As someone who has flown many post-major servicing maintenance test flights on the VC10K, the thing which immediately struck me when reading the CVR transcript was the woeful attitude towards flight testing exhibited by the crew.

I see no indication of a pre-planned flight, no indication of a test card with mandatory height/speed/configuration test points, just an "OK, I think we'll do this next" attitude - and rather weak knowledge of the characteristics of the flight laws.

Post-maintenance testing requires a highly disciplined approach, an experienced test team and a thoroughly pre-briefed flight with prepared test cards. It isn't the same as raw 'test flying' and doesn't necessarily need a fully qualified TP, but it DOES require a selected and well-trained crew with better than normal aircraft system knowledge.

Unexpected things may well happen during post-maintenance test flying - I once last half of the entire electrical system and all attitude instruments until we managed to relight the associated engine and get its alternator on line. (Good thing we didn't drop the ELRAT; on the next test flight its alternator control unit caught fire causing smoke on the flight deck during the approach...:\)

Thanks Thunderbug & NOD

I've looked at the diagram on page 94 of the report and can see the entrance route of the water. I understood that the body/internal moving parts of the sensor was heated, but they're not, just the external vane. The fuselage seal is a difficult one to design out given that the vane must freely rotate; internal heating of the body of the sensor is a start.

Well, if you think that making the AoA sensors pressure wash proof - yes. But why? There seem far more fundamental issues to address to prevent a "repetition" which is the aim...

I suppose it comes down to whether the "basic cause" of the accident was HF based, or Technical? To "blame" the AoA sensors means Technical. To me, it was a HF accident unfortunately.

As I said, I fly A320s for a job, with Pax down the back, in all sorts of weather. I have no cause for concern over the AoA sensors as fitted.

NoD

NOD

Agreed, but like all accidents it's a series of holes lining up together,
1 Incorrect maintenance (washing)
2 Water penetrating parts of the gubbins
3 Icing
4 Crew not trained for the task

If just one of these holes had been closed do you think the accident would have happened?

I'm pleased with your comments re Airbus AoA sensors. Thanks

Would this be a fair assesment?. Came from the accident investigation.
PROBABLE CAUSE:
The loss of control of the aeroplane by the crew following the improvised demonstration of the functioning of the angle of attack protections, while the blockage of the angle of attack sensors made it impossible for these protections to trigger.
The crew was not aware of the blockage of the angle of attack sensors. They did not take into account the speeds mentioned in the programme of checks available to them and consequently did not stop the demonstration before the stall.

??The following factors contributed to the accident:
* The decision to carry out the demonstration at a low height;
* The crew’s management, during the thrust increase, of the strong increase in the longitudinal pitch, the crew not having identified the pitch-up stop position of the horizontal stabiliser nor acted on the trim wheel to correct it, nor reduced engine thrust;
* The crew having to manage the conduct of the flight, follow the programme of in-flight checks, adapted during the flight, and the preparation of the following stage, which greatly increased the work load and led the crew to improvise according to the constraints encountered;
* The decision to use a flight programme developed for crews trained for test flights, which led the crew to undertake checks without knowing their aim;
* The absence of a regulatory framework in relation to non-revenue flights in the areas of air traffic management, of operations and of operational aspects;
* The absence of consistency in the rinsing task in the aeroplane cleaning procedure, and in particular the absence of protection of the AOA sensors, during rinsing with water of the aeroplane three days before the flight. This led to the blockage of the AOA sensors through freezing of the water that was able to penetrate inside the sensor bodies.

The following factors also probably contributed to the accident

* Inadequate coordination between an atypical team composed of three airline pilots in the cockpit;
* The fatigue that may have reduced the crew’s awareness of the various items of information relating to the state of the systems

Contributary Factors
 

I am surprised that the summary doesn't mention the unhelpful, to put it mildly, attitude of ATC, though it is discussed in the main body of the report (section 2.1.3, page 86 in the English version/90 in French). It was their baffling refusal to allow a few measly 360s that caused the whole low speed test first to be cancelled and then later inserted at a wholly inappropriate point in the flight. It also encouraged the crew to keep their later intentions to themselves. The obstinate and bureaucratic 'you can't do that there here' attitude, with no explanation, has a lot to answer for and should have no place in aviation, but is sadly common. This crew was not the first to be tripped up by a sudden ATC-inspired change to a flight test schedule, the A 330 accident at Toulouse in 1994 is a case in point.

