Abnormals I — The Probe-Heat Failure Family

Twelve ECAM alerts belong to probe heat, and they form the most reasoning-dense family in ATA-30 — because what they treat is not a broken heater wire but the data that a heaterless probe might soon corrupt. Every step of every procedure answers the same question: of the sources that remain, who can still be believed? And the family's darkest insight lives in a level-2 note: two probes icing together, wrong in the same way, can get the only truthful source voted off the aircraft. Systems background is article 04; the wing/engine families follow in article 12.

1. The map: four tiers, one family rule

And the family's universal first move, wherever an action exists at all — PROBE/WINDOW HEAT to ON — is not a ritual. Per the FCOM anti-ice abnormals:

In some failure conditions, probe heating may be recovered.

The automatic chain (LGCIU and EIU discretes, relay logic — article 04) can fail in ways that merely withhold heating; the ON position is a direct order that bypasses the automatics. The alert may mean a broken command chain, not a burned element — try the cheap fix first.

2. Single probes: swap and carry on

A single heater lost on the captain's or first officer's side draws one action line — air-data switching to the third source — with the effect spelled out:

ADR 3 supplies data to PFD 1 and ND 1.

(F/O side: F/O ON 3, feeding PFD 2 and ND 2.) Mind the conditional in the procedure's own line — IF ADR 3 AVAIL AND NOT USED — one spare source cannot serve two customers. Escalation hides in the fine print: only for a pitot heat fault, and only when the other two ADRs are already failed or off, does "icing expected" arm the unreliable-speed procedure — a single static port or AOA vane never forces that far (each side carries two statics, and AOA has its own voting). The standby tier is even calmer — switching as required, plus one line of situational awareness:

If STBY instruments are used, monitor air data information.

(Article 04's cornerstone looms behind it: ADR 3 and the standby instruments share probes — "the standby isn't".) The TAT pair are the family's only zero-action alerts: heat lost in flight is a status entry; and the ground variant — TAT HEATED ON GND — inverts the logic: a probe being warmed when it must not be means its reading is already unreliable (article 04 §3).

3. Pairs and the "coherent but incorrect" ghost

First read the machinery note that motivates the whole tier. For a failed AOA pair, per the FCOM anti-ice abnormals:

In the case of simultaneous AOA probes icing and if the AOA probes are blocked at the same value, ADR 1 and ADR 2 AOA values will be coherent, but incorrect. Therefore, flight controls will consider the remaining correct source as being faulty, and will reject the only correct source. The following ECAM procedure avoids that the flight controls use two erroneous, but coherent, AOA sources.

[!warning]- The Achilles heel of voting Fault accommodation is majority rule — per the FCTM, The fault accommodation logics rely on a voting principle: When the data provided by one source diverges from the average value, the systems automatically reject this source. Majority rule presumes the wrong ones are the minority. Freeze two probes at the same value and the wrong ones are the majority — the honest third source gets expelled. The procedure's counter-move is to fix the election: shed one of the two suspect ADRs before (or as) they start lying, so no wrong pair can ever outvote the survivor, and the disagree monitors regain their meaning. Which one to shed is not your problem — per the procedure, Depending on the status of the static, pitot and TAT heating, the procedure requires that either ADR 1 or 2 be switched OFF — the ECAM reads the heating states and names its choice. The safety net behind it: In the case of subsequent, significant, AOA discrepancy between the two remaining ADRs, the NAV ADR DISAGREE or NAV AOA DISAGREE alert will trigger.

The pitot pairs run the same script with speeds as the commodity (ADR 1 and ADR 2 speeds will be in agreement, but incorrect…) — plus one branch that deserves its own frame. When the third ADR is already failed or off:

No action is required, as long as there are no icing conditions, in order to keep two independent speed sources.

[!warning]- Same failure, opposite actions — the weather decides With icing: shed one of the pair (the coherent-lie defence). Without icing: shed nothing. The risk arithmetic is exact: a dead heater does not corrupt data by itself — absent ice, both suspect sources are still good sources, and with only two ADRs alive, shedding one would mean flying on a single uncrosscheckable source. Two doubtful-but-independent witnesses beat one unexamined one. Only when icing is expected does the balance flip: shed one, and stand ready for unreliable speed.

