The transfer function for a electro-hydraulic actuator is a bit more complicated than a simple low-pass filter, but the suggestion of oscillations in the system is somewhat too far-fetched... and would indeed imply a fundamental design flaw.... The technology has been around too long, and is too well understood, for this to be a plausible cause, IMO.
Hi Christiaan,
In light of the many thousands hours of successful operation of the A330/340 on autopilot, it might not imply a design flaw, but instead the exceedance of an unpublished limitation.
Just like AA587 taught us to be careful with rudder inputs, perhaps the legacy of AF447 will be that there are other ways to 'break' the aircraft than causing structural damage. Depending on how the flight control laws are structured, it seems possible that extremely challenging weather might cause excessive use of the flight controls and hydraulic pressure depletion/interruption before actual structural failure could occur.
At present, everything I have read relating to PIO/APC events indicates that these events occur with cliff like suddenness. Usually there is a triggering event-a final straw that breaks the camel's back. Things like changing of flight control laws, changing pilot control strategies (e.g. rate based control technique rather than attitude), changes in aircraft configuration, changes in power,and changes in flight conditions are often culprits.
One cannot realistically deny that PIO events exist and they are not restricted to fighter aircraft. They have been experienced on well known transport aircraft such as: A320,A321, C-97, C-17, KC-135A, MD-11, B767, B777, and a number of bombers as well. Not all of these experiences have been in development, a number of them have occured during normal line flights.
Since we are talking about an aircraft (AF447) on autopilot not under pilot control in the moments leading up to its problem, we are no-longer talking about a strict PIO event possibility, but that is probably a weakness of the definition. When it comes to FBW aircraft, the control system is always in the loop except when you lose electric power or hydraulic effector power to the system.
My gut feeling is that Airbus engineers did a great job on their software design, but for an aircraft to suddenly lose control while on autopilot would imply a possible condition well outside of the norm-something like hydraulic supply induced rate limiting.
The A330 is not a naturally unstable aircraft, but it is a relaxed stability aircraft which is made to fly nicely by virtue of its flight control system. Anything that gets in the way of the flight control system's ability to control is bad, and anything that actually aggravates the control system's control has the potential to be downright tail over teacup dangerous. It has been said that you can make an unstable aircraft fly with fly by wire technology, and you can make a stable aircraft lose control using the same technology.
For the doubting Thomases, take a look at these two Youtube videos, and remember-it isn't the pilot's fault-it is an aircraft problem. PIO exists and it doesn't always happen with developmental aircraft.
YouTube - F22 Pilot Induced Oscillation (PIO)
YouTube - Saab JAS39 Gripen Crash 1993
On the second accident, note the wing rock before the departure.