Icing, Systems, and Human Factors: Preliminary Findings on Voepass flight 2283
On the 9th of August 2024 at 16:22, Voepass flight 2283, a scheduled flight from Cascavel, Paraná, to Guarulhos, São Paulo entered a flat spin and crashed into a residential district, killing everyone on board.
CENIPA (CENtro de Investigação e Prevenção de Acidentes Aeronáuticos), the Brazilian Aeronautical Accidents Investigation and Prevention Centre, is charged with investigating this tragic accident. On the 7th of September, CENIPA released their preliminary report. This report does not draw conclusions but it offers the first full timeline of events.
There were two flight crew, two cabin crew, and 58 passengers on board when the aircraft, an ATR 72-212A (ATR 72-500) departed Coronel Adalberto Mendes da Silva Airport in Cascavel.
Both pilots were very experienced, each with over 5,000 hours of flight experience. However, the captain had just 665 hours on type, presumably having recently transitioned to the ATR. The first officer had much more ATR experience with 3,543 hours on type. They had both performed theory and practice training and their time in flight simulators including emergency training and flight management in icing conditions.
The estimated flight time was an hour and forty-five minutes for the flight of 735 km. The weather was overcast for the flight route, with cloud tops reaching temperatures forecast from 0° to -35°C (32° to -31°F). The flight crew adjusted the icing bug to 165 knots. The icing bug is set every flight and indicates the minimum viable speed in icing conditions.
About 15 minutes into the flight, while flight 2283 was climbing to their cruise altitude of FL170 (~17,000 feet), the flight crew turned on the propeller anti-icing for both engines, which is standard procedure for potential icing conditions.
A few minutes later, as they passed through FL130 (~13,000 feet), the Electronic Ice Detector illuminated an amber light on the centre panel and sounded an alert, warning the crew of potential icing conditions and that ice may be accumulating on the aircraft.
The crew activated the airframe de-icing system, which removes ice already forming on the aircraft skin.
A single chime sounded. The crew discussed that there was a fault with the airframe de-icing. The airframe de-icing system turned off.
A few seconds later, the Electronic Ice Detector was still.
Icing, in an aviation context, is the accumulation of ice on the aircraft. When an aircraft changes from a cold area to a warmer and moister atmosphere, hoar frost can build up on the aircraft. Flying in clouds of cold and warm fronts can lead to very small supercooled water droplets which build up as rime ice on the parts of the aircraft exposed to the wind: probes, antennas, and the leading edges of the wings and tail. In severe icing conditions where the aircraft must fly through cloud layers with high liquid water content, supercooled water droplets spread along the aircraft fuselage and then freeze into clear ice, causing horns and shapes on the aircraft which can dramatically disrupt the airflow. Accumulation of clear ice or mixed ice, a combination of rime and clear ice, can seriously degrade the performance of the aircraft. Finally, glaze ice forms when flying through freezing rain, as large supercooled water droplets land and spread on the aircraft’s surface before freezing. The result of glaze ice is very similar to clear or mixed ice; however, it is particularly dangerous because of the speed with which the ice accumulates on the fuselage.
About thirty seconds later, the Electronic Ice Detector lit up and sounded again, turning off after two minutes. Over the next hour, as they cruised at FL170 (~17,000 feet), the ice detector sounded three more times, suggesting that the ATR was flying in and out of icing conditions.
The temperature at their cruising altitude was around -9° with westerly winds at 46 knots.
At no point during this hour did the flight crew reactivate the airframe de-icing system.
As the flight drew closer to its destination, the first officer contacted the Voepass operational dispatcher at Guarulhos to coordinate their arrival. A cabin crew member contacted the flight deck, but the first officer asked her to wait while he finished dealing with dispatch.
The captain made a passenger announcement to give the Guarulhos weather information and estimated time left in the flight.
The Electronic Ice Detector sounded again. One of the pilots turned the airframe de-icing system back on.
The Aircraft Performance Monitoring (APM) system triggered an alert. The Aircraft Performance Monitoring compares the aircraft’s performance data to the expected performance to predict the accumulation of ice. In order to do this, the APM uses the calculated take-off weight entered by the pilots at engine start using a rotary knob on the APM panel.
The APM had triggered a CRUISE SPEED LOW alert in blue. The ATR’s airspeed was 191 knots. The CRUISE SPEED LOW is the first level of APM alert, and means that the indicated airspeed is at least ten knots slower than the predicted speed for their current configuration.
The first officer finished collecting the arrival information from dispatch and the captain began the landing briefing. They were interrupted by São Paulo Approach asking them to try a different radio frequency, as they had reported a slight echo on the frequency. During the conversation with the controller, there was the sound of a single chime on the cockpit voice recorder.
The airframe de-icing system turned off.
Weather warnings had been issued for severe icing conditions in the area, forecasting icing between 12,000 and 21,000 feet. The icing conditions were associated with a cold front moving through the region.
On a jet aircraft, the hot air from the engines are routed to the critical surfaces of the aircraft, offering continuous thermal protection. In a turboprop like the ATR, it’s not practical to offer constant protection. On the ATR, a pneumatic de-icing system protects the critical parts of the airframe, for example the leading edges of the wings and tails, and electronic anti-icing protection is applied on the windshields, probes, sensors and propellers. The pneumatic de-icing system must be turned on when in icing conditions.
The flight crew contacted São Paulo Approach on the new frequency and received no response. When they called a second time, the approach controller asked them to maintain FL170 (17,000 feet) to remain clear of other traffic. The crew acknowledged and said that they were at the ideal point of descent and waiting for clearance.
