UNITED STATES AIR FORCE ABBREVIATED AIRCRAFT ACCIDENT INVESTIGATION BOARD REPORT

MQ-9A T/N 12-4174 42D ATTACK SQUADRON 432D WING INSTALLATION WITHHELD

LOCATION: UNITED STATES CENTRAL COMMAND AREA OF RESPONSIBILITY DATE OF ACCIDENT: 27 October 2018 BOARD PRESIDENT: COLONEL BARTON D. KENERSON Abbreviated Accident Investigation conducted pursuant to Chapter 12 of Air Force Instruction 51-307

EXECUTIVE SUMMARY UNITED STATES AIR FORCE ABBREVIATED AIRCRAFT ACCIDENT INVESTIGATION

MQ-9A, T/N 12-4174 UNITED STATES CENTRAL COMMAND AREA OF RESPONSIBILITY 27 October 2018

On 27 October 2018, at approximately 1300 local time (L), the mishap aircraft (MA), an MQ-9A, tail number (T/N) 12-4174, crashed approximately 142 nautical miles from the airfield in an undisclosed location within the United States Central Command area of responsibility. At the time of the mishap, the 42d Attack Squadron mission control element was in control of the MA. Loss of Government property is valued at $13,788,693. There were no reported fatalities, injuries, or damage to civilian property.

The mishap crew consisted of the Mishap Pilot (MP1) and Mishap Sensor Operator (MSO). Prior to MP1 taking over the MA, the mid-shift Mishap Pilot observed several issues in the MA: the MA’s exhaust gas temperature (EGT) fluctuated more than normal, the flight control station was not properly displaying any maps, and the MA was not visible on the tracker display. Ground control station (GCS) maintenance personnel determined that the solution was to reset the MA’s rack (the console where the pilot controls the aircraft). MP1 agreed with the proposed plan and entered the GCS. At approximately 0830L, MP1 performed the standard gaining checklists in order to gain control of the MA, along with the rack configuration and presets checklists to ensure the rack and parameters for the MA were set up correctly. MP1 successfully re-established link with the MA and the MA appeared to be functioning normally. However, a “[Digital Electronic Engine Control (DEEC)] – sensor fault” caution message appeared on the heads-down display (HDD). This caution is normally associated with a “DEEC in Backup Mode” warning, which would flash on the HDD in red. That second indicator did not appear on the MA screen. MP1 ran the appropriate checklist and, based on indicators he observed in the MA, believed that the DEEC mode was active. MP1 determined this caution was an anomaly and elected to stay on course.

From approximately 0900L to 1230L, the flight was uneventful. At approximately 1230L, the MSO came on shift and MP1 set the MA in orbit to fly itself while he began documenting the DEEC sensor fault discrepancy in Skynet. MP1 noticed the EGT fluctuating rapidly. Torque and propeller speed began to decrease, resulting in an uncommanded descent. MP1 attempted several automatic and manual engine restarts but was unsuccessful. MP1 was forced to make an emergency landing in a relatively clear area. The destroyed MA was not available for inspection.

The Abbreviated Accident Investigation Board President found, by a preponderance of the evidence, the mishap was caused by: (1) the decoupling of the propeller from the engine, and (2) MP1’s failure to adequately follow the DEEC sensor fault checklist. There was insufficient evidence indicating any substantially contributing factors.

Under 10 U.S.C. § 2254(d) the opinion of the accident investigator as to the cause of, or the factors contributing to, the accident set forth in the accident investigation report, if any, may not be considered as evidence in any civil or criminal proceeding arising from the accident, nor may such information be considered an admission of liability of the United States or by any person referred to in those conclusions or statements. SUMMARY OF FACTS AND STATEMENT OF OPINION MQ-9A, T/N 12-4174 27 October 2018

TABLE OF CONTENTS

ACRONYMS AND ABBREVIATIONS...... iii SUMMARY OF FACTS ...... 2 1. AUTHORITY AND PURPOSE...... 2 a. Authority ...... 2 b. Purpose...... 2 2. ACCIDENT SUMMARY...... 2 3. BACKGROUND ...... 3 a. Air Combat Command (ACC) ...... 3 b. Twelfth Air Force (12 AF)...... 3 c. 432d Wing (432 WG)...... 3 d. 42d Attack Squadron (42 ATKS) ...... 4 e. MQ-9A Reaper...... 4 4. SEQUENCE OF EVENTS ...... 4 a. Mission...... 4 b. Planning ...... 4 c. Preflight...... 5 d. Summary of Accident ...... 5 e. Impact...... 6 f. Egress and Aircrew Flight Equipment...... 7 g. Search and Rescue (SAR)...... 7 h. Recovery of Remains...... 7 5. MAINTENANCE ...... 7 a. Forms Documentation...... 7 b. Inspections ...... 7 c. Maintenance Procedures ...... 7 d. Maintenance Personnel and Supervision ...... 7 e. Fuel, Hydraulic, and Oil Inspection Analyses ...... 8 f. Unscheduled Maintenance...... 8 6. AIRFRAME, MISSILE, OR SPACE VEHICLE SYSTEMS ...... 8 a. Structures and Systems ...... 8 b. Evaluation and Analysis...... 8 7. WEATHER...... 9 a. Forecast Weather...... 9 b. Observed Weather...... 9 c. Space Environment ...... 9 d. Operations...... 9 8. CREW QUALIFICATIONS...... 9 a. Mishap Pilot (MP1)...... 9 b. Mid-Shift Mishap Pilot (MP2)...... 9

