Boeing 737 MAX 2019: Safety as a Competitive Casualty

Situation

It is March 10, 2019. Ethiopian Airlines Flight 302, a 737 MAX 8, has crashed six minutes after takeoff from Addis Ababa, killing all 157 people aboard. The flight data profile is nearly identical to Lion Air Flight 610 — which crashed October 29, 2018, killing 189 people in Indonesia.

In both crashes, sensors feeding erroneous data to the MCAS (Maneuvering Characteristics Augmentation System) had caused the automated system to repeatedly push the nose of the aircraft down. The crews followed Boeing-approved procedures but could not overcome MCAS. In the five months between the two crashes, Boeing issued a service bulletin about MCAS but did not disclose its full operational authority, and argued that grounding the MAX was unnecessary.

Within hours of the Ethiopian crash, China grounds its 737 MAX fleet. The FAA — after days of pressure — grounds the aircraft March 13. The global fleet of 387 MAX aircraft is taken out of service.

The 737 MAX had been Boeing's most important product in decades: 4,600 aircraft on order, representing $600 billion in potential revenue. American Airlines, Southwest, and United had structured growth plans around the aircraft. Southwest alone had 34 MAXs in service.

The decision moment

You are a member of Boeing's board of directors. It is March 14, 2019 — one day after the FAA grounding, four months before the board will fire CEO Dennis Muilenburg. You are preparing for an emergency board session.

The following facts have emerged in 72 hours:

1. MCAS was designed to activate based on data from a single angle-of-attack (AoA) sensor — with no cross-check against the second sensor.
2. MCAS's full authority was disclosed to the FAA via the aircraft's safety analysis, but the disclosures were not complete: Boeing initially assessed MCAS's maximum deflection as 0.6 degrees; by the time of certification, it had been expanded to 2.5 degrees — a change that significantly increased the hazard without a corresponding hazard analysis update.
3. Pilots were not trained on MCAS via simulator — a deliberate choice to maintain the MAX's "type rating" equivalence with earlier 737 variants. Type rating equivalence allowed airlines to transition pilots without new simulator certification, saving approximately $1 million per pilot. American Airlines alone valued this at $1 million per pilot over the 737 MAX fleet.
4. An internal Boeing employee had written in 2017: "This airplane is designed by clowns, who are in turn supervised by monkeys."
5. The FAA's certification relied significantly on Boeing's own Organization Designation Authorization (ODA) — Boeing engineers effectively approving their own safety analyses.

Three questions face the board:

1. The competitive context as root cause. The 737 MAX program was accelerated in response to Airbus's A320neo announcement in December 2010. The neo's LEAP engines gave Airbus a fuel efficiency advantage. Boeing's response — mounting LEAP engines on the existing 737 airframe rather than designing a new aircraft — created the center-of-gravity problem that required MCAS. If Boeing had designed a new aircraft (NSA — New Small Airplane), there would have been no MCAS. Is the competitive pressure to avoid a clean-sheet design a legitimate engineering constraint, or was it a management choice that subordinated safety to competitive speed?

2. The type rating decision. Boeing marketed the MAX to airlines with the promise of no new simulator training. This was worth hundreds of millions of dollars in transition costs to major customers. But maintaining type rating equivalence meant MCAS had to be an "invisible" system — one that pilots were not trained on. When a system's commercial value depends on pilots not knowing it exists, how should that fact affect the regulatory approval process?

3. The governance architecture. Boeing's safety review processes had become less rigorous over time. The ODA delegated certification authority back to Boeing. The board received limited detail on specific technical safety trade-offs. The CEO was a finance professional, not an engineer. What governance changes — at the board, management, and regulatory levels — would have created a different outcome?

Key financial datapoints

The MCAS failure mechanics

The MCAS failure illustrates how incremental engineering decisions, each locally rational, can combine into a systemic catastrophe:

1. Original problem: New LEAP engines, mounted higher and further forward on the MAX to maintain ground clearance, shifted the center of gravity and changed the aircraft's pitch characteristics — particularly at high angle-of-attack.

2. MCAS solution: Automatically push the nose down when the single AoA sensor exceeded a threshold, to match the handling characteristics of earlier 737 variants. This would preserve the type rating equivalence Boeing had promised airlines.

3. Scope expansion: The originally certified MCAS had limited authority (0.6 degrees horizontal stabilizer). During testing, engineers expanded MCAS authority to 2.5 degrees (more than 4× original) without a corresponding formal hazard analysis update. The FAA safety documentation described the more limited version.

4. Single-sensor design: MCAS relied on data from one AoA sensor only. If that sensor malfunctioned (as it did on both accident flights), MCAS would activate based on false data and push the nose down repeatedly — once every few seconds, for as long as the faulty sensor input persisted.

