What happened
On 24 October 2016, the operator (pilot) of a Lockheed Martin Stalker eXtended Endurance (XE) unmanned aerial system (UAS), configured in vertical take-off and landing (VTOL) mode,[1] prepared to conduct a demonstration flight at Mount Disappointment, Victoria.
Figure 1: VTOL Stalker XE
Source: Lockheed Martin Corporation. All rights reserved. Copyright 2017.
The previous day, the operator had loaded the latest autopilot software onto the aircraft’s main autopilot. One aim of the flight was to demonstrate the use of a particular radio frequency for the command and control communication link. The ground radio equipment incorporated a narrow beam width directional antenna.
The operator programmed a simple mission: launch segment to a first waypoint and one primary waypoint, which was a coordinate centred on the launch location, then a landing pattern and an alternate landing pattern.
The crew then conducted a physical inspection of the aircraft and ensured all was mechanically correct. They also completed the pre-flight checks. The operator then commanded the aircraft to launch. All four vertical-lift rotors were energised, and the aircraft lifted off the ground. At about 20 ft above ground level (AGL), the aircraft paused in accordance with normal procedures, to conduct an airborne check.
The aircraft then climbed to about 300 ft AGL, which was the programmed transition altitude, but did not transition to forward flight. As the aircraft climbed above the ground antenna, it flew into a null in the antenna pattern above the antenna where communication between the ground control station (GCS) and the aircraft was interrupted.
The aircraft hovered and, after about five minutes, the operator commanded ‘abort’ from the GCS. At that time, the operator observed that communication with the aircraft had been lost and repositioned the antenna to point directly at the aircraft. After observing continued lost link indications for about 30 seconds, the operator enabled the alternate radio datalink, restoring communication with the aircraft. However, the previously selected ‘abort’ command was unavailable for re-issue after the initial selection.
About 11 minutes after launch, the aircraft’s power failed, the vertical propellers stopped, and the aircraft pitched about 95 degrees nose down, descended vertically and collided with the ground.
The aircraft sustained substantial damage.
Vertical take-off and landing (VTOL) configuration
In the VTOL configuration, four vertical lift motors are fitted in addition to a conventional tractor motor/propeller. The aircraft takes off vertically and then transitions to horizontal flight at a set altitude. Following the period of horizontal (fixed-wing) flight, the aircraft transitions back to vertical flight for landing.
Transition altitude
The typical time needed to climb to departure altitude and transition to forward flight is less than 1 minute.
The transition altitude is specified by the operator and is usually 150-200 ft higher than any nearby obstacles. In this incident, the operator had selected 300 ft due to trees about 100 ft high in the vicinity. The lower the transition altitude, the less time is required in the VTOL configuration, which requires substantially more power (and therefore battery) than the more efficient forward flight.
Post-accident inspection
Following the accident, an inspection revealed that the aircraft’s negative main power cable was unsoldered and had separated from its pin in the main power connector, which was plugged into the aircraft’s battery. The operator’s investigation found that the connector had failed before the aircraft battery drained.
Loss of electrical power
The wiring in the VTOL aircraft configuration was designed to supply vertical climb power for 2 minutes and the system had been validation-tested for 3 minutes at that power setting. The battery connector wiring in the accident aircraft failed 11 minutes into flight, resulting in total loss of electrical power and loss of aircraft control.
Flight data
According to the recorded flight data, the data link was interrupted about 1 minute and 20 seconds after launch. Two seconds later, an aircraft software lost-link contingency response automatically issued a command to latch the current altitude command, navigate to the launch point, descend and land.
However, 1 second after the lost link contingency command was issued, an additional spurious command was issued. This inappropriate spurious command caused the aircraft to remain in an extended hover and prevented the operator from further affecting aircraft operation, even after re-establishing data link communications. Extended operations at hover power, well beyond electrical power supply system design limits, overheated the wiring and resulted in a connector failure causing interruption of the battery power supply and subsequent loss of aircraft control.
Software error
The system manufacturer found that an inappropriate spurious command issued by the aircraft software was due to a coding error in the VTOL software that had not been detected during testing.
Communications
Communication between the GCS and aircraft is not required for flight. If communication between the GCS and aircraft is lost during flight, the autopilot continues to fly the aircraft according to programmed contingency logic. If communications are lost for more than 5 seconds during the VTOL launch phase, contingency logic commands the aircraft to return to the launch point, descend and land.
Landing/emergency command options
Having commanded ‘abort’, the operator thought that the command would continue to be sent to the aircraft after communications were restored until the aircraft acknowledged receipt of the command. This did not occur. In the launch phase, the ‘abort’ command should cause the aircraft to navigate to the launch point and descend vertically to the ground.
No other appropriate commands were available to the operator.
Findings
These findings should not be read as apportioning blame or liability to any particular organisation or individual.
- Communication between the GCS and aircraft was lost for about 5.5 minutes during the launch phase, due to the aircraft flying into the null in the antenna pattern above the antenna.
- A return to launch command was issued by the autopilot due to loss of communications, but was not completed, because a spurious command was issued due to a coding error.
- After 11 minutes at vertical climb power, the high current overheated the wiring. The heat unsoldered the negative main power cable resulting in a total loss of electrical power.
- The total loss of power resulted in a loss of control and the aircraft collided with the ground.
Safety action
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following safety action in response to this occurrence.
UAS manufacturer
As a result of this occurrence, Lockheed Martin has advised the ATSB that they are taking the following safety actions:
Software redesign
The software is undergoing testing, redesign and a review of contingency management in VTOL modes.
Safety message
This occurrence highlights the importance of UAS software testing to cover potential non-normal scenarios prior to release into operation.
Aviation Short Investigations Bulletin - Issue 59
Purpose of safety investigationsThe objective of a safety investigation is to enhance transport safety. This is done through:
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. TerminologyAn explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing informationReleased in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2017
Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly. |
__________