1

Unmanned Aircraft System

Handbook and Accident/

Incident Investigation

Guidelines

“Air Safety through Investigation”

International Society of Air Safety InvestigatorsPark Center107 East Holly Avenue, Suite 11Sterling, VA. 20164-5405 January 2015

2

3 Executive Summary

4 Foreword

6 Preface

7 Chapter 1 - Purpose and Structure of the Unmanned Aircraft System (UAS)Handbook and Accident/Incident Investigation Guidelines

8 Chapter 2 - Differences between Manned and Unmanned Aircraft

16 Chapter 3 - Augmentation and Supplementation of Existing InvestigativeCapabilities for UASs Investigations

26 Chapter 4 - Annex 13 to the convention on International Civil Aviation:Recommendations Relative to UAS Investigations

26 Chapter 5 - Data Fields Associated with UAS Operations Requiring Capture

28 Chapter 6 - UAS-Specific Air Safety Investigator Skills

29 Chapter 7 - Evidence Preservation Following Unmanned Aircraft SystemAccidents

29 Chapter 8 - UAS Investigation Procedural and Functional Considerations

APPENDIX

40 Appendix 1- Significant Aspects of the Draft Italian Unmanned AviationRegulations

42 Appendix 2 - Proposed Addition to U.S. Title 14, Code of FederalRegulations

44 Appendix 3 - Recommendations for Further Reading

46 End Notes

48 Index

TABLE OF CONTENTS

This Unmanned Aircraft System (UAS) Handbook and Accident/Incident Investigation Guidelines is published

by the Interna� onal Society of Air Safety Inves� gators and is adapted from the UAS Working Group report UAS Inves� ga� on

Guidelines as submi� ed to and approved by the ISASI Interna� onal Council on October 12, 2014. Its use is intended for profes-

sional air safety inves� gators and accident preven� on specialists. Copyright © 2015—Interna� onal Society of Air Safety Inves-

� gators, all rights reserved. Publica� on in any form is prohibited without permission.

3

EXECUTIVE SUMMARY

The Unmanned Aircraft System (UAS) Handbookand Accident/Incident Investigation Guidelineswere developed by the ISASI UAS Working Group(WG). The ISASI UAS WG Terms of Reference di-rected participants to seek to accomplish the fol-lowing tasks:

1. Determine properties of unmanned aircraft sys-tems and their operations that differ from exist-ing aircraft.

2. Identify additional investigative capabilitiesthat may need to be developed or made more robustto support the investigation of UAS-involved acci-dents.

3. For Annex 13 to the Convention on Internation-al Civil Aviation, Aircraft Accident andIncident Investigation:

a. Determine the extent to which Annex 13definitions for the States of Design, Manufacture,Occurrence, Registry and the Operator can be ap-plied to unmanned aircraft systems, including theirground- and satellite-based components.

b. Assess the adequacy of current guidanceregarding determination of the State responsiblefor conducting the investigation of a UAS accident.

c. Document any need to recommendchanges to Annex 13 related to the above.

4. Identify a standard dataset that should be cap-tured for each UAS-involved accident.

5. Identify additional UAS-specific training re-quirements for air safety investigators based on theabove.

6. Identify additional regulations that may beneeded to create or preserve evidence relevant toUAS accidents.

7. Make recommendations to the ISASI Councilregarding the best means of addressing the aboveto other ISASI Committees and Working Groupsfor appropriate action.

* * * * *

Key operational and physical differences betweenmanned and unmanned aircraft that may drive ad-

ditional investigative personnel, training or equip-ment requirements are:

The lack of a pilot aboard the unmannedaircraft, meaning the aircraft’s condition,trajectory and surrounding airspace can-not be directly perceived by its pilot incommand (PIC).

Reliance on radio-frequency (RF) spec-trum and continuous connectivity be-tween ground control station and aircraftfor safe operation, meaning a UAS pilot’scontrol over their aircraft is subject todisruption of a type not experienced inmanned aircraft;

The varying and sometimes extremely lim-ited abilities different types of unmannedaircraft have to separate themselves fromother aircraft (meaning operation under“visual flight rules” as currently constitutedis not always possible where alternatemeans of compliance with “see-and-avoid”rules are employed); and

Occasional use of novel and exotic mate-rials for propulsion or aircraft recovery,meaning accident sites involving sys-tems where such materials are presentmay be unexpectedly hazardous to bothfirst responders and air safety investiga-tors alike.

The types of accidents and incidents most likely toresult from these differences are:

Midair collisions (unmanned/manned or un-manned/unmanned);

Loss of aircraft control in flight;

Fatalities/injuries on the ground uponground impact (inability to select point ofimpact);

Property damage on the ground uponground impact or collision with obstruction(inability to avoid surface-based feature orto select point of impact);

• Loss of safe separation between an un-manned aircraft and another aircraft;

Loss of aircraft control during ground move-ment; and

Post-crash injury or illness at the accidentscene.

4

The Unmanned Aircraft System (UAS) Handbookand Accident/Incident Investigation Guidelineshave been in development for six years. Theystarted with the formation of the ISASI UnmannedAircraft Systems (UAS) Working Group (WG) atthe 2008 Annual Seminar in Halifax, Nova Scotia.Although initial interest was strong, the slow,drawn-out progress of regulatory activity on UASoperations seemed to have a somewhat chilling ef-fect on participation and collaboration under theUAS WG banner.

The effort was re-booted at the 2011 AnnualSeminar in Salt Lake City, Utah, and was built up-on the following year at the 2012 Annual Seminarin Baltimore, Maryland. A core group of reliable,engaged participants emerged. However, althoughthe assembly of reference materials moved steadilyforward, getting pen to paper for the UAS Hand-book and Accident/Incident Investigation Guide-lines themselves remained a challenge.

Ultimately, this first edition of the ISASI Un-manned Aircraft System Handbook and Accident/Incident Investigation Guidelines, hereafter calledUAS Investigation Guidelines, was primarily theproduct of a single author, supported by commentsand edits from core WG members and a few non-ISASI advisors. As such, it may suffer from thelimitations of a single author’s perspective, alt-hough significant efforts were made to avoid a too-narrow view of the world of unmanned aviation.To that end, it retains some content which was sug-gested for removal by various individual reviewers.Although at one point the philosophy “when indoubt, take it out” was advanced in support of thepared-down perspective, the reason for decidingotherwise was simple.

Many aspects of unmanned aviation policy-making, including basic questions regarding pilotand system certification, continue to evolve. Someissues remain controversial. As such, both appar-ent positives and potential negatives associatedwith properties of, or operations associated withunmanned aviation require as broad and public aconversation as possible. At the same time thetougher challenge – to overcome personal biasesand remain as objective as possible, regardless ofthe aspect of unmanned aviation being discussed –was taken seriously. Hopefully, this first effort hasemerged as judgment-free as possible.

It also should be noted that some content was

included simply as an introduction to the nature ofunmanned aircraft systems as a whole. Many par-ticipants in the WG process had limited or no expe-rience in investigating UAS accidents, or even withUAS operations as they are currently conducted.This is to be expected given the newness of thefield. However, it also showed that the UAS Inves-tigation Guidelines themselves needed to provide ageneral starting point for those new to the subject,rather than strictly adhering to a step-by-step pre-scriptive approach to UAS investigations.

In the years ahead, significant changes in think-ing about how and where to fly UAS are likely tooccur, and some such changes are likely to be driv-en by UAS-involved accidents. For now, however,there is a great deal of improvisation, as well as nosmall amount of political involvement in the devel-opment of rules regarding UAS operations from oneState to the next. These UAS Investigation Guide-lines are intended to highlight where risk exists, aswell as how and why that risk has been accepted asthe unmanned aviation sector evolves into a stableelement of the overall aviation system.

The UAS Investigation Guidelines also had to besweeping enough to explain why all unmanned air-craft systems are not created equal. Apart from (1)not being capable of conforming to the “see-and-avoid” concept as it presently is applied, and (2)relying upon a continuous electronic connection be-tween an unmanned aircraft and its pilot in com-mand, unmanned aircraft may bear as little resem-blance to each other as an Airbus A380 does to anultralight. The tendency is to treat them as a unityfor regulatory purposes, or to simplify their classifi-cation by reference to their physical properties anddimensions. This can result in either too much ortoo little safety-related rulemaking, as well as los-ing important distinctions between the capabilitiesof different types of UAS.

Supporters of efforts to enable “integrated” UASoperations side by side with those of manned air-craft need to understand the extent to which theformer can conform to existing requirements gov-erning the latter. For example, there is a growingpossibility that the “instrument flight rules/visualflight rules” paradigm will be challenged by theneed to accommodate certain limitations of, or de-sired applications for, unmanned aircraft systems.Similarly, the current system of separate classes ofcontrolled and uncontrolled airspace is increasingly

FOREWARD

5

likely to be influenced by commercial pressure toenable access to virtually all of them by unmannedaircraft not equipped for flight in complex airspace.

