The MCAS safety analysis: what it left out

To the public, the Boeing 737 MAX was the routine, minimum-change update to the world’s bestselling jet. The MCAS System Safety Analysis Boeing submitted to the Federal Aviation Administration described a different system. The flight-test data, which Boeing never resubmitted, described a third. The first document said MCAS was limited to 0.6 degrees of stabilizer authority, active only at high speed. The system that flew Lion Air 610 and Ethiopian 302 had 2.5 degrees, was repeatable, and activated at low speed. The hazard analysis on file with the FAA was never updated. The Flight Crew Operating Manual was never updated. 346 people died.

This investigation, part of BURIED, reconstructs what the primary-source record establishes but the headline coverage rarely connects. The 2014 decisions that determined the outcome before MCAS was written. The certification architecture that ensured no integrated reviewer saw the deployed system. The shared supplier-cost-out and delegation pattern that links the 737 MAX to two later Boeing failures, each substantiated separately in the primary-source record. It is the inaugural case file in The Asterisk’s investigative catalog.

The Public Narrative

The Boeing 737 MAX program was approved by Boeing’s board on August 30, 2011, in response to the Airbus A320neo, launched December 1, 2010. The mandate, as Boeing publicly described it at the program-launch press conference, was a re-engined 737 with higher fuel efficiency and no simulator training requirement for pilots already type-rated on the 737 NG. That last condition was not incidental. It was a contractual commitment Boeing had given Southwest Airlines, its largest 737 customer, on each MAX delivery. According to subsequent Seattle Times reporting on the same-type-rating commitment, the value of avoiding simulator training was approximately $1 million per airframe.

The FAA granted the amended type certificate to the 737 MAX 8 in March 2017, and commercial service followed that spring. According to Boeing’s own marketing materials of the period, MCAS, where it was described at all, was a minor pitch-augmentation function that operated only during high-angle, high-speed flight regimes a commercial pilot would rarely encounter. It was not described in the Flight Crew Operating Manual.

The Lion Air crash of October 29, 2018 was initially attributed in industry coverage to a faulty angle-of-attack sensor and crew confusion in the face of repeated nose-down stabilizer commands. The Ethiopian crash of March 10, 2019 was framed as a training failure compounded by airspeed mismanagement. The aircraft returned to service in late November 2020 after a 20-month worldwide grounding. According to Boeing’s current technical documentation hosted at boeing.com/737-max-updates, the redesigned MCAS architecture cross-checks two independent angle-of-attack sensors, activates only when the disagreement between them is below 5.5 degrees, and is non-repeating. The framing is that the system has been corrected.

That framing is the public narrative. The primary-source record supports a different reading.

The First Document

The MCAS System Safety Analysis was the package Boeing submitted to the FAA in support of type certification. According to the Joint Authorities Technical Review final report submitted to the FAA on October 11, 2019, that document described an MCAS with 0.6 degrees of stabilizer authority, limited to high-speed flight, and classified the failure modes as “major” in normal flight and “hazardous” in wind-up turns, neither of which is “catastrophic.”

The classification governed the redundancy posture downstream. Under FAR Part 25.1309, the four-tier failure-mode hierarchy (minor, major, hazardous, catastrophic) sets the redundancy floor: a “major” failure mode permits single-sensor activation, “hazardous” does not, and “catastrophic” requires extensive redundancy. Boeing classified MCAS failure as “hazardous” in the wind-up turn case, yet permitted single-AOA-sensor activation anyway. Three years later, 346 people died of the single-sensor failure that FAR 25.1309 marks as non-permissible for “hazardous”-tier modes. The classification was submitted before flight test and before the authority expansion that the JATR documents as having occurred during the 2016 flight-test program.