Need to set trim
 

When I read the whole report what struck me was that even with everything that was done wrong, I think they almost saved it at the end and would have made it if it was not for the trim being against the end stop. The warning about manual trim required vanished off the FD when it shifted into the unusual attitude mode (Abnormal Alternate Law).

I'm just an SLF with a strong interest in aviation, but is there not a case to be made for some form of highlighting what the trim is and the need to manually correct it in this type of scenario? I appreciate that there's going to be a ton of sounds going off and lights flashing, so not quite sure how to achieve it. Maybe add a "Check Trim" to the stall recovery checklist?

Jesus H Christ!

Does anybody actually read the thread? Or are many so hell bent on posting, you just post anyway?

How hard is this? Every flight is a serious event; a post-maintenance flight even more so. A post maintenance flight involving testing of systems is particularly delicate. This crew stuffed it up.

End of story.

gonebutnotforgotten

What are you talking about? What unhelpful attitude from ATC?

This crew filed a flight plan that made no mention of the manoeuvres that they were planning to fly, and was described by one controller as a "disguised test flight", so who was tripping up whom?

It seems that another aircraft from the same company had played that game earlier in the day, creating coordination issues for ATC, with a "few measly 360s". So ATC were not about to be bitten twice. Whose fault is that?

If the crew had requested a "real" test flight, I'm pretty sure that ATC would have obliged, but as the crew didn't seem to know what they were doing themselves, how could they?

Sorry, ATC didn't trip anyone up in this case, and I fail to see how ATC contributed to the A330 loss in Toulouse.

Have you just got something against French ATC?

TTFN

I agree about ATC: try doing an approach into LHR then ask for a couple of 'touch and goes', a few asymmetric circuits and a flapless landing... I think you might get a rather terse reply.

Airspace all over Europe is busy - delays at choke points and level restrictions are common, especially when the military are using their bits. To expect to fly a test profile without checking beforehand is relying on pure luck; how many aircraft on revenue flights had been planned through that area?

Slightly more on topic, I feel sorry for the two line pilots who paid the ultimate price... I remember being called out long ago for a test flight as a 2-ringer with less than a years experience. We rattled through a schedule and half the stuff went wrong: the pressurisation failed totally and we couldn't relight one of the engines, amongst other things. At the time I thought it was great fun as I was actually doing the flying, shutting down engines, Mmo runs, etc. - now, I'm not so sure it was a good idea and I think I was naive in the extreme to accept this flight with no training or briefing. Unfortunately, as spelt out in the report, there seems to be no official guide/framework as to how you qualify to execute sorties such as this.

The 3rd guy on the jumpseat should have really known better, though - he *was* qualified and experienced in this line of work. :(

BWB
"I've no time for sentimental notions of a fictional 'band of brothers'. The pilots of this A320 were not 21 years old. They knew better. If they didn't know better, they should not have been charged with the responsibility they had. It's as simple as that. Fallen comrades is bollocks. So is blaming Airbus. Damn the French, but not for this."

Agreed but the one thing I find worrying about this and the B737 manual reversion check flight event cross referenced in the report is that in both cases all of the pilots involved appeared to have forgotten a basic fying principle - if you cannot control the a/c in pitch the first thing to do is trim. Yes, a trimmable stab has to be used carefully but it has to be used ! Even though auto trim is the norm and the Airbus sidestick uses spring feel rather than feel related to dynamic pressure the principle of trimming an aeroplane remains the responsibility of the handling pilot. In events where the a/c is plainly not in control in pitch it should also be the first thing checked (via stab position) by the non-flying pilot. It seems that the industry training methods and recurrent training methods are seriously deficient if there are pilots out there who don't understand this or, heaven forbid, have forgotten the basics and are more system operators than pilots. And don't give me the spiel about auto paralysis and SOPs and following the book - what's wrong with the Mark 1 computer when the chips are down.:ugh:

There is a serious breach of Airbus in the certification standards. The CS 25 document requires, paragraph 1309 (c), that pilots be informed of any failure so they can take appropriate action. If the pilots had been warned that 2 sensors were blocked, they never tried to test the proper operation of protection systems in which these probes are the main element.

CS 25.1309
(c) Information concerning unsafe system operating conditions must be provided to the crew to enable them to take appropriate corrective action. A warning indication must be provided if immediate corrective action is required. Systems and controls, including indications and annunciations must be designed to minimise crew errors, which could create additional hazards

Spa83
 

Nobody was aware that the angle of attack sensors were inoperative so how could the Pilots be informed of this?


