N434FXEmbraer S A EMB-545

On September 21, 2023, about 1436 eastern daylight time, an Embraer SA EMB-545 MOD airplane, N434FX, operated by Flexjet LLC as Flexjet flight 434, was substantially damaged when it was involved in an accident near St. Simons Island, Georgia. The pilot, copilot, and the six passengers were not injured. The airplane was operated as a Title 14 Code of Federal Regulations (CFR) Part 91K fractional flight.

The airplane departed Westchester County Airport (HPN), White Plains, New York, at 1239 destined for St. Simons Island Airport (SSI), St. Simons Island. According to the flight crew, the departure and en route phase of the flight were uneventful, and they performed the checklists in accordance with procedures. The pilot (who was flying from the left seat) stated that he chose to fly the GPS runway 4 approach (versus flying a visual pattern) to allow more time for alignment and setup for landing. He said that he selected the “flaps 3” configuration due to the gusting wind component to be prepared in case it shifted to a crosswind and that the autothrottle was in use.

The copilot said they had the runway in sight from 10 miles out, and he made the “500-ft stable, 20-kt headwind” callout when the airplane was descending through 500 ft agl. The NTSB airplane performance study determined that the FDR data and CVR audio for the airplane were consistent with a stable approach up to this point. The flight crew reported that all checklists and callouts were conducted. The FDR data showed that the fly-by-wire system was operating in normal mode, and the airplane’s autopilot was disconnected at 1435:49, when the airplane was about 500 ft.

The pilot said that, when the airplane was about 100 to 150 ft agl, it crossed over a tree line, and he felt an “uplift,” then the airplane began to porpoise. The pilot tried to make pitch corrections using the sidestick control, but the airplane did not respond as commanded.

The copilot said that the airplane was over the runway displaced threshold when it started pitching up and down. He looked over at the pilot’s hand on the sidestick, and he could see the pilot moving it back and forth in what seemed to him to be ”very aggressive” inputs. The copilot then said something like, “Take it easy there,” and the pilot replied that the airplane was not responding.

The copilot estimated that the airplane was about 50 ft above the runway when he asked the pilot something along the lines of, “Would you like me to try?” The copilot said that he pulled back on his sidestick, and it felt like nothing happened. The copilot said that, at this point, it seemed like they were “along for the ride” and that he needed to brace himself for impact.

The NTSB airplane performance study determined that, about 1436:19 (13 seconds before touchdown), when the airplane was about 162 ft radio altitude, the airplane’s AOA increased suddenly, likely due to a wind gust. The airplane’s AOA limiter protection system (aerodynamic stall prevention system) engaged, and the airplane’s AOA reduced. The FDR data for the pilot’s sidestick control showed that the pilot provided airplane-nose-up and airplane-nose-down pitch commands (as well as roll commands) and that the AOA limiter protection, which remained engaged until touchdown, limited the airplane’s response to the pilot’s pitch commands. (See the Tests and Research section for more information about the NTSB airplane performance study and systems functions during the accident flight.) In their postaccident statements, neither flight crewmember indicated any awareness that the AOA limiter protection had engaged.

The CVR transcript showed that, at 1436:28 (4 seconds before touchdown), the flight crew received a terrain awareness and warning system (TAWS) “sink rate” aural alert and reacted in surprise. During the 3 seconds before touchdown, the pilot commanded full airplane-nose-up pitch, and the fly-by-wire control system responded with about 3° airplane-nose-up elevator (full elevator deflection ranges from 25° up to 15° down). During the flare, the airplane was subjected to a horizontal gust which which resulted in a reduction of about 8 kts of indicated airspeed. During the 1.5 seconds before touchdown, the copilot also commanded full airplane-nose-up pitch, and the system responded with 5.5° airplane-nose-down elevator about 0.5 second before touchdown. The airplane impacted the ground at 1436:32.

The copilot said that the airplane touched down “hard” before the runway threshold on centerline, and he thought that it bounced and then touched down again. He said the airplane was listing and drifting to the right as it skidded down the runway. The copilot remarked to the pilot that the airplane was not decelerating very much, and the pilot said that he was trying to get it stopped. The copilot then pulled the emergency brake handle, but nothing happened, so he put it back down.

