Drone Manufacturer: DJI
Drone Model: Matrice 210
Country: United Kingdom of Great Britain and Northern Ireland
Type: Accident
Date: 2019-10-06
Applies: Daytime
Pilot Qualifications: Unknown Status
Pilot Flight Experience: 262 Hours
Link to External Information About This submission: https://assets.publishing.service.gov.uk/media/5ffef886e90e07639e9b13b0/DJI_Matrice_210_UAS_reg_na_02-21.pdf
File Uploaded: screen_shot_20210218_at_11.31.47_am
Description
The DJI Matrice 210 unmanned aircraft system was being operated in a manual flight mode over a nature reserve in support of emergency service operations. Whilst the aircraft was hovering at a height of about 54 m, the ballistic recovery parachute system fitted to the aircraft activated unexpectedly. The aircraft descended under the parachute and became lodged in a tree.
Testing of the parachute system did not identify any evidence of a system malfunction which could have triggered an erroneous parachute deployment, but a false-positive activation of the parachute system could not be ruled out.
Analysis of the aircraft recorded on-board data did not provide any insight into why the flight was abruptly terminated, although several possibilities were identified. It was not established whether the parachute system activated first, cutting power to the aircraft motors or whether the aircraft experienced an inflight failure which triggered the parachute deployment.
History of the flight
The DJI Matrice 210 is a quadcopter Unmanned Aircraft System (UAS) with a maximum takeoff mass of 6.14 kg. It is controlled on the ground using a handheld flight controller via radio frequency and a software application running on a tablet device attached to the controller. For the accident flight the takeoff mass was calculated to be approximately 5.5 kg, which included an underslung camera, two TB55 batteries and a ballistic recovery parachute system.
The UAS was being flown manually in support of police operations at Backwarden Nature Reserve, Danbury, Essex. A pre-flight risk assessment noted that the forecast wind speed was 16 mph with 26 mph gusts, but the actual wind speed on the ground was measured as 7 mph. The pilot conducted function checks after takeoff and checked the aircraft’s stability in the wind conditions. The UAS controller indicated a high wind warning and a “Fly With Caution” message was displayed, but the pilot assessed that the aircraft’s flight was stable.
The aircraft was flown at a height of approximately 50 m to the area of interest. While in the hover, the ballistic recovery parachute system deployed without warning. The aircraft’s motors stopped and it descended under the parachute, coming to rest in some trees. No other warnings were displayed on the controller. From the ground, the pilot assessed that no damage occurred when the aircraft landed in the trees but it was subsequently damaged during recovery from the trees.
The aircraft was sent to a UK repair organisation, which forwarded it to the UAS manufacturer for repair and analysis of the recorded onboard data. The parachute system was sent to the parachute manufacturer for examination and analysis of the recorded on-board data from both the parachute system and the aircraft’s flight log.
Parachute system information
The operator had fitted a ParaZero SafeAir M200 ballistic recovery parachute system to the aircraft. The SafeAir is an optional after-market safety device that aims to reduce the risk of operating unmanned aircraft over populated areas, by reducing impact energy in the event of an in-flight failure. The M200 model is specifically tailored for use with the DJI Matrice 200 series of unmanned aircraft, including the Matrice 210.
The parachute and the system’s internal electronics are mounted on a plate which is fitted on top of the aircraft (Figure 1). It is attached to two parachute mounting legs, which are connected to the aircraft’s landing leg joints. A flight termination device, known as TerminateAir, is mounted above the aircraft’s battery compartment. A cable connects it to the rest of the parachute system.
The SafeAir system uses independent sensors to monitor the flight parameters of the aircraft. If it detects a critical aircraft failure, the first step of the activation sequence is that the TerminateAir device disconnects the aircraft’s batteries, cutting power to the motors. This prevents the motors becoming entangled in the parachute chords or causing laceration injuries. A lever on the TerminateAir is placed across the door of the aircraft’s battery compartment, to prevent the batteries being physically ejected.
Having cut power to the motors, the parachute is then activated by a pyrotechnic charge, allowing the aircraft to descend in a controlled manner. An audio alarm alerts bystanders to the potential threat of the descending aircraft.
The SafeAir system will trigger a parachute deployment if it detects an aircraft freefall event. For such an event to be detected, the overall acceleration of the aircraft must drop below 3 m/sec2, and remain below this threshold for a period of 300 milliseconds (ms). (Note that the aircraft is always subject to the earth’s gravity of 1g which would be detected as 9.81 m/sec2 during hovering flight.) The 300 ms delay was designed to mitigate the differences between the accelerations measured by the SafeAir and those measured by the aircraft. The overall acceleration is resolved from the X, Y and Z accelerations that are measured within the SafeAir unit itself, and no adjustments are made to take account of the SafeAir and aircraft accelerations being measured at different locations. Vibration levels may also be different at the two measurement locations.
