The Necessity of a Human Pilot in eVTOL—Balancing Safety and Autonomy

Abstract

With the rapid development of electric Vertical Take-Off and Landing (eVTOL) aircraft for urban air mobility, ensuring safe operation in complex low-altitude environments remains a major challenge. In particular, interactions with non-cooperative airspace users introduce uncertainties that are difficult to fully handle with current autonomous systems. To better understand these risks, a Monte Carlo simulation framework is developed to model random encounters between an eVTOL and uncontrolled unmanned aerial vehicles. The results show a relatively low collision probability of approximately 0.18%. However, a large proportion of encounters fall within an intermediate separation range of 100–200 m, indicating a high-frequency conflict region that still requires continuous monitoring and decision-making. Based on these observations, Fault Tree Analysis (FTA) is further applied to evaluate system-level safety under different operational architectures, incorporating revised assumptions on human reliability and system interactions. The results suggest that the inclusion of human pilots can contribute to reducing the probability of catastrophic failure compared with fully autonomous configurations, particularly in uncertain and non-cooperative scenarios. These findings suggest that, although full autonomy is a long-term goal, current intelligent systems still face limitations in dealing with uncertain and non-cooperative scenarios in urban airspace. In such situations, human operators can provide additional situational awareness and flexible decision-making, improving overall system robustness. Overall, a phased transition toward full autonomy, starting from a human–machine collaborative approach, appears to be a practical path to ensure safety, support certification, and enable the deployment of eVTOL systems.

1. Introduction

Advancements in electric Vertical Take-off and Landing (eVTOL) technology represent an important step in the evolution of aviation, particularly within the context of Urban Air Mobility (UAM). UAM is increasingly viewed as a potential solution to urban congestion and short-distance transportation challenges. In recent years, research has focused on eVTOL aircraft configurations, distributed electric propulsion, and urban airspace operations, with studies indicating their feasibility in terms of energy efficiency, noise reduction, and operational flexibility. At the same time, regulatory bodies and industry stakeholders have begun to outline initial frameworks for integrating eVTOL operations into existing airspace systems [1].

Modern eVTOL designs combine advanced propulsion systems, energy storage, and avionics with the goal of enabling efficient and ultimately autonomous flight. However, maintaining safety in dense and dynamic urban airspace remains a central challenge [2,3]. These aircraft rely heavily on software-driven systems for flight control, propulsion management, and fault handling, supported by sensor suites and real-time data processing.

Recent progress in autonomous flight has improved capabilities in perception, navigation, and control, particularly through the use of machine learning and sensor fusion. Such systems perform well in structured or semi-structured environments, but their reliability in more complex operational contexts remains limited. In low-altitude urban environments, additional risks arise from factors such as bird strikes, foreign object interactions, and the growing presence of unmanned aerial vehicles (UAVs). These factors introduce further uncertainty and complicate safety assurance. Under such conditions, sensor degradation, occlusions, incomplete environmental information, and the non-deterministic behavior of learning-based models can lead to responses that are difficult to predict and verify in safety-critical scenarios. For this reason, human oversight is often retained as part of the operational framework, particularly in situations where deterministic system behavior cannot be fully guaranteed [4].

Civil aviation imposes stringent safety requirements on aircraft systems. For catastrophic failure conditions, the acceptable probability is typically required to be below ${10}^{-8}$ per flight hour under current airworthiness regulations [5]. Meeting this requirement is particularly challenging for eVTOL operations in urban environments, where both environmental uncertainty and system complexity exceed those of conventional aviation scenarios.

Although previous work has investigated autonomous eVTOL systems and AI-based flight control strategies, relatively little attention has been given to the quantitative role of human pilots as a safety layer in urban operations. In particular, system-level evaluation frameworks that jointly consider hardware reliability, human factors, and external operational risks, such as low-altitude traffic and environmental hazards remain limited. As a result, it is difficult to determine whether fully autonomous solutions can satisfy near-term safety and certification requirement [6].

The main contributions of this manuscript are summarized as follows:

• Original Equipment Manufacturer (OEM) Perspective and Practical Deployment Pathway: This paper presents a deployment pathway for medium-scale eVTOL operations in urban environments over the next 3–10 years, from the perspective of an OEM and vertiport operator. The proposed framework considers technological maturity, regulatory constraints, commercial feasibility, and airworthiness requirements, providing a reference for practical implementation.
• Data-Driven Urban Hazard Risk Assessment: Based on multi-year civil aviation data and Monte Carlo simulation, the study evaluates collision-related risks in low-altitude urban environments. The results indicate that interactions with UAVs constitute a non-negligible source of operational risk under the assumed conditions.
• Quantitative Safety Evaluation Based on System-level Analysis: A layered Fault Tree Analysis (FTA) is developed based on a representative eVTOL platform (“AE200”), integrating hardware reliability and human error modeling. The results indicate that pilot involvement acts as a compensatory safety mechanism, enabling the system to maintain the target level of catastrophic failure probability under realistic operational conditions.
• Scenario-Based Hybrid Operation Framework: A hybrid operational model is proposed, distinguishing between routine and non-routine scenarios. Different flight phases (e.g., hover, transition, cruise) are associated with varying levels of automation and pilot involvement. A graded pilot intervention strategy is further introduced for off-nominal conditions, supporting a structured transition toward higher levels of autonomy.
• Economic and Engineering Cost Analysis: This study analyzes the engineering and economic implications of fully autonomous and hybrid architectures. The results indicate that full autonomy requires substantial sensing, computation, certification, and infrastructure investments, whereas hybrid human–machine configurations can reduce system complexity and certification burden in near-term deployment scenarios.
• Insights into Regulatory Acceleration and Public Trust: The paper discusses the role of human pilots in supporting certification processes under current Federal Aviation Administration (FAA) and European Union Aviation Safety Agency (EASA) frameworks. It also examines public acceptance considerations, suggesting that gradual autonomy supported by human oversight may be more suitable for early-stage deployment, confidence, and perceived safety.

Methodology Overview

This study adopts a system-level evaluation framework combining scenario-based analysis, probabilistic simulation, and fault tree modeling. A representative urban operation scenario is first defined to capture key risks in low-altitude environments, particularly interactions with non-cooperative airspace users.

Based on this scenario, a Monte Carlo simulation is conducted to provide an approximate estimation of collision-related risks under simplified assumptions. The objective of this analysis is to obtain an order-of-magnitude understanding of encounter characteristics and external hazard exposure, rather than high-fidelity physical prediction. The results are used to provide context for evaluating system-level performance under realistic operational conditions.

Building on these observations, two FTA models are developed to assess system-level safety under different assumptions. The first FTA represents a baseline configuration under nominal system-level assumptions, while the second considers degraded conditions associated with complex low-altitude operations and incorporates human pilot involvement as an additional safety layer. This framework allows the role of human intervention to be evaluated as a compensatory mechanism for maintaining target safety levels under more realistic operating conditions.

