NTSB Cites Flight Control Laws in Praetor 500 Accident

The probable cause of the hard landing of a Flexjet-operated Embraer Praetor 500 on Sept. 21, 2023, that resulted in substantial damage was, according to the NTSB final report, “the [fly-by-wire] control laws of the angle of attack limiter protection system, which precluded the system from disengaging during an approach in gusting wind conditions, limiting the flight crew’s ability to control the airplane’s pitch and resulting in a hard landing.”

Both of the pilots and the six passengers were uninjured after the airplane touched down before the threshold of Runway 4 at St. Simons Island Airport (KSSI) in Georgia. After bouncing and touching down again, the jet skidded along the runway for 2,531 feet, then departed off the right side, crossed a taxiway, and stopped in the grass next to the runway, 3,083 feet from the initial impact point. After shutting down the engines, the pilot confirmed that everyone on board was all right, and the copilot opened the cabin door and helped the passengers exit.

The flight departed from Westchester County Airport (KHPN) in White Plains, New York, at 12:39. As the Praetor 500 approached the non-towered airport, the captain chose to fly the RNAV (GPS) Rwy 04 approach “to allow more time for alignment and setup for landing,” according to the NTSB. Winds were from 050 at 13, gusting to 23 knots, and the skies were clear with 10 miles visibility. The pilot opted for the flaps 3 setting instead of full flaps due to the strong winds. The copilot said, “You’re five hundred feet, stabilized, and you have 20 knots of headwind.” The autothrottles remained on after the autopilot was disconnected at about 500 feet.

According to the final report, “When the airplane was about 100 to 150 feet agl, it crossed over a tree line, and [the pilot said] he felt an ‘uplift,’ then the airplane began to porpoise. The pilot tried to make pitch corrections using the [fly-by-wire flight control system’s] sidestick control, but the airplane did not respond as commanded.”

According to the copilot, the airplane was pitching up and down, “and he could see the pilot moving [the sidestick] back and forth in what seemed to him to be ‘very aggressive’ inputs.”

At 100 feet, the airplane’s terrain awareness and warning system (TAWS) called out, “sink rate,” then the copilot said, “Easy, Sparky.”

The captain responded, “It’s not me [exclamation].” After passing 40 feet, the pilot repeated himself, saying “it’s not me” four times, followed by another exclamation and “straining” sounds. The NTSB report continued, “The copilot said that he pulled back on his sidestick, and it felt like nothing happened. The copilot said that, at this point, it seemed like they were ‘along for the ride’ and that he needed to brace himself for impact.”

After the TAWS called “20 [feet],” there were “sounds consistent with ground impact,” followed by an electronic voice inside the cockpit saying “dual input,” a warning to the pilots that they were both moving their sidesticks.

“It wasn’t me, that was not me,” the pilot said, then another “dual input” warning sounded, and the copilot said, “Down, down, down, down.”

“I got it,” the pilot replied, again repeating himself a few times as the copilot twice asked, “Are you on the brakes?” and then said, “I’m helping.”

There was a loud “thud” sound, and then the “rattling and rumbling noises stop,” while one of the pilots radioed on the airport’s common traffic advisory frequency, asking “Saint Simons...(if) you have any fire rescue please roll trucks right now.” The airplane did not catch on fire, while both main landing gears punched through the top of the wing, according to the NTSB. “The lower left side of the fuselage just forward of the airstairs was found torn open with the pressure vessel compromised. The right wing flaps, right outboard spoiler panel, and right aileron were also damaged.”

Wind Gust

In its performance study, the NTSB determined that 13 seconds before touchdown, at about 162 feet radio altitude, “the airplane’s AOA [angle of attack] increased suddenly, likely due to a wind gust. The airplane’s AOA limiter protection system (aerodynamic stall prevention system) engaged, and the airplane’s AOA reduced…Even if the airplane is configured for landing and at the appropriate approach speed, the AOA limiter protection may engage due to a sudden AOA increase caused by wind gusts.

