No, this is the post I had in mind:
AF 447 No.5 post#1729I'm not sure I understand the bit in brackets: does the mod apply to A/C with the BUSS option or to all A/C?

Always? I believe someone posted info that the ADR's have to be physically disabled thru the switches on the overhead before the BUSS is enabled.

BUSS 'appears' to be an 'on demand' EFIS displayed AOA indexer, the first 'S' in BUSS being a misnomer.

In any case this is not full time AOA.

(my bold)

The 'disregard', as a matter of intent to operate that way, is just not done by any carriers west of Atlantis these days. 'Good' data can translate to inappropriate lateral, & particularly inappropriate default vertical steering commands. In the wild west, they're either 'on' providing pilot selected steering guidance in the 'appropriate' mode as confirmed by the FMA or 'OFF'.

PRM breakout procedures are a another prime example of the validity this requirement in order to preclude unintended vertical guidance commands. (This is not to say that an inappropriate steering command should not be recognized for whatever reason it should occur.)

That may be a little 'broadbrushish'.

EDIT: I guess semantically with BUSS, AOA is always 'available' just not always viewable. :)

So Dozy, how do you explain the AOA inhibit of nose up trim in Normal Law? Why did the engineers decide that was sensible? Wasn't it because you could actually trim an aft cg aircraft into a stall?
What happens when the trim stops is you have to hold a pressure. If you don't want to hold the pressure, you can still reach down with your free hand and turn the trim wheel. No big deal, but it will have to be a conscious decision.

There are all manner of things that happen in a FBW aircraft that are not annunciated. If nose up trim stops because it senses a limiting AOA, that is a form of annunciation in itself, and from a piloting standpoint, that is very intuitive..

I still don't get it. You are trying to jump over towering cumulus by trading as much speed for altitude as possible - "green dot" is very technical term for minimum clean speed. You fail to clear TCU. You hit the updraft and lose downward pitch authority. And yet, you think it is normal aeroplane behaviour.

Congratulations on your coolness but I fail to understand source of it. Why would you think it is normal to loose downward pitch authority? Was it something in your training? Did you experience it many times? Why do you assume that what's valid for navigation system is also valid for flight controls system? Could you please explain how updraft can fool ELAC into robbing you of nosedown authority?

Not at all, it fits perfectly into this thread.

All of us did. AF447 has gone where no 330 has gone before. Unsurprisingly, there were many surprises to be found there.

Unless your interest in aviation does not end at what is legally required, that is.

What matters is whether what you do recovers you to normal flight and manufacturers are betting their reputation and existence on their procedures being best available. There was procedure for dealing with unreliable airspeed. There was procedure for approach to stall. None was followed. It would be terrible waste if all we can learn from AF 447 is "Don't pull when faced with stall warning"

I am not surprised at all, since what you wrote is only applicable for spin recovery in some types with less than savoury spin characteristic. If in unusual attitude and not stalled, you do not wait for controls to take effect. They might be mushy or ineffective (EDIT: I should have written "stiff" instead of "ineffective", sorry about the lapsus) but effect will be pretty quick - powered controls lag notwithstanding. Aeroplane that doesn't reply to controls is certain signal of some deeper trouble, be it stall, ice, control failure or airframe failure.

Personally, I am more than little amused by all the exaltations about airline pilots needing full stall recovery training. Ones pleading for it might be correct but let it remain type specific, please. I have just passed 4000 hours mark on aeroplanes that would simply kill me if I ever stall them. Don't see anyone being too excited about it, though.

Is it OK if they just knew the FCOM chapter where they could read about it?

Why? Wasn't pitch up flight controls and thrust induced?

Totally agree. Not necessarily for the same reasons.

Clandestino wrote:
What, to gun it and pull up? Ha!
No, not at high altitude, there wasn't. Stall training, as I read it, was only for low-altitude problems such as wind-shear. This was one of the shockers :eek: to come out of the reports, so far. Somebody please set me straight if I have misunderstood.

Yikes! OK, type-specific: I will never, ever, fly in a 'Bus again until I am sure that everybody holding my life in their hands is properly trained for such rare and unusual attitudes. Passengers do not expect to gamble on such things. In fact, I'm sure there are 228 souls who would emphatically disagree. :cool:

Well, what would be a pilot's choice. I ask the question:
Pilots, do you prefer:
a] an aircraft that may (auto)trim nose up when it's (near) stalled
b] an aircraft that may not (auto)trim nose up when such trim is good, because the said aircraft suffers a "failure" with AoA measurement?
My (unqualified) answer is that 'a' seems more dangerous than 'b'. Then I choose 'b'.

