Part A decision time: August 30, 2011, 9:00 a.m. PDT
Part A knowledge cutoff: August 29, 2011, 11:59:59 p.m. PDT
Outcome horizon: Through Boeing's February 1, 2021 Form 10-K filing
Outcome classification: Failure, with causal weights and aggregate financial attribution unresolved
This instructor note reveals evidence unavailable to the Part A decision maker. It is bound to canonical Part A digest 67a79beae8a8093f4f971eebbcb3f832ff8150dbf24b10df938eecea9d5c4f5d. The structured ledgers, exact excerpts, reported facts, assumptions, conflicts, and judgments are authoritative over this narrative.
Outcome in one sentence
Boeing announced the re-engined 737 launch, and the later record includes two fatal accidents, a worldwide grounding, official findings about system-safety, certification, oversight, and human-response assumptions, required remediation, material MAX-specific financial indicators, and a deferred prosecution agreement. That sequence supports a system-safety-governance failure hypothesis, but it does not establish that the 2011 launch decision alone caused the accidents or that every dollar of Boeing's later financial deterioration was caused by the MAX. source · boeing.2011-737-launch source · faa.737-max-rts-text source · faa.jatr-2019-text source · ntsb.asr-19-01-text
What Boeing actually did
On August 30, 2011, Boeing announced that its board had approved launch of a new-engine 737 variant based on commitments for 496 aircraft from five airlines. This verifies the announced action one day after the Part A knowledge cutoff. It does not establish the final architecture, certification evidence, training basis, program return, or accident causality. source · boeing.2011-737-launch
The actual action therefore differed from Part A's preferred decision architecture. Part A recommended authorizing reversible development work while conditioning final customer, schedule, production, and certification commitments on independent aircraft-level safety, human-factors, supplier, and downside-return gates. The public launch release describes board approval and customer commitments; it does not show whether internal gates equivalent to that recommendation existed or were enforced. [judgment.boeing.cutoff.gated-reengine; assumption.boeing.cutoff.integrated-safety-gate; @src.boeing.2011-737-launch]
What each later source can—and cannot—establish
| Record | Evidentiary role in this case | Important limit |
|---|---|---|
| FAA return-to-service review | Government record of the two accidents, fatalities, grounding sequence, and required return-to-service actions | It is not used here as a complete accident probable-cause allocation |
| JATR report | Official multi-authority technical review of MAX flight-control certification, change control, delegation, and integrated assessment | It identifies certification-process findings; it does not assign a complete percentage of accident causality |
| NTSB ASR-19-01 | Official safety-recommendation report on assumed versus observed pilot response, multiple alerts, workload, and interacting factors | It identifies safety issues and recommendations, not a controlled causal allocation among every factor |
| House Committee report | Congressional investigative characterizations of production pressure and faulty assumptions, plus quoted opposing views on a new type certificate | Committee characterizations and quoted views are attributed; they are not relabeled as JATR, NTSB, or FAA findings |
| Executed DPA and Statement of Facts | Boeing's acceptance of specified facts concerning charged fraud and information conduct, plus the agreed monetary amount | The accepted facts are not presented as an accident probable-cause determination |
| Boeing 2020 Form 10-K | Filed reported financial values, MAX-specific charges and liabilities, and management's description of overlapping financial drivers | Management's driver discussion is a company claim; consolidated changes are not a MAX-only causal bridge |
This separation is essential. Conflating these source roles would turn attributed characterizations, accepted legal facts, and company explanations into a single unsupported causal verdict. [claim.boeing.outcome.jatr-design-change-control; claim.boeing.outcome.ntsb-human-factors; claim.boeing.outcome.house-competitive-pressure; claim.boeing.outcome.dpa-accepted-concealment; claim.boeing.outcome.financial-confounders]
Human and operational outcome
The FAA's return-to-service review records that Lion Air Flight 610 crashed on October 29, 2018, and all 189 people on board perished. It records that Ethiopian Airlines Flight 302 crashed on March 10, 2019, killing all 157 people on board. The same review records the subsequent worldwide fleet grounding and the FAA's March 13, 2019 Emergency Order grounding the 737 MAX. source · faa.737-max-rts-pdf source · faa.737-max-rts-text
| People on board who perished | Lion Air Flight 610 | Ethiopian Airlines Flight 302 |
|---|---|---|
| FAA-reported fatalities | 189 | 157 |
Source lineage: table.boeing.outcome.accident-fatalities, fact.boeing.outcome.lion-air-fatalities, and fact.boeing.outcome.ethiopian-fatalities. The case preserves the two reported values separately and does not introduce an uncited combined casualty calculation.
