THE BOEING 737 MAX & NORMALIZATION OF DEVIANCE

Written By Paul Harrow

An Analysis of What Went Wrong With The 737 MAX (Reposted and updated from August 2019)

In her award-winning book The Challenger Launch Decision, Diane Vaughan provides a detailed examination of NASA’s organizational culture, derived from her sociological research into large entities. This work introduces the concept of “normalization of deviance”—the tendency of complex organizations, when managing advanced technological systems, to accept operational anomalies as standard practice [Vaughan, 1996]. When evaluating the safety and risk of such systems, overlooking these organizational patterns can lead to a misleading sense of understanding, placing lives at risk.

This concept gains significance when considering that the underlying causes of the Space Shuttle Challenger and Columbia accidents were organizationally and sociologically similar, despite their technical differences [Vaughan, 1996]. In both cases, NASA managers treated deviant operational issues as routine maintenance concerns rather than addressing fundamental flaws. For Challenger, this involved gas impingement and blow-by affecting the o-ring seals in the booster joints, a condition the design was not intended to withstand. For Columbia, it was the foam shedding from the external tank, which damaged the heat shield—a problem outside the tank’s intended performance [NASA, 2003]. Yet NASA continued to operate and repair, a pattern akin to driving a car with a persistent gasoline leak, refilling the tank without investigating the source, until a fire inevitably breaks out due to the unresolved issue.

What does this imply for Boeing?

1: As a large organization, Boeing exhibits the typical strengths and challenges inherent to such entities.

2: Within the 737 system, certain deviations likely remain unaddressed or are considered too costly to resolve, accepted as part of normal operations.

The space shuttle system included several notable design limitations, with the orbiter’s heat shield being particularly vulnerable—delicately attached with adhesive, exposed, and positioned unsafely relative to foam and ice shedding during launch, leading to frequent damage [NASA, 2003]. The 737 shares its own design challenges. The specific flaw I will focus on was not an initial defect but became one over time: its low ground clearance. Originally, this low profile facilitated passenger boarding and aircraft servicing, a feature that distinguished the 737 early on. The DC-9 also sat low, but its engines were mounted high on the tail, unlike the 737’s under-wing configuration, enabled by the long, narrow, low-bypass Pratt & Whitney JT8D engines.

As later 737 variants pursued improved efficiency, larger engine bypass ratios required bigger fans, straining the low-slung design’s ground clearance. This issue became evident with the flat-bottomed, forward-positioned engine nacelles of the CFM56-powered 737-300. To address clearance, the engines were shifted forward of the wing, with nacelles adjusted below. On the 737 MAX, this adjustment progressed further—engines moved upward and forward to accommodate even larger fans, with nacelles no longer flat-bottomed. This evolution revealed a critical design limitation: the 737 was not originally designed for a large, high-bypass turbofan positioned so far forward and above the wing, intended instead for a smaller engine directly beneath [EE Times, 2019]. Since the 737-300 through 900 operated without major issues with this configuration, Boeing treated the shift as an acceptable design evolution rather than a constraint [Forbes, 2019]. This acceptance persisted, leading to a configuration that contributed to two fatal accidents.

Every accident results from a sequence of events, a chain of causation. Not all normalized deviations lead to disasters. However, why would a company like Boeing, with its resources and expertise, continue to support a compromised design? It suggests they did not recognize it as compromised. How could they overlook basic failure scenarios for MCAS? How did they account for human factors? Why rely on a single AOA indicator? Why keep MCAS undisclosed? These questions are difficult to answer. Similarly, why did NASA tolerate o-ring erosion, foam shedding, or heat shield damage? The insights lie within Diane Vaughan’s research [Vaughan, 1996].

Large organizations often share common traits: structural rigidity, a focus on self-preservation, profit motives, competitive pressures, limited resource allocation, and conflicting priorities. NASA’s mission is to launch rockets, a drive that must balance ambition with the complexities of outcomes, especially when operating at the edge of technological capability with designs that may never be fully safe. The 737 MAX reflects Boeing pushing this design to its limits, unaware of the risks lurking ahead. The space shuttle was a deliberate compromise—a lightweight, reusable vehicle to carry a significant payload and seven astronauts, designed to land like an airplane. Intentional compromises can have merit, as seen with Northrop’s B-2, which lacks a rudder or vertical stabilizer for radar stealth, potentially at the cost of safety. A 737, however, prioritizes safety above all, though it must also balance speed, stability, cost, and efficiency demands from customers [Vox, 2019]. Deciding which aspects to emphasize or sacrifice can lead to pitfalls. Boeing has a strong history of producing safe, efficient airliners, but with the 737 MAX, it may have been lulled into confidence by the 737 NG’s success with larger, forward-and-up engines, prompting another iteration of a 60-year-old concept. As designs approach their limits, margins narrow, and the tolerance for error diminishes. Boeing should have approached this final adaptation with careful refinement and thorough validation. It’s regrettable that the MCAS analysis was inadequate, that the process was rushed, and that cultural weaknesses were exposed through public investigations and FAA scrutiny [Congressional Hearings, 2019; FAA, 2024]. One might expect self-preservation to demand a flawless 737 MAX, and perhaps, when it returns to service, it will approach that standard.

Following the Challenger accident, the SRBs were redesigned and operated without further issues. After Columbia, NASA addressed foam shedding by removing areas like the bipod ramp, improving launch imaging, and enhancing orbital heat shield inspections to ensure re-entry safety [NASA, 2003]. Though not perfect, the shuttle flew safely for eight more years until its retirement in 2011. I remain hopeful for a similar recovery for the 737 MAX. Boeing has strayed, but this presents an opportunity to improve. NASA achieved this, though it quickly forgot Challenger’s lessons, repeating errors with Columbia 17 years later [Vaughan, 1996]. Boeing’s challenge lies in a lack of awareness, pushing the 737’s flawed design too far without fully understanding the consequences. As the Columbia Accident Investigation Board did, Boeing would benefit from consulting Diane Vaughan and her team to navigate the cultural and sociological roots of the MAX situation.

Bibliography

Paul Harrow
Previous

Division Breeds Danger: The Safety Standoff
Next

Implimenting AI Powered Risk Prediction