Safety procedures when operating BVLOS
Using a recent test flight for Drone2Go as an example, we dive into the different failsafes of the Avy Aera and our contingency and emergency procedures. By linking theory and practice, we share how the Avy Aera performed safely according to design.
Where the first time any drone operator receives approval from a local aviation authority to fly BVLOS is exhilarating, it soon becomes normal. It is a logical and required first step for any new project. BVLOS operations provide numerous advantages for operators over flying within visual line of sight (VLOS). You can fly further and cover larger distances, connecting locations and thus increasing commercial opportunities to scale up operations in a fast, efficient and reliable way.
When planning BVLOS missions there are several factors that need to be taken into account. Whereas for a VLOS flight, the pilot always has visual sight of the drone (max distance 500m), the ability to check the weather and any obstacles in the way, during a BVLOS flight situational awareness becomes a task for the drone. Avy therefore only performs BVLOS flights in automated mode to maximise safety during operations.
The operator’s (the pilot) role to guarantee a safe autonomous flight remains, certainly ahead of take-off: their responsibilities include planning the route, taking into account the distance the drone will travel, evaluating the route settings and mapping the factors involved such as unpredictable weather and weather changes during the flight (very relevant in The Netherlands), any obstacles and identify other risks. Part of this is also defining designated rally points (safe landing sites) along the route for the drone to land safely in case of a malfunction or incident. During the flight, the operator monitors the progress of the route and the operations of the drone based on the data provided to the ground station. When and where required the operator can intervene by triggering an RTL (Return To Land). The drone will then continue to its destination following the mission path as long as it’s able to continue to operate in fixed-wing mode. When this is not possible, it will land as quickly as possible at the nearest defined rally point. A safe landing point is considered to be a rally point, the mission landing or the mission takeoff location.
For all flights, standard operating procedures are followed. These are classified into normal, contingency and emergency situations. Contingency and emergency situations are the result of unexpected flight behaviour, for example caused by a communication data link loss, weather deterioration, or obstacles. Contingency procedures are followed when the drone is not flying as planned, but is still in control and has not left the predefined flight area. Emergency procedures are followed when the drone leaves the predefined area and goes outside the area that was considered safe.
The failsafes of Avy Aera
The Avy Aera runs its autopilot on a custom version of the PX4 firmware, which provides a number of safety features to protect and recover the aircraft. These failsafes are part of our safety design.
Failsafes allow you to specify areas and conditions under which you can safely fly, and the action that will be performed if a failsafe is triggered (for example, landing, holding position, or returning to a specified point).
These failsafes are automatically triggered by the drone when encountering a situation that exceeds its operational parameters or manually by an operator based on the information provided by the drone to the ground control station or other information available. For the Avy Aera, the main failsafes that work together to guarantee safe landing are:
- Quadchute: failsafe activated when a VTOL drone can no longer achieve a desired altitude or attitude setpoint in fixed-wing mode. If triggered, the aircraft will transition to multicopter mode and proceed to land at the nearest rally point.
- Rally points: designated safe landing site, typically used to provide a safe and more convenient (e.g. closer) destination rather than the drone having to return to its origin, or continue to the land site. Before any BVLOS operation the flight ops team plans the location of rally points along the flight route for contingency landing.
- RTL behaviour: The ‘Return To Land’ flight mode is used to automatically fly a drone to safety via an unobstructed path to a designated landing destination. The RTL changes throughout the flight, continuously adjusting to the safest way to land. This can either be done by going to a rally point when in multicopter mode or by fastforwarding the flight path to its designated landing site when in fixed-wing mode.
Rally point landing at Drone2Go
During a recent flight in Nijmegen for the Dutch Drone2Go project, a contingency procedure was triggered, resulting in our drone safely landing at a predefined rally point.
After having already flown a total of 210 km BVLOS, the Avy team set off on their last flight in the evening of July 12th along the river Waal. Along the route multiple rally points were placed (after suitability was verified on-site the week before) to ensure that in a contingency or emergency situation the drone could also be landed safely.
On its return leg, at approximately 6 km away from the flight crew at the landing site, a quadchute and the associated RTL were triggered, transitioning the aircraft from a fixed-wing state to a multicopter state. Following Aera’s RTL logic, the drone then automatically diverted to the pre-planned rally point for a safe landing. During landing, the flight crew was able to watch through the drone’s FPV (first person view) feed with the Camera Operator confirming that the site was clear and safe, after which the drone landed automatically. The flight crew retrieved the drone and performed an on-site inspection that showed no damage to the site or drone.
A thorough investigation was conducted to understand what caused the quadchute. Based on the log-files, Avy's team was able to review the data alongside the observations of the flight crew. The data showed the quadchute mode activated as a result of a minor loss of altitude when the drone tried to increase its velocity after detecting that its airspeed was getting too low. However, other data available clearly showed that in reality the airspeed was not too low. Based on this the attention of the team turned to the airspeed sensor itself. Examination of the component confirmed the contingency operations resulted from its performance, allowing us to repair and adjust the sensor to continue operations the next morning after testing its functionality.
The findings and lessons learned were shared internally with the flight operations, tech and production teams, to determine how such disruptions to the functionality of the component can be prevented and whether a design change in the sensory system is required, possible and practicable. Tech immediately indicated that due to a design change in the next generation Aera such disruption of the functionality of the airspeed sensor is minimised.
During this project our failsafes were put to the test and the Avy Aera showed she performs according to safety design. The aircraft demonstrated that the designed failsafes have been well thought out, ensuring safe BVLOS operations even in case of contingency.