MCAS was added to the autopilot/flight computer system, which was brought forward from previous 737 designs, where there are two flight computers, each with an independent set of sensors; in case of disagreement, between the flight computers, autopilot would disengage and return control to the pilot. And in general, the types of things a pilot would do in response to commanded nose down would disable the autopilot until manually engaged again.
Unfortunately, MCAS acts autonomously, was not disclosed to pilots, and was not able to be disabled without also disabling electric trim control. Because it was built on top of the existing flight computer, which is safe enough, the behavior doesn't appear to have been separately considered.
From what I've read of the proposed fixes in news stories, it doesn't really address the root issue in my mind that the pilots should be able to turn off MCAS; although it does seem likely that it would activate erroneously less often, and that the plane will remain more controllable in the event that it does activate erroneously, it still seems like the situation would be dangerous in case it arises; which would seem possible if both Angle of Attack sensors failed in the same way at the same time. A third AoA sensor might help detect broken sensors, and make it less likely that all three would return the same wrong value simultaneously, but a switch to turn off MCAS would follow the Boeing philosophy of giving pilots control and letting them handle rare events.
Boeing will have a lot more freedom if it can do away with that.
But I don’t know if they can do that without bringing up the MAX to modern standards. The 737 is an old design.
But I largely disagree with grandfathering new planes because they’re built to an old design.
We don’t allow it for cars, why would we for aircraft?
This is not the airlines fault. The second sensor should not have been optional if failure of the first sensor might lead to catastrophic failure.
Intuition says you need three.
There is a backup to extend the landing gear if the primary hydraulic system fails, the plane can fly with one engine out, we make sure that even if an engine explodes it does not damage the air-plane, etc.
On the latter point, you can continue flying without autopilot or landing-assenting electronics and pilots are trained to do so.
MCAS has failed on all counts, it has been very unreliable and fail-deadly.
There are underlying hardware concerns, from the wings to the sensors themselves, that may require retrofits. MCAS can be patched, but I'm not convinced that a patched MCAS can fully address the hardware concerns.