Brit Watchkeeper drone fell in the sea because blocked sensor made algorithms flip out
Report scolds maker Thales for poorly understood software
A British Army Watchkeeper drone stalled itself and crashed into the sea on a bad weather flight test, military investigators have said – though most of the wreckage was never found.
The unmanned aircraft, tail number WK042, fell from the sky in February 2017 while trialling a new ice detection system. The drone was being flown from West Wales Airport, formerly known as Aberporth Airfield, by 47 Regiment Royal Artillery.
Investigators concluded that one of its pitot probes used for reading the aircraft's speed and angle of attack (AOA) became blocked, causing the Watchkeeper's onboard flight control logic to enter an erratic series of climbs and dives until it stalled itself and flopped into the sea. They criticised the craft's maker, Thales, for not fully understanding how its algorithms responded to loss of accurate sensor data.
Air Marshal Susan Gray, director-general of the Defence Safety Authority, criticised the Ministry of Defence and Thales for their "incomplete level of detailed technical understanding" regarding the drone and its systems. So far the British military has crashed five Watchkeepers, including two in quick succession during 2017, which led to a months-long grounding of the entire fleet.
Those two crashes, of which WK042 was one, were not publicly revealed until a senior Navy officer blabbed about them within earshot of a sharp-eared reporter, prompting accusations of an MoD cover-up over the troubled multimillion-pound programme.
The automated decision-making that led to the crash has some parallels with the recent Boeing 737 Max controversy, in which automated flight control software has been fingered as a potential factor in two fatal airliner crashes that cost hundreds of lives. The Watchkeeper crash investigators stated:
The software algorithms used to identify and disqualify single sensor failure were not always well understood by [Thales] within the UK. Consequently, the effectiveness of the algorithms at maintaining the integrity of the air data required by the [flight control system] for safe flight was in part unknown.
"From its detailed analysis," wrote Air Marshal Gray in her formal comments on the Service Inquiry (SI) report, "the SI concluded that the design of [Watchkeeper's] air data system limited its ability to fly safely in cloud and precipitation." A buildup of moisture in the Watchkeeper's pitot probes was found to have caused its automated flight logic to start doing crazy things – ultimately leading to a stall and a crash.
Ice, ice, baby
After taking off uneventfully from Aberporth on the scheduled icing detection trial flight, WK042 climbed first to 3,000ft in the hope of finding icing conditions, gradually stepping up to 8,800ft. It then "experienced high wind that was momentarily on the allowable limits", prompting its operators to command a descent and return to base.
Watchkeeper is not flown like a conventional aeroplane with a human sitting at a stick and rudder. Its operators select waypoints on a screen for the drone to fly itself towards. During flight, its onboard logic decides precisely how the drone arrives at those waypoints, within constraints selected by human operators. Watchkeeper's predecessor, the Hermes 450, could be flown manually but this design feature was not included on the British Army's craft.
Twenty minutes later, a spate of warnings began to be displayed to the operators as their controls relayed the drone's violent oscillations. Fifteen minutes after that, contact with the Watchkeeper was lost. In that last quarter of an hour, the drone "pitched up and down repeatedly between 3,200ft and 3,500ft" until it "descended rapidly into the sea" about two miles northwest of the hamlet of Llangrannog, which itself is four or five miles northeast of Aberporth Airfield.
Among the warnings displayed to its operators during the pitching incidents were "estimated AOA in use" and "flight envelope protection active", indicating that the Watchkeeper was no longer trusting its sensors. Thales' own investigators concluded that the left tail fin had been damaged or possibly even been torn from the airframe by the violent manoeuvres, "causing a catastrophic loss of control", though the MoD inquiry downgraded this to saying it was a contributory factor but not the critical one.
A seabed search using remote underwater vehicles failed to turn up any of the Watchkeeper wreckage, though RAF personnel later found one of its composite panels washed up on a beach. That was the sum of wreckage found by investigators – all the analysis was done from data transmitted by the UAV back to its ground station. There is no "black box" on a Watchkeeper.
The SI report into WK042 is here.
The MoD has 50 Watchkeepers remaining on charge. Another report into WK050 – the 2018 crash on land near Aberporth village – is expected soon, while The Register will be separately reporting about the crash of WK043, which also had an unscheduled surface/aircraft interaction event a month after the drone featured in this article. ®
Sponsored: Becoming a Pragmatic Security Leader