Introduction: The Critical Role of the Pitot-Static System

The pitot-static system is the backbone of an aircraft’s airspeed, altitude, and vertical speed indication. In the Airbus A350, as in all modern airliners, these parameters are fed into the flight computers, autopilot, flight director, and multiple other systems. When this system fails—whether through ice, blockage, or sensor malfunction—the resulting “unreliable airspeed” and “unreliable altitude” warnings demand immediate, correct action from the flight crew. This article expands on the emergency procedures for pitot-static system failures in the Airbus A350, covering the deeper technical context, exact ECAM drill steps, manual flying techniques, and the importance of recurrent training. By understanding not just the checklist but the underlying physics and redundancy, pilots can maintain safe control even in degraded conditions.

How the Pitot-Static System Works on the A350

Basic Principles

The pitot-static system relies on two types of pressure: pitot pressure (dynamic pressure from forward motion) and static pressure (ambient atmospheric pressure). The difference between these two—the dynamic pressure—drives the airspeed indicator. Static pressure alone determines altitude and vertical speed. On the A350, these pressures are captured by multiple independent pitot probes and static ports, located on the fuselage and nose section.

A350 Redundancy Design

The A350 boasts a triple-redundant pitot-static architecture. Three pitot probes feed into three Air Data Modules (ADM), which in turn supply data to the three primary flight computers (PFCs). In parallel, the aircraft carries a separate standby instrument system (Integrated Standby Instrument System, or ISIS) powered by a dedicated air data module. This design means a single pitot-static failure rarely results in total loss of information, but a common-mode failure—such as ice covering all probes simultaneously—can render all primary air data unreliable.

External resource: Learn more about Airbus pitot-static system architecture from Airbus official A350 page.

Common Causes of Pitot-Static System Failures in the A350

Ice or Freezing Conditions

The most frequent cause is ice accretion blocking the pitot probes or static ports. The pitot heat system is designed to prevent this, but if activated too late or if the aircraft encounters supercooled large droplets (SLD) exceeding certification criteria, ice can form rapidly. A350 operators have reported incidents where pitot heat was inadvertently turned off during maintenance or where a faulty heater element allowed ice to build.

Blockage by Debris

Insects, dirt, or even FOD (foreign object debris) can block static ports or pitot tubes during ground operations. Although covers are used, cases of human error—forgetting to remove covers before flight—still occur. Such blockages cause immediate erroneous readings on takeoff.

Sensor or Electrical Failure

While rare, a failed Air Data Module or wiring fault can introduce false static pressure. The A350 flight computers compare the three ADM outputs; if one deviates significantly, it is rejected. However, a failure that affects all three via a common electrical bus can trick the system into accepting wrong data.

Physical Damage

Bird strikes, hail, or ground collisions can crack static ports or deform pitot probes. The A350’s composite fuselage is robust, but static ports are vulnerable low on the fuselage.

External resource: For a deeper technical analysis of air data failures, refer to the SKYbrary article on Pitot-Static System Failure.

Detection and Alerts in the A350

Warnings and ECAM Messages

When the A350 detects that air data from two of the three ADMs disagree, or if the data exceeds realistic thresholds, the following ECAM caution or warning messages appear:

  • “AIRSPEED UNRELIABLE”
  • “ALTITUDE UNRELIABLE”
  • “VERTICAL SPEED UNRELIABLE”

The autopilot and autothrust will typically disconnect if the data is too inconsistent. The Captain’s Primary Flight Display (PFD) may show red X’s over the speed tape or altitude tape, or the bars may show wildly fluctuating values.

Cross-verification with Standby Instruments

The A350’s ISIS provides an independent airspeed, altitude, and vertical speed indication. It uses its own pitot-static probe and does not depend on the primary ADMs. Pilots are trained to immediately cross-check the ISIS when any unreliability warning appears. If the ISIS also shows erratic data, then the failure is likely a common-mode or the ISIS itself has failed.

Immediate Actions: The Unreliable Airspeed Drill

Primary Goal: Maintain Aircraft Control

Upon detecting an unreliable airspeed or altitude warning, the first priority is manual control of the aircraft. The A350’s fly-by-wire system automatically switches to alternate or direct law if valid air data is missing. In direct law, protections are reduced—pilots must fly pitch and power using basic pitch attitude and thrust settings.

