​Breaking New Ground: The Challenge of Certifying Autonomous Aircraft

Owing to the novelty of vertical takeoff and landing (VTOL) technology, the FAA is requiring air taxi developers such as Archer Aviation, Joby Aviation, and Beta Technologies to complete a gauntlet of testing. One of them, Boeing’s Wisk Aero, is building an aircraft that incorporates not just VTOL but another emerging technology—autonomy.

Unlike Archer’s Midnight, Joby’s S4, or Beta’s Alia, Wisk’s Generation 6 is designed to fly autonomously from the jump. The all-electric, four-passenger design will use a combination of computers, predictive hardware and software, radar, sensors, and ground links to fly predefined routes, which will be overseen by remote Multi-Vehicle Supervisors. According to Wisk, though, it will be able to detect and avoid other aircraft on its own.

This Article First Appeared in FLYING Magazine

If you’re not already a subscriber, what are you waiting for? Subscribe today to get the issue as soon as it is released in either Print or Digital formats.

Subscribe Now

Perhaps Wisk’s boldest claim is that autonomous operations will be as safe as—or safer than—piloted flight. Cindy Comer, the company’s vice president of SMS, certification, and quality, wants to prove that to the FAA.

In a Q&A with FLYING, Comer discussed just how Wisk plans to do it:

FLYING Magazine (FM): Wisk’s strategy is different from some of its competitors. Archer, Joby, and Beta are looking to fly autonomous eventually, but not at launch. Companies like Reliable Robotics and Merlin Labs are retrofitting aircraft with autonomy. What would you say are the advantages of the pathway that Wisk is taking—flying a clean-sheet autonomous aircraft at launch, even if it means that you might launch after some of your competitors?

Cindy Comer (CC): I was at Merlin previously, so I’ve gotten an insight into the world of retrofitting an aircraft with an autonomous solution. Putting autonomy into an already existing airplane is really hard. You can switch some things out. But you’re going to be making concessions here and there. You need to have a partnership with the OEM, because you need to understand the safety data and the assumptions that were made when that plane was built. And that stuff’s really hard to get, especially with an older plane.

• READ MORE: Boeing’s Wisk Self-Flying Air Taxi Makes First Flight
• READ MORE: Former Army Aviator Champions Safety Reform After Son’s Fatal Collision

We know that eventually, to scale, this industry needs to have autonomy. We could build an aircraft and put pilots in it, and then later go autonomous. But we don’t want to have to redesign anything. We don’t want to have to go back and reevaluate our assumptions, reevaluate our safety assessments, to say, ‘Did we meet the right safety levels when we first built this aircraft in order to do this?’ So we’ve decided to just eat the elephant and go autonomy first.

Joby, Archer, Beta, all of those folks, they’re working through how to certify an eVTOL aircraft with the FAA. We want them to succeed, and I’m sure they want us to succeed, because we need the FAA to be moving forward with these policies and frameworks for us to fit into the space.

FM: Some U.S. air taxi developers say they are getting close to type inspection authorization (TIA) testing, when they’ll need to demonstrate maneuvers like crewed transition from hover to forward flight for the FAA. With the Generation 6’s autonomy, will the FAA require Wisk to complete any special testing?

CC: I don’t know that I would call it special testing. The way that a certification program works is you identify your intended functions, the FAA identifies their intended safety or airworthiness criteria, and then you make sure that you’re meeting the safety criteria with your intended functions. You’re required to test all of those functions, regardless of what they are.

So will there be additional testing for us? Yes, because we have a ground station, Multi-Vehicle Supervisor, and functions that a pilot won’t be doing. These other aircraft, they still have to test those functions, but they’re doing them in a slightly different way than we will. We’ll use the same evaluation methods that every other program uses, whether it’s test, simulation—all of the methods that you can use to show compliance to the FAA regulations. There are just more functions that we need to show.

FM: In advance of TIA testing, companies like Wisk are doing their own internal testing. Do you have an internal curriculum that you’re looking to meet before advancing to TIA?

