Daniel sent us this one — he's asking about how airplanes operate safely in icy conditions. Which, when you think about it, is genuinely incredible. Ice on wings has killed hundreds of people in some of the most notorious crashes in aviation history. And yet every winter, thousands of flights push back from gates in freezing precipitation, and they arrive just fine. So the question is: how did the industry go from ice being a top-three killer to a managed, everyday risk? And where are the remaining weak points?
The short version is that we built three independent layers of defense — what happens to the aircraft before takeoff, what happens to the runway, and what happens in the cockpit. And if any two of those layers hold, you're probably okay. If two fail, you're in a very bad place.
Let's start with why ice is so dangerous in the first place. Because the numbers are more dramatic than I think most people realize.
They really are. NASA did a whole series of icing research flights in the late nineties, and what they found is that even a one-millimeter layer of rough ice on the leading edge of a wing can reduce lift by thirty percent and increase drag by forty percent. That's about the thickness of a credit card.
Which is terrifying when you put it in those terms. A credit card's worth of ice and suddenly your wing is thirty percent worse at being a wing.
It's not just the weight. People assume the problem is that ice is heavy. It's not. The weight is almost irrelevant. The problem is aerodynamic. A wing works because air flows smoothly over it in what's called laminar flow. Ice disrupts that. It roughens the surface, creates turbulence, and the smooth attached airflow separates from the wing earlier than it should. That increases the stall speed — the speed below which the wing stops flying. So now you need to land faster, but you're heavier, on a possibly contaminated runway, and your controls might be less responsive.
I think the stall speed point deserves a moment, because it's counterintuitive. Most people think stall means the engine stops. It doesn't. Stall means the wing stops producing enough lift to keep the aircraft flying, and that can happen at any speed, any attitude, any power setting. When ice raises your stall speed, it means the wing quits at a speed where it should still be flying just fine. So you could be at full power, nose level, and the aircraft simply stops being an aircraft.
And this is where an analogy helps. Think of a wing like a ski on snow. Smooth waxed ski on packed powder — that's laminar flow. Now imagine trying to ski on gravel. The ski doesn't glide, it chatters, it catches, it stops. That's what ice does to a wing. The air molecules can't flow smoothly, so they tumble and separate. And just like you'd need to go faster to stay upright on gravel — which you can't, because the gravel is fighting you — the aircraft needs more speed to stay airborne, but the ice is simultaneously increasing drag, so getting that speed is harder.
This isn't theoretical. There's a reason ice was a top-three cause of fatal accidents in the eighties.
Two crashes in particular reshaped everything about how the industry handles ice. The first is Air Florida Flight 90 in 1982. A 737 departing Washington National in a snowstorm. The aircraft was de-iced before pushback, but then it sat at the gate for forty-nine minutes with the engines running while snow continued to fall. By the time it took off, ice had re-accumulated on the wings. Worse, the crew didn't turn on the engine anti-ice system. The PT2 probe — that's the pressure sensor in the engine inlet — iced over and started feeding false pressure readings to the cockpit instruments. The pilots thought they had more thrust than they actually did. The aircraft struggled into the air, stalled, and hit the Fourteenth Street Bridge. Seventy-eight people died, including four on the ground.
That crash is haunting because it wasn't one thing. It was a cascade. Missed de-icing, missed anti-ice, instrument failure, and a crew that didn't recognize what was happening until it was too late.
There's a specific detail from the cockpit voice recorder that still gets taught in crew resource management courses. The first officer noticed something was wrong during the takeoff roll — he said, "That doesn't seem right, does it?But he said it as a question, not a declaration. The captain either didn't hear him or didn't register the urgency. That moment reshaped how crews are trained to communicate concern. Now it's drilled into pilots: if you see something, you don't hint at it. You say "abort" or "go around" in unambiguous language.
The "hint and hope" communication style. It's killed a lot of people across a lot of industries, not just aviation.
That's the procedural failure case. The other landmark crash is American Eagle Flight 4184 in 1994, and this one is different — it wasn't about a crew skipping steps. It was about the aircraft encountering conditions that the entire regulatory system hadn't anticipated.
