Originally Posted by
Sriajuda
Exactly my thoughts. And it neither starts nor ends at the computer level: AF447 was not the first AC brought down by a pitot failure. The mistake I see there is what I call 'false redundancy'. While the sensors are there in triple, they are not truly redundant as
a) they are the same type and manufacturer
b) they operate on the same physical principle.
Since numerous ways to measure air speed exist, I cannot understand why not even one truly redundant airspeed measuring device is used in AC. (Boeing is the same here,
AFAIK).
The "redudancy" assumed by this design of speed sensing - which at this point is not different than other manufacturers - seems to target intrinsic/internal sensor failures and less a failure caused by external events, such as weather.
With the current design, the 3 pitot tubes are not only of the same type and same manufacturer, but they are also located pretty much in the same place - under the nose - and thus they're sharing the same fate and will likely behave the same way in front of external events, such as weather. They will fail the same way, and pretty much at the same time, which the case of AF 447 shows so clearly.
From a system architecture and design perspective one can find many weak elements, some of which several recent posts, including yours pointed to.
In the wider perspective, in which design decisions include costs, a very well trained crew, and many others, the presence of multiple factors is supposed to provide an attenuation of the effects of these weak elements. Statistically though, there is always a probability that the elements necessary for the whole to work well are NOT going to be present - as the case with AF 447 shows - with the tragic consequences we know.