Pilots’ Reaction in Severe Icing Too Late To Avoid Crash

The safety mantra: anti-icing ON, autopilot OFF, speed UP, get OUT of icing

The basic procedures necessary to cope with in-flight icing continue to be re-learned the hard way – with dead aircrews and wrecked airplanes.

The basic aircraft certification standards do not protect against freezing precipitation. Procedures required by airworthiness directive also may be inadequate, as evidenced by the toll of dead pilots and shattered airplanes

One of the more recent examples concerns the fatal crash Dec. 21, 2002, of a Trans Asia Airways (TNA) ATR-72 twin turboprop into the waters of the Taiwan Strait. The airplane, configured to carry cargo (textiles, leather products and electronic items on the accident flight), encountered severe icing while cruising at 18,000 feet some 30 minutes into the two and a half-hour night flight from Taipei to Macau. The accident sequence unfolded in the space of some 18 minutes – from first indication of icing to impact. It went from concern to outright alarm in much less time. Only two minutes separated the crew’s first mention of severe icing to the sound of stall warning and stick shaker. The rapidity with which the aerodynamics degraded indicates how quickly a routine flight characterized by crew quotidian comments on the quality of their box lunches can turn into a desperate loss-of-control situation.

The case is being investigated by the Aviation Safety Council (ASC) of Taiwan, with participation by ATR (Avions de Transport R�gional), the aircraft manufacturer and, as accredited representative, the Bureau Enquetes-Accidents (BEA), the French accident investigation board. The ASC had earlier issued a safety bulletin calling on operators worldwide to reinforce proper crew responses to flight in icing conditions. In a transcript of the cockpit voice recorder (CVR), the two pilots – Capt. Pan Teh-chung, 54, and First Officer Liu Ching-hai, 34, knew their speed was bleeding off and a “big chunk” of ice was observed on the ice probe located just outside the captain’s port window.

After 10 months of investigative digging, on Oct. 28 the ASC released more than 300 pages of factual data surrounding the case. The final report is not expected to be published until late 2004.

The factual reports just issued add significant details to the preliminary accounts of the crash.

It would appear that the crew unknowingly flew into severe icing conditions and may have been late taking precautions. As a general statement, by the time controllability symptoms appear in icing conditions, urgent action may be necessary, such as a maximum-rate descent to get to warmer air below the icing. Such action would have the added benefit of getting to a lower density altitude, where additional thrust is available to offset increased drag from ice accretion and thus increase the stall margin.

To develop this picture, weather reports reviewed by the crew before their departure from Taipei’s Chiang Kai Shek International Airport on the nightly cargo run (flight GE791) to Penghu, Macau, advised of rain but made no mention of icing. The significant weather chart – SIGWX – generated by Taiwan had no indication of moderate icing, although it was mentioned in SIGWX reports generated at Hong Kong and Naha, Okinawa. Severe icing had not been observed and was not forecast.

About a half-hour into the flight, the airplane’s ice detector alerted. The alert occurred about two minutes after the crew first noticed ice on the airplane. Airframe de-icing was activated, from local time 0134 to 0137, a brief period of about three minutes. A four-minute gap followed, when the airplane was flying in icing conditions with the de-icing system turned off. Airframe de-icing was then turned back on, from time 0141 until some 11 minutes later, when the flight data recorder (FDR) ceased functioning.

Until the final moments of the flight, when a cacophony of alarms sounded, the crew continued the flight on autopilot. In previous icing-related accidents, crews flying on autopilot have been lulled by nil apparent degradation of flying qualities as the autopilot silently worked to maintain its prescribed parameters. In this case the crew kept the autopilot on as speed slowed below the minimum for icing conditions, and even as speed slowed below the minimum for severe icing conditions.

Following the fatal Jan. 19, 1997, crash of a Comair EMB-120 twin-turboprop in icing conditions at Monroe, Mich., the U.S. National Transportation Safety Board (NTSB) recommended that pilots should disengage the autopilot whenever anti-icing systems are activated. At the very least, frequent periodic manual flying can provide tactile cues to the airplane’s handling characteristics, and certainly by getting the autopilot out of the “altitude hold” mode, it would not automatically trim nose-up.

In May 1999 ATR issued a number of updated changes to the airplane flight manual dealing with operation in icing conditions. The procedures and limitation were explicit, and made a number of essential points. They included (and were not limited to): adding a 10-kt. speed margin, activating anti-ice systems until the aircraft is clear of ice (emphasis added), turning off the autopilot and exiting the icing conditions as soon as possible.

