Rotana Jet A6-RRA

A scheduled flight reaches the top of climb

Rotana Jet flight RJD123 took off from Abu Dhabi International Airport at 1505 UTC on 12 September 2015, bound for Salalah in Oman. The Embraer EMB-145MP, registered A6-RRA, carried 11 passengers, two pilots and one cabin crewmember. The copilot was the pilot flying and the commander was monitoring. The flight proceeded normally through the climb until it reached FL360. At that point, three cockpit displays went blank and showed diagonal red crosses.

The affected screens were the left primary flight display, PFD1, the left multifunction display, MFD1, and the engine indicating and crew alerting system, EICAS. Together, they presented primary flight information, navigation and systems pages, engine indications and crew alerts. The aircraft had two IC-600 integrated computers that managed information reaching the cockpit. In normal operation, the No.1 computer supplied images to those three screens, while the No.2 computer supplied the right primary and multifunction displays.

A6-RRA had been manufactured in 2001. Its most recent A-check had been completed on 9 September 2015, three days before the incident. The investigation found that the aircraft had been certified, equipped and maintained in accordance with UAE requirements and was airworthy when released to service. Both pilots held the required licences and type ratings. The commander had 2,443 hours on type; the copilot had 370.

The indications return and manual flying continues

The pilots recognised the display pattern from their training and experience as a failure of the No.1 IC-600. The commander pressed the symbol generation button on the No.1 reversionary panel. This selected the No.2 computer to generate indications for the failed displays. The indications returned, and an IC BUS FAIL message appeared on EICAS. The second computer could supply both sets of primary and multifunction displays as well as the engine and alerting display after this selection.

The autopilot disengaged with the display failures. Although the two integrated computers shared several functions, only the No.1 IC-600 incorporated the autopilot functions. Its failure therefore removed the automatic flight capability. The investigation recorded that AUTOPILOT FAIL appeared and the autopilot could not be re-engaged. The copilot flew the aircraft manually for the remainder of the flight, including the descent, approach and landing.

Information feeding the computers came through data acquisition units as well as other systems. DAU1 collected data from forward aircraft systems and the left engine; DAU2 collected data from aft systems and the right engine. Engine information reached them through the full authority digital electronic controls and directly from sensors. Each acquisition unit had two channels, with channel A serving as the primary source and channel B available through manual reversion. The integrated computers converted the incoming information into the images displayed to the pilots.

The display system also provided several ways to recover information after equipment failures. If the No.1 integrated computer failed, the first radio management unit automatically displayed an engine backup page. Pressing the symbol generation button to select the other computer restored that radio unit to normal operation. The multifunction displays could also be selected to show primary flight or engine information. Standby instruments supplied essential information following multiple system failures, and the radio management unit could provide essential flight data if all the main displays were lost.

An electrical odor prompts emergency action

Soon after the screens failed, the pilots sensed an electrical odor. They saw no smoke and suspected the failed integrated computer. As the odor increased and its source remained unidentified, the commander assessed the possibility of an electrical system fire developing. He began the memory items for the Electrical System Fire or Smoke procedure. Both pilots put on their emergency oxygen masks, and communication between them remained normal.

The commander broadcast a MAYDAY to Muscat while the copilot continued manual flying. He then reviewed the Quick Reference Handbook, checked that the memory items had been completed and confirmed a diversion to Muscat International Airport, the nearest suitable airport. After receiving air traffic control clearance, the crew began a rapid descent. The summary gives a descent rate of 3,000 to 6,000 feet per minute, an initial clearance to 12,000 feet and a subsequent clearance to 10,000 feet. They turned north and selected transponder code 7700.

During the descent, EICAS displayed TERR INOP and GPWS INOP, indicating loss of terrain and ground proximity warning capability. The commander said that he pressed the AC power button to isolate the affected systems. He changed the diversion destination to Al Ain in the UAE because of the high terrain around Muscat. The AAIS assessed that decision as appropriate mitigation of the risk of flying over high terrain with GPWS deactivated. The crew completed the Electrical System Fire or Smoke, IC Failure/IC Bus Failure and GPWS INOP checklists.

