Boeing 737 MAX MCAS System What Went Wrong

What MCAS Was Actually Designed to Do

The Boeing 737 MAX has gotten complicated with all the speculation and misinformation flying around. So let me cut through it. MCAS — the Maneuvering Characteristics Augmentation System — existed because of a physics problem Boeing created when they redesigned the engine mounts.

The new LEAP engines sat further forward on the MAX wing than the older CFM56s on previous 737 models. That forward placement shifted where lift concentrates — backward, relative to the plane’s center of gravity. At high angles of attack, especially during slow-speed flight with flaps retracted, the nose wanted to pitch up harder than any 737 pilot expected. Different feel. Dangerous feel.

But what is MCAS, really? In essence, it’s a software patch for a hardware problem. But it’s much more than that — it was Boeing’s bet that they could make a re-engineered airplane feel identical to its predecessor without requiring pilots to earn a new type rating. No retraining. No additional certification costs for airlines. Just code running quietly in the background, nudging the horizontal stabilizer nose-down whenever it sensed trouble. That decision had consequences nobody fully anticipated.

How a Single AOA Sensor Controlled the Whole System

Probably should have opened with this section, honestly. Because this is where everything falls apart.

MCAS read from one angle-of-attack vane. One. The 737 MAX had two AOA sensors installed — one on each side of the fuselage — but the original logic only pulled data from a single source. No cross-check. No disagreement detection. If that one vane sent garbage numbers, MCAS believed them completely.

The activation conditions were specific. MCAS kicked in when the detected angle of attack exceeded roughly 15.5 degrees on the MAX 8, the flaps were retracted, and the autopilot was disengaged. Once triggered, it commanded a nose-down stabilizer trim of 2.5 degrees over approximately 10 seconds. If the vane then dropped below threshold, the system paused before cycling again. But a stuck vane — physically jammed or just reading false — never drops below anything. It just keeps screaming high.

Meanwhile, the pilots? They saw airspeed. Altitude. Standard primary flight display data. Raw AOA numbers weren’t visible unless a crew specifically configured their screens to show them — and many airlines didn’t display it by default. The system was moving the stabilizer based on sensor data the flight crew had no practical way to verify. That’s not a malfunction. That’s a design choice.

What the Flight Data Actually Showed

Confronted by conflicting instrument readings and a trim wheel spinning on its own, the crew of Lion Air Flight JT610 had roughly six minutes to figure out what was happening. They didn’t make it.

It was October 29, 2018. 5:20 in the morning over the Java Sea. Indonesia’s KNKT — the Komite Nasional Keselamatan Transportasi — later reconstructed the sequence from the flight data recorder, and the numbers are brutal in their clarity.

At 5:20:21, the left AOA sensor read 74 degrees. The right sensor read 15 degrees. One vane was lying. MCAS, reading only the left sensor, saw 74 degrees and concluded the airplane was pitched dangerously skyward. It wasn’t. But MCAS didn’t know that.

The stabilizer started moving. Nose down. The pilots felt it and pulled back manually, fighting the trim. MCAS activated again. Then again. The cycle repeated:

• 5:20:43 — First MCAS activation. Stabilizer trim commanded nose-down.
• 5:21:10 — Pilots manually re-trim nose-up using the control column.
• 5:21:26 — MCAS activates again. More nose-down trim.
• Repeated cycles continue for the next several minutes.

The airplane descended from 5,000 feet. The pilots never knew MCAS existed — it wasn’t in their training materials. At 5:26:34, the 737 MAX hit the water. All 189 people aboard died. That’s what one stuck sensor and one line of unmonitored code actually costs.

Why the Standard Runaway Trim Procedure Did Not Work

Every 737 pilot drills the runaway stabilizer checklist. Disconnect the autopilot. Grab the column. Use the thumb switches or trim wheel to fight it back. If that fails, hit the two STAB TRIM CUTOUT switches on the overhead panel and kill the electric trim entirely. Decades of flights. Thousands of pilots. The procedure worked.

MCAS broke that assumption in a way the checklist authors never anticipated — because MCAS didn’t exist yet when they wrote it.

The system didn’t require autopilot engagement. It just needed flaps up and a high AOA reading. So even while pilots hand-flew the airplane and applied nose-up trim manually, MCAS saw the same false sensor data and immediately commanded nose-down again. Manual trim against an automated system that reset itself repeatedly. That’s not a fair fight.

There’s also a physical reality here that doesn’t get discussed enough. At 400 knots indicated airspeed, the aerodynamic load on the horizontal stabilizer is enormous. Moving that surface manually against that load requires real physical force — sustained, repeated force while also flying the airplane. Fatigue sets in fast. The human loses. The machine doesn’t get tired.

Don’t make my mistake of assuming checklists age gracefully. The KNKT report revealed that Lion Air’s maintenance crews had actually replaced the left AOA vane multiple times before the fatal flight. Each swap seemed to solve it temporarily. It didn’t. The underlying problem — MCAS reading a single, unmonitored sensor with no fallback — was baked into the software. A new vane couldn’t fix bad architecture.

What Was Changed After the Grounding

The FAA grounded the 737 MAX on March 13, 2019. Five months had passed since Lion Air. Days earlier, Ethiopian Airlines Flight ET302 had crashed under circumstances disturbingly similar — same sensor failure mode, same MCAS response, same outcome. 157 more people dead. 346 total.

Boeing was ordered to fix the system before a single MAX flew passengers again. The redesign addressed the core failures directly:

• MCAS now requires both AOA sensors to agree within a defined range before it activates. Disagreement disables the system entirely.
• The system fires once per event — not repeatedly. After a single trim command, the pilots must intervene manually before anything else happens.
• Maximum stabilizer authority from MCAS dropped from 2.5 degrees to 0.6 degrees, dramatically reducing the force needed to override it.
• An AOA disagreement alert now appears on flight decks as standard equipment — not an optional add-on airlines could skip.

Recertification also required actual MCAS-specific training for 737 MAX pilots before returning to service. The system still exists. It just has guardrails now — the ones that probably should have been there from the beginning.

That’s what makes this story enduring for anyone who studies aviation safety. Modern transport aircraft hand off critical decisions to software reading sensor data that human crews can’t easily verify in real time. One vane. One truth. No backup. The MAX flew again in November 2020, but the design philosophy around automation — what we trust, how we verify it, what happens when it’s wrong — shifted permanently because of those 346 deaths. And because someone had to ask whether a checklist written in 1984 could possibly account for a problem that wouldn’t be invented for another thirty years.