ZeroAvia has tightened the experimental regime for its hydrogen fuel-cell aircraft testing, including management of commercial pressures, after a UK investigation into a serious loss-of-power accident uncovered safety weaknesses in the programme.
The accident, at Cranfield on 29 April last year, involved a modified Piper M350 (G-HYZA) whose single piston engine had been replaced by electric motors driven by a battery and fuel cell.
As the pilot switched power source – from the battery to the cell – the propeller windmilled in the airflow and generated a back-voltage which exceeded a critical threshold. This caused a protection system to lock-out electrical power to the motors. With the crew unable to restore power, the aircraft force-landed in a field and suffered substantial damage.
The inquiry found power loss from lock-out caused by a windmilling propeller had occurred on two previous test flights, both of which landed safely – including one just two days earlier which had not been investigated because the crew “did not consider it to be significant at the time”, says the Air Accidents Investigation Branch.
Risk assessment had classified the loss of thrust from two motors as ‘improbable’, says the inquiry, but this was not reviewed after the two previous incidents even though the basis of the risk assessment was “no longer valid”.
Although loss of thrust had previously been identified as a hazard, not all the mitigations to avert an off-airfield landing were listed in relevant documentation, and not all were followed by the crew.
The inquiry found that sufficient ground-testing had not been carried out to determine the effect of back-voltage from a windmilling propeller, and the emergency procedure to clear the lock-out was “ineffective”.
Investigators also point out that, on the day of the accident, “ad hoc changes” were made to the flight-test plan – including, crucially, the point at which the switch from battery to fuel-cell occurred – without the knowledge of the designated competent person responsible for managing safety of the experimental test programme. The crew also allowed the aircraft to drift outside of the 2nm radius limit for the test flight.
ZeroAvia had been carrying out the electric-engine testing under its HyFlyer I initiative, and the company has since moved on to HyFlyer II which involves conversion of a 19-seat twin-engined Dornier 228.
The inquiry says the operator is incorporating lessons from the windmilling and back-voltage in its future projects, and that prototype testing will be limited to non-critical redundant situation until powerplant design matures.
ZeroAvia says its own internal probe into the accident identified many of the same issues noted by the inquiry, and these have been “addressed robustly”, with the recommendations having helped to shape the company’s expansion.
“We have embedded key learnings into both our organisational culture and structure, as well as our future technical designs,” says ZeroAvia. “This includes the establishment of a safety and security review board, adding to our team with extensively qualified members in several critical positions, including within our design, airworthiness and flight test teams.”
It has also set up a ‘just culture’ safety-management system for occurrence reporting, investigation and corrective actions.
The inquiry highlights the competitive nature of the new drive to develop zero-emissions technology, and states that the operator’s investigation had found a “high workload” on the experimentation team with pressure to achieve a long-duration demonstration flight by the end of May last year.
With significant preparation also underway for the 19-seat project, some personnel were showing signs that pressure was “influencing them to make decisions based primarily on expediency”, says the inquiry.
But it also points out that there was “no apparent threat” of funding or investment being withdrawn if the flight-test programmes needed more time for completion. The inquiry states that ZeroAvia intends to manage commercial pressure “actively” to ensure that it does not compromise safety.
