On August 9th, 2024, video of an ATR 72 in a flat spin went viral. It was a remarkable and devastating moment memorializing the deaths of all 62 occupants aboard the 76-seat turboprop. With severe ice forecasted in the area, the culprit quickly became obvious. Still, the question remained: how did two professional pilots, in an aircraft equipped for flight in icing conditions, manage to lose control of an airliner?
The Aircraft
The accident aircraft was an ATR 72-500. It was a legacy version of the twin turboprop, utilizing an assortment of round gauges instead of the more streamlined flatscreens prevalent in the newer -600 models (Voepass operated both variants). The accident aircraft was equipped with two pneumatic air conditioning kits (PACKs), which conditioned pressurized air from bleeds tapped from the compressor section of the Pratt & Whitney engines. One of the PACKs had malfunctioned on a previous flight and had been deferred through a minimum equipment list (MEL). This allows airlines to continue operating aircraft with certain inoperable components until a maintenance fix can be scheduled. In the case of a single PACK MEL, the aircraft was restricted to a maximum altitude of 17,000 feet. A SIGMET forecasted FGA (severe ice) between 12,000 and 21,000 feet. Severe ice is defined as a rate of accumulation such that anti-icing and de-icing equipment cannot control or reduce the hazard. Operation in forecasted areas without an escape plan (i.e., the ability to climb above or descend below the ice levels) is inadvisable.
The aircraft was equipped with an ice evidence probe (IEP) and an ice detector. The IEP was a small airfoil that protruded just below the captain’s side view window. Ice that accumulated on the probe provided a visual indication of accumulation on unprotected surfaces. The ice detector located on the wing was a probe that vibrates at a certain frequency. When ice accumulates the frequency changes. This generates an amber alert, ICE DETECT, along with a single chime for flight crew awareness. In addition to this, ATR had developed an aircraft performance monitoring (APM) system which calculated predicted cruise speed based on air data, power setting, and aircraft weight (which was input each flight by the crew via a rotary knob). The system provided alerts at three levels. CRUISE SPEED LOW was a blue colored annunciation that alerted the crew when actual airspeed was 10% below predicted airspeed. DEGRADED PERFORMANCE was amber and accompanied by a single chime to alert crews of a 22% to 28% degradation of airspeed. These two preemptive alerts indicated that ice accumulation might be adversely affecting performance. A final alert warned when the aircraft was approaching a stall in icing conditions.
The number of icing detection/protection layers is extensive. There is a reason for this. This was not the first ice-related crash in the ATR’s varied history. On Halloween in 1994, Simmons Airlines flight 4184 (doing business as American Eagle) crashed into a soybean field in Roselawn, Indiana. NTSB investigators later determined that the aircraft had encountered severe icing conditions. The pilots had been holding due to flow into Chicago O’Hare airport. They had extended flaps in the hold in response to an uncomfortable deck angle at the slow holding airspeed. Ice gradually accumulated aft of the protected surfaces, which resulted in abnormal aerodynamic forces on the ailerons. This caused the aileron to snap into full deflection once the flaps were retracted when the aircraft exited the holding pattern. The resulting roll instability led to a loss of aircraft control. All 68 occupants were killed. For a short period after the crash, the FAA prohibited the ATR fleet from operations in areas of known icing. New deice boots were quickly developed and installed that protected further aft along the top of the wing. American Eagle eventually banished their fleet of ATRs to island hopping out of Puerto Rico.
No More Turboprops
ATR was not the only turboprop to suffer a public crash in cold weather. The last fatal airline crash in the United States occurred in 2009 when a Bombardier Q400 operated by Colgan Air crashed during approach to Buffalo Niagara Airport. Like the ATR crashes, icing conditions were present, though not severe. Both pilots had commuted to their base in New Jersey for the assignment. Neither had apparently slept in a bed the previous night (the captain was seen sleeping in the crew room, the first officer had commuted from the West Coast on a two-leg redeye). Due to icing conditions on approach into Buffalo, the stall protection system was operating in advanced mode. This resulted in a higher airspeed trigger point for stick shaker and pusher activation. During an intermediate level off the captain (who was the pilot flying) failed to increase power from the descent setting. The aircraft slowed, the stick shaker rattled, the autopilot automatically disengaged, and the captain yanked the yoke aft. The Q400 entered an aerodynamic stall and crashed.
The airline turboprop fleet in the U.S. had already been skating on thin ice due to competition with newly developed regional jets such as the Embraer 170. Though the turboprops were much more efficient over short-haul distances, passenger preference was for jet engines. The Colgan crash resulted in congressional hearings (many of the dead passengers were from Senate leader Chuck Schumer’s district). The visibility of those hearings did nothing for the public perception of turboprops. At the same time, turboprops in the regional airlines (originally a staple of the industry) were rapidly falling out of favor, as the short-haul structure of regional airlines had expanded into longer routes out of hub airports, an operation more efficiently flown by high-flying turbofans. The days of airline turboprops in the U.S. was rapidly waning.
