When the Dispatch Relief Was the Safety Margin: The A220 HPV Butterfly-Clip Emergency AD Through an ARP4761A and MMEL Lens

The most interesting thing about the emergency airworthiness directive that hit the Airbus A220 fleet last week is what it does not do. It does not mandate an inspection. It does not require a part replacement. It does not incorporate a single service bulletin. It walks past the airplane entirely and confiscates paperwork: seven Master Minimum Equipment List relief items and eighteen crew-alerting messages under which an A220 may no longer be dispatched. When a regulator's fastest available safety lever is deleting dispatch relief rather than touching hardware, it is telling you something precise about where the safety margin actually lived. It lived in the MMEL. And a broken retaining clip just spent it.

1. The public record

On June 29, 2026 the FAA issued Emergency AD 2026-13-52 directly to all known U.S. owners and operators of Airbus Canada Limited Partnership Model BD-500-1A10 and BD-500-1A11 airplanes — every A220-100 and A220-300, certificated in any category. The same requirements were published as a final rule on July 7, 2026 (91 FR 41542, Docket No. FAA-2026-7211), effective the day of publication, with comments open until August 21. The action is filed under ATA Code 36, Pneumatic, and the FAA estimates it reaches 211 U.S.-registered airplanes. The MCAI behind it is Transport Canada Emergency AD CF-2026-33R1, dated June 24, 2026.

The trigger is almost embarrassingly small. Per the MCAI, "it was reported to ACLP that several missing or broken HPV butterfly clips were found in a repair shop." The HPV is the high pressure valve — the valve that admits high-stage engine bleed air into the pneumatic system, and the thing you need to close when you want that air to stop. The butterfly clip is a retaining feature on that valve. Airbus Canada's assessment, quoted in the AD, is the sentence that does all the work: "failure of the butterfly clip may not be readily detected during operation and could remain latent until the next scheduled inspection or until secondary effects occur (e.g., bleed leak or overheat indications). Failure of the butterfly clip may also lead to degradation of the valve sealing function."

The FAA's statement of the end-state hazard is equally direct: the condition, if not addressed, "could result in the inability to properly isolate the bleed system when required, uncontrolled hot air leakage, overheating of critical airplane structures and components, and degradation of structural integrity" — and, in the good-cause justification for skipping notice and comment, the agency goes one step further: "This could lead to loss of control of the airplane."

So what does the AD actually require? Two prohibitions, both operational. First, no dispatch under the operator's MEL items corresponding to seven MMEL items: 30-11-00 (Wing Anti-Ice System), 30-12-01 (Wing Anti-Ice Pressure Sensor), 36-11-92 (Fan Air Valve), 36-12-00 (Bleed Air Systems), 36-12-01 (Engine Bleed Pressure Regulating Shutoff Valve), 36-12-05 (the HPV itself), and 36-21-03 (Pack Bleed Air Leak and Overheat Detection Loop). Second, no dispatch with any of eighteen enumerated CAS messages displayed — the L/R WING A/ICE LO HEAT cautions with HPV FAIL CLSD or temperature-sensor-inop info messages, the L/R BLEED FAIL cautions, the WING A/ICE FAULT valve-leak advisories, and the AIR SYSTEM FAULT advisories flagging an inoperative bleed monitor pressure sensor.

The FAA calls this interim action and says further rulemaking may follow. Translation: the inspection or design fix is coming; this AD exists to stop the bleeding — in this case literally, the bleed — until it does.

One more piece of record worth having on the table. This is not ATA 36's first supplier-quality escape on this airplane. In 2022-2023, Transport Canada chased a manufacturing escape in the bleed leak overheat detection sensing elements — elements built with insufficient salt fill that could fail to detect a hot-air leak at all (AeroTime's contemporaneous coverage). Read those two events together: the detection layer had a quality escape then, and the isolation layer has one now. Same system, both halves of the same fault tree, three years apart.

2. The standards lens

Start with why a retaining clip on one valve produces a fleet-wide emergency AD. The certification argument for the A220's bleed system runs through 14 CFR 25.1309 (via the Canadian equivalent, CAR 525.1309, and the type-certificate basis): failure conditions must be inverse in probability to severity, Catastrophic conditions must not result from a single failure, and — the clause this story turns on — the analysis must account for latent failures and bound their exposure time. The companion guidance in AC 25.1309-1B and the methodology in SAE ARP4761A are explicit that a latent failure combined with one subsequent active failure is the canonical dual-fault pattern, and that the probability math only closes if the latency period is capped by a scheduled check, a power-up test, or a monitor.