2. Current State of eVTOL Intelligence

The emergence of eVTOL technologies has created new opportunities for UAM, with increasingly sophisticated intelligent systems supporting the development of autonomous flight capabilities. Current systems demonstrate measurable progress toward automation, and in structured or controlled environments, eVTOL platforms are capable of repeatable, precise, and stable autonomous maneuvers. However, despite these advancements, the level of automation remains constrained by technical maturity, hardware limitations, and the complexity of real-world operational environments. A closer examination of these limitations helps explain why full autonomy remains an ongoing objective rather than an operational reality [7].

2.1. Maturity and Capabilities of Intelligent Systems

Autonomy levels for vehicles are commonly categorized from Level 0 (no automation) to Level 5 (full autonomy without human intervention). Level 3 autonomy enables systems to manage most aspects of operation under specific conditions but requires human intervention when necessary. Level 4 systems can operate independently within predefined environments, while Level 5 represents full autonomy across all conditions [8].

At present, eVTOL systems are progressing toward higher levels of autonomy, but most platforms operate at Level 3 or Level 4, requiring human oversight during certain flight phases. Demonstrations by companies such as Joby Aviation, Archer, and EHang indicate that semi-autonomous capabilities, such as automated takeoff, trajectory tracking, and landing, are technically feasible. However, reliable operation in complex and unstructured environments remains a challenge [2].

2.1.1. Environmental Susceptibility of Perception Systems

The performance of eVTOL perception systems is influenced by environmental factors that are inherently variable and difficult to control. Lidar performance may degrade under fog, rain, and snow due to scattering effects [9]. Cameras can experience reduced contrast, exposure imbalance, and motion blur under rapidly changing lighting conditions, particularly in urban canyon environments. Radar systems, while more robust to weather conditions, may be affected by multipath reflections and clutter in dense urban.

These effects are frequently observed in low-altitude urban operations and therefore represent persistent operational conditions rather than isolated anomalies. As a result, perception outputs may become sensitive to atmospheric and geometric disturbances, which are challenging to fully mitigate in practice [10].

2.1.2. Platform-Level Constraints on Sensor Deployment

The physical constraints of eVTOL aircraft limit the size, quantity, and distribution of onboard sensors. Weight, power, and thermal management requirements restrict the integration of large, power-sensitive, or redundant sensing modules. Additionally, the aerodynamic form factor constrains sensor placement, resulting in unavoidable blind spots and gaps in coverage. Unlike ground vehicles, where sensor arrays can be expanded with minimal penalty, increasing the size of sensors on an eVTOL directly impacts flight endurance, payload capacity, and certification complexity. As a result, perception fidelity is bound not only by sensor technology but also by the aircraft’s structural configuration and energy limitations.

2.1.3. Incomplete Resolution Through Multi-Sensor Fusion

Multi-sensor fusion enhances robustness but cannot guarantee deterministic perception. Fusion algorithms reduce random noise yet remain limited when underlying data is degraded, incomplete, or inherently ambiguous. Transparent surfaces, thin cables, irregularly shaped structures, and small fast-moving objects challenge even advanced fusion pipelines. These limitations persist despite progress in learning-based frameworks, because fusion only compensates for stochastic uncertainty but cannot overcome bias created by insufficient or corrupted data [11,12]. Since Aviation safety requirements such as EASA Special Condition for VTOL (EASA SC-VTOL-01) [13] impose extremely stringent reliability targets, with catastrophic failure probabilities required to be below ${10}^{-8}$ per flight hour.

2.1.4. Limitations of Infrastructure-Assisted Awareness

To supplement onboard sensing, eVTOL systems increasingly rely on Electronic Conspicuity (EC), Automatic Dependent Surveillance–Broadcast (ADS-B), multi-lateration networks, and Digital Twin infrastructures. These technologies expand the range of situational awareness beyond physical line-of-sight and can improve trajectory prediction. However, they depend on communication density, coverage reliability, and full ecosystem participation—conditions not yet met in most urban environments. Signal blockage, urban canyon effects, intermittent network availability, and the presence of non-cooperative airspace participants all limit the effectiveness of external sensing. Consequently, infrastructure-assisted awareness enhances safety but cannot substitute for reliable onboard perception.

2.2. Regulatory and Safety Challenges Faced by Fully Autonomous eVTOLs

2.2.1. Certification Requirements for Deterministic Reliability

Aviation certification imposes stringent safety requirements. Achieving this level of safety requires system behavior to be sufficiently predictable, analyzable, and verifiable within defined operational conditions. While probabilistic methods such as FTA are widely used in certification, they must be supported by clear system-level understanding, traceable logic, and well-defined failure modes.

Fully autonomous eVTOL systems present additional challenges in this context. AI-driven architectures often rely on data-driven and probabilistic decision-making processes, which may not always provide fully transparent or repeatable behavior across all scenarios. This can complicate compliance with certification frameworks that emphasize determinism, traceability, and verifiability, as reflected in standards such as EASA SC-VTOL-01, together with safety assessment and software assurance practices, including Safety Assessment Process for Civil Airborne Systems (SAE ARP4761) [14] and Software Considerations in Airborne Systems and Equipment Certification (RTCA DO-178C) [15].

2.2.2. Incomplete Coverage of Off-Nominal Conditions

Autonomous systems are required to address not only nominal flight conditions but also off-nominal and unexpected scenarios, which explicitly require safe operation under degraded and abnormal conditions. These may include abnormal weather patterns, sensor degradation or loss, localized environmental disturbances, and external hazards such as UAVs or bird strikes.

Many such scenarios are difficult to fully enumerate in advance, and the behavior of non-cooperative external participants cannot be precisely predicted. As a result, while probabilistic safety assessments can provide valuable insights, they may not be sufficient on their own to demonstrate robustness across the full range of operational conditions. Additional validation strategies are typically required to support certification [16].

2.2.3. Limits of Modeling External Risks

Urban low-altitude airspace is inherently complex and may include uncontrolled or unpredictable objects, such as unauthorized drones, construction equipment, balloons, or airborne debris. The motion of such objects may deviate from assumptions commonly used in trajectory prediction models, introducing uncertainty into perception and decision-making processes.

Autonomous systems must therefore detect, classify, and respond to objects whose behavior may not be fully captured by existing models. This introduces additional challenges in ensuring predictable system responses, particularly under safety-critical conditions. As a result, modeling external risks in a fully comprehensive and certifiable manner remains a challenging aspect of fully autonomous operations [17].

2.2.4. Cybersecurity and Systemic Vulnerability

The increasing reliance on communication links, remote diagnostics, and networked systems introduces additional cybersecurity considerations for eVTOL operations. Potential risks include signal spoofing, jamming, false data injection, and other forms of interference.

As system connectivity increases, so does the potential attack surface, which may affect both onboard systems and communication infrastructure. Vulnerabilities in aviation communication technologies, such as Global Navigation Satellite System (GNSS) and ADS-B, have been widely studied, where the absence of robust authentication mechanisms can allow for signal manipulation or data injection. In addition, similar vulnerabilities have been demonstrated in autonomous driving systems, where adversarial perturbations applied to physical objects can lead to incorrect perception results and unsafe control responses [18,19,20].

