Flight control software pushes the nose down on one bad sensor

Software acting on one faulty sensor kept trimming the nose down. Most pilots did not know it existed, and a late change that gave it more authority was never fully reassessed.

Date: 2018–2019
Kind of system: Conventional automation, included as a precedent
Outcome: Harm

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G5 Blind to the total G6 No independent evidence G7 Review in name only G11 Safeguard off G12 Unreviewed change

What happened

MCAS commanded nose-down stabilizer trim based on one of the airplane’s two angle-of-attack sensors. Each command moved the stabilizer a fixed amount regardless of where it already was, and the system reset and commanded again after the pilots used their trim switches. On Lion Air 610, on 29 October 2018, this happened more than 20 times. On Ethiopian 302, on 10 March 2019, MCAS triggered four times in about six minutes.

In 2016 Boeing had extended MCAS to low speeds and given it more authority, and the certification documents and safety assessments were not consistently updated. References to MCAS were taken out of the pilots’ manual, and an alert showing that the two sensors disagreed did not work on most of the fleet. The FAA’s fixes made MCAS compare both sensors and activate once per event, and capped how far it can move the stabilizer.

What allowed the action to take effect

G5 Blind to the total
Each action was allowed one at a time. Nothing tracked what the actions added up to in volume, rate, exposure, or repetition until the total did the harm.
“All MCAS commands were incremental commands, which moved the horizontal stabilizer a fixed amount, regardless of the current position of the stabilizer,” and the system reset after each pilot trim input. The fix permits “only one activation of MCAS per sensed high-AOA event.”
Kind of evidence: finding. Source: Federal Aviation Administration, 18 November 2020, pp. 8–9.
Related guidance: P8 Sequence awareness. Contract clause C-8.
G6 No independent evidence
The action, or the approval of it, was based on the system’s own output or on a single unverified input. Evidence that would have shown the error was never gathered, was thrown away, or was available and not consulted.
“Erroneous data from a single AOA sensor activated MCAS.” The reading of the second sensor was not used to check it until the fix.
Kind of evidence: finding. Source: Federal Aviation Administration, 18 November 2020, pp. 7–9.
Related guidance: P6 Signer independence and P4 Reviewable policy. Contract clause C-6.
G7 Review in name only
A person was supposed to catch the error but lacked the information, time, training, or practical means to do it, so the review did not work as a check.
Boeing “expected that pilots, who were largely unaware that the system existed, would be able to mitigate any potential malfunction.” The FAA found that the crews “were unable to effectively manage the stabilizer movement and multiple flight deck effects.”
Kind of evidence: finding. Sources: House Committee on Transportation and Infrastructure, majority staff, September 2020; Federal Aviation Administration, 18 November 2020. References: House report p. 13; FAA summary p. 8.
Related guidance: P5 Human authority. Contract clause C-5.
G11 Safeguard off
A check that could have caught the action existed but was switched off, bypassed, set to approve automatically, or not working when the action happened.
The AOA Disagree alert, meant to be standard, was tied to an optional display, “the result of which was to render the AOA Disagree alert inoperable on more than 80 percent of the MAX aircraft.”
Kind of evidence: finding. Source: House Committee on Transportation and Infrastructure, majority staff, September 2020, pp. 22–23.
Related guidance: P3 Fail-closed. Contract clause C-3.
G12 Unreviewed change
The change that introduced the harmful behavior went live without independent review. The change can be code, a prompt, a model, a package, a configuration, or a procedure.
The redesign that extended MCAS to low speed was not carried through the safety work: “the SSA and functional hazard assessment (FHA) were not consistently updated.” In 2021 Boeing admitted that two of its pilots concealed the expanded scope of MCAS from the FAA group that set pilot training.
Kind of evidence: finding. Sources: Joint Authorities Technical Review, 11 October 2019; U.S. Department of Justice, 7 January 2021. References: JATR executive summary, p. VI; agreement, Statement of Facts ¶ 35.
Related guidance: P4 Reviewable policy and P2 Independence. Contract clauses C-10 and C-4.

Entries with gaps in common

Sources

Official recordSummary of the FAA’s Review of the Boeing 737 MAXFederal Aviation Administration, 18 November 2020
Official recordFinal Committee Report: The Design, Development & Certification of the Boeing 737 MAXHouse Committee on Transportation and Infrastructure, majority staff, September 2020
Official recordBoeing 737 MAX Flight Control System: Observations, Findings, and RecommendationsJoint Authorities Technical Review, 11 October 2019
Court recordDeferred Prosecution Agreement, United States v. The Boeing CompanyU.S. Department of Justice, 7 January 2021

Cite this entry

External Control Layer. (2026). Entry 6: Flight control software pushes the nose down on one bad sensor. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-6

@misc{ecl_cgr_6,
  author = {{External Control Layer}},
  title = {Entry 6: Flight control software pushes the nose down on one bad sensor},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-6},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 6” in the subject line.

Write the email

Facts about this incident

When: 29 October 2018 (Lion Air 610) and 10 March 2019 (Ethiopian Airlines 302)
Who: Boeing, with the FAA as certifying authority; Lion Air and Ethiopian Airlines
System: MCAS, a control law in the 737 MAX flight control computer
Kind of system: Conventional automation
Precedent: The system is older automation rather than AI. The incident is included because the controls that failed are of the same kind, and it is counted separately from the AI incidents.
Sector: Transportation
Action: Repeatedly commanded nose-down stabilizer trim based on erroneous data from one angle-of-attack sensor.
Why it acted: Conventional fault. An erroneous angle-of-attack reading. On the Lion Air aircraft, the replacement sensor had been mis-calibrated during an earlier repair.
Outcome: Harm. Two crashes killed 346 people: 189 on Lion Air 610 and 157 on Ethiopian Airlines 302.
Confidence: High. FAA and international technical review findings, a congressional committee’s majority staff report, and admissions in Boeing’s 2021 agreement with the Justice Department.