That was kind of my point.. MCAS should turn off as soon as a single sensor fails, and three sensors are therefore unnecessary. Two sensors are sufficient to

That was kind of my point.. MCAS should turn off as soon as a single sensor fails, and three sensors are therefore unnecessary. Two sensors are sufficient to detect when a single sensor fails. If you only have two sensors and two fail, then MCAS remains active and your plane crashes. But that's not likely to happen. However that's more likely to happen if you have three sensors and try to use two sensors to vote out a third, in order to keep MCAS active when a sensor fails. In that configuration, a double failure (causing a crash) is three times more likely. My conclusion is turn off MCAS as soon as even one sensor disagrees with the others. And if that's how MCAS is configured, then three sensors is unnecessary overkill. If you want overkill, you may as well double up the sensors on both sides and have four instead of three; all the better right?