Ibrahim Khalid

What the Voepass Flight 2283 Investigation Really Tells Us

On 9 August 2024, Voepass Flight 2283 departed Cascavel in Brazil on a domestic passenger flight to São Paulo, Guarulhos. The aircraft was an ATR 72-500, registration PS-VPB, carrying 58 passengers and four crew members.

While cruising at 17,000 feet, the aircraft encountered severe icing conditions. Its speed gradually reduced until it stalled, went out of control and entered a flat spin. It then fell almost vertically while rotating and crashed near the town of Vinhedo. Sadly, all 62 people on board lost their lives.

Videos of the final descent were seen around the world. From the ground, the aircraft appeared to be falling almost like a leaf while turning around itself. Since severe icing had been reported in the area, many people naturally assumed that ice alone had brought the aircraft down.

After going through the final investigation report, it became clear to me that ice was only one part of a much bigger problem. The accident involved the weather, the serviceability of the aircraft, the way earlier defects had been reported, flight planning, cockpit discipline, crew decisions, company practices, management oversight and the action taken by the aviation regulator.

From my experience in aviation safety and accident investigation, I have learned that an accident of this nature is hardly ever caused by one mistake or one person. What happens in the final few seconds is normally the easiest part to see, but the conditions that made those final seconds possible may have been developing for months or even years.

This accident is a very good example of why an investigation must not stop after identifying what the pilots did or not do. We must also ask how the aircraft reached that position, what information was available before departure, what the company knew, how maintenance defects were handled and why the regulator did not act more strongly on the warning signs already available.

The Flight Started with More Risk Than It Should Have

The circumstances behind this accident did not begin when the stall warning sounded. They were present before the aircraft departed.

The aircraft had experienced earlier problems with its airframe de-icing system. According to the investigation, some failures that occurred on previous flights were not formally entered in the aircraft’s technical logbook.

The information may have been passed verbally between pilots and maintenance personnel. However, in aviation, passing technical information verbally cannot replace a proper written entry in the aircraft technical log.

The technical logbook is the official record of the aircraft’s condition. It tells maintenance control what failed, when it failed, what the crew observed and what action needs to be taken before the aircraft flies again.

It also allows the operator to see whether the same defect is happening repeatedly. If a failure is not entered in the logbook, the next crew may not know about it, maintenance control may not see the full history and management may never realize that a serious pattern is developing.

One pilot may know about one failure and one engineer may know about another. Unless those failures are officially recorded, nobody may have the complete picture.

What concerns me most is that the investigation found evidence of an informal culture in which some defects were not properly recorded so that aircraft could continue operating. This may avoid a delay or cancellation on that particular day, but it creates a much greater risk for another crew and another group of passengers later.

An aircraft may complete several flights with an unrecorded defect and nothing serious may happen. People then begin to believe that the defect is not important or that the informal way of handling it is acceptable.

The real danger is still there, but it remains hidden. It may only become critical when the aircraft meets the exact weather or operating conditions in which that particular system is badly needed.

The Aircraft Was Operating with Technical Limitations

On the day of the accident, one of the aircraft’s two air conditioning units, known in aviation as ‘packs’, was not working. These units do much more than keep the passengers comfortable. They use compressed air from the engines to control the temperature, ventilation and air pressure inside the aircraft.

The aircraft was allowed to fly under its approved Minimum Equipment List, commonly called the MEL. This is a document that states which equipment may be temporarily out of service, how long the aircraft may continue operating and what restrictions and special procedures must be followed.

Allowing an aircraft to fly with one item inoperative does not automatically make the flight unsafe. Aircraft have backup systems, and the MEL is carefully prepared to ensure that an aircraft can continue operating safely for a limited period when certain equipment is unavailable.

In this case, however, the inoperative air conditioning pack came with an important restriction. The aircraft was limited to Flight Level 170, which for an ordinary reader can be understood as approximately 17,000 feet, and could not climb above that level.

The pack defect should therefore not have been considered on its own. The altitude restriction, the severe icing forecast and the earlier problems involving the aircraft’s de-icing system all needed to be considered together.

Severe icing had been forecast along the route and around the altitude at which the aircraft was planned to cruise. The aircraft would therefore be flying at 17,000 feet in conditions where ice could build up and where its airframe de-icing system might become essential.

A proper risk assessment should have asked whether this was the right aircraft to use for that particular flight on that particular day. The operator should also have considered changing the route, using another altitude, delaying the flight or providing another aircraft without the same concerns.

