Notwithstanding what Machinbird says at post 1641 above and the other quoted remarks below, I have a problem with identifying the circumstances leading to (and the possibility) of an initial Vmo/Mmo protective pitch-up (see argument below the quotes).
Confiture said:
  Hazelnuts said:
  Machinbirs said:
  .
I'm not really following why the Airbus Flt Ctrl pitch-up protection against an imminent Vmo/Mm0 encounter should kick in if the airspeeds being fed to the ADIRS were:
.
...a. Initially in agreement, albeit wrong due to pitot icing - either internally (supercooled ice-crystal build-up) or externally (BBC's pure water icing theory)
.
...b. Latterly being maintained at the selected cruise speed by autothrust (even though the actual airspeed/mach was much higher).
...
..c. Ultimately mismatching the three pitot-derived speeds sufficiently to cause a disagree and the Autopilot to disconnect.
.
I imagine that the flt ctrl protections are keyed by CAS and Mach, and if these weren't uniformly trending dangerously high (due to pitot blockage), what is there to cause the protections to cook off and intervene - by allowing the AP to pitch the nose up then disconnect? Isn't it more likely (per posts 1208 and 1471 and 1476 and 1489 ) that the aircraft accelerated into a nose-down pitch (i.e. mach tuck) because there was nothing (no high CAS or mach) detected to trigger any such protection. If the flight crew responded to a pitch-down by misinterpreting it as a stall and went TOGA/stick fwd, then that would have embedded the A330 in compressibility (with all its nasty L.o.C. follow-ons).
.
The above debate disregards where the THS may have been trimmed to and what instantaneous pitch effect it may have had upon the aircraft at autopilot disconnect. That's another ball-of-wax that's unclear to me. i.e. where's the THS being trimmed to when the datum indicated airspeed is artificially low - and how much deflected elevator can the autopilot's baro-hold handle? -  in order to maintain the dialled in flight level (before disconnecting)?

The development of a Loss of Control scenario at night in weather with an autopilot disconnect and perplexing/conflicting instrument indications? .... how far is that from an incipient UNRECOVERABLE attitude? The answer is not very far at all. It's measurable in mere seconds, particularly if Mach Crit and/or stall speed intervene to further confuse the issue..... or if the pilot's reaction and initial control response is incorrect (as in: rolling the wrong way).

And that's where the power of surprise and the differing impressions/reactions and actions/disagreement of those seated at the controls comes into play. Once the nose drops, speed increases and the g comes on, the two junior pilots would be quite out of their element and the disorienting dynamics that ensued...totally beyond their experience..... particularly if yaw and or high AoA was to then induce some engine asymmetry to compound the problem. Attitude flying just isn't available "out the window" when in cloud at night, so it's the first priority to "go out the window" (i.e. priority one.... "fly the jet" is fatally disregarded because of the system alert distractions). INITIALLY, following autopilot disconnect, even though the pilot immediately implements manual side-stick control, the ATTITUDE CHANGE CAN BE QUITE INSIDIOUS as the pilots try to concentrate on making sense of the conflicting array of aural and visual alerts and aural alarms that they are suddenly presented with. Low perceptibility roll-rate thresholds are a major cause of loss of control at night.

We could extrapolate further here and comment upon some other imponderables (that are never covered in flight simulator sessions):

a. Cruising in Ci/CS cloud, as the airspeed probes became gradually clogged with ice crystals, overcoming the pitot-heating capability, would the system have opposed that apparent airspeed loss by auto-thrust increments - resulting in the aircraft flying faster than what was displayed? i.e. dangerously accelerating towards a coffin corner encounter with its control compromising compressibility effects?

b. Would the engines, operating at higher thrust at a high cruise altitude, become more vulnerable to compressor stalling (N over root t exceedance) during any yaw asymmetry or high AoA (i.e. whatever happened after autopilot kick-out).

c. Because the three probes were the BA variety and equally affected, there'd be no initial prospect of there being sufficient disagreement between systems to trigger any alert. So much for triple redundancy eh? However, ultimately the trending discrepancy between thrust and airspeed and trim would have triggered a tripping threshold and the autopilot would have clicked out (see d. below). That would possibly have been the FIRST indication to the pilots (otherwise concentrating upon the weather radar display) that they'd suddenly had some type of system malfunction. Just "what" wouldn't be clear and would never be sorted by them, as the situation rapidly deteriorated. At this point the ACARS would've robotically started spewing its ether data, but not in any coherent manner or useful order. There'd be no time for a distress call under this scenario....

