Boeing’s Pre-737 MAX MCAS flight-control system had safeguards

Boeing engineers working on a flight-control system for the 737 MAX omitted key safeguards included in an earlier version.

After the Lion Air crash, Air Force officials were worried their tanker, the KC-46A Pegasus, shared the same problems as Boeing’s 737 MAX. Picture: Reuters

Boeing engineers working on a flight-control system for the 737 MAX omitted key safeguards that had been included in an earlier version of the same system used on a military tanker jet, sources say.

Accident investigators have implicated the system, known as MCAS, in two deadly crashes of the jetliner that killed a total of 346 people.

The engineers who created MCAS more than a decade ago for the military refuelling plane designed the system to rely on inputs from multiple sensors and with limited power to move the tanker’s nose — which one person familiar with the design described as deliberate checks against the system acting ­erroneously or causing a pilot to lose control.

“It was a choice,” this person said. “You don’t want the solution to be worse than the initial problem.”

The MAX’s version of MCAS, however, relied on input from just one of the plane’s two sensors that measure the angle of the plane’s nose. The system also proved tougher for pilots to override. Investigators have implicated the system in the fatal nosedives of a Lion Air jet in October 2018 and of an Ethiopian Airlines MAX in March. Indonesia is expected to fault that MCAS design, in addition to US oversight lapses and pilot missteps, in its final report on the Lion Air crash into the Java Sea, The Wall Street Journal has reported.

Now, Boeing’s expected fix for the 737 MAX will make its MCAS more like the one used in the tanker, sources say.

Details of the system’s history and engineers’ desire to build in safeguards on the tanker version of MCAS haven’t been previously reported. The existence of a version of MCAS on the tanker was earlier reported by Air Force magazine.

MCAS stands for the Manoeuvring Characteristics Augmentation System. A Boeing spokesman declined to explain why the systems differed on two aeroplanes, but said: “The systems are not directly comparable.” The contrast in design highlights how different teams of Boeing engineers wound up including protections on one aeroplane but not on a later model of another aircraft.

Boeing has said the MAX, with its revised MCAS, will be among the safest aeroplanes ever to fly.

After the MAX operated by Lion Air crashed, Air Force officials said they were concerned their tanker, the KC-46A Pegasus, shared the same problems. An Air Force spokeswoman said senior officials met with their Boeing counterparts to confirm the tanker’s MCAS complied with military requirements for designs that prevent a single faulty sensor from causing a system to fail.

Boeing developed the MCAS for the military tanker around the early 2000s. The tanker was a military derivative of Boeing’s wide-body 767 commercial jet and included pods on its wings used for air-to-air refuelling of fighters and other war planes.

Those wing pods added lift and caused the tanker’s nose to pitch up in some flight conditions, risking the plane’s ability to meet Federal Aviation Administration safety requirements. So engineers devised MCAS software that automatically pushes down the tanker’s nose if necessary.

In a key difference from the subsequent version of the system used on the MAX, the system on the tanker moves the plane’s horizontal stabiliser — the control surface perpendicular to the aeroplane’s tail — once per activation and not repeatedly.

The tanker engineers also gave the system only limited power to nudge the plane’s nose down to ensure that pilots would be able to recover if it accidentally pushed the plane into a dive.

Aside from sensors, the tanker MCAS has another key safeguard. Pilots of the tanker can override MCAS by simply pulling back on controls, according to a senior Air Force official.

The new MCAS for the 737 MAX is expected to rely on two sensors to verify data. It will fire once, not repeatedly, each time it activates. And pilots will be able to override the system by pulling back on the controls.