This was the ATR-72 that went down in Indiana.
The ATR-72 was flying a holding pattern at about ten thousand feet, in freezing rain. The aircraft had pneumatic de-icing boots on the wings — these rubber bladders that inflate and crack off ice that's already formed. And those boots were working. They were cycling. But what nobody fully understood at the time was that in supercooled large droplet conditions — SLD — the ice doesn't just form on the leading edge where the boots are. It forms aft of the boots, on an area the boots can't reach. So the boots would inflate, crack the ice on the leading edge, but a ridge of ice was building up behind them. That ridge disrupted airflow enough to cause an uncommanded roll. The aircraft went inverted and dove into the ground. Sixty-eight people died.
That crash directly led to a change in how aircraft are certified for ice.
It took twenty-one years, but yes. In 2015, the FAA added something called Appendix O to the Part 25 certification standards. The original Appendix C — which had been the standard since the sixties — defined the icing envelope as a specific range of temperatures, liquid water content, and droplet sizes. Basically, it said: if you can fly safely through these conditions, you're certified for known icing. But Appendix C only covered droplets up to about fifty microns in diameter. SLD conditions involve droplets that are much larger — up to a thousand microns, which is basically freezing drizzle and freezing rain. Appendix O added those. If an aircraft is certified under Appendix O, it's been tested against the exact conditions that brought down Flight 4184.
How do you even test for that? You can't exactly schedule a freezing rain storm and go fly into it.
You do it behind a tanker aircraft. The Air Force operates modified KC-135s that spray water behind them in controlled droplet sizes. The test aircraft flies behind the tanker, and the water freezes on contact. It's incredibly precise — they can dial in the exact droplet size, the liquid water content, the temperature profile. But it's also incredibly expensive, which is part of why it took two decades to build the regulatory framework. You need the tanker, the test aircraft, the instrumentation, and the right atmospheric conditions. It's a multi-million dollar campaign just to certify one aircraft type.
That's the aerodynamic threat. Which brings us to the first layer of defense that most passengers actually see — the de-icing trucks at the gate. And I think there's a widespread misconception about what's actually happening when they spray the plane.
The misconception is that they're spraying something that prevents ice from forming, full stop. The reality is more complicated. There are two types of fluid, and they do different things. Type I is the orange stuff. It's heated — typically to about a hundred and eighty degrees Fahrenheit — and it's mostly glycol and water. Its job is to remove ice, snow, and frost that's already on the aircraft. It's a de-icing fluid, emphasis on the "de." It melts existing contamination. But it provides almost no protection against new accumulation. In freezing precipitation, you've got maybe five to ten minutes before ice starts forming again.
If you only spray Type I and then sit there, you're basically back to Air Florida Flight 90.
Which is why there's a second step. Type IV is the green stuff. It's thickened — it has a consistency somewhere between paint and honey — and it's designed to sit on the aircraft surfaces and create a barrier. When precipitation hits it, the fluid absorbs the moisture and slowly dilutes, and eventually it shears off during the takeoff roll. That's the anti-icing step. Type IV gives you a holdover time — a window during which the aircraft is protected.
I want to pause on the shearing-off part, because that's something passengers sometimes notice and worry about. You're in your window seat, the plane is accelerating down the runway, and you see the green fluid streaming off the wing. That looks alarming if you don't know what it is.
It's actually what you want to see. The fluid is designed to shear off at a specific speed — usually around a hundred knots, which is roughly when the aircraft is committed to the takeoff. If it stays on past that speed, it means the fluid might be too thick, or it might have started to freeze, and now you've got a layer of slush on the wing that could itself disrupt airflow. The shearing is a visual confirmation that the system is working.
Those holdover times are not guesswork. There's a whole regulatory framework for calculating them.
The FAA publishes holdover time tables that are updated regularly. They factor in the fluid type, the dilution ratio, the outside air temperature, the type and rate of precipitation, and the relative humidity. For Type IV fluid in light snow at around twenty degrees Fahrenheit, you might get sixty to eighty minutes of protection. But in freezing rain at twenty-three degrees Fahrenheit — which is minus five Celsius — that drops to fifteen to twenty minutes. And the FAA just revised those tables in November 2025, specifically tightening the numbers for Type IV under freezing drizzle conditions. There had been some near-misses where fluid failed earlier than the old tables predicted.