The growing practice of granting exceptions tocurrent regulatory requirements simply because agiven type of unmanned aircraft is larger, smaller,or intended to be flown well clear of manned air-craft is likely to be confronted at some point by un-intended and unexpected interactions. The evi-dence already exists to show that such interactionscan and do occur; air safety investigations maywind up providing the necessary impetus to re-spond to them.

Finally, some States are being challenged re-garding the extent to which they should be regulat-ing unmanned aviation at all. When a “small un-manned aircraft” is indistinguishable from a“model aircraft” but for the intent of the pilot flyingit, the difficulty in crafting equitable and effectiverules for the safety of all affected by such opera-tions becomes obvious. However, a variety of resid-ual issues still have yet to be resolved.For example: Where and how are lines to be drawn – by alti-

tude segregation, by aircraft size or speed, or byother means?

Is something flown at an altitude below thatused by most other aircraft being operated“safely?” If not, whose responsibility is it totake action against the operator – national civilaviation authorities or local governments?

Air safety investigators must understand thesedebates as they expand and mature. We must beprepared to document the extent to which their res-olution succeeds – and fails – in the course of fu-ture investigations if we as a community are to pre-vent the recurrence of future unmanned aircraftaccidents as we have for past and present accidentsinvolving manned aviation.

In closing, some editorial notes seem in order toput the shape and content of this product in con-text. As noted above, during early reviews therewere disagreements among WG participants re-garding what it should include and what should beomitted. Some participants felt there was toomuch; some held that there wasn’t enough. Somefelt it wasn’t prescriptive enough, while others heldit was too prescriptive and tried to “set investiga-tive priorities.” For a document with no regulatoryidentity or authority of any type, neither argumentseemed particularly persuasive. This product isinformational only.

There are a host of matters that have yet to bedealt with adequately in the context of UAS opera-

tions themselves, such as the determination of in-flight conditions, maintaining clearance fromclouds, weather avoidance, and the potential haz-ards of GPS-derived versus barometric altimetry.The UAS Investigation Guidelines were created toserve as an atlas to the many subjects touched up-on by unmanned aviation, but they are not theproper place for exploring as yet uncharted terrain.

There was a sense on the part of some that everyreference to “accidents” should be amended to em-brace “accidents and incidents” (without referenceto “unusual occurrences” or other lesser-consequence events), or that the U.S. military dis-tinction between “accident” and “safety” investiga-tions should be reflected in the civil-oriented UASInvestigation Guidelines. There also were com-ments to the effect that more detailed training ma-terial or examples of previous UAS-involved acci-dents and recommendations should be provided,while others felt the UAS Investigation Guidelinesas a whole already might be straying into a regimemore properly addressed by the ISASI groups dedi-cated to training development or government ASIactivities.

These debates were difficult to adjudicate, inpart because fully addressing all of them likelywould have further delayed the release of this doc-ument by a year or more. Ultimately, the philoso-phy that “perfect is the enemy of ‘good enough’”held sway. With the delivery of this first effort, theUAS Working Group is ready to step aside to letother ISASI member-run groups take the raw ma-terial provided and mold it into tools specificallygeared to the needs of their respectiveconstituencies.

Readers are urged to use the list of references inAppendix 3 as a starting point for independent re-search, and to realize that there never will be a“last word” on the safety of unmanned aircraft sys-tems… just as there never will be in the broaderarena of aviation itself.

Thanks to all members of the ISASI UAS Work-ing Group who unselfishly gave of their time andwho with great deliberation produced the essenceof this Unmanned Aircraft System Handbook andAccident/Incident Investigation Guidelines. Mem-bers of the Working Group and others who provid-ed technical guidance are: Thomas A. Farrier, WGChairman; Mike Cumbie, MO5142; John Darbo,MO4218; Darren Gaines, MO3918; Doug Hughes,MO4415; Justin Jaussi, MO6105; Roy Liggett,MO5452; John Stoop, FO4873; and Al Weaver,MO4465. Technical Advisors: Adam Cybanski, Ca-nadian Forces; and Beverley Harvey, TSB Canada.

6

PREFACE

There is growing awareness in the air safety inves-tigator (ASI) community that there are fundamen-tal differences between manned and unmannedaircraft, and that those differences need to be fullyunderstood when planning for and carrying outaccident investigations involving the latter. Theurgency with which the differences need to be ad-dressed will vary widely from one State to thenext. However, controlling many of the risks asso-ciated with unmanned aircraft system (UAS)1 op-erations is best accomplished as part of the regula-tory process that allows them in the first place.

Since the primary reason air safety investiga-tions are conducted is to prevent future accidents,civil aviation regulators and national aviation in-vestigative authorities need to begin dialogue onunmanned aviation issues sooner rather than lat-er. To be proactive in preventing UAS-related ac-cidents, ASIs need to help regulators apply lessonslearned from manned aircraft accidents to theemerging issues associated with unmanned air-craft operations. There is no point to repeating thesafety evolution of the present-day aviation envi-ronment with a new generation of foreseeable UAS

-related accidents.Based on the above, it appears there are two

key challenges facing the ASI community with re-spect to unmanned aviation: Being ready to conduct future accident investi-

gations involving unmanned aircraft systemswith procedures and capabilities that take intoaccount the differences they bring to the avia-tion environment; and

Making sure safety lessons written in bloodfrom previous accident investigations staylearned.These UAS Investigation Guidelines are in-

tended for use by a wide range of ASI audiences.The publication’s purpose is solely to introducereaders to major issues associated with the emer-gence of the UAS sector in the context of air safetyinvestigation requirements and challenges. Anyspecific capabilities or limitations of UAS de-scribed throughout the UAS Investigation Guide-lines are for illustrative purposes only. In particu-lar, it is understood that the rapid development ofUAS technology may overtake some of the UASInvestigation Guidelines’ content.

7

The Unmanned Aircraft System (UAS) Inves-tigation Guidelines were developed by the In-ternational Society of Air Safety Investigators(ISASI) Unmanned Aircraft Systems (UAS)Working Group (WG). The ISASI UAS WGTerms of Reference directed participants toseek to accomplish the following tasks:1. Determine properties of unmanned air-

craft systems and their operations thatdiffer from existing aircraft.

2. Identify additional investigative capabili-ties that may need to be developed ormade more robust to support the investi-gation of UAS-involved accidents.

3. For Annex 13 to the Convention on Interna-tional Civil Aviation, Aircraft Accident andIncident Investigation:a. Determine the extent to which Annex 13

definitions for the States of Design, Man-ufacture, Occurrence, Registry and theOperator can be applied to unmanned air-craft systems, including their ground- andsatellite-based components.

b. Assess the adequacy of current guidance

regarding determination of the State re-sponsible for conducting the investigationof a UAS accident.

c. Document any need to recommend chang-es to Annex 13 related to the above.

4. Identify a standard dataset that should becaptured for each UAS-involved accident.

5. Identify additional UAS-specific trainingrequirements for air safety investigatorsbased on the above.2

6. Identify additional regulations that may beneeded to create or preserve evidence relevantto UAS accidents.

7. Make recommendations to the ISASICouncil regarding the best means of ad-dressing the above to other ISASI Com-mittees and Working Groups for appro-priate action.

* * * * *

The remaining chapters of this document individ-ually address, as appropriate, each of the sevenmain tasks.

CHAPTER 1Purpose and Structure of the UAS Investigation Guidelines

8

CHAPTER 2Differences between Manned and Unmanned Aircraft

IntroductionThe definition of what constitutes an “unmannedaircraft,” “unmanned aircraft system,” “remotelypiloted aircraft,” “remotely piloted aircraft system,”and similar terms associated with unmanned avia-tion varies widely from State to State. Similarly,the circumstances under which any such aircraft orsystem is considered to have been involved in aninvestigation-worthy accident, incident or unusualoccurrence must be individually established basedon the associated regulatory structure and opera-tional environment.

For example, in 2010 the U.S. National Trans-portation Safety Board modified its Title 49 rulesto include the following:

Unmanned aircraft accident means an occur-rence associated with the operation of any public orcivil unmanned aircraft system that takes placebetween the time that the system is activated withthe purpose of flight and the time that the systemis deactivated at the conclusion of its mission, inwhich:

(1) Any person suffers death or serious injury; or(2) The aircraft has a maximum gross takeoff

weight of 300 pounds or greater and sustains sub-stantial damage.

In 2012, the Congress of the United States en-acted Public Law 112-95, the FAA Modernizationand Reform Act of 2012, which contained the fol-lowing definitions:

Section 331:The term “unmanned aircraft” means an air-

craft that is operated without the possibility of di-rect human intervention from within or on the air-craft.

The term “unmanned aircraft system” means anunmanned aircraft and associated elements(including communication links and the compo-nents that control the unmanned aircraft) that arerequired for the pilot in command to operate safelyand efficiently in the national airspace system.

The term “small unmanned aircraft” means anunmanned aircraft weighing less than 55 pounds.