Regards
Exeng

Not trying to blame this crew as they are now unable to defend themselves.

As said previously, in general pilots are getting away from the basics!

If you are testing something during test, you should be expecting it not to work or fail. If not why do the test? If you are expecting the test to fail have sufficient alt to recover.

Any low speed work at least bug Vref, or better still the Vs for the weight and configuration of the aircraft.

Auto trim? Now that to me is scary.

- the answer to that is, as SPA83 posts,
'CS 25.1309
(c) Information concerning unsafe system operating conditions must be provided to the crew to enable them to take appropriate corrective action. A warning indication must be provided if immediate corrective action is required. Systems and controls, including indications and annunciations must be designed to minimise crew errors, which could create additional hazards'

I would have expected an aircraft, which is supposed to be all things to all pilots, to know when 2 of its 3 PRIMARY sensors have 'failed' and therefore disagreed with the third. It is not even as if all 3 had failed at the same alpha when the warning system would need to be extra-clever.

Exeng,
Have a look at the page 33 English version :
This is an absolute shame !

My apologies to those who can rightfully call themselves professional pilots for stating the bloomingly obvious:

Airbus is not all things to all pilots! Whoever is subscribing to this is buying marketing hype that has no connection to reality whatsoever! It's just another aeroplane. Granted, it has some quirks but when it comes down to basics, everything DP Davies wrote still holds true for the Airbi and one cannot choose to disregard it at his own peril as no Airbus is single seater! Airbus Industries attempt to create foolproof aeroplane has spectacularly failed, it only proved old maxim that nothing is foolproof because fools are so ingenious.

Extra clever computers? Alow me to use analogy; you are flying in IMC and unbeknownst to you two of your three EADIs start toppling simultaneously at the same rate, in the same direction. There are no ATT flags, just two ADIs that agree but are wrong and one that is right. Would you really be smarter than ELACs/FACs that outwoted the truthsaying AoA probe in favor of other two that agreed, yet their output, while valid, had no semblance to actual AoA?

The AoA sensors did not fail outright - they kept transmitting measured angle of AoA vanes, which did not match actual one as their pivoting mechanism was frozen. There is no protection against this kind of insidious failure except having good idea what the aroplane should be doing, being alert to what it is doing and not going over any discrepancy lightly . CHECK GW was subtle hint that something was wrong, yet it wasn't picked up by the crew. Acceptance test pilots should be very well acquainted with conditions that trigger the message. IMHO, seeing this on test flight is reason enough to cut the flight short and return the aeroplane to maintenance.

If it were true, then there would also be a serious breach of Boeing 757 in the certification standards too. If one forgets to remove masking tape from static ports after giving the aeroplane a wash, there would be no warnings except after the takeoff - and of all the christmas three lights and whistles not a single one would say "STATIC PORTS TAPED OVER"

Unfortunately, looks don't deceive. It can not be disputed that the system operators of today occupying the cockpit seat of modern technology aeroplane have statisticaly greater chance of surviving into retirement than pilots of yesteryear flying the steam gauged aeroplanes. Of course, pilot flying modern aeroplane would be safest of them all but insurers, flight schools, regulators and airlines have decided that sparing a couple of hull losses and a couple hundred dead annually just isn't worth the effort, time and money. Lip service is only paid to achieving the maximum possible safety while quietly being satisfied with the optimum costs/safety ratio.

So we have the final report. Now I know what it takes to regain autotrim after going into abnormal attitude law. Blooming shame it wasn't in FCOM. One thing I can't understand, however; there were a couple of seconds between stall warning and beginning of tumble, pilot's input was stick forward, control law was still normal and yet the THS remained stuck. Can someone shed some light on this?

How do they do that?
 

Anyone have a thought on how the investigators differentiate between fresh water that entered the sensor before the flight and sea water (if any) that entered between the time of the crash and the recovery?



Mickjoebill

CONFiture wrote:
Good reading here: https://secure.wikimedia.org/wikiped...ntine_generals

It also depends upon the various allowed deltas between the values (at least in a continuous system)...

fc101
E145 Driver

@clandestino
"Would you really be smarter than ELACs/FACs that outwoted the truthsaying AoA probe in favor of other two that agreed, yet their output, while valid, had no semblance to actual AoA?"
The computer may not be able to 'decide' which values might be correct, but there could easily be an oral /visual warning, that there is a disagreement within the three AoA probes.

