ERA23LA376

The control laws of the angle of attack limiter protection system, which precluded the system from disengaging during an approach in gusting wind conditions, limiting the flight crew’s ability to control the airplane’s pitch and resulting in a hard landing.

According to the flight crew, the departure and en route phases of the flight in the airplane were uneventful. Gusting wind and visual conditions existed at the destination airport, and the pilot chose to fly a GPS approach (versus a visual pattern) to allow more time for alignment and set-up for landing. The flight crew reported that all checklists and callouts were conducted. During the approach with the autothrottles engaged, the approach was stable as the airplane descended through 500 ft above ground level (agl). After the copilot made the “500 ft stable” callout, the airplane continued its descent, then crossed over a small section of trees. The pilot reported that he felt an “uplift,” then the airplane began to porpoise when it was about 100 to 150 ft agl. The pilot tried to make pitch corrections, but the airplane’s attitude did not change as commanded. The copilot tried to assist but observed the same airplane response. The airplane landed hard and slid along the runway, coming to rest in the grass off the right side of the runway. Although the flight crew at times engaged in nonessential conversation while approaching the airport, there is no indication that this contributed to the accident. Further, review of data from the engines’ full authority digital engine controls did not reveal any anomaly that would have contributed to the accident. The airplane was equipped with a fly-by-wire flight control system that featured an angle of attack (AOA) limiter protection system (instead of a traditional stall warning system) designed to prevent the airplane from stalling by limiting its AOA. Review of flight data recorder (FDR) data indicated that the AOA limiter protection engaged during the approach due to a sudden increase in AOA when the airplane was at a radio altitude of 162 ft. The sudden AOA increase was likely due to a wind gust. The airplane’s AOA then quickly reduced from 12.8° to less than 5° and remained below the engagement threshold for the remainder of the flight, but the AOA limiter protection remained engaged. Although the AOA limiter protection performed as designed, it reduced the flight crew’s ability to pitch up the airplane during the flare. For example, the pilot used the sidestick to command full airplane-nose-up pitch for about 3 seconds before touchdown, but the fly-by-wire system provided less than 3°of airplane-nose-up elevator. About 1.5 seconds before touchdown, the copilot also used the sidestick to command full airplane-nose-up pitch, but the fly-by-wire system responded with 5.5° of airplane-nose-down elevator. Neither flight crewmember indicated any awareness that the AOA limiter protection had engaged. During the flare, the airplane was subjected to a horizontal gust which resulted in a reduction of about 8 kts of indicated airspeed and the airplane touched down hard. An NTSB performance study determined that, at the time the airplane touched down hard, about 10° of AOA or stall margin remained that the flight crew was unable to use during the landing because the AOA limiter protection was engaged. The flight control computer software version current at the time of the accident would allow AOA limiter protection disengagement only on having three conditions met: 1) AOA reduced to values below the engagement threshold, 2) airspeed above a factor of stall speed threshold, and 3) difference between the normal load factor demand determined by the sidestick pitch command and the airplane’s actual load factor being below a specified threshold. Review of FDR data revealed that the frequency and amplitude of the pilot’s oscillating sidestick pitch commands prevented AOA limiter protection disengagement due to condition 3. About 7 months after the accident, the FAA issued airworthiness directive (AD) 2024-05-13, which required revisions to the airplane flight manual (AFM) to incorporate new operational airspeed limitations, flight control limitations, and approach procedures when the AOA limiter protection is engaged. This interim safety measure mandated the actions specified in the National Civil Aviation Agency of Brazil (ANAC) AD 2024-02-02, which was issued about 2 months earlier. Subsequently, about 22 months after the accident, ANAC issued AD 2024-02-02R1, which superseded ANAC AD 2020-02-02 and required a software update to the flight control computers to revise the AOA limiter protection criteria, which included allowing for a higher pitch response to sidestick movement while the AOA limiter protection is engaged and allowing for it to disengage any time there is a sidestick pitch-down command and conditions 1 and 2 are satisfied. The FAA indicated that it planned to release its final rule regarding the Embraer EMB-545 and EMB-550 AOA limiter about September 2026.

The pilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land and sea. He also held type ratings on the BE-300, BE-400, CE-560XL, CE-650, CL-600, EMB-550, HS-125, and MU-300. He possessed a flight instructor certificate with ratings for single-engine and instrument airplanes, a ground instructor certificate with ratings for advanced and instrument, and a remote pilot certificate for small unmanned aircraft systems. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 10,900 total flight hours, with 1,872 hours in the accident airplane make and model. The copilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land. He also held type ratings on the A-310, A-320, B-757, B-767, DC-9, DC-10, EMB-550, and LR-JET. Additionally, he also held a flight engineer certificate with a rating for turbojet-powered. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 16,686 total flight hours, with 306 hours in the accident airplane make and model. The accident airplane was manufactured in 2020. Its most recent continuous airworthiness inspection was completed on April 11, 2023, at 2,863 total hours of operation. At the time of the accident, the airplane had accrued about 3,424 hours of operation. Flexjet reported no deferrals per the airplane’s minimum equipment list, and a review of the discrepancy history for the airplane for the preceding year revealed no discrepancies related to the accident. The Embraer EMB-545 MOD airplane, which requires a minimum two-pilot crew, is a low-wing, T-tail, pressurized airplane powered by two high bypass-ratio Honeywell International rear-mounted turbofan engines. The fully retractable tricycle landing gear is designed to be operated on paved runways only. The instrument panel uses a glass cockpit concept with the Collins Pro Line Fusion avionics system consisting of four display units (left, center, right, and lower). The operation is based on the use of the flight management system and is equipped with an autopilot, flight director, and autothrottle. The accident airplane’s avionics included a Honeywell TPM-6000 TAWS module configured with the reactive windshear feature disabled. By design, the fly-by-wire flight control system provides closed-loop control and monitoring of all primary and secondary flight control surfaces within the system. The normal mode is designed to provide improved flying handling qualities and reduce flight crew workload. In direct mode, the airplane behaves like a conventional airplane, such that the sidestick and pedal deflections are directly related to the control surface position. AOA Limiter Protection System As outlined in detail in the NTSB Systems Group Chair’s Factual Report, available in the public docket for this accident, the airplane’s AOA limiter protection system is designed to prevent the airplane from entering an aerodynamic stall condition. To accomplish this, the fly-by-wire flight control computers apply control laws to the pilot’s pitch commands on the sidestick to position the elevators as required to prevent the airplane from exceeding the maximum AOA limit. The maximum AOA limit is designed to provide adequate airplane roll maneuverability, good flight characteristics, and sufficiently safe margin to the aerodynamic stall AOA. The AOA limiter protection engagement, which depends solely on AOA, engages when the AOA becomes greater than a given value, which is predetermined for each airplane configuration (for example, gear position, flap setting, or icing conditions) and may be reduced in case of significant AOA rate of change. Normally, the airplane’s maximum AOA limit is reached at lower speeds, but the AOA limiter protection may engage due to maneuvers that increase the load factor or a sudden AOA increase due to wind gusts. The fly-by-wire control laws are designed so that when the airplane flies in normal mode (such as during the accident approach), its AOA will not exceed the maximum AOA limit, even if the pilot holds the sidestick control fully aft. Based on the flight control computer software version that was current at the time of the accident and installed on the accident airplane (FCC software load Build 3), once the AOA limiter protection is engaged, it will automatically disengage only when the following conditions are met: 1. The AOA must be reduced to a value about 2° below the engagement threshold. 2. The airspeed must be increased to more than 1.1 times the reference stall speed. 3. The difference between the normal load factor demand determined by the sidestick pitch command and the actual load factor experienced by the airplane must be equal to or lower than 0.3 g for 1 second. The purpose of condition 3 is to prevent high AOA excursions during the disengagement transition. This condition may not be met if a pilot inputs rapid and large oscillating pitch inputs to the sidestick, which will delay the AOA limiter protection disengagement even when the other criteria are met. Low-Speed Awareness The low-speed awareness indication displays over the speed tape on the primary flight display to alert the flight crew of a low-speed condition. In normal mode, the AOA limiter protection function is available, and the low-speed awareness is displayed. The three low-speed awareness color bands on the speed tape are defined as follows: •VSS: This speed, defined as the stable velocity speed, is represented by the top of the white band. It indicates a low energy state and is not a function of the AOA or load factor. For a 1g flight, it is equivalent to about 1.13 times the stall speed. In normal conditions, if airspeed goes below VSS, an audible “low speed” alert will sound. •VAOA: This speed, defined based on the AOA that engages the AOA limiter protection, is represented by the top of the yellow band. For a 1g flight, it corresponds to about 1.08 times the stall speed. •VLIM: This speed, defined based on association with the maximum allowable AOA limit, is represented by the top of the red band. For a 1g flight, it corresponds to about 1.03 times the stall speed. Figure 1. Exemplar low-speed awareness indication color bands. In addition, when the AOA limiter protection is engaged, the airspeed readout background becomes yellow at or below VAOA, turning red at VLIM. Since VAOA and VLIM are based on the AOA, they may vary according to flight conditions. Pilots may observe the yellow and red bands moving up or down as the airplane encounters sudden AOA or load factor changes. In the case of a rapid increase in AOA, the AOA limiter protection may be activated sooner, at a lower AOA. Even if the airplane is configured for landing and at the appropriate approach speed, the AOA limiter protection may engage due to a sudden AOA increase caused by wind gusts. In this case, the low-speed awareness white band will not be seen, as it will be overlapped by the yellow and red bands, and the “low speed” aural alert will not sound. Pitch Limit Indicator The Pitch Limit Indicator is displayed on the pitch angle scale on the primary flight display when the AOA increases above the AOA limiter protection engagement value and the AOA limiter protection is engaged. (The Pitch Limit Indicator is not displayed unless the AOA limiter protection is engaged.) The Pitch Limit Indicator shows the difference between the AOA and the maximum AOA limit when the fly-by-wire system is in normal mode. The Pitch Limit Indicator is displayed in yellow when the AOA is between AOA limiter protection engagement value and the maximum AOA limit, and it is displayed in red if the AOA increases to the maximum AOA limit. Figure 2. Prima