Originally Posted by
Luc Lion
If you re-read the Seattle Times article, you'll notice that it is only 2 bits flipping that are required for enacting the scenario.
Five bits have been actually flipped because this is the standard procedure for this category of tests ; flipping what is considered the most extreme and improbable data corruption : 5 bits simultaneously.
Also before getting deep into probabilities of N bits flipping it seems to me that the '5 bit flip' test is also a rational stand in for "something happens we have not though about",
In other words it is impossible to contemplate model and test every failure path but it is still vital to know outcome of failures no matter what triggering event.
There could be any number of paths that result in the Seattle times scenario most of which would be hard or impossible to predict in advance.
---
On the dual FCC fix:
Reading between the lines I sense that this might be implemented with simple "both say move or nothing happens" logic, either internal or could even be done with external HW (relay or other) close to the trim motor inputs.
This would be a lot less work than truly coupling the 2 in a high reliability cross checking mode.