I wouldn't be surprised to find out it is an optional unit like the attack angle sensor for MCAS

In the MCAS case the 'optional' component was an AoA display available to the pilots. Due to a misunderstanding about the design intent, planes without this option also did not display an AOA DISAGREE alert if the sensors disagreed. (I agree that such a simple situational awareness aid based on data the plane already has being a paid option is pretty absurd)

However all MAXes did/do have two AoA sensors, and prior to the fixes, regardless of the AoA display option, MCAS only considered one of them.

In the MCAS, the ‘AoA disagree’ sign allowed more freight to be carried. The pricing segmentation is based on freight, the intent was not segmentation over security levels.

Even if it leaded to lowering security so much that 4 planes crashed in just a few months.

The AOA DISAGREE was never intended to be optional, that was a bug due to miscommunication between Boeing and the avionics manufacturer, if the congressional report is to be believed.

Only the persistent numeric AoA indicator was optional. And none of this had anything to do with freight, there's no difference in capabilities between the aircraft, it's purely about pilot situational awareness.

https://boeing.mediaroom.com/news-releases-statements?item=1...

Agree with the overall sentiment.

But to pick on this point, from a systems perspective, isn't a single thermostat still a single point of failure? So to address the issue, they'd need to add multiple (2?) thermostats, each linked to a different bus etc.? Asking out of curiosity on how these systems work...

3, at least. Two just tells you one is wrong, not which. If you have 3, you take the two that agree.

Makes sense and thanks. Sounds like the kind of capability that gets very expensive to include late in the game. Which speaks to a problem with contemporary culture at Boeing, which was to get rid of the test and QA roles that would typically catch these issues early enough to incorporate the solution (3+ thermostats) back into the design before it got too expensive to do so. Microsoft, btw, is guilty of the same test & QA culture dilapidation, which results in the crap Windows we get nowadays.

Thermostat malfunctions, and de-icing stops working when needed...

Still better than no thermostat at all and it's up to the pilot to decide even though he doesn't have any means to determine what to do

Sounds like more redundant thermostats and median filtering is the solution, not removing all and melting your engine.