First, the black box doesn't actually do anything safety-critical. It's a pure data recorder, and only comes into play _after_ an accident. You're thinking more

First, the black box doesn't actually do anything safety-critical. It's a pure data recorder, and only comes into play _after_ an accident. You're thinking more of the flight control computers, as well as the air data inertial reference units (ADIRUs). These components are indeed redundant; from the sounds of the report, one of the ADIRUs malfunctioned (there are three), sending incorrect angle-of-attack data (as well as a lot of other incorrect data). Although the flight computers have monitoring routines for identifying and disregarding erroneous inputs, there was an unforeseen scenario in which a very specific pattern of erroneous AOA data could avoid detection - and this happened here. It's important to note that the plane was not in autopilot at the time - the autopilot disengaged itself immediately upon detecting an input discrepancy (several seconds prior to the actual pitch down event that caused the injuries) and the captain took manual control. However, due to the fly-by-wire system, the flight controls are normally processed through a rather complex system that (under normal circumstances) helps prevent accidents due to human error (eg, it's impossible to stall an Airbus A330 under normal conditions; the plane will respond to your commands until just before it stalls, at which point it'll force a pitch down or thrust increase to maintain lift). This invalid AOA data made the flight computers believe the plane was indeed in a dangerously steep climb, in danger of a stall (the stall warnings even sounded multiple times during the flight), and automatic protections called for a pitch down movement (ie, a descent). Due to the precise timing needed for the AOA fault to go unnoticed, some of the flight computers were unaffected - as such, shortly after each of the two pitch down events, flight computer error detection systems triggered failovers - but not until the flight computer currently in charge triggered a descent. The second time this happened, none of the primary computers were eligible for controlling pitch angle (due to each having a pitch-angle-related failure already) and so control passed to a more primitive backup system - incidentally disabling the pitch angle protections that had caused the problems, and allowing the crew to regain control.