Comment Re:Now I am even more worried... (Score 1) 471
The statement of using only one sensor is scary especially for something that automatically adjust the flight path, but even having two is scary. With 2 sensors how does the software know which is right when they disagree ? For true fault tolerance you need a minimum of 3 sensors
I assume that the MCAS system design is designed similar to the Stall Protection System (SPS) in most aircraft. The SPS uses both angle-of-attack vane sensor inputs but triggers a stall alert if either of the sensors exceed a limit. So yes, one wrong sensor input would cause an issue but the system is looking at both. Because they are necessarily located on the side of the aircraft, an aircraft in roll will have differing angle-of-attack sensor inputs. Given that a rolling stall was one of the scenarios they were trying to protect against, a miscompare between the two angle-of-attack vane sensors would be expected, especially considering that the system can have tolerances of up to 1.5degrees during the takeoff phase
It appears that they are looking at using the airspeed and inertial sensors to cross-verify, but given that no other sensor is directly measuring angle-of-attack any other method will be limited, as the computed angle-of-attack will be an estimate.
So while I agree that there were issues with design, it is not as simple a fix as cross-comparing both vane sensors in this case