What happened
On 27 November 2017, an Embraer Legacy 500, registration RA-02788, was performing a cross-country flight from Moscow-Domodedovo to Paris-Le Bourget. Prior to departure from Moscow, the aircraft had been de-iced due to a thin film of ice on the airframe. During engine start-up, the crew set the ice protection control panel to the 'ALL' position, which triggered an 'A-I WINGSTAB FAIL' message on the EICAS. Although the crew attempted to reinitialize the system, the failure message persisted.
During the climb, a 'STALL PROT ANTICIPATE' message appeared, indicating that the angle-of-attack (AOA) limiter protection thresholds had been increased due to the unoperational anti-icing system. Upon arrival at Le Bourget, the crew conducted an ILS 27 approach at speeds between 120 and 130 kt. At approximately 1,000 ft, the AOA limiter protection activated, disengaging the autopilot. Despite the pilot's full nose-up sidestick input, the protection prevented the necessary pitch attitude for a flare. The aircraft subsequently made a hard landing with a descent rate of approximately 1,35/min and a 4g load factor, causing the right main landing gear to rupture and damaging the wing surface.
The investigation
The BEA examined the flight data recorder (FDR), cockpit voice recorder (CVR), and the aircraft's Onboard Maintenance System (OMS). The investigation focused on the sequence of events leading to the activation of the AOA limiter and the crew's handling of the anti-icing system failure. Investigators reviewed the aircraft's maintenance logs, the flight manual procedures for 'A-I WINGSTAB FAIL' and 'STALL PROT ANTICIPATE', and the Master Minimum Equipment List (MMEL) requirements regarding flight in icing conditions.
Findings
- The crew initiated the anti-icing system 'ALL' setting before engine start-up, which was contrary to the flight manual and caused the initial failure message.
- The crew failed to follow the 'STALL PROT ANTICIPATE' procedure, which required increasing the reference landing speed by 30 kt (to 144 kt) and increasing the landing distance calculation.
- The crew elected to take off despite the 'A-I WINGSTAB FAIL' message and known icing conditions at the departure airport, which violated MMEL restrictions.
- The activation of the AOA limiter protection prevented the pilot from achieving the pitch attitude required for a proper flare.
- The 'A-I WINGSTAB FAIL' procedure was found to be incomplete, as it did not specify that the 'ICE PROT MODE' selector must be set to 'AUTO' before attempting to reinitialize the system.
Safety action
Following the investigation, Embraer updated the flight manuals for the Legacy 450 and 500 to specify that the 'ICE PROT MODE' selector must be set to 'AUTO' during the 'A-I WINGSTAB FAIL' procedure.