Drone Manufacturer: Alauda
Drone Model: Airspeeder Mk II
Country: United Kingdom of Great Britain and Northern Ireland
Pilot Qualifications: Licensed or Certificated by Aviation Authority
Pilot Flight Experience: 20 Hours
Link to External Information About This submission: Full Report
File Uploaded: screen_shot_20210218_at_12.09.17_pm
Whilst performing a demonstration flight, the remote pilot lost control of the 95 kg Alauda Airspeeder Mk II scale demonstrator. After the loss of control had been confirmed by the remote pilot, the safety ‘kill switch’ was operated but had no effect. The Unmanned Aircraft then climbed to approximately 8,000 ft, entering controlled airspace at a holding point for flights arriving at Gatwick Airport, before its battery depleted and it fell to the ground. It crashed in a field of crops approximately 40 m from occupied houses and 700 m outside of its designated operating area. There were no injuries.
The AAIB found that the Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and that its design and build quality were of a poor standard. The operator’s Operating Safety Case contained several statements that were shown to be untrue.
The Civil Aviation Authority’s Unmanned Aircraft Systems (UAS) Unit had assessed the operator’s application and, after clarification and amendment of some aspects, issued an exemption to the Air Navigation Order to allow flights in accordance with the operator’s Operating Safety Case. The Civil Aviation Authority did not meet the operator or inspect the Alauda Airspeeder Mk II before the accident flight.
There have been many other similar events where control of an unmanned aircraft has been lost, resulting in either it falling to the ground or flying away. Even a small unmanned aircraft falling from a few metres could cause a fatal injury if it struck a person.
The Civil Aviation Authority and the organisation which designed and operated the Airspeeder Mk II have introduced measures to address a number of issues identified during the course of the investigation. In addition to the actions already taken this investigation report makes 15 Safety Recommendations regarding the operator’s procedures, airworthiness standards and the regulatory oversight.
History of the flight
The Airspeeder Mk II unmanned aircraft (UA) was designed, manufactured and operated by the same company. For simplicity, they will be referred to as the operator.
The operator is an Australian-based designer and manufacturer of ‘high performance electric aerial vehicles’2. Established in 2016, it has flown what it described as “fully functional” prototypes since early 2017. At the time of the accident the operator’s staff consisted of a Chief Executive Officer (CEO), one permanent member of staff and several part-time university students. The operator stated, in their Operating Safety Case (OSC), that they were fully compliant with the pilot and UA licencing and registration requirements of their national regulator, the Civil Aviation Safety Authority (CASA) of Australia and had worked closely with designated CASA representatives since the UA started flying. They also stated that all operations were to be conducted in accordance with the conditions and limitations in their UAS OSC.
Late in 2018, the operator was invited to exhibit the Airspeeder Mk II as part of an exhibition at a large public event at Goodwood House, West Sussex. They were also invited to do some flying demonstrations that were planned to take place at Goodwood Aerodrome and on a golf course adjacent to the exhibition, Figure 2.
The operator arrived in the UK on 28 June 2019 with two Airspeeder Mk II UAs and established a temporary workshop at Goodwood Aerodrome. They conducted an on-site familiarisation and risk assessment and completed pre-flight inspections of the UA as detailed in their OSC.
The CAA issued an exemption to the Air Navigation Order 2016 (ANO) on 3 July 2019, and a test flight was flown at the aerodrome that day using one of the UAs; the CAA were not present for this test flight. This flight resulted in a hard landing due to a loss of power which was later traced to a fault in a battery feeder cable connection. This UA sustained damage to its landing gear. Although required to do so under the regulations, the OSC and the exemption, this accident was not notified to the CAA, CASA, Australian Transport Safety Bureau (ATSB) or AAIB.
The electronic control box was removed from the damaged airframe and fitted to the remaining UA for a flight the following day.
