Boeing

The 1997 merger changed where technical authority had to travel

The 737 MAX was not caused by a corporate merger in 1997. Its design program began fourteen years later, and the accident investigations identified a chain of aircraft-design, certification, maintenance, training, and crew-performance factors.¹²³ The merger with McDonnell Douglas is governance context: it changed senior leadership and became part of a later argument about what Boeing valued and how technical evidence reached executives.⁴

Boeing chief executive Phil Condit remained chief executive of the combined company, while McDonnell Douglas chief executive Harry Stonecipher became president and chief operating officer. In 2001 Boeing moved a corporate staff of roughly 500 from Seattle to Chicago. Condit presented distance from operating units as a way to keep the corporate center focused on strategy. Former employees later described the move and Stonecipher's leadership as part of a shift toward cost, shareholder returns, and business-unit separation. The House Transportation Committee's Democratic majority staff and journalist Jerry Useem both reconstructed that cultural argument; neither source establishes that the merger itself caused either crash.⁴

Commercial aircraft cannot be governed by engineering alone. Airlines must be able to afford and operate them, factories and suppliers must build them, and regulators must certify them. The relevant post-merger question is therefore not whether finance displaced engineering altogether. It is whether the institution could make dispersed technical evidence authoritative when it conflicted with a commercial program already in motion.

An airline order made commonality a design requirement

Airbus announced the A320neo in 2010. In July 2011 American Airlines selected Airbus and Boeing narrow-body aircraft and agreed to order 100 of a re-engined 737, subject to Boeing board approval. Boeing's own announcement described up to 300 aircraft, while the later House investigation situated the order in a rapid competitive decision to launch the MAX as a 737 derivative.¹

Commonality was a real operating benefit and a program constraint. A derivative could share pilots and maintenance arrangements with existing 737 fleets. Boeing sought the FAA's Level B differences-training determination, which did not require full-flight-simulator training, and accepted contractual exposure with Southwest Airlines if more training became necessary. The House majority staff treated those commitments as pressure on later training decisions, not as proof that commonality itself was unsafe.⁵

CFM International's larger LEAP-1B engine supplied the promised efficiency. Boeing mounted it higher and farther forward than the previous engine, changing the aircraft's pitch characteristics in parts of the flight envelope. The Joint Authorities Technical Review (JATR) described MCAS as one of the systems added with the engine and structural changes. CFM supplied propulsion; Boeing remained responsible for integrating the engine, airframe, flight controls, pilot response, and certification basis into one aircraft.⁶

MCAS grew while its safety account stayed small

Engineers answered the handling problem with the Maneuvering Characteristics Augmentation System (MCAS). In manual flight with flaps up and at elevated angle of attack, MCAS could command nose-down stabilizer movement. During development its function expanded into low-speed flight, its command authority increased, and pilot electric-trim input could reset it for another activation. The certified design used one of the aircraft's two angle-of-attack sensors at a time. A single erroneous input could therefore produce repeated nose-down commands.⁷

Warnings existed in pieces. The House majority staff documented a 2015 employee question about vulnerability to one sensor and a 2016 simulator encounter in which chief technical pilot Mark Forkner was surprised by MCAS behavior. It also found that design changes were not consistently carried into the system safety analysis and information sent to the FAA. These are investigative staff findings based on internal records; they show incomplete integration across control-law design, safety analysis, certification, technical-pilot work, and training, not that any one message predicted the two accident sequences.⁸

Boeing removed most MCAS references from pilot manuals and did not include the system in MAX differences training. That decision preserved a limited training footprint. It also assigned pilots a central role in the hazard analysis without giving them the name, trigger, or behavior of the system they might have to counteract.⁹

An independent Seattle Times investigation reported from current and former engineers and details of Boeing's system safety analysis that the assessment understated MCAS command authority, omitted the effect of repeated reset and activation, and still permitted a hazardous function to depend on one sensor. The later House and JATR records support the central integration failures. The newspaper's partly anonymous-source reconstruction is corroboration, not the technical record used here to resolve accident causes.¹⁰