MQ-9A, T/N 12-4174, 27 October 2018 i c. Mishap Sensor Operator (MSO1) ...... 10 d. Mid-Shift Mishap Sensor Operator (MSO2) ...... 10 9. MEDICAL ...... 10 a. Qualifications ...... 10 b. Health...... 10 c. Pathology...... 10 d. Lifestyle ...... 11 e. Crew Rest and Crew Duty Time ...... 11 10. OPERATIONS AND SUPERVISION...... 11 a. Operations ...... 11 b. Supervision ...... 11 11. HUMAN FACTORS analysis...... 11 a. Inadequate Real-Time Risk Assessment...... 12 b. Ignored a Caution/Warning...... 12 12. GOVERNING DIRECTIVES AND PUBLICATIONS...... 12 a. Publically Available Directives and Publications Relevant to the Mishap...... 12 b. Other Directives and Publications Relevant to the Mishap ...... 12 c. Known or Suspected Deviations from Directives or Publications...... 13 STATEMENT OF OPINION ...... 14 1. Opinion Summary...... 14 2. Causes ...... 15 a. Decoupling of the Propeller from the Engine ...... 15 b. Failure to Follow the DEEC Sensor Fault Checklist...... 15 3. Substantially Contributing Factor...... 16 4. Conclusion ...... 16 INDEX OF TABS...... 17

MQ-9A, T/N 12-4174, 27 October 2018 ii ACRONYMS AND ABBREVIATIONS

12 AF 12th Air Force ISR Intelligence, Surveillance, and 42 ATKS 42d Attack Squadron Reconnaissance 432 WG 432d Wing L Local Time A1C Airman First Class LR Launch and Recovery AAIB Abbreviated Accident LRE Launch and Recovery Element Investigation Board Lt Lieutenant ACC Air Combat Command MA Mishap Aircraft ADC Area Defense Counsel MC Mishap Crew AFB Air Force Base MCC Mission Control Commander AFETS Air Force Engineering MCE Mission Control Element Technical Service MMSO Mishap Mission Safety Observer AFI Air Force Instruction MP Mishap Pilot AFTO Air Force Technical Order MSO Mishap Sensor Operator AOR Area of Responsibility NM Nautical Miles ASI Air Speed Indicator Ops Operations ATC Air Traffic Control Ops Sup Operations Supervisor CAP Critical Action Procedure ORM Operational Risk Management Capt Captain OSS Operation Support Squadron CAS Close Air Support PAROC Persistent Attack and CC Commander Reconnaissance Operations Center CRM Crew Resource Management PG Propeller Governor DEEC Digital Electronic Engine Control PIC Pilot in Command DO Director of Operations RL Return Link DoD Department of Defense RPA Remotely Piloted Aircraft EFIU Engine and Fuel Interface Unit RPM Revolutions per Minute EGT Exhaust Gas Temperature RTB Return to Base EP Emergency Procedure SAR Search and Rescue FCU Fuel Control Unit SIB Safety Investigation Board ft Feet SIM Simulator GA-ASI General Atomics SIPR Secure Internet Protocol Router Aeronautical Systems, Inc. SOAP Spectrometric Oil Analysis Program GCS Ground Control Station TCTO Time Compliance Technical Order HAT Height Above Target T/N Tail Number HDD Heads-Down Display TO Technical Order HFACS Human Factors Analysis and UCMJ Uniform Code of Military Justice Classification System USAF United States Air Force HUD Heads-Up Display US CENTCOM United States Central HVI High Value Individual Command IFE In-Flight Emergency VIT Variable Information Tables IR Infrared VVI Vertical Velocity Indication Z Zulu Time

The above list derives from the Summary of Facts, the Statement of Opinion, the Index of Tabs, and Witness Testimony (Tab V).

MQ-9A, T/N 12-4174, 27 October 2018 iii SUMMARY OF FACTS

1. AUTHORITY AND PURPOSE

a. Authority

On 17 April 2019, Lieutenant General Christopher P. Weggeman, Deputy Commander, Air Combat Command (ACC), appointed Colonel Barton D. Kenerson as the Abbreviated Accident Investigation Board (AAIB) President to investigate the 27 October 2018 accident involving an MQ-9A aircraft, tail number (T/N) 12-4174 (Tab Y-2 to Y-5). The AAIB conducted their investigation at Nellis Air Force Base (AFB), Nevada (NV), from 26 August 2019 to 30 August 2019, and then remotely from their respective duty locations until 16 October 2019, in accordance with the provisions of Air Force Instruction (AFI) 51-307, Aerospace and Ground Accident Investigations, Chapter 12 (Tab Y-4 to Y-5). A legal advisor (Captain) and a recorder (Staff Sergeant) were also appointed to the AAIB (Tab Y-4). Three Subject Matter Experts were also appointed to advise the board: a medical expert (Colonel), a pilot (Captain), and a maintainer (civilian) (Tab Y-6 to Y-8).

b. Purpose

In accordance with AFI 51-307, this AAIB conducted a legal investigation to inquire into all the facts and circumstances surrounding this Air Force aerospace accident, prepare a publicly releasable report, and obtain and preserve all available evidence for use in litigation, claims, disciplinary action, and adverse administrative action (Tabs Y-4 and BB-8). This investigation was an abbreviated accident investigation, conducted pursuant to Chapter 12 of AFI 51-307 (Tab Y-4).

2. ACCIDENT SUMMARY

On 27 October 2018, at approximately 1300 local time (L), the mishap aircraft (MA), an MQ-9A, T/N 12-4174, assigned to the 432d Wing (432 WG), Creech AFB, NV, crashed approximately 142 nautical miles (NM) from the airfield while conducting an operational mission in an undisclosed location within the United States Central Command (US CENTCOM) area of responsibility (AOR) (Tabs Q-4, R-3, R-18, R-26, R-28, and Y-4). At the time of the incident, the 42d Attack Squadron (42 ATKS) Mission Control Element (MCE) was in control of the MA (Tab V-4.3 and V-4.6 to V-4.7). The MA experienced a sudden loss of engine torque (Tab DD-3). The engine continued to combust but engine torque could not be restored (Tab DD-3). The Mishap Pilot (MP1) made multiple attempts to restart the engine with no success (Tab R-18 to R-20). Ultimately, MP1 was forced to make an emergency landing in a relatively clear area (Tab R-3). The MA was destroyed and not available for inspection (Tabs Q-4 and DD-3). Loss of Government property was valued at $13,788,693 (Tab Q-14).

