GENERAL ATOMICS PREDATOR B
Nogales, AZ, USA · 2006-04-25·UNREG
What happened
NTSB summary, verbatimThe unmanned aircraft (UA), a Predator B, collided with the terrain following a loss of engine power while patrolling the southern U.S. border on a Customs and Border Protection (CPB) mission. The UA's takeoff was delayed due to the inability to establish a communication link between the UA and Pilot Payload Operator (PPO)-1 console during initial power-up. After troubleshooting the problem, an avionics technician switched the main processor cards between PPO-1 and PPO-2. Personnel who were maintaining the unmanned aircraft system (UAS) stated there were very few spare parts purchased with the UAS, which is why they switched the main processor cards instead of replacing the card in PPO-1. The link was subsequently established, and the flight was initiated. The flight was being flown from a ground control station (GCS), which contained two nearly identical control consoles: PPO-1 and PPO-2. Normally, a certified pilot controls the UA from PPO-1, and the camera payload operator (typically a U.S. Border Patrol agent) controls the camera, which is mounted on the UA, from PPO-2. Although the aircraft control levers (flaps, condition lever, throttle, and speed lever) on PPO-1 and PPO-2 appear identical, they may have different functions depending on which console controls the UA. When PPO-1 controls the UA, movement the condition lever to the forward position opens the fuel valve to the engine; movement to the middle position closes the fuel valve to the engine, which shuts down the engine; and movement to the aft position causes the propeller to feather. When the UA is controlled by PPO-1, the condition lever at the PPO-2 console controls the camera's iris setting. Moving the lever forward increases the iris opening, moving the lever to the middle position locks the camera's iris setting, and moving the lever aft decreases the opening. Typically, the lever is set in the middle position. Console lockup checklist procedures indicate that, before switching operational control between the two consoles, the pilot must match the control positions on PPO?2 to those on PPO-1 by moving the PPO-2 condition lever from the middle position to the forward position, which keeps the engine operating. The pilot stated in a postaccident interview that, during the flight, PPO-1 locked up, so he switched control of the UA to PPO-2. In doing so, he did not use the checklist and failed to match the position of the controls on PPO-2 to how they were set on PPO-1. This resulted in the condition lever being in the fuel cutoff position when the switch to PPO-2 was made, and the fuel supply to the engine was shut off. With no engine power, the UA began to descend. The pilot realized that the UA was not maintaining altitude but did not immediately identify that the condition lever was in the fuel cutoff position. The pilot and avionics technician decided to shut down the entire system and send the UA into its lost-link profile, which is a predetermined autonomous flightpath, until they could figure out what the problem was. After the system was shut down, the UA descended below line of sight (LOS), and communications could not be reestablished. The UA began to fly its lost-link profile as it descended to impact with the terrain. When the UA lost engine power, it began to operate on battery power. On battery power, the UA began to shed electrical equipment to conserve electrical power. In doing so, electrical power to the transponder was shut down. This resulted in air traffic control not being able to detect a Mode C transponder return for the UA as it descended below the bottom of the temporary flight restricted airspace. The primary radar return was also lost when the UA descended below the LOS in the mountainous area. The investigation revealed a series of computer lockups had occurred since the CBP UAS began operating. Nine lockups occurred in a 3-month period before the accident, including 2 on the day of the accident before takeoff and another on April 19, 2006, 6 days before the accident. Troubleshooting before and after the accident did not determine the cause of the lockups. Neither the CBP nor its contractors had a documented maintenance program that ensured that maintenance tasks were performed correctly and that comprehensive root-cause analyses and corrective action procedures were required when failures, such as console lockups, occurred repeatedly. Review of the CBP's training records showed that the accident pilot had recently transitioned from flying the Predator A to flying the Predator B and had only 27 hours of Predator B flight time. According to the CBP, the pilot was given verbal approval to fly its Predator B with the caveat that the pilot's instructor would be present in the GCS when the pilot was flying. This verbal approval was not standard practice for the CBP. The instructor pilot was in another building on the airport and did not enter the GCS until after it was shut down and the UA entered the lost-link procedure. The investigation also revealed that the CBP was providing a minimal amount of operational oversight for the UAS program at the time of the accident.
Photographs
15the aircraft, and what the investigators foundPhotographs are NTSB docket attachments — works of the US government, in the public domain. Captions are the Board’s own.
Probable cause
the Board's determinationThe pilot's failure to use checklist procedures when switching operational control from PPO-1 to PPO-2, which resulted in the fuel valve inadvertently being shut off and the subsequent total loss of engine power, and lack of a flight instructor in the GCS, as required by the CBP's approval to allow the pilot to fly the Predator B. Factors associated with the accident were repeated and unresolved console lockups, inadequate maintenance procedures performed by the manufacturer, and the operator's inadequate surveillance of the UAS program.
