AVIATION / SPACE 10 min read

Boeing 737 MAX——The Day 'On Schedule, On Budget' Becomes a Time Bomb

2026-08-16 G.航空宇宙

On the morning of March 10, 2019, Ethiopian Airlines Flight 302 took off from Addis Ababa. Captain Yared Getachew was 29 years old. Born in Kenya, he was the youngest captain in Ethiopian Airlines history, with 8,122 total flight hours. Six minutes after takeoff, the aircraft slammed into a field near Bishoftu at 900 kilometers per hour. All 157 people on board were killed.

Five months earlier, on October 29, 2018. Lion Air Flight 610 departed Jakarta. Captain Bhavye Suneja, 31, Indian, with 5,176 flight hours on the 737. Thirteen minutes after takeoff, the aircraft plunged into the Java Sea at over 740 kilometers per hour. All 189 on board died.

346 people.

Both aircraft were Boeing 737 MAX 8s. Brand-new planes, manufactured just months earlier. The latest variant of the world’s best-selling commercial jet.

And both were killed by the same system. MCAS. Maneuvering Characteristics Augmentation System. Most pilots had never been told it existed.

Internally, the 737 MAX project was a model example. From formal approval in August 2011 to commercial service in May 2017, about six years. Launched in haste to compete with the Airbus A320neo, it was a derivative aircraft that hit all three KPIs: on schedule, within budget, and “virtually no additional simulator training required for existing 737 pilots.”

To the PM textbook, this looked like success. It ended with a 20-month worldwide grounding, cumulative direct losses of $20 billion, and 346 deaths.

Mission: Why the 737 MAX Began

Wind the clock back to December 2010. Airbus announced the A320neo. A derivative aircraft improving fuel efficiency by 15% with new-generation engines. Within just six months of going on sale, it accumulated over 1,200 orders.

Boeing faced a choice.

There were two options. One was to scrap the 737 and start fresh with clean-sheet design. The 737’s lineage traced back to the 1960s—low landing gear, a narrow fuselage, an aging design philosophy—and it was nearing its limits. A clean-sheet design would mean rebuilding from scratch for a modern airliner. But that meant 8–10 years of development and an upfront investment exceeding $15 billion.

The other was to build it as a 737 derivative. Just swap in a new-generation engine. Ready in 3–4 years. Lower cost, and above all, a powerful selling point: “existing 737 pilots can fly it with no additional simulator training.”

On July 20, 2011, Boeing’s largest customer American Airlines announced a massive order including 130 A320neos. Rattled, Boeing formally approved the 737 MAX development program at a board meeting roughly 40 days later, on August 30.

That was the moment “no additional training for existing pilots” was locked in as a technical requirement.

In requirements-definition terms: add a new capability (new-generation engine), but the external interface (handling characteristics) must remain compatible with the existing version. Make the difference invisible to the user.

Any software engineer will recognize this immediately. A requirement that says “major version upgrade, but nothing changes for existing users.”

Design: How It Was Designed

The 737 MAX’s biggest technical problem was that the new-generation engines simply wouldn’t fit.

The CFM LEAP-1B selected for the aircraft was about 20 centimeters larger in diameter than its predecessor. But the 737 had short landing gear. Designed in the 1960s, when airport jetways were still scarce, the fuselage had been kept deliberately low to ease passenger boarding. Simply swapping the engine meant it would scrape the ground.

The engineers chose to mount the engine shifted forward and upward on the wing. Extending the landing gear would require a complete redesign of the undercarriage—out of scope for a “derivative aircraft.” Moving the engine forward solved the ground clearance problem.

But a new problem emerged.

With the engine ahead of the wing, the lift distribution at high angles of attack changed. The nose would pitch up more readily. This worsened stall precursors and made the handling characteristics differ from the existing 737.

“Different handling characteristics” meant a regulatory problem. The FAA could classify it as a new type certificate, requiring new pilot training.

That was absolutely unacceptable. “No additional training” was the requirement.

The engineers’ solution was to use software to hide the difference. MCAS. If the Angle of Attack (AoA) sensor detected the nose pitching up too far, it would automatically push the horizontal stabilizer down. Working invisibly beneath the pilot’s awareness, correcting the aircraft’s tendency.

In design intent, it was a modest auxiliary function that activated only under specific conditions. The original design required both AoA sensors to show elevated readings and high G-force conditions before triggering. Control input: 0.6 degrees.

That changed in 2016, during flight testing.

When engineers discovered that pitch-up occurred at low speeds as well, they deleted the G-force condition. At low speeds, G-forces don’t build, so that condition would prevent MCAS from activating when needed. But removing it meant MCAS now triggered off a single AoA sensor. The control authority was expanded more than fourfold, to 2.5 degrees. It was designed to run for 10 seconds per activation and could re-engage after being canceled.

At this point, 737 MAX chief technical pilot Mark Forkner sent a colleague an internal email.

“MCAS is running rampant in the simulator.”

This change was never formally re-reported to the FAA. In fact, around this same period, Boeing requested—and received FAA approval—to delete MCAS from the pilot manual. The stated reason: “to avoid confusing pilots with information overload.”

