...

aerospace@aerothermalsolutions.co

Services / Icing and aircraft systems / Ice protection systems

Ice protection systems engineering: design, testing, simulation and certification

ATS is an engineering company: we design, test and certify the anti-ice and de-ice systems of your aircraft and its air data probes, and issue the certification documents, ready for you to review and submit to the authorities. We size the heaters with thermal analyses validated in icing-tunnel tests, covering water collection, the water film and heat conducted through the skin. The method, developed at USP and used at Embraer, has been kept current with client projects on different aircraft and the new icing requirements.

See the requirements
  • FAR 25 Appendix O: supercooled large drops (SLD)
  • FAR 33 Appendix D and EASA CS-25 Appendix P: ice crystals and mixed phase
  • ASTM F3120: general aviation
  • SAE AS5562 and FAA TSO-C16b: air data probes
  • EASA Special Condition VTOL and EUROCAE ED-314: icing on eVTOL

Led by Dr. Guilherme A. Lima da Silva: anti-ice design and certification of wings, pitot, TAT, static port and smart probes at Embraer (1997 to 2007), with tests in the NASA icing tunnel. His 2007 Journal of Aircraft papers on airfoil anti-ice simulation remain his most cited.

Heater in orange, water film in blue, ice in light blue.

Main assumptions

  • SAE AIR1168/4 Example 9.2 equation, applied point by point on a 1 m chord leading edge (1.58 % c radius) at 4° angle of attack, with stagnation slightly on the lower surface.
  • Fixed condition: 250 KTAS, sea level, −17.8 °C, 0.50 g/m³, 20 µm MVD (FAR 25 App. C intermittent maximum).
  • Heated surface held at 4.4 °C with 100 % efficiency; outside the heater water freezes at the highest rate the balance allows; 10 min exposure.

Simplified engineering model, not a simulation. References: SAE AIR1168/4, Ex. 9.2; Jeck, DOT/FAA/AR-00/30, 2002 (FAR 25 App. C); Bragg, Broeren & Blumenthal, 2005.

Want to run the numbers for your case? The SAE AIR1168/4 spreadsheet, with Examples 9.1 and 9.2 in English and Portuguese, is sent by e-mail.

Request the spreadsheet
Parameters and solved variables

Icing condition (SAE AIR1168/4 Example 9.2)

Airspeed / altitude
250 KTAS / sea level
Air temperature
−17.8 °C (0 °F)
LWC / MVD
0.50 g/m³ / 20 µm
FAR 25 App. C envelope
Intermittent max. (above continuous)
Running-wet surface
4.4 °C (40 °F)
Chord / exposure
1 m / 10 min
Angle of attack / leading-edge radius
4° / 1.58 % c

Solved variables

Recovery temperature
—
Stagnation h (Frössling)
—
Water catch at stagnation
—
Running-wet requirement at leading edge
—
Total heater power
—
Water leaving the heater
—
Ice mass outside the heater
—
Highest ridge
—
How it is calculated

It is the SAE AIR1168/4 Example 9.2 equation (running wet, Fig. 3F-18): q = h(Ts − Trec) + ṁ·cw(Ts − T∞) + evaporation (Chilton-Colburn analogy, saturated air). With the example’s ṁ and h it gives 5.90 W/in², against 5.9 in the document. Here it is applied point by point on a 1 m chord leading edge at 4° angle of attack, marching the water film from stagnation; outside the heater the water freezes at the highest rate the balance allows and forms the spanwise ridge (Bragg et al., 2005). The condition is above the continuous maximum and inside the intermittent maximum of FAR 25 Appendix C (DOT/FAA/AR-00/30). 100 % heating efficiency, as in Fig. 3F-18; AIR1168/4 recommends 70 % at the heater edges.