Safety recommendations
22 issuedwhat changed because of this accidentTO THE FEDERAL AVIATION ADMINISTRATION: Require that unmanned aircraft transponders provide beacon code and altitude information to air traffic control and to aircraft equipped with traffic alert and collision avoidance systems (TCAS) at all times while airborne by ensuring that the transponder is powered via the emergency or battery bus.
TO THE FEDERAL AVIATION ADMINISTRATION: Require that all conversations, including telephone conversations, between unmanned aircraft (UA) pilots and air traffic control, other UA pilots, and other assets that provide operational support to unmanned aircraft system operations, be recorded and retained in accordance with Federal Aviation Administration Orders 7210.3 and 8020.11.
TO THE FEDERAL AVIATION ADMINISTRATION: Require periodic operational reviews between the unmanned aircraft system (UAS) operations teams and local air traffic control facilities, with specific emphasis on face-to-face coordination between working-level controllers and unmanned aircraft pilot(s), to clearly define responsibilities and actions required for standard and nonstandard UAS operations. These operational reviews should include, but not be limited to, discussion on lost-link profiles and procedures, the potential for unique emergency situations and methods to mitigate them, platform-specific aircraft characteristics, and airspace management procedures.
TO THE FEDERAL AVIATION ADMINISTRATION: Require that established procedures for handling piloted aircraft emergencies be applied to unmanned aircraft systems.
TO THE FEDERAL AVIATION ADMINISTRATION: Require that all unmanned aircraft system operators report to the Federal Aviation Administration, in writing within 30 days of occurrence, all incidents and malfunctions that affect safety; require that operators are analyzing these data in an effort to improve safety; and evaluate these data to determine whether programs and procedures, including those under air traffic control, remain effective in mitigating safety risks.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require General Atomics Aeronautical Systems, Inc., to modify the unmanned aircraft system to ensure that inadvertent engine shutdowns do not occur.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require General Atomics Aeronautical Systems, Inc., to modify the unmanned aircraft system to provide adequate visual and aural indications of safety-critical faults, such as engine-out conditions and console lockups, and present them in order of priority, based on the urgency for pilot awareness and response.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Review the U.S. Customs and Border Protection’s methods of developing lost-link mission profiles to ensure that lost-link mission profile routes minimize the potential safety impact to persons on the ground, optimize the ability to recover the data link, and, in the absence of data-link recovery, provide the capability to proceed to a safe zone for a crash landing.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Following completion of the action requested in Safety Recommendation A-07-72, require that pilots be trained concerning the expected performance and flightpath of the unmanned aircraft during a lost-link mission.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require that the unmanned aircraft system be modified to ensure that the transponder continues to provide beacon code and altitude information to air traffic control even if an engine shuts down in flight and that the pilot is provided a clear indication if transponder function is lost for any reason.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Review all unmanned aircraft system (UAS) functions and require necessary design changes to the UASs that the U.S. Customs and Border Protection operates to ensure that electrical power is available for an appropriate amount of time to all systems essential to unmanned aircraft control following loss of engine power.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Develop a means of restarting the unmanned aircraft (UA) engine during the lost-link emergency mission profile that does not rely on line-of-sight control, for example, through an autonomous capability in the unmanned aircraft system’s control system or through use of control functions enabled via a backup satellite communication system available to the pilot on the ground.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Participate in periodic operational reviews between the unmanned aircraft system operations team and local air traffic control facilities, with specific emphasis on face-to-face coordination between the working-level controller and unmanned aircraft (UA) pilot(s), to clearly define responsibilities and actions required for standard and nonstandard UA operations. These operational reviews should include, but not be limited to, discussion on lost-link profiles and procedures, the potential for unique emergency situations and methods to mitigate them, platform-specific aircraft characteristics, and airspace management procedures.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require that all conversations, including telephone conversations, between unmanned aircraft (UA) pilots and air traffic control, other UA pilots, and other assets that provide operational support to UA operations, be recorded and retained to support accident investigations.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Identify and correct the causes of the console lockups.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Implement a documented maintenance and inspection program that identifies, tracks, and resolves the root cause of systemic deficiencies and that includes steps for in-depth troubleshooting, repair, and verification of functionality before returning aircraft to service.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require that aviation engineering and maintenance experts oversee the definition of maintenance tasks, establishment of inspection criteria, and the implementation of such programs. Also, ensure oversight of contractor(s) implementing such programs.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Develop minimum equipment lists and dispatch deviation guides for the U.S. Customs and Border Protection’s unmanned aircraft system operations.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Assess the spare-parts requirements for U.S. Customs and Border Protection’s unmanned aircraft operations to ensure the availability of parts critical to unmanned aircraft launch, as defined by the minimum equipment list .
