Re: Surely...
Having two is less bad than having one: if you have two and they disagree then the system knows something is wrong and can notify the humans in charge of that and if possible put itself into some kind of safe mode. If the second thing is not possible then it can tell the humans that they need to be responsible for doing whatever it was the system previously did and disable itself altogether.
With only one you never even know if anything is wrong.
It's not clear to me in this case whether the humans can fly the plane safely at all on their own though, still less do so without a good AOA indication: if that's true then you want at least three sensors (but I think you also want a plane which can be flown in some regime where it is safe without them).
I also think the MCAS software didn't even pay attention to the 'disagree' signal.
Sadly Boeing are clearly too big to fail, because this should kill them.
Biting the hand that feeds IT
