Icing, Systems, and Human Factors: Preliminary Findings on Voepass flight 2283
On the 9th of August 2024 at 16:22, Voepass flight 2283, a scheduled flight from Cascavel, Paraná, to Guarulhos, São Paulo entered a flat spin and crashed into a residential district, killing everyone on board.
CENIPA (CENtro de Investigação e Prevenção de Acidentes Aeronáuticos), the Brazilian Aeronautical Accidents Investigation and Prevention Centre, is charged with investigating this tragic accident. On the 7th of September, CENIPA released their preliminary report. This report does not draw conclusions but it offers the first full timeline of events.
There were two flight crew, two cabin crew, and 58 passengers on board when the aircraft, an ATR 72-212A (ATR 72-500) departed Coronel Adalberto Mendes da Silva Airport in Cascavel.
Both pilots were very experienced, each with over 5,000 hours of flight experience. However, the captain had just 665 hours on type, presumably having recently transitioned to the ATR. The first officer had much more ATR experience with 3,543 hours on type. They had both performed theory and practice training and their time in flight simulators including emergency training and flight management in icing conditions.
The estimated flight time was an hour and forty-five minutes for the flight of 735 km. The weather was overcast for the flight route, with cloud tops reaching temperatures forecast from 0° to -35°C (32° to -31°F). The flight crew adjusted the icing bug to 165 knots. The icing bug is set every flight and indicates the minimum viable speed in icing conditions.
About 15 minutes into the flight, while flight 2283 was climbing to their cruise altitude of FL170 (~17,000 feet), the flight crew turned on the propeller anti-icing for both engines, which is standard procedure for potential icing conditions.
A few minutes later, as they passed through FL130 (~13,000 feet), the Electronic Ice Detector illuminated an amber light on the centre panel and sounded an alert, warning the crew of potential icing conditions and that ice may be accumulating on the aircraft.
The crew activated the airframe de-icing system, which removes ice already forming on the aircraft skin.
A single chime sounded. The crew discussed that there was a fault with the airframe de-icing. The airframe de-icing system turned off.
A few seconds later, the Electronic Ice Detector was still.
Icing, in an aviation context, is the accumulation of ice on the aircraft. When an aircraft changes from a cold area to a warmer and moister atmosphere, hoar frost can build up on the aircraft. Flying in clouds of cold and warm fronts can lead to very small supercooled water droplets which build up as rime ice on the parts of the aircraft exposed to the wind: probes, antennas, and the leading edges of the wings and tail. In severe icing conditions where the aircraft must fly through cloud layers with high liquid water content, supercooled water droplets spread along the aircraft fuselage and then freeze into clear ice, causing horns and shapes on the aircraft which can dramatically disrupt the airflow. Accumulation of clear ice or mixed ice, a combination of rime and clear ice, can seriously degrade the performance of the aircraft. Finally, glaze ice forms when flying through freezing rain, as large supercooled water droplets land and spread on the aircraft’s surface before freezing. The result of glaze ice is very similar to clear or mixed ice; however, it is particularly dangerous because of the speed with which the ice accumulates on the fuselage.
About thirty seconds later, the Electronic Ice Detector lit up and sounded again, turning off after two minutes. Over the next hour, as they cruised at FL170 (~17,000 feet), the ice detector sounded three more times, suggesting that the ATR was flying in and out of icing conditions.
The temperature at their cruising altitude was around -9° with westerly winds at 46 knots.
At no point during this hour did the flight crew reactivate the airframe de-icing system.
As the flight drew closer to its destination, the first officer contacted the Voepass operational dispatcher at Guarulhos to coordinate their arrival. A cabin crew member contacted the flight deck, but the first officer asked her to wait while he finished dealing with dispatch.
The captain made a passenger announcement to give the Guarulhos weather information and estimated time left in the flight.
The Electronic Ice Detector sounded again. One of the pilots turned the airframe de-icing system back on.
The Aircraft Performance Monitoring (APM) system triggered an alert. The Aircraft Performance Monitoring compares the aircraft’s performance data to the expected performance to predict the accumulation of ice. In order to do this, the APM uses the calculated take-off weight entered by the pilots at engine start using a rotary knob on the APM panel.
