A330 has figured in the incidents, but AFAIK the flight control software and angle of attack sensors that are implicated in those incidents are the same in all of the Airbus models.
> They never quite figured out the root cause of the un-commanded dives
Yes, they did. Read the "Conclusion" under the "Final Report" section. The "design limitation" they're referring to is that, first, the autopilot is not driven by an average or majority vote of the three angle of attack sensors, but by one of them only (which one depends on whether the captain or first officer's position engaged the autopilot), and second, the other two angle of attack sensor inputs are not used to check the sensor that is driving the autopilot, so if that sensor gives faulty input (the "multiple spikes" described), the faulty input is allowed to trigger uncommanded events such as the violent pitch down that happened on Quantas Flight 72.
What should happen is that the input from all three angle of attack sensors should be combined: as long as all three of them are within some tolerance, the average of the three becomes the angle of attack used to drive the autopilot. If one goes out of tolerance compared to the other two, its input is discarded until it comes back into tolerance (so "multiple spikes" from one sensor would simply be ignored). If it takes too long for the one sensor to come back into tolerance compared to the other two, that sensor gets ignored for the remainder of the flight and the pilots get notified. If it gets to a point where no two of the sensors are within tolerance of each other, the autopilot gets disengaged and a big red light goes on in the cockpit. I am unable to understand why that is not how the system is designed, but the investigation reports make clear that it isn't.
A330 has figured in the incidents, but AFAIK the flight control software and angle of attack sensors that are implicated in those incidents are the same in all of the Airbus models.
> They never quite figured out the root cause of the un-commanded dives
Yes, they did. Read the "Conclusion" under the "Final Report" section. The "design limitation" they're referring to is that, first, the autopilot is not driven by an average or majority vote of the three angle of attack sensors, but by one of them only (which one depends on whether the captain or first officer's position engaged the autopilot), and second, the other two angle of attack sensor inputs are not used to check the sensor that is driving the autopilot, so if that sensor gives faulty input (the "multiple spikes" described), the faulty input is allowed to trigger uncommanded events such as the violent pitch down that happened on Quantas Flight 72.
What should happen is that the input from all three angle of attack sensors should be combined: as long as all three of them are within some tolerance, the average of the three becomes the angle of attack used to drive the autopilot. If one goes out of tolerance compared to the other two, its input is discarded until it comes back into tolerance (so "multiple spikes" from one sensor would simply be ignored). If it takes too long for the one sensor to come back into tolerance compared to the other two, that sensor gets ignored for the remainder of the flight and the pilots get notified. If it gets to a point where no two of the sensors are within tolerance of each other, the autopilot gets disengaged and a big red light goes on in the cockpit. I am unable to understand why that is not how the system is designed, but the investigation reports make clear that it isn't.