Originally Posted by
CONSO 
Bird strike or ramp rash or software error are three most obvious- the point is to alllow a SINGLE sensor to directly override pilot input and not be documented that it even exists is as close to criminal as one can imagine.
Originally Posted by
Prag
There is no such thing as 100% reliable sensor. You can vote in software, but in case of two sensors you dont know, which value is OK and which is bad, you need at least three to have confident voting system. There are much better options sw engineer can use, if he knows something about the subject and phisical reality it deals with. I'm just plain earth based industry programmer, but can imagine some verification methods that works even with one sensor. The basic method is to observe sensor behavior in time, just as you watching if it works by your own eyes, in many phases of flight.
- during the takeoff run just before plane goes airborne, you can assume that values AoA should be close to zero. If not, sensor is stuck or misaligned.
- after that should the values change to positive normal range, if not, the sensor is stuck. This is also the case of normal in/flight behavior, values in acceptable range, that change slowly and possibly with small difference between two sensors according to actual flight conditions. So you can tell its still living and not stuck somewhere.
And the most significant, dont check for value constantly over the set threshold. You should check if value rises from accepted range dynamically and in one moment oversets it, then act.
Programmers working for Boeing or component manufactors should have known this. I'm somewhat surprised they obviously dont. Or maybe the flight computer is totally out of resources after mods.
I agree with CONSO here. With just one sensor you have to do lot of magic with the input and it gets flaky near the edge of the envelope and/or when there are unusual environmental conditions present, which is just when you need it the most.
Any form of redundancy would be better, even if you just disabled the system when there was a difference between the sensors and displayed a caution to that effect. At least then you are back to pilot inputs only, rather than random stabiliser motion. GIGO, as they say...