Official technical and safety findings
JATR reported that certification deliverables were not updated as MCAS evolved, including relevant design assumptions, flight-deck effects, safety assessments, and workload effects. JATR also found that MCAS was not evaluated as a complete, integrated function in certification documents submitted to the FAA. These are official technical-review findings about process and evidence. source · faa.jatr-2019-pdf source · faa.jatr-2019-text
JATR further reported that the FAA oversight office responsible for Boeing delegated a high percentage of MAX compliance approvals and findings to Boeing's Organization Designation Authorization. Delegation is treated as part of the oversight mechanism, not proof that every delegated item was defective. [evidence.boeing.outcome.jatr-delegation; claim.boeing.outcome.jatr-delegation]
NTSB reported that multiple alerts increased workload and that actual pilot responses did not match the response assumptions used in Boeing's MCAS hazard classifications. NTSB also identified system design, training, airline operations, and prior pilot experience as relevant factors. The evidence therefore weighs against any monocausal account that ignores the operating context, while also showing that assumed operator mitigation required realistic validation. source · ntsb.asr-19-01-pdf source · ntsb.asr-19-01-text
The FAA's return-to-service record later included procedures for an angle-of-attack sensor system test and an operational-readiness flight. Those requirements show concrete remediation; they do not quantify how much a similar ex ante gate would have reduced risk. [evidence.boeing.outcome.faa-remediation; claim.boeing.outcome.faa-remediation; assumption.boeing.outcome.integrated-review-counterfactual]
Congressional characterizations and an unresolved certification counterfactual
The House Committee characterized financial pressure to compete with the Airbus A320neo as a central production-pressure theme affecting MAX design, development, certification, and oversight. It also characterized reliance on one angle-of-attack sensor and expected pilot mitigation as faulty assumptions. These propositions are recorded as the Committee's investigative characterizations, not silently promoted into FAA, JATR, or NTSB findings. source · house.737-max-report-pdf source · house.737-max-report-text
The same report preserves a real conflict about certification strategy. Experts interviewed by the DOT Special Committee said that a new type certificate would not by itself have produced more rigorous scrutiny or a safer MAX. A Boeing engineer quoted in the House report argued the opposite direction: amended certification avoided newer safety regulations and some modern alerting features. The case does not resolve that counterfactual. [evidence.boeing.outcome.house-new-tc-experts; evidence.boeing.outcome.house-new-tc-engineer; claim.boeing.outcome.new-tc-expert-view; claim.boeing.outcome.new-tc-engineer-view; conflict.boeing.outcome.new-tc-safety-effect; assumption.boeing.outcome.new-tc-effect]
Accepted DPA facts and legal outcome
In the executed deferred prosecution agreement, Boeing admitted, accepted, and acknowledged responsibility under U.S. law for the acts set out in the charging document and accepted the Statement of Facts as true and accurate. That Statement says two Boeing Flight Technical Pilots intentionally withheld and concealed MCAS's expanded operational scope from the FAA Aircraft Evaluation Group. This is strong primary evidence about the accepted information-conduct facts within the agreement's scope. It is not an accident probable-cause finding and is not used to allocate all accident causality. source · doj.boeing-dpa-pdf source · doj.boeing-dpa-text
| Agreed amount | January 7, 2021 |
|---|---|
| Total U.S. Criminal Monetary Amount, USD millions | 2,513.6 |
Source lineage: table.boeing.outcome.dpa-monetary and fact.boeing.outcome.dpa-total-monetary-amount. The agreement describes the total as a $243.6 million criminal penalty, $1.77 billion of airline-customer compensation, and $500 million of crash-victim beneficiary compensation. These are agreement components, not an estimate of total economic loss. [evidence.boeing.outcome.dpa-monetary; claim.boeing.outcome.dpa-monetary]
Reported financial outcomes
Every value below is as reported in Boeing's 2020 Form 10-K. The table establishes consolidated scale and direction; it does not allocate the changes to the MAX.
