piper/chapter05.raw

chapter 5.

A Friendly Fire Accident.
The goal of STAMP is to assist in understanding why accidents occur and to use
that understanding to create new and better ways to prevent losses. This chapter
and several of the appendices provide examples of how STAMP can be used to
analyze and understand accident causation. The particular examples were selected
to demonstrate the applicability of STAMP to very different types of systems and
industries. A process, called CAST (Causal Analysis based on STAMP) is described
in chapter 11 to assist in performing the analysis.
This chapter delves into the causation of the loss of a U.S. Army Black Hawk
helicopter and all its occupants from friendly fire by a U.S. Air Force F-15 over
northern Iraq in 1994. This example was chosen because the controversy and mul-
tiple viewpoints and books about the shootdown provide the information necessary
to create most of the STAMP analysis. Accident reports often leave out important
causal information (as did the official accident report in this case). Because of the
nature of the accident, most of the focus is on operations. Appendix B presents
an example of an accident where engineering development plays an important
role. Social issues involving public health are the focus of the accident analysis in
appendix C.
section 5.1. 
Background.
After the Persian Gulf War, Operation Provide Comfort (OPC) was created as a
multinational humanitarian effort to relieve the suffering of hundreds of thousands
of Kurdish refugees who fled into the hills of northern Iraq during the war. The goal
of the military efforts was to provide a safe haven for the resettlement of the refu-
gees and to ensure the security of relief workers assisting them. The formal mission
statement for OPC read: “To deter Iraqi behavior that may upset peace and order
in northern Iraq.”
In addition to operations on the ground, a major component of OPC’s mission
was to occupy the airspace over northern Iraq. To accomplish this task, a no-fly zone


(also called the TAOR or Tactical Area of Responsibility) was established that
included all airspace within Iraq north of the 36th Parallel (see figure 5.1). Air
operations were led by the Air Force to prohibit Iraqi aircraft from entering the
no-fly zone while ground operations were organized by the Army to provide human-
itarian assistance to the Kurds and other ethnic groups in the area.
U.S., Turkish, British, and French fighter and support aircraft patrolled the no-fly
zone daily to prevent Iraqi warplanes from threatening the relief efforts. The mission
of the Army helicopters was to support the ground efforts; the Army used them
primarily for troop movement, resupply, and medical evacuation.
On April 15, 1994, after nearly three years of daily operations over the TAOR
(Tactical Area of Responsibility), two U.S. Air Force F-15’s patrolling the area shot
down two U.S. Army Black Hawk helicopters, mistaking them for Iraqi Hind heli-
copters. The Black Hawks were carrying twenty-six people, fifteen U.S. citizens and
eleven others, among them British, French, and Turkish military officers as well as
Kurdish citizens. All were killed in one of the worst air-to-air friendly fire accidents
involving U.S. aircraft in military history.
All the aircraft involved were flying in clear weather with excellent visibility, an
AWACS (Airborne Warning and Control System) aircraft was providing surveil-
lance and control for the aircraft in the area, and all the aircraft were equipped with
electronic identification and communication equipment (apparently working prop-
erly) and flown by decorated and highly experienced pilots.

The hazard being controlled was mistaking a “friendly” (coalition) aircraft for a
threat and shooting at it. This hazard, informally called friendly fire, was well known,
and a control structure was established to prevent it. Appropriate constraints were
established and enforced at each level, from the Joint Chiefs of Staff down to the
aircraft themselves. Understanding why this accident occurred requires understand-
ing why the control structure in place was ineffective in preventing the loss. Prevent-
ing future accidents involving the same control flaws requires making appropriate
changes to the control structure, including establishing monitoring and feedback
loops to detect when the controls are becoming ineffective and the system is migrat-
ing toward an accident, that is, moving toward a state of increased risk. The more
comprehensive the model and factors identified, the larger the class of accidents
that can be prevented.
For this STAMP example, information about the accident and the control struc-
ture was obtained from the original accident report [5], a GAO (Government
Accountability Office) report on the accident investigation process and results [200],
and two books on the shootdown—one originally a Ph.D. dissertation by Scott
Snook [191] and one by Joan Piper, the mother of one of the victims [159]. Because
of the extensive existing analysis, much of the control structure (shown in figure 5.3)
can be reconstructed from these sources. A large number of acronyms are used in
this chapter. They are defined in figure 5.2.


5.2
The Hierarchical Safety Control Structure to Prevent Friendly Fire Accidents
National Command Authority and Commander-in-Chief Europe
When the National Command Authority (the President and Secretary of Defense)
directed the military to conduct Operation Provide Comfort, the U.S. Commander
in Chief Europe (USCINCEUR) directed the creation of Combined Task Force
(CTF) Provide Comfort.
A series of orders and plans established the general command and control struc-
ture of the CTF. These orders and plans also transmitted sufficient authority and
guidance to subordinate component commands and operational units so that they
could then develop the local procedures that were necessary to bridge the gap
between general mission orders and specific subunit operations.
At the top of the control structure, the National Command Authority (the Presi-
dent and Secretary of Defense, who operate through the Joint Chiefs of Staff)
provided guidelines for establishing Rules of Engagement (ROE). ROE govern the
actions allowed by U.S. military forces to protect themselves and other personnel
and property against attack or hostile incursion and specify a strict sequence of
procedures to be followed prior to any coalition aircraft firing its weapons. They are


based on legal, political, and military considerations and are intended to provide for
adequate self-defense to ensure that military activities are consistent with current
national objectives and that appropriate controls are placed on combat activities.
Commanders establish ROE for their areas of responsibility that are consistent with
the Joint Chiefs of Staff guidelines, modifying them for special operations and for
changing conditions.
Because the ROE dictate how hostile aircraft or military threats are treated,
they play an important role in any friendly fire accidents. The ROE in force for
OPC were the peacetime ROE for the United States European Command with
OPC modifications approved by the National Command Authority. These conserva-
tive ROE required a strict sequence of procedures to be followed prior to any
coalition aircraft firing its weapons. The less aggressive peacetime rules of engage-
ment were used even though the area had been designated a combat zone because
of the number of countries involved in the joint task force. The goal of the ROE
was to slow down any military confrontation in order to prevent the type of friendly
fire accidents that had been common during Operation Desert Storm. Understand-
ing the reasons for the shootdown of the Black Hawk helicopters requires under-
standing why the ROE did not provide an effective control to prevent friendly fire
accidents.
Three System-Level Safety Constraints Related to This Accident:
1. The NCA and UNCINCEUR must establish a command and control structure
that provides the ability to prevent friendly fire accidents.
2. The guidelines for ROE generated by the Joint Chiefs of Staff (with tailoring
to suit specific operational conditions) must be capable of preventing friendly
fire accidents in all types of situations.
3. The European Commander-in-Chief must review and monitor operational
plans generated by the Combined Task Force, ensure they are updated as the
mission changes, and provide the personnel required to carry out the plans.
Controls: The controls in place included the ROE guidelines, the operational
orders, and review procedures for the controls (e.g., the actual ROE and Operational
Plans) generated at the control levels below.
Combined Task Force (CTF)
The components of the Combined Task Force (CTF) organization relevant to the
accident (and to preventing friendly fire) were a Combined Task Force staff, a Com-
bined Forces Air Component (CFAC), and an Army Military Coordination Center.
The Air Force fighter aircraft were co-located with CTF Headquarters and CFAC

based on legal, political, and military considerations and are intended to provide for
adequate self-defense to ensure that military activities are consistent with current
national objectives and that appropriate controls are placed on combat activities.
Commanders establish ROE for their areas of responsibility that are consistent with
the Joint Chiefs of Staff guidelines, modifying them for special operations and for
changing conditions.
Because the ROE dictate how hostile aircraft or military threats are treated,
they play an important role in any friendly fire accidents. The ROE in force for
OPC were the peacetime ROE for the United States European Command with
OPC modifications approved by the National Command Authority. These conserva-
tive ROE required a strict sequence of procedures to be followed prior to any
coalition aircraft firing its weapons. The less aggressive peacetime rules of engage-
ment were used even though the area had been designated a combat zone because
of the number of countries involved in the joint task force. The goal of the ROE
was to slow down any military confrontation in order to prevent the type of friendly
fire accidents that had been common during Operation Desert Storm. Understand-
ing the reasons for the shootdown of the Black Hawk helicopters requires under-
standing why the ROE did not provide an effective control to prevent friendly fire
accidents.
Three System-Level Safety Constraints Related to This Accident:
1. The NCA and UNCINCEUR must establish a command and control structure
that provides the ability to prevent friendly fire accidents.
2. The guidelines for ROE generated by the Joint Chiefs of Staff (with tailoring
to suit specific operational conditions) must be capable of preventing friendly
fire accidents in all types of situations.
3. The European Commander-in-Chief must review and monitor operational
plans generated by the Combined Task Force, ensure they are updated as the
mission changes, and provide the personnel required to carry out the plans.
Controls: The controls in place included the ROE guidelines, the operational
orders, and review procedures for the controls (e.g., the actual ROE and Operational
Plans) generated at the control levels below.
Combined Task Force (CTF)
The components of the Combined Task Force (CTF) organization relevant to the
accident (and to preventing friendly fire) were a Combined Task Force staff, a Com-
bined Forces Air Component (CFAC), and an Army Military Coordination Center.
The Air Force fighter aircraft were co-located with CTF Headquarters and CFAC


at Incirlik Air Base in Turkey while the U.S. Army helicopters were located with the
Army headquarters at Diyarbakir, also in Turkey (see figure 5.1).
The Combined Task Force had three components under it (figure 5.3):
1. The Military Coordination Center (MCC) monitored conditions in the security
zone and had operational control of Eagle Flight helicopters (the Black
Hawks), which provided general aviation support to the MCC and the CTF.
2. The Joint Special Operations Component (JSOC) was assigned primary
responsibility to conduct search-and-rescue operations should any coalition
aircraft go down inside Iraq.
3. The Combined Forces Air Component (CFAC) was tasked with exercising
tactical control of all OPC aircraft operating in the Tactical Area of Respon-
sibility (TAOR) and operational control over Air Force aircraft.1 The CFAC
commander exercised daily control of the OPC flight mission through a Direc-
tor of Operations (CFAC/DO), as well as a ground-based Mission Director at
the Combined Task Force (CTF) headquarters in Incirlik and an Airborne
Command Element (ACE) aboard the AWACS.
Operational orders were generated at the European Command level of authority
that defined the initial command and control structure and directed the CTF
commanders to develop an operations plan to govern OPC. In response, the CTF
commander created an operations plan in July 1991 delineating the command rela-
tionships and organizational responsibilities within the CTF. In September 1991, the
U.S. Commander-in-Chief, Europe, modified the original organizational structure in
response to the evolving mission in northern Iraq, directing an increase in the size
of the Air Force and the withdrawal of a significant portion of the ground forces.
The CTF was ordered to provide a supporting plan to implement the changes
necessary in their CTF operations plan. The Accident Investigation Board found
that although an effort was begun in 1991 to revise the operations plan, no evidence
could be found in 1994 to indicate that the plan was actually updated to reflect the
change in command and control relationships and responsibilities. The critical
element of the plan with respect to the shootdown was that the change in mission
led to the departure of an individual key to the communication between the Air
Force and Army, without his duties being assigned to someone else. This example
of asynchronous evolution plays a role in the loss.

footnote. Tactical control involves a fairly limited scope of authority, that is, the detailed and usually local direc-
tion and control of movement and maneuvers necessary to accomplish the assigned mission. Operational
control, on the other hand, involves a broader authority to command subordinate forces, assign tasks,
designate objectives, and give the authoritative direction necessary to accomplish the mission.



Command-Level Safety Constraints Related to the Accident:
1. Rules of engagement and operational orders and plans must be established at
the command level that prevent friendly fire accidents. The plans must include
allocating responsibility and establishing and monitoring communication
channels to allow for coordination of flights into the theater of action.
2. Compliance with the ROE and operational orders and plans must be moni-
tored. Alterations must be made in response to changing conditions and
changing mission.
Controls: The controls included the ROE and operational plans plus feedback
mechanisms on their effectiveness and application.
CFAC and MCC
The two parts of the Combined Task Force involved in the accident were the Army
Military Coordination Center (MCC) and the Air Force Combined Forces Air
Component (CFAC).
The shootdown obviously involved a communication failure: the F-15 pilots did
not know the U.S. Army Black Hawks were in the area or that they were targeting
friendly aircraft. Problems in communication between the three services (Air Force,
Army, and Navy) are legendary. Procedures had been established to attempt to
eliminate these problems in Operation Provide Comfort.
The Military Coordination Center (MCC) coordinated land and U.S. helicopter
missions that supported the Kurdish people. In addition to providing humanitarian
relief and protection to the Kurds, another important function of the Army detach-
ment was to establish an ongoing American presence in the Kurdish towns and
villages by showing the U.S. flag. This U.S. Army function was supported by a
helicopter detachment called Eagle Flight.
All CTF components, with the exception of the Army Military Coordination
Center lived and operated out of Incirlik Air Base in Turkey. The MCC operated
out of two locations. A forward headquarters was located in the small village of
Zakhu (see figure 5.1), just inside Iraq. Approximately twenty people worked in
Zakhu, including operations, communications, and security personnel, medics, trans-
lators, and coalition chiefs. Zakhu operations were supported by a small administra-
tive contingent working out of Pirinclik Air Base in Diyarbakir, Turkey. Pirinclik is
also where the Eagle Flight Platoon of UH-60 Black Hawk helicopters was located.
Eagle Flight helicopters made numerous (usually daily) trips to Zakhu to support
MCC operations.
The Combined Forces Air Component (CFAC) Commander was responsible for
coordinating the employment of all air operations to accomplish the OPC mission.
He was delegated operational control of the Airborne Warning and Control System


(AWACS), U.S. Air Force (USAF) airlift, and the fighter forces. He had tactical
control of the U.S. Army, U.S. Navy, Turkish, French, and British fixed wing and
helicopter aircraft. The splintering of control between the CFAC and MCC com-
manders, along with communication problems between them, were major contribu-
tors to the accident.
In a complex coordination problem of this sort, communication is critical. Com-
munications were implemented through the Joint Operations and Intelligence
Center (JOIC). The JOIC received, delivered, and transmitted communications up,
down, and across the CTF control structure. No Army liaison officer was assigned
to the JOIC, but one was available on request to provide liaison between the MCC
helicopter detachment and the CTF staff.
To prevent friendly fire accidents, pilots need to know exactly what friendly air-
craft are flying in the no-fly zone at all times as well as know and follow the ROE
and other procedures for preventing such accidents. The higher levels of control
delegated the authority and guidance to develop local procedures2 to the CTF level
and below. These local procedures included:
•Airspace Control Order (ACO): The ACO contains the authoritative guidance
for all local air operations in OPC. It covers such things as standard altitudes
and routes, air refueling procedures, recovery procedures, airspace deconfliction
responsibilities, and jettison procedures. The deconfliction procedures were a
way to prevent interactions between aircraft that might result in accidents. For
the Iraqi TAOR, fighter aircraft, which usually operated at high altitudes, were
to stay above 10,000 feet above ground level while helicopters, which normally
conducted low-altitude operations, were to stay below 400 feet. All flight crews
were responsible for reviewing and complying with the information contained
in the ACO. The CFAC Director of Operations was responsible for publishing
the guidance, including the Airspace Control Order, for conducting OPC
missions.
•Aircrew Read Files (ARFs): The Aircraft Read Files supplement the ACOs
and are also required reading by all flight crews. They contain the classified
rules of engagement (ROE), changes to the ACO, and recent amplification of
how local commanders want air missions executed.
•Air Tasking Orders (ATOs): While the ACO and ARFs contain general infor-
mation that applies to all aircraft in OPC, specific mission guidance was pub-
lished in the daily ATOs. They contained the daily flight schedule, radio
frequencies to be used, IFF codes (used to identify an aircraft as friend or foe),

and other late-breaking information necessary to fly on any given day. All air-
craft are required to have a hard copy of the current ATO with Special Instruc-
tions (SPINS) on board before flying. Each morning around 11:30 (1130 hours,
in military time), the mission planning cell (or Frag shop) publishes the ATO for
the following day, and copies are distributed to all units by late afternoon.
•Battle Staff Directives (BSDs): Any late scheduling changes that do not make
it onto the ATO are published in last-minute Battle Staff Directives, which are
distributed separately and attached to all ATOs prior to any missions flying the
next morning.
•Daily Flowsheets: Military pilots fly with a small clipboard attached to their
knees. These kneeboards contain boiled-down reference information essential
to have handy while flying a mission, including the daily flowsheet and radio
frequencies. The flowsheets are graphical depictions of the chronological flow
of aircraft scheduled into the no-fly zone for that day. Critical information is
taken from the ATO, translated into timelines, and reduced on a copier to
provide pilots with a handy in-flight reference.
•Local Operating Procedures and Instructions, Standard Operating Procedures,
Checklists, and so on: In addition to written material, real-time guidance is
provided to pilots after taking off via radio through an unbroken command
chain that runs from the OPC Commanding General, through the CFAC,
through the mission director, through an Airborne Command Element (ACE)
on board the AWACS, and ultimately to pilots.
The CFAC commander of operations was responsible for ensuring that aircrews
were informed of all unique aspects of the OPC mission, including the ROE, upon
their arrival. He was also responsible for publishing the Aircrew Read File (ARF),
the Airspace Control Order (ACO), the daily Air Tasking Order, and mission-
related special instructions (SPINS).


footnote. The term procedures as used in the military denote standard and detailed courses of action that
describe how to perform a task.

