Boeing 737 MAX: How 346 Deaths and a Grounded Fleet Remade Aircraft Certification

The Boeing 737 MAX 8 operated as Lion Air Flight JT610 departed Jakarta’s Soekarno-Hatta International Airport at 06:20 local time on October 29, 2018, with 181 passengers and 8 crew members on board. Twelve minutes later, it struck the Java Sea at high speed. There were no survivors. The Indonesian accident investigation authority, KNKT, found evidence of a flight control system that had repeatedly pushed the nose down, fighting a crew that had fought back and lost. Five months and twelve days later, on March 10, 2019, Ethiopian Airlines Flight ET302 departed Addis Ababa with 149 passengers and 8 crew. It crashed six minutes after takeoff. Again there were no survivors. Again the evidence showed the same nose-down input, the same crew response, the same outcome. The two accidents killed 346 people in circumstances so similar that, in the 146 days between them, it had not been enough to ground the aircraft.

The Boeing 737 MAX was grounded globally on March 13, 2019, three days after ET302. The FAA was the last major aviation regulator to act: Ethiopia, China, and the European Union had all grounded the type in the preceding 72 hours. The grounding lasted 20 months, the longest for any US aircraft type in history. What followed was not only an investigation into why two aircraft had crashed, but into how a safety-critical flight control system had been designed, approved, and put into service without pilots being told it existed.

The Boeing 737 MAX crisis is unique in this series. Most of the events covered here were accidents that revealed unknown or underestimated hazards, gaps that no one had yet found a way to close. The 737 MAX crashes revealed something different: a system whose known risks had been assessed incorrectly, whose failure modes had been disclosed incompletely to the regulator, and whose existence had been deliberately kept out of pilot training materials. The investigations that followed produced changes to how commercial aircraft are certified, who has authority over that process, and how international aviation regulators relate to one another. Some of those changes are still being worked out.

How MCAS was designed, kept from pilots, and what failed on both flights

The 737 MAX was Boeing’s response to Airbus’s announcement of the A320neo, a re-engined version of the A320 that offered significant fuel savings and which airlines were ordering in large numbers. Boeing’s answer was to re-engine the 737, fitting it with CFM LEAP-1B turbofans significantly larger and more fuel-efficient than the CFM56s on previous 737 variants. To fit these larger engines under the 737’s low-slung wing, Boeing mounted them further forward and higher than the CFM56s. This changed the aircraft’s aerodynamic characteristics: at high angles of attack, the new engine position created a nose-up pitching tendency that was different from the original 737 design. To preserve the 737’s handling certification, which would allow pilots to transition to the MAX without full simulator training, Boeing developed the Maneuvering Characteristics Augmentation System, or MCAS: a flight control software function that, when it detected a high angle of attack, would automatically apply nose-down stabilizer trim.

MCAS had one critical design flaw: it read from a single angle-of-attack sensor. The 737 MAX has two AoA sensors, one on each side of the forward fuselage. MCAS used only one. If that sensor produced erroneous data — as it did on both fatal flights, due to a damaged sensor vane on Lion Air JT610 and a faulty sensor on ET302 — MCAS would activate based on false information, repeatedly applying nose-down trim until the stabilizer reached its limit. The crew could defeat MCAS using the electric trim cutout switches, interrupting its authority. But MCAS was designed to reactivate after the crew used the electric trim to recover, so it would continue fighting any attempt at correction. On both flights, the crew encountered repetitive nose-down inputs, fought to raise the nose, and ultimately could not overcome the system. The US House Transportation Committee’s investigation, published in September 2020, described MCAS’s single-sensor design as a fundamental flaw: “a single point of failure in a safety-critical system,” one that Boeing’s own safety analysis had rated as less dangerous than it actually was.

The more significant finding of the House investigation was not the technical flaw but how MCAS had been certified. The FAA operates the Organization Designation Authorization program, under which it delegates portions of the certification process to engineers employed by the manufacturer. This delegation is intended to make efficient use of the industry’s technical expertise. In the case of the 737 MAX, the delegation extended to MCAS’s safety analysis, and the engineers conducting that analysis worked for Boeing. The House investigation found that Boeing’s safety analysis had understated the hazard severity of a single AoA sensor failure, had not correctly analyzed MCAS’s maximum possible authority, and that these findings had been accepted by the FAA without independent verification. Internal Boeing communications disclosed during the investigation showed employees who were aware of problems but felt pressure not to escalate them. The agreement between Boeing and the FAA that pilots could transition to the MAX with computer-based training rather than full simulator training, because disclosing MCAS would require simulator training and risk the aircraft’s competitiveness, was documented in internal records. The House committee found the agreement reflected a systematic failure of oversight, not an isolated error.

