The KC-46 has a two-sensor MCAS system, which “compares the two readings,” the Air Force said.
I’m aware that the 737 uses two sensors and always has, but the computer reads them simultaneously based off which pilot is flying the plane. So if the Captain is flying it’s reading data from the left side, correct?
At this point I’m assuming Boeing’s decision to pull data from one sensor was to reduce the workload and make for a earlier introduction?
According to the article, the KC-46 uses the dual FCC/AoA sensor for computing both FCC channels and comparing the command signals. With two disagreeing signals there is no way to determine which one is correct and the usual remedy is to disengage both, warn the pilot, and engage in the appropriate crew procedure. And that requires training.
The B737MAX was promoted as requiring only very limited differences training relative to the NG, so the setup for the KC-46 could not be copied. The original design of MCAS in the B737MAX also used two transducers for activation - two different types of transducers, both of which had to be over a threshold value, as mentioned in this answer. Original design MCAS only had limited authority of 0.8 deg stabiliser. From the crash report of Lion Air 610, page 204:
MCAS is designed to function only during manual flight (autopilot not engaged), with the aircraft’s flaps up, at an elevated AOA. As the development of the 737-8 (MAX) progressed, the MCAS function was expanded to low Mach numbers and increased to maximum MCAS command limit of 2.5 of stabilizer movement.
The report states that in the failure analysis, Boeing classified the uncommanded MCAS failure condition as Major (which may not occur more than once in 10$^5$ flying hours), instead of Hazardous (1:10$^7$) or Catastrophic (1:10$^9$) allowing for indeed a single transducer input. Again from the report, page 206:
If the probability of an undesirable failure condition is not below the maximum allowable probability for that category of hazard, redesign of the system should be considered. If the uncommanded MCAS failure condition had been assessed as more severe than Major, the decision to rely on single AOA sensor should have been avoided.
Why all of this was done for the B737, while the KC-46 uses two sensors, is a conglomeration of factors. Two sensors is best. Time pressure for plane delivery, airline customer pressure for limiting differences training, the observation that previous versions of B737s with accumulated flying hours of 250 million had experienced no catastrophic failures due to AoA sensor failure (reference again from the crash report), all led to the perhaps justifiable belief that the one sensor was sufficient. If rapid action was taken by the crew to contain the failure - but the failure could not be reognised in time. Again page 206:
During the single and multiple failure analysis from the air data system worst case scenario of “failure of one AOA followed by erroneous AOA”, Boeing concluded that the effect would be hazardous until the flight crew recognized the problem and took appropriate action to mitigate it. Since the training or the guidance for actions taken in such situation were not provided, the effect category should have remained hazardous.
Since the FCC controlling the MCAS is dependent on a single AOA source, the MCAS contribution to cumulative AOA effects should have been assessed.
We can't know why Boeing did what they did unless they tell us and given the legal implications of saying too much there's more noise than signal. I can speculate with the rest on an answer with the rest of them.
The 737MAX MCAS was meant to provide a certain "feel" on the control yoke to the pilot when making specific maneuvers. MCAS would be expected to make minor corrections to the trim, do so rarely, and any failure was expected to look like a runaway trim or other failure that pilots were already trained to address in the 737NG. This was not considered a flight critical function and so used only one sensor.
On the KC-46 the purpose of MCAS was to mitigate the shifting center of gravity as fuel was being delivered to other aircraft. MCAS would be in near constant operation, it had what was believed to be far greater control of how the aircraft performed, and so used two AoA sensors for redundancy of input.
As I recall the decision to use only one AoA sensor was not to reduce workload on the engineering and testing but to reduce workload on the computers in the aircraft, computers that already had considerable workload for their capability. One AoA sensor meant not needing to take the extra computing power to check one input against the other.
I wish I could recall where I read this but someone that claimed to know what he was talking about said that it would have been possible to not only compare one AoA sensor against the other but to compute the AoA from other sensors to determine which sensor was giving good data if there was a disagreement. This is in effect a "virtual" AoA sensor so that there can be a vote of 2 out of 3 on what is the correct AoA. Additionally this was supposedly possible without exceeding the computing power of the 737MAX onboard computers. Assuming this was possible that would have meant additional work to create this software and validate it was safe. Given Boeing had a tight schedule, and MCAS was not considered safety critical by the FAA, this extra work was not done.
While the AoA sensors are on all 737MAX aircraft not all have this information available to the crew. The crew would only be told of an AoA sensor mismatch if the airline purchased the option for AoA indicators on the flight deck. This was apparently not a popular option, few 737MAX aircraft had AoA indicators. Again, there are two AoA sensors on all the 737MAX aircraft but not all aircraft had AoA indicators for the crew, MCAS had this information but the crew might not.
Airbus apparently views AoA indication differently. They put three AoA sensors on their aircraft so that single sensor failures can be detected and corrected. Again, there is a claim that Boeing could correct for a single AoA sensor failure by computing AoA from other sensor inputs but they chose not to. It's possible they chose not to out of legal reasons as much as practical and technical reasons. If they demonstrated the ability to calculate AoA in order to detect and correct for a single AoA sensor input failure then that could open up another investigation on why this was not done before.
Boeing may have to dig in their heels on maintaining that AoA is "nice to know" rather than vital to controlling the aircraft so as to not attract more lawyers. I don't know how important knowing AoA is to a pilot as I am not a pilot. I expect this to be debated for some time.
