Boeing's Revised 737 MAX MCAS Disables Itself if Two AOA Sensors Differ by More Than 5.5 Degrees

Boeing redesigned the Maneuvering Characteristics Augmentation System (MCAS) on the 737 MAX after the Lion Air flight 610 crash in 2018 and the Ethiopian Airlines flight 302 crash in 2019. The original system relied on input from a single angle-of-attack (AOA) sensor. In both crashes, incorrect sensor data caused MCAS to repeatedly command the nose down even though the aircraft was not approaching a stall.

MCAS was introduced because the 737 MAX's larger engines, mounted higher and further forward on the wing, made the aircraft pitch up more aggressively than earlier 737 variants. A software fix was chosen to preserve handling commonality with the 737NG and avoid additional simulator training or a separate pilot type rating.

Under the revised design, the system compares readings from both AOA sensors. If they differ by more than 5.5 degrees, MCAS is disabled and pilots receive an "AOA Disagree" alert. That alert is now always enabled; previously it was optional depending on whether an airline had the AOA Gauge. The redesigned MCAS can activate only once during a high-AOA event and cannot command more nose-down input than a pilot can counteract using the control column alone.

Investigations found that MCAS had been left out of pilot manuals and training materials, and CBS News reported that US pilots were initially given 56 minutes of iPad training on the differences between the 737 MAX and earlier 737 models. After the global grounding, new computer-based training modules, updated documentation and simulator training were added, with requirements evaluated and validated by regulators.

A July 2020 report by the US Department of Transportation's Inspector General found that Boeing had downplayed the power and scope of MCAS during certification. The report also found that the Federal Aviation Administration's (FAA) delegation system left the original single-sensor design without meaningful independent oversight. MCAS was initially presented as a minor modification of the 737's speed trim system, and later expansions of its authority were not subject to a second review.

The European Union Aviation Safety Agency (EASA) initially pushed for a third AOA sensor. In January 2021 it agreed to the 737 MAX's return to service after Boeing committed to developing a "synthetic" sensor that calculates AOA from other data sources.

Boeing has flight-tested the synthetic AOA system on the 737 MAX 10. In 2021, a Boeing official told Aviation Week that the system would monitor five parameters to determine whether an AOA signal is erroneous and could suppress an incorrect signal. Boeing is also working on additional monitoring systems and a switch allowing pilots to disable the function.

The FAA has received at least 216 reports since 2004 involving AOA sensors that failed or required repair, replacement or adjustment. Around one-fifth involved Boeing aircraft, and in some cases faulty sensors triggered stall warnings that forced pilots to reject takeoffs or make emergency landings.

The 737 MAX history illustrates how a handling-commonality decision can shape a safety architecture. Choosing software to make a new variant fly like its predecessor kept simulator training and type-rating costs down for airlines, but it also placed heavy weight on one sensor and on how the system was described to regulators. Once authority was expanded without a second review, the delegation structure offered no independent check.

The revised design shows where regulators ended up: cross-checking redundant inputs, limiting the authority and repetition of automated commands, and making disagreement alerts standard rather than an optional extra. Training and documentation, which had omitted MCAS entirely, became part of the certification package rather than an afterthought.

The open item is the synthetic AOA system. It was the condition on which EASA accepted the return to service, and it has so far been flight-tested on the 737 MAX 10. Its certification, and how it is paired with the additional monitoring systems and pilot disable switch Boeing is developing, would show how far sensor redundancy is being solved by software rather than hardware.