I've followed the discussion of the AF447 investigation on several flight discussion forums.
The PF (Bonin) apparently never became aware of his angle of attack (once the airplane fully stalled, AOA was absurdly high). He did not seem to be aware that his constant inputs had caused the Airbus's THS (trimmable horizontal stabilizer, horizontal flaps on the tail) to deflect to maximum in order to try to keep the nose up. Therefore when he tried to input stick up (nose down) several times briefly, and there was no obvious response (the computer takes a while to reduce THS elevation in response to opposing input), who knows what he thought -- maybe that all readings were incorrect.
Strangely, Bonin was the one pilot who had significant recent glider experience as I recall. The Airbus computer even in "alternate law" functions nothing like a glider (only "direct law" is sort of close to direct input), so maybe that further confused him.
In my opinion, at night, over an ocean, in a storm, with no visibility, in possibly significant turbulance, a modern aircraft cutting off Autopilot for any reason other than computer failure is completely unacceptable. A computer should be able to fly as well as a human under those circumstances.
People suggesting that on airliner forums get flamed. But it's true. Most pilots kept up the refrain that a computer cannot safely fly by gps and gyros unless they also have airspeed. Which is true. It's dangerous to fly if you don't have true airspeed (gyros and gps cannot accurate provide relative wind speed). However, if pitot tubes are frozen and the computer no longer has valid airspeed, the pilots no longer have valid airspeed either. Pitch and power is all they can do. The computer can do that just as well. All it needs to know is aircraft weight, which can be entered (maybe it is entered) before takeoff and automatically adjusted to account for fuel consumption.
There are a bunch of factors that contributed to the accident:
Pitots shouldn't have frozen.
Lack of Air France training for controlling an aircraft at altitude with the computer in "alternate law" (mode without full flight envelope protection; it's therefore possible to stall).
The command structure in the cockpit without the Captain (who had just gone on break) actually had Bonin in command, even though the co-pilot in the left seat outranked him... AF has since changed that. CRM (crew resource management) was poor; the co-pilot in the left seat didn't try to take control until way too late. The co-pilot was preoccupied with where the Captain was rather than offering constructive input on how to fly.
Bonin was not adequately aware of what his inputs were doing, or what the plane's Angle of Attack was, and did not react properly to the stall warning which in almost every case at high altitude means drop the nose, not raise it (though without valid airspeed there's a risk of overspeed which can cause a new set of problems).
The Airbus computers had some quirks; stall warnings stop if airspeed drops too low (due to some computer programming logic involving low airspeed, AOA sensors, and the result being silencing the stall warnings).
Nobody believed a passenger aircraft would be so stable during a full stall. This undoubtedly contributed to confusion about whether they were actually stalled. The Airbus's computer setting the trimmable horizontal stabilizer to max nose-up deflection, in response to Bonin's almost constant nose-up input, possibly contributed to the stability during stall.
Angle of Attack information may not have been adequately displayed to the PF (Bonin) -- the black box doesn't record data from the right set of instruments, so nobody knows what Bonin had on his screen.
There was poor notification on the co-pilot's side of what the PF (Bonin) was doing. Unlike traditional aircraft, it is not easy to see what the pilot in the other seat is doing with the stick.
There was poor notification on either side of the cockpit when the other pilot took control. When the co-pilot took control, Bonin almost immediately took control back, and it's not clear either of them knew what the other was trying to do. Apparently there's a light that indicates override, but who would notice such things under that amount of stress?
IOW, it was a disaster from top to bottom. Usually in aircraft accidents there's a chain of events, but in this case there were so many possible contributing causes that other than having better pitots that didn't freeze over, solving any one other problem may not have broken the chain.
IANA Pilot. I do make aerodynamically correct fixed-wing and lifting-body type paper airplanes, however, and I have had a LOT of fun playing with aerodynamics in this hobby.
One thing to keep in mind regaring stall is that it's 100% dependent on angle of attack, not speed (something Popular Mechanics gets entirely wrong). What happens basically is that at a high angle of attack the air layer doesn't track the wing surface properly and so you are deprived of standard lift. With certain aircraft designs (SR-71 for example) this is very hard to make happen (but the SR71 can stall it's engines before the wings stall due to AoA).
If you are faced with a stall, I would expect the first thing to do is to pitch down to reduce angle of attack then accellerate and pitch up to get out of it. T-tail designs are generally disfavored because the elevators can get blanked by the wings in a deep stall, but with the A330 this isn't an issue as it doesn't have this tail design.