Good flight planning is not simply drawing a route, calculating the fuel and submitting a flight plan. It means bringing together the weather, the condition of the aircraft, its operating restrictions, the crew’s ability to deal with the expected conditions and the alternatives available if something goes wrong.

In this case, the aircraft’s condition and the severe icing forecast do not appear to have been brought together into one clear picture. Each problem may have seemed manageable when considered separately, but together they created a much more serious risk.

This is something we often see during accident investigations. Several small or moderate risks are accepted one at a time, but nobody stops to consider what could happen if all of them come together during the same flight.

The First Icing Problem Appeared During the Climb

Flight 2283 took off at approximately 1458 UTC. A short time later, the crew switched on the propeller anti-icing systems.

While the aircraft was climbing through approximately 13,000 feet, the electronic ice detector produced an icing warning. The crew switched on the airframe de-icing system, but a warning chime sounded shortly afterwards and they discussed a fault affecting that system.

The airframe de-icing system was then switched off. The electronic ice warning later disappeared, but that did not mean the aircraft was free of the danger.

An ice warning can appear and disappear as an aircraft passes through areas with different temperatures and moisture levels. The warning going away only means that the detector is not sensing ice at that particular moment. It does not mean that ice already on the aircraft has disappeared or that the aircraft will not meet more icing further ahead.

During the flight, the ice detector activated and stopped several times. These repeated warnings showed that the aircraft was continuing to pass through conditions suitable for ice formation.

The report found that the crew did not properly complete the required procedure after the airframe de-icing fault appeared. They continued the flight without fully resolving what the fault meant and without taking enough action to reduce their exposure to further icing.

This was one of the first major opportunities to prevent the accident. The crew could have reviewed the weather again, changed altitude or direction, returned to where it had departed from or diverted to another airport.

If they were uncertain about the reliability of the de-icing system, the safest decision would have been to avoid further icing altogether. Continuing towards forecast severe icing left the aircraft depending on a system that had already indicated a fault.

How the Ice Slowly Took Away the Aircraft’s Performance

Ice on an aircraft does much more than add some extra weight. It changes the shape of the wing and disturbs the smooth flow of air over its surface.

A wing must remain clean and properly shaped to produce lift efficiently. When ice forms on its leading edge, the aircraft experiences more drag while the wing becomes less capable of producing lift.

The engines must then work harder to maintain the same altitude and speed. If ice continues to build, even additional engine power may not be enough and the aircraft’s speed will begin to fall.

A pilot trying to hold altitude may naturally feel the need to raise the nose. However, raising the nose increases the angle at which the wing meets the airflow and brings the aircraft closer to a stall.

Severe icing is especially dangerous because ice may form faster than the aircraft’s protection system can remove it. The de-icing system is an important protection, but it does not make it safe to remain in severe icing for an unlimited period.

The correct response is normally to get out of the icing conditions as quickly as possible. Depending on the situation, this may require a climb, descent, turn, diversion or emergency declaration.

In the case of Flight 2283, ice continued to collect while the aircraft remained at Flight Level 170. As the drag increased, the aircraft’s speed and overall performance gradually reduced.

The problem did not arrive as one sudden and obvious failure. It developed slowly, which may have made it harder for the crew to appreciate how serious the situation had become.

This is one of the dangers of a gradual loss of performance. People may keep adjusting to each small change without realizing that the whole process is moving closer and closer to a limit from which there may be very little time to recover.

The ATR 72 ice protection system and the inflatable de-icing boots fitted to the leading edges of the wings. The boots inflate to break and remove ice that has formed on the aircraft.

The Cockpit Became Busy at the Wrong Time

At approximately 1615 UTC, the first officer contacted the company’s operational dispatcher at the destination to provide information connected with the aircraft’s arrival. While that conversation was taking place, a cabin crew member also called the cockpit.

The first officer asked the cabin crew member to wait and continued speaking with the dispatcher. The captain later made an announcement to the passengers, while the first officer continued dealing with the cabin and company communications.

At the same time, the crew was preparing for the approach to the destination airport. Air traffic control was also changing the aircraft’s radio frequency and issuing further instructions.

None of these tasks was unusual by itself. Speaking with the dispatcher, coordinating with the cabin crew, making a passenger announcement, receiving ATC instructions and preparing for the approach are all normal activities during a commercial flight.

The problem was their timing. All these activities were taking place while the aircraft was accumulating ice and beginning to lose performance.

