1 Introduction

The increasing energy density of high-voltage batteries, development in connectivity, and progress in digitization enable new mobility concepts such as electric vertical take-off and landing (eVTOL) vehicles. The eVTOL industry is growing rapidly.

According to Roland Berger’s Study [1], more than 160.000 units will be part of air traffic by 2050. The potential of the new urban air mobility (UAM) market is estimated, in a study initiated by NASA [2], to be worth up to 500 billion US dollars even for implementation in the USA alone [3]. First services are announced for the Olympic games in 2024 [4].

Time-saving will be one of the essential advantages of air-taxi services due to the potential of shorter overall travel time compared to ground-based transportation modes [5, 6].

Unlike most conventional aircraft, air taxis will compete with individual transportation systems like cars and public transportation, e.g., buses and trains, due to their short missions in urban and interurban areas. Hence, increasing the acceptance of air taxis for potential customers, aspects like safety, comfort, and overall customer perception become increasingly important.eVTOL’s novel missions, supplemented with reduced flight height and operations in urban areas, cause new crash scenarios compared to classic aviation. Also, unconventional vehicle configurations and propulsion units like high-voltage batteries cause novel safety challenges [7]. A crash cannot be ruled out entirely, even not with a failure probability of less than 10–9. The absolute number of accidents will increase with rising numbers of vehicles in defined flight corridors and constant failure probability. Additionally, crashes will occur predominantly in populated areas, which causes a high relevance for humanity and, finally, public acceptance of the urban air mobility industry.

Recently presented eVTOL concepts do not seem to consider appropriate crashworthiness. The five vehicle concepts with the highest readiness and feasibility to come to market, according to the Advanced Air Mobility (AAM) Reality Index (ARI) by SMG [8], are Joby Aviation, Beta Technologies, Lilium, Volocopter, Wisk, and Archer (Fig. 1). Neither external energy-absorbing structures nor occupant protection is publicly communicated.

Fig. 1
figure 1

Latest eVTOL vehicle concepts with the highest readiness level according to ARI [8] (Image sources: Websites of the manufacturers)

Full size image

However, after EASA’s 2019 published VTOL regulation (SC-VTOL [9]), mainly based on helicopter and small airplane regulations, it can be assumed that future eVTOL vehicles focus on the same level of crashworthiness safety. This work proposes implementing a new safety approach that combines active and passive safety to improve eVTOL passengers’ life protection in case of a crash.

2 Mobility trade-off

Figure 2 depicts the mobility trade-off. It presents the key reasons people choose a specific transportation mode, inspired by passenger acceptance surveys and UAM studies [11,12,13]. People balance these six reasons in seconds before moving from A to B, mainly based on experience and habit. Nowadays, increasingly mobility applications help to identify, for example, the time to destination and costs. The mobility trade-off visualizes people’s reasons for choosing a transportation mode and illustrates its interrelations. If a mobility solution loses advantages in one category, another category needs to be improved. For example, if the transportation mode is more time-consuming, more expensive, or less safe, with an equal level in the other categories (excitement, sustainability, comfort and privacy), people will consider choosing another mobility solution. eVTOL offer advantages in time to destination compared to aircraft on short-distance flights due to reduced access and waiting time using vertiports. However, the time to destination advantage for eVTOL flight missions (short distance) compared to ground-based transportation modes is less than for most (long-distance) aircraft missions. Therefore, categories like comfort and privacy, and safety need to be improved for eVTOL to attract customers. How comfort and privacy, and safety can be improved and what eVTOL manufacturers can learn from the automotive industry is explained in the two following sections.

Fig. 2
figure 2

Key reasons to choose transportation mode [11,12,13,14]

Full size image

3 Design process

The following two sections describe general classic design processes for aircraft and passenger cars and highlight the branches’ different focuses.

3.1 Classic automotive design process

Automobiles are developed from the inside to the outside. Starting point is the passengers. The human body shows ergonomic and biomechanical limits, defining the customer-focused design approach’s boundary conditions.

During vehicle development, ergonomic design is subdivided into seven subject areas (seating, visibility, operating and display elements, sense of space, entry and exit, loading, and service). Package development describes the reserving of installation space for individual components and can be divided into two main topics: technical and ergonomic package development [10]. During technical development, it is important to reserve installation space for components considering the specific technical parameters. In the case of ergonomic package development, installation spaces are defined and reserved using ergonomic parameters in order to identify and resolve possible discrepancies with adjacent installation spaces at an early stage.

