piper/chapter05.raw

chapter 5.

A Friendly Fire Accident.
The goal of STAMP is to assist in understanding why accidents occur and to use
that understanding to create new and better ways to prevent losses. This chapter
and several of the appendices provide examples of how STAMP can be used to
analyze and understand accident causation. The particular examples were selected
to demonstrate the applicability of STAMP to very different types of systems and
industries. A process, called CAST (Causal Analysis based on STAMP) is described
in chapter 11 to assist in performing the analysis.
This chapter delves into the causation of the loss of a U.S. Army Black Hawk
helicopter and all its occupants from friendly fire by a U.S. Air Force F-15 over
northern Iraq in 1994. This example was chosen because the controversy and mul-
tiple viewpoints and books about the shootdown provide the information necessary
to create most of the STAMP analysis. Accident reports often leave out important
causal information (as did the official accident report in this case). Because of the
nature of the accident, most of the focus is on operations. Appendix B presents
an example of an accident where engineering development plays an important
role. Social issues involving public health are the focus of the accident analysis in
appendix C.
section 5.1.
Background.
After the Persian Gulf War, Operation Provide Comfort (OPC) was created as a
multinational humanitarian effort to relieve the suffering of hundreds of thousands
of Kurdish refugees who fled into the hills of northern Iraq during the war. The goal
of the military efforts was to provide a safe haven for the resettlement of the refu-
gees and to ensure the security of relief workers assisting them. The formal mission
statement for OPC read: “To deter Iraqi behavior that may upset peace and order
in northern Iraq.”
In addition to operations on the ground, a major component of OPC’s mission
was to occupy the airspace over northern Iraq. To accomplish this task, a no-fly zone


(also called the TAOR or Tactical Area of Responsibility) was established that
included all airspace within Iraq north of the 36th Parallel (see figure 5.1). Air
operations were led by the Air Force to prohibit Iraqi aircraft from entering the
no-fly zone while ground operations were organized by the Army to provide human-
itarian assistance to the Kurds and other ethnic groups in the area.
U.S., Turkish, British, and French fighter and support aircraft patrolled the no-fly
zone daily to prevent Iraqi warplanes from threatening the relief efforts. The mission
of the Army helicopters was to support the ground efforts; the Army used them
primarily for troop movement, resupply, and medical evacuation.
On April 15, 1994, after nearly three years of daily operations over the TAOR
(Tactical Area of Responsibility), two U.S. Air Force F-15’s patrolling the area shot
down two U.S. Army Black Hawk helicopters, mistaking them for Iraqi Hind heli-
copters. The Black Hawks were carrying twenty-six people, fifteen U.S. citizens and
eleven others, among them British, French, and Turkish military officers as well as
Kurdish citizens. All were killed in one of the worst air-to-air friendly fire accidents
involving U.S. aircraft in military history.
All the aircraft involved were flying in clear weather with excellent visibility, an
AWACS (Airborne Warning and Control System) aircraft was providing surveil-
lance and control for the aircraft in the area, and all the aircraft were equipped with
electronic identification and communication equipment (apparently working prop-
erly) and flown by decorated and highly experienced pilots.

The hazard being controlled was mistaking a “friendly” (coalition) aircraft for a
threat and shooting at it. This hazard, informally called friendly fire, was well known,
and a control structure was established to prevent it. Appropriate constraints were
established and enforced at each level, from the Joint Chiefs of Staff down to the
aircraft themselves. Understanding why this accident occurred requires understand-
ing why the control structure in place was ineffective in preventing the loss. Prevent-
ing future accidents involving the same control flaws requires making appropriate
changes to the control structure, including establishing monitoring and feedback
loops to detect when the controls are becoming ineffective and the system is migrat-
ing toward an accident, that is, moving toward a state of increased risk. The more
comprehensive the model and factors identified, the larger the class of accidents
that can be prevented.
For this STAMP example, information about the accident and the control struc-
ture was obtained from the original accident report [5], a GAO (Government
Accountability Office) report on the accident investigation process and results [200],
and two books on the shootdown—one originally a Ph.D. dissertation by Scott
Snook [191] and one by Joan Piper, the mother of one of the victims [159]. Because
of the extensive existing analysis, much of the control structure (shown in figure 5.3)
can be reconstructed from these sources. A large number of acronyms are used in
this chapter. They are defined in figure 5.2.


5.2
The Hierarchical Safety Control Structure to Prevent Friendly Fire Accidents
National Command Authority and Commander-in-Chief Europe
When the National Command Authority (the President and Secretary of Defense)
directed the military to conduct Operation Provide Comfort, the U.S. Commander
in Chief Europe (USCINCEUR) directed the creation of Combined Task Force
(CTF) Provide Comfort.
A series of orders and plans established the general command and control struc-
ture of the CTF. These orders and plans also transmitted sufficient authority and
guidance to subordinate component commands and operational units so that they
could then develop the local procedures that were necessary to bridge the gap
between general mission orders and specific subunit operations.
At the top of the control structure, the National Command Authority (the Presi-
dent and Secretary of Defense, who operate through the Joint Chiefs of Staff)
provided guidelines for establishing Rules of Engagement (ROE). ROE govern the
actions allowed by U.S. military forces to protect themselves and other personnel
and property against attack or hostile incursion and specify a strict sequence of
procedures to be followed prior to any coalition aircraft firing its weapons. They are


based on legal, political, and military considerations and are intended to provide for
adequate self-defense to ensure that military activities are consistent with current
national objectives and that appropriate controls are placed on combat activities.
Commanders establish ROE for their areas of responsibility that are consistent with
the Joint Chiefs of Staff guidelines, modifying them for special operations and for
changing conditions.
Because the ROE dictate how hostile aircraft or military threats are treated,
they play an important role in any friendly fire accidents. The ROE in force for
OPC were the peacetime ROE for the United States European Command with
OPC modifications approved by the National Command Authority. These conserva-
tive ROE required a strict sequence of procedures to be followed prior to any
coalition aircraft firing its weapons. The less aggressive peacetime rules of engage-
ment were used even though the area had been designated a combat zone because
of the number of countries involved in the joint task force. The goal of the ROE
was to slow down any military confrontation in order to prevent the type of friendly
fire accidents that had been common during Operation Desert Storm. Understand-
ing the reasons for the shootdown of the Black Hawk helicopters requires under-
standing why the ROE did not provide an effective control to prevent friendly fire
accidents.
Three System-Level Safety Constraints Related to This Accident:
1. The NCA and UNCINCEUR must establish a command and control structure
that provides the ability to prevent friendly fire accidents.
2. The guidelines for ROE generated by the Joint Chiefs of Staff (with tailoring
to suit specific operational conditions) must be capable of preventing friendly
fire accidents in all types of situations.
3. The European Commander-in-Chief must review and monitor operational
plans generated by the Combined Task Force, ensure they are updated as the
mission changes, and provide the personnel required to carry out the plans.
Controls: The controls in place included the ROE guidelines, the operational
orders, and review procedures for the controls (e.g., the actual ROE and Operational
Plans) generated at the control levels below.
Combined Task Force (CTF)
The components of the Combined Task Force (CTF) organization relevant to the
accident (and to preventing friendly fire) were a Combined Task Force staff, a Com-
bined Forces Air Component (CFAC), and an Army Military Coordination Center.
The Air Force fighter aircraft were co-located with CTF Headquarters and CFAC

based on legal, political, and military considerations and are intended to provide for
adequate self-defense to ensure that military activities are consistent with current
national objectives and that appropriate controls are placed on combat activities.
Commanders establish ROE for their areas of responsibility that are consistent with
the Joint Chiefs of Staff guidelines, modifying them for special operations and for
changing conditions.
Because the ROE dictate how hostile aircraft or military threats are treated,
they play an important role in any friendly fire accidents. The ROE in force for
OPC were the peacetime ROE for the United States European Command with
OPC modifications approved by the National Command Authority. These conserva-
tive ROE required a strict sequence of procedures to be followed prior to any
coalition aircraft firing its weapons. The less aggressive peacetime rules of engage-
ment were used even though the area had been designated a combat zone because
of the number of countries involved in the joint task force. The goal of the ROE
was to slow down any military confrontation in order to prevent the type of friendly
fire accidents that had been common during Operation Desert Storm. Understand-
ing the reasons for the shootdown of the Black Hawk helicopters requires under-
standing why the ROE did not provide an effective control to prevent friendly fire
accidents.
Three System-Level Safety Constraints Related to This Accident:
1. The NCA and UNCINCEUR must establish a command and control structure
that provides the ability to prevent friendly fire accidents.
2. The guidelines for ROE generated by the Joint Chiefs of Staff (with tailoring
to suit specific operational conditions) must be capable of preventing friendly
fire accidents in all types of situations.
3. The European Commander-in-Chief must review and monitor operational
plans generated by the Combined Task Force, ensure they are updated as the
mission changes, and provide the personnel required to carry out the plans.
Controls: The controls in place included the ROE guidelines, the operational
orders, and review procedures for the controls (e.g., the actual ROE and Operational
Plans) generated at the control levels below.
Combined Task Force (CTF)
The components of the Combined Task Force (CTF) organization relevant to the
accident (and to preventing friendly fire) were a Combined Task Force staff, a Com-
bined Forces Air Component (CFAC), and an Army Military Coordination Center.
The Air Force fighter aircraft were co-located with CTF Headquarters and CFAC


