What happened
On 2 May 2020, a Believer unmanned aerial system (UAS) was conducting a test flight at Solent Airport, Hampshire, as part of a programme preceding commercial operations to the Isle of Wight. The flight was intended to follow a specific procedure: the aircraft would be hand-launched and controlled manually by a safety pilot until it reached a stable altitude, at which point the automatic flight control system would be engaged. Once the automated system was active, the ground control system operator would then signal the safety pilot to shut down the radio control transmitter.
Following a successful launch, the safety pilot mistakenly believed the command to deactivate the transmitter had been given. Consequently, the pilot switched the radio control transmitter off while the aircraft was still in manual mode and before the automatic flight control system had been engaged. Upon detecting the loss of signal, the onboard fail-safe logic responded by reducing the throttle to idle and initiating an aileron input. At an altitude of roughly 235 m, the safety pilot was unable to react quickly enough to reactivate the controller. The aircraft subsequently crashed into an open area of the airfield at a speed greater than 40 m/s, resulting in the destruction of the aircraft. There were no injuries.
The investigation
The AAIB investigation established that the safety pilot's error was the primary driver of the accident. The investigation also considered the possibility that crew fatigue played a role, noting that the operator's personnel had been working extended hours in the days leading up to the event. The investigation examined the aircraft's fail-safe programming, which functioned as designed by attempting to curtail the flight upon signal loss, but found that the timing of the transmitter shutdown left no window for recovery.
Findings
- The safety pilot deactivated the radio control transmitter before the automatic flight control system was engaged and without receiving the required verbal instruction.
- The aircraft's fail-safe logic responded to the signal loss by reducing power and inducing a descending turn.
- The loss of control was too rapid for the pilot to re-establish a link via the transmitter.
- Potential crew fatigue due to long working hours may have contributed to the human error.
Safety action
Following the accident, the operator implemented several changes:
- Flight procedures were modified to minimize manual control periods; the UAS is now launched in a revised automatic mode where the safety pilot provides oversight rather than primary control.
- The fail-safe logic was updated so that transmitter fail-safe settings are automatically configured based on the aircraft's current flight mode, reducing the need for manual intervention.
- The operator's fatigue risk management strategy was reviewed, leading to new limitations on crew working hours and a requirement for crew to declare their fitness for duty during every briefing.