What happened
On 4 September 2018, a DJI Matrice 210 was conducting an emergency services operation at Tilbury Docks, Essex. The aircraft was being operated within a cordoned-off area to ensure a safe distance from any persons or property not under the operator's control. During the third flight of the day, approximately six and a half minutes into the mission, the pilot observed a battery system error on the controller while the aircraft was roughly 20 m above the ground. Although the pilot attempted to initiate a Return to Home command, the aircraft failed to respond. Shortly thereafter, the motors ceased operation, causing the destroyed aircraft to fall onto a road within the controlled area.
The investigation
The AAIB examined recorded flight data and coordinated with the manufacturer to analyze the aircraft's onboard information. The investigation focused on why the aircraft's power failed despite the batteries appearing to have a high charge. Data analysis revealed that at the start of the flight, the batteries indicated a 100% State of Charge (SOC), even though the actual voltage was significantly lower than what is typically required for a full charge. As the flight progressed, the system detected a low-voltage condition, which triggered an automatic landing mode. However, the voltage dropped so rapidly that the motors lost power entirely before the landing could be completed.
Findings
- The primary cause of the crash was a software error in the battery management system that caused the batteries to report an erroneously high State of Charge.
- During long-term storage, a phenomenon known as 'ghost' current caused the battery capacity algorithm to accumulate a false charge.
- Because the reported SOC was much higher than the actual remaining capacity, the aircraft's automated safety triggers (such as Return to Home) were based on inaccurate data.
- The manufacturer's decision not to implement certain voltage corrections (OCV) left the system vulnerable to these inaccuracies.
- The aircraft's charging process stopped prematurely because the system believed the batteries were already at 100% capacity.
Safety action
Following the investigation, several corrective measures were implemented:
- The manufacturer released battery firmware updates to correct the SOC calculation error.
- New aircraft firmware was introduced to perform a secondary check of the battery's reported SOC against the actual voltage, triggering an alert if a discrepancy of more than 10% is detected.
- The manufacturer updated the DJI Pilot app to provide clearer warnings regarding outdated battery firmware.
- The CAA issued multiple Safety Notices to alert operators of the risks and provide guidance on necessary firmware updates.