Gee sensing for FBW systems
 

Indeed the Nz is provided by - state of the art - IR part of ADIRU.

2 separate vertical accelerometers (and Lateral accelerometers) are used for turbulence damping.
But will be used by FCPCs in case of Dual ADIRU (IR part) failure to consolidate the load factor information supplied by the valid ADIRU

Autorim
 

Good question. I wouldn't. Do we know that the stick was "hard back"? Not yet anyway.

Not necessarily. I believe that they forgot, or never really knew, that back stick would trim them up into a stall. I'm not convinced that the PF realized he was pulling back.

I also know exactly what would happen, merely from the perspective of knowing a bit about how stuff that flys (and control systems) is designed and built. I have no answer as to "why" though.

reports are clear that the speeds failed low, not high.

I'm curious - from a pilot's perspective, what do you (or any o fthe other real pilots on here) think "really happened" in the colgan crash, where the report says PF pulled hard back through stick shaker and stick pusher ?

Real time information to the crew
 

RetiredF4 That´s why i remembered to be technically feasible to have the information even some time (seconds) before System "reconfig".

I hope the advanced planes designers (A, B or ...Z) invest in this issue.

Cool Guys
 

Kind of a misconception. We have only two things going for us when we encounter a new situation - we can sort through past experiences to find ones that might seem relevant (and can do so fairly quickly, especially when the previous experience had a negative consequence, hence "learn from one's mistakes") and less important in the present context b/c a good computer could do so faster, we often can correctly calculate the near-term consequences of a contemplated action. As has been well mentioned, in this case relevant previous experience was lacking, by design.

The point about limiting human tasks to five is no doubt very important, but probably hasn't made it into the design rules. Beastly hard to implement when six very important things go wrong at once, and the flight computers haven't been programmed to boil them down to the root cause.

A few hundred posts ago I suggested that HAL should be tasked with warning the humans that he was starting to "worry" about a situation, and what was bothering him. That would give the humans just one thing to worry about themselves, before the cockpit was filled with stimuli, and with even a second's warning might plant the seed that would let them start the trouble-shooting on the right page.

Possibly confusion between AOA protections and low/high speed protections.

As I understand it, the latter may come back if the speeds come back, but they are not AOA based, and they are overridable. Low-speed protection may push the nose down if you do nothing, but if you've got the stick back, you win.

BEA says "to the left and nose-up stops". For 30s. Is that not "hard back" ?

@IFF789:

Read A33Zab's edit (post #663). He has clarified his response to CONF iture and pointed out some ambiguity in terminology.

You are correct regarding this function.

edit: Not necessarily.

Cool Guys

Of course it would be excessive, so it is not suppose to happen that way. The idea is to prioritize warnings.

A stall is quite high in priority and so is "whoop whoop terrain" hopefully they shouldn't occur at the same time. The other stuff is calling for visual scans to figure out why you were allerted to begin with. If you don't take the propper action something is going to deterioate and alert you furthur.

I suspect that your system designs perform the same way don't they?

Hi,

RR_NDB

And as you know, it´s easy to put responsibilities in an operator if a Human machine interface (even a poor designed one) is working as designed. Always the management could point to lack of "training", etc. exempting the System.



In fact .. it is the pitot tubes that have been exempted
In fact we know for decades that these Pitot tubes have been certified by not taking into account certain elements or conditions under which they are supposed to work
After some experience .. have realized that they no longer met the requirements expected
What solution do we find?
It was decided to continue to use them despite their lack known
It has continued to let the planes go in places that are not appropriate for these Pitot tubes
At the same time .. asked pilots to cope with procedures (not satisfactory since each time .. reviewed after an event involving the pitot tubes) to counter a bad certification .. or better to counter the fact that they must fly at certain altitudes for economic reasons
Is it normal to give pilots a plane that accessories that are unreliable for their operating domain ? (knowing that Pitot certification does not comply with the the field of employment)
With such principles can be certified tomorrow a plane that has the aerodynamic qualities of a bathtub provide you trow some procedures to the pilots

Immediate a/c feeling to the crew
 

Hi,

poorjohn20 years ago i had an incident at night under rain conditions (with no consequences) and made very deep analysis starting next day at 8 AM.

This car had an abnormal position of CG (too ahead) much different to my rear engine car used by me during 500,000 miles +. I had only 1 second (or less) to understand what was going on after i initiated a "test maneuver" to check an abnormal behavior the car showed some 30 minutes before during a 2 hour short trip.