Ice protection systems track record

  • IndustryEmbraer, 1997 to 2007: anti-ice design and certification for the wing and for pitot, TAT, static port and smart probesSlat and wing thermal anti-ice with LEWICE and the NASA icing tunnel. Smart probes certified with CFD++, ahead of TSO-C16b.
  • IndustryEngine anti-ice system developed with tests and simulationSAE technical paper, 2007, with the Embraer team.
  • ProjectTurkish Aerospace STC on a surveillance aircraft: ice-protection substantiation and certification-support analyses (FENSAP based)Four-year program, in partnership with Akaer. ATS performed the substantiation and certification-support analyses; the STC and certification were held by Turkish Aerospace and Akaer.
  • ProjectJoby eVTOL and an LWC probe redesign: heat load, water catch and optimum heater powerAir data probe for cruise during icing escape, and an electrically heated LWC probe validated in an icing tunnel.
  • Certification and standardsAir data probe power density model, SAE AC-9C Portland, 2010Compared FAR 25, EASA, BS 2G 135 and SAE AS5562 conditions.
  • iceAccretionFoamOur 3D solver iceAccretionFoam will add thermal protection in Phase 2FAPESP PIPE, 2027/28. Product development, separate from the project experience above.

Complete packages, from design to certification reports

We prefer whole, long-term programs to isolated runs: ATS responsible for the ice protection system design, the tests and the certification evidence.

What a package covers

Ice protection system design, sizing and integration; test planning and execution in the icing tunnel, on the ground and in flight; and the certification documents, ready for submission to the authority. We issue them ourselves, whether from analysis or test results: system description, safety assessment, certification plan, reports or any other document the program needs. You review them and submit them to the authorities. This is our differentiator.

One team for the whole program

The same engineers carry the program from the first analysis to the last report, so design decisions, test points and evidence stay consistent over the years. Simulation runs inside this work, it is not the product.

An example: Akaer, ASOJ TA

2020 to 2024. An STC of Turkish Aerospace (TA) for a surveillance aircraft, in partnership with Akaer: ATS performed the ice-protection substantiation and certification-support analyses, with simulation and test support.

How a project happens

A program runs through five certification reports: system description; safety assessment; certification plan; icing-tunnel and flight test planning and results; and numerical model description, validation and results.

Need only a part? We define the scope with you.

Anti-ice and de-ice, and where the ice goes

The two families behave differently, so the analysis and the evidence differ.

Anti-iceDe-ice
PurposePrevent ice from forming on the protected surface.Let ice form, then melt or expel it.
OperationSteady state, on during the icing encounter.Transient, in cycles of accretion and shedding.
WaterResidual water forms and can run back and refreeze aft of the protected area.Melt water and shed ice pieces.
What we analyzeSurface temperature, wet and dry limits, runback and refreeze location, power density and margin.Cycle timing, ice thickness at activation, residual ice and where shed pieces go.
Typical hardwareHot air from bleed, electrothermal heaters.Pneumatic boots, electrothermal cycles, electro-expulsive systems.

Thermal systems are the most common on commercial aircraft. New systems may use hydrophobic surfaces or electro-expulsive de-ice, and we model those as well as mechanical protection.

Ice protection systems are an integration problem

It touches other systems

The ice protection system connects to pneumatic, electric, indication, navigation and stall protection systems.

It must not interfere

Its operation cannot degrade those systems, and they must be evaluated under icing conditions.

It needs operating rules

Flying in icing conditions requires specific maintenance and operation procedures.

The IPS has multiple interfaces with aircraft systems and requires specific procedures for operation.

Dr. Guilherme A. Lima da Silva, The Icing Engineering Process

The physics we solve

Five layers from the free stream to the skin, solved together.

  1. 1
    Free stream flowSpeed, altitude and angle of attack from the mission.
  2. 2
    Gaseous flow with dropletsAir and water vapor mixture. Droplet trajectories and impingement.
  3. 3
    Momentum and thermal boundary layersIntegral or differential solution, or CFD with heat transfer, with laminar-turbulent transition and streamwise gradients.
  4. 4
    Water filmBeads, film and rivulets. Evaporation, energy balance and runback.
  5. 5
    Solid surfaceConduction through skin, heater and structure layers.

Effects that decide the answer

Laminar-turbulent transition, streamwise temperature and pressure gradients, and the hydrodynamics of runback water all change temperature and evaporation, so they are in the model.

What you receive

Surface temperature, water mass flow, wetness, runback limits, power density and margin, and the residual ice left when the system fails or is off.

One CFD tool for all five layers

All of this physics can be solved inside a single CFD tool, such as iceAccretionFoam, CFD++ or FENSAP-ICE. It is separated into layers here only for clarity.

Where the model comes from, and how it evolved

From the PhD at Poli-USP to iceAccretionFoam, with the papers behind each step.