Safety Constraints Related to the Accident:
1. Coordination and communication among all flights into the TAOR must be
established. Procedures must be established for determining who should be
and is in the TAOR at all times.
2. Procedures must be instituted and monitored to ensure that all aircraft in the
TAOR are tracked and fighters are aware of the location of all friendly aircraft
in the TAOR.
3. The ROE must be understood and followed by those at lower levels.
4. All aircraft must be able to communicate effectively in the TAOR.

Controls: The controls in place included the ACO, ARFs, flowsheets, intelligence
and other briefings, training (on the ROE, on aircraft identification, etc.), AWACS
procedures for identifying and tracking aircraft, established radio frequencies and
radar signals for the no-fly zone, a chain of command (OPC Commander to Mission
Director to ACE to pilots), disciplinary actions for those not following the written
rules, and a group (the JOIE) responsible for ensuring effective communication
occurred.
Mission Director and Airborne Command Element
The Airborne Command Element (ACE) flies in the AWACS and is the com-
mander’s representative in the air, armed with up-to-the-minute situational infor-
mation to make time-critical decisions. The ACE monitors all air operations and
is in direct contact with the Mission Director located in the ground command
post. He must also interact with the AWACS crew to identify reported unidentified
aircraft.
The ground-based Mission Director maintains constant communication links
with both the ACE up in the AWACS and with the CFAC commander on the
ground. The Mission Director must inform the OPC commander immediately if
anything happens over the no-fly zone that might require a decision by the com-
mander or his approval. Should the ACE run into any situation that would involve
committing U.S. or coalition forces, the Mission Director will communicate with him
to provide command guidance. The Mission Director is also responsible for making
weather-related decisions, implementing safety procedures, scheduling aircraft, and
ensuring that the ATO is executed correctly.
The ROE in place at the time of the shootdown stated that aircrews experiencing
unusual circumstances were to pass details to the ACE or AWACS, who would
provide guidance on the appropriate response [200]. Exceptions were possible, of
course, in cases of imminent threat. Aircrews were directed to first contact the ACE
and, if that individual was unavailable, to then contact the AWACS. The six unusual
circumstances/occurrences to be reported, as defined in the ROE, included “any
intercept run on an unidentified aircraft.” As stated, the ROE was specifically
designed to slow down a potential engagement to allow time for those in the chain
of command to check things out.
Although the written guidance was clear, there was controversy with respect to
how it was or should have been implemented and who had decision-making author-
ity. Conflicting testimony during the investigation of the shootdown about respon-
sibility may either reflect after-the-fact attempts to justify actions or may instead
reflect real confusion on the part of everyone, including those in charge, as to where
the responsibility lay—perhaps a little of both.


Safety Constraints Related to the Accident:
1. The ACE and MD must follow procedures specified and implied by the
ROE.
2. The ACE must ensure that pilots follow the ROE.
3. The ACE must interact with the AWACS crew to identify reported unidenti-
fied aircraft.
Controls: Controls to enforce the safety constraints included the ROE to provide
overall principles for decision-making and to slow down engagements in order to
prevent individual error or erratic behavior, the ACE up in the AWACS to augment
communication by getting up-to-the-minute information about the state of the
TAOR airspace and communicating with the pilots and AWACS crews, and the
Mission Director on the ground to provide a chain of command from the pilots to
the CFAC commander for real-time decision making.
AWACS Controllers
The AWACS (Airborne Warning and Control Systems) acts as an air traffic control
tower in the sky. The AWACS OPC mission was to:
1. Control aircraft en route to and from the no-fly zone
2. Coordinate air refueling (for the fighter aircraft and the AWACS itself)
3. Provide airborne threat warning and control for all OPC aircraft operating
inside the no-fly zone
4. Provide surveillance, detection, and identification of all unknown aircraft
An AWACS is a modified Boeing 707, with a saucer-shaped radar dome on the top,
equipped inside with powerful radars and radio equipment that scan the sky for
aircraft. A computer takes raw data from the radar dome, processes it, and ultimately
displays tactical information on fourteen color consoles arranged in rows of three
throughout the rear of the aircraft. AWACS have the capability to track approxi-
mately one thousand enemy aircraft at once while directing one hundred friendly
ones [159].
The AWACS carries a flight crew (pilot, copilot, navigator, and flight engineer)
responsible for safe ground and flight operation of the AWACS aircraft and a
mission crew that has overall responsibility for the AWACS command, control,
surveillance, communications, and sensor systems.
The mission crew of approximately nineteen people are under the direction of
a mission crew commander (MCC). The MCC has overall responsibility for the
AWACS mission and the management, supervision, and training of the mission crew.
The mission crew members were divided into three sections:


1. Technicians: The technicians are responsible for operating, monitoring, and
maintaining the physical equipment on the aircraft.
2. Surveillance: The surveillance section is responsible for the detection, track-
ing, identification, height measurement, display, and recording of surveillance
data. As unknown targets appear on the radarscopes, surveillance technicians
follow a detailed procedure to identify the tracks. They are responsible for
handling unidentified and non-OPC aircraft detected by the AWACS elec-
tronic systems. The section is supervised by the air surveillance officer, and the
work is carried out by an advanced air surveillance technician and three air
surveillance technicians.
3. Weapons: The weapons controllers are supervised by the senior director
(SD). This section is responsible for the control of all assigned aircraft and
weapons systems in the TAOR. The SD and three weapons directors are
together responsible for locating, identifying, tracking, and controlling all
friendly aircraft flying in support of OPC. Each weapons director was assigned
responsibility for a specific task:
•
•
•
1.The enroute controller controlled the flow of OPC aircraft to and from the
TAOR. This person also conducted radio and IFF checks on friendly aircraft
outside the TAOR.
2.The TAOR controller provided threat warning and tactical control for all
OPC aircraft within the TAOR.
3.The tanker controller coordinated all air refueling operations (and played no
part in the accident so is not mentioned further).
To facilitate communication and coordination, the SD’s console was physically
located in the “pit” right between the MCC and the ACE (Airborne Command
Element). Through internal radio nets, the SD synchronized the work of the
weapons section with that of the surveillance section. He also monitored and coor-
dinated the actions of his weapons directors to meet the demands of both the ACE
and MCC.
Because those who had designed the control structure recognized the potential
for some distance to develop between the training of the AWACS crew members
and the continually evolving practice in the no-fly zone (another example of asyn-
chronous evolution of the safety control structure), they had instituted a control by
creating staff or instructor personnel permanently stationed in Turkey. Their job was
to help provide continuity for U.S. AWACS crews who rotated through OPC on
temporary duty status, usually for thirty-day rotations. This shadow crew flew with
each new AWACS crew on their first mission in the TAOR to alert them as to how
things were really done in OPC. Their job was to answer any questions the new crew

might have about local procedures, recent occurrences, or changes in policy or inter-
pretation that had come about since the last time they had been in the theater.
Because the accident occurred on the first day for a new AWACS crew, instructor
or staff personnel were also on board.
In addition to all these people, a Turkish controller flew on all OPC missions to
help the crew interface with local air traffic control systems.
The AWACS typically takes off from Incirlik AFB approximately two hours
before the first air refueling and fighter aircraft. Once the AWACS is airborne, the
systems of the AWACS are brought on line, and a Joint Tactical Information Distri-
bution System (JTIDS3) link is established with a Turkish Sector Operations Center
(radar site). After the JTIDS link is confirmed, the CFAC airborne command
element (ACE) initiates the planned launch sequence for the rest of the force.
Normally, within a one-hour period, tanker and fighter aircraft take off and proceed
to the TAOR in a carefully orchestrated flow. Fighters may not cross the political
border into Iraq without AWACS coverage.


footnote. The Joint Tactical Information Distribution System acts as a central component of the mission
command and control system, providing ground commanders with a real-time downlink of the current
air picture from AWACS. This information is then integrated with data from other sources to provide
commanders with a more complete picture of the situation.


Safety Constraints Related to the Accident:
1. The AWACS mission crew must identify and track all aircraft in the TAOR.
Friendly aircraft must not be identified as a threat (hostile).
2. The AWACS mission crew must accurately inform fighters about the status of
all tracked aircraft when queried.
3. The AWACS mission crew must alert aircraft in the TAOR to any coalition
aircraft not appearing on the flowsheet (ATO).
4. The AWACS crew must not fail to warn fighters about any friendly aircraft
the fighters are targeting.
5. The JTIDS must provide the ground with an accurate picture of the airspace
and its occupants.
Controls: Controls included procedures for identifying and tracking aircraft, train-
ing (including simulator missions), briefings, staff controllers, and communication
channels. The SD and ASO provided real-time oversight of the crew’s activities.
Pilots
Fighter aircraft, flying in formations of two and four aircraft, must always have a
clear line of command. In the two-aircraft formation involved in the accident, the


lead pilot is completely in charge of the flight and the wingman takes all of his com-
mands from the lead.
The ACO (Airspace Control Order) stipulates that fighter aircraft may not cross
the political border into Iraq without AWACS coverage and no aircraft may enter
the TAOR until fighters with airborne intercept (AI) radars have searched the
TAOR for Iraqi aircraft. Once the AI radar-equipped aircraft have “sanitized” the
no-fly zone, they establish an orbit and continue their search for Iraqi aircraft and
provide air cover while other aircraft are in the area. When they detect non-OPC
aircraft, they are to intercept, identify, and take appropriate action as prescribed by
the rules of engagement (ROE) and specified in the ACO.
After the area is sanitized, additional fighters and tankers flow to and from the
TAOR throughout the six- to eight-hour daily flight schedule. This flying window is
randomly selected to avoid predictability.
Safety Constraints Related to the Accident:
1. Pilots must know and follow the rules of engagement established and com-
municated from the levels above.
2. Pilots must know who is in the no-fly zone at all times and whether they should
be there or not, i.e., they must be able to accurately identify the status of all
other aircraft in the no-fly zone at all times and must not misidentify a friendly
aircraft as a threat.
3. Pilots of aircraft in the area must be able to hear radio communications.
4. Fixed-wing aircraft must fly above 10,000 feet and helicopters must remain
below 400 feet.
Controls: Controls included the ACO, the ATO, flowsheets, radios, IFF, the ROE,
training, the AWACS, procedures to keep fighters and helicopters from coming into
contact (for example, they fly at different altitudes), and special tactical radio fre-
quencies when operating in the TAOR. Flags were displayed prominently on all
aircraft in order to identify their origin.
Communication: Communication is important in preventing friendly fire acci-
dents. The U.S. Army Black Hawk helicopters carried a full array of standard avion-
ics, radio, IFF, and radar equipment as well as communication equipment consisting
of FM, UHF, and VHF radios. Each day the FM and UHF radios were keyed with
classified codes to allow pilots to talk secure in encrypted mode. The ACO directed
that special frequencies were to be used when flying inside the TAOR.
Due to the line-of-sight limitations of their radios, the high mountainous terrain
in northern Iraq, and the fact that helicopters tried to fly at low altitudes to use the
terrain to mask them from enemy air defense radars, all Black Hawk flights into the


no-fly zone also carried tactical satellite radios (TACSATs). These TACSATS were
used to communicate with MCC operations. The helicopters had to land to place the
TACSATs in operation; they cannot be operated from inside a moving helicopter.
The F-15’s were equipped with avionics, communications, and electronic equip-
ment similar to that on the Black Hawks, except that the F-15’s were equipped with
HAVE QUICK II (HQ-II) frequency-hopping radios while the helicopters were
not. HQ-II defeated most enemy attempts to jam transmissions by changing fre-
quencies many times per second. Although the F-15 pilots preferred to use the more
advanced HQ technology, the F-15 radios were capable of communicating in a clear,
non-HQ-II mode. The ACO directed that F-15s use the non-HQ-II frequency when
specified aircraft that were not HQ-II capable flew in the TAOR. One factor involved
in the accident was that Black Hawk helicopters (UH-60s) were not on the list of
non-HQ-II aircraft that must be contacted using a non-HQ-II mode.
Identification: Identification of aircraft was assisted by systems called AAI/IFF
(electronic Air-to-Air Interrogation/Identification Friend or Foe). Each coalition
aircraft was equipped with an IFF transponder. Friendly radars (located in the
AWACS, a fighter aircraft, or a ground site) execute what is called a parrot check
to determine if the target being reflected on their radar screens is friendly or hostile.
The AAI component (the interrogator) sends a signal to an airborne aircraft to
determine its identity, and the IFF component answers or squawks back with a
secret code—a numerically identifying pulse that changes daily and must be uploaded
into aircraft using secure equipment prior to takeoff. If the return signal is valid, it
appears on the challenging aircraft’s visual display (radarscope). A compatible code
has to be loaded into the cryptographic system of both the challenging and the
responding aircraft to produce a friendly response.
An F-15’s AAI/IFF system can interrogate using four identification signals or
modes. The different types of IFF signals provide a form of redundancy. Mode I is
a general identification signal that permits selection of 32 codes. Two Mode I codes
were designated for use in OPC at the time of the accident: one for inside the TAOR
and the other for outside. Mode II is an aircraft-specific identification mode allowing
the use of 4,096 possible codes. Mode III provides a nonsecure friendly identification
of both military and civilian aircraft and was not used in the TAOR. Mode IV is
secure and provides high-confidence identification of friendly targets. According to
the ACO, the primary means of identifying friendly aircraft in the Iraqi no-fly zone
were to be modes I and IV in the IFF interrogation process.
Physical identification is also important in preventing friendly fire accidents.
The ROE require that the pilots perform a visual identification of the potential
threat. To assist in this identification, the Black Hawks were marked with six two-
by-three-foot American flags. An American flag was painted on each door, on both


sponsons,4 on the nose, and on the belly of each helicopter [159]. A flag had been
added to the side of each sponson because the Black Hawks had been the target of
small-arms ground fire several months before.

footnote. Sponsons are auxiliary fuel tanks.


section 5.3.

