Content uploaded by Ellis Thompson
Author content
All content in this area was uploaded by Ellis Thompson on Jun 21, 2022
Content may be subject to copyright.
A Survey of eVTOL Aircraft and AAM Operation Hazards
Ellis Thompson∗, Abenezer Taye†, Wei Guo‡and Peng Wei §
George Washington University, Washington, D.C. 20052, USA
Marcos Quinones-Grueiro¶, Ibrahim Ahmed‖and Gautam Biswas∗∗
Vanderbilt University, Nashville, TN, 37212
Jesse Quattrociocchi††, Steven Carr‡‡ and Ufuk Topcu§§
University of Texas at Austin, Austin, TX 78712, USA
James Jones¶¶ and Marc Brittain∗∗∗
MIT Lincoln Laboratory, Lexington, MA 02421, USA
In this research, we have identified and surveyed three categories of hazards for advanced
air mobility (AAM): (i) adverse weather with a special focus on winds, (ii) eVTOL vehicle
and component level faults/degradation, and (iii) AAM corridor incursion by non-cooperative
aircraft. While these categories of hazards may be independent of one another as first order
effects, their collective impact on safety is also an important factor. This paper is the first
publication from the NASA funded project named “Demonstration of the In-Time Learning-
Based Safety Management for Scalable Heterogeneous AAM Operations”. Our research team
proposes the design, development and demonstration of an in-time learning-based aviation
safety management system (ILASMS) for scalable heterogeneous AAM operations. We propose
three core functions (F1-mission level, F2-vehicle level, and F3-airspace level) in the ILASMS,
to address these hazards. This survey paper will identify possible hazards that will define the
function groups design requirements and specifications. We will perform system validation and
scenario demonstrations with use case simulations and sub-scale flight tests.
I. Introduction
Advancements
in electric vertical take-off and landing (eVTOL) vehicles and unmanned aerial systems (UAS)
technology have begun to shape the future of urban mobility. Collectively, these new highly autonomous air systems,
will be capable of transporting passengers and cargo around urban environments, defining the urban air mobility (UAM)
concept. Advanced air mobility (AAM) builds on this UAM concept by introducing cases that are not specific to an
urban environment, bringing this plethora of air services to areas under-served or not served by air transportation
systems, extending UAM beyond the urban environment. These vehicles will be initially piloted, however, it is expected
that flights will operate at increasing levels of autonomy as the airspace systems and certification standards evolve.
With the introduction of highly autonomous air vehicles, operational safety will be paramount. Air Navigation
Service Providers have begun examining potential barriers to operational safety to meet this need. The Federal Aviation
Administration (FAA) [
1
] identified key components of off-nominal UAM operations, derived from nonconformance to
shared operational intent, and which are concerned with: performance issues, high winds and navigation degradation.
The SESAR joint undertaking [
2
] has also recognized similar hazard areas surrounding component level faults and
∗Graduate Research Assistant, Computer Science Department
†Graduate Research Assistant, Mechanical and Aerospace Engineering Department
‡Graduate Research Assistant, Computer Science Department
§Assistant Professor, Mechanical and Aerospace Engineering Department, AIAA Senior Member
¶Research Scientist, Institute for Software Integrated Systems
‖Graduate Research Assistant, Electrical and Computer Engineering Department
∗∗Professor, Computer Science Department
††Research Scientist, Department of Aerospace Engineering and Engineering Mechanics
‡‡Graduate Research Assistant, Department of Aerospace Engineering and Engineering Mechanics, AIAA Student Member
§§Associate Professor, Department of Aerospace Engineering and Engineering Mechanics, AIAA Senior Member
¶¶Technical Staff, Air Traffic Control Systems Group, AIAA Senior Member
∗∗∗Technical Staff, Surveillance Systems Group, AIAA Senior Member
1
degradation and hazardous winds which lead to nonconformance or non-cooperation. Aweiss et.al [
3
] identified that
non-conformance arises from ineffective planning and execution. Identifying potential hazards prior to takeoff can aid
in effective planning, by avoiding potential hazardous situations, along with knowing the capabilities of the aircraft and
given due consideration to natural degradation of components.
We have conducted a survey of three areas of potential hazards afflicting eVTOLs and UASs: hazards caused by winds;
hazards from component level faults and degradation, as well as, hazards that arise from flight plan nonconformance and
non-cooperatives. We have qualitatively assessed their impact on both individual aircraft and the surrounding airspace.
Additionally, the surveyed hazards will help define the requirements for a system composed of three core functions
addressing: mission level hazards (F1), vehicle level hazards (F2) and airspace level hazards (F3), as part of the NASA
funded project: “Demonstration of the In-Time Learning-Based Safety Management for Scalable Heterogeneous AAM
Operations and our proposed solution of an in-time learning-based aviation safety management system (ILASMS)”.
This paper is organized as follows: In section II we discuss hazards that arise due to adverse winds and their impact
on AAM operations. Section III examines component level faults and degradation of the electric propulsion system
components. Section IV examines hazards from flight plan nonconformance and non-cooperative aircraft. Finally, the
findings of this survey are concluded in section V.
