Know your drone

Rupert Dent

Drone/UAS Programme Manager

Initial Report

Synopsis

The quadcopter unmanned aircraft (UA) was being flown over the city of Poole during a police operation when the wind at 400 ft exceeded the forecast wind, the manufacturer’s wind limit and the maximum restricted speed of the UA. The UA drifted beyond visual line of sight and then communication with it was lost. When the battery level was low it entered an auto-land mode but collided with the wall of a house, damaging its propeller blades before coming to rest on a balcony.

The investigation revealed that shortly after take-off one of the UA’s two batteries had disconnected which resulted in its maximum speed being restricted, but this restriction is not referenced in the user manual and neither the remote pilot nor operator were aware of it. When the UA detected that the manufacturer’s wind limit had been exceeded, the message triggered on the pilot’s controller display was ‘Fly with caution, strong wind’ instead of advising the pilot that the limit had been exceeded and that the UA should be landed as soon as possible. Three Safety Recommendations are made to the UAS manufacturer and one to the CAA on Visual Line of Sight guidance.

History of the flight (abridged)

The remote pilot was working with an observer who had a slave controller. At 1108hrs the remote pilot obtained a wind forecast at 400ft of 24mph from the north-west using a UAS weather forecast app. At 1117hrs, a flight towards the south-west was carried out with no issues. The two batteries were replaced and then at 1145hrs the UA took off again. Standard control checks were carried out at a height of 10m before climbing to 120m (400ft) and flying south-east towards a target location that was 500m away.

The remote pilot reported that he maintained a good visual sight of the UA and referred to his controller for flight and aircraft information. He then noticed two messages on the controller screen: one stating ‘Battery communication error’ and then another stating ‘Fly with caution, strong wind’. He noted that one of the batteries was showing 97% state of charge (SOC) while the other battery SOC was decreasing faster than normal. The pilot tried to fly the aircraft back towards him, but it did not appear to be moving any closer. He then noted that one battery was showing 58% SOC while the other was still showing 97% The pilot used the map function to check the aircraft’s orientation and confirmed it was correct, but it was still not returning. The aircraft’s distance from the pilot began to increase beyond 500m which is not normally possible because the maximum flight distance from the remote pilot had been set to 500m using the DJI Pilot app.

The pilot was now very concerned and activated the ‘Return to home (RTH)’ feature on the controller, but it did not appear to engage despite being operated multiple times. RTH then appeared to activate but the aircraft did not move any closer. The pilot then switched to ‘Sport Mode’ as per their emergency procedure which he expected would give him a top speed of 51mph, allowing a greater ability to overcome the headwind. This cancelled the RTH feature so he pressed RTH again, but it would not re-engage. The remote pilot asked the observer to try engaging it using his slave controller, but this did not work either. At this stage neither the pilot nor the observer could see the aircraft, but they could see it on the moving map heading slowly towards Poole Park boating lake in a south-easterly direction. Both controllers then lost communication with the aircraft.

The pilot and observer packed their kit and drove to the last location of the aircraft shown on the map display. When they arrived in the area of the last position, the controllers regained communication with the aircraft and displayed its GPS coordinates. They found the aircraft on a first-floor balcony of a house. The aircraft’s right leg had snapped at the mounting bracket, three propeller blades had shattered, and one propeller had detached but was located next to the aircraft.

Analysis

Cause of the fly away accident

The fly-away event was caused by a number of factors. Battery 1 became disconnected shortly after takeoff which resulted in the UA being powered by Battery 2 alone. The cause of the battery disconnection could not be determined, but the battery functioned normally when fitted to another UA so it is probable that it was not fully pushed into place before takeoff.

The battery disconnection meant that the UA sensed a large drop in total battery capacity which triggered a restriction in its pitch limit and therefore its top speed. From the data the pitch limit appeared to be about 15°.

The wind at 400ft increased beyond the 24mph speed forecast by the pilot’s UAS weather forecast app. The wind reached a calculated peak of 39mph, but varied mainly between 25mph and 35mph. The UA’s top speed in P-mode was either 35.8 or 38mph. If it had been able to achieve 38mph then it would not have drifted away in the wind. Even at a top speed of 35.8mph there were periods when it would have made progress back towards the home point. However, with the restricted pitch attitude that was about 10° less than normal, this was not possible. The pilot’s attempt to use S-mode as per the operator’s emergency procedure did not allow an increase in speed as the restricted pitch limit also applied in S-mode.

