If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out. Even if you had say 10 redundant sensors, and 1 doesn't agree with the other 9, is there cause for concern or no? And I'm not sure they'd install 10 sensors either, eventually you'll also get information overload for the pilot.

The aircraft will have configurations that are known to be good. For example a particular thrust level and pitch at cruise that should avoid overspeed. Or using a normal ascent profile at lower altitude, or full thrust in a go around. It should be perfectly possible to divert and land without functional air speed or AOA sensors. And there are other good sources of independent data. For example GPS/radar ground speed, the engine stats, vertical speed, wind data etc.

Although I agree that some pilots in the past have not performed well with these kind of complex failures. And criticially the solution could be an argument for more automation or less automation. And that plays into more political discussions about the future.

I wonder if a third option would be to report data in real time to the manufacturer. Have a mission control style setup that is trained to rapidly analyse data and give immediate advice to the pilot. With better communication systems this could be possible. Although it does erode the concept of "pilot in command" which is another political issue. Although pilots takes advice all the time from ATC and that works well. Why not advice on the aircraft systems?

> If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out.

That's not easy, but good engineering is making plans for every sensor failure. Some failures are catastrophic - then make redundant sensors. Some are not - just ignore that sensor and try to infer that information from other sensors or defer to pilot. In my car there are many sensors and engine can run with many of them defective or disconnected, but typically in "safety mode". I even had failure of gas pedal (CAN-connected, so my car is drive-by-wire) and car managed to drive, but it used on-off mode and accelerated and decelerated very slowly. Similarly even with faulty sensor you can try to extract some data from other similar sensors and create safeguards.

That's generally not how redundant systems work. They'll usually implement some form of a Kalman filter or whatever cool kids use these days to filter out bad readings, while alerting the pilot that one of the sensors seems to be faulty.

Usually things that can kill people are triple redundant, where one goes bad, you can trust the other two readings for this reason.

I'm surprised there is a single point of failure like this in the design. But after I've read a bit about how Boeing released this product, maybe I'm not surprised.

The doesn't account for a systematic failure. It doesn't matter if you have 1000 sensors if they all fail at the same time.

Then you could also use more than one type of sensor, for example accelerometer & GPS

Personally, I believe the problem is too few sensors. Don't make it 3 or 10, make it 10K sensors. If 10% are off, you can simply ignore them, and not even alert the pilot.

Living beings have millions of sensors for most input and are able to work with conflicting sensory information because of this high redundancy.

> In Air France 333, the pitot static tube, which measure airspeed, was jammed by ice.

In such a case, all of your 10k sensors would have been iced.

But they would not go down all at once like one or two sensors. As they would be spread across the plane, the system would "feel" it is losing sensors and be "aware" of it.

It would know when to invalidate sensor input and tell the pilot about it. With a mix of Pitot and other sensors, it would be even more precisely able to know when to stop trusting the sensors. This is something that is currently lacking.

Do you propose to grow airplanes, too?

Minor correction: I believe that was Air France flight 447, not 333, which involved an Airbus A330.

Airbus 332 he refers to stands shortened for Airbus A330-200

My mistake! Thank you for the correction!

Different sensors, yes. But similar issues -- in one case the pilot stalled the plane, and in the other case software designed to prevent a stall caused an unrecoverable dive.