Section 336:“Model aircraft means an unmanned aircraft

that is—(1) capable of sustained flight in the atmos-

phere;

(2) flown within visual line of sight of the personoperating the aircraft; and

(3) flown for hobby or recreational purposes.Based on the above, it is clear that the first pri-

ority of any air safety investigator faced with theprospect of inquiring into any occurrence involvingan unmanned aircraft of any size or type is to un-derstand the regulatory structure governing UASoperations. Once their authority and obligation toinvestigate are clearly established, air safety inves-tigators need to recognize that the similarities be-tween manned and unmanned aircraft far outnum-ber their differences.

At the same time, the similarities relied upon toassert the rights of unmanned aircraft to fly side byside with manned aircraft in shared airspace maynot outweigh their differences with respect to theirreadiness to operate under the same set of rules asother aircraft. History has proven that placing air-craft operating under different rules in shared air-space will result in accidents.

While the path taken from one State to the nextmay vary, concerns for the safety of the generalpublic typically arise whenever aircraft of un-known or unproven reliability are operated over-head. For UAS at the smaller end of the size spec-trum, there are some indications that civil aviationauthorities may be willing to accept a certainamount of risk on behalf of the public in exchangefor sustaining the growth of the sector as a whole.However, from a narrower perspective, the princi-pal safety issue that always must be considered isthe ability of aircraft operators to interact safelywith other operators within the existing aviationsystem, regardless of how their aircraft are de-signed, operated, or certified.

In exploring these matters further, civil aviationauthorities and national investigative entities willfind it useful to develop a working understandingof the nature of the differences among unmannedaircraft systems, as well as those between mannedand unmanned aircraft in general, and how thosedifferences affect the regulation, operation andrisks associated with specific unmanned aircraftflown in specific environments. At the same time,all parties should be clear that the mere fact thatan aircraft involved in an accident is unmanned isnot evidence that all such aircraft are unsafe.Likewise, the fact that an unmanned aircraft is in-volved in an accident should not automatically be-

9

come the central feature of the ensuing accidentinvestigation unless and until its differences areproven relevant to the inquiry.

With the above caveats firmly in mind, it isequally important to acknowledge that while thetypes and consequences of accidents involving un-manned aircraft systems may be indistinguishablefrom those involving manned aircraft, the underly-ing cause or causes of such accidents may be quitedifferent. As such, unmanned aircraft accidentsmay lead investigators to make very different rec-ommendations for future prevention than would bethe case for manned aircraft accidents occurringunder similar circumstances.

Also, the possibility always is present that sometypes of accidents largely controlled by previouspreventive actions could reassert themselves in theunmanned sector. The nature of unmanned air-

craft systems and the limitations they impose upontheir pilots – such as the inability to assess flightconditions beyond whatever data on them has beenprovided for in the system’s design – may preventpreviously developed preventive strategies or sys-tems from operating as effectively as they normallydo for manned aircraft. Such effects may not beobserved for some time, especially if unmanned air-craft operations are relatively infrequent and typi-cally receive special handling.

Key Concepts Underlying UnmannedAircraft Systems

In 2007, RTCA Special Committee 203 first offeredan information architecture diagram (Figure 1)that shows the requirements for an unmanned air-craft system at a glance:

Note that the three principal nodes depictedabove – the unmanned aircraft, the ground controlstation (GCS), and the airspace within which theyoperate – always are present, no matter if one isreferring to a hand-launched aircraft of thirtyminutes’ endurance or a jet-powered, interconti-nental-capable high altitude aircraft. This is oneof the main reasons why this diagram is so power-ful when used to examine both the conceptual ba-sis and the implications of unmanned aviation.

Most UAS operators assert a desire to move to-ward a system state where unmanned aircraft areallowed access to non-segregated airspace on a “fileand fly” basis and are handled the same asmanned aircraft. This notional end state should beconsidered a point of departure for exploring theextent to which unmanned aircraft systems – ei-ther in general or where individual systems lackcertain capabilities required of manned aircraft –are capable of achieving side-by- side participationin shared airspace, and which should be a topic ofdiscussion in any accident sequence where bothmanned and unmanned aircraft are involved.

For the foreseeable future, unmanned aviationis best conceptualized as “unoccupied aircraft pi-loted from physically separate ground control sta-tions.” Active piloting, where a single responsiblepilot in command is required to exercise one-to-onesupervision over the operation of a single un-manned aircraft as a “human in the loop” (HITL)or a “human on the loop” (HOTL), is crucial to anunmanned aircraft’s safe participation in the exist-ing aviation system.

Finally, it is important to acknowledge thatthere is no regulatory structure within which au-tonomous flight can be carried out safely, at leastin the United States, because manned aircraftare at liberty to fly anywhere that unmanned air-craft can outside special use airspace. This hasincreased interest in some circles for establishingsegregated airspace for the exclusive use of un-manned aircraft, even as other members of theunmanned sector continue to insist on unfetteredaccess to the system as a whole.

Key Differences between Manned andUnmanned AircraftFor the purpose of these UAS Investigation Guide-lines, the following should be considered the key

Figure 1. Common Components of an Un-manned Aircraft System (from DO-304, Guid-ance Material and Considerations for Un-manned Aircraft Systems (March 22, 2007))

10

operational and physical differences betweenmanned and unmanned aircraft: The lack of a pilot aboard the unmanned air-

craft, meaning the aircraft’s condition, position,trajectory, and surrounding airspace cannot bedirectly perceived by its pilot in command(PIC).

Reliance on radio-frequency (RF) spectrum andcontinuous connectivity between ground controlstation(s) and aircraft for safe operation, includ-ing as a substitute for the PIC’s limitations de-scribed above; this has two potentialconsequences: A UAS pilot’s control over their aircraft issubject to disruptions not experienced inmanned aircraft; and There can be delays in both communicationsbetween the pilot and air traffic control and inthe pilot’s control inputs being received andexecuted by the aircraft;

The varying and sometimes extremely limitedabilities different types of unmanned aircrafthave to separate themselves from other air-craft (meaning operation under “visual flightrules” as currently constituted is not alwayspossible where alternate means of compliancewith “see-and-avoid” rules are employed); and

Occasional use of novel and exotic materials forpropulsion or aircraft recovery, meaning acci-dent sites involving systems where such mate-rials are present may be unexpectedly hazard-ous to both first responders and air safety in-vestigators alike.

The types of accidents and incidents mostlikely to result from these differences are: Midair collisions (unmanned/manned or un-

manned/unmanned); Loss of aircraft control in flight; Fatalities/injuries on the ground upon ground

impact (inability to select point of impact); Property damage on the ground upon ground

impact or collision with obstruction (inabilityto avoid surface-based feature or to selectpoint of impact);

Loss of safe separation between an unmannedaircraft and another aircraft;

Loss of aircraft control during ground move-ment; and

Post-crash injury/illness at an accident scene.In addition, the reliance of UAS on electronic

connectivity between aircraft and pilot means thefailure of the command and control link can have avariety of outcomes depending on: The type of UAS involved (and thus the amount

of system degradation to be expected followingsuch a failure);

The sophistication of on-board systems associ-ated with both post-loss behavior and the abil-ity of sensors aboard the aircraft to enable de-tection and avoidance of conflicting traffic;

The familiarity of the responsible air trafficcontroller with the management ofUAS- related emergencies; and

The volume of airspace within which unex-pected maneuvers can be accommodated safely.

Finally, one of the immediately obvious differ-ences between manned and unmanned aircraft –and among different types of unmanned aircraft –is the enormous range of sizes to which unmannedaircraft are being built. Estimates vary widely asto the proportion of large versus small unmannedaircraft that eventually will constitute the globalmarket. However, it is safe to say that the econom-ic advantages of those at the smaller end of the sizespectrum are likely to make them far more popular,and in far wider use, than their larger brethren.

The mass and performance of any aircraft hasobvious implications regarding the amount of risk agiven system or operation might entail. However,for the purposes of air safety investigations, theseattributes are most worthy of consideration in thecontext of the amount of damage a given unmannedaircraft might be expected to inflict on another air-craft or on people or property it collides with on theground.

At the same time, it is important to rememberthat some equipage and/or capabilities normallyexpected of aircraft in a given class of airspace maybe impractical to install in smaller unmanned air-craft with limited range, payload or on-board elec-trical power. This possibility should be exploredany time a small-size UA is part of any accidentsequence in complex or congested airspace.

The above should be taken into considerationin determining the scope and level of effort thatmay be required for any investigation involving anunmanned aircraft system. While none may proveto be relevant to a given accident sequence or af-termath, all represent potential complicationsthat must be understood fully in order to includeor exclude them from detailed consideration, andthat may drive the need for additional investiga-tive resources – at least on a temporary basis –beyond those normally required for manned air-craft accidents and incidents.

