Instrusion from SPL; disregard as desired.
The problem with redundancy is when there are common fault cases. For example if (hypothetically - not implying this happened with AF447) there is a certain environmental condition where a pitot sensor is susceptible to icing, this might apply to all three.
Reminiscent of the BA 747 losing all four engines from flying through a cloud of volcanic ash, or the L-1011 that lost two engines (and most of the thrust from the third) due to losing oil from not having the oil plugs replaced after a check of some kind.
With three failed pitot sensors, there ain't a whole bunch clever software can do. Even with two failures, you have a big problem - two incorrect sensors in agreement with each other, or possibly three all disagreeing
Garbage in, garbage out is the saying in the software business.
If indeed there is a pitot icing problem here, the problem is a mechanical/physical pitot/static sensor design problem NOT one in the software/automation.
Except that the software’s response to the issue could be better. Why not have the A/P go into attitude hold in this case, instead of simply disconnect? A given attitude and power setting will result in sufficient airspeed stability to at least assess the problem without having to wrestle with the airplane at the same time.
If they were on direct law, they were lucky, IMHO. In alternate law, if IAS goes to a (right or wrong) low figure one has to pull the stick to avoid nose down automatic command (and the contrary for high - right or wrong - IAS reading).
What’s the design justification for even having altenate law? Wouldn’t it be better for the pilot simply to know that the normal law envelope protections are gone, rather than have to remember which subset of them are still in effect? In some ways, partial envelope protection (if that’s what alternate law provides) is worse than none at all – especially if the transition occurs at a difficult moment, as seems to be inherently the case.