Aviation Investigation Report A09P0351

The Air Canada Jazz de Havilland DHC-8-311 (registration C-FRUZ, serial number 293), operating as flight JZA8216, was en route from Cranbrook to Vancouver, British Columbia, in instrument meteorological conditions with 3 crew and 33 passengers on board. On descent through 14 000 feet above sea level, the left forward windshield heater terminal block arced and then caught fire. The flames lasted a few seconds and then went out as the crew turned off power to the windshield heater. The windshield inner pane was shattered. An emergency was declared and the flight landed at 1958 Pacific Daylight Time, with emergency and rescue services at the ready. There were no injuries to passengers or crew.

The flight departed Cranbrook with the windshield heat initially set to WARM. Climbing through 1000 feet above ground level, the outside air temperature (OAT) reached -1°C and icing was encountered. Windshield heat was then set to NORMAL. The aircraft encountered cloud and light to moderate icing in climb, cruise and initial descent. Windshield heat remained in the NORMAL position. At 10 000 feet above sea level (asl), the aircraft was clear of cloud and the OAT was -10°C. The surface temperature in Vancouver was 13°C.

Both pilots were certified and qualified for the flight, captain qualified and possessed significant experience on type and in total. The flight deck and cabin crew handled the emergency in accordance with established procedures.

The designated first officer was the pilot flying and remained at the controls throughout the occurrence. In an attempt to use the fire extinguisher, the captain had difficulty unlatching it from its mount on the bulkhead behind the captain's seat. By the time it was unlatched, the flames had disappeared and the extinguisher was no longer needed. The circuit breaker (CB) for the windshield heat system did not trip.

The flight landed at 1958^{Footnote 1} and stopped on the runway. When the crew deemed it safe to do so, the aircraft was taxied to the gate where the passengers exited normally.

The Transportation Safety Board (TSB) had been advised of the event as it was unfolding and had asked that a message to secure the cockpit voice recorder (CVR) be relayed to the crew. The crew did not receive the message and, consequently, did not secure the CVR.

The Air Canada Jazz Company Operations Manual (COM) requires that the CVR circuit breaker be pulled only after gate arrival on any flight leg during which an incident or accident has occurred. Section 8.2.12 of the COM states the following:

Deliberate de-activation of operable voice and data recorders (CVR & FDR) is not permitted while in operation. Should an incident or occurrence take place more than 30 minutes prior to gate arrival, the CVR must be allowed to run continuously notwithstanding that the CVR record of such incident will be over-recorded. This is under the direction of Transport Canada who requires that the recorder may only be de-activated as soon as possible following gate arrival. Therefore, on any flight leg during which an incident/accident has occurred, pull the appropriate circuit breaker only after gate arrival.

The CVR recorded only the last 30 minutes of sound from the cockpit. The emergency was declared at 1946 and the aircraft reached the gate at about 2008. The CVR could have had about 22 minutes of recordings relating to the event. Once parked, however, the aircraft was not quarantined and the operator's maintenance department proceeded to replace the windshield. During this time, power was applied to the CVR for more that 30 minutes and information that could have been valuable to the investigation was overwritten.

Cockpit windshields^{Footnote 2} are not life-limited. Rather, they are an on-condition maintenance item. The Dash 8 Maintenance Manual (Temporary Revision, 56-010 dated 24 January 2006) specifies limits for the amount of delamination, cracking and damage allowable in various areas of the windshields. The component manufacturer, PPG Aerospace (PPG), also publishes condition limits in the Component Maintenance Manual (CMM). The operator uses both references. The majority of windshields are replaced, prior to failure, when they reach these maximum in-service damage limits.

PPG offers an Optimal Replacement Age (ORA) service to operators who prefer not to run their windshields to in-service damage limits. The aim is to avoid the higher cost of unscheduled removals by replacing windshields on a scheduled basis according to an analysis of data supplied by the operator. Under such a program, windshields are typically replaced between 10 000 and 15 000 flight hours. Air Canada Jazz did not subscribe to this service.

The occurrence windshield was manufactured in 1996 by PPG. In the 9 years since its installation, the windshield had accumulated over 19 000 flight hours.

A review of the National Transportation Safety Board (NTSB) accident database, Transport Canada occurrence reporting system and the TSB occurrence database revealed no evidence of a windshield arcing event that was causal to an accident.

Windshield

The windshield and windshield heat controller were sent to the TSB Laboratory for examination.

The windshield is a 3-ply laminate. The inner ply was cracked (see Photo 1), but not the outer and centre plies. The windshield heat controller was tested and performed as designed.