d. At this juncture, insufficient attention to airspeed and attitude is a crucial factor in what happens next. The airspeed may have appeared "normal" (or slightly low) but may have actually been 30 or 40 knots faster. Why "slightly low" all of a sudden? At a certain point. when the pitot heat has been overwhelmed by ice crystal accumulation, the rate of clogging increases exponentially. It's the same physical process that allows large hailstones to form. As it falls, the hailstone increases its surface area which permits it to coalesce with even greater amounts of freezing water and thus exponentially increase its size and mass during descent. In other words, all of a sudden the pitot tubes become almost totally clogged and that's likely what took the FMGS parameters into imbalance or quite out of tolerance, precipitating the autopilot trip-out. What's the pilot likely to do at this point. noting the airspeed to be "low"? He increases power (engine compressor stall likelihood increases) and lowers the nose to pick up a safer speed. But if he's already close to Mach Crit, that might be all it takes to put him into that dreaded speed regime.

e. Dreaded? My only experience with it was during a descent from 43,000feet in a trainer. I thought that I'd half-roll and pull-through to get down quickly and back into some circuit practise. "Alt & Comp" flown dual had been quite boring, except for the max rate descent. However in a jet that pitched UP upon encountering compressibility (or Mach Crit), hitting that airframe pecadillo whilst inverted made for a quite eventful ride. Inverted, it kept pitching up (which was actually now DOWN into an inverted lower nose attitude) for the next 25,000 feet of height loss. Quite disconcerting when you're a bit bereft about what to do next and simultaneously encounter roll reversal. Luckily you run out of Mach eventually at the lower levels. But if the AF A330 had encountered Mach Crit, penetrating it deeply with a high power set, how would the pilots have coped with the ensuing pitch-up? (assuming that jet pitches up and not down). And what was the longitudinal pitch-trim state anyway - once the autopilot had disconnected?

f. How does the A330's system design compensate in longitudinal pitch trim in such a spurious airspeed circumstance? Whilst on autopilot, does the THS (hoz stabilizers) move and the elevators oppose and hold the (nose up or down?) resultant trim forces? Would the aircraft have been in trim when the autopilot self-disconnected? Or would it have been trimmed for a much slower speed and therefore pitched UP/down upon disconnect? I don't know, I'm just posing the question. In the unfathomable world of malfunctioning flight-control automation, nothing would surprise me. But I wouldn't be the first pilot to disconnect an autopilot and be stunned by what forces it had been holding due to an unalerted system trip (Varicam C/B).

g. So assuming the above scenario has more or less "nailed it" as far as pitot-related developments go, what may have happened next? As said (or inferred) at the outset (above) once you lose it in roll and bury the nose and start pulling g, you end up in a self-sustaining spiral that can be destructive. Clean jets accelerate so fast once the nose is below the horizon. However, given the concentration of the sea-floor debris and the damage analysis of the impact attitude, I'm persuaded that a pitch-up/stall/spin entry and high-rate descent would've been the AF447 follow-through to its high level LOC. As the nose pitched up, if one engine had stalled or flamed out (and especially if the other thrust lever was not immediately idled) a spin entry would've been de rigeur (as the French say). Recoverable? Not really. Think of the vertical spin axis and the resulting centrifugal forces in the cockpit. Even if they hadn't been totally disoriented, there'd have been precious little by way of experience or instrumentation upon which to determine, select and hold the control inputs required for possible recovery. Large B/A ratios in a multi-engine high aspect ratio spin require spin recovery control positions to be set and held for quite a period in order for the yaw/pitch/roll coupling to be effectively countered. We're talking in excess of a minute here. They'd not have been "a propos" that specialist technique.

The lesson for manufacturers and operators [and pilots in particular] is that once a system defect becomes apparent across a certain model (A340/A330 in this case), investigate and extrapolate it into worst-case scenarios and then take the pessimist's course of action. Take the ample precedents as a fortuitous "heads up" threat to safety and just fix it; don't sit on your hands and budget for future modification action or interim alert crews with underwhelming safety bulletins. The Silent Voices from the Tombs always mouth the same words: "Lip-service".

Would I blame the pilots or the weather? Not really, they were set up - as were all A340/A330 crews and pax. AF447 was just the unfortunate first crew to thread the needle.

"The stall warning sounded twice in a row. The recorded parameters show a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS)."
This is what I'd expected and earlier predicted here in this thread as being the "onset" (an eventual total pitot clog - see explanation at post 335 (page 17) on this thread ). The DFDR was of course recording exactly what the pilots were seeing but meanwhile the aircraft's autothrust had actually been increasing power to maintain that programmed speed (and as a result of the gradual ice-crystal pitot blockage, actually exceeding that programmed speed by a considerable margin, whilst headed towards Mach Crit). But what triggered the autopilot disconnect? Was it a Mach Crit encounter or was it that the autopilot couldn't hold the increasing elevator force gradient of a system-driven mis-set THS (hoz stabilizer)? Or was it the sudden total clog of the pitots (see hail formation "exponential" analogy at my previous post).

