What happened
On 2 April 2024, during an experimental test flight at White Waltham Airfield, a Malloy Aeronautics T005 unmanned aircraft (UA) experienced a sudden loss of control. The flight was intended to validate a software update designed to enable visual tracking and following capabilities in auto mode.
Upon activating the auto mode, the aircraft unexpectedly climbed and veered to the left. The pilot attempted to trigger the Flight Termination System (FTS) via the primary controller, but the command was ignored by the software. After switching to a backup controller, the pilot successfully activated the FTS, but the aircraft had already entered a steep descent. The UA struck two unoccupied General Aviation aircraft parked near a hangar, eventually coming to rest beneath one of them. The impact resulted in the destruction of the UA and minor damage to the parked aircraft. There were no injuries as no crew or passengers were on board the drone.
The investigation
The AAIB investigation examined the software configuration, the flight control logic, and the operational procedures used during the test. Investigators found that the aircraft was unable to establish a GNSS signal prior to launch, which prevented the use of a geofence. The pilot decided to proceed with the flight because alternative emergency mitigations, such as the FTS, were available.
Technical analysis revealed that the software used for the update was based on a flight model from a different aircraft with a lower power-to-weight ratio. This caused the software to command excessive throttle during auto mode. Furthermore, the investigation found that the operator's change management process had failed to properly document the software update, meaning the risks associated with the new code were not fully assessed.
Findings
- The primary cause of the accident was that the flight control software commanded excessive throttle for the T005's specific power-to-weight ratio, leading to an uncontrolled climb.
- The software feedback loops were poorly tuned, preventing the motors from stabilizing the aircraft.
- The pilot was unable to use the primary controller to terminate the flight because the software was programmed to ignore FTS commands while in auto mode.
- The decision to fly without a geofance was influenced by the pilot's belief that it was not required under the Open A3 Category and the knowledge of a previous successful flight conducted without one.
- The operator's internal modification management process was bypassed for this software update, preventing a formal safety review of the changes.
Safety action
The operator has implemented several technical and procedural changes, including:
- Modifying the T005 software so that FTS commands are no longer ignored in auto mode.
- Relocating the GNSS receiver to reduce interference from onboard hardware.
- Updating pre-flight checklists to ensure emergency procedures are reviewed.
- Strengthening the change management process to ensure all software and hardware modifications undergo formal assessment.
- Implementing new oversight roles to manage aviation safety and regulatory compliance.