The Accident Analysis Using STAMP.
With all these controls and this elaborate control structure to protect against friendly
fire accidents, which was a well-known hazard, how could the shootdown occur on
a clear day with all equipment operational? As the Chairman of the Joint Chiefs of
Staff said after the accident:
In place were not just one, but a series of safeguards—some human, some procedural,
some technical—that were supposed to ensure an accident of this nature could never
happen. Yet, quite clearly, these safeguards failed.5
Using STAMP to understand why this accident occurred and to learn how to prevent
such losses in the future requires determining why these safeguards were not suc-
cessful in preventing the friendly fire. Various explanations for the accident have
been posited. Making sense out of these conflicting explanations and understanding
the accident process involved, including not only failures of individual system com-
ponents but the unsafe interactions and miscommunications between components,
requires understanding the role played in this process by each of the elements of
the safety control structure in place at the time.
The next section contains a description of the proximate events involved in the
loss. Then the STAMP analysis providing an explanation of why these events
occurred is presented.

footnote. John Shalikashvili, chairman of the Joint Chief of Staff, from a cover letter to the twenty-one-volume
report of the Aircraft Accident Investigation Board, 19 94 a, page 1.


section 5.3.1. Proximate Events.
Figure 5.4, taken from the official Accident Investigation Board Report, shows a
timeline of the actions of each of the main actors in the proximate events—the
AWACS, the F-15s, and the Black Hawks. It may also be helpful to refer back to
figure 5.1, which contains a map of the area showing the relative locations of the
important activities.
After receiving a briefing on the day’s mission, the AWACS took off from Incirlik
Air Base. When they arrived on station and started to track aircraft, the AWACS
surveillance section noticed unidentified radar returns (from the Black Hawks). A
“friendly general” track symbol was assigned to the aircraft and labeled as H,


denoting a helicopter. The Black Hawks (Eagle Flight) later entered the TAOR
(no-fly zone) through Gate 1, checked in with the AWACS controllers who anno-
tated the track with the identifier EE01, and flew to Zakhu. The Black Hawk pilots
did not change their IFF (Identify Friend or Foe) Mode I code: The code for all
friendly fixed-wing aircraft flying in Turkey on that day was 42, and the code for the
TAOR was 52. They also remained on the enroute radio frequency instead of chang-
ing to the frequency to be used in the TAOR. When the helicopters landed at Zakhu,
their radar and IFF (Identify Friend or Foe) returns on the AWACS radarscopes
faded. Thirty minutes later, Eagle Flight reported their departure from Zakhu to
the AWACS and said they were enroute from Whiskey (code name for Zakhu) to
Lima (code name for Irbil, a town deep in the TAOR). The enroute controller
reinitiated tracking of the helicopters.
Two F-15s were tasked that day to be the first aircraft in the TAOR and to sanitize
it (check for hostile aircraft) before other coalition aircraft entered the area. The
F-15s reached their final checkpoint before entering the TAOR approximately an
hour after the helicopters had entered. They turned on all combat systems, switched
their IFF Mode I code from 42 to 52, and switched to the TAOR radio frequency.
They reported their entry into the TAOR to the AWACS.
At this point, the Black Hawks’ radar and IFF contacts faded as the helicopters
entered mountainous terrain. The AWACS computer continued to move the heli-
copter tracks on the radar display at the last known speed and direction, but
the identifying H symbol (for helicopter) on the track was no longer displayed. The
ASO placed an “attention arrow” (used to point out an area of interest) on the
SD’s scope at the point of the Black Hawk’s last known location. This large arrow
is accompanied by a blinking alert light on the SD’s console. The SD did not
acknowledge the arrow and after sixty seconds, both the arrow and the light
were automatically dropped. The ASO then adjusted the AWACS radar to detect
slow-moving objects.
Before entering the TAOR, the lead F-15 pilot checked in with the ACE and was
told there were no relevant changes from previously briefed information (“negative
words”). Five minutes later, the F-15’s entered the TAOR, and the lead pilot reported
their arrival to the TAOR controller. One minute later, the enroute controller finally
dropped the symbol for the helicopters from the scope, the last remaining visual
reminder that there were helicopters inside the TAOR.
Two minutes after entering the TAOR, the lead F-15 picked up hits on its instru-
ments indicating that it was getting radar returns from a low and slow-flying aircraft.
The lead F-15 pilot alerted his wingman and then locked onto the contact and used
the F-15’s air-to-air interrogator to query the target’s IFF code. If it was a coalition
aircraft, it should be squawking Mode I, code 52. The scope showed it was not. He
reported the radar hits to the controllers in the AWACS, and the TAOR controller


told him they had no radar contacts in that location (“clean there”). The wing pilot
replied to the lead pilot’s alert, noting that his radar also showed the target.
The lead F-15 pilot then switched the interrogation to the second mode (Mode
IV) that all coalition aircraft should be squawking. For the first second it showed
the right symbol, but for the rest of the interrogation (4 to 5 seconds) it said the
target was not squawking Mode IV. The lead F-15 pilot then made a second contact
call to the AWACS over the main radio, repeating the location, altitude, and heading
of his target. This time the AWACS enroute controller responded that he had radar
returns on his scope at the spot (“hits there”) but did not indicate that these returns
might be from a friendly aircraft. At this point, the Black Hawk IFF response was
continuous but the radar returns were intermittent. The enroute controller placed
an “unknown, pending, unevaluated” track symbol in the area of the helicopter’s
radar and IFF returns and attempted to make an IFF identification.
The lead F-15 pilot, after making a second check of Modes I and IV and again
receiving no response, executed a visual identification pass to confirm that the target
was hostile—the next step required in the rules of engagement. He saw what he
thought were Iraqi helicopters. He pulled out his “goody book” with aircraft pictures
in it, checked the silhouettes, and identified the helicopters as Hinds, a type of
Russian aircraft flown by the Iraqis (“Tally two Hinds”). The F-15 wing pilot also
reported seeing two helicopters (“Tally two”), but never confirmed that he had
identified them as Hinds or as Iraqi aircraft.
The lead F-15 pilot called the AWACS and said they were engaging enemy air-
craft (“Tiger Two6 has tallied two Hinds, engaged”), cleared his wingman to shoot
(“Arm hot”), and armed his missiles. He then did one final Mode I check, received
a negative response, and pressed the button that released the missiles. The wingman
fired at the other helicopter, and both were destroyed.
This description represents the chain of events, but it does not explain “why” the
accident occurred except at the most superficial level and provides few clues as to
how to redesign the system to prevent future occurrences. Just looking at these basic
events surrounding the accident, it appears that mistakes verging on gross negli-
gence were involved—undisciplined pilots shot down friendly aircraft in clear skies,
and the AWACS crew and others who were supposed to provide assistance simply
sat and watched without telling the F-15 pilots that the helicopters were there. An
analysis using STAMP, as will be seen, provides a very different level of understand-
ing. In the following analysis, the goal is to understand why the controls in place did
not prevent the accident and to identify the changes necessary to prevent similar
accidents in the future. A related type of hazard analysis can be used during system

design and development (see chapters 8 and 9) to prevent such occurrences in the
first place.
In the following analysis, the basic failures and dysfunctional interactions leading
to the loss at the physical level are identified first. Then each level of the hierarchical
safety control structure is considered in turn, starting from the bottom.
At each level, the context in which the behaviors took place is considered. The
context for each level includes the hazards, the safety requirements and constraints,
the controls in place to prevent the hazard, and aspects of the environment or situ-
ation relevant to understanding the control flaws, including the people involved,
their assigned tasks and responsibilities, and any relevant environmental behavior-
shaping factors. Following a description of the context, the dysfunctional interac-
tions and failures at that level are described, along with the accident factors (see
figure 4.8) that were involved.

footnote. Tiger One was the code name for the F-15 lead pilot, while Tiger Two denoted the wing pilot.


section 5.3.2. Physical Process Failures and Dysfunctional Interactions.
The first step in the analysis is to understand the physical failures and dysfunctional
interactions within the physical process that were related to the accident. Figure 5.5
shows this information.
All the physical components worked exactly as intended, except perhaps for the
IFF system. The fact that the Mode IV IFF gave an intermittent response has never
been completely explained. Even after extensive equipment teardowns and reenact-
ments with the same F-15s and different Black Hawks, no one has been able to
explain why the F-15 IFF interrogator did not receive a Mode IV response [200].
The Accident Investigation Board report states: “The reason for the unsuccessful


Mode IV interrogation attempts cannot be established, but was probably attribut-
able to one or more of the following factors: incorrect selection of interrogation
modes, faulty air-to-air interrogators, incorrectly loaded IFF transponder codes,
garbling of electronic responses, and intermittent loss of line-of-sight radar contact.”7
There were several dysfunctional interactions and communication inadequacies
among the correctly operating aircraft equipment. The most obvious unsafe interac-
tion was the release of two missiles in the direction of two friendly aircraft, but there
were also four obstacles to the type of fighter–helicopter communications that might
have prevented that release.
1. The Black Hawks and F-15s were on different radio frequencies and thus the
pilots could not speak to each other or hear the transmissions between others
involved in the incident, the most critical of which were the radio transmissions
between the two F-15 pilots and between the lead F-15 pilot and personnel
onboard the AWACS. The Black Hawks, according to the Aircraft Control
Order, should have been communicating on the TAOR frequency. Stopping
here and looking only at this level, it appears that the Black Hawk pilots were
at fault in not changing to the TAOR frequency, but an examination of the
higher levels of control points to a different conclusion.
2. Even if they had been on the same frequency, the Air Force fighter aircraft
were equipped with HAVE QUICK II (HQ-II) radios, while the Army heli-
copters were not. The only way the F-15 and Black Hawk pilots could have
communicated would have been if the F-15 pilots switched to non-HQ mode.
The procedures the pilots were given to follow did not tell them to do so. In
fact, with respect to the two helicopters that were shot down, one contained
an outdated version called HQ-I, which was not compatible with HQ-II. The
other was equipped with HQ-II, but because not all of the Army helicopters
supported HQ-II, CFAC refused to provide Army helicopter operations with
the necessary cryptographic support required to synchronize their radios with
the other OPC components.
If the objective of the accident analysis is to assign blame, then the different
radio frequencies could be considered irrelevant because the differing technol-
ogy meant they could not have communicated even if they had been on the
same frequency. If the objective, however, is to learn enough to prevent future
accidents, then the different radio frequencies are relevant.


3. The Black Hawks were not squawking the required IFF Mode I code for those
flying within the TAOR. The GAO report states that Black Hawk pilots told
them they routinely used the same Mode I code for outside the TAOR while
operating within the TAOR and no one had advised them that it was incorrect
to do so. But, again, the wrong Mode I code is only part of the story.
The Accident Investigation Board report concluded that the use of the
incorrect Mode I IFF code by the Black Hawks was responsible for the F-15
pilots’ failure to receive a Mode I response when they interrogated the heli-
copters. However, an Air Force special task force concluded that based on the
descriptions of the system settings that the pilots testified they had used on
the interrogation attempts, the F-15s should have received and displayed any
Mode I or II response regardless of the code [200]. The AWACS was receiving
friendly Mode I and II returns from the helicopters at the same time that the
F-15s received no response. The GAO report concluded that the helicopters’
use of the wrong Mode I code should not have prevented the F-15s from
receiving a response. Confusing the situation even further, the GAO report
cites the Accident Board president as telling the GAO investigators that
because of the difference between the lead F-15 pilot’s statement on the day
of the incident and his testimony to the investigation board, it was difficult to
determine the number of times the lead pilot had interrogated the helicopters
[200].
4. Communication was also impeded by physical line-of-sight restrictions. The
Black Hawks were flying in narrow valleys among very high mountains that
disrupted communication depending on line-of-sight transmissions.
One reason for these dysfunctional interactions lies in the asynchronous evolu-
tion of the Army and Air Force technology, leaving the different services with largely
incompatible radios. Looking only at the event chain or at the failures and dysfunc-
tional interactions in the technical process—a common stopping point in accident
investigations—gives a very misleading picture of the reasons this accident occurred.
Examining the higher levels of control is necessary to obtain the information neces-
sary to prevent future occurrences.
After the shootdown, the following changes were made:
1.•Updated radios were placed on Black Hawk helicopters to enable communica-
tion with fighter aircraft. Until the time the conversion was complete, fighters
were directed to remain on the TAOR clear frequencies for deconfliction with
helicopters.
2.•Helicopter pilots were directed to monitor the common TAOR radio frequency
and to squawk the TAOR IFF codes.



footnote. The commander of the U.S. Army in Europe objected to this sentence. He argued that nothing in the
board report supported the possibility that the codes had been loaded improperly and that it was clear
the Army crews were not at fault in this matter. The U.S. Commander in Chief, Europe, agreed with his
view. Although the language in the opinion was not changed, the former said his concerns were addressed
because the complaint had been included as an attachment to the board report.


section 5.3.3. The Controllers of the Aircraft and Weapons.
The pilots directly control the aircraft, including the activation of weapons (figure
5.6). The context in which their decisions and actions took place is first described, fol-
lowed by the dysfunctional interactions at this level of the control structure. Then the
inadequate control actions are outlined and the factors that led to them are described.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints: The safety constraints that must be enforced
at this level of the sociotechnical control structure were described earlier. The F-15
pilots must know who is in the TAOR and whether they should be there or not—
that is, they must be able to identify accurately the status of all other aircraft in the
TAOR at all times so that a friendly aircraft is not identified as a threat. They must
also follow the rules of engagement (ROE), which specify the procedures to be
executed before firing weapons at any targets. As noted earlier in this chapter, the
OPC ROE were devised by the OPC commander, based on guidelines created by
the Joint Chiefs of Staff, and were purposely conservative because of the many
multinational participants in OPC and the potential for friendly fire accidents. The
ROE were designed to slow down any military confrontation, but were unsuccessful
in this case. An important part of understanding this accident process and prevent-
ing repetitions is understanding why this goal was not achieved.
Controls: As noted in the previous section, the controls at this level included the
rules and procedures for operating in the TAOR (specified in the ACO), informa-
tion provided about daily operations in the TAOR (specified in the Air Tasking
Order or ATO), flowsheets, communication and identification channels (radios and
IFF), training, AWACS oversight, and procedures to keep fighters and helicopters
from coming into contact (for example, the F-15s fly at different altitudes). National
flags were required to be displayed prominently on all aircraft in order to facilitate
identification of their origin.
Roles and Responsibilities of the F-15 Pilots: When conducting combat missions,
aerial tactics dictate that F-15s always fly in pairs with one pilot as the lead and one
as the wingman. They fly and fight as a team, but the lead is always in charge. The
mission that day was to conduct a thorough radar search of the area to ensure that
the TAOR was clear of hostile aircraft (to sanitize the airspace) before the other
aircraft entered. They were also tasked to protect the AWACS from any threats. The
wing pilot was responsible for looking 20,000 feet and higher with his radar while
the lead pilot was responsible for the area 25,000 feet and below. The lead pilot had
final responsibility for the 5,000-foot overlap area.
Environmental and Behavior-Shaping Factors for the F-15 Pilots: The lead pilot
that day was a captain with nine years’ experience in the Air Force. He had flown


F-15s for over three years, including eleven combat missions over Bosnia and nine-
teen over northern Iraq protecting the no-fly zone. The mishap occurred on his sixth
flight during his second tour flying in support of OPC.
The wing pilot was a lieutenant colonel and Commander of the 53rd Fighter
Squadron at the time of the shootdown, and he was a highly experienced pilot.
He had flown combat missions out of Incirlik during Desert Storm and had served
in the initial group that set up OPC afterward. He was credited with the only
confirmed kill of an enemy Hind helicopter during the Gulf War. That downing
involved a beyond visual range shot, which means he never actually saw the
helicopter.
F-15 pilots were rotated through every six to eight weeks. Serving in the no-fly
zone was an unusual chance for peacetime pilots to have a potential for engaging
in combat. The pilots were very aware they were going to be flying in unfriendly
skies. They drew personal sidearms with live rounds, removed wedding bands and
other personal items that could be used by potential captors, were supplied with
blood chits offering substantial rewards for returning downed pilots, and were
briefed about threats in the area. Every part of their preparation that morning drove
home the fact that they could run into enemy aircraft: The pilots were making deci-
sions in the context of being in a war zone and were ready for combat.
Another factor that might have influenced behavior, according to the GAO
report, was rivalry between the F-15 and F-16 pilots engaged in Operation Provide
Comfort (OPC). While such rivalry was normally perceived as healthy and leading
to positive professional competition, at the time of the shootdown the rivalry had
become more pronounced and intense. The Combined Task Force Commander
attributed this atmosphere to the F-16 community’s having executed the only fighter
shootdown in OPC and all the shootdowns in Bosnia [200]. F-16 pilots are better
trained and equipped to intercept low-flying helicopters. The F-15 pilots knew that
F-16s would follow them into the TAOR that day. Any hesitation might have resulted
in the F-16s getting another kill.
A final factor was a strong cultural norm of “radio discipline” (called minimum
communication or min comm), which led to abbreviated phraseology in communica-
tion and a reluctance to clarify potential miscommunications. Fighter pilots are kept
extremely busy in the cockpit; their cognitive capabilities are often stretched to the
limit. As a result, any unnecessary interruptions on the radio are a significant distrac-
tion from important competing demands [191]. Hence, there was a great deal
of pressure within the fighter community to minimize talking on the radio, which
discouraged efforts to check accuracy and understanding.
Roles and Responsibilities of the Black Hawk Pilots: The Army helicopter pilots
flew daily missions into the TAOR to visit Zakhu. On this particular day, a change


of command had taken place at the US Army Command Center at Zakhu. The
outgoing commander was to escort his replacement into the no-fly zone in order to
introduce him to the two Kurdish leaders who controlled the area. The pilots were
first scheduled to fly the routine leg into Zakhu, where they would pick up two
Army colonels and carry other high-ranking VIPs representing the major players in
OPC to the two Iraqi towns of Irbil and Salah ad Din. It was not uncommon for the
Black Hawks to fly this far into the TAOR; they had done it frequently during the
three preceding years of Operation Provide Comfort.
Environmental and Behavior-Shaping Factors for the Black Hawk Pilots: Inside
Iraq, helicopters flew in terrain flight mode, that is, they hugged the ground, both
to avoid midair collisions and to mask their presence from threatening ground-
to-air Iraqi radars. There are three types of terrain flight: Pilots select the appro-
priate mode based on a wide range of tactical and mission-related variables.
Low-level terrain flight is flown when enemy contact is not likely. Contour flying
is closer to the ground than low level, and nap-of-the-earth flying is the lowest
and slowest form of terrain flight, flown only when enemy contact is expected.
Eagle Flight helicopters flew contour mode most of the time in northern Iraq.
They liked to fly in the valleys and the low-level areas. The route they were taking
the day of the shootdown was through a green valley between two steep, rugged
mountains. The mountainous terrain provided them with protection from Iraqi air
defenses during the one-hour flight to Irbil, but it also led to disruptions in
communication.
Because of the distance and thus time required for the mission, the Black Hawks
were fitted with sponsons or pontoon-shaped fuel tanks. The sponsons are mounted
below the side doors, and each holds 230 gallons of extra fuel. The Black Hawks
were painted with green camouflage, while the Iraqi Hinds’ camouflage scheme was
light brown and desert tan. To assist with identification, the Black Hawks were
marked with three two-by-three-foot American flags—one on each door and one
on the nose—and a fourth larger flag on the belly of the helicopter. In addition, two
American flags had been painted on the side of each sponson.
Dysfunctional Interactions at This Level
Communication between the F-15 and Black Hawk pilots was obviously dysfunc-
tional and related to the dysfunctional interactions in the physical process (incom-
patible radio frequencies, IFF codes, and anti-jamming technology) resulting in the
ends of the communication channels not matching and information not being trans-
mitted along the channel. Communication between the F-15 pilots was also hindered
by the minimum communication policy that led to abbreviated messages and a
reluctance to clarify potential miscommunications as described above as well as by
the physical terrain.