Ensuring resilience against such threats at high certification levels presents additional challenges, particularly in demonstrating that systems can maintain safe operation under adverse conditions. While advances in cybersecurity technologies continue to improve system robustness, validation of these protections to the same level of rigor as traditional avionics systems remains an ongoing area of development.

In this context, the inclusion of human oversight and independent control pathways may provide an additional layer of safety, particularly in early-stage deployment scenarios.

3. Collaboration Between Pilots and Intelligent Systems

In the initial commercial deployment phase of UAM, expected over the next 3–5 years, operations are likely to follow existing regulatory frameworks, including the FAA powered-lift rules, Advisory Circular AC-21-AA-2026-45 (Airworthiness Standards for Powered-Lift Aircraft) [21], and the EASA SC-VTOL.These frameworks generally assume the presence of a clearly identifiable pilot-in-command, either onboard or remotely supervising operations, rather than fully autonomous passenger services [22,23].

As illustrated in Figure 1, the eVTOL flight control architecture can be described as a closed-loop interaction among the human pilot, flight control computers (FCC), onboard sensors, actuators, and the avionics and display system. The human pilot provides high-level control inputs and supervisory decisions through the human–machine interface. These inputs are processed by the flight control computers, which implement control laws, perform control allocation, and generate actuator commands.

The actuators, including control surfaces, distributed electric propulsion systems, and tilt mechanisms, convert these commands into physical control effects acting on the aircraft. The resulting aircraft motion is measured by onboard sensors (e.g., air data, IMU, navigation systems, and propulsion and actuator feedback). The sensed data is processed within the avionics system and presented to the pilot via the display as flight state and system status information. This information is also fed back to the flight control computers, forming a closed-loop control system.

This architecture explicitly separates sensing, computation, actuation, and human interaction, while enabling continuous coordination between human decision-making and automated control. Within the current regulatory context, such structure remains consistent with certification expectations and provides the foundation for the human–machine collaboration mechanisms discussed in the following sections.

3.1. Necessity of Combining Pilots with Intelligent Systems to Enhance Safety

In complex operational environments, automated eVTOL systems can be broadly categorized into Human-on-the-Loop (HOTL) and human-in-the-loop (HITL) architectures. In HOTL configurations, automation performs most control actions autonomously, while a human operator supervises system behavior and may intervene when necessary [24,25]. In HITL configurations, the operator remains directly involved in the decision-making process, such that key actions, such as flight-mode transitions, trajectory adjustments, or emergency responses, typically require human approval.

From a system perspective, these supervisory structures are consistent with the layered architecture of eVTOL flight-control systems. Inner-loop stabilization functions, including attitude control, rate control, thrust allocation, and envelope protection, are handled by high-integrity flight-control computers designed to stringent Design Assurance Levels (DAL) [26]. In contrast, mission-level tasks, such as diversion decisions, abnormal procedure management, and contingency routing, require pilot oversight. In practice, pilots do not continuously perform manual control but instead supervise automation and make decisions at critical points, including route acceptance, fault recovery evaluation, emergency landing selection, and approach management.

The importance of this supervisory role is reflected in human-factor studies. For example, NASA and FAA human-in-the-loop (HITL) simulations of separation assurance indicate that pilot response times can vary significantly under different workload conditions, highlighting the need for systems to remain stable even when human intervention is delayed [27,28]. Rotorcraft safety studies also suggest that certain low-altitude emergency scenarios may allow only limited reaction windows (on the order of 1.0–1.5 s) for critical pilot actions, such as collective reduction following power loss [29]. These findings support the use of HITL/HOTL-compatible architectures that account for realistic, rather than idealized, human response characteristics.

Route deviation handling provides a practical example of this interaction. Minor deviations (e.g., <50 m, <10 s) are generally managed by onboard automation. Moderate deviations (e.g., 50–200 m, 10–30 s) may require pilot monitoring and potential intervention. More significant deviations (e.g., >200 m or >30 s) typically require timely human involvement, particularly during takeoff, climb, and landing phases where safety margins are limited. During cruise, available response time may increase, but human judgment remains important in validating recovery actions and ensuring safe system behavior [30].

Human involvement also plays a role in legal accountability and decision-making boundaries. In extreme emergency scenarios where controlled flight cannot be maintained, multiple forced-landing options may exist, each associated with different levels of third-party risk. Current aviation regulations do not explicitly define how such trade-offs should be resolved by autonomous systems, nor do they clearly assign responsibility for decisions made solely by algorithms.

While intelligent systems may assist in identifying feasible landing options or estimating potential risks, final decision-making in such scenarios is generally expected to remain under human authority, reflecting current regulatory practices and accountability requirements.

Overall, these technical, human factors, and operational considerations highlight the continued role of human involvement in highly automated eVTOL systems. Accordingly, the approaches proposed in this work are developed within HITL/HOTL frameworks rather than assuming full autonomy.

3.2. Addressing Complex or Emergency Situations

In urban low-altitude operations, external hazards such as birds and ground obstacles represent another critical source of risk to manned eVTOL flight safety. In densely populated environments, consumer-grade UAVs, birds, buildings, high-voltage power lines, bridges, and other foreign objects may interfere with the intended flight trajectory, thereby introducing significant safety hazards. Although current onboard sensing systems provide basic capabilities for obstacle detection, warning, and avoidance, their effectiveness is fundamentally limited under extreme conditions. In particular, in the event of sudden sensor failures, the system may lose the ability to detect and avoid obstacles along the flight path, potentially leading to severe accidents.

To quantitatively characterize such risks, statistical data from CAAC Safety Information System were analyzed. The dataset covers general aviation operations in China from 2017 to 2021, including fixed-wing aircraft and helicopters. The data collection scope and reporting standards comply with the Civil Aviation Safety Information Management Regulations (CCAR-396) [31], providing a consistent basis for safety analysis.

The original incident records were obtained from the publicly available CAAC Safety Information System [32] and further processed by the authors to extract foreign-object- and obstacle-related events. The occurrence rates of these incidents, normalized per flight hour, are summarized in

Table 1. Flight Incident Rate Due to Foreign Objects and Obstacles in General Aviation Nationwide (Per Flight Hour) from 2017 to 2021.

Year	Bird Strike	Encounter with High-Altitude Obstacles/ Airborne Objects	Controlled Flight into Terrain/Obstacle Event	Foreign Object Strike Incident
2021	$1.02\times {10}^{-5}$	$1.10\times {10}^{-5}$	$0.85\times {10}^{-5}$	$1.70\times {10}^{-6}$
2020	$2.74\times {10}^{-5}$	$1.32\times {10}^{-5}$	$1.52\times {10}^{-5}$	$7.11\times {10}^{-6}$
2019	$2.82\times {10}^{-5}$	$2.25\times {10}^{-5}$	$1.03\times {10}^{-5}$	$5.63\times {10}^{-6}$
2018	$2.88\times {10}^{-5}$	$2.35\times {10}^{-5}$	$1.28\times {10}^{-5}$	$9.60\times {10}^{-6}$
2017	$9.55\times {10}^{-5}$	$2.63\times {10}^{-5}$	$0.72\times {10}^{-5}$	$3.58\times {10}^{-6}$

.

