eVTOL crashworthiness simulation that supports your certification evidence
Crashworthiness is shown with evidence, and simulation belongs in that evidence only where it has been correlated with tests. What SC-VTOL asks for, how a building-block programme supports it, and where AI saves test articles and where it cannot.
eVTOL crashworthiness is shown to the authority with evidence, and simulation earns a place in that evidence only where each model has been correlated with tests at coupon, element and sub-assembly level. Used that way it plans the expensive tests, explains their results and covers impact attitudes you cannot afford to test, with the credit it may take agreed with the authority in your certification programme.
A crash test article is a flight-weight airframe with a battery pack inside, and you will have very few of them. The decisions that decide the result come earlier: where the pack sits relative to the seats, how stiff the floor is, what the lower shell may crush. When a sub-assembly test shows a moving pack or a high seat pulse, the remedy is new composite tooling and a moved certification date. The design-review questions are plain. Will the pack stay intact? Which impact attitude is worst? How many tests do we need?
What do SC-VTOL and the FAA ask for in an emergency landing?
EASA's Special Condition for small-category VTOL-capable aircraft (SC-VTOL) is published with its means of compliance. EASA's Easy Access Rules for small category VCA consolidate them: Revision 0 of May 2024 incorporates SC VTOL Issue 2 and the MOC issues published to date. It applies to person-carrying VTOL-capable aircraft in the small category, with a passenger seating configuration of 9 or less and a maximum certified take-off mass of 5 700 kg or less (VTOL.2005). Category Basic requires a controlled emergency landing, in which some damage may occur, and Category Enhanced continued safe flight and landing.
VTOL.2270 says that the aircraft, even when damaged in an emergency landing, must protect each occupant against injury that would preclude egress. That applies when the occupant uses the safety equipment, experiences the ultimate static inertia loads likely in an emergency landing, and when items of mass, including lift/thrust units, within or adjacent to the cabin experience the same loads. The conditions must include likely dynamic conditions and must not generate occupant loads that exceed established human-injury criteria. The same text appears in 14 CFR 23.2270 for normal category airplanes.
The means of compliance accepts the CS 27.561 and CS 27.562 provisions for small rotorcraft, with "energy storage systems" replacing fuel tanks. It then adds a caution that matters for eVTOL. The 30 g at seat attachment level was based on the typical underfloor structure of a conventional rotorcraft, so it is valid only if the structure under the seats has equal or better damping. With specific design features, less than 30 g at the seat may be acceptable "based on analysis supported by tests". For batteries, MOC VTOL.2325(a)(4) sets a drop test from at least 15.2 m onto a non-deforming surface, with the pack in a representative surrounding structure. Afterwards there should be no fire, or any fire or harmful release should be contained for at least 15 minutes in non-occupied areas and outside the evacuation path.
The FAA certificates powered-lift aircraft under special class criteria written per aircraft. The FAA's final special class airworthiness criteria for the Joby Model JAS4-1 (89 FR 17230, 8 March 2024) apply 23.2270 to that model and require its energy-storage system to retain energy and to minimise hazards to occupants and first responders after a survivable impact. Those criteria belong to one applicant, so check the ones issued for yours. Neither text, as we read it, hands you certification by analysis: EASA's MOC on simulation and rig tests states that it does not apply to the compliance demonstration of structural requirements, where emergency landing sits. Whether and how analysis counts is settled with the authority in your certification programme. Our pages on eVTOL and UAM crashworthiness certification and EASA and the eVTOL, VTOL and UAM hub cover the context.
Why is eVTOL crashworthiness different from a helicopter's?
Helicopter crash design grew around a known layout: fuel low, a deep underfloor, aluminium that bends. An eVTOL changes that.
- The heavy item is in the load path. A pack under the floor takes stroke the seat needs. A pack or motor behind the occupants is an item of mass adjacent to the cabin, with its own ultimate-load requirement.
- Composites absorb energy differently. A composite shell does not yield. It absorbs energy by progressive crushing, fracture and delamination, so the force-stroke curve depends on laminate, trigger geometry and joints.
- The energy is simple and the stroke is short. A low vertical descent leaves E = ½mv² to absorb. Over a stroke s the mean force is about mv²/2s.