Flawed or Inadequate Decisions and Control Actions.
Both the Army helicopter pilots and the F-15 pilots executed inappropriate or
inadequate control actions during their flights, beyond the obviously incorrect F-15
pilot commands to fire on two friendly aircraft.
Black Hawk Pilots:
1.•The Army helicopters entered the TAOR before it had been sanitized by the Air
Force. The Air Control Order or ACO specified that a fighter sweep of the
area must precede any entry of allied aircraft. However, because of the frequent
trips of Eagle Flight helicopters to Zakhu, an official exception had been made
to this policy for the Army helicopters. The Air Force fighter pilots had not
been informed about this exception. Understanding this miscommunication
requires looking at the higher levels of the control structure, particularly the
communication structure at those levels.
2.•The Army pilots did not change to the appropriate radio frequency to be used
in the TAOR. As noted earlier, however, even if they had been on the same
frequency, they would have been unable to communicate with the F-15s because
of the different anti-jamming technology of the radios.
3.•The Army pilots did not change to the appropriate IFF Mode I signal for the
TAOR. Again, as noted above, the F-15s should still have been able to receive
the Mode I response.
F-15 Lead Pilot: The accounts of and explanation for the unsafe control actions of
the F-15 pilots differ greatly among those who have written about the accident.
Analysis is complicated by the fact that any statements the pilots made after the
accident were likely to have been influenced by the fact that they were being inves-
tigated on charges of negligent homicide—their stories changed significantly over
time. Also, in the excitement of the moment, the lead pilot did not make the required
radio call to his wingman requesting that he turn on the HUD8 tape, and he also
forgot to turn on his own tape. Therefore, evidence about certain aspects of what
occurred and what was observed is limited to pilot testimony during the post-acci-
dent investigations and trials.
Complications also arise in determining whether the pilots followed the rules of
engagement (ROE) specified for the no-fly zone, because the ROE are not public
and the relevant section of the Accident Investigation Board Report is censored.
Other sources of information about the accident, however, reference clear instances
of Air Force pilot violations of the ROE.


The following inadequate decisions and control actions can be identified for the
lead F-15 pilot:
1.•
He did not perform a proper visual ID as required by the ROE and did not take
a second pass to confirm the identification. F-15 pilots are not accustomed to
flying close to the ground or to terrain. The lead pilot testified that because of
concerns about being fired on from the ground and the danger associated with
flying in a narrow valley surrounded by high mountains, he had remained high
as long as possible and then dropped briefly for a visual identification that
lasted between 3 and 4 seconds. He passed the helicopter on his left while flying
more than 500 miles an hour and at a distance of about 1,000 feet off to the
side and about 300 feet above the helicopter. He testified:
I was trying to keep my wing tips from hitting mountains and I accomplished two
tasks simultaneously, making a call on the main radio and pulling out a guide that
had the silhouettes of helicopters. I got only three quick interrupted glances of less
than 1.25 seconds each. [159].
The dark green Black Hawk camouflage blended into the green background
of the valley, adding to the difficulty of the identification.
The Accident Investigation Board used pilots flying F-15s and Black Hawks
to recreate the circumstances under which the visual identification was made.
The test pilots were unable to identify the Black Hawks, and they could not
see any of the six American flags on each helicopter. The F-15 pilots could not
have satisfied the ROE identification requirements using the type of visual
identification passes they testified that they made.
2.•
He misidentified the helicopters as Iraqi Hinds. There were two basic incorrect
decisions involved in this misidentification. The first was identifying the UH-60
(Black Hawk) helicopters as Russian Hinds, and the second was assuming that
the Hinds were Iraqi. Both Syria and Turkey flew Hinds, and the helicopters
could have belonged to one of the U.S. coalition partners. The Commander of
the Operations Support Squadron, whose job was to run the weekly detach-
ment squadron meetings, testified that as long as he had been in OPC, he had
reiterated to the squadrons each week that they should be careful about mis-
identifying aircraft over the no-fly zone because there were so many nations
and so many aircraft in the area and that any time F-15s or anyone else picked
up a helicopter on radar, it was probably a U.S., Turkish, or United Nations
helicopter:
Any time you intercept a helicopter as an unknown, there is always a question of
procedures, equipment failure, and high terrain masking the line-of-sight radar. There




are numerous reasons why you would not be able to electronically identify a heli-
copter. Use discipline. It is better to miss a shot than be wrong. [159].
4.•He did not confirm, as required by the ROE, that the helicopters had hostile
intent before firing. The ROE required that the pilot not only determine the
type of aircraft and nationality, but to take into consideration the possibility
the aircraft was lost, in distress, on a medical mission, or was possibly being
flown by pilots who were defecting.
5.•He violated the rules of engagement by not reporting to the Air Command
Element (ACE). According to the ROE, the pilot should have reported to
the ACE (who is in his chain of command and physically located in the
AWACS) that he had encountered an unidentified aircraft. He did not wait for
the ACE to approve the release of the missiles.
6.•He acted with undue and unnecessary haste that did not allow time for those
above him in the control structure (who were responsible for controlling the
engagement) to act. The entire incident, from the first time the pilots received
an indication about helicopters in the TAOR to shooting them down lasted
only seven minutes. Pilots are allowed by the ROE to take action on their own
in an emergency, so the question then becomes whether this situation was an
emergency.
CFAC officials testified that there had been no need for haste. The slow-flying
helicopters had traveled less than fourteen miles since the F-15s first picked
them up on radar, they were not flying in a threatening manner, and they were
flying southeast away from the Security Zone. The GAO report cites the Mission
Director as stating that given the speed of the helicopters, the fighters had time
to return to Turkish airspace, refuel, and still return and engage the helicopters
before they could have crossed south of the 36th Parallel.
The helicopters also posed no threat to the F-15s or to their mission, which
was to protect the AWACS and determine whether the area was clear. One
expert later commented that even if they had been Iraqi Hinds, “A Hind is only
a threat to an F-15 if the F-15 is parked almost stationary directly in front of it
and says ‘Kill me.’ Other than that, it’s probably not very vulnerable” [191].
Piper quotes Air Force Lt. Col. Tony Kern, a professor at the U.S. Air Force
Academy, who wrote about this accident:
Mistakes happen, but there was no rush to shoot these helicopters. The F-15s could
have done multiple passes, or even followed the helicopters to their destination to
determine their intentions. [159].
Any explanation behind the pilot’s hasty action can only be the product of
speculation. Snook attributes the fast reaction to the overlearned defensive

responses taught to fighter pilots. Both Snook and the GAO report mention
the rivalry with the F-16 pilots and a desire of the lead F-15 pilot to shoot down
an enemy aircraft. F-16s would have entered the TAOR ten to fifteen minutes
after the F-15s, potentially allowing the F-16 pilots to get credit for the downing
of an enemy aircraft: F-16s are better trained and equipped to intercept low-
flying helicopters. If the F-15 pilots had involved the chain of command, the
pace would have slowed down, ruining the pilots’ chance for a shootdown. In
addition, Snook argues that this was a rare opportunity for peacetime pilots to
engage in combat.
The goals and motivation behind any human action are unknowable (see
section 2.7). Even in this case where the F-15 pilots survived the accident, there
are many reasons to discount their own explanations, not the least of which is
potential jail sentences. The explanations provided by the pilots right after the
engagement differ significantly from their explanations a week later during the
official investigations to determine whether they should be court-martialed.
But in any case, there was no chance that such slow flying helicopters could
have escaped two supersonic jet fighters in the open terrain of northern Iraq
nor were they ever a serious threat to the F-15s. This situation, therefore, was
not an emergency.
7.•He did not wait for a positive ID from the wing pilot before firing on the heli-
copters and did not question the vague response when he got it: When the lead
pilot called out that he had visually identified two Iraqi helicopters, he asked
the wing pilot to confirm the identification. The wingman called out “Tally Two”
on his radio, which the lead pilot took as confirmation, but which the wing pilot
later testified only meant he saw two helicopters but not necessarily Iraqi
Hinds. The lead pilot did not wait for a positive identification from the wingman
before starting the engagement.
8.•He violated altitude restrictions without permission: According to Piper, the
commander of the OPC testified at one of the hearings,
I regularly, routinely imposed altitude limitations in northern Iraq. On the fourteenth
of April, the restrictions were a minimum of ten thousand feet for fixed-wing aircraft.
This information was in each squadron’s Aircrew Read File. Any exceptions had to
have my approval. [159]
None of the other accident reports, including the official one, mentions this
erroneous action on the part of the pilots. Because this control flaw was never
investigated, it is not possible to determine whether the action resulted from a
“reference channel” problem (i.e., the pilots did not know about the altitude
restriction) or an “actuator” error (i.e., the pilots knew about it but chose to
ignore it for an unknown reason.)

9.•He deviated from the basic mission to protect the AWACS, leaving the AWACS
open to attack: The helicopter could have been a diversionary ploy. The
mission of the first flight into the TAOR was to make sure it was safe for the
AWACS and other aircraft to enter the restricted operating zone. Piper empha-
sizes that that was the only purpose of their mission [159]. Piper, who again is
the only one who mentions it, cites testimony of the commander of OPC during
one of the hearings when asked whether the F-15s exposed the AWACS to
other air threats when they attacked and shot down the helicopters. The
commander replied:
Yes, when the F-15s went down to investigate the helicopters, made numerous passes,
engaged the helicopters and then made more passes to visually reconnaissance the
area, AWACS was potentially exposed for that period of time. [159]



Wing Pilot: The wing pilot, like the lead pilot, violated altitude restrictions and
deviated from the basic mission. In addition:
1.•He did not make a positive identification of the helicopters: His visual identi-
fication was not even as close to the helicopters as the lead F-15 pilot, which
was inadequate to recognize the helicopters, and the wing pilot’s ID lasted only
between two and three seconds. According to a Washington Post article, he told
investigators that he never clearly saw the helicopters before reporting “Tally
Two.” In a transcript of one of his interviews with investigators, he said: “I did
not identify them as friendly; I did not identify them as hostile. I expected to
see Hinds based on the call my flight leader had made. I didn’t see anything
that disputed that.”
Although the wing had originally testified he could not identify the helicop-
ters as Hinds, he reversed his statement between April and six months later
when he testified at the hearing on whether to court-martial him that “I could
identify them as Hinds” [159]. There is no way to determine which of these
contradictory statements is true.
Explanations for continuing the engagement without an identification could
range from an inadequate mental model of the ROE, following the orders of
the lead pilot and assuming that his identification had been proper, the strong
influence on what one sees by what one expects to see, wanting the helicopters
to be hostile, and any combination of these.
2.•He did not tell the lead pilot that he had not identified the helicopters: In
the hearings to place blame for the shootdown, the lead pilot testified that
he had radioed the wing pilot and said, “Tiger One has tallied two Hinds,
confirm.” Both pilots agree to this point, but then the testimony becomes
contradictory.


The hearing in the fall of 1994 on whether the wing pilot should be charged
with twenty-six counts of negligent homicide rested on the very narrow ques-
tion of whether the lead pilot had called the AWACS announcing the engage-
ment before or after the wing pilot responded to the lead pilot’s directive to
confirm whether the helicopters were Iraqi Hinds. The lead pilot testified that
he had identified the helicopters as Hinds and then asked the wing to confirm
the identification. When the wing responded with “Tally Two,” the lead believed
this response signaled confirmation of the identification. The lead then radioed
the AWACS and reported, “Tiger Two has tallied two Hinds, engaged.” The
wing pilot, on the other hand, testified that the lead had called the AWACS
with the “engaged” message before he (the wing pilot) had made his “Tally
Two” radio call to the lead. He said his “Tally Two” call was in response to the
“engaged” call, not the “confirm” call and simply meant that he had both target
aircraft in sight. He argued that once the engaged call had been made, he cor-
rectly concluded that an identification was no longer needed.
The fall 1994 hearing conclusion about which of these scenarios actually
occurred is different than the conclusions in the official Air Force accident
report and that of the hearing officer in another hearing. Again, it is not pos-
sible nor necessary to determine blame here or to determine exactly which
scenario is correct to conclude that the communications were ambiguous. The
minimum communication policy was a factor here as was probably the excite-
ment of a potential combat engagement. Snook suggests that the expectations
of what the pilots expected to hear resulted in a filtering of the inputs. Such
filtering is a well-known problem in airline pilots’ communications with con-
trollers. The use of well-established phraseology is meant to reduce it. But the
calls by the wing pilot were nonstandard. In fact, Piper notes that in pilot train-
ing bases and programs that train pilots to fly fighter aircraft since the shoot-
down, these radio calls are used as examples of “the poorest radio communications
possibly ever given by pilots during a combat intercept” [159].
3.•
He continued the engagement despite the lack of an adequate identification:
Explanations for continuing the engagement without an identification could
range from an inadequate mental model of the ROE, following the orders
of the lead pilot and assuming that the lead pilot’s identification had been
proper, wanting the helicopters to be hostile, and any combination of these.
With only his contradictory testimony, it is not possible to determine
the reason.
Some Reasons for the Flawed Control Actions and Dysfunctional Interactions
The accident factors shown in figure 4.8 can be used to provide an explanation for
the flawed control actions. These factors here are divided into incorrect control


algorithms, inaccurate mental models, poor coordination among multiple control-
lers, and inadequate feedback from the controlled process.
Incorrect Control Algorithms: The Black Hawk pilots correctly followed the pro-
cedures they had been given (see the discussion of the CFAC–MCC level later).
These procedures were unsafe and were changed after the accident.
The F-15 pilots apparently did not execute their control algorithms (the proce-
dures required by the rules of engagement) correctly, although the secrecy involved
in the ROE make this conclusion difficult to prove. After the accident, the ROE
were changed, but the exact changes made are not public.
Inaccurate Mental Models of the F-15 Pilots: There were many inconsistencies
between the mental models of the Air Force pilots and the actual process state. First,
they had an ineffective model of what a Black Hawk helicopter looked like. There
are several explanations for this, including poor visual recognition training and the
fact that Black Hawks with sponsons attached resemble Hinds. None of the pictures
of Black Hawks on which the F-15 pilots had been trained had these wing-mounted
fuel tanks. Additional factors include the speeds at which the F-15 pilots do their
visual identification (VID) passes and the angle at which the pilots passed over
their targets.
Both F-15 pilots received only limited visual recognition training in the previous
four months, partly due to the disruption of normal training caused by their wing’s
physical relocation from one base to another in Germany. But the training was
probably inadequate even if it had been completed. Because the primary mission
of F-15s is air-to-air combat against other fast-moving aircraft, most of the opera-
tional training is focused on their most dangerous and likely threats—other high-
altitude fighters. In the last training before the accident, only five percent of the
slides depicted helicopters. None of the F-15 intelligence briefings or training ever
covered the camouflage scheme of Iraqi helicopters, which was light brown and
desert tan (in contrast to the forest green camouflage of the Black Hawks).
Pilots are taught to recognize many different kinds of aircraft at high speeds using
“beer shots,” which are blurry pictures that resemble how the pilot might see those
aircraft while in flight. The Air Force pilots, however, received very little training in
the recognition of Army helicopters, which they rarely encountered because of the
different altitudes at which they flew. All the helicopter photos they did see during
training, which were provided by the Army, were taken from the ground—a perspec-
tive from which it was common for Army personnel to view them but not useful
for a fighter pilot in flight above them. None of the photographs were taken from
the above aft quadrant—the position from which most fighters would view a heli-
copter. Air Force visual recognition training and procedures were changed after
this accident.


