Door failure and depressurisation involving a Cessna 441, VH-LBY, near Broome, Western Australia, on 22 July 2020

Outbound flight

On 22 July 2020, at about 0904 Western Standard Time,^[1] a Skippers Aviation Cessna Aircraft Company 441 aircraft, registered VH-LBY, departed on a charter flight from Broome Airport, Western Australia, to Browns Range Airport with two pilots and six passengers on board. Browns Range is located about 388 NM (719 km) east of Broome and the flight was planned to be conducted at flight level^[2] (FL) 270 with an estimated flight time of 84 minutes.

The aircraft reached FL 270 at about 0932. At about 0933, when 108 NM (200 km) from Broome and before the cruise configuration was set, both pilots heard a loud noise from the passenger cabin. The PIC initially thought the emergency pressurisation valve (refer to section titled Pressurisation system), located near the emergency exit door on the right side of the cabin, had inadvertently activated.

At about the same time the PIC was checking the warning light for the emergency pressurisation valve, the cabin altitude warning light and aural beeping tone activated. The PIC noted the cabin altitude gauge passing 25,000 ft, while the observation pilot (OP) in the right seat recalled observing about 27,000 ft, indicating a rapid depressurisation of the cabin. The pilots donned their emergency oxygen masks and the PIC initiated an emergency descent. The OP retrieved the emergency checklist and contacted air traffic control (ATC) to request a descent to FL 120. Figure 1 below depicts the incident flight path from Broome to Browns Range and approximate location of the depressurisation.

Figure 1: VH-LBY flight path and location of depressurisation

Source: Google earth, annotated by the ATSB

During the descent, the pilots confirmed the passengers had fitted their masks. When ATC asked if they were ‘ops normal’, the crew reported they were experiencing pressurisation issues, but were ‘ok’. At about 0937, the aircraft reached FL 120. Shortly after, the OP sent a text message to the operator’s senior base pilot (SBP) at Broome advising of the situation and asking if they should return to Broome. The SBP, who was preparing for a flight to Halls Creek, and knew there were no passengers for the return flight on VH-LBY from Browns Range, advised the pilots to continue the flight depressurised, to upload fuel at Halls Creek if required, and to apply the minimum equipment list (MEL).^[3]

At about 0940, the pilots commenced a further descent from FL 120 to 10,000 ft. When at 10,000 ft, the pilots removed their oxygen masks, instructed the passengers to do the same and confirmed they were all responsive and uninjured. The PIC confirmed the aircraft handling was normal, selected the autopilot on, and notified ATC of their intention to return to Broome.

Shortly after the PIC contacted ATC, the OP passed the text message reply from the SBP to the PIC. The PIC initially misunderstood the message and amended their destination intentions to ATC from Broome to Halls Creek, before correcting this to Browns Range. The pilots briefed the passengers and recalculated their fuel requirements for maintaining 10,000 ft, which indicated they would need to divert to Halls Creek on the return flight for fuel.

At about 0942, the operator’s maintenance shift supervisor at Perth received a phone call from the SBP and they discussed the event. During the discussion, they concluded that the problem was likely to be related to an air cycle machine fault (refer to section titled Pressurisation system). Therefore, they agreed that it was acceptable for the aircraft to continue to Browns Range, where the PIC could invoke the MEL item for the pressurisation system, and return to Broome at, or below 10,000 ft without passengers. The shift supervisor reported that they ended the phone call with the expectation that a re-assessment would be made after the aircraft arrived at Browns Range. They then notified the operator’s continuing airworthiness manager and chief pilot of the incident.

At about 0946, the SBP sent another text message to the OP advising the pilots to contact the shift supervisor if assistance was required, that the issue was likely related to the air cycle machine and asked if the emergency pressurisation annunciator light had illuminated. The PIC reported to the OP that they thought the emergency pressurisation annunciator light did come on momentarily. The OP relayed to the SBP that it did activate. The pilots had a further conversation after the OP sent the message to the SBP and concluded that the PIC might have confused the emergency pressurisation annunciator light with the activation of the cabin altitude warning light, and that it probably did not activate.

At about 1046, the aircraft landed at Browns Range Airport without further incident. The passengers disembarked and the PIC applied the MEL item for the pressurisation system. During their walk-around of the aircraft, both pilots noticed the lower aft section of the emergency exit door skin had separated (disbonded). Figure 2 depicts the location of the emergency exit door and Figure 3 depicts the separation of the door outer skin.

