Incident: Facebook's Aquila Drone Crash Due to Autopilot Software Failure

Published Date: 2016-12-16

Postmortem Analysis
Timeline 1. The software failure incident involving the Aquila drone prototype happened on June 28, as reported in Article 58353.
System 1. Autopilot technology of the Aquila drone [58353]
Responsible Organization 1. The software failure incident with Facebook's Aquila drone prototype was caused by an inability of the autopilot technology to handle a gust of wind, leading to the drone crashing during its first test flight [Article 58353].
Impacted Organization 1. Facebook [58353]
Software Causes 1. The software cause of the failure incident was the autopilot technology's inability to track both the airspeed and glidepath simultaneously, giving too much priority to tracking the glidepath at the expense of not limiting the airspeed, as mentioned in the NTSB report and Facebook's blog post [58353].
Non-software Causes 1. Stronger-than-expected wind gust that made it hard for the drone to maintain its proper angle of descent [58353]. 2. Autopilot compensating by pointing the nose of the aircraft down due to the wind gust. 3. Lifted up flaps called elevons on the trailing edge of the wing causing too much pressure and twisting for the lightweight aircraft to handle. 4. Inability of the drone to slow itself down enough through aerodynamic drag.
Impacts 1. The software failure incident led to the crash of Facebook's Aquila internet-beaming drone prototype during its first test flight, resulting in substantial damage to the aircraft [58353]. 2. The incident highlighted the inability of the autopilot technology to effectively handle a stronger-than-expected wind gust, leading to the drone's inability to maintain its proper angle of descent and ultimately crashing [58353]. 3. The software failure incident revealed that the autopilot was unable to track both the airspeed and glidepath simultaneously, prioritizing tracking the glidepath at the expense of not limiting the airspeed, which contributed to the crash [58353]. 4. As a result of the software failure incident, Facebook is changing the aircraft design to address the issues identified, including incorporating a mechanism to increase drag for better descent control in future designs [58353].
Preventions 1. Implementing a more robust autopilot system that can effectively track both airspeed and glidepath simultaneously to prevent prioritizing one over the other, as identified by the NTSB report [58353]. 2. Enhancing the software to better handle unexpected environmental conditions, such as strong wind gusts, by improving the algorithms for maintaining proper aircraft angles during descent. 3. Conducting thorough testing and simulations to identify and address potential software limitations related to aerodynamic drag and speed control to ensure safe landings in varying conditions.
Fixes 1. Implementing a mechanism to increase drag to allow the Aquila drone to descend without gaining too much speed [58353].
References 1. National Transportation Safety Board report [58353] 2. Facebook blog post [58353]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to the Aquila drone crash by Facebook due to an inability to handle a gust of wind is specific to Facebook. There is no mention in the article of a similar incident happening before within the same organization. (b) The article does not mention any similar incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. The incident involving Facebook's Aquila drone crashing was attributed to an inability to handle a gust of wind, which was a design flaw. The National Transportation Safety Board (NTSB) report highlighted that the stronger-than-expected wind gust caused the autopilot to point the nose of the aircraft down, leading to too much pressure and twisting for the lightweight aircraft to handle. This design issue resulted in the crash and substantial damage to the drone [58353]. (b) The software failure incident related to the operation phase is also mentioned in the article. The NTSB report pointed out that the autopilot of the Aquila drone was unable to track both the airspeed and glidepath simultaneously during the landing, giving too much priority to tracking the glidepath at the expense of not limiting the airspeed. This operational issue contributed to the crash as the drone couldn't slow down enough through aerodynamic drag, indicating a failure in the operation of the system [58353].
Boundary (Internal/External) within_system (a) within_system: The software failure incident involving Facebook's Aquila drone was primarily attributed to factors originating from within the system. The National Transportation Safety Board (NTSB) report highlighted that the drone's autopilot technology was unable to effectively handle a stronger-than-expected wind gust during landing, leading to the crash. Specifically, the autopilot's inability to track both airspeed and glidepath simultaneously, prioritizing glidepath tracking over airspeed control, contributed to the failure [58353]. Additionally, the report mentioned that the autopilot's response to the wind gust by lifting up flaps on the wing caused excessive pressure and twisting on the lightweight aircraft, further emphasizing internal system issues as the root cause of the incident.