XL Airways Germany Flight 888T was an acceptance flight for an Airbus A320 on 27 November 2008. The aircraft crashed into the Mediterranean Sea, 7 km (4.3 mi; 3.8 nmi) off Canet-en-Roussillon on the French coast, close to the Spanish border, killing all seven people on board. The subsequent investigation attributed the accident to incorrect maintenance procedures that allowed water to enter and freeze in the angle-of-attack sensors during flight, rendering them inoperative, combined with the crew's attempt to perform a test at a dangerously low altitude.
Background
Flight test purpose
The aircraft was on a flight test (or "acceptance flight") that had taken off from Perpignan–Rivesaltes Airport, made an overflight of Bay of Biscay, before flying back to Perpignan Airport. At the time of the crash, it was due to commence a touch-and-go landing at Perpignan Airport before flying to and landing in Frankfurt Airport, from where it would have taken a ferry flight to Auckland, New Zealand. The flight took place following light maintenance and repainting to Air New Zealand livery in preparation for its transfer from XL Airways Germany, which had been leasing the aircraft from Air New Zealand, the owner.
Aircraft
The aircraft involved was an Airbus A320-232, registered as D-AXLA, manufactured in 2005, and assigned a manufacturer's serial number of 2500. It first flew on 30 June 2005, and was delivered to Air New Zealand's low-cost subsidiary Freedom Air with the registration ZK-OJL. Star XL German Airlines (as XL Airways Germany was named at the time) took delivery of the aircraft on 25 May 2006. The aircraft had been overhauled by a local French company located at the Perpignan–Rivesaltes Airport prior to its return off lease. At the time of the accident, it was due to be delivered back to Air New Zealand and re-registered as ZK-OJL.
Passengers and crew
Seven people were on board, two French-German dual nationals (the captain and first officer, from XL Airways) and five New Zealanders (one pilot, three aircraft engineers, and one member of the Civil Aviation Authority of New Zealand (CAA).
In command was 51-year-old Captain Norbert Käppel, who had been with the airline since February 2006. He was the airline's air and ground operations manager, having previously held this position at Aero Lloyd. Käppel had logged a total of 12,709 flight hours, including 7,038 hours on the Airbus A320.
The first officer was 58-year-old Theodor Ketzer, who had been with the airline since April 2006 as an A320 first officer. He attempted to upgrade to an A320 captain in 2007, but dropped out of the programme for "personal reasons". Ketzer had 11,660 flight hours, with 5,529 of them on the Airbus A320.
Sitting in the jump seat was 52-year-old Air New Zealand senior captain Brian Horrell, who had been with the airline since September 1986. He had been an Airbus A320 captain since 27 September 2004, and had 15,211 flight hours, including 2,078 hours on the Airbus A320. He did not speak nor understand German.
The three aircraft engineers were 37-year-old Murray White, 49-year-old Michael Gyles, and 35-year-old Noel Marsh. The member of the CAA was 58-year-old Jeremy Cook.
Accident
Shortly after take-off from Perpignan–Rivesaltes Airport at 14:44 UTC, the crew flight requested the airspace and headed to begin their test manoeuvres. However, their request was firmly denied by air traffic control, telling the flight "I'm afraid we cannot do test flights in general air traffic, you have to be operational air traffic sir for that". Flight 888T, instead of completing an operational air traffic flight plan (which would have allowed their tests with the assistance of a dedicated controller), had filed a general aviation flight plan, which didn't accommodate test flights. After further pleas to the controller were rejected, the crew decided to turn around and head back to Perpignan. Regardless, they would improvise on the way and do as many of the tests as they could.
At 15:33 UTC on the flight back to Perpignan, the crew requested clearance to 39,000 feet to test the auxiliary power unit (APU). The controller replied, "I understand sir but you know you are on general aviation and many sectors above so it's a bit more difficult for us than different controllers". However, despite the controller's reluctance to approve it, the request was granted. The crew of Flight 888T proceeded to test the auxiliary power unit, bank angle protections and the overspeed warning among other things at 39,000 feet. Continuing their descent to Perpignan, the crew of Flight 888 signed off with the Bordeaux air traffic controller who gave them a sharp send-off "Yes for the next time sir it'll be better not to do your… your flight in general aviation".
From there, they continued with the remaining checks. Captain Horrell raised the question of the low-speed check. The procedure was supposed to be performed at approximately 14,000 feet, but Flight 888T was already descending toward Perpignan. Horrell described the actions required as the aircraft descended through approximately 8,000 to 6,000 feet.
The crew was then cleared for the ILS approach to runway 33 and instructed to descend toward 5,000 feet. While the aircraft was passing through cloud, Captain Käppel said, "I think we will have to do the slow flight probably later." Horrell replied, "Okay, yeah." Käppel continued, "Or we do it on the way to Frankfurt or I even skip it." This suggestion went unanswered. However, after descending below the clouds at a little over 4,000 feet, Captain Käppel asked Horrell what he wanted him to do. Horrell then described the actions required for the low-speed test. With barely 3,000 feet between them and the ocean, following instructions of the New Zealand pilot sitting in the jump seat, Captain Norbert Käppel moved the throttles to idle and raised the nose of the aircraft by pulling back on his side-stick, dramatically slowing the speed of the aircraft. The pilots were fully expecting the A320's alpha floor (α-Floor) protections to come into effect (which pushes the engines to full power during a stall).
