• Engineers’ layered approach, deliberate process ensure safety for autonomous aerial refueler.

Boeing, June 10, 2026 — It is one of the most complicated maneuvers any machine can perform: one aircraft transferring fuel to another while flying thousands of feet in the air. Now imagine doing that and then landing back on an aircraft carrier in the middle of the sea. Then do all of the above without a pilot on board.

That’s exactly what the MQ-25A Stingray™ does. And the engineers who designed it built safety into every phase to ensure the autonomous aircraft will react as well as — and sometimes better than — a conventional piloted refueler.

The Boeing teammates making it happen say the aircraft’s autonomy software — commonly referred to as “the brains” inside the Stingray — is the foundation of the aircraft’s success. Boeing teammates designed, built and tested the software through years of exhaustive verifications to prove, before the Stingray ever left the ground, that it would fly safely.

Why it matters: Safety is the first consideration when designing any aircraft. And flying without a pilot on board presents distinct and novel challenges.

• A robust, thoroughly tested autonomy software with a contingency management system directs the MQ-25A to make safe decisions on its own in real time.
• A safe, autonomous aircraft will expand mission options for the U.S. Navy and keep more service men and women out of harm’s way.

How the MQ-25A works: The MQ-25A is an autonomous aircraft with a human on the decision-making loop. But unlike other remotely piloted systems, the humans on the ground (or on a carrier), known as Air Vehicle Pilots (AVPs), do not control the aircraft via a traditional stick and throttle.

• AVPs establish waypoints and flight paths the aircraft will fly. They then send commands, with the press of a button, such as taxi, takeoff and land to the Stingray from a Ground Control Station known as the Unmanned Carrier Aviation Mission Control System (UMCS).
• The Stingray’s onboard autonomy translates commands and manages all onboard systems including propulsion, subsystems, guidance and flight control.

Innovation takes flight: The Boeing-owned T1 test asset that first flew in 2019 was a prototype that laid the groundwork for today’s MQ-25A. The new U.S. Navy MQ-25A Stingrays are designed to survive the harsh conditions of life on an aircraft carrier and are built for Navy operational deployments. They are also equipped with more advanced autonomy software and a contingency management system building on lessons from the T1 test asset.

• “The software flying on the airplane today isn’t just a first flight demonstration version,” said Mark Dunn, MQ-25 Mission Systems Integrated Product Team leader. “It’s significantly more complex and contains all the capabilities that let MQ-25A safely integrate seamlessly with the carrier air wing.”

How they tested the MQ-25A’s brains: Before the MQ‑25A’s first flight, Boeing teammates ran thousands of safety checks focused on proving the software’s intended behavior and the reliability of aircraft hardware. Tests examined every line of software code, aircraft components, and how they worked together.

• Verification of software logic: Testing started three years before the first flight, in a lab, using the exact Vehicle Management System Computers (VMSCs) that go in the aircraft. Engineers loaded the autonomy and contingency-management software and verified every decision and response.
• Testing with real aircraft parts: The team then integrated aircraft components — including real actuators on hydraulic and electrical systems — to prove the VMSCs correctly operate and control all systems.
• Final checks on the aircraft: After lab work proved successful, the same VMSCs and software were installed on the aircraft, followed by extensive ground tests by Boeing and Navy teams.

Technical excellence: To prepare for Navy deployments, engineers validated autonomy and contingency-management performance across many potential failure conditions.

• The toughest part was testing every bit of software logic in the lab and on the airplane. As Juan Cajigas, MQ‑25 chief engineer, put it: “We had to consider all the possible scenarios the aircraft could experience in flight and ensure the airplane would autonomously react as we intended.”
• Engineers deliberately introduced failures — loss of GPS, engine failure, or loss of AVP communications — and observed system responses.
• In a specific test, if the Stingray loses communications with the AVPs, the contingency management system directs the aircraft to autonomously return to its departure airfield and land safely — a behavior verified through repeated injections of the fault.

By the numbers:

• 600,000 lines of safety-of-flight software code
• Over 200,000 hours of lab tests for flight software
• Over 1,000 hours of ground tests on the first flight airplane