In analyzing the incident (with a friend, air accidents investigator, C130, 707, etc. Captain) i concluded (modeled) we have in our mind "two processors":)

1. One "processor", that check if the "scenario" you are facing fits in what you stored in your memory up to this day. It´s put "on line" immediately and first.
2. Another processor that "try" to understand the new situation that seems to be very different from everything you saw before. Both "processors" operate concurrently.

Human beings, has this second capability. Machines has just the first one (they were programmed to deal with a finite number of possible scenarios)

During the "decisive phase" along the incident i had in about 1 second opportunity to select and implement the best solution for a situation i never before imagined as possible to occur. And despite therefore, not being able to find a similar scenario in my "data base".

And during the "high adrenalin" phase i had time to think a lot of things including the surprise with the new intriguing scenario.

I see the pilot as the only one capable to solve new scenarios not imagined by the System designers. And this always will be for an airliner.

To do that he must receive immediately all the BASIC information from a SIMPLE interface. This can be, IMHO the "turning point" when unexpected situations arise.

And if the System for any reason delays his perception, or even worse, present and introduce "new components" the pilot chances reduces accordingly, to timely perform the best and precise actions.

In the described case i was able, despite facing a very rare and highly improbable failure, to feel very fast (in less than one second), the car behavior in order to act decisively and precisely to save my life. In an advanced plane, full of complex "feedback Systems" affected by crew actions "in the loop" the issue is really complex. But it seems to me to be mandatory to allow an immediate understanding of what´s happening, obviously with the help of the System.

Murphy law specter to complex machines
 

jcjeant Using this kind of approach you are designing machines that can transition very fast from Normal Law directly to "Murphy Law" conditions, where interfacing issues, etc. could fill the cockpit and crew minds, capable to generate unbelievable situations. Where you may not be able to understand timely what´s going on or even "fly" the aircraft.

We are just "modeling". After receiving reliable pieces of factual information we will be able to "conclude".

infrequentflyer789


Join Date: Jan 2008
Location: uk
Posts: 306 Quote:
Originally Posted by bubbers44
So the PF with less than a year experience in the Airbus used full nose up SS with this knowledge???? Did he forget? Why did both pilots use full up pitch control if they knew they had no stall protection? All us conventional airline pilots know exactly what would happen. Exactly what their profile did putting them in a deep stall.

I also know exactly what would happen, merely from the perspective of knowing a bit about how stuff that flys (and control systems) is designed and built. I have no answer as to "why" though.


Quote:
The initial report left all the important stuff out like if they pulled up and with frozen pitot tubes and static pressure dropping did they get an erroneous overspeed warning.

reports are clear that the speeds failed low, not high.


Quote:
They must have a reason to keep this quiet but eventually they will have to tell us what really happened up there.

I'm curious - from a pilot's perspective, what do you (or any o fthe other real pilots on here) think "really happened" in the colgan crash, where the report says PF pulled hard back through stick shaker and stick pusher ?


I think the inexperienced Colgan pilots resorted to a previous aircraft the captain had flown that had a tailplane stall recovery procedure that was opposite of wing stall recovery. This wasn't a problem in their aircraft and all pilots are taught to lower the nose in a stall, they raised it causing the crash.

That is why I couldn't understand why on this flight they pulled back on the side stick zooming 2500 ft above their altitude when we all know this would put you in a deep stall which could only be recovered from by lowering the nose a lot and using a lot of power to save the aircraft. Something motivated them to pull back and all I can think of is an overspeed warning that was false. Why else would you pull back? I know the report said they lost their airspeed but if that was the case wouldn't they hold pitch and attitude, not pull back until they went into a full stall?

The fact they are holding all the pertinent information back that they have makes me think we will have some big surprises when they finally have to reveal it to the public.

Thanks for you answer A33Zab. The more we talk about the overall system, the more we measure its extreme complexity.

Incorrect

It depends how was the trim at the time of the malfunction. As reminded earlier by DJ77, if the trim was locked above 8 UP, max speed would be 180kt.
For the 330, it would be B & Y.

As discussed earlier, IMO, translation is not accurate, and should possibly be as follow :
The PF made an input on the sidestick to the left stop and nose-up, which lasted about 30 seconds.