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident related to non-human actions in the article is primarily attributed to the inability of the drone's autopilot technology to handle a stronger-than-expected wind gust during landing. This led to the drone not being able to maintain its proper angle of descent, causing the autopilot to compensate by pointing the nose of the aircraft down, ultimately resulting in too much pressure and twisting for the lightweight aircraft to handle [58353]. (b) The software failure incident related to human actions in the article is highlighted in the statement by Facebook, where it was mentioned that the autopilot was unable to track both the airspeed and glidepath simultaneously, giving too much priority to tracking the glidepath at the expense of not limiting the airspeed. This indicates a design flaw or oversight in the software's prioritization logic, which was a contributing factor to the crash [58353].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The Aquila drone crash was caused by an inability to handle a gust of wind, which led to the autopilot technology compensating by pointing the nose of the aircraft down, resulting in too much pressure and twisting for the lightweight aircraft to handle [Article 58353]. (b) The software failure incident related to software: - The autopilot software of the Aquila drone was unable to track both the airspeed and glidepath simultaneously, giving too much priority to tracking the glidepath at the expense of not limiting the airspeed, which contributed to the crash [Article 58353].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the Aquila drone crash was non-malicious. The incident was attributed to an inability of the software, specifically the autopilot technology, to handle a stronger-than-expected wind gust during the landing, leading to the drone's inability to maintain its proper angle of descent. This caused the autopilot to compensate by pointing the nose of the aircraft down, resulting in too much pressure and twisting for the lightweight aircraft to handle [58353]. The failure was a result of design and operational challenges rather than any malicious intent.
Intent (Poor/Accidental Decisions) unknown (a) The software failure incident related to the Aquila drone crash by Facebook was not primarily due to poor decisions but rather due to technical challenges and design limitations. The incident was attributed to the drone's inability to handle a strong gust of wind during its first test flight, leading to issues with maintaining the proper angle of descent and managing airspeed. The National Transportation Safety Board (NTSB) report highlighted technical issues with the autopilot system and aerodynamic drag, indicating that the failure was more related to technical constraints rather than poor decisions [58353].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article [58353]. (b) The software failure incident was accidental, as it was caused by an inability of the drone's autopilot technology to handle a stronger-than-expected wind gust during landing, leading to the crash. The autopilot's inability to track both airspeed and glidepath simultaneously, prioritizing glidepath tracking over limiting airspeed, was a contributing factor to the accident [58353].
Duration temporary The software failure incident related to the Aquila drone crash mentioned in Article 58353 was temporary. The incident was caused by the inability of the autopilot software to effectively handle a stronger-than-expected wind gust during the drone's landing, leading to the crash. Facebook acknowledged that the autopilot was unable to track both the airspeed and glidepath simultaneously, prioritizing the glidepath tracking over limiting the airspeed, which contributed to the crash. Future designs of the drone will include mechanisms to address these software limitations [58353].
Behaviour crash (a) crash: The software failure incident in this case can be categorized as a crash. The Aquila drone, operated by autopilot technology, crashed during its first test flight due to an inability to handle a gust of wind, resulting in the system losing its state and not being able to perform its intended function of landing safely [Article 58353]. (b) omission: There is no specific mention of the software failure incident being caused by the system omitting to perform its intended functions at an instance(s) in the provided article. (c) timing: The software failure incident is not attributed to the system performing its intended functions correctly but too late or too early in the provided article. (d) value: The failure of the software incident is not described as the system performing its intended functions incorrectly in the provided article. (e) byzantine: The software failure incident is not described as the system behaving erroneously with inconsistent responses and interactions in the provided article. (f) other: The behavior of the software failure incident in this case can be categorized as a crash due to the system losing its state and not being able to perform its intended functions as it crashed during the test flight [Article 58353].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human The consequence of the software failure incident related to the Aquila drone crash mentioned in Article 58353 was property damage. The incident resulted in the drone being "substantially damaged" as it crashed during its test flight, although nobody was injured [58353].
Domain information, knowledge (a) The failed system, Facebook's Aquila internet-beaming drone prototype, was intended to support the production and distribution of information by providing internet access to remote areas without traditional infrastructure [Article 58353].

Sources

Back to List