MQ-9A, T/N 12-4174, 27 October 2018 2 3. BACKGROUND

a. Air Combat Command (ACC)

As the direct successor to Tactical Air Command, ACC is a major command of the United States Air Force (USAF) and the primary provider of air combat forces to America’s warfighting commanders (Tab CC-3). ACC’s primary mission is to support global implementation of national security strategy (Tab CC-3). ACC operates fighter, reconnaissance, battle-management and electronic-combat aircraft (Tab CC-3). It also provides command, control, communications and intelligence systems, and conducts global information operations (Tab CC-3). As the Combat Air Forces lead agent, ACC develops strategy, doctrine, concepts, tactics, and procedures for air-, space-, and cyber-power employment (Tab CC-3). The command provides conventional and information warfare forces to all combatant commands to ensure air, space, cyber, and information superiority for warfighters and national decision-makers (Tab CC-3). The command can also be called upon to assist national agencies with intelligence, surveillance and crisis response capabilities (Tab CC-3).

b. Twelfth Air Force (12 AF)

12 AF (Air Forces Southern) controls ACC’s conventional fighter and bomber forces based in the western United States and serves as the air component for United States Southern Command (Tab CC-4). In its numbered air force role, 12 AF is responsible for the combat readiness of seven active-duty wings and one direct reporting unit (Tab CC-4). These subordinate commands operate more than 800 aircraft with more than 64,000 uniformed and civilian Airmen (Tab CC-4). The command is also responsible for the operational readiness of wings and other units of the Air National Guard (Tab CC-4).

c. 432d Wing (432 WG)

The 432 WG, a veteran combat unit, returned to active service on 1 May 2007 at Creech AFB, NV, and formed the USAF’s first remotely piloted aircraft systems wing (Tab CC-8). In doing so, the 432 WG took charge of existing and rapidly expanding unmanned precision attack and intelligence, surveillance, and reconnaissance combat missions there in support of overseas contingency operations (Tab CC-8). Within a few short years, the 432 WG quadrupled their output of MQ-1 Predator and MQ-9 Reaper combat lines (Tab CC-8). Elements of the wing’s operations and maintenance units underwent transformation in 2016 following the USAF’s decision to retire the MQ-1 Predator fleet from active service (Tab CC-9).

MQ-9A, T/N 12-4174, 27 October 2018 3 d. 42d Attack Squadron (42 ATKS)

The 42 ATKS became the first operational MQ-9 Reaper Squadron in the USAF in 2007 (Tab CC-11). From 27 September 2007, the squadron has provided combatant commanders with deployable precision engagement capabilities for time-critical targets, air interdiction, close air support, strike coordination, and reconnaissance (Tab CC-11).

e. MQ-9A Reaper

The MQ-9A Reaper is an armed, multi-mission, medium-altitude, long- endurance RPA employed primarily against dynamic execution targets and secondarily as an intelligence collection asset (Tab CC-13). Due to its significant loiter time, wide-range sensors, multi-mode communications suite, and precision weapons, the MQ-9A is uniquely qualified to perform strike, coordination, and reconnaissance against high-value, fleeting, and time-sensitive targets (Tab CC-13 to CC-14). MQ-9As can perform the following missions and tasks: intelligence, surveillance, reconnaissance, close air support, combat search and rescue, precision strike, buddy-lase, convoy/raid overwatch, target development, and terminal air guidance (Tab CC-14).

4. SEQUENCE OF EVENTS

a. Mission

At approximately 1230L on 27 October 2018, the MCE mishap crew (MC), consisting of MP1 and the Mishap Sensor Operator (MSO1), was conducting an assigned 432 WG authorized mission in an undisclosed location within the US CENTCOM AOR (Tabs Q-4, R-3, R-26, V-4.3, and Y-4). The MCE was responsible for gaining the aircraft and continuing to conduct a classified mission (Tabs Q-4 and V-4.3). MP1 took control of the MA from the mid-shift Mishap Pilot (MP2) at approximately 0830L (Tab R-3). MP1 initially conducted the mission with the mid-shift Mishap Sensor Operator (MSO2) (Tabs R-17 and V-1.7 to V-1.8). MSO2 was later replaced by MSO1 at approximately 1230L as part of a routine shift change but MP1 remained in the cockpit (Tabs R- 26 and V-4.7). At the time of the mishap, the MC’s mission was to conduct surveillance and gather intelligence (Tab V-1.11).

b. Planning

As part of the MCE mission planning, MP1 and MSO2 attended a mass briefing for their shift to discuss the different mission statuses for each aircraft (Tab V-5.5). MP1 and MSO2 then conducted a separate crew briefing to discuss their specific mission (Tab V-5.5). MP1 and MSO2 then conferred with intelligence personnel to obtain a more detailed status update about their mission (Tab V-5.5). MP1 and MSO2 also met with the Mission Control Commander (MCC), who was responsible for monitoring all of the missions and authorizing crews to fly (Tab V-5.5). MP1 and MSO2 were cleared to fly the MA (Tab V-1.7 and V-5.6).

MQ-9A, T/N 12-4174, 27 October 2018 4 c. Preflight

Prior to MP1 taking over the MA, MP2 flew the MA on 27 October 2018 (Tab V-3.9). During his flight, MP2 observed the MA’s exhaust gas temperature (EGT) fluctuating more than normal (Tab V-3.6). The EGT fluctuated between the minimum and maximum operating range at a larger gap than MP2 had previously seen, and the EGT had once gone below the normal operating range by two to five degrees for approximately five to 10 seconds (Tab V-3.8). MP2 did not notice any changes to the revolutions per minute (RPM) speed or any other indicators that suggested to him that the engine was faulty (Tab V-3.7).