ALL PITOT HEAT climbs the whole ladder: pushbutton → shed one ADR by name → icing expected: shed a second → and the last rung is stated plainly:

Only one ADR is available, and the corresponding pitot probe may be affected by ice accretion. Be prepared to use the UNRELIABLE SPEED INDICATION procedure (Refer to PRO-ABN-NAV Unreliable Speed Indication - Memory Items).

The associated-procedures block names the constitutional cost. Alternate law becomes active if One ADR was already switched OFF, and the two remaining ADRs are not in agreement, or — completing the sentence — Two ADRs were switched OFF. Shedding the second ADR is a deliberate walk into alternate law (protections lost): the procedure would rather surrender normal-law protections than let the flight controls dine on a coherent false airspeed. Data integrity outranks automation integrity — the post-AF447 constitution in one trade.

4. Unreliable speed: pathology, symptoms, two temperaments

The FCTM's diagnosis chapter starts with the culprit and the reassurance:

The most probable reason for erroneous airspeed and/or altitude information is an obstruction of the pitot and/or static probes.

It is highly unlikely that the aircraft probes will be obstructed at the same time, to the same degree and in the same way. Therefore, the first effect of erroneous airspeed/altitude data in the cockpit will most probably be a discrepancy between the various indications (CAPT PFD, F/O PFD and STBY instruments).

(That second sentence is simultaneously the sales brochure for article 04's three-channel architecture and the reason §3's simultaneous, same-value icing is treated as a designed-for exception.) The blockage taxonomy, condensed from the FCTM's failure-case table:

Total pressure blocked. Constant IAS in level flight, until obstruction is cleared. In climb, IAS increases. In descent, IAS decreases.

[!warning]- A fully sealed pitot turns the ASI into an altimeter Trapped total pressure is constant; static keeps changing with altitude — so indicated airspeed rises in a climb and falls in a descent, with the autopilot and autothrust chasing the phantom (pitching up in open climb to hold a "rising" speed, and the reverse going down). Accelerating in the climb is not performance — it is a dead probe. Pair it with "constant IAS in level flight" and "IAS falls in descent" for the three-view portrait.

Service history gives the two temperaments — worth quoting because they shape your patience:

The majority of unreliable speed events at low altitude are permanent situations, due to the obstruction of pitot probes by rain, severe icing, or foreign objects (refer to the table above).

At high altitude, typically above FL 250, the cases of unreliable speed situation are mostly a temporary phenomenon: They are usually due to contamination of the pitots, by water or ice, in particular meteorological conditions. In-service experience shows that such a contamination typically disappears after few minutes, allowing to recover normal speed indications.

Low means lasting; high usually heals in minutes — and the high-altitude culprit is article 10's ice crystals wearing their air-data mask. Trigger discipline: run the drill when the ECAM demands it (the UNREL SPD PROC line rides on NAV ADR DISAGREE and on this family's pitot alerts) or on your own suspicion — discordant, fluctuating or simply unbelievable indications. And time the verdict fairly — per the FCTM, the flight crew should only assess the reliability of the air data sources when the aircraft trajectory and configurations are stable (manoeuvre and configuration changes jostle the probes' airflow all by themselves).

The identification toolkit is the QRH's air-data check: probe/window heat on, then crosscheck all speed indications — reading the results through article 04's cornerstone, ADR3 and STBY speeds use the data of the same probe: standby agreeing with ADR 3 is one vote written twice, not two votes. The deepest cut of the family (triple-ADR fault with AOA heating failed) escalates past switching entirely: at least two AOA heaters failed puts all three ADRs off and the flight on the backup speed scale, with the note — ADR3 and STBY speeds use the data of the same probes. Therefore, standby instrument must be used with care.

5. When the electrics decide whom to believe

Degraded electrical configurations rewrite the trust map, because heating follows the surviving buses (article 01: captain + standby pitot/AOA are the emergency survivors). The electrical abnormals then instruct, on a discrepancy:

In case of discrepancies between airspeed indications on captain PFD and on standby indicator, disregard standby indicator (Probe not always deiced: refer to ELEC EMER CONFIG SYS REMAINING).

And the smoke procedure's deeper electrical isolation goes further:

If this electrical configuration is maintained, the Captain's Total Air Temperature and angle-of-attack, standby angle-of-attack, and pitot are not deiced. PFD1 and STBY instruments may display erroneous data in icing conditions. Use PFD2.

[!warning]- Trust follows the wiring, not the seat Normal-day seniority (captain first, standby as referee) is void under electrical reconfiguration: whichever side keeps its heaters keeps your belief — and in the smoke case that is the first officer's side, standby included in the distrust. Sequence for any degraded-power icing scenario: first establish who still has heat (the systems-remaining table), then decide whose display to fly.

