PJ2
thanks for your considerate response in
1503
I disagree. These two accidents bear only superficial similarities. I think it is beneficial to understand why. The main reason is, the similarity between the static/pitot sensors and a Radio Altimeter in terms of the nature of potential outcomes should one or the other fail, especially in the two accidents cited, is minimal.
An airplane with an unreliable Radio Altimeter can be flown without a problem - it is a non-event. I have seen it, flown it, seen such spikes/dropouts in flight data. I have also flown a B767 with serious pitot-static problems, (at night, over mountains) and know the potential for disorientation.
Yes, that's all true for a single system. The 767, however, has three independent pitot systems, right? (two for the CPT/FO PFDs and one feeding the Backup). So while a sinlge pitot/static, if it fails without any backup, will create a major issue, having three of them will always render the failed one a minority.
The same is true for the two independent radalt systems. In that case it's at least rather trivial to determine that they are in disagreement and thus not trustworthy. If you then also look at altitude trends from the barometric altimeter, you'd again be able to rule out the faulty one.
The design of the current system does feed from a single data source, though and doesn't seem to make use of available redundancies. I'm sure there is a design decision behind this, and I guess my knowledge is insufficient to second guess the design. I'm just stating that there are options to have fallback systems.
There may be engineering aspects to this but this isn't fundamentally an engineering issue. It is an airmanship, piloting issue.
True. There's always a point where you get to a system state that hasn't been anticipated in the design, that's the point where you have to throw it over the fence to you guys.
A nonexistent risk is, by definition, nonexistent...