Synopsis
On 25 March 2025 at 1450 UTC, a Phoenix Wings Orca unmanned aircraft (serial no: PW54) struck the ground in a wooded area within Coombe Country Park, Warwickshire, during an approach to a landing site near Coventry Hospital. The aircraft, powered by eight electric motors, was operating under a Beyond Visual Line of Sight with Visual Mitigations (BVLOS VM) authorisation. The accident occurred during the sixth consecutive flight, which was part of preparations for a demonstration. The aircraft was damaged beyond economic repair; there were no injuries to persons or damage to property.
History of the Flight
The flight crew comprised a Remote Pilot (RP), Safety Remote Pilot (SRP), Pad Manager (PM), Visual Observer (VO), and an Emergency Response Team. The RP controlled the aircraft from a remote facility using a PC-based ground control station. The SRP was stationed at the hospital landing site with a hand controller that could take manual control, arm/disarm the aircraft, and terminate flight. The PM, located at the farm takeoff site, had a handheld controller for takeoff and landing. Coordination was via two-way radios.
Five previous flights had been completed successfully over about an hour. After ground checks at the farm, the aircraft took off for the hospital landing site. It climbed vertically to about 50 m above ground level, transitioned to forward flight, and climbed to a cruise height of 60 m. The takeoff weight was 38.9 kg. As the aircraft approached approximately the halfway point of its route, all motors stopped suddenly. The aircraft initially maintained altitude but then stalled and descended rapidly, striking the ground in a wooded area. The RP, SRP, and PM reported no control inputs prior to the loss of power.
Aircraft Information
The PW Orca is an unmanned, electrically powered vertical takeoff and landing aircraft. It has six motors under the wings for vertical lift and two motors at the wing fronts for forward propulsion. Maximum takeoff weight is 52 kg, cruise speed 60 kt, and maximum range 54 nm. The aircraft is controlled via a ground control station for the RP and an optional SRP controller. The ground control station uses an uninterrupted command link, while the SRP controller uses a 2.4 GHz signal limited by range and line of sight. As of the report, 26 aircraft had been built, with 20 in operational service. The accident aircraft had accumulated 13 hours 59 minutes and 119 flights before the accident; it was the first accident involving this type.
Flight Termination System
The aircraft is equipped with a Flight Termination System (FTS) that removes power from the motors and deploys a parachute when activated. The parachute manufacturer specified a minimum deployment height of 40 m, but the aircraft manufacturer added a safety margin, requiring 60 m for full effectiveness. The FTS can be triggered automatically if descent rate exceeds 2,000 fpm, or manually by a terminate button on the RP ground station or a switch on the SRP controller. After the accident, the manufacturer confirmed that if the aircraft is disarmed in flight, the FTS is also disabled. This information was in the technical manual, but the operator stated they had not appreciated that the FTS would be disabled upon in-flight disarm. The operator considered the ability to disarm in flight a safety hazard and requested the manufacturer to remove it.
Arm and Disarm Function
The arm/disarm function applies or removes power to the electric motors and enables or disables remote control. The aircraft automatically disarms upon landing to allow safe approach. Manual disarm is possible in flight or on the ground, intended for abnormal situations. The system uses two physical hardware switches, and once hardware is armed, software can be armed for remote commands. The SRP controller has a toggle switch for arm/disarm. The manufacturer had intended that the system should require a change from disarm to arm and back to disarm before responding to an incoming disarm signal, to prevent inadvertent in-flight shutdown. However, a software bug in combination with loss of synchronisation between the RP and SRP allowed the SRP controller, which had remained set to disarm since takeoff, to be received when the aircraft came within range, causing power removal.
Recorded Information
Onboard data recorded control signals from the RP station and, when in range, from the SRP controller. The SRP controller does not store data. Data showed that during the previous flight, the SRP controller was set to arm for about 90 seconds until the aircraft moved out of range. After landing at the farm, the battery was replaced. The aircraft then took off under automatic control. Recorded data indicated that the SRP controller had remained in the disarm position from the time of takeoff. When the aircraft came within range, the controller's disarm signal was processed due to the software bug, cutting power to the motors. The aircraft's emergency parachute system was disabled because the aircraft was disarmed, leading to an uncontrolled descent from 60 m.