ABC News reports a failure in a pitot tube sensor may be the cause of an AirFrance Rio to Paris flight tragedy. Excerpts from the news include:

An Associated Press investigation at the time found that Airbus had known since at least 2002 about problems with the type of pitots used on the jet that crashed, but failed to replace them until after the crash.

As a storm buffeted the plane, ice disabled the plane's pitot tubes, blocking speed and altitude information. The autopilot disconnected. The crew resumed manual piloting, but with erroneous navigation data. The plane went into an aerodynamic stall, its nose pitched upward and then it plunged into the sea on June 1, 2009.

Air France is accused of not having implemented training in the event of icing of the pitot probes despite the risks. It has since changed its training manuals and simulations. The company said it would demonstrate in court “that it has not committed a criminal fault at the origin of the accident” and plead for acquittal.

If a pilot recognizes that flight condition sensor inputs (Altitude, AOA, etc) are faulty: what prevents the pilot from "dead reckoning" and safely land the aircraft at the nearest airstrip?

  • 5
    $\begingroup$ That happened 13 years ago. It has been discussed quite thoroughly here: aviation.stackexchange.com/search?q=Af4447 Have you done any research? Is there any new development? $\endgroup$
    – nobody
    Oct 10, 2022 at 14:32
  • 1
    $\begingroup$ Additionally to AF447, there is this A330 incident where all 3 airspeed inputs failed due to forgotten pitot covers. Mentour pilot did a video on it which might be of interest to you. $\endgroup$
    – Bianfable
    Oct 10, 2022 at 14:40
  • 1
    $\begingroup$ @nobody That search link returns nothing. Correct link is aviation.stackexchange.com/search?q=Af447 $\endgroup$ Oct 11, 2022 at 17:24
  • 1
    $\begingroup$ Even the basic news report I saw recently said that this was due to pilot training and reactions, not just to a faulty sensor. $\endgroup$ Oct 11, 2022 at 18:39
  • 2
    $\begingroup$ I strongly disagree that it was the failed sensor. Failed sensors are just slightly inconvenient, but rarely a serious problem. The real cause was the pilot's failure to respond appropriately by reading the other instruments, understanding the problem and taking appropriate action. Also the other pilots' failure to monitor and oversee the handling of the plane. $\endgroup$
    – abelenky
    Oct 11, 2022 at 18:55

1 Answer 1


Generally speaking: Yes it can! (no pun intended)

This is done because all critical systems are built either such that they are very, very unlikely to fail. For flight critical systems it is required that the systems fails with a probability of only 1e-9 (therefore once every 1e9 flight hours), or in other words practically never. In case of electronics this usually means that they are built redundantly, meaning two or more copies of the hardware exist such that if one fails, the other can take over. For example critical flight computers onboard the Airbus A320 or Boeing 777 which compute the control inputs for the control surfaces are redundant both in hardware and software such that one of the (two or more) flight control computers can fail without something bad happening.

A good counterexample is that of the MCAS fail in which Boeing connected only one Angle-of-Attack probe to the flight control computers. Therefore any fail in this sensor had direct consequences for the flight controls, which is exactly what happend (twice...). This resulted in the death of 346 people.

This should illustrate two things:

  1. It vividly shows that redudancy is very much needed for the safety (btw, this is one major reason why aviation is so expensive)
  2. Coming back to your question: Yes the pilot is able to safely return to the airstrip with one sensor fail. For more then one sensor it depends a bit on the exact combination, but in all generality it still should work.

Not the answer you're looking for? Browse other questions tagged .