> the system did what it was designed to do, i.e. fail safely when it receives data that it can't process
I am no expert in air traffic control systems, but in a case like this, wouldn't it be better to simply reject the incorrect data and send a warning or something similar?