LENS Learning Engineering for Next-Generation Systems
Case Studies
Part 3 · Aviation & Aerospace · What failed

Boeing 737 MAX / MCAS

2018 – 2019 aviation

Impact. 346 killed across two crashes — Lion Air 610 and Ethiopian Airlines 302; 20-month worldwide grounding; ~$20B direct cost; FAA delegated-authority reform under the Aircraft Certification, Safety, and Accountability Act (2020)

Ask AI about this case Opens a new chat prefilled with this case — explore it in your own context.

The 737 MAX is Therac-25 written at the scale of an airline fleet. To sell the jet without costly new pilot training, Boeing masked its changed handling with software — MCAS — then left it out of the manuals and let it fire on a single failing sensor. When that sensor failed, crews who had never heard of the system could not recover, and 346 people died. Five investigations converged on the mechanism, and the House Transportation Committee’s went to the motive: the training omission wasn’t an oversight but a cost-driven commercial choice — human capability removed to avoid the cost of sustaining it, waved through by a certification regime too close to Boeing to catch it.

In brief

The Boeing 737 MAX was a re-engined 737 meant to fly without new pilot training — the commercial promise that sold it against the Airbus A320neo. Its bigger, forward-mounted engines changed the jet's pitch behavior, so Boeing added software (MCAS) to mask the difference, then kept it out of the manuals and training and let it fire repeatedly on a single angle-of-attack sensor. When that sensor failed on Lion Air 610 (October 2018) and Ethiopian 302 (March 2019), MCAS forced the nose down and crews who had never heard of it could not recover; 346 people died and the fleet was grounded for twenty months. Five major investigations — the NTSB-supported KNKT (Lion Air) and EAIB (Ethiopian) reports, the US House Transportation Committee final report, the DOT Inspector General review, and the multinational Joint Authorities Technical Review (JATR) — converged on the same mechanism: an MCAS that could fire the nose down on a single failing sensor, waved through an FAA delegated-authority regime in which Boeing reviewed much of its own safety judgment. The House Transportation Committee's report went further, documenting the training omission as a cost-driven commercial choice — Boeing had promised Southwest a $1-million-per-plane rebate if simulator training proved necessary. The MAX is the book's inverse case: human capability engineered out of a system to save the price of sustaining it, with the elision underwritten by a certification process that did not have the independence to catch it.

The case in five beats

  1. Re-engined 737 sold on no new pilot training; MCAS hid the handling change
  2. Single-sensor MCAS forced two jets down, killing 346 across both crashes
  3. Internal records show training omission was deliberate; certification was largely delegated to Boeing itself
  4. Training absence was a contract deliverable, not an oversight; pilots engineered out
  5. Twenty-month grounding; MCAS redesigned, simulator training required, FAA oversight tightened
The Learning Engineering Lens

LE insight

The 737 MAX is the documentary record of a design choice to remove human capability to avoid the regulatory and commercial cost of sustaining it. The pilots were not undertrained by accident — they were undertrained as a requirement. The omission of training was a contract deliverable. Once that is understood, the accident becomes legible as an engineering decision rather than a training failure.

LENS approach

The 737 MAX is the canonical engineered-out-capability failure (induced 1.1; LENS D1+D3/PT4). LENS uses it in Domain 1 (Systems Analysis) for the CLO-1 work of decomposing system performance requirements into measurable human-capability requirements: the elided pilot-training requirement is the traceable artifact a capability-requirements analysis would have surfaced before the omission could become a contract deliverable. LENS uses it in Domain 5 (Navigating Sociotechnical Constraints; CLO-5) for the delegated-authority regulatory regime in which Boeing reviewed its own most consequential safety judgments — the case is the governance counterpart to Therac-25 (Case 1) at the safeguard-removed-with-nothing-in-its-place layer, and pairs with Patriot/Dhahran (Case 129) at the layer of design assumptions that do not travel with a change of context.

The LENS competency this case exercises
  1. 1 Systems Analysis
  2. 2 Iterative Development
  3. 3 Human-System Collaboration
  4. 4 Test & Evaluation
  5. 5 Sociotechnical Constraints

Problem type · PT4

Problem type
D1+D5/PT4
Induced
1.1
CLO
1, 5