Management points and ditching involving RPA swarm of 500 Damoda Newton 2.2 RPA, Victoria Harbour, Docklands, Victoria, on 14 July 2023 – sUAS Information

On the night of 14 July 2023 an aerial mild show was scheduled to be carried out over the waters of Victoria Harbour, Docklands, Victoria utilizing a swarm of 500 Damoda Newton V2.2 remotely piloted plane (RPA). 

At 1830 the Distant Pilot in Command (RPIC) launched the swarm. Shortly after, the RPIC recognized each visually and from a number of errors on the bottom management station (GCS) pc, that a number of plane had been out of place. 

Regardless of this, the plane routinely commenced the transition from the launch location in direction of the present space. Because the plane transitioned, additional errors with growing severity appeared on the GCS pc. Plane had been noticed to be out of place and colliding within the air, with a number of plane breaching the geofence.

Because the errors cascaded, the RPIC commanded the plane within the swarm to loiter (maintain place) and tried to return these with probably the most vital errors to the launch web site individually. While a number of plane had been within the loiter, the GCS pc misplaced connection to virtually 400, with the bulk descending into the harbour under.

427 of the five hundred plane within the swarm had been misplaced into the water, with divers subsequently recovering 236.

What the ATSB discovered

The ATSB decided that shortly after launch, the swarm encountered wind situations that exceeded the plane’s printed functionality. That was not recognized by the RPIC as they had been unaware that the wind pace affecting the plane was displayed on the GCS pc. Moreover, whereas the GCS pc displayed the wind pace, it didn’t have the performance to actively alert the pilot to exceedances.

Consequently, the RPIC allowed the flight to proceed towards the present space, the place wind speeds greater than twice the printed restrict had been encountered. In these situations the plane had been unable to take care of place, leading to plane collisions, breaches of the working space, and activation of failsafe modes that led to most of them descending to the water.

The RPIC didn’t make use of all processes obtainable to them to gather related wind data previous to launching the swarm. There have been additionally a lot of elements on the day that prompted the RPIC to have the next than regular workload that affected their choice‑making capability, and was prone to be underneath strain to conduct the present. It was additionally discovered that the operator had no process in place to confirm that pilots had been conversant in all related features of the GCS software program. 

Lastly, whereas not contributory to the accident, the investigation additionally recognized that the flight crew didn’t adjust to operational limitations set by the regulator and contained inside their very own documentation.

What has been accomplished consequently

Operator

The operator suggested that in response to this accident it undertook an in depth evaluate of its working procedures and made a number of adjustments, together with:

• adjustments to the crewing necessities to have 2 Civil Aviation Security Authority‑accepted pilots working each present
• introduction of wind pace take a look at flights utilizing particular person plane prior to indicate launch to ascertain precise situations within the present space
• institution of a number of go/no-go factors through the launch sequence permitting for extra clearly outlined cease factors
• introduction of sterile cockpit procedures to restrict exterior interactions with the flight crew in vital phases within the lead‑as much as present launch.

Moreover, the ATSB issued a security suggestion that the operator develops a course of to make sure that future software program adjustments are communicated and understood by all pilots earlier than commencing operations.

Producer

The producer suggested that updating the bottom management station software program to incorporate an lively alert for wind pace exceedances was technically attainable and that this characteristic was being thought of for future software program releases. The ATSB issued a security suggestion to the producer that such alerting be applied.

Security message

In Remotely Piloted Plane System (RPAS) swarm operations the flight crew are extremely depending on the bottom management station software program, its performance and the info it offers for protected operation. It’s subsequently vital that the flight crew be conversant in all functionalities and perceive the knowledge being introduced to them. Performance that actively alerts crew to exceedances in flight‑vital parameters can help crew consciousness.

Operators ought to have programs in place to make sure that pilots are conversant in new performance when launched. To help flight crews, operators ought to be sure that operational documentation, together with checklists, carry the related prompts for flight crews to assemble all needed data to help their choice‑making processes.

Moreover, the impression of human elements on RPAS operations must be actively thought of and managed. Whereas the chance profile might differ from that of crewed operations, elements akin to workload and operational strain can equally impression RPAS operations. 

As RPAS operations proceed to quickly develop and diversify, compliance with operational tips and limitations set or accepted by the regulator are critically essential to minimise threat to each the operation and the general public. That is significantly essential the place RPAS are being operated in larger threat environments, akin to public shows in constructed‑up areas.

The prevalence

Take a look at flight

Late within the night of 13 July 2023, the Distant Pilot in Command (RPIC) and copilot of a Damoda Newton V2.2 Remotely Piloted Plane (RPA) swarm operated by the Australian Visitors Community Pty Restricted (ATN) arrived at a pre-arranged launch web site on North Wharf at Docklands, Melbourne, Victoria (Determine 1). They had been to conduct a restricted take a look at of a swarm RPA show (drone present) which was to happen the next night in help of a sporting occasion on the Docklands Stadium. 

Determine 1: Operational space and launch web site

Supply: Google Earth, annotated by the ATSB

The RPIC and copilot set out 10 plane [1] on the launch web site and ready the bottom management station (GCS) to check the present program. The first perform of the flight was to check for potential interference from the launch web site and the encompassing space. Shortly earlier than the launch time, the RPIC recognized that the wind situations had been effectively above the 15.6 kt restrict that the plane may safely function in and the take a look at was downscaled to a hover take a look at. The hover take a look at concerned 10 plane launching to a top of 10 m and hovering for a short while earlier than touchdown. 

The hover take a look at was efficiently accomplished with the GCS system recording minimal interference from the launch web site. Nonetheless, the RPIC reported that as a part of this course of the launch location programmed for the present was recognized to be incorrect and that this location wanted to be up to date earlier than the present the next night.

Flight preparation

At roughly 1400 native time on 14 July 2023 the RPIC and copilot returned to the launch web site to arrange for the present that was scheduled for 1830. On surveying the meant working space, the RPIC recognized that the mast of a ship moored on the wharf instantly adjoining to the launch space was an impediment for the swarm because it transitioned from the launch space to the present space. The mast was measured at roughly 15 metres tall, requiring the peak of the swarm’s transition between the launch and the present to be elevated.

Shortly after arriving, the copilot and RPIC had been met onsite by 4 members of the present help crew. A fifth member, who was to help in organising and conducting security checks on the five hundred plane, was late. Following launch, the help crew had been to watch the exclusion zone [2] surrounding the present space for intruders.

The RPIC briefed the crew on a number of matters, together with the operational plan for the show, the necessities for the launch grid and organising the plane. The help crew then commenced setting out the launch grid and plane as per the present plan. The RPIC recalled that setting out the plane took barely longer than anticipated because of the wind interfering with the method of measuring out the grid. In the course of the set‑up the RPIC took a number of floor degree wind readings with a handheld anemometer. The pilot recalled that these readings had been returning 8‍–‍10 kt of sustained wind, with frequent gusts as much as 12 kt. 

All through the set‑up the RPIC was interrupted on a number of events by duties usually assigned to the copilot. This included:

• extra briefings to help personnel
• a number of interactions with the shopper who wished to substantiate whether or not the present would be capable to go forward within the prevailing situations
• interactions with different stakeholders and senior administration of the operator’s firm who had been in attendance to view the present.

Organising the grid took roughly 2 hours, after which the RPIC gave the help crew a 30‑minute break whereas they accomplished a walkthrough of the grid to make sure that the placement and identification of every plane aligned with the set‑up plan. 

At 1740, the RPIC began display screen recording on the bottom management station (GCS) pc. This recorded all exercise on the display screen of the GCS pc and audio inside vary of the pc’s microphone (see the part titled Floor Management Station). 

All through the 50 minutes main as much as the present the recording captured interactions between the RPIC and copilot, and with help crew and stakeholders. It additionally recorded a spread of operationally vital data. An in depth abstract of occasions captured within the recording might be present in Appendix A, with key occasions summarised under.

At 1750 the primary recorded wind pace studying was taken, giving 14 kt. At 1754 and 1817 additional readings are taken at 12 kt and 14 kt respectively. At 1805 and following the 1816 studying the pilot and copilot mentioned the prevailing wind situations. The copilot said that they believed that situations had been appropriate to launch the swarm. In response, the RPIC recognized that the readings they’d had been solely at floor degree they usually had not examined for gusts on the meant top of the present. No additional wind pace readings had been taken and there was no additional dialogue of the wind pace recorded earlier than the present.

At 1756 the RPIC was recorded dictating a voice to textual content message to the shopper’s consultant with an replace relating to the standing of the present. They suggested that the situations had been on development with the forecast they usually anticipated the present to go forward at that time. At 1816 the RPIC recognized that the consultant had requested them for an replace by 1815 as as to whether the present would go forward. At 1817 the RPIC was recorded dictating an extra textual content message to the shopper that they had been good to launch.

At 1759 the RPIC recognized that to reprogram the present place to keep away from the boat mast in entrance of the launch space required the help of one other firm pilot as they’d not used that software program performance earlier than. Nonetheless, they had been unable to contact the opposite firm pilot for an extra 8 minutes, regardless of prearranging for them to be obtainable at 1800 to help.

Between 1807 and 1817 the RPIC and the opposite firm pilot went by means of the method of shifting the present, performing the present digital preview and deciphering the outcomes of the preview. The RPIC utilized the related correction to the present place, growing the present top and shifting the present to the left. The RPIC recognized that the elevated present top now exceeded the 120 m restrict of the approval, however the different firm pilot recognized that the encompassing buildings offered some shielding. The RPIC elected to proceed the present.

At 1817, following the completion of the present repositioning, the RPIC recognized that they wanted to work by means of the pre‑flight guidelines previous to launch. The pilot and copilot labored by means of the objects on the pre‑flight guidelines. On a number of events they’re interrupted by exterior communications from stakeholders and help crew.

At 1827 the RPIC instructed the copilot to make an airband broadcast in accordance with the pre‑flight guidelines. The copilot questioned the necessity for the printed however was overruled by the RPIC and made the related transmission. The RPIC then accomplished the verification that the present program had been efficiently uploaded to all 500 plane. At 1829 the copilot learn out the final pre‑launch objects on the guidelines and the RPIC confirmed that they’d been accomplished.

Flight

Launch

The plane had been programmed to take off and ascend right into a hover in a collection of 10 layers of fifty plane (Determine 2). The plane would then transfer out over the water transitioning into the present space flying by means of a collection of waypoints to make the related patterns of the present earlier than returning and touchdown again on the grid. The entire present was deliberate to take about 10 minutes from take-off to return.

At 1830:15 the RPIC commanded the present to launch on the GCS. Following a ten second countdown the plane powered up and the take‑off sequence commenced. The plane took off as programmed, with the ten layers of plane stacked over the take‑off grid (Determine 2). Nonetheless, 15 seconds after the primary plane launched the GCS recorded 45 plane with errors, indicating that plane had been out of place. Over the next 30 seconds the GCS recorded an extra 78 plane exhibiting as out of place. 

Transition to the present space 

At 1831:11 the swarm commenced its transition into the present space, however inside 30 seconds greater than half of the plane within the present had been indicating errors, most for being out of place. At 1831:43 and 1831:48 the RPIC tried to command the swarm to loiter, the primary try was unsuccessful as they’d not chosen the plane to ship the command to. The second try was profitable with the loiter command reaching all of the plane that had been related to the GCS pc. 

At roughly the identical time because the second loiter command was issued, a number of plane introduced with vital errors indicating an autopilot failure. This was shortly adopted at 1831:55 by the RPIC figuring out that there was a ‘fly‑away’. Additional errors of various severity ranges continued to current on the GCS. After confirming that the copilot had the fly‑away plane underneath their management, the RPIC directed the copilot to disarm[3] that plane. 

By this time over 400 plane had been presenting errors on the GCS. Between 1832:30 and 1832:50 the GCS quickly misplaced connection to virtually 400 of the plane within the swarm. When the connection was misplaced plane had been in a number of totally different modes, with many exhibiting loiter as per the RPIC’s command, some trying to return to the launch space and others, predominantly these with vital errors, exhibiting land in place.

Of the remaining plane related to the GCS, 7 plane had been trying to proceed with the present, which the RPIC then commanded to return house, whereas the rest had been indicating various ranges of errors. 

9 minutes and 56 seconds after the present was commanded to launch, the final operational plane returned to the launch level.

Divers contracted by the operator tried to recuperate the plane from the harbour over the next days. The divers recovered 236 of the 427 plane that entered the water, with 191 unrecovered.

