# Why does the KC-46 use two sensors for MCAS when the 737 Max doesn’t?

The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.

I’m aware that the 737 uses two sensors and always has, but the computer reads them simultaneously based off which pilot is flying the plane. So if the Captain is flying it’s reading data from the left side, correct?

At this point I’m assuming Boeing’s decision to pull data from one sensor was to reduce the workload and make for a earlier introduction?

• Regarding Boeings decision to use single sensor data for MCAS, words that come to mind are stupid and reckless. The Air Force was most likely smart enough to demand a system with some basic redundancy. Feb 14, 2020 at 10:23
• Also a guess: There was no pressure to carry over a type rating for pilots of a previous model. Feb 14, 2020 at 10:45
• @Jpe61 redundancy is very important for the military. Furthermore, I believe that the military is in a much better position to gain insight into a plane's design; and if they see a need, to demand changes. MCAS was deliberately designed by Boing so that the MAX falls under the 737's existing certification. If the 737 MAX fulfills all existing regulation, on what grounds could the FAA demand changes to the MCAS? Feb 14, 2020 at 10:47
• @MSalters So if Boeing changed the computer, and opened it up to read two sensors at once, the plane now requires additional training? Feb 14, 2020 at 10:59
• @Firefighter1: You then need to compare them. And since you only have two, in case of conflict you need a pilot procedure in case the readings differ too much. Can't vote with just two sensors. Feb 14, 2020 at 11:25

According to the article, the KC-46 uses the dual FCC/AoA sensor for computing both FCC channels and comparing the command signals. With two disagreeing signals there is no way to determine which one is correct and the usual remedy is to disengage both, warn the pilot, and engage in the appropriate crew procedure. And that requires training.

The B737MAX was promoted as requiring only very limited differences training relative to the NG, so the setup for the KC-46 could not be copied. The original design of MCAS in the B737MAX also used two transducers for activation - two different types of transducers, both of which had to be over a threshold value, as mentioned in this answer. Original design MCAS only had limited authority of 0.8 deg stabiliser. From the crash report of Lion Air 610, page 204:

MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.

The report states that in the failure analysis, Boeing classified the uncommanded MCAS failure condition as Major (which may not occur more than once in 10$$^5$$ flying hours), instead of Hazardous (1:10$$^7$$) or Catastrophic (1:10$$^9$$) allowing for indeed a single transducer input. Again from the report, page 206:

If the probability of an undesirable failure condition is not below the maximum allowable probability for that category of hazard, redesign of the system should be considered. If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.

Why all of this was done for the B737, while the KC-46 uses two sensors, is a conglomeration of factors. Two sensors is best. Time pressure for plane delivery, airline customer pressure for limiting differences training, the observation that previous versions of B737s with accumulated flying hours of 250 million had experienced no catastrophic failures due to AoA sensor failure (reference again from the crash report), all led to the perhaps justifiable belief that the one sensor was sufficient. If rapid action was taken by the crew to contain the failure - but the failure could not be reognised in time. Again page 206:

During the single and multiple failure analysis from the air data system worst case scenario of “failure of one AOA followed by erroneous AOA”, Boeing concluded that the effect would be hazardous until the flight crew recognized the problem and took appropriate action to mitigate it. Since the training or the guidance for actions taken in such situation were not provided, the effect category should have remained hazardous.

Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.

• This may be grounds for a new question. If I'm reading correctly, a failure happening 1 in 10^5 hours is Major, while a failure happening 1 in 10^9 is Catastrophic? How's that? 10^5 is a much smaller number (and therefore much more frequent occurrance) than 10^9. (Or is that a typo?) Feb 14, 2020 at 15:16
• @FreeMan A Catastrophic failure may occur not more than 1 in 10$^9$ flying hours, a Major fail does not have catastrophic consequences per se and is allowed to happen no more than once in 10$^5$ flying hours. Feb 14, 2020 at 22:54
• Ah, that makes more sense. Thank you! Feb 17, 2020 at 12:15
• @FreeMan Thanks for the comment, have improved the phrasing in the answer. Feb 18, 2020 at 0:27
• Two sensors is better, three (or more) would be best. May 13, 2021 at 12:59

We can't know why Boeing did what they did unless they tell us and given the legal implications of saying too much there's more noise than signal. I can speculate with the rest on an answer with the rest of them.

