Pilots of an Airbus A320 which crashed into the Mediterranean Sea were caught out by unexpected angle-of-attack sensor icing while conducting a poorly-organised low-speed flight test under pressure at low altitude.
French investigators have determined that the aircraft's angle-of-attack sensors were not protected during a water-rinsing carried out at maintenance company EAS Industries three days before the accident.
At least two of the three sensors ingested water which subsequently froze while the aircraft was at cruise altitude during a pre-handover flight on 27 November 2008, as the A320 came off lease from XL Airways to Air New Zealand.
The failure by the crew to realise that the sensors were not functioning correctly resulted in the pilots' inadvertently allowing the aircraft to stall while attempting a low-speed flight test.
France's Bureau d'Enquetes et d'Analyses, in its final inquiry report into the crash near Perpignan, suggests that the flight had been ill-conceived from the outset.
Air New Zealand had devised a handover check programme to be carried out on the aircraft but had based this on Airbus customer-acceptance flights conducted by test pilots. The XL pilots flying the jet did not have the technical skills or experience to follow this programme.
The BEA adds that the nature of the flight did not fit the criteria of other non-revenue or post-maintenance check flights. "As early as the preparation phase, the performance of this flight did not thus come within a well-defined framework," it says. "This meant that those undertaking the flight had to adapt and improvise in order to be able to complete their task."
After the aircraft departed Perpignan, with the two XL pilots flying and an Air New Zealand pilot riding in the cockpit, it climbed to cruising altitude at which point the water trapped in the angle-of-attack sensors froze.
While the crew had intended to conduct a two-and-a-half hour flight, air traffic control constraints prevented them from carrying out intended manoeuvres. The BEA says this made the planned test programme "impossible", and the crew opted to turn back after just 24min. But it also led the XL captain and the ANZ pilot to agree to take a less-strict approach to the flight programme.
Some checks were carried out as the aircraft descended towards Perpignan, and the ANZ pilot mentioned a low-speed check in landing configuration. Airbus' customer-acceptance manual dictates that this check should be carried out at flight level 140, but the A320 had descended to below 4,100ft by the time the crew started to run through it. The captain "did not take into account" the aircraft's altitude, says the BEA.
With the workload mounting in the cockpit, because the aircraft was on approach to Perpignan, the low-speed test commenced. But the blockage of the angle-of-attack sensors resulted in an underestimation of the limit speeds for the A320's angle-of-attack protection.
"The crew waited for the triggering of these protections while allowing the speed to fall to that of a stall," says the BEA. It says this "passive" wait for the protective systems, a lack of awareness of the risks, and confidence in the operation of the aircraft's systems "tend to show" that the captain and the ANZ pilot started the manoeuvre as a "demonstration of the functioning" of the angle-of-attack protection "rather than as a check".
Although the stall warning sounded, and the captain increased thrust and pitched the aircraft nose-down, the configuration of the aircraft - notably a progressive pitch-up deflection of the horizontal stabiliser as the A320 decelerated - and the failure to understand the jet's behaviour, resulted in the situation deteriorating and the crew's losing control of the stall recovery. All seven occupants were killed when the A320 struck the water, just 62s after the stall alarm.