The focus on the rudder travel limiter is a red herring because it fails in the status quo if the flight control system degrades for whatever reason. The faster the aircraft is flying, the smaller the rudder travel limit. The ‘failure’ warning does not mean that the available travel is no longer limited; it means the limit is now fixed. If the failure happens at low speed, the now-fixed available travel is large and the airplane warns the pilot to be careful with rudder handling as he could overstress the vertical fin as the leverage capable of being applied increases as the aircraft accelerates. At high speed, such as in the cruise, the available rudder travel is low, and overstress due to careless rudder handling should not be possible. In the AA587 case, Airbus contends that the pilot mishandled the rudder. The issue in that case was, I believe, that the pilot (or a design failure) may have somehow overridden the rudder travel limiter allowing him to apply more rudder than the structure could cope with.

In the AF447 case, it is, in my opinion, highly likely that the majority of the warnings ACARS reported back to AF HQ were triggered by the break up of the structure of the aircraft due to encountering extreme weather. I suspect that few, if any, of the reported failures are directly causal to the loss of the aircraft and are in fact simply the death throes of a crippled machine. It may well be, however, that the pitot tube problem (causing confusing and unreliable speed indications) hastened the loss of control and subsequent break-up of the aircraft, and that’s where I’d be looking most closely for any weaknesses in the aircraft. However, none of that is as important as why the aircraft was in the weather in the first place. The strongest machine will break if it’s put in the wrong environment; you don’t blame a car for killing its passengers if the driver drives it into a brick wall at 100mph! You may learn plenty about survivability and structural integrity from such an incident, and may apply those lessons to future vehicles, but the cause remains that the driver did the wrong thing.
In this case, it would appear that the aircraft was in a place it shouldn’t have been. the important question is not what happened inside that weather, but why was it there?

Ice in/on the pitot tubes is not likely. The PTs have powerful electric heaters, and the q at 35K, .81 M is approx 3.5psi with zero airflow inside the tube. The most likely candidate for the anomalous air data signals is the system design. Triplex (not recommended but used in the Airbus) redundant digital FBW control systems are fail op/fail op based on self test/fail. The sensor preprocessing is: A/D sample and digitize in each channel – cross channel differences formed and conditioned in each channel – differences are voted upon – odd channel ignored – all channels agree on best choice. The result is that all 3 channels give identical commands to their individual hydraulic servovalves.

POSTULATED CAUSE of 447, 587 crashes and logged anomalous incidents. The yaw damper (see same) and 1st bodybending mode feedback loop undergoe sustained oscillations of increasing amplitude to the point that aerodynamic loads on the plane exceed ultimate strength of the structure.

HYPOTHETICAL SCENARIO: 447 enters region of severe turbulence. Intermittent YD/BBM1 oscillations develop and produce large excursions in pitch and yaw (the YD couples roll and yaw – see Dutch Roll) angles which cause pitot outputs to disagree. (They don’t see the same airstream) Lateral loads are placed on the Ver.stab. One channel of air data sensor is voted out. Over the next few minutes a second channel is voted out. The remaining channel is degraded and the poor data doesn’t help the situation. Fatigue and or a sudden big side load breaks off the ver. stab. Aircraft goes broadside to the airstream and begins to break up.