"At 2 h 10 min 51s, the stall warning was triggered again. The thrust levers were positioned in the TO/GA detent and the PF maintained nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) passed from 3 to 13 degrees nose-up in about 1 minute and remained in the latter position until the end of the flight." Over time, as they cruised in the ice crystals of Cirrus cloud (a known "pitot heat capacity" anomaly for that mark of pitot tube), the gradually clogging pitot system resulted in the autothrust incrementally applying power to stop the "apparent" speed decay. Similarly, the auto-trim maintained the nose-up trim for that programmed speed - and the autopilot offset the elevator (via "fwd stick") to hold height - as the aircraft was actually flying faster than shown. When it reached its design pitch-holding limit (i.e. the max nose-down force gradient it could hold), the autopilot gave up, and the handling pilot now had an instant unalerted surprise handful of an aircraft in Direct Law with nearly full nose-up trim and near to full power. So did the DFDR faithfully record this or did the BEA just construe (and misrepresent) it as the pilot's aft sidestick input? i.e. in the absence of any better/more logical explanation?

When it comes to high speed protection, should this crew have received wrong airspeed info indicating a high speed situation, you have protection where, once Mmo + few kts has been exceeded, you will get an auto pitch-up to try and maintain Mmo + few knots, so should this happen at slow actual airspeed, it will not be too hard to see why the pilot may have continued to pull back and continue increasing the acft's pitch angle. But my theory was that they were actually at an initially higher speed than indicated. Here (most importantly) we have to consider that after their involuntary zoom climb (due trim), the static pressure changes would thereafter have had a considerable additive (and further confusing) effect upon the blocked pitot systems and the displayed airspeed/mach. i.e. ( "The speed displayed on the left side increased sharply to 215 kt (Mach 0.68). The airplane was then at an altitude of about 37,500 ft and the recorded angle of attack was around 4 degrees.")

"the angle of attack exceeded 40 degrees" later saith the report. You have to close your eyes to this, because it's not anything those AF447 pilots would have known (i.e. no AoA display for them).

"By the time it reached the apex of the ensuing pitch-up and subsequent " bunt" (around 38,000ft), the aircraft was ACTUALLY entering into a deep stall with a forward speed of around 60kts and a high angle of attack...ultimately resulting in the 10,000ft +/minute Rate of descent at high AoA. But they'd initially responded correctly to the stall warning with TOGA power? - however that response was soon to change. Why? In Direct law, which they should now have been in, holding the stick back will maintain that stall. But why would the pilot do that back-stick thing? Perhaps they were attempting to attain level flight - and unaware that they were in Direct Law? But was there another reason and why did they then idle the TOGA thrust? Who knows for sure? But here's a clue. In the subsequent descent with static pressure increasing and the pitots still blocked?, even though the airplane was actually stalled (complete with stick-shaker) the indicated airspeed would be increasing alarmingly - courtesy of increasing static pressure. That's my guess - and it's anyways a physical fact, Been there and done that trick with frozen trapped water in the static lines (i.e. the opposite effect of trapped dynamic pitot pressure). There's also a report on the Irish Accident Board's site about a 747 on a test flight with uncapped static lines due maint error. It's an elucidating gaelic tale that shows just how confusing the pitot-static scenario can be. See below for how much a 1000feet of altitude change is worth in terms of additional "displayed knots". Ask any instrument technician. That's what I did. He'll demo it for you on his test-bench.

As somebody said: "All this will probably come down to crew composition, very high workload, in adverse weather conditions, having to manually hand-fly an aircraft which suddenly found itself in alternate law at high altitude due to spurious information being fed to not only the flight display computers, but also the flight control protection and guidance computers, simultaneously." Suddenly? Don't underestimate the power of surprise. Spurious info? Maybe, but when it's what you are taught to believe (your instruments), that's what you react and respond to. You see a high and increasing airspeed and you apply backstick to attempt to control it - and you idle the throttles..... but instead you are (unbeknownst to you) embedding yourself in a deep-stall condition. Will the stall warning cease once embedded in deep-stall at 40 degs AoA?. That's my guess. That they were non-plussed by developments is obvious from the limited dialogue. Even the captain was struck dumb by what he saw. No solution was obvious in the time available - as the airspeed was seen to be much more than just "adequate" (i.e. even high - and even higher as the static pressure increased inexorably upon descent) i.e. so how could they be stalled? Unthinkable - so it wasn't even considered. It was perhaps a meteorological phenomena?). They just ran fresh out of ideas. Freeze-framed twilight zone? Been there and done that too.