The APM had triggered a CRUISE SPEED LOW alert in blue. The ATR’s airspeed was 191 knots. The CRUISE SPEED LOW is the first level of APM alert, and means that the indicated airspeed is at least ten knots slower than the predicted speed for their current configuration.
The first officer finished collecting the arrival information from dispatch and the captain began the landing briefing. They were interrupted by São Paulo Approach asking them to try a different radio frequency, as they had reported a slight echo on the frequency. During the conversation with the controller, there was the sound of a single chime on the cockpit voice recorder.
The airframe de-icing system turned off.
Weather warnings had been issued for severe icing conditions in the area, forecasting icing between 12,000 and 21,000 feet. The icing conditions were associated with a cold front moving through the region.
On a jet aircraft, the hot air from the engines are routed to the critical surfaces of the aircraft, offering continuous thermal protection. In a turboprop like the ATR, it’s not practical to offer constant protection. On the ATR, a pneumatic de-icing system protects the critical parts of the airframe, for example the leading edges of the wings and tails, and electronic anti-icing protection is applied on the windshields, probes, sensors and propellers. The pneumatic de-icing system must be turned on when in icing conditions.
The flight crew contacted São Paulo Approach on the new frequency and received no response. When they called a second time, the approach controller asked them to maintain FL170 (17,000 feet) to remain clear of other traffic. The crew acknowledged and said that they were at the ideal point of descent and waiting for clearance.
While this exchange was going on, another single chime sounded and an alert appeared for DEGRADED PERFORMANCE in amber. The ATR’s airspeed was 184 knots. The DEGRADED PERFORMANCE alert is a second level APM alert which indicates a significant performance degradation of 22-28%. This signifies a significant increase in drag which is causing the airspeed to drop by 15 to 20 knots.
The approach controller instructed the crew to continue to wait for the descent clearance. The following is a radar return showing the airspace at that moment.
The captain resumed the approach briefing. During this, the first officer remarked that there was “a lot of icing”. Someone, probably the first officer, turned on the airframe de-icing system for the third time.
São Paulo Approach cleared the flight to fly direct to the SANPA waypoint, maintaining FL170. The controller advised that their descent would be authorised in the next two minutes. The flight crew confirmed SANPA. This was their final communication with ATC.
The flight crew turned right to fly to the SANPA waypoint. As the ATR entered the turn, the INCREASE SPEED alert was triggered as a flashing message with a single chime and a master caution alert. The aircraft’s airspeed had decayed to 169 knots. This is the third level of APM alert, indicating that the airspeed was falling below the minimum severe icing speed.
On the cockpit voice recorder are the sounds of vibration and the stall warning siren.
The pilots lost control of the aircraft as the ATR rolled left to a 52° bank angle and then right to 94° while performing a 180° clockwise turn. Then the turn reversed direction and the ATR entered a flat spin, rotating five times before crashing into the ground and bursting into flames.
Here is a YouTube link to the heartbreaking video of the aircraft in the spin.
São Paulo Approach cleared the flight to descend to FL 090 (~9,000 feet) and continue to SANPA. The controller received no response and called again, this time asking the flight to confirm the heading that they were maintaining. The controller called again and again, five times over the next 50 seconds, but received no answer. Flight 2283 had crashed into the grounds of a house, forty nautical miles northwest of Guarulhos Airport.
The preliminary report covers the anti-icing and de-icing systems in great detail, along with the correct procedures in severe icing. This shows severe icing and the reaction as a leading direction of inquiry in the first instance.
The ATR Cold Weather Operations handbook gives four levels of icing with recommendations to the flight crew. The highest, severe icing, reads as follows (bolding in the original):
Severe icing
Severe icing indicates that the rate of accumulation is so fast that ice protection systems fail to remove the accumulation of ice (1 cm in less than 5 minutes). The crew need to exit this condition immediately.
Severe icing is usually a product of clear or mixed icing encounter. Severe icing occurs most frequently in areas where the air has high content of liquid water or there are very large droplets.
Pilot action recommendation:
Immediate pilot action is required. Performance and handling may be seriously affected after only a few minutes exposure. Activate the ice protection system and work to exit the conditions immediately.
