Confidential Human Factors

Incident Reporting Programme

Submit Report

The Charity

Aviation

Maritime

The Charity

Aviation

Maritime

Submit Report

FEEDBACK

DUASFB 7

The Human Factors

It’s all about the mental and physical capabilities, limitations and actions that relate to how we interface and perform in the environment safely, comfortably and effectively – or not…

Welcome to Drone FEEDBACK Edition 7. This is our first newsletter of 2023 and there are some very instructive Human Factors and Just Culture occurrences in this Edition. Amongst others, they include an Emergency Services Drone colliding with a Cessna 172 aircraft on final approach to an aerodrome, a 28kg Drone filming at the Henley Regatta that ran out of fuel (battery), dropped vertically and narrowly missed passengers sitting on a boat. The common link? Human Factors.

Published just before the Christmas and New Year period, we were delighted to see that in the latest issue of CAP 722, Edition 9.1 (as well as the AMC and GM issued on 7th December), the availability and purpose of CHIRP is set out in legislative material. As many of you will know, we have been anticipating these documents for a while, so it was an excellent year- end bonus to see them in print! We very much hope that this will encourage voluntary reporting of Human Factor and Just Culture occurrences from the world of Drone Operations.

Finally, we wanted to include an end of season element to this issue. Although Winter is receding behind us, there are some common Winter Operations themes that pilots might still want to bear in mind as we transition towards Spring. They include:

    1. The performance of your batteries is likely to reduce as outside air temperatures decline. Older batteries are likely to experience a larger decline in performance.
    2. Even light precipitation may freeze on your propellers. This adds weight and will reduce their aerodynamic performance.
    3. Cold hands and fingers may reduce dexterity. Gloves may do the same!
    4. Snow can confuse those Drones that use sonar sensors as an altitude input. Consider turning them off, so the aircraft is just using a barometric input to calculate its altitude, if you are flying over a layer of snow.
    5. If your Drone usage has reduced during the winter, don’t forget to check for software updates whilst you have an internet connection and before your next flight.

As in previous editions, we would again like to thank those who have taken time to send in a report. Without you, others would have missed out on learning something. We are very grateful to those that have altruistically shared the benefit of their experience.

With Spring ahead of us and a return to warmer weather, less fog and more suitable weather for flying, there is undoubtedly some optimism in the air! Safe flying.

Rupert Dent, Drone/UAS Programme Manager

  • DUAS16

    –

    Unintended deployment of Flight Termination System
    Unintended deployment of Flight Termination System

    Initial Report

    The aircraft was undergoing test flights – the pilot in charge was inexperienced and had only recently been promoted to test pilot. The FTS (Flight Termination System) deployed with no warning and there was no immediate reason for this.

    Following the initial report to CHIRP there was some further communication which is re-printed below in its entirety, so the context can be better understood.

    CHIRP email to reporter:

    Firstly, many thanks for your report, which CHIRP is pleased to accept. In order to learn from it, I wondered if you would be kind enough to give us a little more detail on what happened?

    1. You state that the parachute deployed without warning. This implies that there was a technical problem and human error was not involved. Were there in your opinion any human factors involved in the occurrence or was it entirely technical? Perhaps you would be able to give me your view on this aspect?
    2. You have mentioned that the pilot was inexperienced. However, from the submitted report, the pilot has 300 hours of flying, which for small UAVs is relatively experienced. Given that this was a test flight and only the second flight of the XXX I take it that you mean inexperienced on type or on flight testing. Perhaps you could just confirm this aspect?
    3. Were there in your view any lessons to be learnt regarding the training available, or explanation of how the aircraft works, prior to undertaking the test flights?
    4. Are there any other aspects connected with the occurrence that would be useful to learn from and that involved Human Factors or a Just Culture?

    Response email from the reporter:

    Thanks for the reply, I’ve answered your points below:

    1. Human factors were not involved in this occurrence, the system initiated entirely uncommanded by any team/crew member.
    2. I may not have explained that correctly. I have around 300 hours of UAS flying, but I was not pilot in command. In fact, I had essentially refused to fly the aircraft due to safety concerns. The newly-promoted test pilot was one of the engineer team and had a small number of hours of UAS flying. As you surmised, there is nobody with any experience on type as this was the second flight.
    3. The test program was being rushed and undue pressure to perform was being placed on the whole team due to commercial considerations. The team was very often having very early starts before spending large amounts of ‘down’ time at the airfield due to weather being out of limits for the aircraft, generally in line with weather forecasts.