Dozy, I'm not trying to describe what it takes to implement a feature, I'm limiting myself on the "logical sheme", as I think this is all what is of interest to airmen (I can be wrong, there, and stand to be corrected).
So basically, I was agreeing to what you said: yes, one more "test" to do before allowing the autotrim to do its job is adding complexity to the system.
Having by no mean done any of a serious study (from a manufacturer perspective) on such an implementation, I won't comment on the "how much more complexity".

Huh? What's the point? Are you saying that:
- inhibiting NU autotrim when a protection is ON
is far more simple than
- inhibiting NU autotrim when a warning is ON
??
I don't understand. Protection and warning share a source: The actual AoA. I don't see where is the "more complex/difficult" thing.
By the way, IIRC (*) on the A310 (older system), there is no "hard" protection. But when the aircraft "senses" a too large AoA, I believe it enters a specific mode which "unwind" the trim by x degrees.
(*) Ref is an east-european A310 (TAROM?) incident on approach to ORY, years back.


I'm not sure to follow you, there. Could you elaborate, please?


I don't know why AF447 crew didn't react to the S/W. If we assume they "fail to notice it", then no, the warning I suggest would probably not have had any use. Except, perhaps, with the CPT who returned just ~ the time the S/W came OFF...



Yep. Would like to know what pilots would prefer?

I'm afraid you misunderstood.
Ref to interim report #2, where the AF procedure "stall warning" (at the time of the accident) is reproduced.
Abstract:
During any other flight phases after lift-off:
- TOGA
- Reduce pitch attitude
- Wings level
- Retract speed brakes.

Is that really "to gun it and pull up"?

I agree with you on the "no-training" part (high altitude), but Clandestino wrote "There was procedure", not "There was training". ;)

Personally I would like to be handed a basic aeroplane, but that is probably because I am so old I can fly one.:)

Way back I attributed to DW (but he said 'not me') the concept of the AB software reverting to Direct Law on such a failure as 447 had. IF then crews know this, they can be (hopefully) given the training to actually fly a real aeroplane. If they were, for example, to need trim, as long as there is some way they can INPUT it themselves - as required - that's fine. I would not wish some *** (censored for DW's peace of mind) to decide to put it in for me. I would, after all, know I need it, because I am a pilot. I should then know I have done it (because I am a pilot) if it becomes troublesome, whereas it is more than possible that the unfortunate 447 PF had NO idea he had full nose up HS - as I think the PGF PF also did not. KISS?

I just cannot see the problem- computers go tits up - pilots get given a machine that will fly the old fashioned way - all the bells and whistles are absent - who cares? It's an emergency. We don't need them.

When a concept atrophies a pilot's basic ability such as trimming, there are very serious questions to be asked regarding that design, especially as that pilot could be requested to instantaneously master that art again following a malfunction of that very same wonder concept.


But I would like to hear you about that one first :

Hi,

Those kind of consequences (atrophy of basic skills by a concept) is coming common in the industry
I see that in marine industry (unable to control manually water level and pressure of a high press steam boiler)
Again ..training .. training .. it's must be trained .. as the marine engineers who have the experience to manually control a boiler are a endangered specie !!
Even manually coupling on the electrical bus bars one diesel generator is for someone a unknow task !

Here is what needs be known:

The algorithm change is minimal - adding one test - and brings the Alternate Law "autotrim" behavior to be similar to the Normal Law "autotrim" behavior, so it's NOT something completely new.
The additional test in the algorithm requires a version upgrade in a number of internal specifications, that are documenting that algorithm, and in the user documents. The algorithm change is followed by a change of the software implementation, which depending of programming language goes from a line or two - the additional test - in high level language, to perhaps about 6-10 instructions, in machine language.

Is that a lot? That's about as minimal as one would get in terms of a software fix/upgrade.

A software upgrade is the easiest change, a lot easier than changing hardware, mechanical, hydraulic, etc.. components

Dozy:
Both.
But for me "on line" was flying in the Navy, not hauling hundreds of folks about the skies to Rio and Venice and Bali and other nice places. A half dozen souls at a time were all who were at risk were I to cock it all up.