As part of its risk mitigation, the operator’s procedures required the SafeAir parachute system to always be fitted when operating the Matrice 210.
Review of recorded information by parachute manufacturer
The parachute manufacturer analysed the log files from both the aircraft and the parachute system and stated that they were ‘similar until the moment of deployment’. Thereafter the aircraft’s flight log ended at cruise altitude, while the parachute system log continued to record the parachute deployment, characterised by erratic acceleration readings, and a descent at a constant rate.
Testing of the parachute system by parachute manufacturer
The parachute manufacturer tested the electronic and mechanical aspects of the SafeAir parachute system including the TerminateAir device and no anomalies were noted. In order to determine whether a TerminateAir malfunction could have disconnected the aircraft’s batteries, leading to a loss of power in flight and subsequent parachute deployment, tests were conducted with the parachute system installed on a DJI Matrice 200 aircraft. The SafeAir system was armed and the entire assembly was subjected to 24 hours of continuous vibration testing. A higher vibration rate than that observed during the accident flight was used. At the conclusion of the vibration testing, the system was still armed, no parachute trigger had been detected and the batteries were still connected.
The Matrice 200 with the SafeAir unit fitted was then flight tested to assess the behaviour of the parachute system during flight. A flight profile similar to that of the accident flight was used and additional, more extreme, manoeuvres were flown. No abnormal events were recorded during the flight test. The parachute system did not trigger, nor did the acceleration cross the triggering threshold (Figure 3).
The parachute manufacturer considered that the sudden end of the aircraft’s flight log during the accident flight, could be explained by a total power failure of the Matrice 210. However, it stated that a false-positive parachute deployment could not be ruled out, although such a phenomenon could not be recreated during flight testing.
Reported Cause
Review of recorded information by AAIB
A review of the aircraft’s on-board recorded data by the AAIB confirmed that the recording ended abruptly after 220 seconds, when the aircraft was hovering at a height of 53.5 m (recorded resolution is 0.5 m), having travelled 390 m from the takeoff point. The energy level (state of charge) of the aircraft’s two batteries was 87% (Figure 4). The figure also compares the aircraft’s altitude and acceleration data with the equivalent data from the SafeAir log file and shows that as the flight progressed, the acceleration recorded by the SafeAir system grew in amplitude compared to that recorded by the aircraft.
Figure 5 is a close-up of the last one second of the flight before power was lost to the aircraft. During this second the aircraft’s inertial measurement unit (IMU) sensed slight changes in vertical speed that equated to about 2.6 cm height gain, with the aircraft’s acceleration decreasing from just over 1g to below the SafeAir’s trigger threshold over the last 25 ms. During these last 25 ms, the aircraft’s nose-up pitch reduced by 0.77° (so about 30°/sec) and the thrust (probably in response) increased the power of the front motors and decreased the power of the rear motors. There were 23 more points in the aircraft’s log file, covering a 109 ms period, that were corrupted (the last 12 of which appeared to be from an earlier flight two months earlier). The aircraft’s log did not contain any warnings or provide an insight into the reason for the parachute activation, or if the batteries had been disconnected.
Figure 5 also shows the acceleration recorded by the SafeAir system, when it detected 300 ms of freefall. This triggered the TerminateAir within 2 ms and the parachute deployed 50 ms later. However, the drop in acceleration to below the SafeAir trigger threshold occurred about 700 ms before a drop in acceleration was measured by the aircraft.
Comparison of accelerations
The two acceleration data sets in Figure 5 appear misaligned; however, given that the aircraft logged data at about 200 Hz and timestamped each line of data in the log file with a UTC time, these should be accurate to within 5 ms. Similarly, the parachute system logged data at about 100 Hz so should be accurate to within 10 ms. It is also time stamped data but relative to the start of logging. The alignment of these data sets, therefore, relies on matching accelerations during a couple of portions of the flight, ideally at the start and then as near to the end as possible where a match in acceleration can be found to confirm the alignment. Figure 6 does this by comparing accelerations shortly after takeoff and then 150 seconds later (about 60 seconds before parachute deployment). Note that each square on the x-axis is 500 ms so any misalignment more than say 50 ms would be noticeable.
