Lebo77

Not quite. It's even dumber than that.

It picks one sensor to watch each flight, switching to the other one next flight. Has the other AOA sensor been damaged in the two crash flights it would have been a non-event.

This is being fixed in the software update.

They are just making it fail passive. That is any substantial miscompare disables the system. That's fine since this is not required to fly and land the aircraft. They will also let the pilots know via a PFD annunciation that the miscompare exists.

Eh.

They are making the system fail passive, so if there is a miscompare it cannot do any harm. If it was a flight critical system you would be 100% right, you need 3 to figure out which one is malfunctioning.

It's a distinction that matters. I work in aviation and the people who do the architecture and define the requirements are not the same people who write the code in most cases.

This goes to a deeper problem with how the industry handles system architecture, especially on legacy platforms.

BINGO!