The A220's uncontrolled-hot-air-leak case was analyzed exactly that way. A bleed leak that overheats structure is classified Hazardous or worse in the System Safety Assessment, and the argument that it is sufficiently improbable rests on an AND: the leak has to happen, and the detection-and-isolation chain has to fail to contain it. The isolation chain is the PRSOV and the HPV closing on command. The detection chain is the overheat detection loop and the bleed pressure/temperature monitors feeding CAS. Every leg of that AND has a failure rate, and every latent leg has an assumed exposure time.

Now insert the butterfly clip. ACLP's own assessment says clip failure is not readily detectable in operation and can degrade the valve sealing function. That is a latent failure of the isolation leg — the HPV may not seal, and nobody knows until a scheduled inspection or until the secondary effects (a leak, an overheat indication) announce it. ARP4761A's latent-failure discipline exists precisely to catch this: any basic event marked dormant must have a bounded exposure interval, enforced through a Certification Maintenance Requirement or equivalent scheduled task. A clip whose failure is invisible for an unbounded interval means the fault tree's numbers were computed against an exposure time the hardware no longer honors.

But here is the lens I actually want to grind, because it is the part most engineering teams never write down: every MMEL relief item is a quantitative safety claim. When the MMEL says you may dispatch for N days with the pack bleed air leak and overheat detection loop inoperative, that relief was justified — through the MMEL system-safety justification process that FAA and Transport Canada both require — by an analysis showing the remaining protections keep the failure-condition probability acceptable for the relief interval. That justification assumed a healthy HPV: if a leak occurs while the detection loop is deferred, the crew can still isolate the bleed. Dispatch relief on the wing anti-ice system assumed the same valve behaves. The MMEL is not a list of things you can live without; it is a stack of conditional probability arguments, each conditioned on the rest of the system being at nominal reliability.

The butterfly clip broke the condition. With a credible latent seal-degradation mode in the HPV population, every MMEL item that leaned on "the HPV will isolate it" lost its justification simultaneously. That is why the AD reads the way it does. The regulators did not pull seven MMEL items because seven things failed — they pulled them because one latent failure mode invalidated the shared assumption under all seven. And the eighteen prohibited CAS messages are the same logic at the level of a single flight: each of those messages is the airplane reporting that one leg of the detection-or-isolation AND is already down. Yesterday that was a deferrable annoyance. Today, with the other leg suspect, it is a no-dispatch condition.

There is a supplier-quality thread here too — clips missing or broken at a repair shop points at AS9100/AS9110 process control questions that the eventual root-cause finding will have to answer — but the airworthiness lesson does not wait for that finding. The lesson is that the MMEL justification analysis is a living safety artifact with dependencies, and nobody's configuration management system treats it that way. When a new latent failure mode is discovered, the question "which MMEL reliefs assumed this component was healthy?" should be answerable by query, not by a week of engineers re-reading justification memos. Transport Canada answered it in days, which is fast — and the R1 in CF-2026-33R1 suggests even they needed a second pass to get the item list right.

3. A worked snippet — the fault tree the clip rewrote

The FHA row, in ARP4761A terms:

| ID | Function | Failure condition | Phase | Effect | Classification | Quantitative objective | |---|---|---|---|---|---|---| | FHA-BLD-02 | Bleed-air containment and isolation | Uncontrolled hot bleed-air leak not isolated; overheat of adjacent structure and systems | All phases | Structural degradation, potential loss of critical systems, potential loss of control | Hazardous–Catastrophic | ≤ 1×10⁻⁹ per flight hour at the Catastrophic end; no single failure (25.1309) |

And the tree that supports it. Watch where the clip lands — and where the MMEL lives:

TOP: Uncontrolled hot bleed-air leak overheats critical structure
     [Hazardous/Catastrophic, target <= 1E-9/FH]
        AND
        ├── G1: Hot high-stage air escapes / bleed system cannot be isolated
        │        OR
        │        ├── BE1  HPV butterfly clip missing/broken ->
        │        │        valve sealing degraded          [LATENT - exposure unbounded]
        │        ├── BE2  HPV fails to close on command
        │        └── BE3  PRSOV fails to regulate or shut off
        │
        └── G2: Leak not detected and annunciated in time to isolate
                 OR
                 ├── BE4  Overheat detection loop inoperative
                 │        [MMEL 36-21-03 deferral = scheduled entry into this state]
                 ├── BE5  Bleed monitor pressure sensor inoperative
                 │        [AIR SYSTEM FAULT advisory - previously dispatchable]
                 └── BE6  Bleed temperature sensor inoperative
                          [L/R BLEED FAIL info - previously dispatchable]

