Lessons Learned from our Aircraft First Flight Tests: Overcoming Challenges. Part 3

Problem 4: QLOITER Instability, Failsafe Misunderstanding, and Recovery Mistakes

During a flight test on January 18-th, 2025, our drone experienced a critical sequence of failures stemming from improper tuning, failsafe misconfiguration, and pilot reaction errors, resulting in an unintended disarm at 20m altitude. Here’s a detailed breakdown of the failure chain and key technical takeaways I was able to extract from this learning experience. So, what happened:

1. Initial Setup Issues

   • I had set some speed parameters (including vertical speed, Q_WP_SPEED_UP and DN) to very low values (~10 cm/s) after previous flights (which is due my slow reaction, lack of knowledge of what to do to save the plane in an emergency situation, as well as due to my misunderstanding of the parameters I tune).

   • I used QLOITER mode (altitude and position hold), which relies on well-tuned PID controllers for stable flight.

     
     

2. Untuned PIDs Led to Instability

   • I later learned that position and altitude PIDs can only be tuned properly after roll, pitch, and yaw accelerations/rates are correctly tuned—something that must be done in QSTABILIZE mode.

   • Since my drone was not properly tuned, immediately after takeoff it experienced vibrations, leading to poor altitude hold performance.

     
     

3. Fence Breach and Failsafe Activation

   • Due to the instability, the drone climbed unexpectedly to 20 meters, breaching the geofence.

   • This triggered failsafe mode, but I didn’t realize that exiting failsafe requires manually switching modes.

     
     

4. Loss of Control & Accidental Disarm

   • The drone stopped responding to my inputs (because it was in failsafe).

   • Thinking it was out of control, I panicked and accidentally disarmed it (I had intended to switch to QSTABILIZE).

   • The presence of people nearby added to the stress and urgency of the situation.

Root Cause Analysis

1. PID Tuning Hierarchy Neglected

• QLOITER (Position & Altitude Hold) requires well-tuned inner loops first.

  • Before tuning Q_P_POSXY_P, Q_P_POSZ_P, or VEL controllers (Q_WP_SPEED_UP and DN, Q_P__POSZ_P, Q_P_VELZ_P, Q_P_ACCZ_P PIDs ans filters) , Attitude (Roll/Pitch) PIDs (in QSTABILIZE) must be stable:

    • Rate PIDs and filters (Q_A_RAT_..., as well as Q_A_ANG...)

    • Acceleration Feedforward (Q_A_ACCEL_...)

• Symptoms of Poor Tuning:

  • High-frequency oscillations → degraded position and altitude hold

  • Slow response → altitude drift

  • In my case, vibrations led to altitude inaccuracies, causing an uncommanded climb.

2. Incorrect Speed Parameter Settings

• Alt hold Vertical speed (Q_WP_SPEED_UP and DN) set too low (10 cm/s)

  • Combined with mistuned VELZ and ACCZ PIDs, the drone struggled to correct altitude deviations.

3. Geofence (Fence) Misconfiguration

• FENCE_ALT_MAX was set without buffer margin.

  • If the drone oscillates near the fence limit, small overshoots can trigger failsafe.

  • Best Practice: Set FENCE_ALT_MAX at least 10-15% above operational ceiling to account for control error.

4. Failsafe Mode Misunderstanding

• FS_GCS_ENABLE = 1 (Enabled) → Entered failsafe due to fence breach.

• Critical Oversight:

  • Failsafe did not auto-clear.

  • Required manual mode switch (e.g., to QSTABILIZE) to regain control.

• Better Approach:

  • Test failsafe behavior in a controlled environment.

5. Pilot-Induced Error: Accidental Disarm

• Mitigation Strategies:

  • Well, I set flight modes to a switch on the other side from the arm/disarm switch on the remote control.

Lessons Learned

1. Follow the Tuning Hierarchy

1. Stabilize Mode (Manual Tuning or Autotune) → Tune rate and acc controllers.

2. Attitude Hold → Verify ACCZ and VELZ P/I/D for stable level flight.

3. Velocity & Position Control → Only after inner loops are solid.

   
   

2. Test Failsafe Behavior Proactively

• Know your failsafe triggers (FS_ parameters).*

• Test:

  • Radio loss (FS_THR_ENABLE)

  • Geofence breach (FS_GCS_ENABLE)

  • Low battery (FS_BATT_ENABLE)

    
    

3. Avoid Over-Constraining Flight Parameters

• PILOT_VELZ_MAX too low → Poor climb performance.

• FENCE_ALT_MAX too tight → Risk of false triggers.

  
  

4. Emergency Response Protocol

• First action in unexpected behavior: Switch to QSTABILIZE.

• If unresponsive: Check mode, failsafe status, and RC link.

• Never disarm mid-air unless absolutely necessary.

  
  

Conclusion

This failure was a systems-level issue:

poor tuning led to instability,

which triggered failsafe,

and lack of failsafe familiarity led to incorrect recovery.

For pilots, structured tuning, proactive failsafe testing, and disciplined emergency procedures are non-negotiable. Poor, poor little drone...

Our little drone deserved better from us. But in its sacrifice, it taught invaluable lessons about respecting the complexity of autonomous systems. The path forward is clear: rigorous pre-flight checks, systematic tuning protocols, and - most importantly - humble recognition that every flight test is an experiment with physical consequences.

In memory of a brave little drone that died so our future flights might live.