Figure 2: VH-LBY and the location of the emergency exit door

Source: Joe Barr, annotated by the ATSB

Figure 3: Separation of the emergency exit door outer skin

Source: Operator, annotated by the ATSB

Return flight

As there was no phone reception at Browns Range (internet access was available at the mine site) and noting the door skin separation was at the trailing edge and not in the airflow, the PIC elected to continue with the return flight via Halls Creek Airport where they expected to meet the SBP and have reception. At about 1117, the aircraft departed Browns Range and arrived at Halls Creek at 1144 without incident. The pilots refuelled the aircraft and waited for the SBP to arrive.

On arrival at Halls Creek, the SBP inspected the emergency exit door and noted there was a 10 mm gap at the bottom of the door and that the door had disbonded, which they had not seen before. They photographed the door and sent them to the maintenance shift supervisor for further discussions.

The shift supervisor subsequently discussed the photographs with the continuing airworthiness manager. They assessed that the door skin was not in the airflow, and therefore, should not result in any further damage for a return flight to Broome unpressurised. Between the personnel at Halls Creek and Perth, there was no discussion of the applicability of the pressurisation system MEL item. This item restricted operations to a maximum altitude of 10,000 ft unpressurised, which was consistent with their plan for the return to Broome for maintenance. At about 1255, the aircraft departed Halls Creek and arrived at Broome at 1419 without further incident.

__________

1. Western Standard Time (WST): Coordinated Universal Time (UTC) + 8 hours.
2. Flight level: at altitudes above 10,000 ft in Australia, an aircraft’s height above mean sea level is referred to as a flight level (FL). FL 270 equates to 27,000 ft.
3. An approved MEL is a document that allows for the operation of a specific aircraft under specific conditions with a particular item(s) of equipment inoperative at the time of dispatch for the intended flight. Despite the inoperative equipment, the aircraft still complies with its type design standards. This requirement enables the PIC to determine whether a flight may be commenced or continued from any intermediate stop should any instrument, equipment or system become inoperative.

Flight crew information

Pilot in command

The pilot in command (PIC) held a Commercial Pilot Licence (Aeroplane) with an instrument rating for multi-engine aeroplanes and a valid Class 2 Aviation Medical Certificate.^[4] The PIC had accumulated a total of 604.3 flying hours, of which 110.3 hours were on the Cessna 441. The PIC had previously flown the sector from Broome to Browns Range while operating in-command under supervision. However, the coronavirus pandemic resulted in an extended delay between the PIC’s flying under supervision and line check. Therefore, the Broome senior base pilot (SBP) rostered a second pilot with more recent experience of Browns Range to act as an observation pilot (OP) for the flight.

Observation pilot

The OP held a Commercial Pilot Licence (Aeroplane) with an instrument rating for multi-engine aeroplanes and a valid Class 1 Aviation Medical Certificate. The OP had accumulated a total of 1,899.1 flying hours, of which 389.9 hours were on the Cessna 441.

Aircraft information

VH-LBY was a Cessna Aircraft Company 441 (Conquest II) 11-seat pressurised twin-engine turboprop aircraft. It was manufactured in 1978 and first registered in Australia on 13 May 1986. At the time of the incident, the aircraft had accumulated 27,116 flight hours, 23,484 cycles and was about 42 years old. On 29 July 2015, the type certificate for the Cessna 441 was transferred to Textron Aviation Inc.

Pressurisation system

Bleed air from each of the engines was delivered via flow control valves to an air cycle machine, located in front of the forward pressure bulkhead. This provided pressurisation and temperature control for the cabin environment through air ducts and a series of vents. In-flight, the pressurisation source could be selected by the pilot to both, left, right or emergency. Emergency could be selected manually by the pilot (in response to a depressurisation) or activated automatically if the air cycle machine overheated. The associated annunciator light only activated for the air cycle machine overheat condition.

If emergency pressurisation was activated, a control valve provided unregulated airflow from the right engine directly into the cabin via a separate vent to the main system. This will maintain cabin altitude, but also cause the cabin temperature to climb uncontrollably. Activation of the emergency valve was described by the PIC as ‘very loud and sounds similar to the noise we heard…it is located in the forward right of the cabin fuselage…similar location to the emergency exit door…have heard due to age they could inadvertently open’.

