Safety summary
What happened
On the morning of 15 January 2021, a DJI Inspire 2 remotely piloted aircraft (RPA) was being used for aerial photography and videography above Cockle Bay in Darling Harbour, Sydney. A short time after take-off the RPA unexpectedly accelerated away from the pilot. The pilot attempted to control the RPA and arrest its movement however, the aircraft was unresponsive to control inputs. The aircraft continued to accelerate to its maximum speed while flying away from the operator and towards nearby buildings. A short time later the RPA struck, and shattered, the window of a hotel adjacent to Darling Harbour. An occupant of the hotel received minor injuries from flying glass and the RPA was destroyed.
What the ATSB found
The ATSB found that shortly after take-off for the second flight of the day, the compass on the RPA failed due to electromagnetic interference. This resulted in the aircraft becoming unresponsive to control inputs leading to the collision with a building. Although not triggered in this occurrence, the failure of the compass also disabled the Failsafe return to home function. Thus, the failure of the compass had the two-fold effect of rendering the aircraft uncontrollable while simultaneously disabling the failsafe designed to prevent a fly away occurrence.
Although not contributory to this occurrence, the ATSB also found the pilot did not follow the operator’s emergency procedures or comply with the regulators operational permissions to fly in restricted airspace.
What has been done as a result
Following a review of this occurrence, the manufacturer updated the user manuals of a number of products, including the Inspire 2. These changes provide additional guidance to users regarding the use of the fully manual attitude flight mode in the event of compass interference.
Safety message
While the reliability of Remotely Piloted Aircraft (RPA’s) is generally high, they are not infallible. Occurrences reported to the ATSB indicate that RPA fly-away occurrences are not rare. It is therefore important that pilots ensure they are familiar with and well drilled in emergency procedures, as well as being proficient in flying in all flight modes. In the case of an RPA fly‑away, whether it be due to a compass failure or loss of signal, there may only be a few seconds in which a pilot can take avoiding action. In the event of a compass failure, switching to the fully manual attitude flight mode may assist regaining control of the RPAS. Whereas, following a loss of signal to the RPA, the last remaining risk control to prevent a fly away are built-in design features such as the Failsafe Return to Home.
Remote pilots are also reminded that adhering to operational guidelines and limitations remains important for ensuring the safe operation of RPAs. This is particularly true in populated areas, where risks are potentially elevated. Adhering to the limitations and guidance provided by the regulator will ensure these risks remain as low as reasonably practicable.
On the morning of 15 January 2021, the pilot of a DJI Inspire 2 remotely piloted aircraft (RPA) arrived at Darling Harbour, New South Wales (Figure 1) for the commencement of aerial work operations. The operator had been contracted to conduct aerial photography and videography in the Cockle Bay area within Darling Harbour.
Figure 1: Accident location
Source: Google Earth, annotated by ATSB
After being advised by the client that the subject was ready, the pilot set-up the RPA on the Cockle Bay marina (Figure 2) and conducted pre-flight checks. Pre-flight checks included checking for software updates, ensuring that GPS satellites were acquired, and checking the home point was set to the take-off location. It was reported that the first flight of the day commenced at about 1030 Eastern Daylight‑save Time[1] and lasted about 20 minutes.
Photographs and video of the subject were captured, and the RPA returned for an uneventful landing. The client advised that there would be an hour before the subject would be ready again, so the RPA was packed away. After receiving advice from the client advised that the subject would shorty be ready for photography, the RPA was once again set up. Fully‑charged batteries were installed, and the pre-flight checks were again conducted.
Figure 2: Area of operations
Source: Google Earth, annotated by ATSB
The second flight for the day was reported to have commenced at about 1145. The pilot reported taking-off the RPA and climbing to about 10 m. During this time the RPA’s retractable legs were raised. The pilot recalled pitching the RPA towards the subject and within about 5 m of travel the RPA had pitched over to about 30°‑ 40° and accelerated quickly. The pilot realised the behaviour of the RPA was abnormal and attempted to control the RPAS and stop it pitching however the control inputs from the pilot had no effect on the RPA and it continued to accelerate in the same direction.
The pilot reported that when the RPA was about 30 m away the screen on the transmitter froze then subsequently went black. As the RPA continued to fly away the pilot lost sight of it. Having realised the RPA had flown away, the pilot made phone calls to report the matter to the operator’s chief pilot and chief executive officer. The pilot then initiated a search for the RPA and was subsequently notified by the company’s chief pilot that the aircraft had collided with a hotel on the far (western) side of Darling Drive. The pilot proceeded to the hotel to brief hotel staff and New South Wales Police Force officers, before returning to Darling Harbour to complete the job using a back-up RPA.