"CHECK GW was subtle hint that something was wrong, yet it wasn't picked up by the crew"
The German BFU has commented on this displayed message in Appendix 18 of the report and even the response from BEA concluded, that it was impossible for the crew to react on this hint.

A lot of comment here about detection of incorrect data from multiple sensors; voting algorithms and the like. This is a serious and involved technical topic involving considerable insight and expertise in algorithm design. It is not easy.

Can you algorithmically detect two out of three incorrect sensors? Well, it depends on what fault detection and tolerance algorithms you have decided to implement, and it has a lot to do with whether you think the HW and SW needed for implementing those algorithms is more reliable than a simple system which doesn't detect such anomalies but is rarely subject to such failures.

SPA83 thinks that failure to detect the sensor-anomaly situation on the accident aircraft is a No, it's not. You can't condemn a manufacturer for not solving a problem that is generally insoluble without considerable trade-offs (and even then only part-soluble). Maybe SPA83 would like to propose his own solution to the problem and write it out here. That would at least ensure that heshe understands the problem before waggin the finger at someone for not solving it.

BOAC said: No one who works in this area knows of any reliable way of accomplishing this feat in general, the way it is stated here. Specific sorts of failures can be detected and accomodated: in this particular case, of course, putting a water-detector in each instrument would have sufficed, but it is (I hope, obviously) impractical in general to think of every specific possible anomaly and put in a circuit to detect exactly that condition.

None of the general methods are oriented towards common-cause failures such as happened to the accident aircraft.

Just to be clear, the sensor failures on the accident aircraft were not Byzantine faults. I also find the Wikipedia article on Byzantine faults to be confusing and generally poorly written. There will shortly appear a set of slides from a brilliant keynote talk last Thursday by Kevin Driscoll at SAFECOMP 2010 on instances of Byzantine failures in aerospace.

PBL

PBL: agree that the wikipedia article is not great - however for those talking about sensor failure, voting and detection it is the best starting place to understand this topic. Maybe I should have written my reply better...

fc101
E145 Driver

The ATC contribution
 

alemaobaiano - Neither XL crew were 'playing games' as you put it, they were just trying to do a job. They clearly expected to be able to use a block of airspace, as one would in the UK, well away from any airway hotspot. They had discussed this with the ATC unit at Perpignan, who could see no problem with the plan, and the subsequent refusal left them baffled, as noted in the report. Apparently no explanation or alternative area was offered, I call that unhelpful, what would you call it? I don't know why the words 'Test flight' weren't used, but the patterns they wanted to fly would have been identical to any general handling detail, so what's in a name?

As for the A330 accident, the trigger was the ATC request to alter the level off from 6000ft (from memory) to 2000ft; I didn't say or imply or mean this was in some way a piece of deliberate sabotage, merely that it is very easy for the (very) best laid plans to get screwed up by ATC inputs. The fact that both incidents happened in France is mere coincidence, I've nothing against French ATC.

BOAC...

I am not sure they are "primary sensors"? The fact is the aircraft flew nigh on normally with 2 of them failed / stuck. The report at some point discussed them as "stall warning devices" in certificaiton terms... and they are "triple redundancy" in this, in that with only 1 working, they still got a (correct) stall warning.

We must understand that in normal ops, it would take an <10-6 scenario to replicate this as an accident. It would require a multiple AoA failure (improbable), followed by a crew flying at Vref-20K or less, with all the characteristics of an approaching stall (low IAS, high nose attitude). Therefore to relate the design in this area to normal ops is stretching things. I suspect the AoA probes would "report" themselves as faulty in the PFR, so again, for an accident to occur in normal ops, the low speed scenario would have to occur on the 1st flight post the common maint error.

I cannot get away form the fact this was an HF accident - and those factors are not confined to the pilots, but also to the airlines who "tasked" them. It is a bit much to blame the aircraft design for "not saving" such reckless and ill thought out testing of those very AoA system(s).

For those who say "but the pilots should have been told the AoAs disagreed"... Why? We don't fly the Airbus on AoA! The only people who "need to know" the AoAs are dodgy are those who fly the test profiles... who it might be assumed know what to look for (as the report says, it was patently obvious the AoA info was faulty by the Alpha Max/Prot indications).

NoD

fc101,

I don't agree. For example, This article by Driscoll et al. from SAFECOMP 2003 is a much more understandable article which talks about Byzantine failures as they actually occur in aeronautics.

