Synopsis

The quadcopter unmanned aircraft (UA) was being flown over the city of Poole during a police operation when the wind at 400 ft exceeded the forecast wind, the manufacturer’s wind limit and the maximum restricted speed of the UA. The UA drifted beyond visual line of sight and then communication with it was lost. When the battery level was low it entered an auto-land mode but collided with the wall of a house, damaging its propeller blades before coming to rest on a balcony.

The investigation revealed that shortly after take-off one of the UA’s two batteries had disconnected which resulted in its maximum speed being restricted, but this restriction is not referenced in the user manual and neither the remote pilot nor operator were aware of it. When the UA detected that the manufacturer’s wind limit had been exceeded, the message triggered on the pilot’s controller display was ‘Fly with caution, strong wind’ instead of advising the pilot that the limit had been exceeded and that the UA should be landed as soon as possible. Three Safety Recommendations are made to the UAS manufacturer and one to the CAA on Visual Line of Sight guidance.

History of the flight (abridged)

The remote pilot was working with an observer who had a slave controller. At 1108hrs the remote pilot obtained a wind forecast at 400ft of 24mph from the north-west using a UAS weather forecast app. At 1117hrs, a flight towards the south-west was carried out with no issues. The two batteries were replaced and then at 1145hrs the UA took off again. Standard control checks were carried out at a height of 10m before climbing to 120m (400ft) and flying south-east towards a target location that was 500m away.

The remote pilot reported that he maintained a good visual sight of the UA and referred to his controller for flight and aircraft information. He then noticed two messages on the controller screen: one stating ‘Battery communication error’ and then another stating ‘Fly with caution, strong wind’. He noted that one of the batteries was showing 97% state of charge (SOC) while the other battery SOC was decreasing faster than normal. The pilot tried to fly the aircraft back towards him, but it did not appear to be moving any closer. He then noted that one battery was showing 58% SOC while the other was still showing 97% The pilot used the map function to check the aircraft’s orientation and confirmed it was correct, but it was still not returning. The aircraft’s distance from the pilot began to increase beyond 500m which is not normally possible because the maximum flight distance from the remote pilot had been set to 500m using the DJI Pilot app.

The pilot was now very concerned and activated the ‘Return to home (RTH)’ feature on the controller, but it did not appear to engage despite being operated multiple times. RTH then appeared to activate but the aircraft did not move any closer. The pilot then switched to ‘Sport Mode’ as per their emergency procedure which he expected would give him a top speed of 51mph, allowing a greater ability to overcome the headwind. This cancelled the RTH feature so he pressed RTH again, but it would not re-engage. The remote pilot asked the observer to try engaging it using his slave controller, but this did not work either. At this stage neither the pilot nor the observer could see the aircraft, but they could see it on the moving map heading slowly towards Poole Park boating lake in a south-easterly direction. Both controllers then lost communication with the aircraft.

The pilot and observer packed their kit and drove to the last location of the aircraft shown on the map display. When they arrived in the area of the last position, the controllers regained communication with the aircraft and displayed its GPS coordinates. They found the aircraft on a first-floor balcony of a house. The aircraft’s right leg had snapped at the mounting bracket, three propeller blades had shattered, and one propeller had detached but was located next to the aircraft.

Analysis

 Cause of the fly away accident

The fly-away event was caused by a number of factors. Battery 1 became disconnected shortly after takeoff which resulted in the UA being powered by Battery 2 alone. The cause of the battery disconnection could not be determined, but the battery functioned normally when fitted to another UA so it is probable that it was not fully pushed into place before takeoff.

The battery disconnection meant that the UA sensed a large drop in total battery capacity which triggered a restriction in its pitch limit and therefore its top speed. From the data the pitch limit appeared to be about 15°.

The wind at 400ft increased beyond the 24mph speed forecast by the pilot’s UAS weather forecast app. The wind reached a calculated peak of 39mph, but varied mainly between 25mph and 35mph. The UA’s top speed in P-mode was either 35.8 or 38mph. If it had been able to achieve 38mph then it would not have drifted away in the wind. Even at a top speed of 35.8mph there were periods when it would have made progress back towards the home point. However, with the restricted pitch attitude that was about 10° less than normal, this was not possible. The pilot’s attempt to use S-mode as per the operator’s emergency procedure did not allow an increase in speed as the restricted pitch limit also applied in S-mode.