__________
Aircraft details
General details
The Remotely piloted Aircraft (RPA) was a SZ Da-Jiang Innovations (DJI) Technology Co Ltd Inspire 2 (Figure 3).
Figure 3: DJI Inspire 2, shown in landing configuration
Source: DJI
The Inspire 2 is part of DJI’s professional product line and is designed for aerial photography and cinematography. The aircraft is a quadcopter measuring 42.7 cm in length, 31.7 cm in height and 42.5 cm in width (without propellers). The aircraft is constructed with a magnesium aluminium composite shell and carbon fibre arms holding the motors and landing struts. During flight these arms are raised to allow unobstructed viewing from the camera suspended by the gimbal below the aircraft. With both batteries and all four propellers (but without the gimbal or camera) the Inspire 2 weights 3.44 kg and it has a maximum take-off weight is 4.25 kg. The Inspire 2 has a maximum flight time of between 23 and 27 minutes, depending on the payload, and has a maximum speed of 94 km/h.
Flight sensors
The inspire 2 was fitted with a Vision System and Infrared[2] Sensing System. The Vision System consisted of two forward facing optical sensors and two downward facing ultrasonic sensors. The Infrared Sensing System comprised two upwards facing infrared sensors. These systems were utilised in certain flight modes (see the Flight modes section) for positioning and obstacle avoidance. The Assisted Braking from Obstacle Sensing function used these sensors to actively aerodynamically brake when obstacles were detected around the aircraft. However, this function was only effective at aircraft speeds up to 50 km/h.
Flight modes
The Inspire 2 could be flown in three different flight modes, P-mode (Positioning), A-mode (Attitude), and S-mode (Sport).
P-mode was the most automated of the three modes. In this mode the Global Positioning System (GPS), as well as the anti-collision sensors, were used to assist stability and navigation. This mode also made use of the aircraft’s failsafe features (detailed in the following section).
S-mode maximised the aircraft’s agility and speed while still using GPS for positioning. In this mode a number of the aircraft’s safety features, such as the forward and downward vision systems, were disabled. As a result, the ability for the aircraft to sense and avoid obstacles was not available in S-mode.
A-mode was effectively a fully manual mode that could be used when neither the GPS nor the Vision System were available. In this mode the aircraft could not position or auto brake and, due to the lack of GPS positioning, the aircraft’s position was also affected by wind. The manual stated that the aircraft would switch into A-mode in the following two instances:
Passive: When there is weak GPS signal or when the compass experienced interference where the Vision System is unavailable.
Active: Users toggle the flight mode switch to A-mode.
The pilot reported normally using P-mode, including on the day of the occurrence.
Return to Home function
The Inspire 2 had three types of return to home (RTH) functions that could return the aircraft back to the last recorded home point; Smart RTH, Low Battery RTH and Failsafe RTH.
- Smart RTH could be activated by either using the RTH button on the remote controller or taping the RTH button in the DJI GO 4 application.
- Low battery RTH would be automatically activated when the batteries are depleted to a point that may affect the safe return of the aircraft.
- The Failsafe RTH was designed to automatically return the aircraft to its home point in the event of a loss of controller signal. For this feature to work the home point was required to be set and the compass functioning normally. If these conditions were met, the Failsafe RTH would activate if the controller signal was lost for more than 3 seconds.
Compass
The Inspire 2 was fitted with a single magnetic field sensor compass. The compass fed data to the Internal Measurement Unit (IMU), which was used for flight control.
Wreckage and accident site information
The aircraft struck a window of a hotel on the western side of Darling Drive. The impact site was approximately 330 m from the take-off location. The impact of the aircraft shattered the window, causing an ingress of glass into the room however, the aircraft did not penetrate the window.
The sole occupant of the room sustained minor injuries from the flying glass and the aircraft was destroyed, coming to rest on a balcony below the window. The glass used in the window was 10.38 mm bronze‑laminated glass, compliant with Australian Standard 1288.
Meteorological information
The pilot reported that the weather on the day was fine for RPA flying. That assessment was consistent with Bureau of Meteorology observations which, at 0900, indicated that the temperature was 21.9 °C with 80 per cent relative humidity and no rain. The wind speed was observed at Fort Denison (3 km north‑east of Darling Harbour) at 15 km/h from the south-south-west.