The remote pilot stated that on the day of the accident all items in the pre-flight checklist were completed successfully. This included a test of the UA’s ‘kill switch’ which was designed to electrically isolate the power supply to the UA’s four motors.
Observing the flight was an audience of around 200 invited guests, the majority of which were positioned on the roof terrace of an adjacent building. Also present were two members of the CAA’s UAS Unit who had been involved in assessing the operator’s application for the exemption.
After takeoff, the remote pilot manoeuvred the UA away from himself and the audience and flew it along Runway 32 before returning in the opposite direction. Just over a minute after takeoff, as the remote pilot was turning the UA close to the threshold of Runway 32, it levelled off. As the remote pilot had not commanded the manoeuvre, he realised that he had lost control of the UA. He immediately informed the maintenance controller, standing next to him and assigned to operate the kill switch, who then attempted to operate the kill switch. This was unsuccessful and the UA was then observed to enter an uncommanded climb.
The remote pilot instructed the audience to “take cover”, which they did by descending into the building they were on. He also informed the aerodrome’s Operations Manager, who was standing close by, that the UA had had a “fly-away” and then the Operations Manager informed the aerodrome’s Flight Information Service Officer (FISO) in the tower to advise inbound aircraft to remain clear of the Air Traffic Zone (ATZ). The FISO informed the UK air navigation service provider (NATS) of the potential for the UA to enter the controlled airspace above the aerodrome. The aerodrome’s RFFS, who were on standby in their vehicles for the flight, went to assist removing people from the roof of the building. They did not attend the scene in order to maintain the fire cover for aircraft holding outside the ATZ.
The UA continued to climb vertically and drifted in a south-south-westerly direction. After about 41⁄2 minutes it fell, with a high rate of descent, striking the ground in a field of crops. Residents, who saw the UA crash from their garden, approached the accident site to investigate. Upon realising the size of the UA, they called the police.
The remote pilot and the spotters went to the accident site where they carried out their post-crash procedures which included making the battery safe and removing it.
The operator’s OSCs defined three key personnel in the organisation:
The remote pilot held a Remote Pilot Licence issued by the Australian CASA. He was also the operator’s Chief Remote Pilot and their only pilot that was authorised to operate UAVs up to 150 kg. A licence was not required by the CAA for this operation in the UK.
The OSC stated that the Chief Remote Pilot was responsible for all operational matters affecting the safety of operations. As such his roles and responsibilities included:
● ‘ensure that operations are conducted in compliance with the CAA
● monitor and maintain operational standards and supervise RP(s) who work under the authority of operator
● develop applications for approvals and permissions where required to facilitate operations
● develop checklists and procedures relating to flight operations.’
The OSC stated that the maintenance controller was responsible for ensuring the maintenance of the UAS in accordance with the manufacturer’s specifications. His roles and responsibilities included:
● ‘control of all UAS maintenance
● maintain a record of UAS defects and any unserviceability
● ensure that specialist equipment items including payload equipment are serviceable
● investigate all significant defects in the UAS.’
The CEO was ultimately responsible for ensuring that any operations were conducted in adherence to the operator’s ‘strict safety standards’ and under the control and authority of the Chief Remote Pilot and Maintenance Controller.
An aftercast provided by the Met Office stated that at the time of the accident the aerodrome and surrounding area was under a ridge of high pressure. The weather was generally fine with largely clear skies. The winds through the lower part of the atmosphere were relatively light and variable in direction, varying between 030° and 130° but less than 8 kt. Once the UA had reached an altitude of around 6,000 ft and above, the wind direction became more north-westerly at 8 to 15 kt. The atmospheric pressure was 1024 hPa.
Goodwood Aerodrome is situated 1.5 nm north-north-east of Chichester, West Sussex. The city has a population of approximately 27,0004 people. Between 4 and 7 July 2019, a large public event was taking place about 1 nm to the north-east of the aerodrome at Goodwood House. On the day of the accident there were reported to be 35,000 attendees at the event.