The maintenance shift supervisor had a previous experience with an air duct separating from the air cycle machine in another Cessna 441. This resulted in the shift supervisor anticipating a mechanical issue with the pressurisation system rather than a structural issue with the airframe. The shift supervisor further reported that, if airflow from the vents had been verified in-flight, they could have discounted a fault with the air cycle machine and considered other possibilities.

When the SBP asked the pilots at 0946 if the emergency pressurisation activated, the pilots interpreted this query as related to an uncommanded activation associated with the depressurisation. However, the pilots’ response that it activated was interpreted by the SBP that the pilots had manually selected emergency as the pressurisation source at step 3 of the depressurisation checklist and that it had operated as designed.

Supplemental type certificate

Supplementary inspection programs are used to ensure the continuing airworthiness of ageing aircraft. Maintenance becomes more complex as an aircraft increases in age. Additional maintenance is required in areas where experience has shown fatigue or environmental degradation to be greater than predicted (ATSB, 2007).

Cessna, supported by operators and the United States Federal Aviation Administration, had produced a supplemental structural inspection program, published in the model 441 maintenance manual supplemental inspection document (SID). The SID revision number 5-3, dated 15 January 2008, stated the program is valid for:

…model 441 airplanes with less than 22,500 flight hours. Beyond this, continued airworthiness of the airplane can no longer be assured. Retirement of the airframe is recommended when 22,500 flight hours have been accumulated.

In response to the manufacturer’s recommendation to retire the aircraft, the Civil Aviation Safety Authority (CASA) issued a direction to all Australian Cessna 441 pilots and operators, for aircraft that had accumulated 22,500 hours, that commenced on 19 September 2008 and was valid until 18 September 2009.^[5] The direction stated that:

The aircraft may not be flown at any time or for any purpose while this direction is in force unless, being satisfied that it is safe to do so, the Director approves in writing the details of the flight, including the time, route, purpose and risk mitigators.

In response to the recommendation from Cessna and the direction issued by CASA, a Cessna 441 life extension program was developed in Australia and submitted to CASA. This resulted in CASA issuing a supplemental type certificate^[6] (STC SVA 528) on 10 August 2010, with the description:

A life extension program, requiring modification of the airframe and incorporation of a mandatory inspection program, which allows operations beyond Cessna’s current 22,500 hour limitation.

The latest STC was issued to West Star Aviation (STC holder)^[7] on 11 March 2020. The STC permitted the operation of the Cessna 441 until:

• 40,000 hours, or
• 40,000 flight cycles, or
• 25,000 flight cycles after incorporation of this STC, whichever occurs first.

According to STC SVA 528, to be eligible for the life extensions, aircraft incorporating the STC must be inspected in accordance with both the continuous inspection program and the SID, detailed in the maintenance manual supplement (MMS 13757.030-01).

Following the incident, CASA provided data that indicated there were 44 Cessna 441 aircraft in Australia, and that five had exceeded 22,500 hours, and therefore, required STC SVA 528 to continue operating. The incident aircraft was the highest hours Cessna 441 on the Australian register.

Emergency exit door structure

The operator’s contracted aeronautical engineer inspected the door post-incident and provided the following general description of its structure:

• The door skin structure was comprised of an inner layer with a channel around the edge that carried the door seal, and which also acted as a bonded waffle layer; and an outer full skin which was bonded to the inner layer channel at the edge.
• The two skin layers were not mechanically fastened together in a uniform manner. Rivets joined the layers in lateral and vertical channels and surrounded the window [upper half of door] but were not present in the failure location.
• The bond was produced using a film adhesive applied with an unwoven carrier cloth.
• The door skin stresses were almost entirely due to pressurisation forces alone. It did not carry any flight or ground loads.

Emergency exit door inspections

Textron reported that, for aircraft within their recommended life (less than 22,500 hours), there was an inspection for cracks, corrosion, and damage to the emergency exit door, detailed in supplemental inspection 52-20-01. According to the Cessna aircraft maintenance manual, inspection 52‑20-01: Emergency exit door, had an initial compliance of 4,000 hours or 8 years, with a repeat inspection at 2,000 hour or 4-year intervals. The inspection instructions required the emergency exit door to be removed from the airframe to conduct a visual inspection for ‘cracks, deformations, corrosion, and loose or failed fasteners’, with reference to an associated figure (Figure 4). The associated figure included a shaded area, referred to as the ‘critical area to be inspected’, which was located at the join of the lateral and vertical internal door beams.

