6 ms·

The anti-safety culture is kind of surprising. When they made previous announcements I thought that safety was what they were bringing to the table. Autonomous

The anti-safety culture is kind of surprising. When they made previous announcements I thought that safety was what they were bringing to the table. Autonomous drones, even large scale ones, are pretty ubiquitous at this point. People are building human-scale drones using off the shelf equipment in their back gardens. The thing they're all lacking is properly safety certified electronics. I would have thought the thing a project with deep pockets like kitty hawk would bring would be the huge effort required to build a certifiably safe done. Having worked in other hardware startups though, I'm guessing what actually happened was a few years of reinventing the wheel and learning on the job. Safe systems don't look any different to non safe systems to an outsider, so unless there's a real buy in from management it's very hard to build them.

crocal 7y ago
Before talking about anti-safety culture, I observed that the real issue in a purely hardware/software-driven culture is that people focus on technology. For safety systems, this usually fails / overbudgets because there needs to be some systems thinking /before/ about why and how the proposed system can be declared safe. In the case of drones, I am afraid that the systems design to make these devices acceptably safe is yet to be formulated (Note: these are not planes, they fly close to the ground so they do not benefit from the safety of altitude to have time to react in case of failure)
- TheSpiceIsLife 7y ago
  Helicopters are certifiable for carrying passengers, and yet take offs and landings have no altitude nor speed benefits. In what way do multirotors / drones differ?
  - TeMPOraL 7y ago
    I know exactly nothing about aircraft safety, but since this is HN, I want to throw out a guess: in case of landing, could it be that helicopters make the blades spin very fast prior to beginning the landing maneuver, compensating for extra lift with pitch control, and then keep them spinning fast throughout the entire landing process, and brake them only after touchdown? This would, in my mind, let them do a soft touchdown via autorotation in case of sudden engine failure at any point of the landing maneuver (at least if the pilot has fast enough reflexes).
    - TheSpiceIsLife 7y ago
      That does sound like a reasonable guess. Can anyone with more knowledge chime in? I’m off to bed, otherwise I’d try looking in to it.
    - Already__Taken 7y ago
      I'm going to go on a limb here, you'd need to put enough energy into the rotors of: helicopter weight * recovery time (so distance * descent rate) * gravity². that is a big number to get rotor mass * rpm to equal.
      - TeMPOraL 7y ago
        Autorotation is already the standard emergency landing practice in case of loss of engine power mid-flight; I'm only guessing that landings could be performed in such a way as to maintain the capability for autorotation throughout the maneuver.
        Already__Taken 7y ago
        That's what I was trying to explain, that energy to maintain rotor speed in an autorotation is stored in the height. To replace that is a damn big number you're putting somewhere else. Maybe landing rockets like the soyuz.
    - dreamcompiler 7y ago
      In theory, yes. In practice the blades don't have enough angular momentum for this to work longer than a very short time, which is why the first step a pilot must take upon engine failure is to slam the collective down so the air flowing past the blades will keep them spinning in the same direction. Some helicopters with very heavy blades with lots of angular momentum have been built, but it makes the blades heavy which requires a more powerful engine which makes the whole craft heavier which means you need even more angular momentum...you get the idea. It's an engineering nightmare so it's atypical.
  - mnw21cam 7y ago
    If the engine fails in a helicopter, and you have enough altitude, you can autorotate the rotors for a soft landing. It's the helicopter equivalent of gliding in a fixed wing aircraft. The danger potential is similar to a fixed wing aircraft - landing and takeoff are the critical stages, but normal flight gives plenty of opportunity for a safe-ish forced landing. A multirotor on the other had doesn't have the ability to glide, like a fixed wing or a helicopter. Any safety will have to be engineered in by making sure that a single rotor failure (or even multiple) can be coped with correctly and reliably.
    - tonyarkles 7y ago
      I suffered a battery lead failure on a large hexcopter this summer at ~27 ft. It was spectacularly destructive to the airframe. Had it been a motor/prop/ESC, it would have had enough thrust to land (awkwardly), but cutting power to all 6 motors at the same time (flight controller has a separate battery)... not recoverable.
  - Nasrudith 7y ago
    I know copters have autostability as their benefit - the big rotor has inertia on its side and keeps it aloft and even a loss of power would fall slower. Multirotors I believe require active control of every individual rotor instead of straightforward big angular momentum. Which I believe is part of why they are seen on drones.
    - tonyarkles 7y ago
      Riffing on this a little bit based on my experiences with multirotors but not having any kind of "autorotation" capability with them: Most motors on multirotors are BLDC motors that require active control to make them spin. Voltage gets applied to the motor phases sequentially to make it spin. However, when they're completely open-circuit, they actually spin quite freely! I've seen the ones I had (26" prop) windmill quite well in a mild breeze. The trick, though is that you're probably not going to get much descent-arrest out of open-circuit BLDCs. Another possibility is short-circuited BLDCs; in that condition, the rotos are quite tough to turn. My speculation is that the props wouldn't spin much at all in a short-circuit condition. Buuuuut... if ESCs were able to modulate the open/short-circuit condition (even without power to actively spin the motors), I suspect you might be able to get some kind of arrested descent situation. I've been thinking of building an ESC from scratch this winter... this might be a useful feature to experiement with!
