Nogales, AZ, USA
UNREG
GENERAL ATOMICS PREDATOR B
The unmanned aircraft (UA), a Predator B, collided with the terrain following a loss of engine power while patrolling the southern U.S. border on a Customs and Border Protection (CPB) mission. The UA's takeoff was delayed due to the inability to establish a communication link between the UA and Pilot Payload Operator (PPO)-1 console during initial power-up. After troubleshooting the problem, an avionics technician switched the main processor cards between PPO-1 and PPO-2. Personnel who were maintaining the unmanned aircraft system (UAS) stated there were very few spare parts purchased with the UAS, which is why they switched the main processor cards instead of replacing the card in PPO-1. The link was subsequently established, and the flight was initiated. The flight was being flown from a ground control station (GCS), which contained two nearly identical control consoles: PPO-1 and PPO-2. Normally, a certified pilot controls the UA from PPO-1, and the camera payload operator (typically a U.S. Border Patrol agent) controls the camera, which is mounted on the UA, from PPO-2. Although the aircraft control levers (flaps, condition lever, throttle, and speed lever) on PPO-1 and PPO-2 appear identical, they may have different functions depending on which console controls the UA. When PPO-1 controls the UA, movement the condition lever to the forward position opens the fuel valve to the engine; movement to the middle position closes the fuel valve to the engine, which shuts down the engine; and movement to the aft position causes the propeller to feather. When the UA is controlled by PPO-1, the condition lever at the PPO-2 console controls the camera's iris setting. Moving the lever forward increases the iris opening, moving the lever to the middle position locks the camera's iris setting, and moving the lever aft decreases the opening. Typically, the lever is set in the middle position. Console lockup checklist procedures indicate that, before switching operational control between the two consoles, the pilot must match the control positions on PPO?2 to those on PPO-1 by moving the PPO-2 condition lever from the middle position to the forward position, which keeps the engine operating. The pilot stated in a postaccident interview that, during the flight, PPO-1 locked up, so he switched control of the UA to PPO-2. In doing so, he did not use the checklist and failed to match the position of the controls on PPO-2 to how they were set on PPO-1. This resulted in the condition lever being in the fuel cutoff position when the switch to PPO-2 was made, and the fuel supply to the engine was shut off. With no engine power, the UA began to descend. The pilot realized that the UA was not maintaining altitude but did not immediately identify that the condition lever was in the fuel cutoff position. The pilot and avionics technician decided to shut down the entire system and send the UA into its lost-link profile, which is a predetermined autonomous flightpath, until they could figure out what the problem was. After the system was shut down, the UA descended below line of sight (LOS), and communications could not be reestablished. The UA began to fly its lost-link profile as it descended to impact with the terrain. When the UA lost engine power, it began to operate on battery power. On battery power, the UA began to shed electrical equipment to conserve electrical power. In doing so, electrical power to the transponder was shut down. This resulted in air traffic control not being able to detect a Mode C transponder return for the UA as it descended below the bottom of the temporary flight restricted airspace. The primary radar return was also lost when the UA descended below the LOS in the mountainous area. The investigation revealed a series of computer lockups had occurred since the CBP UAS began operating. Nine lockups occurred in a 3-month period before the accident, including 2 on the day of the accident before takeoff and another on April 19, 2006, 6 days before the accident. Troubleshooting before and after the accident did not determine the cause of the lockups. Neither the CBP nor its contractors had a documented maintenance program that ensured that maintenance tasks were performed correctly and that comprehensive root-cause analyses and corrective action procedures were required when failures, such as console lockups, occurred repeatedly. Review of the CBP's training records showed that the accident pilot had recently transitioned from flying the Predator A to flying the Predator B and had only 27 hours of Predator B flight time. According to the CBP, the pilot was given verbal approval to fly its Predator B with the caveat that the pilot's instructor would be present in the GCS when the pilot was flying. This verbal approval was not standard practice for the CBP. The instructor pilot was in another building on the airport and did not enter the GCS until after it was shut down and the UA entered the lost-link procedure. The investigation also revealed that the CBP was providing a minimal amount of operational oversight for the UAS program at the time of the accident.