II. Hazards from Winds
Wind and turbulence play a major role in inducing weather related aviation accidents [
4
]. A study conducted by
the FAA [
5
] on data from 2003 to 2007 on weather related aviation accidents show that wind accounted for 53.6% of
manned aircraft accidents, higher than any other factor by 35%. Since the current eVTOL aircraft types are generally
lighter in weight and weaker in propulsion, we expect this issue to be broadly applicable to vehicle operating at lower
altitudes as well. According to Ranquist et.al [
4
], wind and turbulence will have the following three categories of
impacts: (a) affecting the aircraft trajectory in terms of speed changes and deviation from a planned trajectory; (b)
reducing the flight control and manoeuvre capability; and (c) affecting the aircraft endurance. Here we describe the
risks introduced by different winds to both aircraft and airspace.
A. Headwind
Risk on individual aircraft and flight mission: Headwinds bring extra energy cost and/or additional en route
flight time, if the propulsion is insufficient. In turn, this additional flight time can result in delay, which causes the flight
to miss critical metering and arrival time slots. If the headwind is severe enough it can result in the aircraft not being
able to fly at all rendering the aircraft unable to complete its mission.
Risk on airspace: When an aircraft cannot complete the planned mission, rerouting the aircraft, rescheduling for
new time slots or performing emergency landings may need to occur, which all induce extra workload for tactical air
traffic control (ATC) and/or pre-departure flight planning operators or dispatchers. Additionally, it is possible that
aircraft may require longer charging time on the ground to ensure that the battery will have enough energy to tackle the
headwind which could delay the scheduled departure time further. This additional ground time can have secondary
effects within the air transportation network as more vertipads are occupied by aircraft that are unable to start their
mission. Once the vertiport is fully occupied, it can no longer accommodate incoming traffic. This blockage can result
in the need for additional reroutes and emergency landings.
B. Tailwind
Risk on individual aircraft and flight mission: A tailwind originates from behind the aircraft and blows in the
direction of flight. Pradeep et.al [
6
] investigated the effect of tailwinds on the performance of eVTOL aircraft during
the cruise phase of flight. The results indicate that tailwinds cause decreased energy consumption and flight duration
compared to headwind or crosswind conditions. On the other hand, tailwinds increase the aircraft’s speed. Extra
forward momentum can create a high risk of overrun in the take-off and landing phases of the flight, which may cause
the aircraft to travel beyond the available runway length [
7
] in larger aircraft. In the case of eVTOLs and UASs, extra
forward momentum on landing could shift from its designated landing pad potentially causing a collision with vertiport
buildings or other static aircraft.
Risk on airspace: The influence of tailwinds on vertiport capacity was studied by Maslovara and Mirković [
8
]. The
study shows that tailwinds affect the choice of runway configuration, and by extension departure routes, which has an
impact on the vertiport capacity and could cause delays. Furthermore, if the tailwinds exceed a certain threshold during
2
landing, aircraft would be required to enter a holding pattern or be rerouted. Delaying the departure of a flight can cause
the vertiport to exceed its maximum capacity. While an aircraft is delayed on the ground an aircraft en route that is
assigned to the delayed aircraft’s landing pad would be required to enter a holding stack until either a new pad can be
assigned or the delayed aircraft vacates the original one. The vertiport could exceed its maximum capacity if more
arriving aircraft are being held than there are landing pads at the vertiport. When this occurs aircraft running low on
energy must be diverted to a different location.
C. Crosswind
Risk on individual aircraft and flight mission: Similarly to headwinds, crosswinds also introduce additional
energy costs into the mission, with an additional component perpendicular to the direction of flight (track), causing the
aircraft to deviate laterally from its flight path as can be seen in Figure 1a. To maintain an already filed and approved
mission, an aircraft has to counter the effects of the crosswind by turning into the wind (crabbing)(Figure 1b). A
crosswind can cause an aircraft to deviate from its filed plan if it does not have sufficient power to correct for the
crosswind. If the crosswind is strong enough, it could push the aircraft into conflicting paths with terrain, buildings or
other routes from other flights. Additionally, correcting for the crosswind can slowdown the aircraft resulting in missed
time slots for metering or arrival. High crosswinds can also affect the stability of the aircraft rendering it unflyable in
certain conditions.
Risk on airspace: If the affected aircraft does not sufficiently correct for the crosswind impact, it can cause the
aircraft to drift into the path of other aircraft increasing the risk of mid-air collisions. If the conditions are severe enough
flight may be grounded due to the inability to complete planned missions. Aircraft may additionally require rerouting or
rescheduling. Similarly, as with headwinds, a longer charging period on the ground may be required to ensure sufficient
energy is available to counter the crosswind, which could result in a delayed departure.
(a) (b)
Fig. 1 (a) An aircraft affected by crosswind without compensation, deviates from its filed path. (b) The aircraft
correcting for that crosswind by turning into it (crabbing).
D. Downburst and Microburst
Downbursts and microbursts are strong downward movement of air usually associated with a thunderstorm, the latter
having a diameter less than 2.5 miles [
9
]. Figure 2a [
10
] showed the components of a microburst, producing strong
headwinds and tailwinds symmetrically around the centre of the storm, along with the strong downward movement of
air. Windshear, characterised by the FAA as “a change in wind speed and/or direction over a short distance”[
11
] and
is common in microbursts. McCarthy and Serafin [
12
] found that the microburst windshear can also be a significant
hazard to aircraft performance.