The F-15 pilots also had an inaccurate model of the current airspace occupants,
based on the information they had received about who would be in the airspace
that day and when. They assumed and had been told in multiple ways that they
would be the first coalition aircraft in the TAOR:
1.• The AGO specified that no coalition aircraft (fixed or rotary wing) was allowed
to enter the TAOR before it was sanitized by a fighter sweep.
2.• The daily ATO and ARF included a list of all flights scheduled to be in the
TAOR that day. The ATO listed the Army Black Hawk flights only in terms of
their call signs, aircraft numbers, type of mission (transport), and general route
(from Diyarbakir to the TAOR and back to Diyarbakir). All departure times
were listed “as required” and no helicopters were mentioned on the daily flow-
sheet. Pilots fly with the flowsheet on kneeboards as a primary reference during
the mission. The F-15s were listed as the very first mission into the TAOR; all
other aircraft were scheduled to follow them.
3.•
During preflight briefings that morning, the ATO and flowsheet were reviewed
in detail. No mention was made of any Army helicopter flights not appearing
on the flowsheet.
4.• The
Battle Sheet Directive (a handwritten sheet containing last-minute
changes to information published in the ATO and the ARF) handed to them
before going to their aircraft contained no information about Black Hawk
flights.
5.•In a radio call to the ground-based Mission Director just after engine start, the
lead F-15 pilot was told that no new information had been received since the
ATO was published.
6.•Right before entering the TAOR, the lead pilot checked in again, this time with
the ACE in the AWACS. Again, he was not told about any Army helicopters
in the area.
7.• At 10 20, the lead pilot reported that they were on station. Usually at this time,
the AWACS will give them a “picture” of any aircraft in the area. No informa-
tion was provided to the F-15 pilots at this time, although the Black Hawks had
already checked in with the AWACS on three separate occasions.
8.• The
AWACS continued not to inform the pilots about Army helicopters
during the encounter. The lead F-15 pilot twice reported unsuccessful attempts
to identify radar contacts they were receiving, but in response they were not
informed about the presence of Black Hawks in the area. After the first
report, the TAOR controller responded with “Clean there,” meaning he did
not have a radar hit in that location. Three minutes later, after the second
call, the TAOR controller replied, “Hits there.” If the radar signal had been



identified as a friendly aircraft, the controller would have responded, “Paint
there.”
9.• The IFF transponders on the F-15s did not identify the signals as from a friendly
aircraft, as discussed earlier.
Various complex analyses have been proposed to explain why the F-15 pilots’ mental
models of the airspace occupants were incorrect and not open to reexamination
once they received conflicting input. But a possible simple explanation is that they
believed what they were told. It is well known in cognitive psychology that mental
models are slow to change, particularly in the face of ambiguous evidence like that
provided in this case. When operators receive input about the state of the system
being controlled, they will first try to fit that information into their current mental
model and will find reasons to exclude information that does not fit. Because opera-
tors are continually testing their mental models against reality (see figure 2.9), the
longer a model has been held and the more different sources of information that
led to that incorrect model, the more resistant the models will be to change due to
conflicting information, particularly ambiguous information. The pilots had been
told repeatedly and by almost everyone involved that there were no friendly heli-
copters in the TAOR at that time.
The F-15 pilots also may have had a misunderstanding about (incorrect model
of) the ROE and the procedures required when they detected an unidentified
aircraft. The accident report says that the ROE were reduced in briefings and in
individual crew members’ understandings to a simplified form. This simplification
led to some pilots not being aware of specific considerations required prior to
engagement, including identification difficulties, the need to give defectors safe
conduct, and the possibility of an aircraft being in distress and the crew being
unaware of their position. On the other hand, there had been an incident the week
before and the F-15 pilots had been issued an oral directive reemphasizing the
requirement for fighter pilots to report to the ACE. That directive was the result
of an incident on April 7 in which F-15 pilots had initially ignored directions from
the ACE to “knock off” or stop an intercept with an Iraqi aircraft. The ACE over-
heard the pilots preparing to engage the aircraft and contacted them, telling them
to stop the engagement because he had determined that the hostile aircraft was
outside the no-fly zone and because he was leery of a “bait and trap” situation.9
The GAO report stated that CFAC officials told the GAO that the F-15 community
was “very upset” about the intervention of the ACE during the knock-off incident

and felt he had interfered with the carrying out of the F-15 pilots’ duties [200].
As discussed in chapter 2, there is no way to determine the motivation behind
an individual’s actions. Accident analysts can only present the alternative
explanations.
Additional reasons for the lead pilot’s incorrect mental model stem from ambigu-
ous or missing feedback from the F-15 wing pilot, dysfunctional communication with
the Black Hawks, and inadequate information provided over the reference channels
from the AWACS and CFAC operations.



footnote. . According to the GAO report, in such a strategy, a fighter aircraft is lured into an area by one or more
enemy targets and then attacked by other fighter aircraft or surface-to-air missiles.



Inaccurate Mental Models of the Black Hawk Pilots: The Black Hawk control
actions can also be linked to inaccurate mental models, that is, they were unaware
there were separate IFF codes for flying inside and outside the TAOR and that they
were supposed to change radio frequencies inside the TAOR. As will be seen later,
they were actually told not to change frequencies. They had also been told that the
AGO restriction on the entry of allied aircraft into the TAOR before the fighter
sweep did not apply to them—an official exception had been made for helicopters.
They understood that helicopters were allowed inside the TAOR without AWACS
coverage as long as they stayed inside the security zone. In practice, the Black Hawk
pilots frequently entered the TAOR prior to AWACS and fighter support without
incident or comment, and therefore it became accepted practice.
In addition, because their radios were unable to pick up the HAVE QUICK
communications between the F-15 pilots and between the F-15s and the AWACS,
the Black Hawk pilots’ mental models of the situation were incomplete. According
to Snook, Black Hawk pilots testified during the investigation,
We were not integrated into the entire system. We were not aware of what was going on
with the F-15s and the sweep and the refuelers and the recon missions and AWACS. We
had no idea who was where and when they were there. [191]
Coordination among Multiple Controllers: At this level, each component (air-
craft) had a single controller and thus coordination problems did not occur. They
were rife, however, at the higher control levels.
Feedback from the Controlled Process: The F-15 pilots received ambiguous infor-
mation from their visual identification pass. At the speeds and altitudes they were
traveling, it is unlikely that they would have detected the unique Black Hawk mark-
ings that identified them as friendly. The mountainous terrain in which they were
flying limited their ability to perform an adequate identification pass and the green
helicopter camouflage added to the difficulty. The feedback from the wingman to
the lead F-15 pilot was also ambiguous and was most likely misinterpreted by the
lead pilot. Both pilots apparently received incorrect IFF feedback.


Changes after the Accident
After the accident, Black Hawk pilots were:
1.•Required to strictly adhere to their ATO published routing and timing.
2.•Not allowed to operate in the TAOR unless under positive control of AWACS.
Without AWACS coverage, only administrative helicopter flights between
Diyarbakir and Zakhu were allowed, provided they were listed on the ATO.
3.•Required to monitor the common TAOR radio frequency.
4.•Required to confirm radio contact with AWACS at least every twenty minutes
unless they were on the ground.
5.•Required to inform AWACS upon landing. They must make mandatory radio
calls at each enroute point.
6.•If radio contact could not be established, required to climb to line-of-sight with
AWACS until contact is reestablished.
7.•Prior to landing in the TAOR (including Zakhu), required to inform the
AWACS of anticipated delays on the ground that would preclude taking off at
the scheduled time.
8.•Immediately after takeoff, required to contact the AWACS and reconfirm
IFF Modes I, II, and IV are operating. If they have either a negative radio
check with AWACS or an inoperative Mode IV, they cannot proceed into the
TAOR.
All fighter pilots were:
9.•Required to check in with the AWACS when entering the low-altitude environ-
ment and remain on the TAOR clear frequencies for deconfliction with
helicopters.
10.•Required to make contact with AWACS using UHF, HAVE QUICK, or UHF
clear radio frequencies and confirm IFF Modes I, II, and IV before entering
the TAOR. If there was either a negative radio contact with AWACS or an
inoperative Mode IV, they could not enter the TAOR.
Finally, white recognition strips were painted on the Black Hawk rotor blades to
enhance their identification from the air.

section 5.3.4.
The ACE and Mission Director.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints: The ACE and mission director must follow
the procedures specified and implied by the ROE, the ACE must ensure that pilots


follow the ROE, and the ACE must interact with the AWACS crew to identify
reported unidentified aircraft (see figure 5.7).
Controls: The controls include the ROE to slow down the engagement and a chain
of command to prevent individual error or erratic behavior.
Roles and Responsibilities: The ACE was responsible for controlling combat oper-
ations and for ensuring that the ROE were enforced. He flew in the AWACS so he
could get up-to-the-minute information about the state of the TAOR airspace.
The ACE was always a highly experienced person with fighter experience. That
day, the ACE was a major with nineteen years in the Air Force. He had perhaps
more combat experience than anyone else in the Air Force under forty. He had
logged 2,000 total hours of flight time and flown 125 combat missions, including 27
in the Gulf War, during which time he earned the Distinguished Flying Cross and
two air medals for heroism. At the time of the accident, he had worked for four
months as an ACE and flown approximately fifteen to twenty missions on the
AWACS [191].
The Mission Director on the ground provided a chain of command for real-time
decision making from the pilots to the CFAC commander. On the day of the acci-
dent, the Mission Director was a lieutenant colonel with more than eighteen years
in the Air Force. He had logged more than 1,000 hours in the F-4 in Europe and an
additional 100 hours worldwide in the F-15 [191].
Environmental and Behavior-Shaping Factors: No pertinent factors were identified
in the reports and books on the accident.

Dysfunctional Interactions at This Level.
The ACE was supposed to get information about unidentified or enemy aircraft
from the AWACS mission crew, but in this instance they did not provide it.

Flawed or Inadequate Decisions and Control Actions.
The ACE did not provide any control commands to the F-15s with respect to fol-
lowing the ROE or engaging and firing on the U.S. helicopters.

Reasons for Flawed Control Actions and Dysfunctional Interactions.
Incorrect Control Algorithms: The control algorithms should theoretically have
been effective, but they were never executed.
Inaccurate Mental Models: CFAC, and thus the Mission Director and ACE, exer-
cised ultimate tactical control of the helicopters, but they shared the common view
with the AWACS crew that helicopter activities were not an integral part of OPC
air operations. In testimony after the accident, the ACE commented, “The way I
understand it, only as a courtesy does the AWACS track Eagle Flight.”

The Mission Director and ACE also did not have the information necessary to
exercise their responsibility. The ACE had an inaccurate model of where the Black
Hawks were located in the airspace. He testified that he presumed the Black Hawks
were conducting standard operations in the Security Zone and had landed [159].
He also testified that, although he had a radarscope, he had no knowledge of
AWACS radar symbology: “I have no idea what those little blips mean.” The Mission
Director, on the ground, was dependent on the information about the current air-
space state sent down from the AWACS via JTIDS (the Joint Tactical Information
Distribution System).
The ACE testified that he assumed the F-15 pilots would ask him for guidance
in any situation involving a potentially hostile aircraft, as required by the ROE. The
ACE’s and F-15 pilots’ mental models of the ROE clearly did not match with respect
to who had the authority to initiate the engagement of unidentified aircraft. The
rules of engagement stated that the ACE was responsible, but some pilots believed
they had authority when an imminent threat was involved. Because of security
concerns, the actual ROE used were not disclosed during the accident investigation,
but, as argued earlier, the slow, low-flying Black Hawks posed no serious threat
to an F-15.
Although the F-15 pilot never contacted the ACE about the engagement, the
ACE did hear the call of the F-15 lead pilot to the TAOR controller. The ACE
testified to the Accident Investigation Board that he did not intervene because
he believed the F-15 pilots were not committed to anything at the visual identi-
fication point, and he had no idea they were going to react so quickly. Since being
assigned to OPC, he said the procedure had been that when the F-15s or other
fighters were investigating aircraft, they would ask for feedback from the ACE.
The ACE and AWACS crew would then try to rummage around and find
out whose aircraft it was and identify it specifically. If they were unsuccessful, the
ACE would then ask the pilots for a visual identification [159]. Thus, the ACE
probably assumed that the F-15 pilots would not fire at the helicopters without
reporting to him first, which they had not done yet. At this point, they had simply
requested an identification by the AWACS traffic controller. According to his
understanding of the ROE, the F-15 pilots would not fire without his approval
unless there was an immediate threat, which there was not. The ACE testified that
he expected to be queried by the F-15 pilots as to what their course of action
should be.
The ACE also testified at one of the hearings:
I really did not know what the radio call “engaged” meant until this morning. I did
not think the pilots were going to pull the trigger and kill those guys. As a previous right
seater in an F-111, I thought “engaged” meant the pilots were going down to do a visual
intercept. [159]


Coordination among Multiple Controllers: Not applicable.
Feedback from Controlled Process: The F-15 lead pilot did not follow the ROE
and report the identified aircraft to the ACE and ask for guidance, although the
ACE did learn about it from the questions the F-15 pilots posed to the controllers
on the AWACS aircraft. The Mission Director got incorrect feedback about the state
of the airspace from JTIDS.
Time Lags: An unusual time lag occurred where the lag was in the controller and
not in one of the other parts of the control loop.10 The F-15 pilots responded faster
than the ACE (in the AWACS) and Mission Director (on the ground) could issue
appropriate control instructions (as required by the ROE) with regard to the
engagement.
Changes after the Accident.
There were no changes after the accident, although roles were clarified.
secton 5.3.5. The AWACS Operators.
This level of the control structure contains more examples of inconsistent mental
models and asynchronous evolution. In addition, this control level provides interest-
ing examples of the adaptation over time of specified procedures to accepted prac-
tice and of coordination problems. There were multiple controllers with confused
and overlapping responsibilities for enforcing different aspects of the safety require-
ments and constraints (figure 5.8). The overlaps and boundary areas in the con-
trolled processes led to serious coordination problems among those responsible for
controlling aircraft in the TAOR.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints: The general safety constraint involved in
the accident at this level was to prevent misidentification of aircraft by the pilots
and any friendly fire that might result. More specific requirements and constraints
are shown in figure 5.8.
Controls: Controls included procedures for identifying and tracking aircraft, train-
ing (including simulator missions), briefings, staff controllers, and communication
channels. The senior director and surveillance officer (ASO) provided real-time
oversight of the crew’s activities, while the mission crew commander (MCC) coor-
dinated all the activities aboard the AWACS aircraft.



footnote. A similar type of time lag led to the loss of an F-18 when a mechanical failure resulted in inputs
arriving at the computer interface faster than the computer was able to process them


