Method for Defining the Automation Level of an eVTOL

Borges, Sarah Francisca de Souza; Cardoso Junior, Moacyr Machado; Castilho, Diogo Silva

doi:10.1590/jatm.v16.1342

Acessibilidade / Reportar erro

Brasil

Journal of Aerospace Technology and Management

Español English

Brasil

Español English

sumário « anterior atual seguinte »

Sumário

ORIGINAL PAPER • J. Aerosp. Technol. Manag. 16 • 2024 • https://doi.org/10.1590/jatm.v16.1342 copy

Method for Defining the Automation Level of an eVTOL

Authorship SCIMAGO INSTITUTIONS RANKINGS

ABSTRACT

Optimizing pilot-automation collaboration necessitates early safety assessment of the aircraft, which involves a rigorous examination of potential scenarios. This article seeks to establish a comprehensive framework for safety analysis, exploring various levels of automation (LoA) within high-technology projects such as electric vertical takeoff and landing (eVTOL) aircraft. The method is divided into three phases: the first involves defining the operations concept; the second involves applying the systems theoretic process analysis (STPA) method; and the third encompasses determining the safest LoA. Furthermore, this article scrutinizes the landing operations of eVTOL aircraft in urban centers. The identified control actions (CAs) include flight monitoring, landing verification, speed selection, and maneuvering. Ultimately, a LoA categorized as automated decision making emerged as the safest. This entails the concurrent monitoring and generation of alternatives by both the pilot and the autopilot, with the final selection of the optimal alternative and its subsequent implementation exclusively entrusted to the autopilot. This work contributes by presenting evidence that safety analysis should commence at the level of individual CAs, rather than at a higher level encompassing complete operations or the entire aircraft. This approach aims to generate comprehensive, practical, and effective safety requirements.

Keywords
Aeronautics; Automation; Aerospace safety; Methodology

Automation level		Roles
Automation level		Monitor	Generate	Select	Implement
1	Manual control (MC)	P	P	P	P
2	Action support (AS)	P/AP	P	P	B
3	Batch processing (BP)	P/AP	P	P	AP
4	Shared control (SHC)	P/AP	P/AP	P	P/AP
5	Desicion support (DS)	P/AP	P/AP	P	AP
6	Blended decision making (BDM)	P/AP	P/AP	P/AP	AP
7	Rigid system (RS)	P/AP	AP	P	AP
8	Automated decision making (ADM)	P/AP	P/AP	AP	AP
9	Supervisory control (SC)	P/AP	AP	AP	AP
10	Full automation (FA)	AP	AP	AP	AP

Interviews with pilots to gather information
1	What are the routine actions for landing helicopters in terms of safety?
2	What level of automation is available on the aircraft (e.g., H-36)?
3	What incidents have occurred during the landing of a highly automated aircraft? Could you describe the process until you reach the hazard?
4	What are the possible accidents and hazards in these cases? For example, accident “death or injury to people” and hazard “bird attack”.
5	What mitigating measures can be taken? To avoid an accident, what actions could or could not be taken?
6	In the case of quick decisions in a time of emergency landing, what skills/procedures/knowledge are important?

Stakeholders and their objectives
1	Agência Nacional de Aviação Civil (ANAC) is a federal regulatory agency that holds the vital responsibility of overseeing civil aviation operations in Brazil. Its primary focus encompasses the regulation of both economic aspects and technical safety within the aviation sector.
2	Eve Air Mobility is a Brazilian company that plans to produce eVTOL aircraft, as well as UAM infrastructure.
3	Passengers will be the users of the air taxi service in the state of São Paulo, Brazil, who seek convenient transportation between cities.

Objectives for Goal 1: To provide an optimized means of transportation that connects the states of Brazil
1	The passenger collection point must be close to one or more other means of transport (bus stop, subway etc.).
2	The duration of the journey en route should be a maximum of 3 hours.
3	The duration of the journey en route should be a maximum of 3 hours.
4	The duration of the journey en route should be a maximum of 3 hours.
5	The vehicle must carry 4 passengers.
6	The aircraft shall have eight electric propellers.
7	The aircraft must be powered by two or more high-voltage batteries.
8	The aircraft must be powered by two or more high-voltage batteries.
9	The aircraft must have electric motor power (12 rotors).
10	The aircraft must have helicopter-type two-skid landing gear.
11	The aircraft must have a noise level of 70 dB at 500 feet.
12	The aircraft must reach a maximum altitude of 6,600 feet.
13	The aircraft shall have a cruising speed of 150 mph and a range of 60 miles (96 km per hour).

Objectives for Goal 2: To ensure comfort and safety for passengers in the face of operational risks
1	The operation or flight phase of the aircraft must receive the safest LoA between 1 to 10.
2	The sensor must identify objects at a safe distance to deflect.
3	The pilot or autopilot must maintain communication with one or more ground support centers.