Statistical analysis of Table 1 indicates that bird strikes constitute the most frequent category among all external hazard-related incidents. In particular, the bird strike rate reached a peak of $9.55\times {10}^{-5}$ per flight hour in 2017, significantly exceeding other categories. Although a decreasing trend is observed in subsequent years, bird strikes remain the dominant external hazard throughout the observed period. According to CAAC operational statistics, such events predominantly occur during low-altitude flight phases, including takeoff, climb, approach, and landing, where aircraft operate under rapidly changing speed and altitude conditions and onboard detection systems have limited response time.

Seasonal and temporal patterns further amplify this risk. Bird strike incidents peak during spring and autumn migration periods, particularly in September, while daily distributions show higher occurrence during dawn and dusk under low-visibility conditions. From an ecological perspective, bird activity varies significantly across seasons: spring breeding leads to localized activity, while autumn migration increases both population density and spatial coverage. Additionally, birds exhibit higher activity levels during early morning and evening, coinciding with critical operational windows for UAM systems. A bird strike event may result in structural damage, propulsion system failure, or malfunction of avionics and navigation systems, thereby posing a direct threat to flight safety.

In addition to avian hazards, encounters with high-altitude obstacles and airborne objects represent another important risk source. CAAC investigation reports indicate that such incidents are primarily caused by non-compliant building structures exceeding approved height limits, collisions with high-voltage power lines, recreational kite flying, unauthorized UAV operations, and drifting balloons. Among these, unauthorized or uncontrolled UAV activities account for approximately 61% of all such incidents (57 cases during 2017–2021), highlighting their increasing impact. Furthermore, seven accidents involving collisions with power lines resulted in complete structural failure and aircraft loss, demonstrating the potentially catastrophic consequences of such events.

To further assess collision risks in integrated low-altitude airspace, a simulation-based study was conducted to examine the interaction between a crewed eVTOL and an uncontrolled UAV under simplified operational assumptions.

(1) Kinematic and Dynamic Modeling: A six-degree-of-freedom (6-DOF) model was used to describe the motion of both the eVTOL and the UAV, capturing translational and rotational dynamics. A Cartesian inertial coordinate system was defined with the origin located at the lower corner of the simulation domain. Each vehicle was assigned a body-fixed coordinate system, and Euler angles were used to represent attitude and enable coordinate transformation.

(2) Collision Risk Criterion: Collision detection was based on the Euclidean distance between the two vehicles. A safety threshold of $d=10\mathrm{m}$ was adopted, representing a conservative separation distance accounting for vehicle dimensions, rotor downwash effects, and operational safety margins. Specifically, rotor-induced flow disturbances of eVTOL configurations may remain significant within approximately 8 m, while UAV positioning uncertainties (typically within $\pm 2.5\mathrm{m}$) and obstacle avoidance response distances (on the order of 5–10 m) further justify the selection of this threshold. The chosen distance also provides an approximate reaction time window of 0.5–1 s under typical relative velocities [33,34]. A collision event is defined when:

$$d\left(t\right)=\sqrt{{\left[x_e\left(t\right)-x_u\left(t\right)\right]}^2+{\left[y_e\left(t\right)-y_u\left(t\right)\right]}^2+{\left[z_e\left(t\right)-z_u\left(t\right)\right]}^2}<d$$

(1)

(3) Boundary Conditions: The simulation domain was defined in a global Cartesian coordinate system, where x, y, and z denote the spatial axes. Specifically, $x\in [0,1000\mathrm{m}]$, $y\in [0,150\mathrm{m}]$, and $z\in [50,150\mathrm{m}]$, representing a typical low-altitude descent corridor. The simulation time step was set to $\Delta t=0.1\mathrm{s}$. The total simulation duration corresponds to the time required for the eVTOL to descend from 150 m to 50 m at a constant vertical speed of $2\mathrm{m}/\mathrm{s}$, resulting in a total duration of approximately 50 s.

(4) Simulation Setup and Results: A Monte Carlo simulation approach was adopted to evaluate collision risk under stochastic UAV behavior. The eVTOL follows a nominal descent trajectory with a 3° glide slope and a forward velocity of 20 m/s, which corresponds to typical approach or transition flight conditions observed in representative eVTOL platforms. The UAV is modeled as an uncontrolled agent with an initial position following a normal distribution to reflect navigation uncertainty and environmental disturbances such as wind effects. Its velocity is set to approximately 10 m/s, consistent with the typical cruising speed of industrial multirotor UAVs. The resulting relative velocity of approximately 30 m/s represents a realistic lateral encounter scenario in urban low-altitude airspace, where collision risk is generally most critical during low-speed descent or transition phases [35].

A total of 10,000 simulation runs were conducted. As the number of runs increased, the cumulative number of collision events gradually rose and the estimated collision probability exhibited convergence toward a stable value.

Across all simulation runs, a total of 18 collision events were observed, corresponding to an estimated collision probability of approximately 0.18%. The convergence behavior indicates that the selected sample size is sufficient to provide a stable estimate of the collision risk under the defined modeling assumptions.

To provide a more intuitive understanding of the interaction dynamics, a representative collision scenario from the Monte Carlo simulation is illustrated in Figure 2. In this example, the red trajectory denotes a UAV path that leads to a collision with the eVTOL, while the blue trajectories represent non-colliding UAV trajectories. The nominal eVTOL descent trajectory is depicted as a dense line bundle, reflecting its relatively deterministic motion compared with the UAV behavior.

As shown in Figure 2, most UAV trajectories remain separated from the eVTOL path, whereas only a small subset evolves toward collision under unfavorable combinations of initial position and motion direction. This suggests that collision risk is governed not simply by instantaneous proximity but by the dynamic evolution of the relative motion between the two vehicles.

Further insight can be obtained by analyzing the distribution of the minimum separation distance between the eVTOL and UAV across all simulation runs, as shown in Figure 3. The results reveal a highly non-uniform distribution, with a significant concentration of encounters occurring within the 100–200 m range.

Specifically, the 100–200 m interval exhibits the highest frequency among all bins, indicating that most encounters occur at intermediate separation distances rather than at very close or very far ranges. This can be attributed to the relative kinematics of the two vehicles. Given the forward velocity of the eVTOL (20 m/s) and the randomly oriented UAV motion (10 m/s), many encounters produce transient crossing trajectories that reach separation distances on the order of hundreds of meters without necessarily leading to collision.

From a safety perspective, however, such distances cannot be considered negligible. Existing aviation separation concepts, including the well-clear definitions used in Detect-and-Avoid (DAA) systems, emphasize conflict avoidance based on both spatial and temporal thresholds rather than strict distance alone. In low-altitude operations, emerging Unmanned Aircraft System Traffic Management (UTM) and U-space frameworks suggest that separation distances for small unmanned and UAM vehicles are typically on the order of several tens to a few hundred meters, depending on vehicle speed, navigation accuracy, and operational constraints. Studies in UTM and UAM scenarios commonly adopt separation buffers ranging from approximately 50 m to 200 m for conflict detection and resolution purposes.