CC: For sure. We have our preproduction prototype aircraft that we’re working on now, and we’ll be flying those quite a bit to see if we want to make any design changes as we move into the meat of the program.

Then we have the component testing. We test all of the components on the ground, in labs, in wind tunnels. Then we’ll move into more formal compliance showings with the FAA, all the way into TIA and beyond.

But, yes, there is a lot of testing that we’ll do. And we want to do simulation in addition to that testing to safely check out all of those edge cases that we can think of. We don’t necessarily want to put our aircraft in that situation in every case. A lot of them we will, because we need to see how it’s going to respond. But the really dangerous ones we want to do in simulation.

FM: So you view simulator testing as additive to actual flight testing?

CC: Yes, I do. There is a world, maybe somewhere in the future, where you could start using simulations to cut down on testing. I don’t think we’re there right now, especially when we’re introducing new technology and we’re taking the pilot out. It may be totally safe, but I don’t think it’s going to win hearts and minds. I think we need to do the actual testing and prove to everybody—us, the FAA, the public—that this is the real deal, and the simulation is a bonus.

FM: Will Wisk certify its autonomy system as part of the aircraft, or will it seek a separate certification?

CC: I wouldn’t say that we have an autonomy system. We have a group of systems that form the autonomy functions. I actually like to call them automated instead of autonomy, because that word is very loaded. Transport aircraft that are flying today, 737s and A350s, have these systems as well.

We have computers that manage flight, flight controls, contingency management, mission management. All of those things are critical to flying an autonomous aircraft. But we view them as their own systems. If you need to make changes, you don’t want to have to test the entire airplane’s worth of software. You want to test it system by system, and then you want to test the interfaces to ensure that you have covered all aspects of that function and system, and there are no adverse effects due to the changes.

We haven’t talked about certifying any of these systems out to the world. Will we do it in the future? Maybe. I think that we have some technology that would be hugely beneficial to use in other aircraft as safety enhancing equipment, not necessarily to replace pilots. I think there are things that we could bring to other types of aircraft that would be very beneficial to the industry and to the safety of our airspace.

But right now, we are all-in on getting our Gen 6 certified, and we’ve chosen to do that as one certification instead of breaking it up.

FM: There’s an opportunity coming up to test some of your autonomy in a real-world setting through the FAA’s eVTOL Integration Pilot Program (eIPP). What are you looking to get out of that program if selected?

CC: Let’s start with what the FAA and DOT are trying to get out of it. They’re trying to learn what advanced air mobility is going to look like in our existing airspace, and what they are OK allowing.

We want to be flying our aircraft in real airspace—not restricted airspace—and seeing how we fit. It’s an opportunity to see how we integrate with piloted eVTOL, unpiloted traditional aircraft, and piloted traditional aircraft that are out there today. We’re going to pretend it’s real. We’re working with real ATC. We’re working with real ground infrastructure and airports. And we get to do it before we enter service.

My personal hope is that we can combine this with some of our TIA testing so that we’re doing the flying, and we’re learning a lot from it, but we’re also getting credit toward our certification program. We’re going to have to do all of this anyway. But if we can do it in that space, it’s kind of like a two birds, one stone situation.

FM: Could those eIPP operations include flights into airports?

CC: I think we have to. Will it be into one of the core 30 airports? I don’t know. But I have to believe we’re coming into airports.

FM: What would you say will be the biggest remaining hurdle for Wisk as you prepare for commercial launch?

CC: I think the biggest hurdle is integrating an autonomous aircraft into an airspace. I think there’s a hurdle of integrating an eVTOL into the airspace, and then there’s the autonomous piece. It’s figuring out what’s the right way to fly in the airspace the way it is today, because that’s the airspace we’re going to be entering. How do we best engage with air traffic control so that we don’t increase their workload, but they’re aware and engaged in our flights as much as they need to be? I think that is the biggest hurdle. 

---

This column first appeared in the March Issue 968 of the FLYING print edition.