A series of accidents has underlined that development of safe, robust electric vertical-takeoff-and-landing (eVTOL) vehicles will be no easy task.
Reports released by the U.S. National Transportation Safety Board (NTSB) show how control system flaws contributed to crashes of three different eVTOL prototypes.
The most recent accident investigated was the Oct. 17, 2019, crash of a Kitty Hawk Heaviside 2 during an unmanned test flight over privately owned land near Tres Pinos, California. The tilt-prop eVTOL was substantially damaged during a manual precautionary landing.
About 10 min. into the flight, the aircraft encountered an anomaly while in wing-borne flight at 2,000 ft. Multiple flight computer limits were exceeded. The ground pilot took control and, sensing the aircraft had degraded control, decided to perform a conventional landing on a large open field.
Approaching the intended landing zone, the pilot began transitioning the aircraft to hover configuration until he felt there was risk of losing control if he transitioned further. The aircraft impacted at 37 kt. airspeed, with 20-deg., nose-down pitch and 20-deg. left roll.
Kitty Hawk subsequently discovered a software timing error had affected controllability of the aircraft. The timing error was caused by a battery charging script that, due to operator error, had not been properly terminated before the start of the flight.
The improper termination, and the priority given to running the script, resulted in it using significant processing resources in flight, which led to the software timing error. To address the anomaly, Kitty Hawk is improving the ground station and future software versions will address processor priority issues to prevent similar timing errors occurring.
The second accident, On June 21, 2019, involved Boeing’s CV2 Cargo Air Vehicle (CAV). The large multirotor unmanned aircraft was substantially damaged in a contingency landing during a test flight at Chase International Airport in Beeville, Texas.
All flights of the CAV are preprogrammed. The only control the ground pilot has is through contingency management via “abort to planned zone” (APZ), “land now” or “cut power” commands. A two-level geofence boundary contains the aircraft within a safe boundary.
After takeoff for a planned 30-kt. flight, the aircraft started to deviate from the planned flight profile. Detecting the deviation, the CAV autonomously triggered the APZ contingency plan, immediately turning toward the closest planned landing zone.
But the lateral deviation continued and when the aircraft reached the first geofence boundary it autonomously executed a “land now” command, where it immediately began to land regardless of its position. It continued to drift, however, and on reaching the outer geofence boundary, the aircraft autonomously cut all power and dropped to the ground.
A review of flight data showed the deviation was caused by higher than expected wind, which resulted in high vibration within the aircraft’s navigation system. The contingency logic within the control system was unable to return the aircraft to the planned abort zone before reaching the outer geofence zone.
The accident was blamed on insufficient crosswind testing and insufficient ability to determine winds during test flights, the NTSB says. Inadequate physical separation between the planned abort zone and the geofence boundaries was a contributing factor.
The CAV accident came barely two weeks after Boeing subsidiary Aurora Flight Sciences’ Personal Air Vehicle (PAV) prototype was damaged in a June 4, 2019, unmanned test flight at Manassas Regional Airport, Virginia. The aircraft fell to the ground during landing when the lift motors went to idle in flight.
The normal landing for the eVTOL PAV is a vertical autoland. A combination of squat switches and “jerk” logic that detects the acceleration spike on touchdown switches the control system to ground mode and idles the lift motors. The aircraft had a radar altimeter, but it was not being used for ground detection.
The PAV was landing vertically when it experienced a resonant vibration that exceeded the accelerations used to set the jerk-logic threshold in the autopilot. This fooled the control system into thinking the aircraft had landed and it transitioned from autoland to ground mode while still at altitude, with the PAV dropping to the runway.
Related Content