Determine 2: CCTV footage of present

Supply: Metropolis of Melbourne, cropped and annotated by the ATSB

Context

Plane data

Overview

The swarm consisted of 500 Newton V2.2 remotely piloted plane manufactured by Shenzhen Damoda Clever Management Know-how Co., Ltd. (Damoda).

The Newton V2.2 is a quadcopter designed particularly for mild present operations (Determine 3). It measured 360 mm sq., sat 109 mm excessive, and weighed 725 grams. Mounted centrally on the underside of the plane was a single color‑altering LED mild outputting a most of 16 watts. With a single battery the plane was designed for a present time of between 16 and 18 minutes and with a most hover endurance of roughly 26 minutes. The variety of plane inside the swarm could possibly be diverse relying on the person present necessities, as much as a most of 1,024.

Determine 3: Damoda Newton V2.2

Supply: Operator, annotated by the ATSB

To conduct a present every plane was programmed with a collection of timed waypoints and light-weight color adjustments. The plane operated independently by means of these waypoints with minimal separation distances of roughly 1.5 m through the present. Plane weren’t fitted with sensors to permit impartial collision avoidance, counting on positional and time‑primarily based accuracy to forestall collisions.

The plane had been put in with a firmware bundle to allow operations. Because of the flight vital nature of the firmware, the operations guide required a flight take a look at be carried out following a firmware replace and {that a} document of this flight be made within the plane upkeep log.

Batteries

For the present every plane was fitted with a removeable Lithium Polymer (LiPo) battery that weighed 300 g and had a most power capability of 42.56Wh. Upon set up the plane had a pink button that might protrude from the physique of the plane to point that the battery was mounted appropriately. For a swarm of 500 RPA these batteries equated to a complete power capability of 21.28kWh. 

Plane limitations

The producer’s wind pace restrict for the Newton V2.2 was 8 m/s (equal to fifteen.6 kt or 29 km/h), this wind restrict was widespread to all Damoda plane. Along with the wind pace restrict the plane additionally had an ingress safety or IP[4] ranking of 63. This ranking indicated that the plane had been mud tight and will resist water spray however weren’t designed to function in rain or be immersed in water and they’d not float.

Plane positioning

Because of the shut proximity of the swarm plane, uncorrected GNSS place data was not sufficiently correct. To acquire excessive accuracy GNSS positions the plane had been related to a community containing a Actual Time Kinematic (RTK) receiver. Through the use of an impartial stationary receiver in proximity to the plane the positional accuracy might be improved from a number of metres to centimetres as required for present operations. At 1822, 8 minutes earlier than the present was resulting from launch, all plane had been exhibiting between 23 and 28 satellites related and a excessive accuracy RTK place repair.

Previous to the present, the operator arrange a spectrum analyser to determine potential interference within the GNSS sign that will trigger the plane to malfunction or be out of place. The RPIC suggested that previous to the present no abnormalities had been recognized within the sign that might have affected the aircrafts’ capacity to precisely place themselves. 

GNSS spoofing

GNSS spoofing is the method of tricking a receiver into reporting an incorrect place. Spoofing a sign requires 2 steps, first the incoming sign to the receiver must be jammed after which the receiver should lock onto an independently generated false sign offering incorrect data. Within the lead‑as much as the show the GCS pc reveals the place of every plane on the bottom and in flight. These positions had been proven over a base map and corresponded with places recorded by CCTV footage (Determine 4). If the sign to the plane had been spoofed these places wouldn’t have aligned.

Determine 4: Comparability of GCS and recorded plane positions

Be aware: The satellite tv for pc basemap picture as proven on the GCS will not be an correct illustration of the particular buildings across the launch web site. This picture was taken earlier in 2023 however the ATSB was unable to substantiate the precise date. Supply: Metropolis of Melbourne and operator annotated by the ATSB.

Plane modes

The Newton V2.2 could possibly be operated in 6 totally different flight modes, G (guided), S (stabilised), L (loiter), R (return to launch), LD (land) and AH (altitude maintain). A mode could possibly be chosen for a person plane, it could possibly be commanded for all plane within the swarm or it could possibly be routinely modified by logic inside the plane within the occasion that sure situations had been met. Handbook mode adjustments could possibly be commanded by way of the bottom management station pc or a backup guide controller (see the part titled Floor management station).

In guided mode the plane was positioned primarily based on the corrected GNSS place and transited by means of a collection of pre‑programmed waypoints, earlier than returning to the launch location.

In stabilised mode the GNSS positioning was disabled and the plane was manually flown utilizing the hand controller. This mode was used if the plane had an error that rendered it unable to return to house routinely.

In loiter mode the plane held each lateral and vertical place till an extra command was offered by the pilot, both by way of the GCS or utilizing the hand controller.

In return to launch (RTL) mode the plane routinely tracked again to a place over the launch location. Because the plane didn’t have impediment avoidance sensors, this selection was most well-liked just for particular person or small teams of plane as commanding RTL for the entire swarm was prone to lead to a number of plane collisions and lack of plane.

In land mode the plane landed instantly under its present location.

Plane errors

The Newton V2.2 had 6 error modes that could possibly be introduced on the bottom management station. These had been: 

• EKF (autopilot failure)
• W (waypoint concern)
• B (battery voltage was low)
• F (plane had breached the geofence)
• T and S (Too far and Static) each indicated that the plane was not on the deliberate place. Too far indicated that the plane was greater than 0.8 m from its goal place. The space from the goal place required to activate a static error was not recognized within the plane documentation.

These errors had been damaged into 3 classes relying on the required pilot response when they’re introduced.

• EKF or W errors required the pilot to return the plane to launch.
• B error – the plane ought to activate RTL routinely.
• F error – the plane would routinely activate RTL and re-enter the geofence. If it didn’t return inside the geofence the motors could be routinely shut down.
• T and S errors had been for data and monitoring. The pilot was solely to intervene and manually activate RTL if the gap between the deliberate and precise places continued to extend. 

The show of those errors on the GCS is mentioned additional within the part Flight management software program – Warnings. The RPIC recognized that there have been as much as 10 plane presenting with EKF errors, and that they’d by no means skilled multiple EKF error concurrently. 

Fleet

On the time of the prevalence the operator had a complete Damoda V2.2 fleet of 1,136 plane registered with the Civil Aviation Security Authority (CASA). The primary 515 of those had been registered with CASA on the finish of October 2022. The remaining plane had been registered in April of 2023, shortly after their buy.

Together with these extra plane, the operator additionally bought extra help tools for a second full GCS structure. This enabled the operator to both function 2 impartial fleets of 500 plane or to mix the two fleets for a single present of as much as 1,024 plane. When the operator bought the extra plane, it was equipped with the newest model of the plane firmware and the producer’s newest GCS software program (see the part titled Flight management software program). 

Floor management station

The bottom management station (GCS) consisted of 4 components: 

• a laptop computer pc operating Damoda’s flight management software program
• a Wi-Fi community to which all of the plane had been related, enabling communications and information switch between the plane and flight management software program earlier than and through the present
• a differential floor station for actual time correction of the GNSS sign
• a spectrum analyser used to determine abnormalities or points within the frequency bands that the plane and the GNSS sign had been working. 

These components had been dropped at the present location by the operator and had been arrange by the flight crew.

Flight management software program

Working on a laptop computer pc, the flight management software program offered all command and management actions for the swarm by means of the native community. Widespread to all Damoda plane varieties, the software program allowed flight crew to watch the standing of all plane earlier than and all through the present. It was used to add, manipulate and take a look at the proposed present, management the plane both by means of the software program itself or by tethering them to the hand controller.

The flight management software program additionally displayed errors and warnings affecting the plane or the software program. The flight management software program was not used for the event of the present flight paths or ‘drama’. This was accomplished in a unique software program bundle and a drama file containing the present flight paths for every plane was imported into the flight management software program for importing to the person plane.

When the operator obtained the primary 500 plane in October 2022 these had been supplied with model 2 of the producer’s flight management software program. Previous to the acquisition of the operator’s second 500 plane in April 2023, the producer launched an up to date model of the flight management software program (model 3), and this was offered to the operator, together with an up to date model of the plane firmware.

Wind pace monitoring

A wind monitoring perform was launched with model 3 of the flight management software program. This perform displayed the utmost wind pace and course encountered by plane within the swarm, within the higher proper nook of the display screen (Determine 5). To offer a studying, not less than one plane needed to be lively and related to the GCS software program.

The wind monitoring perform remained seen and its place fixed on the display screen all through the operation of the GCS. Different performance could possibly be chosen or deselected relying on the pilot’s data choice. Wind pace and course had been calculated and displayed in actual time by means of the interpretation of plane financial institution angle and motor pace, mixed with the deliberate and precise positions of the plane. 

When the wind pace restrict was exceeded, there was no audible, visible or tactile alert introduced to the pilot. As such, the flight crew wanted to actively monitor the parameter to pay attention to an exceedance of the wind pace restrict. Determine 6 reveals the wind pace indicator at 3 moments through the present with the wind pace under, simply above and considerably exceeding the 8 m/s printed wind pace restrict of the plane. 

Determine 5: GCS software program show with wind pace readout highlighted

Supply: Operator, annotated by the ATSB

Determine 6: Wind pace show under, simply above and considerably exceeding the wind pace restrict

Supply: Operator, cropped and annotated by the ATSB

The flight crew suggested that on the time of the present they weren’t conscious that this performance was obtainable to them. The RPIC reported that they solely turned conscious of it after they had been reviewing the incident with one other one of many operator’s pilots who recognized the indicator to them. The RPIC said that if they’d recognized this data on the time of the present then they’d have seemingly terminated the present when the wind pace restrict was reached.

Warnings

The GCS software program may current 2 various kinds of warnings relying on whether or not a person or a number of plane had been affected. 

Errors associated to particular person plane introduced on the GCS pc in a person field as proven in Determine 7. These bins confirmed the plane identifier, the error or errors and the mode the plane was working in. They had been then grouped by color coded class relying on the required pilot response. Errors requiring quick motion had been coded pink, those who resulted in an computerized RTL had been coded orange and those who solely required monitoring had been coded blue.

The place an plane confirmed errors from a number of totally different classes the plane was positioned within the highest class of urgency encountered. Determine 8 reveals all 3 of the classes showing on the GCS for this prevalence, shortly after the plane transitioned in direction of the present space.

Determine 7: GCS screenshot exhibiting particular person plane errors

Supply: Operator, annotated by the ATSB

Determine 8: GCS recording exhibiting the three error classes as they appeared on the night time of the present

Supply: Operator annotated by the ATSB

Errors that affected a number of plane had been introduced as a pop‑up over different home windows on the GCS display screen (Determine 9) and required acknowledgement earlier than every other motion could possibly be taken. These warnings had been introduced in cases akin to a failure of information to efficiently add to plane or failure of a command to succeed in the plane. 

Determine 9: GCS screenshot exhibiting a multi-aircraft warning pop‑up

Supply: Operator, annotated by the ATSB

Each forms of warnings relied on information processed by the GCS to show the related data to the pilot. The errors had been then introduced in such a method that the pilot may quickly interpret the that means and reply appropriately. 

Adjusting the present 

The GCS software program had the aptitude to regulate the place, top and orientation of the drama file to make sure that the flight paths could possibly be executed safely. The flight crew had a number of choices for making the adjustment, which could possibly be used independently or concurrently. They may change the peak or place of the entire drama file or they might modify the launch and touchdown profiles, which modified the place and altitude that the plane moved to earlier than they transitioned into the present space.

Because of the boat mast hazard the RPIC, in session with one in all firm’s different pilots, elected to regulate the place of the transition into the present space by growing the peak by 11 m and shifting all plane 2 m to the left (Determine 10). To accommodate for these adjustments the whole top of the present was additionally adjusted up by 8 m taking the utmost present top to 126 m. 

Determine 10: Drama adjustment performance as set by the RPIC

Supply: Operator, annotated by the ATSB

Setting the geofence and exclusion zone

The geofence is a polygon made from a collection of GNSS places surrounding the present space (Determine 11). It was manually created within the flight management software program after which uploaded to the plane. As soon as in flight, if an plane handed by means of the geofence it routinely activated the RTL mode to carry it again contained in the geofenced space and return to land. If the plane remained exterior the geofence then the motors had been shut down and the plane fell to the bottom or water uncontrolled. 