Therefore, the observed high-frequency region of 100–200 m falls within a critical interaction zone where conflict detection, trajectory prediction, and avoidance decision-making are still required, particularly in the presence of non-cooperative targets. This implies that, although only a small fraction of encounters result in direct collisions, a much larger proportion falls within a potential conflict zone, thereby imposing substantial monitoring, prediction, and decision-making demands on the onboard autonomy system.

In such situations, purely autonomous systems may face challenges due to sensing uncertainty, limited prediction horizon, and ambiguous intent inference of non-cooperative UAVs. Human operators can provide higher-level situational awareness, contextual judgment, and flexible decision-making, thereby serving as a complementary safety layer in abnormal or unforeseen situations.

These results suggest that even in a simplified single-UAV scenario, interactions with non-cooperative airspace users may introduce measurable collision risk in shared low-altitude environments. In realistic urban operations, where traffic density and environmental complexity are higher, such risks may increase further.

3.3. Shared Safety Responsibilities of Pilots and Intelligent Systems

The hybrid human-automation model enables eVTOL systems to leverage the strengths of both automated control and human supervision. Routine functions such as stabilization, trajectory tracking, and fault detection are typically handled by automated systems, while pilots are responsible for mission-level supervision, validation of system behavior, and intervention under off-nominal conditions [36].

From a control-system perspective, the eVTOL can be viewed as a controlled plant receiving commands from both the autopilot and pilot inputs through actuators, with sensors providing continuous feedback to flight computers and crew interfaces. Within this closed-loop structure, pilots monitor system performance, assess whether automated actions remain within expected bounds, and intervene when necessary.

The fault-handling and mode-transition strategies proposed in this work are developed within this shared-authority framework. Low-criticality events may be addressed through autonomous reconfiguration with pilot awareness, whereas higher-criticality or multi-fault scenarios may require explicit pilot confirmation or manual control. This approach is consistent with the functional allocation principles described in Guidelines for Development of Civil Aircraft and Systems (ARP4754A) [37] and the safety assessment processes outlined in ARP4761, which emphasize clear system behavior definition and traceability.

As regulatory frameworks evolve, the balance between automation and human oversight may change over time. However, under current operational and certification conditions, maintaining a pilot-in-command is generally considered an important component in ensuring safety, accountability, and operational acceptability.

3.4. Fundamental Difference Between Ground Vehicles and Aircraft in Safety Architecture

Although comparisons are often made between autonomous ground vehicles and autonomous aircraft, their underlying risk structures, control characteristics, and operational environments differ significantly. Ground vehicles typically operate within relatively structured environments, where traffic lanes, road boundaries, speed limits, and physical constraints provide multiple passive safety layers. In the event of degraded system performance, vehicle motion is largely confined to two dimensions, and mitigation actions such as braking, lane changes, or controlled stopping can often reduce the severity of potential outcomes.

Aircraft, including eVTOLs, operate under fundamentally different conditions. Once airborne, motion is unconstrained in three dimensions, and the vehicle cannot rely on passive containment or friction-based deceleration. In addition, aircraft carry substantial kinetic and potential energy, particularly during low-altitude operations. As a result, loss of control, sensor degradation, or incorrect system responses may lead to rapidly evolving situations with limited recovery margins.

Unlike ground vehicles, aircraft operations generally do not include readily available fallback states equivalent to stopping at the roadside or relying on physical barriers for protection. Consequently, aviation safety architectures place greater emphasis on active control, redundancy, and real-time decision-making. Within this framework, human pilots can provide an additional layer of supervision, particularly in situations requiring rapid contextual assessment, evaluation of forced-landing options, or adaptation to unforeseen environmental conditions.

These differences suggest that autonomy concepts developed for ground vehicles may not be directly applicable to aircraft without adaptation. In the context of UAM, where operations occur in dense environments with limited contingency options and higher third-party risk, maintaining a HITL supervisory structure is generally considered a practical approach during the near-term deployment phase, even as automation capabilities continue to evolve.

4. Quantifying the Collaboration Between Pilots and Intelligent Systems: A Fault Tree Analysis

This section uses a FTA framework to quantify the safety implications of combining human pilots with intelligent systems in eVTOL operations. Two representative scenarios are considered: one relying solely on automated control and another incorporating pilot intervention.

4.1. AE200 System Description and Operational Profile

The AE200 is a representative eVTOL aircraft developed by Aerofugia. It adopts a distributed electric propulsion configuration consisting of eight motors, including four tiltable inner rotors and four fixed outer rotors, as shown in Figure 4.

Each electric motor adopts a dual-winding design, and each motor controller is implemented with dual-redundant channels. This architecture improves fault tolerance so that the failure of a single winding or a single controller channel does not directly lead to a catastrophic system-level failure.

During vertical takeoff, the aircraft operates in a multirotor configuration. As altitude increases, the four inner rotors gradually tilt forward, enabling the transition from rotor-borne flight to forward flight. During descent and landing, the rotors tilt backward, allowing the aircraft to return to rotor mode.

The flight operation of the AE200 consists of multiple phases, including vertical takeoff, transition to forward flight, climb, cruise, descent, reverse transition, and vertical landing, as shown in Figure 5. These phases involve significant variations in flight dynamics, control authority, and safety margins, and therefore provide the operational context for defining failure conditions and associated risk levels.

During nominal operation, flight control tasks are primarily executed by the automatic flight control system. In the presence of system degradation or control anomalies, the pilot may assume supervisory or direct control as required. This interaction between human operators and automation is an important consideration in the design of failure handling strategies.

4.2. Failure Scenario Definition for FTA

Based on the propulsion architecture described above, a representative failure scenario is defined as a single motor failure during flight, as illustrated in Figure 6.

In the AE200 aircraft, each electric motor consists of a driving unit and a controller. The driving unit adopts a dual-winding configuration, while the controller uses a dual-channel redundant design, in which both Channel A and Channel B are capable of controlling each winding. Under nominal conditions, the motor controller receives commands from the flight control computer and regulates both windings to provide the required power output.

This configuration provides basic fault tolerance. If one winding fails, the remaining winding can still provide approximately 75% of nominal thrust, allowing continued flight. If one controller channel fails, control can be switched to the other channel to maintain normal operation. At the system level, the distributed propulsion architecture allows the aircraft to tolerate the loss of a single motor, with the remaining motors providing sufficient thrust and control authority to maintain stable flight.

Under normal conditions, the flight control system is expected to detect such faults and redistribute thrust to maintain stability. In this case, the failure is not considered catastrophic. However, if the motor failure occurs together with a failure in fault detection or control response, such as sensor degradation, control logic errors, or communication faults, the system may fail to execute the required recovery actions. In such cases, the failure can escalate and may require pilot intervention to prevent loss of control.

According to current eVTOL airworthiness frameworks such as EASA SC-VTOL, high-severity failure conditions are typically required to satisfy probability targets on the order of ${10}^{-8}$ per flight hour. Based on the system architecture and failure scenario defined above, fault tree models are constructed in the following sections. The top-level event is decomposed into factors related to propulsion failure, fault detection, control response, and, when applicable, human intervention.