| USD millions | FY 2018 | FY 2019 | FY 2020 |
|---|---|---|---|
| Revenue | 101,127 | 76,559 | 58,158 |
| Operating cash flow | 15,322 | (2,446) | (18,410) |
| Total debt at year-end | 13,847 | 27,302 | 63,583 |
Source lineage: table.boeing.outcome.reported-financial-scale. Each value resolves to a reported metric fact and exact filing excerpt. source · boeing.2020-10k
The filing also discloses amounts labeled specifically to the 737 MAX:
| USD millions | FY 2019 | FY 2020 |
|---|---|---|
| Estimated customer-considerations charge | 8,259 | 498 |
| Abnormal production cost | Unknown in this extraction; not assumed zero | 2,567 |
| Customer-concessions liability at year-end | 7,389 | 5,537 |
Source lineage: table.boeing.outcome.max-cost-indicators. These values preserve different accounting concepts and periods. Charges, production costs, and liability balances are not mechanically summed. [evidence.boeing.outcome.2019-customer-charge; evidence.boeing.outcome.2020-customer-charge; evidence.boeing.outcome.2020-abnormal-cost; evidence.boeing.outcome.customer-liability; claim.boeing.outcome.max-financial-indicators]
Boeing attributed the 2020 Commercial Airplanes revenue decline to a combination of COVID-19, 787 production issues, and the 737 MAX grounding. That issuer explanation is evidence of material confounding, not an independently verified percentage allocation. Consequently, this case reports MAX-specific labeled amounts but abstains from assigning the consolidated revenue, cash-flow, or debt changes wholly—or by any unsupported percentage—to the MAX. [evidence.boeing.outcome.financial-confounders; claim.boeing.outcome.financial-confounders; conflict.boeing.outcome.aggregate-financial-attribution; assumption.boeing.outcome.financial-multi-causality; judgment.boeing.outcome.financial-attribution]
Process quality versus outcome quality
Part A did not predict these accidents or the displayed financial values. Its recommendation was to preserve reversibility and require an independent integrated gate before commercial commitments became difficult to reverse. Cutoff-valid FAA guidance already described integration of interrelated systems, fail-safe design, cross-functional evaluation, corrective-action assumptions, and warning quality. source · faa.ac-25-1309-1a-pdf source · faa.ac-25-1309-1a-text
Later JATR and NTSB findings are directionally aligned with those proposed gates: they identify stale or incomplete certification evidence, lack of complete integrated MCAS evaluation, and human-response assumptions that did not match observed responses. That alignment makes the ex ante process recommendation more credible. It does not prove that the process would have prevented either accident, that it was feasible in every detail, or that it would have generated a superior financial outcome. [judgment.boeing.outcome.system-safety-governance; assumption.boeing.outcome.integrated-review-counterfactual; assumption.boeing.outcome.partial-causal-attribution]
Outcome quality and decision quality therefore remain separate:
- The outcome was catastrophic in human terms and material in operational, legal, and financial terms.
- The launch release alone is not a causal finding.
- The frozen packet's gating logic is supported by later mechanism evidence, not validated by hindsight as a guaranteed prevention strategy.