Additional information
Recorded flight data
Flight data logs were recovered from the RPA transmitter by the operator and supplied to the ATSB. Flight data logs were also recovered from a Secure Digital (SD) card mounted on-board the aircraft. Data from the penultimate flight (Figure 4) showed that the aircraft commenced the flight at 1048 from the Cockle Bay Marina and climbed to about 24 m above ground level (AGL).
Figure 4: Recorded flight data for the penultimate flight
Source: Google Earth, annotated by ATSB
The aircraft was then manoeuvred within Cockle Bay before rising to 70 m (230 ft) AGL at the northern end of the bay. The aircraft was then flown over shore to a position above the Harbourside shopping mall before descending for landing at the take-off location. The flight time for the first flight was just over 17 minutes.
Data recorded from the incident flight is shown in Figure 5. Data recovered from the controller (shown in green in Figure 5) showed the aircraft taking off at 1140, again from the Cockle Bay Marina and initially climbing to about 20 m AGL.
Figure 5: Recorded flight data of the incident flight
Source: Google Earth, annotated by ATSB
The aircraft then proceeded in a westerly direction towards the centre of Cockle Bay. Within about 8 seconds of take-off, and having only traversed about 5 m, the aircraft’s pitch increased to about 24° nose down and the aircraft quickly accelerated. The direction, altitude and pitch remained largely consistent as the aircraft continued to accelerate westward.
The last data point recorded by the controller was 184 m from the take-off location, as the aircraft approached the western side of Cockle Bay. At this point the aircraft was at 26 m AGL and travelling at its maximum speed of 94 km/h.
Data recovered from the aircraft (shown in red in Figure 5) is consistent with the controller data with regard to heading and speed. The slight off-set in altitude data is likely due to one data set using GPS altitude and the other using barometric altitude. The RPA data shows the aircraft continuing at its maximum speed at a relatively stable heading and altitude for another 150 m until it impacted a building on the western side of Darling Drive.
Operational information
Restricted airspace operations
The area of operation was classified as a restricted area by the Civil Aviation Safety Authority (restricted area R405A). Sub regulation 101.065 (3) of the Civil Aviation Safety Regulations (CASR) 1998, required that the controlling authority must provide a written statement to an RPA operator of the conditions of entry to a restricted area. The operator applied for this permit, and one was provided by CASA. Some of the conditions of the permit were:
- the radius of operation was to be within a 30-metre radius of a vessel at the location as shown in Figure 6
- operations were to be between the surface and 90 feet above surface level (ASL)
- operations were not permitted within 30 metres of the shoreline of Cockle Bay and not within 30 metres of, or over, any vessel not directly associated with the RPA operation, or in such a way that the master of a vessel had to take avoiding action.
Figure 6: Operational restrictions for operations within restricted area R405A.
Source: Operator
Additionally, the permit did not exempt the RPA operator from the general conditions applicable to all RPA operators, that an RPA must not be operated:
- beyond visual line-of-sight
- over a populous area
- within 30 metres of any person not directly associated with the RPA operation.
Emergency procedures
The operator’s operational procedures document provided guidance for actions to take in the event of a flyaway or visual loss of an RPA.
Fly Away or Visual Loss of RPA - Where an RPA is experiencing loss of control or is visually lost, all attempts shall be made to regain control or initiate the Return To Home procedure. Should these attempts fail perform a combined stick movement to shut-down the motors with due regard for the location of the RPA so as not to increase the risk of collision with persons or property. The Controller will shout warning to people or use radio where necessary. The shut-down timing is crucial to control the RPA termination point within a safe area before the aircraft has the possibility to fly beyond the area of operation into areas over people/property etc. In the event of an uncontrolled Fly Away, the RPA will be deemed unserviceable pending inspection by the Maintenance Controller.
The pilot made a number of attempts to control the RPA through use of the control sticks, without effect. However, they had no recollection of using the Smart return to home function or the emergency engine shutdown procedure.
Related occurrences
A review of the ATSB’s aviation occurrence database revealed that in the 4 years between 2017 and 2020, 1,165 occurrences have been reported to the ATSB involving an RPA aircraft type. In this time, 94 occurrences were classified as a Data link (UAS) occurrence type. The ATSB Occurrence type coding manual described this occurrence type as:
The partial or complete loss of transmission and/or reception of digital information from an unmanned aerial system.