at Incirlik Air Base in Turkey while the U.S. Army helicopters were located with the
Army headquarters at Diyarbakir, also in Turkey (see figure 5.1).
The Combined Task Force had three components under it (figure 5.3):
1. The Military Coordination Center (MCC) monitored conditions in the security
zone and had operational control of Eagle Flight helicopters (the Black
Hawks), which provided general aviation support to the MCC and the CTF.
2. The Joint Special Operations Component (JSOC) was assigned primary
responsibility to conduct search-and-rescue operations should any coalition
aircraft go down inside Iraq.
3. The Combined Forces Air Component (CFAC) was tasked with exercising
tactical control of all OPC aircraft operating in the Tactical Area of Respon-
sibility (TAOR) and operational control over Air Force aircraft.1 The CFAC
commander exercised daily control of the OPC flight mission through a Direc-
tor of Operations (CFAC/DO), as well as a ground-based Mission Director at
the Combined Task Force (CTF) headquarters in Incirlik and an Airborne
Command Element (ACE) aboard the AWACS.
Operational orders were generated at the European Command level of authority
that defined the initial command and control structure and directed the CTF
commanders to develop an operations plan to govern OPC. In response, the CTF
commander created an operations plan in July 1991 delineating the command rela-
tionships and organizational responsibilities within the CTF. In September 1991, the
U.S. Commander-in-Chief, Europe, modified the original organizational structure in
response to the evolving mission in northern Iraq, directing an increase in the size
of the Air Force and the withdrawal of a significant portion of the ground forces.
The CTF was ordered to provide a supporting plan to implement the changes
necessary in their CTF operations plan. The Accident Investigation Board found
that although an effort was begun in 1991 to revise the operations plan, no evidence
could be found in 1994 to indicate that the plan was actually updated to reflect the
change in command and control relationships and responsibilities. The critical
element of the plan with respect to the shootdown was that the change in mission
led to the departure of an individual key to the communication between the Air
Force and Army, without his duties being assigned to someone else. This example
of asynchronous evolution plays a role in the loss.

footnote. Tactical control involves a fairly limited scope of authority, that is, the detailed and usually local direc-
tion and control of movement and maneuvers necessary to accomplish the assigned mission. Operational
control, on the other hand, involves a broader authority to command subordinate forces, assign tasks,
designate objectives, and give the authoritative direction necessary to accomplish the mission.



Command-Level Safety Constraints Related to the Accident:
1. Rules of engagement and operational orders and plans must be established at
the command level that prevent friendly fire accidents. The plans must include
allocating responsibility and establishing and monitoring communication
channels to allow for coordination of flights into the theater of action.
2. Compliance with the ROE and operational orders and plans must be moni-
tored. Alterations must be made in response to changing conditions and
changing mission.
Controls: The controls included the ROE and operational plans plus feedback
mechanisms on their effectiveness and application.
CFAC and MCC
The two parts of the Combined Task Force involved in the accident were the Army
Military Coordination Center (MCC) and the Air Force Combined Forces Air
Component (CFAC).
The shootdown obviously involved a communication failure: the F-15 pilots did
not know the U.S. Army Black Hawks were in the area or that they were targeting
friendly aircraft. Problems in communication between the three services (Air Force,
Army, and Navy) are legendary. Procedures had been established to attempt to
eliminate these problems in Operation Provide Comfort.
The Military Coordination Center (MCC) coordinated land and U.S. helicopter
missions that supported the Kurdish people. In addition to providing humanitarian
relief and protection to the Kurds, another important function of the Army detach-
ment was to establish an ongoing American presence in the Kurdish towns and
villages by showing the U.S. flag. This U.S. Army function was supported by a
helicopter detachment called Eagle Flight.
All CTF components, with the exception of the Army Military Coordination
Center lived and operated out of Incirlik Air Base in Turkey. The MCC operated
out of two locations. A forward headquarters was located in the small village of
Zakhu (see figure 5.1), just inside Iraq. Approximately twenty people worked in
Zakhu, including operations, communications, and security personnel, medics, trans-
lators, and coalition chiefs. Zakhu operations were supported by a small administra-
tive contingent working out of Pirinclik Air Base in Diyarbakir, Turkey. Pirinclik is
also where the Eagle Flight Platoon of UH-60 Black Hawk helicopters was located.
Eagle Flight helicopters made numerous (usually daily) trips to Zakhu to support
MCC operations.
The Combined Forces Air Component (CFAC) Commander was responsible for
coordinating the employment of all air operations to accomplish the OPC mission.
He was delegated operational control of the Airborne Warning and Control System


(AWACS), U.S. Air Force (USAF) airlift, and the fighter forces. He had tactical
control of the U.S. Army, U.S. Navy, Turkish, French, and British fixed wing and
helicopter aircraft. The splintering of control between the CFAC and MCC com-
manders, along with communication problems between them, were major contribu-
tors to the accident.
In a complex coordination problem of this sort, communication is critical. Com-
munications were implemented through the Joint Operations and Intelligence
Center (JOIC). The JOIC received, delivered, and transmitted communications up,
down, and across the CTF control structure. No Army liaison officer was assigned
to the JOIC, but one was available on request to provide liaison between the MCC
helicopter detachment and the CTF staff.
To prevent friendly fire accidents, pilots need to know exactly what friendly air-
craft are flying in the no-fly zone at all times as well as know and follow the ROE
and other procedures for preventing such accidents. The higher levels of control
delegated the authority and guidance to develop local procedures2 to the CTF level
and below. These local procedures included:
•Airspace Control Order (ACO): The ACO contains the authoritative guidance
for all local air operations in OPC. It covers such things as standard altitudes
and routes, air refueling procedures, recovery procedures, airspace deconfliction
responsibilities, and jettison procedures. The deconfliction procedures were a
way to prevent interactions between aircraft that might result in accidents. For
the Iraqi TAOR, fighter aircraft, which usually operated at high altitudes, were
to stay above 10,000 feet above ground level while helicopters, which normally
conducted low-altitude operations, were to stay below 400 feet. All flight crews
were responsible for reviewing and complying with the information contained
in the ACO. The CFAC Director of Operations was responsible for publishing
the guidance, including the Airspace Control Order, for conducting OPC
missions.
•Aircrew Read Files (ARFs): The Aircraft Read Files supplement the ACOs
and are also required reading by all flight crews. They contain the classified
rules of engagement (ROE), changes to the ACO, and recent amplification of
how local commanders want air missions executed.
•Air Tasking Orders (ATOs): While the ACO and ARFs contain general infor-
mation that applies to all aircraft in OPC, specific mission guidance was pub-
lished in the daily ATOs. They contained the daily flight schedule, radio
frequencies to be used, IFF codes (used to identify an aircraft as friend or foe),

and other late-breaking information necessary to fly on any given day. All air-
craft are required to have a hard copy of the current ATO with Special Instruc-
tions (SPINS) on board before flying. Each morning around 11:30 (1130 hours,
in military time), the mission planning cell (or Frag shop) publishes the ATO for
the following day, and copies are distributed to all units by late afternoon.
•Battle Staff Directives (BSDs): Any late scheduling changes that do not make
it onto the ATO are published in last-minute Battle Staff Directives, which are
distributed separately and attached to all ATOs prior to any missions flying the
next morning.
•Daily Flowsheets: Military pilots fly with a small clipboard attached to their
knees. These kneeboards contain boiled-down reference information essential
to have handy while flying a mission, including the daily flowsheet and radio
frequencies. The flowsheets are graphical depictions of the chronological flow
of aircraft scheduled into the no-fly zone for that day. Critical information is
taken from the ATO, translated into timelines, and reduced on a copier to
provide pilots with a handy in-flight reference.
•Local Operating Procedures and Instructions, Standard Operating Procedures,
Checklists, and so on: In addition to written material, real-time guidance is
provided to pilots after taking off via radio through an unbroken command
chain that runs from the OPC Commanding General, through the CFAC,
through the mission director, through an Airborne Command Element (ACE)
on board the AWACS, and ultimately to pilots.
The CFAC commander of operations was responsible for ensuring that aircrews
were informed of all unique aspects of the OPC mission, including the ROE, upon
their arrival. He was also responsible for publishing the Aircrew Read File (ARF),
the Airspace Control Order (ACO), the daily Air Tasking Order, and mission-
related special instructions (SPINS).


footnote. The term procedures as used in the military denote standard and detailed courses of action that
describe how to perform a task.

Safety Constraints Related to the Accident:
1. Coordination and communication among all flights into the TAOR must be
established. Procedures must be established for determining who should be
and is in the TAOR at all times.
2. Procedures must be instituted and monitored to ensure that all aircraft in the
TAOR are tracked and fighters are aware of the location of all friendly aircraft
in the TAOR.
3. The ROE must be understood and followed by those at lower levels.
4. All aircraft must be able to communicate effectively in the TAOR.

Controls: The controls in place included the ACO, ARFs, flowsheets, intelligence
and other briefings, training (on the ROE, on aircraft identification, etc.), AWACS
procedures for identifying and tracking aircraft, established radio frequencies and
radar signals for the no-fly zone, a chain of command (OPC Commander to Mission
Director to ACE to pilots), disciplinary actions for those not following the written
rules, and a group (the JOIE) responsible for ensuring effective communication
occurred.
Mission Director and Airborne Command Element
The Airborne Command Element (ACE) flies in the AWACS and is the com-
mander’s representative in the air, armed with up-to-the-minute situational infor-
mation to make time-critical decisions. The ACE monitors all air operations and
is in direct contact with the Mission Director located in the ground command
post. He must also interact with the AWACS crew to identify reported unidentified
aircraft.
The ground-based Mission Director maintains constant communication links
with both the ACE up in the AWACS and with the CFAC commander on the
ground. The Mission Director must inform the OPC commander immediately if
anything happens over the no-fly zone that might require a decision by the com-
mander or his approval. Should the ACE run into any situation that would involve
committing U.S. or coalition forces, the Mission Director will communicate with him
to provide command guidance. The Mission Director is also responsible for making
weather-related decisions, implementing safety procedures, scheduling aircraft, and
ensuring that the ATO is executed correctly.
The ROE in place at the time of the shootdown stated that aircrews experiencing
unusual circumstances were to pass details to the ACE or AWACS, who would
provide guidance on the appropriate response [200]. Exceptions were possible, of
course, in cases of imminent threat. Aircrews were directed to first contact the ACE
and, if that individual was unavailable, to then contact the AWACS. The six unusual
circumstances/occurrences to be reported, as defined in the ROE, included “any
intercept run on an unidentified aircraft.” As stated, the ROE was specifically
designed to slow down a potential engagement to allow time for those in the chain
of command to check things out.
Although the written guidance was clear, there was controversy with respect to
how it was or should have been implemented and who had decision-making author-
ity. Conflicting testimony during the investigation of the shootdown about respon-
sibility may either reflect after-the-fact attempts to justify actions or may instead
reflect real confusion on the part of everyone, including those in charge, as to where
the responsibility lay—perhaps a little of both.


