# Why does the KC-46 use two sensors for MCAS when the 737 Max doesn’t?

The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.

I’m aware that the 737 uses two sensors and always has, but the computer reads them simultaneously based off which pilot is flying the plane. So if the Captain is flying it’s reading data from the left side, correct?

At this point I’m assuming Boeing’s decision to pull data from one sensor was to reduce the workload and make for a earlier introduction?

• Regarding Boeings decision to use single sensor data for MCAS, words that come to mind are stupid and reckless. The Air Force was most likely smart enough to demand a system with some basic redundancy. – Jpe61 Feb 14 at 10:23
• Also a guess: There was no pressure to carry over a type rating for pilots of a previous model. – MSalters Feb 14 at 10:45
• @Jpe61 redundancy is very important for the military. Furthermore, I believe that the military is in a much better position to gain insight into a plane's design; and if they see a need, to demand changes. MCAS was deliberately designed by Boing so that the MAX falls under the 737's existing certification. If the 737 MAX fulfills all existing regulation, on what grounds could the FAA demand changes to the MCAS? – Dohn Joe Feb 14 at 10:47
• @MSalters So if Boeing changed the computer, and opened it up to read two sensors at once, the plane now requires additional training? – Firefighter1 Feb 14 at 10:59
• @Firefighter1: You then need to compare them. And since you only have two, in case of conflict you need a pilot procedure in case the readings differ too much. Can't vote with just two sensors. – MSalters Feb 14 at 11:25

According to the article, the KC-46 uses the dual FCC/AoA sensor for computing both FCC channels and comparing the command signals. With two disagreeing signals there is no way to determine which one is correct and the usual remedy is to disengage both, warn the pilot, and engage in the appropriate crew procedure. And that requires training.

The B737MAX was promoted as requiring only very limited differences training relative to the NG, so the setup for the KC-46 could not be copied. The original design of MCAS in the B737MAX also used two transducers for activation - two different types of transducers, both of which had to be over a threshold value, as mentioned in this answer. Original design MCAS only had limited authority of 0.8 deg stabiliser. From the crash report of Lion Air 610, page 204:

MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.

The report states that in the failure analysis, Boeing classified the uncommanded MCAS failure condition as Major (which may not occur more than once in 10$$^5$$ flying hours), instead of Hazardous (1:10$$^7$$) or Catastrophic (1:10$$^9$$) allowing for indeed a single transducer input. Again from the report, page 206:

If the probability of an undesirable failure condition is not below the maximum allowable probability for that category of hazard, redesign of the system should be considered. If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.

Why all of this was done for the B737, while the KC-46 uses two sensors, is a conglomeration of factors. Two sensors is best. Time pressure for plane delivery, airline customer pressure for limiting differences training, the observation that previous versions of B737s with accumulated flying hours of 250 million had experienced no catastrophic failures due to AoA sensor failure (reference again from the crash report), all led to the perhaps justifiable belief that the one sensor was sufficient. If rapid action was taken by the crew to contain the failure - but the failure could not be reognised in time. Again page 206:

During the single and multiple failure analysis from the air data system worst case scenario of “failure of one AOA followed by erroneous AOA”, Boeing concluded that the effect would be hazardous until the flight crew recognized the problem and took appropriate action to mitigate it. Since the training or the guidance for actions taken in such situation were not provided, the effect category should have remained hazardous.

Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.

• This may be grounds for a new question. If I'm reading correctly, a failure happening 1 in 10^5 hours is Major, while a failure happening 1 in 10^9 is Catastrophic? How's that? 10^5 is a much smaller number (and therefore much more frequent occurrance) than 10^9. (Or is that a typo?) – FreeMan Feb 14 at 15:16
• @FreeMan A Catastrophic failure may occur not more than 1 in 10$^9$ flying hours, a Major fail does not have catastrophic consequences per se and is allowed to happen no more than once in 10$^5$ flying hours. – Koyovis Feb 14 at 22:54
• Ah, that makes more sense. Thank you! – FreeMan Feb 17 at 12:15
• @FreeMan Thanks for the comment, have improved the phrasing in the answer. – Koyovis Feb 18 at 0:27