Army Watchkeeper drone flopped into tree because crew were gazing backwards

The latest British Army Watchkeeper drone crash happened because its crew became fixated on live footage from an onboard camera instead of their instruments, a Ministry of Defence report has revealed.

An internal Defence Accident Investigation Branch (DAIB) report detailed why the semi-autonomous aircraft, tail number WK050 and flown on the day by two Royal Artillery operators, crashed in June 2018.

The report, dated February 2019, was published online by the MoD after the BBC made a Freedom of Information request for it, leading to news reports over the past few weeks.

WK050 flopped into a tree just beyond the runway of Aberporth airport on the Welsh coast after its Army operators, under the supervision of contractors from a Thales joint venture company, cut its throttle immediately after the drone had landed and lifted off again.

"Had no action been taken, the [Watchkeeper] would have completed its automatic go-around from which it could have been commanded to conduct a further approach," said the DAIB in its Safety Investigation Report, which was written by a major and a Warrant Officer 1 (WO1).

From grey to green to crunch

That report revealed that the Watchkeeper's operators were focused on a screen showing output from an onboard camera instead of their air vehicle display computer, used for monitoring the drone and its onboard software's decision-making. The camera was part of the drone's surveillance payload and had been retracted to its stowed position, facing backwards and downwards but still transmitting footage, immediately before landing.

The camera was not part of the flight control suite. Nonetheless, the DAIB found that the monochrome pictures it was sending the crew were "compelling" against the actual control display.

Winds of change

Watchkeeper is programmed to "semi-flare" at 7 metres (22ft) above ground level, reducing its approach glideslope from the standard 3˚ to 1.5˚, until it touches down. In crosswind conditions it also "decrabs" during this manoeuvre: a piloting term for pointing an aircraft straight down the runway instead of being turned slightly towards a crosswind to compensate for the wind drift. This Youtube video shows airliners decrabbing just before touchdown.

When WK050 touched down at Aberporth on 13 June 2018, it did so after flying past its intended touchdown point on the downwards-sloping runway, as well as to the right of the centreline. Thanks to a crosswind, the Watchkeeper was blown off course during its decrab – far enough for it to run off the right-hand side of the runway and onto the grass verge beside it. According to the DAIB, WK050 "failed to register ground contact during the ground touch window and auto-aborted", meaning it throttled up and took off.

Its human operators, however, mesmerised by camera footage showing grass when they were expecting to see the runway surface, hit an override button to cut the drone's throttle. The senior operator "verbalised a single expletive", shocked at a situation that "had never happened in the previous 749 flights" with that production-standard Watchkeeper hardware and software build.

Starved of thrust, WK050 nosed over into a tree just beyond the airfield perimeter, having narrowly missed a local road. It was written off as a result of the crash.

The DAIB said: "The most appropriate [flight reference card] drill ...stated: 'If UA [unmanned aircraft] not maintaining centreline axis: Engine cut……..Command'."

Trouble-prone

Although WK050 was being flown within its crosswind limits, had its operators not cut the throttle it would have taken off safely and flown away ready to try another landing.

"Despite being operated normally," said the DAIB, "and within the flight envelope limits, the AV went onto the grass, which was the trigger for P1 [pilot 1] to press engine cut." Had the operators not become distracted by the onboard camera footage, they would have been aware “what mode of flight the [Watchkeeper] was in."

They had also been trained to position emergency cutoff buttons within hand's reach before activating a landing command, while the operators' quick-reference cards stated that the right response to a Watchkeeper rolling off the runway centreline was to cut the throttle.

The apparent explanation of why the drone's software failed to register contact with the ground, something to do with the flight control software's "BETA loop" disengaging, was redacted from the MoD-published report. Watchkeeper does not use a weight-on-wheels switch as most modern commercial aircraft do. Instead its software uses the aircraft's vertical acceleration value, along with two laser altimeters, to determine whether or not it is on the ground, as explained in detail in our article about the crash of WK006 in 2015.

Although Watchkeeper flies itself, its human operators navigate it by selecting waypoints on a screen for the drone to fly to, as well as engaging entirely autonomous modes for takeoff and landing.

So far, five Watchkeepers from the total of 54 have been destroyed in crashes. The drone has never been used operationally, other than a short token deployment to Afghanistan in 2013.

The DAIB made 13 safety recommendations to the Army and Thales, including reviewing crosswind limits and making an effort to "improve the air vehicle's landing accuracy". ®