A 2025 STPA (System-Theoretic Process Analysis) study by Elizebeth et al. provided the first comprehensive operations-level hazard analysis of passenger-carrying electric vertical take-off and landing (eVTOL) aircraft in current airspace, but it deliberately assumed a human-piloted vehicle with no autonomous flight capabilities and conventional (human) air traffic management. The study's authors explicitly identify as open future work the exploration of 'the consequences of automating air traffic management and integrating autonomous functionalities in eVTOLs'. No published work yet performs a comprehensive, multi-stakeholder, full-mission STPA of passenger eVTOL operations that models both automated air traffic management functions and on-board autonomy and derives the resulting unsafe control actions, causal factors, safety requirements, and regulatory gaps. Fragments exist — landing-phase automation-level selection (Borges et al. 2024), certification-oriented preliminary STPA (Ferreira Filho & Cardoso Júnior 2024), STPA of unmanned traffic management for package delivery (Antoniazzi et al. 2024) — but none covers the combined scope. The open problem is the systematic extension of the operations-level STPA baseline to autonomy-inclusive eVTOL operations, including the human-automation interaction hazards such a control structure introduces.

Background

Electric vertical take-off and landing (eVTOL) aircraft are battery-electric aircraft intended for short passenger and cargo flights within and around cities, as part of the emerging Advanced Air Mobility (AAM) transportation concept; its urban segment is called Urban Air Mobility (UAM). Operating these aircraft at scale requires vertiports (dedicated take-off/landing and charging infrastructure), airspace redesign, and coordination among many actors: the regulator, the air navigation service provider (ANSP, the organization managing air traffic), the eVTOL operator, the vertiport operator, the manufacturer, and the flight crew. Because this sociotechnical system has no operating precedent, its hazards cannot be exhaustively derived from historical accident data, which motivated the application of systems-theoretic hazard analysis.

STPA (System-Theoretic Process Analysis) is a hazard-analysis method built on the STAMP accident model of Nancy Leveson, in which safety is treated as a control problem rather than a component-reliability problem: accidents arise from unsafe interactions among system components, including software and human decision-makers, even when no component 'fails'. An STPA analysis proceeds by (1) defining the purpose of the analysis (losses, system-level hazards, safety constraints), (2) modeling the system as a control structure — a diagram of controllers, controlled processes, and feedback/ command loops across the sociotechnical hierarchy — and (3) identifying Unsafe Control Actions (UCAs), i.e., control actions that are provided when they should not be, not provided when they should be, provided too early/too late/in the wrong order, or applied too long/stopped too soon. Step (4) identifies loss scenarios and causal factors (the conditions — component failures, human decision errors, flawed information, process-model inconsistencies — that can lead to a UCA or make its hazard realizable) and derives safety requirements to prevent or detect them.

Elizebeth, Chen, El Badaoui, Khastgir, and Jennings (2025, arXiv:2510.09283; UK Department for Transport / Civil Aviation Authority project GFA 3549) applied STPA to a concept of passenger eVTOL operations in UK airspace, covering regulatory preparation, operational preparation, take-off, cruise, and descent/landing phases, with stakeholders including the regulator, ANSP, eVTOL operator, vertiport operator, manufacturer, and the onboard commander. To manage the scale of results (317 UCAs, 377 causal factors, 432 requirements), they applied a novel prioritization extension to STPA (developed in the companion framework paper by El Badaoui, 2025, arXiv:2508.10446) combining expert judgment and Monte Carlo simulation, yielding 124 high-priority requirements; comparison against existing aviation regulations, policies, and procedures flagged 56 of these as regulatory gaps. Crucially, the analysis assumed an eVTOL with one onboard human pilot and 'no autonomous flight capabilities', and modeled the current, human-centered air traffic management system. The paper's conclusions state that future work 'could also explore the consequences of automating air traffic management and integrating autonomous functionalities in eVTOLs', noting the very limited research in this area. This framing is consistent with regulator interest: the paper cites a 2024 multi-authority evaluation of STPA (its ref. [53], involving the FAA, EASA, ICAO, and NASA) concluding that STPA is applicable to future technologies such as increasing autonomy and eVTOL.

Adjacent literature covers only fragments of this question. Markov, Bendarkar, and Mavris (2022) used STPA for conceptual design of novel distributed-electric-propulsion vehicle configurations — a vehicle-level, not operations-level, analysis. Borges, Cardoso Junior, and Castilho (2024) proposed a three-phase framework that applies STPA to eVTOL landing operations in urban centers and selects the safest level of automation (LoA) per individual control action, finding 'automated decision making' safest for the landing control actions studied — a single flight phase with pilot–automation allocation, not a full-mission, multi-stakeholder analysis including the ANSP/ATM side. Ferreira Filho and Cardoso Júnior (2024) performed a preliminary STPA-oriented analysis of the eVTOL product, manufacturer, and operator (human or autonomous) to support certification — certification-focused and explicitly preliminary. Antoniazzi et al. (2024) conducted a preliminary STPA of UTM (UAS Traffic Management, the unmanned-aircraft traffic management concept) for urban package delivery — an automated-ATM context but for unmanned cargo operations, not passenger eVTOL operations. Banik, Kim, Hovakimyan, Carlone, Thomas, and Leveson (2024) integrated STPA with a vision system for autonomous take-off and landing of small VTOL unmanned aerial vehicles. Graydon, Neogi, and Wasson (2020, NASA/AIAA) gave guidance on which hazard-analysis techniques (including STPA) are appropriate for designing safety into UAM, arguing that system-level techniques are needed for increasingly automated operations, but did not perform such an analysis. None of these works, individually or jointly, delivers the autonomy-inclusive counterpart of the Elizebeth et al. baseline: an operations-level STPA of passenger eVTOL operations in which both the ground/ANSP air traffic management functions are automated and the aircraft itself carries autonomous flight functionalities.