MP2 also experienced an issue with the flight control station in the MA (Tab V-1.8). The tracker display, which is the top monitor in the MA, was not properly displaying any maps and the MA was not visible on the tracker display (Tab V-1.8 and V-3.9). Without the ability to move the maps in the MA, MP2 was unable to update his emergency mission route of flight (Tab V-3.9). Emergency mission dictates where the aircraft goes if the aircraft goes lost link (Tab V-3.9). Given the location of the MA, MP2 was concerned with the possibility of losing the MA (Tab V-3.9). After conferring with Air Traffic Control, MP2 sent the MA in a lost link orbit in order to determine what caused the issue in the MA’s flight control station (Tab V-3.9). MP2 also consulted with Ground Control Station (GCS) maintenance personnel, and GCS maintenance managed to get the MA back on the tracker display but the maps were still not visible (Tab V-3.9 to V-3.10). GCS maintenance determined that the solution was to reset the rack in the MA (Tab V-3.9). The rack is the console where the pilot controls the aircraft (Tab V-3.9).

MP1 arrived at the cockpit right before the rack reset was to be executed (Tab V-3.9). Prior to taking over the MA, MCC briefed MP1 and MSO2 about the MA not properly displaying any maps (Tab V-1.8). When MP1 and MSO2 arrived at the cockpit, GCS maintenance were already preparing to reset the rack (Tab V-1.8). During the changeover briefing between MP2 and MP1, MP2 explained that the MA’s EGT had been fluctuating abnormally during his flight (Tab V-3.10). Additionally, prior to MP1 taking over the MA, MP2 explained the proposed plan to reset the rack and gain the MA (Tab V-3.9 to V-3.10). MP1 agreed with the proposed plan (Tab V-1.8 and V-3.10).

d. Summary of Accident

At approximately 0830L, MP1 entered the GCS (Tabs R-3 and V-3.10). MP2 stayed with MP1 as he performed the standard gaining checklists, including the “Gaining Handover – General” and “Gaining Handover – Airborne,” in order to take control of the MA (Tabs R-17 to R-18 and V-1.8 to V-1.9). MP1 also ran through the rack configuration and presets checklists to ensure the rack and parameters for the MA were set up correctly (Tab R-17 to R-18). A period of lost datalink occurred due to the rack swap (Tab DD-4). Within a few minutes, MP1 re-established link with the MA and the MA appeared to be functioning normally (Tab V-1.8). However, a yellow “[Digital Electronic Engine Control (DEEC)] – sensor fault” caution message appeared on the heads-down display (HDD) (Tab V-1.8 and V-5.9). This caution is normally associated with a “DEEC in Backup Mode” warning, which would flash on the HDD in red (Tab V-1.8). That indicator did not appear on the MA screen (Tab V-1.8).

MQ-9A, T/N 12-4174, 27 October 2018 5 MP1 reviewed the emergency procedures (EPs) associated with the “DEEC – sensor fault” caution message (Tab V-1.8). The caution guides the pilot to run the DEEC failure checklist (Tab V-1.9). MP1 executed the DEEC failure checklist, which directs the pilot to reset the DEEC; however, the DEEC sensor fault caution remained on the HDD (Tab V-1.9). A DEEC failure is indicated by a lack of response to the engine commands or receiving a warning message in the HDD (Tab V-5.9). If the aircraft were in backup mode, the aircraft should speed up to 100% RPM automatically (Tab V-5.9). MP1 observed that he still had control of engine speed, which indicated to MP1 that the DEEC was functioning properly and the MA was not in backup mode (Tab V-1.9). MSO2 also reviewed the Variable Information Tables (VIT) and did not see any abnormalities (Tab V-1.9). The checklist associates the caution warning with a heads-up display (HUD) warning message of “DEEC in Backup Mode,” which was not present on the MA’s HUD (Tab V-1.8). MP1 determined this caution was an anomaly that occurred during the handover from the previous crew (Tab V-1.9). MP1 notified the Operations Supervisor of the caution, and MP1 elected to stay on station (Tab V-1.9). MP2 left at that point (Tab V-1.9). For the next three and a half hours, the flight was normal (Tab DD-5). The MA continued to fly at the commanded altitude and airspeed (Tab DD-5). MSO2 was replaced by MSO1 as part of a routine shift change at approximately 1230L (Tabs R-26, V-4.12, and V-5.8). MSO1 observed the DEEC sensor fault caution when he entered the GCS (Tab V-4.8).

At approximately 1200L, MP1 set the MA in orbit to let the MA fly itself while he began documenting what he believed to be the MA’s DEEC fault discrepancy in Skynet (Tabs R-3 and V-1.9). MP1 noticed the EGT was fluctuating between 10 to 20 degrees up and down rapidly (Tab V-1.9). Before MP1 was able to consult with another cockpit regarding their EGT readings, engine torque decreased and RPM was at approximately 50% (Tab V-1.9). MP1 proceeded to turn off the pre-programmed orbit mode and the altitude hold, and he turned the MA back towards the launch and recovery element (LRE) (Tab V-1.9). At this point, the MA was approximately 142 NM away from the LRE (Tab R-18). According to MP1, there had been no prior indications of an engine malfunction other than the DEEC caution warning (Tab V-1.9). MP1 attempted an air restart but was unsuccessful (Tab V-1.10). MP1 then attempted a manual air restart but was again unsuccessful (Tab V-1.10). MP1 made an emergency radio call and provided the MA’s location but did not receive a response (Tab V-1.10). MP1 determined his only other option was to attempt to feather (turn off) the engine and then attempt an air restart again (Tab V-1.10). The engine completely shut down and MP1 put the condition lever full forward to attempt to perform an air restart (Tab V-1.10). The engine began to restart as indicated by an increase in EGT and RPM; however, the engine failed and was unable to start (Tab V-1.10). MP1 attempted to restart the engine by placing the DEEC in backup mode before attempting an automatic restart (Tab V-1.10). At this point, MP1 made another emergency radio call, providing the MA’s position and altitude (Tab V-1.10). MP1 did not receive any guidance as to how he could further attempt to save the MA (Tab V-1.10). The MC located an area in a mountainous range and made an emergency landing (Tab R-19 to R-20).

