Update:  Newer Rudder related postings

Air France Flight 447: Sunday In Paris Before The Storm…

AF Flight 447 – More “Rudder” Chatter

The American Media has missed another opportunity to provide coverage to the American people.  While the American media has been either bowing or kneeling to the Obama Arab World Appeasement Tour, the American population has turned to the on-line community for their news on this important story.

Below is a update to the recovery operations currently going on off the coast of Brazil. Several newspapers have reported parts of a wing have been found.  I will update when I can confirm with the SAR Mission Força Aérea Brasileira website. Air France seems to be doing a great job assisting the victims at it’s crisis centers in Paris and Rio de Janeiro.  However, I’m increasingly seeing more on-line discussions by Brazilians concerning the cost of this recovery and the lack of assistance for the estimated 250,000 Brazilians displaced due to flooding in Northern Brazil.

Again, I simply do not thrust the Bureau d’Enquêtes et d’Disinformation (BEA).  The less available data, the weaker the case for conclusive litigation. The fact remains that the following Iberia aircraft rerouted 56kms to avoid the storm and the Air France aircraft proceeded through the storm.

Le Monde confirms that the flight AF 447 had encountered serious technical problems, particularly the “Inconsistency” between the measured speed.

A possible link between the problems of measuring speed and the disaster is not established and the crash remains unexplained.

The Office of Investigations and Analysis (BEA), responsible for the technical survey of France, has confirmed the existence of problems regarding the measurement of speed. The European aircraft manufacturer Airbus and operators of the aircraft have “replacement programs and improvement of detection speed” of the A330 because of problems had been encountered previously on other devices in the range, revealed the BEA director Paul-Louis Arslanian.


The sensor measuring airspeed on the A330 is a so-called Pitot tube, named after the French engineer who discovered in the early 1700s that the pressure of a gas or liquid through a tube could be used to determine velocity. The Bloomberg article states that:

According to Thales, its unit includes an electric heating system to “limit the risk of icing” that could obstruct the airflow and produce faulty readings.

Thales will be asked to supply information to crash investigators, the person with knowledge of the inquiry said. Christophe Robin, a spokesman for the Neuilly-sur-Seine, France- based company, didn’t immediately return a call to his mobile phone after regular business hours.

Blocked or damaged Pitot tubes have been blamed for air disasters including the 1996 crash of a Boeing Co. 757 flown by Alas Nacionales, which plunged into the Atlantic after takeoff from the Dominican Republic, killing all 189 people on board. Readings overstating the plane’s speed caused the pilots to fly too slowly and stall, investigators found.


Air France Press release N°12 -Update on anemometric sensors

Following the many questions which have appeared in the media on the issue of the Pitot probes in its fleet (the Pitot probe is an instrument which measures the air speed of the aircraft), Air France wishes to make the following clarifications:

1)   Malfunctions in the Pitot probes on the A 320 led the manufacturer to issue a recommendation in September 2007 to change the probes. This recommendation also applies to long-haul aircraft using the same probes and on which a very few incidents of a similar nature had occurred.

It should be noted that a recommendation from the manufacturer gives the operator total freedom to apply the corresponding guidelines fully, partially or not at all. Should flight safety be concerned, the manufacturer, together with the authorities, issues a mandatory service bulletin followed by an airworthiness directive (AD).

The recommendation to change the probes was implemented by Air France on its A320 fleet where this type of incident involving water ingress had been observed. It was not implemented on the A340/330s as no such incidents had been noted.

2)   Starting in May 2008 Air France experienced incidents involving a loss of airspeed data in flight, in cruise phase on A340s and A330s. These incidents were analysed with Airbus as resulting from pitot probe icing for a few minutes, after which the phenomenon disappeared. Discussions subsequently took place with the manufacturer.  Air France asked for a solution which would reduce or eliminate the occurrence of these incidents. In response to these requests, the manufacturer indicated that the probe model recommended for the A320 was not designed to prevent such incidents which took place at cruise levels, and reiterated the operational procedures well-known to the crews.