History of FlightOn April 25, 2006, about 0350 mountain standard time, a MQ-9 (Predator B) aircraft, serial number BP-101, call sign OMAHA 10, collided with the terrain approximately 10 nautical miles northwest of the Nogales International Airport (OLS), Nogales, Arizona. The unmanned aircraft system (UAS) was owned by U.S. Customs and Border Protection (CBP) and operated as a public-use aircraft. The flight was operating in night visual meteorological conditions (VMC). An instrument flight rules (IFR) flight plan had been filed and activated for the flight. The unmanned aircraft (UA) sustained substantial damage. There were no injuries to persons on the ground. The flight originated from the Libby Army Airfield (FHU), Sierra Vista, Arizona, at 1851, on April 24, 2006. The wreckage was located at 0630. The flight was being flown from a ground control station (GCS) located at FHU. The GCS contains two nearly identical pilot payload operator (PPO) consoles, PPO-1 and PPO-2. Normally, a certified pilot controls the UA from PPO-1, and the camera payload operator (typically a U.S. Border Patrol agent) controls the camera, which is mounted on the UA, from PPO-2. Although the aircraft control levers (flaps, condition lever, throttle, and speed lever) on PPO-1 and PPO-2 appear identical, they may have different functions depending on which console controls the UA. When PPO-1 controls the UA, movement the condition lever to the forward position opens the fuel valve to the engine; movement to the middle position closes the fuel valve to the engine, which shuts down the engine; and movement to the aft position causes the propeller to feather. When the UA is controlled by PPO-1, the condition lever at the PPO-2 console controls the camera's iris setting. Moving the lever forward increases the iris opening, moving the lever to the middle position locks the camera's iris setting, and moving the lever aft decreases the opening. Typically, the lever is set in the middle position. In addition to the pilot and payload operator, other personnel present in the GCS were an avionics technician and a sensor operator, both of whom are General Atomics Aeronautical Systems, Inc. (GA-ASI) employees. GA-ASI manufactures the Predator B and was contracted by CBP to fly and maintain BP-101. The flight was originally scheduled to take off at 1700 but was delayed because of the inability to establish a communication link between the UA and PPO-1 during initial power up. The avionics technician stated he powered down the UA and downloaded the system status. He then recycled the power on PPO-1 and PPO-2, but again he was not able to establish an uplink on PPO-1. The technician did not attempt to gain an uplink on PPO-2 during either of these power-ups. The technician reported that he again captured the system status data on his laptop and called his supervisor at the manufacturer's facility in California for assistance. He reported that his supervisor and the technical support personnel with whom he spoke had not seen this type of problem before. They recommended that he switch the main processor cards between PPO-1 and PPO-2. The technician stated that he did this, powered up the system, and was able to establish an uplink on both PPO-1 and PPO-2. He stated that everything operated normally at this point, and he went off duty at 2000. Because the UA typically stays airborne for extended periods of time, more than one pilot is scheduled to fly during each mission. The pilots rotate flying duties every couple of hours throughout the duration of the flight. The pilot who was flying the initial part of the accident flight, including the takeoff, was not the accident pilot. The accident pilot reported that he was scheduled to work from 1900 on April 24, 2006, until 0500 on the day of the accident. The accident pilot reported that he took control of the flight at 1900 when BP-101 was already airborne and operating in the temporary flight restriction (TFR) airspace. He reported that he flew from 1900 until 2100. At 2100, another pilot resumed control of the flight. The accident pilot took control of the flight again at 0300 and was scheduled to fly until 0500. He stated that the change-over briefing at 0300 was normal and that nothing had changed with the flight. He reported that, shortly after he resumed control of the flight, the lower monitor screen went blank on PPO-1. The screen then reappeared, but the telemetry (transmitted data) was locked up, so he decided to switch control of the UA to PPO-2. The pilot stated that he informed the Border Patrol agent who was at PPO-2 that he needed to switch positions. The Border Patrol agent stated that he moved away from PPO-2 and left the GCS. The pilot stated that he verified the ignition was "hot" on PPO-2 and that the stability augmentation system was on. He reported that, at some point, he used his cell phone to call another pilot (who had been his instructor) to discuss what was going on. At the time, the instructor was in a hangar building across the ramp. Checklist procedures state that there should be pilots in both the PPO-1 and PPO-2 seats before switching control of the UA from one PPO to the other. CBP stated that its procedures call for the avionics technician to assume the duties of a co-pilot for the purpose of assisting with the checklist items before switching control from one PPO to the other. This did not occur during the accident sequence. The pilot stated that he did not use the checklist when making the switch. Checklist procedures state that before switching operational control between the