Delegated certification saw the aircraft in pieces

The Federal Aviation Administration did not simply let Boeing certify itself. Under the Organization Designation Authorization program, Boeing employees made specified compliance findings on the agency's behalf, while FAA specialists retained other findings and oversaw the delegation. Delegation is a routine way to use manufacturer expertise. It also placed some engineers under two authorities: the regulator whose finding they were making and the employer whose program had schedule and cost targets.¹¹

The international JATR found that FAA resource shortages constrained specialist involvement, that the agency had inadequate awareness of MCAS, and that Boeing employees performing delegated work reported undue pressure. It concluded that the certification process had evaluated discrete changes but had not adequately considered their cumulative effects, system integration, and human factors. It also found that some certification deliverables were not updated as MCAS changed.¹¹

The FAA certified the MAX in March 2017 with computer-based differences training and without a simulator requirement. Airlines received an efficient aircraft that fit existing fleets; Boeing met the commitment around which the program had been sold. Pilots received responsibility for the residual risk without the same picture of the system held by its designers.¹²

Lion Air turned a hidden assumption into an emergency

On October 28, 2018, a Lion Air MAX flying from Bali to Jakarta received a false high angle-of-attack signal. MCAS repeatedly commanded nose-down trim. The crew, helped by an off-duty pilot in the cockpit, countered the commands and landed. Maintenance work after the flight did not expose the whole failure. The continuous stick-shaker activation and use of the runaway-stabilizer checklist were not entered in the aircraft flight and maintenance log, so neither Jakarta maintenance personnel nor the next crew received that information.¹³

The next morning, Lion Air Flight 610 left Jakarta with captain Bhavye Suneja, first officer Harvino, six other crew members, and 181 passengers. A faulty angle-of-attack signal produced a stick shaker, disagreeing indications, and repeated nose-down MCAS commands. The pilots repeatedly used electric trim to raise the nose, only for MCAS to move it down again. They searched the flight manual for an explanation of a system the manual did not name. Twelve minutes after takeoff, the aircraft struck the Java Sea. All 189 people aboard died.¹⁴

Indonesia's National Transportation Safety Committee (KNKT) did not assign the accident to one actor. Its nine contributing factors included assumptions about pilot response, incomplete review of multiple flight-deck effects, single-sensor MCAS design, missing manual and training guidance, a disabled AOA-disagree alert, sensor repair and installation failures, incomplete maintenance records, and flight-crew performance and workload. The report therefore joins design, certification, maintenance, communication, and operations without making any of them an excuse for the others.²

Boeing and the FAA responded with instructions to use the established runaway-stabilizer procedure while Boeing developed a software change. That kept the fleet in service and treated trained pilot action as the immediate barrier. The first crash became a disputed signal rather than an event that displaced the program's operating assumptions.¹⁵

Ethiopian Airlines made the cost 346 lives

On March 10, 2019, Ethiopian Airlines Flight 302 departed Addis Ababa for Nairobi. Shortly after takeoff the left angle-of-attack signal became erroneous, MCAS activated, and multiple warnings competed for the pilots' attention. The crew moved the stabilizer-trim cutout switches to cutout, but the aircraft was already fast and badly out of trim. Electrical trim later became available again; MCAS commanded another nose-down movement. The aircraft struck terrain near Ejere about six minutes after takeoff, killing all 157 people aboard.¹⁶

The Ethiopian Aircraft Accident Investigation Bureau (EAIB) identified repeated uncommanded MCAS inputs from erroneous angle-of-attack data as the probable cause and listed MCAS design, warning, training, and documentation failures as contributing factors. The U.S. National Transportation Safety Board agreed that MCAS and related systems played a central role but rejected the EAIB's proposed electrical explanation for the sensor failure; its analysis found a foreign- object impact, most likely a bird, better fit the evidence. France's BEA agreed on MCAS's contribution but said the final report insufficiently analyzed crew actions, training, experience, and airline organization. Those are material disputes over initiation and crew contribution, not disputes about the deaths or the repeated MCAS commands.³

After Lion Air, the NTSB separately concluded that the certification assumptions had not adequately considered the multiple alerts and indications confronting the crews. Recommendations A-19-10 through A-19-16 called for more realistic assumptions about pilot response and for system-safety assessments to include the combined effects of alerts and flight-deck indications.¹⁷