The UA drifted beyond visual line of sight and communication was lost which meant that a recovery was no longer possible. The UA could not auto-return-home due to the wind. When the battery 2 level dropped to 23% the UA entered an auto-land mode but was unable to avoid the wall of a house resulting in damage to the propeller blades and a subsequent impact with the balcony. If the balcony had been occupied, people could have been seriously injured by the propeller blades.

The following were contributory factors to the accident:

Awareness of the wind speed

The wind at 400ft cannot be directly measured so the pilot was reliant on a wind forecast. The forecast was for a wind 3mph below their operational limit and the manufacturer’s limit. The pilot believed that S-mode would give him a top speed of 51mph, so he may have considered that he had a significant safety margin if the wind increased beyond the forecast. But with both camera gimbals fitted the speed limit was 40.3mph. However, this was still higher than the peak wind of 39 mph so recovery would still have been possible. The pilot also believed that he would receive a wind warning that would tell him to land if the wind increased excessively. He reasonably interpreted the ‘High Wind Velocity. Fly with caution’ message to mean that he could continue the flight. The user manual does not provide any information on the alert messages that can appear, or the appropriate actions to take.

The manufacturer appears to have used the same message for both a Level 1 and a Level 2 wind warning, causing confusion to the remote pilot on the action to take. The manufacturer had set a wind limit of 27mph, and therefore the Level 2 wind warning should have advised the pilot to land as soon as possible. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-001

It is recommended that DJI amend the DJI Pilot and DJI GO4 apps to warn the remote pilot when the wind limit has been exceeded and that the UA should be landed as soon as possible.

The pilot is required to maintain visual line of sight with the UA and therefore could miss an alert message on the controller screen if they are concentrating on manoeuvring the UA visually. If messages related to safety of flight had an associated aural warning the pilot’s attention could be drawn to them. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-002

 It is recommended that DJI amend the DJI Pilot and DJI GO4 apps so that an aural alert is triggered when alert messages relating to safety of flight appear.

The pilot’s awareness of the wind would also be improved if the controlling apps displayed the wind speed that is calculated by the UA. This is a feature on the newer Matrice 300 series UAS.

Awareness of the pitch attitude restriction

Neither the operator nor the pilot was aware that below a certain total battery SOC, the aircraft’s pitch attitude is restricted to about 15°, 10° less than normal, and 15° less than in S-mode; and that this results in a lower top speed. These facts are not mentioned in the UAS user manual or on the manufacturer’s website. The limit is also triggered at a total battery capacity level which is not displayed to the pilot. The total battery capacity figure had logic to ignore the capacity of battery 1 which was not connected, whereas the DJI Pilot app only displayed two separate battery levels, and battery 1 was still showing 97%.

Operators and pilots need to be made aware of the pitch attitude limit, the reduced speed limit, and at what battery levels this is triggered. Otherwise, more operators will be caught out by stronger than forecast winds. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-003

It is recommended that DJI amend the Matrice 200 series user manual to provide information on the pitch attitude limiting system, including the new maximum speed which results from the limit, and the battery level at which it triggers; and communicate this change widely to pilots and operators.

Visual line of sight rules

The VLOS regulation requires the pilot to maintain ‘continuous unaided visual contact’ with the UA which allows them to control the flight path in order to avoid collisions. To be able to take avoiding action to avoid a collision a pilot needs to know the orientation of the UA. At a certain distance the UA will appear as just a dot in the sky with no orientation information apparent. The pilot might recall which orientation it is in so can take rapid avoiding action, but if they lose track of its orientation then accurate and rapid flight path control becomes impossible. The regulation requires interpretation to establish the acceptable distance for VLOS. CAP 722 is designed to provide guidance to help pilots interpret the regulation and provide guidance on safe practices. CAP 722 states that:

‘The CAA will normally accept that the VLOS requirement is met when the UA is flown out to a distance of 500 metres horizontally from the remote pilot, but only if the aircraft can still be seen at this distance.’

It is not clear why the CAA considers 500m as a normally acceptable distance. A distance cannot be considered normally acceptable without specifying what a normal size is, which CAP 722 does not do. CAP 722 emphasises the importance of being able to avoid collisions but does not state anything about the importance of being able to recover the UA from that distance following a loss of position holding or telemetry. The smaller the apparent size of the UA in the sky the more difficult it will be to recover it manually, particularly in strong winds.

The operator had adopted a distance of 500 m for their VLOS operations in part because of the CAA’s guidance in CAP 722. The Matrice M210 was the largest UA they operated at the time, and they accepted that its orientation could not be seen at that distance – at 500m it has an apparent size of just 0.4 by 0.3 mm on a piece of paper held at normal reading distance. It is not entirely clear from the regulation or CAP 722 whether this is acceptable.