4.3. FTA Without Human Intervention

From a safety assessment perspective, a representative high-severity condition is defined as the combination of a single motor failure and the loss of the autonomous fault-handling function. For the baseline analysis, this condition is assessed against the target probability level of ${10}^{-8}$ per flight hour.

Following the methodology outlined in ARP4761, the top-level failure event is decomposed into contributing sub-events through a fault tree structure. For this preliminary analysis, probability allocation is performed using a uniform assumption across the primary branches to provide a baseline estimate of individual event probabilities.

Based on the AE200 propulsion and control architecture, the top-level event is decomposed into several basic events, including loss of winding 1, loss of winding 2, motor controller failure, loss of fault information output, failure of flight control fault-handling logic, and loss of command output from the flight control computer. The logical relationships among these events are shown in Figure 7.

Failure rate data for these components are referenced from established reliability handbooks such as Military Handbook: Reliability Prediction of Electronic Equipment (MIL-HDBK-217) [38], which provides empirical models for electronic component reliability. Typical failure rate ranges are on the order of ${10}^{-5}$ per flight hour for motor drive units, ${10}^{-6}$ to ${10}^{-5}$ per flight hour for motor controllers, and ${10}^{-7}$ to ${10}^{-6}$ per flight hour for avionics interfaces and processing units.

These reference values are used only to check whether the assumed event probabilities are within a reasonable engineering range. Under the baseline assumptions, the resulting probability of the top-level event is consistent with the required safety target. This result should be understood as an architecture-level estimate under nominal assumptions rather than a direct representation of large-scale urban operational conditions.

4.4. FTA with Human Intervention

In the second scenario, pilot intervention is introduced into the fault tree as an additional safety layer, as shown in Figure 8. Unlike the baseline fault tree, where only system-level failures are considered, this extended model explicitly incorporates human response following the loss of the autonomous fault-handling function.

From a system design perspective, airworthiness requirements are not normally defined by relying on pilot intervention to satisfy safety targets. However, in practical low-altitude operations, pilot actions form an important part of the overall safety framework and can reduce the probability of high-severity events under degraded conditions.

Considering the operational characteristics of eVTOL systems in complex urban environments, the probability of the combined event “single motor failure with loss of fault-handling function” is conservatively adjusted to the order of ${10}^{-6}$, reflecting increased operational uncertainty in dense and less structured low-altitude environments. Compared with conventional civil aviation operations, low-altitude UAM is expected to involve higher traffic density, more frequent operations, operation in less structured airspace without centralized air traffic control services [39], and increased interaction with weakly coordinated or non-cooperative users [40]. These factors introduce additional uncertainty and make it more difficult to maintain the level of system reliability typically assumed in traditional aviation environments.

When human reliability is taken into account, the top-level event is defined as the combined occurrence of system failure and ineffective pilot response. For modeling convenience, these two events are treated as approximately independent and are therefore connected through an AND relationship in the fault tree. This is a simplifying assumption, since human performance in practice may be affected by system state, workload, and situational complexity.

Based on established human reliability analysis (HRA) methodologies, the probability of unsuccessful pilot response is conservatively assumed to be on the order of ${10}^{-2}$ under time-critical and high-workload conditions. This range is consistent with widely reported human error probabilities in classical HRA methods, such as the Technique for Human Error Rate Prediction (THERP) and the Cognitive Reliability and Error Analysis Method (CREAM), where human error probabilities for cognitively demanding or time-constrained tasks typically fall within the range of ${10}^{-3}$ to ${10}^{-2}$ [41,42].

For trained operators performing repetitive tasks in complex operational environments, reported error rates are broadly consistent with this range, typically on the order of a few percent or lower, depending on workload and situational complexity. In this study, the upper bound (${10}^{-2}$) is selected as a conservative assumption to avoid underestimation of human-related risks. This assumption is consistent with the CREAM framework. Under these assumptions, the resulting top-level event probability can still satisfy the target level of ${10}^{-8}$ per flight hour [43].

To refine the human reliability model, pilot actions in the AE200 single motor failure scenario are decomposed according to the actual human–machine interface and operating procedure.

In the AE200 aircraft, flight control is performed using left and right control sticks (see Figure 9 and Figure 10), while system-level actions and mode switching are carried out via the front and overhead panels. For the propulsion system, a manual motor shutdown function is implemented on the overhead panel, as shown in Figure 11.

In the event of a motor failure combined with the loss of autonomous fault handling, the pilot is required to manually shut down the affected motor using the overhead panel switch and then perform control compensation using the control stick.

Based on this operating sequence, pilot failure is decomposed into four basic events: failure to operate the overhead panel shutdown switch, incorrect operation of the overhead panel switch, failure to perform control stick compensation, and incorrect control stick compensation. This decomposition corresponds to two basic classes of human error: action omission and incorrect action execution.

For simplicity, the upper-level probability is equally allocated among these four basic events, resulting in a probability requirement of no more than $2.5\times {10}^{-3}$ for each event. This allocation is consistent with the assumed overall human error probability of ${10}^{-2}$, ensuring that the decomposition remains probabilistically coherent.

According to available human reliability data, the probability of action omission is typically on the order of ${10}^{-3}$, while incorrect action execution is on the order of ${10}^{-4}$. In more complex operational environments, reported omission probabilities may increase to the order of ${10}^{-3}$ to ${10}^{-2}$, depending on workload, time pressure, and situational uncertainty. These values remain within the bounds required by the allocated probability for each basic event and therefore support the feasibility of the adopted human reliability model.

Compared with the purely autonomous scenario, pilot intervention in this analysis does not serve as an additional margin applied to an already compliant system. Instead, it acts as a compensatory safety mechanism under more realistic degraded operating conditions. In this sense, human–machine collaboration helps maintain compliance with the target safety level when system-level reliability is reduced.

The present analysis is intended as an engineering-level approximation to support conceptual safety assessment, rather than a certification-level validation.

5. Economic Trade-Offs Between Hybrid and Fully Autonomous eVTOL Models

Hybrid operations introduce continuous human-related costs, including training, salaries, and recurrent qualification requirements. In contrast, fully autonomous operations eliminate pilot-related expenses but require substantial upfront investment in sensing, computing, communication, and cybersecurity infrastructure, much of which must be established prior to large-scale deployment [44].

From a system economics perspective, this trade-off can be understood across three main components: aircraft-level hardware cost, human-related operational cost, and infrastructure-level investment. While full autonomy may offer long-term cost advantages, hybrid architectures can reduce initial deployment barriers by lowering both onboard system requirements and infrastructure dependencies.

5.1. Aircraft-Level Cost Trade-Offs: Onboard Sensing and Computing

A key distinction between hybrid and fully autonomous architectures lies in the onboard sensing and computing systems required to achieve acceptable safety levels. Fully autonomous eVTOL systems must rely entirely on onboard perception and decision-making, whereas hybrid configurations allow part of this responsibility to be absorbed by the pilot.