- A clean-sheet alternative remains unquantified and disputed rather than retrospectively declared optimal.
Causal assessment
Primary hypothesis: system-safety governance
The best-supported unifying hypothesis is that evolving design, incomplete integrated certification evidence, fragmented oversight and information flow, and unvalidated human-response assumptions formed a system-safety-governance mechanism that contributed to the unsafe conditions later identified. [hypothesis.boeing.system-safety-governance; judgment.boeing.outcome.system-safety-governance]
The mechanism has complementary, but differently scoped, support:
- The House Committee characterized competitive and financial pressure as a central program theme; this supplies context rather than proof that commercial urgency alone caused the accidents. [claim.boeing.outcome.house-competitive-pressure]
- JATR reported that material certification documents did not keep pace with MCAS evolution and that MCAS was not assessed as a complete integrated function. [claim.boeing.outcome.jatr-design-change-control; claim.boeing.outcome.jatr-integrated-safety]
- JATR reported extensive delegation, while NTSB found a mismatch between assumed and observed human responses under multiple alerts. [claim.boeing.outcome.jatr-delegation; claim.boeing.outcome.ntsb-human-factors]
- Boeing accepted DPA facts describing concealment of MCAS's expanded scope from the FAA Aircraft Evaluation Group; this supports the information-flow element within the DPA's legal scope. [claim.boeing.outcome.dpa-accepted-concealment]
- The accidents and grounding were followed by remediation, direct MAX financial indicators, and legal consequences, but the consolidated financial endpoint remained confounded. [claim.boeing.outcome.faa-remediation; claim.boeing.outcome.max-financial-indicators; claim.boeing.outcome.dpa-monetary; claim.boeing.outcome.financial-confounders]
Confidence is moderate because multiple authoritative records identify complementary portions of the mechanism. It is not high because the selected record does not allocate causal shares across design, certification, training, operations, individual conduct, and other factors. [assumption.boeing.outcome.partial-causal-attribution]
Rival 1: new-certificate and legacy-architecture effects dominate
A credible rival argues that extending the legacy 737 under an amended type certificate—not review and governance failures within that path—was the dominant mechanism. The cutoff record showed a structural-change burden, and the House report preserved an engineer's view that amended certification avoided newer requirements and alerting features. [hypothesis.boeing.new-tc-legacy-architecture; claim.boeing.cutoff.structural-burden; claim.boeing.outcome.new-tc-engineer-view]
The contrary expert view in the same House report prevents a confident conclusion that a new certificate would itself have produced more scrutiny or a safer airplane. Without a requirement-by-requirement design and certification counterfactual, confidence in this rival remains low. [claim.boeing.outcome.new-tc-expert-view; conflict.boeing.outcome.new-tc-safety-effect; judgment.boeing.outcome.new-tc-counterfactual]
Rival 2: operational and external factors dominate
Another rival gives more weight to training, airline operations, prior pilot experience, and other operational factors for the safety endpoint, and to COVID-19 and other aircraft programs for the consolidated financial endpoint. NTSB and Boeing's filing establish that these factors cannot be ignored. [hypothesis.boeing.operational-and-external-factors; claim.boeing.outcome.ntsb-human-factors; claim.boeing.outcome.financial-confounders]
The rival cannot fully explain away the official integrated-design and certification findings, the accepted information-conduct facts, or directly labeled MAX costs. It is retained to prevent monocausal and salient-event reasoning, not to exonerate design or certification. [claim.boeing.outcome.jatr-integrated-safety; claim.boeing.outcome.dpa-accepted-concealment; claim.boeing.outcome.max-financial-indicators]
Counterfactuals
Independent integrated gates