  - blattimwind 7y ago
    Helicopters have a height-velocity diagram with some areas marked unsafe (low speed, low altitude); when operating in the forbidden areas a pilot cannot be reasonably expected to perform an emergency landing using autoration following complete engine loss. In all other areas this should be possible. Coincidentally, that's why helicopters avoid taking off vertically (they only do that in video games...); they want to gain some speed before gaining significant altitude, because forward speed helps autorotation. If a helicopter just climbs straight up at zero speed and the engine goes out, it's going to fall pretty much like a rock. Average multicopter designs would seem to be incapable of autorotation for aerodynamic and technical reasons. The technical reason being that the BLDC motors used are typically permanent magnet synchronous machines, which develop significant holding torque in most (driver) failure modes and there is no clutch to disconnect the motor from the propeller.
    - dreamcompiler 7y ago
      There's also typically* no collective pitch control in small multicopters, so to autorotate the props have to have time to stop turning and reverse. Even assuming they could declutch from the motors they would usually crash first. *There are some exceptions: https://www.droneguru.net/collective-pitch-drones/ https://www.droneguru.net/collective-pitch-drones/
    - mikeyouse 7y ago
      Notably - this is what killed the billionaire owner of the Leicester City football club. He liked to land his helicopter on the field after the game and depart from there (against many people's advice) which prevented any forward momentum on takeoff or landing. Last year, he was taking off after a game and had an engine issue which resulted in the helicopter crashing into the parking lot killing everyone on board. https://www.youtube.com/watch?v=Kvk6rslCDAI https://www.youtube.com/watch?v=Kvk6rslCDAI
- MisterTea 7y ago
  Modern soft/hardware development looks like this: idea -> money. There is no real engineering in between except hammering on things until they get to "money".
- digikata 7y ago
  Safety, very much like security, needs to be built in during the design phase - or you're trading off the development cost for an expensive retrofit while gambling with the risk of killing the project (or even setting back that entire class of transportation) by killing people.
  - Gibbon1 7y ago
    Can't emphasize that enough. I read a book in 80's on safety critical design and that was the first rule. Safety has to be a primary design goal from the start or you are hosed.
hinkley 7y ago
I recall when Tesla was starting out that they already had a safety story including compartmentalizations and monitoring. The impression given was that safety was a forethought.
nradov 7y ago
The home built experimental powered lift aircraft are lacking a lot more than properly safety-certified electronics. The big gaps are in power reserves and systems redundancy for fault tolerance. The FAA generally requires certified helicopters to have a 30 minute fuel reserve in order to allow a safe diversion to an alternate landing site. With lithium battery power, once you subtract out the reserve time there's hardly any range left. (It might be possible to obtain some exemptions to the reserve regulations in limited circumstances.)
- sokoloff 7y ago
  It’s 20 minutes for rotorcraft: https://www.law.cornell.edu/cfr/text/14/91.151 https://www.law.cornell.edu/cfr/text/14/91.151 Experimentals don’t get to waive fuel reserve requirements (which are Part 91 flight requirements [pilot responsibility to comply], not Part 23/25 type design requirements [designer responsibility]).
  - nradov 7y ago
    The 20 minute reserve requirement is for VFR conditions only. The 30 minute reserve requirement that I cited is for IFR conditions. If Kitty Hawk wants to sell a certified aircraft that can be used for revenue passenger flights then I assume it will have to meet the IFR requirements, but perhaps the FAA will reach a different decision? https://www.law.cornell.edu/cfr/text/14/91.167 https://www.law.cornell.edu/cfr/text/14/91.167
    - sokoloff 7y ago
      Many helo ops are VMC only. You could sell a helo that wasn’t IFR equipped.
      - dmitrygr 7y ago
        but you could not (AFAIK) operate it as a scheduled passenger service as such
6gvONxR4sf7o 7y ago
This isn't a product yet. Not focusing on safety when it's ferrying people is one thing, but not focusing on safety when the craft doesn't even work yet is another. I read this as an order of operations thing. First work out the concept, then get it to work, and then get it to work reliably. As long as nobody is in danger putting reliability last seems natural by definition. Once it's reliable, it's done.
- nradov 7y ago
  That simply doesn't work. If you want to build a reliable aircraft then you have to design around reliability from the beginning, starting with the basic product concept. Reliability isn't something you can add on at the end of the development cycle and achieve good results. Real aeronautical engineers have known this for decades.
  - gretch 7y ago
    That really doesn't match actual aircraft design history though. Like were the wright brothers in 1900 thinking about how to make their first flier safe?
    - leoedin 7y ago
      This isn't 1900 though. Helicopters have been a thing for 70 years. Everyone knows you can make an unsafe multirotor. They're everywhere. Colin Furze made one in his shed. You can buy general aviation aicraft today with fully autonomous autopilots, including a completely hands-off "land at the nearest airport because the pilot's having a heart attack" button. The absolute bottom line offering of any small aircraft has to be that its safe (or at least, the failure rate is acceptable - which means at least comparable to modern helicopters). That's the innovation that anyone entering the market needs to bring.
      - matz1 7y ago
        No? not safe + working is more useful than safe + not working. Beside they are not building helicopter, they are building new kind of aircraft.
empath75 7y ago
I'm not sure that safety is a primary concern if you're just trying to see if you can make something fly _at all_. I'm sure they've started from zero several times with entirely new designs. There's no point worrying overly much about safety if you only plan to fly something once.

