Aircraft Accident/Incident Report

Nogales, Arizona 85621
Tuesady, April 25, 2006 3:50 MST

The unmanned aircraft (UA), a Predator B, collided with the terrain following a loss of engine power while patrolling the southern U.S. border on a Customs and Border Protection (CPB) mission. The UA's takeoff was delayed due to the inability to establish a communication link between the UA and Pilot Payload Operator (PPO)-1 console during initial power-up. After troubleshooting the problem, an avionics technician switched the main processor cards between PPO-1 and PPO-2. Personnel who were maintaining the unmanned aircraft system (UAS) stated there were very few spare parts purchased with the UAS, which is why they switched the main processor cards instead of replacing the card in PPO-1. The link was subsequently established, and the flight was initiated. The flight was being flown from a ground control station (GCS), which contained two nearly identical control consoles: PPO-1 and PPO-2. Normally, a certified pilot controls the UA from PPO-1, and the camera payload operator (typically a U.S. Border Patrol agent) controls the camera, which is mounted on the UA, from PPO-2. Although the aircraft control levers (flaps, condition lever, throttle, and speed lever) on PPO-1 and PPO-2 appear identical, they may have different functions depending on which console controls the UA. When PPO-1 controls the UA, movement the condition lever to the forward position opens the fuel valve to the engine; movement to the middle position closes the fuel valve to the engine, which shuts down the engine; and movement to the aft position causes the propeller to feather. When the UA is controlled by PPO-1, the condition lever at the PPO-2 console controls the camera's iris setting. Moving the lever forward increases the iris opening, moving the lever to the middle position locks the camera's iris setting, and moving the lever aft decreases the opening. Typically, the lever is set in the middle position. Console lockup checklist procedures indicate that, before switching operational control between the two consoles, the pilot must match the control positions on PPO?2 to those on PPO-1 by moving the PPO-2 condition lever from the middle position to the forward position, which keeps the engine operating. The pilot stated in a postaccident interview that, during the flight, PPO-1 locked up, so he switched control of the UA to PPO-2. In doing so, he did not use the checklist and failed to match the position of the controls on PPO-2 to how they were set on PPO-1. This resulted in the condition lever being in the fuel cutoff position when the switch to PPO-2 was made, and the fuel supply to the engine was shut off. With no engine power, the UA began to descend. The pilot realized that the UA was not maintaining altitude but did not immediately identify that the condition lever was in the fuel cutoff position. The pilot and avionics technician decided to shut down the entire system and send the UA into its lost-link profile, which is a predetermined autonomous flightpath, until they could figure out what the problem was. After the system was shut down, the UA descended below line of sight (LOS), and communications could not be reestablished. The UA began to fly its lost-link profile as it descended to impact with the terrain. When the UA lost engine power, it began to operate on battery power. On battery power, the UA began to shed electrical equipment to conserve electrical power. In doing so, electrical power to the transponder was shut down. This resulted in air traffic control not being able to detect a Mode C transponder return for the UA as it descended below the bottom of the temporary flight restricted airspace. The primary radar return was also lost when the UA descended below the LOS in the mountainous area. The investigation revealed a series of computer lockups had occurred since the CBP UAS began operating. Nine lockups occurred in a 3-month period before the accident, including 2 on the day of the accident before takeoff and another on April 19, 2006, 6 days before the accident. Troubleshooting before and after the accident did not determine the cause of the lockups. Neither the CBP nor its contractors had a documented maintenance program that ensured that maintenance tasks were performed correctly and that comprehensive root-cause analyses and corrective action procedures were required when failures, such as console lockups, occurred repeatedly. Review of the CBP's training records showed that the accident pilot had recently transitioned from flying the Predator A to flying the Predator B and had only 27 hours of Predator B flight time. According to the CBP, the pilot was given verbal approval to fly its Predator B with the caveat that the pilot's instructor would be present in the GCS when the pilot was flying. This verbal approval was not standard practice for the CBP. The instructor pilot was in another building on the airport and did not enter the GCS until after it was shut down and the UA entered the lost-link procedure. The investigation also revealed that the CBP was providing a minimal amount of operational oversight for the UAS program at the time of the accident.

The pilot's failure to use checklist procedures when switching operational control from PPO-1 to PPO-2, which resulted in the fuel valve inadvertently being shut off and the subsequent total loss of engine power, and lack of a flight instructor in the GCS, as required by the CBP's approval to allow the pilot to fly the Predator B. Factors associated with the accident were repeated and unresolved console lockups, inadequate maintenance procedures performed by the manufacturer, and the operator's inadequate surveillance of the UAS program.