While this exchange was going on, another single chime sounded and an alert appeared for DEGRADED PERFORMANCE in amber. The ATR’s airspeed was 184 knots. The DEGRADED PERFORMANCE alert is a second level APM alert which indicates a significant performance degradation of 22-28%. This signifies a significant increase in drag which is causing the airspeed to drop by 15 to 20 knots.
The approach controller instructed the crew to continue to wait for the descent clearance. The following is a radar return showing the airspace at that moment.
The captain resumed the approach briefing. During this, the first officer remarked that there was “a lot of icing”. Someone, probably the first officer, turned on the airframe de-icing system for the third time.
São Paulo Approach cleared the flight to fly direct to the SANPA waypoint, maintaining FL170. The controller advised that their descent would be authorised in the next two minutes. The flight crew confirmed SANPA. This was their final communication with ATC.
The flight crew turned right to fly to the SANPA waypoint. As the ATR entered the turn, the INCREASE SPEED alert was triggered as a flashing message with a single chime and a master caution alert. The aircraft’s airspeed had decayed to 169 knots. This is the third level of APM alert, indicating that the airspeed was falling below the minimum severe icing speed.
On the cockpit voice recorder are the sounds of vibration and the stall warning siren.
The pilots lost control of the aircraft as the ATR rolled left to a 52° bank angle and then right to 94° while performing a 180° clockwise turn. Then the turn reversed direction and the ATR entered a flat spin, rotating five times before crashing into the ground and bursting into flames.
Here is a YouTube link to the heartbreaking video of the aircraft in the spin.
São Paulo Approach cleared the flight to descend to FL 090 (~9,000 feet) and continue to SANPA. The controller received no response and called again, this time asking the flight to confirm the heading that they were maintaining. The controller called again and again, five times over the next 50 seconds, but received no answer. Flight 2283 had crashed into the grounds of a house, forty nautical miles northwest of Guarulhos Airport.
The preliminary report covers the anti-icing and de-icing systems in great detail, along with the correct procedures in severe icing. This shows severe icing and the reaction as a leading direction of inquiry in the first instance.
The ATR Cold Weather Operations handbook gives four levels of icing with recommendations to the flight crew. The highest, severe icing, reads as follows (bolding in the original):
Severe icing
Severe icing indicates that the rate of accumulation is so fast that ice protection systems fail to remove the accumulation of ice (1 cm in less than 5 minutes). The crew need to exit this condition immediately.
Severe icing is usually a product of clear or mixed icing encounter. Severe icing occurs most frequently in areas where the air has high content of liquid water or there are very large droplets.
Pilot action recommendation:
Immediate pilot action is required. Performance and handling may be seriously affected after only a few minutes exposure. Activate the ice protection system and work to exit the conditions immediately.
There is a fair amount of detail about the aircraft’s pneumatic system but the key point is that the pneumatic system had two packs, one on either side of the aircraft, which were fed from the bleed air of the that-side engine.
This is important because Pack 1, the left-side pack which was fed bleed air from the left-hand engine, had been marked as inoperative on the 5th of August 2024, four days before the fatal accident.
Aircraft have a minimum equipment list (MEL) which lists the equipment that the aircraft is not required to have onboard. The instruments and equipment which are not essential to the safety of the flight can be listed on the MEL allowing the captain to take the decision to continue the flight without the listed equipment. As an example, a commercial flight does not have to be cancelled because a fire extinguisher in a lavatory has failed; the captain can decide that it is safe to continue, as long as he or she follows the MEL requirement to lock the lavatory door to stop it from being used.
The minimum equipment list had specific conditions for the situation where one of the packs was inoperative, including that a placard be placed in the cockpit to show that the pack was not available and that a specific operational procedure was required.
There were two specific requirements for an aircraft flying with an inoperative pack:
The pack must be selected to OFF
The flight level must be limited to FL 170
The operational procedure referred to the fuel calculations and that the engine related to the pack would see increased engine torque, thus a power level adjustment was needed for the affected engine, in this case, the left one.
There is no information as to whether the captain signed off on the inoperative pack or if this could have affected the de-icing system. However, it is of note that the aircraft operated within the altitude restriction.
The report concludes that the investigation will focus on the following:
- Human Factors – exploring the individual, psychosocial, and organizational conditions related to the crew’s performance in the situation experienced by them;
- Material Factor – seeking to ascertain the airworthiness condition of the aircraft. Special attention will be given to the aircraft’s Anti-Icing, De-Icing and stall protection systems; and
- Operational Factor – analyzing the aspects related to the technical performance of the crew and of the elements related to the operational environment in the context
of this accident.
This report paints a picture of a flight in increasingly severe icing conditions. The failure of Pack 1 brings the aircraft’s pneumatic system into question. The airframe de-icing system was clearly not operating as intended. Although we can’t say for sure what was happening and the report doesn’t make any explicit statement on the matter, it sure seems like the airframe de-icing system fault that the crew mentioned was causing the system to shut itself off. More importantly, there’s no sign that the crew realised this. The flight crew’s actions show that they were unaware of the speed at which their aircraft was accumulating ice and especially that they did not understand the seriousness of the situation.
CENIPA’s focus on human, material and operational factors seems very sensible and I hope that, when the final report is released, we will gain more insight into the key causes of the crash of Voepass flight 2283.
I’m wondering how the crew ranking system works for this airline; do they usually let someone with captain’s bars on a different aircraft type come in over a first officer with much more experience on type? I’m remembering discussion about KAL 007, in which it was suggested that if the captain made a navigational error the first officer might not feel empowered to correct it. This might not have been a factor here as pilot training has become more aware of the need for proper Cockpit Resource Management; it will be interesting to see what the final report says, especially if there’s any info from the cockpit voice recorder.
It will also be interesting to see what procedures the carrier had in place to make sure pilots were aware of sub-critical defects in their aircraft.