The Gulfstream G150, a twin-engine business jet, arrived at Kittilä airport in Lapland on a cold Tuesday afternoon on the 2nd of January 2018, carrying three crew and four passengers. It was snowing and the temperature was around -5°C (23°F). Normally the aircraft was kept in a hangar if available, however, this wasn’t possible at Kittilä.

The aircraft was registered in Austria as OE-GKA; the operator was a German company and had only one aircraft. The captain was very experienced with 13,000 total flying hours and was also the CEO of the company. The first officer had been hired two months before and had a total of 1,000 flying hours of which 100 were on type.

As they taxied from the runway, the pilots started the APU and the captain expressed concern about the cold conditions. They parked the aircraft at the north end of the apron and shut the engines down normally in accordance with the checklist. The first officer left the cockpit to assist the passengers and remove their baggage from the hold. The captain left the APU running to keep the cabin warm and electric power to the systems. The cabin assistant remained working in the galley for another twenty minutes. The captain completed the final cockpit procedures while the first officer put covers on the engines and the external sensors.

The three crew, the captain, the first officer and the cabin assistant, checked into a hotel, where they were informed that their next mission would be a flight from Yekaterinburg in Russia to Milan, Italy on Friday, the 5th of January. The captain decided that they would do the repositioning flight the evening before and scheduled their departure from Kittilä for 17:00.

The temperatures dropped over the next day and the crew remained indoors, resting at the hotel.

On the morning of the 4th, the temperature had dropped to -22°C (-7.6°F). That afternoon, crew arrived at Kittilä airport at 15:00 Finnish local time (UTC+2) as dusk was falling.

The ground handling company took the crew to the aircraft. The captain took photographs of the snow and frost on the aircraft and then opened the cabin door so that the cabin assistant could board the plane.

The captain and the first officer placed their flight bags behind the cockpit and then the first officer walked around the aircraft to place the crews’ baggage in the rear baggage compartment. The two flight crew removed the engine covers, which were placed into storage bags and also placed into the rear baggage compartment. The captain then boarded the plane and started the Auxiliary Power Unit (APU), generating electricity for the aircraft systems and heat for the cabin.

The first officer began to brush off the snow on the aircraft and the captain came out to help him. They were dressed in light clothing and clearly had not been expecting to have to work outside in the -22°C temperatures. They discussed whether they could clear the snow themselves or if they needed chemical de-icing and then pulled the aluminium stairs out of the baggage compartment so that they could reach the snow on the top of the aircraft.

The first officer initially climbed up the ladder but, as the captain was taller, he took it upon himself to remove the frost from the cockpit windows. Initially, he was brushing off the snow with his bare hands but soon it became too cold and he stopped to get his gloves which were in the cabin.

In there, he told the cabin assistant that it would be possible to turn on the cabin heating in five minutes. As he disembarked again, he closed the door behind him.

The first officer was removing ice from the nose wheel and the captain continued to brush off the snow from the top.

The captain did not return in five minutes as was promised. The cabin assistant continued to work in the cabin when she began to experience a “strange pressure in her ears and chest”. As it continued, she started to feel like she might be having a panic attack. She leaned into the cockpit to the left side window as she could see the pilots working nearby. The window doesn’t open, so she knocked on it to get their attention and called the captain by name.

The pilots heard the knocking and saw the cabin assistant there, looking distressed. The captain climbed down from the working platform and went to the cabin door but found that it didn’t want to open.

He pulled harder on the door handle at which point the door blew open, knocking the captain to the ground and fatally injuring him. The first officer, who was about a metre away and to the left of the doorway, was knocked over by the pressure wave.

The first officer got to his feet and saw the captain lying unconscious on his back on the ground with his legs partly under the door. The first officer turned him on his side and then entered the cabin to check on the cabin assistant. She had been struck by the cockpit’s aft bulkhead and fell to the ground, fainting into a semi-seated position in the cabin. The first officer shook her shoulder and told her to get off the plane. She had chest pain and bruises on her right arm, as well as what turned out to be a mild concussion.

