Automation Limits and Failure Modes

Automation still needs a pilot

Automated flight management can improve repeatability, mapping quality and crew workload, but it also introduces setup risk. Wrong height, wrong home point, wrong geofence, wrong mission direction or bad GPS can create a problem before the aircraft moves.

A remote pilot should understand what the aircraft will do when GPS degrades, the IMU fails, thrust is lost or the planned route becomes unsafe.

A 14 second loop. Four stations sit on a loop around a mission map: plan, verify, monitor and intervene. A marker travels round the loop. At plan, a mapping route is drawn and a home point is set. At verify, the setup is checked against the site. With the setup error selected, the home point is not on the launch pad, so verify shows a mismatch and a red branch sends the marker back to plan, where the home point is moved onto the pad before it is verified again. With the correct setup selected, verify passes first time. At monitor, the drone flies the route while the pilot watches. Then GPS is lost, and at intervene the pilot pauses the mission, holds and brings the drone back to land on the pad. The marker returns to plan, closing the loop for the next flight. The still frame shows the mismatch at verify and the branch back to plan.

Read the When automation fails transcript

Program, verify, brief

Treat the mission file as an operational control. Check the route, height references, obstacle environment, battery margin, failsafe settings and recovery options before launch.

• Check the mission direction, altitude reference and terrain clearance.
• Check geofence, maximum height, return-to-home height and home-point behaviour.
• Brief who will monitor the aircraft, who will monitor the app and who will call stop.

Automation can hide mode confusion

Automated systems often have multiple modes: position hold, waypoint, terrain follow, return-to-home, active track, manual, attitude or degraded modes. The aircraft may be doing exactly what it was told, while the pilot believes it is doing something else.

Mode awareness is therefore a critical skill. The pilot should know the active mode, the next programmed action and the quickest safe way to pause, hold, return or take manual control.

Four cards along the top show the live mode picture: active mode, next action, failsafe and interrupt method. Below, a plan view shows a home point with the pilot and a drone flying a waypoint route. First the mode is Waypoint, the next action is a turn, the failsafe is return to home and the interrupt is pause. Then the control link is lost: the failsafe triggers, the mode changes to RTH and the drone turns towards home, while the pilot's thought bubble still says Waypoint, so pilot and aircraft disagree. The link comes back, the pilot presses pause, the mode becomes Hold and the drone stops; pilot and aircraft now agree.

Faults must be identified early

Automation depends on sensors and data. GPS loss, IMU failure, compass disagreement, barometer error, obstacle sensor limitation, payload issue or weak link can all degrade the mission.

The pilot should understand both the alert and the aircraft response. A warning that seems minor on the screen may be the first sign that the mission no longer has the margin it started with.

Side view with the wind blowing from the left, a building on the right and a mark on the ground below the drone. At first the drone is in GPS mode: satellites are linked, the sticks are released, and it tilts into the wind and holds its position over the mark. Then the GPS signal is lost and it changes to ATTI mode: it levels itself but no longer holds position, so it drifts with the wind towards the building. The pilot pushes the right stick into the wind, the drone tilts into the wind and flies back over the mark, and the pilot keeps making corrections to hold it there. In GPS mode only, the drone holds position over the mark all the time.

• Know which warnings require immediate recovery.
• Know which modes remain available after GPS or sensor degradation.
• Do not push deeper into a mission when the aircraft is already telling you the system is degraded.

Emergency behaviour is part of the setup

Automated emergency behaviour should be planned, not discovered. Loss of control, loss of thrust, lost link, low battery, geofence breach and obstacle conflict all need known responses.

Return-to-home may be safe in one site and dangerous in another if it climbs into controlled airspace, heads toward people, crosses an obstacle or lands in the wrong area. The setup must match the actual job.

Side view of a site. The home pad and the pilot are on the left, a few people stand further left, and a 40 m tree line stands between the pad and a work area on the right. A dashed line marks the normal 120 m height limit. The drone is working low beyond the trees when the command link is lost, and return to home (RTH) starts: the aircraft climbs to the set RTH height, flies straight back to its recorded home point and lands. Heights are above take-off. With RTH set to 60 m, the RePL Guide example (highest obstacle 40 m plus at least 20 m), it clears the trees by 20 m and lands on the pad. At 30 m it flies into the trees. At 150 m it climbs above the 120 m limit. If the home point was not updated and is still recorded among the people, the aircraft flies back and lands among them. This is a typical RTH sequence; the actual behaviour varies by aircraft and settings. Not to scale.

Precautions before pressing start

Before starting an automated mission, the crew should verify the map, route, heights, battery, payload, wind, obstacle environment, failsafe settings and abort method. The pilot should be ready to intervene from the first second.

Automation is at its best when it makes a well-planned operation repeatable. It is at its worst when it hides a bad plan behind a confident-looking route line.

Practice Questions