Why did AF447 never return to normal law? Air France Flight 447 degraded from normal law to alternate-2B law when its pitot tubes were temporarily filled with ice crystals, resulting in a loss of airspeed data.  As a consequence of being in alternate-2B law, most of the aircraft's flight envelope protections were lost, allowing the first officer to stall the aircraft with his counterproductive control inputs, causing the aircraft to experience unplanned high-speed hydrobraking.

However, according to the BEA report on the crash, after only about a minute, the pitot tubes had unfrozen, and all airspeed data was once again valid.  At this point, the aircraft was still climbing, and, although its airspeed was steadily bleeding off, it was still approximately 30 seconds away from stalling (although it was still dangerously close to doing so, and the stall warning horn was sounding); had the aircraft automatically returned to normal law, with all its associated envelope protections, the aircraft would have rapidly recovered itself from the impending stall.

And, yet, despite the clearance of the fault that had caused the aircraft to fall from normal law to alternate-2B law in the first place, it did not transition back into normal law at this point, instead remaining in alternate-2B law all the way up (or down) until impact occurred over three minutes later.1

Why did AF447 remain in alternate law, even after airspeed data from all sources was once again valid?



1: Once the aircraft actually stalled, the airspeed data once again started being invalid (interspersed by periods of validity), but this was due to the aircraft's extreme attack angles during its descent, and would have been avoided had the aircraft not stalled.
If the system detects anomalies for more than about ten seconds, alternate law becomes locked in for the remainder of the flight.

The system detected a change in the median value of the three airspeed sources of more than 30 knots within one second (it actually dropped from 274 to 52 knots within 3 seconds). That started a process where the system monitors the difference for a verification period (about 10 seconds). Alternate Law was triggered, along with limiting the rudder travel limit (which was not annunciated to the crew). The flight control law would have returned to Normal Law if the median speed value was within 50 knots of the original speed prior to the loss, at the end of the verification period. If the speeds remain outside of those parameters, Alternate 2 is locked on for the remainder of the flight, and the rudder travel limit fault is displayed.
emphasis mine

From “Understanding Air France 447” by Bill Palmer