Two things this tree makes uncomfortable. First, BE1 was not in the certified tree — the clip's failure mode entered the fleet as an unanalyzed basic event with no exposure bound, which silently inflates G1's probability by an amount nobody can currently compute. Second, and worse: G2's basic events are purchasable states. An operator using MMEL 36-21-03 relief was deliberately standing in BE4 for up to the repair interval, on the strength of a justification that priced G1 at its certified value. Multiply a degraded G1 by a deferred G2 and the AND gate that made this failure condition "extremely improbable" is doing arithmetic the safety case never approved.

The MMEL items the AD pulled, mapped to the claim each one was silently making:

| MMEL item | Relief granted (pre-AD) | Hidden dependency on the HPV | |---|---|---| | 36-21-03 Leak/overheat detection loop | Dispatch with detection segment inop | A leak will still be isolated: HPV/PRSOV close and seal | | 36-12-00 / 36-12-01 Bleed system / PRSOV | Dispatch with one bleed degraded | Remaining valve chain, HPV included, isolates on demand | | 36-12-05 HPV | Dispatch with HPV inop (secured) | The other engine's HPV is healthy — now unverifiable | | 36-11-92 Fan Air Valve | Dispatch with FAV inop | Bleed temperature control degraded; leak margin intact | | 30-11-00 / 30-12-01 Wing anti-ice / pressure sensor | Dispatch with WAI degraded | Bleed supply and its containment behave as certified |

4. Derived requirements (excerpt)

If I owned this system, these are the rows the corrective-action package must produce — with the traceability spine back to the fault tree above. Values are illustrative targets; the certified numbers belong to ACLP.

| Req ID | Requirement text | Trace | Verification | |---|---|---|---| | REQ-BLD-101 | The HPV assembly shall retain its butterfly clip such that no single clip failure degrades valve sealing below the certified leakage limit, or clip failure shall be detectable within one flight cycle. | BE1 / G1 | Design analysis + endurance test to 2× inspection interval | | REQ-BLD-102 | Any latent failure mode of the bleed isolation chain shall have a bounded exposure time of ≤ 600 flight hours, enforced by a CMR or scheduled task in the maintenance program. | BE1, BE2 / ARP4761A latent-failure analysis | Maintenance program audit; CMR listing | | REQ-BLD-103 | The bleed system shall annunciate degraded HPV sealing (leakage above threshold with valve commanded closed) within 60 seconds, independent of the pack overheat detection loop. | G2 independence | Rig test with seeded clip failure | | REQ-MEL-104 | Each MMEL justification for ATA 30/36 relief shall record, as structured data, every component whose nominal reliability the justification assumes; discovery of a new latent failure mode in any listed component shall trigger re-validation of dependent reliefs within 72 hours. | MMEL process gap | Process audit; tabletop exercise | | REQ-QMS-105 | Clip installation and retention shall be a verifiable characteristic at valve overhaul, with acceptance criteria and recorded inspection results per AS9110 shop process control. | Repair-shop finding | Supplier/shop audit; FAI records |

REQ-MEL-104 is the one nobody will want to own, because it is a process requirement rather than a hardware one, and it lands on the desk of whoever maintains the MMEL justifications rather than whoever designs valves. It is also the only one on this list that would have shortened the gap between "clips found in a repair shop" and "dispatch relief withdrawn" from weeks to hours, on any aircraft type, for any future escape.

5. What the headline really tells us

The headline says an emergency AD restricted A220 dispatch. What actually happened is that a latent failure mode was discovered in the isolation leg of a certified AND gate, and the regulators — correctly — recognized that the fastest way to restore the safety margin was not to fix the valve but to stop spending the margin through the MMEL. Dispatch relief is margin. It always was. The missing artifact here is not another fault tree; ACLP has the fault tree. It is the dependency map between the fault tree and the MMEL justifications built on top of it — the artifact that turns "we found broken clips" into "here are the seven reliefs that just lost their basis" without a human having to remember where the bodies are buried. The A220 got that answer in about five days because Transport Canada moved fast. The system that makes it an hour is just traceability, and traceability is a choice.

— Jherrod Thomas, The Lion of Functional Safety™