Risk on individual aircraft and flight mission: Downbursts, microbursts and the resulting windshear can cause
aircraft to deviate from their paths (Figure 2b [
13
]). When an aircraft is close to the ground or buildings, in conjunction
with the risks of strong headwinds and tailwinds, downbursts and microbursts introduce a further risk of collision with
3
the static environment. In severe cases there is a greater risk of loss of control of the aircraft.
Risk on airspace: If the downburst or microburst is encountered en route, the aircraft may be pushed out of the
planned trajectory, as with headwinds, this creates additional workloads for tactical ATC. This increases the risk of
collision with nearby traffic or the flight dropping out of the planned corridor. If the weather is encountered during
take-off or landing it has the potential to cause the aircraft crash which could, in turn, result in the vertiport and terminal
airspace being shut down. A shutdown of the terminal airspace or vertiport can cause delays, resulting in en route
aircraft being forced to hold. If a sufficient number of aircraft are left holding or delayed it is possible that the arriving
airspace at a vertiport becomes too congested and that there may not be enough landing pads for the arriving aircraft.
(a) (b)
Fig. 2 (a) Microburst airflow in axial symmetry plane [
10
]. (b) Aircraft that encounter a microburst can deviate
from its flight path [13].
E. Aircraft Downwash and Wake Vortex
Risk on individual aircraft and flight mission: Downwash [
14
] and wake turbulence [
15
], are wind-related effects
caused by other aircraft. These can generate instability among lighter aircraft and rotorcraft. Downwash can severely
affect an aircraft’s ability to generate lift [
16
], potentially resulting in the aircraft being unable to meet altitude constraints
or unable to takeoff at all. An aircraft encountering a wake vortex, especially that of a larger aircraft, can result in the
aircraft entering an uncontrolled roll, resulting in loss of control of the aircraft. The AAM airspace could operate at
a lower altitude than traditional airspace, if so then there is an increased risk of collision with static obstacles if the
aircraft is affected by a wake vortex. If the AAM airspace operates at higher altitudes then encountering a wake vortex
could force the aircraft into a lower airspace region. If the aircraft drops from the AAM airspace it could interfere with
the safe operation manned aircraft operating in the lower airspace.
Risk on airspace: Downwash and wake vortices may require aircraft to need additional vertical and lateral separation
to avoid the region where downwash and wake turbulence can occur. They could also render regions or airspace unusable
for periods of time if, for example, a lighter UAS aircraft is due to depart after a larger eVTOL.
(a) (b)
Fig. 3 (a) Wake vortex for rotorcraft [
17
]. (b) Downwash seen in and out of the ground effect of a rotorcraft [
18
].
4
F. Excessive Winds and Turbulence
Risk on individual aircraft and flight mission: Turbulence and excessive winds can affect the stability of an
aircraft in flight (Figure 4 [
19
]). Horizontal gusts either blow against the aircraft or from underneath it can cause the
aircraft to either yaw excessively or can cause the aircraft to bank(roll) with little control respectively. Additionally, as is
depicted in Figure 4, turbulence coming from below the aircraft can cause sudden changes in altitude. The aircraft
type and pre-existing wind conditions will also influence the severity of turbulence. Excessive turbulence or wind
gusts could also impact on-board communication equipment, interfering with the aircraft’s ability to communicate with
control stations. This in turn could affect the aircraft’s ability to receive updated instructions, loss of communication is
discussed further in section IV.
Risk on airspace: Aircraft may deviate from the filed plan, potentially placing it in the path of other aircraft.
Excessive winds can result in loss of control or a change/reduction in the flight envelope. Complex wind flows around
buildings and in urban canyons and without improved weather information could compromise what regions of airspace
are available to aircraft. Large eddy simulations or improved wind information from onboard sensors, such as LIDAR,
would be required to ensure the safety of these areas, increasing the computational workload needed to facilitate adequate
weather situational awareness.
Fig. 4 Turbulence on a passenger aircraft. Lighter aircraft are at higher risk [19].
III. Hazards from Aircraft Component Faults and Degradation
This section surveys aircraft component faults and degradation corresponding to the electric propulsion system. The
main focus is on the propulsion system given its crucial role in terms of eVTOL aircraft safety, faults on other electronic
systems are discussed also.
As identified in [
20
] a UAS/eVTOL aircraft is comprised of many subsystems and before a diagnostic tool can
function the essential subsystems need to be identified along with the essential components. We have chosen to focus on
the electrical propulsion system which can be broken down into three main essential components: the battery pack,
motors, and electronic speed controller (ESC).
A. Battery Pack Faults and Degradation
Battery pack faults and degradation will have an impact on the overall flight performance required to complete
the current or forthcoming mission. Hendricks et al. [
21
] investigated potential failure mechanisms of lithium-ion
batteries, identifying that faults can regularly occur due to degradation of the internal components. Degradation of
internal components of the battery can be caused by a plethora of factors such as general use, extreme temperatures or
just degradation over time due to general use. These faults can lead to short circuits and thermal runaway [
22
] and
requires the battery to be monitored closely.
