Machinbird...regarding warnings blending with others and so on, in fact this accident is such an outlier in so many ways that the fixes applied by way of different messaging, auditory and visual alerting and so on, may rarely if ever be seen again, the risk being that, while this accident "uncovered" some aspects of the design that in these specific circumstances, crew included, we are not assured that there aren't other, different circumstances which, when they do occur and we have once again the benefit of years of analysis, new calls for design changes once again arise.
I'm not disagreeing with you so much as observing (as you have considered, I know) that the designers and the engineers must have done 99.9% of it right given the millions of unremarkable hours flown by Airbus crews, and the thirty-one A330 crews who, in the same circumstances, continued a safe flight to their destination.
The real question is, how far do we go in safe-guarding systems against inappropriate responses? What do we eliminate?...extremely rare conditions aside which potentially cannot be expected or even reasonably assumed?, more automation?, better-trained pilots? And if so, what justifies (and certifies) each response and who pays?, (because the airline passenger won't). How much can we expect (and pay for) from the designers, engineers and test pilots before we can all say, "enough has been done"?
Having watched and participated in this extended discussion on AF447 and related matters for five-and-a-half years now, I think it is important to be mindful of the very great amount of data "on the other side of the question" regarding automation, the Airbus, pilot competency and risk. I suspect it exceeds the usual 10-9 standard for engineering probabilities.
Is it "good enough"? Never, where loved ones' lives are concerned which is why accepting that 99.9% isn't good enough when statistics no longer apply...but, given how this industry does its work, will we know "not good enough" when we see it? The history of "not good enough" and the industry's response is deep in this industry which is why it has a safety record that is enviable by all other industries who must manage risk-to-life.
But it is not just not realistic to have it both ways - it is not possible to have it both ways and so the decisions on what may be reasonable to anticipate and what may be left up to resiliency, robustness, competency and probabilities remain silent until circumstances such as AF447 re-focus the discourse.
Last edited by PJ2; 14th Feb 2015 at 22:26.