9 ms·

This could have been very ugly: the 10-kg drone suffered an uncontrolled crash “in a wooded area of Zurich’s university quarter only 50 yards away from a gro

This could have been very ugly: the 10-kg drone suffered an uncontrolled crash “in a wooded area of Zurich’s university quarter only 50 yards away from a group of playing kindergarten children.” One of the things that few people are aware about is quadrotor MTBF is very low relative to other common vehicles. For many drones, the expectation for failure dramatically increases just after 100-200 hours of operation[1]. Figuring out points of failures, building systematic fault trees and increasing MTBF by order of magnitude or two would be big part of the drone delivery projects. [1] https://catsr.vse.gmu.edu/SYST490/490_2014_SPDAV/DST-NSPDAV_USMA.pdf https://catsr.vse.gmu.edu/SYST490/490_2014_SPDAV/DST-NSPDAV_...

jcims 7y ago
Quadrotor form factor seems unusual for something that clearly has reliability/safety as a high priority.
- asteli 7y ago
  I think multirotors have the capability to be made quite safe. The only moving parts are the rotors, and with higher rotor counts, graceful degradation of flight performance is possible in the case of a rotor-out. Problem is that most of the components (batteries, motor controllers, flight controllers) are built by and for hobbyists. Motor burns a winding? ESC spontaneously lets the smoke out? Whatever, they're $15 bucks each. The field of "commercial grade cargo multirotor" is still in its infancy. The balance of safety and cost for the components hasn't been struck in the market. You either deal with random chinese components and control algorithms written by intrepid RC airplane nuts, buy very expensive industrial/aerospace grade components, or roll your own solution.
  - bigiain 7y ago
    Hexes and octocopters are "safer" than quads - since they can (with appropriate controllers) cope with any one motor/controller out, and some combinations of multiple motors out. (Anyone flying expensive DSLR cameras uses these for that reason.) There are some quad copter controllers that try to deal with single motor failures, but they're mostly experimental (at least on the hobby end to the space) since they need to be able to reverse a motor, which most motor controllers used in these applications are not build to do.
    - asteli 7y ago
      I recall a quadcopter control mode that spins the entire craft quite rapidly, exchanging yaw control for altitude control. Found a vid: https://m.youtube.com/watch?v=bsHryqnvyYA https://m.youtube.com/watch?v=bsHryqnvyYA
      - bigiain 7y ago
        Without even clicking that I knew it was gonna be ETH Zurich... They do pure magic. Pretty much nobody _else's_ quadcopters can survive a motor failure... (But it'll come, presumably. Amazing software is cheaper than redundant hardware, after all...)
        toxik 7y ago
        Not to detract from how cool this work is but the preconditions for this to work are quite far-reaching. It is based on bridging the reality gap by having that gap approach zero - by removing error sources from the real world rather than model and account for them. Same goes for other ASL work.
  - mc32 7y ago
    I don’t expect a service delivery company to use hobbyist components. That’d be s recipe for disaster. One would think they’d put something like this though its paces before testing it out in public. I’d expect they buy aerospace grade components where possible and build their own to spec where needed.
    - bigiain 7y ago
      I fully expect most "service delivery companys" to buy their drones from the same Alibaba vendors that share bike ad scooter companies buy from... Losing them, crashing them, having people steal them or throw them in a lake - those are things to include in your VC funded "operating costs" and to mitigate/offload the risks in your TOS... (Small print: "The delivery customer shall be wholly and solely responsible for any damages and costs incurred by their delivery and any company equipment used in the completion of the customer's delivery, including but not limited to the drone crashing into a playground full of children." Just like Tesla's abrogation of responsibility when their "autopilot" software is driving the car they sold you...)
      - mc32 7y ago
        Not sure how things work in Switzerland, but at least in the US I think these aircraft would be under the purview of the FAA who likely would require some rigor. Likely something similar in CH.
        pfundstein 7y ago
