Argthtjtr

Regarding the 737 MAX story, the New York Times writes:

"Boeing’s software update would require the system to rely on two
sensors, rather than just one, and would not be triggered if the
sensors disagreed by a certain amount, according to the three people.
Given that the 737 Max has had both sensors already, many pilots and
safety officials have questioned why the system was designed to rely
on a single sensor, creating, in effect, one point of failure [emphasis mine]"

Now I understand that this avoids a False Positive, when one erroneous sensor triggers the MCAS.

But, considering the opposite situation, doesn't this update introduce a new single point of failure, a False Negative, when a stall should be counteracted with MCAS but it isn't, because only one sensor detects it?

(Or if not, what am I missing here? Is it that a faulty sensor fails in a certain way and will not read normal AOA erroneously?)

Noting that the details of the MCAS update are yet to be publicly confirmed by Boeing - no I don't believe you are missing anything.

MCAS was meant to be a system that only kicked in when the pilots were letting the situation get out of hand. It was to aid in stall prevention, but does not do anything the pilots can't (as long as their situational awareness would allow). In a million flights MCAS would not be used once unless there were other serious difficulties at play.

In such a system it is much better to have a false negative than a false positive. A false negative means that the aircraft doesn't change anything, and continues to follow the pilot commands. A false positive means... well, it looks like there are 2 crashes that demonstrate what happens.

Every automated system has a possibility of a false positive and a possibility of a false negative. In the system design you have to consider

( Probability of a false positive * consequence of false positive ) versus (probability of a false negative * consequence of false negative).

A team of engineers at Boeing certainly looked at the tradeoff above in the initial design. The probability of AoA sensor failure was most likely based on failure rates from historical aircraft such as original 737. The consequence of each failure was presumably a little harder to estimate, because no such MCAS system existed on previous aircraft, but they somehow they came up with an estimate of what would happen in each case. Based on that, they believed they had the right tradeoff.

Now, new information has come to light. Specifically, "consequence of false positive" is an absolutely unacceptable situation (two fatal crashes). Therefore the system needs to be redesigned. A increased probability of false negative may be acceptable, if it can significantly reduce the probability of false positive. Both errors are still possible, and both consequences still exist, but the tradeoff is shifted to favor one versus the other.

Having two of the same type of sensor may not improve things as icing conditions could easily cause disagreement just when it was needed the most. A second system, such comparison of airspeed, pitch to the horizon, power setting, and vertical velocity (In addition to what the pilots are doing) may be much more useful.

Grossly changing the horizontal stabilizer pitch in an uncommanded manner only worsens the situation when the pilot needs to be in control. Breaking a stall is done by releasing the elevator. A properly designed air craft will almost immediately unstall, especially if it is caught early. Strict adherence to aft CG limits greatly improves safety as well.

A more pilot friendly MCAS may work as follows. Design the elevator such that, in conjunction with the horizontal stabilizer, it does not have enough pitch authority to stall the plane under normal flying conditions. An aircraft of this type, with a properly set CG, at full aft elevator, will lose airspeed, start to sink, and "mush" forward with the nose dropping.
Have amber and red stall warning lights.

If a stall warning occurs (real or not), pilot and computer check second system data.
If stall is real, pilot activates MCAS. (toggle switch)

The MCAS would ONLY increase the elevator throw rate and travel. Much like dual rates in
R/C planes, this would hugely increase pitch authority, but would always be under the control
of the pilot. Once stable flight is restored, the pilot turns off the MCAS.

Best luck to Boeing getting this fixed.

The new system will not be a single point of failure.

Normally, the AOA sensors should not disagree. But then again, normally pilots should not be flying the aircraft near stall margins.

However, if the sensors do disagree -- it will tell the pilots with a cockpit indication: effectively "MCAS will not rescue you today, watch your trim". It should also automatically log a report of the failure to the maintenance staff. This then becomes a maintenance item that must be fixed soon.

You're right that either sensor failing will cause this, and you're right, that is a single point of failure of the MCAS system; but this would still require an unbroken string of pilot mistakes to cause a crash, and that string of mistakes isn't happening today on the thousands of 737 classic and NGs without any MCAS at all.