Drone Manufacturer: DJI
Drone Model: Matrice 200
Country: United Kingdom of Great Britain and Northern Ireland
Type: Accident
Date: 2019-09-21
Applies:
Pilot Qualifications: Unknown Status
Pilot Flight Experience: 86 Hours
Link to External Information About This submission: https://assets.publishing.service.gov.uk/media/602be85ad3bf7f0316f8eff8/DJI_Matrice_200_V1_UAS_reg_na_03-21.pdf
File Uploaded: screen_shot_20210218_at_12.29.48_pm
Description
The DJI Matrice 200 Unmanned Aircraft System (UAS) was being operated on an automated flight plan to conduct an aerial survey. On the fifth flight of the day, while the aircraft was at a height of 100 m, the ballistic parachute recovery system fitted to the aircraft activated. The aircraft descended under the parachute and was subsequently found on the roof of a nearby house.
Two months later, after having been repaired and fitted with a new parachute system, the aircraft experienced a second parachute deployment. On that occasion the aircraft was being manually flown in GPS mode at a height of 92 m over an area of open ground.
The first accident most likely occurred due to excessive vibration as a result of the parachute system not being securely attached to the airframe.
The investigation was unable to establish the cause of the second accident. There were several warnings in the recorded aircraft’s flight log, but analysis of this data did not provide any insight into why the flight was abruptly terminated. However, the parachute manufacturer considered that the second event involved a valid activation of the parachute system in response to a total aircraft power failure.
The investigation was limited by the availability of recorded flight data for the first accident and a lack of information from the UAS manufacturer. It was therefore unable to establish if there were any common factors between the two accidents, which involved the same aircraft but different parachute units. One Safety Recommendation is made regarding technical support to accident investigations by the UAS manufacturer.
In response to the first accident, the parachute manufacturer and the operator amended their respective procedures for securely attaching the parachute system to the aircraft.
The operator also identified that further emphasis on wind speed and direction was required prior to launch, to provide greater understanding of the drift potential in the case of a parachute deployment.
History of the flight
21 September 2019
The DJI Matrice 200 is a quadcopter UAS with a maximum takeoff mass of 6.14 kg. It is controlled on the ground using a handheld flight controller via radio frequency and a software application (app) running on a tablet device attached to the controller. For the accident flight the takeoff mass was 5.5 kg, which included an underslung camera, two TB55 batteries and a ballistic parachute recovery system.
The UAS was being operated on an automated flight plan using the DJI Go 4 app, to conduct an aerial survey of a helicopter landing site in an urban area. Four flights were completed in the morning without incident. The pilot and observer returned to the same launch point in the afternoon to conduct further flights. The accident occurred on the first flight of the afternoon.
The aircraft was prepared for flight in accordance with the operator’s company procedures and all systems indicated normal. Following a normal takeoff, the aircraft climbed to the pre-programmed survey height of 100 m before automatically following the planned route towards the survey site. Soon after, when the aircraft was approximately 250 m from the launch point, the ballistic parachute recovery deployed. The aircraft motors stopped and the aircraft began to descend under the parachute, drifting in the prevailing light winds. The pilot and observer lost sight of the aircraft as it descended behind a tree line. It was subsequently found on the roof of a nearby house and had suffered substantial damage. The recorded flight time was one minute and six seconds. The pilot inspected the aircraft and determined that the thumbscrews on the parachute mounting bracket were tight.
The aircraft was sent to the UAS manufacturer for repair. The parachute system was sent to the parachute manufacturer for examination and analysis of the on-board recorded data from the parachute system, aircraft controller and aircraft flight log.
29 November 2019
Following the aircraft’s return from repair of the damage incurred in the accident on 21 September 2019, the pilot carried out several test flights without the parachute system installed, over two days totalling two hours flight time. No anomalies were noted. On 29 November 2019, the pilot planned a further test flight prior to conducting an aerial survey, this time with a parachute system installed. This was a new parachute unit from stock and not the same unit that had been fitted on the previous accident flight.
The aircraft and parachute system were prepared for the test flight in accordance with the operator’s company procedures and all systems indicated normal. The aircraft was to be manually flown in GPS mode over an area of open ground. After a normal takeoff, the aircraft reached a height of approximately 20 m2 and the pilot completed the control checks. The aircraft was then commanded to climb and was flown on a south-westerly heading over the open ground. When the aircraft was at a height of 92 m and had travelled 144 m from the launch point, the pilot brought the aircraft into a hover to check the operation of the onboard camera. At this point, one minute and 15 seconds into the flight, the parachute deployed.