Lyman:

You misunderstand my "how CRM is supposed to work" scenario. As we have noted previously (three or four threads ago), is was not how the cockpit discussion went based on what BEA has released to us. I was using a general conversation, not trying to repeat verbatim what was actuall recorded.

OK?

CRM in that cockpit: from the evidence provided, it was not up to scratch beginning about ten to fifteen seconds after the UAS incident began ...

Notice of stall warning, instruments, audio
 

All bolding by me

Was the stall warning not noticed, noticed but not formally announced, noticed and not formally announced and not successfully reacted upon?


Let´s look at BEA Interim report 3: (bolding by me)

.

BEA assumes, that both stall warnings had been recognized and honoured by an action (although not successfull ones), and the PF admitted twice and the PF and PNF stated to the captain, that they had lost control of the aircraft, which could be a term to describe the fallout of the stalled situation.

We have to consider that BEA had made up its mind concerning this issue. The crew probably reacted to the stall warnings and admitted to have lost control, but did not formally announce stall to each other and also not to the captain.

I could not find your claim, that the captain was pointing to the ISIS, but i might have overlooked it in the report. Can you point me to it?

Edit: Thank you DW, found it with your help!

The following two quotes are for the one / ones, who still think(s) that instruments tell it all.

Some say, he would have understood better without asking, if he would have been able to observe a full NU control input together with the instruments.

And that one for the audio channel:
franzl

You don't know that - the change itself may be minor, but the surrounding modules must all be tested to make sure there are no adverse effects. The development process is considerably different to any other software development methodology - even other real-time systems.

If you don't believe me, let my late Prof. explain:

Report on visit to Airbus Industrie - 28-29th Jan. 1993

(Emphasis mine)

In the middle of the intermittent stall warnings is when the PF makes his comment "I have the impression that we have some crazy speed no what do you think?", which we're told by some of our French posters refers to the PF believing they were in overspeed. The Stall Warning comes on again shortly after he makes that statement, so either he's not hearing it, or he has ruled it out as erroneous.

Still one ADR ... no ?

Testing is part of an upgrade, and it is proportional in all aspects to the type of system, and the type of manufacturer. Don't get into assumptions territory with my knowledge base, and let's keep things at their real scale and/or proportions. It's up to Airbus to have a clean, efficient, straight forward process, or a complicated mess. It is expected that theirs is not bellow - actually it could be very well above - the level that is considered norm in such type of critical systems - appropriate level of automation/simulation, etc.. .

STALL WARNING
 

Something is not clear with the STALL WARNING :

For the 330 the FCOM mentions there is no FLT PHASE INHIB.
In the meantime there is an EMERGENCY PROCEDURE called STALL WARNING AT LIFT-OFF when such warning may sound if an AoA probe is damaged. I would then think there is actually an inhibit as long as there is still WOW ...

For the 320 the FCOM (not updated) clearly mentions that the STALL WRN in inhibited on GND.

I see no logic behind the logic as described on page 20 in report #3 :

I'd agree with that, but the tak might not be as simple as presented.

We are talking about taking a single protection active in one law/mode and making it available in another mode. In the other mode that protection is part of a set, and the algortihms and code may well be interdependent, so you have to first split out the logic for that one protection and that might not be simple. Setting up the testing etc. won't be as simple either, for the same reason.

Further, it's entirely possible that the air data you need for the protection is simply not available at the flight control computers (prim or sec) in the event of airdata failure. I'm basing that on two things - the non-switch to abnormal-attitute law in 447 (which should have tripped on AOA, but didn't because of triple AD failure) and the reports that the BUSS option requires new airdata units in order to route raw AOA data around the ADIRU. Even if you could base your new code off the BUSS option, that still makes it a non-trivial hardware change rather than just a software patch, and you've also probably got to get an additional input ("raw" AOA) into the flight computers - maybe more hardware change and definitely much more testing.


However, I think there may be an even bigger problem that is much more fundamental. Looking across the civilian FBW implementations, there is a clear and consistent decision that protections/limits based on airdata are dropped when airdata is not valid/trusted. Either that is an independent engineering decision across teams/types and mfrs (yes, it's the same on B), or it's a regulatory / certification decision.

You need to overturn that decision to put trim protections into Alt2.