The aerodrome has four grass runways, orientated 14/32 and 06/24. Due to the nearby public event, special areas were designated on the aerodrome for the arrival and departure of helicopters used to transport visitors. Additional parking and static display areas were also provided.
The Aerodrome Flight Information Service operated on a frequency of 122.455 MHz. Located on the southern edge of the aerodrome is a VOR/DME navigation aid operating on a paired frequency of 114.75 MHz. The DME transmits on 1055 MHz and receives on 1118 MHz.
The aerodrome is situated in Class G airspace and has an ATZ extending to 2 nm laterally and 2,109 ft amsl vertically. Aircraft movements are assisted by an Aerodrome Flight Information Service. There is Class A airspace6 with a base of FL657 above Goodwood Aerodrome which includes a holding pattern between FL130 and FL70, aligned on the Goodwood VOR, for arrivals to London Gatwick Airport (Figure 3).
The UA came to rest inverted in a field of wheat, 875 m south-south-west of the takeoff point. The crop was dry and there was no post-impact fire. The accident site was 40 m from the nearest building which was in a group of houses on the north-eastern edge of Chichester, (Figure 4).
By the time the AAIB arrived, the operator had removed the main battery and placed it away from the crop (Figure 5).
Goodwood Aerodrome was aware of the planned flights and the aerodrome and ATZ were temporarily closed to aircraft by NOTAM8 between 1115 and 1145 hrs, to allow the UAS demonstration flight to take place in this airspace.
The aerodrome’s RFFS was equipped with, and trained to use, breathing apparatus. In the event of a fire involving the UA’s batteries, they would have been able to engage in appropriate firefighting activities.
Description of the Airspeeder
The Alauda Airspeeder Mk II is an unmanned, radio-controlled, battery-powered quadcopter measuring 3 m long and 1.5 m wide with a maximum takeoff weight of 95 kg. The UA was constructed from an aluminium frame, to which the motors, controllers and battery were attached, along with a fibreglass outer shell (Figure 6). The operator had built two UA specifically for use at this event. These were 3⁄4 size versions of what was planned to be a full-size, human-carrying racing aircraft (Mk IV), which was expected to have a takeoff mass of around 250 kg. The UA was controlled by a ground-based, hand-held transmitter and was reported to be capable of speeds of up to 80 km/h (43 kt).
Each of the four 32-inch propellers were powered by a brushless DC motor. Each motor had a dedicated Electronic Speed Controller (ESC) which supplied high voltage from the battery to the motors, based on the commands from the flight control system. This lithium polymer battery was of a bespoke design, operating in the 42 to 58 V range for up to 8 minutes.
Flight control system
The flight control system was powered by a dedicated 7.2 V battery. Throttle and flight control commands were received by the on-board controller from a 915 MHz radio receiver. These commands were processed, along with inputs from two Inertial Measurement Units (IMUs), to produce the motor commands. The IMUs were used as a basic stability and control system; if no input was supplied by the pilot, the UA should self-level.
The remote pilot’s transmitter contained a graphical signal strength meter display which was based on the strength of the signal received by the aircraft. In the event of loss of connectivity, the transmitter’s ‘telemetry loss alarm’ provides an audible warning. The onboard control system will also freeze the current throttle command to each of the motors but will self-level the UA using the IMU sensors. The effect of this was that the UA would continue flying the last known command but at a level attitude.
The flight controller power supply was routed through a relay, which was controlled by a kill switch. This relay was wired in the ‘Normally Closed (NC)’ position meaning that if the kill switch was unpowered, power was still available to the flight controller (Figure 7). When activated, the kill switch opened the relay, cutting the power to the flight controller. With the control system unpowered, the ESCs would receive no command and the motors would stop.
The kill switch was powered by an independent 7.2 V battery and operated on a different frequency (433 MHz LoRa9) and control system to the normal flight control system. This system was also used to allow the UA to be safely electrically isolated during manual handling on the ground.