This leads to several coupled trade-offs:

Weight versus detection capability: Increasing detection range and coverage typically requires higher transmit power, larger apertures, and more capable sensing systems. This increases system mass and power consumption, directly affecting payload capacity and flight range. Fully autonomous configurations generally require more conservative and comprehensive sensing coverage, leading to higher weight penalties.

Physical integration versus system complexity: High-performance sensing often requires multi-sensor configurations and larger installations, increasing structural integration complexity, electromagnetic compatibility constraints, and maintenance burden. These factors contribute to higher engineering and certification costs.

Performance versus unit cost: Achieving robust perception under diverse environmental conditions requires advanced and often expensive components. This increases per-aircraft capital cost, particularly in early deployment phases when production scale is limited.

Human pilots, in hybrid architectures, effectively act as a system-level redundancy that can compensate for residual perception limitations. As a result, some sensing requirements can be relaxed in early deployment scenarios, reducing the need for high-end hardware and lowering initial aircraft [45].

However, this benefit must be balanced against ongoing operational costs associated with pilots. Over long time horizons and at large fleet scales, these recurring costs may offset or exceed the additional capital investment required for fully autonomous systems. Therefore, the relative economic advantage depends strongly on assumptions regarding fleet utilization, hardware cost trends, and operational scale.

5.2. System-Level Cost Trade-Offs: Infrastructure, Connectivity, and Cybersecurity

Fully autonomous operations also impose significant requirements on ground infrastructure and network systems. Many autonomy concepts rely on a Smart City (SC) ecosystem with dense communication coverage, edge computing capability, and distributed sensing networks. In practice, such infrastructure is still at an early stage of deployment, particularly in urban low-altitude environments.

Achieving aviation-grade reliability would require communication networks capable of providing continuous and redundant connectivity across operational airspace. This includes reliable service at flight altitudes, expansion of 4G/5G/6G or dedicated command-and-control links, and supporting infrastructure such as backhaul systems, power redundancy, and real-time monitoring.

In addition, distributed sensing systems, for example like urban lidar, radar, or camera networks, may be required to enhance situational awareness. The deployment of such systems at city scale would involve significant investment and coordination, potentially delaying large-scale adoption [46].

Cybersecurity requirements also become more demanding in highly connected autonomous systems. Communication links, software update mechanisms, and distributed computing interfaces increase system exposure to potential threats. Ensuring aviation-grade cybersecurity requires mechanisms such as secure boot, code signing, intrusion detection, and continuous monitoring, all of which introduce additional development and operational costs.

Hybrid architectures, by retaining human oversight, provide an additional operational safeguard in scenarios involving degraded communication or partial system failure. While this does not eliminate infrastructure or cybersecurity requirements, it reduces the system’s dependence on their full maturity.

For these reasons, SC infrastructure should not be treated as a strict prerequisite for initial eVTOL deployment. Hybrid architectures provide a more feasible entry point by reducing both aircraft-level and infrastructure-level cost constraints. As sensing, communication, and computing technologies mature, a gradual transition toward higher levels of autonomy can be achieved in a more scalable and economically sustainable manner.

6. Public Perception and Regulation

As eVTOL technology advances, public perception and regulatory frameworks will play a decisive role in shaping its path toward large-scale adoption. Fully autonomous operations introduce challenges not only in technical safety assurance but also in public trust, accountability, and certification feasibility.

Public concerns regarding fully autonomous eVTOL systems primarily stem from two sources: uncertainty in system behavior and ambiguity in responsibility allocation. While autonomous technologies continue to improve, the lack of deterministic guarantees in complex environments and the absence of a clearly defined decision-maker remain key barriers to acceptance.

6.1. Public Trust and Acceptance

Although fully autonomous eVTOL systems offer long-term potential, public acceptance remains cautious, particularly in urban environments with high operational complexity. Surveys on autonomous transportation reflect this hesitancy. A Gartner survey indicated that 55% of respondents in the U.S. and Germany would not consider using fully autonomous cars, and a 2017 UBS survey reported that only 17% of passengers would be willing to fly in an unmanned aircraft, with 54% rejecting the idea even if ticket prices were reduced [47,48]. At the same time, targeted applications show higher acceptance; for example, 83% of respondents in a European Union survey expressed optimism regarding eVTOL use in emergency medical services, although safety and privacy concerns remain significant [49].

Beyond general safety concerns, public perception is also influenced by how complex operational decisions are handled. In emergency scenarios, such as forced landings under degraded conditions, multiple feasible landing sites may be available, each associated with different trade-offs between third-party risk and occupant safety. One option may offer more favorable landing conditions but involve higher population density, while another may reduce external risk but introduce higher uncertainty or risk to occupants.

Such scenarios illustrate that operational decision-making often involves context-dependent judgment, including safety prioritization, risk distribution, and situational interpretation. These factors are difficult to fully formalize within current autonomous decision frameworks, particularly when ethical and operational considerations must be addressed simultaneously.

Similarly, onboard contingencies unrelated to flight mechanics may affect safety and public confidence. Situations such as passenger medical emergencies or disruptive behavior require timely assessment and coordinated response. In conventional aviation, these responsibilities are supported by onboard crew and ultimately overseen by the pilot-in-command. In fully autonomous configurations, the absence of such human roles introduces additional challenges in terms of response coordination and responsibility allocation.

These representative scenarios highlight that, beyond nominal system performance, real-world operations require decision-making under uncertainty and context-specific judgment. Human pilots provide a decision authority layer capable of integrating contextual information, resolving ambiguity, and maintaining accountability in such situations. From a public perception standpoint, this human involvement can enhance confidence and perceived safety during early deployment stages of UAM [50].

6.2. Regulatory Challenges and Human Pilot Role

From a certification perspective, a central challenge in fully autonomous eVTOL systems lies in demonstrating deterministic and verifiable behavior across all operational conditions. Existing regulatory frameworks, including those developed by the FAA and the EASA, are largely based on piloted aircraft. Extending these frameworks to cover fully autonomous operations is expected to require substantial validation effort and operational evidence.

Hybrid configurations provide a more practical pathway for regulatory alignment. By retaining a human pilot, these systems introduce an additional operational safeguard, which can reduce the burden of demonstrating complete autonomy in all scenarios and facilitate incremental certification.

A specific technical challenge arises from false positives in perception systems. Unlike ground vehicles, aerial platforms have limited options for safely halting or delaying motion. In such environments, incorrect detection or classification may trigger unnecessary avoidance maneuvers, potentially introducing additional risk.

For illustrative purposes, consider a hypothetical UAM scenario in which 500 eVTOL aircraft operate within a metropolitan area, each performing approximately 20 flights per day. Assuming a conservative false positive rate of 0.01% per minute and an average flight duration of 15 min, this corresponds to approximately 0.0015 false alarms per flight. At the fleet level, this would result in approximately 15 false alarms per day, some of which may occur during critical flight phases such as takeoff and landing.

Such frequency and timing constraints present challenges for fully autonomous systems in terms of both real-time response and certification assurance. Human operators can provide contextual filtering, suppress inappropriate responses, and improve overall operational robustness under such conditions.