The first officer rushed into the cockpit to call for help; however he was initially so panicked, the ground controller wasn’t clear what had happened or even which aircraft was calling. The controller asked the co-pilot to repeat the message and then phoned the Oulu emergency response centre (ERC) to report an accident at the airport. The ERC asked for more details but the controller wasn’t sure what had happened and simply told them that a passenger had been injured.

At the same time, the airport maintenance shift supervisor, who was waiting for permission to enter the runway to measure the friction, heard the call from the first officer and told ground control he would go to see what had happened. He arrived at the aircraft to find one person lying on the ground and two panicked-looking people nearby, who told him that some kind of explosion had taken place in the aircraft. He joined the first officer in performing CPR on the captain.

The controller attempted to contact the aircraft for more information but received no answer, as the first officer was out of the cockpit and with the captain.

The airport’s apron supervisor arrived at the accident site and helped the first officer continue CPR while the maintenance shift supervisor contacted another staff member to ask him to escort the ambulance to the accident site as quickly as possible. In the terminal, an announcement came over the public address system to ask if there was a doctor or nurse available to help. Two nurses were on their way to the accident site with the airport defibrillator when the ambulance arrived. Ten minutes had elapsed since the first officer’s initial emergency call. The first responders took over CPR and continued with the resuscitation, with support and instructions from an emergency care doctor on duty in Oulu. They commented on the noise from the aircraft and the first officer turned off the APU at their request. About fifteen minutes later, the doctor stopped the resuscitation attempts and declared the victim dead.

The Lapland Police Department arrived soon after, cordoning off the area and photographing the accident site and its surroundings. Police investigators arrived a few hours later and concluded that the accident was not sabotage but an occupational accident.

One thing I’m not used to seeing in an investigation like this is what support was offered to the victims and witnesses. It is an important aspect which is not much talked about and not always taken seriously, so I was pleased to see this covered.

In order to organise psychosocial support following accidents and incidents, airport operator Finavia has prepared a post trauma system for their own personnel which lays out instructions for different situations. It is possible to prevent a possible stress disorder or prolonged stress by providing help through trained support persons to sufferers. Individual or group discussions, led by the support person, play an important role that provides the opportunity for immediate debriefing. The goal is to provide the employee with mechanisms with which to handle and manage the situation.

The following day, at 14:00, occupational health care organised a debriefing session at the airport; all Finavia and Airpro employees which were on duty at the time of the accident were invited. They were together during the general segment, following which it was possible to hold private conversations. Moreover, all of the participants were also able to seek support later from occupational health care.

The co-pilot and the cabin assistant went to the private clinic for a check-up. Psychological support was also offered. The following morning they received voluntary support, comparable to crisis support. The Finnish Air Line Pilots’ Association SLL takes part in international voluntary crisis support activities. They focus on aircrews which, while in Finland, become involved in accidents or incidents. At the time when the accident happened a retired airline pilot was at Levi ski resort in Kittilä. The safety committee of SLL notified him of the accident and he took it upon himself to provide support. He contacted the co-pilot and the cabin assistant. He and his wife took the shaken co-pilot and cabin assistant to their vacation home. During the meeting it became evident that they needed to talk about what had happened. In addition to providing crisis support, the airline pilot helped the ones who were involved in the accident with practical arrangements.

The police investigators documented the visible damage to the aircraft. The door had a few small dents and a few scratches. Once the damaged wall panels were put back into place, the door opened and closed normally.

There was much more damage in the cabin.

The cockpit’s aft left bulkhead and the cabin’s forward left bulkhead were nearly torn off, left hanging by only a few fastenings near the doorway. The airstairs’ acoustic entry curtain and the extinguisher, flashlight and crash axe, which were fastened to the cockpit’s aft bulkhead, came loose from their fastenings and were ejected out approximately 5 m from the door. When the front cabin bulkhead came loose, the tableware storage drawers on the bulkhead broke and the dishes were broken. Several cabin wall panels came loose from their lower fastenings. The cabinets in the aft cabin toilet had opened. The oxygen box in the headliner, closest to the door, had opened and two oxygen masks were hanging on their air hoses.

