Accident Summary
On 10 April 2019, at approximately 0200 Zulu time, an MQ-9A Reaper (tail number 08-4035) assigned to the 432d Wing at Creech Air Force Base, Nevada, lost controlled flight and impacted terrain in an undisclosed location within the United States Central Command (USCENTCOM) Area of Responsibility (AOR). The aircraft was destroyed, valued at $11,319,416. There was no reported damage to civilian property, injuries, or fatalities. The mishap crew, consisting of a pilot and sensor operator, were located at Creech AFB operating the aircraft remotely.
Sequence of Events
At approximately 0156Z, multiple control inputs from the mishap Ground Control Station (MGCS) to the aircraft changed simultaneously, including commands to close the fuel shut-off valve and feather the propeller. Over the next minute, engine torque, oil pressure, and propeller speed decreased as the engine shut down. The crew performed engine failure procedures per the emergency checklist, but because erroneous commands kept the fuel shut-off valve closed, the engine could not be restarted.
The MGCS also transmitted erroneous pitch, roll, and yaw commands. Initially, the aircraft ignored these commands because autopilot hold modes were enabled. When the crew disabled these modes to perform emergency checklist tasks, the aircraft began to follow the erroneous commands. The crew attempted to regain control but were unable. Rapid attitude changes caused intermittent departures from controlled flight and a permanent loss of datalink. The aircraft subsequently impacted the ground and was destroyed.
Investigation Findings
The Abbreviated Accident Investigation Board (AAIB) President determined that the cause of the mishap was a loose, flat metallic washer on the Control Console Serial Module (CCSM) that created an electrical short between several pins, resulting in erroneous control inputs being transmitted to the aircraft. Two factors substantially contributed to the mishap: (1) the design of the Control Console Assembly (CCA), which contained inadequately restrained metallic hardware, and (2) limitations in software fault logic.