In the first quarter of 2009 laboratory tests suggested, however, that the new probe could represent a valuable improvement to reduce the incidence of high altitude airspeed discrepancy resulting from pitot probe icing, and an in service evaluation in real flight conditions was proposed by Airbus. Without waiting for the in service evaluation, Air France decided to replace all its probes and the programme was launched on 27 April 2009.

Without making any assumptions as to a possible link with the causes of the accident, Air France speeded up this programme and reminded its pilots of the current instructions issued by the manufacturer to cope with the loss of airspeed data.


Below are the most recent on-line pilot chatter and message board discussions.  Please understand the below are only chatter/discussion upong aviation professionals and should not be considered fact until all official information is released by Bureau d’Enquêtes et d’Disinformation (BEA).

Ice Protection (1.30.50)

It ways that Electrical heating protects the pitot heads, static ports, Angle Of Attack (AOA) probes and Total Air Temperature (TAT) probes. The heating is controlled by Three independent Probe Heat Computers (PHC) which automatically control and monitor Captain probes, F/O probes and STBY probes, The PHC protect against overheating protection and indicate fault, and automatically heats all the probes when in flight.

If ice protection fails, an ECAM message will be generated and an ACARS message generated. We see none? We can assume that the probes worked.

Despite having probe heats and Engine Anti Ice and Wing Anti Ice, what happens when you go into icing?


Ice Detection (1.30.70)

The ice detection system has two separate ice detector probes on the forward lower section of the fuselage. The system operates automatically and starts at electrical power up.

The probes detect ice build-up. They also indicate, through the MEMO display, that icing conditions have disappeared. The system logic generates ECAM messages according to ice detector signals and the flight crew’s selection of engine or wing anti ice systems. The ice detection system however does not control the ENG or WING anti ice systems.

We have no ICE DETECT FAULT message generated on the ACARS… the question is, would it?

But then, how does it detect the ice and alerts the crew? If one has engine anti ice on, it would detect 0.5mm of ice accretion within 60s but not provide an ECAM message. If at least 0.5mm of ice accretion is detected 10x60secs, then it’ll generate a Severe Ice Detected if Wing and engine Anti Ice is not on.

Whilst ice detection warnings is nice even if you have anti ice on, its still not a requirement to have it… the system only alerts you if you do not have adequate anti ice on.

So, a build up of ice in the probes would not have generated a message. Therefore, there is no data from within the aircraft that was sent on ACARS than can point the icing the aircraft went through.

This would make the icing theory, whether true or not, pass from the no detection message aspect.


Flight Controls (1.27.30)

330ALTNLAW_Flt_Ctrls 1.27.30


The pitot probe issue is a red herring and is because some idiot journalist was looking for something to blame on the two biggest protagnists in the disaster and have a jucier story. This upgrade is ongoing in the entire Airbus fleet and is normally done during heavy maintenance checks or by attrition if one of the probes gets damaged or fails a regular check.


So far I have not seen any evidence to suggest that the accident aircraft had all old probes, all new probes or a mixture of old and new due to part availability. I am 99% sure that it will have no bearing on the cause of the accident.

Any component can be upgraded for a number of reasons and when it involves safety normally an Airworthiness Directive (AD) is issued to ensure that the upgrade is implemented, which was not deemed necessary with this upgrade. In this case after all the press coverage it is quiet possible that an AD will be issued as a precaution but mainly to calm the travelling public.

Article in the Brazilian media suggesting a rudder failure, as in complete structural failure reference message sent in the last four minutes of flight.

The message indicated a fault in the rudder travel limiter, not the rudder. The fault given the codes next to would in my view be due to inaccurate airspeed data to the SECs. The SEC control and monitor the rudder deflection, and restricts the travel (i.e. maximum deflection from side to side) of the rudder to low travel at high speed (around 4 deg), and larger deflections at lower speeds (around 30 deg for takeoff). When travel limiter faults, the rudder travel limit remains at the calculated limit prior to the fault until slats are extended for landing.


My understanding is that the message occurs when the travel limiter is exceeded, which could indicate massive force or presumably it could also mean the limiter itself is not functioning. However…

…since the rudder is FBW, the limiter is a software function, not any specific device. I would imagine that if the rudder itself went missing, or stopped responding entirely, you would get a FAR more drastic set of messages.

