XL Airways Germany Flight 888T

The aircraft was on a flight test (or "acceptance flight") that had taken off from Perpignan–Rivesaltes Airport, made an overflight of Bay of Biscay, before flying back to Perpignan Airport. At the time of the crash, it was due to commence a touch-and-go landing at Perpignan Airport before flying to and landing in Frankfurt Airport, from where it would have taken a ferry flight to Auckland, New Zealand.^[2] The flight took place following light maintenance and repainting to Air New Zealand livery in preparation for its transfer from XL Airways Germany, which had been leasing the aircraft from Air New Zealand, the owner.

 

The aircraft involved was an Airbus A320-232, registered as D-AXLA, manufactured in 2005, and assigned a manufacturer's serial number of 2500. It first flew on 30 June 2005, and was delivered to Air New Zealand's low-cost subsidiary Freedom Air with the registration ZK-OJL. Star XL German Airlines (as XL Airways Germany was named at the time) took delivery of the aircraft on 25 May 2006. The aircraft had been overhauled by a local French company located at the Perpignan–Rivesaltes Airport prior to its return off lease.^[3] At the time of the accident, it was due to be delivered back to Air New Zealand and re-registered as ZK-OJL.^[4]

Seven people were on board, two Germans (the captain and first officer, from XL Airways) and five New Zealanders (one pilot, three aircraft engineers, and one member of the Civil Aviation Authority of New Zealand (CAA).^[5][6]

In command was 51-year-old Captain Norbert Käppel,^[7] who had been with the airline since February 2006. He was the airline's air and ground operations manager, having previously held this position at Aero Lloyd. Käppel had logged a total of 12,709 flight hours, including 7,038 hours on the Airbus A320.^{[8]: 21–22}

The first officer was 58-year-old Theodor Ketzer,^[7] who had been with the airline since April 2006 as an A320 first officer. He attempted to upgrade to an A320 captain in 2007, but dropped out of the programme for "personal reasons".^[8] Ketzer had 11,660 flight hours, with 5,529 of them on the Airbus A320.^{[8]: 22–23}

The pilot from New Zealand was 52-year-old Brian Horrell, who had been with Air New Zealand since September 1986. He had been an Airbus A320 captain since 27 September 2004, and had 15,211 flight hours, including 2,078 hours on the Airbus A320. Horrell was seated in the cockpit jumpseat at the time of the accident. He did not speak nor understand German.^{[8]: 23–24}

The three aircraft engineers were 37-year-old Murray White, 49-year-old Michael Gyles,^[9] and 35-year-old Noel Marsh.^{[8]: 24 [7]} The member of the CAA was 58-year-old Jeremy Cook.^{[8]: 24 [7]}

Shortly after take-off from Perpignan–Rivesaltes Airport 14:44 UTC, the crew flight requested the airspace and headed to begin their test manoeuvres, however, they were firmly told no by air traffic control telling the flight "I'm afraid we cannot do test flights in general air traffic, you have to be operational air traffic sir for that". Flight 888T instead of completing an operational air traffic flight plan, which would have allowed their tests with the assistance of a dedicated controller, had filed a general aviation flight plan, which didn't accommodate test flights. After further pleas to the controller were rejected, the crew decided to turn around and head back to Perpignan. Regardless, they would improvise on the way and do as many of the tests as they could.

At 15:33 UTC on the flight back to Perpignan, the crew requested clearance to 39,000 feet to test the auxiliary power unit (APU). The controller replied, "I understand sir but you know you are on general aviation and many sectors above so it's a bit more difficult for us than different controllers". However, despite the controller's reluctance to approve it, the request was granted. The crew of Flight 888 proceeded to test the auxiliary power unit, bank angle protections and the overspeed warning among other things at 39,000 feet. Continuing their descent to Perpignan, the crew of flight 888 signed off with the Bordeaux air traffic controller who gave them a sharp send-off "Yes for the next time sir it'll be better not to do your… your flight in general aviation".

From there, continuing with their checks, it was now running out of time that Senior Air New Zealand Captain Brian Horrell, seated in the jump seat, raised the question of the low-speed test. A low-speed stall test should have been performed at 14,000 feet but Flight 888 was now at 12,000 feet and descending. As flight 888 descended through 6,000 feet, it was cleared to land in Perpignan. Not eager to test the stall protection while passing through a layer of cloud, the German captain said, "I think we will have to do the slow flight probably later", to which his New Zealand counterpart replied, "okay yeah". The German pilot added "or we do it on the way to Frankfurt... or we even skip it". This suggestion went unanswered. However, at a little over 3,000 feet, now clear of the clouds, it was the German who brought it up again, asking his New Zealand counterpart for instructions to perform the test. With barely 3,000 feet between them and the ocean, following instructions of the New Zealand pilot sitting in the jump seat, Captain Norbert Käppel moved the throttles to idle and raised the nose of the aircraft by pulling back on his side-stick, dramatically slowing the speed of the aircraft. As the speed of the aircraft dropped to a critical point in which it could no longer maintain flight, a stall alarm sounded in the cockpit. The plane shook and made a hard bank to the left. After applying full power, initially, the crew were able to regain control again and come out of the stall. However, the aircraft began a rapid and uncontrolled climb. What the pilots hadn't noticed, in the chaos, the aircraft had switched to alternate law, meaning, normally automated controls were now left to the pilots. Although the captain was pushing forward on his side-stick in an attempt to lower the nose again, the plane kept climbing. In normal law, moving the side-stick prompts the computer to adjust the horizontal stabilizer to control the pitch. Now, in alternate law, with no assistance from the computer, the pilots needed to use both the side-stick and the manual trim wheel to lower the nose of the aircraft. A warning on their display advised them of this, but they likely didn't notice. Reaching 57 degrees nose up, while in a hard bank to the left, their altitude peaked at just below 4,000 feet and the airspeed dropped to just 40 knots, far too low to fly. Shuddering violently, the aircraft crashed into the Mediterranean Sea, 7 km (4.3 mi; 3.8 nmi) off the coast of Étang de Canet-Saint-Nazaire near Canet-en-Roussillon.^[8] All seven people on board were killed.^{[8]: 15–20}