Bear in mind that if/when you do, a line has been crossed. Currently with UAS or other airdata failure, a good crew that can
a) work out which instruments they can trust
b) fly the plane within the safe envelope based on (a)
will survive. Throw in protections based on partial/incomplete/known-bad airdata and sooner or later you will kill a good crew that's doing the right thing. [There is still a chance of that in normal law, but it's much lower and much easier to quantify and try to design out. You couldn't even simulate all the failure modes for the input data for the bad airdata case].

So, who do you want to kill ? - because that is what it boils down to. It's normally the engineers faced with the dilema, maybe it should be answered by the pilots ?

Possibly belt and braces - WOW switches not sufficiently reliable on their own (not a great history of reliability, and they regularly take a beating in use).

There may be more behind it than just SW as well. Active protections have consequences requiring greater data certainty than mere warnings. SW on taxiway is one thing, alpha-floor on taxiway likely to end less well...

For what it's worth, I think we may see this logic changed - if it's in software and is an easy update. If it's hardware and needs 3xADIRU replaced I think it's somewhat less likely....

IF789,
I think you put things far more complicated that they need to be :

When there is a known problem on the data or one is suspected, just stop the Magic and reverse to the conventional aircraft in Direct Law.

Did you say KISS BOAC ?

Then why is it good enough for the 320 ?

That would be far more simple, indeed:
- for the engineering team to implement
- for the pilots to "understand"

Now, Airbus made a different "philosophical" choice. "Why" is a good question.
A guess: Alternate law retains "parts of" automation. What would we say if there was an accident and we found out that the accident could have been prevented by a protection/automation that was made inop because of a reversion to direct law, while the input data needed for this protection were available & reliable.
Exemple : Let's imagine AF447, the aircraft stalls but then the crew engage a recovery : nose down, AoA is lessened, speed come back. At this point, the PF pulls on his stick to go back to level flight but he pulls too hard.
If reversion to direct law => overstressed the plane => structural failure => irrecoverrable => crash.
If reversion to alternate law => g protection still available => no overstress => plane recovers => continue flight => lands with all souls onboard alive.

See the point? That's about "graceful degradation" if I understand the concept correctly.

I read your "may" as your making a cautious assumption, which is always welcome at the outset. A closer perspective can clarify if the more distant perspective caution is justified.

With the risk of repeating the considerations mentioned by AlphaZuluRomeo, with my own closer perspective and words:

As far as I can remember from when I looked closely at Normal Law protections, in an up-down sequential flow, the elements of the set are parallel, and independent.

Please note, dependency of more than one algorithm on a certain parameter, which, if I recall correctly is the case, does not make the elements of the set of algorithms dependent on each other, or interspersed.

An additional factor is that the Alternate Law is a subset of Normal Law, in fact a minimal subset, which means that the number of parallel algorithms in the set is minimal.

These are both elements that speak about simplicity.

It's good to remind us the philosophical and general principles, if there is a suspicion that the "higher" perspective was lost.

But I don't think it was the case, the perspective was/is there.

In the same time let's not loose the close perspective - while we look at the Forest, let's keep looking at the Tree we're concerned about.

The function of the Autotrim is an automation factor to "the Trimmed Stabilizer".

When Autotrim didn't exist, pilots did the trimming Manually - if the "trimmed stabilizer" was present - if there was no "trimmed stabilizer" on a plane, the pilot did NO trimming at all

So, the intention of the "automation" was/is to do the "autotrim", on behalf of the pilot, in those conditions in which the pilot would have done the "manual trimming". This is very important and should be remembered by everyone, pilots, engineers, system architects, managers,etc.... !

What do we have in the AF447 case?

We have the STALL condition being announced loudly - and after so much analysis, very clear in its meaning to us - and throughout the duration of that announcement, we have an "automation" decision/action of employing the "autotrim" to max NU, which obviously if it did anything, it helped the STALL.

The analysis work of last 2 years, performed by appropriate organizations, and the very clear and loud resulting recommendations for the required actions from pilots at High Altitude Stall Approach, or Stall is to bring the ND, which implies the strong recommendation of NO Manual Trimming NU during such conditions!

When remembering the few lines above, that the "automation"s role is to only do what the pilot would do manually if automation was not present, the answer to anyone's dilemma seems simple....extend the "don't do manual trim NU", with "don't do manual/automated trim NU"...