Someone also said (and theShadow said earlier in his 20 May post - and last year): "You are not only dealing with conflicting airspeed info, you are also presented with multiple spurious ECAM warnings and cautions which it is sometimes hard to ignore, also depending on the alternate law protection loss which itself can be further divided in two categories, or even direct law which would mean direct side-stick to flight control input without any load protection - leading to control overload." Isn't automation wonderful?

A pitot-static system's pneumatic airspeed data (the usable output product) relies wholly upon very accurate dynamic pressure and static (i.e. ambient atmospheric) pressure inputs - and the latter changes rapidly during a descent at 10,000fpm. No digitized sourcing of that info, it's all air pressure analogue. Falsify either one (via blockage or leak) and zoom or descend and the story will be ever more confusing. Birgenair and Air Peru 757's found that to be the case. For example, with a snap-frozen static pressure (at FZLVL) the airspeed indication will wind back from 250 knots to zero over as little as 3400 feet of climb at 250kts IAS. I think that the BEA is still trying to wrap their minds around that obscure fact here (Gallic and not Gaelic closed minds). They are also (possibly) assuming that the zoom was a result of pilot input and not an aerodynamic pitch-up..... i.e. as a result of (possibly) hitting Mach Crit with an A/P disconnect and a very nose-down trimmed horizontal stabilizer (@3 degs nose-up but increasing to 13 degs nose-up due to pilot's aft sidestick inputs after top of zoom climb). But do I actually think they hit Mach Crit? No, more likely it was the excessive elevator force gradient that kicked out the autopilot and kick-started the fatal zoom sequence..

Someone also said: "Direct law is there to give the pilot more direct control of the aircraft but it still has some protection to offer - BUT at the same time the protection on offer is only as good and accurate as the information provided to the computers involved. Much more info is needed before one can create a valid picture of what went wrong when it comes to the decisions the pilots made in the last few minutes of the flight." However the change in static pressure resulting from the zoom into ever more rarified air and the instinctive attempt to maintain level flight and use backstick to reduce the ever higher displayed airspeed indicated during the ensuing descent (subsequent to the zoom climb) are key factors dictating an inevitable entry into the unrecognized deep-stall condition. Additive to this was the dearth of info that they had to work with and little prior exposure to degraded flight control laws. And all this in night and in cloud.....

Confirmatory (for me anyway):
Did the pilot zoom climb the acft or was it caused by the automated mis-trimming in pitch? Perhaps this next statement in the report is a clue: [I]"The airplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb. The PF made nose-down control inputs and alternately left and right roll inputs."[/I] Perhaps the left and right roll inputs were his insufficient attempts to get the nose to drop (airline pilots rarely use more than 30 degs angle of bank due to the pax sensitivities - and in an Airbus? Perish both the thought and possibility....). When you've got a stuck elevator, or an aircraft pitching up of its own volition due to a runaway elevator pitch-trim, that's the way to go (i.e. roll the beast onto its wingtip to get the nose to drop - and drop flap). Pity they didn't think of that during the Jan 2003 Beech 1900 stuck elevator take-off accident at Charlotte NC.(52 degs nose-up at 1200feet agl).

So having read all the above, please feel free to shoot it all down. But ultimately, whether it's right or it's wrong, you have to ask yourself: "Is the training to combat automation anomalies and its inherent malfunction complexities adequate?" As someone else said: "In alternate law - is the amount of warning signals inhibited to the bare minimum necessary to keep the tube flying? i.e. you don't need a warning that the lights in the aft toilets aren't working - while busy with a stalling conundrum...?" Note how quickly the situation described above can become completely and incomprehensibly unglued. The debate yet to come is going to be ponderous and inherently evasive. The AF447 crew were caught out by a little known pneumatics phenomenon and reacting understandably to what they saw. They died clueless as to their actual predicament but I cannot bring myself to blame them. As they said: "We have no valid indications". They were right. Man can easily be defeated by automation. It's a burgeoning and futuristic problem. I can't shame them for being cheated of life by a system that's too conscious of cost and inconsiderate of consequence. The engineers and designers? Well they live in Never Never Land. If only the twain should meet....