The MMS made no changes to the Cessna maintenance manual requirements for 52-20-01, nor were there any additional requirements related to the ongoing airworthiness of the emergency exit door. Inspection 52-20-01 was last certified as completed for the incident aircraft on 1 March 2020, with nil defects found. At interview, the maintenance shift supervisor noted that a visual inspection alone might not be adequate to detect the pre-failure condition of the bondline. The shift supervisor stated the ‘current diagram might draw attention to a specific area [shaded area] …very easy to overlook…need a bond check with NDT [non-destructive testing] or a tap test’.

Figure 4: Maintenance manual figure for the inspection of the emergency exit door

Source: Cessna Aircraft Company, annotated by the ATSB

Emergency exit door structural failure investigation

The operator’s aeronautical engineer conducted a structural failure investigation (root cause analysis). A copy of the report was provided to the ATSB, which was shared with Textron. There were no technical objections to the report and the report findings and conclusions included the following:

• The emergency exit door appeared to be the original door fitted to the aircraft during manufacturing.
• The maintenance records did not indicate any previous bonded repairs on the door.
• The depressurisation was the result of a failure of the emergency exit door skin, which appeared to have been caused by propagation of a disbond between the inner and outer skin layers. The final position of the distorted skin corner was about 16 mm proud from the original bond surface.
• Normally, a thin skin disbonding in this manner would provide a warning prior to failing through a pressurisation leak, whistle or failure to maintain cabin altitude. However, in this case, it appeared that the skin had sufficient thickness to continue working until a ‘more serious rapid failure mode’ (‘pop’) occurred.
• A large disbond area resulted from moisture and corrosion, progressing from the inside edge of the door. There were no rivets in the bond in this area to interrupt a progressive disbond (peeling action).
• The basic design, with an overhanging edge and lack of any edge sealing, allowed for eventual bondline contamination, disbonding, and failure. This was exacerbated by corrosion and dents accumulated at the edge.
• While the starting point of the disbond was unknown, initiation (or likelihood) was probably caused by the calendar age of the aircraft. Once a disbond was present, repetitive cycles will tend to grow the disbond.
• Neither the Cessna aircraft maintenance manual nor life extension STC inspection schedules required specific inspection of the skin/bondline area that failed.
• Visual inspection of the affected area required removal of the door from the aircraft and close, detailed inspection of the door perimeter.

Figure 5 depicts the deteriorated bondline and pulled fibres visible under ultraviolet light, indicating final cohesive failure of the normal bond.

Figure 5: Deteriorated and failed bondline of the emergency exit door

Source: Eric Whitney, annotated by the ATSB

The report also highlighted that the door did not carry any flight or ground loads, so failure of the bondline would cause depressurisation, but not a catastrophic airframe loss. The corrosion was not visible on either the inner or outer surfaces of the door. Inspection of the remaining circumference of the door edge revealed the following:

• there were numerous other smaller starting points for bondline failures
• a smaller, similar disbond was found on the lower forward corner and failure at this location was probably also imminent
• lifting of the adhesive carrier cloth was noticed in many places
• a small smudge may have been an indicator of an early local pressurisation leak, however, this would not have been detectable unless the door was removed from the aircraft (Figure 6).

Figure 6: Indication of a local pressurisation leak

Source: Eric Whitney, annotated by the ATSB

Airworthiness bulletin 52-004

Following the incident, the operator’s contracted aeronautical engineer developed an interim inspection procedure that was shared with CASA. On 5 August 2020, CASA held an airworthiness concerns meeting with the information available and elected to publish an airworthiness bulletin. The intent was to have a reporting recommendation to gather more data for potential further fleetwide action, if deemed necessary (and pending completion of the operator’s root cause analysis). The interim inspection procedure required a torch to be used to assist the identification of any separated areas, with a focus on tell-tale pressurisation leaks and defects to the skin edge.

Airworthiness bulletin 52-004 issue 1: Cessna 441 in Flight Depressurisation due to Emergency Exit door bonded skin failure, was released on 6 August 2020. The bulletin’s interim inspection procedure was ‘strongly recommended’ for Cessna 441 aircraft incorporating STC SVA 528, and also ‘recommended’ for all other Cessna 441 aircraft ‘as the root cause is undetermined and failure may be calendar time related, not just hours/cycles’. It was requested that a defect report be submitted to CASA if any anomalies were detected.

