So much is written about the stupidity of a single sensor vs multiples. I have been a participants of many FMEAs where participants have gone through different scenarios ending up with the more inputs, the more possibility of failure. That was followed with brainstorming how to detect a failure with the possibility of adding an additional sensor (the 3 sensor deal) tripling the possibility of failure with developing a method to determine which was the bad sensor. Easy, right, the 2 that match must be right. But if its a critical item the analysis must then go on to 2 bad inputs and 1 good, how to determine that?
AOA sensors - where to place? Two on one side, one on the other? AOA sensors are often clipped by birds and the possibility of birds taking out 2 on one side while flying through a flock of birds is significant. Suddenly 2 sensors are bad, still keep those bad signals and ignore the one on the side that didn't take the hit?
Solution could be a sensor that is not affected by FOD. When performing a systems analysis FMEA and determine an item is critical, the people analyzing can drive themselves crazy trying to find the perfect solution.
I've been retired for 10 years so processes like the FMEA may now be obsolete. However the MAX was in development for 7+ years (everyone says rushed into production but at my company there would be 2 generations in that time or we would be out of business) so its possible that is how the system was analyzed.
I am amazed how quickly the people here can quickly call decisions made stupid without having gone through an analysis like I described. Its so easy to armchair quarterback.
How times have changed. 15 years ago the A330 had multiple unintended pitch down events. That was before I retired and was frequently flying trans-Atlantic flights on A330s. There was talk at the time about grounding the fleet but think of what it would do to the industry so they kept flying. Watching the Canadian series "Mayday" is scary learning that at that time, Airbus had no idea, never could identify the root cause, and kept the fleet flying while they redid the software. Knowing the unit was actually produced by Lockheed-Northrup - were they the software developers? What is the difference between actually crashing and avoiding the crash because of altitude? Same thing with the AF447 incident. Continued flying - why? I ask because I continued to fly A330 flights with some unusual flight events, learning later that NWA, my home town airline I was mostly forced to use, had experienced similar events but the crews reacted appropriately.
Monday I fly out on a Delta 767-400 and 2 weeks later return on an A-330. Wish instead I could travel on something truly safe like the Titanic!