Thoughts
The longer I look at the AF447 loss, the more it looks like the aircraft promptly entered a stall and then descended to the water. The question I asked earlier regarding how protection "collisions" are handled applies. When one protection commands an action and it conflicts with the limits of another protection, how is that handled?? Is it always in fact the logical prioritization?
The latest thought relates to the Vmo/Mmo protection in normal law. If the protection commands an additional amount of g to get the nose moving up and it "thinks" the aircraft is at Vmo, how hard does it pull g. If 1.65 g is commanded and only 1.6 g is actually available, what happens then? It would seem that the protection should apply g as mitigated by the envelope protection software, however if this software had an erroneous CAS input, it might be possible to pull so much g that a departure would result. Ok, you ask, what about Alpha Protect limits.
Well first we have a limits collision in a little explored part of the software (erroneous airspeed input). Does it behave the way we think it should?
Second, I am not entirely sure that Airbus is using actual angle of attack data in all of their angle of attack calculations. They may possibly be substituting inferred angle of attack based upon aircraft configuration data and airspeed.
And finally, it appears that if bogus airspeed data tripped the Vmo/Mmo protections, ACARS messages infer that the aircraft then shifted in a few seconds into Alt2 flight laws where it is possible to stall the aircraft. Has anyone run that kind of scenario in a SIM to see if there are additional implications?
When you see indications of anomalous behavior, it is time to look for a path to how the anomaly could be created. Maybe it is time for BEA to do some forensic software analysis. It might cost less than the actual search for the boxes and be more productive.