Determine 11: Improvement and placement of Geofence

Supply: Operator, annotated by the ATSB

The flight management software program had a measurement characteristic that allowed the operator to determine and measure approximate distances over the bottom map. This allowed the willpower of the dimensions of each the geofence and the following dimension of the exclusion zone (see the part titled Exclusion zone).

Hand controller

Swarm operations are carried out autonomously with the plane shifting by means of a collection of pre‑programmed waypoints or within the related failsafe modes. Within the occasion of a system concern or error that prevented the automated system from successfully controlling the swarm, guide management could possibly be taken utilizing a hand controller. The controller allowed the operator to fly the swarm, command mode adjustments and activate related failsafe modes on the plane. For the hand controller for use it should be tethered to the related plane within the swarm. It could possibly be tethered to all plane within the swarm or to sure plane independently.

The guide controller employed by the operator was a VANTAC Taranis hand‑held controller, manufactured by FrSky. The VANTAC (Determine 12) was a programmable, 24 channel, 2.4 GHz transmitter that could possibly be used to manage a spread of distant units, together with RPA. The controller had 8 programable management switches, (6 3‑place and a pair of 2‑place) that the person may assign to modes or operational settings. In help of the Damoda swarm operations the switches had been assigned as per Determine 12. The mode change allowed the operator to alter the mode between land, loiter and stabilised modes. As a part of the operator’s pre-flight guidelines the throttle (vertical motion on the left management stick) on the controller was to be set to 50% in order that if the controller was required the plane would have adequate energy to hover.

The emergency kill change was a 2‑place change. When activated it instantly shut down the motors, inflicting the plane to fall to the bottom. This was the command that the copilot applied as soon as the RPIC instructed them to disarm the fly‑away plane.

Determine 12: FrSky VANTAC Taranis controller

Supply: Operator

Crew data

The operator’s manuals listed the crew for a light-weight present operation in 3 distinct teams, all underneath the oversight of the RPIC, as follows: 

• flight crew, accountable for the protected setup and operation of the fleet of drones
• floor/help crew, assisted within the set-up of the fleet and operational space and monitoring the bottom and airspace across the present for potential intruders
• extra safety or different personnel concerned in securing the operational space, akin to water police for a present over water. 

Flight crew

For mild present operations involving as much as 500 plane the corporate operations guide required a flight crew of two – a mission commander (RPIC) and a copilot. The CASA permission for the operation (see the part titled Operational approval) listed particular pilots who had been accepted to function multiple RPA at a time. The CASA permission didn’t particularly require a second pilot, nonetheless the operator’s manuals contained a requirement for a 2 or 3 pilot operation relying upon the swarm dimension. 

Distant pilot in command 

The RPIC was authorised and certified to behave because the mission commander for the operation that was being undertaken. They held a Distant Pilot License (RePL) for multi‑copter operations as much as 25 kg. Upon becoming a member of the operator in October 2022, they’d accomplished the Damoda coaching program and subsequently been endorsed by CASA to function multiple RPA at a time.

On the time of the operation the RPIC had roughly 6 hours on kind consisting of 32 coaching or operational reveals various in dimension from 10 to 1,050 plane carried out at a spread of places, together with over water, and in each day and night time situations. The RPIC’s most up-to-date present flight was the rehearsal for the Docklands operation, which was carried out 4 days previous to the present.

The RPIC held final duty for the protected operation of the present in accordance with the related permissions and operator’s manuals. The operations guide outlined the precise duties of the RPIC to incorporate however weren’t restricted to:

• Conducting an operational security briefing on objects related to the RPA operation.
• RPA crew co-ordination.
• Making certain the RPA is in CASA accepted airspace.
• Making certain operations are carried out in accordance with firm working procedures together with the JSA [job safety assessment] and Flight Authorisation.
• Sustaining communication with the RPA crew all through the complete operation utilizing Native Comms Handheld Radios.
• Confirming duties of all flight crew members
• Reviewing the present design and confirm operational space, exclusion space, and minimal drone separation distance (1.0 m) previous to flight.
• Confirming correct set-up of base station.
• Operation of the RPA.
• Publish-flight information recording.
• Affirm all crew health for responsibility.
• Reporting incidents to the Chief Pilot.

Copilot

The copilot for this operation was authorised and certified to function within the function of copilot. They held a RePL for multi‑copter operations as much as 25 kg and had accomplished the operator’s Damoda coaching program following the introduction of the plane kind in October 2022.

The copilot had beforehand accomplished 17 lightshow coaching flights working in both the RPIC or copilot function, the newest of which was as a copilot 3 days previous to the prevalence flight at Sydney Olympic Park. The operator’s flight logs recognized that previous to that operation they’d not accomplished a present in additional than 6 months. The copilot had not been endorsed by CASA as certified to function as mission commander (RPIC) in a single‑to‑many operations, nonetheless underneath the operator’s manuals this was not required to function within the function of copilot. 

The copilot’s function as outlined within the operator’s manuals was to help the RPIC within the conduct of the present. The guide delegated particular duties to the copilot. Whereas not particularly said within the guide, one of many goals of this was to cut back the RPIC’s workload. The duties of the copilot included: 

• conducting an operational security briefing on airspace objects
• administration of stakeholders
• administration of present help crew
• monitoring working space Airband VHF frequencies all through the complete operation
• broadcasting on VHF frequency when wanted
• instantly advising Mission Commander of any related airspace site visitors
• present timing
• co-ordinating incident response
• help the Distant Pilot in Command and be co-located through the present except attending to an emergency
• activate emergency procedures in occasion of RPIC incapacitation
• Maintain direct communication with the all crew all through the complete operation utilizing Native Comms Handheld Radios (or co-location).
• Visible statement of swarm
• Alert of drone flyaway
• Management of drone flyaway Drones IDs 1-500

The copilot was additionally the operator’s chief distant pilot (CRP). As such, they’d general duty for the RPAS operation, together with the approval of operations deliberate by the opposite pilots. The copilot had accomplished coaching on the V2.2 plane and GCS software program when it was launched, nonetheless they said that they usually left the planning and operation of the reveals to the opposite pilots who had been more adept in swarm operations. This allowed them to deal with different areas of their function within the organisation. 

Because of staffing adjustments on the operator (see the part titled Staffing adjustments) the chief distant pilot had been introduced into this operation as a copilot. As they weren’t endorsed by CASA, they might not assume the function of RPIC. 

Floor crew

In help of the flight crew the operator’s guide required that one floor crew member be current for each 100 plane inside the show. Underneath the operations guide these crew members had been accountable for a spread of duties. These included: 

• floor dealing with of the RPAs
• pre- and post-flight checks of the RPAs
• battery administration
• monitoring of the bottom and airspace across the present space for potential breaches
• sustaining direct communications with the flight crew all through the complete operation.

The operator sourced floor crew members from a labour rent firm. Floor crew members had been briefed by the RPIC and required to finish a consent and compliance declaration acknowledging that they understood their function. As soon as briefed by the RPIC the administration of the present help crew was the duty of the copilot.

Further personnel

As this present was to be carried out over water, the operator was required to make sure that water site visitors was maintained away from the present space exclusion zone. To implement this zone the operator had engaged vessels from Parks Victoria, Victorian water police and a personal contractor to watch the present space perimeter. Communications between these vessels and the flight crew was maintained by UHF radio.

Multi-crew operations

Cockpit gradient

A cockpit or authority gradient refers to how balanced energy and choice‑making authority is inside a workforce. Authority will not be essentially outlined by expertise or competence in a job however could also be by means of the function that an individual holds (SKYbrary, 2025). The place a cockpit gradient is simply too steep, workforce members will not be prepared to problem or specific considerations over a pacesetter’s choices, and the place too shallow it will probably sluggish choice‑making processes.

A unfavourable gradient is the place a workforce member in a subordinate function has extra energy or authority than the workforce chief. This may undermine the workforce chief’s authority and result in the chief deferring to, or putting extra weight on, that workforce member’s opinions or concepts.

In crewed operations, to be endorsed to fly multi‑crew, pilots should undertake multi‑crew coordination (MCC) coaching. A part of this coaching required the candidate to show efficient administration of flight deck gradient for duties that had been being carried out. Neither the CASA approval nor the operator’s documentation required this or equal coaching for swarm operations.   

Operator data

Operations guide

The operator maintained an operations guide and operations library in accordance with the necessities of Half 101 of the Civil Aviation Security Laws 1998 (CASR); each had been accepted by CASA. The operations guide contained the operator’s overarching processes and procedures and outlined numerous regulatory compliance necessities. The operational library contained extra particular plane data and operational processes.

For instance, the operator’s guide contained details about the conduct of RPAS show operations, nonetheless the precise course of for finishing up the pre‑present guidelines was contained within the operational library. Equally, the fundamental and overarching emergency procedures had been contained inside the operations guide however particular responses and processes for various emergencies had been within the operational library. 

The operations guide outlined that the chief distant pilot was accountable for all operational issues and distant pilot coaching affecting security. This included:

• making certain that operations had been carried out in compliance with related rules
• duty for functions, permissions and approvals to facilitate operations
• sustaining a reference library of operational paperwork
• creating guidelines and procedures regarding flight operations. 

Checklists

To help present operations utilizing Damoda plane the operator maintained and utilised a number of checklists contained inside the operations library. The present day and flight checklists had been the first paperwork utilized by the crew in preparations for a present. There have been totally different variations of those checklists relying on whether or not kind of than 500 drones had been getting used within the present. 

For a present of as much as 500 drones, the present day guidelines consisted of 10 objects, taking the crew by means of the set‑up of the GCS and the laying out of all drones in preparation for the present. It additionally included steerage on the set‑up of the community and RTK tools and environmental monitoring together with electromagnetic and wind situations.

The ultimate merchandise on this guidelines (Determine 13) was for a climate inspection. This merchandise required the pilot to examine the present climate forecast and measure the wind pace at 5‑minute intervals for the 30 minutes earlier than the present begin ‘if the pilot has capability’. The guidelines didn’t determine a selected location the place these wind readings are to be taken. The guidelines was dated 7 March 2023, which was earlier than the introduction of the wind administration plan and climate drone (see the part titled Wind administration plan). 

Determine 13: Merchandise 10 on the operator’s present day guidelines

Supply: Operator

At interview each the RPIC and copilot recognized that this guidelines was obtainable to help them within the lead‑as much as the present. The RPIC said that they and different pilots had been conversant in the content material and they didn’t all the time consult with the guidelines throughout preparations for the present.

For a present of as much as 500 drones the flight guidelines consisted of 20 objects taking the flight crew by means of the set‑up of the plane and GCS tools, a evaluate of the emergency procedures and remaining checks. Merchandise 17 was the ultimate merchandise earlier than launch and it required the RPIC to contemplate their confidence within the fleet and assess the general threat elements earlier than deciding whether or not to launch the present. The RPIC said that the flight guidelines was obligatory and was all the time used within the lead‑as much as the present.

Emergency procedures

The operator’s manuals outlined the procedures within the occasion of an emergency through the swarm show. It outlined procedures for a spread of non‑swarm associated emergencies together with hearth on the bottom, crew medical occasion and non‑cooperative site visitors (plane or chicken) interacting with the swarm.

The final response to any of those emergencies was to reply to the quick risk (if required) after which place the swarm on the bottom as shortly and safely as attainable both utilizing an RTL or land command despatched to all plane or manually controlling plane to the bottom. 

The operator maintained particular emergency procedures for plane producing EKF (autopilot failure) and W (waypoint concern) errors. These errors required a direct response from the pilot to pick RTL and if the RTL command failed the plane had been to be flown again manually utilizing the hand controller.

Merchandise 2 of the operator’s flight guidelines required that the RPIC and copilot reviewed the emergency procedures previous to flight. The GCS recorded that the RPIC said that the response to those errors could be to RTL, take management of the plane manually and if neither of those had been profitable, land the plane within the water.

In response to this prevalence, the RPIC activated the emergency process for EKF errors and fly away plane. Whereas initially the RPIC activated a loiter command, at the moment neither the fly away nor the primary EKF error had occurred. When these occurred the RPIC instructed the copilot to manage after which deactivate the plane and tried to RTL every plane exhibiting an EKF error on the GCS.

Coaching and checking

With the introduction of the Damoda plane all of the operator’s pilots, together with the copilot (CRP) undertook preliminary coaching with the producer’s Australian agent. The CRP recognized that there have been some gaps within the coaching so the operator’s pilots undertook additional in‑home familiarisation and testing with the present software program to know the related capabilities and options.