The airplane then went off the right side of the runway, hit a concrete base for a sign, then skidded mostly sideways before coming to rest on the grass to the right of the runway. After the airplane came to a stop, the copilot opened the cockpit door to check on the passengers and advised the pilot to shut down the engines so he could open the cabin door and deplane the passengers. The pilot shut down the engines, and all occupants deplaned through the main cabin door.

The pilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land and sea. He also held type ratings on the BE-300, BE-400, CE-560XL, CE-650, CL-600, EMB-550, HS-125, and MU-300. He possessed a flight instructor certificate with ratings for single-engine and instrument airplanes, a ground instructor certificate with ratings for advanced and instrument, and a remote pilot certificate for small unmanned aircraft systems. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 10,900 total flight hours, with 1,872 hours in the accident airplane make and model.

The copilot held an airline transport pilot certificate with a rating for airplane multi-engine land and commercial privileges for airplane single-engine land. He also held type ratings on the A-310, A-320, B-757, B-767, DC-9, DC-10, EMB-550, and LR-JET. Additionally, he also held a flight engineer certificate with a rating for turbojet-powered. His most recent FAA first-class medical certificate was issued on June 13, 2023. He reported that he had accrued about 16,686 total flight hours, with 306 hours in the accident airplane make and model.

The accident airplane was manufactured in 2020. Its most recent continuous airworthiness inspection was completed on April 11, 2023, at 2,863 total hours of operation. At the time of the accident, the airplane had accrued about 3,424 hours of operation. Flexjet reported no deferrals per the airplane’s minimum equipment list, and a review of the discrepancy history for the airplane for the preceding year revealed no discrepancies related to the accident.

The Embraer EMB-545 MOD airplane, which requires a minimum two-pilot crew, is a low-wing, T-tail, pressurized airplane powered by two high bypass-ratio Honeywell International rear-mounted turbofan engines. The fully retractable tricycle landing gear is designed to be operated on paved runways only. The instrument panel uses a glass cockpit concept with the Collins Pro Line Fusion avionics system consisting of four display units (left, center, right, and lower). The operation is based on the use of the flight management system and is equipped with an autopilot, flight director, and autothrottle. The accident airplane’s avionics included a Honeywell TPM-6000 TAWS module configured with the reactive windshear feature disabled.

By design, the fly-by-wire flight control system provides closed-loop control and monitoring of all primary and secondary flight control surfaces within the system. The normal mode is designed to provide improved flying handling qualities and reduce flight crew workload. In direct mode, the airplane behaves like a conventional airplane, such that the sidestick and pedal deflections are directly related to the control surface position.

AOA Limiter Protection System

As outlined in detail in the NTSB Systems Group Chair’s Factual Report, available in the public docket for this accident, the airplane’s AOA limiter protection system is designed to prevent the airplane from entering an aerodynamic stall condition. To accomplish this, the fly-by-wire flight control computers apply control laws to the pilot’s pitch commands on the sidestick to position the elevators as required to prevent the airplane from exceeding the maximum AOA limit. The maximum AOA limit is designed to provide adequate airplane roll maneuverability, good flight characteristics, and sufficiently safe margin to the aerodynamic stall AOA.

The AOA limiter protection engagement, which depends solely on AOA, engages when the AOA becomes greater than a given value, which is predetermined for each airplane configuration (for example, gear position, flap setting, or icing conditions) and may be reduced in case of significant AOA rate of change.

Normally, the airplane’s maximum AOA limit is reached at lower speeds, but the AOA limiter protection may engage due to maneuvers that increase the load factor or a sudden AOA increase due to wind gusts. The fly-by-wire control laws are designed so that when the airplane flies in normal mode (such as during the accident approach), its AOA will not exceed the maximum AOA limit, even if the pilot holds the sidestick control fully aft.

Based on the flight control computer software version that was current at the time of the accident and installed on the accident airplane (FCC software load Build 3), once the AOA limiter protection is engaged, it will automatically disengage only when the following conditions are met:

1. The AOA must be reduced to a value about 2° below the engagement threshold.

2. The airspeed must be increased to more than 1.1 times the reference stall speed.

3. The difference between the normal load factor demand determined by the sidestick pitch command and the actual load factor experienced by the airplane must be equal to or lower than 0.3 g for 1 second.