        These aircraft are in fact manufactured by a US company (Matternet).
        Leherenn 7y ago
        The market is too young for this kind of process. Regulators around the world are smart enough to realise you can't expect drones to follow classic aeronautical design and safety processes right now, you would just stop dead the whole field. So while they gently introduce such rules (mostly centered around see and avoid for now, also identification), the main way they use to ensure safety is restrict where and who can fly them. You know they can't be trusted, so you don't fly them above sensitive areas. As processes mature, reliability increase and trust is gained, you will see drones expand the airspace in which they are allowed. It's already happening for BVLOS (beyond visual line of sight) flights which requires a waiver from the FAA in the US (with paperwork such as risk assessment, collision tests on mannequins and so on), as well as specific equipment/processes.
- bayesian_horse 7y ago
  In a sense, most other aerial vehicle types are worse. Helicopters, with only one main rotor are incredibly complex machines requiring constant maintenance. The rotor blades are articulated to provide flight control. Quadcopters are a ton simpler because their rotors are "just" rotors, and flight control is achieved through differential thrust, not angling the blades. On the other hand, helicopters often seem to deal with engine failure better than quadcopters or even fixed wing aircraft. Fixed wing drones have the big problem that they need to go fast to stay in the air. Which requires a lot more motion planning.
  - jacquesm 7y ago
    Your typical helicopter is made to entirely different standards than your typical drone.
    - bayesian_horse 7y ago
      Yes, of course. But toy helicopters have been around for a lot longer than quad-copters have been popular. And I've not seen a lot of people using single-rotor RC helicopters for filming and delivery (I'm sure there are some ...). My point is that multicopters are a lot simpler mechanically. No articulation, no transmission, just propellers on an electrical motor, controlled by pure electronics with no mechanical components in the loop except the drive coils. Arguably multicopters are easier to control automatically (with modern electronics), though that wouldn't be THAT big a factor today, I guess. Also electrical engines can deal a lot better with variable load and RPM. Multicopters with combustion engines (driving the rotors directly, not through a generator) seem to be quite uncommon. Still, if multicopters are supposed to be routinely used in the presence of people, they need similar standards of maintenance and failure control as would bigger aircraft, be they manned or unmanned...
  - jcims 7y ago
    You're not wrong, but even model helicopters can autorotate: https://www.youtube.com/watch?v=bxQ5kwqiPN4&t=135 https://www.youtube.com/watch?v=bxQ5kwqiPN4&t=135
crazygringo 7y ago
Wow, that's shockingly low. The paper doesn't describe why -- do you have any idea what part(s) are failing so quickly? The rotors, the motors, the battery? For commercial delivery service, it seems quite clear that we'll need either 1) "enterprise-grade" drones (like difference between consumer and enterprise SSD's), 2) reliable sensors to detect imminent failure before a flight, and/or 3) easy replacement of failing parts. I mean, for many hobbyists 100-200 hrs seems like a reasonable cost/benefit tradeoff... but not even close for commercial delivery services.
- sytelus 7y ago
  Commercial drones can push to 10^3 hrs but that's still far cry from aviation standards of 10^5 hrs. According to this nav system and fuel+actuators are two big failing components: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6165073/pdf/sensors-18-03171.pdf https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6165073/pdf/sen...
  - crazygringo 7y ago
    That article seems to be referring to winged UAV drones (e.g. Predator) not the quadcopter-type drones used for deliveries.
    - bitxbitxbitcoin 7y ago
      Good catch. It is possible for quadcopter-type drones to come with four extra motors that sit opposite of the traditional four motors and props and face down with slightly different sized props and rotating the opposite way. In the case of failure of a prop in this configuration (the most common failure in my own experience with quads and octos), it is possible to program the n-copter to automatically change to flying in 7 prop mode or 6 prop mode or 5 prop mode, and so on and so forth as a redundancy feature. This could help with a not insignificant amount of crashes but obviously comes with increased costs.