On another subject, my post SR-111 invention in 1998 of satellite-uplinked recorder data is back in the limelight and I hope, with a vengeance. Wish it wasn't. But if you want to familiarize, just Google Iridian/Roadshow. Like all similar solutions to the long-winded AF447 saga, it's not as if somebody somewhere wasn't prescient. If we could just stop those holes in the Swiss cheese from aligning...... or more easily and quickly determine why they did.
____________________________________________________________ ___
Edited to add an afterthought:
a. I've heard two different qualified opinions as to whether the acft would have ended up in Alternate Law or ultimately transitioned to Direct Law. ???

b. "Just 20s after the captain returned to the cockpit, said the BEA, the thrust levers were set to the 'idle' position, with the engines delivering 55% of N1." i.e. Did the captain, upon entering the flight-deck, see the high (but fraudulent) IAS on descent and order the throttles to idle, understandably assuming a LOC existed and everything/anything BUT a stalled condition. You tend to take in and believe what you see on a first scan..... when the matter is urgent.

As some technical "niceties" about the auto-trim system starts to emerge, it's beginning to sound as if the vagaries of the auto-trim system in respect of Airbus Law Change philosophy were instrumental in the inability of the AF447 crew to recover from the type of stall that they'd entered. i.e. they may have been victims of the circumstances of their stall entry scenario. To explain:

a. During the zoom climb to FL380 (in Alternate Law) the auto-trim transitioned from 3 deg N/up to 13 degs n/up (near to, if not max nose-up THS trim for the type).

b. Upon entering the stall ballistically and starting its "deep"-stalled descent, the aircraft would have been (and remained) in Abnormal Law, with the auto-trim inop and the trimmable horizontal stabilizer (THS) therefore locked at 13 degs nose-up..... unless it was to be manually changed by the pilot (and we now know that it was not).

c. The engines were at TOGA at this stage, so we have the pitch-up effect of TOGA power plus the THS "stuck" (i.e. de-automated) at 13 degs nose up.... both tending to pitch-up and support a stall continuance..... no matter what the pilots did (unless they were to change the acft configuration somehow - aerodynamically or CofG wise).

d. Airline pilot exposure to stalling tends to concentrate upon the approach to the stall and recovery (i.e. avoidance) with minimum altitude loss. In that stock standard scenario, one of the primary and persistent preliminaries in the incipient stall experience is the airframe buffeting and stick-shaker progression. This is de rigeur in a standardised level 1kt/sec deceleration towards a level 1g stall and is the cue for the trainee to take recovery action. However, if one enters a stall ballistically at high altitude, will there be any buffeting? The AoA system will issue a stall warning but is this against a distracting background medley of other aural alarms? Stall recognition and realisation then becomes an obscurity of the first order.

So the question now becomes: "What would be required to un-stall this aircraft (now in Abnormal Law) if there is insufficient elevator authority at 13 degs nose-up THS to get the nose down (and thus air over and across the wings and tail), during a stall locked in at 40 degs AoA (as predicated by their entry config)?" One answer might be: "Idle the power" (and this was done soon after the captain re-entered the flight-deck, possibly because he'd just misinterpreted their predicament as a L.o.C., based upon a quick scan). Another might be: "Manually run the trim" (i.e. not something that comes naturally to an Airbus pilot - particularly not if he's unclued and quite unaware that the 13 deg nose-up THS is now his basic problem). A pilot's normal cueing to adjust trim is that the airplane is "out-of-trim" and tending to deviate from a chosen flight-path i.e. not a player in this deep-stall scenario.

Three questions: 1. "Will the pilot be aware that he's in abnormal Law? (and the portents of that)" The answer might well be: "Probably not" (there's nothing to promote awareness of this being the case i.e. no aural annunciation - and thus we arrive at: what now needs to be done that's essential for recovery?)
2. "Does the elevator alone have sufficient authority to unstall the wings at max power or at idle?" The answer is probably not, at least not while the superior trim authority of the THS at 13 degs n/up holds sway.... and particularly not whilst at TOGA power.
3. "Why doesn't the elevator have sufficient authority to unstall?" The whole design premise of the THS is to reduce trim drag and allow the elevator to become more of an active trim and less of a primary flight control. This ideation works well 99.99% of the time and it's used in all models of airliners to some degree. They need the capability of coping with large CofG ranges to accommodate loading, fuel burn-off and configuration changes. Some aircraft augment this capability with tail-located fuel trim-tanks. However this minimalistic elevator design feature in the A330 apparently won't "work" in the progression of events that AF447 underwent.