The UA drifted beyond visual line of sight and communication was lost which meant that a recovery was no longer possible. The UA could not auto-return-home due to the wind. When the battery 2 level dropped to 23% the UA entered an auto-land mode but was unable to avoid the wall of a house resulting in damage to the propeller blades and a subsequent impact with the balcony. If the balcony had been occupied, people could have been seriously injured by the propeller blades.

The following were contributory factors to the accident:

Awareness of the wind speed

The wind at 400ft cannot be directly measured so the pilot was reliant on a wind forecast. The forecast was for a wind 3mph below their operational limit and the manufacturer’s limit. The pilot believed that S-mode would give him a top speed of 51mph, so he may have considered that he had a significant safety margin if the wind increased beyond the forecast. But with both camera gimbals fitted the speed limit was 40.3mph. However, this was still higher than the peak wind of 39 mph so recovery would still have been possible. The pilot also believed that he would receive a wind warning that would tell him to land if the wind increased excessively. He reasonably interpreted the ‘High Wind Velocity. Fly with caution’ message to mean that he could continue the flight. The user manual does not provide any information on the alert messages that can appear, or the appropriate actions to take.

The manufacturer appears to have used the same message for both a Level 1 and a Level 2 wind warning, causing confusion to the remote pilot on the action to take. The manufacturer had set a wind limit of 27mph, and therefore the Level 2 wind warning should have advised the pilot to land as soon as possible. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-001

It is recommended that DJI amend the DJI Pilot and DJI GO4 apps to warn the remote pilot when the wind limit has been exceeded and that the UA should be landed as soon as possible.

The pilot is required to maintain visual line of sight with the UA and therefore could miss an alert message on the controller screen if they are concentrating on manoeuvring the UA visually. If messages related to safety of flight had an associated aural warning the pilot’s attention could be drawn to them. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-002

It is recommended that DJI amend the DJI Pilot and DJI GO4 apps so that an aural alert is triggered when alert messages relating to safety of flight appear.

The pilot’s awareness of the wind would also be improved if the controlling apps displayed the wind speed that is calculated by the UA. This is a feature on the newer Matrice 300 series UAS.

Awareness of the pitch attitude restriction

Neither the operator nor the pilot was aware that below a certain total battery SOC, the aircraft’s pitch attitude is restricted to about 15°, 10° less than normal, and 15° less than in S-mode; and that this results in a lower top speed. These facts are not mentioned in the UAS user manual or on the manufacturer’s website. The limit is also triggered at a total battery capacity level which is not displayed to the pilot. The total battery capacity figure had logic to ignore the capacity of battery 1 which was not connected, whereas the DJI Pilot app only displayed two separate battery levels, and battery 1 was still showing 97%.

Operators and pilots need to be made aware of the pitch attitude limit, the reduced speed limit, and at what battery levels this is triggered. Otherwise, more operators will be caught out by stronger than forecast winds. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-003

It is recommended that DJI amend the Matrice 200 series user manual to provide information on the pitch attitude limiting system, including the new maximum speed which results from the limit, and the battery level at which it triggers; and communicate this change widely to pilots and operators.

Visual line of sight rules

The VLOS regulation requires the pilot to maintain ‘continuous unaided visual contact’ with the UA which allows them to control the flight path in order to avoid collisions. To be able to take avoiding action to avoid a collision a pilot needs to know the orientation of the UA. At a certain distance the UA will appear as just a dot in the sky with no orientation information apparent. The pilot might recall which orientation it is in so can take rapid avoiding action, but if they lose track of its orientation then accurate and rapid flight path control becomes impossible. The regulation requires interpretation to establish the acceptable distance for VLOS. CAP 722 is designed to provide guidance to help pilots interpret the regulation and provide guidance on safe practices. CAP 722 states that:

‘The CAA will normally accept that the VLOS requirement is met when the UA is flown out to a distance of 500 metres horizontally from the remote pilot, but only if the aircraft can still be seen at this distance.’

It is not clear why the CAA considers 500m as a normally acceptable distance. A distance cannot be considered normally acceptable without specifying what a normal size is, which CAP 722 does not do. CAP 722 emphasises the importance of being able to avoid collisions but does not state anything about the importance of being able to recover the UA from that distance following a loss of position holding or telemetry. The smaller the apparent size of the UA in the sky the more difficult it will be to recover it manually, particularly in strong winds.

The operator had adopted a distance of 500 m for their VLOS operations in part because of the CAA’s guidance in CAP 722. The Matrice M210 was the largest UA they operated at the time, and they accepted that its orientation could not be seen at that distance – at 500m it has an apparent size of just 0.4 by 0.3 mm on a piece of paper held at normal reading distance. It is not entirely clear from the regulation or CAP 722 whether this is acceptable.