5. Undisclosed to pilots: Because MCAS was intended to be invisible to pilots, it was not in the flight manual. When crews encountered MCAS activation on erroneous data, they did not have a procedure for it. The runaway stabilizer procedure existed but did not account for repeated MCAS activations.

Frameworks invoked

• Stakeholder Theory. Boeing had competing stakeholder obligations: shareholders (maintain program economics), airline customers (avoid training costs), regulators (obtain certification), and passengers/crews (provide a safe aircraft). When financial stakeholder interests were prioritized over passenger safety, the result was 346 deaths. A genuine stakeholder analysis would have identified passengers as the ultimate end-user whose interests could not be traded away.
• Safety Culture Degradation. Boeing's 1997 merger with McDonnell Douglas brought a financial engineering culture into conflict with Boeing's historically engineering-first identity. Multiple internal studies documented the culture change. "Safety culture" is not a slogan — it is the set of incentives, reporting mechanisms, and authority relationships that determine whether safety concerns can rise above commercial pressure.
• Regulatory Capture and Self-Certification. The FAA's ODA program — delegating certification authority to Boeing's own engineers — made economic sense given the technical complexity of modern aircraft. But when the certifying engineers work for the manufacturer and face the same commercial pressures, the independence of the certification is compromised by design. The MAX crashes were partly a failure of the ODA model.
• Competitive Response Strategy. Boeing's decision to accelerate the MAX rather than design a clean-sheet aircraft was a competitive response to Airbus's A320neo. That choice created the engineering constraints (engine placement, CG shift, MCAS requirement) that led to the crashes. Understanding competitive strategy requires understanding its downstream technical and safety implications.

Discussion questions

1. Boeing engineers documented MCAS's expanded authority in internal systems but the FAA safety documentation reflected the original, more limited version. The internal communications suggest this discrepancy was known. Is this an engineering documentation failure, an intentional misrepresentation, or something in between — and how does your answer affect Boeing's culpability?
2. Southwest Airlines valued the type rating equivalence at approximately $1 million per pilot. American and United placed similar values on it. To what extent are airlines responsible for the MCAS disaster — given that the commercial value of "no simulator training" created the incentive to keep MCAS invisible to pilots?
3. Boeing's ODA allowed its own engineers to certify the MAX's safety. The FAA reviewed Boeing's submissions but did not independently verify all technical analyses. After the crashes, the FAA hired independent technical experts and found additional problems Boeing had not flagged. What is the appropriate regulatory model for certifying complex systems when the regulator cannot independently replicate the manufacturer's technical analysis?
4. The 737 MAX grounding lasted 20 months. During that time, Boeing continued to produce MAX aircraft — accumulating a backlog of 450+ undelivered planes. What does the decision to continue production during a grounding tell you about Boeing's institutional confidence in the eventual recertification — and was that confidence justified?
5. Dennis Muilenburg testified before the Senate Commerce Committee in October 2019, saying he was "proud" of Boeing's safety record and that Boeing had "followed the rules." Five months later, internal communications were released in which Boeing engineers called the MAX "designed by clowns" and mocked regulators. How should CEOs balance legal defensibility against moral accountability when testifying before Congress in the aftermath of a corporate safety failure?

The real outcome (revealed at session end)

November 18, 2020: FAA recertifies the 737 MAX after Boeing redesigns MCAS to use two AoA sensors, adds a disagreement light, and requires simulator training for all pilots.

January 2021: Boeing agrees to pay $2.5 billion to resolve DOJ criminal charges — including a $243.6 million criminal fine and $1.77 billion in airline compensation. The deal includes a deferred prosecution agreement (no guilty plea from Boeing the corporation).

2021: Boeing delivers a $500M+ settlement to families of the 346 victims.

2024: DOJ determines Boeing violated the 2021 deferred prosecution agreement (concealing technical information). Reopens criminal investigation; Boeing agrees to plead guilty to one count of conspiracy to defraud the United States.

The lesson: Competitive pressure is not an engineering constraint — it is a management choice. When commercial decisions determine whether safety systems are disclosed to pilots, whether sensor redundancy is built in, and whether regulators receive complete technical documentation, the organization has made a trade between safety and revenue. Boeing made that trade. 346 people paid for it.

Sources

• US House Committee on Transportation and Infrastructure, "The Boeing 737 MAX Aircraft: Costs, Consequences, and Lessons from its Design, Development, and Certification" (September 2020).
• DOJ Press Release: Boeing enters deferred prosecution agreement for conspiracy to defraud the FAA (January 2021).
• Joint Authorities Technical Review (JATR), "Observations, Findings, and Recommendations" (October 2019).
• FAA AD 2019-06-08, Emergency Airworthiness Directive grounding the 737 MAX (March 2019).
• Final Reports: Indonesian KNKT (Lion Air JT610) and Ethiopian Civil Aviation Authority (ET302).
• Peter Robison, "Flying Blind: The 737 MAX Tragedy and the Fall of Boeing" (2021).