It’s impossible to know exactly what the pressure was inside the cabin when the captain opened the door.

The door of the Gulfstream G150 is connected at the bottom, opening from the top down to rest on a support leg, which allows the door to be used as airstairs when open. The door has two seals.

One is an inflatable seal which is automatically pressurised with engine or APU bleed air when the door is closed. When the door handle is moved, the pressure port fitted on the door automatically deflates the seal. The other seal is a conventional seal which is, according to AFM, designed to maintain cabin pressurisation even if the inflatable seal malfunctions.

You open the door from the outside by pulling the stirrup handle, at which point the door seal deflates, which takes two or three seconds. Then you raise the handle and pull the door upwards and into position. The Cabin Operating Manual warns that the door is heavy, but it is balanced and usually does not take much force to open. However, the manual warns that you should not stand directly underneath the door when opening it and to ensure that the door pathway is clear.

When the captain got his gloves from the cabin, he closed the door from the outside. The Gulfstream G150 Cold Weather Operations Manual recommends this, stating that the heating can be expedited by closing the door. The checklist in the manual includes the item: If APU is operating, check outflow valve full open.

The first officer reported that the captain struggled to get the door open and used much more force than usual.

Now the investigators had enough information to start on piecing together the chain of events leading to the accident.

When the flight arrived at Kittalä airport, the pilots turned on the APU as they taxied to the apron. They parked and shut down the engines, leaving the APU running. The captain then remained in the cockpit alone while the first officer dealt with the passengers and then the external covers.

The engine shutdown checklists specifies that the Environmental Control System be set to RAM to shut off the bleed air flow and the cabin pressurisation set to to manual control, which depressurises the cabin using the outflow valve.

The Environmental Control System (ECS) monitors cabin airflow, pressurisation and temperature through the air conditioning system and the pressurisation system.

The Air Conditioning System can be used both on the ground and in the air, either automatically (the default) or by pressing the CABIN TEMP MAN button to set it to manual. When on the ground, the APU or at least one engine must be running to use the system.

The Cabin Pressurisation System is normally operated in automatic control and the switch illuminates when it is set to manual. The system has direct control over the outflow valve in order to regulate the outflow volume of air. At least one of the avionics power switches must be turned on for it to operate automatically. During flight, the cabin pressure differential is set automatically based on the aircraft altitude. If the system detects that the engine power is below 70% and the “weight on wheels” sensors are active, it presumes the aircraft is on the ground and fully opens the outflow valve.

When the Environmental Control System is set to RAM, the engine and APU bleed air is cut off from the cabin, which depressurises using the outflow valve. It is not possible to control the cabin temperature or to manually control the outflow valve when the Environmental Control System is set to RAM.

The outflow valve exhaust is on the right side of the front of the aircraft, below the cockpit, and protected by a metal grill. Checking that the grill is free and that the valve isn’t blocked by snow or ice is part of the cold weather walk-around check. The first officer later said that, on the day of the accident, he did not think that the outflow valve had been checked visually yet.

Now, the weather was clearly bad when they arrived and no pilot wants the valve to get bunged up with snow and ice. Knowing that, we can begin to imagine what happened.

The Gulfstream G150 has a DITCH button which overrides any other control commands to the outflow valve and closes it, in order to protect the value an emergency landing on water. It takes about 15-20 seconds for the valve to close. The DITCH pushbutton lights up when pressed but it doesn’t indicate whether the outflow valve is open or closed, just that the button has been pressed. This is meant for use in emergencies, of course, but apparently it is also commonly used to close the outflow valve when parked, in order to protect the valve from snow, sand or insects entering the valve.

Somewhat related is the DUMP button, which is used to depressurise the cabin in an emergency. This opens the outflow valve. Just as with the DITCH functionality, the pushbutton lights up when pressed without showing the state of the outflow valve. It takes about 15-20 seconds for the valve to open. It, also, is only meant to be used in emergencies.