The GE791 crew had added 10-knots to the airplane’s target cruising speed, as called for when flying in icing conditions. It does not appear that they performed the other actions required, although 28 seconds before the stall warning and stick shaker activated, the anxiety on the captain’s mind is evident from his urging the first officer to radio a request to air traffic control [ATC] for an immediate descent from 18,000 feet to 16,000 feet.

“Down, down, down, down, down, notify them quickly,” the captain urged.

“Do you see that? It’s severely iced up,” he said moments before the airplane rolled beyond 60� angle of bank and spun into the water.

It was the first fatal accident in icing conditions for the ATR-72 since the 1994 crash at Roselawn, Indiana. In the period in between, manufacturer ATR had modified the flight manual to more explicitly caution crews about the airplane’s limitations in icing, and ATR had redesigned the wing de-icing boots to extend further back on the wing, from seven percent of the wing chord to 12.5 percent. The TransAsia Airways ATR-72 had been outfitted with the larger wing boots.

After the GE791 accident, ATR conducted a number of flight simulations to assay the circumstances surrounding the loss. In a June 2 report to the ASC, the French manufacturer cited “non-compliance by the crew of the icing speeds led the aircraft to attitudes where, on wings polluted by severe ice, aerodynamic anomalies occur.”

ATR noted that the crew was able to arrest the deteriorating speed by turning on the anti-icing system, but by then turning the anti-ice system off, the “expected nominal speed was not completely recovered.”

The ATR analysis concluded that it was way late in the sequence when the crew finally established the relationship between ice on the airplane and its decaying speed.

On Dec. 5, 2002, just 16 days before the crash, ATR issued a worldwide reminder to its customers of winter operations, and a number of icing events in which ATR-42 and ATR-72 crews had not followed necessary procedures. The ATR-72 is a stretched version of the ATR-42. Continuous “situational awareness” and “an accurate compliance with established procedures” are necessary to prevent a recurrence of “such undesired icing reports,” the ATR reminder said.

Outside the envelope

But the ATR reminder also mentioned the larger problem: aircraft are not certified to cope with severe icing, notably supercooled drizzle drops (SCDD). At temperatures near freezing, the drops do not necessarily freeze on impact, but run back along the surface and freeze. This process accelerates the adverse effects, since droplets hitting within the protected part of the leading edge of the wing run back and form ice aft of the boot. Significantly, more ice can accrete than would be the case if the droplets hit and froze on impact.

“Please ask your pilots to pay the most possible care in watching and detecting conditions which could exceed the certification standards and have to be escaped/avoided when inadvertently encountered,” the ATR note advised.

Ice from SCDD is characterized by rapid accumulation of large droplets. Even enlarged de-icer boots may not shed all of it, as the ice tends to slap and stick all over (including wing areas behind the boots). For a turboprop, which flies at altitudes where SCDD can occur, the accumulation of a coat of thin, rough ice can impose severe aerodynamic penalties. Those penalties take the form of as much as a 25 percent increase in stall speed and hence a reduced stall margin, increased drag requiring either a huge increase in engine power to sustain flight or increased angle of attack (AOA) if excess thrust is not available. The higher AOA may exceed the new iced stall angle and cause a change in section of the tailplane due to the changed airflow over it.

On the night of the flight GE791 accident, the weather was a little unseasonable, because snow fell on the higher Taiwanese mountain areas. The weather reports indicated the conditions were conducive to SCDD. These factors suggest that the GE791 crew may have been up against the worst kind of icing for turboprops, which often occurs at altitudes where turboprops typically fly. Moreover, with reduced visibility at night, crews very quickly can pick up ice-loads that would alarm them if the buildup occurred during daylight.

Special certification review

Following the Roselawn crash, and at the instigation of the NTSB, the U.S. Federal Aviation Administration (FAA) convened a special certification review (SCR) of the ATR-72. The SCR report concluded that SCDD icing is outside the envelope of icing types for certification purposes, and that “these conditions may not be as infrequent as commonly believed and that accurate forecasts of SCDD conditions do not have as high a level of certitude as other precipitation.”

The SCR posed two options: (1) the airplane “must be shown to be free from any hazard due to an encounter of any duration” with the SCDD environment, or (2) the pilots need “a positive method of identifying when the airplane has entered SCDD, and their airplane must be able to operate safely in that regime long enough to identify and safely exit the condition.”

