14.6 Abnormal Operations, Fail-Safes and Flight Termination
Key Takeaways
- Motor failure, control-link loss, remote pilot station failure, fire and bird strike are the five abnormal situations Schedule 4 names.
- Fail-safe options include return to home, a regain-link holding pattern, flight to a predetermined holding point, parachute deployment, immediate landing and flight termination.
- Failsafe behaviour must be configured before flight, because once the link is lost no command can be sent.
- Carbon fibre containment matters after a crash: shattered carbon produces sharp fragments and fine airborne dust that require gloves, care and controlled clean-up.
Abnormal Becomes Emergency When It Is Not Managed
AC 101-01 puts it plainly: even the best designed, manufactured and maintained RPA will suffer failures, and abnormal operations that are not properly managed readily become emergencies. The difference between the two is almost always preparation — the procedure was known, the option was pre-configured, and the site had been surveyed for somewhere to put the aircraft down.
CASA expects a ReOC holder's documented practices and procedures to identify the relevant emergency procedures, with type-specific procedures where they are needed, and expects the mission plan to detail emergency procedures where the standard ones cannot be achieved for a particular task. Most manufacturers publish emergency checklists — read yours before you need it.
The failures AC 101-01 lists for planning are: engine or propeller failure, loss of data link, loss of control, failure of navigation equipment such as loss of GPS, and airframe damage.
Motor or Engine Failure, by Circumstance
Schedule 4 topic 6(a) asks about motor failure in five specific circumstances, and the right answer differs in each.
| Circumstance | Considerations |
|---|---|
| Immediately after launch | Low altitude, low energy, and the crew is close by. Prioritise getting the aircraft away from people even at the cost of the airframe. A quadcopter will not recover; steer it clear and let it down |
| On approach to landing | Similar low-energy case, but the landing area is usually already clear. Continue the descent to the cleared area if possible |
| In controlled airspace under ATC control | Advise ATC immediately. The aircraft's uncontrolled descent is a hazard to other traffic and ATC needs to know where it is going |
| In a built-up area | The highest-consequence case. Steer for the largest clear area available — a road is worse than a park, a park is worse than a river. Reduce power once clear of people to lower impact energy |
| In the vicinity of bystanders | Move the aircraft away from people first, using whatever roll and pitch authority remains. Avoid yaw inputs, which accelerate the departure |
Across all five the priority order is constant: people first, then property, then the aircraft.
Control Link Failure
AC 101-01 requires that the RPAS data link be continuously and automatically monitored in flight, with a real-time warning displayed to the remote pilot on failure. It also distinguishes intermittent loss of signal — and programmed periods of outage — from a genuine total loss, with the parameters for each pre-determined by the manufacturer and documented in the operations manual.
On a genuine lost control data link the pilot should:
- Advise air traffic services (where applicable) and any aircraft in the vicinity if the RPA is likely to pose a hazard.
- Execute the recovery procedures — which means letting the pre-configured failsafe run while positioning yourself and the crew appropriately.
The pilot cannot select a failsafe after the link is lost. This is the single most important point in the topic: failsafe behaviour must be configured before flight, because once the uplink is gone there is no way to send a command.
Remote Pilot Station Failure
A ground-station failure is the mirror image of a link failure — the aircraft is fine, but the pilot has lost the means to command it. Causes include a flat or overheated tablet, a controller battery failure, an app crash, or a damaged antenna lead.
Mitigations are all pre-flight: charged spare controller and display, the display shaded and with background apps disabled, a known procedure for restoring the app (many aircraft will hold position or fly the failsafe while the app restarts), and a second controller in dual-operator setups. If restoration is not achievable, the aircraft will run its link-loss failsafe — which is another reason to have set it correctly.
Fire, Bird Strike and Airframe Damage
Fire in flight or on the ground. Lithium fires are self-sustaining, burn extremely hot, and cannot be extinguished by smothering. Practical response:
- In flight — land immediately, well clear of people, vegetation and structures. Do not attempt to return to the launch point if that route crosses anything flammable or populated.
