What happened
On 29 December 2020, a Tekever AR5 Evolution Mk 2 (registration G-TEKV) was conducting commercial unmanned aircraft operations at Lydd Airport, Kent. The aircraft was returning from a flight over the English Channel and was orbiting at approximately 600 ft to prepare for a landing on Runway 03.
During the final orbit, both engines of the aircraft unexpectedly shut down. While the ground control station crew noticed the aircraft deviating from its planned flight path and observed zero RPM on the engine displays, they did not receive any immediate alarms or warnings. However, the External Pilot (EP) positioned near the runway was visually monitoring the aircraft. Upon noticing the nose drop and hearing the engines fail, the EP immediately switched to fly- by-wire mode and took manual control of the aircraft. Using this manual override, the EP successfully guided the aircraft through a glide approach, landing it on the runway without further incident.
The investigation
The investigation focused on why the engines received an uncommanded shutdown signal. Analysis of the aircraft's flight logs revealed that the autopilot had detected an 'Ignition OFF' command during the final orbit. The investigation examined the data stream from the radio link used by the EP, which travels through a multiplexer before reaching the autopilot.
It was determined that the system's 11-bit command structure was vulnerable to single-bit errors. Specifically, a single bit error in the 'Ignition ON' signal could inadvertently push the value above the threshold required to trigger an 'Ignition OFF' command. The investigation also looked into a previous, similar event from June 2020 involving an uncommanded shutdown during ground testing.
Findings
- The simultaneous shutdown of both engines was triggered by a spurious 'Ignition OFF' signal received by the autopilot.
- This erroneous command was likely caused by electromagnetic interference (EMI) originating from the aircraft's generator power unit (GPU), which corrupted the data transmitted via the multiplexer.
- While hardware improvements to the multiplexer had been implemented following the June 2020 event, the aircraft was not yet equipped with the updated autopilot firmware that would have required 10 consecutive 'Ignition OFF' commands to trigger a shutdown, rather than just a single instance.
- The ground control station's alerting system was found to be prone to 'warning saturation,' which could lead operators to temporarily disable or ignore notifications.