55 (59 %) of the 94 Data link occurrences involved a DJI aircraft. However, it should be noted that DJI are the market leader for RPAS and, as such, they represent a significant proportion of RPAS flying in Australia. Outcomes for these occurrences varied, depending on whether the aircraft crashed immediately, flew away, or auto-landed (either on land or in water).
- 43 of the 55 (78 %) were associated with a collision with terrain, while another two involved a ditching and seven resulted in missing aircraft.
- 42 of the 55 (76 %) were classified as an accident, with the remainder classified as an incident
- Nealy all of the 55 data link occurrences resulted in some level of damage to the aircraft, with 29 (53 %) of the 55 occurrences resulting in the aircraft being lost or destroyed. Another 12 occurrences resulting in substantial damage and 10 with minor damage.
- Of the 55 DJI aircraft involved in a Data link occurrence, 32 of the RPA’s were in the Phantom product line, with 13 in the Matrice, 6 Mavic and 4 Inspire.
These aircraft varied in size between about 0.75 kg and 9 kg, with maximum speeds between about 65 and 94 km/h. The user manuals for all these aircraft types described the Failsafe Return to Home Function.
__________
Loss of control
Shortly after take-off for the second planned flight from the Darling Harbour area on 15 January 2021, the pilot reported that the Inspire 2 remotely piloted aircraft (RPA) initiated an uncommanded pitch‑down and acceleration. The aircraft remained unresponsive to control inputs as it continued to accelerate westwards, towards the Harbourside shopping mall.
Before the aircraft left Cockle Bay the screen on the pilot’s transmitter that showed the camera image froze and then went black. Flight data recovered from the transmitter showed that about 8 seconds into the flight, the pitch of the aircraft increased significantly, followed shortly by an increase in speed. The aircraft continued to accelerate to its maximum speed of 94 km/h before recording of the flight data ceased 184 m from the take-off location.
Controller signal
The manufacturer advised that the data transmission system for the Inspire 2 had two independent channels, one for data upload and one for data download. Therefore, it was possible for one signal to be lost while maintaining the other. Analysis of the flight data log undertaken by the manufacturer showed a number of control inputs made by the pilot were received by the RPAS for the duration of the entire flight. Thus, the manufacturer advised that the upload signal (from the controller to the RPAS) was maintained for the entire flight.
Despite these control inputs being received by the RPAS, the flight data in Figure 5 shows that the aircraft did not appear to respond to these inputs, as it continued at roughly the same heading, speed and altitude until it collided with the building.
Compass failure
Analysis undertaken by the manufacture indicated that at the time the aircraft took-off the compass was functioning normally. However, about a second after take-off the compass was subjected to strong magnetic interference. From this point the compass started sending spurious information to the internal measurement unit (IMU). A short time later the IMU accelerometer measurements became unstable leading to the loss of directional control.
Failsafe Return to Home
The Inspire 2 had a Failsafe Return to Home (RTH) function, which was designed to prevent a flyaway occurrence in the event of a loss of controller signal. The user manual described three prerequisites for this feature to function properly. Specifically, the:
- home point must be set
- compass must be functioning
- controller loss of signal must exist for more than three seconds.
In this occurrence the pilot had no control authority over the aircraft, and the signal download link ceased. Despite this, the signal upload link was maintained and therefore the failsafe RTH was not triggered. Additionally, about 1 second after take-off when the compass failed, the failsafe RTH was rendered inoperable as it relies on a functioning compass.
Flight modes
The Inspire 2 manual stated that the aircraft would switch to A-Mode if the compass suffered from interference, but only when the Vison System was unavailable. In this occurrence, despite the compass failure, the Vision System remained available, and therefore the flight mode was not automatically switched to A-Mode. As A-Mode does not rely on the compass or GPS, the manufacturer advised that if the flight mode was switched to A-mode, control of the aircraft could have been regained.
Operational requirements
Permissions provided by the Civil Aviation Safety Authority to fly an RPA in restricted area R405A came with a number of operational restrictions. These included:
- operating in an area 30 m in radius within Cockle Bay
- operating between the surface and 90 ft (27.4 m)
- operating within 30 m of the shoreline of Cockle Bay.
Other general conditions applicable to all RPA operators included not flying over a populous area and not flying within 30 m of any person not directly associated with the RPA operation. Flight data recovered from the transmitter showed the pilot exceeded a number of these limitations by flying up to 70 m (230 ft) as well as flying over the Cockle Bay shoreline and over the Harbourside shopping mall.