- The battery adds a second failure. The pack must not rupture, vent into the cabin or ignite, which links crash to thermal runaway.
- Seat and restraint are part of the structure. The seat is the last stroke before the occupant and must not create a hazard of its own.
- Ground contact. The first load enters at the skids or gear. Impact speed and attitude set how it is shared between them and the belly, and the attitude that is worst for the pack is not always the worst for the seat.
- Crushable lower structure. A composite airframe absorbs energy by progressive crushing and fracture of its lower shell, not by yielding. The stroke available here is what sets the force that continues upward, so it is shared with the battery bay above it.
- Battery bay. The pack is a heavy, stiff block in the load path. It has to stay intact and attached while the structure around it deforms, and its stiffness changes the pulse seen by the floor.
- Floor and seat attachments. Whatever the lower structure lets through arrives as a pulse at the floor, and the seat attachments carry it into the seat. Local stiffness here decides whether the seat sees a peak or a plateau.
- Seat and energy absorber. The seat can add stroke by absorbing energy in its legs or cushion, which limits what reaches the occupant. It has to be designed as part of the same load path, not as a catalogue item.
- Occupant and restraint. The restraint couples the body to the seat. Injury is judged on the loads the occupant experiences, against the human-injury criteria agreed for the programme, not on the structure alone.
- Mass behind and above. A motor, a wing carry-through or other heavy items near the cabin must stay in place under the emergency landing loads. They are inertial loads on their attachments and a hazard if they break free.
How is eVTOL crash simulation usually done, and where does it break?
Often a full-vehicle explicit model is built late, to match the one drop test that exists. Crush parameters are tuned until the pulse looks right. The model then matches that test and nothing else, because the parameters absorbed errors in mesh, contact and material. Scatter is not carried, and the comparison is a slide rather than a record. When the authority asks how the model was validated, the honest answer is that it was fitted.
How does the building-block approach support eVTOL crashworthiness certification?
The remedy is to climb the levels in order, attempting each only after the model has passed the one below.
- Coupons. Laminate, adhesive and fastener coupons give the material and interface properties, and the effect of loading rate and temperature. They are cheap enough to run in numbers, so they are where scatter is measured rather than assumed.
- Elements and joints. Crush tubes, corrugations, frames and bonded or bolted joints show how the composite absorbs energy by progressive crushing and fracture. The crush parameters that cannot be read from a coupon are calibrated here, with their uncertainty.
- Sub-assembly. A floor section with battery bay and seat is the first level at which load path, stroke and pack all interact. The model predicts the test before it is run, and the result is compared with the prediction, not used to tune it.
- Full vehicle. Few tests, in a chosen attitude, on an article that costs most and arrives last. Its job is to confirm what the lower levels already support, not to discover it.
- Correlation gate. Before the next level is attempted, the model is compared with the test on metrics and tolerances written down beforehand, and the comparison is stored with the model version. A level that fails its gate is fixed at its own scale.
- Credit and uncertainty. Scatter and impact attitude travel upward with the model. How much credit analysis may take at each level is agreed with the authority in the certification programme, not assumed.
At coupon and element level we calibrate and validate material and joint models in LS-DYNA or Abaqus/Explicit. Composite crush is hard because the parameters that control it, such as softening and the strain at which elements are removed, cannot be measured directly and depend on mesh size. We calibrate them on crush elements, with their uncertainty, then fix them; see composite material simulation across scales. At sub-assembly level the model predicts the test before it is run, and the comparison is judged on metrics set in advance, as in our crash model credibility checklist.
Two uncertainties need their own treatment. Material scatter is real in a laminate, and EASA's special factor of safety (VTOL.2265) applies where a design value is uncertain or subject to appreciable variability. Impact attitude is the other: the worst case for the pack is rarely the worst for the seat, so a sweep beats one nominal case. The Crash Certification by Analysis - Are We There Yet? (Jackson, Fasanella and Lyle, 2006) names the issues: model validation procedures, uncertainty in test data and models, and probabilistic test-analysis correlation.