The thermal balance couples the skin, the water film and the air: conduction along the wall, heat exchange with the water, droplet enthalpy and kinetic energy, and evaporation. It was born at Embraer and Poli-USP and is still being developed at ATS.

  1. 2003–2009
    Research
    Poli-USP, supported by Embraer and FAPESP: anti-ice model with continuous film and rivulets (runback).

    Validated against the Al-Khalil et al. (2001) test and NASA ANTICE. MSc (2003) and PhD: thesis at Poli-USP.

  2. 2007–2010
    Research
    Laminar-turbulent transition and intermittency in heat transfer and ice shape.

    Stefanini, Silvares, Silva and Zerbini (COBEM 2007; AIAA 2008-474). See Publications.

  3. 2008–2009
    Research
    Cal State Long Beach: Cebeci compressible differential boundary layer integrated into the code.

    Silva, Silvares, Zerbini, Hefazi, Chen and Kaups, AIAA, 2009.

  4. 2010–today
    Project
    Pitot probes: heat load and test envelope models, from spreadsheet to Python.

    Presented at SAE AC-9C (Portland, 2010) and used in eVTOL programs and probe certification.

  5. 2011
    Research
    Wall functions for heat transfer on rough surfaces.

    Silva, Arima, Branco and Pimenta, SAE 2011-38-0023.

  6. Projects
    Project
    Electrothermal anti-ice code to define the power distribution in probes.

    LWC probe: CFD for Cp and impingement, optimum electric power distribution and icing tunnel validation.

  7. 2023
    iceAccretionFoam
    Start of the collaboration with Prof. Hrvoje Jasak.

    Starting point of iceAccretionFoam, our own 3D solver (NUMAP-FOAM Summer School 2023).

  8. 2024
    iceAccretionFoam
    First iceAccretionFoam paper and glaze ice at SAE AC-9C.

    Teixeira da Silva et al., ICAS 2024-1112, Florence; SAE AC-9C, Ottawa.

  9. 2025
    iceAccretionFoam
    Two papers in Philosophical Transactions of the Royal Society A, with Prof. Jasak.

    Impingement and rime ice and glaze ice; presentation at SAE AC-9C, CIRA, Capua.

  10. 2026
    iceAccretionFoam
    FAPESP PIPE 2025/19697-9 and the ATS accretion model in the site applets.

    Phase 1 (July 2026 to February 2027): 2D beta, rime and glaze; Phase 2: 3D MVP with thermal anti-ice and de-ice (FAPESP, post). The ATS accretion model in Python, checked against LEWINT and the NASA test, runs the icing applets on the site.

Tools, and how mature each one is

We say what runs today and what is still in development, so you can plan the evidence.

ToolRole in ice protection systems workStatus
ATS thermal codesATS, 2DIntegral (Ambrok and superposition) and differential boundary-layer methods coupled to a water film with beads, film and rivulets. Compared with the NASA anti-ice experiment of Al-Khalil et al. (2001).In use
CFD++MetacompCFD with heat transfer: external flow, droplets and thermal balance on the wall, plus internal hot-air flow when the system needs it.In production use
LEWINT (LEWICE)NASA, American KestrelFast thermal analysis of anti-ice and de-ice heat balance. ATS holds a LewInt licence.Licensed
FENSAP-ICEAnsysIce protection systems module on a licence you provide, as on the Akaer STC ice protection systems work where the customer required it, compared with the other tools when a cross-check helps.Client-supplied licence
iceAccretionFoamATS, foam-extend 5.0Finite-area water film exchanging heat with the wall, and 2D shell conduction for electrothermal heaters, in the same 3D solver that grows the ice.Phase 2 target, 2027/28

Air data probe envelope mapping

Makers of pitot, TAT and smart probes, angle-of-attack vanes and ice detectors are a large market, with hundreds of suppliers in the US alone, and their certification depends on conditions that differ from standard to standard. We map them.

Power density needed to keep the probe skin at 5 degrees Celsius against water catch, with the FAR 25 critical envelope and crossing points, EASA conditions, BS 2G 135 tests, SAE AS5562 tables 2 and 3 and reference points
Heat load against water catch: power density needed to keep the skin at 5 °C, with the FAR 25 continuous and intermittent maximum critical envelope and crossing points, the EASA conditions, the BS 2G 135 tests, SAE AS5562 (Class 1, tables 2 and 3) and the reference points.
Static air temperature against pressure altitude at 145 knots calibrated airspeed cruise, with continuous and intermittent maximum envelopes, the aircraft limit and crossing points with liquid water content
Operating points: static air temperature against altitude at 145 KCAS cruise, with the FAR 25 continuous (CM) and intermittent (IM) maximum envelopes, the aircraft limit, and the crossing points for recovery temperatures of 0, −5, −10 and −16 °C, each with its liquid water content.