Image

The windshield still had its original moisture seal. Though there was some erosion of its polysulfide layer on the outer side due to rain impingement, the seal appeared to be in good condition.

Resistance values for the temperature sensors were measured as well as the bus to bus resistance. These values were compared against the design values specified in the component maintenance manual (CMM). The temperature sensor resistances all fell within the allowable limits; however, the bus to bus resistance value was well above the allowable limit.

The windshield is wired through a terminal connector block. The electrical terminal block has 8 connectors: 3 pairs (A-F) running to temperature sensors within the windshield and 2 (L1, L2) that supply power to the conductive film within the windshield.

Wires that attach to the top side of the terminal block with ring terminals lead to the windshield temperature controller. Wires soldered on the bottom of the terminal block (including a wire braid located under L2) lead to temperature sensors and to the conductive film inside the window. At the time of installation, the terminal block is placed upside down to solder the braids to the terminal pads. Once the soldering is complete, the block is flipped over and placed in position on the windshield. When the block is flipped, the braiding is folded over, lining up the bend with the edge of the terminal block.

Most of the terminal block was undamaged, but the terminal block material near the L2 connection exhibited heat damage, some melting and some burn damage. Most of the direct melting and heat damage was located on the side of the terminal block and not at the L2 connector itself.

The top ring terminal that had been connected to the L2 connector did not exhibit any arcing or heat damage. There was no evidence of arcing to the wire remnants that were attached to this ring terminal. The crimp connection attaching the wires to the ring terminal was solid.

The screw attaching the top ring terminal to the L2 position did not exhibit any arcing or heat damage. There was no damage to the screw threads that would have indicated that it had been cross-threaded. The terminal that the screw threads into was also examined; there was no damage to the threads in the terminal, indicating that it had not been cross-threaded. There was some discoloration of the screw.

The L2 connection on the bottom of the terminal block was severely burnt and the wire braid was severed from the terminal due to arcing damage. The solder connections of the braids to the remaining pads on the terminal block, including the other power connection (L1), appeared to be in good condition and solidly connected.

The L2 terminal was extracted from the terminal block and microscopically examined. The wire braiding was still soldered to the bottom of the terminal; the braid was folded over and the fold lined up well with the edge of the terminal. The temperature at the L2 wire arcing site had been high enough to melt copper (1083°C).

A previously molten ball of metal was found under the terminal block embedded in a patch of re-melted glass, which penetrated beyond the case depth of the glass ply.

As evidenced by the localized re-melting of glass, the cracking of the windshield appears to have originated from under the L2 connection on the terminal block. The re-melted glass had penetrated beyond the case depth of the glass ply, which is the strengthened portion of the glass. Softening of this type of glass occurs at about 593°C (1100 degrees F), melting occurs at about 815°C to 1093°C (1500 to 2000 degrees F). Pressure builds up in the glass at about 50 psi for every degree F difference (between one area and the next).

Mechanical damage from foreign objects was ruled out as a contributing factor, as the wire was in a protected area. Moreover, a review of maintenance records for the past 30 days did not reveal any actions in the vicinity of the windshield, which could have initiated the arcing event.

The circuit breaker for the windshield heat had not tripped. The majority of circuit breakers used in aircraft are thermal overload type circuit breakers. These are designed to allow a set amount of current to flow through the device over a given amount of time. If the flow of current rises above this set value, it will heat up the thermal components within the breaker, which will cause the breaker to trip or open the circuit, stopping the flow of current. For example, a circuit breaker rated at 5A is designed to trip in about 3.2 to 17 seconds if subjected to a current flow of 10A.

The trip speed, however, is the rating for a continuous current flow, as this is the amount of time it takes for the current to heat up the tripping components within the breaker. If the same current were to be pulsed on and off, it would take much longer for the circuit breaker to trip, as this would allow some time for the components to cool off in between the ON pulses. For this reason, thermal circuit breakers are not effective in detecting and protecting against arcing events, which consist of many current pulses of very short duration. Thermal circuit breakers were not designed for this purpose; however, a different type of circuit breaker called an arc fault circuit breaker is designed to detect the arcing signature electronically and to trip on these characteristics.

The following TSB Laboratory report was completed:

• LP148/2009 – Examination of Windshield Panel and Controller

This report is available from the Transportation Safety Board of Canada upon request.

An arcing event could have been caused by faulty or aging conductive film in the windshield or by the moisture-induced degradation of it. However, this would have caused the outer ply, not the inner ply, to break. Since the inner ply was the layer that had broken, the conductive film is likely not at fault.

