⏱ Reading time: 10 minutes | WRM Solutions — Rodolfo Liuzzi, CEO
After three decades spent analysing, mapping and attempting to master operational risks in high-criticality sectors, I must admit it: few cases have chilled my blood as much as that of the Boeing 737 MAX.
346 deaths. More than 20 billion dollars in direct losses. Two brand-new aircraft brought down in minutes. And yet, everything had been whispered, written, signalled, years before the crashes of Lion Air flight 610 and Ethiopian Airlines flight 302.
The MCAS: anatomy of a poorly designed system
In 2010, Airbus launched the A320neo with new, more efficient engines. The commercial pressure on Boeing was immediate and brutal. On 30 August 2011, Boeing approved the 737 MAX project — with the sole CFM LEAP-1B engine — to catch up. The new CFM LEAP-1B engines, larger and more powerful, had to be positioned further forward and higher on the wing to maintain ground clearance.
This modification altered the aerodynamic characteristics of the aircraft, increasing the tendency to pitch up — rotating an aircraft around its transverse axis to raise the nose relative to the horizon — at high angles of attack, with the concrete risk of entering a stall.
Boeing chose a software solution rather than structurally redesigning the aircraft. A choice that would have required years of development and a completely new certification. The MCAS (Maneuvering Characteristics Augmentation System) was programmed to automatically lower the tail plane when the system detected an abnormal angle of attack, pushing the nose back down and compensating for the pitch-up tendency.
A year before the 737 MAX was finalised, Boeing made the system even more aggressive. While the original version relied on data from at least two different sensors, the final version used only one — leaving the system with no protection against the failure of a single component.
The FAA, in its final report of November 2020, identified three fundamental safety issues related to the MCAS.
Safety Issue #1 — The single sensor: the MCAS relied on a single angle of attack (AOA) sensor, with no redundancy or cross-verification system. In aviation, the principle of redundancy is sacred. No critical system should depend on a single point of failure. Here, this fundamental rule was deliberately violated — for reasons of cost and schedule.
Safety Issue #2 — Reactivation every 5 seconds: when the sensor provided erroneous data, the MCAS activated repeatedly, pushing the aircraft’s nose downward with increasing force. Pilots could counter it manually, but the system automatically reactivated every 5 seconds. Control of the aircraft became progressively impossible — exactly what happened on Lion Air flight 610 and Ethiopian Airlines flight 302.
Safety Issue #3 — Pilots did not know the MCAS existed: Boeing had deliberately omitted to mention the system in the original flight manuals, to avoid the obligation of additional simulator training. Training that would have increased costs for airlines and reduced the commercial appeal of the 737 MAX compared to the A320neo. Pilots found themselves fighting a system whose existence, operation and deactivation procedures they were completely unaware of. This was not a technical oversight. It was a deliberate choice, documented and validated at every level of the chain of command.
The weak signals, all ignored
1. Internal reports suppressed
The commercial pressure was not limited to the upper echelons of management. It permeated every level of the Boeing organisation — down to the engineers working directly on the 737 MAX programme.
The investigation by the US House Transportation Committee, conducted over 18 months and based on more than 600,000 internal documents, revealed a chilling picture. Boeing employees were under constant pressure to meet production and delivery schedules. The rush was symbolised by “countdown clocks” hung on the walls of meeting rooms — an implicit but enormously powerful message: time matters more than safety.
In this climate, several engineers had expressed concrete concerns about the design of the MCAS. Their reports focused on three specific points: the underestimation of the system’s criticality, the reliance on a single AOA sensor, and the absence of dedicated training for pilots.
These reports did not get lost by accident. They were systematically marginalised. The decision not to incorporate the proposed modifications was not driven by incompetence, but by the awareness that their implementation would have meant slowing down the programme, requiring a new certification and imposing simulator training on airlines. Such a choice would have resulted in billions of dollars in losses and would have allowed Airbus’s A320neo to gain market ground.
The most revealing statement emerged during the US Congressional investigations in 2020. A Boeing engineer had internally described the MCAS as “designed by clowns, supervised by monkeys”. A brutal phrase — but one that concealed something deeper than simple frustration. It was the voice of a professional who saw fundamental safety standards being compromised, and who knew that nobody was listening.
The statement by FAA Administrator Michael Whitaker before the US Senate in September 2024 confirmed that this cultural problem was not limited to the 2018-2019 crashes. Boeing “must maintain robust safety reporting programmes and promote a safe and proactive reporting culture within its organisations”. Six years later, the regulator was still imposing on Boeing what should have been the starting point.