The aircraft descended under the parachute drifting to the east in light winds. It remained in sight during the descent and came to rest approximately 130 m from the launch point in grassy, open ground (Figure 1). One of the batteries dislodged as the aircraft struck the ground.
There were no injuries to people on the ground or damage to other property. The pilot inspected the aircraft and determined that the parachute mounting bracket, mounting legs and associated screws were secure. After recovery the aircraft could still be started and operated with the same battery set that had been installed during the accident flight.
The aircraft was sent to the UAS manufacturer for repair. The parachute system was sent to the parachute manufacturer for examination and analysis of the recorded on-board data from both the parachute system and the aircraft’s flight log.
Parachute system information
The operator had fitted a ParaZero SafeAir M200 ballistic parachute recovery system to the aircraft. The SafeAir is an optional after-market safety device that aims to reduce the risk of operating unmanned aircraft over populated areas, by reducing impact energy in the event of an in-flight failure. The M200 model is specifically tailored for use with the DJI Matrice 200 series of unmanned aircraft.
The parachute and the system’s internal electronics are mounted on a plate which is fitted on top of the aircraft (Figure 2). A flight termination device, known as TerminateAir, is mounted above the aircraft’s battery compartment. A cable connects it to the rest of the parachute system.
To allow rapid installation and removal of the parachute, the integral mounting plate attaches to two parachute mounting legs via four thumb screws, one in each corner of the mounting plate. The parachute mounting legs are fitted to the aircraft’s landing leg joints by removing the existing three landing leg attachment screws and replacing them with three longer screws (Figure 3). A spring washer and plain washer are also installed at each mounting screw. The parachute mounting legs can remain attached to the aircraft between flights.
The SafeAir system uses independent sensors to monitor the flight parameters of the aircraft. If it detects a critical aircraft failure, the first step of the activation sequence is that the TerminateAir device disconnects the aircraft’s batteries, cutting power to the motors. This prevents the motors becoming entangled in the parachute chords or causing laceration injuries. A lever on the TerminateAir is placed across the door of the aircraft’s battery compartment, to prevent the batteries being physically ejected.
Having cut power to the motors, the parachute is then activated by a pyrotechnic charge, allowing the aircraft to descend in a controlled manner. An audio alarm alerts bystanders to the potential threat of the descending aircraft.
The SafeAir system will trigger a parachute deployment if it detects an aircraft freefall event. For such an event to be detected, the overall acceleration of the aircraft must drop below 3 m/sec2 and remain below this threshold for a continuous period of 300 milliseconds (ms). (Note that the aircraft is always subject to the earth’s gravity of 1g which would be detected as 9.81 m/sec2 during hovering flight.) The 300 ms delay was designed to mitigate the differences between the acceleration measured by the SafeAir and the aircraft. For example, this overall acceleration is resolved from the X, Y and Z accelerations that are measured within the SafeAir unit itself, and no adjustments are made to these values to transform them to where the accelerations are measured on the aircraft. Vibration levels may also be different at the two measurement locations.
Recorded data analysis, examination and testing parachute manufacturer
21 September 2019 flight
The parachute manufacturer analysed the log file from the parachute system. This showed an extensive vibration pattern after 9000 on the ‘Time stamp’ x-axis (Figure 4), which subsequently triggered the parachute deployment. The vibration pattern changed after deployment of the parachute as the power to the aircraft motors was cut by the TerminateAir system.
Laboratory testing by the manufacturer of the parachute system did not reveal any electrical or mechanical anomalies. The system was serviced to allow it to be installed on a DJI Matrice 200 for flight testing. The flight computer elements were not modified and a dummy pyrotechnic device was installed. The first test flight produced a stable flight log and did not result in a parachute deployment trigger, despite a flight pattern involving rapid changes in altitude and acceleration.
The parachute manufacturer advised that vibration can arise due to an attachment problem between the SafeAir system and the UAS. To try and replicate the unusual vibration pattern seen during the accident flight, a second test flight was performed. For this flight, the four thumb screws which connect the parachute to its mounting legs, were intentionally loosened. This produced an extensive vibration pattern which triggered a parachute deployment signal (Figure 5). Unlike the accident flight, the vibration pattern continued after the parachute trigger, as the dummy pyrotechnic device prevented the parachute from deploying.