I would imagine the message itself is there primarily to inform maintenance that the rudder has been used beyond flight tolerances, which in many cases warrants structural inspection. This is of particular interest to Airbus, since the rudder travel limits, or lack thereof, were highly suspected during the crash of AA 587.

… or that limits were no longer being imposed on rudder travel because the system no longer knew what the limits should be? If the rudder had been used beyond tolerances wouldn’t the message say so, rather than reporting a “travel limiter fault”?


In relation to the Rudder Travel Limiter (RTL) if the violent storm theory holds then it is probably as a result of structural failure due to massive yawing forces induced by turbulence.

The F/CTL RUD TRVL LIM FAULT message has been generated due to the NAV ADR DISAGREE message and NOT due to a fault in the Rudder Travel Limiter itself NOR due to a failure/separation of the rudder.

If the problem lay in the unit itself, a F/CTL RUD TRVL LIM 1 / (2) FAULT would appeaer. This is due to the Rudder Travel Limiter requiring an airspeed input from the ADR’s to function properly.


Excerpt from FCOM 3.2.24… (NAV ADR DISAGREE)





The rudder travel limit value is frozen at the moment when the failure occurs. Therefore, to prevent damage to the aircraft structure, use the rudder with care, when the speed is above 160 knots. At slats’ extension, full rudder travel authority is recovered.


Where are satellite uplink antennas located, physically?

On top of the fuselage, normally around the area of Doors 1L/R, but this can vary.


ACARS messages for the benefit of those who don’t know about the aircraft automatic communications features…

A quick read of Maintenance System (1.45.20) gives a nice overview on what can be sent, and how it is sent. But anyways, it needs AC bus 1 and/or AC bus 2 for the Centralized Maintenance System of the aircraft to operate.

It is sent by the ATSU…

ATSU Communications Function (1.46.20)

The Air-Ground communications are managed by the ATSU communication function either automatically without pilot action, or manually using MCDU pages and/or RMPs.

Aircraft to ground messages (downlink) comprise maintenance, monitoring, operational, performance and cabin data and later ATC messages. Reports generated by a peripheral (CMS, ACMS, FMS, CABIN TERMINAL) system can be automatically downlinked by the ATSU depending on each airline. Ground to air (uplink) features are available too.

The ATSU sends through a datalink, Real-time failure and warning messages (inflight).

What is interesting for me is that the Aircraft Condition Monitoring System can also send data automatically, covering Aircraft Performance Monitoring (APM), Engine Condition Monitoring (ECM), and APU Health Monitoring (AHM). This info can also be requested from the ground.

The datalink is part of the CNS/ATM (Communications Navigation Surveillance/Air Traffic Management) system. The current CNS/ATM system uses the ACARS networks, mainly ARINC and SITA. The related data communications are managed by the Air

Traffic System Unit (ATSU), and can be supported by SATCOM or VHF.


Where does power come to the AC 1 Bus?

FCOM 1.24.10………


Each AC BUS is supplied in priority order by:

the corresponding engine generator.

  • the APU generator or the external power A (if both are connected, the APU generator has priority for the left side bars, and the external power has priority for the right side bars.
  • the external power B (if both external power are connected, B has priority for the left side bars and A has priority for the right side bars).
  • the other side engine generator.

The APU generator or the external power may supply all the network.

One generator can supply all the network (with galley shedding in case of overload detection).

The generators cannot be connected in parallel (except on ground during No Break Power Transfers).



Each engine-driven generator supplies its associated AC BUS (1 and 2) via its Generator Line Contactor (GLC 1 and GLC 2).

AC BUS 1 normally supplies the AC ESS BUS via a contactor.

AC BUS 1 supplies TR 1 which normally supplies DC BUS 1, DC BAT BUS.

AC BUS 2 supplies TR 2 which normally supplies DC BUS 2.

AC BUS 1 supplies ESS TR which normally supplies DC ESS BUS.

The two batteries are connected to the DC BAT BUS if they need charging. When they are fully charged the Battery Charge Limiter disconnects them.


Either the APU generator or external power may supply the complete system (with some galley shedding in case of overload).

