Significant Regulatory & Related Activity

Wed, Feb 2, 2011 — David Evans

Featured, Regulatory & Other Items

Ice in pitot tubes and angle of attack sensors can be as threatening to continued safe flight as ice on the wings, as elucidated by recent FAA actions. Protections against frozen water seem decidedly lax given the deadly threat.


25 January 2011                   FAA

FR Doc No. 2011-1226          Docket No. FF-2011-0029

AD 2011-02-09

Final Rule, Airworthiness Directive (AD), Airbus A330-200, A330-300, A340-200 and A340-300 Airplanes

The potential for an abrupt pitch command can lead to a departure from controlled flight, which requires corrective action outlined in this AD, which was propounded by EASA (European Aviation Safety Agency) on 22 December 2010. This mandatory action clearly relates to the 2009 fatal crash of Air France flight 447, an A330-200, on a flight from Rio de Janeiro to Paris. As recounted in other stories in this publication, faulty pitot tube readings can lead to an overspeed condition, creating an out-of-control situation that flight crews may not be able to handle, especially all of a sudden and on a dark night with thunderstorms, as was the case of AF 447. (See Aviation Safety Journal, June 2010, “Air France Memorandum Intended to Quell Pilot Union Unrest”).

The accident airplane

The accident airplane

This AD comes 17 months after the crash and requires actions that basically require the crew to distrust their instruments – contrary to the schooling drummed into every tyro pilot.

The erroneous agreement of two or even all three of the airplane’s pitot readings clogged by ice can fatally override the Airbus system’s self-check. Or, as put more specifically, the crew of AF 447 was duped into re-engaging the autopilot, only to have an abrupt pitch-up at high altitude, leading to a loss of controllability at night at a very low actual airspeed, with attendant engine compressor stalling due to low airspeed and flight-path asymmetry (e.g., flat spin). Or, as expressed more succinctly by one wag: “Remember my saying 3 airspeed indicators (pitot tubes) could give different information to different computers that more than likely caused a logic race between them? This would possibly cause the aircraft to beat itself to death.”

Pitot probes on the A330

Pitot probes on the A330

In all likelihood, ice clogging two or more pitots contributed to the same erroneous speed reading, leading the computers to “believe” the aircraft was flying slower than it was actually flying.

The effect of ice in the pitot tube

The effect of ice in the pitot tube

As the FAA announcement says:

“The unsafe condition is the potential for abrupt pitch command which may lead to unexpected maneuvers of the airplane and cause injuries of the crew and passengers, as well as increased pilot workload. Required actions include revising the limitations and abnormal sections of the airplane flight manual to include a procedure for when the autopilot and auto-thrust are automatically disconnected and flight controls have reverted to alternate law.”

The “increased pilot workload” is a whopping euphemism for pilots in an unfamiliar situation frantically trying to figure out unexpected and sudden aircraft behavior while gyrating down toward a raging sea or dark, threatening terrain, and trying to regain control before they’re crushed by the forces of looming impact.

Quoting from the EASA document, the FAA recounts the following regarding these fly-by-wire (FBW) aircraft:

“When there are significant differences between all airspeed sources, the flight controls of an Airbus A330 or A340 airplane will revert to alternate law, the autopilot (AP) and the auto-thrust (A/THR) automatically disconnect, and the Flight Directors (FD) bars are automatically removed.

“It has been identified that, after such an event, if two airspeed sources become similar while still erroneous, the flight guidance computers will:

— Display FD bars again, and

— Enable autopilot and auto-thrust re-engagement.

“However, in some cases, the autopilot orders may be inappropriate, such as possible pitch command.”

Substitute the word “deadly” for “inappropriate” for a better appreciation of the implications.

“FD bars” refer to the instrument display that shows the proper pitch and bank angles required in order for the aircraft to follow a selected flight path.

The AD specifies changes to the A330/A340 Flight Manual to inform crews of the hazard and what they should (and should not) do when FD bars are displayed following AP disconnect. The following guidance must be inserted into the Airplane Flight Manual:


“When autopilot and auto-thrust are automatically disconnected and flight controls have reverted to alternate law:

— Do not engage the AP and the A/THR, even if the FD bars have reappeared.

— Do not follow the FD orders


• If unreliable speed indication is suspected:


• If at least two ADRs provide reliable speed indication for at least 30 seconds, and the aircraft is stabilized on the intended [flight] path:

AP/FD and A/THR – as required.”

In other words, don’t trust the instruments and especially ignore the FD bars. The guidance does not seem particularly helpful to pilots in extremis. Surely, this is an interim “remedy.”

Replacement of Thales pitots with BF Goodrich probes was supposedly done to increase resistance to icing

Replacement of Thales pitots with BF Goodrich probes was supposedly done to increase resistance to icing

As a first order of business – not yet undertaken by regulatory authorities in Europe – a two-stage heat selection for the pitots is needed. In the case of AF 447. cruising at high altitude for long periods, in clouds composed of supercooled ice crystals, the present heating formula no longer works. The rate of cooling exceeds the ability of the heater to keep the pitot head warm enough to stop ice from entering and ultimately blocking the pitot tube – leading to erroneous speed readings (slower than the airplane is actually flying). What’s needed is a stepped heating arrangement, either automatic or pilot selected (preferably automatic/barometric with a manual back-up) to bump the amps up to a higher rate of heating. This could be done via an altitude switch or via an outside air temperature (OAT) threshold.

