1. Gradual icing reduces the inlet areas of all 3 Pitot probes, uniformly. The angle-of-attack (AOA) sensor is a weathervane attached to a horizontal shaft at the side of the aircraft near its nose. The AOA measures the angle between the airflow and the longitudinal axis of the airplane. Assume the AOA vane also ices, swiveling gradually to higher angle. Both effects cause a gradual speed-up on auto-thrust (the airplane version of cruise control).2. Pitot icing blockage becomes severe and non-uniform; a 50 kph discrepancy between probes is recorded.
3. The Pitot system fails at 2:10 UTC, auto-pilot and auto-thrust go to the "alternate" mode, which is comparable to the combination of automatic and manual control used on the Boeing 777. The rudder is no longer limited to only 5 degrees of deflection because the flight control programming presumes the pilots would need the freedom of greater motion to perform recovery maneuvers. The shift to alternate mode is not a failure of the automated system, but the response programmed for the situation.
4. The speed window ("coffin corner") at 35,000 feet is 757-913 kph (Mach 0.72-0.86). The pilots had set auto-thrust to maintain a speed near 881 kph (Mach 0.83). They are fooled into thinking their present speed is about 834-850 kph because of the last presumably good speed readings they observed prior to the warnings of 2:10 UTC. They assume the current power settings are for this speed, when actually the speed has crept up to 913-929 kph without notice.
5. Arriving at excessive speed causes 1.3 g shaking, which is self-induced but they interpret as atmospheric turbulence. If they were really cruising at 881 kph (Mach 0.83) and had encountered turbulence, then they should have reduced their speed to 819 kph (Mach 0.77). Assuming this is their situation, they try reducing speed by using the 'no airspeed data' flying procedure. They throttle back a bit, guessing at a 16-32 kph reduction based on the combination of the AOA sensor (which is iced and showing too high an angle) and the power setting. They assume the power setting accounts for a higher headwind than is the case (because it seems high), and they want to be assured of avoiding a stall, so they actually only reduce power to slow down by 16 kph to 897-913 kph (a good thing, too!), imagining they are now flying at 819-834 kph.
6. The AOA system fails at 2:11 UTC. Either the vane stalk is frozen into position, or the 1.3+ g shaking from excessive speed has caused too many erratic and wide swings of the vane, and it has faced broadside into the flow and become heavily balled up in ice. So, speed guessing is now nearing impossible. They are at about 897-913 kph when they should be 819 kph, assuming turbulence; and there may actually be some real turbulence as well. The majority of the "turbulence" they are experiencing is really the buffeting effect of excessive speed caused by the erratic shock and pressure jumps along the fuselage, wings, tailplanes, vertical stabilizer and rudder during transonic cruise. At 2:12 UTC, air data discrepancies are flagged; perhaps icing and transonic flow (shock wave effects) prevent other measurements such as of total air temperature.
7. Swept-wing transports have a tendency to swing back and forth in a lateral rolling motion called a Dutch Roll. A combined yaw and roll make the nose point left and the right wing dip (or go into the opposite combination), which is countered by the ailerons to level the wings, and the rudder to steer back on track. But, the lag in response swings the plane past straight and level into a nose pointing right and the left wing down attitude. The Dutch Roll is an oscillation between control inputs and lateral swings. Part of the automatic flight control system is a yaw damper, a slight shifting of the rudder back and forth as needed to keep the airplane straight and level.
At 2:13 UTC, AF447 was flying at excessive speed, the surrounding atmosphere may have exacerbated flight instability by being turbulent, and the flight control system no longer limited rudder deflection to 5 degrees. Yaw damping became ineffective. Because of the 1.3+ g shaking and the shock-induced flow disruptions of transonic cruise, the responses to the deflections of the ailerons and rudder became erratic, and an amplifying Dutch Roll oscillation sets in.
