(2022)
Source: House Committee on Transportation and Infrastructure, "The Design, Development & Certification of the Boeing 737 MAX" (September 2020); NTSB accident reports (Lion Air 610, Ethiopian Airlines 302); DOJ deferred prosecution agreement (January 2021) (NTSB Report)
See what we'd flag in your next strategic memo.
Upload a strategic memo or board deck. Get the same hindsight-stripped analysis you just saw for Boeing, on your own high-stakes call, in under 60 seconds.
Or leave your email, we'll run a strategic memo of your choosing and send the readout within a business day.
Ready to audit your own memo right now? Create a free account →