The clock is ticking from the moment the spray stops. How do the pilots know when their time is up?
The de-icing crew communicates the fluid type, the mix ratio, and the start time to the cockpit. The pilots then look up the holdover time in their tables or on their electronic flight bags. If they're not airborne by the end of that window, they have to come back for another spray. There's also a visual check — Type IV fluid is designed to shear off at a specific speed, usually around a hundred knots. If the pilots see fluid still on the wings past that speed, that's actually a problem, because it means the fluid might be too thick or frozen.
What happens if they're in line for takeoff and the holdover time expires while they're sitting there?
They have to leave the queue and go back to the de-icing pad. It's a hard rule. And yes, it causes delays, and yes, passengers get frustrated. But the alternative is taking off with unprotected surfaces. There's no discretion on this. The clean aircraft concept is absolute.
That's the ground-based system. But aircraft also have onboard ice protection. And this is where things get interesting, because the technology varies wildly depending on the aircraft.
There are basically three approaches. The oldest and most common on turboprops and smaller jets is pneumatic de-icing boots. These are rubber strips along the leading edges of the wings and tail. When ice accumulates, the system inflates the boots with compressed air — they puff up and crack the ice, and the airflow blows the pieces away. They cycle on and off, because if you left them inflated they'd disrupt the aerodynamics themselves. The limitation, as Flight 4184 showed, is that they only protect the surfaces they cover. Ice can build up behind them.
There's an operational nuance with boots that I think is worth explaining, because it's counterintuitive. You don't turn them on the moment you see ice.
If you inflate the boots too early, before enough ice has accumulated, the ice doesn't crack — it just flexes with the rubber and stays attached. You need a certain thickness of ice, typically a quarter to half an inch, before the boots can get enough leverage to fracture it. So pilots flying in icing conditions have to let ice build up, then cycle the boots, then let it build up again. That takes discipline. The instinct is to get rid of ice immediately, but doing that can actually make the situation worse by creating a rough, partially-shed layer that's more disruptive than a smooth ice layer.
Then there's the heated approach.
The older one is bleed-air thermal anti-icing. Jet engines compress air, and some of that air is extremely hot — hundreds of degrees. The system bleeds some of that hot air and routes it through ducts inside the wing leading edges and engine inlets. This is anti-icing, not de-icing — it prevents ice from forming in the first place rather than removing it after it's there. Most Boeing and Airbus aircraft use this for the wings and engines. The Boeing 787 is different — it uses electro-thermal systems, where electric heating elements are embedded in composite leading edges. No bleed air required, which is more efficient because you're not stealing compressed air from the engines.
The third approach?
Weeping wing systems. These are mostly on business jets. The leading edge has tiny laser-drilled holes — thousands of them — and a glycol-based fluid is pumped through them. It literally weeps out onto the wing surface and prevents ice from sticking. It's elegant but complex, and you have to carry the fluid onboard. It's basically a built-in de-icing truck.
Between the ground spray and the onboard systems, you'd think the aircraft itself is covered. But you mentioned three layers. The second is the runway.
This is where things get less visible to passengers but arguably just as critical. Even a perfectly de-iced aircraft can't stop on an ice rink. Runway surface management is its own entire discipline, with its own chemistry, its own vehicles, and its own regulatory framework.
Let's start with the chemistry, because I think most people assume they just dump rock salt on runways like a highway department.
They absolutely do not. Sodium chloride — rock salt — is corrosive to aircraft aluminum and engine components. Runways use either potassium acetate or sodium acetate. These are different molecules that lower the freezing point of water without the corrosion problems. Airports used to use urea, but that was phased out because of environmental concerns — urea breaks down into ammonia, which is terrible for waterways.
The environmental constraints are serious. Denver International is the case study.