Safety Constraints Related to the Accident:
1. The ACE and MD must follow procedures specified and implied by the
ROE.
2. The ACE must ensure that pilots follow the ROE.
3. The ACE must interact with the AWACS crew to identify reported unidenti-
fied aircraft.
Controls: Controls to enforce the safety constraints included the ROE to provide
overall principles for decision-making and to slow down engagements in order to
prevent individual error or erratic behavior, the ACE up in the AWACS to augment
communication by getting up-to-the-minute information about the state of the
TAOR airspace and communicating with the pilots and AWACS crews, and the
Mission Director on the ground to provide a chain of command from the pilots to
the CFAC commander for real-time decision making.
AWACS Controllers
The AWACS (Airborne Warning and Control Systems) acts as an air traffic control
tower in the sky. The AWACS OPC mission was to:
1. Control aircraft en route to and from the no-fly zone
2. Coordinate air refueling (for the fighter aircraft and the AWACS itself)
3. Provide airborne threat warning and control for all OPC aircraft operating
inside the no-fly zone
4. Provide surveillance, detection, and identification of all unknown aircraft
An AWACS is a modified Boeing 707, with a saucer-shaped radar dome on the top,
equipped inside with powerful radars and radio equipment that scan the sky for
aircraft. A computer takes raw data from the radar dome, processes it, and ultimately
displays tactical information on fourteen color consoles arranged in rows of three
throughout the rear of the aircraft. AWACS have the capability to track approxi-
mately one thousand enemy aircraft at once while directing one hundred friendly
ones [159].
The AWACS carries a flight crew (pilot, copilot, navigator, and flight engineer)
responsible for safe ground and flight operation of the AWACS aircraft and a
mission crew that has overall responsibility for the AWACS command, control,
surveillance, communications, and sensor systems.
The mission crew of approximately nineteen people are under the direction of
a mission crew commander (MCC). The MCC has overall responsibility for the
AWACS mission and the management, supervision, and training of the mission crew.
The mission crew members were divided into three sections:


1. Technicians: The technicians are responsible for operating, monitoring, and
maintaining the physical equipment on the aircraft.
2. Surveillance: The surveillance section is responsible for the detection, track-
ing, identification, height measurement, display, and recording of surveillance
data. As unknown targets appear on the radarscopes, surveillance technicians
follow a detailed procedure to identify the tracks. They are responsible for
handling unidentified and non-OPC aircraft detected by the AWACS elec-
tronic systems. The section is supervised by the air surveillance officer, and the
work is carried out by an advanced air surveillance technician and three air
surveillance technicians.
3. Weapons: The weapons controllers are supervised by the senior director
(SD). This section is responsible for the control of all assigned aircraft and
weapons systems in the TAOR. The SD and three weapons directors are
together responsible for locating, identifying, tracking, and controlling all
friendly aircraft flying in support of OPC. Each weapons director was assigned
responsibility for a specific task:
•
•
•
The enroute controller controlled the flow of OPC aircraft to and from the
TAOR. This person also conducted radio and IFF checks on friendly aircraft
outside the TAOR.
The TAOR controller provided threat warning and tactical control for all
OPC aircraft within the TAOR.
The tanker controller coordinated all air refueling operations (and played no
part in the accident so is not mentioned further).
To facilitate communication and coordination, the SD’s console was physically
located in the “pit” right between the MCC and the ACE (Airborne Command
Element). Through internal radio nets, the SD synchronized the work of the
weapons section with that of the surveillance section. He also monitored and coor-
dinated the actions of his weapons directors to meet the demands of both the ACE
and MCC.
Because those who had designed the control structure recognized the potential
for some distance to develop between the training of the AWACS crew members
and the continually evolving practice in the no-fly zone (another example of asyn-
chronous evolution of the safety control structure), they had instituted a control by
creating staff or instructor personnel permanently stationed in Turkey. Their job was
to help provide continuity for U.S. AWACS crews who rotated through OPC on
temporary duty status, usually for thirty-day rotations. This shadow crew flew with
each new AWACS crew on their first mission in the TAOR to alert them as to how
things were really done in OPC. Their job was to answer any questions the new crew

might have about local procedures, recent occurrences, or changes in policy or inter-
pretation that had come about since the last time they had been in the theater.
Because the accident occurred on the first day for a new AWACS crew, instructor
or staff personnel were also on board.
In addition to all these people, a Turkish controller flew on all OPC missions to
help the crew interface with local air traffic control systems.
The AWACS typically takes off from Incirlik AFB approximately two hours
before the first air refueling and fighter aircraft. Once the AWACS is airborne, the
systems of the AWACS are brought on line, and a Joint Tactical Information Distri-
bution System (JTIDS3) link is established with a Turkish Sector Operations Center
(radar site). After the JTIDS link is confirmed, the CFAC airborne command
element (ACE) initiates the planned launch sequence for the rest of the force.
Normally, within a one-hour period, tanker and fighter aircraft take off and proceed
to the TAOR in a carefully orchestrated flow. Fighters may not cross the political
border into Iraq without AWACS coverage.


footnote. The Joint Tactical Information Distribution System acts as a central component of the mission
command and control system, providing ground commanders with a real-time downlink of the current
air picture from AWACS. This information is then integrated with data from other sources to provide
commanders with a more complete picture of the situation.


Safety Constraints Related to the Accident:
1. The AWACS mission crew must identify and track all aircraft in the TAOR.
Friendly aircraft must not be identified as a threat (hostile).
2. The AWACS mission crew must accurately inform fighters about the status of
all tracked aircraft when queried.
3. The AWACS mission crew must alert aircraft in the TAOR to any coalition
aircraft not appearing on the flowsheet (ATO).
4. The AWACS crew must not fail to warn fighters about any friendly aircraft
the fighters are targeting.
5. The JTIDS must provide the ground with an accurate picture of the airspace
and its occupants.
Controls: Controls included procedures for identifying and tracking aircraft, train-
ing (including simulator missions), briefings, staff controllers, and communication
channels. The SD and ASO provided real-time oversight of the crew’s activities.
Pilots
Fighter aircraft, flying in formations of two and four aircraft, must always have a
clear line of command. In the two-aircraft formation involved in the accident, the


lead pilot is completely in charge of the flight and the wingman takes all of his com-
mands from the lead.
The ACO (Airspace Control Order) stipulates that fighter aircraft may not cross
the political border into Iraq without AWACS coverage and no aircraft may enter
the TAOR until fighters with airborne intercept (AI) radars have searched the
TAOR for Iraqi aircraft. Once the AI radar-equipped aircraft have “sanitized” the
no-fly zone, they establish an orbit and continue their search for Iraqi aircraft and
provide air cover while other aircraft are in the area. When they detect non-OPC
aircraft, they are to intercept, identify, and take appropriate action as prescribed by
the rules of engagement (ROE) and specified in the ACO.
After the area is sanitized, additional fighters and tankers flow to and from the
TAOR throughout the six- to eight-hour daily flight schedule. This flying window is
randomly selected to avoid predictability.
Safety Constraints Related to the Accident:
1. Pilots must know and follow the rules of engagement established and com-
municated from the levels above.
2. Pilots must know who is in the no-fly zone at all times and whether they should
be there or not, i.e., they must be able to accurately identify the status of all
other aircraft in the no-fly zone at all times and must not misidentify a friendly
aircraft as a threat.
3. Pilots of aircraft in the area must be able to hear radio communications.
4. Fixed-wing aircraft must fly above 10,000 feet and helicopters must remain
below 400 feet.
Controls: Controls included the ACO, the ATO, flowsheets, radios, IFF, the ROE,
training, the AWACS, procedures to keep fighters and helicopters from coming into
contact (for example, they fly at different altitudes), and special tactical radio fre-
quencies when operating in the TAOR. Flags were displayed prominently on all
aircraft in order to identify their origin.
Communication: Communication is important in preventing friendly fire acci-
dents. The U.S. Army Black Hawk helicopters carried a full array of standard avion-
ics, radio, IFF, and radar equipment as well as communication equipment consisting
of FM, UHF, and VHF radios. Each day the FM and UHF radios were keyed with
classified codes to allow pilots to talk secure in encrypted mode. The ACO directed
that special frequencies were to be used when flying inside the TAOR.
Due to the line-of-sight limitations of their radios, the high mountainous terrain
in northern Iraq, and the fact that helicopters tried to fly at low altitudes to use the
terrain to mask them from enemy air defense radars, all Black Hawk flights into the