I find it puzzling that a professional pilot would pitch up in response to a stall warning. Popular Mechanics is right to flag that is as difficult to understand.
A commenter below (cellularmitosis) makes a very interesting point: Bonin may not have realized he was in "alternate law" (let's call it "mode" instead of "law").
In "normal mode" the computer will not let pilots stall the plane, whatever they do; it will accept the commands up to what it considers dangerous. There's an "envelope" of acceptable plane movements; pilots can move inside this envelope but not outside of it.
In "alternate mode", the envelope is much wider and you can actually stall the plane.
If you're in normal mode, it makes sense to pull the stick all the way so that you're at the edge of the envelope: you climb as fast as you possibly can (as fast as the computer will let you).
And you can probably fool yourself when the stall alarm rings: the computer is telling me I'm near stalling -- I'm at the edge of the envelope, THIS IS WHAT I WANT!!
In fact you're not in normal mode anymore, and the computer is telling you that you're way past the envelope. But you can't register that, because for you that is simply impossible.
If that's what happened, the cause of the crash is insufficient training in alternate mode.
Bonin would have had to realize that the plane is in alternate mode in the first place in order to react correctly. It probably never crossed his mind since he never trained in it, and conversely if he had trained in it, he may have been more likely to at least check.
But to me the bigger problem seems to be that such an important change in the plane's behaviour could happen without anyone noticing. I'd consider the mode to be something the pilot must be made aware of, not something he has to deduce from the fact that the airspeed isn't available.
Perhaps the mode is shown prominently and the pilots just didn't notice it in their state of panic. Making it more prominent probably leads right into an insane arms race - the stall warning was as prominent as anything can be and still got ignored.
I don't envy the person who has to design a airliner cockpit's user interface and decide which of a hundred potentially vital pieces of information should be displayed how.
Bonin had to have known that the plane was in alternate law.
In the flight recorder log, at 2h10m05s, there was an audible "cavalry charge" alarm that indicated to everybody in the cockpit that the autopilot was disconnecting (plus message at the same time on the ECAM).
Then, on the ECAM message console 1 second later, the message "F/CTL ALTN LAW (PROT LOST)" was displayed: alternate law, protection lost. At the same time, Bonin said "I have the controls", which to me indicates that he knew that the autopilot was off and that alternate law was engaged.
A mode switch as important as this should be very visible. An idea: put a two-color led under every indicator light and switch to the other color when the plane falls into alternate law. This should make it sufficiently clear that something very notable has just happened.
Something like that was my initial thought. However, you have to remember that there is massive amount of very notable things going on and data shown. As brazzy pointed out, the stall warning was as prominent as possible and still was pretty much completely ignored. I don't think they would've noticed any amount of leds in that point.
When in normal law, if you pull the nose up all the way, and are at the edge of the envelope, will the computer even give you a stall warning? I would guess (hope!) not, since the plane is never actually in danger of stalling. Assuming that's the case, a stall warning from the computer should always be heeded.
If that's not the case, and the stall warning sounds even when there's no real danger of stalling (because the controls are operating in normal law), I feel like that's a terrible user interface.
I really don't like the idea in general that 'normal law' mode lets the pilots yank the controls any which way and the computer (supposedly) prevents the plane from leaving the safe flight envelope. I believe that sets up the wrong attitude in the pilot's mind about having to carefully and thoughtfully control the aircraft.
If the flight computer is having to intervene and change the flight controls, then at the very least there should be a force-feedback mechanism in the stick which tells the pilot he's doing something wrong, and that he really shouldn't be yanking back the stick that hard.
The other bad part of the user interface is that the two sets of flight controls are not linked, like they were in the old days. With side sticks, it is not easy to see what the other pilot is doing. And averaging the control inputs of the two pilots is INSANE, in my opinion. Only one pilot should be flying the plane, and it needs to be quite obvious who that is at all times.
The CRM mechanism to take over flight controls should not be saying the words "I have control", it should be flipping a big switch on the center console that visibly indicates who has control.
I like the idea of linked control, like on the small planes. That's "the principle of least surprise" and also gives the copilot the right information of what another guy is doing -- that was obviously missing here!