The parachute manufacturer concluded that it was highly probably that the cause of the parachute deployment on the 21 September 2019 accident flight was induced vibration due to loose attachment of the SafeAir unit to the aircraft.
29 November 2019 flight
The parachute manufacturer analysed the log files from the parachute system and the aircraft and stated that both files were similar, with identical altitude and acceleration, until the point of parachute deployment. The aircraft’s data log ended at cruise altitude, while the parachute system log (Figure 6) continued to record a fall in altitude, followed by the parachute deployment, which was characterised by erratic altitude and acceleration readings, before a constant rate descent to the ground.
The parachute manufacturer noted several warnings/errors in the aircraft’s flight log and it considered that the sudden end of the aircraft’s data log could be explained by a total aircraft power failure. It therefore did not examine the SafeAir system and no test flights were performed.
AAIB review of aircraft on-board recorded data
A review of the aircraft system’s logged data for both flights was made by the AAIB and comparisons were made with SafeAir logged data provided by the parachute system manufacturer. As detailed in AAIB report AAIB-26256, published in Bulletin 2/2021, alignment of the aircraft and parachute system data was difficult to establish and hindered the investigation’s ability to identify the reason for the parachute deployments. Specifically, for the 21 September 2019 flight, as no copy of the aircraft’s flight log was available to analyse, the only data available was that recorded in the aircraft controller log file. This log file only records basic flight parameters and does not record any that are common with the parachute system log that could be of use, such as accelerations, to accurately correlate both sets of data. However, it does record status messages of the system including warnings.
21 September 2019 flight
The recorded aircraft data confirmed that the recording ended abruptly after about 65 seconds of flight with the aircraft in the hover about 100 m above the ground, and at which point the energy level (state of charge (SOC)) of the aircraft’s batteries was 96% (Figure 7). Not shown in Figure 7 is the aircraft’s vertical velocity which changes from zero (whilst the aircraft is hovering) to 0.4 m/s in a downward direction over the last 0.2 s of recording. No warnings were recorded in the aircraft’s controller log file.
The acceleration recorded by the parachute system is also plotted in Figure 7 and shows that the amplitude of the oscillations in acceleration appear in places to be biased below 9.81 m/sec2 (1g) and dropping briefly below the 3 m/sec2 trigger threshold about 20 times.
29 November 2019 flight
The recorded aircraft data confirmed that the recording ended abruptly after about 75 seconds of flight with the aircraft in the hover about 93 m above the ground, and at which point the energy level (state of charge(SOC)) of the aircraft’s batteries was 94% (Figure 8).
Figure 8 also shows some of the warnings recorded in the aircraft controller log3. These included seven ’Propeller Fell Off’ warnings, prior to takeoff, three of which also contained the message ‘Drone is Vibrating. Not Enough Force/ESC Error.’ After takeoff there were another 15 ‘Propeller Fell Off’ warnings, 12 of which contained the message ‘Drone is Vibrating. Not Enough Force/ESC Error’. Some of these also contained the message ‘Barometer is Dead in Air. Motor is Blocked’.
Figure 8 also compares the aircraft’s altitude and acceleration data with the equivalent data from the SafeAir log file. It shows that as the flight progressed, the acceleration recorded by the SafeAir system grew in amplitude compared to that recorded by the aircraft. The two data sets were aligned to within 10 ms at the start and throughout most of the recording, by matching the acceleration peaks and troughs associated with level changes in altitude. The accelerations throughout the flight were generally smaller in amplitude than those of the 21 September 2019 accident flight shown in Figure 7 and did not suggest the presence of excessive vibration.
Figure 9 is a close up of the end of the aircraft data and when the parachute was deployed. The aircraft data shows that all four motors started to slow down over the last 0.1 s of recording with a corresponding decrease in the height and acceleration. The drop in the aircraft’s acceleration is similar to that recorded by the parachute system; however, they are misaligned by about 150 ms. The parachute system’s acceleration continued the fall below the parachute trigger threshold where it remained for 300 ms before triggering the TerminateAir and then deploying the parachute 50 ms later.