no-fly zone also carried tactical satellite radios (TACSATs). These TACSATS were
used to communicate with MCC operations. The helicopters had to land to place the
TACSATs in operation; they cannot be operated from inside a moving helicopter.
The F-15’s were equipped with avionics, communications, and electronic equip-
ment similar to that on the Black Hawks, except that the F-15’s were equipped with
HAVE QUICK II (HQ-II) frequency-hopping radios while the helicopters were
not. HQ-II defeated most enemy attempts to jam transmissions by changing fre-
quencies many times per second. Although the F-15 pilots preferred to use the more
advanced HQ technology, the F-15 radios were capable of communicating in a clear,
non-HQ-II mode. The ACO directed that F-15s use the non-HQ-II frequency when
specified aircraft that were not HQ-II capable flew in the TAOR. One factor involved
in the accident was that Black Hawk helicopters (UH-60s) were not on the list of
non-HQ-II aircraft that must be contacted using a non-HQ-II mode.
Identification: Identification of aircraft was assisted by systems called AAI/IFF
(electronic Air-to-Air Interrogation/Identification Friend or Foe). Each coalition
aircraft was equipped with an IFF transponder. Friendly radars (located in the
AWACS, a fighter aircraft, or a ground site) execute what is called a parrot check
to determine if the target being reflected on their radar screens is friendly or hostile.
The AAI component (the interrogator) sends a signal to an airborne aircraft to
determine its identity, and the IFF component answers or squawks back with a
secret code—a numerically identifying pulse that changes daily and must be uploaded
into aircraft using secure equipment prior to takeoff. If the return signal is valid, it
appears on the challenging aircraft’s visual display (radarscope). A compatible code
has to be loaded into the cryptographic system of both the challenging and the
responding aircraft to produce a friendly response.
An F-15’s AAI/IFF system can interrogate using four identification signals or
modes. The different types of IFF signals provide a form of redundancy. Mode I is
a general identification signal that permits selection of 32 codes. Two Mode I codes
were designated for use in OPC at the time of the accident: one for inside the TAOR
and the other for outside. Mode II is an aircraft-specific identification mode allowing
the use of 4,096 possible codes. Mode III provides a nonsecure friendly identification
of both military and civilian aircraft and was not used in the TAOR. Mode IV is
secure and provides high-confidence identification of friendly targets. According to
the ACO, the primary means of identifying friendly aircraft in the Iraqi no-fly zone
were to be modes I and IV in the IFF interrogation process.
Physical identification is also important in preventing friendly fire accidents.
The ROE require that the pilots perform a visual identification of the potential
threat. To assist in this identification, the Black Hawks were marked with six two-
by-three-foot American flags. An American flag was painted on each door, on both


sponsons,4 on the nose, and on the belly of each helicopter [159]. A flag had been
added to the side of each sponson because the Black Hawks had been the target of
small-arms ground fire several months before.

footnote. Sponsons are auxiliary fuel tanks.


section 5.3.

The Accident Analysis Using STAMP.
With all these controls and this elaborate control structure to protect against friendly
fire accidents, which was a well-known hazard, how could the shootdown occur on
a clear day with all equipment operational? As the Chairman of the Joint Chiefs of
Staff said after the accident:
In place were not just one, but a series of safeguards—some human, some procedural,
some technical—that were supposed to ensure an accident of this nature could never
happen. Yet, quite clearly, these safeguards failed.5
Using STAMP to understand why this accident occurred and to learn how to prevent
such losses in the future requires determining why these safeguards were not suc-
cessful in preventing the friendly fire. Various explanations for the accident have
been posited. Making sense out of these conflicting explanations and understanding
the accident process involved, including not only failures of individual system com-
ponents but the unsafe interactions and miscommunications between components,
requires understanding the role played in this process by each of the elements of
the safety control structure in place at the time.
The next section contains a description of the proximate events involved in the
loss. Then the STAMP analysis providing an explanation of why these events
occurred is presented.

footnote. John Shalikashvili, chairman of the Joint Chief of Staff, from a cover letter to the twenty-one-volume
report of the Aircraft Accident Investigation Board, 19 94 a, page 1.


section 5.3.1. Proximate Events.
Figure 5.4, taken from the official Accident Investigation Board Report, shows a
timeline of the actions of each of the main actors in the proximate events—the
AWACS, the F-15s, and the Black Hawks. It may also be helpful to refer back to
figure 5.1, which contains a map of the area showing the relative locations of the
important activities.
After receiving a briefing on the day’s mission, the AWACS took off from Incirlik
Air Base. When they arrived on station and started to track aircraft, the AWACS
surveillance section noticed unidentified radar returns (from the Black Hawks). A
“friendly general” track symbol was assigned to the aircraft and labeled as H,


denoting a helicopter. The Black Hawks (Eagle Flight) later entered the TAOR
(no-fly zone) through Gate 1, checked in with the AWACS controllers who anno-
tated the track with the identifier EE01, and flew to Zakhu. The Black Hawk pilots
did not change their IFF (Identify Friend or Foe) Mode I code: The code for all
friendly fixed-wing aircraft flying in Turkey on that day was 42, and the code for the
TAOR was 52. They also remained on the enroute radio frequency instead of chang-
ing to the frequency to be used in the TAOR. When the helicopters landed at Zakhu,
their radar and IFF (Identify Friend or Foe) returns on the AWACS radarscopes
faded. Thirty minutes later, Eagle Flight reported their departure from Zakhu to
the AWACS and said they were enroute from Whiskey (code name for Zakhu) to
Lima (code name for Irbil, a town deep in the TAOR). The enroute controller
reinitiated tracking of the helicopters.
Two F-15s were tasked that day to be the first aircraft in the TAOR and to sanitize
it (check for hostile aircraft) before other coalition aircraft entered the area. The
F-15s reached their final checkpoint before entering the TAOR approximately an
hour after the helicopters had entered. They turned on all combat systems, switched
their IFF Mode I code from 42 to 52, and switched to the TAOR radio frequency.
They reported their entry into the TAOR to the AWACS.
At this point, the Black Hawks’ radar and IFF contacts faded as the helicopters
entered mountainous terrain. The AWACS computer continued to move the heli-
copter tracks on the radar display at the last known speed and direction, but
the identifying H symbol (for helicopter) on the track was no longer displayed. The
ASO placed an “attention arrow” (used to point out an area of interest) on the
SD’s scope at the point of the Black Hawk’s last known location. This large arrow
is accompanied by a blinking alert light on the SD’s console. The SD did not
acknowledge the arrow and after sixty seconds, both the arrow and the light
were automatically dropped. The ASO then adjusted the AWACS radar to detect
slow-moving objects.
Before entering the TAOR, the lead F-15 pilot checked in with the ACE and was
told there were no relevant changes from previously briefed information (“negative
words”). Five minutes later, the F-15’s entered the TAOR, and the lead pilot reported
their arrival to the TAOR controller. One minute later, the enroute controller finally
dropped the symbol for the helicopters from the scope, the last remaining visual
reminder that there were helicopters inside the TAOR.
Two minutes after entering the TAOR, the lead F-15 picked up hits on its instru-
ments indicating that it was getting radar returns from a low and slow-flying aircraft.
The lead F-15 pilot alerted his wingman and then locked onto the contact and used
the F-15’s air-to-air interrogator to query the target’s IFF code. If it was a coalition
aircraft, it should be squawking Mode I, code 52. The scope showed it was not. He
reported the radar hits to the controllers in the AWACS, and the TAOR controller


told him they had no radar contacts in that location (“clean there”). The wing pilot
replied to the lead pilot’s alert, noting that his radar also showed the target.
The lead F-15 pilot then switched the interrogation to the second mode (Mode
IV) that all coalition aircraft should be squawking. For the first second it showed
the right symbol, but for the rest of the interrogation (4 to 5 seconds) it said the
target was not squawking Mode IV. The lead F-15 pilot then made a second contact
call to the AWACS over the main radio, repeating the location, altitude, and heading
of his target. This time the AWACS enroute controller responded that he had radar
returns on his scope at the spot (“hits there”) but did not indicate that these returns
might be from a friendly aircraft. At this point, the Black Hawk IFF response was
continuous but the radar returns were intermittent. The enroute controller placed
an “unknown, pending, unevaluated” track symbol in the area of the helicopter’s
radar and IFF returns and attempted to make an IFF identification.
The lead F-15 pilot, after making a second check of Modes I and IV and again
receiving no response, executed a visual identification pass to confirm that the target
was hostile—the next step required in the rules of engagement. He saw what he
thought were Iraqi helicopters. He pulled out his “goody book” with aircraft pictures
in it, checked the silhouettes, and identified the helicopters as Hinds, a type of
Russian aircraft flown by the Iraqis (“Tally two Hinds”). The F-15 wing pilot also
reported seeing two helicopters (“Tally two”), but never confirmed that he had
identified them as Hinds or as Iraqi aircraft.
The lead F-15 pilot called the AWACS and said they were engaging enemy air-
craft (“Tiger Two6 has tallied two Hinds, engaged”), cleared his wingman to shoot
(“Arm hot”), and armed his missiles. He then did one final Mode I check, received
a negative response, and pressed the button that released the missiles. The wingman
fired at the other helicopter, and both were destroyed.
This description represents the chain of events, but it does not explain “why” the
accident occurred except at the most superficial level and provides few clues as to
how to redesign the system to prevent future occurrences. Just looking at these basic
events surrounding the accident, it appears that mistakes verging on gross negli-
gence were involved—undisciplined pilots shot down friendly aircraft in clear skies,
and the AWACS crew and others who were supposed to provide assistance simply
sat and watched without telling the F-15 pilots that the helicopters were there. An
analysis using STAMP, as will be seen, provides a very different level of understand-
ing. In the following analysis, the goal is to understand why the controls in place did
not prevent the accident and to identify the changes necessary to prevent similar
accidents in the future. A related type of hazard analysis can be used during system

design and development (see chapters 8 and 9) to prevent such occurrences in the
first place.
In the following analysis, the basic failures and dysfunctional interactions leading
to the loss at the physical level are identified first. Then each level of the hierarchical
safety control structure is considered in turn, starting from the bottom.
At each level, the context in which the behaviors took place is considered. The
context for each level includes the hazards, the safety requirements and constraints,
the controls in place to prevent the hazard, and aspects of the environment or situ-
ation relevant to understanding the control flaws, including the people involved,
their assigned tasks and responsibilities, and any relevant environmental behavior-
shaping factors. Following a description of the context, the dysfunctional interac-
tions and failures at that level are described, along with the accident factors (see
figure 4.8) that were involved.

