Originally Posted by
Speed of Sound
At some point in the design phase of the MCAS, the question would have been asked "How many Alpha vanes do we want to feed the active FCC?"
Three would be the best use of redundancy. The problem with two is that all you can really do with a two sensor disagree, is disable the system altogether which then leaves the aircraft without a system required for certification. That leaves one sensor which if it fails 'unsafe', leaves the system in operation therefore good for certification but then relies on the crew to 'catch' the problem.
This may be overthinking things but that suggests to me that the MCAS decision was made very late in the whole process where adding an extra vane to the nose (or anywhere else) would cause a prohibitively long delay so the use of only one vane was the only option open to the designers at that stage of the game, effectively a fait accompli.
There are currently legal cases against Boeing with respect to the Lion Air crash and if that turns out to be down to the MCAS as does ET-302, unless Boeing makes an out of court settlement, the design and testing process will almost certainly have to be revealed to all in open court.
MCAS availability requirement is driven by the handling qualities impact of not having MCAS. 737MAX was not able to certify without MCAS, but the hazard level of not having MCAS must not be so high as to require MCAS availability to be greater than that of a single AOA sensor as that is the current design. If hazard level of not having MCAS is sufficiently low to allow that condition at the twice the failure rate of an AOA sensor then logic that compares two AOA signals and disables MCAS when they don't agree would be fine. We will see if that is part of the pending MCAS control law update.