The Seattle Times’ “Inside Story of MCAS,” published in June 2019, established that during the 737 MAX’s flight-test program in 2016, Boeing engineers determined the original 0.6-degree setting was inadequate at low angle-of-attack regimes encountered during certain pilot-induced wind-up turns. They expanded the authority to 2.5 degrees, made the activation repeatable rather than one-shot, and removed the high-speed restriction. The hazard analysis on file with the FAA was not updated to reflect any of these changes. The Flight Crew Operating Manual was not updated either. The 2021 Department of Justice deferred prosecution agreement records, as admitted fact, that two Boeing technical pilots deceived the FAA about the change. One of those two pilots, Mark Forkner, the 737 MAX’s chief technical pilot, wrote in a November 3, 2016 email to an FAA staffer that he had been “jedi-mind tricking [foreign] regulators into accepting the training that I got accepted by [the] FAA.” Thirteen days later, in a November 16, 2016 text message exchange with a Boeing colleague, Forkner described MCAS as “running rampant in the sim” and added: “So I basically lied to the regulators (unknowingly).” The DPA records the deception as fact; the Fort Worth jury that tried Forkner alone in March 2022 acquitted him in under two hours, accepting the defense argument that Boeing engineers had not informed him about the authority expansion. Either reading is devastating: concealment either by Forkner or from Forkner.

There is one further document the video does not have time to surface. In 2014, Boeing flight-deck systems engineer Curtis Ewbank filed an internal proposal for a Synthetic Airspeed redundancy upgrade that, according to his subsequent whistleblower disclosure to the Senate Commerce Committee, would have provided a second computed-airspeed reference cross-check independent of the angle-of-attack sensors. Ewbank’s complaint states that upper management rejected the upgrade over cost and training concerns. The rejection predates the MCAS authority expansion by two years. The redundancy it would have introduced is precisely the redundancy whose absence killed Lion Air 610. This is inference (the rejection memo does not refer to MCAS, which had not yet been written), but the structural overlap is direct: the engineering function the rejected upgrade would have provided is the engineering function the un-updated safety analysis assumed was unnecessary.

The “hazardous” classification, the un-updated hazard analysis, and the rejected redundancy upgrade are three expressions of the same incentive architecture, documented at three points in time. (This is inference: the dossier substantiates each event separately rather than asserting them as a single decision; the House Transportation and Infrastructure Committee’s September 2020 final report is the closest the public record comes to a structural finding tying them together.) The defining pattern of a BURIED case file is that such structural conditions are documented in the public record once one knows where to look.

Get the breakdown of next week’s investigation →

The Pattern

The mechanism of the concealment is not one decision. It is a system of decisions, each individually defensible at the moment it was taken, that systematically optimized for cost, schedule, and capital return at the expense of engineering redundancy. The data shows this most clearly across three cohorts.

Capital allocation. Between fiscal year 2013 and fiscal year 2019, Boeing returned $43.4 billion to shareholders through stock repurchases, according to the company’s own 10-K cash-flow disclosures aggregated by Macrotrends, Leeham News, and Jacobin. Across the same period, R&D expenditure was flat to declining, against a revenue base that grew to a record $101.1 billion in fiscal 2018. Approximately 80 percent of Boeing’s free cash flow during the 2013 to 2018 window was returned to shareholders rather than reinvested. In April 2019, weeks after the Ethiopian crash, Boeing suspended its $20 billion repurchase authorization (the December 17, 2018 board approval, of which the company had spent only a portion before the suspension). The suspension is consistent with leadership having concluded the capital-return cycle was structurally untenable, though the dossier records the suspension itself rather than an explicit leadership conclusion in those terms.

Executive incentive. According to Boeing’s 2019 proxy statement, CEO Dennis Muilenburg’s fiscal 2018 total compensation was $23.4 million, including a $5.4 million annual bonus and a $7.6 million long-term performance award keyed to total shareholder return and operating margin. According to Seattle Times reporting (March 2019), when fiscal 2018 option exercises and delayed stock payouts are included, Muilenburg’s total realized compensation rose to approximately $30 million. The compensation architecture rewarded margin expanded and cash returned. It did not reward redundancy added.

Supplier cost-out. The Partnering for Success program, publicly described by CEO Jim McNerney in 2013 at his Kiawah Island investor conference and in full effect by 2014, demanded annual price cuts of 15 to 25 percent from Boeing’s supplier base. According to Seattle Times reporting, suppliers who refused were threatened with placement on a “no fly list” of vendors excluded from future programs. Bloomberg’s February 2018 feature on the program documented the mechanics in detail. Reporting across Seattle Times, Bloomberg, and Leeham News over the subsequent five years documented that suppliers absorbed the cost and that quality drift was visible in the public record (whether Boeing’s senior leadership monitored per-supplier defect rates remains undisclosed in the public record).

