SR71
I aggree re he man/machine interface.
And re redundancy and failure detection: if you can't decide from two, you need three. Some digital instruments are smart enough to figure out when they're wrong (and the radalt seemed to have signalled just that, no?) in some other cases, you have a redundancy of three (like the airspeed indicators in the Birgenair case. Two on the main screens, one steam gauge somewhere else).
But that isn't my point really. The point is that, and you said it right: things fail, but they must either fail towards a safe mode or, if they fail to manual intervention, they must announce that completely unmistakeable.
The thing that I find shocking here is: surely the PF was required to have his hand on the throttles. If he had, he would have been fully aware of them going to idle, no?