However if you add force feedback of the plane computer "correcting you" you'd never know if it's plane or an another guy. Therefore, force feedback from the computer doesn't sound to me as a good idea. Some kind of feedback would be a good thing, but in panic, it wouldn't be noticed. I guess I'd put something like something "protruding up" on the stick when in another mode -- you'd feel and see it.
Finally, switch flipping is unnecessary if you have a force feedback. It think that's really the major feature missing!
yeah, I agree with that. Also there's another factor in that stall warnings may have been seen as an ADIRU malfunction rather than an actual stall. In those cases, I suppose pulling back might make some sense if you think you have bad ADIRU input and the plane is in normal law.
I think the whole point is that in almost all circumstances an ADIRU failure will lead directly or indirectly to alternate law. Hence the correct procedure should be to assume alternate law and cross check.
Once your instruments start failing left, right, and centre you should go into what I call "advanced free fall" mode, check horizon (true, false or otherwise), check altitude, check parachute, repeat... If you hit gimbal lock (or similar INS failure) in the dark, well just bend over and kiss it goodbye.
From what I read from the preliminary report, it's established that the stall warning sounded. If it had not been audible on the CVR, they would probably have noted it.
One problem was that the stall warning stopped due to high angle of attack even though the plane was stalled, and it started again when the nose was lowered and the AOA was in the "valid" region again. This might have confused the pilots in a situation when they already had inconsistent airspeeds etc. to deal with.
Ah, yes, I read that too. It was so frustrating that the pilot kept pulling up all the time, it makes no sense. You'd think that at some point he'd stop and reassess, but I guess he was too confused and shocked to do it...
On the other hand, it's not obvious to me that the simulator would behave correctly in this regime either. Having the simulator work correctly in a deep stall is probably not high on their list of priorities. It's possible that this was even the first time ever that an Airbus had been stalled like that, so maybe no one actually knew how it would behave.
Yes, that's possible. I remember reading an article by the author of X-Plane about how stalls are mostly simulated by trying it in the real aircraft and programming something similar, because the airflow dynamics are too difficult to model in real time. (Incidentally, the Cessna 172 is nearly impossible to stall in X-Plane, but somewhat easier to stall in FlightGear. I wonder who's closer :)
By easier, do you mean that you have to exert more back pressure to have it stall, or that it quickly gets out of the stall? I think it can vary a bit depending on weight and the exact model you're flying. In some models it's difficult to maintain the stall because the nose will just drop.
You should get an introductory flight lesson, then you could ask do have a stall demonstrated and see which flight simulator matches best. There are a lot of signs you don't get outside a full motion simulator, such as wing buffeting and "mushy" controls.
Yup, intentional stalls give plenty of warning in a trainer.
It's the stalls caused by uncoordinated flight during a steep bank or snap spins caused by exceeding critical angle of attack, regardless of speed, that will kill you. The first is easy to get into in a trainer like a C172. The second won't happen (safely) unless you're in something with a bit less lift and more power, like a Pitts.
I've been meaning to start taking lessons so I can get a private pilot's license, but it's hard when you live in downtown Chicago without a car. There are a couple schools at MDW, but you'll eventually have to drive to the suburbs as MDW does not let students fly solo out of the airport. Probably for good reason :)
> Of course, very little airliner training happens outside a simulator, which can you can stall without damaging anything.
Maybe they should apply mild taser shocks to pilots stalling in the simulator. I'm not being snarky. There should be some kind of physical consequence of making bad mistakes, otherwise it's too disconnected from reality.
The result of that would be pilots doing everything in their power to avoid entering stall and thus learning less about behaviour while in stall and exiting stall. I'm not sure that's a desirable outcome. Sometimes you have to fail to learn.
I don't think accidents happen because pilots don't realize crashing is a bad thing, they happen because pilots do the wrong thing. You probably want pilots that have trained on dealing with lots of different failures and can do the right thing as correctly and quickly as possible, not pilots who get stressed and upset recalling the electric shocks they got during training.
It's especially frustrating for me because i remember all the times i crashed in a simulator due to stall until i understood what was happening. I don't even remember the name of the simulator, i'm not even an amateur-pilot - but that makes that report almost unbelievable, that something like this happened in a real flight to a real pilot.
unbelievable, that something like this happened in a real flight to a real pilot
Actually, most fatal crashes are "stall-spin accidents", where pilots stall the airplane near the ground without sufficient altitude to recover. But those are not cases where you keep the airplane in a deep stall for 90s. When you stall an airplane in VFR, it's obvious what happens.