Presently, neither condition applies. According to sources, the certification standards for flying in icing conditions have not been expanded to cover SCDD. Relying on the accuracy of weather forecasts (or forecasters) and pilot discretion when assessing the likelihood of a medium-altitude encounter with freezing precipitation may be akin to dicing with death. The SCR suggested that the ability of airframes and engines to handle icing conditions needs to be designed into turboprop aircraft, because they fly at intermediate levels where icing is likely to be encountered for long periods in cruise.

It may be possible to equip pilots with additional tools for coping with ice.

The present situation could be likened to the optimism of a spearfisherman snorkeling along a reef and trailing his catch from his weight belt – in an area known for sharks. The regulatory effect of what has not been done since the Roselawn accident is equivalent to requiring the spearfisherman (i.e., pilots) to ask (the weatherman) if any sharks (SCDD) have been seen in the area, carry a knife (emergency exit procedures) and to keep a good lookout.

The ASC documents point to the shortcoming in certification standards for turboprop operations in icing conditions, and some of its strongest recommendations may require future turboprop aircraft to be certified capable of coping with SCDD. In fact, the acronym could well stand for Safety Compromising Deadly Danger. It lurks just outside of the current certification envelope, reaching out and striking down those pilots who aren’t quick enough to escape.

(ASW note: The various factual reports can be accessed at the ASC website: http://www.asc.gov.tw )

Flight in Freezing Drizzle is Prohibited

Advisory Circular No. 23.1419-2B, Certification of Part 23 [commuter category] Airplanes for Fight in Icing Conditions, Appendix 2 (extracts):

• Flight in meteorological conditions described as freezing rain or freezing drizzle … is prohibited.
• If the airplane encounters conditions that are determined to contain freezing rain or freezing drizzle, the pilot must immediately exit the freezing rain or freezing drizzle conditions by changing altitude or course.

NOTE: The prohibition on flight in freezing rain or freezing drizzle is not intended to prohibit purely inadvertent encounters … however, pilots should make all reasonable efforts to avoid such encounters and must immediately exit the conditions if they are encountered.

• CAUTION: Flight in freezing rain, freezing drizzle, or mixed icing conditions (supercooled liquid water and ice crystals) may result in hazardous ice build-up on protected surfaces exceeding the capability of the ice protection system, or may result in ice forming aft of the protected surfaces. This ice may not be shed using the ice protection systems, and it may seriously degrade the performance and controllability of the airplane.
• Do not engage the autopilot. The autopilot may mask unusual control system forces. Source: FAA

Limitations and Procedures, Icing Conditions

ATR-72 airplane flight manual (extracts):

Operation in icing conditions:

• ANTI-ICING (propellers, horns, side-windows): CONFIRM ON
• DE ICING ENG 1 + 2: ON
• AIRFRAME DE ICING: ON

Note: anti-icing selection triggers the illumination of the ‘ICING AOA’ green light, and lowers the AOS stall warning threshold.

Severe icing:

Unexpected decrease in speed or rate of climb.

Extensive ice accretion.

Actions:

Exit the severe icing conditions to avoid extended exposure to flight conditions more severe than those for which the airplane has been certificated.

Do not engage the autopilot.

If the autopilot is engaged, hold the control wheel firmly and disengage the autopilot.

If the flaps are extended, do not retract them until the airframe is clear of ice.

Immediately increase … the minimum maneuvering/operating speeds by 10 kt. Increase power up to MAX CONT if needed.

If unusual roll response or uncommanded roll movement is observed … [push] on the [control] wheel as needed, [extend] flaps to 15�, increase power, up to MAX CONT if needed. Source: ATR