The purpose of condition 3 is to prevent high AOA excursions during the disengagement transition. This condition may not be met if a pilot inputs rapid and large oscillating pitch inputs to the sidestick, which will delay the AOA limiter protection disengagement even when the other criteria are met.

Low-Speed Awareness

The low-speed awareness indication displays over the speed tape on the primary flight display to alert the flight crew of a low-speed condition. In normal mode, the AOA limiter protection function is available, and the low-speed awareness is displayed. The three low-speed awareness color bands on the speed tape are defined as follows:

•VSS: This speed, defined as the stable velocity speed, is represented by the top of the white band. It indicates a low energy state and is not a function of the AOA or load factor. For a 1g flight, it is equivalent to about 1.13 times the stall speed. In normal conditions, if airspeed goes below VSS, an audible “low speed” alert will sound.

•VAOA: This speed, defined based on the AOA that engages the AOA limiter protection, is represented by the top of the yellow band. For a 1g flight, it corresponds to about 1.08 times the stall speed.

•VLIM: This speed, defined based on association with the maximum allowable AOA limit, is represented by the top of the red band. For a 1g flight, it corresponds to about 1.03 times the stall speed.

Figure 1. Exemplar low-speed awareness indication color bands.

In addition, when the AOA limiter protection is engaged, the airspeed readout background becomes yellow at or below VAOA, turning red at VLIM. Since VAOA and VLIM are based on the AOA, they may vary according to flight conditions.

Pilots may observe the yellow and red bands moving up or down as the airplane encounters sudden AOA or load factor changes. In the case of a rapid increase in AOA, the AOA limiter protection may be activated sooner, at a lower AOA. Even if the airplane is configured for landing and at the appropriate approach speed, the AOA limiter protection may engage due to a sudden AOA increase caused by wind gusts. In this case, the low-speed awareness white band will not be seen, as it will be overlapped by the yellow and red bands, and the “low speed” aural alert will not sound.

Pitch Limit Indicator

The Pitch Limit Indicator is displayed on the pitch angle scale on the primary flight display when the AOA increases above the AOA limiter protection engagement value and the AOA limiter protection is engaged. (The Pitch Limit Indicator is not displayed unless the AOA limiter protection is engaged.) The Pitch Limit Indicator shows the difference between the AOA and the maximum AOA limit when the fly-by-wire system is in normal mode. The Pitch Limit Indicator is displayed in yellow when the AOA is between AOA limiter protection engagement value and the maximum AOA limit, and it is displayed in red if the AOA increases to the maximum AOA limit.

Figure 2. Primary flight display for flight in normal mode before (left) and after (right) AOA Protection Limit engagement, showing the appearance of the Pitch Limit Indicator.

Surface Observation

SSI had an Automated Surface Observing System. Reported conditions at 1453 included a wind from 050° at 13 kts with gusts to 23 kts, visibility 10 statute miles or greater, sky clear, temperature of 29°C and dew point temperature of 23°C, and an altimeter setting of 30.03 inches of mercury.

Terminal Aerodrome Forecast

A terminal aerodrome forecast issued for SSI at 1324 for the time of the accident included wind from 050° at 14 kts with gusts to 20 kts, visibility greater than 6 statute miles, rain showers, thunderstorms in the vicinity, scattered clouds at 2,500 ft agl with clouds of cumulonimbus type, and an overcast ceiling at 6,000 ft agl. Temporary conditions forecast for between 1400 and 1700 included visibility of 4 statute miles, thunderstorm with moderate rain, mist, and a broken ceiling at 2,500 ft agl with clouds of cumulonimbus type.

Area Forecast Discussion

The NWS Jacksonville, Florida, Weather Forecast Office issued an Area Forecast Discussion at 1338 applicable for a region that included the accident location. The aviation section of the forecast stated that “showers and storms will continue to become more widespread in the afternoon with gusting northwesterly winds strengthening through today with speeds reaching up to about 12 to 15 kts with gusts of 20 to 25 kts.”