I am still very interested in what Svarin, yourself, and PJ2, wrote on that WRG ACARS message ...
Among the 30 known events of UAS at cruising altitude, AF447 has been the only one to lose control, as I understand it, it has also been the only one to deal with a simultaneous mysterious wiring issue ...
And I don't put too much expectation in the BEA to dig any further in that direction.

But my question to PA 18 151 was more, if the protected aircrafts save many lives, the unprotected ones should logically kill more ... is it the case ?

To me, after 20 years of operation of these FBW Airbus, what the protections did manage to do for sure, is to get bigger incident/accident reports.
But then I don't want to speak too loud as a protection could well save my life one day ... not sure I'll be humble enough to tell that story here tough.

Gee sensing deux
 

Thanks a33Z, shows a variation of design philosophy as well as implementation.

Our FLCS ( flight control system) folks were paranoid about using anything but their own data/sensors. Their data was shared by other systems, but if it came down to "us or them", then "them" had to do their own thing. Although we had the best system flying, autopilot inputs were not even treated with the same respect as pilot stick inputs. Very limited AP capabilities, which surprised many of us.

Our attitude display came from the nav inertial system, and we could fly without the inertial even turned on. HAL didn't care, as he had Nz and body rates of his own.

The deal with rate and accel sensing for the FLCS is you want the displayed attitude and such in the cockpit to be independent of the FLCS system. It is very easy and more redundant/reliable to have gee/rate sensors for each FLCS conmputer, and let the ADIRU equivalent be displayed and used for the autopilot inputs. In our case, we had four confusers - one in "standby", and the middle value of the other three for commanding the servo-actuators. If it got down to two, then the most benign value was used.

Not all sensor inputs were quad reduntant. AoA was supplied by two cones and an aero probe with all kindsa holes in it ( hemispherical probe). Q and static pressure was also dual, but FLCS had priority and other stuff got the leftovers. However, the system had the "standby gains" feature in case the air data was deemed unreliable or simply went to lala land. IMHO, this feature should have been incorporated in the 'bus FLCS. Easy and very safe. Stick might be more sensitive if at a very high "q", but would also be less sensitive below the chosen "stby gain" value. Wioth gear down, values were reduced to typical approach "q" values.

sorry for design philosophy, but the final report may get into this aspect of the Airbus implementation.

Chronology of events @ 5 sec interval.
 

Here an updated chronology:

Thx to HN39 which pointed me on the fact I used the first released BEA update which did contain some errors, e.g. switched AOA angle with Pitch angle.

I used all available resources (as known today) and contributions in the forum about this subject.
Bolt printing is data provided from BEA report.

A33Zab.

http://i474.photobucket.com/albums/r...447Events3.jpg

Stall Warning-Communication
 

Going back to a post by Ian_W http://www.pprune.org/6542805-post525.html, and a discussion of cognitive overload.
I imagine most of us have experienced this effect where you effectively 'turn off your ears so you can get some room to think.'

Underlining by me for emphasis. One of the AF447 issues may be that the aural stall warnings leading up to the actual stall were ignored because of "verbal analysis channel overload".

The stall warning is one of the highest priority warnings in any aircraft. It deserves its own mode of communication.

The F-4 had a very nice stall warning consisting of an excentric weight mounted on an electric motor attached to the left rudder pedal. When warning AOA was reached on our single AOA sensor, you received a brisk foot massage. Unfortunately on a transport aircraft where it is completely realistic to be flying with your feet off the pedals, rudder pedal shakers cannot be depended upon to convey the message.
The DC-10 had a stick shaker of similar principle. Unfortunately the Airbus A320/330/340/380 have a dinky little stick that can be highly sensitive to motion, so stick shakers are out as a means of conveying a stall warning.
There is another part of aircrew anatomy that is available for receiving the message of a vibrating stall warning effector, the part that they sit on.
By vibrating the seat bottom, the crew could receive a stall warning message through a tactile mode of sensing and not add to the cockpit uproar.

Of course, it is important that AOA warnings are available while weight is off wheels, no matter what the airspeed indication.

Like feet-on-pedals, the sidestick is not normally held in the hand in cruise.
Excellent idea! I wonder if it was ever considered in the design.

Quote:

---

Originally Posted by infrequentflyer789

BEA says "to the left and nose-up stops". For 30s. Is that not "hard back" ?