1. State of charge related faults
Risk on individual aircraft and flight mission: State of Charge (SoC) related faults may affect the operation of
the power train system, which translates into deficient trajectory-tracking capability, reduced manoeuvrability, and/or
reduced available energy. This would impede the aircraft’s ability to complete a flight either due to insufficient energy
5
available or insufficient manoeuvrability, not being able to meet the required trajectory profiles. Furthermore, in [
23
] it
was shown that minimum battery degradation can be achieved if the SoC is maintained above 40% therefore potentially
prolonging the life of the battery and reducing potential faults.
Risk on airspace: Reduced battery capacity, results in the aircraft potentially not being able to make a safe
emergency landing. An uncontrolled or unsafe landing may interfere with airspace allocated for other aircraft. The
airspace may be affected either through it being closed due to a crash of an aircraft rendering the airspace unsafe or an
increased risk potential from an aircraft not being capable of performing critical manoeuvres. The airspace being closed
or operating under reduced capacity can induce delays, to ensure the operational safety of all aircraft.
2. State of health failures
The state of health, unlike state of charge, is the ratio of the maximum charge to the maximum rated capacity and is
affected by operational conditions and loading profiles on the battery. While aging of the batteries may not directly
affect other systems it could result in the aircraft being unable to perform certain aggressive manoeuvres within a
required period of time due to insufficient power to perform those manoeuvres.
Risk on individual aircraft and flight mission: The inability to perform certain aggressive manoeuvres within a
required period of time could result in a collision with buildings or other aircraft. Additionally, the aircraft may be
unable to recover from weather related situations resulting in a loss of control. Reducing degradation on the battery and
ensuring it is replaced when a minimum state of health threshold is reached, can reduce the risk of hazards occurring
due to the battery state of health.
Risk on airspace: The aircraft’s ability to make collision avoidance manoeuvres can also be impeded. This reduced
manoeuvrability could result in a mid-air collision if it results in avoidance manoeuvres not being performed in sufficient
time.
3. Issues with the battery output
Issues with the battery output or associated wiring may cause the system to fail to provide electrical energy to
an ESC. Insufficient or no power to an ESC will result in a motor unable to provide output torque. The output of a
battery, as described by Han et al. [
24
] can be influenced by SoC, component composition, design as well as aging and
degradation.
Risk on individual aircraft and flight mission: A decreased battery output results in a reduced maximum
achievable output speed as the motors receive less power. The aircraft’s inability to take-off, or maintain positions at
higher payloads will be affected as a result, potentially grounding an aircraft. Furthermore, the inability to maintain
position en route may cause the aircraft to deviate from its assigned path and collide with buildings.
Risk on airspace: As a result of decreased battery output, safety paths could be violated as the aircraft is unable to
maintain its path. The violation can result in the aircraft interfering with the paths of the surrounding aircraft leading to
potential mid-air collisions from this reduced separation.
B. Motor Faults and Degradation
1. Faults from motor loading profiles
When considering a single motor, a fault can originate from operational conditions and loading profiles. Bazurto et
al. [
25
] classified the origin of fault sources in electric motors as originating internally or externally falling into the
categories: Inherent weakness of material, design and manufacturing; misuse or application of efforts in the wrong
direction; gradual deterioration as a result of wear, tear or fatigue through stress or corrosion. Faults relating to
bearings, a mass unbalance or low insulation resistance can result in motor loss in effectiveness which may translate into
deteriorated trajectory tracking depending on the motor affected and the trajectory configuration.
Risk on individual aircraft and flight mission: Reduced trajectory-tracking capability may result in the aircraft
being unable to perform critically safe manoeuvres such as landing. Failure to land safely near a vertiport could result
in the aircraft hitting the building or other aircraft on the ground. Additionally, depending on the motor affected, the
aircraft could deviate from its assigned trajectory en route either as a result of not maintaining altitude, speed or correct
for changes in heading.
Risk on airspace: A motor not performing within its optimal parameters could have a lower power output, as such
the aircraft may not be able to maintain altitude or its assigned trajectory, resulting in a deviation. Deviations from an
6
assigned trajectory affects surrounding aircraft int he airspace, increasing the potential risk of a mid-air collision.
2. Faults from high power consumption
Faults generated from a high-power consumption can be caused by a change in winding resistance or bearing faults
within the motor. High currents drawn from the battery pack decrease the remaining flight time and remaining useful
life (RUL) of a battery shortening the effective time available to complete the current and/or future missions on a single
charge.
Risk on individual aircraft and flight mission: A lower RUL can decrease the remaining flight time meaning the
aircraft may not have sufficient power to complete a mission. In conjunction with weather, the aircraft may not have
sufficient power to compensate for trajectory deviation as a result of high winds. Multiple motors causing higher power
consumption will result in a more drastic decrease in remaining flight time and RUL. Additionally, an increase in battery
discharge rate as a result of high-power consumption would require more frequent charging after shorter missions.
Risk on airspace: A decrease in flight time can cause congestion around vertiports with an increased number of
recharging stops for en route aircraft adding strain onto tactical ATC. If there is insufficient energy to complete a mission
it could result in an emergency landing or crash leading to sectors of airspace being closed temporarily, for recovery
efforts or to ensure the airspace is safe after an incident.