The MCAS redesign and certification reforms that came from the crashes

The FAA’s return-to-service requirements, formalized in an Airworthiness Directive on November 18, 2020, specified the technical changes Boeing was required to make before the MAX could fly again. MCAS was fundamentally redesigned. The system now reads from both AoA sensors simultaneously; if they disagree by more than 5.5 degrees for a specified period, the Speed Trim System is disabled and MCAS cannot activate. MCAS is now limited to a single activation per high-AoA event and cannot reset through pilot trim inputs. The maximum authority of any single MCAS command was reduced, ensuring that the crew can always override the system using only the control column without requiring electric or manual stabilizer trim. These three changes, dual-sensor input, limited authority, and single activation, addressed the specific failure mode on both fatal flights. An AoA disagree alert, previously an optional paid feature that many airlines, including Lion Air, had not purchased, was made standard equipment on all MAX aircraft.

The FAA also reversed the training agreement that had allowed pilots to transition to the MAX without full simulator time. All 737 MAX pilots are now required to complete differences training in a Level D full flight simulator before operating the aircraft. This requirement, which Boeing and the FAA had jointly determined was unnecessary before the crashes, was recognized after them as essential. The specific content of the training includes MCAS operation, the AoA disagree alert, and the runaway stabilizer procedure, covering the failure mode that crews on both fatal flights encountered but had never been trained to manage. The irony documented in the investigation is precise: the training requirement was avoided partly because acknowledging MCAS’s significance would require it, and requiring it would complicate the MAX’s entry into service. After 346 deaths and a 20-month grounding, the requirement was unavoidable.

The systemic failures in the certification process produced the most far-reaching institutional changes. The FAA Reauthorization Act of 2024, signed into law on May 16, 2024, included significant provisions reforming how the FAA oversees aircraft manufacturers under the ODA program. The law strengthened the FAA’s authority to require changes to ODA training programs, extended and made permanent several provisions of the Aircraft Certification, Safety, and Accountability Act, and established new reporting requirements for design change exceptions approved under type certification regulations. These are not the removal of ODA delegation, which remains the practical mechanism for certifying modern aircraft, but a tightening of the oversight, independence, and documentation requirements that define how that delegation works. The specific mechanisms that allowed Boeing’s MCAS safety analysis to reach the FAA without adequate independent review are addressed in the reformed framework.

Perhaps the most consequential long-term change was one that no regulation required: international aviation regulators stopped deferring to the FAA. Before the MAX crisis, major aviation authorities, including EASA, Transport Canada, and the Civil Aviation Administration of China, routinely validated FAA aircraft type certificates with limited independent review, on the basis that the FAA’s process was trusted and the duplication of effort unnecessary. After the MAX crashes, each of these authorities conducted fully independent technical evaluations of the redesigned aircraft before clearing it for service in their jurisdictions. Transport Canada, which spent more than 15,000 engineering hours on its independent review, issued return-to-service conditions that differed in specific training and procedure requirements from the FAA’s. EASA cleared the MAX on January 27, 2021, with its own independent conditions. CAAC completed its review and cleared the aircraft for Chinese airlines in December 2021. These independent validations are not mandated by any treaty or regulation: they are a decision by each authority that automatic deference to the FAA was no longer appropriate. That decision has not been reversed.

The question of criminal accountability for the MAX crashes remained unresolved for years and ended without a conviction. In January 2021, the US Department of Justice entered a Deferred Prosecution Agreement with Boeing, under which Boeing paid $2.5 billion and admitted that two of its employees had misled the FAA. The DOJ filed a criminal fraud conspiracy charge but agreed to drop it if Boeing complied with the DPA’s terms over a three-year period. In May 2024, the DOJ determined that Boeing had violated the DPA by failing to implement required compliance programs. Boeing subsequently agreed to plead guilty to the criminal fraud charge. A federal judge rejected the proposed guilty plea, citing concerns about the selection process for the corporate compliance monitor. In May 2025, the Department of Justice dropped the criminal case against Boeing entirely. Victims’ families expressed outrage at the decision. Boeing has not been convicted of any criminal offense in connection with the 737 MAX crashes.

The Boeing 737 MAX crisis sits apart from the other accidents in this series in one important way: the failures were not primarily in understanding or detecting an unknown hazard. The hazard was known. The system behavior was known. The decision not to disclose it to pilots or to require simulator training was a documented choice, made in a context where commercial and competitive pressures influenced what got told to regulators and what did not. The investigations produced changes in both the aircraft and in the institutions that approved it, changes whose full effects are still developing. The ODA program still exists. Boeing still designs aircraft. The question the MAX crisis raised, about how much a manufacturer can be trusted to certify its own safety-critical systems, has been answered with tighter rules and less deference, but not with a fundamentally different answer.

For the full context of why the aviation safety system works the way it does, and what happens when it fails, The Flights That Changed Aviation covers each of the accidents that produced the rules flying depends on today. The MAX story connects directly to Air France Flight 447, another case where automation design and the information given to pilots about how a system worked did not match the situation crews encountered when it failed. And for an earlier story of how FAA oversight of Boeing specifically shaped airworthiness regulation, Aloha Airlines 243 traces the origin of aging aircraft rules to a failure the FAA’s inspection program had missed for years.