Two bodies were recovered within hours of the crash; the others were found during later weeks. The extent of shattering of the wreckage indicated that the crash occurred at high speed.^[10] The crash area was declared a crime scene and the French justice system opened a manslaughter investigation.^[10]

The cockpit voice recorder (CVR) was quickly found and recovered, and on 30 November, divers recovered the second flight recorder–the flight data recorder (FDR)–and a third body, unidentified at the time. Although the CVR was damaged, experts said a good probability existed of recovering data from it.^[11]

In late December, French investigators attempted to retrieve data from the CVR and FDR, but they could not be read. Usable data from the recorders was later recovered by Honeywell Aerospace in the United States.^[12]

The investigators' interest focused on the air data inertial reference unit (ADIRU) following recent similar incidents involving Airbus A330s operated by Qantas, exhibiting sudden uncommanded manoeuvring (including Qantas Flight 72).^[13] The investigation was led by the Bureau of Enquiry and Analysis for Civil Aviation Safety (BEA), with the participation of its counterparts from the German Federal Bureau of Aircraft Accident Investigation (BFU), the New Zealand Transport Accident Investigation Commission (TAIC),^[14] and the United States National Transportation Safety Board (NTSB). Specialists from Airbus and from International Aero Engines (IAE, the manufacturer of the aircraft's engines), from XL Airways Germany (operator of the aircraft), and from Air New Zealand (the owner of the aircraft), were associated with the work of the technical investigation.^[15]

Analysis of the data led to an interim finding that the crew lost control of the aircraft. The crew was not granted needed airspace to do their acceptance checklist of various test procedures, but they chose to conduct a number of the tests as they flew back to base. One of the tests that the crew unofficially fit into their flight was a test of low-speed flight, which they attempted after already dropping to a low altitude (rather than the normal 10,000 feet (3,000 m)), while descending through 3,000 feet (910 m) on full autopilot for a go-around. Landing gear was just extended when at 15:44:30 UTC the speed dropped from 136 to 99 knots (252 to 183 km/h; 157 to 114 mph) in 35 seconds. The stall warning sounded four times during violent manoeuvring to regain control. By 15:46:00, the warning had silenced as the aircraft regained speed in a rapid descent, but 6 seconds later, at 263 knots (487 km/h; 303 mph), the aircraft had only 340 feet (100 m) elevation and was 14° nose down. A second later, the aircraft crashed into the water.^[16]

In September 2010, the BEA published its final report into the accident. One of the contributing causes was incorrect maintenance procedures, which allowed water to enter the angle-of-attack (AOA) sensors. During fuselage rinsing with water before painting, three days before the flight, the AOA sensors were unprotected. As specified in the Structure Repair Manual by Airbus, fitting a protection device on AOA sensors before these tasks is mandatory.^{[8]: 56, 95} The water was able to penetrate inside the sensor bodies, then froze in flight, rendering two of three of the sensors inoperative, thus removing the protection they normally provided in the aircraft's flight management system.

The primary cause of the accident was that the crew attempted an improvised test of the AOA warning system, not knowing that it was not functioning properly due to the inoperative sensors. They also disregarded the proper speed limits for the tests they were performing, resulting in a stall.

The aircraft's computers received conflicting information from the three AOA sensors. The aircraft computer system's programming logic had been designed to reject one sensor value if it deviated significantly from the other two sensor values. In this specific case, this programming logic led to the rejection of the correct value from the one operative AOA sensor, and to the acceptance of the two consistent, but wrong, values from the two inoperative sensors. This resulted in the system's stall-protection functions responding incorrectly to the stall, making the situation worse, instead of better. In addition, the pilots also failed to recover from an aerodynamic stall in a manual mode in which the stabilizer had to be set to an up position to trim the aircraft. Since the stick was applied only forward, the aircraft did not trim itself because it was switched to full manual mode. Seconds later, the plane crashed into the sea.

Moreover, the stall warning in normal law was not possible. The stall warning function, though, was still available, and was triggered during the last phase of the flight.^[17]

Five safety recommendations were made following examination of the particulars of the crash. To improve requirements for planning and procedures of non-revenue flights, to close a loophole pertaining to equipment qualification discovered during the investigation (but which did not impact the events as transpired), to undertake a safety study of certification standards for flight control reconfiguration warning systems, and to re-evaluate recommended approach-to-stall techniques and training for all types of modern airplanes.^[8]

The story of the accident was featured on the 13th season of Canadian television show Mayday, an episode entitled "Imperfect Pitch".^[17]

• List of accidents and incidents involving the Airbus A320 family

Bureau of Enquiry and Analysis for Civil Aviation Safety

• "Accident to an Airbus A320-232 registered D-AXLA operated by XL Airways Germany on November 27, 2008 near Canet-Plage." (Archive)
  • Interim report (Archive)
  • Final report (Archive)
• Accident d'un Airbus A320-232 immatriculé D-AXLA exploité par XL Airways Germany survenu survenu le 27 novembre 2008 au large de Canet-Plage (Archive) (in French) – the French version is the report of record.
  • Interim Report (in French) (Archive)
  • Final Report (in French) (Archive)
• Accidents and Incidents during Non-Revenue Flights — SKYbrary
• "When a Flight Crew Trusts a Plane Too Much". Smithsonian Channel. 12 March 2015.