C. Electronic speed controller faults and degradation
Power consumption faults caused by operational stress or high electrical and thermal stress on components can affect
single or multiple ESCs. Gorospe et al. [
26
] studied the effects of ESC degradation and identified that degradation can
result in a change in switching frequency, MOSFET degradation or stuck faults. The main risk associated with ESC
hazards is the degraded control capability resulting in the potential inability to perform manoeuvres required within a
predefined time period or flight profile.
Risk on individual aircraft and flight mission: As previously mentioned, when systems that affect the aircraft’s
ability to perform required manoeuvres are impacted by component level faults, there is an increased risk of collision with
static objects or terrain. Additionally, there is a joint hazard if the aircraft is unable to perform correcting manoeuvres
for strong winds or adverse weather. A longer time to perform a manoeuvre could also increase the total flight time
resulting in missed time slots for metering and approaches.
Risk on airspace: Similarly, if an aircraft is unable to perform avoidance manoeuvres in a timely manner there is an
increased risk of mid-air collisions with other airspace users.
D. Other system hazards
Faults that affect the navigation or autopilot systems include components such as internal measurement unit (IMU),
global position system (GPS) or LIDAR/obstacle acquisition sensor. The inability to provide real-time information of
location, altitude, and/or obstacles results in the inability to process flight plan nonconformance requirements.
GPS or IMU loss due to damaged equipment, jamming or spoofing renders the aircraft unable to recognize its true
position or suffer from localization errors. This would potentially result in flight plan nonconformance as the aircraft is
not aware of its true location. A sensor failure, such as the LIDAR means the aircraft would be unable to detect its
distance from surrounding objects. This could result in loss of separation or even potential collisions with other aircraft
or static obstacles.
Finally, loss of communication caused by: on-board communication device failure, damaged antenna, malicious
jamming, occupied frequencies, data link or Command and Control (C2) link failures can result in the aircraft having
non-cooperative behaviours, Zhou and Kwan [
27
] described a method of mitigation through contingency waypoints
in the event of a break down in the ability to send commands to the aircraft. These faults are discussed in detail in
section IV.
IV. Hazards from Flight Plan Nonconformance and Non-Cooperatives
This section focuses on UAM corridor incursions from flight plan nonconformance and non-cooperative aircraft.
Flight plan nonconformance occurs when an aircraft violates its accepted or active flight plan, causing a potential
deviation from its assigned route (or corridor). A non-cooperative aircraft is one which does not receive or update
its flight plan or movements according to provided advisories. Therefore, an aircraft could be either flight plan
nonconformant or non-cooperative, or potentially both simultaneously. For example, a deviation from a flight plan due
7
to excessive winds while, at the same time, not receiving aircraft control advisories due to a lost C2 link. The following
are hazards identified that directly affect an aircraft’s flight plan conformance or its ability to cooperate.
Fig. 5 An example of a C2 infrastructure.
A. Wind and the Electric Propulsion System
As established in section II and section III there are hazards resulting from the effect of winds on the aircraft or
failure of the electrical propulsion system. The resultant hazards to individual aircraft and on the airspace have been
discussed in the previous section so will not be covered here beyond identifying that they largely result in flight plan
nonconformance.
B. Inertial Measurement Unit
The Inertial Measurement Unit (IMU) is another potential source of failure, it reports on the body’s specific force,
angular rate and body orientation. Failures of the IMU are rooted in the autopilot or device/sensor failures. This means
the system is unable to provide real-time positional attitude recognition or render the system unable to process the status
of the aircraft, resulting in flight plan nonconformance.
Risk on individual aircraft and flight mission: Reimann et al. [
28
] showed that the IMU of the UAV may fail
because of circuitry overload, calibration loss, or disconnection from the Battery Eliminator Circuit (BEC), which may
cause a power surge, electrical static discharge, or vibrations to damage connections. Loss of the IMU can render the
aircraft unable to correct for drift, which in turn would cause the aircraft to deviate from its filed flight plan or out of a
defined corridor, potentially resulting in collision with obstacles.
Risk on airspace: Lindsay and McDermid [
29
] showed that failure of the IMU during the pre-launch phase of a
missile may harm the system safety. Since the omission of the IMU will make the missile unavailable to calculate its
orientation and the incorrect drift of the IMU may lead to the collision with the launch vehicle. The principal follows
for UAS and eVTOLs in which failure of the IMU carries an inherent risk of collision within in the airspace for any
autonomous aircraft.
C. Loss of Navigation
Risk on individual aircraft and flight mission: Loss of navigation (e.g., GPS loss) may be caused by communication
failures from damaged antennas, malicious radar jamming, or occupied radio frequencies. This could result in an aircraft
being unable to track its position or active flight plan, resulting in nonconformance. Belcastro et al. [
30
] showed when
the GPS power was turned off, the ability of the aircraft to maintain altitude, course, and attitude degrade rapidly. The
reason is because the compass packaged with the GPS unit highly relies on the GPS power. This will lead the aircraft
8
into a dangerous situation. Kunzi [
31
] found that a GPS failure or outage may cause the aircraft to deviate from the
original flight path which lowers the safety of the system.
