> If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out. That's not easy, but good engineering is making pla

> If redundant sensors contradict each other, what should the pilot do next? That's not easy to figure out. That's not easy, but good engineering is making plans for every sensor failure. Some failures are catastrophic - then make redundant sensors. Some are not - just ignore that sensor and try to infer that information from other sensors or defer to pilot. In my car there are many sensors and engine can run with many of them defective or disconnected, but typically in "safety mode". I even had failure of gas pedal (CAN-connected, so my car is drive-by-wire) and car managed to drive, but it used on-off mode and accelerated and decelerated very slowly. Similarly even with faulty sensor you can try to extract some data from other similar sensors and create safeguards.