The difference between a turboprop and a turbofan is not nearly as significant as it may seem. Modern jet engines replace four (or six) propeller blades with twenty-four fan blades. The core section of the engine is nearly identical. For all of that, turboprops (in general) have a less desirable safety record compared to jets. There are a few different reasons for this. Turboprops are often crewed by less experienced pilots (and, in many cases, by only one pilot). Cruise altitudes are often in the mid-20s, a ripe place for icing encounters. Added to this, straight-wing aircraft experience a steeper drop-off in lift at lower airspeeds. A stall in a swept-wing jet is less about the loss of lift and more about drag (at a certain angle of attack, induced drag exceeds thrust). The net result is that a stall-spin is much more likely in a straight-wing aircraft.
The Pilot Makes the Difference
There is a simple solution to ice. Fly fast. Ice accumulation decreases the angle of attack (thus increasing the airspeed) that a wing stalls at. It is difficult to find a crash caused by icing conditions where insufficient airspeed was not a factor. The difficulty with ice is that accumulation not only increases stall speed, but also drag. When drag exceeds thrust, the aircraft slows. The double whammy in propeller aircraft is contamination of the props, which greatly decreases the transfer efficiency of power into propulsion. Even with relatively high-performance turbine engines, sometimes the only option to maintain airspeed is to descend. If terrain allows it, this is a good solution. Not only does it preserve life-saving speed margins, but objectionable icing conditions rarely persist across more than a few thousand vertical feet. Descend three thousand feet, and you will likely exit the problematic icing.
In the case of the Voepass crash, flight data recorder (FDR) transcripts indicated that wing deice failed early in the flight. The crew quickly turned the system off in response. This was consistent with abnormal checklist procedures. However, Brazilian investigation entity CENIPA does not comment on whether the crew verbally accomplished the full checklist (only a partial transcript from the cockpit voice recorder was released). There is evidence that the crew either failed to complete the checklist or ignored it. Under DE ICING AIRFRAME FAULT, the first item is: ICING CONDITIONS: LEAVE AND AVOID. In the event icing conditions cannot be avoided, the checklist requires pilots to maintain a minimum speed of “icing bug + 15 knots” (icing bug speeds are calculated preflight by the crew).
Following the failure, the ice detector triggered ice accumulation caution messages five times. There is no indication that the crew discussed exiting the icing conditions. After the fifth alert, one of the pilots attempted to activate airframe deice again (this was contrary to the DE ICEING AIRFRAME FAULT procedure, which instructed the crew to turn the system off). Soon after this, CRUISE SPEED LOW was alerted (indicating a 10% degradation in airspeed due to ice-induced drag). The deice fault message once again alerted, and the crew turned the airframe deice off for the second time. Twenty-one seconds later, the DEGRADED PERFORMANCE alert was triggered. The checklist associated with this message recommended a minimum airspeed of icing bug + 30 knots. It also instructed the crew to turn off the autopilot (autopilots can mask the aerodynamic effects of ice accumulation) and to select LOW BANK mode for turns (decreasing angle of attack during level turns). The crew did not perform any of these actions. As they got closer to the destination airport, the first officer commented: “A lot of icing.” Once again, the deice system was turned on. Less than a minute later, in a turn, an INCREASE SPEED message alerted. Concurrently, an airframe buffet could be heard in the audio, as well as triggering of the stick shaker. The ensuing stall evolved into an unrecoverable flat spin (multi-engine aircraft that enter a spin with high power settings often become flat).
Mistakes and Lessons
Given ATR’s well-documented history in icing conditions, the crew’s blasé response to multiple layers of ice alerts is difficult to comprehend. Continuing into icing conditions with broken deice equipment is a bad idea in any aircraft. Perhaps the crew’s confidence came from the knowledge that warmer air on approach would be certain to melt the contaminants in the descent. Regardless, the pilots deviated from manufacturer guidance when they either ignored or failed to accomplish the appropriate checklist when the airframe deice system faulted. The secondary speed alert messages occurred during a high workload period (the first officer was communicating on the radio, and the captain was making a PA to the passengers). The tried-and-true axiom “aviate, navigate, communicate” was devastatingly proven. Communications clearly distracted the crew from recognizing the degraded airspeed messages and responding to ensure proper airspeed margins (the aircraft stalled at 169 knots, six knots below the ice accretion limit of ICE BUG + 10 knots, and 26 knots below the SEVERE ICE limit of ICE BUG + 30 knots).
There were, as always, several holes in the various layers of Swiss cheese: the failure to articulate a plan to confront the SIGMET for severe ice (inexcusable in an aircraft limited to 17,000 feet); the PACK MEL that created the altitude restriction in the first place; the failure of the deice boot system; the crew’s failure to adhere to abnormal checklist procedures; and the decision to try the airframe deice system after it had twice failed. It is obvious that the crew had become increasingly concerned with the amount of ice they saw accumulating. Turning on a faulty deice system can be tempting, but it is a bad idea. Asymmetric ice accumulation on the wings is extremely dangerous. If the failure in the airframe deice system was caused by a single inoperative boot, cycling the system would have cleared one wing while the other remained contaminated. This greatly increases the odds of a spin in the event of a low-speed encounter. In the end, the message is clear. When it comes to malfunctions, follow manufacturer guidance to the letter. Always take ice seriously. When the airframe is contaminated, go fast. It is that simple.