The operator now trains its pilots to manually recover their UA from 500 m under manual mode without use of telemetry which helps to mitigate the risk, but this guidance on training is not in CAP 722. Therefore, the AAIB makes the following Safety Recommendation:

Safety Recommendation 2022-004

It is recommended that the Civil Aviation Authority review the Visual Line of Sight distance figures in CAP 722 and amend the guidance to make it clear that just being able to see an unmanned aircraft is not sufficient for Visual Line of Sight operations and that pilots need to be able to demonstrate that at the distance they are flying, they can manoeuvre it rapidly to avoid a collision and can also land the unmanned aircraft safely following a loss of position-holding without reference to video or telemetry.

Conclusions

The fly away accident was the result of the following main causal factors:

Battery 1 became disconnected shortly after takeoff which reduced the UA’s maximum pitch attitude and maximum speed.
The pilot did not notice that the ‘battery communication’ message included the words ‘land as soon as possible’.
When the wind measured by the UA exceeded the manufacturer’s wind limit the alert message to the pilot advised him to ‘fly with caution’ instead of to ‘land as soon as possible’.
The wind at 400 ft was stronger than forecast and at times above the UA’s restricted maximum speed so the pilot could not fly it back towards him.
The wind speed calculated by the UA was not displayed to the pilot on his controller app so he did not know that the wind limit had been exceeded.
After communication was lost, the UA entered an auto-land mode but it was unable to avoid colliding with a wall.

The following factors contributed to the accident:

The pilot and operator were not aware that the UA’s maximum pitch attitude and maximum speed were restricted at low battery levels as this information is not in the UAS user manual.
The pilot may have missed the ‘land as soon as possible’ part of the battery message because it did not stay visible for long enough. An aural alert may have helped draw the pilot’s attention to the seriousness of the message.
The disconnected battery was still showing a high SOC instead of showing zero or blank which would have been a clearer indication of a battery issue.
The pilot probably did not fully push battery 1 into place and the UA was not fitted with a battery safety clip which is a new part on the updated version of the UA.
The pilot’s decided to launch from a position that would require flying downwind in a wind that was close to limits.

The operator has taken steps to mitigate the risks for future flights and has retired its Matrice M210 UA and replaced them with updated Matrice 300 series UA which have a battery safety clip and display wind speed on the controller app. Three Safety Recommendations have been made to the manufacturer.

The issues identified with the guidance on VLOS in CAP 722 were not a direct factor in this accident as the UA may not have been recoverable at a closer distance; however, the guidance should be improved to help reduce the chance of other types of VLOS fly away accidents which could result in injuries to people.

CHIRP Comment

We thought it well worthwhile reprinting a significant part of the AAIB’s report, because it is a good example of two aspects of aviation that the drone sector experiences today. They are:

Do manufacturers disclose enough detail in their user manuals about how the control logic is configured? This occurrence was partly the result of a lack of a clear explanation of the control logic, combined with the pilot inevitably not having a detailed understanding of how it is set up.
Human factors in the set up and pre-flight checks. If the batteries had been installed properly in the first instance, it would not have led to the sequence that caused the aircraft to be damaged during an auto land.
The batteries on the first version of the M210 would normally have “clicked” into place. Not hearing a click meant the battery was not secured properly.

For those interested in reading the entire report, we have added a link here:

AAIB investigation to DJI Matrice M210 Version 1 (UAS, registration n/a) – GOV.UK (www.gov.uk)

Initial Report

UNITED STATES AIR FORCE AIRCRAFT ACCIDENT INVESTIGATION (Abridged)

On 6 August 2021, at 0727 local (L) time, an RQ-4B Global Hawk, tail number (T/N) 08-2035, impacted terrain 6.8 miles north of Grand Forks Air Force Base (GFAFB), North Dakota (ND), while conducting a local flying mission.

The mishap RPAS was flown by the 348th Reconnaissance Squadron (348 RS), a unit assigned to the 319th Operations Group, 319th Reconnaissance Wing, GFAFB, ND.

The mishap crew members were assigned to the 348 RS for flying and were all active duty United States Air Force members. The mishap did not result in any injuries. The mishap RPAS, valued at approximately $64 million, was destroyed.

On 6 August 2021, the mishap RPAS was flying a mission in a local military operating area (MOA) when the mishap mission control element (MMCE) experienced a workstation lockup, ultimately resulting in the mishap RPAS’s return to base on an autonomous, pre-programmed route. The pre-programmed route returned the mishap RPAS from the MOA to GFAFB via a descent and approach, but the mishap RPAS did not initially descend as the pre-programmed route required since the mishap mission control element pilot (MMP) failed to sever the MMCE control link with the mishap RPAS. The mishap RPAS was too high at the final approach fix (FAF) and commenced a go-around/missed approach route. Once the MMP severed the MMCE control link, and while the mishap RPAS was on the go-around/missed approach route, the mishap pilot (MP) and mishap instructor pilot (MIP) gained control of the mishap RPAS with the mishap launch and recovery element (MLRE).