Significant Meteorological Information

At 1355, the National Weather Service Aviation Weather Center issued Convective SIGMET 57E that was active for the accident location and valid until 1555. (Convective SIGMETs imply severe or greater turbulence, severe icing, and low-level windshear.) The Convective SIGMET warned of an area of thunderstorms with tops to flight level 390.

The accident airplane was manufactured in 2020. Its most recent continuous airworthiness inspection was completed on April 11, 2023, at 2,863 total hours of operation. At the time of the accident, the airplane had accrued about 3,424 hours of operation. Flexjet reported no deferrals per the airplane’s minimum equipment list, and a review of the discrepancy history for the airplane for the preceding year revealed no discrepancies related to the accident.

The Embraer EMB-545 MOD airplane, which requires a minimum two-pilot crew, is a low-wing, T-tail, pressurized airplane powered by two high bypass-ratio Honeywell International rear-mounted turbofan engines. The fully retractable tricycle landing gear is designed to be operated on paved runways only. The instrument panel uses a glass cockpit concept with the Collins Pro Line Fusion avionics system consisting of four display units (left, center, right, and lower). The operation is based on the use of the flight management system and is equipped with an autopilot, flight director, and autothrottle. The accident airplane’s avionics included a Honeywell TPM-6000 TAWS module configured with the reactive windshear feature disabled.

By design, the fly-by-wire flight control system provides closed-loop control and monitoring of all primary and secondary flight control surfaces within the system. The normal mode is designed to provide improved flying handling qualities and reduce flight crew workload. In direct mode, the airplane behaves like a conventional airplane, such that the sidestick and pedal deflections are directly related to the control surface position.

AOA Limiter Protection System

As outlined in detail in the NTSB Systems Group Chair’s Factual Report, available in the public docket for this accident, the airplane’s AOA limiter protection system is designed to prevent the airplane from entering an aerodynamic stall condition. To accomplish this, the fly-by-wire flight control computers apply control laws to the pilot’s pitch commands on the sidestick to position the elevators as required to prevent the airplane from exceeding the maximum AOA limit. The maximum AOA limit is designed to provide adequate airplane roll maneuverability, good flight characteristics, and sufficiently safe margin to the aerodynamic stall AOA.

The AOA limiter protection engagement, which depends solely on AOA, engages when the AOA becomes greater than a given value, which is predetermined for each airplane configuration (for example, gear position, flap setting, or icing conditions) and may be reduced in case of significant AOA rate of change.

Normally, the airplane’s maximum AOA limit is reached at lower speeds, but the AOA limiter protection may engage due to maneuvers that increase the load factor or a sudden AOA increase due to wind gusts. The fly-by-wire control laws are designed so that when the airplane flies in normal mode (such as during the accident approach), its AOA will not exceed the maximum AOA limit, even if the pilot holds the sidestick control fully aft.

Based on the flight control computer software version that was current at the time of the accident and installed on the accident airplane (FCC software load Build 3), once the AOA limiter protection is engaged, it will automatically disengage only when the following conditions are met:

1. The AOA must be reduced to a value about 2° below the engagement threshold.

2. The airspeed must be increased to more than 1.1 times the reference stall speed.

3. The difference between the normal load factor demand determined by the sidestick pitch command and the actual load factor experienced by the airplane must be equal to or lower than 0.3 g for 1 second.

The purpose of condition 3 is to prevent high AOA excursions during the disengagement transition. This condition may not be met if a pilot inputs rapid and large oscillating pitch inputs to the sidestick, which will delay the AOA limiter protection disengagement even when the other criteria are met.

Low-Speed Awareness

The low-speed awareness indication displays over the speed tape on the primary flight display to alert the flight crew of a low-speed condition. In normal mode, the AOA limiter protection function is available, and the low-speed awareness is displayed. The three low-speed awareness color bands on the speed tape are defined as follows:

•VSS: This speed, defined as the stable velocity speed, is represented by the top of the white band. It indicates a low energy state and is not a function of the AOA or load factor. For a 1g flight, it is equivalent to about 1.13 times the stall speed. In normal conditions, if airspeed goes below VSS, an audible “low speed” alert will sound.

•VAOA: This speed, defined based on the AOA that engages the AOA limiter protection, is represented by the top of the yellow band. For a 1g flight, it corresponds to about 1.08 times the stall speed.