The Delta Point system, used since the inception of OPC, provided standard code
names for real locations. These code names were used to prevent the enemy, who
might be listening to radio transmissions, from knowing the helicopters’ flight plans.
Roles and Responsibilities: The AWACS crew were responsible for identifying,
tracking, and controlling all aircraft enroute to and from the TAOR; for coordinating
air refueling; for providing airborne threat warning and control in the TAOR; and
for providing surveillance, detection and identification of all unknown aircraft.
Individual responsibilities are described in section 5.2.
The staff weapons director (instructor) was permanently assigned to Incirlik. He
did all incoming briefings for new AWACS crews rotating into Incirlik and accom-
panied them on their first mission in the TAOR. The OPC leadership recognized
the potential for some distance to develop between stateside spin-up training and
continuously evolving practice in the TAOR. Therefore, as mentioned earlier, per-
manent staff or instructor personnel flew with each new AWACS crew on their
maiden flight in Turkey. Two of these staff controllers were on the AWACS the day
of the accident to answer any questions that the new crew might have about local
procedures and, as described earlier, to inform them about adaptation of accepted
practice from specified procedures.
The SD had worked as an AWACS controller for five years. This was his fourth
deployment to OPC, his second as an SD, and his sixtieth mission over the Iraqi
TAOR [159]. He worked as a SD more than two hundred days a year and had logged
more than 2,383 hours flying time [191].
The enroute controller, who was responsible for aircraft outside the TAOR, was
a first lieutenant with four years in the Air Force. He had finished AWACS training
two years earlier (May 1992) and had served in the Iraqi TAOR previously [191].
The TAOR controller, who was responsible for controlling all air traffic flying
within the TAOR, was a second lieutenant with more than nine years of service in
the Air Force, but he had just finished controller’s school and had had no previous
deployments outside the continental United States. In fact, he had become mission
ready only two months prior to the incident. This tour was his first in OPC and his
first time as a TAOR controller. He had only controlled as a mission-ready weapons
director on three previous training flights [191] and never in the role of TAOR
controller. AWACS guidance at the time suggested that the most inexperienced
controller be placed in the TAOR position: None of the reports on the accident
provided the reasoning behind this practice.
The air surveillance officer (ASO) was a captain at the time of the shootdown. She
had been mission-ready since October 1992 and was rated as an instructor ASO.
Because the crew’s originally assigned ASO was upgrading and could not make it to
Turkey on time, she volunteered to fill in for him. She had already served for five and

a half weeks in OPC at the time of the accident and was completing her third assign-
ment to OPC. She worked as an ASO approximately two hundred days a year [191].
Environmental and Behavior-Shaping Factors: At the time of the shootdown,
shrinking defense budgets were leading to base closings and cuts in the size of the
military. At the same time, a changing political climate, brought about by the fall of
the Soviet Union, demanded significant U.S. military involvement in a series of
operations. The military (including the AWACS crews) were working at a greater
pace than they had ever experienced due to budget cuts, early retirements, force
outs, slowed promotions, deferred maintenance, and delayed fielding of new equip-
ment. All of these factors contributed to poor morale, inadequate training, and high
personnel turnover.
AWACS crews are stationed and trained at Tinker Air Force Base in Oklahoma
and then deployed to locations around the world for rotations lasting approximately
thirty days. Although all but one of the AWACS controllers on the day of the acci-
dent had served previously in the Iraqi no-fly zone, this was their first day working
together and, except for the surveillance officer, the first day of their current rota-
tion. Due to last minute orders, the team got only minimal training, including one
simulator session instead of the two full three-hour sessions required prior to
deploying. In the only session they did have, some of the members of the team were
missing—the ASO, ACE, and MCC were unable to attend—and one was later
replaced: As noted, the ASO originally designated and trained to deploy with this
crew was instead shipped off to a career school at the last minute, and another ASO,
who was just completing a rotation in Turkey, filled in.
The one simulator session they did receive was less than effective, partly because
the computer tape provided by Boeing to drive the exercise was not current (another
instance of asynchronous evolution). For example, the maps were out of date,
and the rules of engagement used were different and much more restrictive than
those currently in force in OPC. No Mode I codes were listed. The list of friendly
participants in OPC did not include UH-60s (Black Hawks) and so on. The second
simulation session was canceled because of a wing exercise.
Because the TAOR area had not yet been sanitized, it was a period of low activ-
ity: At the time, there were still only four aircraft over the no-fly zone—the two
F-15s and the two Black Hawks. AWACS crews are trained and equipped to track
literally hundreds of enemy and friendly aircraft during a high-intensity conflict.
Many accidents occur during periods of low activity when vigilance is reduced com-
pared to periods of higher activity.
The MCC sits with the other two key supervisors (SD and ACE) toward the front
of the aircraft in a three-seat arrangement named the “Pit,” where each has his own
radarscope. The SD is seated to the MCC’s left. Surveillance is seated in the rear.


Violations of the no-fly zone had been rare and threats few during the past three
years, so that day’s flight was expected to be an average one, and the supervisors in
the Pit anticipated just another routine mission [159].
During the initial orbit of the AWACS, the technicians determined that one
of the radar consoles was not operating. According to Snook, this type of problem
was not uncommon, and the AWACS is therefore designed with extra crew positions.
When the enroute controller realized his assigned console was not working properly,
he moved from his normal position between the TAOR and tanker controllers,
to a spare seat directly behind the senior director. This position kept him out of
the view of his supervisor and also eliminated physical contact with the TAOR
controller.
Dysfunctional Interactions among the Controllers
According to the formal procedures, control of aircraft was supposed to be handed
off from the enroute controller to the TAOR controller when the aircraft entered
the TAOR. This handoff did not occur for the Black Hawks, and the TAOR control-
ler was not made aware of the Black Hawks’ flight within the TAOR. Snook explains
this communication error as resulting from the radar console failure, which inter-
fered with communication between the TAOR and enroute controllers. But this
explanation does not gibe with the fact that the normal procedure of the enroute
controller was to continue to control helicopters without handing them off to the
TAOR controller, even when the enroute and TAOR controllers were seated in their
usual places next to each other. There may usually have been more informal interac-
tion about aircraft in the area when they were seated next to each other, but there
is no guarantee that such interaction would have occurred even with a different
seating arrangement. Note that the helicopters had been dropped from the radar
screens and the enroute controller had an incorrect mental model of where they
were: He thought they were close to the boundary of the TAOR and was unaware
they had gone deep within it. The enroute controller, therefore, could not have told
the TAOR controller about the true location of the Black Hawks even if they had
been sitting next to each other.
The interaction between the surveillance officer and the senior weapons director
with respect to tracking the helicopter flight on the radar screen involved many dys-
functional interactions. For example, the surveillance officer put an attention arrow
on the senior director’s radarscope in an attempt to query him about the lost heli-
copter symbol that was floating, at one point, unattached to any track. The senior
director did not respond to the attention arrow, and it automatically dropped off the
screen after sixty seconds. The helicopter symbol (H) dropped off the radar screen
when the radar and IFF returns from the Black Hawks faded and did not return until
just before the engagement, removing any visual reminder to the AWACS crew that



there were Black Hawks inside the TAOR. The accident investigation did not include
an analysis of the design of the AWACS human–computer interface or how it might
have contributed to the accident, although such an analysis is important in fully
understanding why it made sense for the controllers to act the way they did.
During his court-martial for negligent homicide, the senior director argued that
his radarscope did not identify the helicopters as friendly and that therefore he was
not responsible. When asked why the Black Hawk identification was dropped from
the radarscope, he gave two reasons. First, because it was no longer attached to any
active signal, they assumed the helicopter had landed somewhere. Second, because
the symbol displayed on their scopes was being relayed in real time through a JTIDS
downlink to commanders on the ground, they were very concerned about sending
out an inaccurate picture of the TAOR.
Even if we suspended it, it would not be an accurate picture, because we wouldn’t know
for sure if that is where he landed. Or if he landed several minutes earlier, and where
that would be. So, the most accurate thing for us to do at that time, was to drop the
symbology [sic].
Flawed or Inadequate Decision Making and Control Actions.
There were myriad inadequate control actions in this accident, involving each of the
controllers in the AWACS. The AWACS crew work as a team so it is sometimes hard
to trace incorrect decisions to one individual. While from each individual’s stand-
point the actions and decisions may have been correct, when put together as a whole
the decisions were incorrect.
The enroute controller never told the Black Hawk pilots to change to the TAOR
frequency that was being monitored by the TAOR controller and did not hand off
control of the Black Hawks to the TAOR controller. The established practice of not
handing off the helicopters had probably evolved over time as a more efficient way
of handling traffic—another instance of asynchronous evolution. Because the heli-
copters were usually only at the very border of the TAOR and spent very little time
there, the overhead of handing them off twice within a short time period was con-
sidered inefficient by the AWACS crews. As a result, the procedures used had
changed over time to the more efficient procedure of keeping them under the
control of the enroute controller. The AWACS crews were not provided with written
guidance or training regarding the control of helicopters within the TAOR, and, in
its absence, they adapted their normal practices for fixed-wing aircraft as best they
could to apply them to helicopters.
In addition to not handing off the helicopters, the enroute controller did not
monitor the course of the Black Hawks while they were in the TAOR (after leaving
Zakhu), did not take note of the flight plan (from Whiskey to Lima), did not alert
the F-15 pilots there were friendly helicopters in the area, did not alert the F-15



pilots before they fired that the helicopters they were targeting were friendly, and
did not tell the Black Hawk pilots that they were on the wrong frequency and were
squawking the wrong IFF Mode I code.
The TAOR controller did not monitor the course of the Black Hawks in the
TAOR and did not alert the F-15 pilots before they fired that the helicopters they
were targeting were friendly. None of the controllers warned the F-15 pilots at any
time that there were friendly helicopters in the area nor did they try to stop the
engagement. The accident investigation board found that because Army helicopter
activities were not normally known at the time of the fighter pilots’ daily briefings,
normal procedures were for the AWACS crews to receive real-time information
about their activities from the helicopter crews and to relay that information on to
the other aircraft in the area. If this truly was established practice, it clearly did not
occur on that day.
The controllers were supposed to be tracking the helicopters using the Delta
Point system, and the Black Hawk pilots had reported to the enroute controller that
they were traveling from Whiskey to Lima. The enroute controller testified, however,
that he had no idea of the towns to which the code names Whiskey and Lima
referred. After the shootdown, he went in search of the card defining the call signs
and finally found it in the Surveillance Section [159]. Clearly, tracking helicopters
using call signs was not a common practice or the charts would have been closer at
hand. In fact, during the court-martial of the senior director, the defense was unable
to locate any AWACS crewmember at Tinker AFB (where AWACS crews were
stationed and trained) who could testify that he or she had ever used the Delta Point
system [159] although clearly the Black Hawk pilots thought it was being used
because they provided their flight plan using Delta Points.
None of the controllers in the AWACS told the Black Hawk helicopters that
they were squawking the wrong IFF code for the TAOR. Snook cites testimony
from the court-martial of the senior director that posits three related explanations
for this lack of warning: (1) the minimum communication (min comm) policy, (2) a
belief by the AWACS crew that the Black Hawks should know what they were
doing, and (3) pilots not liking to be told what to do. None of these explanations
provided during the trial is very satisfactory and appear to be after-the-fact ratio-
nalizations for the controllers not doing their job when faced with possible court-
martial and jail terms. Given that the controllers acknowledged that the Army
helicopters never squawked the right codes and had not done so for months, there
must have been other communication channels that could have been used besides
real-time radio communication to remedy this situation, so the min comm policy is
not an adequate explanation. Arguing that the pilots should know what they were
doing is simply an abdication of responsibility, as is the argument that pilots did not
like being told what to do. A different perspective, and one that likely applies to all


the controllers, was provided by the staff weapons director, who testified, “For a
helicopter, if he’s going to Zakhu, I’m not that concerned about him going beyond
that. So, I’m not really concerned about having an F-15 needing to identify this
guy.” [159]
The mission crew commander had provided the crew’s morning briefing. He
spent some time going over the activity flowsheet, which listed all the friendly air-
craft flying in the OPC that day, their call signs, and the times they were scheduled
to enter the TAOR. According to Piper (but nobody else mentions it), he failed to
note the helicopters, even though their call signs and their IFF information had been
written on the margin of his flowsheet.
The shadow crew always flew with new crews on their first day in OPC, but the
task of these instructors does not seem to have been well defined. At the time of
the shootdown, one was in the galley “taking a break,” and the other went back to
the crew rest area, read a book, and took a nap. The staff weapons director, who was
asleep in the back of the AWACS, during the court-martial of the senior director
testified that his purpose on the mission was to be the “answer man,” just to answer
any questions they might have. This was a period of very little activity in the area
(only the two F-15s were supposed to be in the TAOR), and the shadow crew
members may have thought their advice was not needed at that time.
When the staff weapons director went back to the rest area, the only symbol
displayed on the scopes of the AWACS controllers was the one for the helicopters
(EE01), which they thought were going to Zakhu only.
Because many of the dysfunctional actions of the crew did conform to the estab-
lished practice (e.g., not handing off helicopters to the TAOR controller), it is
unclear what different result might have occurred if the shadow crew had been in
place. For example, the staff weapons director testified during the hearings and trial
that he had seen helicopters out in the TAOR before, past Zakhu, but he really did
not feel it was necessary to brief crews about the Delta Point system to determine
a helicopter’s destination [159].
Reasons for the Flawed Control.
Inadequate Control Algorithms: This level of the accident analysis provides an
interesting example of the difference between prescribed procedures and estab-
lished practice, the adaptation of procedures over time, and migration toward the
boundaries of safe behavior. Because of the many helicopter missions that ran from
Diyarbakir to Zakhu and back, the controllers testified that it did not seem worth

handing them off and switching them over to the TAOR frequency for only a few
minutes. Established practice (keeping the helicopters under the control of the
enroute controller instead of handing them off to the TAOR controller) appeared
to be safe until the day the helicopters’ behavior differed from normal, that is, they
stayed longer in the TAOR and ventured beyond a few miles inside the boundaries.
Established practice no longer assured safety under these conditions. A complicat-
ing factor in the accident was the universal misunderstanding of each of the control-
lers’ responsibilities with respect to tracking Army helicopters.
Snook suggests that the min comm norm contributed to the AWACS crew’s
general reluctance to enforce rules, contributed to AWACS not correcting Eagle
Flight’s improper Mode I code, and discouraged controllers from pushing helicopter
pilots to the TAOR frequency when they entered Iraq because they were reluctant
to say more than absolutely necessary.
According to Snook, there were also no explicit or written procedures regarding
the control of helicopters. He states that radio contact with helicopters was lost
frequently, but there were no procedures to follow when this occurred. In contrast,
Piper claims the AWACS operations manual says:
Helicopters are a high interest track and should be hard copied every five minutes in
turkey and every two minutes in Iraq. These coordinates should be recorded in a special
log book, because radar contact with helicopters is lost and the radar symbology [sic] can
be suspended. [159].
There is no information in the publicly available parts of the accident report about
any special logbook or whether such a procedure was normally followed.

footnote. Even if the actions of the shadow crew did not contribute to this particular accident, we can take
advantage of the accident investigation to perform a safety audit on the operation of the system and
identify potential improvements.