Instead of commanding a new flight route to the mishap RPAS, the MP commanded an altitude override command to the mishap RPAS, which resulted in the mishap RPAS being approximately 4,000 feet too high at the FAF. The MP and MIP were not aware of the altitude deviation. At that FAF, the mishap RPAS’s go-around/missed approach route logic commenced an approach to land at GFAFB, but, because it was 4,000 feet too high, the mishap RPAS overshot and crashed into a farm field 6.8 miles north of the runway.

The Accident Investigation Board (AIB) president found, by a preponderance of the evidence, the cause of the mishap was the MP’s incorrect selection of aircraft flight commands resulting in the mishap RPAS’s controlled flight into terrain. Further, the AIB president found, by a preponderance of the evidence, the cause of the mishap was the MIP’s failure to provide sufficient inputs to the MP to prevent the mishap RPAS’s controlled flight into terrain. Additionally, the AIB president found, by a preponderance of the evidence, the MMP failed to follow established procedures, resulting in the mishap RPAS’s delayed descent and pre-programmed selection of a go-around/missed approach route, significantly contributing to the mishap. Finally, by a preponderance of the evidence, the pilot workstation lockup, including the lack of documented procedures regarding requesting numerous detailed status requests within a short timeframe, resulted in the MMP’s inability to positively control the aircraft resulting in the mishap RPAS’s execution of pre-programmed logic and return to base, significantly contributing to the mishap.”

In the published report on the accident the USAF includes a section on the Human Factor component as follows:

HUMAN FACTORS ANALYSIS

The Department of Defence Human Factors Analysis and Classification System 7.0 lists potential human factors that can play a role in aircraft mishaps and identifies potential areas of assessment during an accident investigation. Four human factors were identified as relevant to the mishap:

(1) procedure not followed correctly – a procedure not followed correctly is a factor when a procedure is performed incorrectly or accomplished in the wrong sequence

(2) rushed or delayed a necessary action – this is a factor when an individual takes the necessary action as dictated by the situation, but performs these actions too quickly or too slow

(3) wrong choice of action during an operation – a wrong choice of action during an operation is a factor when the individual, through faulty logic or erroneous expectations, selects the wrong course of action

(4) pressing [on] – pressing is a factor when the individual knowingly commits to a course of action that excessively presses the individual and/or their equipment beyond reasonable limits (e.g., pushing self or equipment too hard)

CHIRP Comment

There is a surprising sequence of errors that lead up to this accident. From our perspective one of the main points here though is that by not understanding the control logic, the pilots were very quickly behind the aircraft in its execution of its pre-programmed logic and became further and further away from it as time progressed. The Human Factors element is well summarised by the US Accident Investigation Board, and it is clear it had a role to play. If the very high level of training undertaken by the US military still leads to humans making these sorts of errors, it sets the scene for how the logic execution sequence training objectives for the future civilian BVLOS operations world need to be at a very high level.

The other aspect that is worth noting is that situational awareness was lost early in the sequence and never really re-established. Once the aircraft was 4,000ft too high at the initial final approach fix, it remained too high. This would perhaps have been less likely to have happened if the pilot had been on board the aircraft.

Initial Report

I was practicing some drills in the park, the aircraft was a DJI FPV. I was practicing a throttle down with forward momentum dive and climb-out drill with a treeline as the climb-out. When I was getting into position for another run of the manoeuvre my spotter reported the area around the treeline clear of people, so I started the run towards it and descending sharply from about 70m at 8-9m/s vertical speed, peaking at around 120km/h lateral speed. About 2/3 of the way through and with an estimated 50m to the treeline a dog walker was spotted walking out from the treeline by both myself and my spotter at the same time. I immediately aborted the manoeuvre and turned the aircraft right and away from the trees and started climbing. My spotter estimated an approximate closest approach to the dog walker at around 40m so on the 30m distance rule I consider the abortion of the manoeuvre a success with a decent margin from the minimum approach distance.

The dog walker then walked across the area of the park and came within 2m of the landing area, moving at a very slow pace, which was clearly marked with a pad and with myself and my spotter there was clearly the landing area. This was late in the flight, and I was needing to come in to land, as this happened on what was intended to be the last run of the flight. I’d declared the intention to land to my spotter who declared the landing area was unavailable. I kept the aircraft at altitude and with an eye on the landing area as we watched to see whether the landing area would become available.