Emergency procedures
The operator’s emergency procedures in the event of a fly away recommended attempting to regain control of the RPA or initiating a RTH. If these failed, the recommendation was to initiate an emergency motor shutdown.
Although the pilot made a number of attempts to control the RPA through use of the control sticks, the pilot did not recall using the Smart RTH feature or the emergency engine shutdown procedure. However, given that the compass had failed the Smart RTH would not have worked anyway. Additionally, given that the pilot had no control authority over the aircraft, it is unclear whether the emergency motor shutdown commands would have been acted on by the RPA.
|
ATSB investigation report findings focus on safety factors (that is, events and conditions that increase risk). Safety factors include ‘contributing factors’ and ‘other factors that increased risk’ (that is, factors that did not meet the definition of a contributing factor for this occurrence but were still considered important to include in the report for the purpose of increasing awareness and enhancing safety). In addition ‘other findings’ may be included to provide important information about topics other than safety factors. Safety issues are highlighted in bold to emphasise their importance. A safety issue is a safety factor that (a) can reasonably be regarded as having the potential to adversely affect the safety of future operations, and (b) is a characteristic of an organisation or a system, rather than a characteristic of a specific individual, or characteristic of an operating environment at a specific point in time. These findings should not be read as apportioning blame or liability to any particular organisation or individual. |
From the evidence available, the following findings are made with respect to the Loss of control and collision with terrain, Inspire 2 (PRA), Darling Harbour New South Wales, on 15 January 2021.
Contributing factors
- Shortly after take-off the compass failed rendering the aircraft uncontrollable, disabling the Return to Home function and resulting in the collision with a building.
Other factors that increased risk
- The pilot in command did not follow the emergency procedures outlined in the operations manual and did not comply with the operating limitations outlined in the Civil Aviation Safety Authority approval.
AGL Above ground level
CASA Civil Aviation Safety Authority
CASR Civil Aviation Safety Regulations
DJI Da-Jiang Innovations
GPS Global Positioning System
RPA Remotely Piloted Aircraft
RPAS Remotely Piloted Aircraft System
RTH Return to Home
SD Secure Digital
Sources of information
The sources of information during the investigation included the:
- pilot of the accident flight
- Sky Monkey Pty. Ltd.
- Civil Aviation Safety Authority
- New South Wales Police Force
- SZ Da-Jiang Innovations (DJI) Technology Co Ltd
- Bureau of Meteorology
- recorded data from the RPAS.
References
Civil Aviation Safety Authority (CASA), Civil Aviation Safety Regulation (CASR) 1998 Part 101
Sky Monkey Operations manual, operational procedures and safe work method statement.
DJI Inspire 2 user manual
Submissions
Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report.
A draft of this report was provided to the following directly involved parties:
- Civil Aviation Safety Authority
- Sky Monkey Pty. Ltd
- the pilot of the accident flight
- SZ Da-Jiang Innovations (DJI) Technology Co Ltd
- Australian Federal Police
Submissions were received from:
- Civil Aviation Safety Authority
- Sky Monkey Pty. Ltd
- SZ Da-Jiang Innovations (DJI) Technology Co Ltd
- Australian Federal Police.
The submissions were reviewed and where considered appropriate, the text of the report was amended accordingly.
Purpose of safety investigationsThe objective of a safety investigation is to enhance transport safety. This is done through:
It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. TerminologyAn explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing informationReleased in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2022
Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this publication is licensed under a Creative Commons Attribution 3.0 Australia licence. Creative Commons Attribution 3.0 Australia Licence is a standard form licence agreement that allows you to copy, distribute, transmit and adapt this publication provided that you attribute the work. The ATSB’s preference is that you attribute this publication (and any material sourced from it) using the following wording: Source: Australian Transport Safety Bureau Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly. |
Safety action not associated with an identified safety issue
|
Whether or not the ATSB identifies safety issues in the course of an investigation, relevant organisations may proactively initiate safety action in order to reduce their safety risk. The ATSB has been advised of the following proactive safety action in response to this occurrence. |
Additional safety action by SZ Da-Jiang Innovations (DJI) Technology Co Ltd
The manufacturer has advised that they have updated the user manuals of a number of products, including the Inspire 2. These changes provide additional guidance to users regarding the use of the fully manual attitude flight mode in the event of compass interference.