Collision with terrain involving an Insitu ScanEagle X200 unmanned aircraft system (UAS), near Woleebee Creek, Queensland, on 9 January 2019

What happened

On the morning of 9 January 2019, the Insitu Pacific (the operator) crew prepared to conduct a 4‑hour ‘beyond visual line of sight’ survey flight, in the Woleebee Creek area, about 350 km west‑north‑west of Brisbane, Queensland. The flight was being conducted by an Insitu ScanEagle X200 (X200).

The crew consisted of two remote pilots^[1] (one acting as mission controller/pilot in command and one acting as pilot flying) and two ground crew (who were also qualified remote pilots).^[2] The two pilots for this flight were located in the ground control station (GCS).^[3] Headsets were worn by all crew members, to enable effective communication. All crew reported to being ‘refreshed’ and looking forward to the day’s flight.

The X200 was launched at 0825 Eastern Standard Time.^[4] The crew described the launch as ‘textbook’. The secondary ground crew member maintained visual contact with the X200, typically done until advised by the pilots that they had video feedback from the on-board camera.^[5] He reported that, about one minute after launch, the X200 pitched up ‘quite high’, before entering an aerodynamic stall.^[6] He immediately advised the pilot flying (PF) with the standard phrase ‘wings level, wings level, you’re stalling’. At this time, the primary ground crew member also observed the X200 in a ‘left-hand spin’ and advised the PF ‘you’ve stalled, wings level, wings level’.

At the same time, the GCS identified the stall condition and projected the ‘stall-spin’ emergency procedures checklist to the display. The PF commenced the checklist items, however the X200 self‑recovered before the checklist was completed. The ground crew reported the X200 recovered ‘low to the ground’ and then commenced a climb to return to the programmed flight altitude.

At about the time of the recovery from the first stall, the GCS initiated the warnings and emergency procedures checklist for an ‘airspeed failure’. Upon the mission controller’s direction, the PF commenced the airspeed failure checklist. The ground crew reported that following a ‘steep’ climb, the X200 was then observed to be ‘porpoising’ (oscillating in pitch) while it continued to the first programmed waypoint. Shortly after this, the X200 flew beyond visual sight of the ground crew.

Telemetry data showed that, about 90 seconds after the first stall, the X200 entered a second stall. The X200 self-recovered again, at about 150 ft above the ground, and commenced a climbing orbit. After about 30 seconds, the X200 entered a third stall and impacted the ground eight seconds later. The mission controller advised the ground crew that the X200 had been lost. Total flight time was less than four minutes and distance from the launch site to the collision with terrain location was about 4.75 km (Figures 1 and 2).

Figure 1: X200 flight path

Source: Insitu Pacific and Google Earth, modified by the ATSB

Figure 2: X200 flight profile

Source: Insitu Pacific and Google Earth, modified by the ATSB

Post-accident recovery and inspection

The aircraft impacted the ground near vertically, there was no post-impact fire and the X200 was destroyed. There was no evidence of in-flight break-up or collision with vegetation or infrastructure prior to the impact. In addition, there were no reported injuries. The operator conducted an examination of the occurrence X200 and identified a partial blockage in the pitot system, which was subsequently confirmed by the manufacturer. The blockage appeared to be a combination of a section of O-ring debris and grease.

Flight operations

The Civil Aviation Safety Authority (CASA) issued the operator with an authorisation to operate the X200 beyond visual line of sight, within a defined area. Some of the authorisation’s requirements included:

• all remote pilots were to hold a CASA authorisation
• a mode C transponder^[7] was to be operational, and transmitting accurate barometric altitude, on all flights
• a primary and secondary ‘fail safe’ mode to ensure that, in the event of data-link loss, the X200 did not depart the area of operation and would land at a pre-determined location
• air traffic control at Brisbane was to be advised of the intended operation 15 minutes prior to launch, and the crew were to maintain standard airspace radio procedures for the duration of the flight
• the operator was to ensure a current Notice to Airmen (NOTAM)^[8] was active for each operation
• the X200 was only to be operated in visual meteorological conditions.

In addition to the CASA authorisation, the operator’s procedures included:

• no flight over populous areas
• operations were conducted at altitudes intended to avoid agricultural and passenger aircraft.

Remote pilots underwent a 10-week course prior to being endorsed to operate the X200. This course included a theory component and time in the simulator. The pilots recalled that ‘airspeed failure’ was included in the course, however they felt that particular emergency procedure wasn’t focussed on as ‘heavily’ as others.

The accident site was located within the defined operational area, which was in accordance with the authorised requirements.