  - TylerE 7y ago
    Airplanes get regular (and quite extensive) maintenance though.
walrus01 7y ago
Arducopter flight controller user here: There is a reason why pro grade filming setups carrying $40,000 to $150,000 cameras are all coaxial octocopters or flat octocopters. Even a hexacopter cannot 100% reliably recover from a single motor failure. Personal opinion, any craft that is over 3 to 4kg and spends time over people needs to be an octo.
- 4ntonius8lock 7y ago
  Thanks for contributing toward progress and not toward fear/restriction.
  - walrus01 7y ago
    There's valid technical reasons for having a coaxial octo within a total craft body+arm size radius of 1.5 meters as well. You can generate more thrust and carry more payload for the same disc loading area. Four large motors and four 28" CF props produce less thrust than four arms, each arm with two motors stacked, and eight props. Octos are not a conservative, redundant, fail tolerant design decision just for the sake of protecting expensive gear. Many of them still have 1+0 non redundant power systems.
- sytelus 7y ago
  I've held the opinion that we shouldn't be using multirotors but VTOLs when it comes to aerial deliveries. The multirotors are extremely energy inefficient, have very low MTBF, short-range and very low payload cap. On the other hand designing safe reliable VTOL is hard but solvable problem when thrown enough resources because you can draw a lot from existing aviation tech. However, Amazon has gone through quadrotors to VTOL and then they switched back to multirotor again, surprisingly. Unfortunately, most of the delivery vehicles are being built by relatively small limited resources startup-like groups. While multirotors are very easy to build, they have an enormous number of problems. I think if there was a well-funded group of 500 or so engineers working over ~5 years, there is a decent chance we can have safe reliable commercial-grade VTOL for autonomous point-to-point deliveries that can be adopted as standard. Unfortunately, this is a big capex project.
dmix 7y ago
Can’t this be mitigated with parachutes and other safety measures when certain descent speeds or other failures are detected? It could also broadcast an alarm during any descent to warn people.
- sytelus 7y ago
  Perhaps you didn't read the article but that's exactly what they had. The drone would flash light, deploy chute and make big whistle sound if it detected a crash. The problem is that it still does count as a crash. In the second crash chute system, itself failed.
kuzehanka 7y ago
That figure doesn't sound convincing, and the linked paper seems to just make it up without any explanation or justification. The limiting factor of a quad's ability to fly is the motor and unexpected failure of the battery. Higher end brushless motors have a life expectancy in the tens of thousands of hours. Battery failure is already mitigated in consumer drones by having independent packs each of which provides enough current to continue operation. Quads do occasionally just fall out of the sky because a defective bearing ceases or a defective cell sags, but it's very rare. Most of the time they crash due to operator error.
- neals 7y ago
  That's some interesting statistics you claim, would love to see the source on that.
  - dsfyu404ed 7y ago
    Considering that mechanical failure is basically a rounding error compared to human error when it comes to causing crashes of every other vehicle and piece of machinery humans operate I'm inclined to believe the same is true for drones.
    - empath75 7y ago
      People have a much lower tolerance for mechanical failure in vehicles that carry people. Anything that crashed at a higher rate from mechanical failure than human error would not be produced for very long.
- davinic 7y ago
  You've left out the critical component between the battery and the bldc motors: the motor controller. These deal with the most difficult thermal issues and fail frequently. On a quad there a 4 motor controllers on board, and only one needs to fail, greatly increasing the odds of overall failure.
  - 7y ago
Shivetya 7y ago
My only question is, why are there no blade guards in place? Not to protect the blades but to protect anyone near this drone?
- joncrane 7y ago
  I imagine that it reduces efficiency for the fastest part of the blades to pass very close to a stationary ring, as opposed to letting the turbulence tumble off the ends of the blades unimpeded.