As the speed of the aircraft dropped to a critical point in which it could no longer maintain flight, the angle of attack increased, and a stall alarm sounded in the cockpit. The plane shook and made a hard bank to the left. After manually applying full power, initially, the crew were able to regain control again and come out of the stall. However, the aircraft began a rapid and uncontrolled climb. What the pilots hadn't noticed, in the chaos, the aircraft had switched from the A320's normal law (with automations and protections) to direct law, meaning, normally automated controls were now left to the pilots. Although the captain was pushing forward on his side-stick in an attempt to lower the nose again, the plane kept climbing. In normal law, moving the side-stick prompts the computer to adjust the horizontal stabiliser to control the pitch. Now, in direct law, with no such assistance from the computer, the pilots needed to use both the side-stick and the manual trim wheel to lower the nose of the aircraft. A warning on their display advised them of this, but they likely didn't notice, potentially in part because the aural stall warning covered the warning indicating a change of flight control laws. Reaching 57 degrees nose up, while in a hard bank to the left, their altitude peaked at just below 4,000 feet and the airspeed dropped to just 40 knots, far too slow to fly. Shuddering violently, the aircraft crashed into the Mediterranean Sea, 7 km (4.3 mi; 3.8 nmi) off the coast of Étang de Canet-Saint-Nazaire near Canet-en-Roussillon. All seven people on board were killed.
Recovery
Two bodies were recovered within hours of the crash; the others were found during later weeks. The extent of shattering of the wreckage indicated that the crash occurred at high speed. The crash area was declared a crime scene and the French justice system opened a manslaughter investigation.
Investigation
The cockpit voice recorder (CVR) was quickly found and recovered, and on 30 November, divers recovered the second flight recorder–the flight data recorder (FDR)–and a third body, unidentified at the time. Although the CVR was damaged, experts said a good probability existed of recovering data from it.
In late December, French investigators attempted to retrieve data from the CVR and FDR, but they could not be read. Usable data from the recorders was later recovered by Honeywell Aerospace in the United States.
The investigators' interest focused on the air data inertial reference unit (ADIRU) following recent similar incidents involving Airbus A330s operated by Qantas, exhibiting sudden uncommanded manoeuvring (including Qantas Flight 72). The investigation was led by the Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA), with the participation of its counterparts from the German Federal Bureau of Aircraft Accident Investigation (BFU), the New Zealand Transport Accident Investigation Commission (TAIC), and the United States National Transportation Safety Board (NTSB). Specialists from Airbus and from International Aero Engines (IAE, the manufacturer of the aircraft's engines), from XL Airways Germany (operator of the aircraft), and from Air New Zealand (the owner of the aircraft), were associated with the work of the technical investigation.
Analysis of the data led to an interim finding that the crew lost control of the aircraft. The crew was not granted needed airspace to do their acceptance checklist of various test procedures, but they chose to conduct a number of the tests as they flew back to base. One of the tests that the crew unofficially fit into their flight was a test of low-speed flight, which they attempted after already dropping to a low altitude (rather than the normal 10,000 feet (3,000 m)), while descending through 3,000 feet (910 m) on full autopilot for a go-around. Landing gear was just extended when at 15:44:30 UTC the speed dropped from 136 to 99 knots (252 to 183 km/h; 157 to 114 mph) in 35 seconds. The stall warning sounded four times during violent manoeuvring to regain control. By 15:46:00, the warning had silenced as the aircraft regained speed in a rapid descent, but 6 seconds later, at 263 knots (487 km/h; 303 mph), the aircraft had only 340 feet (100 m) elevation and was 14° nose down. A second later, the aircraft crashed into the water.
In September 2010, the BEA published its final report into the accident. One of the contributing causes was incorrect maintenance procedures, which allowed water to enter the angle-of-attack (AOA) sensors. During fuselage rinsing with water before painting, three days before the flight, the AOA sensors were unprotected. As specified in the Structure Repair Manual by Airbus, fitting a protection device on AOA sensors before these tasks is mandatory. The water was able to penetrate inside the sensor bodies, then froze in flight, rendering two of three of the sensors inoperative, thus removing the protection they normally provided in the aircraft's flight management system.
The primary cause of the accident was that the crew attempted an improvised test of the AOA warning system, not knowing that it was not functioning properly due to the inoperative sensors. They also disregarded the proper speed limits for the tests they were performing, resulting in a stall.
The aircraft's computers received conflicting information from the three AOA sensors. The aircraft computer system's programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative AOA sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative sensors. This resulted in the system's stall-protection functions responding incorrectly to the stall, making the situation worse, instead of better. In addition, the pilots also failed to recover from an aerodynamic stall in a manual mode in which the stabiliser had to be set to an up position to trim the aircraft. Since the stick was applied only forward, the aircraft did not trim itself because it was switched to full manual mode. Seconds later, the plane crashed into the sea.