crocal 7y ago

Before talking about anti-safety culture, I observed that the real issue in a purely hardware/software-driven culture is that people focus on technology. For safety systems, this usually fails / overbudgets because there needs to be some systems thinking /before/ about why and how the proposed system can be declared safe. In the case of drones, I am afraid that the systems design to make these devices acceptably safe is yet to be formulated (Note: these are not planes, they fly close to the ground so they do not benefit from the safety of altitude to have time to react in case of failure)

TheSpiceIsLife 7y ago
Helicopters are certifiable for carrying passengers, and yet take offs and landings have no altitude nor speed benefits. In what way do multirotors / drones differ?
- TeMPOraL 7y ago
  I know exactly nothing about aircraft safety, but since this is HN, I want to throw out a guess: in case of landing, could it be that helicopters make the blades spin very fast prior to beginning the landing maneuver, compensating for extra lift with pitch control, and then keep them spinning fast throughout the entire landing process, and brake them only after touchdown? This would, in my mind, let them do a soft touchdown via autorotation in case of sudden engine failure at any point of the landing maneuver (at least if the pilot has fast enough reflexes).
  - TheSpiceIsLife 7y ago
    That does sound like a reasonable guess. Can anyone with more knowledge chime in? I’m off to bed, otherwise I’d try looking in to it.
  - Already__Taken 7y ago
    I'm going to go on a limb here, you'd need to put enough energy into the rotors of: helicopter weight * recovery time (so distance * descent rate) * gravity². that is a big number to get rotor mass * rpm to equal.
    - TeMPOraL 7y ago
      Autorotation is already the standard emergency landing practice in case of loss of engine power mid-flight; I'm only guessing that landings could be performed in such a way as to maintain the capability for autorotation throughout the maneuver.
      - Already__Taken 7y ago
        That's what I was trying to explain, that energy to maintain rotor speed in an autorotation is stored in the height. To replace that is a damn big number you're putting somewhere else. Maybe landing rockets like the soyuz.
  - dreamcompiler 7y ago
    In theory, yes. In practice the blades don't have enough angular momentum for this to work longer than a very short time, which is why the first step a pilot must take upon engine failure is to slam the collective down so the air flowing past the blades will keep them spinning in the same direction. Some helicopters with very heavy blades with lots of angular momentum have been built, but it makes the blades heavy which requires a more powerful engine which makes the whole craft heavier which means you need even more angular momentum...you get the idea. It's an engineering nightmare so it's atypical.
- mnw21cam 7y ago
  If the engine fails in a helicopter, and you have enough altitude, you can autorotate the rotors for a soft landing. It's the helicopter equivalent of gliding in a fixed wing aircraft. The danger potential is similar to a fixed wing aircraft - landing and takeoff are the critical stages, but normal flight gives plenty of opportunity for a safe-ish forced landing. A multirotor on the other had doesn't have the ability to glide, like a fixed wing or a helicopter. Any safety will have to be engineered in by making sure that a single rotor failure (or even multiple) can be coped with correctly and reliably.
  - tonyarkles 7y ago
    I suffered a battery lead failure on a large hexcopter this summer at ~27 ft. It was spectacularly destructive to the airframe. Had it been a motor/prop/ESC, it would have had enough thrust to land (awkwardly), but cutting power to all 6 motors at the same time (flight controller has a separate battery)... not recoverable.
- Nasrudith 7y ago
