While the changes were dramatic, Boeing did not submit documentation of the revised system safety assessment to the FAA.
An FAA spokesman said the safety agency did not require a new system safety analysis because it wasn't deemed to be critical.
"The change to MCAS didn't trigger an additional safety assessment because it did not affect the most critical phase of flight, considered to be higher cruise speeds," he said.
The person familiar with the details of MCAS' evolution said Boeing did the extra analysis of the new low-speed, higher-authority changes. He said the effect of the potential failures at low speed was less, and so didn't add any risk to the prior analysis. So the documents sent to the FAA with the failure analysis were not revised.
"You turn in the answer," he said. "You don't have to document all your work."
MCAS as it was actually implemented differed in another way from what was described in the safety analysis turned in to the FAA.
The failure analysis didn't appear to consider the possibility that MCAS could trigger repeatedly, as it did on both accident flights. Moving multiple times in 0.6 or 2.5 increments depending on the speed, it effectively had unlimited authority if pilots did not intervene.
Discussions around this new MCAS design appear to have been limited during flight testing.
Two former Boeing test pilots described a culture of pressure inside the company to limit flight testing, which can delay projects at a time when orders are stacking up, costing the company money.
Matt Menza, a different pilot who did test flights on the MAX, recalled times when test pilots at Boeing would have the chance to thoroughly examine systems in what he called a "system-safety murder board" to explore all the potential failures. But he reported that the general corps of test pilots didn't have a lot of technical details about the MCAS design, such as the single-sensor input.
Boeing never flight-tested a scenario in which a broken angle-of-attack sensor triggered MCAS on its own, instead relying on simulator analysis, according to a person familiar with the process. One of the former test pilots expressed bewilderment that the angle-of-attack failure was never explored in the air.
A variety of employees have described internal pressures to advance the MAX to completion, as Boeing hurried to catch up with the hot-selling A320 from rival Airbus.
Mark Rabin, an engineer who did flight-testing work unrelated to the flight controls, said there was always talk about how delays of even one day can cost substantial amounts. Meanwhile, staff were expected to stay in line, Rabin said.
"It was all about loyalty," Rabin said. "I had a manager tell me, 'Don't rock the boat. You don't want to be upsetting executives.'"