There is a fair amount of detail about the aircraft’s pneumatic system but the key point is that the pneumatic system had two packs, one on either side of the aircraft, which were fed from the bleed air of the that-side engine.
This is important because Pack 1, the left-side pack which was fed bleed air from the left-hand engine, had been marked as inoperative on the 5th of August 2024, four days before the fatal accident.
Aircraft have a minimum equipment list (MEL) which lists the equipment that the aircraft is not required to have onboard. The instruments and equipment which are not essential to the safety of the flight can be listed on the MEL allowing the captain to take the decision to continue the flight without the listed equipment. As an example, a commercial flight does not have to be cancelled because a fire extinguisher in a lavatory has failed; the captain can decide that it is safe to continue, as long as he or she follows the MEL requirement to lock the lavatory door to stop it from being used.
The minimum equipment list had specific conditions for the situation where one of the packs was inoperative, including that a placard be placed in the cockpit to show that the pack was not available and that a specific operational procedure was required.
There were two specific requirements for an aircraft flying with an inoperative pack:
The pack must be selected to OFF
The flight level must be limited to FL 170
The operational procedure referred to the fuel calculations and that the engine related to the pack would see increased engine torque, thus a power level adjustment was needed for the affected engine, in this case, the left one.
There is no information as to whether the captain signed off on the inoperative pack or if this could have affected the de-icing system. However, it is of note that the aircraft operated within the altitude restriction.
The report concludes that the investigation will focus on the following:
- Human Factors – exploring the individual, psychosocial, and organizational conditions related to the crew’s performance in the situation experienced by them;
- Material Factor – seeking to ascertain the airworthiness condition of the aircraft. Special attention will be given to the aircraft’s Anti-Icing, De-Icing and stall protection systems; and
- Operational Factor – analyzing the aspects related to the technical performance of the crew and of the elements related to the operational environment in the context
of this accident.
This report paints a picture of a flight in increasingly severe icing conditions. The failure of Pack 1 brings the aircraft’s pneumatic system into question. The airframe de-icing system was clearly not operating as intended. Although we can’t say for sure what was happening and the report doesn’t make any explicit statement on the matter, it sure seems like the airframe de-icing system fault that the crew mentioned was causing the system to shut itself off. More importantly, there’s no sign that the crew realised this. The flight crew’s actions show that they were unaware of the speed at which their aircraft was accumulating ice and especially that they did not understand the seriousness of the situation.
CENIPA’s focus on human, material and operational factors seems very sensible and I hope that, when the final report is released, we will gain more insight into the key causes of the crash of Voepass flight 2283.
I’m wondering how the crew ranking system works for this airline; do they usually let someone with captain’s bars on a different aircraft type come in over a first officer with much more experience on type? I’m remembering discussion about KAL 007, in which it was suggested that if the captain made a navigational error the first officer might not feel empowered to correct it. This might not have been a factor here as pilot training has become more aware of the need for proper Cockpit Resource Management; it will be interesting to see what the final report says, especially if there’s any info from the cockpit voice recorder.
It will also be interesting to see what procedures the carrier had in place to make sure pilots were aware of sub-critical defects in their aircraft.
It is interesting how the two had a similar amount of total hours but the FO was much more experienced on type. That said, the cockpit voice recorder doesn’t show much sign of the FO being aware that they were in dangerous straits. I think the fatigued felt by both crew members have a lot to do with that; it was the last flight before getting back home after a strenuous day, so it would be normal to feel like you just want to get there.
The scary thing about the data is that we can see the performance of the aircraft get steadily worse, with speed bleeding off in level flight, and 3 consecutive alerts generated by the avionics, yet the pilots did nothing to counteract that loss of speed (or the ice buildup) until it was too late and the aircraft stalled. They seem to not have realized how dangerous their situation was.
Yes. The final report will shed some further light on this but I think it is clear that something wasn’t working as intended and that the pilots had no idea how dangerous a situation they were in. I’d like to understand what the first officer saw that caused him to comment on the icing without considering an emergency descent.
Doesn’t sound like the crew were aware or remembered that the anti-icing system was only half working. Horrible.
