The initial design of the Maneuvering Characteristics Augmentation System (MCAS) on the Boeing 737 MAX relied on a single Angle of Attack (AOA) sensor and inadequate pilot training, contributing to two fatal accidents, the Lion Air Flight 610 and the Ethiopian Airlines Flight 302, within five months, resulting in the loss of 346 lives. While prior studies have addressed technical or organizational factors in isolation, this paper presents a systemic analysis aimed at linking the causes of failures and how they led to changes in system design. The methodology employs an integrated approach using two accident causation models, the Swiss Cheese Model for mapping out the alignment of latent failures and the Systems-Theoretic Accident Model and Process (STAMP) for analyzing the hierarchical deficiencies in the control structure of the system. The analysis confirms that systemic breakdown across engineering, regulation, and training created the pathway to the accidents. Following the accidents, fault tolerance was successfully implemented in the redesigned system, furthermore, a verified record of zero critical failures across millions of flight hours has been achieved, strengthening the system. Quantitatively, simulations utilizing Root Mean Square Error (RMSE) were carried out to examine the system’s control logics in comparison, providing numerical evidence of improved system stability from 1.68° to 0.79°. The study concludes that while the redesigned system is a necessary corrective safety response, the safety of systems depends on robust structural redundancy and mandatory fault tolerance, which must be incorporated at the design stage in line with regulatory requirements for all future flight control systems.
David et al. (Sun,) studied this question.