I have a buddy who is into the quad copters and associated autopilots *big time* (like commercially with tens of thousands of dollars invested). You can spend thousands on an autopilot for those things and have it still fly away, *easily*. It happens to those guys all the time. They let it get out until its a dot, then hit the "home switch," and away it goes, never to be seen again.

My students and I build UAV autopilots for a living, and I have seen *every single* commercial one we've tested crash an airplane at one time or another, and I'm talking about ones that cost from $7,000 to upwards of $20,000. Our own autopilots that we build are fairly reliable, but only to a point.

We had a situation a couple of years ago, where we were using our autopilot to fly a set pattern while we tested a digital video link. The aircraft got to a waypoint about a mile away (13' ws aircraft), and instead of turning around, it kept going. I let it go for about 5 seconds and then took it over and brought it back - right at the edge of visual range. We tried it again and the same thing happened. We saved the flight path and brought the system back and put into the hardware-in-the-loop simulation. Sure enough (luckily) it happened there too. After a day or two of debugging, we traced the problem to a unique combination of longitude inputs that caused a floating point underflow in the FPU. We, of course, fixed it and never had it happen again - in that specific scenario.

A couple of days later, one of my students told me that they went back to the old version of the software and left it running after the error occured to see what would happen. Eventually, the (simulated) aircraft did turn around and came back - after traveling some 400 miles to a point over the middle of Ohio...

Software bugs like that are a big problem in low-end autopilots like we can afford and they are *very* hard to test out - so much so that I'd never put an autopilot in compete control of a model that i couldn't afford to loose.

Bob