So are Airbus elevator throws and areas (i.e. authority) an under-design or does the THS have undue authority? That becomes the question here as we switch our attention to not blaming the pilots but agonizing over possible Airbus design deficiencies. But before we look into that, we need to pose the question: "Were the AF447 pilots aware that they were locked in an aerodynamic stall?" I'd suggest that they were NOT..... mainly because of the circumstances of their entry being wholly unfamiliar..... and that medley of aural alarms mentioned earlier that had overloaded their capacity to assimilate transient info. It's called cognitive disequilibrium, an idiosyncratic need to ignore or de-prioritize - a close relative of cognitive dissonance (a tendency to rigorously deny or disbelieve), two behavioral paradigms to which professional pilots are prone. One final thought, centering upon human factors. When the captain entered the cockpit and tried to take it all in at a glance one of the things he would've missed, because of its positioning, is what the pilot's input was on his sidestick. With a yoke (thinking of Egyptair MS990 here) it's visually apparent that what's afoot is directly related to pilot action. Food for thought.

Are there any precedents in the Airbus incident and accident annals? There's the Air New Zealand A320 test-flight crash and the Tarom Airbus near accident on ILS finals at CDG..... that spring to mind.

It's worth citing an extract from the Tarom incident: "Under the aerodynamic effect of this THS deflection (of 13 degs) and under the mechanical effect of thrust, the aircraft was thus subjected to a nose-up force that could not be controlled by elevators. It rapidly assumed an extreme pitch attitude and angle of attack.

There may be others. The 1994 crash on go-round of a (non-FBW) A300 at Nagoya? (link). Para 4.2.b of this link lists 6 Airbus incidents and one B747 involving pitch-trim anomalies. An extract from that Nagoya narrative might help emphasize the sometimes inordinate power of a THS in some circumstances: After the PF inadvertently pressed TOGA on finals,

"The autopilot automatically went into GA mode, and this would have shown on the primary flight display (a very vague alert really). The aircraft was flying 18 degrees nose-up, normal for a go-around, but the FO was pushing heavily on the yoke to get the nose down. He was meeting heavy resistance, a design indication on almost all airplanes that that his manual commands were in conflict with the autopilot. For nearly 20 seconds, as he applied down-elevator, the autopilot moved the trimmable horizontal stabilizer (THS) in the opposite direction to keep the nose up. At T+30, THS reached maximum nose-up; at T+42, the autopilots were disengaged. Pilot C asked for autothrottles engaged and took control, increasing down elevator to full deflection as the aircraft began climbing. Alpha-floor (an Airbus automatic protection mode) triggered at T+50 from excessive AOA. Alpha-floor triggered maximum thrust for climb-out, but that added thrust in fact increased the nose-up attitude to 52.6 degrees (one may surmise that the thrust centerline is below the rotational center of the airplane, and at low speed there is not much aerodynamic force to maintain resistance to this rotation). (52.6 degrees is very steep. A high-friction granite rock face of this angle would nevertheless be considered a technical rock climb.) C disengaged alpha-floor by retarding thrust and tried to get the nose down again with trim. Airspeed had dropped to 78 kt., the aircraft stalled at 1,800 ft, and control was not regained before it hit the ground."

If the BEA Inquiry into AF447 heads down this well-trammeled path towards THS excess authority and control law anomalies in stalls, Airbus is going to have to do the old quickstep that they've always done so well - in order to avoid changing physical design. No doubt it will take the form of a circuitous software patch to the control laws and/or yet another aural alarm and cautionary bulletin.
Edited to add:
However, despite all of the above, there is no denying that “no clear-cut stall recognition and persistent warning” is the apparent deficiency that put AF447 into the Atlantic. Recognizing that the overwhelmed pilot can become clueless in a time of great stress, perhaps aural alarms should become aural admonitions: as in “Stall Warning. Reduce angle-of-attack and trim nose-down for recovery”