footnote. Tiger One was the code name for the F-15 lead pilot, while Tiger Two denoted the wing pilot.


section 5.3.2. Physical Process Failures and Dysfunctional Interactions.
The first step in the analysis is to understand the physical failures and dysfunctional
interactions within the physical process that were related to the accident. Figure 5.5
shows this information.
All the physical components worked exactly as intended, except perhaps for the
IFF system. The fact that the Mode IV IFF gave an intermittent response has never
been completely explained. Even after extensive equipment teardowns and reenact-
ments with the same F-15s and different Black Hawks, no one has been able to
explain why the F-15 IFF interrogator did not receive a Mode IV response [200].
The Accident Investigation Board report states: “The reason for the unsuccessful


Mode IV interrogation attempts cannot be established, but was probably attribut-
able to one or more of the following factors: incorrect selection of interrogation
modes, faulty air-to-air interrogators, incorrectly loaded IFF transponder codes,
garbling of electronic responses, and intermittent loss of line-of-sight radar contact.”7
There were several dysfunctional interactions and communication inadequacies
among the correctly operating aircraft equipment. The most obvious unsafe interac-
tion was the release of two missiles in the direction of two friendly aircraft, but there
were also four obstacles to the type of fighter–helicopter communications that might
have prevented that release.
1. The Black Hawks and F-15s were on different radio frequencies and thus the
pilots could not speak to each other or hear the transmissions between others
involved in the incident, the most critical of which were the radio transmissions
between the two F-15 pilots and between the lead F-15 pilot and personnel
onboard the AWACS. The Black Hawks, according to the Aircraft Control
Order, should have been communicating on the TAOR frequency. Stopping
here and looking only at this level, it appears that the Black Hawk pilots were
at fault in not changing to the TAOR frequency, but an examination of the
higher levels of control points to a different conclusion.
2. Even if they had been on the same frequency, the Air Force fighter aircraft
were equipped with HAVE QUICK II (HQ-II) radios, while the Army heli-
copters were not. The only way the F-15 and Black Hawk pilots could have
communicated would have been if the F-15 pilots switched to non-HQ mode.
The procedures the pilots were given to follow did not tell them to do so. In
fact, with respect to the two helicopters that were shot down, one contained
an outdated version called HQ-I, which was not compatible with HQ-II. The
other was equipped with HQ-II, but because not all of the Army helicopters
supported HQ-II, CFAC refused to provide Army helicopter operations with
the necessary cryptographic support required to synchronize their radios with
the other OPC components.
If the objective of the accident analysis is to assign blame, then the different
radio frequencies could be considered irrelevant because the differing technol-
ogy meant they could not have communicated even if they had been on the
same frequency. If the objective, however, is to learn enough to prevent future
accidents, then the different radio frequencies are relevant.


3. The Black Hawks were not squawking the required IFF Mode I code for those
flying within the TAOR. The GAO report states that Black Hawk pilots told
them they routinely used the same Mode I code for outside the TAOR while
operating within the TAOR and no one had advised them that it was incorrect
to do so. But, again, the wrong Mode I code is only part of the story.
The Accident Investigation Board report concluded that the use of the
incorrect Mode I IFF code by the Black Hawks was responsible for the F-15
pilots’ failure to receive a Mode I response when they interrogated the heli-
copters. However, an Air Force special task force concluded that based on the
descriptions of the system settings that the pilots testified they had used on
the interrogation attempts, the F-15s should have received and displayed any
Mode I or II response regardless of the code [200]. The AWACS was receiving
friendly Mode I and II returns from the helicopters at the same time that the
F-15s received no response. The GAO report concluded that the helicopters’
use of the wrong Mode I code should not have prevented the F-15s from
receiving a response. Confusing the situation even further, the GAO report
cites the Accident Board president as telling the GAO investigators that
because of the difference between the lead F-15 pilot’s statement on the day
of the incident and his testimony to the investigation board, it was difficult to
determine the number of times the lead pilot had interrogated the helicopters
[200].
4. Communication was also impeded by physical line-of-sight restrictions. The
Black Hawks were flying in narrow valleys among very high mountains that
disrupted communication depending on line-of-sight transmissions.
One reason for these dysfunctional interactions lies in the asynchronous evolu-
tion of the Army and Air Force technology, leaving the different services with largely
incompatible radios. Looking only at the event chain or at the failures and dysfunc-
tional interactions in the technical process—a common stopping point in accident
investigations—gives a very misleading picture of the reasons this accident occurred.
Examining the higher levels of control is necessary to obtain the information neces-
sary to prevent future occurrences.
After the shootdown, the following changes were made:
1.•Updated radios were placed on Black Hawk helicopters to enable communica-
tion with fighter aircraft. Until the time the conversion was complete, fighters
were directed to remain on the TAOR clear frequencies for deconfliction with
helicopters.
2.•Helicopter pilots were directed to monitor the common TAOR radio frequency
and to squawk the TAOR IFF codes.



footnote. The commander of the U.S. Army in Europe objected to this sentence. He argued that nothing in the
board report supported the possibility that the codes had been loaded improperly and that it was clear
the Army crews were not at fault in this matter. The U.S. Commander in Chief, Europe, agreed with his
view. Although the language in the opinion was not changed, the former said his concerns were addressed
because the complaint had been included as an attachment to the board report.


section 5.3.3. The Controllers of the Aircraft and Weapons.
The pilots directly control the aircraft, including the activation of weapons (figure
5.6). The context in which their decisions and actions took place is first described, fol-
lowed by the dysfunctional interactions at this level of the control structure. Then the
inadequate control actions are outlined and the factors that led to them are described.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints: The safety constraints that must be enforced
at this level of the sociotechnical control structure were described earlier. The F-15
pilots must know who is in the TAOR and whether they should be there or not—
that is, they must be able to identify accurately the status of all other aircraft in the
TAOR at all times so that a friendly aircraft is not identified as a threat. They must
also follow the rules of engagement (ROE), which specify the procedures to be
executed before firing weapons at any targets. As noted earlier in this chapter, the
OPC ROE were devised by the OPC commander, based on guidelines created by
the Joint Chiefs of Staff, and were purposely conservative because of the many
multinational participants in OPC and the potential for friendly fire accidents. The
ROE were designed to slow down any military confrontation, but were unsuccessful
in this case. An important part of understanding this accident process and prevent-
ing repetitions is understanding why this goal was not achieved.
Controls: As noted in the previous section, the controls at this level included the
rules and procedures for operating in the TAOR (specified in the ACO), informa-
tion provided about daily operations in the TAOR (specified in the Air Tasking
Order or ATO), flowsheets, communication and identification channels (radios and
IFF), training, AWACS oversight, and procedures to keep fighters and helicopters
from coming into contact (for example, the F-15s fly at different altitudes). National
flags were required to be displayed prominently on all aircraft in order to facilitate
identification of their origin.
Roles and Responsibilities of the F-15 Pilots: When conducting combat missions,
aerial tactics dictate that F-15s always fly in pairs with one pilot as the lead and one
as the wingman. They fly and fight as a team, but the lead is always in charge. The
mission that day was to conduct a thorough radar search of the area to ensure that
the TAOR was clear of hostile aircraft (to sanitize the airspace) before the other
aircraft entered. They were also tasked to protect the AWACS from any threats. The
wing pilot was responsible for looking 20,000 feet and higher with his radar while
the lead pilot was responsible for the area 25,000 feet and below. The lead pilot had
final responsibility for the 5,000-foot overlap area.
Environmental and Behavior-Shaping Factors for the F-15 Pilots: The lead pilot
that day was a captain with nine years’ experience in the Air Force. He had flown


F-15s for over three years, including eleven combat missions over Bosnia and nine-
teen over northern Iraq protecting the no-fly zone. The mishap occurred on his sixth
flight during his second tour flying in support of OPC.
The wing pilot was a lieutenant colonel and Commander of the 53rd Fighter
Squadron at the time of the shootdown, and he was a highly experienced pilot.
He had flown combat missions out of Incirlik during Desert Storm and had served
in the initial group that set up OPC afterward. He was credited with the only
confirmed kill of an enemy Hind helicopter during the Gulf War. That downing
involved a beyond visual range shot, which means he never actually saw the
helicopter.
F-15 pilots were rotated through every six to eight weeks. Serving in the no-fly
zone was an unusual chance for peacetime pilots to have a potential for engaging
in combat. The pilots were very aware they were going to be flying in unfriendly
skies. They drew personal sidearms with live rounds, removed wedding bands and
other personal items that could be used by potential captors, were supplied with
blood chits offering substantial rewards for returning downed pilots, and were
briefed about threats in the area. Every part of their preparation that morning drove
home the fact that they could run into enemy aircraft: The pilots were making deci-
sions in the context of being in a war zone and were ready for combat.
Another factor that might have influenced behavior, according to the GAO
report, was rivalry between the F-15 and F-16 pilots engaged in Operation Provide
Comfort (OPC). While such rivalry was normally perceived as healthy and leading
to positive professional competition, at the time of the shootdown the rivalry had
become more pronounced and intense. The Combined Task Force Commander
attributed this atmosphere to the F-16 community’s having executed the only fighter
shootdown in OPC and all the shootdowns in Bosnia [200]. F-16 pilots are better
trained and equipped to intercept low-flying helicopters. The F-15 pilots knew that
F-16s would follow them into the TAOR that day. Any hesitation might have resulted
in the F-16s getting another kill.
A final factor was a strong cultural norm of “radio discipline” (called minimum
communication or min comm), which led to abbreviated phraseology in communica-
tion and a reluctance to clarify potential miscommunications. Fighter pilots are kept
extremely busy in the cockpit; their cognitive capabilities are often stretched to the
limit. As a result, any unnecessary interruptions on the radio are a significant distrac-
tion from important competing demands [191]. Hence, there was a great deal
of pressure within the fighter community to minimize talking on the radio, which
discouraged efforts to check accuracy and understanding.
Roles and Responsibilities of the Black Hawk Pilots: The Army helicopter pilots
flew daily missions into the TAOR to visit Zakhu. On this particular day, a change