The ground-based part of the kill switch was a transmitter connected to a laptop via a trailing USB cable. All of the transmitter’s electronics were exposed with no protective enclosure and, when used, the antenna and electronics hung underneath the laptop on the USB cable (Figure 8).
To activate the kill switch, a spotter was required to enter a command into a terminal on the laptop which communicated this to the USB transmitter. There was no two-way communication in the kill switch system. This meant that if connectivity was lost, it would remain unknown until an attempt was made to use the system.
On the UA both the kill switch and flight controller were packaged into an IP5510 box with holes removed in the sides to allow cable access. This box was interchangeable between aircraft.
The CAA exemption required the operator to operate in accordance with OSC Volume 1, which included fitting an altitude and battery voltage monitoring telemetry system.
There was no Global Navigation Satellite System (GNSS) position system fitted and no return-to-home function available, nor was there required to be. If control was lost, the only back up was the kill switch. If the kill switch failed to operate, the UA would continue to fly until the main battery depleted.
Detailed examination of the wreckage
The airframe had suffered permanent distortion and cracking from the impact, but no preaccident anomalies were found.
The main battery had sustained some impact damage but remained intact within its case. Although initially the battery appeared stable, it was later dismantled by the operator into individual cells when it became warm. The individual cells were then disposed of by the operator before the AAIB was able to inspect them.
Flight control system transmitter
Examination of the transmitter revealed that the battery charge was full. The transmitter settings were examined in detail and are covered in the ‘Radio control’ section.
Flight control box
The lid of the flight control box, containing the UA control systems, had detached in the accident but the electronic control boards were all present. Only one of the 7.2 V batteries was present, the other was not recovered.
Flight control system receiver
The flight control circuit board was present, but the operator had disconnected the ESC connection wires prior to AAIB arrival. The radio receiver, which was normally slotted into the circuit board, had detached and broken into several pieces (Figure 9). This damage was likely caused in the impact. Failure or loss of this component would lead to loss of link between the UA and pilot.
All of the other components appeared to be present.
Initial examination of the on-board kill switch circuit board showed that the relay and one of the battery power supply leads had detached from the board. Loss of either of these components would render the kill switch inoperative. The antenna and the rest of the components all appeared to be in place.
The system was powered and tested in the presence of the operator. The relay and power supply lead were re-attached to the circuit board and the kill switch tested on a number of occasions, each time successfully.
Examination of circuit boards
Initial examination of the circuit boards revealed some concerns regarding build quality and workmanship. The boards were populated with ‘hobbyist’ components with exposed wiring, large amounts of solder and lumps of adhesive. The kill switch used an electronics prototyping board with a number of jumper wires instead of a printed circuit. Failure of any of these wires would render the kill switch inoperative (Figure 10).
Each circuit board was X-rayed. This revealed no dry solder joints but had large quantities of solder present.
The AAIB engaged a specialist company who provided an experienced IPC11 mastertrainer/ instructor to examine the circuit boards against the IPC A-610 standard. This standard provides acceptance requirements for the manufacture of electrical and electronic assemblies. It defines three classes, which depends on the application of the electronic assembly. Class 1 is aimed at non-critical items, up to Class 3 which is for high performance products where equipment downtime cannot be tolerated. For this application, Class 3 seemed to be appropriate.
The examination revealed a number of issues with the flight control system and both the airborne and ground-based kill switch assemblies. All the assemblies failed an evaluation against all IPC A-610 classes due to quality and workmanship issues. Examples included misaligned components, burnt insulation, the use of solder bridges, excessive flux residues and a power connector that appeared to be installed in the incorrect orientation when compared to the drawn orientation on the circuit board (Figure 11).