The dead were not an output measure appended to a technical failure. They were the people to whom every upstream assurance was owed. Relatives of people killed on both flights testified to Congress, participated in regulatory and judicial proceedings, and later challenged the government's criminal resolutions. Their participation changed who was present when institutions decided what counted as repair and accountability.¹⁸

Return to service repaired a design; accountability stayed divided

Regulators grounded the MAX worldwide after the Ethiopian crash. During the twenty-month U.S. grounding, Boeing changed MCAS to compare both angle-of-attack sensors, limited its authority and repetition, revised cockpit indications and procedures, and accepted simulator training. The FAA conducted its own flight testing and retained final approval of each new MAX rather than delegating it. The FAA's return-to-service review documents the new sensor comparison, single MCAS activation per high-angle-of-attack event, command limit, revised procedures, and training requirements. It establishes what the agency reviewed and required; it does not by itself evaluate Boeing's wider culture.¹⁹

Institutional responsibility remained harder to integrate. A Delaware court allowed shareholders' oversight claims against Boeing directors to survive a motion to dismiss. The ruling decided that the complaint adequately pleaded an absence of a board-level airplane-safety reporting system and failure to respond to a red flag; it did not decide those allegations after trial. The litigation later ended in a $237.5 million insurer-funded settlement and governance reforms, including enhanced board safety reporting.²⁰

The Justice Department charged Boeing in 2021 with conspiring to defraud the FAA group that determined pilot-training requirements. A deferred prosecution agreement imposed a criminal penalty, airline compensation, and a fund for families while locating the admitted deception principally in the work of two technical pilots. In 2022, a federal judge held that relatives of crash victims were crime victims directly and proximately harmed by that conspiracy. After a court rejected a proposed guilty plea, the department reached a non-prosecution agreement in 2025 and obtained dismissal of the charge. Several families petitioned the Fifth Circuit. A panel denied mandamus on March 31, 2026, and on May 22 denied both panel and en banc rehearing. That is the latest appellate disposition located as of July 14, 2026; describing the case as still awaiting rehearing would now be wrong.²¹

The 2024 door-plug accident exposed a manufacturing system

On January 5, 2024, the left mid-exit door plug separated from a newly delivered Alaska Airlines 737-9 during climb, causing rapid depressurization. One flight attendant and seven passengers received minor injuries; 164 passengers and the remaining crew were uninjured. The NTSB found that four securing bolts were missing before delivery. Boeing personnel had opened the plug for nearby rivet rework without generating the required removal record, and it was closed without the bolts or a quality-assurance inspection.²²

The NTSB's June 2025 probable-cause finding assigned the accident to Boeing's failure to provide the training, guidance, and oversight needed for workers to follow the parts-removal process consistently. It identified the FAA's ineffective compliance-enforcement surveillance and audit planning as a contributing factor. The report also found a decade-long history of problems with the relevant work instruction, ineffective corrective actions, inadequate change management as workforce experience declined, and weaknesses in both Boeing's and the FAA's record systems. This was a manufacturing and oversight failure, not a recurrence of the original MCAS design.²³

An FAA-appointed expert panel had separately reviewed Boeing's safety culture, safety-management system, and ODA structure. Its February 2024 report, based on more than 4,000 pages of documents, seven surveys, more than 250 interviews, and visits to six sites, reported a disconnect between senior management and other employees, confusing safety processes, and continuing opportunities for retaliation against employees performing delegated functions. It issued 27 findings and 53 recommendations. In April 2024 Boeing quality engineer Sam Salehpour then told a Senate subcommittee that he had faced pressure and retaliation after raising 787 and 777 manufacturing concerns. His specific engineering allegations remain testimony, not findings adopted here; they are included as a worker's account of the reporting environment.²⁴

After the door-plug accident, the FAA audited Boeing's production line, reported noncompliance in manufacturing-process control, parts handling and storage, and product control, increased onsite inspection, and halted 737 MAX production expansion. In May 2024 it required a corrective roadmap covering employee reporting, work instructions, supplier oversight, training, audits, and safety- management measures. In September 2025 the FAA restored only limited delegation of some 737 MAX and 787 airworthiness certificates on alternating weeks; it said direct production oversight and attention to worker reporting would continue. An October 2025 FAA statement said those controls remained in place when it approved a small production-rate increase.²⁵