Sorry to be pedantic :”the MEL does not list systems that are not required to be on board”. No, the MEL lists systems that may be inoperative under certain circumstances. Limitations are also part of this, including for instance restrictions such as weather conditions, nav aids, a time limit, or the correction can be deferred until the aircraft is at a station where repairs can be effected. This usually carries a limit of time or a maximum number of flight cycles.
I have been away and just skim over this, but I have been a captain on ATR 42. We operated the ATR mainly in Ireland and the UK, so icing is not an unknown phenomenon here.
I cannot remember any problems with icing, as long as proper procedures would be adhered to.
Leaving other areas, such as pitot, windscreens, static ports, engine intakes,, propellers etc. aside, I am referring to airframe de- or anti icing here.
High performance aircraft, especially jets, have different systems to cope with airframe icing. Usually by bleed air, but some use a fluid (TKS) that can be forced through a maze of fine openings onto the leading edges.
This must be done BEFORE entering icing conditions as this is an anti-ice protection. Citation 500 series usually have boots, some used TKS, the more sophisticated types had very efficient boots that barely affected the aerodynamic efficiency of the wings.. The leading edges in front of the engines were electrically heated.
Icing must ALWAYS be considered as a serious hazard.
If I read this correctly, there seems to have been a problem with the airframe de-icing system.
And if that was the case, especially prior to the flight, this should have restricted the aircraft to operate clear of known icing conditions and marked as such on the MEL. In other words: if this is true, it should not have been dispatched for this flight at all.
So, there is a difference between de-icing and anti-icing.
In older types of prop aircraft the crew would observe ice accumulation and if there was a certain sufficient amount of ice accretion the crew would activate the “boots”. They would inflate and break the ice. The fragments would then be blown off by the airflow.
At night, often a light illuminating the leading edge would be available in order to enable the crew to monitor the extent of the ice accretion.
The ATR has a modern critical wing profile. It enhances the aerodynamic efficiency, but is far less tolerant to any disturbance of the airflow.
The procedure on the ATR was to turn ON the airframe system (and of course other relevant systems)at the first ICE warning. They would remain on as long as the warning was illuminated. This means CONTINUOUSLY ON. The crew could judge if and when it was time to cycle the boots again. Not by observing the wings, but when prompted by the “ICE” warning.
If there was an intermittent fault with the system, and encountering icing conditions (the warning), the crew should have declared an emergency.
And I wonder: if there was a problem with only one of the leading edge boots: was there more ice on one wing than on the other?
I do not want to even suggest that “pilot error” was the case. But this crew might not have been exposed to the dangers of anti-icing very often as they were more used to warmer climates.
The pilots, judging from what I read here, certainly seemed to have underestimated the grave danger they were in.
The stall speed increases considerably with icing, but the stall warning may not necessarily have sounded, or stick shaker not activated before it was too late. The one and only remedy, if they realised in time, just might have been to shove the controls forward manually and declare a “Mayday” Which is what they probably should have done when the aircraft started to build up ice without the leading edges systems working properly.
I feel sad for the crew and passengers, the untimely loss of life is always a tragedy. May they rewst in peace..
The MEL always trips me up! I was hoping you’d comment, though, as I knew you would be able to talk about the ATR and Icing.
This is one reason why I think that the crew were not aware of the issue. They turned it on as they climbed into icing conditions and it then turned itself off but they believed it to be on. When one of them turned it back on later, it should have been noticed but again, there’s no reaction to it turning itself off. Maybe one of the crew did this but I rather suspect it disengaged for some reason.
Sylvia,
The airframe ice protection of older, usually propeller driven aircraft as I mentioned was usually in the form of inflatable rubber strips along the leading edges of wings and empennage.
It was essential for the crew to activate them only AFTER a certain amount of ice accumulation. It had to be thick enough to burst; the airflow would then dispense with the shards of ice.
Premature activation could cause the ice to be pushed outwards from the surface of the boots, but remain in place, leaving a small space between the wing and the ice.
Further ice would accumulate on top of this, but the free space under the ice would prevent the boot from breaking the ice. This could of course be catastrophic.
The wings would be thick and relatively tolerant to a certain amount of ice accumulation – only IN FLIGHT. Never before take-off because performance would be limited, not seldom severely so. Too many recorded accidents were caused by attempted take-off with ice on the aircraft.
