I think what you really want to do in aviation (or anything safety-critical) is reduce risk of failure. Avoiding risk of mechanical failure at the expense of co

I think what you really want to do in aviation (or anything safety-critical) is reduce risk of failure. Avoiding risk of mechanical failure at the expense of controllability is simply pushing the blame onto the pilot. The general approach for critical hardware like flight controllers is triple redundant systems with two-out-of-three voting, driving redundant actuators. MCAS is a prime example of this NOT being followed, because it relied on a single sensor input to generate a significant control output.