737 MAX: the number that changed and the analysis that didn't

Twelve minutes, then six

On the morning of 29 October 2018, Lion Air flight 610 left Jakarta for Pangkal Pinang in a Boeing 737-8, registration PK-LQP. The evening before, on the flight in from Denpasar, the same airplane had pitched nose down by itself again and again. That crew had stopped it with the stabilizer trim cutout switches and landed. The left angle of attack sensor had been replaced in Denpasar only hours before that flight. The replacement read about 21 degrees higher than the right one. The Indonesian investigators found it had been miscalibrated during an earlier repair at a US repair station, that the error was not caught then or at installation, and that they could not establish the installation test had been done properly.¹

Once the flaps were up, the airplane's flight control computer began trimming the nose down. The crew trimmed it back up. From the time the flaps were last retracted to the end of the recording, the recorder captured at least 26 automatic nose-down trim commands and at least 34 manual electric trim-up inputs. The column forces needed to hold the nose went past 100 pounds, against the 75 pound limit the certification rules set for a brief two-handed pull. The stick shaker ran on the captain's side, airspeed and altitude disagree alerts came up, and the crew started the checklist for an airspeed disagreement, which is what the cockpit was telling them they had. About twelve minutes after takeoff the airplane hit the Java Sea. All 189 people on board were killed.²

The Indonesian report names no single probable cause. Its nine contributing factors, listed in time order and not by weight, run from the design and certification through the sensor repair and the installation test to the airline and the crews. The crew of the previous flight did not record the stick shaker or their use of the cutout procedure, so neither the Jakarta engineers nor the accident crew knew of them. On the accident flight, the alerts, the repeated activations and the radio traffic were not managed effectively, which the investigators attributed to the difficulty of the situation and to weaknesses in manual handling, checklist use and crew communication that had already shown up in training.³

On 10 March 2019, Ethiopian Airlines flight 302 left Addis Ababa for Nairobi in another 737-8, ET-AVJ. Shortly after liftoff the left angle of attack sensor read 74.5 degrees, 59 degrees more than the right. Once the flaps were up and the autopilot was off, the same system began trimming the nose down. The crew trimmed against the first activations and then, the recorders indicate, set the stabilizer trim cutout switches, a step in the procedure the emergency directive issued after Lion Air called for. When the first officer tried the manual trim wheel, the voice recorder has him saying it was not working. The recorders indicate they then switched electric trim back on, and after two brief trim-up inputs the system trimmed the nose down again. Six minutes after takeoff the airplane struck the ground near Ejere, southeast of Addis Ababa. All 157 people on board were killed.⁴

The Ethiopian report gives the probable cause as repeated nose-down inputs from MCAS driven by the erroneous angle of attack value, and places its contributing factors with the design, the certification, the training material and the manufacturer. It also records that engine thrust stayed near the takeoff setting for most of the flight and that the airplane went past its maximum operating speed. The NTSB, which agrees with the report on MCAS, asked for the crew's use of electric trim and their management of thrust to be named as causes as well, and said that handling the event by the procedures of the time would have allowed the crew to recover. The French BEA, which shares the report's conclusions on MCAS, also asked for the crew's actions to be analyzed more fully. Both said their comments were not appended to the report as they had asked.⁵

Most of the airplane was buried in the crater. Investigators moved the wreckage to a store in Addis Ababa, a pile about five feet high and thirty feet across, and went through it for the flight control parts. They found the stabilizer jackscrew broken into three pieces, with the ballnut jammed on it. Matching the fracture faces put the ballnut about five inches from its upper stop, which the report, using Boeing's 737 NG position data, equates to about 1.5 degrees airplane nose down, or 2.5 units of trim. The flight data recorder had the stabilizer near 1 unit after the last activation. Both positions are further nose down than 3.85 units, which the table Boeing supplied to the report gives as the furthest nose-down setting the pilots' own electric trim switches can command with the flaps up. By the manufacturer's computation, turning the manual trim wheel at the moment the first officer tried it, with the airplane by then past its maximum operating speed, needed between 42 and 53 pounds of force.⁶

Three hundred and forty-six people. The two investigations, the international review that followed and the House committee's majority investigation, which the committee's Republican leaders called partisan, did not agree on everything, and we will say where they differ. On the part this article is about, they are consistent. The system that pushed both airplanes nose down had been changed during development, and the safety analysis behind it was re-checked but kept the conclusions it had reached for the original design.⁷

