NTSB Safety Forum on UAVs

The National Transportation Safety Board (NTSB) is holding a three-day forum on the safety of unmanned aircraft systems (UAS) April 29-30 in the NTSB Board Room and Conference Center in Washington, DC. The forum will provide an opportunity for the Safety Board and interested parties to understand the safety...

For immediate service; more information; and multi-user access (site license), non-profit organization, educational institute pricing, contact Karen Garner kgarner@accessintel.com at (301) 354-1612.

This story is only available to paid subscribers. Please login below with your username and password if you are a subscriber.

Username:
Password:
	What is my password?

Subscribe     Trial

The National Transportation Safety Board (NTSB) is holding a three-day forum on the safety of unmanned aircraft systems (UAS) April 29-30 in the NTSB Board Room and Conference Center in Washington, DC.

The forum will provide an opportunity for the Safety Board and interested parties to understand the safety implications presented by the growing use of UAS in the National Airspace System.

Issues addressed will include: regulatory standards; integration with the NAS; perspectives of current UAS operators; design, certification and airworthiness; human factors; and, future UAS applications and perspectives of current users of the NAS.

The forum is a result of the Safety Board's investigation into a Predator B unmanned aircraft that crashed near Nogales, AZ, in April 2006. The Board's October 2007 meeting on this accident resulted in 22 safety recommendations to address deficiencies associated with the civilian use of unmanned aircraft.

"The Nogales accident surfaced a number of important questions that need to be addressed if UAS's are to operate safely in the National Air Space," said Board Member Kitty Higgins, who will chair the forum. "We are very interested in the military's experience with UAS's, training of pilots, maintenance of the aircraft, communication with Air Traffic Control and oversight of UAS operations by public use agencies and other operators."

The forum will include representatives from the military, industry, the FAA, and government agencies involved in UAS operations.

The National Transportation Safety Board (NTSB) on Oct. 16, 2007 entered a new era of oversight, making a "historic" ruling on the probable cause of an unmanned aircraft accident.

While the reasons for the crash were not unexpected, the Safety Board's numerous recommendations growing out their accident investigation could have far-reaching effects on how unmanned aerial systems (UAS) are built and operated and how pilot training and qualifications are set.

The safety recommendations approved by the Safety Board stemmed from the April 25, 2006 accident in which a $6.5 million General Atomics Aeronautical Systems, Inc. (GA-ASI) turboprop- powered Predator B looking for illegal immigrants for the U.S. Customs and Border Protection (CPB) crashed within 100 yards of a house in a sparsely populated residential area near Nogales, Arizona. Luckily, no one on the ground was injured, but The remotely piloted 66-foot wingspan drone was substantially damaged.

The Predator B flight originated from the Libby Army Airfield (HFU), Sierra Vista, AZ.

The flight was being flown from a ground control station (GCS) located at HFU. The GCS contains two nearly identical consoles, pilot payload operator (PPO)-1, and PPO-2.

During a routine mission, a certified pilot controls the UAV from the PPO-1 console and the camera payload operator (typically a U.S. Border Patrol Agent) controls the camera from PPO-2. The aircraft controls (flaps, stop/feather, throttle, and speed lever) on PPO-1 and PPO-2 are identical. However, when control of the UAV is being accomplished from PPO-1, the controls at PPO-2 are used to control the camera.

The pilot employed by GA-ASI as part the Predator B turn-key operation reported that during the flight the console at PPO-1 "locked up", prompting him to switch control of the UAV to PPO-2. Checklist procedures state that prior to switching operational control between the two consoles, the pilot must match the control positions on the new console to those on the console, which had been controlling the UAV.

The pilot stated in an interview that he "got in a hurry and did not use the checklist." The result was that the stop/feather control in PPO-2 was in the fuel cutoff position when the switch over from PPO-1 to PPO-2 occurred. As a result, the fuel was cut off to the UAV when control was transferred to PPO-2.

The pilot stated that after the switch to the other console, he noticed the UAV was not maintaining altitude but did not know why. As a result he decided to shut down the GCS so that the UAV would enter its 'lost link' procedure, which called for the UAV to climb to 15,000 feet above mean sea level and to fly a predetermined course until contact could be established.

But with no engine power, the UAV continued to descend below line-of-site communications and further attempts to re-establish contact with the UAV were not successful.

NTSB investigators said lockups involving either PPO-1 or PPO-2 had occurred 16 times over the four months preceding the accident. Although the presence of redundant control consoles could mitigate the safety risks associated with a console lockup event, repeated reliance on this backup system increases pilot workload and the corresponding risk that an undesirable outcome will result.

Although a backup console is available to the pilot in the event of a lockup of PPO-1, it likely that this backup console will be in the fuel cutoff position when it's needed to backup PPO-1. Should the UA pilot fail to complete the condition lever reconfiguration step on the console transfer checklist to address the PPO-1 failure, inadvertent engine shutdown is all but assured.

Although some aural and visual indications were provided to the pilot by the Predator B ground control station, the most critical indication during the accident sequence, the engine out condition, was buried among other less critical information in the heads down display making the warning indication inconspicuous to the pilot. When the console locked up during the accident sequence, there was no warning indication presented to alert the pilot to the loss of control.

Rather, the pilot detected the condition using indirect queues such as frozen images on the display screen. These indications do not provide the pilot with the ability to quickly and precisely determine the nature and urgency associated with unsafe conditions such as an engine-out / or console lockup event.

When the engine shut down during the accident sequence, the UA lost its primary source of electrical power and this caused critical systems to revert to battery power to continue operation. However, a momentary surge caused by the immediate transfer of these systems to the battery compelled the system to reduce the load on the battery, and, as a result, electrical power was cut to critical systems such as the transponder and the satellite communication link.

Because the accident pilot sent the UA to its lost link mission following the engine shutdown, communications between the GCS and the UA were discontinued at the time the transponder dropped off line. Without its transponder, no live link to the GCS, and no pilot onboard to report its position, the accident UA was invisible to ATC. The burden of separation was placed solely on other aircraft in the NAS, and their ability to see and avoid a potential conflict with the uncontrolled UA.

An additional concern related to the loss of engine power was the inability to restart the engine during the accident sequence. The investigation revealed that the engine on CBP's Predator B can only be restarted in-flight if commanded by the pilot using the line of sight, or LOS, communication link between the GCS and the UA. This means that engine restart is not possible when the UA is in lost link mode or when LOS control is lost.

Maintenance plans, procedures, and oversight were also issues identified in this investigation.

The Safety Board determined that the probable cause of the accident was the pilot's failure to use checklist procedures when switching operational control from a console that had become inoperable due to a "lockup" condition, which resulted in the fuel valve inadvertently being shut off and the subsequent total loss of engine power.

Contributing to the accident was the absence of a flight instructor in the Ground Control Station as required by CPB rules. The pilot did not have enough hours to fly the drone solo, but the instructor was in another building when the trouble occurred.

Factors associated with the accident were repeated and unresolved console lockups, inadequate maintenance procedures performed by GA-ASI, and the CPB's inadequate monitoring of border surveillance program.