Aircraft information

The ScanEagle is a small, long-endurance, low-altitude unmanned aerial system (UAS) built by Insitu, a subsidiary of Boeing, and is used for defence and civilian applications (the X200 variant). The X200 (Figure 3) has a wingspan of 3.1 m, a length of 1.6 m, maximum take‑off weight of about 23 kg and a typical cruise speed of 50-60 kt.

The nose module (payload) on the X200 is interchangeable, depending on the type of mission being flown, and was supplied by the payload manufacturer. The payload fitted to the X200 at the time of the occurrence consisted of a camera assembly located in an articulated turret (turret). The camera could be directed through a defined fore/aft arc and the turret rotated through 360˚.

The pilot controls the X200 entirely through the aircraft autopilot from launch until recovery. The aircraft’s flight path is controlled by position, altitude and airspeed commands through the remote pilot station computer (part of the ground control station), which is then sent to the aircraft autopilot. The pilot does not have a control yoke, or equivalent, that links directly or indirectly to the aircraft control surfaces.

Typically, once the X200 has launched, the pilot commands it through a pre-planned sequence of locations and orbits around each location of interest. At the completion of the flight’s activities, the pilot would position the aircraft in preparation for the recovery phase using the same method of control. In this instance, the emergency procedure checklist actions involved the pilot utilising additional X200 autopilot control laws in order to negate the erroneous airspeed information.

Figure 3: X200 with articulated turret

Source: Insitu Pacific, modified by the ATSB

Pitot-static system

The pitot-static system senses ram air pressure through the pitot probe (on the forward face of the payload) and static air pressure through the static ports (on each side of the payload). The two pressures are used to calculate true airspeed (TAS) and barometric altitude (Alt). The autopilot uses this data to calculate the minimum and maximum airspeed in relation to the weight of the X200 and to maintain controlled flight.

The pitot and static tubes for the X200 were routed from the pitot probe and static port through the turret and connected to the pitot-static tubing in the fuselage. If not correctly oriented during assembly, the tubes could become pinched, blocked or damaged with turret operation. Obstructed pitot-static tubes have the potential to cause incorrect TAS and Alt calculations, affecting autopilot operation.^[9] In addition, the TAS and Alt indications to the pilots would also be unreliable. The manufacturer alerted X200 operators to this potential condition in November 2017, via both a service advisory and an operational advisory. Damage sustained to the X200 during this occurrence prevented testing for possible turret interference.

The service advisory (SA) provided expanded procedures for pitot and static tube routing and connection, and inspection procedures if an anomaly was identified during pre-flight checks. A review of the X200 maintenance records showed the turret had been installed as per the SA in July 2018. Since then, it had been operated for about 80 hours, without indication of turret interference.

The operational advisory (OA) included:

• information about how to identify and troubleshoot different types of incorrect TAS and Alt indications on the ground and in-flight
• a pre-flight function test to identify incorrect TAS and Alt indications shown on the ground control station (GCS) program
• in-flight emergency procedures to normalise the incorrect TAS and Alt indications and avoid loss of controlled flight.

The function test was to be completed before every flight and the OA provided examples of how anomalies with the pitot-static tubing may appear on the GCS display. Where inspection and routing of the pitot-static tubes did not rectify the anomaly, the turret was to be replaced prior to next flight. The OA procedures had been incorporated into the GCS program at the time of the occurrence.

In addition, the payload manufacturer identified a quality issue with the turret assembly procedures that had the potential to induce a blockage in the pitot system. The operator identified that the occurrence X200 was affected by this quality issue, consisting of excess grease and O‑ring debris forming the pitot-system partial blockage. The X200 manufacturer published procedures to inspect (and, if required, clean) turrets that were in-service and prior to fitment. The operator examined the remainder of their fleet with these revised procedures, with no further occurrences identified.

Pre-flight checks

As part of the pre-flight procedures, the primary ground crew conducted an inspection of the X200 while the secondary ground crew readied the launcher and recovery systems. At the same time the pilots, located in the GCS, conducted their pre-flight systems checks, which included a function test of the pitot-static system (Figure 4). This test included the primary ground crew fitting a sealed clear tube to the pitot probe, which increased pressure in the system and simulated an airspeed indication associated with forward flight (equivalent to TAS). The procedure stated that any reduction in pressure (TAS) indicated on the GCS during the test, equal to or greater than the specified limits, was indicative of a system leak that required rectification prior to flight.

During the test, a slow rise of about 10 kt TAS occurred, while the indicated altitude remained steady. The OA detailed that if the TAS ‘increases slowly without turret movement or pressurisation of the pitot-static system’, this was an indication of a blockage in the pitot-static system. As per the OA, turret movement had the potential to induce a restriction in the pitot system tubing, which could ‘clear’ with subsequent movement. The pitot system was pressurised and the turret was being operated for part of this test and as such, the rise in TAS as a possible indication of a blockage may have been difficult to identify. Following this occurrence, a revised OA amended the criteria for the slow increase in TAS to show ‘at any time’ during the procedure, removing any ambiguity surrounding pitot pressurisation and turret movement during the tests.