Previous ATR-42 and -72 Incidents & Accidents (1994-2002) Events 1 & 8 were fatal accidents. Events 2-7 were nonfatal incidents
Event	1	2	3	4	5	6	7	8
Date	Oct. 31, 1994	Dec. 14, 1998	Jan. 7, 1999	Jan. 28, 2000	June 12, 2000	May 2, 2002	Dec. 10, 2002	Dec. 21, 2002
Model	ATR-72	ATR-42	ATR-42	ATR-42	ATR-72	ATR-42	ATR-42	ATR-72
Autopilot	ON	ON	ON	ON	ON	ON	ON	ON
Altitude	8,000 ft.	13,500 ft.	3,000 ft.	3,000-6,000 ft.	17,000 ft.	16,000 ft.	16,600 ft.	18,000 ft.
Airspeed	184 kts.	155 kts.	142 kts.	UNK	175 kts.	153 kts.	146 kts.	157 kts.
Flap posn.	15�	0�	30�	0�	0�	0�	0�	0�
Min. icing speed	157 kts.	148 kts.	118 kts.	148 kts.	155 kts.	153 kts.	154 kts.	166 kts.
Min. severe icing spd.	167 kts.	158 kts.	128 kts.	158 kts.	165 kts.	163 kts.	164 kts.	176 kts.
Angle of attack (AOA)	5.2�	11�	-1.2�	7�	5�	8�	10.4�	11.2�
AOA icing alarm threshold*	11.2� / 15.3�	11� / 21.5�	11� / 21.5�	11� / 21.5�	11.2� / 15.3�	11.2� / 15.3�	10.4� / 13.5�	11.2� / 15.3�
Visual cues reported	N/A	Side window cue	Side window cue	Side window cue	Side window cue	N/A	Side window cue	Side window cue
Flight phase	Initial descent after holding	Climb	Approach	Climb	Cruise	Capture cruise	Climb	Initial descent after cruise
Ice effects on aerody-namics	Aileron hinge moment reversal	Asym-metric stall	Elevator pitch down	No event	Asym-metric stall	Asym-metric stall w/ moderate roll	Asym-metric stall	Asym-metric stall
Ice protection system	Level III	Level III	Level III	Level III	Level II	Level III	Level III	Level III
Airframe de-icing activated	25 min.	12 min.	22 min.	8 min.	OFF	17 min.	12 min.	18.5 min.
A/C model hardware	Basic	CONF 1	CONF 1	CONF 1	CONF 1 + 2	CONF 1 + 2	CONF 1 + 2	CONF 1 + 2
Aircraft model procedure	Basic	PROC 1	PROC 1	PROC 1 + 2	PROC 1 + 2	PROC 1 + 2 + 3	PROC 1 + 2 + 3	PROC 1 + 2 + 3
Probable cause	Aileron hinge moment reversal after ice ridge formed aft of the de-ice boots.	Prolong-ed operation in severe icing for which A/C not certified.	Flight in severe icing for which A/C not certified.	Severe icing. Crew exited condit-ions.	Airframe de-icing OFF. Lost 25 knots followed by mild 15� roll.	Excess-ive AOA. Crew dropped nose and recover-ed.	Crew cont’d climb in severe icing. Stalled w/ roll.	Loss of control following stall. Still under investigat-ion.
Explanatory notes: *AOA icing alarm threshold: Two values are shown for the angle of attack (AOA)/stall protection (SP) system. The first is for icing conditions and the second for non- icing conditions, both cases in the same flap configuration. Level II: Anti-ice ON Level III: Airframe de-icing ON CONF 1 =External wing boots extended + flap extension allowed above VFE (flaps extended above placard speed) CONF 2 = Median wing boots extended + AAS (anti-icing advisory system) new flashing logic PROC 1 =Side window cue + Hold prohibited in icing with flap extended + exit and recovery procedures PROC 2 = Minimum icing + 10 knots when severe icing + new severe icing cues (e.g., decrease of speed or ROC) PROC 3 = De-icing ON at first visual indication of ice accretion and as long as icing conditions are present Source: ASC, Performance Group Report. AOA/SP footnote added by ASW.

Some Ideas and Concepts for Coping With In-Flight Icing

A simple warning system for severe icing: A warbler sounds if nose-up trim exceeds two units of travel while in unbanked cruise, as an indicator of ice build-up and compensating trim adjustment. The two units would allow for passenger movement to or from a lavatory aft.

Improved stall recovery training: A huge factor, which would arm pilots with the “muscle memory” to more effectively cope with icing-induced stalls. The captain at the controls of flight GE791 did not aggressively unload the airplane (drop the nose and reduce AOA), as evidenced by the elevator position captured on the flight data recorder.

A new emergency transponder code: The standard 7700 emergency squawk reverting after a minute to 7400 would immediately tell ATC the aircraft is iced up and about to enter an emergency descent and all aircraft at levels below should be cleared. Reluctance to act can mean the precipitation gets the icy upper hand.