When model 3 of the GCS software program was launched, no formalised coaching was undertaken with the producer or its Australia agent. The operator and RPIC reported that the producer had offered a doc with set up steerage and a few variations between the previous and new variations of the software program. They additional recognized that previous to beginning operations with the brand new software program the pilots undertook familiarisation with it, figuring out updates to present options and a number of the new options.   

There was no documented course of for making certain that every one pilots had the identical degree of competence or had been conscious of all of the related options of the software program.

Previous to commencing present operations, the RPIC was required to finish the operator’s inner coaching program and be checked by CASA for approval to function a number of plane concurrently. The coaching syllabus for operations utilizing the Damoda plane concerned 8 periods. The primary required the pilot to show appropriate set‑up and operation of all of the present {hardware}, together with the GCS and plane.

The next periods concerned incremental will increase within the variety of plane from a single plane by means of to a 1,050 plane flight. Every session required the pilot to determine the related configuration, set‑up and crewing adjustments for the variety of plane being operated. The CASA examine for approval to the operational instrument was constructed into this coaching syllabus and was accomplished as a part of session 7. Session 8 was a remaining demonstration flight with 1,050 RPA.

The operator’s guide required present‑certified RPICs, copilots and floor crew members to undertake proficiency checks to make sure that they had been operationally succesful. Proficiency checks lined a spread of things relevant to every of those roles. They had been required each 12 months except the candidate had carried out a minimal of 4 related mild present operations within the final 12 months, whereby the time between the proficiency checks could possibly be prolonged to 24 months.

The RPIC had joined the operator lower than 12 months beforehand and had accomplished greater than the required 4 mild present operations as RPIC that means {that a} proficiency examine was not required till October 2024.

Proficiency checks had been required for every plane kind and extra proficiency checks weren’t required within the occasion of serious adjustments to the software program.

Wind administration plan

In response to a selected request from an earlier shopper the operator had developed a wind administration plan. Launched on 21 Might 2023, the plan was ‘…to make sure the protected and profitable execution of a drone mild present occasion in windy situations’. Whereas initially developed for that particular shopper the plan made no particular reference to that shopper or occasion, typically figuring out the set‑up and operational wind limits and specifying how climate could possibly be monitored. The set‑up restrict was 18 kt (9.2 m/s) measured 3 hours earlier than the flight and the operational restrict was 14 kt (7.2 m/s) measured 5 minutes earlier than the flight. The wind administration plan additionally contained larger degree statements about how the usage of sure plane, coaching of pilots, engagement with stakeholders, an emergency response plan and submit‑occasion analysis was used to realize the aim of the plan. 

Regardless of containing operationally related data associated to wind administration and responses to hostile situations the plan was solely included within the occasion plan for the present and was not built-in into the organisation’s operational processes and procedures.

Model 1.1 of the wind administration plan was dated 6 June 2023, roughly 5 weeks earlier than the accident flight. The up to date model elevated the operational wind restrict from 14 to 15.3 kt (7.2 to 7.9 m/sec) and launched, on the RPIC’s discretion, the usage of a climate drone to check the situations within the present space earlier than the present was launched. The plan didn’t element how the climate drone could possibly be used, however the CRP recognized that it could possibly be carried out with a separate plane or an plane from the swarm could possibly be tethered to the controller and flown manually for the climate examine. As with the sooner model, the up to date model of the plan was solely included within the occasion operational plan and never built-in into present processes and procedures. 

The wind administration plan didn’t consult with the wind pace readout on the GCS show.

The RPIC suggested that they had been conscious of the wind administration plan and that, to their information on the time of the prevalence, it didn’t include the choice for the launch of a climate drone. They additional said that this was solely launched submit this accident. 

Staffing adjustments

Within the weeks main as much as the present there have been a number of staffing adjustments that impacted how the present was deliberate and carried out. Firstly, the operator’s chief government officer (CEO) had left and this present was the primary alternative for the brand new CEO to see the corporate’s drone swarm operation in practise. Secondly, the operations supervisor, who had been the primary level of interplay between the shopper and flight crew throughout present preparations had left the corporate and had not been changed. 

On account of the departure of the operations supervisor, the RPIC had taken on this function and subsequently was concerned in preparation of a number of reveals, together with the Docklands present. This included liaising instantly with the shopper and different stakeholders. The RPIC said that having the pilot working the present concerned in shopper interplay throughout operational planning was usually averted. This was to make sure that the RPIC on the night time may deal with working the present and never have to fret about participating with the shopper.

Usually, as soon as a present had been deliberate, contact with the shopper could be handed over to the copilot for them to handle on the night time of the present. For this present that didn’t happen because of the already established relationship between the RPIC and shopper. 

The discount in workforce dimension led to by the operations supervisor’s departure diminished the personnel obtainable for this present. Subsequently the CRP who was copilot‑certified, however said that they weren’t ‘current’ within the operation, stepped into the function of copilot. The RPIC commented that this resulted in a unique dynamic between the RPIC and copilot than if the copilot had been extra skilled.

Operator’s evaluate

Following the accident the operator carried out a evaluate into the prevalence and recognized the next:

• The flight crew didn’t take into account the situations within the present space at altitude.
• RPIC was underneath unrealistic strain to finish the present within the allotted time.
• The copilot’s restricted expertise elevated strain on the RPIC.
• Requirement to maneuver the present diminished time obtainable for present preparations.
• The RPIC had vital confidence within the reliability and performance of the operational fleet.

Operational data

Operational approval

In Australia RPAS operations are ruled by Half 101 of the CASR. Underneath regulation 101.300 an individual might not function multiple RPA and not using a particular approval from CASA. On 12 Might 2023 CASA issued a 12‑month approval for the operator and specified pilots to function multiple RPA at a time and at night time, topic to a collection of situations. A number of the situations listed on this approval had been that the:

• operator should have an lively discover to airmen (NOTAM) advising when and the place the operation was happening
• operator should function in accordance with their operations guide
• operator might solely function Damoda multirotor plane as much as 750 g
• RPA should have acceptable failsafe performance within the occasion the info hyperlink to it was misplaced.
• operator should preserve an acceptable exclusion distance to non-essential personnel as outlined within the particular revision of their operations library.

Supplied that these situations could possibly be met, the operator was permitted to plan reveals at any location in Australia. 

Present planning

As soon as a possible present location had been recognized, an operational self‑evaluation was to be carried out on the positioning utilizing the method outlined within the operations library. The evaluation was to incorporate hazards inside the operational space, together with the present airspace, the launch and restoration space and the traversal airspace between these 2 areas. The evaluation additionally decided the exclusion zone necessities. 

The self-assessment required consideration of the entry to each the bottom and airspace in these areas, clearance and obstacles, the potential for RF interference, floor topography and different potential customers. The guide particularly recognized that waterways had been a most well-liked operational space because the water offered a pure barrier to public entry. Waterways with out vessel entry had been most well-liked, nonetheless the place vessel entry was attainable then an exclusion zone wanted to be arrange and enforced by the related authorities.

Docklands

The present planning for the Docklands operation was carried out by the RPIC and one of many operator’s different pilots. A part of the planning course of was engagement with the harbour authority to organise a harbour closure and enforcement of the exclusion zone across the present. Within the days main as much as the present, the operator requested that the 15‑minute closure window for the present be moved later resulting from forecast wind situations. The operator suggested that the harbour authority had said that this was not attainable.

Occasion operational plan

The occasion operational plan contained all of the related data that the crew required to conduct the present, akin to timings, location, related stakeholder contact particulars and plans for site visitors and crowd management. Listed as attachments to the operational plan had been 5 appendices (labelled A by means of E). Appendix A was the wind administration plan. The occasion operational plan didn’t specify which model was hooked up, nonetheless on the time v1.1 was present. Appendix D contained the operator’s threat evaluation. This doc recognized the lack of plane into the water as a hazard that required therapy. A lot of the therapies had been associated to administration of batteries and inspection of plane, the ultimate therapy was the provision of divers onsite to recuperate any RPAS that had been misplaced into the water.

The occasion operational plan and its appendices had been obtainable to the flight crew on the day of the accident. Nonetheless, the RPIC reported that within the lead‑as much as the present the crew would usually consult with the checklists somewhat than the occasion operational plan for related processes. Within the 50 minutes main as much as the present the one reference that was recorded to the occasion operational plan was related to acquiring the frequency for the close by Essendon air site visitors management tower.

Operational space

Victoria Harbour is positioned roughly 1 km south‑west of the Melbourne CBD. The realm surrounding the harbour is a combined residential and business precinct with the Docklands Stadium on the northern finish and several other excessive‑rise buildings adjoining to the harbour, with the tallest being roughly 140 m.

South of the harbour the Bolte Bridge crosses the Yarra River with two 140 m tall help towers. The chosen launch web site had beforehand been utilized by one other operator to launch a swarm show. That show had encountered points with magnetic interference near the bottom, which was believed to be because of the massive quantity of metal reinforcing of the concrete on the launch web site related to its earlier use as an operational dock.

The operator had recognized this as a possible hazard and anticipated that there could also be some magnetic interference with the plane, nonetheless there have been minimal impacts recognized within the GCS recording or reported by the flight crew previous to or through the preliminary launch of the swarm.

As proven in Determine 1 there have been a number of jetties the place pleasure craft had been moored extending as much as 90 m into the harbour. Because the operator didn’t have entry controls in place for these jetties, to make sure security for anybody on them on the time of the present, they wanted to be exterior of the exclusion zone across the present space. 

Exclusion zone

An exclusion zone ensures that, within the occasion of an plane operational concern, it is going to be contained and never pose a threat to non‑important personnel. The zone is calculated from the geofence, primarily based on the plane’s most operational pace and its wind pace restrict. Due to this fact, an plane working at most operational pace with a tail wind on the plane’s wind pace restrict will nonetheless be contained. The exclusion zone was calculated at 50 ft working top increments between 100 ft and 400 ft (most allowable present top).

Desk 1, reproduced from the operations library, reveals the calculated minimal exclusion zones for Damoda V2 plane between 100 ft and 400 ft.

Desk 1: Damoda V2 minimal exclusion zones by plane top

top of RPA	dimension of exclusion zone
400 ft (121.92 m)	70 m
350 ft (106.68 m)	61.4 m
300 ft (91.44 m)	54 m
250 ft (76.20 m)	45.9 m
200 ft (60.96 m)	39 m
150 ft (45.72 m)	31.3 m
100 ft (30.48 m)	23.9 m[5]

Previous to setting the geofence, the pilot measured the gap between the sting of the present space and a publicly-accessible jetty on the other facet of the harbour to be 62 m. The RPIC then set the geofence across the present space manually utilizing a buffer of 8‍–‍15 m, leading to an efficient exclusion zone between 47‍–‍54 m (Determine 14). 

Determine 14: Exclusion zone positioning

Supply: Operator, modified and annotated by the ATSB

Based mostly on the operator’s exclusion zone calculation course of, the ATSB assessed the dimensions of zone required to include plane working at most present pace and topic to a tailwind of twice the accepted restrict of the plane (16 m/s) at a top of 126 m (the utmost deliberate top of the present). In that situation, an exclusion zone of greater than 100 m would have been required. 

Meteorological data

Operator accessed data

The flight crew suggested that, all through the afternoon and within the lead‑as much as the present, they’d accessed meteorological data from a number of sources. This included the Bureau of Meteorology (BoM), Windy and Willy Climate functions and aviation meteorological forecasts, together with the related graphical space forecast and terminal space forecast for Essendon Airport (6 nautical miles to the north-west of Docklands). In discussing the wind situations the flight crew famous that they had been above the restrict of the plane, however anticipated them to ease main as much as the present time.

Floor‑primarily based monitoring

The flight crew had been monitoring the wind pace on the bottom utilizing a handheld anemometer[6]. The flight crew reported that through the set‑up for the present the wind had been recorded in extra of the aircrafts’ restrict. 

Desk 2 reveals the recorded wind readings that had been taken within the 40 minutes main as much as the present, ending at 1817.

Desk 2: Wind pace measurements taken at launch web site recorded by GCS

Native time	Wind Velocity (knots)	Wind Velocity (m/s)	Notes
1750	14	7
1752	11	5.5
1754	12	6
1754	29	15	Crew member recorded advising ‘just for a second however then it went again right down to 12’
1817	14	7
1830	–	–	Present launch
Plane wind restrict	16	8

Bureau of Meteorology aviation forecasts and observations

The graphical space forecast issued by the BoM, legitimate on the time of the present for the Docklands space, recognized floor visibility exceeding 10 km and extreme turbulence under 6,000 ft for many of south‑japanese Victoria.