While the screw and ring terminal attached to the top L2 position on the terminal block were discoloured due to their proximity to the arcing and heat, they were not melted or physically damaged. There was no evidence of arcing between the screw, ring terminal and L2 terminal. This indicates that there was likely good contact between the screw and L2 terminal.

The lack of damage to the screw threads and the internal screw threads indicate that the screw had not been cross threaded, which may have allowed the area to heat up or arc due to increased resistance in the connection. The burning and melting damage was mainly located at the edge and under side of the terminal block, indicating that the damage was not related to the external connection to the windshield.

The origin of the arcing appears to either be a deterioration of the solder joint under the L2 connection on the terminal block or a damaged braid leading to the L2 connection. If the solder joint had failed, it could have separated allowing an arc to occur. If the braid had been damaged, it may have increased the resistance in the wire, heating it enough that it may have melted the solder. This would have resulted in a separation of the wire from the pad, allowing arcing to occur. A damaged wire could also have separated, allowing arcing between the wire segments.

The high bus to bus resistance can be explained by the burning away of part of the wire leading to the L2 connector. While this would normally result in an open circuit, the charred remains created a conductive carbon path, completing the circuit with a higher characteristic resistance than a wire would.

When the L2 terminal was extracted from the terminal block, the wire braiding that was soldered to the bottom of the terminal appeared to be in its originally installed position. The remnant of the braiding that was found soldered to the terminal pad was still folded and the bend was lined up with the edge of the terminal block. If the arcing had initiated at the braid connection at the L2 pad due to a loose or poor solder connection, it is most probable that the braid remnant would no longer be found in its original orientation, as the forces from the arcing would have moved the loose braiding around. The previously molten ball of metal found embedded in the patch of re-melted glass would have come from the missing portion of the braid that leads to the L2 pad. Therefore, it is most probable that the solder connection to the L2 pad was solid and that the braiding was damaged leading to the arcing event between damaged portions of the braid itself.

It was not possible to examine the braid where the arcing had initiated as this section of the wiring had been vaporized. It was not possible to determine what caused the initial damage to the wire braid.

As the glass melted in a small localized area where the arcing occurred, a high temperature differential was experienced and, as the melting had penetrated beyond the strengthened portion of the glass, the glass ply cracked. This indicates that the cracking was caused by the arcing.

Air Canada Jazz COM includes procedures for the FDR/CVR following an accident or incident. However, the procedures include not disabling it until gate arrival, which in some circumstances may increase the risk of the CVR being overwritten. Whenever a CVR is not secured after an occurrence, information relevant to a TSB investigation is lost and the identification of safety deficiencies and the development of safety messages are impeded.

Findings as to causes and contributing factors

1. Electrical arcing in the braid lead to the L2 connector on the windshield terminal block occurred as a result of damage within the wire braiding. It was not possible to determine the initial cause of the damage within the wire braid.
2. Due to its proximity to the arcing, the inner ply of the windshield cracked.

Findings as to risk

1. Whenever a cockpit voice recorder (CVR) is not secured after an occurrence, information relevant to a TSB investigation is lost and the identification of safety deficiencies and the development of safety messages are impeded.
2. Under certain arcing conditions, a thermal overload style circuit breaker may not trip, increasing the risk of overheat or fire.

Air Canada Jazz

Air Canada Jazz has taken the following safety action:

Instigated an immediate Dash-8 fleet wide check of all heated transparency terminal block connections for proper torque, hardware and installation.

Conducted a risk assessment of the fire extinguisher type and location. The company reported that the installation is standard on all its aircraft. Its findings indicated a low risk with no further action.

The DHC-8 Maintenance Schedule was amended to include a torque check of the windshield terminal block connections at each C Check (5500 hours).

Inserted specific guidance in its Emergency Response Manual regarding when to quarantine an aircraft and the requirement to pull the CB's for the CVR/FDR, following an incident or accident. The manual states in part:

When Do I Quarantine an Aircraft?

…the investigation into a serious incident will be conducted by the Transportation Safety Board of Canada (TSB) and a parallel investigation will be conducted by the Jazz Corporate Safety Investigative team. Although all crew members are advised to do so, the Maintenance Operational Control (MOC) checklist reflects that the CB's for the CVR and the FDR are to be pulled as soon as possible to ensure that any electronic information is also preserved…

The Jazz (pilot) Training Program Manual, section 6.16.2 now specifies that annual pilot training includes requirements for FDR/CVR deactivation. This training was introduced in response to Transport Canada Advisory Circular AC 700-013, published on 01 January 2010.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 05 January 2011.