Slippery stuff: A waxy/resinous coating might be employed as a wintry semi-permanent de-icer. This Teflon-like non-stick surface coating would be sprayed seasonally on upper surfaces and leading edges of the wings, nacelles and tailplane. Adding little weight or drag, the coating would limit the amount of ice that could build up (before departing due to lack of stiction). Add a color marker. The colored wax would be seen to be present, and a significant loss of color would indicate an ice buildup beyond the capability of the debonding wax agent – thereby predicating an urgent descent escape. A new range of environmentally friendly methyl carbitol-based range of waxes, resins and film depositions may be suitable. It should be possible to find a suitably slippery coating that can stop lethal buildups of SCDD ice over the whole airframe.

It should be noted that this concept has been seriously explored, although not with some of the new coatings alluded to above. The paradox of Teflon is that when supercooled liquid water strikes, the liquid forms ice in the “pores” of the Teflon. By far the biggest problem is that coatings analyzed to date can erode in the rain. The use of coatings has been encouraged by the FAA but are not allowed for certification purposes, as an effective means of determining if the eroded coatings are still effective, and for how long.

Thermal laser wiping: The theory is that a twin laser unit sits atop the cockpit of a high-wing turboprop (and another under the nose of a low-wing turboprop) in an ice- guarded rear-facing cupola. It is memory-mapped with the airplane’s anatomic profile.

The low-power laser continuously measures (via a mensuration mapping software program) the aircraft’s profile, until it detects an anomaly associated with ice accretion. With the high-power laser armed by the ice-detector, it then commences thermal lasering of the aircraft’s leading edges, engine intakes, propellers, pitots and forward wing sections. The cupola mounted above the flight deck also would handle the empennage.

Such a system might weigh less than the unaerodynamic boots. Electric power demand might not be that great, as heavy-duty capacitors could be charged up over a period of time and then discharged for the periodic phased attacks on ice. As per the standard inflation cycle for de-icer boots, the lasers could alternate phase (top cupola/bottom cupola) and run a 30 seconds on/30 seconds off cycle.

Maybe this system could be called the Laissez-faire, a play on the word laser which might appeal to the French manufacturer of the ATR-72 (Laissez-faire = Non- interference in the affairs of others, as in ‘ice go away’).