The cabin prepares for a precautionary landing

The cabin crewmember called the cockpit by interphone and reported a burning odor in the cabin. The commander briefly explained that a technical fault had occurred and said he would provide a NITS briefing shortly. Once the aircraft was established on a track to Al Ain and other procedures had been completed, he contacted her again and requested that she open the cockpit door for the briefing. When he asked about burning smells or smoke, she reported neither at that stage.

The briefing covered a precautionary landing, with further action if smoke developed. The commander required the cabin crewmember to inform him and prepare for an evacuation in that event. NITS covers the nature of the emergency, intentions, time available and special instructions. After the briefing, the cabin crewmember secured the cabin and told passengers that a technical issue had led to the diversion. The copilot continued flying manually while wearing his oxygen mask, and the crew completed the descent, transition, approach and landing checklists.

At approximately 1613 UTC, A6-RRA landed uneventfully on runway 01 at Al Ain International Airport. Airport rescue and firefighting staff attended and reported no smoke or fire. The aircraft taxied normally to stand 7. After parking, the engines were shut down and the passengers disembarked normally. All 14 occupants were uninjured, and the aircraft was undamaged. The AAIS found that crew resource management was effective and that cockpit and cabin safety information had been exchanged accurately and in time.

Heat damage inside the integrated computer

The failed IC-600 was sent to Honeywell for laboratory examination. Opening the unit revealed an electrical burning smell at its front and heat damage to the A1Q1 power supply printed board assembly. Parts on the reverse side of the card showed excessive heating. Removing the daughter card exposed charred resistors A1R27 and A1R28, with further charring and component failure affecting the daughter card and another component.

A specialist in analog circuits and power supply design examined the affected assembly. Severe heat damage prevented several examinations and tests, so the specialist used an experimental board of a similar revision and applied different inputs. The tests failed to reproduce the failure. Drawing on similar historical examinations, the specialist considered an internal breakdown of transformer T1 the most likely source of a short circuit that produced the heat buildup. The AAIS adopted overheating of the power supply board as the cause of the integrated computer failure.

The heat disconnected the No.1 computer, which explained both the loss of its display outputs and the automatic disengagement of the autopilot. Maintenance records showed that this component had last visited the manufacturer on 10 May 2015, about four months before the incident. Since its production in December 2000, it had undergone two modifications and three repairs. The investigation also reviewed the aircraft manuals and the emergency procedures associated with the failed equipment.

Recorder loss and checklist discrepancies

The investigation was notified four days after the occurrence. A6-RRA had continued flying during that period, exceeding the recording capacities of both the cockpit voice recorder and the flight data recorder. Both recordings were overwritten. The occurrence came to the AAIS's attention through routine review of the GCAA mandatory Reporting of Safety Incidents system. The AAIS classified it as an incident and notified Brazil's CENIPA, representing the State of Manufacture, and the International Civil Aviation Organization.

The AAIS found differences between the Airplane Operations Manual and Quick Reference Handbook. The manual included odor as a condition for the Electrical System Fire or Smoke checklist, while the handbook omitted that condition. Investigators considered that the omission could prevent a crew from starting the procedure when odor was the only sign. They also found no explicit precaution in the IC Failure/IC Bus Failure checklist warning that an integrated computer failure could automatically disconnect the autopilot.

The Autopilot Failure procedures differed as well. The manual described an autopilot aural warning below 2,500 feet radio altitude, while the handbook omitted that altitude condition. A separate manual page described voice message self-cancellation above 2,500 feet with a valid radio altimeter signal. The AAIS considered that these discrepancies could add unnecessary workload during an emergency. In its completed summary report, issued on 8 November 2016, it addressed recommendation SR71/2016 to Embraer, calling for review and revision of the three sets of procedures to achieve consistency.

The investigation examined the order of actions within the procedures as well as their wording. The integrated computer failure checklist ended with selection of the corresponding symbol generator on the reversionary panel, and the autopilot failure checklist ended with disengaging the autopilot. Investigators considered that crews facing these failures needed straightforward procedures that led them towards safe conditions. The recommendation also invited Embraer to extend its review to other procedures and checklists in the two references.