    These are mainly my opinions and I have not been party to the full internal investigation as I no longer work for the company. I am still amazed that the company has never been audited by the CAA (terrible accident rate in the 6 months prior to this event) and that AAIB did not pick up this issue, despite all occurrences being reported through the correct channels. There had been a significant deterioration in safety culture as was highlighted during an independent audit, but I believe that the findings were never escalated to the Senior team and therefore not acted upon in a timely manner.

    CHIRP Comment

    We did of course discuss the report with the responsible manager of the company involved and established that the matter was investigated, and a full report was submitted to the company’s Safety Review Board, which was chaired by the CEO. We also understand that the aircraft was grounded for 8 weeks whilst corrective actions were considered, which included a design change that added 2 buttons with covers that were required to be lifted, before the deployment of the FTS could be triggered.

    In answer to one of the reporter’s points, we have checked with the AAIB, and have determined that if they see a recurrence of accidents from a particular Operator, they do in fact have the ability to recommend auditing by CAA, if they are of the view it would be beneficial.

    The reporter was concerned enough about the situation to file a report and, after a little encouragement, give some additional details about what they felt was not being dealt with correctly. We have been able to alert the company to the concerns, sought and received reassurance on several matters and have also been able to discuss some of the points raised with the AAIB.

    There is one item that we would not agree with the reporter on and that is there were no Human Factors at play. The fact that the FTS was triggered inadvertently may have been because Human Factors were not adequately considered in the design stage. Indeed, it seems from the company’s corrective actions that they thought it might have had something to do with it. Adding two covers to the buttons used to deploy the system will no doubt have reduced the chance of the same event occurring again.

    Another point that we feel is worth mentioning is that the test airfield was about 30 minutes’ drive from the manufacturing site and office. Given the equipment that needed to be transferred from one place to another, the distance probably led to a tendency to go to the test site and spend all day there, waiting for any unsuitable weather to pass. This may have led to a lack of clarity on when a pilot was on duty or on a rest period, with fatigue becoming an issue.

    Last but not least, it may have been unwise to have gone ahead with the flight if the more experienced pilot had, as indicated in the report, refused to do so. Peer and Commercial pressure may have had some influence here.

  • DUAS18

    –

    Battery installation failure
    Battery installation failure

    Initial Report

    The flight crew were wearing gloves to install batteries into a Mavic 2 Enterprise Advanced. The battery powered-on the UA but when it came to take off, an error was displayed stating that the battery was not inserted correctly. The flight was cancelled. Upon visual inspection, the battery looked as if it was installed correctly, but when it was firmly depressed, 2 audible clicks were heard, and the battery was then secure. It was about 1°C and the flight crew were wearing gloves that would have meant loss of dexterity.

    Lessons Learned:

    Be aware that wearing gloves will mean that the sense of touch will be less sensitive than normal. This could lead to perception being misled, i.e. the perception that the battery has been installed correctly, when in fact, it has not. The safety of the system was robust enough to give a warning to the Remote Pilot and safety was not compromised at any time. Internal procedural changes to the pre-flight checks are deemed sufficient to prevent a repeat occurrence. An Internal Safety Notice was created to inform all Remote Pilots of the failure.

    Procedural changes:

    The following improvements are to be made to the pre-flight checklists every time a battery is installed onto a Mavic:

    1. Install battery onto the UA. Ensure a click is heard as the battery clips into place. Note that more than a single click may be heard.
    2. Try to remove the battery without pressing the battery release tags.
    3. Repeat the above procedure or cross check with another remote pilot if you are unsure.
    4. Check for warnings on the controller before launch. If a warning is seen, cancel the flight and rectify.