11

Special Aspects of Unmanned AircraftSystem Differences

“Detect and Avoid” Systems-Detect and avoid(DAA) systems, sometimes referred to as “senseand avoid” or “detect, sense and avoid” systems,are still largely in their infancy. Although somecommentators try to equate DAA with existingflight path surveillance and warning capabilitieslike traffic alert and warning systems (TAWS),DAA represents a significantly more complex set ofcooperative and interrelated technologies.

The simplest way to think of a high-functioning DAA system is to understandthat it must in very rapid and continuoussuccession: Detect electronic signals from aircraft

equipped with transponders, Mode S“squitters” or Automatic Dependent Surveil-lance – Broadcast (ADS-B);

Detect non-emitting aircraft or surface-basedobstacles that would be visible to the nakedeye (e.g., gliders, vintage aircraft, balloons,buildings, antennas);

Process all such targets through an algorithmthat allows for performance differences amongthe various types of aircraft that could be en-countered or the maneuvering required toavoid a fixed obstruction;

Command the unmanned aircraft or its pilotto maneuver in such a way as to remain wellclear of the conflict; and

Annunciate any course, airspeed or altitudechange to the pilot or directly advise the ap-propriate controlling agency that it has exe-cuted an autonomous avoidance maneuverthat has it off its assigned heading or altitude

An additional property of DAA systems as cur-rently envisioned is that they most likely will in-corporate two distinct sets of behaviors. The firstresponse to encounter detection will be for thesystem to maneuver the aircraft – or to provideguidance to the pilot supporting such maneuver-ing – so as to remain “well clear” of conflictingtraffic or obstacles (a subjective term requiring anas-yet undetermined objective threshold). Suchautonomous or directed maneuvering ideally willbe carried out without violating an air traffic con-trol clearance or other regulatory requirementssuch as altitude, proximity to congested areas,etc.

The second response will become controllingshould a conflict progress to the point where more“TCAS-like” response is needed, and would be in-

tended to prevent an imminent collision. Thisfunctionality is more likely to be automated, bothto avoid latency issues (see Chapter 3) and becausea UAS pilot would have no way of gauging the ac-tual proximity of the other aircraft or the preciseavoidance maneuver needed that would ensuresafe separation while not exceeding the unmannedaircraft’s flight envelope.

Various technical solutions for DAA chal-lenges are being explored, including sensorcombinations that fuse visible or infrared im-agery with electronic detection equipment. Itis unlikely that an industry-level standard,incorporating all of the capabilities describedabove while imparting an acceptable weightand electrical power penalty, will be in placefor the foreseeable future. However, work isproceeding to this end, with RTCA SpecialCommittee 228 having established a workinggroup specifically directed toward this effort.

The complexity of DAA architecture and sys-tem logic alone is not the only reason why special-ist knowledge most likely will be required to ex-plore a given collision scenario. For the nearterm, the larger problem is that government- ap-proved performance standards and specificationsfor DAA systems themselves do not yet exist. Atthe same time, pressure to move forward with ef-forts to integrate manned and unmanned aircraftoperations in shared airspace is likely to driveregulators’ acceptance of DAA systems that aredeemed capable of reducing the risk to other air-craft and to the public, but which are based onproprietary or otherwise non-certified criteria.

Finally, it is worth noting that many observersconsider DAA systems to have the potential to beinherently superior to human vision in the “see-and-avoid” role. Human perception is limited oradversely affected by any number of conditions,both from an anatomical and an “attention” per-spective.* A continuously scanning DAA systemnever would be looking the wrong way, distractedor otherwise taken away from its designed pur-pose. When any conflict enters the detectionthreshold, such a system will warn of or react to itas appropriate.

By the same token, the likely pace of DAA evo-lution versus demand for expanded UAS opera-tions most likely will result in tremendous varia-bility among DAA installations. This in turn willmean investigative authorities will need to haveaccess to subject matter experts who can evaluatethe effectiveness of individual DAA solutions that

12

may come into question as a result of an aviationaccident or incident.

Cockpit Design-While the subject of cockpitdesign may be considered largely in the domain of ahuman factors investigation (see Chapter 3), thecontext of an aircraft accident investigation puts asomewhat different perspective on the issues thatmay arise where unmanned aircraft systems areinvolved.

The “cockpit” of an unmanned aircraft is aground control station not physically attached tothe aircraft in any way. Its complexity and sophis-tication may be indistinguishable from that of anairliner’s flight deck, or it could be as simple as ahand-held control box identical to one used to con-trol model aircraft. In any event, except for a fewinstances where military operators are attemptingto move toward some type of “common cockpit” ca-pable of being configured to fly a variety of differentUAS, it is highly unlikely that the human-machineinterface (HMI) in use has been developed withmuch attention to existing cockpit/flight deck de-sign requirements or the requirements of flight inthe existing aviation system.

While this may seem counterintuitive, manyUAS designs were brought into service through ac-celerated procurement processes (e.g., the“Advanced Technology Concept Develop-ment” (ACTD) initiatives) on an urgent basis. Be-cause they were intended for use during armed con-flict but would be incapable of defending them-selves from aerial engagement, their developmentwas conditioned by an implied assumption thatthere would be little or no competing use of the air-space within which the unmanned aircraft wereintended to operate.

The procurement strategy for some early medi-um and high altitude long endurance UAS alsoplaced an emphasis on maximizing the likelihoodof efficient, successful mission accomplishment.While the solutions to certain challenges (e.g., con-trol redundancy, payload operations, etc.) were nov-el and elegant from an engineering perspective,they did not always take into consideration pilotworkload, usage and task prioritization issues rou-tinely accounted for in the design of certificatedmanned aircraft and addressed through formal sys-tem safety programs.

A well-documented example of the kinds of prob-lems resulting from these trade-offs is that of aU.S. Customs and Border Protection Predator Bthat crashed in Arizona in 2006. The aircraft wason patrol along the southern U.S. border when itexperienced a “rack lock-up” that disabled the

pilot’s controls. He switched over to the sensor op-erator’s position – which was equipped with identi-cal controls – only to see the aircraft immediatelybegin to lose altitude. He was unable to regain con-trol, and the aircraft crashed.

Among the multiple issues uncovered in thecourse of the investigation was the discovery thatproper use of the appropriate checklist would haveprevented the loss; the sensor operator’s consolewas not properly set up to assume control of theaircraft when the switchover was made. However,the HMI aspect of this is that controls normallyused by the pilot have a separate, alternate usewhen running the payload sensors, virtually guar-anteeing that a breakdown in checklist disciplinewould have a catastrophic outcome at some pointduring the system’s life cycle. Fortunately, in thiscase the hidden trap was discovered without loss oflife and has been addressed to some extent by sub-sequent design and training fixes.

The point of this discussion is that the potentialinvolvement of cockpit layout and “switchology” is-sues involvement in an unmanned aircraft accidentinvestigation is not necessarily a matter for humanfactors specialists alone. Rather, investigators willneed to be trained to explore how the system as awhole is routinely operated, any previously encoun-tered design issues reported by its users, and howmisleading, incomplete or inappropriate design fea-tures or informational cues can have unexpected orconfusing outcomes. Exploring these matters is nota human factors engineering or human perfor-mance line of inquiry so much as an operations lineof inquiry that will require specialist knowledge toeffectively pursue.

Accidents Where UAS Differences fromManned Aircraft May Be a FactorMidair Collision-A midair collision involving anunmanned aircraft and a manned aircraft probablyis the most likely type of event that typically comesto mind when considering worst-case scenarios in-volving UAS operations in shared airspace.*

Determining how the two aircraft came into con-flict may require examining how their respectiveoperations were being conducted and what they en-tailed; the presence and effectiveness of rules andprocedures intended to separate manned and un-manned operations; the qualifications of the un-manned aircraft pilot (if different levels of certifica-tion are allowed by the State of Occurrence); andsimilar issues of airspace utilization and crew certi-fication. At some point the question of whether one

13

Figure 2. Example Design Eye Reference Point Diagram (Transportation Safety Board ofCanada)

or both pilots had the ability to see and avoid (ordetect and avoid, as appropriate) the other prior toimpact is likely to arise. Once a given investigationturns to this issue, it is likely to become far morecomplex, and developing recommendations intend-ed to prevent the accident’s recurrence will becomemore challenging.

If a manned and unmanned aircraft are in-volved, traditional means of determining themanned aircraft pilot’s perspective first should beemployed. Investigators may wish to determine ifthe manned aircraft’s pilot could have seen the un-manned aircraft by examining the collision geome-try against possible impediments to cockpit visibil-ity, such as through use of a design eye referencepoint diagram like that shown in Figure 2.