---

The original French reads: "Le PF exerce une action sur le manche en butée à gauche et à cabrer, qui dure environ 30 secondes."
Perhaps this can be read either way, but if the BEA meant what you suggest, this would be very sloppy writing. In addition, IMHO it doesn't really matter whether the nose-up command was to the stop. The AoA was beyond 40 degrees, and only a prolonged command to the nose-down stop would have made any difference.

Yes, the sidestick shaker concept has previously been tested in an Airbus sim.

I'am guessing the results were non favourable to warrant production.

Hi,

This french stance is very interesting to analyze word by word ....
I will only focus on 3 words "gauche" (left) .. 30 (30) .. and "secondes" (seconds)
So the stick was maintened on a full deflection to the left ... and yet .. the plane will not go in a left turn
Think ... maximum deflection to the left (for 30 seconds .. what a very long time) and the aircraft would not embark on a sharp left turn (or bank angle) ... very strange ..
What can prevent him from taking a left bank angle ?
Remember that it is to counter a bank angle to the right ..
So the force pushing the plane to a bank angle to the right should be very strong !!!
Wat can be this force ? .. what can produce this phenomena ?

A stall ...?

Spot on.

The question jcjeant should really be asking is why was the PF trying to use aileron to counter wing drop.

Human machine interface and lost information
 

Machinbird :ok:

CONF iture There is also a technical reason for this: Technically speaking i´m not sure it would be possible to go deep by lack of data (recorded information). During the critical phase: The AS was lost (simply was not measured properly, despite the "redundancy"), and the mysterious WRG failure could also be impossible to be "understood" by lack of enough information to perform the analysis.

IIRC 'low speed stability' is the only anti-stall feature left in ALT(1). Is is a 'soft' resistance to stalling, overridable by the pilot. It is lost in ALT(2) in case of failure of 2 ADRs.

Dealing with UAS
 

mm43 :ok:

It sounds very good for short duration AS issues at cruise.

Other (even less precise redundant method) AS information could "help".

Can we agree that if the Pilots would have followed this advise it is very highly likely that we would know nothing about an air France Flight 447 today ?!

Re your first paragraph:
I still haven't seen any evidence/indication that 'HAL' has significantly contributed to the entry into the unfortunate attitude of the flight that was not commanded for by the Pilots.
Even the THS moving NU I would consider commanded to some extent as thirty seconds full NU Elevator indicates the desire for more NU and thereby for support by the trim. If you consider the response of the AC sufficient you won't try to pull max aft for 30s (that's an eternity, when was the last time you pulled just 5s or 10s full aft ???).
This to me indicates to some extent they wanted more NU.
And asked for that.
And got that.
Tragically.

I hate to disappoint you but the sales talk about a self diagnosing aircraft just doesn't hold up. Very basically now just for pilots:

you have a wire that goes from A to B. Along the way the wire connects to components within a system. Quite often when 2 components attached to the wire lose contact with each other a fault message will be sent.

the message will name the 2 components that are unable to communicate and quite often the message will add wrg: (wiring).

This is not a statement of a definate wiring fault just a statement that a very basic fault detection system can't work out who is at fault

Real time information to the crew
 

DozyWannabe "Redundancy is "powerful" when critical elements do not fail simultaneously. And UAS cases show clearly simultaneous "failing" (due product limitation) Simultaneous "failure" of critical elements should be reported immediately.

To the crew, and in Real Time.

Now, after clarifying to you i would like to repeat the Question (yet posted earlier): Why they put this redundancy? For what reason? What benefit?
When reviewing earlier posts i found this and i am now clarifying to you what i said.

Far less messages than possible failures
 

Safety ConcernsAnd in your opinion what this msg could indicate? The FDR is "not designed" for this type of data. So, BEA and Airbus SAS could never understand what caused it?

You can't determine what it means without having performed some form of diagnosis on the affected system.

For example an A320 apu starting circuit has a 400 ampere fuse. When this fuse blows the fault messages do not refer to it because the system is unable to determine where the loss of voltage occurred. The system often quotes the next relay in the chain as defective. So without the fuse its difficult to determine what was actually at fault.

These mesages are just a rough guide for maintenance as to where to look and also indicate that it isn't a good idea to use the mel based upon low intelligence fault messages

Complex Systems diagnosability and testability
 

Another "great feature" of "advanced planes". In some situations you may not be capable to even imagine what happened when analyzing a "mysterious" case.