e. Impact

The MA impacted terrain approximately 142 NM from the LRE in an undisclosed location at approximately 1300L (Tabs Q-4, R-3, R-18, R-26, and R-28). After several attempts to restart the

MQ-9A, T/N 12-4174, 27 October 2018 6 engine, MP1 was forced to make an emergency landing in a relatively clear area (Tabs R-3, R-19 to R-20, and DD-3). The MA was destroyed and not available for inspection (Tab DD-3).

f. Egress and Aircrew Flight Equipment

Not applicable.

g. Search and Rescue (SAR)

Not applicable.

h. Recovery of Remains

Not applicable.

5. MAINTENANCE

a. Forms Documentation

A review of the maintenance records for the MA leading up to the mishap day revealed significant engine maintenance, but there were no relevant discrepancies or issues and no overdue Time Compliance Technical Orders (TCTOs), time change items, or special inspections (Tabs D-2, U-2 to U-142, DD-8 to DD-9, and EE-4). Prior to launch, the MA was released for flight and cleared pre-flight inspections (Tab U-2).

b. Inspections

At the time of the mishap, the MA accumulated 9920.8 total flight hours and was not overdue for any inspections (Tab D-2). All maintenance inspections were current and complied with relevant authorities (Tab EE-4). An Air Force Technical Order (AFTO) Form 781H, dated 27 October 2018, indicated maintenance personnel inspected the MA prior to its last flight (Tabs U-2 to U-3, and EE-3).

c. Maintenance Procedures

Maintenance personnel conducted all maintenance procedures in accordance with applicable TOs and guidance (Tabs V-7.2 to 7.5 and EE-4).

d. Maintenance Personnel and Supervision

Maintenance personnel documented all pre-flight servicing and maintenance (Tab U-2 to U-9). There was no evidence to suggest that the training, qualifications, and supervision of the maintenance personnel were a factor in this mishap (Tab V-7.2, V-7.4, and V-9.4).

MQ-9A, T/N 12-4174, 27 October 2018 7 e. Fuel, Hydraulic, and Oil Inspection Analyses

According to the MA’s AFTO 781H forms, fluid levels were inspected and found to be adequate to conduct the mishap mission, though the MA was awaiting its last Spectrometric Oil Analysis Program (SOAP) sample analysis at the time of mishap (Tabs U-2 to U-5, DD-3 to DD-4, and DD- 9). At that time, GCS maintenance in the deployed AOR had not received any trending data to suggest there was a possible engine malfunction, but they sent out SOAP samples from the MA for testing (Tab V-7.5). The second to last SOAP sample taken from the MA indicated a minor amount of carbon steel; however, Honeywell Aerospace had not recommended any corrective action (Tab DD-9). When the last SOAP sample analysis returned, the report revealed a trace amount of stainless steel, a minor amount of carbon steel, and a trace amount of alloy steel (Tab DD-9).

Analysis of SOAP samples provide valuable information on engine health trends (Tab DD-17). Prior to the mishap, SOAP samples were already being analyzed as part of an ongoing investigation of spiral retaining ring wear conducted by General Atomics-Aeronautical Systems, Inc. (GA-ASI) and Honeywell Aerospace (Tab DD-3). Metal debris in SOAP samples is categorized from least to most debris as follows: trace, minor, major (Tab DD-9). After the mishap, the spiral retaining ring investigation determined the that the presence of greater than trace amounts of carbon steel and alloy steel in the same sample may be indicative of spiral retaining ring and/or spline coupling wear (Tab DD-3 and DD-15). Most of the instances of previous failures concerning decoupled engines with similar SOAP samples were identified by SOAP testing or at engine overhaul (Tab EE-3).

f. Unscheduled Maintenance

Maintenance documentation revealed no unscheduled maintenance prior to the mishap (Tab EE-4).

6. AIRFRAME, MISSILE, OR SPACE VEHICLE SYSTEMS

a. Structures and Systems

Structures and systems analysis were not conducted because the MA was destroyed, and the MA was not recovered (Tabs Q-4 and FF-2).

b. Evaluation and Analysis

Mishap hardware was not available for inspection as the unrecovered MA impacted terrain and was destroyed in place (Tabs DD-3 and FF-2). However, following the mishap, the MCE classified data logs from the GCS were sent to GA-ASI for review (Tab DD-3). Their data log analysis indicated the loss of engine torque was caused by a decoupling of the propeller from the engine (Tab DD-3). After the decoupling occurred, the data logs confirm the DEEC and Engine and Fuel Interface Unit (EFIU) indicated different but accurate speeds, which is only possible if the propeller was decoupled from the engine (Tab DD-3). Without an analysis of the hardware, GA-

MQ-9A, T/N 12-4174, 27 October 2018 8 ASI could not confirm the root cause of the decoupling, but they determined that the decoupling was most likely the result of a failed spiral retaining ring (also known as the spiral lock ring) inside the gearbox (Tab DD-3). They suspected a failure of the spiral retaining ring because of the history of excessive wear and failure (Tab DD-17).

7. WEATHER

a. Forecast Weather

The weather information briefed prior to the mishap flight indicated no significant weather anticipated at the time of the mishap (Tab F-2).

b. Observed Weather

The weather at the time of the mishap was reported as winds at zero knots with unrestricted visibility (Tab F-9). No significant weather was reported or observed at the time of the mishap (Tabs F-9 and V-1.7).

c. Space Environment

Not applicable.

d. Operations

No evidence suggests the MA operated outside of prescribed operational weather limits (Tab V-1.7 to V-1.10).

