Boeing 737 MAX: MCAS and a Single Point of Failure

Between October 2018 and March 2019, two Boeing 737 MAX jets crashed within minutes of takeoff, killing 346 people. Lion Air 610 went down off Indonesia, and Ethiopian Airlines 302 near Addis Ababa. Both aircraft were nearly new. In both, a piece of software pointed the nose at the ground while the pilots fought to bring it back up.

The 737 MAX used larger, heavier engines than earlier 737s, mounted further forward and higher on the wing. That changed how the aircraft handled and gave it a tendency to pitch up in certain turns. Rather than redesign the airframe, Boeing added software called MCAS that would quietly push the nose back down when it sensed a high angle. The system read that angle from a single sensor on the side of the fuselage. If that one sensor was wrong, MCAS would act on a danger that was not there, push the nose down, reset, and push again.

Most pilots did not know MCAS existed. It was left out of the manuals and the training, in part to keep the MAX similar enough to older 737s that airlines would not need expensive simulator time. So when the nose dropped on its own, the crews were fighting a system they had never been told about, with the wrong mental model, and seconds to work it out.

Where it failed

This one is mixed. The sensor fault that started each accident was probabilistic, a part that fails at some rate. But the path from one bad sensor to a crash was deterministic by design. MCAS read a single sensor, with no cross-check against the second one the aircraft already carried, and it had the authority to trim the aircraft nose-down over and over. Given a bad reading, the dangerous response was built in.

The deepest break was in people and process, above the technology. The choice to rely on one sensor, to keep the system from pilots, and to classify its failure as less severe than it was, all happened in design reviews and certification, under cost and schedule pressure, with a regulator that had delegated much of the checking back to Boeing itself.

MCAS did what it was designed to do. The decisions that doomed both flights were made in design reviews and certification, long before either plane left the ground.

How it could have been caught

Use both angle sensors and refuse to act when they disagree, which the aircraft was physically able to do. Limit how far and how often the system can move the trim, so a single fault cannot stack into a dive. Tell pilots the system exists and train the recovery, so the response is a memory item rather than a puzzle. And hand the safety analysis to someone with no stake in the schedule, because the classification that called this failure survivable is the single decision that let everything else through.

What it means for AI

MCAS is the case to keep in mind whenever an automated system is given authority to act on a single input without telling the people who have to live with it. That describes a great deal of AI being deployed now. A model reads one stream of data, decides, and acts, and the operators are not told what it is doing or how to stop it.

The agentic version is an agent with real authority, acting on a narrow signal, while the human is kept out of the loop for the sake of a smoother experience. The fixes are the ones Boeing skipped: cross-check the inputs so one bad reading cannot set the system off, and cap what it can do on its own so a single fault cannot stack into a dive. The people in the loop also have to know what the system is capable of. An override is useless when nobody has been told there is anything to override.