One more liftoff-minute item closes the family from the outside. Spurious stall warnings right at rotation, per the FCTM: Damage to the AOA probes ‐ Ice Ridges degrading pitot and AOA ‐ Wake Vortex. The middle culprit is article 08's meltwater ridge grown upstream of the probes — heating all healthy, airflow already poisoned. Not every probe problem announces itself through a heat alert.

6. The family drill, distilled

Facing any probe-heat alert: (1) pushbutton ON — cheapest possible cure; (2) switch or shed as the ECAM names — it can read the per-probe heating states, you cannot; (3) ask the weather question — the same failure differs by icing versus none (§3's fork); (4) pre-arm the unreliable-speed memory items whenever the ladder leaves you near a single believable source. Dispatched-with-a-dead-heater flights fold in from the other side — the operator's dispatch procedures pre-position the source switching at cockpit preparation and, on meeting icing in flight, shed the affected ADR for the remainder of the flight (article 13); an airborne heat alert then stacking onto the dispatched one is handled as the corresponding pair.

Self-test

[!note]- Q1. Why does every actionable probe-heat procedure begin with PROBE/WINDOW HEAT ON?

Because in some failure conditions, probe heating may be recovered — the fault may sit in the automatic command chain (air/ground and engine-running discretes, relays) rather than the heater. ON is a direct order past the automatics: the cheap fix first.

[!note]- Q2. Tell the "coherent but incorrect" story and the procedure's counter-move.

Two same-side-of-pair probes icing simultaneously and freezing at the same value make two ADRs agree on a lie; the voting logic then expels the honest third source. The counter: shed one of the suspect pair (the ECAM names which, from the heating states), so no false majority can form — with the DISAGREE alerts as the net beneath.

[!note]- Q3. Pitot pair failed, ADR 3 already dead, sky clear of icing. Action?

None — deliberately. Without ice the data is still good, and shedding would trade two independent (if suspect) sources for one uncheckable one. Only "icing expected" flips it: then shed one and arm the unreliable-speed drill. Two doubtful witnesses beat one unexamined one.

[!note]- Q4. Which two situations put you in alternate law at the end of the ALL PITOT ladder — and why is that a choice?

One ADR already off with the remaining two disagreeing; or two ADRs off. The procedure accepts protection loss on purpose: better alternate law on honest data than normal law fed a coherent false airspeed. Data integrity outranks automation integrity.

[!note]- Q5. Fully sealed pitot: give the three-view signature.

Level: IAS frozen constant. Climb: IAS rises (trapped total vs falling static). Descent: IAS falls. With AP/FD/autothrust chasing the phantom — "accelerating in the climb" is a dead probe, not performance.

[!note]- Q6. Low-altitude versus high-altitude unreliable-speed events — temperaments and implications?

Low: mostly permanent (rain, severe icing, foreign objects) — plan around a lasting failure. High (above FL 250): mostly transient pitot contamination that clears within minutes — typically the ice-crystal signature. Assess only with trajectory and configuration stable.

[!note]- Q7. In the smoke procedure's electrical configuration, why "use PFD2" — against every habit?

That configuration leaves the captain's TAT/AOA/pitot and the standby AOA un-deiced; PFD1 and standby may lie in icing. Trust follows the wiring: whichever side keeps its heat keeps your belief — here, the F/O's.

Key takeaways

References

Alert triggering statements, heating-recovery note, source-switching lines and effects, TAT alert pair, pair-failure machinery notes for AOA and pitot, ECAM shedding designation and DISAGREE nets, keep-two-sources branch, ALL PITOT ladder with unreliable-speed readiness and the alternate-law conditions per the FCOM anti-ice abnormal procedures. Voting principle, obstruction pathology and failure-case table, service-history temperaments and stability discipline per the FCTM navigation abnormal chapter; liftoff spurious-stall causes per the FCTM miscellaneous chapter. Air-data check sequence and shared-probe sentence per the QRH; triple-fault AOA branches and standby caution per the FCOM navigation abnormal procedures; standby-disregard and PFD2 instructions per the FCOM electrical and smoke procedures. Dispatch pre-positioning reflects some operators' MEL practice (article 13). The four-tier map, the election metaphor and the "two doubtful witnesses" framing are integrative syntheses of the referenced material.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.