Boeing Built Deadly Assumptions Into 737 Max, Blind to a Late Design Change

In both doomed flights, pilots struggled as a single damaged sensor sent the planes into irrecoverable nose-dives within minutes, killing 346 people and prompting regulators around the world to ground the Max.But many people involved in building, testing and approving the system, known as MCAS, said they hadn’t fully understood the changes. Regulators didn’t conduct a formal safety assessment of the new version of MCAS.The current and former employees, many of whom spoke on the condition of anonymity because of the continuing investigations, said that after the first crash, they were stunned to discover MCAS relied on a single sensor.“That’s nuts,” said an engineer who helped design MCAS.“I’m shocked,” said a safety analyst who scrutinized it.“To me, it seems like somebody didn’t understand what they were doing,” said an engineer who assessed the system’s sensors.In 2012, the chief test pilot for the Max had a problem.During the early development of the 737 Max, the pilot, Ray Craig, a silver-haired retired Navy airman, was trying out high-speed situations on a flight simulator, like maneuvers to avoid an obstacle or to escape a powerful vortex from another plane. Mr. Wilson, who had tested Boeing fighter jets, had replaced Mr. Craig the previous year.“The 737 Max just felt right in flight, giving us complete confidence that this airplane will meet our customers’ expectations,” he said.But a few weeks later, Mr. Wilson and his co-pilot began noticing that something was off, according to a person with direct knowledge of the flights. And the agency’s rules didn’t require it to take a second look because the changes didn’t affect how the plane operated in extreme situations.“The F.A.A. was aware of Boeing’s MCAS design during the certification of the 737 Max,” the agency said in a statement. “Consistent with regulatory requirements, the agency evaluated data and conducted flight tests within the normal flight envelope that included MCAS activation in low-speed stall and other flight conditions.”After engineers installed the second version of MCAS, Mr. Wilson and his co-pilot took the 737 Max for a spin.The flights were uneventful. In both cases, the pilots were able to easily fly the jet, according to a person with knowledge of the flights.In those flights, they did not test what would happen if MCAS activated as a result of a faulty angle-of-attack sensor — a problem in the two crashes.Boeing engineers did consider such a possibility in their safety analysis of the original MCAS. It didn’t require additional training.William Schubbe, a senior F.A.A. official who worked with the training group, told pilots and airlines in an April meeting in Washington, D.C., that Boeing had underplayed MCAS, according to a recording reviewed by The Times.“The way the system was presented to the F.A.A.,” Mr. Schubbe said, “the Boeing Corporation said this thing is so transparent to the pilot that there’s no need to demonstrate any kind of failing.”The F.A.A. officials involved in training weren’t the only ones operating with outdated information.An April 2017 maintenance manual that Boeing provided to airlines refers to the original version of MCAS.