I hope we will be able to understand the reasons for the "persistent" NU from PF.

A reason to "rethink" the FDR concept. Probably it currently lacks the capability to provide the required details perhaps not allowing definite conclusions.

:{

PS

Probably Safety boards have:

1) All required resources to put responsibilities on the crew.
2) Not enough (resources) to verify why the crew made some actions.*

A perfect :rolleyes: organizational "configuration" to conclude "crew error". And in this case, something that seems going to happen based in what BEA and Leaks yet emphasized.

(*) RHS not recorded may "help"?

Stalls and ailerons
 

Quotes

jcjeant:
"Think ... maximum deflection to the left (for 30 seconds .. what a very long time) and the aircraft would not embark on a sharp left turn (or bank angle) ... very strange ..
What can prevent him from taking a left bank angle ?
Remember that it is to counter a bank angle to the right ..
So the force pushing the plane to a bank angle to the right should be very strong !!!
Wat can be this force ? .. what can produce this phenomena ?"
HN39:
"A stall ...?"
PA_18_151:
"The question jcjeant should really be asking is why was the PF trying to use aileron to counter wing drop."

Absolutely, but jcjeant's question is a perfectly understandable one from a non-pilot. For the benefit of the others, let me explain that, when we do our basic flying training on conventional light aircraft at a flying club or wherever, our ability to recover from the approach to the stall and the stall itself has to be demonstrated before we can be sent off solo. It is drummed into us that the use of aileron to keep the wings level approaching or in the stall is an absolute no-no. Roll must be countered with rudder.

Many light aircraft are fairly forgiving in that respect, perhaps because the wing/body angle washes out towards the tip-mounted ailerons. Others will react by rolling against the pilot input as the downgoing aileron stalls, usually leading to a spin. This is the classic trap from the early years of aviation.

In jet transports, when practising the approach to the stall, use of aileron (and associated roll-spoiler) is normally permitted. At the point in question, AF447 was already in a super-stall, although we have to assume that the PF had not diagnosed it. Quite what effect this was having on lateral stability is unclear, bearing in mind that the PF had been working hard on lateral control long before the aircraft stalled. Now, the whole wing was super-stalled.

I am reliably informed that, in addition to the fact that the aileron inputs might have been counterproductive (we don't really know), the associated roll-spoilers would have had little or no effect. Well aft on the wing chord, I guess they would have been in relatively stagnant air.

Chris Scott;

Just to add a few elements from the Upset Recovery Training Aid to your as usual excellent explanation:

The use of rudder to correct roll is not advised on large jet transports. The correct stall recovery procedure (not to be confused with reversing an approach to the stall) is:
1. Pitch down to reduce AoA in order to 'unstall' the airplane, then
2. Roll wings level using ailerons, and then
3. Add thrust to regain original airspeed and altitude.

Quote:
Originally Posted by BOAC http://images.ibsrv.net/ibsrv/res/sr...s/viewpost.gif

Henra
Henra,
If it had been Alt 1 law yes. Unfortunately this was in Alt 2 law. Nothing is leveling the wings in Alt 2 law but the pilot. There are indications that there was either a wing heavy condition or turbulence causing roll inputs to be required to avoid an extreme roll attitude.

From the BEA note

The aircraft was not yet stalled while the above was happening.
If we knew the reason for the nose up pitch inputs, we would be well on the way to understanding the accident. IMHO, inadvertent pitch input while controlling the roll axis seems to be the most likely cause.
Alt 2 is a funny law. You have to stay off the pitch axis, but fly the roll axis. That does not seem trivial to me.

JCLEANT

What can prevent him from taking a left bank angle ?
Remember that it is to counter a bank angle to the right ..
So the force pushing the plane to a bank angle to the right should be very strong !!!
Wat can be this force ? .. what can produce this phenomena ?

ans: Strong and violent updrafts in a thunderstorm!

In swept wing aircraft at high AOA, "aileron drag" or "adverse yaw" is due to increased induced drag (as well as parasite drag) from the down going aileron causing yaw opposite the roll input. Not because the aileron is stalled.

I flew the "poster child" aircraft which exhibited this nasty tendency, the F-100 Super Sabre. At high AOA it was a "rudder" aircraft for roll (if you felt lucky, you could "tweek" in some opposite aileron to assist the rudder).

