CONF - read what I'm saying carefully. The limiting protections are not assigned to each of the flight controls in turn, the flight control computers simply command a flight path, and when an axis limit is reached, maintain the flight path in said axis. The THS (and for that matter elevators, ailerons etc) are not prescribed movement limits in real-time (which would be inefficient and unnecessarily complex), they are set to follow the commanded flightpath, whatever that may be.

When the protections are inhibited in Alternate Law 2, the pitch axis is still controlled by the commanded flightpath, but the flightpath no longer has a hard or soft limit. As such the THS and elevator will follow any command given from the stick, which makes sense as long as you're willing to trust the pilot.

So - on that basis, the systems designer faces a dilemma. Do they add an autotrim limit or warning based on the current status of the aircraft? Would doing so run the risk of making things worse? Is it worth taking that risk on the basis of a single incident where the control inputs made by the PIC were woefully inappropriate?

At the risk of repeating myself, the autotrim would have assisted in the recovery if the PIC had ordered sustained and consistent nose-down. It would have stopped dead and slowly recalibrated itself if he'd levelled off at any point prior to the apogee and stall.

Even if autotrim was limited or disabled in Alternate, the end result of AF447 would have been the same because the fact we cannot escape from is that the PIC pulled up at the onset of UAS, continued pulling up during the climb, and kept pulling all the way thorough stall and descent to the ocean.

PS. I wasn't bringing up Habsheim to talk about Habsheim, I was simply drawing your attention to the behaviour of the flight surfaces in that incident to illustrate my point. I did so because I know you're very familiar with it.

This can be interpreted from another point of view ...
If this amendment would have existed before the accident .. the accident would perhaps not have the same end
Exactly as for pitot .. if they had been replaced by .. lots had the accident less likely to occur

How can you say that with a straight face? He pulled up almost all the way down!

Let's be clear here - the THS position didn't help matters once stall had been established, but correcting that was a simple matter of pushing the stick forward and holding it there for about 8 seconds. The elevators would have overcome the THS force even before that. They had approximately 70 seconds from apogee until the stall became effectively unrecoverable.

This is like getting hung up on the rivets on the Titanic - OK, so they may not have been the best possible composition, but what made the ship sink was hitting a ^&*$ing iceberg. Even the best rivets might have only bought them a little more evacuation time at best. This aircraft crashed because the crew handled the aircraft inappropriately and stalled it.

You really should read the report. The replacement pitots have fallen in disgrace since. It is not certain, not even probable, that they would have made any difference in the particular conditions encountered by AF447.

I try to understand the meaning of your message ...
This would mean that the replacement of pitot is a sham (or smokescreen) and that the risk is exactly the same as before AF447 ... and yet the planes continue to fly happily because a procedure is available in case of pitot problems

It's just like if you buy a car that has the latest technical refinements
But the salesman informs you that from time to time (often when it rains) the brakes (pitots) are no longer available (short-term phenomenon)
It does not matter because you will see a warning on the dashboard telling you that the brake assist is no longer available
In addition the manufacturer shall have available a brochure (procedure) explaining how to do in case of brake failure
Do not leave the road
Avoid obstacles
Try to stop with other methods
Furthermore the seller'll reassure you because he saw that you are a good driver for your drivers license has more than 20 years .. so no problems
Will you buy this car and take your family to a certain death ?

And... Just in case people missed it earlier, the Thales pitot tubes were an optional fit. The standard was 3x Goodrich.

The Thales AA type are the only model known to have suffered a triple failure. The Thales AB type have suffered single and double failures, but not triple. The Goodrich probes have suffered single failure only.

There is no such thing as a perfect pitot tube design for weather conditions of that type.

You are misinformed Dozy.
Reaching alpha prot, the THS just stops moving.
Anything above alpha prot is done on the elevators only.
It is not 'inefficient and unnecessarily complex' it is commun sense.

jcjeant,

At the time of the accident, AF was in the process of replacing Thales C16195AA probes by Thales C16195BA probes. The current standard is Goodrich Type 0851HL.

PS. For more details, see interim report #2, 1.18.7 and final report 1.18.1.7.

No - it does not stop moving because it is commanded to stop, but because at that point there is nothing else to correct for. This is something on which I'm pretty damn certain because (admittedly many years ago) I saw the logic paths.

Dozy,

FCOM 1.27.20 Flight Controls, Normal Law, Flight Mode:
When angle of attack protection is active, THS is limited between setting at entry in protection and 2° nose down (i.e. further nose up trim cannot be applied).

@HN39 - which is not the same as being directly commanded to stop, no? Movement is limited because of the useful positional range at the protection limits.

All I know is that I was taught it was a side-effect of the protection logic rather than a direct command.

That is what is terrible with you Dozy, you have a biaised concept of the laws, modes, protections ... but you keep explaining each and everyone how it works.

It shows especially when you start talking about Habsheim ... but as long you're 'pretty damn certain' ...

No CONF, I have a conception of the logic at engineering level. If you want to think of it as a physical analogy, picture a metal sheet in a G-clamp. The Normal Law protections are the G-clamp and prevent the flight surfaces from exceeding a certain position. The closer to the airframe limits the aircraft gets, the tighter the G-clamp is wound, but the protections do not directly order the flight surfaces not to exceed a given position.

Take the G-clamp away and there is no restriction.

No, it is not, but who said it was, and does it matter?

It matters if someone tries to claim that there was a direct limit on autotrim movement in Normal Law that was taken away when degrading to Alternate...

To inhibit a direct control surface limit implies that something that could have still functioned despite the degradation was nevertheless taken away, whereas inhibiting an entire external system that relied on data that was no longer reliable is a perfectly reasonable design decision.

Dozy,

For practical purposes, the difference escapes me. Perhaps you should say that the PRIM's, having rejected the three ADR's, cannot define alpha-prot?

You don't answered my question :)
Will you buy this car and take your family to a certain death ?

That's one technical explanation (aside from replacing "alpha-prot" with "alpha max"). But the issue from an engineering standpoint is that the flight surface limits are not defined within the system that controls them, but imposed by a second system from outside (hence the G-clamp analogy). In Alt 2 that second system as a whole is considered failed and therefore inhibited.

This design decision was made based on the hypothesis that the pilot should have full authority across every flight control surface if the reliability of data was doubtful, and ironically this is a position that every Airbus sceptic would normally agree with.

What makes this situation doubly ironic for me is that if Airbus had slapped a limit on autotrim in alternate law and that limit had prevented a recovery in another incident, the same people who are currently lambasting the autotrim design for unquestioningly following the PICs inputs would be lambasting Airbus for preventing a recovery by limiting autotrim authority.

The simple solution for avoid this double ironic situation is to put the trim in manual when out of normal law when trouble (false or no data at all)
Pilot full manual authority on ALL moving surfaces ... :ok:
My aircraft

Not so simple if the pilot isn't used to it, as studi points out.

Manual control does not necessarily mean manual trim, no matter if you or others wish it was so.