PBL

- hang on a moment - shall we all take a breath? I thought the brilliance of the AB technology was sold (for the 'concierge', of course) on the fact that it was 'unstallable' in normal flight? Unless I have this wrong, is this protection not based primarily on AoA readings?

It is not beyond the bounds of your HF arena for a 'normal' crew to screw up the speeds with 2 out of 3 sensors screwed. What then? 'Check GW?:ugh:. I'm not sure many of us would have reacted correctly to that warning

No, as long as sentient beings remain in the cockpit there should be as many clear indications of which bricks have fallen from the castle walls as possible. At least (hopefully) an 'AoA disagree' or similar warning might have made an average crew stop and think about testing the AoA protection. - agreed, but AB are hung on the scaffold of the sales brochures, I'm afraid. How many other little glitches are there lurking in the wires? We are still groping in the dark on the Air France Airbus crash. Was that another one? As I said in post #1 on my other thread - I don't think we are there yet. Where is the warning that tail trim is 'excessive'? Where is 'Hey fellow, this is 'Hal' - I am not sure what is happening with the AoA probes - please check for me - I may be confused'?

Give a crew the necessary information. Let's make sure EVERYONE understands the system is not 'perfect'.

This goes for all 'modern' aviation technology, by the way.

???? Not seen that anywhere? It has some "protections", but it is not flown in an everyday manner so as to get anywhere near them.

Please re-read my post. This takes a number of "improbable events" in sequence, much as most design decisions are based on. What use would a "AoA disagree" message have been (and difficult, since in fact the 2 main AoAs were frozen at ~the same value)? We don't fly on AoA. So the QRH/ECAM says "take care, do not stall". Errr... I don't tend to plan to anyway ;) Yes - a consideration that perhaps it could have degraded to Altn Law, for a Direct Law landing, but if every little sensor reporting a problem gets this level of degradation, then few Airliners woudl despatch (B machines included).

Please re-read the context of that. A Test Crew should have understood that a "Check GW" message, together with Alpha Displays being clearly incorrect.

They had it:

1. Do not perform this Test unless you are Qualified e.g. Test Crew.
2. Do not perform this test below 12000'
3. The speed output of this test is in the table below. Do not go below it - if the desired result is not occurring, recover to normal flight and consider what is happening.
4. Consider what you are testing, why you are testing it, and what will happen if it goes wrong...

Exactly, and this applies to the Airbus as much as any aircraft. The approach and lead up to this accident shows exactly that... and I for one think in this accident Airbus (as a company) come out well... all the wanring signs were there (who could do the test, the altitude, the confidentiality agreements before handing over the schedules etc.)

Bottom line - see where the Report's Safety Recs lie. Largely HF. I still have trouble seeing this as an Airbus specific issue. It is so similar to the 2 EJ 737 incidents, where the outcome was different purely due to the adherence to basic safety precautions.

NoD

- where HAVE you been?

PBL. According to CS25, this is the responsibility of the manufacturer. If the manufacturer is not able to inform the pilots that an equipment is faulty that means he has serious shortcomings in the design of its systems

Can someone please provide a link to the Airbus Industrie A330 accident?

I can't seem to find one anywhere.

Thanks.

Jet_A_Knight - For some odd reason I cannot find the A330 Toulouse accident report on the BEA website either. There are others available, e.g. The Risks Digest Volume 16: Issue 39, a contribution from Pprune's own PBL. But none I have seen recently mention that the reason, as I recall it, for the low selected altitude on that test point was the request from ATC on the previous landing to restrict the next take-off to 2000ft instead of the 6000 called for in the test plan. As PBL notes, though, it took that sequence to show that the A330 at aft CG might not cope with TOGA and eng fail and low level off.

gonebutnotforgotten,

for those who read French, the preliminary report of the 1994 A330 Test Flight accident is at this entry in the CRICA Compendium. I am not aware of an English version.

SPA83, No one, least of all the certification authorities who issue CS 25, expect a manufacturer to solve algorithmic problems whose general solutions are known to no one. Even if it said in CS 25 that a manufacturer must solve the twin-primes problem, no sensible regulator would enforce that.
I think it is inappropriate for someone who neither understands the technology nor the issues involved, such as yourself apparently, to conclude there are "serious shortcomings" here in the system design.

It seems to me that the issue of testing AoA sensorics is adequately solved by the measures pointed out here by Nigel on Draft. The report points out that the indications of sensor error were indeed present on the cockpit indicators where they should appear, but were apparently not well interpreted.