•VLIM: This speed, defined based on association with the maximum allowable AOA limit, is represented by the top of the red band. For a 1g flight, it corresponds to about 1.03 times the stall speed.

Figure 1. Exemplar low-speed awareness indication color bands.

In addition, when the AOA limiter protection is engaged, the airspeed readout background becomes yellow at or below VAOA, turning red at VLIM. Since VAOA and VLIM are based on the AOA, they may vary according to flight conditions.

Pilots may observe the yellow and red bands moving up or down as the airplane encounters sudden AOA or load factor changes. In the case of a rapid increase in AOA, the AOA limiter protection may be activated sooner, at a lower AOA. Even if the airplane is configured for landing and at the appropriate approach speed, the AOA limiter protection may engage due to a sudden AOA increase caused by wind gusts. In this case, the low-speed awareness white band will not be seen, as it will be overlapped by the yellow and red bands, and the “low speed” aural alert will not sound.

Pitch Limit Indicator

The Pitch Limit Indicator is displayed on the pitch angle scale on the primary flight display when the AOA increases above the AOA limiter protection engagement value and the AOA limiter protection is engaged. (The Pitch Limit Indicator is not displayed unless the AOA limiter protection is engaged.) The Pitch Limit Indicator shows the difference between the AOA and the maximum AOA limit when the fly-by-wire system is in normal mode. The Pitch Limit Indicator is displayed in yellow when the AOA is between AOA limiter protection engagement value and the maximum AOA limit, and it is displayed in red if the AOA increases to the maximum AOA limit.

Figure 2. Primary flight display for flight in normal mode before (left) and after (right) AOA Protection Limit engagement, showing the appearance of the Pitch Limit Indicator.

Examination of the wreckage revealed both main landing gear were damaged, and the landing gear struts had punctured the top of each wing. The lower left side of the fuselage just forward of the airstairs was found torn open with the pressure vessel compromised. The right wing flaps, right outboard spoiler panel, and right aileron were also damaged.

Examination of the accident site revealed that the total distance from the airplane’s initial ground contact point to the wreckage was about 3,083 ft. Evidence showed that, during the impact sequence, the airplane skidded about 2,531 ft down the runway before departing off the right side, striking runway and taxiway lights and a sign, crossing a taxiway, then coming to rest in the grass beside the runway.

Other AOA Limiter Activations in Embraer Airplanes

A review of FDM program data provided by Flexjet to the NTSB and FAA revealed 43 events involving AOA limiter protection activation during approach that occurred before September 2023. This resulted in a rate of 1.744 activations per 1,000 flights. According to Flexjet, for each event, the flight crews were unaware that the AOA Limiter had engaged.

A review of FDM data supplied by a foreign operator revealed that on June 13, 2023, (about 3 months before the accident), an airplane’s AOA limiter protection activated during an autothrottle approach in gusting wind conditions. The airplane’s airspeed dropped from 120 kts to 106 kts in about 1 second when the airplane was about 197 ft agl. The airplane’s AOA peaked at 14.7°, the AOA limiter protection engaged, and the flight crew immediately initiated a go-around, which included moving the throttles to takeoff power setting. The AOA Limiter remained engaged for 10 seconds, and the airplane descended to 97 ft agl before it began to climb, about 6 seconds after AOA limiter engagement.

At the time of the accident flight (and the previous AOA limiter protection engagement events described in this section) the software version for the flight control computers, FCC Load Build 3, required that three conditions be met for disengagement of the AOA limiter protection. As discussed in the Airplane Information section, these conditions involved, 1) reducing AOA to below the engagement threshold, 2) increasing airspeed to above a factor of stall speed, and 3) achieving a difference between the normal load factor determined by the sidestick pitch command and the actual load factor to be equal or lower than 0.3 g for 1 second.

Postaccident Safety Actions

Flexjet

Established a historical review and investigation process for all AOA limiter activations on final approach, along with continuous monitoring of future occurrences.

Flexjet shared data from its FDM program with the NTSB and the FAA regarding AOA limiter protection activations since September 2023.

In its November 2023 newsletter, Flexjet reiterated to flight crews its sterile cockpit procedures and their importance.

