Description

On 25 My 2016, multiple indications of electrical system failure appeared on an Embraer ERJ190 (C-FHOS) being operated by Air Canada on a scheduled international passenger flight from Boston to Toronto as ACA361 whilst it was in the cruise at FL 360 in day VMC having completed about a quarter of the planned flight. The autopilot disconnected and three of the five EFIS displays went dark. Automatic deployment of the RAT restored some of the lost power and during a descent initiated to FL 240 it was possible to start the APU which restored most of the rest. Sufficient systems were restored to allow the flight to be completed as originally intended and this was achieved without any significant remaining airworthiness issues being apparent to the crew. On arrival, it was immediately apparent on inspection by Company maintenance personnel that smoke and fire in an avionics bay had accompanied the electrical fault.

Investigation

An Investigation was carried out by the Canadian TSB. Relevant data was successfully recovered from both the FDR and CVR as well as from the NVM in the two GCUs.

It was found that the Training Captain who had been PF for the flight had approximately 8,000 total flying hours and was supervising the First Officer, who had approximately 8,500 hours total flying experience but was a new Air Canada employee and was undertaking type line training.

It was established that eighteen minutes after departure - four minutes after the flight had reached its planned cruise level FL 360 – EICAS Fault messages had begun to appear accompanied by audible alert tones and detailing "numerous faults". One minute later, the Master Warning Light and Alarm were activated, the AP disconnected and three of the five EFIS Display Panels "went dark". Several more EICAS warnings were then annunciated including “ELEC EMERGENCY”, “IDG 1 OFF BUS” and “IDG 2 OFF BUS”, the two IDGs together being the main source of electrical power to the aircraft. The RAT automatically deployed and power to the Essential Bus Bars was quickly restored. Boston Centre were advised that the aircraft had suffered an electrical malfunction and, in the absence of navigation systems and the AP the crew requested "a heading and possible altitude deviation". In response to ATC asking if they "required assistance", the crew told ATC to stand by because "they were uncertain of the severity of the problem". They "discussed declaring an emergency but decided that they would attempt to restore main electrical power first". The Electrical Emergency Checklist was run and since the first item after "LAND AT THE NEAREST SUITABLE AIRPORT" (which was discounted) was to start the APU for which the AFM maximum altitude was 30,000 feet, a descent was requested and approved.

By the time the aircraft was levelling as cleared at FL 240, the APU had been started and the two IDGs had been brought back online and full power had been restored to both main AC and DC bus bars and the EICAS 'ELEC EMERGENCY' annunciation had ceased. A fault with TRU2 was still shown but the systems connected to it were being powered by TRU1. At this point, the electrical emergency was essentially over "although a few non-critical components were unavailable" and the AP was re-selected some 17½ minutes after the onset of the problems and, with 170 nm to run to Toronto, Boston ATC were advised "that they had restored some electrical power but were still requesting vectors for the (destination) final approach" as well as use of "the longest runway available because they planned to land with decreased flap". This was relayed accordingly and "all ATC units involved made accommodations to minimise delays for the aircraft for the rest of the flight". The remainder of the flight was without further event and after landing, the aircraft was taxied to the gate for normal passenger disembarkation.

It was noted that the crew had not realised that their attempt to make a PA announcement to the passengers once they had begun descent in order to start the APU had been completely inaudible in the cabin because of the noise generated by the RAT on account of its high rotation speed. As a result, the cabin crew called the flight deck, were appraised of the situation and were then able to relay the information to the passengers.

Air Canada maintenance personnel who inspected the aircraft after it had arrived in Toronto found that the Right Integrated Control Centre (RICC) had been "extensively damaged by fire and smoke". Subsequent examination of the removed RICC by the Investigation found that "there had been severe arcing of the 3-phase bus bars that connect to the thermal circuit breakers in AC BUS 2 and that there was evidence that a fluid contaminant had entered the vented top surface of the RICC and entered TRU2". It was concluded that this fluid "had been spilled directly on top of the RICC" before flowing down its face and through its interior and entering the circuit breaker panel compartment, "where it came into contact with the bus bars and other conductive surfaces, eventually causing the arcing that led to the smoke and fire". It was found that although "the arcing, melting, and fire (had) damaged AC BUS 2 and disabled power distribution to several connected systems, including TRU2", the damage was limited to the RICC and had not spread to any other nearby components.

