--snip--
If you were to write an article about this (beyond "think hard about your problem and deal with sensor failures") I'd be delighted to read it.
I haven't really addressed this kind of thing in detail, because I've mostly worked with loops that lack redundant sensors and which were inherently mechanically safe. I _do_ have an abhorrence of controllers with modes, because the mode change always seems to be awkward at best. I suspect that a modeless controller is going to be inherently better positioned to deal with sensors coming and going (not perfectly, just better, often).
I don't think it's just that people don't understand the limits of their models. I think that people are so used to academic problems that they forget that their models might possibly not be sufficiently accurate. There's at least a few places in the book where the phrases "if your model is accurate enough" or "if your linear model applies" appear. I also made a point in the chapter on dealing with nonlinearities of showing what happens when you blithely use a linear model to a design a controller for a nonlinear system (a big scary/embarrassing oscillation, in the example).