There were absolutely software design failures - to have two sensors but only read the value of one of them and to not even apply sanity checks to check the sen

There were absolutely software design failures - to have two sensors but only read the value of one of them and to not even apply sanity checks to check the sensor is working (e.g. is the sensor saying that the aircraft is pointing towards the sky when it's on the ground?). It's simply crazy. The only plausible explanation is that Boeing did not perceive MCAS to be safety critical, even though it had control of the aircraft, and so they didn't bother to apply any redundancy to it. Boeing seemed to wrongly assume that any failure modes would appear as a runaway trim.