No one would persist in keeping the airplane at 20 degrees positive pitch while descending at thousands of feet per minute without realizing the airplane is stalled. But here, without outside references and with obvious confusion about the state of the airplane, it was apparently beyond these guys. (Except the captain, whose comment about "no, don't climb" seems to indicate he was on the right track, but by then it was too late.)
Actually, only the less experienced copilot, Bonin, appeared to be in favor of climbing. The other repeatedly told him to level out or dive, and apparently thought Bonin had listened (which would explain why he was so baffled). As the OP points out, neither that copilot nor the captain seemed to realize that Bonin had been futilely trying to climb the whole time until that moment at the end when the captain ordered him to stop.
> One thing to keep in mind regaring stall is that it's 100% dependent on angle of attack, not speed (something Popular Mechanics gets entirely wrong). What happens basically is that at a high angle of attack the air layer doesn't track the wing surface properly and so you are deprived of standard lift.
So the air layer on the back "peels off", and you have turbulent flow on the back, instead of laminar, is that right? So the negative pressure is greatly diminished.
One thing to keep in mind regaring stall is that it's 100% dependent on angle of attack, not speed...
While the degree of stall with respect to the wing is independent of airspeed, the effects of stalling on the aircraft are very much dependent on speed. Even with the wing in the process of stalling, it can still generate enough lift to keep flying if you're going fast enough.
I find the fact that the control sticks do not move together the most troubling design flaw. Bonin's actions were not obvious to the other two pilots, if the other pilot saw his stick pulled all the way back when he knows they need to get the nose down and pick up airspeed, he'd instantly know what was wrong. Instead he is looking at instruments and talking to the other pilot and is completely unaware of how self-inflicted the crisis is.
That, and the fact that the computer chooses to average inputs from the two sets of controls even when they're very different. One pilot pulling back, and the other pushing forward and the system just quietly averages them out rather than sounding another alarm?
You suggest that one problem might be that Bonin didn't know his angle of attack. Alternately, I remember a similarity here with an Egypt Air flight that went down when some instruments went dead: when one of the instruments experienced malfunction, the pilots suddenly found it hard to believe anything the computer was saying. So maybe, on some level, Bonin dismissed the stall warning because the speed sensor had failed. One sensor is faulty, he might have reasoned, how can I know the computer isn't just over-reacting to that?
The NTSB concluded that 990 was a homicide. A relief pilot assumed control after take-off and then deliberately crashed the aircraft. From what I hear, it wasn't a fun week at the RI Medical Examiner's office.
and Aeroperu Flight 603, where the pitot tubes had been covered by maintenance workers and not removed prior to takeoff, also resulting in pilot confusion and lack of confidence in instrument readings:
The ground speed is not useful information. You can be moving backwards relative to the ground and still be overspeed. The only thing that matters to the airframe is the airspeed, and the only way to know the airspeed is to sample the air around the plane.
> You can be moving backwards relative to the ground and still be overspeed
Only in a simulator.
A Cessna 152 is a slow, low-powered trainer. It has a never-exceed speed of 141 knots. So for that aircraft to be going backwards AND be overspeed, you'd have to going into a headwind that exceeded 141 knots.
These windspeeds only occur a) during hurricanes/tornados or b) the high flight levels. You're not going to get a 152 out of the hanger during a hurricane and with a service ceiling around 14,000 feet, you're not getting close to the flight levels, which start at 18,000 feet. I supposed you might see some 100+ knot winds on occasion between 14,000 feet, but again, you're not probably going to be alive to attain the necessary altitude.
You can be moving backwards relative to the ground and still be overspeed.
That's not true. The wind even at altitude won't be more than ~100knots. It's true you can't land using GPS speed, but if your GPS tells you 90 knots ground speed at 37000ft, you know something's not right regardless of wind.
The margin between stall and overspeed is something like 20 knots at that altitude. You're not going to be able to calculate your airspeed from the groundspeed within that margin. (FWIW, I'm pretty sure this GPS speed information is available in the cockpit already. If not, you can get it off your iPhone if you really care.)