At 0927 on the day of the present the BoM issued a terminal space forecast (TAF) for Essendon Airport (YMEN)[7]. The TAF was legitimate between 1000 and 2200 native time on the day of the present. It forecast winds from the north at 18 kt gusting to twenty-eight kt, strengthening to twenty kt gusting 32 kt from 1100, with extreme turbulence under 5,000 ft from 1000.

At 1507 the BoM issued an amended TAF legitimate from 1600 until 0400 the day after the present. From 1600 it forecast winds from the north at 18 kt gusting 28 kt and extreme turbulence under 5000 ft. From 2200 winds had been forecast from the north at 14 kt with the turbulence lowering to average. 

Corresponding observations

METAR and SPECI data for YMEN for the interval from the beginning of the amended TAF at 1600 till 1830 (the present launch time) was in line with the forecast situations. The wind course was constantly from the north and wind speeds diverse across the aircrafts’ restrict, with gusts between 25–30 kt (Determine 15).

Determine 15: YMEN wind pace observations

Supply: ATSB utilizing BOM information

Plane

Whereas airborne and related to the GCS the plane reported wind pace and course data, which was displayed on the wind monitor. The wind pace was manually extracted from the GCS recording and plotted at 5 second intervals exhibiting the adjustments in wind pace all through the prevalence (Determine 16).

Inside 10 seconds of the primary information being recorded, the plane had been working in extra of the wind pace restrict. Because the plane climbed through the transition to the present space the wind pace elevated quickly progressing to greater than double the 8 m/s restrict of the plane.

Over the next 35 seconds the wind pace decreased and remained at or near the restrict till 1833:30, roughly 2 minutes after the present was launched. On the time the wind pace decreased a lot of the plane had activated their failsafe mode and had been trying to land within the water. However the potential impact of wind gusts, at these decrease heights the wind speeds had been seemingly nearer to the speeds recorded on the bottom earlier than launch.

Determine 16: Wind speeds displayed on the GCS

Supply: ATSB primarily based on operator information

Recorded information

Plane

Following the prevalence the operator downloaded the flight logs from the plane that weren’t submerged and offered these, together with the display screen recording and logs from the GCS software program to the producer for additional evaluation.

The producer recognized that as much as 397 plane concurrently reported ‘T’ errors. Additional evaluation of the obtainable logs indicated that plane throttled to 100% and that the recorded pitch angle of the plane (max 53°) exceeded the traditional flight angle (Determine 17).

The producer concluded that the plane had encountered wind situations exceeding their functionality.

Determine 17: Plane pitch, roll and throttle parameters

Supply: Producer, annotated by the ATSB

Particularly, whereas a lot of the plane had been exhibiting the commanded loiter mode, the producer recognized that:

Because of the affect of the wind pace, the facility of the motors was not capable of present the required raise for the drones, so that they moved up and down and slowly landed.

With out the capability to offer the required raise the plane couldn’t preserve place within the loiter because the RPIC had commanded and subsequently descended. This resulted in a lot of the plane ditching into the harbour. The GCS recording didn’t present proof of a mode change, with most plane nonetheless exhibiting the ‘L’ indicating they had been in loiter mode on the GCS when connection was misplaced.

The producer’s report additionally said that the pilot was accountable for testing the wind pace and must be conscious that the winds at top could also be higher than that on the bottom.

Floor management station

In accordance with the operator’s present day guidelines the RPIC began display screen recording on the GCS laptop computer pc at 1740, 50 minutes earlier than the present was launched. The recording captured all exercise that was displayed on the display screen, together with command inputs and alternatives, errors and performance shows by means of till 1920, 50 minutes after launch.

The recording solely captures what was displayed on the display screen and never the knowledge that the software program used to generate the visible show. For instance, through the present an plane standing window was open over the placement map so the placement of the plane throughout and after transition into the present space was not seen. 

The software program used to document the display screen additionally recorded the enter from the pc’s microphone, capturing the interactions and communications between numerous crew members that had been inside vary. Appendix A summarises the recording main as much as the present.

Closed circuit tv

A collection of 6 closed circuit tv (CCTV) cameras round Victoria Harbour (Determine 18) captured the present’s launch, transition to the present space and a number of the present. The footage captured the uncommanded motion of a number of plane, plane collisions, the plane touchdown within the water and the fly away plane (Determine 2).

Digicam 1 captured the placement of the boat mast that the RPIC had recognized as presenting an impediment to the swarm (Determine 2). Digicam 4 captured a number of flags exhibiting full extension on the time that the present was launching within the background. Noting that wind situations diverse with top, this digital camera was used to achieve a basic understanding of the situations across the present web site within the lead‑as much as, and on the time of, the present.

Determine 18: CCTV cameras round Docklands

Supply: Google Earth, annotated by the ATSB

Security evaluation

Introduction

At 1830 on 14 July 2023, the distant pilot in command (RPIC) of a swarm of 500 Damoda Newton V2.2 plane commanded the plane to launch to conduct a light-weight present. Shortly after launch, and earlier than the plane transitioned to the present space, the RPIC was introduced with an growing variety of errors. The swarm continued in direction of the present space the place additional errors introduced with a number of plane getting into failsafe modes and touchdown or falling into the water. A complete of 427 plane had been submerged, with solely 236 recovered.

The next evaluation will take into account the conduct of the present from the launch to the plane ditching into the water, together with the elements that impacted the choice to launch. It’ll additionally evaluate a number of issues of safety that elevated the chance to the operation. 

Launch choice

Obtainable data

Previous to the present the flight crew monitored wind situations by referencing numerous climate sources and taking wind pace measurements at floor degree. The situations on the bottom had been under the restrict of the plane with gusts exceeding the restrict. The flight crew anticipated that, primarily based on their interpretation of the obtainable forecasts, wind situations would ease within the lead‑as much as the present time.

Nonetheless, at 1817, 13 minutes earlier than the present launch, a wind pace of seven m/s was recorded on the bottom, just one m/s under the allowable wind restrict. At the moment there was a dialog between the RPIC and the copilot concerning the wind situations. The RPIC recognized that the situations on the bottom had been close to the restrict of the plane and that the wind pace within the present space was prone to be larger than that at floor degree. The copilot responds that it’s solely gusting and that they simply need to get off the bottom. Within the following 13 minutes previous to the launch the RPIC was occupied with different duties and no additional wind pace evaluation was undertaken. 

Contributing issueThe distant pilot in command launched the present with the wind pace near the restrict of the plane and conscious that situations within the present space had been prone to be worse than these on the bottom.

Wind administration plan

The model of the operator’s wind administration plan present on the time of the accident offered steerage for the gathering of wind data inside the present space utilizing a climate drone. The RPIC was conscious of the wind administration plan however not that it contained the choice to make use of a climate drone. That understanding was in line with the content material of the earlier model of the plan that didn’t include that choice. 

Because the wind administration plan was hooked up to the occasion operational plan, which was ready by the RPIC and accepted by the copilot of their function as CRP, each flight crew ought to have been conscious of the plan’s availability to them on the night time of the present and its contents. Nonetheless, in response to the draft report, each suggested that they had been unaware of its attachment to the occasion operational plan. Additional, because the wind administration plan had not been included in any operational course of or process there was no immediate for the flight crew to evaluate or entry the plan previous to the present for steerage within the windy situations. Subsequently, neither the plan nor the climate drone choice it contained had been used.

If a climate drone had been launched it’s extremely seemingly that it could have encountered situations like these skilled by the swarm. That might then have offered the flight crew with affirmation that situations had been unsuitable for the sunshine present to proceed.

Contributing issueWithin the lead‑as much as the present, the flight crew didn’t use a climate drone to conduct a wind examine at present altitude as outlined within the operator’s wind administration plan. Because of this, the distant pilot in command didn’t have correct details about the situations inside the present space on the time they launched the swarm.

Management points and ditching

Present launch

Ten seconds after the RPIC commanded the swarm to launch, the wind pace displayed on the bottom management station (GCS) was equal to the aircrafts’ restrict of 8 m/s. An extra 10 seconds later the readout was exhibiting a wind pace of 9.9 m/s. At the moment 85 plane had been displaying errors on the GCS. Of those, the 20 the place the error kind was seen had been all exhibiting ‘T’ errors indicating that they had been out of place. The producer’s evaluation of the flight information recognized that these ‘T’ errors had been introduced because of the plane motors being unable to carry place towards the prevailing wind.

Having dominated out interference with or spoofing of the GNSS sign the ATSB additionally thought of the potential of a malicious actor trying to take management of the swarm. Nonetheless, the GCS pc confirmed no surprising adjustments to plane mode or any instructions obtained by the plane that weren’t commanded both by the RPIC or routinely by means of plane logic. Moreover, if the plane had been interfered with and tasked to alternate positions then they’d seemingly not have recorded out of place errors.

Contributing issueShortly after launch, earlier than transitioning to the present space, the swarm encountered wind situations that exceeded the aircrafts’ operational manoeuvring functionality. This resulted in a number of plane being out of place and errors presenting on the bottom management station pc.

Floor management station wind pace show

There was no indication from the dialogue, feedback or actions recorded on the GCS pc that the flight crew recognized a wind restrict exceedance. They didn’t equate the 85 plane indicating ‘T’ errors to a restrict exceedance or determine the wind pace readout. The RPIC and copilot had been each unaware of the GCS wind pace show performance so weren’t monitoring it for restrict exceedances. They said that if they’d recognized that the wind was in exceedance of restrict that they’d have taken actions to terminate the present.

As soon as the present had launched the copilot’s duties as outlined within the operations guide had been to watch the airspace for related site visitors, visually observe the swarm and to watch it for fly aways. These 3 duties required the copilot’s consideration to be on the swarm and the encompassing airspace somewhat than element displayed on the GCS pc. Whereas the copilot visually recognized plane out of place, they didn’t affiliate it with a wind pace restrict exceedance.

Contributing issueThe flight crew had been each unaware that the bottom management station had a wind pace monitoring perform. The distant pilot in command didn’t use it to watch the wind situations after take-off. Because of this, they didn’t determine that the wind exceeded the aircrafts’ limits and continued with the transition to the present space.

Motion into the present space

Because the plane moved into the present space alongside the pre‑programmed flight paths, the wind pace will increase noticeably from 8.3 m/s to 18.5 m/s 40 seconds later. CCTV footage confirmed a number of plane within the higher layers of the present drop into the decrease layers and collide with each other. The GCS displayed an growing variety of errors throughout all 3 classes. Not all errors had been proven on the display screen concurrently so it was not attainable to find out the precise variety of plane presenting every error. Nonetheless, the producer’s evaluation confirmed a most of 397 plane concurrently recorded T errors indicating that they had been out of place and the GCS recorded not less than 11 plane introduced with F errors indicating that they’d breached the geofence. 

The RPIC’s final command to the swarm was to loiter, the producer’s evaluation confirmed that this command was obtained by plane within the swarm. The producer’s evaluation additional recognized that, because of the wind situations the motors had been unable to offer the required raise to stay airborne whereas trying to take care of their place. The producer reported that they subsequently descended into the water under their location. 

Contributing issueShortly after beginning the transition into the present space, the swarm encountered wind situations that had been greater than double the printed functionality of the plane. This led to a number of plane being unable to carry place, with not less than 11 plane breaching the geofence, a number of plane collisions and most plane descending into the water.

Human Elements

Pilot workload

All duties require a degree of cognitive load to course of the knowledge and undertake the exercise. Workload is a measure of the quantity of psychological effort that’s wanted or expended to course of this data. People have a restricted capability to course of data, the place the knowledge processing required is near, or exceeds, the human functionality that is known as overload and may have a number of unfavourable results on efficiency. These results can embrace, process shedding, attentional focusing, discount in situational consciousness, elevated fatigue and the elevated likelihood of errors. (United Kingdom Civil Aviation Authority, 2016)

The extent of workload that a person process requires varies relying on a spread of things. These embrace the problem of the duty, familiarity and recency with the duty, the variety of different duties which might be being carried out concurrently and the time obtainable to finish the duty. (United Kingdom Civil Aviation Authority, 2016)

The completion of an RPAS mild present requires flight crew to be acquainted and work together with a number of programs together with:

• the plane
• the assorted {hardware} and software program components of the GCS
• situation monitoring tools
• operational processes and procedures.

The flight crew additionally have to work together with and handle help crew and stakeholders. The operator had procedures to mitigate this by means of the implementation of the multi‑crew operation requiring not less than 2 flight crew members for reveals of greater than 10 plane. 