As a design judgment, this represented compounded failures. They discarded redundancy (single-AoA-sensor dependency), expanded the impact radius (fourfold control authority), and stripped the function of user visibility (manual deletion). Each was a small change, and each passed internal review individually.

MCAS had been classified with a “Major” hazard severity—not Catastrophic. In aviation design convention, a Major function can depend on a single sensor. The basis for that assessment was evaluation of MCAS in isolation. Multiple consecutive activations, pilot cognitive load, and the compounded effect of training omission were outside the scope of the analysis.

Execution: How It Was Built

As a manufacturing program, the 737 MAX proceeded almost exactly on schedule.

August 2011: Development formally approved
January 2016: First flight
March 2017: FAA type certificate obtained
May 2017: First aircraft delivered to Malindo Air of Malaysia

Just under six years. The goal of reaching market at roughly the same time as the Airbus A320neo was achieved. Orders exceeded 3,000 aircraft, the fastest-selling aircraft in Boeing history.

The training omission was reinforced through contract terms.

Southwest Airlines, the world’s largest 737 operator with 590 aircraft in its fleet, had ordered 280 737 MAXs. The contract between the two companies read: “If simulator training is required for 737 MAX pilots at entry into service, Boeing will pay Southwest $1 million per aircraft.”

$280 million in total. That gave Boeing an overwhelming financial incentive to ensure training would never be required.

Transition training for existing 737 pilots to the 737 MAX ultimately became “two hours on an iPad.” A 13-page difference document. Zero mention of MCAS.

October 29, 2018: Lion Air Flight 610. Immediately after takeoff, the left AoA sensor began transmitting corrupted data. On the ground the nose was level, but the aircraft believed it was pitching up excessively. MCAS activated. It pushed the nose down. The pilots fought back with the control column. Ten seconds later, MCAS activated again. After more than 20 exchanges, the aircraft dove nose-down into the sea at over 740 kilometers per hour.

From the dark depths of the Java Sea, wreckage and the flight data recorder were recovered. The data was unambiguous. Repeated MCAS activations. The pilots didn’t know MCAS existed. It wasn’t in the manual.

Boeing’s official response was not the immediate release of a technical fix, but a notice to operators: “Corrupted AoA data may cause nose-down pitch inputs.” The implication was that following procedures would be sufficient.

Five months later, March 10, 2019: Ethiopian Airlines Flight 302. Same scenario. AoA sensor anomaly. Repeated MCAS activations.

Captain Getachew and his first officer followed the procedure Boeing had issued after the Lion Air crash—the electric trim cutout. They did everything by the book.

But it wasn’t enough.

After the cutout, raising the nose required manually cranking the trim wheel. But above 350 knots, the aerodynamic load is too great for human strength to move the horizontal stabilizer. They re-engaged the electric trim to try again. MCAS activated once more.

Six minutes after takeoff. High-speed impact into a field near Bishoftu. All 157 dead.

The second crash couldn’t be dismissed as “inadequate pilot training.” The FAA still argued for continued operations, but on March 11, China’s Civil Aviation Administration became the first in the world to announce a grounding. The EU, Canada, Russia, Singapore, and over 50 countries and territories followed.

March 13: President Trump announced the grounding. The United States became the last country in the world to ground the aircraft.

People: Who Led

Dennis Muilenburg, Boeing’s CEO at the time. Born in Iowa in 1964. He studied aerospace engineering at Iowa State University, joined Boeing in 1985, and climbed over 30 years to the CEO role in 2015. An engineer-turned-CEO.

Yet his management decisions were finance-driven. During his tenure, Boeing returned more than 100% of its profits to shareholders through stock buybacks and dividends. Total share repurchases from 2013 to 2018: $43 billion. A new commercial aircraft program costs $15–20 billion per type.

Here lies one explanation for why “clean-sheet design” was never chosen.

After the Lion Air crash, Muilenburg repeatedly insisted “the aircraft is safe.” He held the same position the day after the Ethiopian Airlines crash. Even after the grounding on March 13, he pressed to resume operations quickly.

December 23, 2019: he was fired. He declined a severance package, but total compensation including stock options already vested exceeded $60 million.

Dave Calhoun succeeded him. A GE veteran with a finance-heavy background. He led the final phase of the return to service.

On the engineering side, there was Mark Forkner, the 737 MAX chief technical pilot. After sending the internal email in 2016 about MCAS “running rampant,” he did not inform the FAA’s Aircraft Evaluation Group of the specification changes.

In October 2021, he was indicted by a federal grand jury on fraud charges. The only individual criminally prosecuted in connection with Boeing. In March 2022, he was acquitted. The jury’s view: it was unfair to place the blame on him alone.

The cultural turning point most widely cited is the 1997 merger with McDonnell Douglas. Before it, Boeing was described as a “Seattle culture.” Engineers sat at the top of the company. Technical judgment took precedence over business judgment. After the merger, headquarters relocated to Chicago in 2001. Engineering’s center (Seattle) was geographically severed from management’s center (Chicago).

