What happened
On May 9, 2019, a Matternet M2 V9 drone, registered as SUI-9903, crashed in the "Ob der Hueb" forest area in Zurich, Switzerland. The aircraft was performing a commercial delivery service on behalf of Swiss Post, transporting medical samples between the University of Zurich and the University Hospital Zurich.
Approximately one minute after departing from the University of Zurich, the drone'-s autonomous Flight Termination System (FTS) activated, initiating an emergency descent via parachute. However, during the descent, the connection line between the parachute and the aircraft snapped. The drone subsequently fell uncontrolled into a wooded area near a group of children playing in the forest. While the impact destroyed the aircraft, there were no injuries to the children or bystanders nearby.
The investigation
SUST examined the flight controller configuration and the software environment of the Matternet M2 V9. The investigation focused on the Extended Kalman Filter (EKF) processes used for navigation and stability. The drone utilized a Pixhawk Cube Black flight controller running a modified version of ArduCopter software.
The investigation looked into how the system processed data from multiple Inertial Measurement Units (IMUs). It was noted that the software configuration at the time only allowed for the parallel calculation of two EKF lanes, which prevented the system from isolating a single faulty signal. Furthermore, investigators reviewed a Service Bulletin (SB 0000002) released by the flight controller manufacturer in April 2019, which addressed issues with IMU data processing and recommended specific parameter changes to improve signal isolation.
Findings
- The drone's software configuration lacked the ability to isolate a faulty sensor signal because it only processed two EKF lanes simultaneously.
- The flight controller's parameter settings (specifically the EK2_IMU_MASK) were not optimized to utilize all available IMUs for better error detection.
- The connection line between the parachute and the drone failed during the emergency descent, leading to the uncontrolled impact.
- There was a lack of clear, standardized communication from component manufacturers regarding critical safety updates and service bulletins to operators.