When the battery dropped to 20% on the OSD I asked my spotter whether the backup landing area was available – he said it was, so I started turning towards it. At this point my spotter then said the dog walker had sped up and the main landing area was imminently about to become available, so I turned back towards it and landed, this was still with 30m separation including during landing because of the speed she’d gone up to which looked like a jog (maybe she’d heard what we were saying? Can’t know). The aircraft was landed with 16% battery on the OSD.

Lessons learned:

Improved spotter briefing for broader ground concerns (esp. uninvolved people) prior to drill manoeuvres, including direction of movement towards manoeuvre area.
Consideration of a “bingo battery” state of use of the backup landing site. This will vary by flying site and aircraft due to endurance and distance between landing site concerns.

CHIRP Comment

There is some excellent stuff in this report. Firstly, the pilot and spotter have set themselves up well for the drills they had planned. A spotter has been included from the outset, they had a backup landing area figured out and had completed a comprehensive FPV UK Remote Pilot Risk Assessment Form, as required by Article 16 of FPV UK’s Operational Authorisation.

In terms of preparation, the flight was logged with Drone Assist, the risk assessment included mitigations for dealing with the encroachment of uninvolved people and any approaching aircraft, marking out the landing site with a pad and agreeing on a backup landing site.

Finally, they have then reported the occurrence to FPV UK and CHIRP so others can learn from their experience. In addition to this, they have reviewed the recording of the flight and then considered and gone over the sequence of events and the learning points, which they have shared.

So, the two learnings they have concluded for themselves look good to us. We would add some further thoughts as follows:

In the flight planning phase, it would be worthwhile aiming to land with a higher % battery level, whilst taking into account a period of loitering and the use of the alternate landing site. This might mean starting to head for home when the battery level is indicated as being 30%, in order to be on the ground by 25% but with something in reserve if you have to loiter for a few minutes.
Choosing a location that is a little less crowded, taking into account the fact that more people are going to be outside walking as the weather improves and it is spring or summer.
Maybe putting up a sign that indicates to uninvolved people that they are in a “Drone flying / landing area” which will give them a nudge to look around them and perhaps not approach so closely.
Whilst the swift reaction time of the pilot enabled him to keep the aircraft within the proximity requirements of the OA, when choosing a manoeuvre that involves flying at high speed, it would be worthwhile including reaction time and stopping distance when choosing how close you can get to something you cannot see through, before turning or climbing away. Whilst a treeline is static, it is difficult to see through and the possibility of someone walking or even running through it to suddenly emerge as an object moving towards you, is always going to be there.
This occurrence shows how important the choice of a good landing area can be.
Firm decision making is sometimes better than changing one’s mind several times. The latter may end up creating additional risks, originally unforeseen, that complicates circumstances further. Sometimes people use the acronym BRAN when making a decision: what are the Benefits, what are the Risks, what are the Alternatives, what if I do Nothing

CHIRP Comment

This is a short and sweet report from a reporter who is probably flying a home build Drone. What is good about it, is that the reporter has drawn their own conclusions on what the problem was and what to do about it. They have learnt from their own analysis and taken the trouble to share it, however brief it may be.

Additional thoughts are:

a) there is no reference to a set of protocols that have been created for the purpose of doing test flights, or of an observer being present. CHIRP would recommend that both of these actions should be considered before testing any aircraft, whatever the size;
b) we would recommend including in the protocols, choosing a location that is far away from people, so the consequences of a loss of control does not result in any injury.

Initial Report

Aircraft suddenly went into an end over end violent roll 100M/ 200m from flight line at approximately 150ft. Battery ejected from aircraft and went through member’s car bumper. Calm and clear sky. I believe the hatch popped open acting as a sudden air brake sending the aircraft end over end sling-shotting the battery.

CHIRP Comment

This report is short and sweet but useful. Not securing the hatch seems to be the pilot’s own analysis of the cause of the accident. This is the crewed aviation equivalent of the “hatches and harnesses” moment in pre-take-off checks. Making sure the batteries were secure was the Human Factor element, which in fact led to a design modification on the later version of the aircraft. It is also important to add that in the design there should always be a way of securing any battery, irrespective of whether the hatch is securely fastened.

Rupert Dent

Drone/UAS Programme Manager

DUASxxx1

Initial Report

CHIRP Comment

DUASxxx2

Initial Report

CHIRP Comment

DUAS13

Initial Report

CHIRP Comment

DUAS14

Initial Report

CHIRP Comment

DUASxxx3

Initial Report

CHIRP Comment