Information from the aircraft manufacturer
The UAS manufacturer also analysed the aircraft’s onboard recorded data. Preliminary information provided by the manufacturer stated: ‘Primary conclusion: Hardware or structure issue. Secondary conclusion: Internal power-off in the air ([electronic speed controller] ESC voltage jump)’. It also stated that ‘there is a very high possibility that the parachute cut off the batteries of the M210, as the ESC and Fly control and battery [parameters] stops at the same time’, despite the batteries still having charge remaining. However, the UAS manufacturer did not provide any additional information to support its conclusions, despite several requests. The UK repair organisation confirmed that the UAS manufacturer repaired the aircraft under warranty and in addition to replacing items damaged during recovery of the aircraft, replaced the battery compartment module, batteries and a power board.
Previous accidents
The AAIB has investigated several accidents involving DJI Matrice 210s which have crashed due to a sudden loss of power. In those cases, the aircraft batteries indicated an erroneously high State of Charge (SOC), the cause of which is discussed in report EW/G2018/09/04, of AAIB Bulletin 11/2019. There was no indication from analysis of the flight log for this event that it was related to the same battery issue.
Analysis
During a routine manually operated flight of an unmanned aircraft, the ballistic recovery parachute system deployed and the aircraft descended towards the ground, becoming stuck in trees. There were no warnings generated on the UAS controller, other than an advisory “Fly With Caution” message due to the wind conditions. Review of the aircraft’s flight log did not reveal the reason for the sudden termination of the flight and the batteries had 87% SOC remaining when the flight ended.
The parachute manufacturer conducted electronic, mechanical, vibration and flight testing of the SafeAir parachute system and its TerminateAir device and did not identify any evidence of a system malfunction which could have caused an unintentional parachute deployment. It concluded that the parachute deployment could have been a valid activation of the system in response to a sudden loss of power to the aircraft but could not rule out a false-positive activation of the system. However, it was unable to replicate a false-positive activation during post-accident testing of the parachute system.
The AAIB independently reviewed both the aircraft’s flight log and the data recorded by the parachute system. The aircraft’s flight log recorded a drop in the acceleration from 9.81 m/s (1g) to below the SafeAir trigger threshold over the last 25 ms of recording during which the aircraft’s nose-up pitch started to decrease at 30 /sec with a corresponding change in thrust distribution fore and aft to counter this. However, this was about 700 ms after the SafeAir measured a drop in its acceleration below the threshold level. The differences in the recorded acceleration between the two systems makes it difficult to correlate the two. The changes in motor thrust and slight climb indicate that the motors were operating and generating positive thrust up to the point that the recording stopped. This could have been a result of the parachute system falsely detecting a freefall condition; however, the aircraft’s flight log event file did not contain entries to say that the batteries had been disconnected. The investigation was unable to explain the erroneous data at the end of the fight log.
Conversely, if the loss of power was a result of an aircraft power failure, causing the aircraft to go into freefall thus triggering a parachute deployment, the alignment in time of the accelerations between the two systems would have to be shifted by about 700 ms. However, this would be contrary to the evidence of aligned data at point earlier in the flight.
As the flight progressed, the parachute system was measuring increasingly greater amplitudes in acceleration compared to those measured by the aircraft. These were perhaps a result of the accelerations being measured from different locations and with different levels in vibration. The 300 ms trigger delay was designed to mitigate against false-positive detections due to transient differences in accelerations between the two systems, but any delay will always be a compromise between false positive detections and late detections of true aircraft failures.
The aircraft was not examined by the AAIB. Without additional information from the UAS manufacturer it was not possible to establish whether the aircraft experienced a sudden power loss or other failure, which triggered activation of the parachute system, or whether the parachute system detected an erroneous trigger and activated in response, cutting power to the aircraft motors. However, the fact that the batteries, battery compartment module and a power board were replaced during the repair, could indicate a power problem with the aircraft, even though it is difficult to reconcile this with the alignment of data between the two systems.
The AAIB is currently investigating two other events involving unexpected activation of a ballistic recovery parachute on DJI Matrice aircraft and will collate any common factors emerging from those investigations.
Conclusion
A routine flight of an unmanned aircraft terminated prematurely when the ballistic recovery parachute system activated unexpectedly. It was not established whether the parachute system activated erroneously, cutting power to the UAS motors or whether the UAS experienced an inflight failure which triggered the parachute deployment.
Safety action
The parachute system manufacturer is aware of the log alignment issues between its system and the DJI Matrice 200 series of aircraft. As such, the latest parachute system that is being designed for the DJI Matrice 300 series aircraft will communicate directly with the aircraft to cut power to the motors, leaving power on the aircraft to continue logging data, and enable more accurate syncing of the aircraft and parachute system log files.