The sequence of electrical failure and fire was established from the downloaded flight data as follows:

• GCU 2 sensed a fault in the AC circuit breaker section of AC BUS 2 and it is likely that it was at this point that smoke started to be produced.
• GCU 2 then sensed a distortion in the voltage caused by high-impedance arcing in the bus bar area of AC BUS 2 and tripped Generator Line Contactor 2 (GLC 2) which controls IDG2 and disconnected IDG 2 from the electrical system.
• Bus Ties connecting AC BUS 1 and AC BUS 2 automatically which allowed IDG 1 to power AC BUS 2.
• After 6 seconds, because the fault had progressed to sustained arcing with smoke and fire, GCU 1 sensed an overcurrent and tripped GLC 1 which disconnected IDG 1 from the system.
• With both IDGs now offline, no power was being supplied to the main buses (AC BUS 1 and 2 and DC BUS 1 and 2) which triggered the Master Warning and documented EICAS annunciations.
• The No. 1 secondary power distribution assembly, which was still being powered by the DC essential buses, sensed that AC BUS 1 and AC BUS 2 were unpowered and, within 300 milliseconds, commanded RAT deployment which restored power to the essential bus bars.
• The main bus bars remained unpowered until the APU was started approximately 8 minutes later.

It was concluded that the reason why the fire in the RICC had "subsided" was that "the loss of power to AC BUS 2 meant that the area in which the fire had started was no longer being provided with electrical current" and that there had been "limited combustible material nearby".

It was concluded that the reason why no smoke had been apparent in the cabin or flight deck air supply and no EICAS smoke warning had been triggered by the smoke which had accumulated in the avionics bay was that the loss of power to all the main bus bars had disabled both the relevant smoke detector and the recirculation fans and this had happened before enough smoke had been drawn through the recirculation ducts leading to the cabin or over the smoke detector. Once the main power had been lost, it was considered that "the smoke likely began to vent overboard from the recirculation bay through the outflow valve, which remained powered through the essential bus". By the time power to the recirculation fans and the smoke detector had been restored almost 10 minutes later, "the smoke had likely dissipated to a level that was no longer detectable".

It was determined that the dried fluid contaminant which had caused the failure "was a beverage, possibly coffee or a soft drink" but it was not possible to establish how much time might have elapsed between the spill and the resultant arcing. It was, though, found that "the contaminant was significantly more conductive when in a liquid state" and testing of similar fluids "determined that fluids spilled in environmental conditions similar to those surrounding the RICC would remain in liquid state for less than 6 hours". The presence of drip trays above the RICC which were intended to prevent fluid spilled in mid cabin above the avionics compartment concerned from coming into contact with the RICC or other electrical equipment in its vicinity were examined and found to show no evidence of any contaminants. It was noted that cabin crew who had operated on the aircraft involved in the days prior to the investigated event had not reported any spills and there was no record of any cabin defects or rectifications that would have required carpet cleaning.

The Investigation noted that although ATC were advised at the onset of the emergency condition that the aircraft had suffered "a complete electrical failure and loss of all navigation systems", at no time had the crew declared an emergency. It was found that this was because they considered that "an emergency existed only if the power could not be restored". As a result, once electrical power had been restored, "they believed that because they did not require priority for their approach.....declaring an emergency was also not necessary". In fact, the content of the pilots' transmissions to ATC resulted in all ATC units treating the flight as an emergency anyway and therefore according priority to the flight thereafter and ensuring that the emergency services were on standby for the subsequent destination landing. It was considered that "if flight crews become aware of a situation that may jeopardise safety but do not declare an emergency with ATC, then there is an increased risk that, should the situation worsen, the flight will still be airborne due to a lack of priority handling, or that it will land without emergency services standing by”.