If external power A and external power B plus APU supply the complete system, the APU has priority over external power B.

Situation then will be as displayed for case APU plus external power

On ground, when only ground services are required, external power can supply the AC and DC GRND/FLT buses directly, without supplying the aircraft’s entire network.

This configuration is selected via the MAINT BUS switch located in the forward entrance area.




ECMU provides automatic reconfiguration.

Complete network remains supplied.

Note : If a generator is lost due to over current detection, reconfiguration does not occur and the related AC BUS is lost.

The system automatically replaces the failed generator with:

  • The APU generator if available or,
  • The other engine generator (automatically shedding part of the galley load).


The AC BUS 2 supplies the AC ESS BUS and the ESS TR automatically.


The contactor of each TR opens automatically in case of:

  • overheat
  • minimum current
  • overcurrent
  • open or short circuit

ECMU provides automatic reconfiguration (except for APU TR)

Note : If a TR is lost due to over current detection, reconfiguration does not occur and the related DC BUS is lost.

Failure of one TR

  • TR 1 or 2 lost: the available TR replaces the faulty one.
  • ESS TR lost: the TR 1 replaces the ESS TR.

Failure of ESS TR and TR 1 (or TR 2)

  • The remaining TR supplies the two DC norm busses and the DC BAT bus.
  • The DC ESS bus is lost.


If both buses, AC 1 and 2, are lost and if both engines are lost, the Ram Air Turbine (RAT) extends automatically.

If powered by the RAT only, the EMER GEN is inhibited when slats are extended.

The emergency generator can be manually activated through the MAN ON pushbutton.

Emergency generator deactivation occurs only automatically :

In flight: at slats extension if powered by the RAT only (both engines are lost) it can be reactivated after slats retraction through the MAN ON pushbutton.

On the ground: after both engines shutdown.

EMER GEN TEST pushbutton allows to activate the emergency generator and to connect it to the essential network. This test is inhibited when the slats are extended.


If the green hydraulic system, which actuates the emergency generator, is powered by an engine-driven pump, the emergency generator supplies the :



And, through the ESS TR, the :



If the green hydraulic system is powered by the Ram Air Turbine, the emergency generator supplies the :


DC ESS BUS, through the ESS TR.

All LAND RECOVERY AC and DC BUS bars are shed. They are recovered when the LAND RECOVERY pushbutton is ON.

The AC ESS GND is lost.



When emergency generator is not available, the batteries supply:

  • the DC ESS BUS
  • the DC LAND RECOVERY (whatever the LAND RECOVERY pushbutton position is)
  • and through the STAT INV :
  • the AC ESS BUS
  • the AC LAND RECOVERY (whatever the LAND RECOVERY pushbutton position is)
  • The AC ESS SHED, the DC ESS SHED and the SHED LAND RECOVERY are not supplied.
  • The AC ESS GND is lost.

Example: flight with batteries only.



Provided they are both selected AUTO, the batteries supply:

  • the DC ESS BUS
  • the DC BAT BUS
  • the DC LAND RECOVERY (whatever the LAND RECOVERY pushbutton position is)
  • and through the static inverter:
  • the AC ESS BUS
  • the AC ESS GND
  • the AC LAND RECOVERY (whatever the LAND RECOVERY pushbutton position is)
  • The AC ESS SHED, the DC ESS SHED and the SHED LAND RECOVERY are not supplied.


Is pitot heat something that is always automatically on (and controlled by computers) or can it be turned of manually?

FCOM 1.30.50……

Electrical heating is provided for the protection of:

  • Pitots.
  • Static ports.
  • Angle Of Attack (AOA) probes.
  • Total Air Temperature (TAT) probes.

Three independent Probe Heat Computers (PHC) automatically control and monitor:

Captain probes

F/O probes

STBY probes

They provide overheat protection and fault indication.

The probes are heated:

  • automatically when at least one engine is running, or in flight
  • manually by switching ON the PROBE/WINDOW HEAT pushbutton.

On the ground, TAT probes are not heated and pitot heating operates at low level (normal power in flight by automatic changeover).


Related  Brazilian Links


Other Links

HotAir More bowing from the media