6.3. Driving Broader Adoption

The role of human pilots extends beyond technical safety and regulatory considerations, and also affects the broader adoption of eVTOL systems. By maintaining a human-in-the-loop architecture, hybrid systems provide a bridge between advanced automation and operational trust.

Hybrid models also support integration with existing airspace management frameworks. In particular, coordination between UTM and conventional Air Traffic Management (ATM) systems remains an important aspect of UAM deployment. Human pilots can facilitate compliance with established procedures and support interaction in mixed airspace environments.

Overall, hybrid operational models serve as a practical pathway for aligning technological capability, regulatory requirements, and public acceptance. By enabling early deployment while maintaining safety and accountability, they provide a foundation for gradually increasing levels of autonomy as supporting technologies, infrastructure, and regulatory frameworks mature.

7. Discussion: Novelty, Limitations, and Future Directions

This section summarizes the main contributions of this study, discusses its limitations, and outlines directions for future work. The overall objective is to support the development of hybrid eVTOL operational concepts that are both technically feasible and practically deployable in complex urban environments.

7.1. Contributions Beyond Existing Literature

This study provides a system-level perspective on the role of human–machine collaboration in eVTOL operations. Compared with existing work, which often focuses on isolated aspects such as perception, control, or autonomy algorithms, the present analysis highlights several distinguishing contributions.

1. System-level reinterpretation of autonomy limitations

The study shows that the limitations of fully autonomous eVTOL systems are not confined to perception accuracy or control performance. Instead, they arise from a broader set of challenges, including environmental uncertainty, decision-making complexity, response-time constraints, and operational variability. This shifts the discussion from algorithm-level performance to system-level capability.

2. Quantitative and scenario-based grounding of human involvement

Rather than treating human pilots as a qualitative fallback, this work connects human involvement with specific system-level constraints. By combining fault tree analysis, Monte Carlo simulation of external risks, and representative operational scenarios, the study provides a structured basis for understanding how human operators contribute to safety, robustness, and decision-making under uncertainty.

3. Integration of technical, economic, and regulatory considerations

The analysis extends beyond technical feasibility by incorporating sensor size, weight, and power (SWaP) constraints, infrastructure maturity, communication requirements, and certification challenges. This integrated perspective links system design with deployment constraints, providing a more realistic assessment of the pathway from hybrid to fully autonomous operations.

7.2. Limitations of the Current Approach

The limitations of this study mainly arise from the trade-off between model tractability and real-world complexity.

1. Simplified representation of urban environmental uncertainty

The hazard simulations are based on simplified spatial distributions and UAV behavior models. In reality, urban environments involve more complex traffic patterns, weather effects, and sensing limitations that are not fully captured in the current framework.

2. Static role allocation between human and automation

The analysis assumes fixed roles for pilots and automated systems. In practice, the allocation of control authority may vary depending on workload, system state, and environmental conditions.

3. Use of generic human reliability assumptions

Human response behavior is represented using simplified probabilistic models. Due to the lack of eVTOL-specific human factors data, these assumptions may not fully reflect actual pilot performance in low-altitude urban operations.

4. Qualitative treatment of ethical and legal aspects

Even though the study identifies challenges related to responsibility allocation and decision-making under uncertainty, these aspects are discussed qualitatively and are not incorporated into the quantitative framework.

5. Simplified treatment of infrastructure and cost variability

The economic and infrastructure analysis does not explicitly account for regional differences in deployment cost, technology maturity, or scalability, which may influence practical implementation.

6. Dependence on consistent assumptions across integrated analyses

The study combines simulation, FTA, and qualitative reasoning under a unified framework. The validity of the overall conclusions depends on the consistency of assumptions across these components.

7.3. Future Research Directions

Future work should focus on improving the integration between human, system, and environmental models, as well as addressing practical challenges in certification and deployment.

From a technical perspective, further research is needed on adaptive human–machine role allocation, where control authority can be adjusted dynamically based on workload, uncertainty, and system performance. In addition, the development of high-fidelity urban airspace models, incorporating realistic traffic patterns, environmental conditions, and sensing limitations, would improve the accuracy of safety assessments. Experimental studies on eVTOL-specific human factors, including response time, workload, and decision behavior, are also required to refine current assumptions.

From a regulatory and certification perspective, future work should focus on clarifying responsibility allocation in hybrid and autonomous operations, as well as developing verification metrics for AI-based systems. This includes establishing standards for perception performance, response-time requirements, and system robustness under urban operating conditions. The evolution of pilot-in-command definitions, particularly in hybrid or remotely supervised configurations, also requires further study.

In addition, certification approaches tailored to hybrid systems need to be developed, balancing safety requirements with practical deployment constraints. Methods for evaluating AI-based components, including scenario-based testing and explainability techniques, remain an important research area.

Finally, infrastructure and system integration challenges should be addressed. This includes cybersecurity for connected eVTOL systems, assessment of SC readiness in terms of communication and sensing coverage, and the integration of UTM and conventional air traffic management systems in mixed operational environments.

Overall, the transition toward fully autonomous eVTOL operations should be understood as a system-level evolution rather than a purely technological progression. Achieving this transition will require coordinated advances in system design, regulation, infrastructure, and operational concepts.

8. Conclusions

This study investigates the role of human–machine collaboration in eVTOL operations from a system-level perspective, integrating fault tree analysis, low-altitude hazard statistics, and scenario-based simulation.

The results show that, under the representative failure scenario considered in this work, pilot intervention introduces an additional mitigation pathway in the fault tree. When more realistic low-altitude operational conditions are considered, the system-level failure probability is conservatively adjusted to the order of ${10}^{-6}$. Under the adopted human reliability assumptions, pilot intervention enables the overall probability of the top-level catastrophic event to be maintained at the target level of ${10}^{-8}$ per flight hour. While this result relies on simplified modeling assumptions, it illustrates the compensatory role of human intervention under degraded system performance.

In parallel, the analysis of low-altitude operational risks, including CAAC statistical data and Monte Carlo simulations of UAV encounters, indicates that external hazards in urban airspace are non-negligible and may not be fully predictable or exhaustively modeled. Under such conditions, purely automated perception and decision-making systems may face challenges in addressing off-nominal scenarios, particularly in the presence of sensor degradation, environmental uncertainty, and non-cooperative actors.

Beyond safety considerations, the study also examines engineering, economic, and regulatory aspects. The results suggest that achieving fully autonomous eVTOL operations would require substantial investments in sensing, computation, communication infrastructure, and certification validation. In contrast, hybrid architectures can leverage human oversight to reduce system complexity and better align with existing regulatory frameworks during early deployment stages.

Taken together, these findings support the view that human–machine collaborative operational models provide a practical approach for near-term eVTOL deployment. Rather than serving solely as a transitional solution, such architectures allow automated systems to operate with human supervision, improving robustness in complex and uncertain environments.

At the same time, the results of this study do not exclude the possibility of higher levels of autonomy in the long term. Instead, they suggest that the transition toward full autonomy is likely to be progressive, requiring improvements in perception reliability, decision transparency, certification methodologies, and supporting infrastructure. Within this context, human–machine collaboration can serve as an intermediate step toward safe and scalable deployment.