What happened
The FAA’s narrative, in sentence case. The FAA writes it in capitals and removes private details.
UAS on take off and climb out developed an uncommanded oscillation in roll and pitch causing the aircraft to crash. An esc motor-1 failure caused the engine -1 to stop. The other motors overcompensated which then commanded the aircraft to roll then crash.
Root cause according to the ch's engineers: fatigue-cracked wire termination at the motor-side can-h connection to the rotor-0 electronic speed controller, aggravated by a manufacturing defect of incomplete solder fill at that joint —
A physical root cause confirmed by an independent sem/eds laboratory analysis and accepted by the hardware engineering and reliability engineering. This fault caused escalating can-bus communication errors and ultimately resulted in a loss of throttle commands being received, causing the module to disarm approximately 2.8 seconds into the flight. The module then restarted when commands were received roughly two seconds later and produced an uncommanded RPM surge, driving an unrecoverable roll divergence, inversion, and ground impact approximately 10 seconds
After arming.
A single-motor fault of this kind would ordinarily be survivable; three aircraft configuration settings that had not been fully developed for the intended production required baseline — disabled automatic motor-failure detection, a disabled pre-arm esc health check, and enabled stick-gesture re-arming — are what allowed the failed module to restart uncommanded and turned this event into loss of the aircraft.
Hardware mitigations have been identified that can be retrofitted into existing DDA2 aircraft, and software health monitoring has been developed to automatically detect degrading can performance. The design of future DDA2 aircraft (block 1.2) has already incorporated changes that address this failure mechanism.
As the FAA filed it
UAS ON TAKE OFF AND CLIMB OUT DEVELOPED AN UNCOMMANDED OSCILLATION IN ROLL AND PITCH CAUSING THE AIRCRAFT TO CRASH. AN ESC MOTOR-1 FAILURE CAUSED THE ENGINE -1 TO STOP. THE OTHER MOTORS OVERCOMPENSATED WHICH THEN COMMANDED THE AIRCRAFT TO ROLL THEN CRASH.
ROOT CAUSE ACCORDING TO THE CH'S ENGINEERS: FATIGUE-CRACKED WIRE TERMINATION AT THE MOTOR-SIDE CAN-H CONNECTION TO THE ROTOR-0 ELECTRONIC SPEED CONTROLLER, AGGRAVATED BY A MANUFACTURING DEFECT OF INCOMPLETE SOLDER FILL AT THAT JOINT —
A PHYSICAL ROOT CAUSE CONFIRMED BY AN INDEPENDENT SEM/EDS LABORATORY ANALYSIS AND ACCEPTED BY THE HARDWARE ENGINEERING AND RELIABILITY ENGINEERING.THIS FAULT CAUSED ESCALATING CAN-BUS COMMUNICATION ERRORS AND ULTIMATELY RESULTED IN A LOSS OF THROTTLE COMMANDS BEING RECEIVED, CAUSING THE MODULE TO DISARM APPROXIMATELY 2.8 SECONDS INTO THE FLIGHT. THE MODULE THEN RESTARTED WHEN COMMANDS WERE RECEIVED ROUGHLY TWO SECONDS LATER AND PRODUCED AN UNCOMMANDED RPM SURGE, DRIVING AN UNRECOVERABLE ROLL DIVERGENCE, INVERSION, AND GROUND IMPACT APPROXIMATELY 10 SECONDS
AFTER ARMING.
A SINGLE-MOTOR FAULT OF THIS KIND WOULD ORDINARILY BE SURVIVABLE; THREE AIRCRAFT CONFIGURATION SETTINGS THAT HAD NOT BEEN FULLY DEVELOPED FOR THE INTENDED PRODUCTION REQUIRED BASELINE — DISABLED AUTOMATIC MOTOR-FAILURE DETECTION, A DISABLED PRE-ARM ESC HEALTH CHECK, AND ENABLED STICK-GESTURE RE-ARMING — ARE WHAT ALLOWED THE FAILED MODULE TO RESTART UNCOMMANDED AND TURNED THIS EVENT INTO LOSS OF THE AIRCRAFT.
HARDWARE MITIGATIONS HAVE BEEN IDENTIFIED THAT CAN BE RETROFITTED INTO EXISTING DDA2 AIRCRAFT, AND SOFTWARE HEALTH MONITORING HAS BEEN DEVELOPED TO AUTOMATICALLY DETECT DEGRADING CAN PERFORMANCE. THE DESIGN OF FUTURE DDA2 AIRCRAFT (BLOCK 1.2) HAS ALREADY INCORPORATED CHANGES THAT ADDRESS THIS FAILURE MECHANISM.