Re: Surely...
"The use of three sensorst allows a faulty sensor to be isolated and normal operation to continue."
It *can* do that, but it's not guaranteed to always fdo that.
It's usually a good idea, but sometimes it's not enough on its own, e.g. AF447 crashed because other Bad Things happened even with three sensors of two dissimilar desgns, before and after the identical two of its three pitot tubes failed identically at the same time (as had occurred on other aircraft on previous occassions in similar conditions, fortunately with less drastic consequences, but the implications had been recognised sufficiently for modification programmes to be required). It's well documented in various places.
When that happens, the two failed sensors can outvote the one which is behaving sensibly, but sensible flight crew may be able to either reduce the risk of it happening (don't fly through icing conditions) or recognise and resolve the issue if two did fail identically..
On the AF447 flight in question, the two identical pitot failures combined with various other unrelated failures (e.g. flying through icing conditions rather than around, less than ideal reaction from the crew, etc) led to the loss of all on board.
Biting the hand that feeds IT