A vehicle is designed for specific percentiles. Percentiles describe the statistical distribution of anthropometric characteristics of the population. For example, the 5% male percentile describes the individual characteristics (e.g., height) that 5% of the male population between the ages of 18 and 65 possess. The choice of design for certain percentiles can differ depending on the manufacturer. Most commonly, interpretation is from the 5% female to the 95% male percentile, to represent approximately 95% of the population, or from the 2.5% female percentile to the 97.5% male percentile, to represent about 97.5% of the population [10].

3.1.1 Ergonomic development with a seat box

The methodology of creating seat boxes in the concept phases of a motor vehicle is widespread and has a long tradition. They consist of parts and controls needed to evaluate first concepts or collect suggestions for improvements before a drivable prototype is created. The respective design is represented in a physically assessable way by depicting parts of the exterior and interior. In particular, relationships that can be represented poorly or not at all in CAD, such as ingress and egress, the position of eyes, general sense of space, angling of extremities, and numerous other ergonomic aspects, are usually tested with a seat box (see Fig. 3). Nowadays, metal base structures are common. The components to be displayed are then mostly milled from hard foam and attached to this base structure [10].

Fig. 3
figure 3

Seat box of SkyCab eVTOL

Full size image

3.1.2 Safety

Safety plays a vital role in the development and homologation of passenger cars. Both the technical and ergonomic package are strongly influenced by safety systems like the life-cell, energy-absorbing structures, or interior requirements respecting, for example, airbags. The developments are indirectly driven by customers via consumer protection tests but also by regulations. The automotive industry soon reaches a turning point where the rapidly changing transition to electrified vehicles, with increasingly complex driver assistance systems, will finally culminate in self-driving vehicles. This will particularly impact the interior design and raise novel safety challenges. The impact of safety on the automotive design process is discussed in chapter 4 Crashworthiness of eVTOL.

3.2 Classic aircraft design process applied for eVTOLs

Sizing is the most critical step of the conceptual design phase [15]. During the sizing, the rough dimensions of a new aircraft, specified as the maximum take-off mass (MTOM), the maximum required thrust (T), respectively, power (P), and the wing area (S), are determined—only by considering a hand full of requirements and constraints. Typical requirements are range, payload, and mission profile. Several legal requirements often define constraints.

In today’s conceptual design, modeling is driven by empirical data. This approach allows designers to get results with reasonable accuracy in combination with a short turnaround time. Therefore, this level of fidelity allows designers to carry out full parametric multidisciplinary design optimization (MDO) studies. However, the results are only as good as the models. If certain effects of specific technology cannot be captured, the technology may skew the results too optimistic or too pessimistic.

It is possible to use advanced tools to optimize a part for its specific design point during detail design at the component level. These high-order methods still carry too much computation time penalty to be appropriate for conceptual design. However, there is a paradigm shift towards physics-based analytical models.

The development of an eVTOL air taxi brings several new challenges to the classic aircraft design approach. First, the lack of data and experience. Most eVTOL configurations are rather unconventional, often equipped with completely new power trains. Therefore, a physics-based analytical model is required for most parts of the design, even at very early design stages. Secondly, the importance of certain aspects of the design differs for most air taxis compared to aircraft. Aspects related to comfort and perceived safety become increasingly important. Here, procedures used in the automotive industry might be a good addition to procedures from the classic aircraft design approach. While the main focus of classic aircraft design is on technical requirements, e.g., flight performance and overall system weight, the automotive design process is particularly customer-focused. Introducing the automotive design process into the development of an air taxi might address at least some of the new challenges eVTOL air taxis face.

4 Crashworthiness of eVTOL

To evaluate the implementation of the automotive safety approach, the following sections describe the relevance of passive safety via analysis of aircraft accident statistics and customer perceptions. Industries’ regulation- and certification processes are compared, the balance between active and passive safety is highlighted, and finally, crash impact conditions are derived.

4.1 Relevance of passive safety

To evaluate the relevance of passive safety, the probability of a crash event compared to severity balanced against range and cost effects need to be researched. The following part analyzes the probability and severity of statistical data of commercial airplanes and helicopters. Moreover, the customer perception and influences of an impact on social acceptance are discussed.

