By my calculation the plane was flying roundabout 100.000 days with 2 accidents. Assuming 2 round-trips a day maybe 200.000 takeoff during this time. One crash every 100.000 take-offs.

Now assuming 40.000 road deaths per year in the US and 300.000.000 citizens we have 0.000133 probability to suffer a road death a year. Assuming one 737MAX round trip per quarter we have 8 take-offs so .00008 probability to die in a 737MAX. Assuming commuter 40 trips a year we have a risk much higher than the average road death risk.

I assume that AoA sensor disagree would have been warned about still on the ground. Even if both fail, a new take off checklist will probably include comparing AoA information with analog instruments. If one sensor failure is 10E-5, two simultaneous should be 10E-10, multiplied with assumption of competence (say 99/100 will now know how to deal with it), which gives 10E-11 - 10E-12. I.e. I wouldn't worry about MCAS anymore after every plane has been updated.

What I would worry about is departure stalls, as MCAS doesn't seem to solve these. I wonder whether there isn't another 10E-5 to 10E-6 risk in there and people have just been lucky so far. Another MAX8 crash involving a stall would kill this plane I think, as it would prove much more that it's inherently unsafe.

> If one sensor failure is 10E-5, two simultaneous should be 10E-10.

That only holds if errors are statistically independent. See also Common Mode Failure [1].

[1] https://en.wikipedia.org/wiki/Common_cause_and_special_cause...

From the FDR data in the report, it seems that the AoA sensor disagreements on this flight didn't start until after takeoff. I don't know if this is the normal failure mode.

Indeed. The speculation is that it was caused by a bird strike during takeoff.

That is not how plane safety is done.