I had a similar discussion once, and the result was very biology cells inspired. Any subsystem must be able to repair itself, and must state its defunct state o

I had a similar discussion once, and the result was very biology cells inspired. Any subsystem must be able to repair itself, and must state its defunct state on repair needed state. If that times out the subsystem must destroy itself "deactivation". Dependant on importance other subsystems must pick up the load and create a replacement under strain over time. In a plane, the aoa could be replaced by sensor fusion of gyroscopic sensors and air density sensors distributed over the hull. Selfrepairing could be a achieved via a reservoir of peeble like standardized spare parts traveling through a conduit and applied via vibration and standardized interfaces. Final fallback, a simulation of expected circumstances, suggesting a half way accurate fallback model.