As innovations in urban air mobility (UAM) systems move us ever closer to turning science fiction into science fact, Dewi Madden, UAS Design and Integration Engineer at Frazer-Nash Consultancy, explores the challenges of certifying these crafts’ crashworthiness.

The future of the aviation industry continues to look positive, with many innovations in development, particularly in relation to smart cities, flying taxis and electric aircraft. Whilst these developments are exciting – many people are looking forward to the day they can grab a ride across the city in a flying taxi – the successful adoption of novel technologies is dependent on both assuring their safety and minimising operational costs. Safety is a key driver, but the challenge is to deliver it cost-effectively: to certify a safe aircraft that is affordable for all stakeholders.

Crashworthiness is a core safety element

One of the core elements of safety is crashworthiness: the degree to which a structure will protect its occupants during an impact. Proving crashworthiness is a particular challenge for urban air mobility (UAM) vehicles for several reasons – in part because its novel nature doesn’t ‘fit’ existing certification standards. Unlike UAM, conventional aircraft have an extensive track record of achieving safety certification, having gone through thorough and robust certification processes which demonstrate and document their safety prior to operational use, ensuring they meet both national and international aviation standards. Aviation is one of the safest forms of travel, with only a small number of accidents – the majority of incidents occurring during take-off or landing, with take-offs resulting in the most severe of cases. But as many as 50 per cent of fatalities are impact related. So, how can we minimise the risk of impact-related injuries in UAM? What makes an aircraft crashworthy?

Crashworthiness is a fundamental part of the design and certification process for original equipment manufacturers (OEMs), and is defined as an aircraft’s ability to protect its occupants during an impact. A crashworthy airframe is one that:

· provides a protective cabin surrounding passengers

· enables a secure tie down of the occupants, through the use of seats and restraint systems

· reduces post-crash fire hazards and provides for emergency egress, and

· mitigates head strike potential, by using pre-tensioned restraint systems or cockpit air bags.

Much of the philosophy of crashworthiness has not changed since the 1980s, and older prescriptive methods are still being utilised for European Union Aviation Safety Agency (EASA) certification specifications, CS23 and CS27. But these are the closest utilisable certification specifications available for most in-development UAM vehicles, whilst new methods are under consideration. As a new and emerging technology, the approach used to certify and demonstrate UAM safety is one that industry is exploring extensively, but there are many layers of complexity to consider.

Certification will consider phases between horizontal and vertical flight

Identifying the appropriate certification framework will require us to take a systems engineering approach to defining the aircraft configuration, including how it operates and flies; and to understanding how it crashes, based upon how it is likely to lose lift/thrust. For vertical take-off and landing (VTOL) aircraft, we need to consider the transient phases between horizontal and vertical flight configurations. For vertical flight (hover), upon loss of thrust/lift, the aircraft drop is likely to be similar to that of a helicopter. As a result, the crashworthiness approach to be adopted should be consistent with CS27 – Small Helicopters. In the forward flight (fixed-wing) configuration however, a loss of power will result in the aircraft gliding to a ditching location. A lack of fixed-design practice for UAM craft makes identifying the certification basis even more difficult. As a result, EASA considers that the current airworthiness standards for fixed-wing and helicopters are not adequate to prescribe for VTOL aircraft.

However, in recent years, EASA has developed a special condition certification document, SC-VTOL-01, which, in the absence of certification specifications for VTOL aircraft, has a complete set of dedicated technical specifications. These address the unique characteristics of VTOL aircraft and prescribe airworthiness standards for the issuance of the type certification. This special condition has been established in the spirit of recent CS-23 amendments, which are considered state of the art in terms of safety objective based provisions for VTOL aircraft.

Moving forward in incremental steps

In the case of crashworthiness, an acceptable means of compliance will need to be developed, to aid OEMs in how best to assure a crashworthy airframe for their UAM craft. Traditionally, certification has always moved ahead through small incremental steps, involving expensive physical and flight-testing, requiring a large quantity of project spend, and often relying on comparison with previous data for similar types of airframe. Impact testing, ranging from ground to air, also needs labour and machinery. Now, however, innovative new methods have been developed that can test, simulate and verify architecture models before hardware testing and selection is conducted. At Frazer-Nash, we use model in the loop (MIL) and hardware in the loop (HIL) tools, which help our clients to ensure their architectures will meet, and pass, the necessary certification requirements before they undertake expensive physical and flight testing.

MIL uses a simulated model that captures the most important features of a system, and verifies the expected outcome as per a specified requirement. Once the ‘logical’ system behaviour has been verified, HIL simulation testing may be used to simulate sub-systems. HIL adds hardware capability to the simulation, allowing it to sample real inputs and drive real outputs. This provides a software-configurable simulated plant, interchangeable with a real sub-system in advance of hardware being available for development. The potential for automation and monitoring is particularly useful in providing confidence measures in high integrity safety functions. Overall, these methods, collectively known as X in the Loop (XIL) reduce overall risk to the crashworthiness certification process, and help avoid costly reworking of architectures at later stages of the design process.

Through MIL and HIL testing, we can support our aviation and aerospace industry clients to design, optimise and manage their complex systems – including both novel and existing technologies – whilst simultaneously providing advice that helps them meet the national and international certification standards for crashworthiness and air safety.

Modelling architectures in the virtual domain

By modelling and verifying their architectures in the virtual domain, before physical testing takes place, developers and manufacturers can continue to assure the safety of their UAM craft, whilst reducing their costs. Excited as we may be about taking a flying taxi to our destination, both operators and passengers will need to have peace of mind about their autonomous craft’s crashworthiness before they flag one down.
Subscribe to the FINN weekly newsletter