Flow provides new-age engineering companies with a requirements tool that is built specifically for their needs and allows them to focus on engineering ground breaking products.

Agile for Safety-Critical Systems—Faster, Safer, and More Reliable — [Read now→](/blog/agile-for-safety-critical-system-faster-safer-and-more-reliable/)

Open Graph sharing image

Flow Engineering

Twitter Image

Advances in lithium ion battery technology over the last decade have been embraced by engineers to dream up so many new types of product, but one of the sectors with the most intense competition is electric VTOL aircraft. There is a proliferation of new companies (and old) chasing the dream first popularised in the 60's with the Jetsons. Everyone is hoping to be first to market with a fully certified product and any hiccup along the way can have wide ranging consequence for who comes out on top.

![Frame 267](//images.ctfassets.net/c2mtbunjxyfe/4546zTonBEeun7Exh3LE4F/0e46ca2bd9575ae38e85759a0e4af2f8/Frame_267.jpg)

In early August, UK based Vertical Aero had exactly the type of issue that could set their programme back by months when their prototype called the VX4 crashed during remotely piloted flight testing. No one was hurt, and in many ways testing is precisely for the purpose of uncovering unknown considerations and interactions in a complex design. However perceptions of such an event and the narrative that surrounds them can be hard to control.

![Mask group (5)](//images.ctfassets.net/c2mtbunjxyfe/1ZOkrpNBKElgM5TSBmtFf/b2932fe9d944c41c3ede86dd43b5804c/Mask_group__5_.png)

The VX4 is a full scale prototype electric VTOL air taxi. It is designed for transporting a pilot and up to four passengers distances of up to 100 miles, and reaching top speeds of 150 miles per hour using 1MW of electric power. Flight is achieved using two lifting 4 blade props at at the trailing edge of each wing and two units of a 5 blade tilting prop at the leading edge of each wing for a combination of lift and forward thrust.

In the interests of time and cost, Vertical are running an intensive flight testing programme in parallel to the ever evolving detailed design work on what will become the production ready specification of the aircraft. This strategy makes sense to get to market in the shortest possible time, but it also means that many of the details that lead to the VX4's crash in testing do not read across to the production variant of the aircraft.

Let's walk through what happened and what we can learn.

The prototype VX4 achieved its first tethered hover in 2022 in a hangar at Cotswold Airport UK with a pilot onboard.

The flight that crashed on the 9th August 2023 was 18 test flights into the test programme from the initial tethered hover. It involved a series of manoeuvres and test procedures outdoors that were carried out unmanned. At the time of the incident the aircraft was hovering at about 6m and conducting test shutdowns of engines in order to verify that the control algorithms for the remaining engines would automatically adjust to the loss of a prop and maintain a level hover.

The following diagram outlines the steps that led to the crash:

![Vertical Crash 1 (2)](//images.ctfassets.net/c2mtbunjxyfe/3zUlqLKoDuREsaNyB9tExq/be7f9e64d53d45f97942a19e73fee0e1/Vertical_Crash_1__2_.png)

1. The left hand outboard tilting prop was disabled as part of the test to simulate a failure and to check that the aircraft was able to correctly adapt.

2. The first unexpected event occurred when a blade failed on the right hand inboard tilting prop. We do not know the details of the design or manufacturing fault that caused this blade to fail. Full details will probably be released with the final CAA (Civil Aviation Authority) report into the incident, but for now all we have to go on are comments made by Vertical themselves. What we do know is that they believe the failure to have been to do with some kind of bonding process within the blade and that a redesign of the component had already taken place before this incident even occurred to eliminate the problematic feature or process. Vertical have stated that no future aircraft will fly with this particular design of blade.

3. The imbalanced load on the prop due to the blade failure almost instantaneously led to the failure of the pylon that supports the prop and its electric motor. Vertical have stated that this failure mode was expected and inline with what their simulations suggested would happen in an blade-off event.

4. The safety system that shuts down a prop due to excessive vibration successfully shut down the right hand inboard tilting prop.

5. Even though the left hand outboard tilting prop had been manually shut down for the sake of the test, the aircraft's safety systems successfully overrode this and restarted the prop in an attempt to maintain flight.

6. The second unexpected interaction that occurred was a fault on the electrical CAN BUS that controls the props in the right hand wing. This occurred specifically due to the pylon failure.

7. The CAN BUS fault resulted in degraded power output from the remaining props on the right hand side of the aircraft. This loss of power was the direct cause of the VX4 coming down.

8. Below is a photo of the VX4 shortly after the crash. You can see that the right hand wing has broken outboard of the first pylon. This failure is along the designed-in failure plane and is inline with simulation results.

![Mask group (8)](//images.ctfassets.net/c2mtbunjxyfe/4Z03EYOxIi5F8taCp5rDlo/a15182bcdf0f8e488477bf4f9024e187/Mask_group__8_.png)

What can we learn from this set of events? There are lessons at multiple different levels of abstraction, from the detailed to the big picture.

At the most detailed there are clearly design and manufacturing lessons to be learned about the design of the rotor blades. We will probably find out more from the CAA report. Needless to say that blade design for this kind of craft is tricky and detailed.

There are thin aerodynamic sections, incredibly high loads, a need to keep the rotating mass low, and the interaction of several different materials. As an example here is a cross section of a regular turboprop composite propeller blade:

![Turboprop 1 (2)](//images.ctfassets.net/c2mtbunjxyfe/3y6XpiOplJKx8pg0RPYtFN/e383f01b8c9725350057499bfad7c988/Turboprop_1__2_.png)

One level up we have the fault that occurred with the CAN BUS due to the pylon failure. This one is also tricky to assess. A case could be made that it is a failure of the requirements process, where a risk (pylon failure) was not sufficiently decomposed into derived safety requirements such as "Aircraft CAN BUS system must have sufficient redundancy to remain fault free during a pylon failure". This is where tools to help users discover second and third order dependencies between their requirements can really come into play. 

However once again we do not know the full details of which risks surrounding the CAN BUS were captured and which were not. Sometimes the exact purpose of testing is to uncover complex and unforeseen interactions such as this so there could easily be an argument that the entire testing process worked well in this case.

The main upshot of this failure is a likely pushback to Vertical's certification target date. It was already revised from 2024 to 2025 last year, and then pushed to 2026 in May. Prior to this accident the next steps in the test programme were supposed to be full-scale crewed flight tests, but understandably all test flying has reportedly been paused. Vertical only have one test aircraft available, and they will need to spend some time working closely with the air accidents investigation branch prior to restarting their programme. Expect a further delay to the anticipated certification date to follow.

However creating a new category of aircraft and achieving a type certificate are hard. Vertical's competitors have also seen setbacks. The U.S. based Joby Aviation (who are one of the best funded players in the space) suffered an eVTOL crash during autonomous flight in 2022 and had to delay its programme as a result. We still know very few details from the investigation into this accident. Germany's Lilium also extended its certification timeline by 12 months last year to 2025, citing supply chain disruption and the need to do more thorough design verification.


Agile Engineering Newsletter

Monthly lessons and examples on building better iterative engineering cultures from teams like SpaceX, Stoke and Impulse Space.

Product

Company

Legal

Resources