two consoles, the pilot must match the control positions on the new console to those on the console that had been controlling the UA. The pilot stated in an interview that he was in a "hurry" and that he failed to do this. The condition lever on PPO-2 was in the fuel cutoff position when the switch from PPO-1 to PPO-2 occurred. As a result, the fuel was cut off to the UA engine when control was transferred to PPO-2. The pilot stated that, after the switch to the PPO-2 console, he noticed that the UA was not maintaining altitude, but he did not know why. He decided to shut down the ground data terminal (GDT) so that the UA would begin its lost-link procedure. This procedure called for the UA to autonomously climb to 15,000 feet above mean sea level (msl) and fly a predetermined course until contact could be reestablished. With no engine power, the UA continued to descend below line-of-sight (LOS) communications, and further attempts to reestablish contact with the UA were not successful. The pilot reported that the instructor pilot entered the GCS shortly after the avionics technician turned off the GDT. He informed the instructor of what occurred, and the instructor looked at the controls and stated that the controls were not positioned correctly. The instructor tried to reestablish contact with BP-101 in both the GCS and the mobile GCS (MGCS); however, BP-101 had already descended below LOS, and contact could not be reestablished. The avionics technician who was positioned at the multifunction workstation (MFW) in the rear of the GCS recalled the events, as follows. He stated that he heard the pilot say that PPO-1 had locked up. He then noticed that the chart display on his monitor had locked up. The technician stated that he walked up to the front of the GCS and looked at the status-warning screen on PPO-2, which indicated that PPO-1 was locked up. He advised the pilot that they needed to switch control to PPO-2. He then went back to the MFW to open up another program, which showed him what processes were running on PPO-1 so that he could record this information. The technician then returned to the front of the GCS, at which time the pilot was using his cell phone to call for support. He advised the pilot again that they needed to switch control from PPO-1 to PPO-2. The technician stated that the pilot switched control to PPO-2 and that the pilot then stated that PPO-2 was also locked up. He then told the pilot that they needed to send the UA into its lost-link procedure by shutting off the GDT. The technician stated that he pulled the plug to the PPO-1 processor rack then switched off the circuit breaker to the GDT. He told the pilot that they needed to go into the MGCS to try and recover the UA because the MGCS was up and running for the entire flight. He stated that he went into the MGCS to make sure that it was ready for the pilot, and, when he returned to the GCS, the other pilot was already there. He stated that he continued to work with the pilots to try and establish link with the UA. Personnel information The pilot, age 35, was employed by GA-ASI. The pilot held a commercial pilot certificate, with single-engine land, multi-engine land, and instrument ratings. He also held a certified flight instructor certificate with single-engine land, multi-engine land, and instrument ratings, along with an advanced ground instructor certificate. The pilot's most recent Federal Aviation Administration (FAA) first-class medical certificate was issued on May 31, 2005. The medical certificate did not contain any limitations. The pilot reported that he had 3,571 total flight hours, which included 519 hours of Predator A flight time and 27 hours of Predator B hours. The 27 hours of Predator B time were flown throughout 9 flights, 5 hours of which were training flights. The 5 hours of training were conducted at the GA-ASI facility in Palmdale, California. There were no Predator B simulators available before the accident, so all of the flight training was accomplished with the actual UAS. At the time of the accident, CBP flight time requirements were 200 hours manned aircraft time and 200 hours UAS flight time. The UAS time was not required to be type specific. CBP required that "All operators shall also be certified by the contractor as being fully capable of maintaining and operating the 'Predator B' UA and its associated equipment." GA-ASI used a training syllabus, which had been approved by the Air Force, to train pilots to operate the CBP UAS for the Air Force. Once a pilot completed the training syllabus, GA-ASI would present the completed training records, which had been approved by the Air Force Government Flight Representative (GFR), to CBP. CBP would then either approve or disapprove the specific pilot to operate the CBP UAS. At the time of the accident, CBP did not have a fully trained GFR on its staff. The pilot's training was documented on several different Department of Defense and Air Force forms. DD Form 2627 indicated that on February 17, 2006, the Air Force GFR approved the pilot to begin MQ-9 training. AFMC Form 68 MQ-9 Pilot Conversion indicated the pilot completed the training on March 24, 2006. On May 5, 2006, which was after the date of this accident, the Air Force GFR disapproved the pilot's request for approval to act as a MQ-9 pilot and cited that the pilot had not completed some training modules. Five of the training events listed on the AFMC Form 68 MQ-9 Pilot Conversion form were not accomplished during the pilot's training. Those events were: Mission Planning/Briefing/Debriefing, Handover Procedures - Ground, Mission Monitor/MFW Procedures, Operational Mission Procedures, and Handover Procedures - Airborne. The training syllabus states that Air Force grading criteria are used to evaluate the pilot's performance during training. According to CBP, GA-ASI contacted their person who was being trained as a GFR and requested that the accident pilot be added to CBP's approved pilot list before the Air Force GFR approval. CBP stated that their GFR trainee gave GA-ASI a verbal approval so that the pilot could operate the CBP UAS but only when an instructor pilot was physically present in the GCS. This verbal approval was not standard practice for CBP. Nowhere in the training records provided to the Safety Board does it list specific training on procedures to switch control of the UAS from one PPO to the other. As previously stated, the majority of the pilot's UAS experience was with the Predator A. The Predator B has different and a more complex engine and engine controls than the Predator A. Also, the control console for the Predator A does not have a condition lever that needs to be matched up between the PPOs when switching from one PPO to the other. Aircraft Information The UA was a MQ-9 (Predator B) aircraft, serial number BP-101, manufactured by GA-ASI. The accident occurred on the UA's 118th flight. The UA typically flew 14-hour missions, 4 days per week, and a shorter mission on the 5th day. According to the flight record, the engine and airframe had accumulated a total of 498 and 1,217 hours, respectively. The Predator B is approximately 36 feet in length with a wingspan of 66 feet. The maximum gross weight is 10,000 pounds. The UA can stay airborne for more than 30 hours at altitudes up to 50,000 feet. The fuselage is a composite structure of impregnated graphite skin and Nomex honeycomb stiffening panels. The fuselage incorporated an avionics bay, fuel bays, an accessory bay, landing gear bays, and an engine bay. The fuel tank bays consisted of three inline bladder fuel tanks located in the forward, header, and aft fuel tank bays. Each wing also contained an inboard and an outboard fuel tank. The aircraft total fuel capacity was 3,920 pounds. The UA was powered by a Honeywell TPE 331-10Y turboprop engine. The engine is mounted at the rear of the fuselage and produces 900-shaft horsepower. The engine controls and indicators located in the GCS were similar to the engine controls for a manned aircraft. The engine was equipped with an in-flight restart capability. A three-bladed, variable pitch McCauley 36FR36C606-B propeller was installed on the aircraft. The pusher propeller was full-feathering and capable of reverse pitch. The most recent maintenance performed on BP-101 was a 200-hour inspection that was performed on April 21, 2006. Interviews with GA-ASI and CBP personnel revealed that, due to limited funding, there was virtually no stock of spare parts at FHU for the BP-101. They stated that, when they needed a part, they would have to wait for it to be shipped from the manufacturer. At the time of the accident, CBP was unable to certify to the FAA that BP-101 was airworthy. Because of national security issues and past experience with similar UASs, the FAA temporarily waived this requirement for the issuance of the Certificate of Waiver or Authorization (COA) to operate in the National Airspace System (NAS). UA Control System The accident UA was operated by means of C-band (signal communications), which provided for LOS control. The UA descended below LOS after the engine stopped producing power. A secondary means of control was provided through the Iridium satellite communication system. However, in the Iridium control mode, there is limited ability to control the UA; under Iridium control, the only way to control the UA is by using autopilot hold modes. All hold modes (altitude, airspeed, and heading) must be active for the Iridium satellite to control of the UA. The hold modes were on before the lost link. If both the Iridium and LOS uplinks are active, the LOS link has priority, and the Iridium data is ignored. However, when the fuel was cut off to the engine and the UA began shedding electrical equipment to conserve battery power, the Iridium system was one of the items that was shed. The UA is also equipped with an auto-ignition system, but this system will not work unless the Iridium system is operable. Lost Link A lost data link occurs when the UA is no longer receiving command/control data from the GCS. In the event of a lost data link between the GCS and UA, the UA will enter a flightpath known as the lost-link profile, which is predetermined and performed autonomously, until the GCS operation can be restored and a data link can be reestablished. The lost-link profile, including the initial lost-link heading and altitude, is uploaded to the UA before every mission Following the accident, it was determined that there were three lost-link profiles stored on the computer in the GCS; only one of which could be activ
The pilot's failure to use checklist procedures when switching operational control from PPO-1 to PPO-2, which resulted in the fuel valve inadvertently being shut off and the subsequent total loss of engine power, and lack of a flight instructor in the GCS, as required by the CBP's approval to allow the pilot to fly the Predator B. Factors associated with the accident were repeated and unresolved console lockups, inadequate maintenance procedures performed by the manufacturer, and the operator's inadequate surveillance of the UAS program.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