Workload evaluate

A evaluate of the operational surroundings within the lead‑as much as and on the time the present was launched recognized 2 elements that elevated the RPIC’s workload above the traditional degree for present operations. These had been the

• copilot’s restricted expertise in present operations
• RPIC’s lack of familiarity with adjusting the present place. 

Copilot expertise

For this operation the operator’s chief distant pilot (CRP) was performing the function of copilot. On the time of the present the RPIC had accomplished virtually twice as many reveals because the copilot, and the copilot had solely carried out a single present within the earlier 6 months, which was on the Wednesday night time earlier than this present. Whereas not required to be, the copilot was additionally not accepted by CASA to function within the RPIC function.

At interview each flight crew recognized that the copilot had much less expertise in present operations in comparison with the RPIC and the copilot themselves recognized that, whereas present, they had been ‘rusty’ when it got here to indicate processes and procedures. Because of this, some duties that had been usually assigned to the copilot had been carried out by the RPIC. The GCS recording captured the RPIC:

• actively managing numerous stakeholders and the present help crew
• making certain that the present timings had been met
• alerting the copilot of an plane fly away.

All these duties had been the duty of the copilot within the operator’s procedures. The RPIC reported that if they’d been working with a extra present pilot the division of duties would have been extra equal, which might have diminished their psychological load. 

The elevated duties that the RPIC carried out meant that they needed to transfer from process to process quickly, and work on a number of duties concurrently. Each of that are identified to extend workload. (United Kingdom Civil Aviation Authority, 2016)

RPIC lack of familiarity

On the night time of the present the presence of the boat mast hazard meant that the RPIC needed to reposition the present. Being unfamiliar with the required course of, the RPIC elected to seek the advice of, by telephone, with one other pilot who was conversant in the system. 

The dialog between the RPIC and the opposite pilot had been prearranged for 1800, 30 minutes earlier than the present launch time. Nonetheless, the opposite pilot didn’t name again till 8 minutes later, leaving solely 22 minutes earlier than launch to impact the change. 

Subsequently the RPIC was preoccupied with duties of shifting the present for 18 of the 30 minutes main as much as the present. Based mostly on the required actions it was assessed that, for somebody conversant in the method and web site, the transfer of the present may have been accomplished in about 5 minutes.

In abstract, the mix of process unfamiliarity, time strain and further duties because of the copilot’s restricted present expertise considerably elevated the RPIC’s workload within the lead‑as much as launch. That diminished the effectiveness of the wind pace evaluation very important for the protection of the launch choice. 

Contributing issueThe distant pilot in command’s workload was considerably elevated resulting from their unfamiliarity with the method to make the mandatory present place adjustment and the copilot’s restricted information and expertise in present operations. This diminished the effectiveness of the wind pace evaluation very important for the protection of the launch choice.

Operational strain

Stress refers to a sense of inner or exterior stress, which can not essentially be primarily based on precise urgency or necessity. This strain can stem from numerous sources, akin to tight schedules, stakeholder expectations or private requirements of efficiency. It could actually result in rushed choices, reducing corners or taking of pointless dangers that may impression the protection of operations. (Ramdeen, 2024)

A number of ATSB investigations and different publications have mentioned the impression that private, social or organisational pressures (perceived or precise) can have on pilot climate‑associated choice‑making. Of their security leaflet about visible flight guidelines into instrument meteorological situations (VFR into IMC) occurrences, (UK CAA, 2024) the UK Civil Aviation Authority (CAA) recognized that as a pilot:

‘It’s possible you’ll really feel strain to start or proceed a flight resulting from elements akin to time constraints, passenger expectations, disruption to your private life or the continuation bias of desirous to execute the meant plan. The impact of those pressures is usually known as ‘get-there-itis’ and may result in a disregard for climate situations or an excessively optimistic interpretation of the state of affairs, growing the chance of a VFR into IMC situation’

As a big public occasion an RPAS mild present will seemingly place a degree of strain on the flight crew, and significantly the RPIC, for the present to go forward. The operator’s procedures went some strategy to mitigating this hazard by assigning the copilot the duty of stakeholder engagement to isolate the RPIC from the potential pressures. On this event nonetheless, the RPIC carried out this process. 

Elements identified to extend strain

A evaluate of the operational surroundings on the night time of the present recognized a lot of the elements that the CAA recognized as prone to improve strain. These, along with 2 different elements, are mentioned within the following sections. 

Time constraints

To conduct the present, the harbour wanted to be closed to maintain vessel site visitors out of the exclusion space. To minimise disruption the port authority offered a 15‑minute time window, beginning at 1830, for the ten‑minute present. Within the days main as much as the present the operator recognized that the forecast situations on the present time had been going to be marginal and had requested that the present time be moved later. The operator suggested that the port authority wouldn’t permit them to maneuver the present later because of the impression on the harbour’s operations. This meant that the RPIC needed to launch at 1830, or the present couldn’t go forward. 

Stakeholder expectation

RPAS mild present operations don’t contain passengers nonetheless there are different stakeholders who may have the identical want for a flight to go forward and restricted understanding of the operational necessities. On this case the shopper had expended vital capital and anticipated that the present would proceed. 

The RPIC suggested that they’d been involved with the shopper’s consultant on a number of events within the lead‑as much as the present giving updates on situations and what that meant for the chance of the present going forward. The RPIC said that they had been conscious that the shopper had different folks ready on the choice as as to whether the present would proceed. 

Secondly, the just lately appointed CEO and COO had restricted expertise with the sunshine present operation and had travelled particularly to see this present and observe the operation in individual. The RPIC suggested that the CEO and COO had spoken with them within the lead‑as much as the present and expressed a want to see the present function successfully.

Continuation bias

Continuation bias is ‘an unconscious cognitive bias to proceed with the unique plan despite altering situations.’ (Transportation Security Board of Canada, 2019) In a crewed operation continuation bias would possibly seem as a pilot departing into questionable situations on a route they’ve accomplished efficiently a lot of occasions earlier than. It may additionally seem as a flight crew conducting a number of makes an attempt to land on the vacation spot airport somewhat than divert to a location the place the situations are extra appropriate. (Federal Aviation Administration, 2022)

The RPIC reported that the operator had by no means needed to cancel a present resulting from wind situations. Additional, the RPIC’s information indicated that they’d carried out greater than 30 reveals with out incident. Due to this fact, persevering with with the present launch was a well-recognized course of and primarily based on earlier expertise a unfavourable end result from this choice was not anticipated.

Further elements 

The sunshine present was being carried out in a populated space, had been marketed by the shopper and was supporting a nationwide sporting workforce’s fixture, which was anticipated to attract a big crowd. The present subsequently had the next than regular profile that offered vital publicity and a possibility to show the operator’s functionality. 

On the night time of the accident the copilot, because the operator’s CRP, held higher organisational authority than the RPIC. Regardless of the RPIC holding general duty for the protected conduct of the flight, that pairing created a unfavourable cockpit gradient. On a number of events through the lead‑as much as the launch the copilot said to the RPIC that they believed that the situations are appropriate for launch. Whereas the RPIC recognized that they had been the last word authority onsite, the statements from the copilot doubtlessly influenced their choice‑making.

Abstract

The evaluate of the operational surroundings recognized that the RPIC was seemingly experiencing time strain, expectations from the shopper and senior employees that the present would go forward, an expectation bias as they’d carried out many reveals and not using a related concern with these plane. As recognized by the CAA these pressures can result in a disregard or overly optimistic interpretation of the state of affairs. Additional growing strain the present had the next than regular profile and there was a unfavourable cockpit gradient between the RPIC and copilot. 

The operator’s report into the accident recognized that the RPIC had been positioned underneath extra strain by exterior elements together with: 

• the shopper engagement
• the time strain from the time window obtainable for the present to be carried out
• confidence within the fleet because of the variety of profitable reveals that had been accomplished. 

Additional, the RPIC recognized instantly that they’d felt that there was strain to have the present occur and for it to achieve success.

Main as much as the present the RPIC had data that the climate situations on the bottom had been close to, however under, the restrict of the plane however the situations inside the present space had been unknown. An optimistic interpretation of situations within the present space could be that the situations had been higher or not less than equal to these at floor degree. Underneath this interpretation of the situations they’d have been acceptable for the present to go forward. 

In crewed operations a poor climate‑associated choice can put the plane, crew and passengers liable to a deadly end result. In uncrewed operations the first dangers relate to monetary and reputational harm within the occasion of an incident or accident. Whereas current, the chance to non-public security of the crew was low, which can have altered the flight crew’s threat notion or tolerance.

Contributing issueIt’s seemingly that the distant pilot in command perceived the next than regular degree of strain for the present to go forward. This mixed with the next than regular workload, contributed to their choice to launch the present into unknown wind situations.

Operational necessities

To mitigate towards the boat mast impediment the RPIC elected to raise the complete present by 8 m above the initially deliberate most top of 118 m to a top of 126 m. The operator’s CASA permission required the RPIC to adjust to their accepted operations guide and subsequently operations library. The operations library said that reveals had been to not be carried out at night time above 120 m (400 ft) except a selected approval had been accepted by CASA, no such permission had been issued for this operation. 

On the time that they modified the present top the RPIC recognized that they had been in exceedance of the 400 ft restrict. The telephone dialogue with the opposite pilot who was helping within the present transfer recognized that this was a minor breach of the restrict, and it was mitigated by the presence of buildings that exceeded the utmost present top.

The CASA permission additionally required that the operations be carried out inside an exclusion zone, which was detailed within the operations library. The function of the exclusion zone was to make sure that within the occasion of an plane lack of management, bystanders had been maintained at a protected distance. For a most present top of 400 ft a minimal exclusion zone of 70 m was required. The exclusion zone set by the RPIC was not capable of be exactly decided however was estimated to be between 47 and 54 m, from a publicly accessible jetty. 

The exclusion zone is calculated primarily based on plane top and wind situations. The RPIC’s choice to raise the present to keep away from the boat mast meant that the deliberate exclusion zone of 70 m was not relevant. The zone ought to have been recalculated primarily based on the brand new present top. For an 8 m (26 ft) improve in present top the exclusion zone ought to have been elevated by about 4 m. Additional, the wind speeds that the plane encountered, being greater than twice the wind restrict, elevated the required exclusion zone to greater than 100 m.

The obtainable information didn’t determine the utmost top that plane reached or whether or not any plane exceeded the exclusion zone. Nonetheless, because the flight was automated, if it had continued as deliberate it could have been in breach of each the utmost top and exclusion zone restrictions accepted by the regulator. By not complying with these limitations security defences constructed into the documentation and approval course of had been eliminated. Whereas this didn’t contribute to the accident, it elevated the chance of an hostile end result.

Different issue that elevated threatThe distant pilot in command programmed and launched the present with a most top which exceeded the 120 m restrict and with an inadequate exclusion zone, each of which had been limitations in accordance with the operator’s CASA‑issued permission to conduct the reveals. This elevated the chance of damage to bystanders within the occasion of an plane malfunction.

Floor management station functionality

Model 3 of the Damoda flight management software program launched a wind pace learn out, exhibiting wind pace and course, within the prime proper nook of the show. Following launch, if the wind pace restrict was exceeded, no lively alert was proven on the GCS pc show. In its report, the producer expressed a view that the flight crew must be actively monitoring the wind pace readout. 

An alert, visible, audible or tactile, improves the possibility that the operator will likely be made conscious of this data, particularly when underneath excessive workload. In crewed aviation there are a number of alerts which might be offered to pilots regardless of data already being introduced independently to them. For instance, plane are required to have an airspeed indicator however lively stall warnings are generally used.

The software program displayed a number of forms of alerts, which diverse from particular person plane exhibiting single or a number of errors, by means of to pop‑up bins advising {that a} command had failed to succeed in a number of plane. All had been clearly identifiable on the display screen and had been simply interpreted by somebody who was conversant in the system. 

For mild present operations wind pace and course are vital to the protection of flight. The small tolerances between plane and their comparatively mild weight implies that adjustments in wind pace can considerably impression the plane place and result in an elevated threat of collisions.  

The implementation of an lively alert to the wind pace monitoring perform would enhance the pilot’s capacity to each determine and reply to wind pace exceedances. 

The RPIC said that they weren’t conscious of the wind pace readout on the time of the prevalence. Due to this fact, for an alert to have been efficient on this occasion it could have needed to each determine the wind pace readout and the exceedance to the flight crew. Because the alerting perform didn’t exist, it was not attainable to find out if it may have successfully accomplished each these items. As such, the shortage of an alert was not thought of contributory to the accident. 