IMO, the recommendations for what "automation" is supposed to do during the conditions of the new recommendations for pilots are just one step behind. The lag seems to be normal, although the current dichotomy
present in some systems will need be resolved regardless of recommendations or not.

It's a big misconception that there is alternate law in Airbus fbw software. Of course we call it alternate, but what it basically is is a degradation of normal law. There is only normal and direct law, and the intermediate position where one degree of freedom still is in normal and the other not anymore is called alternate.

The more protection you lose, the closer you get to direct law. You could now design three dozens of different laws, a gradual sinking into direct law. To make it more easily, they invented 3 positions, which makes absolutely sense to me.

I said it and I say it once more: You as a pilot don't have to know in which law you are. There is no ECAM message "YOU ARE IN XXX LAW". You can fly the aircraft in any law. Just where the amber x's are, that's where you lost your protections.

Now you laugh at me and say "if they (AF447) would have been in normal law, the aircraft never fell into stall". This might be right. But as a wise pilot you just don't pull these maneuvers, even if you can (in normal law). "It is possible in normal law" is no excuse for behaving like an imbecile.

A common main path, versus different main paths is not really relevant. That's because a common path implies branching separate ways into separate sub-paths depending on Law, when decisions and outputs are specific and different for each Law, which ultimately is sort of equivalent. This type of sub-path, which be then the object of the considerations made in this discussion, is still technically a different path, even if a short one. In cases when outputs are similar, the branching/separation may be followed by a rejoining a common path.

Huh? Do I misread this, or is a typo?

The more protections you lose the closer you are to direct law.

Sorry, wrote it in a hurry, but you are right. Of course these are new branches, and software engineers think like that. I have nothing against it. I just want to help non software engineers to think correctly. Pilots get confused when showing too much complexity. They like it simple (anyone said KISS? ;) ), because in the air and under stress you lose your ability to think in details.

When an outstander, which most of the contributers here are, hears about all this laws, he thinks: How could they have made it so complicated. It isn't complicated. Just think straight, think KISS, and Airbus is KISS.

For one understanding them well, they're simple - you're right

Interestingly, that applies also to algorithms and their implementation :O

This is a very good additional argument of why the SS (under PF control) should be placed so that it can be seen - under stress, the visual contact with the SS, is the easiest way to know what's going on with it.

Of course there are :

• F/CTL ALTN LAW
• F/CTL DIRECT LAW

Airbus is so KISS when manually flying that he trims for you ... but sometimes he does not. When he does not he supposed to advise you but it appears he may forget as well.

Don't rush your judgement as you rush your writing.

Doesn't a drop to Direct Law have an amber "USE MAN PITCH TRIM" annunciation?

I know, I know! [waves hand in air]
 

Dozy:
Yup.

• But disappears in Abnormal Attitudes Law
• BEA pretends Altn Law was the active Law all the way

What I can report from my own experiment in the sim :

• I could not get a fwd autotrim
• But USE MAN PITCH TRIM FLAG was NOT displayed on the PFD

CONFiture:

it doesn't disappear, it never appears.

I do not doubt this. Imagine: No valid speed, therefor several fault messages from/through ADR.

Which is confirmed by FCOM. The aircraft behaves like they say it does.

This message appears in direct law, not in alternate law.

The only way you can tell that you are in alternate law is (apart from ECAM messages, thanks for the correction) are the amber crosses on PFD.

Dani

What you seem to be missing, perhaps, philosophically, is the aircraft is mimicking the actual degradation of the suite of cues, displays, and controls that are the very genesis of the LAW degrade in the first place.

When, for any reason, cues and behaviour of airframe are lost to the holes in the cheese, how beneficial is it for the a/c to do the same? Fair enough, this is true for Direct DIRECT also. However, once in DIRECT, the skillset is less chsallenged, the a/c becomes a simple machine, not an automatic one. The interface is straightforward, and quickly acquired. At this point, airmanship is the key, not the interface that mimics it.

To change the response and controls automatically, requires an additional workload, and from my perspective, a most unwelcome one. Looking out the telescope frrom the small end, (what we are doing here), is easy, and without stress or penalty.

Looking through the telescope in reverse, (what the crew were doing), does not form a large enough background for global view. When the flying gets complex, why add additional changes that may cause consternation to a hyperfocused crew, looking for the ONE thing that needs the most attention? Simplification is the driving force, or should be.

The bottom line is the additional workload. Unwelcome, says I.

