Quote from
Mr Optimistic:
"...I think the point about latching the warning is that the system alarmed on valid data, the data then went invalid (as it happens because of the scenario which generated the alarm) and the system logic gave priority to the validity limit. So the system discounted it's previous diagnosis which was based on data it judged valid and just shut up. "
Yes, that's a fair description. Owain's suggestion that the stall warning should be latched on until the system receives a
valid non-stall AoA from the AoA sensor is a good one, IMO. That clearly was not the case in AF447 but - assuming he is quoting the relevant Airbus documentation correctly, without significant omission - Confit rightly points out that the Airbus documentation can be interpreted as promising that it would. Quote from AI documentation via
CONF_iture:
"...a permanent aural alert (“STALL, STALL” synthetic voice then cricket) is triggered until a correct angle-of-attack is recovered."
I would define that as the first aspect of Airbus FBW stall-warning logic that might be reconsidered. The second area that concerns me was also applicable to the stall-warning systems on most of the six swept-wing transport types I've flown. As I commented recently here in
post 1110, the warning signals operate at a constant intensity regardless of how much the stall AoA is being exceeded. When the warning results from intermittent exceedances, perhaps with phase-advanced warnings in turbulence or wind-shear, the pilot may infer that the degree of exceedance, while unacceptable and demanding immediate recovery-action, is low. In the case of AF447, however, the intermittent nature of the warnings persisted (for reasons that, with the benefit of hindsight, are well understood) despite the stall becoming deeper and deeper. This could happen again.
However, moving away from the specific example of AF447: if a crew was suddenly provided with an AoA indicator on each PFD that appeared only when the stall warning was activated, and if that AoA clearly showed the degree of AoA exceedance, any subsequent removal of it due to sensor invalidation - announced with a suitable failure caption - would be far from ideal. But at least the pilot would have been given a good idea of the depth of the stall during the period of validity of the system.
The inclusion of an AoA indicator would demand initial and recurrent training in the simulator, of course, during which recoveries from low-altitude shallow stalls and high-altitude stalls, both shallow and deep, would be practised in Alternate or Direct Law. Simulators would need to be improved in the high AoA, high altitude regimes, assisted to some extent by data from AF 447.
The third area where I would suggest change relates to handling practice. On revenue flights airlines have increasingly discouraged, if not forbidden, flight without AP and FD, as well as the use of manual thrust, particularly at high altitudes. Pilots are expected to spend many thousands of mind-numbing (on long-haul) hours simply monitoring AP and A/THR, only to perform safely on the once-in-a-career occasion that one or both of them fail.
Although it would have to be in Normal Law, regular practice of handling cruise flight, including step climbs and descents, at least puts pilots in a stronger position to handle abnormalities such as befell AF447. Easy to read that a pitch change of one degree represents a VS change of about 800 ft/min at Mach 0.8; quite another to be in regular practice at doing it. Thus, the management of pitch & thrust become second nature, instrument scan is improved, and the panic factor in failure situations significantly reduced.