Routine tasks were competing with the most important duty in the cockpit, which was monitoring and controlling the aircraft. Once abnormal warnings began appearing, the arrival briefing and other non-essential activities should have been stopped until the problem was understood and brought under control.

The cockpit voice recorder also showed that the pilots spent a significant part of the flight in informal conversation unrelated to the operation. The captain was reportedly talking about personal difficulties, and some of the discussion concerned those matters.

The investigators could not prove exactly how much the captain’s emotional condition affected his performance. For that reason, they concluded his emotional state and the outside personal influences as factors that could not be fully determined.

Even so, personal concerns and extended informal conversation may have reduced the attention being given to the aircraft and the weather. This was particularly important because some of the conversation continued during or close to the time when performance warnings began appearing.

People do not normally decide to ignore a serious warning. What often happens is that their attention is already occupied, so they hear or see the warning without fully understanding what it is telling them.

A warning may sound while a pilot is speaking on the radio, carrying out a briefing or thinking about another problem. The ears hear it, but the mind does not give it the importance it deserves.

This is why cockpit discipline is so important. When abnormal warnings begin appearing, normal conversation and routine activities must stop until the crew understands exactly what is happening.

The Aircraft Was Clearly Warning That Something Was Wrong

At 1618:41 UTC, the aircraft’s speed had reduced to approximately 191 knots. The Aircraft Performance Monitoring system displayed a ‘CRUISE SPEED LOW’ alert.

This was a clear warning that the speed was becoming too low for the existing conditions. It required the crew to recognize the problem and carry out the actions stated in the aircraft procedures.

At around the same time, the first officer was finishing the communication with the company dispatcher. The captain then began the approach briefing while ATC instructed the aircraft to change radio frequency.

Less than a minute later, when the speed had fallen to approximately 184 knots, the aircraft displayed a ‘DEGRADED PERFORMANCE’ alert. This was telling the crew that the aircraft was no longer giving the performance expected from it.

A warning chime also sounded, but it came while the pilots were dealing with ATC communication and the approach briefing. From what I understand from the report, the crew did not stop everything else and seriously discuss what all these warnings were telling them.

The required action for the alert was not properly carried out. There was also no clear indication that the crew brought the icing warnings, de-icing fault, falling speed and degraded performance together into one complete assessment of the situation.

At approximately 1620 UTC, the first officer commented that there was ‘a lot of ice’. This statement confirmed that the problem was not just an electronic warning or a theoretical possibility.

By then, the crew had severe icing forecast along the route, repeated ice-detector warnings, a fault involving the de-icing system, a clear comment about a large amount of ice and alerts showing that the aircraft was losing speed and performance. All these signs were pointing towards the same danger.

This was the stage at which the crew needed to leave the icing conditions immediately. The airframe de-icing system was switched on again, but the aircraft remained at Flight Level 170 and continued towards its destination.

When Frequent Warnings Stop Frightening People

One of the most concerning findings was that aircraft performance alerts had reportedly occurred frequently within the operator’s fleet. Some pilots had therefore become used to seeing them.

When a warning appears many times and previous flights continue safely, people may begin to think that it is too sensitive or not very important. They still see the warning, but they no longer react with the urgency required by the procedure.

This is where the situation becomes dangerous. A warning does not become less serious simply because it appears regularly. Frequent warnings may actually be telling the company that there is a recurring problem that needs to be investigated.

The same thing can happen with technical defects. If a defect is passed verbally and the aircraft flies safely the following day, people may begin to believe that making a formal technical entry is unnecessary.

The practice is repeated, and once again nothing happens. Each successful flight gives everyone more confidence in an unsafe way of working.

What they fail to understand is that the practice has not been proved safe. The aircraft simply has not yet encountered the particular set of conditions in which the defect becomes critical.

Over time, a departure from the proper procedure becomes normal practice. Nobody may have formally ordered anyone to ignore the rules, but everyone slowly becomes comfortable doing so.

This accident shows how dangerous that can be. The warning that had been seen before without serious consequences appeared again on a day when the aircraft was heavily affected by ice, and this time the outcome was completely different.

The Seriousness of the Situation Was Not Passed to ATC

Flight 2283 had reached the point at which the crew expected to begin descending towards its destination. Air traffic control instructed the aircraft to remain at Flight Level 170 temporarily because of other traffic below.