“The FDR data for the pilot’s sidestick control showed that the pilot provided airplane-nose-up and airplane-nose-down pitch commands (as well as roll commands) and that the AOA limiter protection, which remained engaged until touchdown, limited the airplane’s response to the pilot’s pitch commands. In their post-accident statements, neither flight crewmember indicated any awareness that the AOA limiter protection had engaged.

“The CVR transcript showed that, at 1436:28 (4 seconds before touchdown), the flight crew received a terrain awareness and warning system (TAWS) ‘sink rate’ aural alert and reacted in surprise. During the 3 seconds before touchdown, the pilot commanded full airplane-nose-up pitch, and the fly-by-wire control system responded with about 3 degrees airplane-nose-up elevator (full elevator deflection ranges from 25 degrees up to 15 degrees down). During the flare, the airplane was subjected to a horizontal gust, which resulted in a reduction of about 8 knots of indicated airspeed. During the 1.5 seconds before touchdown, the copilot also commanded full airplane-nose-up pitch, and the system responded with 5.5 degrees airplane-nose-down elevator about 0.5 second before touchdown. The airplane impacted the ground at 1436:32.”

AOA Limiter Protection

According to the NTSB Systems Group chair’s factual report, the AOA limiter protection engages when AOA exceeds a value that depends on the configuration of the airplane, such as landing gear position, flaps setting, and icing conditions. In the case of a significant rate of AOA change, the limiter protection threshold may be reduced.

The protection can also engage, the NTSB noted, “due to maneuvers that increase the load factor or a sudden AOA increase due to wind gusts.”

There were three conditions required to be met for the limiter protection to disengage, in the flight control computer software Build 3 that was installed on the accident Praetor 500. These include: the AOA must be reduced to a value about 2 degrees below the engagement threshold; the airspeed must be increased to more than 1.1 times the reference stall speed; and the difference between the normal load factor demand determined by the sidestick pitch command and the actual load factor experienced by the airplane must be equal to or lower than 0.3 g for 1 second.

“The purpose of condition 3 is to prevent high AOA excursions during the disengagement transition,” the NTSB report explained. “This condition may not be met if a pilot inputs rapid and large oscillating pitch inputs to the sidestick, which will delay the AOA limiter protection disengagement even when the other criteria are met.”

The NTSB’s airplane performance study found that the AOA limiter protection engaged when the AOA increased at 1436:19, from about 7 to 12.8 degrees in two seconds. “The FDR data showed that the AOA increase, which was accompanied by an 8-kt airspeed loss and vertical g force increase of 0.2 g, was not commanded by the pilot.”

During most of the 13 seconds prior to the airplane’s hard touchdown at about minus 1,000 fpm and with a 3.5 g spike in vertical acceleration, the AOA decreased from 12.8 degrees to less than 5 degrees. Because the AOA limiter remained engaged, the pilots were not able to use about 10 degrees of AOA or stall margin during the landing.

“The NTSB airplane systems review determined that, based on the FDR data, after the AOA limiter protection engaged, the airplane’s AOA quickly reduced and did not again reach the engagement threshold for the remainder of the flight. According to Embraer, the airplane’s reduced response to sidestick pitch inputs during the 13 seconds before touchdown was consistent with the AOA limiter protection control laws. The AOA limiter protection did not subsequently disengage because the frequency and amplitude of the pilot’s oscillating sidestick pitch commands prevented the criterion for disengagement condition 3 from being met.”

The NTSB reviewed flight data monitoring (FDM) data from Flexjet and found 43 other events involving AOA limiter protection activation during approach preceding the accident. “According to Flexjet, for each event, the flight crews were unaware that the AOA limiter had engaged,” the report noted.