With no pitot system leak identified by the pilots, the tooling was removed. At this time, the pilot flying (PF) commented that the TAS was ‘slow to release’ (return to pre-check indication). The primary ground crew member reported that he heard this comment however, he took no action as he wasn’t aware of the significance of this indication. The pilot pre-flight checklist identified that slow to release pressure was indicative of a blockage in the pitot system.

Following completion of the crew’s pre-flight checks, the GCS continued with the system self‑checks, while the crew met outside for a pre-mission brief, as per their standard procedure. During the time the crew were outside, the GCS self-check indicated an anomaly within the pitot‑static system. In this instance, there was an increase over time in TAS, while the Alt decreased. For this indication, the procedures required an inspection of the pitot-static system prior to launch. However, this indication was not flagged or latched.^[10] Therefore, when the pilots returned to the GCS, there was nothing to alert them to this additional indication of a pitot system anomaly.

Figure 4: Pitot pressure test indications

Source: Insitu Pacific, modified by the ATSB

All subsequent pre-flight checks were described as normal. Weather conditions at the time were recorded as overcast conditions, 22˚C, a wind speed of about 6 kt and were described by the crew as ‘ideal’.

Autopilot and the occurrence flight

The X200 autopilot control loops rely on airspeed to control altitude. The target airspeed for the occurrence flight was 53 kt. Recorded data shows that following launch, the TAS reached 70 kt. This resulted in the autopilot commanding a rapid pitch up to try to arrest the perceived high TAS. The pitch attitude was too great for the actual airspeed, which resulted in the X200 entering an aerodynamic stall. Stall recovery took 12 seconds, with an altitude loss of 579 ft (at a rate of 48 ft/s), before the X200 began to climb back to the programmed flight altitude.

Erratic TAS is one of the parameters that can lead to a stall-spin in the X200. Flight data showed that erratic TAS was present from launch, before the turret was unlocked and operated. This was consistent with a blockage of the pitot system, rather than turret interference.

The erratic TAS also resulted in the porpoising flight profile following the first stall and recovery. Following about 80 seconds of porpoising flight, the data showed another rapid increase in TAS. The autopilot likely commanded the X200 to increase pitch attitude, which again resulted in an aerodynamic stall and rapid reduction in height. Within 12 seconds, the X200 had again self‑recovered from the stall, but at a much lower altitude than the first recovery. The second stall required 778 ft for self-recovery (at 64.83 ft/s rate of altitude loss).

This was followed by another extreme increase in TAS, leading to the third stall. This stall was at a similar rate to the second stall. Recovery was again initiated but only 591 ft was available and the X200 collided with terrain, about 9 seconds later (Figure 5).

Figure 5: Flight data showing erratic indicated airspeed and altitude

Source: Insitu Pacific, modified by the ATSB

Safety analysis

Following launch, the Insitu ScanEagle X200 (X200) twice entered an aerodynamic stall and self‑recovered. The X200 entered a third stall, this time at a lower height, and did not recover prior to collision with terrain. The analysis will examine the pre-flight indications of the pitot system blockage and its effect on the flight.

Pre-flight checks

The pre-flight checks provided three opportunities for anomalies in the pitot static system to be detected. There was a slow rise in TAS, which was indicative of an anomaly in the pitot system. The pressurisation of the pitot system and movement in the turret during the pitot-static function test, however, may have meant that the slow rise in TAS and the physical blockage was not obvious. The slow reduction in TAS after the pressure test was an indication of a pitot system blockage. This was noted by some of the crew, however the significance of this indication was not recognised.

The ground control station (GCS) system self-checks showed an additional indication of a pitot system anomaly, however it was not observed by the crew, as they were carrying out other duties at the time. At the completion of the self-checks, there was no ‘flag’ or other indication on the GCS that the pitot system irregularity had occurred. This resulted in the indications of pitot system anomaly not being identified by the crew or flagged by the GCS, resulting the X200 being launched with a blockage in the pitot system.

Unreliable airspeed data

The X200 autopilot uses true airspeed (TAS) and altitude (Alt) data to maintain controlled flight. The blockage in the pitot system resulted in unreliable airspeed data being provided to the autopilot, affecting calculation of TAS. While there remained the possibility that the turret interference may also have been present, it could not be determined as contributory in this occurrence. Flight data showed that erratic (TAS) data was present from launch, before the turret was unlocked and operated. Subsequent movement of the turret may have alleviated any turret‑induced restriction in the pitot system but due to the presence of the identified blockage, the airspeed data was unreliable even without any turret interference.

