The 15 failures that brought down Voepass’s ATR, according to the investigators’ report

This week, Cenipa concluded the investigation of the Voepass accident, in which an ATR 72-600 crashed in Vinhedo (SP) after falling into a flat screw, on August 9, 2024.

In a 266-page report, the agency listed 19 factors that could have contributed to the final result. In 15 of them, it concluded that there was a contribution to the tragedy that killed 62 people. In the other four — the crew’s training, the captain’s emotional state, outside influences and an aspect of the plane’s design — it didn’t gather enough evidence to affirm, and it recorded “undetermined.” The list below brings the 15 confirmed.

What happened to the plane

Ice on the wing of an airplane is a problem especially because it drastically alters the aerodynamics of the aircraft. The layer that accumulates on the leading edge — the front part of the wing, which cuts through the air — deforms the profile designed to generate lift. With the altered profile, drag increases and lift drops. The plane needs more speed to continue flying: the minimum safe speed rises just when the real one is falling.

The ATR-72, like other planes, has defense mechanisms against this. These are rubber membranes on the leading edges of the wings that inflate and deflate, breaking the frozen shell that has formed. In the PS-VPB, the system was in failure on the right wing — and the failure had not been noted in the logbook on previous flights. The plane was thus dispatched to a route with severe ice forecast.

At cruising speed, at 17,000 feet, ice accumulated and the aircraft slowed down. There is a system on board that monitors just that: the APM, which then warns the crew at three levels of severity. The three alarms went off throughout the flight, but none of the corresponding procedures were executed. The pilots did not call for immediate descent or declare an emergency.

When the speed reached the limit, the stall alarm sounded — the condition in which the wing stops supporting the plane. The ATR has an automatic retrieval device, the stick pusher, which pushes the stick forward to lower the nose and regain speed. The drivers did the opposite: they pulled. The force applied against the system disengaged the tail controls, and the plane went into a flat spin.

How to read the list

The report does not serve to ascertain administrative, civil or criminal liability. Its only objective is prevention. Cenipa also does not establish a hierarchy between the factors – the list brings them all in alphabetical order and treats in the same way everything that contributed to the fall of the ATR. The order below was done by AutoPapo.

1. Aircraft maintenance

The most concrete link in the chain. The malfunction of the de-icing system on previous flights was not noted in the bord o diary, the formal record that triggers maintenance. Without this note, nothing could be done: neither dispatch the plane under MEL — the list that defines which inoperative items one can fly with and under which restrictions — nor change aircraft, nor replan the route, nor fix the breakdown. The plane flew into the ice with the de-icing in failure and without the restrictions of MEL.

2. Organizational processes

The company recorded and analyzed data from all its flights, and had enough material to identify the pattern of performance loss due to ice before it became an accident. It did not convert this information into corrective actions. The control center also did not advise pilots on real-time weather.

3. Application of the commands

When the stall alarm sounded, the pilots pulled the stick, raising the nose. It’s the opposite of correct: to get out of the stall you have to lower your nose and gain speed. The action contradicted the QRH — the quick reference manual, which provides the step-by-step of each abnormal situation — and the specific training for recovery from abnormal attitudes.

There was more than 10 kgf of force on the right spine against the stick pusher. Because the two joysticks are mechanically linked, this uneven force triggered a safety mechanism that decouples the elevators — the moving surfaces of the tail that control the plane’s nose. Designed in case an elevator jammed, the decoupling here had the opposite effect: the stick pusher lost authority over the right side.

4. Flight planning

The planning ignored restrictive conditions on the route and kept the plane at a flight level susceptible to ice. The weather forecast for that altitude was below the minimum for the flight — and was not properly evaluated by any of the three instances that were supposed to bar it: the company’s operational control center, the flight dispatcher and the captain himself.

5. ANAC’s performance

Audits and inspections carried out before the accident already pointed to non-conformities in maintenance, traceability of parts, compliance with MEL and the habit of reporting breakdowns informally – or not reporting at all. Processed in the agency’s risk management, these signals did not support the decisions necessary to contain the risk. The means of recording and monitoring hazards were still maturing, and the company continued to operate despite the drop in safety.

6. Working group culture

It explains why the warnings were ignored: high repetition, no consequence, falling vigilance. The numbers show the scale. In 15,365 flights analyzed, the company had the highest rate of performance alerts among six ATR-72 operators compared: 10.9% of flights. The fleet cruised, on average, 5 to 10 knots below the theoretical speed.

7. Piloting Judging

At no time did the pilots ask for an immediate descent or declare an emergency. These are the two actions that would take the plane out of that condition: descending means warmer air, where the ice melts; Declaring an emergency gives absolute priority in airspace. Added to the previous decision to fly on known ice with inoperative thaw, the omission indicates inadequate assessment of safety parameters.

8. Management supervision

Without effective oversight of informal operating and maintenance practices, diversion has become routine — to the point that the alerts issued by the plane itself are overlooked.

9. Organizational culture

From the group of pilots to the entire company, informality crossed sectors and hierarchies. It generated a friendly atmosphere, but opened space for improvisation and relaxation of rules. Institutionalized informal rules have weakened the safety culture.

10. Caution

The crew engaged in informal conversations unrelated to the flight, which reduced the focus on the outside environment and the warnings that lit up on the panel. The report names the phenomenon based on the cognitive psychology literature: inattentional blindness and deafness. It is not a voluntary carelessness, but a known limit of human attention — when it is allocated to a task, relevant signals are no longer processed even though they are visible and audible.

11. Decision-making process

Cruising at FL170 (flight level 170, about 17,000 feet), an altitude with severe ice forecast, revealed difficulty in analyzing and choosing alternatives. Cenipa raises a possible origin: biases coming from a company culture that tolerated improvisation.

12. Attitude

Here “attitude” is professional posture, not the plane’s position in space. The crew knew about the failure of the melt and the forecast of severe ice, and decided to follow the plan without any mitigation measures — they didn’t change levels, they didn’t deviate, they didn’t come back. None of the planned procedures were carried out throughout the flight. For Cenipa, this constitutes tacit acceptance of deviations from the standard.

13. Booth Coordination

It is the CRM item, the discipline that organizes the division of tasks, communication and joint decision in the cockpit — who pilots, who monitors, who talks to the controller. There was inadequate management of these tasks, communication failure and disrespect for rules. Ice was never faced as a problem for the two pilots, and the flight remained at increasing risk.

14. Perception

Unlike attention, this item is about understanding what the signs mean. There was damage on three fronts: the weather, the indications of loss of performance and the APM warnings. Situational awareness — the pilot’s mental model of what is happening to the plane — has fallen, and the risk has not been realized until late.

15. Adverse weather conditions

Severe ice created the scenario. Prolonged exposure increased drag and dropped cruising speed. Still on the way up, the electronic ice detector already indicated accumulation. The de-icing failure checklist was not met, and the system was turned on and off several times during the flight, without the failure being resolved.

What’s Next

There are six recommendations made by Cenipa. Four go to EASA, the European agency that certifies the ATR, to work with the manufacturer: demand immediate action from the crew at the second alert level of the APM; review flight procedures on ice; record parameters that are currently missing, such as the failure of the defrost and the actuation of the stick pusher; and to increase the severity of the third alert, which today only calls for attention when it should require immediate action.

Two go to ANAC: to check if the checklists of ATR pilots in Brazil include the adjustment of cruise speed markers and to review the air-ground communication rule in regular air transport.