Inaccurate and Inconsistent Mental Models: In general, the AWACS crew (and
the ACE) shared the common view that helicopter activities were not an integral
part of OPC air operations. There was also a misunderstanding about which provi-
sions of the ATO applied to Army helicopter activities.
Most of the people involved in the control of the F-15s were unaware of the
presence of the Black Hawks in the TAOR that day, the lone exception perhaps
being the enroute controller who knew they were there but apparently thought
they would stay at the boundaries of the TAOR and thus were far from their actual
location deep within it. The TAOR controller testified that he had never talked to
the Black Hawks: Following their two check-ins with the enroute controller, the
helicopters had remained on the enroute frequency (as was the usual, accepted
practice), even as they flew deep into the TAOR.
The enroute controller, who had been in contact with the Black Hawks, had an
inaccurate model of where the helicopters were. When the Black Hawk pilots origi-
nally reported their takeoff from the Army Military Coordination Center at Zakhu,
they contacted the enroute controller and said they were bound for Lima. The



enroute controller did not know to what city the call sign Lima referred and did not
try to look up this information. Other members of the crew also had inaccurate
models of their responsibilities, as described in the next section. The Black Hawk
pilots clearly thought the AWACS was tracking them and also thought the con-
trollers were using the Delta Point system—otherwise helicopter pilots would not
have provided the route names in that way.
The AWACS crews did not appear to have accurate models of the Black Hawks
mission and role in OPC. Some of the flawed control actions seem to have resulted
from a mental model that helicopters only went to Zakhu and therefore did not
need to be tracked or to follow the standard TAOR procedures.
As with the pilots and their visual recognition training, the incorrect mental
models may have been at least partially the result of the inadequate AWACS train-
ing the team received.
Coordination among Multiple Controllers: As mentioned earlier, coordination
problems are pervasive in this accident due to overlapping control responsibilities
and confusion about responsibilities in the boundary areas of the controlled process.
Most notably, the helicopters usually operated close to the boundary of the TAOR,
resulting in confusion over who was or should be controlling them.
The official accident report noted a significant amount of confusion within the
AWACS mission crew regarding the tracking responsibilities for helicopters [5]. The
mission crew commander testified that nobody was specifically assigned responsibil-
ity for monitoring helicopter traffic in the no-fly zone and that his crew believed
the helicopters were not included in their orders [159]. The staff weapons director
made a point of not knowing what the Black Hawks do: “It was some kind of a
squirrely mission” [159]. During the court-martial of the senior director, the AWACS
tanker controller testified that in the briefing the crew received upon arrival at
Incirlik, the staff weapons director had said about helicopters flying in the no-fly
zone, ‘‘They’re there, but don’t pay any attention to them.” The enroute controller
testified that the handoff procedures applied only to fighters. “We generally have
no set procedures for any of the helicopters. . . . We never had any [verbal] guidance
[or training] at all on helicopters” [159].
Coordination problems also existed between the activities of the surveillance
personnel and the other controllers. During the investigation of the accident, the
ASO testified that surveillance’s responsibility was south of the 36th Parallel, and
the other controllers were responsible for tracking and identifying all aircraft north
of the 36th Parallel. The other controllers suggested that surveillance was respon-
sible for tracking and identifying all unknown aircraft, regardless of location. In fact,
Air Force regulations say that surveillance had tracking responsibility for unknown
and unidentified tracks throughout the TAOR. It is not possible through the


testimony alone, again because of the threat of court-martial, to piece out exactly
what was the problem here, including simply a migration of normal operations from
specified operations. At the least, it is clear that there was confusion about who was
in control of what.
One possible explanation for the lack of coordination among controllers at this
level of the hierarchical control structure is that, as suggested by Snook, this particu-
lar group had never trained together as a team [191]. But given the lack of proce-
dures for handling helicopters and the confusion even by experienced controllers
and the staff instructors about responsibilities for handling helicopters, Snook’s
explanation is not very convincing. A more plausible explanation is simply a lack of
guidance and delineation of responsibilities by the management level above. And
even if the roles of everyone in such a structure had been well defined originally,
uncontrolled local adaptation to more efficient procedures and asynchronous evolu-
tion of the different parts of the control structure created dysfunctionalities as time
passed. The helicopters and fixed wing aircraft had separate control structures that
only joined fairly high up on the hierarchy and, as is described in the next section,
there were communication problems between the components at the higher levels
of the control hierarchy, particularly between the Army Military Coordination
Center (MCC) and the Combined Forces Air Component (CFAC) headquarters.
Feedback from the Controlled Process: Signals to the AWACS from the Black
Hawks were inconsistent due to line-of-sight limitations and the mountainous terrain
in which the Black Hawks were flying. The helicopters used the terrain to mask them-
selves from air defense radars, but this terrain masking also caused the radar returns
from the Black Hawks to the AWACS (and to the fighters) to fade at various times.
Time Lags: Important time lags contributed to the accident, such as the delay of
radio reports from the Black Hawk helicopters due to radio signal transmission
problems and their inability to use the TACSAT radios until they had landed. As
with the ACE, the speed with which the F-15 pilots acted also provided the control-
lers with little time to evaluate the situation and respond appropriately.
Changes after the Accident.
Many changes were instituted with respect to AWACS operations after the
accident:
•
1. Confirmation of a positive IFF Mode IV check was required for all OPC air-
craft prior to their entry into the TAOR.
2. • The responsibilities for coordination of air operations were better defined.
3. • All AWACS aircrews went through a one-time retraining and recertification
program, and every AWACS crewmember had to be recertified.



4.• A plan was produced to reduce the temporary duty of AWACS crews to 120
days a year. In the end, it was decreased from 166 to 135 days per year from
January 1995 to July 1995. The Air Combat Command planned to increase the
number of AWACS crews.
5.• AWACS control was required for all TAOR flights.
6.•
In addition to normal responsibilities, AWACS controllers were required to
specifically maintain radar surveillance of all TAOR airspace and to issue advi-
sory/deconflicting assistance on all operations, including helicopters.
7.• The AWACS controllers were required to periodically broadcast friendly heli-
copter locations operating in the TAOR to all aircraft.
Although not mentioned anywhere in the available documentation on the accident,
it seems reasonable that either the AWACS crews started to use the Delta Point
system or the Black Hawk pilots were told not to use it and an alternative means
for transmitting flight plans was mandated.

section 5.3.6. The Higher Levels of Control.
Fully understanding the behavior at any level of the sociotechnical control structure
requires understanding how and why the control at the next higher level allowed
or contributed to the inadequate control at the current level. In this accident, many
of the erroneous decisions and control actions at the lower levels can only be fully
understood by examining this level of control.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints Violated: There were many safety con-
straints violated at the higher levels of the control structure—the Military Coordina-
tion Center, Combined Forces Air Component, and CTF commander—and several
people were investigated for potential court-martial and received official letters of
reprimand. These safety constraints include: (1) procedures must be instituted that
delegate appropriate responsibility, specify tasks, and provide effective training
to all those responsible for tracking aircraft and conducting combat operations;
(2) procedures must be consistent or at least complementary for everyone involved
in TAOR airspace operations; (3) performance must be monitored (feedback chan-
nels established) to ensure that safety-critical activities are being carried out cor-
rectly and that local adaptations have not moved operations beyond safe limits;
(4) equipment and procedures must be coordinated between the Air Force and
Army to make sure that communication channels are effective and that asynchro-
nous evolution has not occurred; (5) accurate information about scheduled flights
must be provided to the pilots and the AWACS crews.


Controls: The controls in place included operational orders and plans to designate
roles and responsibilities as well as a management structure, the ACO, coordination
meetings and briefings, a chain of command (OPC commander to mission director
to ACE to pilots), disciplinary actions for those not following the written rules, and
a group (the Joint Operations and Intelligence Center or JOIC) responsible for
ensuring effective communication occurred.
Roles and Responsibilities: The MCC had operational control over the Army
helicopters while the CFAC had operational control over fixed-wing aircraft and
tactical control over all aircraft in the TAOR. The Combined Task Force commander
general (who was above both the CFAC and MCC) had ultimate responsibility for
the coordination of fixed-wing aircraft flights with Army helicopters.
While specific responsibilities of individuals might be considered here in an offi-
cial accident analysis, treating the CFAC and MCC as entities is sufficient for the
purposes of this analysis.
Environmental and Behavior-Shaping Factors: The Air Force operated on a pre-
dictable, well-planned, and tightly executed schedule. Detailed mission packages
were organized weeks and months in advance. Rigid schedules were published and
executed in preplanned packages. In contrast, Army aviators had to react to con-
stantly changing local demands, and they prided themselves on their flexibility [191].
Because of the nature of their missions, exact takeoff times and detailed flight plans
for helicopters were virtually impossible to schedule in advance. They were even
more difficult to execute with much rigor. The Black Hawks’ flight plan contained
their scheduled takeoff time, transit routes between Diyarbakir through Gate 1 to
Zakhu, and their return time. Because the Army helicopter crews rarely knew
exactly where they would be going within the TAOR until after they were briefed
at the Military Coordination Center at Zakhu, most flight plans only indicated that
Eagle Flight would be “operating in and around the TAOR.”
The physical separation of the Army Eagle Flight pilots from the CFAC opera-
tions and Air Force pilots at Incirlik contributed to the communication difficulties
that already existed between the services.

Dysfunctional Interactions among Controllers.
Dysfunctional communication at this level of the control structure played a critical
role in the accident. These communication flaws contributed to the coordination
flaws at this level and at the lower levels.
A critical safety constraint to prevent friendly fire requires that the pilots of the
fighter aircraft know who is in the no-fly zone and whether they are supposed
to be there. However, neither the CTF staff nor the Combined Forces Air Compo-
nent staff requested nor received timely, detailed flight information on planned

MCC helicopter activities in the TAOR. Consequently, the OPC daily Air Tasking
Order was published with little detailed information regarding U.S. helicopter flight
activities over northern Iraq.
According to the official accident report, specific information on routes of flight
and times of MCC helicopter activity in the TAOR was normally available to the
other OPC participants only when AWACS received it from the helicopter crews
by radio and relayed the information on to the pilots [5]. While those at the higher
levels of control may have thought this relaying of flight information was occurring,
that does not seem to be the case given that the Delta point system (wherein the
helicopter crews provided the AWACS controllers with their flight plan) was not
used by the AWACS controllers: When the helicopters went beyond Zakhu, the
AWACS controllers did not know their flight plans and therefore could not relay
that information to the fighter pilots and other OPC participants.
The weekly flight schedules the MCC provided to the CFAC staff were not com-
plete enough for planning purposes. While the Air Force could plan their missions
in advance, the different type of Army helicopter missions had to be flexible to react
to daily needs. The MCC daily mission requirements were generally based on the
events of the previous day. A weekly flight schedule was developed and provided
to the CTF staff, but a firm itinerary was usually not available until after the next
day’s ATO was published. The weekly schedule was briefed at the CTF staff meet-
ings on Mondays, Wednesday, and Fridays, but the information was neither detailed
nor firm enough for effective rotary-wing and fixed-wing aircraft coordination and
scheduling purposes [5].
Each daily ATO was published showing several Black Hawk helicopter lines. Of
these, two helicopter lines (two flights of two helicopters each) were listed with call
signs (Eagle 01/02 and Eagle 03/04), mission numbers, IFF Mode II codes, and a
route of flight described only as LLTC (the identifier for Diyarbakir) to TAOR to
LLTC. No information regarding route or duration of flight time within the TAOR
was given on the ATO. Information concerning takeoff time and entry time into the
TAOR was listed as A/R (as required).
Every evening, the MCC at Zakhu provided a situation report (SITREP) to the
JOIC (located at Incirlik), listing the helicopter flights for the following day. The
SITREP did not contain complete flight details and arrived too late to be included
in the next day’s ATO. The MCC would call the JOIC the night prior to the sched-
uled mission to “activate” the ATO line. There were, however, no procedures in
place to get the SITREP information from the JOIC to those needing to know it
in CFAC.
After receiving the SITREP, a duty officer in the JOIC would send takeoff times
and gate times (the times the helicopters would enter northern Iraq) to Turkish
operations for approval. Meanwhile, an intelligence representative to the JOIC



consolidated the MCC weekly schedule with the SITREP and used secure intelli-
gence channels to pass this updated information to some of his counterparts in
operational squadrons who had requested it. No procedures existed to pass this
information from the JOIC to those in CFAC with tactical responsibility for the
helicopters (through the ACE and Mission Director) [5]. Because CFAC normally
determined who would fly when, the information channels were designed primarily
for one-way communications outward and downward.
In the specific instance involved in the shootdown, the MCC weekly schedule
was provided on April 8 to the JOIC and thence to the appropriate person in CFAC.
That schedule showed a two-ship, MCC helicopter administrative flight scheduled
for April 14. According to the official accident report, two days before (April 12)
the MCC Commander had requested approval for an April 14 flight outside the
Security Zone from Zakhu to the towns of Irbil and Salah ad Din. The OPC com-
manding general approved the written request on April 13, and the JOIC transmit-
ted the approval to the MCC but apparently the information was not provided to
those responsible for producing the ATO. The April 13 SITREP from MCC listed
the flight as “mission support,” but contained no other details. Note more informa-
tion was available earlier than normal in this instance, and it could have been
included in the ATO but the established communication channels and procedures
did not exist to get it to the right places. The MCC weekly schedule update, received
by the JOIC on the evening of April 13 along with the MCC SITREP, gave the
destinations for the mission as Salah ad Din and Irbil. This information was not
passed to CFAC.
Late in the afternoon on April 13, MCC contacted the JOIC duty officer and
activated the ATO line for the mission. A takeoff time of 0520 and a gate time of
0625 were requested. No takeoff time or route of flight beyond Zakhu was specified.
The April 13 SITREP, the weekly flying schedule update, and the ATO-line activa-
tion request were received by the JOIC too late to be briefed during the Wednesday
(April 13) staff meetings. None of the information was passed to the CFAC schedul-
ing shop (which was responsible for distributing last minute changes to the ATO
through various sources such as the Battle Staff Directives, morning briefings, and
so on), to the ground-based Mission Director, nor to the ACE on board the AWACS
[5]. Note that this flight was not a routine food and medical supply run, but instead
it carried sixteen high-ranking VIPs and required the personal attention and approval
of the CTF Commander. Yet information about the flight was never communicated
to the people who needed to know about it [191]. That is, the information went up
from the MCC to the CTF staff, but not across from MCC to CFAC nor down from
the CTF staff to CFAC (see figure 5.3).
A second example of a major dysfunctional communication involved the com-
munication of the proper radio frequencies and IFF codes to be used in the TAOR.


About two years before the shootdown, someone in the CFAC staff decided to
change the instructions pertaining to IFF modes and codes. According to Snook, no
one recalled exactly how or why this change occurred. Before the change, all aircraft
squawked a single Mode I code everywhere they flew. After the change, all aircraft
were required to switch to a different Mode I code while flying in the no-fly zone. The
change was communicated through the daily ATO. However, after the accident it was
discovered that the Air Force’s version of the ATO was not exactly the same as the
one received electronically by the Army aviators—another instance of asynchronous
evolution and lack of linkup between system components. For at least two years,
there existed two versions of the daily ATO: one printed out directly by the Incirlik
Frag Shop and distributed locally by messenger to all units at Incirlik Air Base, and
a second one transmitted electronically through an Air Force communications center
(the JOIC) to Army helicopter operations at Diyarbakir. The one received by the
Army aviators was identical in all respects to the one distributed by the Frag Shop,
except for the changed Mode I code information contained in the SPINS. The ATO
that Eagle Flight received contained no mention of two Mode I codes [191].
What about the confusion about the proper radio frequency to be used by the
Black Hawks in the TAOR? Piper notes that the Black Hawk pilots were told
to use the enroute frequency while flying in the TAOR. The commander of OPC
testified after the accident that the use by the Black Hawks of the enroute radio
frequency rather than the TAOR frequency had been briefed to him as a safety
measure because the Black Hawk helicopters were not equipped with HAVE
QUICK technology. The ACO (Aircraft Control Order) required the F-15s to use
non–HAVE QUICK mode when talking to specific types of aircraft (such as F-1s)
that, like the Black Hawks, did not have the new technology. The list of non-HQ
aircraft provided to the F-15 pilots, however, for some reason did not include
UH-60s. Apparently the decision was made to have the Black Hawks use the
enroute radio frequency but this decision was never communicated to those respon-
sible for the F-15 procedures specified in the ACO. Note that a thorough investiga-
tion of the higher levels of control, as is required in a STAMP-based analysis, is
necessary to explain properly the use of the enroute radio frequency by the Black
Hawks. Of the various reports on the shootdown, only Piper notes the fact that an
exception had been made for Army helicopters for safety reasons—the official
accident report, Snook’s detailed book on the accident, and the GAO report do not
mention this fact! Piper found out about it from her attendance at the public hear-
ings and trial. This omission of important information from the accident reports is
an interesting example of how incomplete investigation of the higher levels of
control can lead to incorrect causal analysis. In her book, Piper questions why the
Accident Investigation Board, while producing twenty-one volumes of evidence,
never asked the commander of OPC about the radio frequency and other problems
found during the investigation.