The operator now trains its pilots to manually recover their UA from 500 m under manual mode without use of telemetry which helps to mitigate the risk, but this guidance on training is not in CAP 722. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-004

It is recommended that the Civil Aviation Authority review the Visual Line of Sight distance figures in CAP 722 and amend the guidance to make it clear that just being able to see an unmanned aircraft is not sufficient for Visual Line of Sight operations and that pilots need to be able to demonstrate that at the distance they are flying, they can manoeuvre it rapidly to avoid a collision and can also land the unmanned aircraft safely following a loss of position-holding without reference to video or telemetry.

 Conclusions

The fly away accident was the result of the following main causal factors:

1. Battery 1 became disconnected shortly after takeoff which reduced the UA’s maximum pitch attitude and maximum speed.
2. The pilot did not notice that the ‘battery communication’ message included the words ‘land as soon as possible’.
3. When the wind measured by the UA exceeded the manufacturer’s wind limit the alert message to the pilot advised him to ‘fly with caution’ instead of to ‘land as soon as possible’.
4. The wind at 400 ft was stronger than forecast and at times above the UA’s restricted maximum speed so the pilot could not fly it back towards him.
5. The wind speed calculated by the UA was not displayed to the pilot on his controller app so he did not know that the wind limit had been exceeded.
6. After communication was lost, the UA entered an auto-land mode but it was unable to avoid colliding with a wall.

The following factors contributed to the accident:

1. The pilot and operator were not aware that the UA’s maximum pitch attitude and maximum speed were restricted at low battery levels as this information is not in the UAS user manual.
2. The pilot may have missed the ‘land as soon as possible’ part of the battery message because it did not stay visible for long enough. An aural alert may have helped draw the pilot’s attention to the seriousness of the message.
3. The disconnected battery was still showing a high SOC instead of showing zero or blank which would have been a clearer indication of a battery issue.
4. The pilot probably did not fully push battery 1 into place and the UA was not fitted with a battery safety clip which is a new part on the updated version of the UA.
5. The pilot’s decided to launch from a position that would require flying downwind in a wind that was close to limits.

The operator has taken steps to mitigate the risks for future flights and has retired its Matrice M210 UA and replaced them with updated Matrice 300 series UA which have a battery safety clip and display wind speed on the controller app. Three Safety Recommendations have been made to the manufacturer.

The issues identified with the guidance on VLOS in CAP 722 were not a direct factor in this accident as the UA may not have been recoverable at a closer distance; however, the guidance should be improved to help reduce the chance of other types of VLOS fly away accidents which could result in injuries to people.

UNITED STATES AIR FORCE AIRCRAFT ACCIDENT INVESTIGATION (Abridged)

On 6 August 2021, at 0727 local (L) time, an RQ-4B Global Hawk, tail number (T/N) 08-2035, impacted terrain 6.8 miles north of Grand Forks Air Force Base (GFAFB), North Dakota (ND), while conducting a local flying mission.

The mishap RPAS was flown by the 348th Reconnaissance Squadron (348 RS), a unit assigned to the 319th Operations Group, 319th Reconnaissance Wing, GFAFB, ND.

The mishap crew members were assigned to the 348 RS for flying and were all active duty United States Air Force members. The mishap did not result in any injuries. The mishap RPAS, valued at approximately $64 million, was destroyed.

On 6 August 2021, the mishap RPAS was flying a mission in a local military operating area (MOA) when the mishap mission control element (MMCE) experienced a workstation lockup, ultimately resulting in the mishap RPAS’s return to base on an autonomous, pre-programmed route. The pre-programmed route returned the mishap RPAS from the MOA to GFAFB via a descent and approach, but the mishap RPAS did not initially descend as the pre-programmed route required since the mishap mission control element pilot (MMP) failed to sever the MMCE control link with the mishap RPAS. The mishap RPAS was too high at the final approach fix (FAF) and commenced a go-around/missed approach route. Once the MMP severed the MMCE control link, and while the mishap RPAS was on the go-around/missed approach route, the mishap pilot (MP) and mishap instructor pilot (MIP) gained control of the mishap RPAS with the mishap launch and recovery element (MLRE).

Instead of commanding a new flight route to the mishap RPAS, the MP commanded an altitude override command to the mishap RPAS, which resulted in the mishap RPAS being approximately 4,000 feet too high at the FAF. The MP and MIP were not aware of the altitude deviation. At that FAF, the mishap RPAS’s go-around/missed approach route logic commenced an approach to land at GFAFB, but, because it was 4,000 feet too high, the mishap RPAS overshot and crashed into a farm field 6.8 miles north of the runway.