Normally after landing at Kittilä and parking, the crew would have set the Environmental Control System to RAM in order to shut off the bleed flow air and set the pressurisation to manual. In this circumstance, the outflow valve would remain open. Once they’d finished at the plane, the first officer left the aircraft and the captain shut down the APU on his own. At that point, he almost certainly hit the DITCH button in order to close the outflow valve to protect it from the blowing snow.

On the Thursday when they returned to the aircraft, the captain took photographs, which implies that he found it noteworthy: the weather and ice were not typical. The captain then entered the cockpit alone and started the APU. It’s clear that at this point, the outflow valve was closed. It seems likely that the captain pressed the DITCH button again. Deselecting DITCH would extinguish the indication light but it would not change the state of the valve. The light simply signifies the switch position and not the valve’s position.

The APU bleed air was ducted into the cabin. Then the captain left the aircraft, closing the door behind him. The pressure began to build inside the cabin.

There’s a number of minor issues which combine to create a greater issue. The external walkaround should have been done as soon as the APU was operating. Further, the Cold Weather Manual which mentions heating the interior of the aircraft using the APU bleed air (and for that matter, that the heating can be expedited by closing the door) includes the following in the external checklist: if APU operating, check outflow valve is full open.

The flight crew had no safety net to protect or even alert them that the aircraft had unintentionally pressurised on the ground. The concern with a pressurised aircraft is that it might unintentionally depressurise during flight, exactly the opposite. The only reason to pressurise an aircraft on the ground is for maintenance testing or repair, in which it is expected that the maintenance personnel will not force open the door, because they know the aircraft is pressurised.

It seems clear that the captain closed the outflow valve when parking the vehicle, which is not standard or recommended. Then the following morning, he started the APU and closed the cabin door without opening the valve. It could be that he meant to press the DUMP button and pressed the wrong one. Possibly, he thought that the automatic pressurisation system would kick in but that required the avionics to be powered, and the to power up the systems, he needed the cockpit and cabin temperatures to have reached +10°C (+50F). Maybe he meant to do the external walk-around next, which included checking that the valve was free of ice or snow and would have alerted him to the fact that the valve was closed.

He may have known the valve was closed but thought it didn’t matter as the cabin door was open. But when he left the cockpit he noticed that the cabin attendant was wrapped up in a blanket against the cold and told her that the he would turn the heating on in five minutes. He clearly then closed the door in order to protect her from the cold and expedite the heating. Freeing the aircraft from snow and ice certainly took longer than he expected, as he did not return within five minutes as promised.

Or it could simply be that he completely forgot that he’d hit the DITCH button and closed the valve. As he was alone in the cockpit, it’s impossible to know exactly what he did, let alone what he was thinking.

The first officer had no idea as he’d been outside removing the ice and snow.

There’s no warning system to indicate that pressure is beginning to build in the cabin and the CABIN PRESS panel does not have any information as to whether the outflow valve is open or shut.

The captain and the first officer had no way of seeing that the cabin had pressurised and so did not think there was any issue in opening the door. Even if they had understood what was happening, knowing the cabin crew member was trapped in there, they would still have needed to do something. It is not possible to shut down the APU or to open the outflow valve from outside of the aircraft; the only other option would have been to try to shout instructions to the distressed cabin assistant so that she could shut down the APU.

Although the manual says to avoid standing underneath the door when opening it because it is heavy, in re-enactments, the investigators found that the natural place to stand is right in front of it, with one hand on the stirrup handle and the other hand held out to support the door.

The result was that when the captain used his strength to open the door, the pressure had built up to such a level, it blew the door open and he took the full force of the impact. The cabin assistant, who was moving from the cockpit back to the cabin, was thrown towards the doorway. If she’d been in the cabin, she probably would have been ejected and suffered greater injuries.