Denver is the perfect example because they deal with heavy snow and they sit near sensitive watersheds. DIA uses about one and a half million gallons of de-icing fluid per winter season — that's aircraft fluid, not runway chemical — and they have an automated glycol recovery system that captures ninety-five percent of it. The runoff goes into a dedicated drainage system, gets pumped to holding tanks, and then gets processed. The recovered glycol can actually be recycled and resold. Without that system, all of that fluid would end up in the South Platte River.
It's worth noting that the environmental piece isn't just a nice-to-have. If Denver didn't have that recovery system, they'd be in violation of the Clean Water Act. The EPA can and does fine airports for glycol runoff. So the environmental compliance and the operational capability are the same system. You can't run a major winter hub without solving the runoff problem.
And it's not cheap. Denver's glycol recovery system cost something like a hundred million dollars to build and millions a year to operate. That's part of why you don't see every airport handling winter weather at Denver's volume — the infrastructure investment is enormous.
The chemistry is different, the application is different. But the real question for safety is: how do you know if the runway is too slick to use?
This is where friction testing comes in. Airports use specialized vehicles — the Saab friction tester is the classic one, there's also a device called the GripTester — that drive down the runway and measure the coefficient of friction in real time. For a dry runway, you want a friction coefficient of at least zero point three. For wet, zero point two. On ice, you can drop below zero point one five. Below zero point two, most airports will start considering a closure.
There's a specific case from last winter that illustrates this perfectly.
December 2025, Denver got twenty-eight inches of snow in thirty-six hours. The airport kept one runway open using continuous plowing and chemical application — they were running convoys of plows and chemical trucks in a loop. But at one point the friction tester readings dropped to zero point one eight. That triggered a thirty-minute closure of that runway. Forty percent of flights were cancelled that day. And that's the system working as designed — the limit was hit, and operations stopped until conditions improved.
Friction testers are one input. There's also pilot reports.
Right, and this is where the human layer comes in. The FAA's Takeoff and Landing Performance Assessment system — TALPA — was implemented in 2016. It standardizes how braking action is reported and used. When a pilot lands, they report braking action as good, medium, poor, or nil. Those reports get fed into the system, and arriving aircraft use them to calculate their required landing distance. If braking action is reported as poor, the airline's dispatch system automatically adds fifteen percent to the calculated landing distance. If it's nil, the number jumps to something like plus forty percent — and most airlines will simply divert.
If you're a pilot and you hear "braking action poor" from the aircraft ahead of you, your landing distance just got fifteen percent longer. And if the runway isn't long enough to accommodate that, you don't land.
And that's a hard regulatory requirement now. Before TALPA, the reporting was inconsistent — one pilot's "fair" was another pilot's "poor" — and the calculations were less standardized. There was a near-overrun at JFK in January 2023 that really highlighted why TALPA matters. A Delta 737-900ER landed on a runway with poor braking action reported. The crew didn't apply maximum reverse thrust until very late in the landing roll. The aircraft stopped about five hundred feet from the end of the runway. The NTSB report cited inadequate crew training on TALPA procedures. They had the information — they knew the braking action was poor — but they didn't fully adjust their technique.
Five hundred feet. That's a rounding error in aviation terms.
It's essentially nothing. A 737-900ER at landing speed covers five hundred feet in about two seconds. That was a very close call.
What does "adjusting technique" actually mean in practice? If you know braking action is poor, what do you do differently?
You touch down at the earliest possible point on the runway — no floating, no greasing it on gently. You get the nose wheel down immediately. You deploy reverse thrust to maximum as soon as the mains are on the ground. And you use firm, consistent brake pressure — no pumping, no hesitation. On a dry runway, a pilot might use idle reverse and light braking, letting the aircraft roll out naturally. On a contaminated runway, every foot of runway you don't use for deceleration is a foot you might need later. The technique shift is from "smooth and comfortable" to "maximize deceleration immediately.
You've got the friction testers giving you objective data, you've got the pilot reports giving you real-world confirmation, and you've got TALPA turning all of that into mandatory landing distance calculations. That's the second layer. The third is the pilot's decision-making and the regulatory guardrails.
The guardrails are designed to be conservative. The clean aircraft concept is the foundational rule: no takeoff with any ice, snow, or frost adhering to critical surfaces. Not a thin layer, not a light dusting — zero. This isn't a recommendation, it's federal regulation. If there's frost on the wing, you de-ice. If the holdover time has expired, you de-ice again. There's no "it's probably fine" override.