Another operator experienced a similar phenomenon on June 13, 2023, which was activation of AOA limiter protection with autothrottles engaged on approach in gusty winds. “The airplane’s airspeed dropped from 120 knots to 106 knots in about 1 second when the airplane was about 197 feet agl,” the NTSB wrote. “The airplane’s AOA peaked at 14.7 degrees, the AOA limiter protection engaged, and the flight crew immediately initiated a go-around, which included moving the throttles to takeoff power setting. The AOA limiter remained engaged for 10 seconds, and the airplane descended to 97 feet agl before it began to climb, about 6 seconds after AOA limiter engagement.”

Post-accident Changes

As a result of the Praetor 500 hard-landing accident, Flexjet reviewed AOA limiter activations and monitored FDM data for future occurrences, shared FDM data with the NTSB and FAA, and issued a company operating bulletin on risk-mitigation actions for the fly-by-wire Embraer models based on FDM data.

The FAA issued AD 2024-05-13, considered an interim action pending further action, with revised limitations and normal procedures sections of the flight manual, with “new operational airspeed limitations, flight control limitations, and approach procedures when AOA limiter protection is engaged, as specified in [Brazil’s] ANAC AD 2024-02-02.” The FAA AD also requires finding and sharing with the FAA instances of AOA limiter protection engagement after passing the final approach fix or within 5 miles of the landing point.

Flexjet asked the FAA to approve an alternate means of compliance (AMOC) for that AD, substituting near-real-time FDM of AOA limiter activation, and the FAA approved that AMOC.

According to Joe Salata, senior v-p of Flexjet flight operations, “We quickly identified the contributing issues through our internal [FDM] systems. We issued company operating bulletins (COBs) that outlined new approach procedures, eliminating the potential for recurrence. The effectiveness of these procedure changes was verified by our [FDM] systems and [are] still in effect today through continuous monitoring. We conducted numerous training and discussion sessions with the pilot group to address questions and emphasize the operational changes introduced by the COB.”

For its part, Embraer issued operational bulletins for customers, addressing wind and gust-correction additives, including a recommendation “to add half the steady headwind component plus the gust increment above the steady wind to the reference speed,” according to the NTSB. In addition, Embraer’s bulletins provided: “Adjustments when landings are performed utilizing an approach speed correction including landing distance correction factors; autothrottle logic approach speed; and instructions for entering takeoff and corrected landing data in the FMS.”

A subsequent bulletin reiterated recommendations for approach speed correction and landing distance correction factors. It also pointed out that “if the AOA limiter protection is engaged after the ‘stabilized approach’ callout and before flare initiation, the approach should be considered unstable, and a go-around should be initiated.”

An April 7, 2025 Embraer service bulletin outlined a flight control computer software upgrade, to Build 4. This “modified the AOA limiter protection disengagement requirement specified in condition 3 (allowing for the AOA limiter protection to disengage any time there is a sidestick pitch-down command and conditions 1 and 2 are satisfied). The software update also modified the AOA limiter protection filter to allow higher pitch response (increased elevator deflection) to sidestick inputs when the AOA limiter is engaged,” according to the NTSB.

A Feb. 26, 2024 AD issued by ANAC (2024-02-02) added “a flight controls limitation that stated, ‘Warning: When AOA limiter protection is engaged, rapid and large alternating pitch control inputs must be avoided as they may prevent or delay the AOA limiter protection disengagement.’”

ANAC also mandated the flight control computer software upgrade in a revision to that AD, and the FAA has said it plans to issue a final rule on the AOA limiter around September 2026.

In a statement provided to AIN, Embraer wrote: “Embraer, driven by its unwavering commitment to engineering excellence, has consistently demonstrated a strong safety culture throughout its history. With a robust track record of product reliability and a focus on pilot-centric innovation, the company has identified an opportunity to further enhance operational safety under challenging flight conditions, such as strong winds and gusts. As a testament to its dedication, the company has proactively issued Operational Bulletins to ensure the highest level of safety for all its operators in advance of the ADs issued by ANAC. We also note that the AD 2024-02-02R1 lists terminative actions, including a new Flight Control Computer Software Update via Service Bulletin and an Aircraft Flight Manual revision that removes all operational procedures set forth by the original AD.”