A search of the CASA defect reporting system found two notifications for the Cessna 441 emergency exit door after the publication of the airworthiness bulletin. Both aircraft were operating under the STC life extension program. These were:

• On 10 September 2020, a daily visual inspection of a Cessna 441 resulted in concern as to whether the emergency exit door had started to disbond. As it could not be confirmed by visual inspection alone, an ultrasonic non-destructive test was conducted, which confirmed the bondline had started to separate. The aircraft had accumulated 26,628 hours and 21,841 cycles.
• On 11 September 2020, a Cessna 441 was inspected in accordance with the airworthiness bulletin procedure and an area of disbond was found around the lower edge of the door. The aircraft had accumulated 26,993 hours and 23,214 cycles.

Flight crew immediate actions

At interview, the ATSB discussed the pilots’ immediate actions following the depressurisation. Specifically, the request to air traffic control for a descent to FL 120 in lieu of 10,000 ft, the omission of an emergency declaration, and the decision to continue to Browns Range. The OP reported that FL 120 was the first number that came to mind, but in hindsight they should have requested 10,000 ft. The OP also recognised that they did not amend the initial request as there was a lot happening.

The OP could not provide a reason why the descent request was not prefixed with the declaration of an emergency but did recall reporting ‘pressurisation issues’ and that they ‘were ok’ when air traffic control asked them to confirm ‘ops normal’. The PIC was later advised by the operator’s chief pilot that an emergency should have been declared for a rapid depressurisation incident.

Both pilots reported their decision to continue to Browns Range was influenced by the advice provided by their senior base pilot (SBP). The PIC reported that, with the benefit of hindsight, the initial decision to return to Broome was the correct course of action but noted that they had inadvertently provided some misleading information to the SBP. The OP further reported that they should have returned to Broome as they did not know the exact nature of the fault.

The SBP believed the aircraft was much further along track than it was, and that the depressurisation was due to a pipe disconnection. Post-incident, after learning the proximity of the aircraft to Broome, both the SBP and maintenance shift supervisor concurred that a return to Broome would have been more appropriate.

Special flight permit process

At interview, the maintenance shift supervisor recalled being surprised to receive a phone call from the SBP when the aircraft was at Halls Creek, in lieu of Browns Range, to discuss the fault. However, it was considered safe to continue to Broome due to the location of the defect. This decision was reached in consultation with the SBP and continuing airworthiness manager. The shift supervisor asked the SBP if tape was available for the door, which it was not. The shift supervisor reported that if the forward corner of the door had disbonded then they would not have agreed to continued flight due to the potential adverse effect of the airflow on the door. The shift supervisor also reported that they thought about CASA and the special flight permit (SFP) process but believed the SFP process would have provided the same recommendation – to tape it up and return to Broome unpressurised. The shift supervisor reported that, with the benefit of hindsight, they should have followed the CASA SFP process.

In accordance with advisory circular 21-09 v4.0: Special flight permits, regulation 21.197 (Civil Aviation Safety Regulations 1998) allows CASA or an authorised person to issue an SFP for the purpose of flying an aircraft to a base where repairs can be carried out. An SFP provides a qualified exemption to normal airworthiness requirements in order that an unserviceable aircraft may still be operated in an acceptable and safe manner, but not for commercial operations. The risk to safe flight is managed by presenting all the facts, which may include inspection requirements, to an independent authorised person or CASA inspector, who will then decide on the conditions, limitations, and/or directions that must be applied for the proposed flight.

Passenger survey

The ATSB contacted the six passengers on board the aircraft for voluntary participation in a passenger survey. Three passengers returned the survey and provided consistent responses. A summary of the responses provided was as follows:

• A safety briefing for the use of emergency oxygen masks was provided before flight.
• There was no warning of the depressurisation prior to the incident, which was described by two of the passengers as a loud noise (‘bang’). The passenger seated next to the door thought that it was ‘going to get ripped off’.
• The passenger oxygen cup-style masks were a poor fit (‘inadequate seal’) and needed to be held in place for the duration of the descent. One passenger reported that they possibly experienced dizziness, but this could have also been due to the shock. There were no reports of loss of consciousness.
• There was confusion as to what had occurred and what the pilots’ intentions were during the emergency descent until the masks were removed at 10,000 ft and the OP was able to provide an explanation. One passenger thought they were going to conduct an emergency landing.