    Figure 1 – Battery not clicked into place (note gap)

    Figure 2 – Battery securely clicked into place (gap reduced)

     

    CHIRP Comment

    This was a well caught and handled incident, that may well have had consequences if it had been any different. If a battery is not properly fitted into the aircraft and contact between the battery and airframe is lost, even momentarily, the motors will stop and the aircraft will descend vertically to the ground. We would recommend:

    • For this model of RPAS, hearing the double click and feeling for the potential gap (with gloves removed), is essential!
    • If you are operating in low temperatures, always be aware of the operating temperature range. In the case of a Mavic 2 it is -100 to + 400 C
    • The Manufacturer or Operator might consider applying witness lines, which would make it easier to visually identify an incorrectly seated battery.
    • It is worth noting that just because the Mavic 2 is thought of as being easy to deploy, it does not mean the pilot can ignore pre-flight checks. Easy to do in haste, but this may lead to repenting at leisure.

  • DUAS19

    –

    Spatial awareness
    Spatial awareness

    Initial Report

    Whilst on a training flight in the approved area of the sports field within [University] grounds, contact was made with the left (northern) rugby post as viewed from the take-off/landing zone. The collision took place approximately 7m above ground and was due to pilot error in estimating the proximity to the rugby post by way of depth perception.  The intention was to pass behind both rugby posts; this was successful with the right-hand post but not the left, the aircraft must have been angled slightly towards the pilot.

    Following the collision, the drone fell directly to the floor and the battery came out. One of the front arms had folded in, I believe it was the right one when viewed from above. The drone was then returned to the TLZ and examined and there appeared to be no apparent damage other than a scuff and some white marks which may have been line paint.

    The battery was replaced, and the drone turned on.  No error messages were received so take-off was initiated. All controls were then checked within the TLZ and, once it was established these were as normal, the drone was flown a distance away and the RTH checked. This worked as expected. Following this, the drone was flown for another 10 minutes without any cause for concern or any apparent issues with controls of operation.

    Lessons learned:

    • Updating of Risk Assessment about obstacles
    • Annual Recurrent training to focus on Spatial Awareness
    • Review of operational UAS – Parrot Anafi use
    • Updating Operations Manual for Role of Visual Observer
    • Review recency requirements

     

    CHIRP Comment

    In addition to the actions listed in “Lessons learned” above, all of which are very good, along with the checks performed prior to flying the unit again, we would have looked carefully at all of the data that almost all Drones record on each flight, and which will often indicate if there are any system or hardware faults. Various Apps are available that a pilot can sign up to, which after synchronising with the Drone will show multiple recorded parameters similar to a ‘black box’ Flight recorder used in crewed aviation. This enables pilots to check if there have been any faults or damage incurred following the accident. Whilst we understand the Anafi may not give the pilot the ability to look at CSV files, many other Drones do.

    Developing Spatial Awareness is an important part of flying drones, not least because they are relatively small and can easily merge into the background; practicing flights at a distance is important. Contemporary drones are often equipped with sensors that show your distance from an object in 6 directions or on 3 planes. We would recommend using a drone that is equipped in this way, for the purpose of undertaking practice flights.

    We have done this ourselves on many occasions and rugby posts are usually large enough to be detected by onboard sensors without too much problem. If you are going to use rugby posts for depth perception practice, it may be safer to try and align the drone 5 metres above the post, rather than attempting to fly it as near as the pilot can to the post.

  • DUAS20

    –

    Damaged propellor after landing
    Damaged propellor after landing

    Initial Report

    Narrative of events:

    • Synopsis: Training night flight re-familiarising with procedures and thermal imagery.
    • Particulars of the UAS involved, including firmware and software version number: Mavic Enterprise Advanced, V01.00.0520, SDK App 4.12.0
    • Crew composition and experience: Pilot, 91hr25min. Hours in past 30 days until accident: 1hr11 (4 flights prior plus accident flight).
    • Site information: Flat field, landing pad used, landing area lit with torch.
    • Meteorological information: Light winds, clear skies, 1ÂșC
    • Communication and satellite coverage / information: Good satellite coverage, lowest 15
    • Pilot previous 24 hours: Good night’s sleep previous night, full day of work (computer based). Hydrated and fed.
    • Sortie details and preparation: very basic profile running through all procedures at night and basic camera manipulation and night thermal camera search practice.
    • Sortie execution up to the accident point – full flight completed with no issues, weather good.
    • Accident events: On landing, fractionally not centred on the landing pad. As the aircraft touched down the front left propeller struck a protruding landing pad peg causing the tip of the blade to break.
    • Post-accident events: The aircraft was shut down and made safe. A photo was taken of the damaged propeller and then the propeller removed from the aircraft. A full visual inspection of the drone was completed (no other damage) and a new propeller blade fitted. The pegs were removed from the landing pad and re-fitted at a much shallower angle and pushed until flush with the surface. A subsequent flight was completed, following control checks (as per checklist) proving the new propeller before flying any distance.
    • Damage: Injuries to persons – Nil.
    • Damage to the UAS and impact information – Damage to one propeller set. Propeller removed from service.
    • Additional information: Organisational and Management Information – Aircraft’s 6th flight.

    CHIRP Comment

    On landing, in the final moments between the hover and the final descent, it is quite possible to move one of the sticks very fractionally in one direction or another. In addition a small gust of wind can also cause a small amount of drift from the centre of the target landing site. We at CHIRP are not huge fans of the very light-weight orange circular target-like landing pads that require tent pegs to hold them down. Whilst they do have the benefit of being visible, if they are on grass they don’t really compress it enough and so landing a Mavic on it will often mean the rear two propellers will come into contact with the fabric of the target.

    A colourful carpet tile that is heavy enough to end up flat, stop the Drone from sliding and doesn’t require any form of tie downs, has been what we have used in the past. It is also easy to store and takes very little space. Last but not least, landing pads are now available with integrated weights, which removes the requirement for ground pegs, and some RAEs have now switched to these because of the hazard posed by the pegs.

  • DUASxxx8

    –

    RPAS ran out of power
    RPAS ran out of power

    Initial Report

    From AAIB Bulletin 1/2023 (AAIB-28421). 

    Commander’s Flying Experience: 831 hours (of which 18 were on type); Last 90 days – 73 hours; Last 28 days – 28 hours

     The UAS, a Freefly Systems Inc Alta X, was being operated commercially to provide video footage at the Henley Royal Regatta when a low voltage battery warning occurred in flight at a height of 50m. As the aircraft was being flown back to the landing site, the aircraft battery voltage reduced to the point where controlled flight was lost. It fell, in near free-fall, and impacted a boat on the river, causing damage. No persons were injured. The pilot could not recall checking the aircraft’s battery voltage prior to take-off, and the low voltage battery warning had been changed to trigger at a lower level than that recommended by the manufacturer.

    Image from the aircraft, with the Celtic Queen travelling down-river

    The risk assessment performed by the operator had identified that a loss of battery power in flight could result in a ‘catastrophic’ outcome and was classified as an ‘unacceptable risk’. However, the operator’s classification reduced this to ‘Low Risk’ when mitigations were applied. These mitigations included checking the battery voltage level prior to take-off. However, the pilot could not recall performing this check.

    The aircraft was operating its sixth flight since the batteries had been changed, which was twice that intended by the pilot. He suggested that he may have been fatigued and perhaps the desire to film as many races as possible provided further pressure which may have also distracted him. This may provide possible explanations as to why the aircraft’s batteries were not changed prior to the accident flight as intended by the pilot.

    The pilot stated that he would take-off when the battery voltage was less than 48 V, which he considered was acceptable when making short flights. This differed from the manufacturer’s guidance of ‘above 48 V’, although this value was based on the aircraft being operated at its maximum weight. Although, the operator’s risk assessment stated that the pilot and ground crew would monitor battery voltage, neither the camera operator nor observer had been briefed prior to take-off as to what voltage was acceptable. Therefore, neither would have been able to assist the pilot in identifying that the battery voltage was getting low. The manufacturer’s default trigger threshold for the low voltage battery warning was 44 V, and this was also the level at which it recommended that the aircraft should be landed as soon as possible. This warning threshold had been changed by the operator to trigger at 42 V.

