For 90 minutes, the inaugural flight of Facebook's drone Aquila had been a success. The remote-operated dolly that carried Aquila down the runway had generated sufficient speed to launch it. The drone rose to its intended test altitude of 2,150 feet, and flew steadily over the Yuma Proving Ground in southwestern Arizona. With every minute it spent in the air, Aquila generated reams of new data for Facebook engineers to analyze. Elated, they decided to keep it aloft three times longer than planned. 

But as the drone came in for a landing, something went wrong. An unexpectedly powerful gust of wind, coupled with faulty software, led to a 20-foot section of Aquila's wing shearing off as it approached the ground. A report on the incident issued today by the National Transportation Safety Board describes for the first time a structural failure that Facebook mentioned only in passing at the time of the flight, which it described as a “big milestone” and a success. The drone was flying too fast as it approached the ground, the NTSB concluded, because Aquila’s design generated too little drag to slow it down after the gust of wind knocked it off course.

The NTSB did not respond to a request for comment about the report.

Facebook says it always expected the plane to be damaged upon landing, although not in this particular way. (The company assumed the primary damage would be to the drone’s skids and propellers at the points where they touched the ground.) And the structural failure revealed a critical error in Aquila's autopilot software that has since been corrected, the company says.

But the NTSB report, along with interviews with Facebook’s team, illustrate the significant engineering and design challenges the company faces as it attempts to build a high-altitude, solar-powered plane that can deliver internet access to hundreds of millions of people. Aquila is a linchpin of internet.org, Facebook’s effort to bring the 4.5 billion people without internet access online.

The initial test flight of Aquila began at shortly after 6AM on June 28th. Facebook CEO Mark Zuckerberg had risen at 2AM so he could fly out to the proving ground and see Aquila’s maiden voyage in person. When the plane took off successfully, the team was elated: experimental aircraft often fail. Google’s own experimental internet-delivery drone had crashed shortly after takeoff the previous year when one of its wings failed.

Aquila was intended to fly for 30 minutes. But after that time had passed, Facebook’s engineers made a judgement call: they would keep the plane up longer, so that they could collect more data. But the longer Aquila flew, the more the Yuma desert heated up. It was a scorching June day, and would eventually reach a temperature of 114 degrees. 

According to the NTSB, a strong, hot gust of wind struck Aquila from below five seconds before landing. Facebook had modeled for one of these atmospheric disturbances, and simulations indicated that Aquila could withstand a gust of up to 7 knots. But this gust measured between 12 and 18 knots, according to the NTSB.

As a result of the gust, Aquila was knocked off its flight path. The drone's software was programmed to return the drone to its intended course. It lowered Aquila’s nose and deflected upward the drone’s elevons — the surfaces that control the pitch and roll of the aircraft. But in doing so, Aquila began flying faster than the 25 mph speed it is designed for. When it was about 20 feet above the ground, the high speed and position of the elevon caused the right wing to deform and then snap off. (Incidentally, Google’s test drone failed for similar reasons.)

When I interviewed Facebook executives about Aquila's test flight this summer, Facebook did not disclose the wing break. The company posted a celebratory account to its blog. Only in a separate post to its engineering blog, in the eighth paragraph, did the company make a passing reference to "a structural failure." 

Facebook says this is because the NTSB does not permit them to disclose what happened while an investigation is in progress.

"We feel like we shared 99.9 percent of the details, from a time perspective," said Yael Maguire, who oversees software development for Aquila, in an interview at Facebook’s Menlo Park campus this week. Only in the last few seconds did the structure fail, he said. "From our perspective this was actually fantastic, because we uncovered a bug pretty early on in our program," Maguire said.

Facebook executives also sought to play down the importance of how the drone lands, because Aquila is still a prototype and was not expected to fly again. “Landing, while mandatory, is not something we’re optimizing for,” Maguire said. “Ultimately, if you think about where we’re trying to go with this, we want this to be an aircraft that has a 90-day mission, where almost none of that time is spent focused on landing. We have to focus on flying at altitude and things like that. So that’s what we’re optimizing for.”

I asked Jay Parikh, Facebook’s global head of engineering and infrastructure, whether the structural failure could be traced to Facebook’s haste in getting Aquila in the air. The company conceived, designed, and tested its first prototype within 26 months — a point of pride for its CEO, Mark Zuckerberg, when I interviewed him this summer.

“You can always Monday morning quarterback these things, but I would not have changed anything about the program,” Parikh said. “Everything we do from an engineering perspective is to maximize learning, and to maximize that learning in the shortest amount of time possible. We don’t want to take shortcuts. We don’t want to be reckless. We don’t want to do the wrong thing. And in this case we had taken extreme precautions ... to make sure there was zero risk of people or property damage.”

Facebook says it will make two practical adjustments to the next versions of Aquila, which are now in production. The next-generation model will add a spoiler or airbrake for added drag to slow the plane down. And the autopilot is being rewritten to prioritize low speed over staying on the glide path.

Aquila’s next flight will come soon, the company said, though it declined to specify when. And though Facebook says it is not “optimizing” for them now, Parikh told me that in the production version of Aquila, “safe landings are non-negotiable.”