The investigation found that there have been three fatal accidents involving the explosive discharge of an aircraft pressurised on the ground since 2000. These were on airliners where cabin crew members opened the door from the inside and fell or were ejected from the aircraft. Further, the NTSB investigated a case in 2005 when a cabin crew member was seriously injured when the cabin pressurised on the ground because it was being cooled by an air conditioning cart with all of the doors closed. The cabin crew member was forcibly ejected through the aircraft’s galley service door. The report concluded that the cabin crew training manuals emphasise keeping at least one door open when the air conditioning cart is connected and warning cabin crew against opening a door when an air conditioning cart is providing heated or cooled air to the cabin. The FAA published a Safety Alert for Operators recommending that air carriers should raise awareness of the hazards associated with differential pressure.

EASA’s 2009 study on Cabin Safety Requirements analysed accidents to identify safety threats, including explosive door opening when the cabin was partly pressurised on the ground. They concluded that further research was required to investigate how these occurrences could be created. However, over ten years later, there has been no further research.

There are some aircraft, including the Airbus A320, which have a warning light on the inside of the door which illuminates in the case of excessive pressure. The light is visible to cabin crew from the inside and ground crew on the outside can see the warning light through the door window. However, the Gulfstream G150 does not have any such warning system in place.

The captain of the Gulfstream G150 was the Chief Executive Officer of the operator. According to their organisational chart, the Chief Executive Officer has the overall responsibility for safety and reporting. This makes it very difficult for any staff member to report issues or concerns about the captain. In this case, there were none but at the same time, there was no one to correct the captain’s use of the DITCH button to close the outflow valve during snowy conditions.

The investigators concluded that when the APU is being run, the flight crew must check the outflow valve is fully open and if they cannot check this, then they must not close the door. They made two safety recommendations.

The Gulfsteam G150’s Cold Weather Operations Manual states in many places that “Heating can be expedited by closing the door”. At the end of the manual’s supplementary checklist, there is an instruction: “If APU operating checkout flow valve full open”.
The Safety Investigation Authority recommends that:

The Civil Aviation Authority of Israel (CAAI) supervise that Israel Aviation Industries (IAI) updates the operating manuals of the Gulfstream G150 and other comparable aircraft types. Updates to the sections that address closing the door as a means of heating or cooling the aircraft should include a caution to check that the outflow valve is fully open before the door is closed. [2018-S41]

The only way to check that the valve is open is visually from the outside.

In 2009 the EASA published “Study on CS-25 Cabin Safety Requirements”, which it had commissioned. It charted the safety threats for cabin safety. One safety threat which was mentioned in the study involved explosive door openings when the cabin was partially pressurised on the ground. The study’s conclusions and recommendations state that explosive door openings have resulted in fatal and serious injuries which could have been prevented by better procedures or communication.
The Safety Investigation Authority recommends that:

The European Aviation Safety Agency (EASA) inform air operators, ground handling organisations and aerodrome rescue and fire fighting organisations of a safety threat which may be caused by aircraft pressurisation on the ground and consequent explosive door openings. The bulletin must include the actions with which the safety threat can be controlled, as well as a reminder to provide the associated training to all persons involved with handling aircraft on the ground. [2018-S42]

There’s more information on the background and on the specific details of the Gulfsteam systems; if you are interested I recommend that you download the full accident report.

By the time the report came out, Gulfstream had already contacted all Gulfstream operators with details of the accident and a Maintenance and Operations Letter to remind operators that:

• Published procedures must be followed when running the APU on the ground.

• Crews must check that the outflow valve is fully open and unblocked before using the APU on the ground with the cabin door closed.

• Failure to check the outflow valve may result in inadvertent cabin pressurisation when APU bleed air is ducted into the cabin while the door is closed.

• When operating in cold conditions, the instructions in the Cold Weather Operations Manual must be followed.

EASA has since released a Safety Information Bulletin on the subject of Explosive Door Openings on Parked Aeroplanes to emphasise the importance of following procedures to ensure that there is always a means to release the cabin air pressure before conditioning the cabin on the ground with the APU or an external source.