The wing profile of the ATR is of a much more efficient “super critical” air foil design. Nothing scary, it is just jargon.
But this wing is far less tolerant to aerodynamic disturbance, such as icing. So the “boots” of the ATR would be turned on and cycled continuously as soon as the ice warning would illuminate. Together with other ice protection systems of course.
If the anti-ice system switched itself off, there should have been an alert in the cockpit to warn the crew.
During our conversion to the ATR we were made very much aware of the need to ensure that all systems would operate, and if not: get the heck out of icing conditions and if necessary declare an emergency.
I have once been taken by surprise by severe icing conditions in a Cessna 310. I was flying from Cannes Mandelieu to Amsterdam.
The forecast was okay, but I had to cross mountainous terrain before reaching the safer regions near the Rhone. I was a bit hesitant.
An American in another 310 arrived from Maastricht and had just flown through the same area. He told me that the weather was full IMC, but otherwise had not encountered any problems.
Our 310 was certified for flying in known icing conditions; the cabin was heated by a factory installed petrol-burning heater. Very efficient, but this time it did not work. At FL 100 it was far below zero inside. Soon we sat huddled in our seats, wrapped in rugs (we always had a set with us). The windows frosted over inside. The cold affected my reactions too.
My passenger asked about the de-icing. I cleared some of the frost from the window, saw that it was time to activate the boots again and demonstrated how this removed the ice.
I was on autopilot. Soon, very soon after I had cycled the boots the aircraft suddenly rumbled. That is the best way to describe it. I believe that the IAS was around 150 kts when the aircraft stalled. Adrenalin chased the inertia of my cold-soaked body away, I disconnected the autopilot, shoved the controls full forward, cycled the boots, increased the engines’ rpm – all more or less simultaneously – and squawked A7700. I asked Marseille ATC to give me a heading away from the highest ground whilst descending. I had the aircraft – and the situation – under full control again by the time we passed the Lyon area and I cancelled the emergency.
We continued to Amsterdam where some ice sheets still fell off the underside of the aircraft.
The weather must have deteriorated very rapidly after our departure, and the failure of the cabin heater did not help.
This event taught me to take icing very seriously indeed.
On a more humorous note: I had started in Ryanair on the BAC 1-11 when there was an opening for a command on the ATR.
It was uncertain when a command on the 1-11 would come up, so I took it. Also because the ATR was a much more modern aircraft with GLASS COCKPIT (Wow, the most modern stuff then !)). In some aspects a step down, but a step forward for a chance to work with what was then an ultra- modern cockpit.
To diverge for a moment: I hade become a captain, but some of my co-pilots had far more experience on the ATR. Promotion often goes by seniority, but especially in young airlines also often on the basis of total experience.
Anyway, after completing the training I started my line training. It is customary to check the brakes just as the aircraft pulls away from the stand, or commences taxy after push-back.
The passenger entrance was at the back. Between the cockpit and the passenger cabin was a relatively large cargo area, mainly for the storage of luggage. The ATR did not have underfloor baggage compartments.
There was a door in the bulkhead screening the passenger area, and another one at the back of the cockpit. The luggage was stored behind webbing, leaving a walkway to the cockpit.
In those days, we did not lock these doors.
We moved off-block and I tipped the brakes.
I was still used to the rather heavy brake pressure required on the 1-11, The ATR needed a lot less, so the brake check was a bit abrupt.
Unfortunately the cabin crew had just started their safety demo, and one of the attendants who had been standing at the front of the cabin suddenly found herself seated on the pedestal in the cockpit. To the great hilarity of the passengers.
(No, she was not injured.)
That safety demo moment must have been quite the scene! You have great stories about your time on the ATR; I love to hear them.
Cracking good stories, thanks! That Cessna icing would’ve been a real brown trousers moment. Have always been interested in the ATR aerodynamics; did a bit of aerodynamic research back in the day and have been enjoying watching wing shapes change over the years.
Your brake testing story is reminiscent of my first day with a driver’s license… learned to drive in mum’s 1960 Morris Minor (barely functional drum brakes), then dad gave me his Volvo station wagon on day 1. Drove down the road and stopped 20m short of the intersection with the windscreen wipers going (indicator on the other side too!).