Which is why delays for de-icing are, as we've said before, a feature and not a bug. When you're sitting at the gate waiting for the truck, the system is working.
There are hard limits. Runway closures typically happen when friction drops below zero point two, or when snow accumulation exceeds two inches per hour, or when crosswinds exceed demonstrated limits for contaminated runways. A ten-knot crosswind on an icy runway can be more hazardous than a twenty-five-knot crosswind on dry pavement. The aircraft's demonstrated crosswind limit — which is established during certification — assumes dry conditions. On ice, that limit effectively doesn't apply because the lateral control authority is completely different.
Let me push on that crosswind point, because I think it's another one of those things that sounds technical but has very visceral consequences. If you're landing with a crosswind, you're essentially flying sideways relative to the runway, and you straighten out at the last moment. On dry pavement, the tires grab and you track straight. On ice, those tires slide. So the crosswind can push you sideways even after touchdown.
That's called weathervaning. The vertical stabilizer — the tail fin — acts like a sail. If the wind is coming from the left, it pushes the tail to the right, which points the nose left. On dry pavement, the nosewheel steering and differential braking can counter that. On ice, you have very little lateral grip, so the aircraft can start to rotate even if you're applying full opposite rudder. At that point, you're a passenger in your own aircraft. The only option is to go around — abort the landing and try again, or divert.
The three layers are: keep the aircraft clean with ground de-icing and onboard systems, keep the runway grippy with chemicals and friction management, and keep the decision-making conservative with TALPA and regulatory limits. And the system works because these layers are independent. A failure in one doesn't automatically cascade.
That's the key insight. The Air Florida crash was a failure of all three — the aircraft wasn't properly de-iced, the runway was contaminated, and the crew made bad decisions. The American Eagle crash was a failure of the certification system — the aircraft's onboard protection was inadequate for the conditions it encountered, and the pilots had no way to know that. In both cases, if any one of those layers had held, the outcome might have been different.
Where are the remaining weak points? The prompt asks specifically about the margin of safety.
The margin is real but finite. The system can handle most normal winter conditions. But there are edge cases where ice still wins. Supercooled large droplets are one — even with Appendix O certification, SLD conditions are difficult to detect in real time. A pilot might not know they've flown into freezing drizzle until ice is already accumulating in places the protection systems can't reach. The FAA and EASA are studying updates to Appendix O for the 2028 certification cycle, specifically to address detection and escape procedures.
Another weak point is the holdover time tables themselves. The November 2025 update tightened things, but the tables are still based on laboratory testing that may not perfectly replicate real-world conditions. If you're in freezing rain at an unusually cold temperature — say, minus fifteen Fahrenheit — the fluid behavior is less well-characterized.
There's a human factors dimension. De-icing delays cost airlines money, and there's always pressure — subtle or not — to keep things moving. The TALPA near-overrun at JFK was partly about training, but it's also about a culture where pilots may not have fully internalized that a "poor" braking report changes the physics of what they're doing. The system gives them the information, but they have to act on it.
I think the cultural pressure piece is worth sitting with for a second, because it's not always overt. Nobody is telling a pilot "take off with ice on your wings." But there's a cumulative effect. You've been sitting in the de-icing queue for forty-five minutes. Your passengers are getting restless. Dispatch is asking for an update. The gate agents are getting pressure from the station manager. You're looking at your holdover time and you've got maybe eight minutes left. And the runway is another ten minutes of taxiing away. Do you go back and do it again, adding another hour of delay, or do you convince yourself that the precipitation has lightened up and you're probably fine?
That's exactly the scenario that crew resource management training is designed to counter. The training explicitly teaches pilots to recognize that kind of pressure and override it. But training isn't perfect, and humans are humans. The system relies on pilots making the conservative call every single time, and mostly they do. But the margin there is thinner than the engineering margin.
The runway side has its own limits. Chemical de-icers lose effectiveness at very low temperatures. Potassium acetate stops working well below about minus fifteen Fahrenheit. At that point, you're relying almost entirely on mechanical removal — plowing and brooming — and the friction coefficients can drop fast.