Once the unmanned aircraft has been located onthis type of diagram (i.e., from the manned aircraftpilot’s point of view), investigators will need to takeinto consideration how the unmanned aircraftwould have appeared. Unmanned aircraft come inall shapes, sizes and colors, in some cases meaninga much smaller than usual target, perhaps withlittle contrast against the prevailing background,may have been presented to the manned pilot. Al-so, unmanned aircraft operate at a variety of air-speeds depending on their type, meaning a conflictcould have developed much more quickly than usu-al or, conversely, with so little relative movementas to make it virtually imperceptible. This part ofthe analysis should allow a determination to bemade as to whether the manned pilot reasonablycould have had the ability to see and avoid the

unmanned aircraft prior to impact.When the question turns to the unmanned air-

craft pilot’s ability to avoid the collision, it will benecessary to determine how (or if) the involved sys-tem compensates for the pilot’s inability to directlysee and avoid other aircraft. In some cases, civilaviation authorities may have made a deliberaterisk decision to accept such a limitation withoutfurther mitigation, or by relying purely on the UASpilot having direct visual contact with his/her air-craft at all times based on how and/or where theunmanned aircraft is intended to operate. Howev-er, it is also possible that active and/or passive“detect and avoid” systems may be in use as well.

In exploring a midair collision from an un-manned aircraft system perspective, it is importantto bear in mind that so-called “airborne sense andavoid” (ABSAA) systems that perform DAA func-tions are aircraft-based. While some concepts aresimilar to traffic alert and collision avoidance sys-tems (TCAS), detecting other aircraft and providingdirection to the pilot regarding the best avoidancemaneuver, most involve a fusion of active and pas-sive sensors supported by on-board logic that iden-tifies conflicts and automatically takes or directsaction to separate the unmanned aircraft fromthem.

If an unmanned aircraft that should have beencapable of avoiding a collision by virtue of ABSAAnevertheless is involved in a collision, investigatorswill be faced with a highly complex technical prob-lem. They will have to determine how the encoun-ter unfolded, including if:

14

The conflicting traffic was capable of beingdetected by the available sensor suite;

The detection value was sufficient to triggerthe appropriate warning and/or autonomousresponse (if autonomous maneuvering is ena-bled in the installed DAA system); and

Whether the amount of time between detec-tion and avoidance maneuver (if any) waswithin design parameters, as well as whetherthose parameters were appropriate to the ge-ometry of the encounter.

These questions normally will require signifi-cant engineering and modeling and simula-tion expertise to address, most of which isnot within a typical ASI’s knowledge base.

In contrast to the above, “ground-based senseand avoid” (GBSAA) systems typically support sep-aration between manned and unmanned aircraftby maintaining surveillance over a defined portionof the sky using surface-based sensors, most com-monly using radar capable of seeing both tran-sponder-equipped and non-squawking aircraft.Three key issues most likely will need careful scru-tiny wherever a collision or loss of separation takesplace in a GBSAA-protected volume of airspace: Whether the system successfully detected the

conflict in a timely manner; Who and how the system warned of the con-

flict; and

Whether the UAS pilot’s response was appro-priate to the warning.

As with many aspects of UAS operations, thereare no settled specifications or performance stand-ards for GBSAA systems. Similarly, while thereare a number of innovative approaches to providingGBSAA services at various locations, there is noconsensus regarding the system architecture usedto enable them. Some concepts involve dedicatedradar systems, while others use existing air trafficcontrol radar where those systems have been eval-uated and deemed suitable based on their altitudecoverage, ability to effectively track non-cooperative targets, etc.

At the same time that investigation into thepoint-of-view and surveillance dimensions of theaccident sequence is undertaken, all recorded datacaptured by the involved UAS – including the“take” from any sensors oriented in the direction ofthe axis along which the collision took place –should be obtained for examination as well. Thiswill allow investigators to assess the extent towhich unmanned aircraft system crews typicallyrely on normal spectrum, low-light or infrared cam-eras to scan for conflicting traffic, as well as the

field of view offered by each such system.It may be procedurally acceptable or legally

conformant to use on-board sensors to support col-lision avoidance, or even as an alternate means ofcompliance with a State’s implementation of the“see and avoid” principle. However, it may be dif-ficult for investigators to determine the reasonable-ness of using such systems for clearing an un-manned aircraft’s flight path if doing so is consid-ered an approved technique. As such, close consul-tation with regulatory and certification authoritiesmay become necessary on that point.

Loss of Control Accidents (Airborne)-Unmanned aircraft, like their manned counter-parts, sometimes are involved in accidents wherethe pilot in command loses control of the aircraft.However, with unmanned aircraft, investigatingsuch accidents and incidents can be a more com-plex process simply because there are many moreways such a failure might occur. One’s traditionalmental image of an “out of control” aircraft must besupplemented to include another scenario altogeth-er, where an unmanned aircraft autonomously fliesitself to a final destination that may or may not beknown.

For investigations conducted under existingmodels and taxonomies, it is useful to distinguishbetween events involving the failure of the controland non-payload communications (CNPC) linkfrom those where the link is in operation but theaircraft becomes uncontrollable. In the formercase, the pilot may no longer be in or on the controlloop, but a reasonably sophisticated aircraft mayremain stable and navigate itself to a pre-determined point (following a “lost link profile”).Alternately, it may fail to revert to the prepro-grammed profile and instead take up an unknowntrajectory (“flyaway”).

In the latter case, for the purpose of this discus-sion, a UA loss of control takes place when the pilotis no longer able to change the aircraft’s heading,airspeed or altitude through an otherwise function-ing CNPC link. This type of malfunction typicallyis the result of a mechanical or structural failureaffecting the movement or condition of a primaryflight control or control surface, or due to a failurein the transmission of a control input or its trans-lation into a control input aboard the aircraft. Todate such failures have proven to be rare, but whenthey occur they are extremely difficult to diagnoseremotely.

For UAS accident and incident investigators, thegreatest virtues of just about every unmanned air-

15

craft occurrence – and particularly in cases of lossof control resulting in the loss of an aircraft – are (1)having a live pilot to talk to, and (2) having thepossibility of obtaining significantly more perfor-mance data than is usually captured by a flight da-ta recorder readily available in the ground controlstation, at least where more complex UAS are in-volved.5 The pilot’s testimony can provide signifi-cant clues regarding the cause of virtually any kindof accident; rich recorded data can augment the pi-lot’s recall and understanding of the sequence ofevents and possibly provide clues as to any discon-nects between perception and reality where suchmight exist.

At the same time, as is the case with all UASaccidents – and especially those involving loss ofcontrol – it is vital to remember that a pilot’s abilityto provide information about the sequence of eventsis almost totally dependent on the extent to whichthe system itself provided that pilot with infor-mation, and that data provided to the ground con-trol station is totally dependent on a functioningdownlink throughout the period of interest.

Loss of Control Accidents (Ground) andGround Collisions-The possibility of a runawayunmanned aircraft on the ground is hardly withoutprecedent in manned aviation. Brake failures, air-craft getting away from their pilots after being“prop-started” and a host of other scenarios haveplayed out over time. Similarly, collisions withfixed obstacles or other aircraft regularly take placein manned aircraft operations and should be ex-pected in unmanned operations as well. In general,unmanned aircraft should be assumed to have thesame potential vulnerability to such mishaps astheir manned counterparts, and many such eventsare likely to be traceable to the same or similarcauses and precursors.

At the same time, differences between mannedand unmanned aircraft can have a bearing on thenature and outcomes of ground accidents involvingthe latter. For example, the failure of a CNPC linkduring ground operations can have unexpected ordifficult-to-avoid consequences, particularly if onetakes place in close proximity to other aircraft orsurface obstacles. Most unmanned aircraft incorpo-rate on-board logic that will immediately apply theaircraft’s brakes and/or shut down its engine imme-diately upon detecting a lost link.

Unmanned aircraft systems intended to be tax-ied to or from a takeoff or landing surface typicallyprovide their pilots with the means and a processfor doing so safely. UAS pilots may watch

marshallers with forward-looking optics, follow taxilines, and stop at hold-short lines, just as theywould from the cockpit of a manned aircraft. How-ever, investigators must bear in mind that, whilesuch operations may appear to be conducted in anidentical manner to those performed by mannedaircraft, UAS pilots operate under significant limi-tations with respect to their field of view.

System/Component Failure or Malfunction-Accident sequences that begin with component fail-ures or malfunctions can be particularly insidiousin unmanned aircraft simply because of the poten-tial delay in the pilot’s becoming aware of a devel-oping situation. Unlike manned aircraft, UAS pi-lots cannot directly perceive anything that mightcue them to a mechanical problem: no sounds, nosmells, no vibrations, no “control feel.” Virtuallyeverything they know about the condition of theiraircraft must be transmitted down through thesame limited amount of bandwidth that must beshared with critical flight performance and naviga-tion data.

As they gain experience with how operational orperformance issues show up in regular service,UAS manufacturers have become adept at identify-ing the relative criticality of different componentfailures or flight conditions. Since there are nostandards regarding what needs to be provided to aUAS pilot for situational awareness, each manufac-turer determines data requirements based on histo-ry, known system limitations and vulnerabilities,and available transmission and reception resources.