Step 1: Disconnect Autopilot and Autothrust

Even if the autopilot appears to still be engaged, it may be using faulty data. The QRH (Quick Reference Handbook) directs the pilot to:

  1. Set the FD (Flight Director) switches to OFF.
  2. Engage the PF (Pilot Flying) in manual control.
  3. Set thrust levers manually to a known setting (e.g., CL detent for climb, or a specific N1 percentage).

Step 2: Set a Known Pitch Attitude

One of the most effective techniques is to use known pitch and power combinations (often called “advisory pitch/power tables”) derived from the A350 Flight Crew Operating Manual (FCOM). For example:

  • For climb: pitch 10° nose up, thrust 85% N1 (approximate).
  • For level flight: pitch 2.5° nose up, thrust 55% N1 (varies with weight).
  • For approach: pitch 5° nose down, thrust 40% N1.

Pilots must use the standby altimeter and standby airspeed indicator to fine-tune these values.

Step 3: Conclude the Drill Using the QRH

The A350 QRH contains a dedicated “Airspeed Unreliable” procedure. This includes actions such as:

  • Selecting the “Air Data Reference” page on the MFD to compare all three ADMs.
  • Selecting the alternate static source if altitudes are obviously erroneous (limited use, but can restore static pressure in case of blocked static ports).
  • Optionally, turning on ALL pitot heat, even if already on, to confirm.

The flight crew must not attempt to troubleshoot excessively; the goal is to fly the aircraft and then divert to a suitable airport if conditions deteriorate.

Further Steps: Alternate Static Source and Manual Flying

Alternate Static Source Activation

On the A350, the alternate static source valve is located on the overhead panel. Opening it draws static pressure from inside the cabin, which can help if the primary static ports are blocked by ice or debris. However, note that cabin static pressure is lower than ambient, so opening it will cause erroneous altitude and airspeed initially. Pilots must apply correction factors (typically +30 ft and +2 kt) but these corrections are only approximate. The alternate source should only be used if the crew is absolutely certain the primary ports are blocked and if the ISIS data is also suspect.

Manual Flying with Reduced Protections

Without reliable airspeed, the A350 flight computers may revert to “Alternate Law” (Normal Law with some protections lost) or even “Direct Law” where pitch and roll inputs give direct control surface commands. In direct law, the computer will no longer impose stall or overspeed protection, so pilots must avoid extreme attitudes. Speed management is done by listening to aerodynamic cues (stick shaker activation, buffet, engine noise) and by using the pitch and power table. Some A350 operators equip their aircraft with an additional standalone airspeed indicator (like a small strapped-on tablet) as a backup—though this is not standard.

External resource: The EASA guidelines on unreliable airspeed events provide further operational context.

Training and Preparedness: Recurrent Simulator Sessions

Airline training programs dedicate significant time to pitot-static failures. During type rating and recurrent checks, every A350 pilot must demonstrate:

  • Recognition of unreliable airspeed from ECAM warnings and instrument discrepancies.
  • Immediate transfer to manual flight with correct pitch and power settings.
  • Effective crew coordination: PM (Pilot Monitoring) running the QRH while PF flies.
  • Use of standby instruments and backup air data.
  • Decision-making: when to divert, alternate airport selection, and communication with ATC.

Some operators also include scenarios where both pitot heat switches are off (simulated forgetting to turn them ON before flight). The key learning is to not rely solely on the automated systems; basic airmanship is paramount.

Real-World Incident: Air France 447 and Lessons Applied

While not an A350 incident, the Air France 447 accident (in ice conditions that caused pitot icing on a different Airbus model) reshaped the entire industry. The A350’s design incorporates those lessons: better pitot heat monitoring, improved stall warning logic, and dedicated QRH procedures for airspeed unreliable. The A350 crew is trained to maintain pitch and power even if all airspeed indicators disagree, and to never climb aggressively if uncertain of speed.

Conclusion

Emergency procedures for pitot-static system failures in the Airbus A350 are built upon decades of incident analysis and robust engineering. The redundancy in both hardware (three ADMs plus ISIS) and training (pitch/power tables, manual flying drills) ensures that even if the primary air data disappears, the crew can safely control the aircraft. The key takeaways are: recognize the warning early, maintain control through pitch and power, cross-check with standby instruments, and consult the QRH for confirmatory actions. With diligent recurrent training, every A350 pilot is well-prepared to handle this critical emergency.

External resource: For additional reading on A350 systems, consult Flying Magazine’s A350 pilot report or the official Airbus A350 product page for system diagrams.