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Revise U.S. Customs and Border Protection’s pilot training program to ensure pilot proficiency in executing emergency procedures.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Require that a backup pilot or another person who can provide an equivalent level of safety as a backup pilot be readily available during the operation of an unmanned aircraft system.
TO UNITED STATES CUSTOMS AND BORDER PROTECTION: Develop a safety plan, which ensures that hazards to the National Airspace System and persons on the ground introduced by the U.S. Customs and Border Protection’s (CBP) unmanned aircraft system (UAS) operation are identified and that necessary actions are taken to mitigate the corresponding safety risks to the public over the life of the program. The plan should include, as a minimum, design requirements, emergency procedures, and maintenance program requirements to minimize the safety impact of UAS malfunctions in flight, continuous monitoring of the CBP’s unmanned aircraft operation, analysis of malfunctions and incidents, and lessons learned from other operators of similar UAS designs.
NTSB analysis
from the final reportThe unmanned aircraft (UA), a Predator B, collided with the terrain following a loss of engine power while patrolling the southern U.S. border on a Customs and Border Protection (CPB) mission. The UA's takeoff was delayed due to the inability to establish a communication link between the UA and Pilot Payload Operator (PPO)-1 console during initial power-up. After troubleshooting the problem, an avionics technician switched the main processor cards between PPO-1 and PPO-2. Personnel who were maintaining the unmanned aircraft system (UAS) stated there were very few spare parts purchased with the UAS, which is why they switched the main processor cards instead of replacing the card in PPO-1. The link was subsequently established, and the flight was initiated. The flight was being flown from a ground control station (GCS), which contained two nearly identical control consoles: PPO-1 and PPO-2. Normally, a certified pilot controls the UA from PPO-1, and the camera payload operator (typically a U.S. Border Patrol agent) controls the camera, which is mounted on the UA, from PPO-2. Although the aircraft control levers (flaps, condition lever, throttle, and speed lever) on PPO-1 and PPO-2 appear identical, they may have different functions depending on which console controls the UA. When PPO-1 controls the UA, movement the condition lever to the forward position opens the fuel valve to the engine; movement to the middle position closes the fuel valve to the engine, which shuts down the engine; and movement to the aft position causes the propeller to feather. When the UA is controlled by PPO-1, the condition lever at the PPO-2 console controls the camera's iris setting. Moving the lever forward increases the iris opening, moving the lever to the middle position locks the camera's iris setting, and moving the lever aft decreases the opening. Typically, the lever is set in the middle position. Console lockup checklist procedures indicate that, before switching operational control between the two consoles, the pilot must match the control positions on PPO?2 to those on PPO-1 by moving the PPO-2 condition lever from the middle position to the forward position, which keeps the engine operating. The pilot stated in a postaccident interview that, during the flight, PPO-1 locked up, so he switched control of the UA to PPO-2. In doing so, he did not use the checklist and failed to match the position of the controls on PPO-2 to how they were set on PPO-1. This resulted in the condition lever being in the fuel cutoff position when the switch to PPO-2 was made, and the fuel supply to the engine was shut off. With no engine power, the UA began to descend. The pilot realized that the UA was not maintaining altitude but did not immediately identify that the condition lever was in the fuel cutoff position. The pilot and avionics technician decided to shut down the entire system and send the UA into its lost-link profile, which is a predetermined autonomous flightpath, until they could figure out what the problem was. After the system was shut down, the UA descended below line of sight (LOS), and communications could not be reestablished. The UA began to fly its lost-link profile as it descended to impact with the terrain. When the UA lost engine power, it began to operate on battery power. On battery power, the UA began to shed electrical equipment to conserve electrical power. In doing so, electrical power to the transponder was shut down. This resulted in air traffic control not being able to detect a Mode C transponder return for the UA as it descended below the bottom of the temporary flight restricted airspace. The primary radar return was also lost when the UA descended below the LOS in the mountainous area. The investigation revealed a series of computer lockups had occurred since the CBP UAS began operating. Nine lockups occurred in a 3-month period before the accident, including 2 on the day of the accident before takeoff and another on April 19, 2006, 6 days before the accident. Troubleshooting before and after the accident did not determine the cause of the lockups. Neither the CBP nor its contractors had a documented maintenance program that ensured that maintenance tasks were performed correctly and that comprehensive root-cause analyses and corrective action procedures were required when failures, such as console lockups, occurred repeatedly. Review of the CBP's training records showed that the accident pilot had recently transitioned from flying the Predator A to flying the Predator B and had only 27 hours of Predator B flight time. According to the CBP, the pilot was given verbal approval to fly its Predator B with the caveat that the pilot's instructor would be present in the GCS when the pilot was flying. This verbal approval was not standard practice for the CBP. The instructor pilot was in another building on the airport and did not enter the GCS until after it was shut down and the UA entered the lost-link procedure. The investigation also revealed that the CBP was providing a minimal amount of operational oversight for the UAS program at the time of the accident.