On January 2, 2024, issued an Embraer EMB-545/EMB-550 company operating bulletin (COB) implementing risk-mitigation actions based on FDM-derived data from its fleet, including the accident aircraft.  The FDM program established approach, landing, and rollout metrics that were monitored in near real time to evaluate the COB's effectiveness in preventing AOA limiter activations and mitigating the risk of a runway overrun.

Submitted an alternate means of compliance (AMOC) request to AD 2024-05-13, allowing the use of near-real-time FDM monitoring of AOA limiter activations to satisfy the AD which was subsequently approved by the FAA.

Conducted live training and discussions with the pilot group to address questions and emphasize the operational changes introduced by the COB.

Embraer

On October 11, 2023, Embraer issued Operational Bulletin (OB) 550-002/23, applicable to all Embraer EMB-545 and EMB-550 airplanes, and OB P550-002/23, applicable to all Embraer EMB-545- MOD and EMB-550 MOD airplanes, to provide operators with information related to landing distances and speed. They contained the following information:

o Wind and gust correction additives.

o A recommended method for approach speed correction to add half the steady headwind component plus the gust increment above the steady wind to the reference speed.

o Adjustments when landings are performed utilizing an approach speed correction including landing distance correction factors.

o Autothrottle logic approach speed.

o Instructions for entering takeoff and corrected landing data in the FMS.

On February 5, 2024, Embraer issued OB 550-001/24, applicable to all Embraer EMB-545 and EMB-550 airplanes, and OB P550-001/24, applicable to all Embraer EMB-545 MOD and EMB-550 MOD airplanes, to provide operators additional information and operational guidance related to AOA limiter protection during landing approaches. It contained the following information:

o AOA limiter protection logic

o Reiterated the recommended method for approach speed correction.

o Reiterated the adjustments when landings are performed using an approach speed correction, including landing distance correction factors.

o Advised that if the AOA limiter protection is engaged after the “stabilized approach” callout and before flare initiation, the approach should be considered unstable, and a go-around should be initiated.

o Advised that pilots should closely monitor the thrust levers until touchdown and override the autothrottle if performance is not as expected.

On April 7, 2025, Embraer issued Service Bulletin (SB) 550-27-0009, applicable to affected Embraer EMB-545 and EMB-550 airplanes (listed by serial number on the SB effectivity list), to recommend an update to the flight control computer software. The software update, FCC Load Build 4, modified the AOA limiter protection disengagement requirement specified in condition 3 (allowing for the AOA limiter protection to disengage any time there is a sidestick pitch-down command and conditions 1 and 2 are satisfied (as discussed in the Airplane Information section). The software update also modified the AOA limiter protection filter to allow higher pitch response (increased elevator deflection) to sidestick inputs when the AOA limiter is engaged.

ANAC and FAA Regulatory Actions

On February 26, 2024, ANAC issued AD 2024-02-02, applicable to all Embraer EMB-545 and EMB-550 airplanes (including variants), to mandate that the applicable AFM be revised to include the following information.

o An increase in the approach speed for normal operations.

o Performance information for increased landing speed.

o A flight controls limitation that stated, “Warning: When AOA limiter protection is engaged, rapid and large alternating pitch control inputs must be avoided as they may prevent or delay the AOA limiter protection disengagement.”

A normal procedures revision for Stabilized Approach stating that, “if the AOA limiter protection is engaged during the final approach and before flare initiation, the approach is considered unstable, and a go-around must be initiated.” The revision included a note specifying the three indications that show that the AOA limiter protection is engaged: Airspeed inside the yellow band, the yellow background on the airspeed readout or the yellow Pitch Limit Indicator. The revision also stated that the “use of autothrottle is recommended for approach and landing to minimize crew workload. However, pilots must closely monitor the thrust levers until touchdown and override the autothrottle if performance is not as expected.”