Current Regulatory Activity
Date posted on Federal Register and Document Type	Summary of Situation	Action Date & Comments
Nov. 5 Docket No. 2003-CE-27-AD Notice of Proposed Rulemaking (NPRM)	Raytheon Beech 1900C. Replace 200-amp current limiter with 60-amp circuit breaker to protect landing gear motor and electrical de-icing systems. Manufacturer’s alert service bulletin of April 2002, calling for installation of a replacement kit, to be made mandatory by airworthiness directive (AD). Failure of current limiter led to welding of landing gear power relay contacts and inability to automatically lower the gear. Damage to nearby electrical components could affect propeller de-ice, surface de-ice, and left-hand windshield de-ice, compromising defenses against in-flight icing and “loss of control of the airplane.”	Comments due Jan. 6, 2004. Serious in an airplane cleared for single-pilot operation in some environments. This case is indicative of a deficient electrical loads analysis for initial certification. Wiring looms large here, because the undercarriage bay is a SWAMP area (severe weather and moisture prone). Note that some new transports in development propose to use electric motors for gear actuation rather than traditional hydraulics. This case is a “heads up” for an electrical-related gear failure and begs the question of the operating redundancy of such systems.
Oct. 30 Docket No. 2001-NM-216-AD NPRM	Airbus A300-600 and A310. Modify throttle controls to prevent jamming that could lead to asymmetric thrust and loss of control. Proposed AD follows AD action by French DGAC (Direction G�n�rale de l’Aviation Civile). Airbus service bulletins (SBs) addressing various aspects of the problem date back to 1988.	Comments due Dec. 1. Corrective actions include, inter alia, flexible ice protection boot to prevent moisture accumulation and freezing, leading to cable jam, installation of heating system to prevent freezing/jamming, installation of improved roller and rotation pin to prevent cable stiffness, cooling duct to prevent exposure to excessive heat and deterioration of push-pull cable, installation of grease-filled plug. Consider also vulnerability of pitch-trim jackscrews on Douglas-built twinjets to water/dirt contamination.
Oct. 30 Docket No. 2000-NM-168-AD NPRM	MD-81 through -87 aircraft. Approx. 470 worldwide and 275 in U.S. registry. Action based on ‘several instances’ of power feeder (PF) cables migrating from vibration in cable troughs, chafing against structure and arcing, with consequent smoke/fire in belly holds.	Comments due Dec. 15 Based on manufacturer’s alert service bulletin issued nearly four years ago to install a spacer to prevent PF chafing. Note, such PF cables to be subject to upcoming inspections of all cockpit, electronic bay and PF cables and wiring recommended by Aging Transport Systems Rulemaking Advisory Committee, ATSRAC.
Oct. 30 Docket No. 2003-NE-37-AD Final rule, request for comments	Rolls Royce RB211 Trent 768-60 and 772-60 engines. To prevent uncontained low-pressure turbine case failure and release of high-energy debris with its potential to damage the aircraft. Based on manufacturer’s mandatory alert service bulletin of April 12, 2002, and UK Civil Aviation Authority (CAA) AD action.	Proposed AD effective Nov. 14. Comments due Dec. 29. Supports notion of inerting wing fuel tanks, as shrapnel from uncontained engine failure could penetrate lower wing skins. Edelweiss A330 out of Miami on Oct. 5 provides a graphic example. Although Edelweiss operates the RR Trent 772B, photos of the event show the failure mode nicely. See http://www.iasa.com.au/031103.htm
Oct. 30 Docket No. 2003-NE-42-AD Final rule, request for comments	Rolls Royce RB211 Trent 556-61 engines. Affects foreign operators; no U.S. aircraft presently powered with this engine model. To prevent in-flight fuel leaks, which could result in an engine fire. Based on manufacturer’s alert service bulletin of July 11, 2003, and UK CAA emergency AD action of July 15.	Proposed AD effective Nov. 14. Comments due Dec. 29. Problem discovered when fuel was seen leaking from a taxiing aircraft. Investigation revealed distortion of fuel tube connecting flanges. Distortion was not aggravated by service use, but by exposure to fuel pressure extruding the seal through the gap between the flanges.
Oct. 29 Docket No. 2003-NM-32-AD NPRM	DC-9 aircraft. Proposed AD to replace AC cross-tie power relays. Phase-to-phase short within the relay caused severe smoke and burn damage to the relay, aircraft wiring and adjacent panels.	Comments due Dec. 15. More smoke and fire. Based on alert service bulletin of Jan. 7 and AD 2002-26-13. Sounds very similar to incident involving a failed bus-tie relay on a Swissair MD-11 in 1998.
Oct. 29 Notice of Meeting	Aviation Rulemaking Advisory Committee (ARAC). To deal with ATC issues and 2004 ARAC agenda.	Meeting Nov. 13, 10 a.m. at FAA HQ. Interested parties can participate by telephone. Contact [email protected] to make participation arrangements.
Oct. 28 Docket No. 2003-CE-44-AD Final rule, request for comments on AD	Aerostar PA-60-600, -601, -601P, -602P and -700P airplanes. Leak from fuel tank installed in baggage compartment per supplemental type certificate (STC) process could result in fire or explosion. Problem discovered during normal maintenance. Fuel seeping through wire insulation of auxiliary fuel tank transfer pump and running out through the knife splice connection.	AD effective Nov. 17. Comments due Dec. 23. Inadequate wiring installation and husbandry practices. Another apparent safety breakdown of the STC process leading to potential for fuel vapor explosion and loss of the airplane. The 1996 fuel tank explosion of TWA Flight 800 continues to cast a dark shadow.
Oct. 27 Notice of Meeting	Aviation Security Advisory Committee (ASAC). To discuss security guidelines for general aviation (GA), as produced by GA working group.	Meeting Nov. 12, 11 a.m. to 12 p.m. by telephonic conference call only. To participate, dial 888/395-3015 and, at the prompt, provide the conference code “GA Airport.” At Oct. 1 meeting, ASAC members were reluctant to discuss and vote on GA security guidelines they had not yet seen or had an opportunity to review.
Source: Federal Register

Altitude adjustment

Flight level (FL) 41,000 should have been 40,000 in our domestic reduced vertical separation minimum (DRVSM) story. The graphic at page 2 correctly shows the new FL 400 sandwiched between FL 390 and FL 410. Given that the numbers “1” and “0” are at opposite ends of the row of numbers on the keyboard, the typographical error shows the potential for human error.