8. CREW QUALIFICATIONS

a. Mishap Pilot (MP1)

MP1 was current and qualified to conduct MCE duties in the MQ-9A at the time of the mishap (Tabs G-4 to G-9 and V-1.7). MP1 had 811.5 hours of MQ-9A flight time and 85.3 hours of MQ- 9A simulator time around the time of the mishap (Tab G-10). Recent flight hours were as follows (Tab G-6 and G-7):

Flight Hours Flight Sorties Last 30 Days 30.6 hours 13 Last 60 Days 31.6 hours 14 Last 90 Days 44.5 hours 20

b. Mid-Shift Mishap Pilot (MP2)

MP2 was current and qualified to conduct MCE duties in the MQ-9A at the time of the mishap (Tabs G-34 to G-38 and V-3.5). MP2 had 856.6 hours of MQ-9A flight time and 105.3 hours of

MQ-9A, T/N 12-4174, 27 October 2018 9 MQ-9A simulator time around the time of the mishap (Tab G-39). Recent flight hours were as follows (Tab G-36):

Flight Hours Flight Sorties Last 30 Days 43.6 hours 15 Last 60 Days 69.6 hours 23 Last 90 Days 98.7 hours 32

c. Mishap Sensor Operator (MSO1)

MSO1 was current and qualified to conduct MCE duties in the MQ-9A at the time of the mishap (Tabs G-17 to G-18 and V-4.4). MSO1 had 497.1 hours of MQ-9A flight time and 113.7 hours of MQ-9A simulator time (Tab G-22). Recent flight hours were as follows (Tab G-19):

Flight Hours Flight Sorties Last 30 Days 25.5 hours 7 Last 60 Days 49.5 hours 16 Last 90 Days 89.5 hours 30

d. Mid-Shift Sensor Operator (MSO2)

MSO2 was current and qualified to conduct MCE in the MQ-9A at the time of the mishap (Tabs G-47 to G-48 and V-5.6). MSO2 had 1,922 hours of MQ-9A flight time and 116.9 hours of MQ-9A simulator time (Tab G-52). Recent flight hours were as follows (Tab G-49):

Flight Hours Flight Sorties Last 30 Days 20.0 hours 9 Last 60 Days 59.0 hours 20 Last 90 Days 71.0 hours 23

9. MEDICAL

a. Qualifications

All members were medically qualified for their specific duties at the time of the mishap (Tab EE-5).

b. Health

There was no evidence to suggest the MC’s health contributed to the mishap (Tab EE-5).

c. Pathology

The medical clinic collected toxicology test samples from MP1, MP2, MSO1, and MSO2 after the mishap (Tab EE-5). The reports indicated toxicology was not a factor in the mishap (Tab EE-5).

MQ-9A, T/N 12-4174, 27 October 2018 10 d. Lifestyle

There was no evidence to suggest lifestyle was a factor in the mishap (Tab EE-5).

e. Crew Rest and Crew Duty Time

At the time of the mishap, AFI 11-202, Volume (V) 3, General Flight Rules, ACC Supplement, dated 28 November 2012, indicated aircrew members must have proper crew rest prior to performing any duties involving aircraft operations (Tab BB-5 to BB-6). Paragraph 9.4.5 of the applicable version of AFI 11-202 V3, ACC Supplement, defined crew rest periods as a minimum 12-hour non-duty period before the flight duty period begins (Tab BB-6). Its purpose was to ensure the aircrew member adequately rests before performing flight or flight related duties (Tab BB-6). Crew rest was defined as free time that includes time for meals, transportation, and rest (Tab BB-6). Rest was defined as a condition that allows an individual the opportunity to sleep (Tab BB-6). MP1, MP2, MSO1, and MSO2 verified they received proper sleep before the mishap flight (Tab V-1.7, V-3.6, V-4.5 and V-5.6).

10. OPERATIONS AND SUPERVISION

a. Operations

The operational tempo at the mishap wing was high at the time of the mishap (Tab V-1.4 and V-3.2). A high operational tempo was considered normal for this squadron (Tab V-1.4 and V-3.3). The morale of the unit was high (Tab V-1.4 and V-4.3). The mishap occurred less than six hours into MP1’s shift and 30 minutes into MSO1’s shift (Tab V-3.9, V-4.6, and V-4.12). There is no evidence to suggest the operational tempo contributed to the mishap (Tab V-1.4 and V-4.3).

b. Supervision

MP1, MP2, MSO1, and MSO2 were fully qualified in MCE operations (Tab V-1.7, V-3.5, V-4.4, and V-5.6). The training records show the MC had received all the required training (Tab G-4 and G-17). The MC never felt pressured to fly an aircraft under unsafe conditions (Tab V-1.5 and V-4.3). Further, they were not asked to take unnecessary flight risks by their leadership (Tab V-1.5 and V-4.4). According to the MC, both had received training on how to handle a DEEC sensor fault caution or DEEC failure when it was associated with the DEEC in backup mode (Tab V-1.12 and V-4.9 to 4.10). However, the MC did not receive training on how to proceed if only the DEEC sensor fault caution appeared with no other indicators of an engine malfunction (Tab V-1.12 and V-4.10).

11. HUMAN FACTORS ANALYSIS

The AAIB considered all human factors as prescribed in the Department of Defense Human Factors Analysis and Classification System (DoD HFACS), Version 7.0, to determine whether any human factors were directly related to the mishap (Tab BB-2 to BB-4). The AAIB identified two human factors relevant to the mishap: (1) Inadequate Real-Time Risk Assessment and (2) Ignored

MQ-9A, T/N 12-4174, 27 October 2018 11 a Caution/Warning (Tab BB-3). Both of these factors are considered “Judgment and Decision- Making Errors,” which are factors that occur when an individual proceeds as intended, yet the plan proves inadequate or inappropriate for the situation (e.g. an “honest mistake”) (Tab BB-3).

a. Inadequate Real-Time Risk Assessment

“Inadequate Real-Time Assessment” is a factor when an individual fails to adequately evaluate the risks associated with a particular course of action and this faulty evaluation leads to inappropriate GHFLVLRQဨPDNLQJDQGVXEVHTXHQWXQVDIHVLWXDWLRQV(Tab BB-3). When faced with a DEEC sensor fault warning the pilot is supposed to refer to the DEEC Failure checklist and notify maintenance (Tab EE-6). The checklist concludes that if the DEEC is successfully restarted, the pilot should land as soon as practical (Tabs V-5.11 and EE-6). If the DEEC does not reset, the pilot should land as soon as possible (Tab V-5.11). Land as soon as practical allows the pilot to overfly the nearest acceptable airfield and return to the LRE (Tab V-5.11). Land as soon as possible means the pilot must return directly to the LRE (Tab V-5.11).

