If you would like to get REALLY deep into details about AF447

Yesterday I mentioned one informed hypothesis about the accident-chain that brought Air France 447 down into the Atlantic Ocean: pitot-tube trouble, leading to autopilot trouble, leading to manual control of the airplane, leading (perhaps) to overstressing of the plane's tail structure during severe turbulence. Details at the previous post. AF 447 rudder, below.

After the jump, two long and very detailed contrary arguments by people well informed in this field. I'm not going to go through and translate all the abbreviations in these analyses, because if you've gotten that far you already know (or can look it up yourself). Here we go:

Contrary analysis #1:

"a) Yes, losing airspeed data does disable rudder limit protection, but not in the way you describe -- the Airbus disables *active* rudder limit protection.  Normally, rudder movements are limited in various steps (6, I think) depending on airspeed.  Once the PRIMs disable themselves and rudder limit protection is inactivated (which we know happened in AF447 from the ACARS messages), the rudder is still limited at the exact same degree of deflection the system ordered at the time of last known good airspeed data.  In fact, that deactivation is designed to *protect* the rudder limiter from improperly responding to lower airspeeds and increasing allowed deflection, so it does the exact opposite of what you imply in the last update.  Past a certain amount of time with bad data (I don't know it off hand), the aircraft will not come out of alternate law and return to normal law even if data seemingly returns to normal, and the rudder protection limit will not reactivate based on airspeed.  The rudder limiter will only increase the amount of allowed deflection upon deployment of slats, flaps, or gear (and it then releases to full deflection, 31.9º if memory serves).

"Of course it's possible that the system failed, but as designed, losing airspeed data does *not* mean that you can deflect the rudder to more than the 3º allowed in cruise.  It actually means that you lose your normal ability to deflect rudder more at slower speeds (which possibly could have contributed to the final outcome, if not the root cause -- who knows).

"b) Contrary to what your reader writes, "The Airbus" does not have a "known weak tail".  First of all, AA587 was an A300-600.  AF447 was an A330-300, a FBW airplane designed over 20 years later, and the stabilizer was entirely redesigned in the interim.  While Airbus aircraft certainly do subscribe to a certain degree of commonality, that does not mean that every airframe is identical or even similar in some cases.

"Secondly, in AA587, the stabilizer failed at 200% of its design load. As I know you know, commercial aircraft types have to be certified to not fail completely up to 150% of design load.  The aircraft far exceeded that regulatory requirement (and the NTSB reproduced stab failure at just over 200% repeatedly in lab testing).  The reason the stab failed was because of the rapid, extreme, divergent inputs to the actuators.  Now, that doesn't mean there isn't a problem -- I specifically didn't say "commanded" inputs.  While the NTSB blamed the F/O for commanding the rudder inputs, my understanding is there's not a whole lot to back that up; it was based on a few informed guesses and not a lot of data.  The idea that a well-trained F/O for an American carrier would do to the rudder what he supposedly did is a far-fetched one to me.  At one time I ran across a couple of people who knew the F/O who swear up and down there's no way that the root cause went down the way depicted in the report and that he was one of the best pilots they'd ever known.  Obviously completely anecdotal and unreliable.  But a hydraulic or actuator problem causing the inputs, uncommanded, strikes me as a much more likely cause than an experienced F/O rapidly alternating standing on each pedal to deal with fairly ordinary wake.  I obviously have zero evidence to back it up, it's just a gut feeling."

Contrary analysis #2:

"Just a note, the rudder is almost certainly not a part of the accident chain. When the autopilot disconnects in the event of ADIRU disagreements (caused by, potentially, iced pitot tubes) and the plane goes into alternate law, the rudder travel limiter (which controls how much the rudder can be deflected) is set to the last known good value, preventing overstressing of the rudder. See page 50 of the BEA interim report.

"Further evidence against the rudder theory is that the vertical stabilizer clearly separated at contact with the ocean, not in the air (based on the fact that it was still solidly attached to the fuselage, rather than sheared off by overstress and by its location in the debris field). By comparison, American Airlines Flight 587, the vertical stabilizer had sheared off one of the bolts holding it on and disintegrated as a result of too aggressive rudder actions.

"Speculating, what seems much more like is that the plane managed to get itself into a stall situation from which it could not recover (or ran out of altitude in a recovery attempt). The pilots of the Air Caraibes flight that experienced a similar issue (memo here, in french: summary here: )  noted that the A330 checklist for a loss of reliable speed indicator had potentially contradictory steps with regard to stall warnings in alternate law flight; their recovery relied on the pilots being brave enough to ignore the stall warnings.

"Imagining, the crew of AF447, at their lowest alterness level, in the dark and potentially disorienting instrument flight phase of flight, suddenly loses reliable air speed in heavy turbulence. Multiple alarms start going off, the A/P and A/T disconnect, the ECAM reports multiple faults, and you get a stall warning telling you to nose down. If the pilots believed it, then they could get into a dive/overspeed situation, which could result in something like this that a forum poster posited (remember that the interim report says the plane impacted the water in normal flight position i.e. horizontal, but with a high rate of vertical speed - a high-speed belly flop):

"The aircraft, for whatever reason, is in a dive - the traditional nose pointing at the ground, airspeed increasing, altimeter unwinding dive. 

"Now then, suppose the pilots bring the aircraft under control and attempt to recover from the dive. I don't know what the specific A330 procedure would be, but basic airmanship for getting out of a dive is "power idle, wings level, pull through nearest horizon without overstressing the aircraft, once in a climb attitude and with airspeed below the caution range, full power, climb out". Now, lets picture the aircraft doing that, so that we have the 'bottom of a loop'  effectively, as the aircraft pulls up from a dive into a climb. At the bottom of this loop, the aircraft will be experiencing a high load factor, which means it will be flying at a high angle of attack. So, if the aircraft is at the bottom of the loop, at a high angle of attack, with the body angle of the aircraft roughly as it would be for normal flight (which the report suggests was the case in the final moment of AF447), what direction is the flight path vector? If you draw a picture, you will see it is pointing below the horizontal. So, at the bottom of the loop, the aircraft is not traveling horizontally, it is still descending. The pilots are conceivably in control of the aircraft at this point, and the problem is that they have run out of sky before they can complete the manoeuvre. Aircraft contacts the water in a roughly level attitude, at a high rate of descent.

"*IF* it was in this position of being in a steep dive towards the ground, I'd certainly want envelope protection functioning to give you the best chance of getting out. There is no point pulling too hard, as it were, increasing the load factor, and taking the angle of attack beyond the critical angle of attack - you stall and end up in the same place as if you hadn't pulled hard enough - in the ground. That is why it is critical you never put an aircraft into an intentional dive unless you know exactly how much sky you will need to play with to get it back out of it - you don't want to paint yourself into that nasty region where the only two options are not pull up enough and crash, or pull up enough, stall and crash.

"Also *IF* this is the case, then unfortunately it means that the transition from airborne to in the water (I forget what Mandala's nomenclature for these transitions is - maybe he could share it with us again?), which is what the debris is telling us about, is not going to do much to solve the mystery of what went wrong - what we really need to find out is why the aircraft arrived in the position where it had to pull out of the dive. The problem is, right now we don't seem to have much in the way of information - it is like trying to solve a 2000 piece jigsaw puzzle, having been given only a dozen pieces. *IF* this is the case, retrieving the FDR and CVR will be critical to determining what happened - without them we cannot reasonably expect to see the conclusions some people are lambasting the BEA for being unable to reach one month on from the event."

Plus, Patrick Smith's "Ask the Pilot" column at Salon always has good info on these topics.