Following launch, the autopilot interpreted the TAS as increasing and increased the pitch (nose up) to maintain target airspeed. This resulted in the X200 nose-up attitude being too great for the actual airspeed and led to an aerodynamic stall. The X200 self-recovered and recommenced the climb to operating altitude.

Following recovery from the first stall, flight data showed the TAS was oscillating by up to 30 kt, resulting in the ‘porpoising’ flight profile, indicative of the autopilot trying to maintain controlled flight using unreliable airspeed data. A rapid 30 kt increase in TAS likely led to the autopilot increasing pitch attitude, resulting in the second aerodynamic stall. Again, the X200 self-recovered, however at a much lower altitude. A third rapid TAS increase followed shortly after, leading to the final stall, with insufficient height available for recovery.

Findings

These findings should not be read as apportioning blame or liability to any particular organisation or individual.

• Erroneous airspeed system indications during the pre-flight checks were not identified by the crew or flagged by the ground control station, resulting in the X200 being launched with an unserviceable pitot-static system.
• A blockage in the pitot-static system resulted in unreliable airspeed data being supplied to the autopilot.
• Unreliable airspeed data led to the X200 entering an aerodynamic stall at a height that was insufficient for recovery.

Safety action

Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence.

The operator

As a result of this occurrence, the operator advised the ATSB that the following safety actions, in cooperation with the X200 and payload manufacturers, have been undertaken:

Pilot training

Following the occurrence, all of the operator’s remote pilots underwent refresher training with a focus on identification and emergency procedures regarding incorrect true airspeed (TAS) and/or barometric altitude (Alt) indications. The training consisted of theory (including ‘how’ the system works and symptoms of pitot-static blockage) and several hours’ simulator experience of failures and use of emergency procedures. Feedback from the pilots following this training was positive. In addition, the ATSB was advised that the X200 manufacturer will amend the ab-initio pilot training to highlight pitot-static system anomalies and associated pre- and in-flight procedures.

Training and enhanced procedures can provide ‘reasoning’ behind the steps. This can assist pilots and maintainers in their understanding of indications and events, prompting effective actions and timely resolution.

The manufacturer

Documentation and procedures

The X200 manufacturer published a revised Operational Advisory (OA) on 18 February 2019. One amendment in this revised publication was the inclusion of an image from the occurrence X200, showing the Ground Control Station indication for ‘slow to release’ pitot pressure. The criteria for the slow increase in TAS was also amended to ‘at any time’ during the procedure, removing any ambiguity surrounding pitot pressurisation and turret movement during the tests.

In addition, the revised OA included an additional caution (in red text) warning that the ‘TAS error exceeds launch limit alarm is disabled for pre-flight pitot-static system checks. Therefore, it is critical to monitor the TAS-ALT-Tachometer plot throughout the on ground phase for any abnormal TAS or Alt signatures’. The operator reported that the X200 manufacturer advised a ‘latching system alarm’ would be incorporated into the next software release (scheduled for mid-2019) to alert the crew where the TAS has exceeded a threshold during on-ground checks.

Further, the manufacturer revised their procedures for assembly of the turret and provided a reworked procedure to X200 operators to reduce the risk of in‑service aircraft being affected by a pitot blockage.

__________

1. A remote pilot licence (RePL) is required for commercial operations involving remotely piloted aircraft systems (RPAS) that are greater than 2kg maximum take-off weight.
2. Minimum crew for a deployment consisted of two pilots and one ground crew. When teams consisted of two ground crew, they were identified as primary and secondary. The secondary crew member assisting the primary as directed.
3. The computers and associated equipment required for flight operations were located in a converted climate-controlled shipping container and collectively known as the GCS. The pilots were located in the GCS for the entire flight, including launch and recovery. The launch and recovery sites were determined each mission and located to best suit the weather and intended flight, which could be some distance from the GCS.
4. Eastern Standard Time (EST): Coordinated Universal Time (UTC) + 10 hours.
5. The GCS provided location information via GPS and maps. The video feedback provided additional situational awareness for the pilots.
6. Aerodynamic stall: occurs when the airflow separates from the wing’s upper surface and becomes turbulent. A stall occurs at high angles of attack, typically 16˚ to 18˚, and results in reduced lift.
7. A mode C transponder transmits both aircraft identification and altitude.
8. A NOTAM advises personnel concerned with flight operations of information concerning the establishment, condition or change in any aeronautical facility, service, procedure, or hazard, the timely knowledge of which is essential to safe flight.
9. ‘TAS’ terminology in the remainder of the report refers to the TAS calculated from the unreliable pitot pressure (airspeed) data.
10. A flag, or latch, is a special mark indicating that a piece of data is unusual. This alert will remain, even if the event has passed, until a clearing action has been conducted by a member of the crew.