Three cohorts, all in the service of minimum-change, low-retraining certification. The 2014 rejection of Curtis Ewbank’s Synthetic Airspeed proposal sits inside that pattern. So does the 2014 cockpit-alert decision that this investigation now turns to.

The Question the FAA Couldn’t Answer

The 737 MAX entered commercial service in 2017 with a cockpit-alerting architecture grandfathered to a 1977 regulatory standard (FAR Part 25.1322), inherited from the original 737 lineage that began service in 1968. According to Aviation Pros’ October 2019 reporting, Boeing used the FAA’s Changed Product Rule procedure in 2014 to retain that grandfathered architecture rather than upgrade to the modernized Engine Indicating and Crew Alerting System (EICAS) standard the FAA otherwise required of new transport-category aircraft. The Changed Product Rule decision was approved. The reason: requiring EICAS would have triggered new pilot training and broken the same-type-rating commitment to Southwest.

When MCAS misfired on Lion Air 610 and Ethiopian 302, the cockpits presented an undifferentiated set of alerts simultaneously: stick-shaker activation, airspeed disagree, altitude disagree, and stabilizer trim runaway, each surfacing without prioritization. According to the JATR final report, this warning environment was not adequate to alert flight crews to the underlying MCAS condition in the time window available before terrain impact. The 1977-standard cockpit could deliver a stack of warnings; it had no architecture to prioritize them in the order a crew should act. This is inference: the JATR did not phrase the finding this way, but the inadequacy it documented is structurally consistent with the architectural difference between the 1977 standard and the EICAS standard the MAX was permitted to skip.

The deeper question is institutional. Under the Organization Designation Authorization program, Boeing engineers were authorized to act on behalf of the FAA in clearing portions of their own work. According to the JATR final report, MCAS as eventually deployed was never evaluated as a complete and integrated function across the FAA delegation chain. The October 2019 international review, which represented the FAA, NASA, EASA, and eight national civil aviation authorities (Australia, Brazil, Canada, China, Indonesia, Japan, Singapore, and the UAE), identified a delegation structure that systematically permitted Boeing engineering judgments to substitute for independent FAA review on the integrated systems Boeing was certifying.

The House Transportation and Infrastructure Committee’s September 2020 final report, built from 600,000 pages of Boeing and FAA documents reviewed across an 18-month investigation, reached the same conclusion. According to the filing, the failure was not one negligent engineer or one corrupt regulator. It was an ODA delegation architecture in which no single institution had visibility into the integrated MCAS function. The system was certified piece by piece by people authorized to certify their own pieces. This is inference (the JATR did not phrase it this way), but the pattern is consistent with what the data shows: the FAA had effectively outsourced its review to the entity whose program timeline was at risk if the review took longer.

The Aftermath and the Pattern

The headline aftermath is well documented. 346 dead. 387 aircraft grounded for 20 months across 59 airlines. Between $18.6 and $20 billion in direct costs booked by Boeing across 2019 and 2020. A $2.5 billion deferred prosecution agreement on January 7, 2021, including a $243.6 million criminal monetary penalty and a $500 million victim compensation fund. A $200 million SEC administrative penalty on September 22, 2022, with a separate $1 million sanction against Muilenburg personally for the misleading post-Lion Air statements that the SEC formally found to have misrepresented the safety condition of the aircraft. The statement at the center of the SEC finding was a press release Muilenburg personally approved on November 27, 2018, calling the 737 MAX “as safe as any airplane that has ever flown the skies.” That press release was issued 29 days after the Lion Air crash and 103 days before the Ethiopian crash.

The DOJ resolution chain ran on past the SEC settlement. A $487.2 million guilty-plea agreement on July 7, 2024 was rejected by U.S. District Court on December 5, 2024. A $1.14 billion non-prosecution agreement followed on May 23, 2025. Total Department of Justice resolution value, approximately $3.64 billion. Mark Forkner, the only individual ever criminally charged in the matter, was acquitted by a Fort Worth jury in under two hours on March 23, 2022. Dennis Muilenburg left Boeing in December 2019 with an exit package of approximately $62 million in vested compensation and pension benefits (Boeing publicly stated that no severance was paid).