Risk on airspace: An aircraft deviating from its planned flight path or unable to maintain its trajectory introduces
serious risk to the surrounding airspace. The potential for mid-air collisions increases as the afflicted aircraft is unable
to correct back onto its route.
D. Loss of Communication
Communication with aircraft is essential to ensure safe operation in congested airspace and allow for coordination,
however failures in communication present a significant hazard. A loss of communication can be caused by on-board
communication device failure, damaged antenna, malicious jamming, occupied frequencies, data link or C2 link failures.
This could result in two cases: (1) telemetry link loss, the aircraft is unable to report its own information or telemetry so
it is not tracked by ground stations or other aircraft. (2) C2 link loss, the aircraft is unable to receive information. Olson
and Atkins [
32
] found that loss of communications can be attributable to signal interference, router problems, or going
out of range.
Risk on individual aircraft and flight mission: Losing communication with the ground station during autonomous
mode prohibits the UAS from being able to navigate with the global map. Updates that may be usually sent to the air
system, such as amendments to the route to avoid adverse weather, may not be received posing a risk to the air system in
the future.
Risk on airspace: Incursions with differing autonomy, capabilities, or equipage, such as manned helicopters, general
aviation aircraft or drones, may enter the eVTOL corridor. These incursion aircraft may show non-cooperative behaviors
to operating eVTOLs. Without the ability to communicate with other aircraft, the aircraft may still follow a filed flight
plan, but updates or changes to it cannot be sent or received. Therefore, advisories, corrections or amendments made
may to the flight plans not be adopted by the aircraft. In turn, this may result in the aircraft being unable to correctly
perform conflict avoidance strategies.
E. Loss of Transponder
Transponder equipment provides critical information to enable safe flight and allow aircraft to comprehend the state
of the surrounding airspace. Loss of the transponder can render ground-based control unable to track the aircraft, in
addition to the aircraft being unable to interpret information sent out by nearby aircraft. This can result in the inability
to ascertain if the aircraft is correctly following a flight plan correctly.
Risk on individual aircraft and flight mission: Li et al. [
33
] showed that hazards associated with signal
transponders can present severe safety issues to the UAV system, as the failure to receive correct signals could potentially
result in a crash.
Risk on airspace: Noh and Shortle [
34
] found that the failure of a transponder on the target aircraft may lead to the
failure of TCAS. TCAS obtains surveillance information by direct interrogation of the transponder on the other aircraft.
For UAS systems, the inability to track an aircraft accurately could result in either incorrect avoidance strategies being
issued or no strategy being issued when one is required which could result in a potential mid-air collision.
F. Operator or Pilot Fault
An operator or pilot fault is directly caused by human error or mistake. Human-automation interaction [
35
] is the
largest source of risk in manned eVTOLs. Human pilots may lose the awareness, have a delayed response, or misjudge
the aircraft’s states, intentions, and autonomy’s role/responsibilities. Muthard and Wickens [
36
] showed that in high
workload conditions pilots failed to revise the flight plans because of a change and were more likely to do so with
imperfect automation in a high workload situation. This significantly deteriorates the safety of the system. Wickens
[
37
] stated that accidents have sometimes resulted from the pilot’s failure to perform critical tasks. These failures are
likely a result of a lack of pilot awareness such that the need to perform those tasks dropped from the pilot’s awareness
rather than an inability or failure to perform critical tasks.
Risk on individual aircraft and flight mission: Faults arising from an operator or pilot could put the aircraft in an
unsafe condition, where the safety of the aircraft, in relation to its surroundings, could be compromised. If pilots are
unaware of their surroundings or intervene with the aircraft sub optimally, the aircraft may collide or crash with the
terrain or static obstacles.
Risk on airspace: An unaware pilot or operator could interfere with the operation of the aircraft and perform
9
unexpected manoeuvres. This would put burden on the airspace as nearby aircraft may have to adapt or deconflict with
this sub optimal manoeuvre. Overall, the risk of pilot error increases the chance for a mid-air collision.
V. Conclusion
Safe operation of eVTOL and UAS aircraft is paramount. The hazards which may affect the aircraft at any stage
need to be identified. In this paper we surveyed hazards to eVTOL and UAS aircraft in the context of AAM operations.
We analyzed the hazard impact on the operational performance and safety of the aircraft as well as its impact on the
airspace. We analyzed hazard factors concerning: strong winds, aircraft component faults and degradation, as well as
hazards arising from nonconformance and non-cooperation.
When a hazard develops, it has the potential to cascade, not only impacting the operational safety of the aircraft but
also the safety of the airspace. A single aircraft can initially be affected, battery degradation for example can reduce the
flight time of an aircraft when charged for a fixed length of time compared with aircraft equipped with newer batteries.
The initial aircraft would require a longer charging period to ensure the battery has sufficient charge to complete a flight.
This longer charging period can develop into a delay keeping a landing pad occupied resulting in a pre-departure delay
for the charging aircraft and potentially a en route delay for any arriving aircraft scheduled to land at that landing pad.
Winds also demonstrate a large potential cause of delays due to their impact on aircraft operational safety. Severe winds
or weather could result in large regions of airspace being closed off over these operational safety concerns. Closing off
airspace can quickly induce delays in departing aircraft or delays for en route aircraft which may now be required to
reroute around the closed airspace or divert to a different vertiport.