  I know copters have autostability as their benefit - the big rotor has inertia on its side and keeps it aloft and even a loss of power would fall slower. Multirotors I believe require active control of every individual rotor instead of straightforward big angular momentum. Which I believe is part of why they are seen on drones.
  - tonyarkles 7y ago
    Riffing on this a little bit based on my experiences with multirotors but not having any kind of "autorotation" capability with them: Most motors on multirotors are BLDC motors that require active control to make them spin. Voltage gets applied to the motor phases sequentially to make it spin. However, when they're completely open-circuit, they actually spin quite freely! I've seen the ones I had (26" prop) windmill quite well in a mild breeze. The trick, though is that you're probably not going to get much descent-arrest out of open-circuit BLDCs. Another possibility is short-circuited BLDCs; in that condition, the rotos are quite tough to turn. My speculation is that the props wouldn't spin much at all in a short-circuit condition. Buuuuut... if ESCs were able to modulate the open/short-circuit condition (even without power to actively spin the motors), I suspect you might be able to get some kind of arrested descent situation. I've been thinking of building an ESC from scratch this winter... this might be a useful feature to experiement with!
- blattimwind 7y ago
  Helicopters have a height-velocity diagram with some areas marked unsafe (low speed, low altitude); when operating in the forbidden areas a pilot cannot be reasonably expected to perform an emergency landing using autoration following complete engine loss. In all other areas this should be possible. Coincidentally, that's why helicopters avoid taking off vertically (they only do that in video games...); they want to gain some speed before gaining significant altitude, because forward speed helps autorotation. If a helicopter just climbs straight up at zero speed and the engine goes out, it's going to fall pretty much like a rock. Average multicopter designs would seem to be incapable of autorotation for aerodynamic and technical reasons. The technical reason being that the BLDC motors used are typically permanent magnet synchronous machines, which develop significant holding torque in most (driver) failure modes and there is no clutch to disconnect the motor from the propeller.
  - dreamcompiler 7y ago
    There's also typically* no collective pitch control in small multicopters, so to autorotate the props have to have time to stop turning and reverse. Even assuming they could declutch from the motors they would usually crash first. *There are some exceptions: https://www.droneguru.net/collective-pitch-drones/ https://www.droneguru.net/collective-pitch-drones/
  - mikeyouse 7y ago
    Notably - this is what killed the billionaire owner of the Leicester City football club. He liked to land his helicopter on the field after the game and depart from there (against many people's advice) which prevented any forward momentum on takeoff or landing. Last year, he was taking off after a game and had an engine issue which resulted in the helicopter crashing into the parking lot killing everyone on board. https://www.youtube.com/watch?v=Kvk6rslCDAI https://www.youtube.com/watch?v=Kvk6rslCDAI
MisterTea 7y ago
Modern soft/hardware development looks like this: idea -> money. There is no real engineering in between except hammering on things until they get to "money".
digikata 7y ago
Safety, very much like security, needs to be built in during the design phase - or you're trading off the development cost for an expensive retrofit while gambling with the risk of killing the project (or even setting back that entire class of transportation) by killing people.
- Gibbon1 7y ago
  Can't emphasize that enough. I read a book in 80's on safety critical design and that was the first rule. Safety has to be a primary design goal from the start or you are hosed.