What MCAS was for

The 737 MAX carries the CFM LEAP-1B, a larger engine than the one on the 737 NG. To keep enough ground clearance on an airplane that sits low to the ground, it was mounted higher and farther forward. At high angles of attack the bigger nacelles generate lift of their own ahead of the center of gravity, and the airplane's pitch characteristics change. The column force a pilot feels as the nose comes up has to keep increasing smoothly. That is what the certification rules require, among them 14 CFR 25.143 on maneuvering and 25.203 on stall characteristics.⁸

The answer was software. The Maneuvering Characteristics Augmentation System, MCAS, moves the horizontal stabilizer nose-down, at 0.27 degrees per second, when the angle of attack gets high, in manual flight with the flaps up. It is a function within the 737's existing speed trim system, which is why the documents written after the accidents talk about speed trim. It was not an anti-stall system in the sense the headlines meant: it did not stop the airplane from stalling. It shaped the column force the pilot feels near the stall and in high-g turns, so the airplane handled the way the regulations, and pilots, expect.⁹

As first designed, MCAS was a high-speed function for wind-up turns, roughly Mach 0.6 to 0.8. It could move the stabilizer a maximum of 0.6 degrees. Boeing's preliminary hazard assessment in late 2012 looked at that design and classified an uncommanded activation as Major in the normal flight envelope. The safety classifications that followed were set against those two numbers.¹⁰

March 2016: the number changed

Partway through flight testing, test pilots found the airplane's handling at low speed also needed help. MCAS was redesigned to work there too. Its speed range went from roughly Mach 0.6 to 0.8 down to Mach 0.2 to 0.8, and its authority went from 0.6 degrees to 2.5 degrees per activation at low Mach, tapering to 0.65 at high Mach. A 737 MAX leadership review approved the redesign on 30 March 2016. The House committee's report calls it a significant technical change with dramatic operational implications.¹¹

The larger number needs one piece of context, and a Boeing engineer would supply it straight away. The stabilizer is less effective at low speed, so a larger command there has a smaller effect than the same command would at high speed. What the larger number did change was how far the stabilizer could travel in one activation, and how much could build up if it kept firing.¹²

A few hours after the approval, the House report records, Boeing asked the FAA for permission to remove references to MCAS from the flight crew operations manual. The request described MCAS as a function that "only operates WAY outside of the normal operating envelope," the language of the original high-speed design. The committee found no evidence either way on whether the pilot who sent it had been told of the redesign. The FAA agreed.¹³

Nothing about this is unusual in itself. Flight test exists to find things, and control laws change in development on most programs. The question for a systems engineer is not why the number changed. It is where else the number was written down, and who was told.

The seven places

Here is the list, link by link, as the official record sets it out. Read it as a trace that was re-checked but never fully re-run.

1. The hazard assessment

After the change, Boeing re-evaluated the functional hazard assessments for MCAS and concluded they had not changed in hazard classification as a result of the increase to 2.5 degrees. The Indonesian report is not consistent on what was flown again in the simulator. One section records that the 2.5 degree low-speed case was evaluated and rated Minor, while the more severe high-speed ratings were carried over from the original evaluations as still valid. Another says the uncommanded case was simulated only to the 0.6 degree limit. Both agree that repeated activation was not tested; it was judged to be no worse than a single one.¹⁴

The classification matters for what it switches off. An uncommanded MCAS activation stayed Major in the normal flight envelope. Under the process Boeing followed, the Indonesian report notes, a Major condition did not call for a fault tree or a failure modes and effects analysis; those were reserved for Hazardous and Catastrophic conditions. So no specific fault tree or failure modes analysis was done for an uncommanded MCAS activation. The Joint Authorities Technical Review, set up by the FAA with nine other authorities and NASA, found that the single and multiple failure analysis for angle of attack was not updated after MCAS was introduced either, because the worst case for angle of attack was already considered catastrophic.¹⁵

The record is more nuanced than "classified Major", and it is worth being exact. The Indonesian investigators describe a major effect in the normal flight envelope and a hazardous effect in the operational envelope, and the certification plan listed only the more severe of the two, Hazardous. The JATR noted that the hazardous target was met by taking credit for how rarely the airplane flies in that envelope, using guidance it said was not a standard industry approach. Different failure conditions, different envelopes, different labels. Which is part of the problem: the answer to "how bad is it if MCAS misfires" lived in several places, and when the number changed, the reassessment kept every one of those labels.¹⁶

2. The architecture

MCAS took its angle of attack from one sensor at a time, alternating sides between flights. The Indonesian report states the reasoning directly. Based on incorrect assumptions about crew response and an incomplete review of the effects on the flight deck, reliance on a single sensor was deemed appropriate and met all certification requirements. And then the line every safety engineer should read twice:

If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.