    Shortly after the low voltage warning had occurred in flight, the battery reached a critical voltage level at which point controlled flight was lost and the aircraft then descended in near free-fall. The aircraft’s kinetic energy when it collided with the boat was estimated to have been about 13,700 Joules. The CASA research paper indicates that fatal injuries would have occurred if the 28 kg aircraft falling at 30 m/s had struck a person on the boat.

    Whilst returning to land following a trigger of the low battery voltage warning, the aircraft’s battery voltage depleted to the extent that controlled flight was no longer possible. The aircraft descended, in near free-fall, and impacted an occupied private boat on the river. If the aircraft had struck a person on the boat, it is likely that fatal injuries would have occurred.

    The pilot did not replace the aircraft batteries when he had intended to, and a pre-flight check of their voltage before the accident flight was most likely not performed. In addition, the low voltage battery warning had been set to a level below that recommended by the manufacturer. Had the battery warning been set to the manufacturer’s recommended setting, the aircraft may have been landed safely under the pilot’s control.

    Damage to the Cabin roof and left side Handrail

     

    CHIRP Comment

    This is a surprising report. The pilot was experienced by RPAS standards and had good recency. It is interesting to note however that they had relatively few hours (18) flying the accident aircraft type. We have a few thoughts on the accident:

    • It’s never wise to change voltage limits below manufacturers recommended minimum level. They are normally set at a level that has been tested and other limits may have been set accordingly. It therefore follows that other parameters may be impacted, and the pilot may not know which ones have changed and how they have changed. One example of this would be wind gust limits which are set in part by maximum power output calculations.
    • On an aircraft system like the Alta, it might be sensible to fix a sticker to the controller with the voltage limit at which return home is necessary, so it is easier to remember, particularly if there is no audible warning mechanism.
    • The lack of a briefing for the Observer and Camera Operator. If they had been briefed it might have resulted in one of them calling into question the lack of a voltage check, as part of the pre-flight checks before the accident flight. It sounds like there was time pressure and too much focus on getting the filming done.
    • It is always a good idea to bear in mind where you might go at any moment of a flight when an emergency landing becomes your best option. It is easy to speculate on what the outcome might have been if such a site had been the option chosen, rather than trying to get back to base, perhaps involving some acceleration, which simply exacerbated the power problem.
    • These sort of operations in proximity to crowds undoubtedly require the granting of an Operational Safety Case approval by the CAA, which implies submitting a comprehensive 3 volume Operations Manual. It may be that the pilot had not refreshed their knowledge of what was contained within the operations manual and it was for this reason a number of its stated requirements for undertaking a flight were not adhered to. A re-read of an Ops manual at regular intervals is always time well spent. It is surprising what you can forget! Volume 3 of the OSC will have all the detail covering the Risk Assessment for an Operation like this where the public is present. It is very important to analyse the severity of the risk which of course can change with the geographical location of the flight. At 28kg flying over the top of crew in the boats racing, who would have been unable to get out of the way of a Drone descending, it was about as severe as you can get.
    • The last element we think is also worth bearing in mind, is insurance. As Operations of Drones become more complex and the equipment more costly, there will be a point where insurers, who have perhaps taken a benign approach to paying out when Human Factors have been involved in the past, may have to take a far more robust approach as losses increase. For instance, a situation where an Operator has simply not followed their operations manual and has therefore technically invalidated the terms of their Authorisation, may well lead to insurance cover being withdrawn. Something to perhaps keep in mind for the future.

  • DUASxxx9

    –

    Drone-Aircraft collision
    Drone-Aircraft collision

    Initial Report

    From Transportation Safety Board of Canada’s Air Transportation Safety Investigation Report A21O0069

    On 10 August 2021, the Cessna 172N aircraft (registration C-GKWL, serial number 17268441) operated by Canadian Flyers International Inc. was on a day visual flight rules training flight, on final approach to Runway 15 at Toronto/Buttonville Municipal Airport, Ontario, with a student pilot and flight instructor on board.

    At approximately 1301 Eastern Daylight Time, the student pilot and flight instructor heard and felt a solid impact at the front of the aircraft. Suspecting a bird strike, they continued the approach and made an uneventful landing, exiting the runway and proceeding to park on the ramp. After parking the aircraft, they observed damage on the front left cowl under the propeller; however, there were no signs that a bird had struck the aircraft.