I sorta took exception to the presumptive tone of the article and some private correspondence between journos in the same ilk....that I was copied in on. I decided to re-orient them (late at night after a half-bottle of brandy) - so it may not be comprehensive. If you know of any points that were missed, pls post. Apologies for length but need to be comprehensive. I'm sick of defenceless dead pilots having to carry the can.
Gentlemen
*
You oversimplify their predicament. You (and so do we all) need more data. However it's also obvious that useful data was exactly what the AF447 pilots lacked during their deep-stall descent - because of the peculiar aspects of the pitot freeze-up during high altitude cruise..... and its effect upon the subsequent post-zoom stall.
*
One of the characteristics of an approaching or incipient stall that pilots are trained to respond and react to is "low and decreasing" airspeed (even if they have no stall warning hooter or "cricket"). However they wouldn't have had any airspeed indication during their deep-stall descent with an iced pitot x 3. Nor did they have an angle-of-attack indication..... i.e. even though the A330 is equipped with an AoA vane to feed the automation (including the stall warning system), the pilots don't warrant a gauge of any sort. So what did they have for identification of (and recovery from) a stall? The real answer is precious little - by way of overt display or training fallback.
*
They had a source of pitch attitude. However consider that most approaches to the training one-g stall is made in level flight at a speed reduction rate of circa one knot per second. Thus, at the point of the incipient stall, where pilots are taught to initiate recovery (i.e. at the stall buffet), the additional cue on an ADI or visual horizon*is a high nose attitude (typically around +15 degrees).*But in a deep stall entered ballistically at high altitude post-zoom, the attitude in pitch during descent with max power (due pitch-up effect of underslung engines) would approximate the straight and level attitude of around 3 to 5 degrees nose-up. Thus they were robbed of most all cues that could clue them that they were in fact in a stall. They wouldn't have been aware that their auto-trimmed horizontal stabilizer trim was NOW unavailable - and stuck at its maximum of 13 degrees nose-up. If nothing else, it was that THS (trimmable hoz stabilizer) that would've held them in a stalled pitch attitude..... regardless of any subsequent side-stick pitch inputs. The THS has the REAL pitch-trim authority at low speed, the elevators are virtually trim-tabs for higher speed refinements.
*
But wouldn't the stall warning be blaring you say? Not necessarily so. It's designed to be discontinuous (a rare concession to the cacophony effect of blaring aural alerts in an emergency). In the factually sparse BEA report, that aspect isn't addressed in depth. The only trigger for the aural stall warning is the AoA and that has a set threshold both to start and to cease. Once they were at around 40 degrees AoA I'd be surprised if it was to be heard on the CVR (see later shock statement of cause of non-recovery below). What about the stick-shaker? It too has cautionary thresholds and they were soon well beneath that triggering band. The A330 wasn't tested for its high altitude ballistic stall entry characteristics - so the instrumentation wasn't available or calibrated to cope. What about the VSI or IVSI/RCDI (rate of descent indicator). It's not very attention-getting and it's probably linear (i.e.in a non-circular) presentation anyway in the A330 (I prefer the round dials for visual attention-getting). It's hard to say what it would have read in a compromised pitot-static system anyway. You must also consider what effect upon the airspeed indicators a 10,000 fpm rate of descent would have on their airspeed read-outs (think rate-of-change of static pressure). The ASI's are reliant upon both a pitot and a static pressure input feed.
*
*Would there have been any tell-tale buffeting? In a word "NO". The buffet in a one-g stall is provided courtesy of the disturbed airflow over the wing hitting the tailplane. At the BEA's stated 40 degrees angle-of-attack, the disturbed airflow would not impinge upon the tailplane. They were going down in an express elevator at around that self-same 40 degrees angle (that they were presenting to the relative airflow). I was surprised to find myself agreeing with one animated depiction on TV of the stalled steep descent event. That's how it would've been in my view - and thus the airflow and airframe buffet wouldn't have been a player in alerting the pilots to their stalled status. It was probably/relatively much quieter than the ambient noise in cruise, even with the engines at TO/GA. By design, in alternate, direct or ABNORMAL Law there is no auto-trim (it discontinued after reaching 13 degs nose-up), no ALPHA FLOOR PROT or ALPHA max (i.e. no max selectable AoA), so the aircraft can be stalled once in extremis - an aspect and consideration that's alien to Airbus pilots. AF447's stall occurred beyond the imagination (also) of the A330 designers or test pilots, at the ballistic apex of a zoom climb with lotsa power set - and at or above its ceiling for its weight.
*
But there were also other complications which I'll briefly mention:
*
a. What actually happened to initiate the sequence of failure advisories and the ACARS spew? Did the auto-pilot self-disconnect after running out of its ability to hold the nose-down force gradient of a horizontal stabilizer being trimmed by the system to compensate for the aircraft being driven ever faster in real speed terms (i.e. accelerated by the auto-thrust, to offset the perceived gradual loss of airspeed from the slowly icing pitots?). If so, then when the autopilot disconnected, the pitch-up would have been involuntary. Any evidence for that? The BEA says "the airplane's pitch attitude increased progressively and the plane started to climb. The PF made nose-down control inputs and alternately, left and right roll inputs." Reflect upon the fact that the one thing the pilot has left once he's apparently lost elevator authority in a pitch-up, is to roll the airplane in order to induce a nose-drop. It's evident IMHO that the post-disconnect pitch-up was therefore involuntary and opposed by the PF. Entry to the post-zoom stall is likely to have been automated.