A feasible process counterfactual was to authorize bounded derivative work while making binding schedule, production, certification, training, and customer commitments conditional on independent aircraft-level review. The review would keep certification documents synchronized with every material design change and test combined failures, alerts, workload, corrective action, maintenance, and training assumptions. [counterfactual.boeing.independent-integrated-gates; evidence.boeing.cutoff.faa-integration; evidence.boeing.cutoff.faa-cross-functional; evidence.boeing.cutoff.faa-crew-corrective-action; evidence.boeing.cutoff.faa-warning-quality]
This action is grounded in information available before launch and later evidence about the omitted or required work. But feasibility and direction are not an effect estimate. The public record does not show the delay cost, internal authority, complete design record, or whether the gate would have prevented either accident. No deterministic safety, cash-flow, or valuation model was run. [assumption.boeing.outcome.integrated-review-counterfactual]
Clean-sheet aircraft and new type certificate
A second feasible action was to continue the existing 737 while funding a clean-sheet replacement and accepting later entry. Customer urgency, structural burden, and development-resource risk were visible at cutoff. [counterfactual.boeing.clean-sheet-new-tc; evidence.boeing.cutoff.amr-boeing-commitment; evidence.boeing.cutoff.amr-airbus-order; evidence.boeing.cutoff.structural-change; evidence.boeing.cutoff.development-risk]
The packet did not contain a comparable clean-sheet schedule, cost, capacity, customer-retention, certification, or return case. Later sources still preserve opposing views about the safety effect of a new certificate. This alternative is therefore unresolved, not preferred through outcome knowledge. [assumption.boeing.cutoff.clean-sheet-timing; assumption.boeing.outcome.new-tc-effect]
Ex ante signals an agent should retain
- A customer fork is urgency, not a business case. AMR disclosed a conditional Boeing commitment and an A320neo order. That showed competitive pressure but did not establish whole-market demand, net pricing, margin, cancellations, or the value of one schedule. [evidence.boeing.cutoff.amr-boeing-commitment; evidence.boeing.cutoff.amr-airbus-order]
- Integration burden should trigger gates. Contemporaneous reporting identified structural change, and public FAA guidance described aircraft-level integration and realistic warning and crew-response analysis. Neither proved the derivative unsafe; together they made unconditional commitment evidentially weak. [evidence.boeing.cutoff.structural-change; evidence.boeing.cutoff.faa-integration; evidence.boeing.cutoff.faa-warning-quality]
- Consolidated financial capacity is not program readiness. Cash flow and backlog supported bounded investigation, while debt, inventory, research-and-development spending, and existing program demands limited the inference. [evidence.boeing.cutoff.ocf-row; evidence.boeing.cutoff.backlog; evidence.boeing.cutoff.debt; evidence.boeing.cutoff.inventory-row; evidence.boeing.cutoff.rd-row; evidence.boeing.cutoff.development-risk]
- Missing architecture and hazard evidence is a reason to limit commitment. The public packet lacked an integrated design record, hazard closures, training analysis, supplier plan, program budget, and downside return model. Absence from the packet does not prove the internal evidence did not exist. [assumption.boeing.cutoff.program-envelope; assumption.boeing.cutoff.integrated-safety-gate]
- Operator mitigation must be tested under representative combinations. A warning or corrective-action assumption should not close a material hazard until validated with realistic alerts, workload, timing, training, and failure combinations. [claim.boeing.cutoff.faa-system-safety-guidance]
Every signal retains a false-positive risk. Otherwise hindsight turns generic development hazards, competitive pressure, or missing public evidence into supposedly obvious predictions of a specific accident.
Candidate decision rules
rule.integrated-safety-gate-before-schedule-commitment is a candidate rule:
When a legacy derivative changes interacting safety-relevant functions while customer or schedule pressure encourages early commitments, require an independent aircraft-level safety gate before binding schedule and production commitments. Synchronize every material design change with hazard analysis, certification evidence, combined-failure tests, warnings, procedures, maintenance, training, and regulator communication.