The crew acknowledged the instruction and advised that they were at their ideal point to begin descending. However, they did not tell the controller that the aircraft was accumulating a large amount of ice, that the de-icing system had shown a fault or that performance warnings were appearing.

The crew did not ask for an immediate descent and did not declare an emergency. The controller therefore continued handling Flight 2283 as an ordinary flight.

This part needs to be properly understood. ATC instructed the aircraft to remain at Flight Level 170 because of surrounding traffic and because the controller did not know that Flight 2283 was in serious difficulty.

If the pilots had clearly reported severe icing and degrading performance, or declared an emergency, the controller could have held other traffic and given the Flight 2283 priority. A heading change could also have been approved to help the aircraft leave the icing conditions.

Pilots sometimes hesitate to declare an emergency because they hope the situation will improve. They may also worry about creating disruption or making the problem sound more serious than it appears at that moment.

An emergency or urgency declaration is not an admission that the pilots have failed. It is a way of telling ATC that normal traffic arrangements are no longer enough and that immediate assistance is required.

When an aircraft is accumulating a large amount of ice and losing speed, the crew cannot wait until it is completely certain that control will be lost. By then, there may be no time left for ATC or anyone else to help.

The Final Turn and Loss of Control

At 1620:33 UTC, ATC cleared Flight 2283 directly towards the ‘SANPA’ waypoint while instructing it to remain at Flight Level 170. The controller advised that descent clearance would be available in about two minutes.

The crew acknowledged the instruction, and that became their final radio transmission. The aircraft then began a right turn towards ‘SANPA’.

During the turn, the speed reduced to approximately 169 knots. The ‘INCREASE SPEED’ alert appeared, followed almost immediately by vibration and the stall warning.

A stall does not mean that the engines have stopped. It means that the wing has reached an angle at which the airflow can no longer remain properly attached to its surface.

The first and most important action is to reduce the angle of attack. In simple terms, the pilots must lower the nose, even if the aircraft has to lose some altitude.

According to the investigation report, the pilots made nose up control inputs when the stall warning activated. These inputs were contrary to the aircraft’s emergency procedures and the stall recovery technique covered in their training.

Pulling the nose upwards increased the angle of attack and made the stall more severe. The aircraft rolled approximately 52° to the left and then about 94° to the right.

It changed direction rapidly, went completely out of control and entered what is known as a flat spin. This means that the aircraft was falling almost vertically while rotating around itself, rather like a leaf spinning as it falls from a tree. It completed approximately five rotations before striking the ground.

Once it was fully established in a flat spin at that altitude, the chance of recovery was extremely small. The final loss of control happened in seconds, but the aircraft’s safety margin had been disappearing for a much longer time.

Qualified Pilots Who Did Not React as Trained

The captain had more than 5,200 hours of flying experience, including approximately 665 hours on the ATR. The first officer had more than 5,100 hours in total and more than 3,500 hours on the ATR.

Both pilots were properly licensed and had completed the required theoretical and practical training. Their simulator training included operations in icing conditions and aircraft upset prevention and recovery.

On paper, they had received the training needed to deal with this type of situation. What happened during the flight, however, did not match the response expected from that training.

The crew did not recognize the seriousness of the icing and performance loss early enough. They did not carry out the correct actions in response to the alerts, and their final control inputs did not follow the proper stall recovery technique.

This does not mean that the training had never been given. It raises a more important question about whether the pilots had properly understood it and whether they could apply it during a confusing and rapidly changing real emergency.

Training records can confirm that a pilot attended a course, completed a simulator exercise and passed a check. They cannot always prove that the correct reaction will come naturally when several warnings, communications and operational pressures arrive at the same time.

In my view, training must go further than teaching pilots how to complete a checklist during a planned simulator exercise. It must help them recognize the early signs of a worsening situation and give them the confidence to stop everything else, leave the dangerous conditions and declare an emergency before control is lost.

The Two Pilots Did Not Work as One Team

Two experienced pilots were in the cockpit, but their combined actions did not produce the expected outcome to the developing emergency. The way the tasks were divided did not protect the most important duty, which was monitoring the aircraft’s flight path, speed and systems.

While one pilot handled dispatch, cabin and radio communication, the other should have remained fully focused on flying and monitoring. When the alerts began appearing, all non-essential activities should have stopped.

The pilots should have openly discussed the meaning of the de-icing fault, repeated ice warnings, falling speed and degraded performance. They then needed to agree on one clear plan to leave the icing conditions immediately.