The 737MAX MCAS was meant to provide a certain "feel" on the control yoke to the pilot when making specific maneuvers. MCAS would be expected to make minor corrections to the trim, do so rarely, and any failure was expected to look like a runaway trim or other failure that pilots were already trained to address in the 737NG. This was not considered a flight critical function and so used only one sensor.

On the KC-46 the purpose of MCAS was to mitigate the shifting center of gravity as fuel was being delivered to other aircraft. MCAS would be in near constant operation, it had what was believed to be far greater control of how the aircraft performed, and so used two AoA sensors for redundancy of input.

As I recall the decision to use only one AoA sensor was not to reduce workload on the engineering and testing but to reduce workload on the computers in the aircraft, computers that already had considerable workload for their capability. One AoA sensor meant not needing to take the extra computing power to check one input against the other.

I wish I could recall where I read this but someone that claimed to know what he was talking about said that it would have been possible to not only compare one AoA sensor against the other but to compute the AoA from other sensors to determine which sensor was giving good data if there was a disagreement. This is in effect a "virtual" AoA sensor so that there can be a vote of 2 out of 3 on what is the correct AoA. Additionally this was supposedly possible without exceeding the computing power of the 737MAX onboard computers. Assuming this was possible that would have meant additional work to create this software and validate it was safe. Given Boeing had a tight schedule, and MCAS was not considered safety critical by the FAA, this extra work was not done.

While the AoA sensors are on all 737MAX aircraft not all have this information available to the crew. The crew would only be told of an AoA sensor mismatch if the airline purchased the option for AoA indicators on the flight deck. This was apparently not a popular option, few 737MAX aircraft had AoA indicators. Again, there are two AoA sensors on all the 737MAX aircraft but not all aircraft had AoA indicators for the crew, MCAS had this information but the crew might not.

Airbus apparently views AoA indication differently. They put three AoA sensors on their aircraft so that single sensor failures can be detected and corrected. Again, there is a claim that Boeing could correct for a single AoA sensor failure by computing AoA from other sensor inputs but they chose not to. It's possible they chose not to out of legal reasons as much as practical and technical reasons. If they demonstrated the ability to calculate AoA in order to detect and correct for a single AoA sensor input failure then that could open up another investigation on why this was not done before.

Boeing may have to dig in their heels on maintaining that AoA is "nice to know" rather than vital to controlling the aircraft so as to not attract more lawyers. I don't know how important knowing AoA is to a pilot as I am not a pilot. I expect this to be debated for some time.

• Your downplaying of the 737MAX MCAS paints a wrong picture. While the MCAS of the KC-46 corrected stabilizer trim only once and only by 0.6 degrees, the 737MAX MCAS would do so repeatedly and by a much larger amount of 2.5 degrees of trim until AoA would drop below its limit (I believe that was 8 degrees). With a sensor malfunction this required reaction within 4 seconds to follow the procedure for trim runaway. Dec 1, 2021 at 19:31
• " Your downplaying of the 737MAX MCAS paints a wrong picture. " I'm not downplaying the severity of the 737MAX MCAS problems, I'm answering the question on why Boeing would decide to have a single AoA sensor for MCAS and the FAA would agree to this decision. This was done because at the time MCAS was not seen as safety critical or posing a safety problem of its own. We know now this was not true but that's 20/20 hindsight. Dec 1, 2021 at 22:22
• "why ... the FAA would agree to this decision" This was entirely because the FAA learned only after the crashes of the modifications to MCAS. All previous certification work was done by Boeing employees. If you had followed the link you would have learned that "Boeing Authorized Representatives are Boeing employees who are granted special permission to represent the interests of the FAA and to act on the FAA’s behalf in validating aircraft systems and designs’ compliance with FAA requirements". Dec 2, 2021 at 9:27
• @PeterKämpf I know that the FAA was not aware of the implications of the changes made to MCAS on the 737MAX. Again, the question was, why would the FAA agree to this? The answer, they were not aware of the implications. I am quite aware of the flaws in the system to verify that MCAS was not a safety hazard. Because they did not know of this the FAA agreed that there was no need for a redundant AoA sensor input to MCAS. I addressed your complaint already, why repeat it? What do you want from me? Dec 2, 2021 at 11:54