KNKT final report, PK-LQP, section 2

The single-sensor choice was not made in a vacuum. It was justified by a severity, and the severity rested on high-speed simulator ratings carried over from the original design and on the judgment that repeated activations were no worse than one. The House report notes that the version of MCAS on the KC-46 tanker, built on a 767, took input from at least two sensors, activated once per event and had limited authority. The question of vulnerability to a single bad sensor was raised inside Boeing in 2015. The design that followed rested on the classification, and the classification did not move.¹⁷

The House committee also asked the program's chief project engineer what he knew. According to its report, when he approved the redesign in March 2016 he did not know that MCAS relied on a single sensor, that it could activate repeatedly, or that a Boeing test pilot had taken more than ten seconds to respond in a simulator, with a result described as catastrophic. That is not a story about one person. The approver of a function did not hold three facts about it that were held elsewhere in the same company.¹⁸

3. The crew-response assumption

The hazard assessment assumed the pilot would recognize the problem and re-trim. Boeing's documented assumption, used across its models, was that the pilot would take immediate action to reduce or eliminate the increased control forces. FAA flight test guidance assumes about one second to recognize a failure and three more before recovery begins. Applicants, the JATR observed, appear to treat that as a design assumption that the pilot will respond correctly within four seconds. The Indonesian report found Boeing's assumptions consistent with current industry guidelines, and still incorrect.¹⁹

The JATR then said two things about the four seconds. It found no studies that substantiate the guidance. And the three-second reaction figure dates back decades; the JATR cites an advisory circular from 1968.²⁰

Boeing had data of its own. The House report cites a November 2012 Boeing email describing simulator sessions on the original design, a stabilizer runaway during a high-speed wind-up turn: one pilot reacted in about four seconds, another took more than ten to reach the cutout switches, and the slow case was found catastrophic. At least six Boeing coordination sheets issued between 2015 and 2018 carried virtually the same text, that a reaction time over ten seconds made the failure catastrophic. Boeing told the committee it found no record that any of them had been shared with the FAA, which it said it was not required to do. The committee's majority took a harder view: it called that concealment, and found that Boeing's own authorized representatives, who act on the FAA's behalf, knew of the result and did not pass it on.²¹

The NTSB, in its September 2019 recommendations, added the piece that a desk assessment cannot see. The validation exercises induced the trim failure on its own. They did not simulate what the crews actually got: stick shaker, airspeed disagree, altitude disagree and trim running, all at once. The assumption had been tested against a cleaner failure than the one that happened. The Indonesian report records that on Lion Air 610 the captain responded to the first activation with the column in under two seconds. The activation ran for ten seconds. His trim response to the second took about eight, and the investigators called the slower trim responses understandable, because the crew was reacting to the force on the column.²²

4. The certification deliverables

The JATR's finding is the plainest statement of the whole problem:

... certification deliverables were not updated during the certification program to reflect the changes to this function ... the SSA and functional hazard assessment (FHA) were not consistently updated.

JATR, Executive Summary

The certification plans and the preliminary system safety assessment were not updated to describe the expansion of MCAS to low speed. Because the MAX was certified as an amended type certificate, many of its certification deliverables were revisions to the 737 NG documents, and the JATR found the description of MCAS fragmented among several of them. The FAA received the summary of the hazard assessment. The details and the assumptions sat in Boeing's internal coordination sheets, and the hazard and preliminary safety assessments reached the FAA, in the JATR's words, "much too late (at type inspection authorization) for the FAA to have any influence on the proposed MCAS design." FAA management told the Department of Transportation's Inspector General that it is not unusual for safety assessments to arrive late in certification. MCAS, the review concluded, was not evaluated as a complete and integrated function in the certification documents submitted to the FAA.²³