“They began treating engineers as costs, not assets.” Former Boeing engineers say this in retrospect.

Twenty years after the cultural shift. The MAX crashes arrived with that time delay.

And Captain Yared Getachew of Ethiopian Airlines Flight 302. After his son’s death, his father told a U.S. journalist:

“My son loved the sky since he was a child. He became the youngest captain. When he was nine, he drew a picture of an airplane and showed it to me.”

Legacy: What It Left Behind

Twenty months. The longest grounding in American commercial aviation history.

On November 18, 2020, the FAA approved return to service. MCAS was redesigned: “won’t activate unless both AoA sensors agree,” “activates only once per flight,” “reimposed authority limits.” Rebuilt to proper safety-critical design principles. Simulator training was made mandatory.

Major financial settlements, in outline:

January 2021: Deferred Prosecution Agreement (DPA) with the U.S. Department of Justice. $2.5 billion payment. Breakdown: $244 million criminal penalty for fraud against the FAA, $1.77 billion compensation to airlines, $500 million to victims’ families.

January 2024: Alaska Airlines Flight 1282. At 4,800 meters altitude, a door plug blew out of an operating MAX 9. Emergency landing. Miraculously, no deaths. The FAA identified manufacturing quality control failures. Deemed a violation of the DPA; in May 2025, an additional $1.1 billion settlement.

Direct losses estimated at $20 billion. Including opportunity cost from order cancellations equivalent to 1,200 aircraft, total exceeds $60 billion. The largest loss-generating program in Boeing history.

Several things remain over the longer term.

First, FAA certification reform. Organization Designation Authorization (ODA)—the system in which manufacturer employees perform certification work as FAA delegates—was criticized in congressional investigations as a textbook case of regulatory capture. The Aircraft Certification Reform and Accountability Act of 2020 restored direct FAA oversight authority.

Second, Boeing’s market position. In October 2019, the Airbus A320neo family overtook the 737 in cumulative orders for the first time, becoming the world’s best-selling commercial aircraft. A historic reversal.

Third, a canonical case study in safety engineering. MIT Sloan, Harvard Business School, and the Belfer Center have adopted the 737 MAX as a case study. As a three-part story of “safety culture collapse,” “regulatory capture,” and “single-point-of-failure design,” it has become standard curriculum in engineering ethics.

When MAX problems resurfaced in 2024, the industry’s view was harsh. Dave Calhoun retired at end of 2024. Kelly Ortberg became the new CEO, and Boeing is now somewhere in a “rebuilding” phase.

The 737 MAX itself still flies worldwide. The redesigned aircraft is technically sound. But the damage to the brand runs deep.

Lessons: The Dark Side of “On Schedule, On Budget”

Evaluate the 737 MAX project by conventional PM metrics.

Schedule: planned 6 years, actual 6 years. On schedule. Budget: stayed within the derivative-development budget envelope. On budget. KPI achievement: existing pilot training eliminated, as targeted.

By the textbook, straight A’s. It ended with 346 deaths and over $20 billion in losses.

What went wrong?

Schedule and budget as metrics do not directly reveal what is happening beneath them. In the 737 MAX case, the constraint frame of “stays within scope as a derivative” continuously forced technical compromises. Engine repositioned forward. MCAS added. Single-AoA-sensor dependency. Manual deleted. Training eliminated. Each individually “within scope.” But cumulatively, the safety margin had been consumed entirely.

There is a logic to derivative development. You can ship it at less than half the cost of a clean-sheet design. Faster to market. Lower transition costs for existing users. These are real economic values.

The trap is that derivative constraints shift the optimization target from “what’s different from the existing version” to “what can be made to look like the existing version.” You build something that is actually different to appear the same. The technology for hiding the difference is placed at the center. When what was hidden surfaces, it strips away the means of response. A pilot who doesn’t know MCAS exists cannot respond to MCAS.

This is not unique to aviation. The same structure appears in countless software projects that extend legacy systems. New requirements are absorbed “while maintaining compatibility,” “in a minor version update.” Abstraction layers accumulate to absorb the difference—adapters, shims, compatibility layers. The difference hides. The hidden difference surfaces one day.

When “on schedule, on budget” is achieved by deferring invisible debt, it is not success—it is a time bomb. The debt payment has merely been pushed to next year, and interest is accumulating with certainty.

One more structural observation specific to 737 MAX: from the McDonnell Douglas merger, twenty years passed. The cultural shift took place, and twenty years elapsed before its consequences appeared. Safety culture is determined less by manuals and procedures than by the unspoken rules of “what is permitted and what is not,” “whose opinion prevails and whose does not.” The divergence between management’s words and actions accumulated over years and, one day, toppled as the quality of the entire system.

The invoice that returned with a twenty-year lag was paid with 346 lives and $20 billion in cash.

One final question.

In the projects you are currently reporting as “on schedule, on budget, on requirements”—how many mechanisms did you put in place “to hide the difference”? And in how many years will they come back, and in what form?