Wouldn’t they eventually all freeze at roughly the same position when the AoA doesn’t change for a while? Can’t they be heated?

They definitely are now. If you want to see what they look like, the channel AvE on YouTube tears one down (Search for BOLTR AoA) and discusses the mechanics. You can see what they suspect to be small cables for heating go up into the element.

The A350 has two types of AoA sensor - vanes and multifunction probes - which should reduce the chance of everything failing together.

They are heated now, after the Air France loss. This incident was also the reason for the MCAS system in the first hand: "Don't trust the pilot, regulate it into safety by your own".

Are you referring to AF447? According to the BEA incident report, the AF447 plane was already equipped with heating systems for the pitot probes and AoA sensors.

"1.6.9.1 Probe heating The probes that are installed on the aircraft are heated electrically to remove water by vaporisation when the aeroplane is on the ground and to protect them from icing in flight."

Reference: https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp09060...

Right, I mixed that up. With AF447 the initial problem was not the AOA but the very common pitot tube icing, which renders the airspeed indicator useless, thus leading to wrong stall warnings.

Even if the pitot tube is heated (mandatory), very often airframe icing leads to a blocked static port, rendering even more indicators useless.

https://en.wikipedia.org/wiki/Pitot-static_system

I still don't see how a frozen AoA sensor cannot be detected by the reduction in noise or correlation with other sensors (such as gyroscope or accelerometer).

The trick is to detect conditions like this with virtually zero false positives. Say the sensor fails one in 100,000 times and your algorithm has a 1/100 change of flagging a false positive in the case where the sensor is in fact working properly. Then the chance of a real failure successfully detected is:

    0.00001 * 0.99 = 0.0000099

The chance of a false alarm is:

    0.99999 * 0.01 ~= 0.01

Thus:

    P(failure|alarm) =  P(alarm|failure)*P(failure)
                        ---------------------------
                                P(alarm)

                     =   0.99 * 0.00001
                        ----------------
                        0.0000099 + 0.01

                    ~= 0.001

 

So alerts from your seemingly ok-ish algorithm will be false alarms 99.9% of the time!

Maybe you could have a pair of vanes. Each vane is physically limited to a portion of possible angles. Vane A would only work above say -10 degrees AOA and vane B below +10 degrees AOA. This would give you a regular test of both sensors when the AoA changes in normal flight. You have more bounding of correct values.

Majority vote is a very simple system to reason about. What you’re describing adds a whole bunch more complexity.

For the noise sensor scenario, is the sensor failing or is the ancillary (and single point of failure) noise sensor failing? What happens when you have a false positive like that and a false negative on another sensor?

For the correlation scenario, when you have two systems that disagree, how do you determine which one is failing? Are their precisions and tolerances sufficiently close that you’ll get a warning at a useful point in time?

It probably could, but you'd have to code for that, rather than expecting the majority of 3 sensors to always be right.