4.1.1 Statistical analysis

Figs. A1 and A2 in the appendix show the occurrence rate of crashes for commercial airplanes and helicopters in Europe identified by EASA [16]. From about 100 up to approximately 155 fatal, non-fatal accidents and serious incidents happened between 2015 and 2019 with commercial airplanes. For commercial helicopters, the numbers range between 12 and 24. EASA also identified an accident rate per million flights ranging from two to four for commercial air-taxi airplanes from 2015 to 2019. The serious incident rate per million flights was identified with about 15 to 19 between 2016 and 2019. Applying these rates to a worldwide fully developed eVTOL industry would lead to 1.600 fatal accidents and 7.600 serious incidents in congested areas per year under the assumption that 160.000 units, as predicted by [1], conduct ten flights per day, 250 days per year.

4.1.2 Customer perception

eVTOL’s first layouts, especially the interiors, show a mix of small airplanes, helicopters, and passenger cars. This work suggests that eVTOL interiors need to be customer-focused, as reasoned by the Mobility Trade-Off. So, eVTOLs must be designed car-like with respect to ergonomics and interior packaging. Customers sitting in car-like surroundings are expected to demand car-like characteristics and, therefore, car-like crashworthiness. The first note on confirmation provides the Fraunhofer IAO acceptance study for the Volocopter from November 2020 [17], where 320 interviewees assessed the perception of safety. Key findings are that 75% of the respondents perceived the safety as “rather safe” without having sat in the vehicle, while 40% afterwards rated the perceived safety as “rather safe” until “safe”. 62% assessed a seat belt as a “very important” safety feature. EASA’s study on societal acceptance from May 2021 identifies safety as one main concern. Moreover, 49% of potential customers are influenceable by the vehicle’s quality [18]. Even though the study suggests ensuring a safety level equivalent to current aviation operations, both studies identify safety as a crucial factor and recommend further research on perceived safety. Especially the requested level of passive safety and the effects on customer perception are unexplored.

Therefore, a qualitative study was performed with 14 interviewees to identify the relevance and potential of passive safety systems. First, factors for perceived safety were determined. (see Fig. B1 in the appendix) The factors include the presence of pilots and staff, the process of flight procedure as well as passive and active safety systems. Furthermore, certified testing could be identified as a factor. A main challenge of the study is the absence of knowledge about protection potential and effects of passive safety systems among the probands. Therefore, the study participants are provided with a short explanation video, where mainly stroking seats, energy-absorbing structures and airbags are shown. In addition, drogue parachutes and motor rockets are introduced [19]. Thirteen attendees confirmed afterwards that the possibilities were unknown, and ten indicated to value passive safety measures. After the video was presented, nine out of fourteen were willing to pay for safety systems. Those nine would rather choose a more expensive provider with extended passive safety. Thirteen attendees admitted to have not been aware of passive safety systems.

However, history shows that public perception of safety is a crucial factor for success. Fatal accidents can cause the end of a whole industry, as New York Airways demonstrated with its scheduled passenger helicopter service operations in the late 1970s. Among other things, four fatal crashes caused the end of a rising helicopter commuter industry in those days. Similarly, the fatal accident of the Concorde put an end to an era. Even though it was not the only reason that the Concorde was taken out of service in 2003, the crash of Air France flight 4590 significantly reduced the trust of airlines and customers in the aircraft and had a major part in leading to its retirement [20].

4.2 Regulation and certification (in Europe)

4.2.1 eVTOL

Every air vehicle designed and manufactured in Europe requires European Union Aviation Safety Agency (EASA) certification. The latest certification document is the “Second Publication of Proposed Means of Compliance with the Special Condition VTOL” (MOC-2 SC-VTOL. Issue 1) from June 2021 [21]. It states together with “Means of Compliance with the Special Condition VTOL” (MOC-SC-VTOL. Issue2) [22] from May 2021 and “Special Condition Vertical Take-Off and Landing (VTOL) Aircraft” (SC-VTOL-01. Issue1) [9] from July 2019 the current state of eVTOL certification regulations. Here, paragraphs relevant to passive safety include emergency landing conditions, an energy storage drop test, and landing gear tests (limit drop test and reserve energy absorption drop test). Additionally, limitations of ultimate structural loads, regulations regarding ditching capability and bird strikes are defined. Specific requirements are mainly based on certification specifications for small (CS-27) and large rotorcrafts (CS-29) supplemented by “Certification Specifications for Normal-Category Aeroplanes” (CS-23). It includes component-based safety with requirements for seat structures (SC-VTOL.2270 based on CS-23/27.562) and the energy storage unit. Both requirements are based on an FAA study (DOT/FAA/CT-85/11) “Analysis of Rotorcraft Crash Dynamics for Development of Improved Crashworthiness Design Criteria”, where 1351 rotorcraft accidents between 1974 and 1978 were investigated to identify crash impact conditions [23].