Investigators considering the possible role of asystem or component failure in an observed acci-dent sequence will need to familiarize themselveswith the specifics of the downlinked data providedto the UAS pilot. If it is concluded that the air-craft’s condition deteriorated in such a way thatwarning should have been provided prior to failure,the feasibility of implementing recommendationsregarding future instrumentation will be highly de-pendent on the demand such instrumentation willadd to the system in terms of weight, electricalpower or downlink requirements… not just the unitcost as might be the case with manned aircraft rec-ommended to receive a component repair or up-grade.

For unmanned aircraft, investigators also mustbear in mind that system or component failurescould entail malfunctions of the ground control sta-tion, not just the unmanned aircraft. A completelyairworthy, properly operating unmanned aircraftcan be lost if the ground control station supporting

16

its operation becomes unusable or unreliable. Insome cases, GCS-related problems may appear tobe aircraft problems; if a second GCS or control po-sition is not available to take over the operation ina timely manner, an otherwise preventable acci-dent may occur. Once that has happened, it maybe difficult to diagnose the exact nature of the GCSproblem because uncertainty may remain regard-ing link stability, local interference, or other poten-tially distracting and irrelevant lines of inquiry.

Beyond the fundamental differences betweenmanned and unmanned aircraft cited to this point,other differences may present themselves in thecourse of a UAS systems investigation. In particu-lar, investigators may not assume that flight-critical components necessarily conform to stand-ards established for comparable components inmanned aircraft. Similarly, equipment subject totechnical standard orders or other means of guar-anteeing a specific level of performance or reliabil-ity aboard manned aircraft may be substituted forwith less stringently manufacturer or certified avi-onics aboard unmanned aircraft.

Until contentious issues of cost, airworthinesscertification authority and other “comparability”issues associated with integrating unmanned air-craft into shared airspace are resolved, investiga-tors must be prepared to encounter, document andanalyze the performance of on-board systems thatwould not be acceptable in manned aircraft in thecourse of accident and incident investigations.

CHAPTER 3Augmentation and Supplementation of

Existing Investigative Capabilities for UASInvestigations

Investigative Skills and KnowledgeAssociated with UAS Attributes

It is likely that specialized investigative skillswill be required to explore the involvement of oneor more of the above differences in a given accidentsequence or its aftermath. As may be expected,such skills will be needed to support analysis of theunique attributes listed above.

Human Factors—The human factors domain as itrelates to unmanned aviation must be consideredfrom two distinct perspectives: The extent to which an unmanned aircraft sys-

tem pilot in command is expected to be a “pilot,”with the body of knowledge and physical attrib-utes expected of those flying manned aircraft;

and The extent to which an unmanned aircraft’s pi-

lot can be reasonably expected to accuratelyperceive the flight environment and the imme-diate surroundings of his/her aircraft – in otherwords, to have appropriate situational aware-ness – when physically separate from thataircraft.

To the first point, at this writing there is insuffi-cient objective research available to allow air safetyinvestigators to make any independent judgmentsregarding how an unmanned aircraft system pilotshould be trained or certified. Such decisions areproperly the domain of the national aviation authori-ties who regulate unmanned aircraft system opera-tions. If the circumstances surrounding a given acci-dent under investigation suggest deficiencies inthese areas, appropriate findings and recommenda-tions should be made.

On the other hand, there is a large body of com-pelling historical information that points to how thesafe operation of aircraft is highly dependent on thepilot’s physical condition and fitness to fly. Again,each State that allows unmanned aircraft operationshas to make determinations regarding the specificstandards to which each pilot should be held. Thedistinctive nature of UAS operations includes notsubjecting the pilot to some of the more physicallychallenging aspects of flight, such as high physiologi-cal altitude or exposure to high Gs. In the sameway, some accommodations may be possible for cer-tain typical requirements, like normal color vision orsome physical impairments, simply based on howunmanned aircraft are flown.

This is not to say that some aspects of unmannedaircraft system operation do not place demands onthe physical or mental faculties of UAS pilots. Forexample, visual acuity is critically important for anyUAS operation where the pilot or a visual observermust keep the aircraft in sight to keep it clear of oth-er aircraft and obstacles. Similarly, being properlyrested is a necessary adjunct to any complex mentalactivity, as is good general health. Where a pilot’sfitness to fly or to carry out the responsibilities asso-ciated with flying might come into question in thecourse of an accident investigation, such issues cer-tainly will be worth exploring in the context of theexisting body of regulations applicable to the opera-tion.

The second perspective on human factors – howUAS pilots obtain and maintain situational aware-ness regarding the conduct of their operations – ismuch less clearly understood. One of the principallimitations under which such pilots must work is in

17

having the vast majority of their situation(al)awareness regarding their aircraft’s operation, aswell as the condition of both the aircraft and theenvironmental conditions surrounding it, confinedto the visual sense. Further, the manner in whichmuch of the available data regarding these parame-ters is presented often requires interpretation; forexample, in some systems accumulating ice must bededuced by noting decreased performance, altitudeloss and similar symptoms rather than simply look-ing out a window and seeing ice.6

Throughout the first century of flight, aviationhuman factors experts made great progress in de-termining the best means of presenting informationto pilots, distinguishing between the different typesand criticality of flight-related information as wellas developing context-based rules for prioritizing it.Various types of displays have been developed tosimplify the identification of anomalous conditions,performance trends indicative of developing systemproblems, and differing severity of malfunctions.At the same time, there always has been at least animplicit understanding that direct perception of thesymptoms of some problems, such as unexplainedsounds, vibrations or smells, often supports theirdiagnosis or correction.

None of these cues are available to an unmannedaircraft pilot directly. A conscious decision must bemade by each UAS designer as to which infor-mation is important enough to warrant being addedto the limited data stream from aircraft to pilot.Even if it is deemed desirable to devote a certainamount of bandwidth to purely aircraft state data,developing digital surrogates for sensory-type infor-mation is relatively easily for some conditions (e.g.,identifying a rough ride through rapid excursionsin G-forces), but quite difficult for others (e.g., thesmell of an overheating electrical component, theaccumulation of smoke, etc.).

Another consideration is that the criticality ofsome flight conditions – such as turbulence or icing– varies widely from system to system. So, it is nota simple matter to standardize downlinked dataacross the entire constellation of unmanned aircraftsystems. This is especially the case where requir-ing unnecessary data to be transmitted and dis-played could result in pilot interpretation problems,information overload, a failure to provide data thatmight be more useful, or additional potentialsources of on-board malfunctions associated withthe information collection and transmission itself.

Following the above line of reasoning, it is notunreasonable to assume that at least some futureaccidents with UAS involvement may require the

commissioning of specific human factors studies toexplore investigators’ theories of potential accidentscenarios. This could include determining what apilot could have reasonably concluded about anemerging aircraft problem based on the informationavailable, what more could have been done to sup-port their situation awareness under given opera-tional conditions, or similar issues. Human factorsexpertise also may need to be applied to developingrecommendations to prevent future accidents aswell. This might entail addressing such issues asthe kinds of automation needed to support certaintypes of flight activity, automated functions mightneed to be made more visible to pilots to supportsituation or mode awareness, etc.

Finally, simply describing the constellation ofpossible human factors issues arising from un-manned aviation does little to ensure that the need-ed expertise will be available to explore them. Gov-ernments must take conscious steps as soon as pos-sible to support the growth of a qualified talent pooland an unmanned aviation-focused academic estab-lishment to deal with such challenges as they arise.While it might be ideal to have unmanned aviationhuman factors specialists embedded in each nation-al aviation authority, as a practical matter it wouldseem more useful to ensure that funding for the ac-ademic community is made available to develop ex-perts who could support both public and privateneeds for such skills.

Telecommunications—While telecommunicationsand frequency management expertise periodically iscalled upon in present-day aviation accident inves-tigations involving manned aircraft, it is likely tobecome far more prominent once unmanned air-craft become regular participants in the overall avi-ation system. One of the cornerstones of unmannedaircraft systems operation is the remote location ofthe pilot/operator. At a fundamental level, thismeans that the entire concept of unmanned avia-tion (other than where the aircraft are completelyautonomous) is dependent upon uninterrupted RF-based connectivity with adequate capacity for allneeded data to be exchanged without loss ordistortion.

Prior to the advent of widespread unmanned air-craft operations, the regulatory relationship be-tween aviation and telecommunications largely wassettled. Portions of the RF spectrum have longbeen reserved for aircraft voice communicationsand navigation equipment; whenever new require-ments for additional capabilities have emerged(e.g., Airphones, onboard WiFi, satellite communi-cations, controller-pilot data link communications),

18

they have been aligned with the appropriate partsof existing allocations on the basis of how they op-erate, and accommodated at a regional or globallevel as needed.

However, it is important to note that in recentyears it has been rare for such new requirements tobe related to the safety of flight. Rather, they havebeen driven by the emergence of new technologiesintended to increase the efficiency of tasks alreadyconducted in aviation operations, or they have beencreated for the convenience of aircraft operators orpassengers. Unmanned aviation has raised thestakes in the relationship between those who regu-late flight and those who regulate resources sup-porting flight, since access to spectrum – and lots ofit – is a prerequisite to making use of unmannedaircraft safely and effectively. At the same time, un-manned aircraft move, meaning the frequencies usedto control cannot be allocated using the location-basedmodel applied to air traffic control or navigational aidfrequencies.