The F-4 was also prone to this.

Conversely, when unloaded or pushing over establishing a lower AOA, or simply at a lower AOA, in any swept wing machine, the rudder is relatively ineffective for roll anyway, and ailerons must be used for roll control.

Rudders can roll a swept wing aircraft at high AOA, because of the large differential in lift being produced by the wing being yawed forward versus the wing yawing aft relative to the vertical axis which results in rolling. Straight wing aircraft just don't exhibit this to any great degree.

At 0 AOA in a swept winger, you get no roll from the rudder, only yaw. At negative AOA, you can get "proverse" yaw from the up going aileron.

Post stall, swept wing jet transport aircraft can also exhibit "adverse yaw" to varying degrees with aileron/spoiler inputs. Generally it is minor, but it is disconcerting to be commanding roll in a particular direction and not be getting what you think you should get.

*********************************************

In the A330, in ALT1 or Normal, nothing is leveling the wings but the pilot either. The wings are not automatically leveled when you release the SS input in either ALT1 or Normal laws. If the bank is more than 33 degrees in either law, ALT1 or Normal, true, the aircraft will return to 33 degrees of bank if you "let go da SS".

In ALT2, while hand flying pitch, the A330 is not the "squirrel" it is being portrayed as. Nor in roll.

Agreed we do not know how violent the right bank tendency was.
Looking at the fact that even deep, deep in the stall, at AoA > 45° the roll attitude always appeared to be relatively straight and controllable (for that AoA). This does not point to a dramatical static imbalance. Nor does it point towards a tendancy of the aircraft to roll dramatically in general.
Therefore we will have to wait for more details to judge if aileron input was required to correct this or if it would have been rather a case for rudder trim or even waiting, riding out the turbulence.
We simply do not know the rate and duration of the beginning roll attitude.

On the other hand I agree that a cross control effect from correcting roll attitude is a prime suspect for triggering the initial Nose Up command.

(The subsequent NU's are different, I mentioned already my somewhat favourite theory of somatogravic illusion of falling when reducing the RoC from 7k fpm to 700 fpm close to the stall speed.)

What could have caused the roll excursion:
- Fuel imbalance:
Not very likely, would likely have caused severe Wing Drop after the stall, putting the Aircraft probably either Upside Down or even more likely in a spin as consequence of continuous Left aileron at high AoA. Moreover we have no indication of a pump failure or some such.
- Rudder Trim:
Cannot be completely ruled out. Although there is no mention of Pilots correctiong rudder trim. Would only make sense in combination with asymmetric thrust. Apart from this it is still unclear to me, what would cause this.
- Asymmetric Thrust:
AT should prevent that. Even after disconnect, behaviour should be rather symmetric. I would consider it not extremely likely.
- Aileron mistrim by AP to correct for wind shear, lateral air movement:
Could be a potential reason but it would be quite a concidence if the conditions would just change at the same time as the AP quits.
Ányway amount of roll should be small in this case (< 5° bank)
- Turbulence / Up-/Downdraft:
Looking at the general environment where AF447 was traveling and the relative unlikelyhood of the previously mentioned causes this is probably by far the most likely reason.

Did I forget a reasonable case?

If it was indeed the consequence of turbulence I would assume that even when not touching the SS for 20s, you would still find the aircraft in a reasonable attitude. Not perfectly S/L but probably also not in > 30° bank (Yes Alt2 would not prevent exceding this, I conclude this rather from the general behaviour of the AC in roll- might be wrong though).
With Autotrim trimming for 1g you would even not start entering a spiral dive by doing so. But we will have to wait the next BEA report for details which would confirm or contradict this assumption.

As a non-pilot, my feeling is that this is more about the effective presentation of information to people under stress and psychology than about software or the absence of aoa readouts.

RR_NDB;
You say that the industry should, "'rethink' the FDR concept [/I]".

On the contrary, the industry has come a very long way in flight data recording.

I'm genuinely interested in any push to improve flight data recording, (but with CNN around, not video recording) because the present legal standard in Europe, the United States, Canada and I believe Australia is the recording of 88 parameters for aircraft of the A330's certification date. For those certified prior to 1991 (October to be exact), only 17 or 18 parameters are legally required and if the aircraft is modified with a DFDAU [Digitial Flight Data Aquisition Unit], 22 parameters.