jcims 7y ago

Quadrotor form factor seems unusual for something that clearly has reliability/safety as a high priority.

asteli 7y ago
I think multirotors have the capability to be made quite safe. The only moving parts are the rotors, and with higher rotor counts, graceful degradation of flight performance is possible in the case of a rotor-out. Problem is that most of the components (batteries, motor controllers, flight controllers) are built by and for hobbyists. Motor burns a winding? ESC spontaneously lets the smoke out? Whatever, they're $15 bucks each. The field of "commercial grade cargo multirotor" is still in its infancy. The balance of safety and cost for the components hasn't been struck in the market. You either deal with random chinese components and control algorithms written by intrepid RC airplane nuts, buy very expensive industrial/aerospace grade components, or roll your own solution.
- bigiain 7y ago
  Hexes and octocopters are "safer" than quads - since they can (with appropriate controllers) cope with any one motor/controller out, and some combinations of multiple motors out. (Anyone flying expensive DSLR cameras uses these for that reason.) There are some quad copter controllers that try to deal with single motor failures, but they're mostly experimental (at least on the hobby end to the space) since they need to be able to reverse a motor, which most motor controllers used in these applications are not build to do.
  - asteli 7y ago
    I recall a quadcopter control mode that spins the entire craft quite rapidly, exchanging yaw control for altitude control. Found a vid: https://m.youtube.com/watch?v=bsHryqnvyYA https://m.youtube.com/watch?v=bsHryqnvyYA
    - bigiain 7y ago
      Without even clicking that I knew it was gonna be ETH Zurich... They do pure magic. Pretty much nobody _else's_ quadcopters can survive a motor failure... (But it'll come, presumably. Amazing software is cheaper than redundant hardware, after all...)
      - toxik 7y ago
        Not to detract from how cool this work is but the preconditions for this to work are quite far-reaching. It is based on bridging the reality gap by having that gap approach zero - by removing error sources from the real world rather than model and account for them. Same goes for other ASL work.
- mc32 7y ago
  I don’t expect a service delivery company to use hobbyist components. That’d be s recipe for disaster. One would think they’d put something like this though its paces before testing it out in public. I’d expect they buy aerospace grade components where possible and build their own to spec where needed.
  - bigiain 7y ago
    I fully expect most "service delivery companys" to buy their drones from the same Alibaba vendors that share bike ad scooter companies buy from... Losing them, crashing them, having people steal them or throw them in a lake - those are things to include in your VC funded "operating costs" and to mitigate/offload the risks in your TOS... (Small print: "The delivery customer shall be wholly and solely responsible for any damages and costs incurred by their delivery and any company equipment used in the completion of the customer's delivery, including but not limited to the drone crashing into a playground full of children." Just like Tesla's abrogation of responsibility when their "autopilot" software is driving the car they sold you...)
    - mc32 7y ago
      Not sure how things work in Switzerland, but at least in the US I think these aircraft would be under the purview of the FAA who likely would require some rigor. Likely something similar in CH.
      - pfundstein 7y ago
        These aircraft are in fact manufactured by a US company (Matternet).
      - Leherenn 7y ago
        The market is too young for this kind of process. Regulators around the world are smart enough to realise you can't expect drones to follow classic aeronautical design and safety processes right now, you would just stop dead the whole field. So while they gently introduce such rules (mostly centered around see and avoid for now, also identification), the main way they use to ensure safety is restrict where and who can fly them. You know they can't be trusted, so you don't fly them above sensitive areas. As processes mature, reliability increase and trust is gained, you will see drones expand the airspace in which they are allowed. It's already happening for BVLOS (beyond visual line of sight) flights which requires a waiver from the FAA in the US (with paperwork such as risk assessment, collision tests on mannequins and so on), as well as specific equipment/processes.
bayesian_horse 7y ago
In a sense, most other aerial vehicle types are worse. Helicopters, with only one main rotor are incredibly complex machines requiring constant maintenance. The rotor blades are articulated to provide flight control. Quadcopters are a ton simpler because their rotors are "just" rotors, and flight control is achieved through differential thrust, not angling the blades. On the other hand, helicopters often seem to deal with engine failure better than quadcopters or even fixed wing aircraft. Fixed wing drones have the big problem that they need to go fast to stay in the air. Which requires a lot more motion planning.
- jacquesm 7y ago
  Your typical helicopter is made to entirely different standards than your typical drone.
  - bayesian_horse 7y ago
    Yes, of course. But toy helicopters have been around for a lot longer than quad-copters have been popular. And I've not seen a lot of people using single-rotor RC helicopters for filming and delivery (I'm sure there are some ...). My point is that multicopters are a lot simpler mechanically. No articulation, no transmission, just propellers on an electrical motor, controlled by pure electronics with no mechanical components in the loop except the drive coils. Arguably multicopters are easier to control automatically (with modern electronics), though that wouldn't be THAT big a factor today, I guess. Also electrical engines can deal a lot better with variable load and RPM. Multicopters with combustion engines (driving the rotors directly, not through a generator) seem to be quite uncommon. Still, if multicopters are supposed to be routinely used in the presence of people, they need similar standards of maintenance and failure control as would bigger aircraft, be they manned or unmanned...
- jcims 7y ago
  You're not wrong, but even model helicopters can autorotate: https://www.youtube.com/watch?v=bxQ5kwqiPN4&t=135 https://www.youtube.com/watch?v=bxQ5kwqiPN4&t=135

crazygringo 7y ago

Wow, that's shockingly low. The paper doesn't describe why -- do you have any idea what part(s) are failing so quickly? The rotors, the motors, the battery? For commercial delivery service, it seems quite clear that we'll need either 1) "enterprise-grade" drones (like difference between consumer and enterprise SSD's), 2) reliable sensors to detect imminent failure before a flight, and/or 3) easy replacement of failing parts. I mean, for many hobbyists 100-200 hrs seems like a reasonable cost/benefit tradeoff... but not even close for commercial delivery services.