Good cockpit coordination is not simply two pilots speaking politely and completing their own duties. It requires each pilot to question, challenge and intervene when the safety of the flight is in danger.

The first officer had considerably more experience on the ATR than the captain. That experience could have helped the crew reach a stronger assessment of what the aircraft was doing.

The captain remained responsible for setting the priorities and making the final decision. At the same time, the first officer also had a duty to speak clearly and firmly if he believed the aircraft was approaching an unsafe condition.

The investigation found weaknesses in communication, task management and compliance with procedures. The two pilots did not function as the strong last line of defence that the situation required.

Maintenance, Management and the Company’s Safety Culture

The failure to properly record earlier airframe de-icing defects was not a minor administrative issue. Without a formal technical entry, the company could not reliably apply the Minimum Equipment List, arrange proper repairs, substitute the aircraft or change the operating plan.

A verbal report may appear faster and easier, but it has no permanent place in the aircraft’s technical history. It may be misunderstood, forgotten or passed only to one person.

Proper reporting also protects pilots and engineers. It ensures that decisions about the aircraft’s serviceability are made through an approved process rather than through informal discussion.

If employees believe that recording a defect will bring pressure, criticism or an unnecessary delay, management must find out why. Staff should never feel that keeping the aircraft flying is more important than accurately recording its condition.

Pressure does not always come through a direct order. It may develop through constant messages about avoiding cancellations, maintaining the schedule and reducing technical delays.

Over time, employees learn what the organization really expects from them. The company manual may say that every defect must be recorded, but the daily working culture may send a very different message.

Management must therefore examine what people actually do in practice. It is not enough to show an investigator a properly written procedure if the normal way of working is different.

The operator also had access to aircraft performance information and other safety data. The investigation found that this information was not always properly analyzed or brought into the company’s risk management process.

Collecting safety data is only the beginning. The data becomes useful when someone studies it, identifies a pattern and takes corrective action.

If an aircraft repeatedly produces the same performance warning, management must find out why. If several aircraft produce similar warnings, the company must decide whether the problem involves maintenance, training, procedures, planning or the way the fleet is being operated.

If crews regularly fail to carry out the required warning procedure, management cannot wait for an accident to show that the practice is dangerous. Training and supervision must be reviewed before an undesired outcome accident occurs.

A safety management system should not be judged by how many reports, meetings, committees or presentations it produces. It should be judged by whether it identifies a real danger and changes the operation before that danger causes an accident.

In this case, important information existed in different parts of the organization. One department may have known about the technical problem, another knew about the weather and another held the aircraft performance data.

Nobody appears to have brought all that information together and asked the most important question. Should this particular aircraft be sent on this particular route in these particular weather conditions? That was a management responsibility, and the opportunity was missed.

The Regulator Also Had Enough Reason to Be Concerned

Brazil’s civil aviation regulator had carried out audits and inspections of the operator before the accident. Those inspections found several technical and procedural problems involving maintenance, component traceability, Minimum Equipment List compliance and the informal or missing reporting of defects.

The Voepass group reportedly accounted for a very high proportion of the adverse findings raised among Brazilian airline operators, even though it represented only a small part of the country’s scheduled air transport activity. That difference should have attracted serious regulatory attention.

A regulator cannot simply raise individual findings, receive written replies and close each matter separately. It must look at the complete pattern created by all the findings.

One technical record problem may be corrected with one action. Several findings involving maintenance control, missing records, Minimum Equipment List compliance and informal reporting may show that the operator’s whole safety system is deteriorating.

The investigation concluded that the regulator’s arrangements for processing and monitoring safety information were still developing. As a result, the available warning signs did not lead to the level of intervention required to control the increasing risk.

A regulator should not have to wait for an accident before deciding that an operator’s safety performance has become unacceptable. When the pattern shows continuing deterioration, stronger surveillance, operating restrictions, management changes or suspension of operations may become necessary.

Regulatory action will sometimes cause inconvenience and financial difficulty for an operator. However, the purpose of safety oversight is not to keep an unsafe operation running. It is to protect passengers, crew members and the public before the worst happens.

So Many Chances Missed to Prevent the Tragedy

This accident could have been prevented before the flight if the earlier de-icing defects had been properly recorded, investigated and corrected. It might also have been prevented if the aircraft, route or cruising altitude had been changed after considering the severe icing forecast.

Another opportunity came during the climb when the airframe de-icing fault appeared. The crew could have returned back, diverted or requested a route and altitude clear of the icing conditions.

