I meant disabling the system if they disagree. I agree that one can argue that this doubles the chance of system shutdown compared to properly detecting that o

I meant disabling the system if they disagree. I agree that one can argue that this doubles the chance of system shutdown compared to properly detecting that one sensor fails. That's obviously only ok if the system is expendable to a certain degree.