PBL

PBL, just try again to read and understand the CS 25.1309 paragraph.

(c) Information concerning unsafe system operating conditions must be provided to the crew to enable them to take appropriate corrective action. A warning indication must be provided if immediate corrective action is required. Systems and controls, including indications and annunciations must be designed to minimise crew errors, which could create additional hazards

To help you…
Has the crew been warned about AoA probes failure ? : NO
Is this an anomaly according to CS 25 ? : YES

I would be careful about the rhetorical difference in an annomaly and a unsafe condition.

In my experience an unsafe condition is one that is likely to evolve to a specified level of hazard to the aircraft within a defined range of probability.

We could go into much greater detail about the defined level of hazards vs probailities that are considered in aircraft design but that would divert this thread.

A simple malfunction needs to be considered in combination as to whether it is likely to lead to failure to complete a safe flight and landing. The strongest argument that it is still safe is the redundancy within the system.

Thus let us not be too quick in judging that the design is faulty.

SPA83,

I pointed out that that part of CS 25 isn't really meant to be read in the way in which you are reading it, and gave some indications why that is.

I don't care to indulge in a " 'tis ", " 'tisn't ", " 'tis" " 'tisn't" exchange, because I find it boring and I am here to entertain myself.

PBL

PBL, I read it as a pilot does. I’m quite sure that people like you enjoy playing games with algorithms but pilots don’t fly airplanes with that sort of « bidule » (may be concierges do…). Pilots fly airplanes with their hands, their feet, their eyes, theirs ears, their mind and information they receive. The end.

PBL and NoD,

I’m not sure you realize the central position Airbus gave to the AoA data.
Pilots don’t fly the Airbus on AoA, BUT the AoA data are the core of the main protection features of the Airbus.

As soon as the AoA data show a discrepancy , it is a the most common sense duty for the manufacturer to clearly advise the crew. At this point the crew will proceed as politely as possible to the end of the flight.

Even better, the crew should be able by a single switch to disable all protection features, making sure they won’t interfere based on faulty information.

We could debate the semantics, but yes, they are at the core of some of the protections (Alpha Prot, Max AoA). I am not sure that AoA has much to do with Max AoB / Max/Min Pitch / Max/Min 'g' but I am sure you know better ;)

Disagree to an extent, and did they show a "discrepency"? They froze pretty much at the same value. I would guess, but am not sure, the system would not adversely react to a single excessive AoA value. Low AoA values (as here) are hard to detect, and not in themselves hazardous.

Really? Where does this come from?

I am sure the Certification Authorities will fairly quickly act on your advice.

Summary: suggest we take a step back from all the theoretical angles above and review what happened. This is a public transport airliner, flown by well trained crews to fairly unadventurous SOPs. The design philosophy is to make that as safe as possible, within certification requirements. If you truly feel that this accident exposes a serious flaw in the design within that requirement, please post here an event sequence that leads to an accident.

Of course, when one ventures outside that requirement, the "design" features e.g. FBW / protections / auto trim, might start to make life harder. You do not design an aircraft to make test flying easier / safer, you rely on procedures / training to work out the hazards, and avoid / predict them.

SPA83:
What "immediate corrective action" is required? None at all in normal operations. So I disagree.

I might take you to task with They had been to an extent - the clearly incorrect Alpha Max/Prot displays - as discussed in the report.

Finally I go back the report:
Causes: Nothing to do with design.
4 recs. None querying the compliance with certification standards. Some tightning up of anomolies that were noted.

NoD

Personally, I think I know comparatively quite a lot about these systems. I just wish we could have a reasonable technical discussion about them, as the Concorde people seem able to discuss their favorite airplane on Tech Log, rather than a discussion in which people use their untutored personal philosophies of airplane design to impose requirements on system manufacturers which are currently infeasible.

PBL

The crux of the matter to me appears to be that the AoA failure, while certainly a "hole in the cheese", was secondary to a failure on the part of the humans involved - from the hapless ground staff who used incorrect procedures to rinse the aircraft, to the crew who failed to plan their test cycles correctly and then carried them out in a haphazard manner.

Sensor failure is something that can trip a crew working to IFR up no matter what they are flying. I'm reminded of the BirgenAir accident where the cause of the crew's disorientation was undoubtedly a blocked pitot probe feeding the Captain's panel, but the fact remained that the crew should have aborted the flight and returned to land the second they saw a discrepancy in airspeed indication (which, as I recall, first manifested on the runway).