of command had taken place at the US Army Command Center at Zakhu. The
outgoing commander was to escort his replacement into the no-fly zone in order to
introduce him to the two Kurdish leaders who controlled the area. The pilots were
first scheduled to fly the routine leg into Zakhu, where they would pick up two
Army colonels and carry other high-ranking VIPs representing the major players in
OPC to the two Iraqi towns of Irbil and Salah ad Din. It was not uncommon for the
Black Hawks to fly this far into the TAOR; they had done it frequently during the
three preceding years of Operation Provide Comfort.
Environmental and Behavior-Shaping Factors for the Black Hawk Pilots: Inside
Iraq, helicopters flew in terrain flight mode, that is, they hugged the ground, both
to avoid midair collisions and to mask their presence from threatening ground-
to-air Iraqi radars. There are three types of terrain flight: Pilots select the appro-
priate mode based on a wide range of tactical and mission-related variables.
Low-level terrain flight is flown when enemy contact is not likely. Contour flying
is closer to the ground than low level, and nap-of-the-earth flying is the lowest
and slowest form of terrain flight, flown only when enemy contact is expected.
Eagle Flight helicopters flew contour mode most of the time in northern Iraq.
They liked to fly in the valleys and the low-level areas. The route they were taking
the day of the shootdown was through a green valley between two steep, rugged
mountains. The mountainous terrain provided them with protection from Iraqi air
defenses during the one-hour flight to Irbil, but it also led to disruptions in
communication.
Because of the distance and thus time required for the mission, the Black Hawks
were fitted with sponsons or pontoon-shaped fuel tanks. The sponsons are mounted
below the side doors, and each holds 230 gallons of extra fuel. The Black Hawks
were painted with green camouflage, while the Iraqi Hinds’ camouflage scheme was
light brown and desert tan. To assist with identification, the Black Hawks were
marked with three two-by-three-foot American flags—one on each door and one
on the nose—and a fourth larger flag on the belly of the helicopter. In addition, two
American flags had been painted on the side of each sponson.
Dysfunctional Interactions at This Level
Communication between the F-15 and Black Hawk pilots was obviously dysfunc-
tional and related to the dysfunctional interactions in the physical process (incom-
patible radio frequencies, IFF codes, and anti-jamming technology) resulting in the
ends of the communication channels not matching and information not being trans-
mitted along the channel. Communication between the F-15 pilots was also hindered
by the minimum communication policy that led to abbreviated messages and a
reluctance to clarify potential miscommunications as described above as well as by
the physical terrain.


Flawed or Inadequate Decisions and Control Actions.
Both the Army helicopter pilots and the F-15 pilots executed inappropriate or
inadequate control actions during their flights, beyond the obviously incorrect F-15
pilot commands to fire on two friendly aircraft.
Black Hawk Pilots:
1.•The Army helicopters entered the TAOR before it had been sanitized by the Air
Force. The Air Control Order or ACO specified that a fighter sweep of the
area must precede any entry of allied aircraft. However, because of the frequent
trips of Eagle Flight helicopters to Zakhu, an official exception had been made
to this policy for the Army helicopters. The Air Force fighter pilots had not
been informed about this exception. Understanding this miscommunication
requires looking at the higher levels of the control structure, particularly the
communication structure at those levels.
2.•The Army pilots did not change to the appropriate radio frequency to be used
in the TAOR. As noted earlier, however, even if they had been on the same
frequency, they would have been unable to communicate with the F-15s because
of the different anti-jamming technology of the radios.
3.•The Army pilots did not change to the appropriate IFF Mode I signal for the
TAOR. Again, as noted above, the F-15s should still have been able to receive
the Mode I response.
F-15 Lead Pilot: The accounts of and explanation for the unsafe control actions of
the F-15 pilots differ greatly among those who have written about the accident.
Analysis is complicated by the fact that any statements the pilots made after the
accident were likely to have been influenced by the fact that they were being inves-
tigated on charges of negligent homicide—their stories changed significantly over
time. Also, in the excitement of the moment, the lead pilot did not make the required
radio call to his wingman requesting that he turn on the HUD8 tape, and he also
forgot to turn on his own tape. Therefore, evidence about certain aspects of what
occurred and what was observed is limited to pilot testimony during the post-acci-
dent investigations and trials.
Complications also arise in determining whether the pilots followed the rules of
engagement (ROE) specified for the no-fly zone, because the ROE are not public
and the relevant section of the Accident Investigation Board Report is censored.
Other sources of information about the accident, however, reference clear instances
of Air Force pilot violations of the ROE.


The following inadequate decisions and control actions can be identified for the
lead F-15 pilot:
1.•
He did not perform a proper visual ID as required by the ROE and did not take
a second pass to confirm the identification. F-15 pilots are not accustomed to
flying close to the ground or to terrain. The lead pilot testified that because of
concerns about being fired on from the ground and the danger associated with
flying in a narrow valley surrounded by high mountains, he had remained high
as long as possible and then dropped briefly for a visual identification that
lasted between 3 and 4 seconds. He passed the helicopter on his left while flying
more than 500 miles an hour and at a distance of about 1,000 feet off to the
side and about 300 feet above the helicopter. He testified:
I was trying to keep my wing tips from hitting mountains and I accomplished two
tasks simultaneously, making a call on the main radio and pulling out a guide that
had the silhouettes of helicopters. I got only three quick interrupted glances of less
than 1.25 seconds each. [159].
The dark green Black Hawk camouflage blended into the green background
of the valley, adding to the difficulty of the identification.
The Accident Investigation Board used pilots flying F-15s and Black Hawks
to recreate the circumstances under which the visual identification was made.
The test pilots were unable to identify the Black Hawks, and they could not
see any of the six American flags on each helicopter. The F-15 pilots could not
have satisfied the ROE identification requirements using the type of visual
identification passes they testified that they made.
2.•
He misidentified the helicopters as Iraqi Hinds. There were two basic incorrect
decisions involved in this misidentification. The first was identifying the UH-60
(Black Hawk) helicopters as Russian Hinds, and the second was assuming that
the Hinds were Iraqi. Both Syria and Turkey flew Hinds, and the helicopters
could have belonged to one of the U.S. coalition partners. The Commander of
the Operations Support Squadron, whose job was to run the weekly detach-
ment squadron meetings, testified that as long as he had been in OPC, he had
reiterated to the squadrons each week that they should be careful about mis-
identifying aircraft over the no-fly zone because there were so many nations
and so many aircraft in the area and that any time F-15s or anyone else picked
up a helicopter on radar, it was probably a U.S., Turkish, or United Nations
helicopter:
Any time you intercept a helicopter as an unknown, there is always a question of
procedures, equipment failure, and high terrain masking the line-of-sight radar. There




are numerous reasons why you would not be able to electronically identify a heli-
copter. Use discipline. It is better to miss a shot than be wrong. [159].
4.•He did not confirm, as required by the ROE, that the helicopters had hostile
intent before firing. The ROE required that the pilot not only determine the
type of aircraft and nationality, but to take into consideration the possibility
the aircraft was lost, in distress, on a medical mission, or was possibly being
flown by pilots who were defecting.
5.•He violated the rules of engagement by not reporting to the Air Command
Element (ACE). According to the ROE, the pilot should have reported to
the ACE (who is in his chain of command and physically located in the
AWACS) that he had encountered an unidentified aircraft. He did not wait for
the ACE to approve the release of the missiles.
6.•He acted with undue and unnecessary haste that did not allow time for those
above him in the control structure (who were responsible for controlling the
engagement) to act. The entire incident, from the first time the pilots received
an indication about helicopters in the TAOR to shooting them down lasted
only seven minutes. Pilots are allowed by the ROE to take action on their own
in an emergency, so the question then becomes whether this situation was an
emergency.
CFAC officials testified that there had been no need for haste. The slow-flying
helicopters had traveled less than fourteen miles since the F-15s first picked
them up on radar, they were not flying in a threatening manner, and they were
flying southeast away from the Security Zone. The GAO report cites the Mission
Director as stating that given the speed of the helicopters, the fighters had time
to return to Turkish airspace, refuel, and still return and engage the helicopters
before they could have crossed south of the 36th Parallel.
The helicopters also posed no threat to the F-15s or to their mission, which
was to protect the AWACS and determine whether the area was clear. One
expert later commented that even if they had been Iraqi Hinds, “A Hind is only
a threat to an F-15 if the F-15 is parked almost stationary directly in front of it
and says ‘Kill me.’ Other than that, it’s probably not very vulnerable” [191].
Piper quotes Air Force Lt. Col. Tony Kern, a professor at the U.S. Air Force
Academy, who wrote about this accident:
Mistakes happen, but there was no rush to shoot these helicopters. The F-15s could
have done multiple passes, or even followed the helicopters to their destination to
determine their intentions. [159].
Any explanation behind the pilot’s hasty action can only be the product of
speculation. Snook attributes the fast reaction to the overlearned defensive