On March 26, 2024, the FAA issued AD 2024-05-13, applicable to all Embraer EMB-545 and EMB-550 airplanes (including the EMB-545 MOD and EMB-550 MOD variants), with an effective date of April 10, 2024. The AD, which the FAA considered to be an interim action (pending possible identification of final action requiring further rulemaking), required the following:

o Revising the Limitations and Normal Procedures sections of the existing AFM to incorporate new operational airspeed limitations, flight control limitations, and approach procedures when AOA limiter protection is engaged, as specified in ANAC AD 2024-02-02.

o Inspecting all airplane records for instances of AOA limiter protection engagement that occurred after passing the final approach fix inbound, or within 5 miles of the intended point of landing if a final approach fix is not required, and reporting findings to the FAA. The compliance time for the records inspection was at intervals not to exceed 30 days after the effective date of this AD for 12 months after the effective date of this AD. The compliance time for reporting was within 10 after each records inspection.

On July 8, 2025, ANAC issued AD 2024-02-02R1, applicable to all Embraer EMB-545 and EMB-550 airplanes (including variants), to mandate that the flight control computer software modifications developed by Embraer be incorporated within 1,000 flight hours or 24 months of the AD effective date of July 14, 2025.

As of February 2026, the FAA indicated that it planned to release its final rule regarding the Embraer EMB-545 and EMB-550 AOA Limiter about September 2026.

Flight Data Recorder

The airplane was equipped with an L3Harris FA5000 FDR capable of recording a variety of flight control, engine, and systems parameters. (The FDR was not required by regulation because the airplane was operated under the provisions of 14 CFR Part 91K and had an eight-passenger seat configuration.) The FDR recorded data in a digital format using solid-state flash memory.

The FDR was in good condition, and the data were extracted normally. The recording contained about 69 hours of data. The accident flight was the last flight of the recording, and its duration was about 1 hour 57 minutes. The FDR data (including time, airspeed, pitch, sidestick control position, elevator and aileron positions, and other parameters) were used to correlate the timing of events captured by the CVR and to support the NTSB airplane performance study.

Cockpit Voice Recorder

The airplane was equipped with an L3Harris CVR capable of recording a minimum of 2 hours of digital audio stored on solid state memory modules. (The CVR was required by regulation because the airplane was a multiengine aircraft with more than six passenger seats, required two pilots, and was manufactured after April 7, 2010.)

The CVR was in good condition, and 120 minutes audio data were extracted normally from the recorder. Four channels were recorded: one channel for each flight crew, one channel for a cockpit observer, and one channel for the cockpit area microphone.

The recording began two flights before the accident flight while the airplane was en route to Boston Logan International Airport (BOS), Boston, Massachusetts, with a different flight crew. The flight landed uneventfully. There was a power cycle, and the next recording captured the accident flight crew’s first flight from BOS to HPN, which landed uneventfully.

The accident flight began at 1230:16 as the airplane was powered up for the flight from HPN to SSI. The CVR transcript starts with audio from 1420:39, as the airplane began its descent into SSI. The flight crew at times engaged in nonessential conversation while approaching the airport. (At the time of the accident, the Flexjet Flight Operations Manual specified that flight crews should maintain a “sterile cockpit” environment by not engaging in nonessential conversation during all critical phases of flight, which included any flight operations below 10,000 ft agl, except normal cruise flight.)

The recording (as correlated with the FDR data) revealed that the flight crew received a TAWS “sink rate” aural alert at 1436:28 when the airplane was between 100 and 40 ft, and they reacted in surprise. The airplane impacted the ground at 1436:32. As the airplane came to a stop at 1436:56, the flight crew communicated with airport fire and rescue. The recording ended about 12 minutes later.

Certification History

In Brazil, Embraer EMB-545 airplanes were certificated in accordance with Brazilian Civil Aviation Regulations Part 25 and listed on National Civil Aviation Agency (ANAC) Type Certificate Data Sheet (TCDS) EA-2014T04. Embraer received its ANAC type certificate for model EMB-550 (Legacy 500) in August 2014; model EMB-545 (Legacy 450) in August 2015, the EMB-550 MOD variant (Praetor 600) in April 2019, and the EMB-545 MOD variant (Praetor 500) in August 2019.

In the United States, on May 14, 2009, Embraer applied for a type certificate under 14 CFR Part 25. The FAA determined that these airworthiness regulations did not contain adequate or appropriate safety standards to address the airplane’s AOA limiter protection system, which the FAA considered a “novel/unusual design feature.” As a result, in accordance with 14 CFR 21.6, the FAA applied special conditions to the airplane to establish an equivalent level of safety as provided in Part 25 for reference stall speeds, stall warning, stall characteristics, and other minimum reference speeds.