Finally, the flaps-down speed range of a Cessna 152 is 35-85 kts. So if you're facing into 85kt winds with the flaps down, you're flying backwards and are overspeed. (This can happen with the flaps up too, of course, but winds of 149 kts are a little hard to believe :)
While 149 kts at the 2,000 ft to 12,000 ft typical of Cessna 172 flight is rare, we had it in Seattle last week (wind speeds on the ground were 20 - 3 kts, at 3,000 feet we had 60 kt winds at 12,000 feet we had 100+ kts, can't remember exactly).
I'd guesstimate in the Seattle area it occurs once every 2 months below 20,000 feet. Above 20,000 feet, it's a regular occurrence.
Flying into 85kt winds will not put you overspeed, flaps down or up (assuming you're airborne, and not on the ground). Wind speed has no effect on aircraft air speed.
If you're flaps-up, engine at 2300 RPM, flying straight-and-level you're going to be cruising around 120kts airspeed in a C172 regardless of a 100kt headwind or 100kt tailwind.
Groundspeed is another story all together (and your fuel consumption getting to your destination).
True about the small margin between stall and overspeed, I didn't mean you could regularly fly like that. But according to the article, their air speed decreased from > 220knots to 90knots. What I meant was that regardless of wind, 90knots air speed should give you a ground speed so low that it should leave no doubt that you are stalled.
Apparently the PF was even thinking they were in overspeed at that point. So a ground speed should have told them that they weren't. But on the other hand, positive pitch angle and -10,000 ft/min vertical speed should also tell you beyond a doubt that you are stalled, so the problem here was not that the pilots didn't have the information they needed to figure out what was going on. They did, but failed to process it. It seems this is a classical case of "getting behind the airplane", they were just not processing events at the speed they were happening.
That's an interesting point. But if you're so panicked that you're ignoring the voice saying "stall", are you really going to check your GPS and then do a back-of-the-envelope to verify? Probably not. Because if you weren't panicked, you'd be out of the stall by following the stall recovery procedure.
> I'm sure you'd want to have a Big Flashing Warning Light telling you that ground speed <> air speed
That light would never stop flashing. :)
Once you get up a couple of thousand feet, even if the flag is hanging flush against the pole on the ground, you're going to have some type of air movement. The higher you go, the higher the windspeed (in general).
GPS can only tell you how fast you're moving over the ground. It can't tell you how fast you're moving through an airmass that might be moving with or against you, this is far more important to keeping a plane in the air than how fast you're moving between point a and point b.
I wonder if GPS could be used to estimate the air speed by means of a permanently refining mathematical model? E.g. If I know I have heading X, ground speed Y, weight Z, thrust A, you should be able to work out your predicted ground speed. Any variation in real ground speed and estimated ground speed is got to me made up of wind direction and velocity right??? Just a thought.
(Disclaimer: I know nothing about aerodynamics so this may be nonsense)
Yes, I keep hearing about pitot tube problems... I thought the Egypt Air flight I was thinking of had the same problem but I can't find information about it. It might be harder to find because I'm not sure the plane actually crashed.
That last thing is the most important thing to notice since this is what most people think is the main result of air crash investigations: making a change to break the event chain leading to the incident.
In this case there were probably a number of human errors, a.o: not noticing speed restrictions on the speedtape (even in alternate and abnormal alternate law/mode these are present, although Valpha max and Valpha prot are removed a barberpole is present up to Vstall warning) and 'ignoring' the nose-down moment the airbus tries to induce in a low speed situation.
Possibly some design errors in the form of the alpha-floor protection removed in alternate law/mode.
Seems like there is a lot to learn from this investigation for both pilots and manufacturers and although it might seem harsh and insensitive (believe me, it's not; I've lost friends due to an aircraft crash) I am actually looking forward to the 'final incident reports'.
Thanks for the great summary. I also read the full BEA report which was very informative.
Is there ever a situation in a commercial plane where a stall would be a good thing? My non-pilot brain is trying to figure out why the plane would allow a stall even in alternate law mode.
I'm sure the Airbus user interface designers know what they are doing, but wouldn't it be possible to make stall protection always enabled, and then add a failsafe requiring both pilots to press a button to override stall protection? Then they would both have to consciously do a physical act to enter this dangerous state.
The plane did have the air speed information, at least at the time it made the stall warnings. Starting at time 2h10m17s, the pitot tubes started working again, the air speed was available, and the Flight Director came back online [page 89 of BEA report]. That is why the plane was able to make the stall warning in the first place.
I also wonder if, once the FD was back online, could the pilots have just re-engaged the auto pilot and the plane would have fixed itself? This is just such a tragic accident when there was nothing at all wrong with the plane for most of the incident!