What the mapping does

Python programs place the operating points of your aircraft and the icing tunnel test points on the same heat load against water catch plane as the old and current standards: FAR 25 Appendix C, EASA, BS 2G 135 and SAE AS5562, which FAA TSO-C16b calls. You see which conditions drive the heater power and which tests are worth running. The method started as a spreadsheet model presented at SAE AC-9C in Portland, with a lumped heat and mass balance, ice crystal and water catch terms and CFD++ collection efficiency (presentation). It now runs as Python programs.

Why probes have their own standard

Pitot probes are qualified by TSO-C16b, which calls SAE AS5562, and by ETSO-C16, not only by FAR 25 Appendix C or O. On Air France flight 447, in 2009, ice crystals blocked the pitot probes and started the chain of events, according to the French BEA final report.

CFD on the real aircraft

CFD gives the water catch, and the LWC concentration and speed near the probe, and maps the heat load on the heater. We did this for an eVTOL air data probe that had to be certified for cruise during the escape from icing conditions.

Pitot probe standards and our certification

Pitot probe qualification moved from a 1948 airspeed tube specification to the ice and rain conditions of SAE AS5562, which FAA TSO-C16b calls since 2017. The E170/190 smart probe certification at Embraer, led by Dr. Guilherme, answered an EASA CRI in 2003 and 2004, before the FAA and EASA standards reached those liquid water conditions. Select a milestone to read the detail.

  1. Dec 1947
    SAE AS393, the first pitot heater standard

    SAE AS393, Airspeed Tubes, Electrically Heated. Revised in 1960 and declared noncurrent in 2002.

  2. 1 Sep 1948
    FAA (then CAA) TSO-C16, first edition

    FAA (then CAA) TSO-C16, Airspeed Tubes (Electrically Heated), first edition, with the performance requirements of SAE AS393. Record: FAA TSO-C16, Accuris

  3. 1967
    British Standard BS 2G 135 with supercooled water tests

    British Standard BS 2G 135, Electrically-Heated Pitot and Pitot-Static Pressure Heads (Amendment 1 of 1973), with the supercooled water tests of section 8.7.

  4. 24 Oct 2003
    EASA ETSO-C16, based on SAE AS393

    EASA ETSO-C16, based on SAE AS393. Document: EASA ETSO-C16

  5. 2003–2004
    Embraer E170/190 smart probes: EASA CRI answered

    Embraer, E170/190: the EASA CRI for the smart probes is answered with the AS5562 liquid water conditions, more than a decade before TSO-C16b, using simulation and CFD++. The E170 was validated by EASA on 20 February 2004 (EASA type certificate data sheet).

  6. 6 Oct 2006
    FAA TSO-C16a adds the icing tests and BS 2G 135

    FAA TSO-C16a: moves from SAE AS393 to SAE AS8006 (1988) and adds the icing test of 14 CFR 25 Appendix C intermittent maximum, plus the BS 2G 135 supercooled water tests 1 and 2 of paragraph 8.7.2.

  7. 14 Oct 2009
    EASA ETSO-C16a, harmonised with the FAA

    EASA ETSO-C16a (ED Decision 2009/014/R), harmonised with FAA TSO-C16a after the Air France 447 accident, with the same BS 2G 135 icing test, section 8.7. Documents: EASA ETSO-C16a, EASA terms of reference

  8. Feb 2016
    EUROCAE ED-225, the counterpart of SAE AS5562

    EUROCAE ED-225, with the same title and scope as SAE AS5562: ice and rain minimum qualification standards for pitot and pitot-static probes.

  9. 27 Jan 2017
    FAA TSO-C16b calls SAE AS5562

    FAA TSO-C16b: calls SAE AS8006A and SAE AS5562, in place of the British Standard. Document: FAA DRS, TSO-C16b

  10. 21 Feb 2018
    EASA ETSO-C16b, based on the FAA TSO-C16b

    EASA ETSO-C16b (ED Decision 2018/002/R), based on FAA TSO-C16b. Document: EASA ETSO-C16b

Evidence you can check

Client and Embraer project work, and the papers behind the method.

