This is scary. Something went wrong during design, when they failed to identify 1PA failure mode... and something is still wrong in the aircraft if light switch can kill essential buses. Also note that engines are supposed to be independent -- that's why you have two. In this case, single failure affected both.
Again, ungood.
## Quote from elsewhere:
Aviation 24/7
:
·
*** Serious Incident ***
G-LMRC ATR 42-500 14 nm north-east of Aberdeen Airport 27 AUG 2022
28 POB - No Injuries
Pilot Flight Experience:
Captain - 4,900 hours (of which 243 were on type)
The ATR 42-500 aircraft (G-LMRC) experienced a loss of multiple flight deck displays during climb from Aberdeen Airport. At FL100 when the co-pilot turned off the landing lights as per normal procedure, both the commander’s and co-pilot’s Electronic Attitude Director Indicators (EADI) and Electronic Horizontal Situation Indicators (EHSI) and two other displays went blank, the autopilot disengaged, the air conditioning packs shut down, and the crew felt a momentary deceleration. The co-pilot quickly turned the landing lights back on. The failure lasted about 3 seconds and then the displays and systems returned. The aircraft returned to Aberdeen and landed uneventfully, but a similar failure occurred on the ground when the commander turned the landing lights off.
Investigations revealed a fault in the 1PA contactor, which was stuck in an intermediate position and unable to supply backup power to the emergency electrical network. This was a contributory factor but not a cause of the loss of power.
Despite extensive testing and examinations, the cause of the simultaneous loss of the emergency electrical network and a loss or undervoltage condition of DC BUS 2 could not be determined. However, no further failures occurred after replacement of the 1PA contactor, battery switch, and landing light relays. The aircraft manufacturer and EASA have taken safety action to require testing and replacement of 1PA contactors that have failed.
Given the potential seriousness of a repeat failure, were it to last for more than 3 seconds and occur at night or in IMC conditions, the AAIB has made a Safety Recommendation to the aircraft manufacturer to continue investigating possible causes of the electrical failure.
Analysis:
The aircraft suffered a severe electrical failure soon after takeoff, while in the climb to its cruising altitude. The failure seems to have been initiated when the co-pilot selected the landing lights off, in accordance with the normal operating procedures. While this failure was a surprise to the crew, the co-pilot thought that turning the lights off may have been the initiator of the event, so he reversed the action. The power to the buses was restored with the loss of power lasting about 3 seconds. Once most of the lost services had been restored the crew then handled the remaining faults appropriately and landed without further event.
During the brief period when the flying displays were blank the aircraft was in VMC and it was daytime, so the commander was able to control the aircraft without the need to reference the flight instruments. Had the failure not rectified itself, and the aircraft been in IMC, or it had been night, the crew would have had an increase in their workload as they would have been flying the aircraft with reference to only the standby instruments. This is a scenario the commander had not trained for in the simulator, and there was no specific requirement to do so when obtaining a new type rating.
Cause of the electrical failure
There was clear evidence from the recorded data that electrical power had been lost from the DC STBY BUS, DC EMER BUS and DC ESS BUS (the emergency electrical network). There was no data that could show if DC BUS 2 had lost power, but the flight crew’s evidence that the co-pilot’s EADI and EHSI went blank was compelling, which supported the theory of a momentary loss of power from DC BUS 2. It was also supported by the cabin crew’s reported loss of cabin lights – a loss of ceiling lights would be consistent with a loss of DC BUS 2. The contradictory evidence was the behaviour of engine 2. If DC BUS 2 had lost power, then EEC 2 and the fuel control solenoid on engine 2 would have lost power, which would have caused a reversion to manual mode and both engine power and torque to increase. However, engine power and torque were seen to decrease. One possible explanation for this was that DC BUS 2 suffered from an undervoltage condition rather than a complete loss of power. In an undervoltage condition some components connected to the bus can be affected while others are not, particularly if the power interrupt is very brief. A power interrupt on DC BUS 2 could have been shorter than the 3.2 second period that was seen in the data for the DC ESS BUS.
The behaviour of engine 1 was similar to engine 2 which supported either DC BUS 1 not having lost power, or it suffering a similar undervoltage condition to DC BUS 2. To extinguish all the cabin lights (lateral and ceiling) would have required a loss of DC BUS 1, but there was no other evidence to support a loss of DC BUS 1.
Loss of the emergency electrical network
With contactor 1PA failed in an intermediate position, the three buses on the emergency electrical network would have lost power if contactors 58PA and 3PA had de-energised, resulting in the three buses being connected to the 1PA contactor which could not supply power. The 58PA and 3PA contactors will both de-energise if both MFCs sense that the 7PA battery switch has been turned off. The battery switch is not near the landing light switches, and although it is possible that the co-pilot inadvertently turned off the battery switch instead of the landing light switches, this would not explain why the symptoms reoccurred on the ground when the commander turned off the landing light switches. It is unlikely that both the commander and co-pilot inadvertently turned off the battery switch instead of the landing light switches on separate occasions during the same flight.
