Cornucopia of updates #6: a theory on AF 447

This recent post and preceding items mention the still-ambiguous mix of data concerning the crash of Air France 447 into the Atlantic six weeks ago. The plane's presence in a tropical thunderstorm was almost certainly the trigger for the problems. And what happened then?

From a reader involved in aviation, a hypothesis that it was a thunderstorm -> pitot tube -> autopilot -> rudder chain of events. Almost all airline disasters involve an "accident chain," a sequence of cascading failures that, if interrupted at any point, would not have led to a crash. In this view:

  1. The plane got into a thunderstorm, where the updrafts and downdrafts are extremely powerful and where unusual conditions apply -- including the possibility of the plane being covered with ice;

  2. Storm-related ice may have blocked the pitot tubes -- small probe devices that measure the force of the oncoming air. When compared with other data, pitot data lets the pilot derive the plane's airspeed. If the small openings at the front of the pitot tubes are blocked by ice or anything else, the pilots don't know the plane's speed, which is the most important single piece of info for keeping an airplane under control;

  3. When the sophisticated, computerized, highly-redundant autopilot system detected bad readings from the pitot tubes -- or readings from some of the tubes that differed from the others -- it disconnected the autopilot and returned control to the captain. This is a safety measure to prevent an automated system from following bad data all the way to the ground;

  4. When the human pilot took over, the absence of the autopilot gave him full control over the airplane's rudder. The autopilot and computerized guidance system included a "yaw damper," which limited sudden or severe movements of the rudder (which place strain on an airplane's tail);

  5. While in the storm under manual control, the violent forces on the plane and perhaps movements of the rudder may have broken off the tail and sent the airplane down.

Pitot tube, on the underside of a plane's wing, pointed forward:

As the reader sums up the sequence:

My personal opinion about what happened is as follows - one or both pitot tubes iced over, which means that the air data computers are getting airspeed indications more than 5 knots apart.  In that case, the autopilots disconnect, and the aircraft reverts to basic flight mode - which may be thought of as a limp mode - and among other things the yaw damper is turned off.  Now the pilot has full rate authority on the rudder and the stab.  The airbus has a known weak tail [he cites this Wikipedia entry about the crash of American Airlines flight 587] -- they got into some turbulence and it broke off.  the airplane tumbled and came apart... which explains no mayday call and the diagnostic message about loss of cabin pressure.

I note with interest that the rudder on both 447 and AA 587 were both found intact. 

After the jump, a note from an Airbus pilot who, on a very recent flight in Asia, reported problems that would exactly match this hypothesis for the Air France crash.


Note from an Airbus captain. I have removed various identifying details:

Yesterday while coming up from XXX to YYY [two major cities in Asia], a 4hr. flight, we experienced the same problems Air France 447 had while flying thru bad weather.

I have a link to the failures that occurred on AF 447. [It is here -- in a mixture of French and computer code.] My list [of things that went wrong on the flight] is almost the same.

The problem I suspect is the pitot tubes ice over and you loose your airspeed indication along with the auto pilot, auto throttles and rudder limit protection. The rudder limit protection keeps you from over stressing the rudder at high speed.


[Precise time and location info omitted.]

FL390 ["Flight Level 390," or 39,000 feet], mostly clear with occasional isolated areas of rain, clouds tops about FL410. Outside air temperature was -50C TAT -21C (your not supposed to get liquid water at these temps). We did. [TAT = "total air temperature," a figure used in calculating air speed.]

As we were following other aircraft along our route. We approached a large area of rain below us. Tilting the weather radar down we could see the heavy rain below, displayed in red. At our altitude the radar indicated green or light precipitation, most likely ice crystals we thought.

Entering the cloud tops we experienced just light to moderate turbulence. (The winds were around 30kts at altitude.) After about 15 sec. we encountered moderate rain. We thought it odd to have rain streaming up the windshield at this altitude and the sound of the plane getting pelted like an aluminum garage door. It got very warm and humid in the cockpit all of a sudden.

Five seconds later the Captain's, First Officer's, and standby airspeed indicators rolled back to 60kts.[Showing that the pitot tubes were blocked.] The auto pilot and auto throttles disengaged. The Master Warning and Master Caution flashed, and the sounds of chirps and clicks letting us know these things were happening.

The Capt. hand flew the plane on the shortest vector out of the rain. The airspeed indicators briefly came back but failed again. The failure lasted for THREE minutes. We flew the recommended 83%N1 power setting. When the airspeed indicators came back we were within 5 knots of our desired speed. Everything returned to normal except for the computer logic controlling the plane. (We were in alternate law ["alternate law" = flying manually, without autopilot] for the rest of the flight.)

We had good conditions for the failure; daylight, we were rested, relatively small area, and light turbulence. I think it could have been much worse. The captain did a great job flying and staying cool. We did our procedures called dispatch and maintenance on the SAT COM [satellite phone] and landed in YYY. That's it.