Second, if speed diverges among the three pitots, and the flight control system passed into direct law (with reduced controllability), did an aural stall warning cover up a shift in the flight control laws, such that the crew was not aware of this change? If so, there is a lot more corrective work than the admonition “Do not follow the FD orders.”

The fatal crash into the Mediterranean of an XL Airways Germany A320 in November 2008 is very relevant as far as susceptibility of flight control protections. The BEA (Bureau d’Enquêtes et d’Analyses pour le Sécurité de l’Aviation Civile) produced a report that focused an the air data inertial reference unit (ADIRU) following recent similar Qantas incidents on A330s exhibiting sudden uncommanded maneuvering. The BEA report showed that the A320 crew lost control of the aircraft while conducting a planned test of low-speed flight characteristics and protection laws at low altitude.

The A320 was descending through 3,000 feet on full autopilot when the speed dropped from 136 knots to 99 knots in the span of 35 seconds. The stall warning sounded four times during violent maneuvering inputs to regain control. Within 90 seconds the warning had silenced as the aircraft regained speed in a rapid descent. However, six seconds later, at 263 knots, the aircraft was passing through 340 feet of altitude in a steep 14 degree nose-down rolling attitude. A second later it was in the water.

The flight occurred immediately following light maintenance and repainting to Air New Zealand livery.

BEA investigators found that the primary cause of the accident was incorrect maintenance rinse-down procedures that allowed water to enter the angle of attack (AOA) sensors. The water then froze in flight, rendering the sensors inoperative. With inoperative AOA sensors, a quintessential protection provided from the aircraft’s flight management system was removed.

When the crew attempted an improvised test of the AOA warning system (which was not functioning due to the ice-blocked sensors) they quickly reached loss of control. The crew was unaware that the AOA sensors were blocked and that the Airbus fly-by-wire protection laws would change.

Usually, it’s the electrics that have the potential for wreaking havoc with aircraft systems. However, as AF 447 and numerous prior crashes have proved, ice can create a sensor-based pneumatic maelstrom. The ensuing confusion generated in a cockpit by conflicting instrument data, aural alarms, and perplexing control responses, can lead to a downward spiral. Ice in the sensors is obviously an Achilles Heel that has yet to be armor plated. The stepped heating proposed as the first order of business above seems paramount. Warnings in the flight manual to ignore the FD bars on the instruments seem decidedly insufficient.

Effective date of the AD is 9 February 2011.

Comments due 11 March 2011. Note that comments can be received after the effective date, a hint at the urgency of the mandated action. The FAA obviously considered it important to follow the EASA AD, with minor administrative changes, with only 15 days advance notification (25 Jan. – 9 Feb.).


24 January 2011                   FAA

Special Airworthiness Information Bulletin (SAIB) CE-11-18

Subject: Stall Warning Characteristics in Icing Conditions

This non-mandatory SAIB urges operators of older utility and commuter (Part 23) airplanes to add an increment of speed in icing conditions. Prior to 1973, there were no requirements to test these airplanes in icing conditions, and the stall warning systems may not give indication of an impending icing-induced stall. Moreover, only since 2000 have aircraft been certificated for flight in icing. Therefore, at least a 25% speed increment should be added when flying these older aircraft in icing conditions.


The FAA says:

“At this time, this airworthiness concern is not considered an unsafe condition that would warrant an airworthiness directive (AD) action under Title 14 of the Code of Federal Regulations (14 CFR part 39).”

The FAA goes on to say:

Airplanes Not Certificated for Flight in Icing: In-flight icing accidents and incidents involving these airplanes have outnumbered those on icing certificated airplanes in recent years. Pilots of these airplanes should be aware that these airplanes are not tested for ‘inadvertent’ icing encounters. Do not believe the myth that ‘thicker’ general aviation airfoils are more tolerant of ice accretion. FAA research has dispelled that myth, as described in Advisory Circular 20-73A. The variability of icing conditions means that your next inadvertent encounter may not have the same outcome as your last one.”

The “outcome” referred to is a crash.

Former FAA official and icing expert John Dow applauds this belated guidance:

“This SAIB offers sound advice and is a great start not only for Part 23 airplanes, but hopefully something quite similar will be considered for smaller Part 25 [transport category] airplanes. Many have airfoils that are similar to their slightly smaller cousins, are equipped with similar ice protection systems, and have service histories that also warrant scrutiny. Glad to see the reference to maximum speeds – should keep pilots out of range (for a few type designs) with respect to increased risk of tailplane stall. The cutoff date of 2000 is a puzzling choice and no airplanes have been certificated to freezing rain or freezing drizzle.”

Operators of Part 23 airplanes are encouraged to report environmental icing incidents to the Aviation Safety Reporting System (ASRS).

Comments are closed.

Nolan Law Group