Project work

Papers behind the method

Examples

Select an image to see each example.

Heat load against water collected for air data probes
1 / 12

Probe heat load

Heat load against water collected for air data probes, with the requirements of old and current standards.

Request a technical proposal

What we protect

Wings and empennage

Electrothermal, hot-air and boot systems on leading edges and balance horns.

Engine inlets, ram air and propellers

Ingestion risk, lip heating and blade or spinner protection.

Air data probes and vanes

TAT, pitot and smart probes, angle-of-attack vanes and ice detectors, with heater power and location.

Windshields

Heating for the pilot’s view, with layer stack and temperature limits.

Antennas and radomes

Protection that does not disturb the electromagnetic function.

eVTOL, drones and rotors

Aircraft that may have no conventional system and must show that ice does not affect operation, or that they can escape the condition.

Tests and simulation work together

Tests you will still need

Wind tunnel with simulated ice for aerodynamics, icing tunnel for the protection system, artificial-ice and natural-icing flight tests, and tests that validate the results.

What simulation does for the campaign

It designs the system, saves tunnel and flight tests, supports coverage of the envelope, supports certification and supports the analysis of failure cases.

Where the experience comes from

Ten years of anti-ice design and certification at Embraer, then client projects at ATS, together with research and the development of our own solver.

Industry Embraer, 1997 to 2007Project ATS client and facility projectsResearch Papers, workshops and committeesiceAccretionFoam Development of our own 3D solver

How an engagement runs

  1. Mission and performance

    Mission profile, weights, speeds and altitudes. Angle-of-attack ranges from flight dynamics.

  2. Baseline ice and critical conditions

    Ice on the unprotected surface and the critical points of the envelope.

  3. System design

    Architecture, heat source, layers, protected area and control logic with your team.

  4. Thermal analysis

    Heat balance, water film, runback and power density at the critical points.

  5. Failure cases and residual ice

    Ice shapes when the system fails or is off, and the residual ice after de-icing.

  6. Certification reports and test support

    System description, safety assessment, certification plan, and reports of the numerical model and of the icing tunnel and flight tests. All under NDA.

Questions engineers ask before they hire us

What is the difference between anti-ice and de-ice systems?

An anti-ice system prevents ice from forming on the protected surface and operates in steady state, leaving residual water that can run back. A de-ice system lets ice form and then melts or expels it in cycles, so it operates in a transient state.

What do running wet and fully evaporative mean?

In a fully evaporative anti-ice system all impinging water evaporates on the heated surface, which needs the most power. In a running wet system the surface stays above freezing while water runs aft, and the design must show where that water refreezes and that the ice there is acceptable.

Can you size an electrothermal ice protection system by simulation?

Yes, for the thermal design. We compute the heat balance between air, water film and skin, including conduction through the heater and structure layers, and deliver surface temperature, wet and dry limits, runback and power density. Final proof still needs icing tunnel or flight tests, and simulation reduces how many are needed.

Do you analyze pitot and air data probe heating?

Yes. Probes and sensors are part of our scope. Pitot probes are qualified by TSO-C16b and ETSO-C16, which call SAE AS5562, rather than only by FAR 25 Appendix C or O. We presented a probe power density model at SAE AC-9C in 2010 and compared it with FAR 25, EASA, BS 2G 135 and SAE AS5562 conditions.

How does simulation reduce icing tests?

Simulation designs the system, supports coverage of the envelope and of failure cases, and reduces the number of icing tunnel and flight test points. Tests then validate the numerical tools at the points that matter. Once validated against icing tunnel and flight data, simulation can also cover atmospheric icing conditions that were not tested, rare conditions and the edges of the envelope.

Is our design data kept confidential?

Yes. We work under NDA. In consultancy you receive results and reports, and your geometry, materials and heater layouts stay with you.

Tell us about the system and the certification stage

We reply with a scope, the tools we would use and the evidence you can expect.

Emailaerospace@aerothermalsolutions.co
Phone+55 11 3854-4224
OfficeAv. Pompéia, 634, cj. 107, São Paulo, SP, Brazil.

Send the aircraft or component, the certification stage and the question you need answered. An ATS engineer replies. We work under NDA.