The MCAS function itself is not critical; its failure to function is likely classified as major because the result of its failure to function is simply a non-compliant column force gradient. It's malfunction was catastrophic, and still is potentially catastrophic. It is acceptable for loss of a valid AOA signal to cause the system to become inactive, as long as it does not malfunction. As such, two independent AOA sensors and signals can be an acceptable system architecture if any significant disagreement of the two AOA values causes the MCAS function to be deactivated, and no foreseeable common cause failures can cause identical errors in the two AOA sources. A voting system of three signals is not necessary when loss an accurate signal is not critical.