Snow removal is a logistics problem as much as an engineering one. Denver can keep one runway open in a twenty-eight-inch storm by running continuous convoys, but that consumes enormous resources. If the storm lasts longer than expected, or if equipment breaks down, the margin shrinks. And smaller airports don't have Denver's fleet. A regional airport with two plow trucks and a limited chemical supply has a much thinner margin than a major hub.
To answer the question directly: yes, most normal winter conditions can now be handled. The industry has achieved what you might call relative mastery. But mastery is not elimination. Ice still causes incidents — they're just rare now, and they usually involve a combination of factors rather than a single systemic gap.
The system is designed to fail safe. If conditions exceed the design envelope — if the holdover time expires, if the friction drops too low, if the crosswind on ice is too strong — the rules say you don't go. The flight is delayed or cancelled. That's not a failure of the system. That's the system working.
When your flight is delayed for de-icing, that delay is the margin of safety made visible. What you don't see is the friction tester making another pass down the runway, or the dispatcher running the TALPA numbers, or the certification engineer who spent three years testing wing heating elements in an icing wind tunnel.
The visible de-icing process — the orange and green fluid, the trucks with the cherry pickers — that's maybe ten percent of what's actually keeping you safe. The rest is invisible to passengers. And that's kind of the point. The system is designed so that you don't have to think about it.
What's next? The prompt didn't ask about the future, but it seems worth touching on, because the icing challenge isn't static.
Two things are happening simultaneously. One is that climate change is shifting the icing envelope. Warmer air holds more moisture, which means the frequency of supercooled large droplet conditions may increase. Freezing rain events that used to be rare in certain regions are becoming more common. The FAA and EASA are already studying whether Appendix O needs to be expanded for the 2028 certification cycle.
The other thing is that aircraft themselves are changing.
Electric aircraft are the big open question. Batteries lose significant capacity in cold temperatures — you can lose twenty to thirty percent of your range just from the cold soak at altitude. But the bigger issue is ice protection. Turbine aircraft use bleed air — hot compressed air siphoned from the engines — to anti-ice the wings and engine inlets. Electric motors don't produce bleed air. So an electric aircraft needs an entirely different approach. Electro-thermal systems like the 787 uses are one option, but they draw significant electrical power — power that on a battery-electric aircraft is coming straight out of your range budget. You're essentially choosing between ice protection and getting to your destination.
Which is the kind of tradeoff that keeps certification engineers up at night.
There's research into passive ice-phobic coatings — surfaces that ice simply can't stick to — and they've shown promise in the lab. But nothing that's durable enough for commercial aviation yet. The leading edge of a wing at four hundred knots sees erosion from rain, dust, insects — any coating has to survive that environment for thousands of hours. Right now, the most promising coatings last maybe a few hundred hours before they degrade.
The next generation of ice protection is still very much an open research problem. Which means the system we have — the three layers, the chemistry, the friction management, the regulatory framework — is going to be with us for a while.
It's worth appreciating how remarkable that system is. In the 1980s, ice was killing hundreds of people in commercial aviation. Today, millions of flights operate through winter weather every year, and ice-related accidents are extraordinarily rare. That didn't happen by accident. It happened because the industry studied the crashes, understood the physics, developed the chemistry, built the infrastructure, and wrote the regulations. It's one of the great unsung achievements in engineering safety.
Unsung because when it works, nothing happens. You land, you get off the plane, you complain about the delay. The most successful safety system in the world is the one you never notice.
And now: Hilbert's daily fun fact.
Hilbert: In the early Renaissance, lichen researchers in Papua New Guinea documented a single specimen of crustose lichen covering six hundred and forty square meters of rock face — an area larger than a professional basketball court — with an estimated growth rate of less than half a millimeter per year.
That lichen has been sitting there since roughly the invention of agriculture.
This has been My Weird Prompts. Thanks to our producer Hilbert Flumingtop. If you enjoyed this deep dive, rate the show and tell a friend who always asks why the plane needs to be sprayed. We'll be back next week.
