What has always bothered me right from the beginning of this whole thing is that at some point in the design process the one, two, three or synthetic AoA input question must have come up. And when it did, surely someone put their hand up and said “With only one AoA vane feeding the FCC, an early failure of the sensor will only come to light when either the AP is switched off and/or the flaps are retracted. This really is not the time/speed/altitude/phase of flight to have large amounts of AND.”
Given that it is unthinkable that all potential outcomes weren’t modelled, who on earth decided that this was an acceptable risk to take? 😵