8. A big tail swing right is countered by a rightward rudder deflection of greater then 5 degrees, and the combined moment (torque) to the right and the air resistance against the vertical fin (to the left) puts a greater then 2.5 g load on the vertical stabilizer, and snaps the entire fin-plus-rudder assembly off to the left.
9. The loss of the vertical stabilizer releases resistance to the rightward moment, and an instant angular acceleration of 3.5 to 5 g, or more, swings the tail rightward.
10. The rear pressure bulkhead in the fuselage has a pressure force directed rearward, from the pressurized cabin and cargo hold toward the unpressurized tailcone. During a rightward tail swing, this force points to the back and rightward. At the same time, the rightward moment acting on the tailcone puts a lateral force on it, which is to the left and increasingly back during the rightward swing. With the tail wagged right, the rear bulkhead is tilted forward on right side, backward on left side, and the resultant force on it is more or less straight back. This causes a rotation of the bulkhead so as to open its seam on the right side of the fuselage, breaching the pressure seal and allowing the cabin to de-pressurizes rapidly.
11. An automatic signal sent at 2:14 UTC announces cabin de-pressurization.
12. The unimpeded rightward tail swing sweeps the right wing square into the airstream while the airplane is near its maximum speed, about 881-913 kph (Mach 0.83-0.86). This swings the right wing leading edge forward at a higher relative speed than Mach 1, so it moves forward of the leading shock.
13. The shock extends along the middle chord of right wing, now angled more squarely into the flow, and causes flow separation behind it, with a complete loss of lift; shock stall.
14. The plane's nose is yawed left in a rightward tail swing, the right side losses lift force while left keeps it, and the result is a sudden strong moment causing a rotation (perhaps 5 g) about the plane's longitudinal axis: left side/wing up, right side/wing down.
15. The excessive right twist of the fuselage causes engine pylons to fail. Engine number 1 (left side) breaks off -- cutting electrical power -- rotating in an upward swing right, smashing into the bottom of the left wing near the wing root and trailing edge, and then smashing into and through the left side of the fuselage just past the left wing root.
16. Engine number 2 (right side) swings up and right to twist bottom-up through the right wing leading edge, outboard of the engine location, and the outer wing then snaps off by rotating about the rip, with a tip upward motion. Air blast through its underside blows off upper surface spoilers like the one recovered by the Brazilian Navy.
17. The tailplanes probably snap off at the same time as the engines.
18. The reduction in mass on the right side, relative to the left, gives a boost (less inertia and drag) to the rightward roll underway.
19. The rear section of fuselage twists off from its remaining right side connection with a leftward swing, and the tailcone section separates from it, tearing off from the right to left side of its pressure bulkhead seam.
20. The interior of the fuselage originally behind the wings experiences an air blast through its forward open section toward the tail end; many panels and weakly attached objects are blown out.
21. The still intact assembly of forward fuselage plus right wing stub plus left wing continues to roll completely over while also yawing back and forth, for several cycles. The wing experiences lift forces that make the entire body spin, like a maple seed pod, whose single airfoil causes it to gyrate during a swinging descent.
22. The angular force at the left wingtip and at the cockpit end of the fuselage are greatest, so the fuselage snaps apart aft of the cockpit and also ahead of the left wing root, while an outboard length of left wing also snaps off.
23. The sections of the airplane that fall are: the vertical stabilizer with its rudder (recovered by the Brazilian Navy), the tailcone (with or without tailplanes), the rear cabin section (probably further ruptured during descent by air blast), the engines, the right wing outboard of the number 2 engine location; then after a bit of 'maple seed' auto-rotating helicopter flight as a unit: the cockpit section of the forward fuselage, another length of the forward fuselage, an outer length of left wing and the wing root section of the fuselage with the remaining wing stubs.
24. The four sections of the cabin (the tailcone is a fifth fuselage section) guessed here might experience further air blast rupture and content ejection as they descend; and the large structural remnants hitting the water would then suffer collision fragmentation.