There was probably a fair amount of computer simulations involved that showed it would work and they trusted the simulations too much.
No simulation can justify 1 sensor as the only input to override pilot control.
This was criminal, no doubt in my mind...
Airworthiness certification for a plane without redundancy in a system is NOT about simulations.. the need for redundancy had been a requirement for civil aviation for a long long time... there was criminal activity involved in this plane getting certified for airworthiness with a model that had only input from one sensor allowing the override of pilot control..
There is no other way this happens unless you believe that all of Boeing and all of the FAA are innept.
You will find evidence that folks inside Boeing and the FAA warned that this was not acceptable I guarantee it.