The simple solution to the Thales pitot head conundrum is to have a two-stage heat selection. In normal operations selecting higher than the present amperage of pitot heating would cause an overheat failure of the heating coils (the reason why pitot heat is never turned on)
a. In general aviation aircraft until just before take-off or
b. In more complex aircraft turned on (and off after landing) by ground-air sensing
It’s because there is a need for cooling airflow to offset the pitot heating. (stops the pitot covers melting when ground power is applied, for one thing)
However in the case where an airliner cruises at high altitudes for long periods in Ac/As (alto-cumulus /AltoStratus), cloud types which are composed of supercooled ice crystals, then the formula no longer works. i.e. the rate of cooling exceeds the ability of the pitot heater to keep the pitot head warm enough to stop ice entering, congealing and slowly building up to ultimately block the pitot tube. You need a stepped heating arrangement, either automatic or pilot-selected (or preferably auto with a manual back-up)…. To “bump” the amps up to a higher rate of heating. This could be done via an altitude switch or via an OAT threshold (assuming that the OAT sensor is not going to suffer from a similar icing-induced error).
It is readily apparent that EASA and Airbus were aware of this phenomena (of the ingestion, over a period, of super-cooled icing particulates overpowering the pitot heater’s capability). However they never extrapolated this anomaly into an accident scenario. I don’t disagree with the scenario in the "Last 4 Minutes" article above, but I do think that there is a slightly more complex story behind the loss of control. That was much earlier spelt out in The Shadow’s posts at:
Air France Flt 447 and
The AF447, QF72 and 9M-MRG comparison
Or linked at this URL in this earlier AF447 thread:
http://www.pprune.org/tech-log/37643...ml#post5202785
Extract (only):
Exceeding the Envelope but without any Indications of doing that ...
In enroute mode, with the captain in crew rest, the two copilots would have a low level of situational awareness (i.e. cruise ennui) and would probably not detect that the autothrust was increasing incrementally and insidiously to offset a "system-perceived" speed (and Mach) loss trend. The nett result is an A330 moving through the air ostensibly at its scheduled speed but, in actuality, a lot faster than it should be - maybe 25 to 30 knots fast and quickly approaching a borderline Mach for coffin corner (i.e. the upper operating envelope boundary-line). Available cues? A slightly lower nose-down attitude, a marginally lower Angle of Attack, but with the displayed speed and Mach tapes on both the pilots' screens (PFD's) staying steady, yet both Engines’ N1's spooled up a fraction - as the autothrust endeavours to maintain the scheduled speed. Overall gradual and unnoticeable. The autotrim would be very very slowly winding the trimmable horizontal stabilizer nose-down. It all happens so gradually because the ice is building slowly inside the pitot head's intake. But why even slowly? Isn't there a pitot heat operating to stop icing?
The pitot heat can generate (say) 1300x calories/minute of heating but the nett heat loss due to the "already frozen" nature of the steady, continuously impacting ice crystals in a layer of CirroStratus cloud (Cs) might be -1500x (or greater). Respect the uniqueness of flying in layered sheet cloud for lengthy periods. It's completely different to being "in and out" of convective cloud within which there may be relatively short duration encounters with moisture resulting in rapid accumulations of heavy ice (or momentary hail). The nett overpowering result at the pitot heads, over time, is a gradual accumulation of ice in each pitot head. It's all about exposure time. It's not due to a prior blockage, just due to the design and the thermal give-and-take - and that's why all three pitots' heating provisions can gradually become identically overpowered and blocked, all at the same non-alarming rate of ice-crystal feed. The stagnating pressure that normally generates the airspeed feed to each ADIRU will reduce linearly and generate a consequent progressive autothrust boosted increment to recover that speed (just as it would if there was to be a genuine speed loss due to the added drag of airframe ice). The process possibly takes 30 minutes or more. Because it happens so gradually, no-one notices the imbalance (thrust too high, nose slightly low, trimmed nose-down). The throttles (aka thrust levers) don't move in the Airbus (like they would in a Boeing). They have detented "settings". The ADIRS is geared to identify and reject systematic flaws - however it is easily duped by protracted and unique skewing environmental factors. But what could happen to precipitate the terminal upset into a loss of control ?
It would be the autopilot trying to contend with the data conflict and the sudden onset of Mach Crit and disconnecting due to the high aerodynamic out-of-trim loads it's holding. The earlier ACARS transmission recorded that development. Imagine a sudden autorotative roll and the nose dropping and the pilot wrongly assuming a stall/spin, using aileron and fwd stick and adding thrust. Recollect that he's just not seeing a high airspeed or Mach Number ..... so he could be forgiven for assuming a slow-speed stall and taking the wrong action. It's similar (but opposite) to the Buffalo crash of that Dash 8 recently. Suddenly that Dash8 aircraft stalled and the pilot instinctively took go-round action - which involves raising the nose (but if he'd recognized it as a stall, then of course he should have lowered it).
The reason for the AF447 autopilot disconnect is explained in depth in
part two . Why wouldn't this have happened to the numerous earlier incident airplanes? Well there's different thicknesses of Cs cloud and different exposure times. As in most accidents, the adverse factors often "stack" to ultimately generate a catastrophe. According to this article the AF447 skipper got high early because he was tight for trip fuel and needed to make savings on his contingency reserve. That would've put him closer to the coffin corner boundary. The happy outcomes for the earlier incidents also tended to accommodate a false sense of security in all (un)concerned decision-makers and aircrews.
Etc etc