The watch list is open integrated hazards, certification-artifact lag, and representative validation of human and operational assumptions. Reverse or kill the program when independent review cannot close a material aircraft-level hazard, evidence remains stale, economics depend on suppressing a safety-relevant difference, or legacy constraints erase the derivative's stated advantage.
rule.separate-program-costs-from-portfolio-shocks is a second candidate rule:
Preserve directly labeled program amounts, build a deterministic reconciled bridge for broader attribution, and abstain from assigning aggregate financial changes to the program while material macroeconomic, portfolio, production, accounting, or financing confounders remain uncontrolled.
Its watch list is directly labeled program amounts, a material-confounder register, and a deterministic reconciliation to the consolidated endpoint. Charges, liabilities, payments, concessions, and abnormal costs must not be summed across incompatible bases.
Both rules have moderate confidence and support from this one reconstructed failure case. Neither is corpus-validated, neither prescribes an aircraft design, and neither quantifies a probability reduction or optimal gate cost.
Evidence gaps and abstentions
The selected evidence establishes the reported action, sequence, official findings, accepted DPA facts, and filed values. It does not establish:
- a complete probable-cause allocation for either accident;
- the causal share attributable to design, certification, delegation, training, operations, individual conduct, or other factors;
- Boeing's complete internal architecture, safety analysis, certification, test, communication, training, supplier, and decision records;
- whether Part A's integrated-gate counterfactual would have prevented either accident;
- whether a clean-sheet aircraft or new type certificate would have produced a safer or more valuable outcome;
- the percentage of consolidated revenue, operating-cash-flow, or debt deterioration caused by the MAX;
- a reconciled total economic-loss figure, program return, intrinsic value, or target price.
No material accounting adjustment, deterministic counterfactual, valuation, or aggregate MAX-damage model is presented. Human publication approval remains pending, so this episode must not be represented as approved for external publication.
Source map
- Boeing second-quarter 2011 Form 10-Q — cutoff financial capacity, backlog, and existing development risks (
src.boeing.2011-q2-10q). - AMR aircraft-order filing exhibit — cutoff customer fork and conditional Boeing demand (
src.amr.2011-aircraft-order). - FlightGlobal re-engining report — contemporaneous independent structural-change context (
src.flightglobal.2010-reengining). - FAA Advisory Circular 25.1309-1A — cutoff-valid, non-mandatory system-safety process guidance; exact excerpts use the deterministic text derivative (
src.faa.ac-25-1309-1a-pdf;src.faa.ac-25-1309-1a-text). - Boeing August 30, 2011 launch release — post-cutoff primary action record (
src.boeing.2011-737-launch). - Joint Authorities Technical Review — official technical findings on certification and integrated assessment; exact excerpts use the deterministic text derivative (
src.faa.jatr-2019-pdf;src.faa.jatr-2019-text). - NTSB Safety Recommendation Report ASR-19-01 — official human-performance and safety-assumption findings; exact excerpts use the deterministic text derivative (
src.ntsb.asr-19-01-pdf;src.ntsb.asr-19-01-text). - House Committee final report — congressional investigative characterizations and quoted certification-counterfactual views; exact excerpts use the deterministic text derivative (
src.house.737-max-report-pdf;src.house.737-max-report-text). - FAA return-to-service review — accident and grounding sequence and required remediation; exact excerpts use the deterministic text derivative (
src.faa.737-max-rts-pdf;src.faa.737-max-rts-text). - Executed Boeing deferred prosecution agreement — accepted Statement of Facts and monetary terms; exact excerpts use the deterministic text derivative (
src.doj.boeing-dpa-pdf;src.doj.boeing-dpa-text). - Boeing 2020 Form 10-K — filed consolidated results, MAX-specific indicators, and company-identified confounders (
src.boeing.2020-10k).
Every displayed number resolves through a typed fact to an exact, hash-bound excerpt. Official findings, committee characterizations, accepted DPA facts, company claims, assumptions, conflicts, analyst judgments, causal hypotheses, counterfactuals, and candidate rules remain distinct.