The JATR chair, Christopher Hart, blamed poor communication and said he saw no sign of intentional wrongdoing, as the Associated Press reported, and said MCAS had gone "from a relatively benign system to a not-so-benign system without adequate knowledge by the FAA." Other parts of the record go further, as we will see. But the JATR's point stands on its own, and it should make every program uncomfortable: the fragmentation by itself kept key details of MCAS out of what the regulator saw. A function's description was spread across documents built as revisions of an older airplane's documents, and no single place held all of it.²⁴

5. The crew manual and the training

MCAS came out of the draft crew manual with the FAA's agreement. The JATR found that this left the FAA's Flight Standardization Board not fully aware of the function, and not in a position to assess the training it needed. The board's report for the MAX, published in July 2017, did not include MCAS among the differences from the NG. Differences training from the NG was computer-based, estimated by the FAA at about two hours, and avoiding simulator training was a program objective. When Lion Air 610 flew, neither its crew's manuals nor their training described MCAS.²⁵

The Justice Department's statement of facts, which Boeing accepted in its 2021 agreement, records that Boeing disclosed the expanded scope of MCAS to the FAA staff responsible for airworthiness, but not to the FAA evaluators who set training. It also includes an exchange between two Boeing technical pilots on 15 November 2016. One had just found the low-speed behavior in the simulator: "MCAS is now active down to .2." The other replied that the manual description would have to be updated. The first wrote that he had "basically lied to the regulators (unknowingly)." The answer came back: "it wasn't a lie, no one told us that was the case." The same statement goes on to say that the two pilots then withheld what they had learned from the FAA's training evaluators.²⁶

The pilot who wrote that was later tried on related charges and acquitted by a jury in 2022. We are not quoting him to assign blame, and the legal story is not ours to tell. We quote the reply because it is the most exact description we know of a disconnected engineering model. By their own messages, the people writing the crew-facing description of a function learned of its low-speed behavior in the simulator, more than seven months after the design changed. And we include what came after because it matters to our argument too: a connected model shows people what has changed. It cannot make anyone pass it on.²⁷

6. The alert

The MAX was meant to show an AoA DISAGREE alert when the two sensors disagreed by more than 10 degrees for more than 10 seconds. The requirement carried over from the NG. The display software tied the alert to an optional angle of attack indicator, so it only worked on airplanes whose operator had bought the option. The House report puts it as inoperable on more than 80 percent of the fleet.²⁸

According to the House report, Boeing tested that software in 2015 and did not find the problem. It was identified in 2017 and the fix was deferred to 2020. On 16 August 2018, ten weeks before Lion Air 610, Boeing issued Lion Air a crew manual describing a working AoA DISAGREE alert. Boeing said the alert was not necessary for safe operation, and the FAA said it was not necessary to meet its safety regulations, adding that once it was in the approved type design, it was required to work. Neither accident airplane displayed it. The Indonesian report found that its absence meant the crew the night before could not record it, and the alert was not there to help maintenance find the miscalibrated sensor.²⁹

7. The regulator

Through all of this the FAA was not absent. It had delegated a large part of the certification work to Boeing's Organization Designation Authorization, Boeing employees acting on the FAA's behalf, as the system allows. That included the system safety documents for MCAS, which the FAA had first kept for itself. The JATR found the deliverables would not have given FAA technical staff awareness of the details of MCAS, its architecture, inputs and limits of authority.³⁰

The rest of the record pulls in several directions. Boeing told Congress it had told the FAA on numerous occasions that the final design of MCAS had changed and that its operating range now included low speed. The Inspector General found FAA flight test staff knew of the change, while key certification engineers and the staff approving pilot training said they did not. The FAA told Congress in 2019 that the change needed no separate notice, because the high-speed case was the most critical. A panel set up by the Transportation Secretary found the certification process had been followed by the FAA and Boeing. The House majority found that MCAS was not an area of particular emphasis. All of this can be true at once, and that is the point. A regulator reviewing summaries sees what the summaries carry.³¹

Why fragmented is the default

It would be comfortable to read the 737 MAX as a story about one company at one moment. The record does not support reading it only that way. The JATR's recommendations are addressed to the whole system of certification, and the deeper finding is about how programs hold their engineering information: the JATR asked the FAA to "refuse to accept function descriptions that are fragmented among several documents."³²