Any FDR & QAR data gathered above this regulatory minimum is voluntary. That should give some sense of the extent to which flight data is valued and gathered for investigation and accident prevention in FOQA Programs.

Nevertheless, many working in the industry have been battling this lack of data for decades, but with little success in improving the regulations even for the protection of data that is required to be recorded.

To some, data is indeed "inconvenient" because, in an accident the data can illuminate failures somewhere in the system. The will to deny unwelcome flight data is powerful among those who are commercially-motivated and such short-term thinking does drive the industry to a certain extent.

If the airline lobby (through IATA) is unified at all, it is not around sustaining such "mystery" but more ordinarily around the very high cost of such systems which will always include the costs of retrofitting aircraft to exceed the legal minimums. Where STCs [Supplemental Type Certificates...the legal authority that permits any aircraft to be modified), alone are unbelievably expensive, time consuming and resource-hungry, for smaller organizations.

That many current transport aircraft record over 1000 parameters is a testimony to the digitial revolution and the both the manufacturer's and the airline industry's established intention to monitor their aircraft, primarily aircraft systems but operationally as well.

FOQA Programs, now regulated with certain FAA protections for the collected data in the US but not in Europe, Canada or Australia, use QARs which can be programmed to record many thousands more parameters and at higher sample rates than available in FDRs and certainly exceeding the legal minimums.

The AAIB document, "CAP 731" is well worth examining, especially Appendix B which describes a bit of the complex recording process.

The BEA may have already used the QAR and other EEPROMs from the FMGECs, FCPCs, FCSCs mounted on the main equipment rack, "880VU" and since recovered. Hopefully they will have some comment on this recovery.

To return to your point, the fact that the #2 CAS is not a recorded parameter has nothing to do with a mysterious absence facilitating a 'mystery' and plausible deniability. Were that the case, many other parameters which hold equal importance would also be "missing". There are approximately 1300 parameters on AF 447's SSFDR. It is unfortunate that the #2 CAS parameter is missing, but it just isn't logical or even reasonable to believe that someone or some organization didn't want the parameter to be in the data.

One manual pitch-up theory says that the PF was pulling back in response to a high-speed indication on his PFD.

My own view is, the #2 CAS was almost certainly, roughly the same as the #1 and the ISIS-displayed speeds. Here is why I believe this:

Double or triple independent and concurrent system failures are extremely improbable. So first, let us set aside double or triple failures in other sensors and/or computers independent of the pitot failure and not merely a cockpit effect of upstream data or component failure causing an instant increase in CAS readings just on the #2 PFD.

By design the FMGEC > FCPCs cannot trigger the High Speed Protection Law or the Alpha Protection Law in Alternate Laws 1 or 2. And there is only one case where pilot ND response on the sidestick is inhibited and that is the High Speed Protection in Normal Law, and only until the speed is reduced below VMO +4kts, (IIRC). All other "protection" pitch-ups may be countered by the PF. So if the pitch-ups were executed by "rogue software/hardware", the side-stick should be effective in reducing the pitch and returning the aircraft to level flight.

This leaves us free to examine pitot failures in combination with the plausibility of an airspeed increase just on the #2 PFD.

There is no pitot failure mode which will cause an increase in airspeed in level flight.

A blocked pitot inlet and open drain hole produces a drop in airspeed and a blocked pitot inlet and drain hole requires an increase in altitude to produce an increase in indicated airspeed.

The increase in such a circumstance is mild - from experience (B767) it is not a huge increase - 20kts, perhaps. At FL350, the cruise speed was roughly 271kts (M0.80) and MMO (M0.86) is approximately 295kts. Nobody is going to pitch a transport aircraft up beyond 10deg to control that kind of increase in speed.

Regardless of amount of increase, logically the increase in observed speed must occur before the actual pitch-up because, with the pitot and drain hole both blocked, there is no increase in speed in level flight and the pitch-up by the PF would not have occurred in response to increasing speed. Therefore the PF was not responding to an increase in observed CAS on his PFD.

The argument is merely reasonable but of course is not conclusive.

So your, and everyone's question regarding "Why the pitch-up?" is, I think, the only important one at the moment.

I think the PF was executing the initial memory items of the UAS drill rather than stabilizing the aircraft (maintaining pitch-and-power settings) while calling for the QRH UAS checklist for the book settings but that's just a theory among theories and we'll soon know what actually happened and why.