Quote: Lastly, could the aircraft be saved even though if this flight was conducted at 3000ft?
If aeroplane had been washed properly, the crew would get away with improvised flight test.
True, but having a dual AOA sensor common failure mode because of water ingress is arguably a system safety weakness; one of the recomendations in the BEA report was aimed at addressing this. I very much doubt an aircraft safety case would be signed off if the known likely outcome of "improper washing" was total loss of aircraft and crew. This suggests that the failure mode had not been identified previously, perhaps because nobody thought it could happen. This just goes to show that hindsight is a wonderful thing and that safety cases are not always perfect, even with the best efforts of the people concerned.
artificial feel is pretty complex beast with not much in common with conventional feel
In terms of what the pilot feels through the controls, for an artificial feel system the relationship between control force, speed, height and control deflection can actually be very similar to what a conventional aerodynamic feel would give, but with reduced control forces. It depends on the exact type of feel system used but a Q-feel system, for example, can replicate the force vs speed vs altitude relationships extremely well and relies only on connections to the pitot and static systems to do its calculations. If the trim actuators also bias the neutral position of the control column, then out of trim forces are also accurately reproduced for the pilot. It has been demonstrated that the presence of such force feedback is very important in accurate control of the aircraft, particularly when manoeuvring. The Avro Canada CF-105 Arrow development program is a case in point (
Avro Canada CF-105 Arrow - Wikipedia, the free encyclopedia).
There was no unequivocal failure of any AoA probe right down to impact. Probes 1 and 2 send values that were false but stable and within normal range. Law degradation occurred as the aeroplane was tumbling following full aerodynamic stall.
I have to disagree with this. Both probes were sending data that was identical but false, which is by definition a common mode failure. The probe electronics were operating correctly but the mechanical elements were not free to move as designed due to icing, thus the AOA probes failed to do their job, albeit in a rare and unforseen set of circumstances.
The FCS detection of AOA probe failure depends on one probe giving a different signal to the other, i.e. a non-common mode failure. In the event, the FCS did detect that the AOA and IAS did not correlate given the gross weight of the aircraft, with the ECAM displaying a message suggesting a mismatch of gross weight with the combination of AOA and IAS being measured at the time. However, it would not necessarily be obvious to the crew that the AOA probe icing was the cause of this mismatch unless they checked the actual AOA values on the relevant MCDU page.
Moreover, according to the BEA report the "USE MAN PITCH TRIM" message was removed from the ECAM as soon as the FCS entered abnormal attitude law, which means the crew probably had only a small amount of time to read it when there was a lot going on.
I studied human factors in engineering design as an element of my professional training and, put simply, it was deemed poor practice for a safe outcome to depend on a stressed and possibly confused human operator doing the right thing under pressure, particularly if the information needed to make correct decisions and take correct actions was not immdieately and clearly available. Clearly in this accident the crew expected things to work in a certain way (i.e. the FCS does not permit speed to fall below V alpha max in normal law), thus they were completely thrown by the unexpected stall, FCS reversion and subsequent loss of autotrim.
When operators of equipment have a different mental map of what a system should be doing, compared to what it is actually doing, that is when accidents can happen. Surely XL888T is a case of this? If so, then perhaps engineers should be asking if the system design can be improved to reduce the chance of operator confusion? BOAC posted a thread on exactly this issue (
http://www.pprune.org/tech-log/526796-time-check.html) but unfortunately it only garnered 8 responses then petered out, which is sad, because it appears to be a growing problem and perhaps it is time it was addressed more thoroughly by regulators and industry.