By identifying these hazard areas, our team will be able to generate three function groups as part of the ILASMS
solution. These function groups (F1-mission level, F2-vehicle level, and F3-airspace level) will address the identified
hazard areas. Function one, focusing on the mission level, will develop one system to evaluate an aircraft’s ability to
complete a flight given the available charge of the battery, predicted winds along the route as well as the aircraft’s
ability to conform to the filed flight plan. Function one will also look at re-planning if it is unable to complete a flight
given the aforementioned parameters. Focusing on faults in the electrical propulsion system of the aircraft, function
2 will investigate fault-tolerant techniques to mitigate the hazard of faults with these components. Finally, function
three focuses on airspace level hazards, specifically, corridor incursion introduced from flight plan nonconformance and
non-cooperatives. Function three will look at three causes of nonconformance and non-cooperatives: winds, component
fault and loss of GPS/communication with the aircraft.
Acknowledgments
The research team would like to thank Steven Young and Natasha Neogi for their helpful advice and discussions.
This project is supported by the NASA Grant 80NSSC21M0087 under the NASA System-Wide Safety (SWS) program.
References
[1] The Federal Aviation Administration, “UAM Concept of Operations v1.0” , June 2020.
[2]
SESAR, “CORUS: U-space Concept of Operations” , 2019. URL
https://www.sesarju.eu/sites/default/files/
documents/u-space/CORUS%20ConOps%20vol2.pdf, retrieved 30 March 2022.
[3]
Aweiss, A. S., Owens, B. D., Rios, J., Homola, J. R., and Mohlenbrink, C. P., Unmanned Aircraft Systems (UAS) Traffic
Management (UTM) National Campaign II, 2018. https://doi.org/10.2514/6.2018- 1727, URL https://arc.aiaa.org/doi/abs/10.
2514/6.2018-1727.
[4]
Ranquist, E., Steiner, M., and Argrow, B., “Exploring the range of weather impacts on UAS operations” American Meteorological
Society Annual Meeting, 2017.
[5] The Federal Aviation Administration, “Weather-Related Aviation Accident Study 2003-2007” , February 2010.
[6]
Pradeep, P., Lauderdale, T. A., Chatterji, G. B., Sheth, K., Lai, C. F., Sridhar, B., Edholm, K.-M., and Erzberger, H.,
“Wind-Optimal trajectories for multirotor eVTOL aircraft on UAM missions” AIAA AVIATION 2020 FORUM, 2020, p. 3271.
[7]
Van Es, G., and Karwal, A., “Safety aspects of tailwind operations. National Aerospace Laboratory-NLR” Tech. rep.,
NLR-TP-2001-003, 2011.
10
[8]
Maslovara, A., and Mirković, B., “Impact of Tailwind on Airport Capacity and Delay at Zurich Airport” Transportation
Research Procedia, Vol. 59, 2021, pp. 117–126.
[9]
Nation Weather Service, “What is a microburst?” , n.d. URL https://www.weather.gov/ama/microbursts, retrieved 29 March
2022.
[10]
Liu, T., Dai, Y., and Hong, G., “Flight dynamic simulation of helicopter forward flight through microburst wind field” Advances
in Mechanical Engineering, Vol. 9, 2017, p. 168781401769121. https://doi.org/10.1177/1687814017691212.
[11]
The Federal Aviation Administration, “Wind Shear” , 2008. URL https://www.faasafety.gov/files/gslac/library/documents/
2011/aug/56407/faa%20p-8740-40%20windshear%5Bhi-res%5D%20branded.pdf , retrieved 06 April 2022.
[12]
McCarthy, J., and Serafin, R., “The Microburst Hazard to Aircraft” Weatherwise, Vol. 37, No. 3, 1984, pp. 120–127.
https://doi.org/10.1080/00431672.1984.9933539.
[13]
Sabzehparvar, M., “Dynamic response of the aircraft to wind shear using multi-points loading approach” Archive of Mechanical
Engineering, Vol. 18, 2018, pp. 243–252.
[14]
NASA, “Downwash effects on lift” , May 2021. URL https://www.grc.nasa.gov/www/k-12/airplane/downwash.html, retrieved
28 March 2022.
[15]
The Federal Aviation Administration, “Wake Turbulace” , n.d. URL https://www.faa.gov/air_traffic/publications/atpubs/aim_
html/chap7_section_4.html, retrieved 28 March 2022.
[16] Wagtendonk, W. J., Principles of helicopter flight, Aviation Supplies & Academics, 2006.
[17]
Air Accidents Investigation Branch, “AAIB Bulletin: 7/2012” , July 2010. URL https://www.gov.uk/government/publications/air-
accident-monthly-bulletin- july-2010, retrieved 28 March 2022.
[18]
International Virtual Aviation Organisation, “Ground effect” , January 2022. URL https://mediawiki.ivao.aero/index.php?title=
Ground_effect, retrieved 28 March 2022.
[19]
CBC News, “Violent turbulence: A look at what causes shakes mid-flight” , January 2016. URL https://www.cbc.ca/news/
science/turbulence-air-travel-1.3385566, retrieved 28 March 2022.