4.2.2 Passenger cars

Passenger cars, on the contrary, are not just certified by component tests. Hereby, additional full-vehicle crash tests are used. On the one hand, these are requested by legislation and consumer protection organizations. On the other hand, these tests are self-imposed by manufacturers, with individually defined in-house standards, particularly for marketing reasons. Figure 4 shows an overview of nowadays typical full-vehicle crash load cases. [24, p. 1315] In Europe, about six legal full-vehicle crash tests for front, rear, and side impacts are required, besides four consumer and further pedestrian protection tests. Legal requirements are defined by the United Nations Economic Commission for Europe (UNECE), while Euro NCAP establishes consumer protection tests in Europe. The automotive industry’s history and numerous investigations prove the effectiveness of full-scale vehicle crash tests regularly.

Fig. 4
figure 4

(Source: AUDI AG)

Full-vehicle crash load cases

Full size image

4.3 Crash prevention vs. mitigation

Crash safety can be split into two fields, ‘active’ and ‘passive’ safety. Active safety describes systems that focus on avoiding crash events at all, while passive safety focuses on crash mitigation measures. Integral safety is the coordinated combination of both active and passive safety measures.

Current automobiles show well-developed crash mitigation measures, and the automotive industry has proven the effectiveness of passive safety over the last decades. One of the most important inventions has been the seat belt which caused a significant reduction in occupant fatality and injury rates. Even for high-velocity crash impact conditions as expected for eVTOL, Formula One race cars demonstrated crashworthiness’s effectiveness. While passive safety systems have improved occupant safety over the last 100 years, since 2010, the number of killed occupants is stagnating. Therefore, the automotive industry’s development focus shifts towards active safety potentials [25]. Current representative systems are occupant status monitoring (OSM), speed assist systems (SAS), lane support systems (LSS) and advanced emergency brake (AEB) systems.

For aviation, in contrast, history is the other way around. Active safety systems like cameras, radar, lidar, GPS and infrared scanners are measures already implemented and well developed in aircraft to prevent accidents. Whereas on the other hand, crash mitigation systems are barely investigated.eVTOL seems to base its safety features on rotorcraft and small airplane regulations and recommendations. The latest published European regulation for eVTOL (SC-VTOL) includes requirements for crash mitigation systems based on investigations made in 1989 for military rotorcrafts. Even though eVTOL are similar to rotorcrafts and capable of redundancy (better error safety) with an often-simpler architecture, novel energy storage systems, architectures, and missions raise the need to update and evaluate the relevance of passive safety.

EASA encourages eVTOL manufacturers to guarantee a failure rate of less than one catastrophic event per billion flight hours. This may seem like a very high safety standard, which makes passive safety obsolete, but considering that some experts predict a number of urban air mobility vehicles an order of magnitude greater than the current commercial aircraft fleet, the integration of passive safety makes perfect sense [26].

Figure 5 shows the effectiveness area of passive safety. The risk severity, which is the product of probability and consequences of an accident, from “low” to “very high” is depicted in a matrix layout for probabilities from “almost certain” to “rare” and for severity from “not significant” to “severe”. “Almost certain” to “possible” accidents are covered by active safety, while passive safety needs to cover unlikely accidents with major and severe accident consequences. The representative area implies a medium to high-risk severity.

Fig. 5
figure 5

Crashworthiness effectiveness area regarding probability and severity [27]

Full size image

4.4 Crash impact conditions

From a technical perspective, confidence in UAM safety is heavily dependent on crash probability and severity. To develop passive safety systems, crash impact conditions must be identified. Crash impact conditions are dependent on the crash scenario. Crash scenarios can be determined by two approaches. First, investigation of relevant accident air- and rotorcraft data and statistics, for example, of commercially used small airplanes and helicopters, and second, approximations and predictions of novel crash scenarios. Approximations and predictions can be based not only on aviation accident data and experience, (technical) failure modes and -rates, but also on future eVTOL mission analysis. (see Fig. C1 in the appendix) [28].

The most frequent fatal crash scenarios in the aviation industry are loss of control—in-flight (LOC-I), controlled flight into terrain (CFIT) and runway excursion (RE). Further categories are system/component failure or malfunction (SCF), abnormal runway contact (ARC), and undershoot/overshoot (USOS), according to ICAO [29,30,31].