sytelus 7y ago
Commercial drones can push to 10^3 hrs but that's still far cry from aviation standards of 10^5 hrs. According to this nav system and fuel+actuators are two big failing components: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6165073/pdf/sensors-18-03171.pdf https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6165073/pdf/sen...
- crazygringo 7y ago
  That article seems to be referring to winged UAV drones (e.g. Predator) not the quadcopter-type drones used for deliveries.
  - bitxbitxbitcoin 7y ago
    Good catch. It is possible for quadcopter-type drones to come with four extra motors that sit opposite of the traditional four motors and props and face down with slightly different sized props and rotating the opposite way. In the case of failure of a prop in this configuration (the most common failure in my own experience with quads and octos), it is possible to program the n-copter to automatically change to flying in 7 prop mode or 6 prop mode or 5 prop mode, and so on and so forth as a redundancy feature. This could help with a not insignificant amount of crashes but obviously comes with increased costs.
- TylerE 7y ago
  Airplanes get regular (and quite extensive) maintenance though.

walrus01 7y ago

Arducopter flight controller user here: There is a reason why pro grade filming setups carrying $40,000 to $150,000 cameras are all coaxial octocopters or flat octocopters. Even a hexacopter cannot 100% reliably recover from a single motor failure. Personal opinion, any craft that is over 3 to 4kg and spends time over people needs to be an octo.

4ntonius8lock 7y ago
Thanks for contributing toward progress and not toward fear/restriction.
- walrus01 7y ago
  There's valid technical reasons for having a coaxial octo within a total craft body+arm size radius of 1.5 meters as well. You can generate more thrust and carry more payload for the same disc loading area. Four large motors and four 28" CF props produce less thrust than four arms, each arm with two motors stacked, and eight props. Octos are not a conservative, redundant, fail tolerant design decision just for the sake of protecting expensive gear. Many of them still have 1+0 non redundant power systems.
sytelus 7y ago
I've held the opinion that we shouldn't be using multirotors but VTOLs when it comes to aerial deliveries. The multirotors are extremely energy inefficient, have very low MTBF, short-range and very low payload cap. On the other hand designing safe reliable VTOL is hard but solvable problem when thrown enough resources because you can draw a lot from existing aviation tech. However, Amazon has gone through quadrotors to VTOL and then they switched back to multirotor again, surprisingly. Unfortunately, most of the delivery vehicles are being built by relatively small limited resources startup-like groups. While multirotors are very easy to build, they have an enormous number of problems. I think if there was a well-funded group of 500 or so engineers working over ~5 years, there is a decent chance we can have safe reliable commercial-grade VTOL for autonomous point-to-point deliveries that can be adopted as standard. Unfortunately, this is a big capex project.

dmix 7y ago

Can’t this be mitigated with parachutes and other safety measures when certain descent speeds or other failures are detected? It could also broadcast an alarm during any descent to warn people.

sytelus 7y ago
Perhaps you didn't read the article but that's exactly what they had. The drone would flash light, deploy chute and make big whistle sound if it detected a crash. The problem is that it still does count as a crash. In the second crash chute system, itself failed.

kuzehanka 7y ago

That figure doesn't sound convincing, and the linked paper seems to just make it up without any explanation or justification. The limiting factor of a quad's ability to fly is the motor and unexpected failure of the battery. Higher end brushless motors have a life expectancy in the tens of thousands of hours. Battery failure is already mitigated in consumer drones by having independent packs each of which provides enough current to continue operation. Quads do occasionally just fall out of the sky because a defective bearing ceases or a defective cell sags, but it's very rare. Most of the time they crash due to operator error.

neals 7y ago
That's some interesting statistics you claim, would love to see the source on that.
- dsfyu404ed 7y ago
  Considering that mechanical failure is basically a rounding error compared to human error when it comes to causing crashes of every other vehicle and piece of machinery humans operate I'm inclined to believe the same is true for drones.
  - empath75 7y ago
    People have a much lower tolerance for mechanical failure in vehicles that carry people. Anything that crashed at a higher rate from mechanical failure than human error would not be produced for very long.
davinic 7y ago
You've left out the critical component between the battery and the bldc motors: the motor controller. These deal with the most difficult thermal issues and fail frequently. On a quad there a 4 motor controllers on board, and only one needs to fail, greatly increasing the odds of overall failure.
- 7y ago

Shivetya 7y ago

My only question is, why are there no blade guards in place? Not to protect the blades but to protect anyone near this drone?

joncrane 7y ago
I imagine that it reduces efficiency for the fastest part of the blades to pass very close to a stationary ring, as opposed to letting the turbulence tumble off the ends of the blades unimpeded.