The Accident Investigation Board (AIB) president found, by a preponderance of the evidence, the cause of the mishap was the MP’s incorrect selection of aircraft flight commands resulting in the mishap RPAS’s controlled flight into terrain. Further, the AIB president found, by a preponderance of the evidence, the cause of the mishap was the MIP’s failure to provide sufficient inputs to the MP to prevent the mishap RPAS’s controlled flight into terrain. Additionally, the AIB president found, by a preponderance of the evidence, the MMP failed to follow established procedures, resulting in the mishap RPAS’s delayed descent and pre-programmed selection of a go-around/missed approach route, significantly contributing to the mishap. Finally, by a preponderance of the evidence, the pilot workstation lockup, including the lack of documented procedures regarding requesting numerous detailed status requests within a short timeframe, resulted in the MMP’s inability to positively control the aircraft resulting in the mishap RPAS’s execution of pre-programmed logic and return to base, significantly contributing to the mishap.”

In the published report on the accident the USAF includes a section on the Human Factor component as follows:

11. HUMAN FACTORS ANALYSIS

The Department of Defence Human Factors Analysis and Classification System 7.0 lists potential human factors that can play a role in aircraft mishaps and identifies potential areas of assessment during an accident investigation. Four human factors were identified as relevant to the mishap:

(1) procedure not followed correctly – a procedure not followed correctly is a factor when a procedure is performed incorrectly or accomplished in the wrong sequence

(2) rushed or delayed a necessary action – this is a factor when an individual takes the necessary action as dictated by the situation, but performs these actions too quickly or too slow

(3) wrong choice of action during an operation – a wrong choice of action during an operation is a factor when the individual, through faulty logic or erroneous expectations, selects the wrong course of action

(4) pressing [on] – pressing is a factor when the individual knowingly commits to a course of action that excessively presses the individual and/or their equipment beyond reasonable limits (e.g., pushing self or equipment too hard)

I was practicing some drills in the park, the aircraft was a DJI FPV. I was practicing a throttle down with forward momentum dive and climb-out drill with a treeline as the climb-out. When I was getting into position for another run of the manoeuvre my spotter reported the area around the treeline clear of people, so I started the run towards it and descending sharply from about 70m at 8-9m/s vertical speed, peaking at around 120km/h lateral speed. About 2/3 of the way through and with an estimated 50m to the treeline a dog walker was spotted walking out from the treeline by both myself and my spotter at the same time. I immediately aborted the manoeuvre and turned the aircraft right and away from the trees and started climbing. My spotter estimated an approximate closest approach to the dog walker at around 40m so on the 30m distance rule I consider the abortion of the manoeuvre a success with a decent margin from the minimum approach distance.

The dog walker then walked across the area of the park and came within 2m of the landing area, moving at a very slow pace, which was clearly marked with a pad and with myself and my spotter there was clearly the landing area. This was late in the flight, and I was needing to come in to land, as this happened on what was intended to be the last run of the flight.  I’d declared the intention to land to my spotter who declared the landing area was unavailable. I kept the aircraft at altitude and with an eye on the landing area as we watched to see whether the landing area would become available.

When the battery dropped to 20% on the OSD I asked my spotter whether the backup landing area was available – he said it was, so I started turning towards it. At this point my spotter then said the dog walker had sped up and the main landing area was imminently about to become available, so I turned back towards it and landed, this was still with 30m separation including during landing because of the speed she’d gone up to which looked like a jog (maybe she’d heard what we were saying? Can’t know). The aircraft was landed with 16% battery on the OSD.

Lessons learned:

1. Improved spotter briefing for broader ground concerns (esp. uninvolved people) prior to drill manoeuvres, including direction of movement towards manoeuvre area.
2. Consideration of a “bingo battery” state of use of the backup landing site. This will vary by flying site and aircraft due to endurance and distance between landing site concerns.

Excessive vibration during flight led to loss of attitude awareness and control of quadcopter resulting in an uncontrolled flyaway. Failsafes relied on having attitude control. Drone ended up doing an uncontrolled descent. Further testing needed on airframe vibrations.

Aircraft suddenly went into an end over end violent roll 100M/ 200m from flight line at approximately 150ft. Battery ejected from aircraft and went through member’s car bumper. Calm and clear sky. I believe the hatch popped open acting as a sudden air brake sending the aircraft end over end sling-shotting the battery.