True, there are some parts which are both safety critical and fundamentally unable to be made redundant, at least not without drastically compromising the overa

True, there are some parts which are both safety critical and fundamentally unable to be made redundant, at least not without drastically compromising the overall design. But that doesn’t justify leaving out redundancy in parts which are able. In any case, the actual regulations in play here would have required redundancy if the consequences of failure had been properly categorized: > [I]n normal flight, an activation of MCAS to the maximum assumed authority of 0.6 degrees was classified as only a “major failure,” meaning that it could cause physical distress to people on the plane, but not death. [..] > He said virtually all equipment on any commercial airplane, including the various sensors, is reliable enough to meet the “major failure” requirement, which is that the probability of a failure must be less than one in 100,000. Such systems are therefore typically allowed to rely on a single input sensor. > But when the consequences are assessed to be more severe, with a “hazardous failure” requirement demanding a more stringent probability of one in 10 million, then a system typically must have at least two separate input channels in case one goes wrong. https://www.seattletimes.com/business/boeing-aerospace/failed-certification-faa-missed-safety-issues-in-the-737-max-system-implicated-in-the-lion-air-crash/ https://www.seattletimes.com/business/boeing-aerospace/faile...