hinkley 7y ago

I recall when Tesla was starting out that they already had a safety story including compartmentalizations and monitoring. The impression given was that safety was a forethought.

nradov 7y ago

The home built experimental powered lift aircraft are lacking a lot more than properly safety-certified electronics. The big gaps are in power reserves and systems redundancy for fault tolerance. The FAA generally requires certified helicopters to have a 30 minute fuel reserve in order to allow a safe diversion to an alternate landing site. With lithium battery power, once you subtract out the reserve time there's hardly any range left. (It might be possible to obtain some exemptions to the reserve regulations in limited circumstances.)

sokoloff 7y ago
It’s 20 minutes for rotorcraft: https://www.law.cornell.edu/cfr/text/14/91.151 https://www.law.cornell.edu/cfr/text/14/91.151 Experimentals don’t get to waive fuel reserve requirements (which are Part 91 flight requirements [pilot responsibility to comply], not Part 23/25 type design requirements [designer responsibility]).
- nradov 7y ago
  The 20 minute reserve requirement is for VFR conditions only. The 30 minute reserve requirement that I cited is for IFR conditions. If Kitty Hawk wants to sell a certified aircraft that can be used for revenue passenger flights then I assume it will have to meet the IFR requirements, but perhaps the FAA will reach a different decision? https://www.law.cornell.edu/cfr/text/14/91.167 https://www.law.cornell.edu/cfr/text/14/91.167
  - sokoloff 7y ago
    Many helo ops are VMC only. You could sell a helo that wasn’t IFR equipped.
    - dmitrygr 7y ago
      but you could not (AFAIK) operate it as a scheduled passenger service as such

6gvONxR4sf7o 7y ago

This isn't a product yet. Not focusing on safety when it's ferrying people is one thing, but not focusing on safety when the craft doesn't even work yet is another. I read this as an order of operations thing. First work out the concept, then get it to work, and then get it to work reliably. As long as nobody is in danger putting reliability last seems natural by definition. Once it's reliable, it's done.

nradov 7y ago
That simply doesn't work. If you want to build a reliable aircraft then you have to design around reliability from the beginning, starting with the basic product concept. Reliability isn't something you can add on at the end of the development cycle and achieve good results. Real aeronautical engineers have known this for decades.
- gretch 7y ago
  That really doesn't match actual aircraft design history though. Like were the wright brothers in 1900 thinking about how to make their first flier safe?
  - leoedin 7y ago
    This isn't 1900 though. Helicopters have been a thing for 70 years. Everyone knows you can make an unsafe multirotor. They're everywhere. Colin Furze made one in his shed. You can buy general aviation aicraft today with fully autonomous autopilots, including a completely hands-off "land at the nearest airport because the pilot's having a heart attack" button. The absolute bottom line offering of any small aircraft has to be that its safe (or at least, the failure rate is acceptable - which means at least comparable to modern helicopters). That's the innovation that anyone entering the market needs to bring.
    - matz1 7y ago
      No? not safe + working is more useful than safe + not working. Beside they are not building helicopter, they are building new kind of aircraft.

empath75 7y ago

I'm not sure that safety is a primary concern if you're just trying to see if you can make something fly _at all_. I'm sure they've started from zero several times with entirely new designs. There's no point worrying overly much about safety if you only plan to fly something once.