Nº	CA	Not providing	Providing causehazard	Stop too soon/applying too long
1	Monitor flight	1.1 The pilot does not monitor flight during the landing. [H2, H3, H5] [L1-L4]
2	Verify landing site		2.1 The pilot verifies an unsafe landing site. [H2, H3, H5] [L1-L4]
3	Choose speed	3.1 The pilot does not choose a safe speed during landing. [H1, H2, H3, H5] [L1-L4]
4	Maneuver	4.1 The pilot does not handle the controls with confidence. [H2, H3, H5] [L1-L4]
5	Monitor flight	5.1 The autopilot does not fully monitor the area surrounding the aircraft during the landing. [H2, H3, H5] [L1-L4]
6	Verify landing site		6.1 The autopilot monitors the flight unsafely during landing. [H2, H3, H5] [L1-L4]
7	Choose speed			7.1 The autopilot does not select a slowdown soon enough to avoid impact with an object during the landing. [H2, H3, H5] [L1-L4]
8	Maneuver			8.1 Autopilot does not maneuver (right, left) in time to clear hazards during landing. [H2, H3, H5] [L1-L4]

CA	UCA	Loss scenarios	Safety requirements
1	1.1	The pilot does not monitor the flight because he is inattentive or trusts that he will be warned of any moving object or obstacle nearby.	If the pilot does not monitor the flight due to being inattentive, any breach of safety minimums must be promptly detected, and appropriate measures need to be taken to prevent collisions or potential hazards.
2	2.1	The pilot verifies an unsafe landing site because he does not know the region and it is an emergency landing.	If the pilot finds an unsafe landing site, ground personnel must monitor the route and alert the pilot to the best landing sites.
3	3.1	The pilot does not choose a safe speed during landing, because he is under pressure to finish the experience.	If the pilot does not choose a safe speed during landing, then the ground team must monitor the route and alert the pilot.
4	4.1	The pilot does not confidently maneuver the controls because he suffers from a loss of situational awareness.	If the pilot does not confidently maneuver the controls, then the ground team must monitor the route and alert the pilot.
5	5.1	The autopilot does not fully monitor the area around the aircraft during landing, because there are too few sensors to cover the total area.	The autopilot does not fully monitor the area around the aircraft during landing, and then sensors need to be located at strategic points to pick up different angles if an object approaches.
6	6.1	The autopilot monitors the flight without safety because the maps of the region are out of date.	The autopilot monitors the unsafety flight, and then the ground team must monitor the route and alert the pilot.
7	7.1	The autopilot does not select a slowdown in time to get away from an object during the landing, because the object is out of sensor range.	The autopilot does not select a slowdown in time to get away from an object during the landing, and then the sensors need to be located at strategic points to capture different angles if an object approaches.
8	8.1	Autopilot does not maneuver in time to clear hazards during landing because the object is out of sensor range.	Sensors need to be located at strategic points to capture different angles if an object approaches.

no	CAs	Responsible	Function	Scenarios	Better
1	Monitor flight	Pilot	Monitoring	1.1 and 5.1	P/AP
In this scenario, the pilot neglects monitoring the flight, either due to inattentiveness or reliance on the assumption that any nearby moving object or obstacle will trigger a warning. Concurrently, the autopilot monitors the flight, but the object is beyond the sensor range. In such a situation, it is essential for both the autopilot and the pilot to engage in monitoring. The autopilot offers the advantage of continuous vigilance without distractions, while the pilot contributes the benefit of long-range vision.
2	Verify landing site	Pilot	Generating	2.1 and 6.1	P/AP
In this scenario, the pilot considers an unsafe landing site as an alternative due to unfamiliarity with the region, especially during an emergency landing. Simultaneously, the autopilot monitors the flight without ensuring safety due to outdated maps of the region. In such a case, during routine operating conditions, the autopilot would navigate to the landing site. However, in the scenario of an emergency landing, it would be more appropriate for the pilot in command to analyze and determine the safest area for landing.
3	Choose speed	Pilot	Selecting	3.1 and 7.1	AP
In this scenario, the pilot may not select a safe landing speed due to the pressure to conclude the workday, and the autopilot may not adjust the speed safely in time to clear hazards during landing because the object is beyond the sensor range. In such a situation, the autopilot would possess the precision to control the speed (increasing and decreasing) in the safest manner, thus avoiding a sudden stop. Meanwhile, the pilot would focus on monitoring and discerning the object. Additionally, it is recommended to have sensors covering various areas around the aircraft
4	Maneuver	Pilot	Implementing	4.1 and 8.1	AP
In this scenario, the pilot may struggle to confidently maneuver the controls due to a loss of situational awareness, and the autopilot may not maneuver in time to clear hazards during landing because the object is beyond the sensor range. In such a case, the maneuvering of the aircraft (guiding the directions) would be more effectively performed by the autopilot, especially in situations where the pilot experiences a loss of situational awareness. It is recommended to incorporate sensors that capture different angles of the area around the aircraft.

No	CAs	Function	LoA
No	CAs	Function	1	2	3	4	5	6	7	8	9	10
1	Monitor flight	Monitoring	P	P/AP	P/AP	P/AP	P/AP	P/AP	P/AP	P/AP	P/AP	AP
2	Verify landing site	Generating	P	P	P	P/AP	P/AP	P/AP	AP	P/AP	AP	AP
3	Choose speed	Selecting	P	P	P	P	P	P/AP	P	AP	AP	AP
4	Maneuver	Implementing	P	P/AP	AP	P/AP	AP	AP	AP	AP	AP	AP

Departamento de Ciência e Tecnologia Aeroespacial Instituto de Aeronáutica e Espaço. Praça Marechal do Ar Eduardo Gomes, 50. Vila das Acácias, CEP: 12 228-901, tel (55) 12 99162 5609 - São José dos Campos - SP - Brazil
E-mail: submission.jatm@gmail.com

Acompanhe os números deste periódico no seu leitor de RSS

[1] * Correspondence author: sarahfsborges2021@gmail.com