__________

4. The PIC’s Class 1 medical expired on 24 June 2020. However, Civil Aviation Safety Authority exemption instrument EX57/20 delayed the required renewal date until no later than 31 March 2021.
5. The current applicable CASA airworthiness directive is AD/CESSNA 400/119: Airframe Life Limitation 2/2013.
6. A supplemental type certificate (STC) is one form of approval of the design of a change to a type certificated aircraft, aircraft engine or propeller, when the change is not so extensive as to require a new type certificate (TC). An STC is supplementary to the original TC. It does not change the previously issued TC.
7. The STC holder must supply instructions for continuing airworthiness to registered operators of aircraft in which the STC modification has been incorporated. They remain responsible for the continued integrity of the change to the type design and must continue to be CASA’s contact point for resolving issues if corrective action is required.

Introduction

Shortly after reaching the planned cruising level of FL 270, the two pilots and six passengers on board the Cessna 441 aircraft experienced a rapid depressurisation. Oxygen masks were donned, and an emergency descent was conducted. The aircraft landed without further incident at the planned destination of Browns Range, Western Australia.

This analysis will discuss the reason for the emergency exit door failure, the adequacy of the maintenance manual inspection requirements, and the decision to depart from Browns Range for the return flight with the disbonded door skin using the minimum equipment list.

Disbonding of the emergency exit door

A structural failure investigation performed by an aeronautical engineer and reviewed by the ATSB and Textron Aviation, found that the outer emergency exit door skin had separated in-flight as a result of the propagation of a disbond between the inner and outer skin layers. The disbond likely enlarged via a progressive attack of moisture and corrosion progressing from the inside edge of the door to produce a large disbond area, resulting in a rapid depressurisation of the aircraft cabin at FL 270. The door was likely fitted since manufacture of the aircraft.

It was concluded that the initiation of the disbond was likely the result of the aircraft’s age, noting the aircraft was 42 years old and had exceeded the manufacturer’s recommended retirement life of 22,500 hours. The aircraft was operating under a supplementary type certificate for a life extension program and had accumulated 27,116 hours and 23,484 cycles.

Maintenance manual supplement

The structural failure investigation by the operator's contracted aeronautical engineer found that the corrosion was not visible on either the inner or outer surfaces of the door. The detailed visual inspection of the door edge found numerous other smaller starting points for bondline failure, some of which were difficult to see. Examination of the forward lower corner revealed failure at this location was likely imminent.

Although the engineer concluded that the initiation was likely caused by the calendar age of the aircraft, previous inspections of the incident door did not detect the presence of disbonding. The most recent was about 4 months prior to the incident.

The engineer also concluded that neither the Cessna aircraft maintenance manual nor the West Star Aviation maintenance manual supplement required specific inspection of the area that failed. Further, a detailed visual inspection of the affected area and door perimeter required removal of the door from the aircraft. In addition, the maintenance shift supervisor also reported that they did not believe a visual inspection would have necessarily detected the pre‑failure condition.

In response to the Civil Aviation Safety Authority airworthiness bulletin, two additional aircraft were found with disbonding of the emergency exit door. Both were operating under the life extension program. The first required an ultrasonic non‑destructive inspection procedure to confirm, while the second was revealed following the airworthiness bulletin visual inspection procedure.

Given VH-LBY, the two aircraft mentioned above, and the presence of a combination of excessive age, flying hours and cycles, the ATSB concluded that the Cessna 441 aircraft on the supplemental type certificate life extension program were those most susceptible to this failure. However, as none of these occurrences were found through the existing inspection procedures published in the West Star Aviation maintenance manual supplement, the ATSB concluded that the current procedures were inadequate to detect disbonding of the emergency exit door prior to failure. Although there were only a small number of aircraft currently on the life extension program, the remaining 39 Cessna 441 aircraft could potentially transition across in the future.

Decision to return using the minimum equipment list

After landing at Browns Range Airport, the pilots noted the lower aft section of the emergency exit door skin had separated and was the likely source of the depressurisation. As there was no phone coverage at the airport and the disbonded section of the door was not in the airflow, the PIC decided to depart. Although it was noted that there was an option for the pilots to contact their company from the mine site.

Both pilots reported that they expected to have mobile reception and meet their senior base pilot at Halls Creek. They also reported that the pressurisation system item in the minimum equipment list (MEL) was applied, which allowed them to continue flight below 10,000 ft with the system inoperative. The advice to the pilots that they could apply the MEL and return to Broome, was based on the reasoning that there was a fault with the pressurisation system. However, there was no fault with the pressurisation system. The aircraft had depressurised due to a structural failure that required repair.