Information from the operator
The operator used the SafeAir fitted to the DJI Matrice 200 as an additional safety mitigation when conducting aerial surveys in densely populated areas. It has extended visual line of sight (EVLOS) permissions to allow it to conduct such operations.
Prior to the 21 September 2019 flight, approximately 11 hours of flight time had been accumulated without incident on the aircraft with the SafeAir fitted, over the preceding year. This included a mix of manually flown and autonomous flights conducted at different weights.
The pilot reported that prior to the 21 September 2019 flight, the aircraft had been prepared for flight in accordance with its pre-flight procedures, which included a check that the thumbscrews for the parachute system were tight. When the aircraft was recovered following the accident, the SafeAir unit appeared securely attached and the thumbscrews were tight. The security of the parachute mounting structure was not checked before or after the flight, as there was no specific requirement to do so.
When the aircraft was returned to the operator in November 2019, following repair by the aircraft manufacturer, the operator inspected the SafeAir mounting legs and noted that the attachment screws were loose and had not been installed in accordance with the SafeAir installation guide. Spring washers were missing from four of the screws and flat washers were missing from the other two screws. It was highly likely the mounting legs had been removed during the repair at the aircraft manufacturer’s facility and so the post-repair condition of mounting leg attachment screws and washers did not provide an indication of their pre-accident condition.
The operator subsequently removed and replaced all the SafeAir mounting leg attachment screws and washers and added a thread-locking compound to the screw threads. It amended its pre-flight procedures to check the security of mounting leg screws and correct fitment of washers. It also updated its maintenance procedures to document when the SafeAir mounting legs were fitted and removed. These actions were taken prior to the 29 November 2019 flight.
Information from the parachute manufacturer
21 September 2019 flight
The parachute manufacturer stated that the effectiveness of all attachment screws had been demonstrated during the several hundreds of flight hours accumulated by the SafeAir M-200. It indicated that screws that were not properly tightened could become looser during flight due to aircraft’s vibrations. The SafeAir M200 installation guide included a pre-flight requirement to check the thumb screws were ‘firmly closed’.
The parachute manufacturer did not specifically flight test the system with loose mounting leg attachment screws, but it considered this would create a similar vibration pattern to that demonstrated by loose thumb screws. It did not consider it necessary to introduce a torque requirement for the mounting leg attachment screws, indicating that a pre-flight check to make sure the screws were secure would be sufficient. Accordingly, it amended the pre-flight check in the installation guide to also check the security of the mounting leg attachment screws.
Information from the UAS manufacturer
The UAS manufacturer advised that it is sometimes necessary to remove hardware associated with parachute systems when aircraft are repaired or serviced. It stated that its repair staff are not qualified on such external elements and cannot therefore guarantee the airworthiness of such external systems after repair. The UAS manufacturer recommends additional service by certified personnel if they have been worked on/removed by repair staff.
Despite several requests the UAS manufacturer did not provide any other data relevant to the parachute deployment events.
Reported Cause
Analysis
21 September 2019 flight
Following the first accident on 21 September 2019, a review of the parachute system on-board recorded data identified the presence of a strong vibration pattern. A test flight conducted with intentionally loosened mounting bracket thumb screws produced a similar vibration pattern to that seen during the accident flight.
The operator indicated that the thumbscrews had been correctly tightened when the parachute was fitted prior to the flight and were confirmed to be tight when the parachute system was removed after the accident. The parachute mounting legs and attachment screws were not specifically checked, but these screws were subsequently found to be loose with incorrect washer configurations when the aircraft was returned after repair. It is likely that the mounting legs were removed and improperly reassembled during the repair, so nothing could be deduced about the pre-accident condition of the attachment screws. However, the parachute manufacturer advised that the expected vibration pattern arising from loose mounting leg attachment screws would be similar to that arising from loose thumb screws. The parachute mounting legs had not been disturbed between the four uneventful morning flights and the accident flight, but had they been slightly loose to start, they could have become progressively more so during the flights, due to normal aircraft vibrations.