It was also noted that because of the system failures which occurred, the crew had been directed to and had performed the 'Electrical Emergency' Checklist which had as its first item “LAND AT THE NEAREST SUITABLE AIRPORT" but had not considered that such action was necessary. Despite the "explicit checklist guidance", it was noted that this decision was open to them on the basis of related content in the Air Canada AOM. Nevertheless, at this point, "the flight was less than 100 nm from departure and had been airborne for only about 22 minutes......(and) there were several suitable (diversion) options that would have been closer than their planned destination". The Investigation considered that "an electrical emergency involving loss of all main power on the Embraer ERJ 190 is a serious event and involves multiple failures (and that) even with a complex understanding of the aircraft systems, it is unlikely that a crew would be completely aware of the source of the fault and the likelihood of continued safe operation or increased risk". Indeed, as shown in this event, something as serious as a fire may go undetected.

The formally stated Findings as to Causes and Contributing Factors were as follows:

1. At some point, a fluid contaminant came into contact with the top of the Right Integrated Control Centre. It could not be determined exactly when or how it was introduced into the avionics compartment.
2. The fluid contaminant came into contact with electrical components in one of the alternating current bus bars. This caused arcing, which led to smoke and fire. The resultant failures eventually disabled the main electrical system.
3. Within 36 seconds of the initial fault, power was lost to all main bus bars and, as a result, the smoke detector in the recirculation bay and the recirculation fans lost power.
4. The smoke that had developed during this time did not travel through the recirculation ducts and onto the detector in a sufficient quantity to trigger a warning before the power supply to the detector was lost.
5. Without power, the recirculation fans did not transfer air between the middle avionics compartment and the cabin; as a result, the smoke did not enter the cabin and was not detected by the crew.
6. The flight crew followed the instructions in the Quick Reference Handbook’s 'Electrical Emergency' Checklist and delayed resetting the integrated drive generators until the auxiliary power unit was started. As a result, the smoke detector in the recirculation bay remained un-powered during the period of time when smoke was likely (to be) detectable.
7. Due to the lack of warning of smoke or fire, the flight crew was unaware of the severity of the situation and elected to continue to destination.

The formally stated Findings as to Risk were as follows:

1. If company policies do not restrict outside fluids in areas where they may cause harm to sensitive equipment, then there is a continued risk of contamination causing component malfunctions or failures.
2. If flight crews are not fully aware of the severity of the emergency situation and exercise their discretion as provided in the Aircraft Operating Manual to not land at the nearest suitable airport as prescribed in the Quick Reference Handbook, then there is an increased risk that a flight will be continued to destination when safer options exist.
3. If flight crew guidance for electrical emergencies does not include an early evaluation of battery discharge or confirmation of a supplementary power source, then there is an increased risk that battery power will be insufficient to ensure that essential equipment remains powered until the aircraft can be landed.
4. If flight crews become aware of a situation that may jeopardise safety, but do not declare an emergency with air traffic control, then there is an increased risk that should the situation worsen, the flight will still be airborne due to a lack of priority handling, or that it will land without emergency services standing by.

Safety Action taken by Embraer as a result of the event during and known to the Investigation was the submission, in January 2017, of "a proposal to the Regulator to improve the Electrical Emergency Procedure and Checklist in the Aircraft Flight Manual" so that it includes the following sequence of instructions:

• LAND AT THE NEAREST SUITABLE AIRPORT,
• Limit the airspeed to 150 KIAS minimum,
• Deploy the RAT manually,
• Reset (set to off, then to auto) IDG 1 and IDG 2,
• Start the APU, and
• Set the emergency lights to off.

The Final Report of the Investigation was authorised for release on 5 September 2017 and it was officially released on 11 September 2017. No Safety Recommendations were made.

Related Articles

• Aircraft Electrical Systems
• Electrical Problems: Guidance for Controllers
• Quick Reference Handbook (QRH)
• Smoke
• Fire in the Air
• Aircraft Fire Detection Systems
• Ram Air Turbine (RAT)