[20]
Kulkarni, C., and Corbetta, M., “Health Management and Prognostics for Electric Aircraft Powertrain” 2019 AIAA/IEEE
Electric Aircraft Technologies Symposium (EATS), 2019, pp. 1–13. https://doi.org/10.2514/6.2019- 4474.
[21]
Hendricks, C., Williard, N., Mathew, S., and Pecht, M., “A failure modes, mechanisms, and effects analysis (FMMEA) of
lithium-ion batteries” Journal of Power Sources, Vol. 297, 2015, pp. 113–120. https://doi.org/https://doi.org/10.1016/j.jpowsour.
2015.07.100, URL https://www.sciencedirect.com/science/article/pii/S0378775315301233.
[22]
Feng, X., Ouyang, M., Liu, X., Lu, L., Xia, Y., and He, X., “Thermal runaway mechanism of lithium ion battery for electric
vehicles: A review” Energy Storage Materials, Vol. 10, 2018, pp. 246–267. https://doi.org/https://doi.org/10.1016/j.ensm.2017.
05.013.
[23]
Young, K., Wang, C., Wang, L., and Strunz, K., “Electric Vehicle Battery Technologies” Electric Vehicle Integration into
Modern Power Networks, 2013, pp. 15–56. https://doi.org/10.1007/978-1-4614- 0134-6_2.
[24]
Han, X., Lu, L., Zheng, Y., Feng, X., Li, Z., Li, J., and Ouyang, M., “A review on the key issues of the lithium
ion battery degradation among the whole life cycle” eTransportation, Vol. 1, 2019, p. 100005. https://doi.org/https:
//doi.org/10.1016/j.etran.2019.100005, URL https://www.sciencedirect.com/science/article/pii/S2590116819300050.
[25]
Bazurto, A., Quispe, E., and Castrillon, R., “Causes and failures classification of industrial electric motor” 2016.
https://doi.org/10.1109/ANDESCON.2016.7836190.
[26]
Gorospe Jr., G. E., Kulkarni, C. S., Hogge, E., Hsu, A., and Ownby, N., “A Study of the Degradation of Electronic Speed
Controllers for Brushless DC Motors” Asia Pacific Conference of the Prognostics and Health Management Society 2017, 2017.
[27]
Zhou, J., and Kwan, C., “A High Performance Contingency Planning System for UAVs with Lost Communication” 2018 IEEE
International Conference on Prognostics and Health Management (ICPHM), 2018, pp. 1–8. https://doi.org/10.1109/ICPHM.
2018.8448926.
[28]
Reimann, S., Amos, J., Bergquist, E., Cole, J., Phillips, J., and Seiler, P. J., “UAV for Reliability” Aerospace Vehicle Design.
AEM-4331, 2013.
11
[29]
Lindsay, P. A., and McDermid, J. A., “Derivation of safety requirements for an embedded control system” Systems Engineering
Test and Evaluation Conference, 2002.
[30]
Belcastro, C. M., Klyde, D. H., Logan, M. J., Newman, R. L., and Foster, J. V., “Experimental Flight Testing for Assessing the
Safety of Unmanned Aircraft System Safety-Critical Operations” 17th AIAA Aviation Technology, Integration, and Operations
Conference, 2017. https://doi.org/10.2514/6.2017- 3274.
[31]
Kunzi, F., “Framework for risk-based derivation of performance and interoperability requirements for UTM avionics” 2016
IEEE/AIAA 35th Digital Avionics Systems Conference (DASC), 2016, pp. 1–10. https://doi.org/10.1109/DASC.2016.7778050.
[32]
Olson, I., and Atkins, E. M., “Qualitative Failure Analysis for a Small Quadrotor Unmanned Aircraft System” AIAA Guidance,
Navigation, and Control (GNC) Conference, 2013. https://doi.org/10.2514/6.2013- 4761.
[33]
Li, D., Qiang, Y., and Mott, J. H., “Hazard Analysis of Large Cargo Delivery UAVs Under the Chinese Air Traffic Control
System” 2021 Systems and Information Engineering Design Symposium (SIEDS), 2021, pp. 1–6. https://doi.org/10.1109/
SIEDS52267.2021.9483732.
[34]
Noh, S., and Shortle, J., “Dynamic Event Tree Framework to Assess Collision Risk Between Various Aircraft Types” 2020
Integrated Communications Navigation and Surveillance Conference (ICNS), 2020, pp. 2F1–1–2F1–13. https://doi.org/10.
1109/ICNS50378.2020.9222936.
[35]
Bauranov, A., and Rakas, J., “Urban air mobility and manned eVTOLs: safety implications” 2019 IEEE/AIAA 38th Digital
Avionics Systems Conference (DASC), 2019, pp. 1–8. https://doi.org/10.1109/DASC43569.2019.9081685.
[36]
Muthard, E. K., and Wickens, C. D., “Factors that Mediate Flight Plan Monitoring and Errors in Plan Revision: Planning Under
Automated and High Workload Conditions” 12th International Symposium on Aviation Psychology, 2003.
[37]
Wickens, C., “Situation awareness: Impact of automation and display technology” AGARD AMP Symposium on "Situation
Awareness: Limitations and Enhancement in the Aviation Environment", 1996.
12