On many programs today, a design value lives in the place where the designer works. The hazard assessment lives with safety. The assumptions live in whatever document first needed them. The certification plan lives with certification, the crew manual with technical publications, the training case with flight operations, the interface definitions with the integrators. Each is a document, revised on its own cycle, owned by its own team. When a value changes, the change travels by people: a review, an email, a meeting, a coordination sheet. Each owner learns about it if someone remembers to tell them. In 2018 the US Department of Defense described its own engineering processes as "document-intensive and stove-piped," and in a 2026 Aerospace Industries Association survey only 14 percent of the member companies that responded reported a digital thread running across the whole enterprise.³³

The 737 MAX was certified as a change to an existing type, so its documents were revisions of documents written for another airplane. That made it worse, and changes to designs that are already certified are a large share of what this industry certifies. Many new programs, the eVTOLs, the hybrids, the autonomous freighters, are still changing their designs while the certification documents are being written. Yet certification itself is still run as a document-based process, as a NASA researcher put it in 2021, and the same 2026 report found civil aviation moving more slowly than the wider aerospace and defense sector toward end-to-end digital integration.³⁴

Look again at the seven places. None of them needed a scientific discovery to get right. The facts that pointed to the problem were already on record inside the program: the new authority, the single sensor, the ten-second simulator result, the alert defect, the missing manual entry. They were in different places, nothing connected them, and some, the record shows, were never passed on.

Where the tools sit in this

This is the problem we build for. The Aerospace Industries Association describes a digital thread as connecting authoritative design, manufacturing and operational data across the whole life cycle, so every team sees and traces the same information. In our case the engineering lives in one connected model and the checks run automatically, instead of a stack of documents that depend on people remembering to tell each other. Safety Lab is in use at multiple aircraft OEMs today. Sys Lab, our systems engineering tool, will join it on one platform.³⁵

Safety Lab holds the safety assessment. Fault trees and safety requirements are generated from the architecture, completely deterministically: the same inputs give the same results, and every number traces back to where it came from. Assumptions are records, not sentences in a coordination sheet. Each one carries a validation state and the list of everything that rests on it, and when an assumption is invalidated, every claim still resting on it is flagged. The AI layer can draft any safety, reliability or human factors analysis, grounded in the standards and in the program's own architecture, for the engineers to review and correct. Nobody starts from a blank sheet.

Sys Lab will carry the design into the same model. A function like MCAS will be a function in the model, its authority and speed range design values, and the choice of one sensor or two a recorded design choice with its reason kept beside it. When a value changes, everything traced to it, the requirements, the interface lines, the crew procedures written against the function, will be marked for review, and a single-sensor choice on a function whose severity is in question will be flagged, the same way every time. Design reviews will run on the same model: the board sees every open item and flagged risk, decides, and owns the decision, and every action is followed to closure. Nothing in the tool blocks a program. It shows, it tracks and it flags what does not agree.

What a tool cannot do is decide for people, or make them share what they know. It can make sure that what is known is in front of the people deciding.

What they did about it

The fleet was grounded worldwide by 13 March 2019 and returned to service in the United States on 18 November 2020. The FAA's summary of the changes reads like a list of the broken links, each one addressed.³⁶

The last line in that table is the one to notice. The revised safety assessment was reviewed to confirm that no speed trim system failure mode relies on exceptional piloting skill or immediate pilot action. For the speed trim system, the safety case no longer leans on the four-second assumption.³⁷

Congress followed in December 2020 with the Aircraft Certification, Safety, and Accountability Act. It directs the FAA to require manufacturers to run safety management systems, tightens how the FAA delegates certification work, requires the FAA to validate human factors assumptions before delegating critical design features and to check how safety assessments treat pilot responses, and sets civil penalties of up to $1 million for failing to disclose safety-critical information to the FAA. Boeing has said it learned hard lessons "from the mistakes we have made," and set up a new safety organization and a board-level safety committee. The criminal charge against the company, after a deferred prosecution agreement, a plea deal the judge rejected and a non-prosecution agreement, was dismissed in November 2025 over the objections of many of the families, and in March 2026 a federal appeals court refused their petition to reopen it. That part of the story belongs to the courts and to them.³⁸

Three questions worth asking on Monday

One. Pick one design value on your program that changed in the last six months. Write down every document and analysis that uses it. Now ask whether you found that list from your model or from your memory. If it was memory, the list is incomplete, and you will not know which item is missing until it matters.