    Shortly afterward, a member of the York Regional Police reported to airport staff that he believed a collision had occurred between the remotely piloted aircraft he had been operating and another aircraft. The remotely piloted aircraft, a DJI Matrice M210 (registration C-2105569275), had been in a stationary hover at 400 feet above ground level when the 2 aircraft collided. The DJI Matrice M210 was destroyed. There were no injuries to either pilot on the Cessna 172N or to persons on the ground.

    Findings as to causes and contributing factors (These are conditions, acts or safety deficiencies that were found to have caused or contributed to this occurrence):

    1. The flight crew of the Cessna 172N was unaware of the presence of airborne remotely piloted aircraft traffic in the vicinity and, due to several factors, the active scanning that is part of the see-and-avoid principle was unsuccessful in identifying the conflict.
    2. York Regional Police policy does not require that visual observers be trained crew members, and the remotely piloted aircraft pilot did not brief the visual observer on his role and responsibilities before the operation. As a result, the visual observer was not aware of the requirement to maintain visual line-of-sight with the remotely piloted aircraft, nor was he trained in visual scanning techniques or aircraft identification.
    3. The remotely piloted aircraft pilot was tasked with operating the camera system, monitoring the status of the remotely piloted aircraft, and communicating on multiple channels. As a result, he likely became task saturated, restricting his ability to visually monitor the remotely piloted aircraft and hear radio calls on the control zone’s mandatory frequency and the sound of incoming aircraft, both of which preceded the collision.
    4. In the moments leading up to the collision, the pilot of the remotely piloted aircraft likely was task saturated, the visual observer was unaware of the requirement to maintain visual line-of-sight, and the Cessna pilots’ active scan was unsuccessful; consequently, the conflict went unrecognized, and the 2 aircraft collided.

    Findings as to risk (These are conditions, unsafe acts or safety deficiencies that were found not to be a factor in this occurrence but could have adverse consequences in future occurrences)

    1. If pilots do not consult established checklists before and during flight operations, there is a risk that checklist items deemed critical to the safety of the flight will be omitted.
    2. If remotely piloted aircraft operators who plan to operate in controlled airspace do not communicate their flight intentions with, and receive authorization from, the air traffic services provider, there is an increased risk of conflict or collision with another aircraft.

    Damage to the Cessna 172 after collision with the DJI M210

    Safety action taken:

    The York Regional Police has amended its Command Directive LE-388 to include the addition of a pre-flight risk assessment tool and an updated Remotely Piloted Aircraft Pilot Checklist. There is also additional guidance for the role of visual observer, including a quick reference card outlining their roles and responsibilities, as well as a requirement to have a visual observer present for all operational remotely piloted aircraft flights.

    Overview of Toronto/Buttonville Municipal Airport and surrounding area showing the collision location, the Runway 15 centreline, and the RPA’s flight path (Source: Google Earth, with TSB annotations)

    CHIRP Comment

    We think there are some good Human Factors lessons to take away from this report and are relieved that a more serious outcome did not result. This report shows how important it is to contact Air Traffic Control when you are flying in their FRZ, with precise details of where you will be flying. This applies even if there are operational reasons why time may be constrained. Although Emergency Services clearly have other considerations to consider as well, the safety of flight should not be made a secondary consideration to something they are doing even when the safety of life is just as much at stake. If the impact of the Drone had been a couple of inches higher it would have had an altogether different outcome we suspect.

    An observer that is properly briefed can provide a significant amount of value to any RPAS flight, particularly if there is an element of urgency associated with the deployment. An observer that is not properly briefed may be distracted by the controller screen and not be looking at the Drone and its surroundings. Task saturation is never that far away when you are involved in an unpredictable situation and increases the chance that the holes in the Swiss cheese can align very quickly. In addition, Final approach can be a busy time for the crew of a light-aircraft, and it is not necessarily a moment when they would expect unannounced airborne conflicts. Better to be safe than sorry and get in touch with ATC when you are flying in an FRZ.