If the battery switch was not moved, then a fault within the battery switch could trigger the MFCs to sense it had been moved off. The examination of the battery switch revealed that the B-cell contacts, which when closed send a battery on command to the MFCs, showed some loss of gold plating and some black deposits. If the resistance across these contacts had been excessive then the MFCs would sense an open circuit and de-energise the 58PA and 3PA contactors. However, the voltage drop across these contacts, working stroke and switching force were within specification. And further examinations of the contact surfaces in a scanning electron microscope did not show anything unusual with the deposits.
The investigation then considered if a grounding issue could have sent a false open circuit to the MFCs. The ground reference used by the landing light switches and the battery switch are in close proximity, and it was the actuation of the landing light switches which triggered the failures in both the airborne and on-ground events. However, grounding and bonding tests on G-LMRC did not reveal any issues in that area.
The examinations of the landing light relays revealed that when they were de-energised (i.e. landing light switches turned off) there was a back EMF with high peak transient voltages. Back EMF can cause interference on other wires, but a reference relay had the same level of back EMF suggesting it was normal for that device, and according to the aircraft manufacturer the duration of the peak transient was too short to cause a 3 second loss of power.
Other failure causes, apart from a de-energisation of contactors 58PA and 3PA, were considered but these all involved multiple independent failures occurring simultaneously which was considered very unlikely. Although the cause of the loss of the emergency electrical network could not be determined, there were no further reoccurrences of the failure mode after the battery switch, landing light relays and 1PA contactor were replaced on G-LMRC. This suggests that the battery switch and/or landing light relays may have had a part to play; however, a functioning 1PA contactor could have masked a reoccurrence of the underlying fault by supplying backup power.
Two previous events involving unexplained loss of EADI and EHSI screens were related to turning the landing light switches off. And in two of the three previous screen loss events, replacing the 7PA battery switch reportedly resolved the issues.
Loss of DC BUS 2 A failure of the emergency electrical network cannot explain a loss of the co-pilot’s EADI and EHSI because they receive power solely from DC BUS 2. No single-failure theory could be developed that would explain a simultaneous loss of the emergency electrical network and DC BUS 2. However, there was a wiring issue with DC Gen 2 which supplies DC BUS 2. The cable connecting DC GCU 2 to the excitation field of DC Gen 2 only had one or two strands of wire holding it to the lug on the starter-generator, instead of ten. If the resistance across this lug had increased to 13 Ω then this would have triggered an undervoltage condition on DC BUS 2 which could explain the loss of the co-pilot’s screens. However, resistance measurements of a single strand of wire were between 0.5 and 1 Ω. So, there would have needed to have been a momentary complete disconnect of the remaining two wire strands from the lug, which might be possible to occur as a result of vibration. But it is unlikely that this would have occurred both at the moment the landing light switches were turned off in the air and then again when the switches were turned off on the ground. There is probably some other, not yet conceived, explanation for the simultaneous loss of the co-pilot’s EADI and EHSI screens and the loss of the emergency electrical network.
Cause of the 1PA contactor failure
The only failure that could be identified from physical examinations and testing was the failure of contactor 1PA. When this contactor was energised the contacts did not move sufficiently to close the circuit of the lower contacts. It was effectively stuck in an intermediate position while energised and therefore could not supply backup power from DC BUS 1 to the emergency electrical network. The aircraft system was not designed to detect such a fault, as this type of fault had not been envisaged by either the contactor manufacturer or the aircraft manufacturer. The only test, at the time, that could have detected this fault was a test that was only carried out during a 2C check every 16,000 flight hours. This meant that the fault could have been dormant for a long time.
The contactor failure was caused by the fact that the plunger stop had shifted upwards by about 0.4 mm, preventing sufficient downwards stroke of the contacts when the coil was energised. This upwards shift was most likely a consequence of impact damage to the coil casing which was seen to be dished in. Testing on another contactor revealed that striking the top of the coil casing with a mallet could produce similar dished-in damage and a similar upwards shift in the plunger stop. The cause of this damage could not be determined but it is possible that the contactor had been dropped or possibly hit with a mallet during troubleshooting. The aircraft operator’s maintenance records did not reveal any issues with this contactor so if it had been hit, it may have been by a previous operator.
It is possible that the damage occurred to the contactor some years ago, and that it was only the subsequent normal wear of the contact surfaces that opened the gap sufficiently to result in an open circuit. Hitting contactors is not a technique recommended by the contactor manufacturer nor the aircraft manufacturer, but the AAIB had obtained anecdotal evidence that this had been done before in the aviation industry to release a ‘sticky’ contactor. It was also a technique that had been recommended to the aircraft operator by a different aircraft manufacturer, albeit with certain caveats. Due to the importance of the 1PA contactor in providing backup electrical power to the emergency electrical network, EASA published an AD to require operators to test this contactor and then repeat the test every 1,000 flying hours.