Different issue that elevated threatModel 3 of the Damoda floor management station software program included a wind pace readout, however didn’t actively alert the pilot if the wind pace restrict was exceeded. This elevated the chance {that a} pilot would fail to determine a restrict exceedance and proceed a present into unsafe situations. (Security concern)

Pilot coaching

Following the introduction of model 3 of the GCS software program, the operator’s pilots undertook familiarisation flights with the brand new software program, and the producer was consulted about points after they had been encountered. Nonetheless, there was no formalised coaching, as there had been for an earlier model of the software program, and there was no system of evaluation in place to make sure that all pilots had an equal understanding of the software program earlier than they began utilizing it operationally.

The operator had each preliminary coaching and proficiency necessities for pilots to make sure that they had been competent within the programs that they’d be anticipated to make use of. The continued proficiency checks had been solely required on the introduction of latest plane varieties or yearly or biennially, relying on how just lately a pilot had accomplished operational flights. As such, if a pilot had just lately been checked and a brand new software program model was then launched it could possibly be as much as 2 years of operational flying earlier than their proficiency on the brand new software program and understanding of all its options could be assessed.

The flight crew for this present weren’t conscious of the wind pace indication perform or assured within the technique of shifting the present. Nonetheless, not less than one different pilot was conscious of those programs and how you can successfully use them.

And not using a well timed verification course of in place there was no method for the operator to know whether or not their familiarisation course of had been efficient and if the pilots understood how you can use the related options in an operational surroundings. Had such a system been in place, it’s extra seemingly that the flight crew would have recognized the wind pace restrict exceedance and that shifting the present would have been accomplished extra effectively.

Different issue that elevated threatThe operator didn’t present formal coaching on model 3 of the bottom management station software program to its pilots, as a substitute counting on familiarisation flights and advert hoc recommendation from the producer. This elevated the chance that show-qualified pilots would fail to determine exceedances in flight vital parameters and expertise elevated workload. (Security concern)

Operational doc adjustments

The choice of utilizing climate drones to evaluate airborne situations was launched with model 1.1 of the wind administration plan, dated 6 June 2023. This represented a major change within the data gathering course of for the wind pace data within the lead‑as much as the present. The wind administration plan, together with the occasion threat evaluation, the emergency administration plan and the maritime security administration plan, had been obtainable to the flight crew as attachments to the occasion operational plan. Whereas the occasion plan was obtainable, it was not a major reference throughout preparations for the present. The present day and pre‑flight checklists had been the first references. 

As neither of those paperwork contained reference to both the climate drone or the wind administration plan, subsequently the flight crew had been much less seemingly to make use of a climate drone to gather related data from the present space. That elevated the chance of launching into unsafe flight situations. 

It couldn’t be decided whether or not inclusion of the knowledge within the operator’s procedures would have altered the end result of the accident because it was not identified how or the place this data would have been included within the operational procedures/paperwork. Moreover, as not all of the procedures such because the present day guidelines had been routinely used, the inclusion of the climate drone choice might not have been recognized by the members of the flight crew, significantly given the excessive workload and time‑restricted surroundings within the lead‑as much as present launch. 

Different issue that elevated threatFollowing the introduction of a climate drone choice to the wind administration plan in June of 2023, the operator had not up to date its operational procedures to incorporate this selection. Because of this, flight crew weren’t prompted to make use of this technique for gathering data on wind situations within the present space previous to launch. (Security concern)

Findings

ATSB investigation report findings deal with security elements (that’s, occasions and situations that improve threat). Security elements embrace ‘contributing elements’ and ‘different elements that elevated threat’ (that’s, elements that didn’t meet the definition of a contributing issue for this prevalence however had been nonetheless thought of essential to incorporate within the report for the aim of accelerating consciousness and enhancing security). As well as ‘different findings’ could also be included to offer essential details about matters aside from security elements. Issues of safety are highlighted in daring to emphasize their significance. A security concern is a security issue that (a) can fairly be considered having the potential to adversely have an effect on the protection of future operations, and (b) is a attribute of an organisation or a system, somewhat than a attribute of a selected particular person, or attribute of an working surroundings at a selected cut-off date.These findings shouldn’t be learn as apportioning blame or legal responsibility to any specific organisation or particular person.

From the proof obtainable, the next findings are made with respect to manage points and ditching involving RPA swarm of 500 Damoda Newton 2.2 RPA, Victoria Harbour, Docklands, Victoria on 14 July 2023. 

Contributing elements

• The distant pilot in command launched the present with the wind pace near the restrict of the plane and conscious that situations within the present space had been prone to be worse than these on the bottom.
• Within the lead‑as much as the present, the flight crew didn’t use a climate drone to conduct a wind examine at present altitude as outlined within the operator’s wind administration plan. Because of this, the distant pilot in command didn’t have correct details about the situations inside the present space on the time they launched the swarm.
• Shortly after launch, earlier than transitioning to the present space, the swarm encountered wind situations that exceeded the aircrafts’ operational manoeuvring functionality. This resulted in a number of plane being out of place and errors presenting on the bottom management station pc.
• The flight crew had been each unaware that the bottom management station had a wind pace monitoring perform. The distant pilot in command didn’t use it to watch the wind situations after take-off. Because of this, they didn’t determine that the wind exceeded the aircrafts’ limits and continued with the transition to the present space.
• Shortly after beginning the transition into the present space, the swarm encountered wind situations that had been greater than double the printed functionality of the plane. This led to a number of plane being unable to carry place, with not less than 11 plane breaching the geofence, a number of plane collisions and most plane descending into the water.
• The distant pilot in command’s workload was considerably elevated resulting from their unfamiliarity with the method to make the mandatory present place adjustment and the copilot’s restricted information and expertise in present operations. This diminished the effectiveness of the wind pace evaluation very important for the protection of the launch choice.
• It’s seemingly that the distant pilot in command perceived the next than regular degree of strain for the present to go forward. This mixed with the next than regular workload, contributed to their choice to launch the present into unknown wind situations.

Different elements that elevated threat

• The distant pilot in command programmed and launched the present with a most top which exceeded the 120 m restrict and with an inadequate exclusion zone, each of which had been limitations in accordance with the operator’s CASA‑issued permission to conduct the reveals. This elevated the chance of damage to bystanders within the occasion of an plane malfunction.
• Model 3 of the Damoda floor management station software program included a wind pace readout, however didn’t actively alert the pilot if the wind pace restrict was exceeded. This elevated the chance {that a} pilot would fail to determine a restrict exceedance and proceed a present into unsafe situations. (Security concern)
• The operator didn’t present formal coaching on model 3 of the bottom management station software program to its pilots. As an alternative, counting on familiarisation flights and advert hoc recommendation from the producer. This elevated the chance that show-qualified pilots would fail to determine exceedances in flight vital parameters and expertise elevated workload. (Security concern)
• Following the introduction of a climate drone choice to the wind administration plan in June of 2023, the operator had not up to date its operational procedures to incorporate this selection. Because of this, flight crew weren’t prompted to make use of this technique for gathering data on wind situations within the present space previous to launch. (Security concern)

Issues of safety and actions

Central to the ATSB’s investigation of transport security issues is the early identification of issues of safety. The ATSB expects related organisations will handle all issues of safety an investigation identifies. Relying on the extent of threat of a security concern, the extent of corrective motion taken by the related organisation(s), or the desirability of directing a broad security message to the Aviation business, the ATSB might concern a proper security suggestion or security advisory discover as a part of the ultimate report.All the instantly concerned events had been supplied with a draft report and invited to offer submissions. As a part of that course of, every organisation was requested to speak what security actions, if any, they’d carried out or had been planning to hold out in relation to every security concern related to their organisation. Descriptions of every security concern, and any related security suggestions, are detailed under. Click on the hyperlink to learn the complete security concern description, together with the problem standing and any security motion/s taken. Issues of safety and actions are up to date on this web site when security concern house owners present additional data in regards to the implementation of security motion.

No set off in key operational paperwork to make use of climate drone

Security concern quantity: AO-2023-033-SI-01

Security concern description: Following the introduction of a climate drone choice to the wind administration plan in June of 2023, the operator had not up to date its operational procedures to incorporate this selection. Because of this, flight crew weren’t prompted to make use of this technique for gathering data on wind situations within the present space previous to launch. 

Floor Management Station pilot assurance

Security concern quantity: AO-2023-033-SI-02

Security concern description: The operator didn’t present formal coaching on model 3 of the bottom management station software program to its pilots. As an alternative, counting on familiarisation flights and advert hoc recommendation from the producer. This elevated the chance that show-qualified pilots would fail to determine exceedances in flight vital parameters and expertise elevated workload. 

Security suggestion to The Australian Visitors Community Pty Restricted

The ATSB makes a proper security suggestion, both throughout or on the finish of an investigation, primarily based on the extent of threat related to a security concern and the extent of corrective motion already undertaken. Somewhat than being prescriptive concerning the type of corrective motion to be taken, the advice focuses on the protection concern of concern. It’s a matter for the accountable organisation to evaluate the prices and advantages of any specific technique of addressing a security concern.

Security suggestion quantity: AO-2023-033-SR-02

Security suggestion description: The Australian Transport Security Bureau recommends that The Australian Visitors Community Pty Restricted develops a course of to make sure that future software program adjustments are communicated and understood by all pilots earlier than commencing operations.

Plane management software program

Security concern quantity: AO-2023-033-SI-03

Security concern description: Model 3 of the Damoda floor management station software program included a wind pace readout, however didn’t actively alert the pilot if the wind pace restrict was exceeded. This elevated the chance {that a} pilot would fail to determine a restrict exceedance and proceed a present into unsafe situations.

Security suggestion to Damoda Clever Management Know-how Co., Ltd

The ATSB makes a proper security suggestion, both throughout or on the finish of an investigation, primarily based on the extent of threat related to a security concern and the extent of corrective motion already undertaken. Somewhat than being prescriptive concerning the type of corrective motion to be taken, the advice focuses on the protection concern of concern. It’s a matter for the accountable organisation to evaluate the prices and advantages of any specific technique of addressing a security concern.

Security suggestion quantity: AO-2023-033-SR-01

Security suggestion description: The Australian Transport Security Bureau recommends that Damoda Clever Management Know-how Co., Ltd implements lively wind pace exceedance alerting within the floor management station software program.

Security motion not related to an recognized security concern

Further security motion by The Australian Visitors Community Pty Restricted

The Australian Visitors Community Pty Restricted suggested the ATSB that following this incident it applied a number of adjustments to its present planning and conduct processes. These included:

• adjustments to the crewing necessities to have 2 CASA-approved pilots working each present
• institution of a number of go/no-go factors through the launch sequence permitting for extra clearly outlined cease factors
• introduction of sterile cockpit procedures to restrict exterior interactions with the flight crew in vital phases within the lead‑as much as present launch.

Glossary

ATN	The Australian Visitors Community Pty Restricted
CAA	United Kingdom Civil Aviation Authority
CASA	Civil Aviation Security Authority
CASR	Civil Aviation Security Laws
CCTV	Closed Circuit Tv
CRP	Chief Distant Pilot
GCS	Floor Management Station
IMC	Instrument Meteorological Circumstances
IP	Ingress Safety
JSA	Job Security Evaluation
LED	Mild Emitting Diode
LiPo	Lithium Polymer
RePL	Distant Pilot License
RPA	Remotely Piloted Plane
RPAS	Remotely Piloted Plane System
RPIC	Distant Pilot in Command
RTK	Actual Time Kinematic
RTL	Return To Launch
VFR	Visible Flight Guidelines

Sources and submissions

Sources of data

The sources of data through the investigation included:

• the distant pilot in command and copilot
• The Australian Visitors Community Pty Restricted
• the plane and floor management station software program producer
• Civil Aviation Security Authority
• one other Australian operator of the kind
• floor management station software program display screen recording
• Bureau of Meteorology
• video footage of the accident flight and different pictures and movies taken on the day of the accident

References

Federal Aviation Administration. (2022). CFIT and Plan Continuation Bias. Washington DC: United States Division of Transportation.

Ramdeen, A. (2024, 04). Performing Underneath Percieved Stress in Aviation Upkeep. Naval Security Command Aviation Security Weblog.