On occupant injury we say only what the text says. VTOL.2270 refers to established human-injury criteria without naming them, so the criteria, manikin and tolerances are part of what you agree for the programme, and we quote no limit here.
| Question | What simulation contributes | The evidence behind it |
|---|---|---|
| Does the structure under the seat limit the pulse? | Sub-assembly explicit model, swept over attitude | Dynamic test of a floor and seat section |
| Does the battery pack survive the impact? | Pack in its representative surround, to choose the worst orientation and the weak joint | Pack drop test as the MOC describes |
| Do heavy items behind the cabin stay attached? | Inertial load cases on attachments and joints | Joint and element tests, with scatter |
| Is the seat and restraint a hazard in itself? | Seat model with occupant surrogate | Seat dynamic test |
| Which attitudes and cases do we test at all? | Screening with a validated surrogate | Correlation of the full model at the cases chosen |
| What credit can analysis take? | Nothing by itself | Agreement with the authority in the programme |
A full-vehicle model tuned to one drop is not validation
How do you assess eVTOL battery crash safety by simulation?
The model follows the pack, its mounts and the surrounding shell through the pulse and asks where intrusion, cell loading, connector strain and venting paths appear. The drop test in the MOC remains the demonstration, so the model's role is to choose the orientation and installation worth testing and to explain what the test shows. The thermal consequence continues in propagation modelling.
Where does AI help eVTOL crash work, and where does it not?
- Surrogates for sweeps. A surrogate trained on a planned set of sub-assembly runs gives seat pulse and pack load against impact attitude, speed and mass, so hundreds of cases are screened and the critical ones are run in the full model. See surrogate models for CFD and FEA.
- Calibration with uncertainty. Fitting composite crush parameters to element tests is an inverse problem. Bayesian calibration returns the parameters with their uncertainty, which then propagates to the prediction.
- Test-plan design. Choosing the next coupon, element or attitude by how much it would reduce the uncertainty that matters shows which test articles are worth building.
It does not replace the validation evidence. A surrogate learns only what its training runs contain and extrapolates poorly to a new laminate or layout. We state its range and gate it, as in AI surrogate models you can sign off.
From one drop-test campaign to an evidence workflow you keep
A model built for one test article answers one question. The larger return comes when the same steps repeat for every sub-assembly and design iteration, so each new floor or pack layout starts from checked inputs and ends with a stored comparison against test.
- Physics model. CFD and FEA set up once, as templates: geometry clean-up, mesh, solver settings and post-processing that every later run reuses.
- Validation. Mesh and time-step studies, and comparison with tests or full-scale data, so the model's uncertainty is known before it is trusted.
- Automated runs. Scripted runs over the parameters and operating conditions that matter, on your hardware or in the cloud.
- AI surrogate. A machine-learning model trained on those runs answers in seconds and says how sure it is; low-confidence questions go back to the solver.
- Decision tool. Optimisation, trade-off charts or operating guidance, in a form your engineers and operators use every day.
- Field data. Test, trial and monitoring data flow back to recalibrate the model, so it improves with every project instead of being rebuilt.
- A validated material and joint library. Laminate, adhesive and fastener cards with the coupon and element tests behind each parameter, the scatter measured, and the date and version they were last checked.
- Templated sub-assembly models for floor, battery bay and seat in your explicit solver, so a new layout is set up from a template with the same contact, element and output definitions every time.
- Correlation records. For each test, the prediction made beforehand, the measured result, the metrics and tolerances agreed in advance, and the model version, stored together and reviewable.
- A surrogate with a stated range for pulse and pack load against impact attitude, speed and mass, with a gate that sends any request outside its training range back to the full model.
- Handover and training, so your own engineers can extend the library and run the templates. See our training and software development services.
Questions engineers ask about eVTOL crashworthiness
What does SC-VTOL require for an emergency landing?
Can eVTOL crashworthiness be certified by analysis?
How is the battery assessed for a crash?
What do you need from us to start?
If an eVTOL programme is on your desk, send us the floor and battery bay layout, the laminate specification and the test matrix you have proposed, together with any element tests you already hold. We will reply with a gap list: which correlation gates exist, which are missing, which parameters to calibrate first, and where a surrogate would save test articles. Start with a conversation.