Other official exceptions were made for the helicopter operations, such as
allowing them in the Security Zone without AWACS coverage. Using STAMP,
the accident can be understood as a dynamic process where the operations of the
Army and Air Force adapted and diverged without effective communication and
coordination.
Many of the dysfunctional communications and interactions stem from asynchro-
nous evolution of the mission and the operations plan. In response to the evolving
mission in northern Iraq, air assets were increased in September 1991 and a signifi-
cant portion of the ground forces were withdrawn. Although the original organiza-
tional structure of the CTF was modified at this time, the operations plan was not.
In particular, the position of the person who was in charge of communication and
coordination between the MCC and CFAC was eliminated without establishing an
alternative communication channel.
Unsafe asynchronous evolution of the safety control structure can be prevented
by proper documentation of safety constraints, assumptions, and their controls
during system design and checking before changes are made to determine if the
constraints and assumptions are violated by the design. Unintentional changes and
migration of behavior outside the boundaries of safety can be prevented by various
means, including education, identifying and checking leading indicators, and tar-
geted audits. Part III describes ways to prevent asynchronous evolution from leading
to accidents.
Flawed or Inadequate Control Actions.
There were many flawed or missing control actions at this level, including:
1.•
The Black Hawk pilots were allowed to enter the TAOR without AWACS cover-
age and the F-15 pilots and AWACS crews were not informed about this excep-
tion to the policy. This control problem is an example of the problems of
distributed decision making with other decision makers not being aware of the
decisions of others (see the Zeebrugge example in figure 2.2).
Prior to September 1993, Eagle Flight helicopters flew any time required,
before the fighter sweeps and without fighter coverage, if necessary. After
September 1993, helicopter flights were restricted to the security zone if
AWACS and fighter coverage were not on station. But for the mission on April
14, Eagle Flight requested and received permission to execute their flight
outside the security zone. A CTF policy letter dated September 1993 imple-
mented the following policy for UH-60 helicopter flights supporting the MCC:
“All UH-60 flights into Iraq outside of the security zone require AWACS cover-
age.” Helicopter flights had routinely been flown within the TAOR security
zone without AWACS or fighter coverage and CTF personnel at various levels
were aware of this. MCC personnel were aware of the requirement to have


AWACS coverage for flights outside the security zone and complied with that
requirement. However, the F-15 pilots involved in the accident, relying on the
written guidance in the ACO, believed that no OPC aircraft, fixed or rotary
wing, were allowed to enter the TAOR prior to a fighter sweep [5].
At the same time, the Black Hawks also thought they were operating cor-
rectly. The Army Commander at Zakhu had called the Commander of Opera-
tions, Plans, and Policy for OPC the night before the shootdown and asked to
be able to fly the mission without AWACS coverage. He was told that they must
have AWACS coverage. From the view of the Black Hawks pilots (who had
reported in to the AWACS during the flight and provided their flight plan and
destinations) they were complying and were under AWACS control.
2.•Helicopters were not required to file detailed ,flight plans and follow them.
Effective procedures were not established for communicating last minute
changes or updates to the Army flight plans that had been filed.
3.•F-15 pilots were not told to use non-HQ mode for helicopters.
4.•No procedures were specified to pass SITREP information to CFAC. Helicop-
ter flight plans were not distributed to CFAC and the F-15 pilots, but they were
given to the F-16 squadrons. Why was one squadron informed, while another
one, located right across the street, was not? F-15s are designed primarily for
air superiority—high altitude aerial combat missions. F-16s, on the other hand,
are all-purpose fighters. Unlike F-15s, which rarely flew low-level missions, it
was common for F-16s to fly low-level missions where they might encounter
the low-flying Army helicopters. As a result, to avoid low-altitude midair colli-
sions, staff officers in F-16 squadrons requested details concerning helicopter
operations from the JOIC, went to pick it up from the mail pickup point on the
post, and passed it on to the pilots during their daily briefings; F-15 planners
did not [191].
5.•Inadequate training on the ROE was provided for new rotators. Piper claims
that OPC personnel did not receive consistent, comprehensive training to
ensure they had a thorough understanding of the rules of engagement and that
many of the aircrews new to OPC questioned the need for the less aggressive
rules of engagement in what had been designated a combat zone [159]. Judging
from these complaints (details can be found in [159]) and incidents involving
F-15 pilots, it appears that the pilots did not fully understand the ROE purpose
or need.
6.•Inadequate training was provided to the F-15 pilots on visual identification.
7.•Inadequate simulator and spin-up training was provided to the AWACS crews.
Asynchronous evolution occurred between the changes in the training materi-
als and the actual situation in the no-fly zone. In addition, there were no


controls to ensure the required simulator sessions were provided and that all
members of the crew participated.
8.•Handoff procedures were never established for, helicopters. In fact, no explicit
or written procedures, verbal guidance, or training of any kind were provided
to the AWACS crews regarding the control of helicopters within the TAOR
[191]. The AWACS crews testified during the investigation that they lost contact
with helicopters all the time, but there were no procedures to follow when that
occurred.
9.•Inadequate procedures were specified and enforced for how the shadow crew
would instruct the new crews.
10.•The rules and procedures established for the operation did not provide adequate
control over unsafe F-15 pilot behavior, adequate enforcement of discipline, or
adequate handling of safety violations. The CFAC Assistant Director of Oper-
ations told the GAO investigators that there was very little F-15 oversight in
OPC at the time of the shootdown. There had been so many flight discipline
incidents leading to close calls that a group safety meeting had been held a
week before the shootdown to discuss it. The flight discipline and safety issues
included midair close calls, unsafe incidents when refueling, and unsafe takeoffs.
The fixes (including the meeting) obviously were not effective. But the fact that
there were a lot of close calls indicates serious safety problems existed and were
not handled adequately.
The CFAC Assistant Director of Operations also told the GAO that con-
tentious issues involving F-15 actions had become common topics of discus-
sion at Detachment Commander meetings. No F-15 pilots were on the CTF
staff to communicate with the F-15 group about these problems. The OPC
Commander testified that there was no tolerance for mistakes or unprofes-
sional flying at OPC and that he had regularly sent people home for violation
of the rules—the majority of those he sent home were F-15 pilots, suggesting
that there were serious problems in discipline and attitude among this group
[159].
11.•The Army pilots were given the wrong information about the IFF codes and
radio frequencies to use in the TAOR. As described above, this mismatch
resulted from asynchronous evolution and lack of linkup (consistency) between
process controls, that is, the two different ATOs. It provides yet another example
of the danger involved in distributed decision making (again see figure 2.2).
Reasons for the Flawed Control.
Ineffective Control Algorithms: Almost all of the control flaws at this level relate
to the existence and use of ineffective control algorithms. Equipment and


procedures were not coordinated between the Air Force and the Army to make sure
that communication channels were effective and that asynchronous evolution had
not occurred. The last CTF staff member who appears to have actively coordinated
rotary-wing flying activities with the CFAC organization departed in January 1994.
No representative of the MCC was specifically assigned to the CFAC for coordina-
tion purposes. Since December 1993, no MCC helicopter detachment representative
had attended the CFAC weekly scheduling meetings. The Army liaison officer,
attached to the MCC helicopter detachment at Zakhu and assigned to Incirlik AB,
was new on station (he arrived in April 1994) and was not fully aware of the rela-
tionship of the MCC to the OPC mission [5].
Performance was not monitored to ensure that safety-critical activities were
carried out correctly, that local adaptations had not moved operations beyond safe
limits, and that information was being effectively transmitted and procedures fol-
lowed. Effective controls were not established to prevent unsafe adaptations.
The feedback that was provided about the problems at the lower levels was
ignored. For example, the Piper account of the accident includes a reference to
helicopter pilots’ testimony that six months before the shootdown, in October 1993,
they had complained that the fighter aircraft were using their radar to lock onto the
Black Hawks an unacceptable number of times. The Army helicopter pilots had
argued there was an urgent need for the Black Hawk pilots to be able to commu-
nicate with the fixed-wing aircraft, but nothing was changed until after the accident,
when new radios were installed in the Black Hawks.
Inaccurate Mental Models: The commander of the Combined Task Force thought
that the appropriate control and coordination was occurring. This incorrect mental
model was supported by the feedback he received flying as a regular passenger on
board the Army helicopter flights, where it was his perception that the AWACS was
monitoring their flight effectively. The Army helicopter pilots were using the Delta
Point system to report their location and flight plans, and there was no indication
from the AWACS that the messages were being ignored. The CTF Commander
testified that he believed the Delta Point system was standard on all AWACS mis-
sions. When asked at the court-martial of the AWACS senior director whether the
AWACS crew were tracking Army helicopters, the OPC Commander replied:
Well, my experience from flying dozens of times on Eagle Flight, which that—for some
eleven hundred and nine days prior to this event, that was—that was normal procedures
for them to flight follow. So, I don’t know that they had something written about it, but I
know that it seemed very obvious and clear to me as a passenger on Eagle Flight numer-
ous times that that was occurring. [159]
The commander was also an active F-16 pilot who attended the F-16 briefings. At
these briefings he observed that Black Hawk times were part of the daily ATOs


procedures were not coordinated between the Air Force and the Army to make sure
that communication channels were effective and that asynchronous evolution had
not occurred. The last CTF staff member who appears to have actively coordinated
rotary-wing flying activities with the CFAC organization departed in January 1994.
No representative of the MCC was specifically assigned to the CFAC for coordina-
tion purposes. Since December 1993, no MCC helicopter detachment representative
had attended the CFAC weekly scheduling meetings. The Army liaison officer,
attached to the MCC helicopter detachment at Zakhu and assigned to Incirlik AB,
was new on station (he arrived in April 1994) and was not fully aware of the rela-
tionship of the MCC to the OPC mission [5].
Performance was not monitored to ensure that safety-critical activities were
carried out correctly, that local adaptations had not moved operations beyond safe
limits, and that information was being effectively transmitted and procedures fol-
lowed. Effective controls were not established to prevent unsafe adaptations.
The feedback that was provided about the problems at the lower levels was
ignored. For example, the Piper account of the accident includes a reference to
helicopter pilots’ testimony that six months before the shootdown, in October 1993,
they had complained that the fighter aircraft were using their radar to lock onto the
Black Hawks an unacceptable number of times. The Army helicopter pilots had
argued there was an urgent need for the Black Hawk pilots to be able to commu-
nicate with the fixed-wing aircraft, but nothing was changed until after the accident,
when new radios were installed in the Black Hawks.
Inaccurate Mental Models: The commander of the Combined Task Force thought
that the appropriate control and coordination was occurring. This incorrect mental
model was supported by the feedback he received flying as a regular passenger on
board the Army helicopter flights, where it was his perception that the AWACS was
monitoring their flight effectively. The Army helicopter pilots were using the Delta
Point system to report their location and flight plans, and there was no indication
from the AWACS that the messages were being ignored. The CTF Commander
testified that he believed the Delta Point system was standard on all AWACS mis-
sions. When asked at the court-martial of the AWACS senior director whether the
AWACS crew were tracking Army helicopters, the OPC Commander replied:
Well, my experience from flying dozens of times on Eagle Flight, which that—for some
eleven hundred and nine days prior to this event, that was—that was normal procedures
for them to flight follow. So, I don’t know that they had something written about it, but I
know that it seemed very obvious and clear to me as a passenger on Eagle Flight numer-
ous times that that was occurring. [159]
The commander was also an active F-16 pilot who attended the F-16 briefings. At
these briefings he observed that Black Hawk times were part of the daily ATOs


received by the F-16 pilots and assumed that all squadrons were receiving the same
information. However, as noted, the head of the squadron with which the com-
mander flew had gone out of his way to procure the Black Hawk flight information,
while the F-15 squadron leader had not.
Many of those involved at this level were also under the impression that the
ATOs provided to the F-15 pilots and to the Black Hawks pilots were consistent,
that required information had been distributed to everyone, that official procedures
were understood and being followed, and so on.
Coordination among Multiple Controllers: There were clearly problems with over-
lapping and boundary areas of control between the Army and the Air Force. Coor-
dination problems between the services are legendary and were not handled
adequately here. For example, two different versions of the ATO were provided to
the Air Force and the Army pilots. The Air Force F-15s and the Army helicopters
had separate control structures, with a common control point fairly high above the
physical process. The problems were complicated by the differing importance of
flexibility in flight plans between the two services. One symptom of the problem
was that there was no requirement for helicopters to file detailed flight plans and
follow them and no procedures established to deal with last minute changes. These
deficiencies were also related to the shared control of helicopters by MCC and
CFAC and complicated by the physical separation of the two headquarters.
During the accident investigation, a question was raised about whether the Com-
bined Task Force Chief of Staff was responsible for the breakdown in staff com-
munication. After reviewing the evidence, the hearing officer recommended that no
adverse action be taken against the Chief of Staff because he (1) had focused his
attention according to the CTF Commander’s direction, (2) had neither specific
direction nor specific reason to inquire into the transmission of info between his
Director of Operations for Plans and Policy and the CFAC, (3) had been the most
recent arrival and the only senior Army member of a predominantly Air Force staff
and therefore generally unfamiliar with air operations, and (4) had relied on expe-
rienced colonels under whom the deficiencies had occurred [200]. This conclusion
was obviously influenced by the goal of trying to establish blame. Ignoring the blame
aspects, the conclusion gives the impression that nobody was in charge and everyone
thought someone else was.
According to the official accident report, the contents of the ACO largely reflected
the guidance given in the operations plan dated September 7, 1991. But that was the
plan provided before the mission had changed. The accident report concludes that
key CTF personnel at the time of the accident were either unaware of the existence
of this particular plan or considered it too outdated to be applicable. The accident
report states, “Most key personnel within the CFAC and CTF staff did not consider



coordination of MCC helicopter activities to be part of their respective CFAC / CTF 
responsibilities” [5].
Because of the breakdown of clear guidance from the Combined Task Force staff
to its component organizations (CFAC and MCC ) , they did not have a clear under-
standing of their respective responsibilities. Consequently, MCC helicopter activities
were not fully integrated with other OPC air operations in the TAOR.



section 5.4.
Conclusions from the Friendly Fire Example.
When looking only at the proximate events and the behavior of the immediate
participants in the accidental shootdown, the reasons for this accident appear to be
gross mistakes by the technical system operators (the pilots and AWACS crew). In
fact, a special Air Force task force composed of more than 120 people in six com-
mands concluded that two breakdowns in individual performance contributed to
the shootdown: (1) the AWACS mission crew did not provide the F-15 pilots an
accurate picture of the situation and (2) the F-15 pilots misidentified the target.
From the twenty-one-volume accident report produced by the Accident Investiga-
tion Board, Secretary of Defense William Perry summarized the “errors, omissions,
and failures” in the “chain of events” leading to the loss as:
1.• The F-15 pilots misidentified the helicopters as Iraqi Hinds.
2.• The AWACS crew failed to intervene.
3.• The helicopters and their operations were not integrated into the Task Force
running the no-fly zone operations.
4.• The Identity Friend or Foe ( IFF ) systems failed.
According to Snook, the military community has generally accepted these four
“causes” as the explanation for the shootdown.
While there certainly were mistakes made at the pilot and AWACS levels, the
use of the STAMP analysis paints a much more complete explanation of the role of
the environment and other factors that influenced their behavior including: incon-
sistent, missing, or inaccurate information; incompatible technology; inadequate
coordination; overlapping areas of control and confusion about who was responsible
for what; a migration toward more efficient but less safe operational procedures
over time without any controls and checks on the potential adaptations; inadequate
training; and in general a control structure that did not enforce the safety constraints.
Boiling down this very complex accident to four “causes” and assigning blame in
this way inhibits learning from the events. The more complete STAMP analysis was
possible only because individuals outside the military, some of whom were relatives

of the victims, did not accept the simple analysis provided in the accident report and
did their own uncovering of the facts.
STAMP views an accident as a dynamic process. In this case, Army and Air Force
operations adapted and diverged without communication and coordination. OPC
had operated incident-free for over three years at the time of the shootdown. During
that time, local adaptations to compensate for inadequate control from above had
managed to mask the ongoing problems until a situation occurred where local
adaptations did not work. A lack of awareness at the highest levels of command of
the severity of the coordination, communication, and other problems is a key factor
in this accident.
Nearly all the types of causal factors identified in section 4.5 can be found in this
accident. This fact is not an anomaly: Most accidents involve a large number of these
factors. Concentrating on an event chain focuses attention on the proximate events
associated with the accident and thus on the principle local actors, in this case, the
pilots and the AWACS personnel. Treating an accident as a control problem using
STAMP clearly identifies other organizational factors and actors and the role they
played. Most important, without this broader view of the accident, only the symp-
toms of the organizational problems may be identified and eliminated without
significantly reducing risk of a future accident caused by the same systemic factors
but involving different symptoms at the lower technical and operational levels of
the control structure.
More information on how to build multiple views of an accident using STAMP
in order to aid understanding can be found in chapter 11. More examples of STAMP
accident analyses can be found in the appendixes.