MP1 ran the appropriate checklist and, based on indicators he observed in the MA, believed that the DEEC mode was active (Tabs V-1.9 and EE-6). MP1 confirmed his assessment by moving the speed lever and noting a change in the RPM, which should not have occurred if the DEEC were in backup mode (Tabs R-18 and EE-6). At that point, MP1 deemed this caution a nuisance warning and the MC continued with their mission despite the caution remaining (Tabs R-18 and EE-6). MP1 did not speak with aircraft maintenance personnel in the deployed AOR or return to the LRE (Tab EE-7).

b. Ignored a Caution/Warning

“Ignored a Caution/Warning” is a factor when a caution or warning is perceived and understood by the individual but is ignored by the individual (Tab BB-3). MP1 began to troubleshoot the DEEC sensor fault caution message once it appeared in the HDD (Tab V-1.8 to V-1.9). Although MP1 did not initially ignore the warning, he later determined that this warning was an anomaly that likely occurred during the handover (Tab V-1.9). MP1 indicated he disregarded the caution message because the engine performance indications suggested the DEEC was actually functioning correctly (Tab V-1.9).

12. GOVERNING DIRECTIVES AND PUBLICATIONS

a. Publically Available Directives and Publications Relevant to the Mishap

(1) AFI 51-307, Aerospace and Ground Accident Investigations, 18 March 2019 (2) AFI 11-202, Volume 3, General Flight Rules, ACC Supplement, 28 November 2012 (3) AFI 91-204, Safety Investigation and Hazard Reporting, 27 April 2018 (4) AFI 11-2MQ-1&9, Volume 1, MQ-1&9—Aircrew Training, 23 April 2015 (5) AFI 11-2MQ-1&9, Volume 3, MQ-1&9—Operations Procedures, 28 August 2015

b. Other Directives and Publications Relevant to the Mishap

MQ-9A, T/N 12-4174, 27 October 2018 12 (1) DoD HFACS, Version 7.0

c. Known or Suspected Deviations from Directives or Publications

There is no evidence to suggest that any other directive or publication deviations occurred during this mishap.

Digitally signed

3 February 2020 BARTON D. KENERSON, Colonel, USAF President, Abbreviated Accident Investigation Board

MQ-9A, T/N 12-4174, 27 October 2018 13 STATEMENT OF OPINION

MQ-9A, T/N 12-4174 UNITED STATES CENTRAL COMMAND AREA OF RESPONSIBILITY 27 October 2018

Under 10 U.S.C. § 2254(d) the opinion of the accident investigator as to the cause of, or the factors contributing to, the accident set forth in the accident investigation report, if any, may not be considered as evidence in any civil or criminal proceeding arising from the accident, nor may such information be considered an admission of liability of the United States or by any person referred to in those conclusions or statements.

1. OPINION SUMMARY

On 27 October 2018, at approximately 1300 local time (L), the mishap aircraft (MA), an MQ-9A, tail number (T/N) 12-4174, assigned to the 42d Attack Squadron (42 ATKS), 432d Wing (432 WG), under the control of the Mission Control Element (MCE), crashed approximately 142 nautical miles (NM) from the airfield in an undisclosed location. The MA was destroyed upon impact and the loss of Government property was valued at $13,788,693. There were no reported fatalities, injuries, or damage to civilian property.

The MCE mishap crew (MC) was responsible for mission control operations for the MA. The MCE MC consisted of the Mishap Pilot (MP1) and Mishap Sensor Operator (MSO1). The MA was transferred to the MC from another MCE crew. The mid-shift Mishap Pilot (MP2) was the pilot in command prior to MP1 stepping into the Ground Control Station (GCS). Prior to the changeover, MP2 experienced an issue with the MA’s flight control station not displaying any maps. Further, the MA was not visible on the tracker display. After conferring with Air Traffic Control and GCS maintenance personnel, MP2 determined that a rack reset was the best course of action. MP1 elected to enter the GCS as the rack reset was being performed. MP1 performed standard gaining checklists and successfully gained control of the MA.

At approximately 0830L, a yellow Digital Electronic Engine Control (DEEC) sensor fault caution appeared in the heads-down display (HDD). The MC reviewed the appropriate checklist associated with the DEEC sensor fault caution. This caution is typically associated with the DEEC in backup mode, which should appear in the HDD. However, the MC did not receive any notification that the DEEC was in backup mode. Additionally, the MA was still responding to MP1’s commanded engine speed changes, which should not occur if the DEEC were in backup mode.

According to the technical order (TO) for the MQ-9A, the DEEC sensor fault caution drives the pilot to execute the DEEC failure checklist. The DEEC failure checklist requires the pilot to attempt to reset the DEEC. If the DEEC successfully resets, the pilot should “Land as soon as Practicable.” If the DEEC does not reset, the pilot should “Land as soon as Possible.” MP1 indicated he believed the DEEC was active since his engine parameters were not affected. If the aircraft were in backup mode, the aircraft would speed up to 100% RPM automatically. MP1 concluded that the caution was an anomaly and continued with the mission. MP1 flew the

MQ-9A, T/N 12-4174, 27 October 2018 14 MA for approximately three and a half hours longer without incident. MSO2 was replaced by MSO1 approximately 30 minutes prior to the mishap sequence due to a routine shift change.

