Boeing 737 MAX and MCAS: a design change and its safety assumptions
The MCAS design changed during development; the safety assessment and pilot information did not reflect the evolved system.
- Programme
- Boeing 737 MAX, MCAS
- Year
- 2018–19
- Sector
- Aerospace & Defence
- Outcome
- Two accidents; 346 people died
What happened
Two accidents involving the Boeing 737 MAX resulted in the deaths of 346 people.
The design of MCAS changed during the aircraft's development.
What was found
Investigation and review reports, including the KNKT final report, the JATR report and the US House Committee final report, found that the safety assessment and the information provided to pilots did not reflect the system as it had evolved.
Engineering lesson
Safety assessments are built on assumptions about how a system behaves. When the design changes, those assumptions may no longer hold, even if nobody revisits them.
A design change without full impact analysis can silently invalidate earlier safety assumptions, and with them the information given to the people who operate the system.
The practice this points to
Link every safety assumption to the design elements it depends on, so a change to the design triggers a review of the assumption.
Include operator information, such as pilot documentation and training material, in the scope of change impact analysis.
Where Kelvora fits
Kelvora is a requirements and assurance platform that links safety assumptions, requirements and design elements so that a change can be traced to what it affects. It flags potential impacts for engineers to assess; it does not decide whether a change is safe.
Sources
- KNKT, final investigation report (2019).
- Joint Authorities Technical Review (JATR), report (2019).
- US House Committee, final report (2020).