In operational risk management, there is a fundamental principle: an organisation in which the person who reports a risk is perceived as an obstacle to business — rather than a guardian of safety — has already unconsciously chosen its next disaster. Boeing demonstrated this twice. In five months.
The cost of blindness
When risk signals are systematically ignored, the final bill is not paid only in money. It is paid in human lives, in destroyed reputations, in decimated organisations, in sanctions. The Boeing 737 MAX case produced one of the most devastating balance sheets in the history of commercial aviation.
The human cost
346 people lost their lives in five months. Not in two separate accidents — but in the same accident, repeated twice. Lion Air flight 610 on 29 October 2018 and Ethiopian Airlines flight 302 on 10 March 2019 followed the same sequence of events, produced by the same defective system, ignored by the same people. Behind every statistic lies an individual, a family, a life irrecoverably lost.
The financial cost
The 737 MAX remained grounded for 20 months — from March 2019 to November 2020 — the longest grounding in the history of commercial aviation. The total cost to Boeing was estimated at more than 20 billion dollars, including compensation to victims’ families, reimbursements to airlines, lost orders, redesign and recertification costs.
In January 2021, Boeing reached an agreement with the US Department of Justice for 2.5 billion dollars — acknowledging having deceived the FAA during the MCAS certification process. In September 2022, Boeing was ordered to pay an additional fine of 200 million dollars to the SEC for misleading statements to investors. The cost of not having listened to the engineers raising concerns? A fraction of these figures.
The reputational cost
Boeing was an icon of American engineering. A symbol of precision, reliability, technical excellence. The 737 MAX case cracked this reputation durably. Public confidence in commercial aviation was shaken. Airlines had to manage passengers who refused to board a 737 MAX. Some pilots formally requested not to be assigned to that type of aircraft. A brand built over decades was damaged in a matter of months.
The operational and systemic cost
Supply chains were destabilised. Suppliers dependent on Boeing programmes suffered enormous losses. The board of directors was decimated — CEO Dennis Muilenburg was dismissed in December 2019.
But the deepest cost — the one that does not appear in balance sheets — is the cultural cost. As FAA Administrator Michael Whitaker declared before the US Senate in September 2024, six years after the disasters Boeing still has to be compelled to “encourage its employees to speak up without fear of retaliation”. An organisation in which silence is still the norm has not yet paid the most important bill. That of culture.
Conclusion
The Boeing 737 MAX did not collapse because of a sudden technical flaw. It collapsed because of a chain of deliberate choices, documented and validated at every level of an organisation that had stopped listening.
The signals existed. The engineers had spoken. The near-misses had been recorded. The single sensor was a known heresy. The pilots did not know the MCAS existed. And yet, nothing changed — until two aircraft crashed to the ground in five months.
What this case teaches us, with rare brutality, is that operational risk is not a support function. It is a matter of survival. A risk management system worthy of the name does not merely map risks on a table. It ensures the unfiltered transmission of weak signals. It protects those who raise their voice. It imposes genuine independence of control. And — above all — it refuses to subordinate safety to financial performance.
As FAA Administrator Michael Whitaker declared before the US Senate in September 2024 — six years after the crashes — Boeing still has to be compelled to build a culture in which employees can report risks without fear of retaliation. Six years. Two disasters. 346 deaths. And the lesson has not yet been fully learned.
When you hear “it’s under control” or “there’s nothing to worry about” or similar phrases, always ask yourself three questions: who is saying it, with what evidence, and under what blind spot?
The greatest operational disasters do not come from the unknown. They come from identified, documented risks — deliberately set aside.
Stay alert. Listen to the ground. Treat every signal as a potential crisis precursor. This is the DNA of the risk manager. The day we stop doing so, the price is counted in human lives and billions.
Sources: FAA Summary of the Review of the Boeing 737 MAX (November 2020) — ITAFSC, Boeing B737 MAX: The SMS Would Have Avoided Two Fatal Accidents (May 2021) — Il Sole 24 Ore, The vicissitudes of the Boeing 737 MAX (January 2024) — US House Transportation Committee Report (September 2020) — U.S. Department of Transportation, FAA Oversight of Boeing’s Broken Safety Culture, Statement by Michael Whitaker, FAA Administrator, US Senate (September 2024).