The MA lost engine thrust at approximately 1300L. The MC made multiple attempts to restart the engine but was unsuccessful. The MC correctly assessed that they would not be able to make it back to the launch and recovery element (LRE). The MC located a relatively clear area to conduct a controlled crash of the MA. The MA impacted the ground approximately 142 NM from the LRE. The MA hardware was destroyed in place and not recovered, so it was not available for inspection.

2. CAUSES

I find by preponderance of the evidence the causes of the mishap were (a) the decoupling of the propeller from the engine, and (b) MP1’s failure to adequately follow the DEEC sensor fault checklist.

a. Decoupling of the Propeller from the Engine

The preponderance of the evidence shows that the decoupling of the propeller from the engine was a cause of the mishap. After the mishap, maintenance personnel pulled the MCE classified data logs from the GCS following the mishap and sent those logs to GA-ASI for review. Data log analysis indicated that the loss of engine torque was caused by a decoupling of the propeller from the engine. Although the root cause of the decoupling could not be confirmed without an analysis of the hardware, GA-ASI determined that the decoupling was most likely the result of a failed spiral retaining ring (also known as the spiral lock ring) inside the gearbox. A failure of the spiral retaining ring is suspected because of the history of excessive wear and failure.

Data logs also confirmed that the DEEC and EFIU indicated different but accurate speeds. According to GA-ASI’s analysis of the mishap, this can only occur if the propeller was decoupled from the engine. Ultimately, the loss of engine torque was caused by the decoupled propeller. Therefore, but for the decoupling, the MA would not have experienced a sudden loss of torque and the MC would not have had to attempt to perform the emergency procedures (EPs) in order to attempt to restart the engine.

b. Failure to Follow the DEEC Sensor Fault Checklist

The preponderance of the evidence shows that MP1’s inadequate assessment of the DEEC sensor fault caution and failure to return to base as soon as practical as directed by the DEEC failure checklist was a cause of the mishap. MP1 acknowledged the caution message when it appeared in the HDD and attempted to determine the cause of the caution. However, based on the engine parameters and guidance provided in the TO, MP1 deemed this caution an anomaly and continued with their mission for approximately three and half hours until the MA experienced a sudden loss of engine torque.

The DEEC sensor fault checklist states that the pilot should refer to the DEEC failure checklist and notify maintenance of the caution. The DEEC failure checklist directs the pilot to reset the

MQ-9A, T/N 12-4174, 27 October 2018 15 DEEC; if the reset is successful, the pilot should land as soon as practical. In this case, the MC assumed that a DEEC failure had not occurred since the MA did not appear to go into backup mode as the TO dictates it should with an associated DEEC sensor fault caution. However, the most conservative response in this situation is to return to base as soon as practical. MP1 had ample time to return to the LRE when the caution initially appeared in the HDD.

The MC received EP training on how to handle DEEC sensor fault cautions when associated with the DEEC in backup mode. However, the MC did not receive training on how to proceed when the only indication of a possible engine malfunction is the DEEC sensor fault caution. The lack of training, lack of specificity in the TO, and engine parameters observed in the MA, which indicated the MA was not in backup mode, contributed to MP1’s incorrect assessment of the caution. Regardless, MP1’s assessment was incorrect given the DEEC failure checklist. The checklist provides little pilot discretion as to what course of action to execute when faced with these types of emergencies. Had the MC landed as soon as practical instead of continuing flight for more than three hours, there would have been more time to assess the caution, return the MA to the LRE, and allow GCS maintenance to further troubleshoot the caution message. Therefore, but for MP1’s decision to deviate from the preferred EPs, the mishap would not have occurred.

3. SUBSTANTIALLY CONTRIBUTING FACTOR

I find there was insufficient evidence indicating any substantially contributing factors.

4. CONCLUSION

I find by a preponderance of the evidence the causes of the mishap were as follows: (1) the decoupling of the propeller from the engine, and (2) MP1’s failure to adequately follow the DEEC sensor fault checklist. There was insufficient evidence of any substantially contributing factors.

Digitally signed

3 February 2020 BARTON D. KENERSON, Colonel, USAF President, Abbreviated Accident Investigation Board

MQ-9A, T/N 12-4174, 27 October 2018 16 INDEX OF TABS

Safety Investigator Information ...... A

Not used ...... B

Not used ...... C

Maintenance Report, Records, and Data...... D

Not used ...... E

Weather And Environmental Records and Data...... F

Personnel Records...... G

Not Used ...... H

Deficiency Reports...... I

Releasable Technical Reports and Engineering Evaluations...... J

Mission Records and Data ...... K

Factual Parametric, Audio, and Video Data From On-Board Recorders ...... L

Data From Ground Radar And Other Sources...... M

Transcripts Of Voice Communications ...... N

Any Additional Substantiating Data and Reports...... O

Not Used ...... P

AAIB Transfer Documents...... Q

Releasable Witness Testimony ...... R

Releasable Photographs, Videos, Diagrams, and Animations...... S

Personnel Flight Records Not Included In Tab G...... T

Maintenance Report, Records, And Data Not Included In Tab D...... U

Witness Testimony And Statements ...... V

MQ-9A, T/N 12-4174, 27 October 2018 17 Not Used ...... W

Not Used ...... X

Legal Board Appointment Documents ...... Y

Photographs, Videos, Diagrams, And Animations Not Included In Tab S ...... Z

Flight Documents...... AA

Applicable Regulations, Directives, And Other Government Documents ...... BB

Fact Sheets ...... CC

Contractor Report to USAF Safety Investigation Board………………………………………..DD

Subject Matter Experts Memoranda for Record…………………………………………………EE

Contractor Technical Report …………………………………………………………….………FF

MQ-9A, T/N 12-4174, 27 October 2018 18