Right, Wrong, or Indifferent, the crew were unable to isolate the simplest move, get the Nose Down.

The confusion came from somewhere, I say a fair portion of it came from the platform. Fair?

Perpignan told a different story as the USE MAN PITCH TRIM FLAG was initially displayed but disappeared when the flight switched into Abnormal Attitudes Law.

Dani, what is that FCOM reference that could explain I was not able to get a forward autotrim ?

I rather think that it would not be a fair attribution to suspect the platform. The factor that might best describe what you're driving at would be 'Know your machine' which is a training and cultural issue. We have no evidence of a chain of command, CRM or use of standard procedures. Given that all of these seem lacking any platform is going to produce a similar result in similar circumstances.

And yet on the A320 sim I did. Have you tried talking to the sim engineers about that one?

Thus far there have been no emergency fixes released for the A330 in terms of hardware or software, but there has been a new stall recovery procedure which instructs use of the sidestick to push the nose down. This suggests to me that Airbus and the BEA got positive autotrim response when they tried it on their A330 sim.

Not only that, but the MEMO, when released by BEA, provided no NEW MECHANICAL issues that hadn't been addressed....We don't go there....

OC... It isn't that black and white. There are four degradations that can obtain post UAS. ALT1, ALT2, DIRECT, and ABNORMAL. PITCH and POWER are nothing if not offspring of MANUAL, why present one or more of these different concepts when ostensibly, P/P is always the Drill? P/P is successful, or it is not, and if not, protection memory accomplishes what? Protections obtain when the pilot has lost control anyway? Why bother with stops along the way to DIRECT (PITCH AND POWER)? Did the a/c linger in NORMAL whilst P/P could be applied? If not, why not? And if inertials were such the hot ticket, why not blacken both PFDS in favor of an ISIS with reads in RED?

Complexity for the sake of......?

Another thought. Why leave NORMAL LAW at all? It is possible for NORMAL to retain, even with a/p loss. Just not with unreliable speeds.

It would still come down to training wouldn't it? Me, I'm no Airbus pilot but those who post on this board seem to have no problems with the system as configured. One can legitimately argue that it can be improved but then so can everything. It's logical and it works so I would be very leery of attributing any causal factors to it. The issue is really the inability to analyse the UAS correctly and the unexplained stick movements by the PF (we all have our suspicions but we can't be certain). I would agree that P/P is the drill but if you don't get your initial analysis right then it becomes rather moot.

You're right, but it's also a general statement of the need to be cautious about what is or is not "simple" in software without detailed knowledge. A fair few years in software development has taught me that it's very easy for someone to believe they know enough about the internals of a system to assess the impact of a change request, when in fact they don't. Dependencies can be very subtle. Often the CR will eventually (sometimes only after the test start failing or the user bug reports start landing) hit the desk of the person that does understand the impact and result in an expletive laden exclamation about how that change could obviously never be done without a major redesign...

Unless you've actually worked with and modified (not just read) the actual code, I would always advise that caution. Sometimes I might even follow that advice myself ;) [I have, I admit, been on both sides of this issue...].


Be interested if you know whether or not there would be a change required for getting AOA into the FCPC around the ADIRU in the event of ADIRU going "failed".

Stall warning.

And therein lies the dillema - warning vs actual conditions. Maybe I didn't expalin well.

If the 'bus flight control is in a mode where it is confident that stall condition is anywhere near, it will take action to prevent it (over and above trim limits). Normal law.

If it has lost confidence (e.g. airdata fail) about its condition but has indication that it might be stalling, it will warn the real pilots, but not take overriding action. The pilots can then use actual intelligence (of which the machine has none) to assess the warning and the condition of the a/c and take action. Worth looking at Perpignan report for another example of the difference (dual aoa failure, outlier aoa not trusted for protection but used for warning).

In this case, 447, the warning was actually right, and the pilots assessment fatally wrong.

Change it so the FCC will act and "protect" in the warning scenario based on known-bad data, then you might save 447. At the same time, you risk the warning being wrong (due to bad data), the pilot assessment and actions being correct, and the a/c "protecting" them into the ground...

I think the risks either way are going to be very very difficult to quantify which is why this is a tough call.

Your A320 sim didn't trim up under STALL WRN, and yet my A330 sim did ... as also AF447.

And we have Jacques Rosay, Airbus VP Chief Test Pilot, who states :