SKYbrary. (2025, Might). Authority Gradients. Retrieved from SKYbrary: https://skybrary.aero/articles/authority-gradients

Transportation Security Board of Canada. (2019). AIR TRANSPORTATION SAFETY INVESTIGATION REPORT A18P0031 Lack of management and collision with terrain Island Categorical Air Inc. Beechcraft King Air B100, C-GIAE Abbottsford Airport, British Columbia 23 February 2018. Quebec: Transportation Security Board of Canada.

UK CAA. (2024). VFR Flight Into IMC – CAP 2562. London: UK CAA.

United Kingdom Civil Aviation Authority. (2016). Flight crew human elements handbook. West Sussex: United Kingdom Civil Aviation Authority.

Submissions

Underneath part 26 of the Transport Security Investigation Act 2003, the ATSB might present a draft report, on a confidential foundation, to any individual whom the ATSB considers acceptable. That part permits an individual receiving a draft report back to make submissions to the ATSB concerning the draft report. 

A draft of this report was offered to the next instantly concerned events:

• distant pilot in command
• Australian Visitors Community Pty Ltd chief distant pilot
• Plane and GCS software program producer
• Civil Aviation Security Authority

Submissions had been obtained from:

• distant pilot in command
• Australian Visitors Community Pty Ltd chief distant pilot

The submissions had been reviewed and, the place thought of acceptable, the textual content of the report was amended accordingly.

Appendices

Appendix A – Floor management station recording abstract

Time (native)	Speaker	Theme	Subject/ Quote
1740			Recording began
1742-1743	RPIC	Help crew administration	RPIC demonstrated to crew members how you can function the radio after which directs what tools they should be taking with them.
1747	RPIC	Help crew administration	RPIC directed help crew member what to be looking out for when monitoring airspace.
1749	Copilot	Flight crew interactions	Copilot famous that they’ve the Essendon Airport management tower VHF frequency prepared if required.
1750	Help Crew member	Wind pace monitoring	Wind pace studying taken at 14 kt
1752	Help Crew member	Wind pace monitoring	Wind pace studying taken at 11 kt
	RPIC	Help crew administration	RPIC directed the help crew member to take an extra wind pace studying on the grid.
1753	RPIC and copilot	Stakeholder interactions	RPIC directed the copilot to conduct a radio examine with the waterway authority boat
1754	Help Crew member	Wind pace monitoring	Wind pace studying taken 11.9 kt
	Copilot	Wind pace monitoring	Copilot responds that ’that’s okay it’s the 14 that we’re nervous about’
	RPIC	Wind pace monitoring	RPIC recognized that they’ve had a number of 29 km/h gusts and the edge of the plane is 24-25 km/h
1756	RPIC	Consumer interactions	RPIC dictated textual content message recognized that present wind is above restrict however is according to forecast which is predicting it to drop. Says that ‘we’re nonetheless making ready for launch’
1757	RPIC	Present adjustment	RPIC’s first reference to needing to maneuver the present to keep away from the mast. Wanted to work out how you can raise the present over it.
	RPIC	Help crew administration	RPIC instructs help crew member on their function to make sure that unauthorised personnel should not within the space.
1758	RPIC and copilot	Present adjustment	Preliminary dialogue between RPIC and copilot relating to shifting the present. Copilot requested what’s going to use much less battery, RPIC identifies that isn’t there major concern however that lifting the present will exceed the permitted present altitude.
1759	RPIC	Present adjustment	RPIC recognized that this isn’t one thing they’ve accomplished earlier than and might want to name a 3rd pilot who will not be on web site to help. Makes name and no reply.
1801	RPIC	Present adjustment	RPIC carried out a present take a look at and identifies concern with the separation of the plane as they arrive again in direction of the restoration location on the finish of the present.
1803	Copilot	Help crew administration	Copilot confirmed with RPIC what the decision indicators of the help crew are for radio site visitors and the place they’re positioned.
1805	RPIC and Copilot	Present adjustment	RPIC recognized to copilot that the exclusion zone is 60.5 m which is in need of the necessities.
	RPIC and copilot	Wind pace monitoring	RPIC requested the copilot for his or her ideas on the wind state of affairs. Copilot responded that the plane will be capable to hand the gusts however could be extra involved if it was fixed.
1806	RPIC	Present adjustment	RPIC tried to name third pilot once more no reply, RPIC notably annoyed.
1807-1816	RPIC, copilot and third pilot	Present adjustment	Third pilot calls again RPIC they talk about how you can successfully transfer the present to make sure that the boat mast is averted.
1810		Wind pace monitoring	Microphone information audible wind noise.
1811	RPIC	Wind pace monitoring	Microphone once more information audible wind noise. RPIC said that if a gust like that occurs on take-off this will likely be a difficulty.
1814	RPIC and third pilot	Present adjustment	RPIC recognized that with the adjustment the present will now traverse to 135 m, above the utmost permitted top. Third pilot assured RPIC that there are buildings round larger than that so it’s tremendous.
1816	RPIC	Consumer interactions	RPIC famous that the shopper has requested them to decide at 1815.
1817	Copilot	Wind pace monitoring	Copilot said that they consider the present is sweet to launch.
	RPIC & CoPilot	Wind pace monitoring	RPIC responded questioning the situations on the top of the present. Copilot responded that they solely need to get the showcase the bottom and over the dock.
	RPIC	Consumer interactions	RPIC dictated voice to textual content transmission to shopper advising ‘for the time being we’re good to go’
	RPIC & waterway authority	Stakeholder interactions	Waterway authority contacted the RPIC by way of radio confirming the waterway closure at 1825
1817 – 1829	RPIC & CoPilot	Pre-flight guidelines	RPIC and copilot labored by means of the pre-flight guidelines. Together with responses for emergencies together with EKF and W errors that are RTL, fly manually or land within the river.
1823	RPIC & help crew member	Help crew administration	Help crew member requested a radio examine interrupting the pre-flight guidelines.
	RPIC & waterway authority	Stakeholder interactions	Waterway authority radio name stating that they’re closing the river.
1824	RPIC & help crew member	Help crew administration	Help crew member contacted RPIC and copilot about exit level entry for a bystander.
1825	RPIC & help crew members	Help crew administration	RPIC contacted help crew members advising them to shut the exclusion zone.
1826	RPIC & help crew members	Help crew administration	Help crew member contacted the RPIC requesting entry to the exclusion zone for shopper personnel wishing to look at the present. After some confusion about what they had been making an attempt to do RPIC confirmed by way of copilot that they’ll come by means of.
1828	RPIC & CoPilot	Pre-flight guidelines	RPIC requested airband name as per guidelines, copilot inquired as as to whether it’s needed. RPIC responded that it’s their name and copilot completes the decision.
1829	RPIC & CoPilot	Pre-flight guidelines	RPIC and copilot accomplished the guidelines. Copilot learn out the final merchandise ‘query PIC confidence’ RPIC response ‘terrified’
	Copilot	Wind pace monitoring	Copilot recognized that the wind has died off and they’re ‘all good’.
1830	RPIC instructions present launch
1830:36	RPIC	Observations	RPIC recognized bathroom bowling
1830:42	Copilot	Observations	Copilot recognized 50+ T errors
1831:05	RPIC	Observations	RPIC alerted these round them to the truth that they may have drones fall on them.
1831:11	Plane start transition to the present space
1831:33	RPIC	Observations	RPIC recognized plane on the prime falling into each other.
1831:36	Copilot	Remark	Copilot said to pause it and change off the lights.
1831:43	RPIC	Actions	RPIC tried to loiter all plane within the present.
1831:46	RPIC	Observations	RPIC recognized the fly away
1831:47	RPIC	Observations	RPIC recognized that they loiter command has failed.
1831:48	First EKF (autopilot failure) Error is displayed
1832:10	RPIC and Copilot	Actions	RPIC requested copilot if they’ve management over the fly away. Copilot confirmed they do.
1832:15	RPIC	Observations	RPIC recognized that there are actually 10 EKF errors displaying.
1832:24	RPIC and Copilot	Actions	RPIC once more confirmed that the copilot has management over the fly away after which says ‘disarm, disarm, disarm’
1832:40	RPIC and copilot	Observations	Copilot requested if the plane might be landed, RPIC said that they’re off line so that they can’t be chosen to ship a command to.
1832:56	RPIC	Observations	RPIC said that ‘all failed’ error has introduced.
1833:11	RPIC	Observations	RPIC said that standing of most plane can’t be decided as they’re off line. However they’re trying to RTL every plane that’s nonetheless related.
1836:19	RPIC	Observations	RPIC recognized that the present has ended plane are persevering with to come back again.
1836:38	Copilot	Observations	Copilot recognized that plane are nonetheless returning to the grid.
1837:05	RPIC and copilot	Actions	RPIC directed the copilot to level the entry factors controlling the community out in direction of the present space to aim to reconnect with the plane nonetheless within the space.
1839	RPIC	Observations	RPIC recognized 2 additional plane are returning to the grid.
1840	All plane have returned or misplaced connection to the GCS
1841	RPIC & waterway authority	Stakeholder interactions	Waterway authority contacted the RPIC to substantiate they’re alright to open the river. RPIC confirmed.
1842-1844	RPIC & help crew members	Help crew administration	Help crew members requested and are granted permission to open the street and RPIC requests that all of them return to operations management.

Function of security investigationsThe target of a security investigation is to reinforce transport security. That is accomplished by means of: figuring out issues of safety and facilitating security motion to handle these issuesproviding details about occurrences and their related security elements to facilitate studying inside the transport business.It isn’t a perform of the ATSB to apportion blame or present a way for figuring out legal responsibility. On the similar time, an investigation report should embrace factual materials of adequate weight to help the evaluation and findings. Always the ATSB endeavours to steadiness the usage of materials that might suggest hostile remark with the necessity to correctly clarify what occurred, and why, in a good and unbiased method. The ATSB doesn’t examine for the aim of taking administrative, regulatory or legal motion.TerminologyA proof of terminology utilized in ATSB investigation stories is offered right here. This contains phrases akin to prevalence, contributing issue, different issue that elevated threat, and security concern.Publishing dataLaunched in accordance with part 25 of the Transport Security Investigation Act 2003Printed by: Australian Transport Security Bureau© Commonwealth of Australia 2025Possession of mental property rights on this publicationUntil in any other case famous, copyright (and every other mental property rights, if any) on this report publication is owned by the Commonwealth of Australia.Artistic Commons licenceExcept the Commonwealth Coat of Arms, ATSB brand, and photographs and graphics through which a 3rd get together holds copyright, this report is licensed underneath a Artistic Commons Attribution 4.0 Worldwide licence.The CC BY 4.0 licence allows you to distribute, remix, adapt, and construct upon our materials in any medium or format, as long as attribution is given to the Australian Transport Security Bureau. Copyright in materials obtained from different businesses, non-public people or organisations, belongs to these businesses, people or organisations. The place you want to use their materials, you will have to contact them instantly.

---

[1]     For a restricted take a look at a smaller set of 10 plane from the primary fleet are used. They’re used to check the system and site with out the necessity for all 500 plane and the related help crew.

[2]     The exclusion zone across the present was a security characteristic in case of an plane concern that ensured that spectators weren’t injured by falling plane. It was calculated primarily based on the peak and most pace of the plane performing the present.

[3]     Disarming the plane switched off the plane’s motors.

[4]     Ingress safety code is given by a sequence of two digits following the letters IP and signifies how effectively a tool is protected towards the ingress of mud and water. The primary digit signifies the extent of safety from stable particle ingress from 0 (no safety) to six (mud tight). The second digit signifies that degree of safety towards water ingress from 0 (no safety) to 9 (protected towards excessive strain water jets and immersion in water). 

[5]     The minimal exclusion zone was 30 m except in any other case particularly accepted by CASA.

[6]     Gadget that measures wind pace.

[7]     The terminal space forecast issued by the BOM is legitimate for areas inside 5 NM of the aerodrome. Subsequently the forecast will not be formally legitimate for the Victoria Harbour.

Plane Particulars

Producer

DAMODA

Mannequin

Newton 2.2

Plane Operator

The Australian Visitors Community Pty Ltd

Operation kind

Half 101 Unmanned plane and rockets

Sector

Remotely piloted plane

Departure level

Docklands, North Wharf Highway, Victoria

Vacation spot

Docklands, North Wharf Highway, Victoria

Injury

Destroyed

Security Points

AO-2023-033-SI-01

No set off in key operational paperwork to make use of climate drone

AO-2023-033-SI-02

Floor Management Station pilot assurance

AO-2023-033-SI-03

Plane management software program

Associated