Boeing set aside 737 MAX concerns that later mattered

Concerns about the flight-control software on the Boeing 737 MAX were raised inside the company. The US House committee later found they were inadequately addressed or dismissed. Two crashes followed, and 346 people died.

The final committee report, from the House Committee on Transportation and Infrastructure, is the record. Lion Air flight 610 crashed on 29 October 2018 and killed all 189 people on board. Less than five months later, on 10 March 2019, Ethiopian Airlines flight 302 crashed six minutes after takeoff and killed all 157 on board. The committee's account of the missed chances names flawed technical criteria, faulty assumptions about pilot response, and production pressure.

MCAS, the Maneuvering Characteristics Augmentation System, was built to push the nose down in certain conditions. The committee found Boeing let it activate on a single angle-of-attack sensor, expected pilots who were largely unaware it existed to cope with a malfunction, and failed to classify it as a safety-critical system.

People inside Boeing had already named pieces of this. In 2015 an authorised representative, an employee allowed to validate designs for the Federal Aviation Administration, asked whether MCAS was "vulnerable to single AOA sensor failures." The aircraft was delivered dependent on one sensor. The report says one engineer raised that single-sensor concern, another raised the lack of a synthetic airspeed system, and further concerns covered faulty sensor data and repeated activation. The committee concluded that all of those concerns were inadequately addressed or dismissed.

A June 2016 test flight made the behaviour visible. MCAS countered the pilot's attempts to trim, and an authorised representative raised the faulty-sensor risk. Colleagues discounted the concerns, the test pilots in particular. Faulty sensor data that set off an uncommanded activation was a significant contributing factor in both crashes. After the flight another engineer asked if repeated activation was a safety issue. A colleague answered, in the words the report records, "I don't think this is safety, other then (sic) the pilot could fight the MCAS input and over time find themselves in a large mistrim." On both accident flights the pilots struggled with repeated activations that forced a nose-down attitude they did not recover from.

The same facts missed the person who signed a stronger version. Michael Teal, former chief project engineer, told the committee that when he approved the March 2016 redesign he did not know MCAS used a single sensor, that it could activate repeatedly, or that a Boeing test pilot had taken more than 10 seconds to react in a simulator and called the condition catastrophic. Federal guidelines assume a response within four seconds. Boeing withheld that result from the FAA and from airline customers.

After the crashes Boeing moved toward several of the points that had been set aside: two sensors feeding MCAS, no repeated activation, and, in January 2020, simulator training. The report says the training cut against a premier aim of the programme, which was to avoid it, and that answers to the safety issues had consistently come too late.

1. Keep the question, the answer, and the name of the person who can change the design in one note. The June 2016 reply is an answer. Someone other than the schedule owner has to be able to reopen it. The report sets that reply beside the failure mode of both crashes.

2. Put the dissenting question and the awkward test on the approval page. Teal signed more authority for MCAS without the single-sensor fact, the repeat-activation fact, or the simulator run. A pack that can be signed in that state has already lost the concern on the way up. Require those lines when a date is pressing.

3. Treat the later redesign as evidence the earlier concern was real. Two sensors, an end to repeated activation, and simulator training arrived after 346 people had died. The open moment in the report is the 2015 question and the June 2016 email.

A psychological safety session can be where an intact team walks one live concern from the person who saw it to the person who can change the work, and writes down what happens if the answer is to set it aside.