The AAIB independently reviewed both the recorded data from the aircraft controller and parachute system. The limited aircraft flight data meant that the investigation was unable to determine the aircraft’s performance and attitude when its recording stopped, and how this compared with data from the parachute system data. The accelerations recorded from the parachute system were, however, large in amplitude compared to what would normally be experienced and recorded by the aircraft. As discussed in AAIB report AAIB-26256, the accelerations are measured in different places by the two systems and so differences are expected which the 300 ms trigger delay tries to mitigate against to avoid false positive detections. No warnings were issued by the aircraft and the battery energy levels were above 95% so there is no evidence to suggest the aircraft was experiencing a problem; however, access to the aircraft’s flight log would have allowed a more complete assessment.
29 November 2019
The AAIB independently reviewed both the recorded data from the aircraft and parachute system. There were numerous warnings issued by the aircraft stating that the aircraft was vibrating and that a propeller had fallen off before and after takeoff. These warnings were inconsistent with the acceleration data recorded by the aircraft and the fact that the aircraft was able to get airborne and were therefore considered spurious. The flight did not exhibit the same vibration pattern as the first accident. The drop in motor rpm, acceleration and height during the last 0.1 s of recording could be an indication of the aircraft losing power; however, no related warnings were issued to indicate there was a problem. The batteries had 94% SOC remaining when the flight ended. Additionally, following the accident the aircraft was started and operated using the same battery set; this appears inconsistent with a total power loss.
Without additional information from the UAS manufacturer, particularly about the meaning and validity of the warnings, it was not possible to establish the reason for the sudden termination of the flight or whether there were any common causal factors between both accidents. An absence of information from the UAS manufacturer also impeded identification of a definitive cause during the investigation of a ballistic parachute deployment to a DJI Matrice 210, which is reported in AAIB report AAIB-26256, published in AAIB Bulletin 2/2021.
Support to accident investigations
For accident investigations to be effective, access to relevant technical information from aircraft manufacturers is often essential to assist investigators in understanding the causes of the accident and identifying areas which would benefit from safety improvement.
The AAIB has actively investigated UAS accidents since 2015 and has experienced varying degrees of support from UAS manufacturers. Several of those investigations have involved the UAS manufacturer referenced in this report. AAIB Report EW/G2018/09/04, published in AAIB Bulletin 11/2019 involving an accident to a DJI Matrice 210, provides an example of effective engagement with this UAS manufacturer which enabled the investigation to fully understand the aircraft battery issues being investigated. The report documents the safety actions taken by the manufacturer to develop and roll out firmware changes for the battery and aircraft.
Increasingly the UAS accidents investigated by the AAIB involve those engaged in commercial operations, which is reflective of the rapid growth of such operations in the UK. Until 31 December 2020, UAS operators carrying out commercial operations in the UK required a Permission for Commercial Operations (PfCO) issued by the Civil Aviation Authority (CAA), of which at the time of writing 6,074 had been issued4. The rapid growth in UAS commercial operations is not unique to the UK, and safety investigation authorities in other States are also beginning to investigate UAS accidents. Despite their use in commercial operations, it is acknowledged that many small UAS fall into the category of consumer electronics, which are not required to be certified and have product life cycles much shorter than those of manned aircraft.
Therefore, it is recognised that UAS manufacturers may not be structured or resourced to provide detailed technical support to investigations. Nonetheless, when engagement with an aircraft manufacturer is not effective, the ability to learn from accidents may be compromised and the opportunity to improve flight safety lost.
Therefore, the following Safety Recommendation is made:
Safety Recommendation 2020-016
It is recommended that DJI introduce an effective system for providing timely technical support to State safety investigations.
Conclusion
Two separate routine flights of an unmanned aircraft terminated prematurely when the ballistic parachute recovery system activated. The first accident most likely occurred due to excessive vibration as a result of the parachute system not being securely attached to the airframe. The investigation was unable to establish the cause of the second accident.
The investigation was limited by the availability of recorded flight data for the first accident. Without additional information from the UAS manufacturer it was not possible to establish if there were any common factors between the two accidents.
Safety Actions
In response to the first accident, the parachute manufacturer amended the pre- flight checks in the SafeAir M200 installation guide to check the security of the mounting leg attachment screws.
In response to the first accident the operator:
● added a thread-locking compound to the screw threads of the parachute mounting leg attachment screws.
● amended its pre-flight procedures to check the security of mounting leg screws and correct fitment of washers.
● updated its maintenance procedures to document when the parachute mounting legs were fitted to and removed from the aircraft.
● identified that further emphasis on wind speed and direction was required prior to launch, to provide greater understanding of the drift potential in the case of a parachute deployment.