All aircraft have a VNE speed, the NE standing for "never exceed." Going beyond this threshold invites structural failure and loss of control.
> If you're inside the plane, how does it feel when the plane has stalled?
I've mentioned this in another comment, but the body is a horrible judge of spatial reference. How the body is going to feel during a stall is tough to predict, particularly given that as a passenger a) you will have no visual reference and b) you will be at a unique distance from the aircraft's center of gravity.
That said, you might feel a little buffeting as the wing reaches a critical angle of attack, but once the plane is in a full stall you probably wouldn't feel a whole lot. It's impossible to overstate just how much the body relies on the Mark One Eyeball to properly interpret the sensation motion, gravity, centrifugal force, etc.
>at night, over an ocean, in a storm, with no visibility, in possibly significant turbulance
Instead of finding out strategies on how to fly under these circumstances, why can't the plane change its course, if they anticipate the flying route to have these conditions. How about running some reconnaissance drones in the popular routes if they suspect a bad weather and want to check out. Or try out better weather monitoring methods and tools on these routes.
Edit : Ok my mistake.On reading again, the article states "Unlike other planes' crews flying through the region, AF447's flight crew has not changed the route to avoid the worst of the storms. ".
1. This is a region that is quite regular with thunderstorms. The captain probably assumed this was like any other storm in this area any other day of the week.
2. This route is at the upperlimit this plane configuration can fly. If they had to reroute they would need to stop and refuel in another country, possibly Spain, Senegal or Morocco. I assume the captain didn't want to do this and soldiered ahead.
According to the article, the pitots did, in fact, de-ice and return to normal functioning. However, apparently the alternate law needs to be manually reset, since the plane remained in direct input mode, and thus the pilots managed to stall the plane even though its instruments had all recovered.
Pitot tubes are always under strong heating during flight( so strong that the steel may blue). The problem with the 330 pitots brand in particular( there are several ) is that they cant evacuate water fast enought and sometimes they could become unserviceable ( as it happened to the af ) as they don't sense air preasure anymore.
According to the article's timeline, dual pitot failure occurred at about 02:10:06. Recovery of one pitot occurred at 02:10:36, and the other at around 02:11:03. That's about 30 seconds to recover one pitot, and 57 seconds to the recovery of the second. When you consider that this all boils down to melting off ice, that's not so bad, really. And if they hadn't royally screwed up their manual handling, it wouldn't have downed the plane - there is, in fact, a procedure for maintaining safe lift when airspeed indications are lost; somehow the copilots in command managed to screw it up, and continued to screw up even after the pitots recovered. The BBC tried replicating a pitot failure in a simulator, and when the sim pilots went by the proper procedure, there was no problem: http://www.youtube.com/watch?feature=player_detailpage&v...
So basically, this is human error, but exacerbated by a lack of training in cruise problems and poor feedback from the controls when the copilots gave conflicting commands.
The simulated test is always in a more relaxed environment. But anyway, if your instincts are good they you are OK. The problem is when your instincts tell you to do the opposite of what needs to be done. Probably the pilots need more training to break their instincts?
Maybe, but keep in mind that they are in operation on thousands of planes operating night and day, and they very seldom fail. So it's not what you would call a fragile solution. After all, the pitots involved in this flight were already due to be replaced because of icing problems.
It's hard to measure how fast you're going through the air without being able to sample the air. Pitot tubes are just the tubes that bring the air to the inside of the plane to be sampled; nothing more.
I mean, I know the physics behind pitot tubes, but I wonder if we'll come up with a better way of measuring this. Something like measuring deflections of a thousand tiny rods on the plane skin. Still vulnerable to icing and other mechanical damage, I suppose.
Maybe we'll just have really accurate GPS and beam external local instantaneous wind-speed measurements to the plane.
But, what would be taking those hyperlocal windspeed measurements--at the same altitude and within a mile or two? I can't think of any way at all to accomplish this short of a satellite with an incredible new method to measure many slices of moving air.
The fact that the heating element was not effective enough was a known fact. Since similar incident of lost of air speed had already happened. Pitot were being replaced with beefier heating elements. It was just not considered a high priority.
indeed, a computer can continue to estimate for a certain amount of time the readings of the lost sensor. You can think of solutions. But its strange to see so many cases of lost planes because of pitot problems.