Two. Find every assumption your safety assessment makes about what a pilot, a maintainer or an operator will do, and how fast. For each one, name the evidence. If the evidence is a guidance document, check the date on it. If you have your own test data and it disagrees with the assumption, that data is the more important of the two.

Three. Pick a function whose severity classification decides how much redundancy it gets. Trace backward from the redundancy decision to the classification, and from the classification to the design values it was assessed against. Are they still the values in the design? If the classification changed tomorrow, what would tell the architecture?

If any of those are uncomfortable, that is the finding. Much of what the investigations say was missed was already known somewhere inside the program. It needed to be in one place, in front of the people making the decisions.

What we are and are not claiming

This is not an article about one manufacturer, and it is not written to blame anyone. Boeing and the FAA made deep changes after the accidents. We chose the 737 MAX because its public record is the most thorough account there is of what happens when a design change and the analysis around it drift apart, and that drift can happen on any program, including ours.

We are not claiming that software would have prevented these accidents. Tools do not make decisions, and the decisions on the MAX were made by people under the same schedule, cost and competitive pressure every program works under, which no tool removes. We are not judging either crew; the investigations have done that, and we have tried to report where they landed. They debated crew performance, particularly on Ethiopian 302, where the NTSB disputes the Ethiopian report on the crew's actions and on why the sensor failed: the Ethiopian report points to an electrical defect from production, while the NTSB found the vane was most likely torn off by a bird strike. Outside the investigations, the writer William Langewiesche called the accidents "a textbook failure of airmanship," and Captain Sullenberger told Congress the original MCAS "should never have been approved." No investigation treated crew performance as the main cause. The Lion Air crew faced a system their manuals did not describe. Before Ethiopian 302, its airline had the emergency directive and Boeing's November 2018 description of MCAS.³⁹

The narrower claim is the one we will stand behind. A design value changed, and the hazard classification, the architecture decision, the crew-response assumption, the certification deliverables, the manual and the training never reflected what it meant. The facts needed to see that were on record inside the program. The JATR called the result a function not evaluated as a complete and integrated whole. The fix for that is not only more diligence. It is an engineering model in which a change cannot happen in one place without everything that depends on it knowing.

That is what we build. Safety Lab is in use at multiple aircraft OEMs today, and Sys Lab will join it on one platform. If your program is changing faster than its documents can keep up, we would like to show you what one connected model looks like on your own aircraft.

