MOC VTOL.2425(b) Shutdown and Restart of a Lift/Thrust Unit in Flight

A lift/thrust unit may be shut down during VTOL operation in some particular failure cases (overspeed condition, erratic operation…) or in the event of energy starvation. In the event of failure, this shutdown can be automatically triggered by the control system or manually triggered by the flight crew as a result of the application of an emergency operating procedure. The shutdown can affect several whole lift/thrust units or only one of its sub-systems, e.g. one electric engine.

(a)     In any case, there should be means to isolate the lift/thrust system as requested per VTOL.2440.

(b)     Special care should be taken of distributed propulsion systems incorporating a large number of lift/thrust units. Human error, such as the shutdown of the wrong lift/thrust unit by the pilot, should be avoided by adequate design solutions and an appropriate human factors evaluation.

(c)      The phrase “if the safety benefit outweighs the hazard” employed in VTOL.2425(b) is related to the capability to restart (or relight in the case of an internal combustion engine) a lift/thrust unit.

It is often worthwhile that the aircraft system allows the restart or the relight (in case an internal-combustion engine is part of the lift/thrust system) of the lift/thrust unit that has been shut down.

However, this restart/relight capability should not be systematically the safest option to offer to the flight crew as it could also create hazards to the aircraft. The applicant should therefore establish an associated failure scenario to determine if it is in the interest of safety to perform a restart and relight.

(d)     In performing the assessment in (c), the applicant should take into account the following elements:

(1)     The aircraft performances and handling qualities:

Is a continued safe flight and landing possible without restarting/relighting the lift/thrust unit that has been shut down? If not, there should be means to restart/relight the shutdown lift/thrust unit (automatically or by the flight crew).

(2)     The associated hazards:

Does the restart/relight of the shutdown lift/thrust unit allow a continued safe flight and landing? The following two examples are provided for clarification:

(i)      One electric engine is shut down on a VTOL equipped with several electric engines. On the one hand, the aircraft flight control system detects the engine shutdown and adjusts the flight control laws in order to perform a continued safe flight and landing. On the other hand, a restart of the shutdown electric engine is performed automatically, which may lead to aircraft transient attitude changes due to the flight control system adjustments. This may surprise the flight crew which could be detrimental in situations such as the final approach. In such situations, if automatic engine restart/relight capabilities are provided to the VTOL, the system capability should enable the crew to make a final decision whether to activate this function or not.

(ii)     An electric engine is shut down due to friction caused by a bearing damage. Vibrations are detected and the engine is shutdown. The restart of such engine may lead to sparks (with the associated fire risk), high vibration levels or other phenomena that could impair the safety of the aircraft. Such severe bearing damage should be detectable so as to prevent from restart/relight.

(3)     Human factors

VTOL concepts are often designed around a significant number of lift/thrust units. The applicant should assess if manual operating procedures to restart or relight a shutdown lift/thrust unit are compatible with the workload of the flight crew or if the procedures should be automated, and what are the possibilities of erroneous manipulation of the lift/thrust unit controls during a restart/relight performed by the flight crew, as well as possible ways of mitigating them by design.

Note: Standard systems safety assessment and flight crew error assessment contain specific methodologies to identify and mitigate hazards presented by restarting a lift/thrust unit in flight.