There are two distinct aspects of how the finiteresource of spectrum must be managed in order forunmanned aircraft to be operated safely, both ofwhich will require expert knowledge to interpret inthe event of an aviation accident in which the relia-bility, stability or adequacy of control-related linksmay be in question: the frequencies used, and thebandwidth required on each of those frequencies.To understand the distinction between the two, abrief explanation is in order.

In the earliest days of radio, it was easiest togenerate and broadcast signals of comparativelylong wavelengths (in the “low frequency” and“high frequency” bands). These signals also hadthe side benefit of covering very long distances byvirtue of their property of being reflected by theionosphere, “skipping” over the horizon. As peo-ple learned the relative advantages and disad-vantages of different types of transmissions at dif-ferent frequencies, it became obvious that some or-ganizational scheme would need to be imposed onall of the prospective users of the airwaves to pre-vent their mutual interference. To some extent, thephysics of electronic communications argued in fa-vor of assigning certain uses to specific frequencies.For the rest, however, competing applications vyingfor exclusive use of part of the spectrum often hadto be individually licensed on the basis ofavailability.

The responsibility for such assignments was firstworked out at the international level through anexisting communications-oriented body – the

“International Telegraph Union,” now the Interna-tional Telecommunications Union (ITU) – with in-dividual nations granted portions of the spectrumfor their respective exclusive use, and other por-tions protected to enable commonality for world-wide systems to operate, such as those dedicated toaeronautical activity. However, many current UASactivities share portions of the spectrum with otheroperations. Military UAS often operate on military-reserved frequencies. There also is a small portionof the spectrum set aside exclusively for short-range hobbyist/model aircraft use, which at least inthe U.S. is required to be entirely noncommercial.7

The vast majority of UAS command, control andcommunications most commonly are carried out inthe range of frequencies between 900 megahertz(MHz) and 30 gigahertz (GHz). There are three“services” under which aviation-specific spectrum isallocated by the ITU: Aeronautical mobile (route) service (AM(R)S); Aeronautical mobile satellite (route) service

(AMS(R)S); and Aeronautical navigation radio service (ARNS).

Allocations for UAS uses are complicated byneeding to be made from the first two of these, eachof which is separately administered. The reasonwhy different domains are involved becomes clearerby looking at Figure 3.

Figure 3. UAS communications segment spec-trum/bandwidth requirements by communi-cations node (from an issue paper preparedfor the World Radiocommunication Confer-ence 2007, Spectrum for UAS (Unmanned Air-craft Systems): Status of WRC-2007 prepara-tion and proposal for a new agenda item forWRC- 2011, Didier Petit and Alain Delrieu)

The ITU has identified three distinct types of“radiocommunications” required to operate an un-manned aircraft in controlled airspace: Radiocommunications in conjunction with air

traffic control relay;

19

Radiocommunications for UA command andcontrol;

Radiocommunications in support of the senseand avoid function.8

In addition to the above, many UAS incorporatedata downlinked from apayload such as an on-board camera or other sen-sor, which may use an en-tirely different part of theRF spectrum but which, bythe nature of how its“take” is used, may also beflight- critical. To providefor all of these require-ments, unmanned aircraftsystems require significantamounts of bandwidth tosupport both uplinked anddownlinked data. Mostunmanned aircraft haveseparate downlinked datastreams – one for control,the other with the payload“take.”

Figure 3 shows that the remote location of thepilot and the need to downlink both control andpayload data from the aircraft drive requirementsfor different frequencies. The amount of data thateach frequency hosts requires significant spacefrom competing or potentially interfering signals,and, for security may utilize several separate fre-quencies among which the transmission can “hop.”Further, the vast majority of beyond line of sight(BLOS) UAS operations require satellite service(although some terrestrial methods are being ex-plored) for both data and voice support.

Previously, the UAS community has acknowl-edged the complexity of unmanned aviation and therelationship among its various components, but hastended to downplay the criticality of how those com-ponents must interact to assure their safe opera-tion. In response to the need to re- imagine thefunctional relationships between pilot and aircraft– and to graphically illustrate the different types ofdata exchanges that need to take place through thevarious links – RTCA Special Committee 228’sWorking Group 2 (WG2) reconsidered the originalarchitectural diagram shown in Figure 1.

The new “control chain” conceptual model now inuse by WG2 (Figure 4) differs from the originalRTCA DO-304 notion of “segments.” The groundcontrol station now is envisioned as the place wherehuman- machine interface takes place, and a new

hardware/software node is referred to as the“communication infrastructure.” This change ap-pears to have been made to enable the revised mod-el to accommodate varying levels of connection com-plexity, from radios to a ground-based data distri-

bution system that is envisioned to provide a“signal in space” from terrestrial stations to air-borne aircraft.

While the updated vision of UAS system logicdoubtless is helpful for engineers, it is somewhatdaunting for those new to unmanned aviation.However, WG2 also re-imagined how to portray thedifferent types of flight-required datalinks, which ishelpful in understand both the complexity of linksand how they are used. These demands drive sepa-rate but equally pressing bandwidth requirements.

What Figure 4 is intended to show is that thereare a number of data exchanges constantly occur-ring between a GCS and a UA, especially where aBLOS operation is in progress. SC-228 is not con-cerning itself with any requirements for spectrumthat may be needed to support payload data(although some types of UAS see payloads asproviding possible alternate means of compliancewith see-and-avoid requirements – a flight-criticalfunction).

Also, SC-228 appears to be confining its atten-tion to the far left side of the diagram, where onlythe telecommand (uplink) and telemetry (downlink)data supporting BLOS operations would be accord-ed “protected” bandwidth. Requirements for airtraffic control (ATC) communications presumablyare to be met through existing spectra, althoughhow this is to be assured has yet to be determined.

Figure 4. RTCA SC-228 WG2 “Taxonomy of UAS Data Links”

20

* * * *Beyond the system complexity arising from the

multiple parts of the RF spectrum needed for UASoperations, the bureaucratic complexity describedabove suggests there could be a purely“management” aspect to UAS-related telecommuni-cations issues that may arise in the course of anaccident investigation.

Consider a scenario where a link became unusa-ble at a shorter range than should have been thecase, or was disrupted by interference due to aninappropriate or inadequate allocation of spectrumfor unmanned aviation operations. Delving into apossible accident sequence of that type, and thendeveloping meaningful recommendations to pre-vent its recurrence, requires specialist understand-ing of the properties of radio waves at different fre-quencies, the administration of available spectrum,the degrading effects of intentional or unintention-al interference, and the matching of available spec-trum with intended use as a function of suitabilityrather than its just being “open.”

Different governments (i.e., ICAO memberStates) are organized quite differently for regulato-ry purposes. ASIs need look no further than theirown domain to realize that the relationship be-tween their country and others in the aviation envi-ronment is to some extent conditioned by theirState’s participation in ICAO. A similar relation-ship typically exists between individual nationsand the ITU, which governs the allocation of spec-trum, maximum output power of transmitters, anda whole array of similarly vital aspects of RF appli-cations. Therefore, investigators need to act assoon as possible to identify points of contact in theappropriate agencies within their respective gov-ernments to be ready to address issues of the typedescribed in advance of an accident requiring theirmobilization.

Based on the foregoing discussion, the reasonswhy telecommunications expertise will be essentialto UAS-related air safety investigations should beapparent. However, as mentioned earlier in thissection, the reliance of UAS on their“communications segment” also brings with it twospecific concerns: the potential for its disruption(control link failure), and the practical implicationsof having a built-in lag in the communications be-tween pilot and controller and pilot and aircraft(latency).1. Control Link Failure Impacts

From a purely operational perspective, a fre-quently made analogy is that UAS control link

failure (i.e., a “lost link” occurrence) is pretty muchthe same as a failure of two-way radio communica-tions, even when it occurs in controlled airspace.Proponents of this line of reasoning rarely stepthrough the actual consequences; they simply as-sert that the two events’ impact on surroundingaircraft and the ATC system is equivalent, as is thecontroller’s response to them.

Unfortunately, such is not the case, at least forthe foreseeable future. A manned aircraft’s crewflying on an instrument flight plan follows theclearance issued to them, even if communicationsfail. From the clearance limit onward, there arewell-defined procedures regarding what the pilot isto do based on what he or she was told to expect,and nothing normally will prevent them from fol-lowing those procedures. They also can communi-cate their situation via transponder in most situa-tions, either by squawking 7600 or 7700 as appro-priate to their circumstances.9*

An unmanned aircraft system control link fail-ure cannot be described in terms of “standard pro-cedures” because each such failure may have acompletely unpredictable outcome, a highly specif-ic, well-defined outcome, or something in between.Such variability begins at the moment of link fail-ure: Was only the pilot’s ability to control the air-

craft affected, or were voice communicationswith ATC disrupted as well?

