In the current design, the system engages for 10 seconds at a time, with five-second pauses in between. Under conditions similar to the Lion Air flight, three engagements over just 40 seconds, including pauses, would send the plane into an unrecoverable dive, the two people involved in the testing said.
That conclusion agreed with a separate analysis by the American Airlines pilots’ union, which examined available data about the system, said Michael Michaelis, the union’s top safety official.
One of the people involved in the training said MCAS was surprisingly powerful once tested in the simulator. Another person found the system controllable because it was expected. Before the Lion Air crash, Boeing and regulators agreed that pilots didn’t need to be alerted to the new system, and training was minimal.
At least some of the simulator flights happened on Saturday in Renton, Wash., where the 737 Max is built. Pilots from five airlines — American, United, Southwest, Copa and Fly Dubai — took turns testing how the Max would have responded with the software running as it was originally written, and with the updated version, known as 12.1.
In the simulations running the updated software, MCAS engaged, though less aggressively and persistently, and the pilots were also able to control the planes.
Boeing’s software update would require the system to rely on two sensors, rather than just one, and would not be triggered if the sensors disagreed by a certain amount, according to the three people. Given that the 737 Max has had both sensors already, many pilots and safety officials have questioned why the system was designed to rely on a single sensor, creating, in effect, one point of failure.