A similar shared structural condition appears in two further Boeing programs across the 2014 to 2025 window, though each is documented separately in the primary-source record. The 787 program produced multiple quality-control whistleblower complaints from the Charleston facility, including those of John Barnett, the former Boeing quality manager who was found dead in Charleston during the week of his deposition in March 2024. According to NPR’s reporting, Barnett had been preparing to give civil testimony about quality-control failures at the Charleston plant. The deposition was unfinished at the time of his death.

The 737 MAX 9 produced the Alaska Airlines 1282 door-plug blowout of January 5, 2024, which the NTSB June 24, 2025 board meeting (adopting the AIR-25-04 probable cause determination, with the full final report published thereafter) attributed to inadequate Boeing training, guidance, and oversight.

The four bolts intended to retain the door plug were missing. According to the NTSB June 24, 2025 board determination, the door-plug fabrication and the Boeing installation that followed were both governed by the supplier-base architecture Partnering for Success had restructured a decade earlier. This is inference: the NTSB report does not phrase the finding this way, but the supplier-pressure record documented in the House Transportation Committee’s 2020 final report is the architecture inside which the 2024 NTSB findings on training, guidance, and oversight sit.

Three programs, each substantiated separately in the primary-source record, share a common structural condition: an incentive architecture in which financial judgment governs at the margin. (This is inference: the dossier substantiates the McDonnell Douglas merger, the headquarters move, and the post-2013 capital-return cycle as separate facts; treating them as a unified mechanism is the article’s synthesis.) The framework that examines all three is structural rather than biographical. The McDonnell Douglas merger of August 1997 imported a financial-priority management system into a firm that had previously been engineering-led. The 2001 headquarters move from Seattle to Chicago geographically separated executive leadership from manufacturing operations. The post-2013 capital-return cycle locked the financial-priority system into compensation. Harry Stonecipher, the McDonnell Douglas executive who became Boeing CEO in 2003, stated explicitly: “When people say I changed the culture of Boeing, that was the intent, so that it’s run like a business rather than a great engineering firm.” On this reading, the sentence is the documentary record of the restructured culture; the dossier supports the quote verbatim, but the interpretive frame around it is the article’s.

On the 737 MAX specifically, the engineering judgment that produced the MCAS failure was not refused by an independent reviewer because the FAA had delegated the review to ODA-authorized Boeing engineers (per the JATR final report and the House Transportation Committee’s findings). Whether the same delegation pattern holds for the 787 Charleston quality holds and the 737 MAX 9 door-plug installation is inference: the dossier substantiates each program’s failure separately but does not formally trace each to the same delegation architecture. On one reading of the Stonecipher 2004 quote, the company was reorganized so that financial judgment, rather than engineering judgment, would govern at the margin; the quote itself is verbatim in the dossier, but the interpretive frame around it is the article’s.

What to Watch Next

Two indicators on the current public record bear watching. First, the FAA’s September 2025 decision to restore limited delegation authority to Boeing for both 737 MAX and 787 airworthiness certificates, on alternating weeks with FAA personnel, restores in attenuated form the Organization Designation Authorization architecture the JATR final report identified as having permitted MCAS to be certified piece by piece without integrated-function review. Whether the alternating-week structure produces meaningfully different oversight than the pre-2019 structure is an empirical question the next NTSB or House Transportation report will answer. Second, the John Barnett deposition record, which was scheduled to take testimony from Boeing executives about 787 Charleston quality control before he was found dead during deposition week in March 2024, has not been replaced by an equivalent body of sworn testimony. According to NPR’s reporting, the civil-discovery questions Barnett was prepared to address remain unanswered on the public record.

The MCAS System Safety Analysis Boeing originally submitted to the FAA still describes a system with 0.6 degrees of stabilizer authority, limited to high-speed flight. Whether the architectural conditions that surrounded that document, capital-return primacy, supplier cost-out, and delegated regulation, have been deliberately changed is the open question Boeing’s next 10-K, due February 2026, will begin to answer. The same question, applied to a different revenue-model architecture, opens THE REAL MODEL, the next series in this catalog. The post-2019 FAA delegation reforms have been described by the agency as oversight improvements; on the article’s reading, the 2025 alternating-week restoration is also an operational compromise (this is inference: the FAA’s published characterization is reform, not compromise). Whether anyone inside the FAA certification staff is currently empowered to ask the harder question is what the next filing will not disclose.

The 2025 FAA decision to restore Boeing’s authority to certify portions of its own work begins generating its public record now.

Every empire has one.*