If the latter, how does air traffic control becomeaware of the aircraft’s degraded operationalstate? Is it programmed to change its tran-sponder squawk, will it do so immediately or isthere a built-in delay between the failure andthe initiation of any on-board programmed be-havior?

Was the unmanned aircraft programmed to pro-ceed to orbit at a known point (sometimes re-ferred to as a “flight termination point”) or re-turn to its point of origin in the event of controllink failure? Was the flight termination pointchanging throughout the flight? If so, wherewill the aircraft turn toward, and how longmight it be before it takes up a new heading,airspeed or altitude?

Assume that an unmanned aircraft is in BLOSoperation and any programmed delay between linkfailure and initiation of a “lost link profile” haselapsed. What will the aircraft do next? There is noway to answer this question without knowing thespecifics of the aircraft’s designed capabilities andthe specifics of its pre-programming.

Even if you know that it has been programmed

21

Figure 5. Differences between Manned and Unmanned Aircraft Transactions (ICAO Aeronau-tical Communications Panel Working Paper, ACP-WGF24/WP15, 21-25 March 2011)

to proceed to a particular point in space – say, inmilitary reserved airspace – and ATC is in contactwith the pilot, there is no way to determine precise-ly how the aircraft will navigate itself to that pointin space. This situation can be compounded in com-plexity by taking place outside radar surveillance;control link failures frequently are accompanied bydownlink failures, meaning the pilot in commandmay no longer be receiving positional or perfor-mance information from the aircraft and thus can-not advise air traffic controllers of its position.

The kinds of imponderables cited in this exam-ple are likely to persist for some time. The contentsof UAS flight plans and ATC progress strips willhave to evolve significantly to include critical infor-mation that allows controllers to anticipate thenext moves of an unmanned aircraft that unexpect-edly reverts to what is for all practical purposes anautonomous mode of operation.

In the interim, any investigation resulting froma control link failure will need to be augmented bypersonnel with an intimate understanding of theinvolved system’s architecture and post- failure

decision logic, and who do not have an institutionalstake in the investigation’s outcome. The potentialfor control link disruption is perhaps the singlegreatest common vulnerability across the entirespectrum of unmanned aviation, and the tolerabil-ity of this vulnerability has a direct bearing on theacceptability of the concept of unmanned aircraftsystems themselves.2. Latency Impacts-When air traffic controlcommunications first began being supported by sat-ellites, questions arose regarding the potential ef-fects of delays in control instructions being receivedand executed. The term “latency” came into use todescribe the lag time required for a given transmis-sion to be transmitted to a satellite in low Earth orgeosynchronous orbit and then re-transmitted to itsintended recipient.

The advent of unmanned aircraft systems

brought a new dimension to the latency issue in the

context of flight operations. A great deal of useful

research was conducted on the effects of communi-

cations latency when it first was introduced, and

22

much of it was captured for consideration by the

now-disbanded “Access 5” UAS study group.10

However, referring back to Figures 1 and 3 earlier

in these UAS Investigation Guidelines, it is clear

that long-distance telecommunications are needed

to support unmanned aircraft systems operations

both for communications and for aircraft control.

Thus, “latency” for unmanned aircraft has implica-

tions both for the timely reception of control in-

structions and for the subsequent execution of those

instructions.This issue has been considered at some length in

the ICAO environment. For example, at a March2011 meeting of the Aeronautical CommunicationsPanel (ACP), a presentation on UAS “availability,continuity and latency” suggested that the additionof the need for “non-payload” communications coulddrive the total time between when an instruction isissued and carried out (“transaction time”) to ex-ceed standards established by ICAO Document9869, Manual on Required Communications Perfor-mance (RCP).

The paper’s author concluded, “The UAS trans-action time to meet the overall RCP10 require-ments probably is insufficient to be met by a satel-lite system.” This is an extremely strong state-ment, but is based purely on engineering analysis.Nevertheless, it has yet to make any meaningfulimpact on the evolution of beyond line of sight un-manned aircraft systems, certification require-ments, or policies to date.

Figure 5 illustrates the problem graphically.Each step of the transaction for an unmanned air-craft responding to a control instruction takesmeasurable time due to latency, which must beadded to the total time necessary for the controllerto issue the instruction and the pilot to respond toit. The time involved is extremely small, but thespeed with which aircraft operate and conflicts de-velop makes any delays a matter of some concern.

Despite the relatively small amounts of time laginvolved, latency has been observed to have oneconcrete effect on beyond line of sight UAS opera-tions: unmanned aircraft landing attempts madevia satellite-based control links rarely succeed. Thedisconnect between instrument readings, visual in-formation relied upon for pilot orientation and con-trol inputs almost invariably result in the pilot be-ing well behind the aircraft, reacting to flight condi-tions that already have affected the aircraft in pitchor roll. This is one of the principal reasons behindongoing efforts to develop reliable autoland systemsfor high-value BLOS unmanned aircraft.

It has been suggested that latency challengesshould form the basis of new approaches to UASdevelopment, including possibly placing more deci-sion-making and control capability directly aboardunmanned aircraft themselves. The safety recordof unmanned aircraft, including those involved inaccidents where their control links have been com-promised, will provide support for or direction tosuch efforts, as will the outcomes of UAS-involvedaccidents. However, until unmanned aircraft arecapable of independent two-way communicationsvia natural language or datalink messages to con-trolling agencies, latency is likely to be a normaland unchanging aspect of BLOS UAS operations.

Security Impacts—One final telecommunicationsissue that may need to be explored in the context ofan unmanned aircraft-involved accident is the pos-sibility that a failure observed in the sequence ofevents was deliberately induced instead of acci-dentally encountered. In the past, where bomb-ings, hijackings or intentional crewmember actionshave been the cause of aircraft losses, evidence ofcriminal acts usually has been identified fairlyquickly, and the investigative responsibility andprocess has migrated from safety to law enforce-ment authorities.

In unmanned aviation, actions intended to dis-rupt the conduct or control of a flight may be muchharder to trace or prove. The control link itselfcould be attacked; alternately, Global PositioningSatellite (GPS) signals could be jammed ormeaconed (overridden by a stronger, apparentlyvalid but incorrect signal). Individual investigativeand civil aviation authorities will need to considerdeveloping their own criteria for exploring the pos-sibility of criminal activity in the course of an un-manned aircraft system-related aircraft accidentbased on their individual threat assessments andthe specific circumstances surrounding a givenevent.

To sum up, the telecommunications expertisenecessary, civil aviation and national investigativeauthorities need to be prepared to either developtheir own resources or identify sources of supportwith working knowledge of the following subjectareas: Availability/suitability of supporting ground-

based telecommunications architecture. Availability/degradation of satellite-based over-

the-horizon telecommunications. Availability/adequacy of allocated RF spectrum

in the vicinity of an unmanned aircraft acci-dent.

23

Aircraft Structures—Investigators specializing instructures-related factors are likely to have a livelyset of challenges before them in any major accidentinvestigation involving an unmanned aircraft. Thefundamental issues likely to be on the table are: For any accident involving in-flight structural

failure of an unmanned aircraft: How was the aircraft constructed? To what standards was the airframe built?

For any accident involving a midair collisionbetween a manned and unmanned aircraft re-

sulting in the loss of the manned aircraft: What parts of the manned aircraft were

affected by the initial impact? With what force did the impact take place? What unmanned aircraft components

imparted the greatest part of that force?

What role, if any, did the size, mass, velocity,airframe pliability or general construction ofthe unmanned aircraft play in how impactforces were applied and distributed?

How much force was the manned aircraftdesigned to tolerate at the point of impact?

Are current manned aircraft designstandards adequate to withstand the type ofcollision observed in the accident sequence?

Are current unmanned aircraft design stand-ards adequate to ensure the frangibility of theairframe (where appropriate) in the event ofan impact with a manned aircraft or inhabitedstructure? 11

Most structures investigators and aeronauticalengineers have the necessary expertise to carry outa UAS-involved investigation. However, such in-vestigations may entail understanding how un-manned aircraft designers elected to solve certainchallenges absent both formal certification stand-ards and the need to protect human occupants.

Unmanned aircraft often incorporate design fea-tures that add robustness to certain componentsand forego it in others. As such, qualified investi-gators would be well served by having the oppor-tunity to visit and consult with unmanned aircraftmanufacturers in advance of an investigation,simply as a way of calibrating themselves to recog-nize the tradeoffs and weight-saving compromisesmade in the end items.

Electrical Propulsion Systems—Investigators spe-cializing in powerplant-related inquiries are likelyto need some grounding in the emerging types ofpropulsion systems used by many cutting-edge un-manned aircraft. It is common knowledge thatmany unmanned aircraft make use of non-aviation

certified conventional powerplants (e.g. snowmobileengines and other high-torque, lightweight de-signs). It is less well known that the emphasis inmany unmanned aircraft designs is on extreme en-durance, which has led to