responses taught to fighter pilots. Both Snook and the GAO report mention
the rivalry with the F-16 pilots and a desire of the lead F-15 pilot to shoot down
an enemy aircraft. F-16s would have entered the TAOR ten to fifteen minutes
after the F-15s, potentially allowing the F-16 pilots to get credit for the downing
of an enemy aircraft: F-16s are better trained and equipped to intercept low-
flying helicopters. If the F-15 pilots had involved the chain of command, the
pace would have slowed down, ruining the pilots’ chance for a shootdown. In
addition, Snook argues that this was a rare opportunity for peacetime pilots to
engage in combat.
The goals and motivation behind any human action are unknowable (see
section 2.7). Even in this case where the F-15 pilots survived the accident, there
are many reasons to discount their own explanations, not the least of which is
potential jail sentences. The explanations provided by the pilots right after the
engagement differ significantly from their explanations a week later during the
official investigations to determine whether they should be court-martialed.
But in any case, there was no chance that such slow flying helicopters could
have escaped two supersonic jet fighters in the open terrain of northern Iraq
nor were they ever a serious threat to the F-15s. This situation, therefore, was
not an emergency.
7.•He did not wait for a positive ID from the wing pilot before firing on the heli-
copters and did not question the vague response when he got it: When the lead
pilot called out that he had visually identified two Iraqi helicopters, he asked
the wing pilot to confirm the identification. The wingman called out “Tally Two”
on his radio, which the lead pilot took as confirmation, but which the wing pilot
later testified only meant he saw two helicopters but not necessarily Iraqi
Hinds. The lead pilot did not wait for a positive identification from the wingman
before starting the engagement.
8.•He violated altitude restrictions without permission: According to Piper, the
commander of the OPC testified at one of the hearings,
I regularly, routinely imposed altitude limitations in northern Iraq. On the fourteenth
of April, the restrictions were a minimum of ten thousand feet for fixed-wing aircraft.
This information was in each squadron’s Aircrew Read File. Any exceptions had to
have my approval. [159]
None of the other accident reports, including the official one, mentions this
erroneous action on the part of the pilots. Because this control flaw was never
investigated, it is not possible to determine whether the action resulted from a
“reference channel” problem (i.e., the pilots did not know about the altitude
restriction) or an “actuator” error (i.e., the pilots knew about it but chose to
ignore it for an unknown reason.)

9.•He deviated from the basic mission to protect the AWACS, leaving the AWACS
open to attack: The helicopter could have been a diversionary ploy. The
mission of the first flight into the TAOR was to make sure it was safe for the
AWACS and other aircraft to enter the restricted operating zone. Piper empha-
sizes that that was the only purpose of their mission [159]. Piper, who again is
the only one who mentions it, cites testimony of the commander of OPC during
one of the hearings when asked whether the F-15s exposed the AWACS to
other air threats when they attacked and shot down the helicopters. The
commander replied:
Yes, when the F-15s went down to investigate the helicopters, made numerous passes,
engaged the helicopters and then made more passes to visually reconnaissance the
area, AWACS was potentially exposed for that period of time. [159]



Wing Pilot: The wing pilot, like the lead pilot, violated altitude restrictions and
deviated from the basic mission. In addition:
1.•He did not make a positive identification of the helicopters: His visual identi-
fication was not even as close to the helicopters as the lead F-15 pilot, which
was inadequate to recognize the helicopters, and the wing pilot’s ID lasted only
between two and three seconds. According to a Washington Post article, he told
investigators that he never clearly saw the helicopters before reporting “Tally
Two.” In a transcript of one of his interviews with investigators, he said: “I did
not identify them as friendly; I did not identify them as hostile. I expected to
see Hinds based on the call my flight leader had made. I didn’t see anything
that disputed that.”
Although the wing had originally testified he could not identify the helicop-
ters as Hinds, he reversed his statement between April and six months later
when he testified at the hearing on whether to court-martial him that “I could
identify them as Hinds” [159]. There is no way to determine which of these
contradictory statements is true.
Explanations for continuing the engagement without an identification could
range from an inadequate mental model of the ROE, following the orders of
the lead pilot and assuming that his identification had been proper, the strong
influence on what one sees by what one expects to see, wanting the helicopters
to be hostile, and any combination of these.
2.•He did not tell the lead pilot that he had not identified the helicopters: In
the hearings to place blame for the shootdown, the lead pilot testified that
he had radioed the wing pilot and said, “Tiger One has tallied two Hinds,
confirm.” Both pilots agree to this point, but then the testimony becomes
contradictory.


The hearing in the fall of 1994 on whether the wing pilot should be charged
with twenty-six counts of negligent homicide rested on the very narrow ques-
tion of whether the lead pilot had called the AWACS announcing the engage-
ment before or after the wing pilot responded to the lead pilot’s directive to
confirm whether the helicopters were Iraqi Hinds. The lead pilot testified that
he had identified the helicopters as Hinds and then asked the wing to confirm
the identification. When the wing responded with “Tally Two,” the lead believed
this response signaled confirmation of the identification. The lead then radioed
the AWACS and reported, “Tiger Two has tallied two Hinds, engaged.” The
wing pilot, on the other hand, testified that the lead had called the AWACS
with the “engaged” message before he (the wing pilot) had made his “Tally
Two” radio call to the lead. He said his “Tally Two” call was in response to the
“engaged” call, not the “confirm” call and simply meant that he had both target
aircraft in sight. He argued that once the engaged call had been made, he cor-
rectly concluded that an identification was no longer needed.
The fall 1994 hearing conclusion about which of these scenarios actually
occurred is different than the conclusions in the official Air Force accident
report and that of the hearing officer in another hearing. Again, it is not pos-
sible nor necessary to determine blame here or to determine exactly which
scenario is correct to conclude that the communications were ambiguous. The
minimum communication policy was a factor here as was probably the excite-
ment of a potential combat engagement. Snook suggests that the expectations
of what the pilots expected to hear resulted in a filtering of the inputs. Such
filtering is a well-known problem in airline pilots’ communications with con-
trollers. The use of well-established phraseology is meant to reduce it. But the
calls by the wing pilot were nonstandard. In fact, Piper notes that in pilot train-
ing bases and programs that train pilots to fly fighter aircraft since the shoot-
down, these radio calls are used as examples of “the poorest radio communications
possibly ever given by pilots during a combat intercept” [159].
3.•
He continued the engagement despite the lack of an adequate identification:
Explanations for continuing the engagement without an identification could
range from an inadequate mental model of the ROE, following the orders
of the lead pilot and assuming that the lead pilot’s identification had been
proper, wanting the helicopters to be hostile, and any combination of these.
With only his contradictory testimony, it is not possible to determine
the reason.
Some Reasons for the Flawed Control Actions and Dysfunctional Interactions
The accident factors shown in figure 4.8 can be used to provide an explanation for
the flawed control actions. These factors here are divided into incorrect control


algorithms, inaccurate mental models, poor coordination among multiple control-
lers, and inadequate feedback from the controlled process.
Incorrect Control Algorithms: The Black Hawk pilots correctly followed the pro-
cedures they had been given (see the discussion of the CFAC–MCC level later).
These procedures were unsafe and were changed after the accident.
The F-15 pilots apparently did not execute their control algorithms (the proce-
dures required by the rules of engagement) correctly, although the secrecy involved
in the ROE make this conclusion difficult to prove. After the accident, the ROE
were changed, but the exact changes made are not public.
Inaccurate Mental Models of the F-15 Pilots: There were many inconsistencies
between the mental models of the Air Force pilots and the actual process state. First,
they had an ineffective model of what a Black Hawk helicopter looked like. There
are several explanations for this, including poor visual recognition training and the
fact that Black Hawks with sponsons attached resemble Hinds. None of the pictures
of Black Hawks on which the F-15 pilots had been trained had these wing-mounted
fuel tanks. Additional factors include the speeds at which the F-15 pilots do their
visual identification (VID) passes and the angle at which the pilots passed over
their targets.
Both F-15 pilots received only limited visual recognition training in the previous
four months, partly due to the disruption of normal training caused by their wing’s
physical relocation from one base to another in Germany. But the training was
probably inadequate even if it had been completed. Because the primary mission
of F-15s is air-to-air combat against other fast-moving aircraft, most of the opera-
tional training is focused on their most dangerous and likely threats—other high-
altitude fighters. In the last training before the accident, only five percent of the
slides depicted helicopters. None of the F-15 intelligence briefings or training ever
covered the camouflage scheme of Iraqi helicopters, which was light brown and
desert tan (in contrast to the forest green camouflage of the Black Hawks).
Pilots are taught to recognize many different kinds of aircraft at high speeds using
“beer shots,” which are blurry pictures that resemble how the pilot might see those
aircraft while in flight. The Air Force pilots, however, received very little training in
the recognition of Army helicopters, which they rarely encountered because of the
different altitudes at which they flew. All the helicopter photos they did see during
training, which were provided by the Army, were taken from the ground—a perspec-
tive from which it was common for Army personnel to view them but not useful
for a fighter pilot in flight above them. None of the photographs were taken from
the above aft quadrant—the position from which most fighters would view a heli-
copter. Air Force visual recognition training and procedures were changed after
this accident.