Further opportunities appeared each time the ice detector activated. The ‘CRUISE SPEED LOW’ warning was another clear chance to stop other activities and leave the icing conditions.

The ‘DEGRADED PERFORMANCE’ alert gave the crew another warning that the situation was becoming more serious. When the first officer said there was a lot of ice, there should have been no doubt that immediate action was needed.

The crew could then have declared an emergency and requested an immediate descent or heading change. ATC could have cleared other traffic and given the aircraft priority.

Even when the stall warning activated, one final recovery opportunity remained. An immediate reduction in angle of attack might have prevented the stall from becoming a flat spin.

Every one of these opportunities passed without the necessary action. By the time the aircraft was rotating towards the ground, almost every protection that should have prevented the accident had already failed.

The Lessons That Must Not Be Ignored

The first lesson is that a warning must never be treated as harmless simply because it has appeared before. If a warning is appearing regularly, the reason must be found and corrected.

The second lesson is that the aircraft technical log is one of the strongest safety protections available to an operator. A defect that is not recorded may become invisible to the very people responsible for correcting it.

The third lesson is that weather information is useless unless it changes a decision. A forecast of severe icing should affect the aircraft selected, the route, cruising altitude, fuel planning, dispatch decision and the crew’s escape plan.

The fourth lesson is that several manageable problems can become one unacceptable risk when they occur together. The air conditioning defect, altitude restriction, severe icing forecast and history of de-icing problems should never have been considered separately.

The fifth lesson is that a crew must clearly tell ATC when the aircraft is in danger. A controller cannot provide emergency priority when the controller has not been told that an emergency exists.

The sixth lesson is that training must produce the correct action under pressure. Passing a simulator check is important, but the real test comes when the crew must recognize a worsening situation and act without delay.

The seventh lesson is that management must bring together maintenance reports, flight-data information, safety reports, weather and audit findings. The information may be held in different departments, but management must see the complete risk.

The final lesson is that the regulator must respond to the overall condition of an operator, not only to individual findings. When the same operator continues producing a large number of serious findings, the regulator must act before an accident confirms what the warning signs were already showing.

This Cannot Be Dismissed as Pilot Error

The pilots made serious mistakes during the flight. They did not deal properly with the de-icing fault, repeated icing warnings and aircraft performance alerts.

They did not request an immediate descent or declare an emergency. When the aircraft stalled, their nose up control inputs made the situation worse.

These facts must be stated clearly because a proper investigation should never hide an uncomfortable finding. At the same time, it would be wrong to place the full responsibility for the accident on the two pilots.

Their decisions were made inside an operation where technical defects had sometimes been handled informally. Repeated aircraft warnings had become familiar, and the aircraft’s condition had not been properly considered together with the severe icing forecast.

Management had not made full use of the safety information available. The regulator had identified many problems, but those findings did not lead to strong enough intervention before the accident.

The pilots were the last people in a position to prevent the crash. They were not, however, the only people or organizations that should have prevented the aircraft from reaching that position.

That distinction is important. Accident investigation is not about removing responsibility from the people at the controls, but it is also not about placing every failure on the people who happened to be present during the final seconds.

The Final Seconds Were Only the End of a Much Longer Story

Flight 2283 was lost very quickly after the stall warning activated. The aircraft rolled, entered a flat spin and descended before the crew or ATC could recover the situation.

The accident itself had been building for much longer. It could be seen in the earlier de-icing failures, missing technical entries, repeated performance warnings, informal working practices, weak flight planning, poor cockpit coordination, limited management action and ineffective regulatory control.

Ice was the physical danger that took away the aircraft’s performance. The pilots’ decisions and final control inputs were also major parts of the accident, but neither explanation tells the whole story.

The deeper failure was that an aircraft with a questionable de-icing condition was allowed to enter and remain in forecast severe icing. The protections that should have prevented this, warned the crew, supported the flight and helped it escape the danger failed one after another.

During my many years in aviation, I have learned that accidents rarely happen without earlier warnings. Those warnings are usually already present in technical records, flight data reports, audits, earlier incidents, repeated alerts and the concerns of frontline staff.

The greatest challenge is not always finding more information. It is understanding what the information already available is telling us and having the courage to act before an accident proves that the warnings were real.

Voepass Flight 2283 should not be remembered simply as an icing accident or another case of pilot error. It should be remembered as an accident in which technical, human, operational, organizational and regulatory weaknesses came together until no effective protection remained.