737 MAX MCAS: how delegated authority certified a single-point failure

I have run enough PFMEA sessions to know the moment when a room full of engineers looks at a single-point failure on a safety-critical function and decides, collectively or by omission, that it is acceptable. Rarely dramatic. Usually quiet — a column left blank, a severity rating rounded down, a redundancy assumption carried forward from an earlier design that no longer applies. The 737 MAX MCAS story is what that quiet decision looks like when it scales to 387 aircraft and 346 coffins.

The situation

Boeing faced a commercial problem. Airbus's A320neo was winning orders with fuel-efficient engines. Boeing's answer was to re-engine the 737 rather than design a clean-sheet aircraft. The larger LEAP-1B engines sat further forward and higher on the wing, changing pitch characteristics at high angles of attack. MCAS was added to compensate — and Boeing needed the FAA to treat the MAX as an amendment to an already-certified type, not a new aircraft requiring full pilot type-rating training.

The FAA's Organization Designation Authorization program allows manufacturers to use their own technical staff as designated representatives who perform certification work on the agency's behalf. Built on trust, capability and structural separation between commercial and certification functions. By the time MCAS was being validated, that separation had eroded to the point where Boeing's ODA representatives reported into management chains with a direct interest in certification speed.

How it unfolded

MCAS was originally conceived with limited authority — about 0.6 degrees of stabilizer movement, triggered once per high-AOA event. During flight testing, Boeing discovered the aerodynamic issue was worse than expected. MCAS authority was increased to 2.5 degrees per activation, and the system could reset and reactivate with no lockout. Each time the pilot pulled back on the column, MCAS would wait, then command nose-down again.

The 2.5-degree figure matters. The 737 horizontal stabilizer has roughly 5 degrees of travel needed to counteract full elevator at high speeds. Two MCAS inputs could push the aircraft toward an unrecoverable dive. On both flights, a single angle-of-attack sensor provided erroneous data. MCAS activated. The crews fought a system that could repeat its command indefinitely while they struggled to identify, in the absence of any training or documentation, what was happening to their aircraft.

Root-cause anatomy

The technical root cause is a textbook single-point failure: one sensor, one signal path, one system with authority to command stabilizer movement exceeding a pilot's physical ability to counteract through the control column. No voting logic. No redundancy requirement triggered. No fail-safe beyond the crew's ability to identify and use the stabilizer trim cutout switches — a procedure neither trained nor documented for this failure mode.

The certification review of MCAS was conducted by Boeing employees operating under FAA delegation. The quality gate — independent verification that the system met airworthiness requirements — was staffed by the same organisation that had a schedule and cost incentive to conclude that it did. When the people auditing the risk report to the people managing the budget, the audit loses its teeth.

Where the quality system failed

Somewhere in the design FMEA, there should have been a row — or a chain of rows — that read: erroneous AOA input → MCAS activates erroneously → repeated uncommanded nose-down trim → loss of control → catastrophic. The severity is Category 10. The occurrence, given a single-sensor architecture flying thousands of cycles daily, is not negligible. The detection, absent pilot training or cockpit documentation, is effectively zero. That row either did not exist in that form, or it was not escalated to a design change.

The decision to increase MCAS authority from 0.6 to 2.5 degrees should have triggered a change-control review — an APQP gate that re-examined failure modes under the new parameters. It did not change the certification basis. Under AS9100, the internal audit function must be independent of the area being audited. The ODA model tested this principle to breaking point.

A quality system is only as strong as the independence of the person who is allowed to say no.

The CAPA gate after Lion Air 610 is the other failure. An interim design change was developed, but the global fleet continued to fly for four months until Ethiopian Airlines 302 made the same failure mode undeniable.

What would have caught it

Three controls, any one of which properly executed, would have prevented this. A PFMEA review that explicitly tracked single-sensor dependency on a flight-critical function as Severity 10 with an open action for redundancy or dissimilar voting logic. A change-control gate that re-triggered the full certification review when MCAS authority quadrupled — 0.6 to 2.5 degrees is not an incremental tweak. It is a fundamental change in the system's ability to overpower the crew. An independent certification authority, genuinely separate from the manufacturer's commercial structure, with the mandate and technical capacity to challenge the single-sensor architecture before entry into service.

The second crash was preventable through a CAPA gate after the first. The fleet should have been grounded on 29 October 2018. It was not, because the post-incident risk assessment did not treat the failure mode as systemic.

My take

I spend my working life in AS9100 environments. I have been the person responsible for audit independence — for ensuring that the person signing off a process change is not the person who proposed it. The 737 MAX case is the most expensive argument I know of for why that separation matters.

In my own career — building a greenfield QA function for 900+ employees at SNOP, leading quality across multi-site operations, and now in my role at Airbus — the principle holds at any scale. When I cut an audit finding or sign a PFMEA, I am exercising authority that someone downstream will depend on. Delegated authority can work. It can also degrade into a quality team under cost pressure that treats FMEA rows as paperwork rather than decision points. The distance between those two states is smaller than most executives realise.

The 737 MAX MCAS crashes killed 346 people because a quality system designed to prevent exactly this category of failure was operated by the organisation that needed it to pass. The single sensor was the mechanism. Delegated authority was the enabler. The empty PFMEA row was the silence at the centre of it all. When your quality system cannot independently say no, everything downstream — the engineering, the certification, the aircraft — is built on a foundation that holds only until the specific failure you chose not to write down decides to show up.