- On the ground — do not attempt to pick the aircraft up. Keep people back, call emergency services for anything beyond a small isolated fire, and let it burn out in a controlled area if it is safe to do so. A dry-powder or purpose-designed lithium extinguisher, or copious water to cool surrounding material, are the practical tools; water will not stop the cell reaction but does cool adjacent cells and surroundings.
- Carry a fire plan on any job in dry vegetation, and check total fire ban conditions before flying in summer.
Bird attack. Raptors treat multirotors as rivals or prey. Descend and move away from the territory; do not attempt to out-climb or out-manoeuvre the bird. After any strike, land and inspect — a damaged propeller or a bent motor shaft is a serviceability matter and a technical log entry.
Airframe damage in flight. Symptoms are new vibration, an asymmetric handling feel, or a change in acoustic signature. Land at the nearest safe site, gently, without aggressive attitude changes.
Fail-Safe Options
Schedule 4 topic 7 lists the fail-safe systems and emergency actions a remote pilot should know.
| Fail-safe | What it does | When it is the right choice |
|---|---|---|
| Return to home (RTH) | Climbs to a set altitude, flies to the recorded home point, lands or hovers | The default for open terrain with a clear return path. Requires GNSS lock, a recorded home point, sufficient battery, and an RTH altitude above every obstacle en route |
| Regain-link holding pattern | Holds or orbits while attempting to re-establish the link | Where a brief dropout is likely and the aircraft is over safe ground |
| Fly to a predetermined holding point | Proceeds to a pre-programmed safe location | Complex sites where "home" is not the safest destination |
| Emergency parachute deployment | Deploys a recovery chute to reduce descent energy | Larger aircraft, and operations near people where a ballistic descent is unacceptable |
| Immediate landing | Descends in place | Over water, over a populated return path, or where returning is riskier than landing now |
| Flight termination | Deliberately ends the flight, cutting power | Where continued flight presents a greater hazard than an immediate uncontrolled descent |
Flight termination deserves particular care. AC 101-01 notes that termination procedures for controlled-airspace operations should be developed by the ReOC holder, executed by the remote pilot, and agreed with the air navigation service provider before the operation, with the loss-of-link flight profile, termination capabilities and RPA performance under termination all briefed. It also states that RPA should not be operated within controlled airspace without an operable flight failsafe system, such as one providing automated recovery to a predetermined recovery area.
Choosing the failsafe for the site
The setting is a site decision, not a default. Over open farmland, RTH is usually right. Over water, immediate landing means losing the aircraft — so RTH is better. Over a crowd on the far side of the return path, RTH flies the aircraft over people and immediate landing is safer. Set it deliberately, as part of the pre-flight, for the site you are actually at.
Carbon Fibre Containment
Schedule 4 topic 7(g) names carbon fibre containment in the event of a crash, and it is a genuine and under-appreciated hazard.
Carbon fibre composite does not deform like metal — it shatters. A crashed airframe produces:
- Sharp splinters that penetrate skin easily and are difficult to see or remove.
- Fine airborne dust that is a respiratory and eye irritant.
- Electrically conductive fragments, which can short exposed electrical equipment.
The response at a crash site: wear gloves and, if the debris field is dusty or fragmented, eye protection and a mask. Keep bystanders back. Contain fragments rather than sweeping them into the air — dampen the area if practical and bag the debris. Collect all of it: fragments left in a paddock injure livestock, and fragments left on a worksite are a hazard to everyone who follows. Then photograph, preserve the logs, and start the reporting process.
A remote pilot loses the control data link over open farmland with a clear return path and a full battery. What determines what the aircraft does next?
An RPA suffers a motor failure while operating over water with the return path crossing a crowded beach. Which failsafe setting would have been most appropriate for that site?
What personal protective measures are appropriate when recovering a shattered carbon fibre airframe from a crash site?