On September 3, 2014, the FAA issued special conditions No. 25-564-SC, “Special Conditions: Embraer S.A. Model EMB-550 Airplane Flight Envelope Protection: High Incidence Protection System” (with a minor correction issued on October 2, 2014). The special conditions (which also applied to any other similarly equipped airplane models added to the type certificate, such as the Embraer EMB-545 MOD) considered that the AOA limiter protection system “replaces the traditional stall warning system, prohibits the airplane from stalling, limits the [AOA] at which the airplane can be flown during normal low-speed operations, …cannot be overridden by the flight crew, …[and] impacts…the [airplane’s] longitudinal handling characteristics.” The special conditions were intended to establish a level of safety equivalent to the current regulations for reference stall speeds, stall warning, stall characteristics, and other miscellaneous minimum reference speeds.

Embraer received an FAA type certificate for model EMB-550 in October 2014, model EMB-545 in August 2015, the model EMB-550 MOD variant in May 2019, and the model EMB-545 MOD variant in October 2019, as reflected on FAA TCDS TC00062IB. At the time of the accident, Embraer had delivered about 273 of these four models worldwide.

Terrain Awareness and Warning System

As stated in the Airplane Information section, the accident airplane was equipped with a Honeywell TPM-6000 TAWS module with the reactive windshear feature disabled. Honeywell was asked to provide an analysis based on the FDR data to determine if the reactive windshear feature, if enabled, may have alerted during the approach.

The review found that the maximum recorded shear value, which occurred when the airplane was about 144 ft agl and about 0.25 nm from the displaced threshold of runway 4, was about 60% of the amount required to trigger an alert.

As stated in the Flight Recorders section, the flight crew received a “sink rate” aural alert. The input of FDR data into the TAWS module did result in a TAWS Mode 1 (excessive descent rate) “sink rate, sink rate” aural alert close to touchdown beginning at 79 ft agl with a second “sink rate, sink rate” aural alert about 10 ft agl, which is the lower limit for Mode 1 alerts.

Airplane Performance Study and Systems Review

The NTSB airplane performance study determined that the airplane’s sudden increase in AOA at 1436:19 (as described in the History of Flight section) went from about 7.0° to 12.8° within a 2-second span, and the AOA limiter protection engaged. The FDR data showed that the AOA increase, which was accompanied by an 8-kt airspeed loss and vertical g force increase of 0.2 g, was not commanded by the pilot.

The airplane’s AOA then decreased from 12.8° to less than 5° for most of the 13 seconds preceding the touchdown. The study determined that, based on the maximum AOA limit defined for the flap setting used for the approach, about 10° of AOA or stall margin remained that the flight crew was unable to use during the landing because the AOA limiter protection was engaged. The airplane touched down about -1,000 ft per minute vertical speed and exhibited a 3.5-g spike in vertical acceleration.

The NTSB airplane systems review determined that, based on the FDR data, after the AOA limiter protection engaged, the airplane’s AOA quickly reduced and did not again reach the engagement threshold for the remainder of the flight. According to Embraer, the airplane’s reduced response to sidestick pitch inputs during the 13 seconds before touchdown was consistent with the AOA limiter protection control laws. The AOA limiter protection did not subsequently disengage because the frequency and amplitude of the pilot’s oscillating sidestick pitch commands prevented the criterion for disengagement condition 3 (as described in the Aircraft and Owner/Operation Information section) from being met.

Flexjet, headquartered in Richmond Heights, Ohio, first entered the fractional jet ownership market in 1995 as a division of Bombardier Aerospace. At the time of the accident, it was owned by Directional Aviation, an aviation private investment firm.?Flexjet offered fractional jet ownership and leasing, had a helicopter division, and operated a maintenance and product support infrastructure, with operations in the U.S., Canada, and Europe.

At the time of the accident, Flexjet employed about 1,226 pilots and operated about 254 aircraft, 55 of which were Embraer EMB-545 MOD or EMB-550 MOD airplanes. Flexjet had a formal Threat and Error Management Program, an FAA-accepted safety management system, and a formal flight data monitoring (FDM) program.