Notes and sources

1. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019): synopsis p.xviii; findings 83, 86 (p.214); contributing factors 6 and 7 (p.215). ↩
2. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019): synopsis; p.78 (trim command counts); p.196 (column force); 14 CFR 25.143(d). ↩
3. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019): section 3.2, introduction and contributing factors 8 and 9 (p.215). ↩
4. EAIB final report AI-01/19 (ET-AVJ, Dec 2022): section 1.1, history of the flight; section 3.1, findings 30 and 41 to 43. NTSB Safety Recommendation Report ASR-19-01 (Sept 2019), p.3. ↩
5. EAIB final report AI-01/19 (ET-AVJ, Dec 2022): section 3.2, probable cause and contributing factors (p.255). NTSB comments on the draft final report (Dec 2022) and NTSB response to the final report (13 Jan 2023). BEA press release (3 Jan 2023). ↩
6. EAIB final report AI-01/19 (ET-AVJ, Dec 2022): section 1.12.5 (p.106); sections 1.12.7 and 1.12.8 and Table 17 (pp.110 to 112); section 1.16, Figures 76 and 77 (pp.137 to 139). ↩
7. House T&I Committee majority final report (Sept 2020). Statement of Ranking Member Sam Graves on the report, as reported by Time (16 Sept 2020). ↩
8. FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), pp.9 to 10. ↩
9. FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), pp.9 to 10 and 23. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), O2.8-C. ↩
10. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.153. US v. Boeing, Deferred Prosecution Agreement, Statement of Facts (7 Jan 2021), paragraphs 24 and 25. ↩
11. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.154. US v. Boeing, Deferred Prosecution Agreement, Statement of Facts (7 Jan 2021), paragraph 25. House T&I Committee majority final report (Sept 2020), pp.103 to 104. ↩
12. FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), pp.10 and 23. ↩
13. House T&I Committee majority final report (Sept 2020), p.119. ↩
14. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), pp.154 to 155 and p.190. ↩
15. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.190. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), O6.9-A (p.33). ↩
16. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.196, and Appendix H.1.2.1 (NTSB comments, certification plan CP 13471). JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), O3.2-A (p.17). ↩
17. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), contributing factor 2 (p.215) and section 2 (p.196). House T&I Committee majority final report (Sept 2020), p.20 and p.103. ↩
18. House T&I Committee majority final report (Sept 2020), p.21 and pp.116 to 117. ↩
19. NTSB Safety Recommendation Report ASR-19-01 (Sept 2019), p.6. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.154 and contributing factor 1 (p.215). JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), O2.8-A and O2.8-C (p.14). ↩
20. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), O2.8-D (p.14) and F2.8-D (p.15). ↩
21. House T&I Committee majority final report (Sept 2020), pp.24 to 25 and 113 to 115. ↩
22. NTSB Safety Recommendation Report ASR-19-01 (Sept 2019), pp.5 and 8. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.191. ↩
23. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), Executive Summary section 4 (p.VI), F4.1-C, F4.2-A and F4.3-A (pp.24 to 25). DOT Office of Inspector General, Timeline of Activities Leading to the Certification of the Boeing 737 MAX 8 Aircraft (June 2020). ↩
24. Associated Press, as published by PBS NewsHour (11 Oct 2019). JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), F4.1-B. ↩
25. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), section 10 (p.XI). KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), finding 74 (p.213). House T&I Committee majority final report (Sept 2020), pp.24 to 26. ↩
26. US v. Boeing, Deferred Prosecution Agreement, Statement of Facts (7 Jan 2021), paragraphs 25 and 31 to 41. ↩
27. Associated Press reporting of the verdict (23 Mar 2022). ↩
28. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), p.45. House T&I Committee majority final report (Sept 2020), p.123. ↩
29. House T&I Committee majority final report (Sept 2020), pp.123 to 124. KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), contributing factor 5 (p.215). ↩
30. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), F5.1-A (p.26) and F4.1-B (p.24). KNKT final report KNKT.18.10.35.04 (PK-LQP, 2019), Appendix H.1.2.1.3. ↩
31. House T&I Committee majority final report (Sept 2020), p.104. DOT Office of Inspector General (June 2020). FAA written responses for the record, House T&I aviation subcommittee hearing (15 May 2019). Special Committee to Review the FAA Aircraft Certification Process, report to the Secretary of Transportation (Jan 2020). ↩
32. JATR, Boeing 737 MAX Flight Control System (11 Oct 2019), Recommendation R4.4. ↩
33. US Department of Defense, Digital Engineering Strategy (June 2018). Aerospace Industries Association and EY, Digital thread delivers value, so what's stopping scale? (June 2026), p.6. ↩
34. FAA Advisory Circular 21.101-1 on the changed product rule. N. Borer, NASA Langley, presentation at the AIAA Transformational Flight Certification Symposium (Aug 2021). AIA and EY (June 2026). ↩
35. AIA and EY (June 2026), p.3. Safety Lab product documentation. ↩
36. FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), pp.1 and 7. ↩
37. FAA, Summary of the FAA's Review of the Boeing 737 MAX (18 Nov 2020), p.13. ↩
38. Aircraft Certification, Safety, and Accountability Act, Division V of Public Law 116-260 (27 Dec 2020). Boeing statement on the House report (16 Sept 2020). Reuters (6 Nov 2025) on the dismissal; US Court of Appeals for the Fifth Circuit (31 Mar 2026). ↩
39. NTSB comments on the draft final report (Dec 2022) and response to the final report (13 Jan 2023). EAIB final report AI-01/19 (ET-AVJ, Dec 2022), findings. W. Langewiesche, What Really Brought Down the Boeing 737 Max?, New York Times Magazine (18 Sept 2019). Testimony of Capt. C. Sullenberger, House T&I aviation subcommittee (19 June 2019). ↩

Quotations are short extracts attributed to their source. The diagrams are our own and simplified. Accident report figures are reproduced with credit from the KNKT and EAIB reports and the FAA summary; photographs are credited where they appear, under the licenses named.