a single sensor and to take such dramatic action based on it.

I don’t know anything about airplanes but I am somewhat familiar with automotive and heavy truck controls and software. Those applications do two things that do not seem to be done by Boeing: First, I can’t believe that they only used one sensor and assumed it was right! There are two things the automotive world does to avoid this.

First, the use of redundant sensors. When there were several cases of unintended acceleration manufacturers took a lot more care to ensure that the pedal position read by the computer is a real one. The pedal position sensor is itself a device with two independent sensors in it. They are powered off of 5 volts from the ECU. There is a range of valid signals, usually 0.5 to 4.5 Volts. The two parts of the sensor are wired opposite from each other so that at idle one is at 0.5 Volts, the other at 4.5 Volts. At full throttle it’s the reverse. So 1.0 and 4.0 Volts is valid, etc. In this way if the sensor shorts to ground, shorts to power or shorts to each other then the ECU knows there is a problem. If the signal from one gets too far from the value expected based on the other the ECU knows there is a problem and you can idle to the side of the road but your car won’t go out of control.

For other sensors the car (or at least heavy trucks) have models of what is going on and what to expect. In addition to sensors having valid ranges, a heavy truck engine knows how long the engine has been running and at what load, etc and continuously runs a model of the parameters it is interested in. It will look at, for example, various temperature sensors and compare them to each other and to the expected value. If you have been running for 20 minutes and you have 180 degree oil but the water temperature is 90 degrees then you will get a “sensor value not plausible” fault even though the water temperature appears to be a valid value. It would not make sense based on a bunch of other data that all correlates with each other. It is the one thing that would not fit.

I am surprised that Boeing didn’t do something similar to model thrust, airspeed, altitude, etc and decide that the angle of attack sensor was not plausible and should be ignored.