The F-15 pilots also had an inaccurate model of the current airspace occupants,
based on the information they had received about who would be in the airspace
that day and when. They assumed and had been told in multiple ways that they
would be the first coalition aircraft in the TAOR:
1.• The AGO specified that no coalition aircraft (fixed or rotary wing) was allowed
to enter the TAOR before it was sanitized by a fighter sweep.
2.• The daily ATO and ARF included a list of all flights scheduled to be in the
TAOR that day. The ATO listed the Army Black Hawk flights only in terms of
their call signs, aircraft numbers, type of mission (transport), and general route
(from Diyarbakir to the TAOR and back to Diyarbakir). All departure times
were listed “as required” and no helicopters were mentioned on the daily flow-
sheet. Pilots fly with the flowsheet on kneeboards as a primary reference during
the mission. The F-15s were listed as the very first mission into the TAOR; all
other aircraft were scheduled to follow them.
3.•
During preflight briefings that morning, the ATO and flowsheet were reviewed
in detail. No mention was made of any Army helicopter flights not appearing
on the flowsheet.
4.• The
Battle Sheet Directive (a handwritten sheet containing last-minute
changes to information published in the ATO and the ARF) handed to them
before going to their aircraft contained no information about Black Hawk
flights.
5.•In a radio call to the ground-based Mission Director just after engine start, the
lead F-15 pilot was told that no new information had been received since the
ATO was published.
6.•Right before entering the TAOR, the lead pilot checked in again, this time with
the ACE in the AWACS. Again, he was not told about any Army helicopters
in the area.
7.• At 10 20, the lead pilot reported that they were on station. Usually at this time,
the AWACS will give them a “picture” of any aircraft in the area. No informa-
tion was provided to the F-15 pilots at this time, although the Black Hawks had
already checked in with the AWACS on three separate occasions.
8.• The
AWACS continued not to inform the pilots about Army helicopters
during the encounter. The lead F-15 pilot twice reported unsuccessful attempts
to identify radar contacts they were receiving, but in response they were not
informed about the presence of Black Hawks in the area. After the first
report, the TAOR controller responded with “Clean there,” meaning he did
not have a radar hit in that location. Three minutes later, after the second
call, the TAOR controller replied, “Hits there.” If the radar signal had been



identified as a friendly aircraft, the controller would have responded, “Paint
there.”
9.• The IFF transponders on the F-15s did not identify the signals as from a friendly
aircraft, as discussed earlier.
Various complex analyses have been proposed to explain why the F-15 pilots’ mental
models of the airspace occupants were incorrect and not open to reexamination
once they received conflicting input. But a possible simple explanation is that they
believed what they were told. It is well known in cognitive psychology that mental
models are slow to change, particularly in the face of ambiguous evidence like that
provided in this case. When operators receive input about the state of the system
being controlled, they will first try to fit that information into their current mental
model and will find reasons to exclude information that does not fit. Because opera-
tors are continually testing their mental models against reality (see figure 2.9), the
longer a model has been held and the more different sources of information that
led to that incorrect model, the more resistant the models will be to change due to
conflicting information, particularly ambiguous information. The pilots had been
told repeatedly and by almost everyone involved that there were no friendly heli-
copters in the TAOR at that time.
The F-15 pilots also may have had a misunderstanding about (incorrect model
of) the ROE and the procedures required when they detected an unidentified
aircraft. The accident report says that the ROE were reduced in briefings and in
individual crew members’ understandings to a simplified form. This simplification
led to some pilots not being aware of specific considerations required prior to
engagement, including identification difficulties, the need to give defectors safe
conduct, and the possibility of an aircraft being in distress and the crew being
unaware of their position. On the other hand, there had been an incident the week
before and the F-15 pilots had been issued an oral directive reemphasizing the
requirement for fighter pilots to report to the ACE. That directive was the result
of an incident on April 7 in which F-15 pilots had initially ignored directions from
the ACE to “knock off” or stop an intercept with an Iraqi aircraft. The ACE over-
heard the pilots preparing to engage the aircraft and contacted them, telling them
to stop the engagement because he had determined that the hostile aircraft was
outside the no-fly zone and because he was leery of a “bait and trap” situation.9
The GAO report stated that CFAC officials told the GAO that the F-15 community
was “very upset” about the intervention of the ACE during the knock-off incident

and felt he had interfered with the carrying out of the F-15 pilots’ duties [200].
As discussed in chapter 2, there is no way to determine the motivation behind
an individual’s actions. Accident analysts can only present the alternative
explanations.
Additional reasons for the lead pilot’s incorrect mental model stem from ambigu-
ous or missing feedback from the F-15 wing pilot, dysfunctional communication with
the Black Hawks, and inadequate information provided over the reference channels
from the AWACS and CFAC operations.



footnote. . According to the GAO report, in such a strategy, a fighter aircraft is lured into an area by one or more
enemy targets and then attacked by other fighter aircraft or surface-to-air missiles.



Inaccurate Mental Models of the Black Hawk Pilots: The Black Hawk control
actions can also be linked to inaccurate mental models, that is, they were unaware
there were separate IFF codes for flying inside and outside the TAOR and that they
were supposed to change radio frequencies inside the TAOR. As will be seen later,
they were actually told not to change frequencies. They had also been told that the
AGO restriction on the entry of allied aircraft into the TAOR before the fighter
sweep did not apply to them—an official exception had been made for helicopters.
They understood that helicopters were allowed inside the TAOR without AWACS
coverage as long as they stayed inside the security zone. In practice, the Black Hawk
pilots frequently entered the TAOR prior to AWACS and fighter support without
incident or comment, and therefore it became accepted practice.
In addition, because their radios were unable to pick up the HAVE QUICK
communications between the F-15 pilots and between the F-15s and the AWACS,
the Black Hawk pilots’ mental models of the situation were incomplete. According
to Snook, Black Hawk pilots testified during the investigation,
We were not integrated into the entire system. We were not aware of what was going on
with the F-15s and the sweep and the refuelers and the recon missions and AWACS. We
had no idea who was where and when they were there. [191]
Coordination among Multiple Controllers: At this level, each component (air-
craft) had a single controller and thus coordination problems did not occur. They
were rife, however, at the higher control levels.
Feedback from the Controlled Process: The F-15 pilots received ambiguous infor-
mation from their visual identification pass. At the speeds and altitudes they were
traveling, it is unlikely that they would have detected the unique Black Hawk mark-
ings that identified them as friendly. The mountainous terrain in which they were
flying limited their ability to perform an adequate identification pass and the green
helicopter camouflage added to the difficulty. The feedback from the wingman to
the lead F-15 pilot was also ambiguous and was most likely misinterpreted by the
lead pilot. Both pilots apparently received incorrect IFF feedback.


Changes after the Accident
After the accident, Black Hawk pilots were:
1.•Required to strictly adhere to their ATO published routing and timing.
2.•Not allowed to operate in the TAOR unless under positive control of AWACS.
Without AWACS coverage, only administrative helicopter flights between
Diyarbakir and Zakhu were allowed, provided they were listed on the ATO.
3.•Required to monitor the common TAOR radio frequency.
4.•Required to confirm radio contact with AWACS at least every twenty minutes
unless they were on the ground.
5.•Required to inform AWACS upon landing. They must make mandatory radio
calls at each enroute point.
6.•If radio contact could not be established, required to climb to line-of-sight with
AWACS until contact is reestablished.
7.•Prior to landing in the TAOR (including Zakhu), required to inform the
AWACS of anticipated delays on the ground that would preclude taking off at
the scheduled time.
8.•Immediately after takeoff, required to contact the AWACS and reconfirm
IFF Modes I, II, and IV are operating. If they have either a negative radio
check with AWACS or an inoperative Mode IV, they cannot proceed into the
TAOR.
All fighter pilots were:
9.•Required to check in with the AWACS when entering the low-altitude environ-
ment and remain on the TAOR clear frequencies for deconfliction with
helicopters.
10.•Required to make contact with AWACS using UHF, HAVE QUICK, or UHF
clear radio frequencies and confirm IFF Modes I, II, and IV before entering
the TAOR. If there was either a negative radio contact with AWACS or an
inoperative Mode IV, they could not enter the TAOR.
Finally, white recognition strips were painted on the Black Hawk rotor blades to
enhance their identification from the air.

section 5.3.4.
The ACE and Mission Director.
Context in Which Decisions and Actions Took Place
Safety Requirements and Constraints: The ACE and mission director must follow
the procedures specified and implied by the ROE, the ACE must ensure that pilots


follow the ROE, and the ACE must interact with the AWACS crew to identify
reported unidentified aircraft (see figure 5.7).
Controls: The controls include the ROE to slow down the engagement and a chain
of command to prevent individual error or erratic behavior.
Roles and Responsibilities: The ACE was responsible for controlling combat oper-
ations and for ensuring that the ROE were enforced. He flew in the AWACS so he
could get up-to-the-minute information about the state of the TAOR airspace.
The ACE was always a highly experienced person with fighter experience. That
day, the ACE was a major with nineteen years in the Air Force. He had perhaps
more combat experience than anyone else in the Air Force under forty. He had
logged 2,000 total hours of flight time and flown 125 combat missions, including 27
in the Gulf War, during which time he earned the Distinguished Flying Cross and
two air medals for heroism. At the time of the accident, he had worked for four
months as an ACE and flown approximately fifteen to twenty missions on the
AWACS [191].
The Mission Director on the ground provided a chain of command for real-time
decision making from the pilots to the CFAC commander. On the day of the acci-
dent, the Mission Director was a lieutenant colonel with more than eighteen years
in the Air Force. He had logged more than 1,000 hours in the F-4 in Europe and an
additional 100 hours worldwide in the F-15 [191].
Environmental and Behavior-Shaping Factors: No pertinent factors were identified
in the reports and books on the accident.

Dysfunctional Interactions at This Level.
The ACE was supposed to get information about unidentified or enemy aircraft
from the AWACS mission crew, but in this instance they did not provide it.

Flawed or Inadequate Decisions and Control Actions.
The ACE did not provide any control commands to the F-15s with respect to fol-
lowing the ROE or engaging and firing on the U.S. helicopters.

Reasons for Flawed Control Actions and Dysfunctional Interactions.
Incorrect Control Algorithms: The control algorithms should theoretically have
been effective, but they were never executed.
Inaccurate Mental Models: CFAC, and thus the Mission Director and ACE, exer-
cised ultimate tactical control of the helicopters, but they shared the common view
with the AWACS crew that helicopter activities were not an integral part of OPC
air operations. In testimony after the accident, the ACE commented, “The way I
understand it, only as a courtesy does the AWACS track Eagle Flight.”

page 141