Boeing reported on May 27, 2026, that it had completed an FAA capstone review and was moving 737 production toward 47 aircraft per month. That is a company account of its progress. The latest FAA public production-rate statement located before July 14, 2026, is the October 2025 statement. The public regulatory record cited here therefore does not independently verify Boeing's May 2026 rate or establish that the production-quality program is complete.²⁶

Repairing one interface did not repair authority for the whole

The same fragmentation that produced the MAX complicated its reckoning. Boeing integrated the aircraft, suppliers provided components, airlines demanded economics, employees represented the FAA, regulators approved the design, and pilots met the failure in flight. Those boundaries made many decisions look reasonable from one participant's vantage and offered a place to relocate blame. The two crashes joined those decisions in a way the organization had not: the sales promise shaped the design, the design shaped the certification account, that account shaped what pilots knew, and what pilots knew shaped the final minutes of 346 lives.²⁷ It was a lethal form of organizational ignorance: relevant knowledge existed in many places without becoming a shared warning authoritative enough to change the program. The MAX could return to service after its interfaces were redesigned. The door-plug accident showed that a different interface—between rework, documentation, training, inspection, and oversight— could still fail. Whether Boeing has rebuilt authority for the whole remains open.

Herkert, Borenstein, and Miller analyze the MAX as an engineering-ethics case in which the “problem of many hands” can make responsibility difficult to assign without making complexity an excuse. They argue for stronger institutional support for engineer voice and for public safety as the governing professional obligation. Their peer-reviewed article interprets government reports and journalism; it contributes an ethical lens, not independent accident findings.²⁸

Comparative fingerprint

On the three-point comparative scale, score 3 marks coordination, communication, and common understanding, knowledge, expertise, and professional autonomy, learning, quality, and reliability, governance, stewardship, and accountability, culture, informal organization, trust, and voice, and organizational ignorance. Score 2 marks authority, legitimacy, and acceptance, delegation, decentralization, and responsibility, structure, hierarchy, and scale, decision-making, judgment, and bounded rationality, and strategy, competition, and adaptation. Score 1 marks purpose, mission, and institutional legitimacy, measurement, accounting, and control, work design, productivity, and automation, and executive attention, information, and organizational sensing. Score 0 leaves cooperation, incentives, and organizational equilibrium and innovation, entrepreneurship, and renewal outside the organizing comparison. Both appear in the history; neither organizes the account as directly as the movement and authority of safety-critical knowledge.

Authority combines market-capital, professional-expertise, and state-bureaucracy; decisions sit in central-executive, divisional, professional-cell, and rule-bound-hierarchy loci inside a public-corporation. Coordination uses hierarchy, standards, planning, and teams, while knowledge is coded as bidirectional, specialist-staff, and embedded-practice. Measurement spans financial, operational, quality, and mission modes. Learning appears through after-action-review, formal-research, and doctrinal-revision; adaptation combines central-reconfiguration, local-iteration, and slow-institutional-change. The named beneficiaries are customers, workers, shareholders, and state-and-public, while the recurring failure risks are suppressed-voice, metric-gaming, siloing, and externalized-harm. These are comparative classifications of the cited record, not terms used by Boeing, the regulators, or the accident investigators and not empirical ratings of current performance.²⁹

The documented consequences reach passengers and crews, engineering and production workers, suppliers, public institutions, crash families, and shareholders.^23202324 Ecological effects, nonhuman life, and future generations remain research-needed: the present sources do not establish a Boeing-specific direction or magnitude for those consequences.

Paths into deeper study

• Compare Boeing's reported 2026 production gains with later FAA inspection, quality-escape, and employee-reporting evidence.
• Add union, mechanic, engineer, supplier-worker, pilot, and family records that are not fully preserved in the official investigations used here.
• Trace Boeing-specific climate, airport-noise, material, waste, land, water, nonhuman-life, community, and lifecycle effects without treating aviation-wide estimates as company-level findings.