As new information becomes available, the reasoning behind decisions may need to be re‑evaluated. In this case, the discovery of the disbonded door at Browns Range did not lead the pilots to conclude that the reasoning behind the advice to apply the MEL was no longer valid.  Similarly, when at Halls Creek, and after the operator’s maintenance personnel had been notified, there were no further discussions regarding the MEL.

The required course of action to recover the aircraft to a maintenance facility for repair was the special flight permit process. While this may not have altered the recovery actions, it would have provided an independent assurance that the return flight could be conducted in a safe manner.

From the evidence available, the following findings are made with respect to the depressurisation event involving a Cessna 441, VH-LBY, near Broome, Western Australia, on 22 July 2020.

Contributing factors

• The aircraft's emergency exit door progressively disbonded between the inner skin and outer skin, likely due to the age of the aircraft, facilitated by a combination of corrosion, moisture, and flight cycles. The weakened structure resulted in an accelerated failure of the bondline and rapid depressurisation of the cabin when the aircraft reached flight level 270.
• The inspection procedures in the West Star Aviation maintenance manual supplement for the Cessna 441 aircraft life extension program were inadequate for detecting the progressive disbonding of the emergency exit door skin. (Safety issue)

Other factor that increased risk

• The minimum equipment list item for the pressurisation system was applied for the return flight after discovery of the disbonded door skin. As a result, the special flight permit process to recover the aircraft for repair was not followed, which removed the opportunity for an independent assessment that the flight could be conducted in a safe manner.

Maintenance manual supplement 

Safety issue number: AO-2020-036-SI-01 

Safety issue description: The inspection procedures in the West Star Aviation maintenance manual supplement for extended life program Cessna 441 aircraft were inadequate to detect the progressive disbonding of the emergency exit door.

Safety action not associated with an identified safety issue

Additional safety action by Skippers Aviation

Skippers Aviation advised the ATSB they have/will be implementing the following safety actions:

• The importance of adhering to standard operating procedures have been discussed across the Flight Operations Department during their toolbox meetings.
• All Broome base pilots have been enrolled in additional human factors training for the elements of communication, decision-making, leadership, and threat and error management.
• A revision session on the understanding of the minimum equipment list and its application is planned for the pilots in Broome during the chief pilot’s next scheduled visit, at the end of June 2021.

Sources of information

The sources of information during the investigation included the:

• aeronautical engineer for Skippers Aviation
• Broome senior base pilot for Skippers Aviation
• Civil Aviation Safety Authority
• continuing airworthiness manager for Skippers Aviation
• Flight Aware
• maintenance shift supervisor for Skippers Aviation
• passengers
• pilots of the incident flight
• quality and safety manager for Skippers Aviation
• Textron Aviation Inc.

References

Australian Transport Safety Bureau (2007), Aviation Research and Analysis Report: How old is too old? The impact of ageing aircraft on aviation safety, February 2007.

Civil Aviation Safety Authority (2020), Advisory Circular 21-09 v4.0: Special flight permits, November 2020.

Civil Aviation Safety Authority (2016), Civil Aviation Advisory Publication 37-1(5): Minimum equipment lists (MEL), March 2016.

Civil Aviation Safety Authority (2015), Advisory Circular 21-15: Supplemental type certificates, March 2015.

Whitney, EJ (2020), Emergency exit door structural failure investigation – Cabin depressurisation of VH-LBY on 22 July 2020, Report MTR-0400-001 Rev 0.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.

A draft of this report was provided to the following directly involved parties:

• aeronautical engineer for Skippers Aviation
• Broome senior base pilot for Skippers Aviation
• chief pilot for Skippers Aviation
• Civil Aviation Safety Authority
• continuing airworthiness manager for Skippers Aviation
• maintenance shift supervisor for Skippers Aviation
• pilots of the incident flight
• quality and safety manager for Skippers Aviation
• Textron Aviation Inc.
• United States National Transportation Safety Board
• West Star Aviation.

Any submissions from those parties will be reviewed and, where considered appropriate, the text of the draft report will be amended accordingly.

Submissions were received from:

• Civil Aviation Safety Authority
• Skippers Aviation
• West Star Aviation.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.