After the Airspeeder Mk II failed to respond to control inputs it entered an uncontrolled climb at maximum power. Operation of an independent kill switch had no effect and the aircraft continued to climb for 41⁄2 minutes, drifting with the wind and reaching a height of approximately 8,000 ft. The aircraft infringed controlled airspace over a radio navigation beacon used as a holding point for Gatwick Airport. After depletion of the batteries, the aircraft fell to the ground in a field, 40 m from occupied houses and 875 m from its launch point. The operation of the Airspeeder Mk II during the accident flight breached conditions of the exemption granted by the CAA for the flight.
The loss of control was caused by a loss of link between the ground and airborne control systems. The exact reason for this could not be established but considered likely to be either RF interference or a failure of the onboard control system.
The investigation identified a wide range of contributory factors that set the conditions for this occurrence and made an accident more likely.
The Alauda Airspeeder Mk II was not designed, built or tested to any recognisable standards and although the operator’s OSC, submitted to the CAA claimed it had been built to ‘the highest standards’, none were referenced.
A number of issues were identified with the design and build of the Airspeeder Mk II, including numerous single point failures. The assembly of the electronic flight control system failed to meet relevant standards. The flight control system was not capable of providing telemetry to the remote pilot and was not fitted with a GNSS position monitoring system which could have enabled electronic safety measures, such as automatic return to takeoff point or geo-fencing, to be used. There was no placarding to warn first responders of the hazards of the high voltage stored energy device (battery). The Airspeeder Mk II did not have any data recording devices fitted, which would have provided useful information about the conduct of the flight.
The electronic kill switch was manually operated. In the event of a loss of control the remote pilot would have to recognise that the UA was no longer responding to control inputs then communicate with the observer who would then activate the kill switch. The time delay in recognising a loss of control and operating the kill switch could result in the UA descending uncontrollably outside of the specified operating area.
A radio survey of the operating area was conducted for the flight controller, but it was not carried out for the kill switch, which operated on a different frequency. The radio frequency used for the flight controller was not permitted to be used for airborne applications.
A flight, on the day before the accident flight, resulted in a heavy landing when power was lost which was not reported to the relevant authorities. The power loss was due to a faulty battery connector. The flight control unit from this airframe was then transferred to accident airframe without any detailed inspection.
Statements made by the operator and the findings of this investigation showed that they did not appear to have any knowledge or understanding of airworthiness standards.
The operator’s OSC provided the basis for the exemption issued by the CAA but systems specified in the OSC for the remote pilot to monitor battery condition and altitude were not installed. The map image used by the operator to define the operating area and safety zone was out of date and it did not accurately represent the dimensions of the runway that was being used as a reference point.
The safety zone defined by the OSC and the maximum operating speed specified by the exemption did not consider reaction and communication times of the operator’s staff. The aircraft was unable to transmit telemetry to the remote pilot, so there was no means of monitoring the speed or height of the UA or ensuring that it remained within the limitations of the exemption.
Several areas were identified where CAP 722 could be improved. For instance, there is currently no requirement for UAS to be fitted with GNSS-based safety systems, data recording equipment or warning placards for high voltage stored energy systems to be installed. CAP 722 does not contain any guidance on how operational and safety zones should be defined.
The CAA UAS Sector Team were relatively new to the role and had limited experience in dealing with airworthiness matters. As a result, no assessment was made of the operator’s ability to properly complete the OSC and no independent corroboration of information provided by the operator in the OSC was carried out. The OSC contained references to approvals granted by CASA which were not validated by the CAA UAS team.
No face-to-face meetings were held between the CAA and the operator. The CAA did not inspect the UAS before flight or observe a flight before granting the exemption. The CAA arrived 45 mins before flight without prior arrangement to view or inspect the UAS. Their request to inspect the UAS was declined by the operator as pre-flight preparations were already underway and the NOTAM closing the aerodrome to other traffic only provided a limited window of time for the flight to take place. The CAA UAS Sector Team had no means to ensure that the operation of the UAS remained within the limitations of the exemption.
Following the accident, the CAA informed the operator that the exemption was withdrawn.