*
b. A few seconds after the aircraft levelled at 37,500ft at a 4 deg AoA the BEA says: "the stall warning triggered again. The thrust levers were positioned at TO/GA and the pilot maintained nose-up inputs." No real surprise there. They'd zoomed to above their ceiling and the pilot was stick-back to oppose the tendency of the nose to drop at the unknown (to him) low speed. Unfortunately, as a result, the THS continued to trim to max nose-up and the distracted pilots then allowed the aircraft to stall. There's an indication that the lower speeds may have allowed the pitot heat to clear some of the pitot ice....i.e. the ISIS speeds becoming consonant with the recorded PF speed. Report: "As the captain re-entered the cockpit the recorded speeds became invalid and the stall warning stopped" At this point these are evident indications of now having entered into the very low IAS/high AoA deep-stall condition. Distractions of trouble-shooting are the likely cause of the PF allowing the 13 degs nose-up THS (of which he was unaware) to silently promote a stall.
*
c. If the autopilot had disconnected because of ADR disagree parameters being exceeded, then the zoom may have resulted from a post-disconnect overspeed warning and a natural pilot pitch-up response. Whatever the cause of that pitch-up, the auto-trim would've been available and so it was (BEA) - and so it did auto-trim the THS into a fateful 13 degs nose-up (whence it remained).
*
d. How did the captain's arrival upon the flight-deck affect the outcome? Firstly, in a quick urgent scan he'd not have seen the PF pilot's grip upon his sidestick (think about it and compare with what the MS990 Captain saw upon re-entering his Egyptair cockpit). He would've seen no (or low?) IAS displayed and the altimeter unwinding - yet loads of power. 20 seconds after he entered the flightdeck the throttles were placed at idle. At his command? Probably. Did he misinterpret the situation as the aftermath of a high-speed loss of control and thus did he complicate the recovery issue? Probably. Are Airbus pilots generally unfamiliar with the possibility of entering a deep-stall condition at altitude? Probably. Is it never sim practised or preached or does it not rate a mention in the Pilot's Handling Notes? Probably not.
*
e. The BEA mentions that, at A/P disconnect, a sharp fall from about 275 kts to 60kts in the left primary PFD was recorded, then a few moments later on the ISIS STBY insts. Using the analogy of how hail size-growth increases exponentially in the latter part of its fall (due to an ever increasing surface area upon which moisture can coalesce), we can divine that a similar thing was happening to each of the three pitots. Thus, as soon as the pilot made his sharp nose-up side-stick input, the smooth laminar flow into the LH pitot inlet (the only one recorded) would've been disrupted by the pitot's projecting icy excrescences.... causing the 275/60 transitory hiccup. I'd further interpret this as being partial proof that the auto-pilot disconnected primarily because of the elevator (nose-) download it was carrying due to the discrepancy between the aircraft's actual speed and the system speed (for which it was being THS-trimmed). i.e. It was unlikely that they actually hit Mach Crit and pitched up because of Mach Tuck. Thus the pitch-up may have been trim-induced and not pilot-initiated. Who's to know at this stage? But what happened next (the ballistic stall entry with 13 degrees nose-up THS) surely sealed their fate. The PF was never aware of that 13 degs nose-up THS (or he may have manually trimmed it out - yet another*completely*unnatural input action for a FBW Airbus pilot).
*
f. Ultimately, what killed their chances of recovery? It's very ironic that it was likely one of the systems meant to have saved them.
i.e. The BEA Report says: "At 2 h 12 min 02, the PF said "I don’t have any more indications", and the PNF said "we have no valid indications". At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning sounded again."

At the sound of the stall warning, the pilot was likely deterred from any further initiatives (even though he was on the right track with his pitch-down inputs) - and he promptly then handed over the controls to his more senior PNF. A stall warning that sounds off as you exit a deep-stall condition? Not a great idea at all....... it is likely to have the opposite of the desired effect. The overwrought pilot might easily assume that his action is initiating a stall. A Doppler-based stall warning whose pitch and volume varies (dependent upon how embedded in the stall you are) would be a much safer (and saner) proposition.

It gets back to that old saw: "For the want of a nail...." Unfortunately for AF447 it was more than just a nail. It was a whole row of rivets that allowed the operation to become unglued.

So if you place a pilot in harm's way beyond his training and experience, fail a vital sub-system that then causes a failure cascade, can you really blame him for the outcome? Perhaps you should be blaming a system that's too lazy or incompetent to extrapolate failure modes into real world scenarios and identify real threats. The hazard was all too evident from all the prior Air France, Air Caribbes, NWA and other incidents (including QANTAS). Nobody acted with sufficient urgency to address the hazards. Hubris? In large measure I'd say.
*
PS Also see the attached file - revelations from a*DER Spiegel article