ERA23LA376 · Embraer S A EMB-545 MOD

According to the flight crew, the departure and en route phases of the flight in the airplane were uneventful. Gusting wind and visual conditions existed at the destination airport, and the pilot chose to fly a GPS approach (versus a visual pattern) to allow more time for alignment and set-up for landing. The flight crew reported that all checklists and callouts were conducted. During the approach with the autothrottles engaged, the approach was stable as the airplane descended through 500 ft above ground level (agl). After the copilot made the “500 ft stable” callout, the airplane continued its descent, then crossed over a small section of trees. The pilot reported that he felt an “uplift,” then the airplane began to porpoise when it was about 100 to 150 ft agl. The pilot tried to make pitch corrections, but the airplane’s attitude did not change as commanded. The copilot tried to assist but observed the same airplane response. The airplane landed hard and slid along the runway, coming to rest in the grass off the right side of the runway. Although the flight crew at times engaged in nonessential conversation while approaching the airport, there is no indication that this contributed to the accident. Further, review of data from the engines’ full authority digital engine controls did not reveal any anomaly that would have contributed to the accident. The airplane was equipped with a fly-by-wire flight control system that featured an angle of attack (AOA) limiter protection system (instead of a traditional stall warning system) designed to prevent the airplane from stalling by limiting its AOA. Review of flight data recorder (FDR) data indicated that the AOA limiter protection engaged during the approach due to a sudden increase in AOA when the airplane was at a radio altitude of 162 ft. The sudden AOA increase was likely due to a wind gust. The airplane’s AOA then quickly reduced from 12.8° to less than 5° and remained below the engagement threshold for the remainder of the flight, but the AOA limiter protection remained engaged. Although the AOA limiter protection performed as designed, it reduced the flight crew’s ability to pitch up the airplane during the flare. For example, the pilot used the sidestick to command full airplane-nose-up pitch for about 3 seconds before touchdown, but the fly-by-wire system provided less than 3°of airplane-nose-up elevator. About 1.5 seconds before touchdown, the copilot also used the sidestick to command full airplane-nose-up pitch, but the fly-by-wire system responded with 5.5° of airplane-nose-down elevator. Neither flight crewmember indicated any awareness that the AOA limiter protection had engaged. During the flare, the airplane was subjected to a horizontal gust which resulted in a reduction of about 8 kts of indicated airspeed and the airplane touched down hard. An NTSB performance study determined that, at the time the airplane touched down hard, about 10° of AOA or stall margin remained that the flight crew was unable to use during the landing because the AOA limiter protection was engaged. The flight control computer software version current at the time of the accident would allow AOA limiter protection disengagement only on having three conditions met: 1) AOA reduced to values below the engagement threshold, 2) airspeed above a factor of stall speed threshold, and 3) difference between the normal load factor demand determined by the sidestick pitch command and the airplane’s actual load factor being below a specified threshold. Review of FDR data revealed that the frequency and amplitude of the pilot’s oscillating sidestick pitch commands prevented AOA limiter protection disengagement due to condition 3. About 7 months after the accident, the FAA issued airworthiness directive (AD) 2024-05-13, which required revisions to the airplane flight manual (AFM) to incorporate new operational airspeed limitations, flight control limitations, and approach procedures when the AOA limiter protection is engaged. This interim safety measure mandated the actions specified in the National Civil Aviation Agency of Brazil (ANAC) AD 2024-02-02, which was issued about 2 months earlier. Subsequently, about 22 months after the accident, ANAC issued AD 2024-02-02R1, which superseded ANAC AD 2020-02-02 and required a software update to the flight control computers to revise the AOA limiter protection criteria, which included allowing for a higher pitch response to sidestick movement while the AOA limiter protection is engaged and allowing for it to disengage any time there is a sidestick pitch-down command and conditions 1 and 2 are satisfied. The FAA indicated that it planned to release its final rule regarding the Embraer EMB-545 and EMB-550 AOA limiter about September 2026.

Verbatim NTSB analysis and probable cause from the NTSB dataset