The problem is that there is no redundancy in the sensor input. The quote from the article is:
This original version of MCAS, according to two people familiar with the details, was activated only if two distinct sensors indicated such an extreme maneuver: a high angle of attack and a high G-force.
So on the original design, MCAS activation required two sensors detecting an input over a certain threshold, and in itself this creates protection against false positives.
There are two major failure modes for sub-systems:
- Zero output, where the sub-system simply stops outputting a signal.
- Hard-Over failure, where the sub-system outputs a false positive. This is what happened with the AoA sensor in the two MCAS disasters.
With the original design, if one sensor would go hard-over, MCAS would not activate and the system would be protected against a single failure. But in the certified config, the activating input was not checked against any signal and MCAS repeatedly activated.
Further notes on the AoA sensors, from the final accident report page 45:
The safety analysis of the certified system has proven to be fatally incorrect, and this is what is so baffling. A single mode of failure was allowed to activate a flight critical system, by the most experienced aerospace company on earth. Plus: the incorrect safety analysis was accepted by the aviation authority whose function it is to protect us, the passengers.