With respect to eVTOL missions, the most critical phase will occur during the transition phase from hover to cruise mode. Three main reasons are a complex and undiscovered transition of lift mechanisms, the absence of kinetic energy in the vehicle system to operate a safe emergency landing and altitudes below minimum altitudes for the safe activation of ballistic recovery systems [7, p. 5] At the time of article writing, only a few aircraft are on the market that show transition phases, and thus data about transition phase’s risk and resulting impact conditions are rarely available, hence not evaluable. The second most critical phase will be the start- and landing phase, according to aviation accident statistics. [16, p. 42] Furthermore, low flight height (300–500 m) causes a reduced reaction time period to initiate an emergency landing and navigate to appropriate emergency ground conditions. The expansion of urban air mobility will increase the density of aviation vehicles in cities. This entails two major safety risks in particular. Mid-air collisions, particularly during cruise mode and emergency landings with differing ground conditions from just hard or soft soil.

Source [32] identified key hazards for electric aircraft architectures as battery thermal runaway and energy uncertainty, common mode power system failure, and vehicle automation failure.

Based on the above findings, three full-vehicle crash test configurations are derived and suggested (Appendix D: Fig. D1) to further investigate. Full-Vehicle Crash Test 1 is characterized by a vertical impact velocity of 10 m/s with a level vehicle attitude. The test covers particularly accidents resulting from complications during the transition as well as the start- and landing phases but also protects the occupants in any accident case resulting in vertical loads. Roll and pitch angle variations are based on the Aircraft Crash Survival Design Guide [33]. Full-Vehicle Crash Test 2 is a consequence of accidents, particularly resulting in combined impact conditions caused by low flight heights and results of advanced emergency landings. The vehicle’s attitude is again horizontal to the ground, and the velocity is 20% higher than the vehicle’s stall speed, with a trajectory pointing ten degrees downwards. While the loss of control in-flight (LOC-I) and flight into terrain are often fatal scenarios in aviation, passive safety measures may reach the limit of economic implementation due to confusing impact conditions and high velocities. Full-Vehicle Crash Test 3 covers frontal impacts, which are expected to rise, especially in urban areas. The test conditions are derived to depict a frontal impact against a rigid barrier with an impact velocity of 11 m/s. The representation of passengers is realized via the FAA Hybrid III 50 percentile dummy for crash tests one and two dues to the possibility of evaluating spine and lumbar loads. Only crash test three is equipped with four Thor 50 percentile dummies, which are the latest frontal impact dummies of the automotive industry.

5 Conclusion

The mobility trade-off shows the novel challenge and competitiveness of factors for eVTOL’s design process from a customer’s perspective. Because eVTOL compete with ground-based vehicles, customers’ needs move into focus. Those will request at least the same levels of key reasons to choose a transportation mode they are used to. That leads, among other requirements, to new challenges in integrating safety and comfort into eVTOL’s design process.

Nowadays, the design processes for aircraft show a technical-driven focus, while passenger cars show a customer-driven focus. Implementing the automotive design process consequently leads to a demand for higher passive safety and ergonomic standards. According to the automotive industry, an increased passive safety level can be achieved by implementing full-vehicle crash tests (automotive safety approach). That impacts the eVTOL’s design significantly. A fully comprehensive safety concept for eVTOL needs to include an energy-absorbing underbody and front structure, a rigid life-cell, airbags, a specific landing gear with compatible deforming seat structure, etc., to fulfill full-vehicle crash tests. Ergonomic requirements similar to ground-based vehicles enlarge the challenges of the package-, weight- and cost targets.

The relevance of passive safety is described by analyzing accident statistics and customers’ perceptions. The regulation and certification processes for both industries are compared, and the advantages of integral safety are described. After identifying possible impact conditions by analyzing statistics of aviation accidents and considering eVTOL-specific missions, three full-vehicle crash tests are derived.

The effect of applying standardized full-vehicle crash tests for eVTOL according to the automotive safety approach needs to be further investigated. Due to a lack of crash databases comparable to the automotive industry, computer-aided engineering methods need to be used to investigate possible crash scenarios, crash impact conditions, and resulting structural challenges for passenger protection. Finally, economic aspects, especially weight and cost targets, need to be carefully considered to develop a realistic integrated safety approach.

The authors recommend that both industries focus on a holistic, integral safety approach to use positive synergy effects between active and passive safety.