Problem Statement

Extend the operations-level STPA of passenger eVTOL operations to an autonomy-inclusive operational concept, as explicitly identified as future work by Elizebeth et al. (2025, arXiv:2510.09283): construct the control-structure model(s) of eVTOL operations in which (a) air traffic management functions (e.g., separation, sequencing, flight authorization, monitoring, and alerting currently performed by air navigation service provider controllers) are automated to some specified degree, and (b) the eVTOL itself integrates autonomous flight functionalities to a specified level of automation/autonomy, spanning the same sociotechnical stakeholders and operational phases as the piloted baseline (regulatory preparation, operational preparation, take-off, cruise, descent and landing). The specified degrees of ATM automation and on-board autonomy must make the operational concept genuinely autonomy-inclusive: it must go beyond the piloted baseline of Elizebeth et al. (2025), which assumed one onboard human pilot, 'no autonomous flight capabilities', and human-centered air traffic management, so that a relabeled reproduction of that baseline does not satisfy the statement. Apply the STPA steps to this concept: identify the new or changed unsafe control actions introduced by the reallocation of control between humans and automation on both the ground and the aircraft, identify the associated loss scenarios and causal factors — including those arising from human-automation interaction such as function handover between human supervisors and automated controllers, degraded human oversight of automated processes, and automation behavior outside human expectation — derive the corresponding safety requirements, and compare the results against both the piloted baseline (which new UCAs, causal factors, and requirements appear, and which disappear) and existing aviation regulations, policies, and procedures to identify the resulting regulatory gaps. The analysis must make the derivation of each safety requirement and regulatory gap traceable to the corresponding unsafe control actions and causal factors.

References

  1. Mariat James Elizebeth, Shufeng Chen, Halima El Badaoui, Siddartha Khastgir, Paul Jennings (2025), 'Safety Analysis of eVTOL Operations based on STPA', arXiv:2510.09283, DOI: 10.48550/arXiv.2510.09283, https://arxiv.org/abs/2510.09283
  2. Shufeng Chen, Halima El Badaoui, Mariat James Elizebeth, Takuya Nakashima, Chris Booth, Siddartha Khastgir, Paul Jennings (2026), 'Introducing a scalable framework for the management of STPA requirements: A case study on eVTOL operations', Safety Science, DOI: 10.1016/j.ssci.2026.107211, https://doi.org/10.1016/j.ssci.2026.107211 (preprint: arXiv:2508.16708, https://arxiv.org/abs/2508.16708)
  3. Sarah Francisca de Souza Borges, Moacyr Machado Cardoso Junior, Diogo Silva Castilho (2024), 'Method for Defining the Automation Level of an eVTOL', Journal of Aerospace Technology and Management, Vol. 16: 1342, DOI: 10.1590/jatm.v16.1342, https://doi.org/10.1590/jatm.v16.1342
  4. Bemildo Alvaro Ferreira Filho, Moacyr Machado Cardoso Júnior (2024), 'PRELIMINARY ANALYSIS TO AID REGULATORY AGENCIES IN THE EVTOL CERTIFICATION PROCESS USING SYSTEMS-THEORETIC PROCESS ANALYSIS (STPA)', Anais do XXI Simpósio de Transporte Aéreo (SITRAER 2024), DOI: 10.29327/xxi-sitraer-2024.895760, https://doi.org/10.29327/xxi-sitraer-2024.895760
  5. Mauricio Antoniazzi, Rafael Hickmann Albarello, Rafael Cenato, André Luiz Elias Melo, Celso Massaki Hirata, Rubens José Maleiner (2024), 'CONDUCTING A PRELIMINARY STPA ANALYSIS OF UNMANNED AIRCRAFT SYSTEM TRAFFIC MANAGEMENT (UTM): A CASE STUDY ON PACKAGE DELIVERY IN URBAN ENVIRONMENTS', Anais do XXI Simpósio de Transporte Aéreo (SITRAER 2024), DOI: 10.29327/xxi-sitraer-2024.881951, https://doi.org/10.29327/xxi-sitraer-2024.881951
  6. Sandeep Banik, Jinrae Kim, Naira Hovakimyan, Luca Carlone, John P. Thomas, Nancy G. Leveson (2024), 'Integrating Vision Systems and STPA for Robust Landing and Take-Off in VTOL Aircraft', arXiv:2412.09505, DOI: 10.48550/arXiv.2412.09505, https://arxiv.org/abs/2412.09505
  7. Mallory Graydon, Natasha A. Neogi, Kimberly Wasson (2020), 'Guidance for Designing Safety into Urban Air Mobility: Hazard Analysis Techniques', AIAA Scitech 2020 Forum, DOI: 10.2514/6.2020-2099, https://doi.org/10.2514/6.2020-2099
  8. Alex Markov, Mayank V. Bendarkar, Dimitri N. Mavris (2022), 'Improved Hazard Analysis for Novel Vehicle Configurations Using the Systems-Theoretic Process Analysis', AIAA SciTech 2022 Forum, DOI: 10.2514/6.2022-0260, https://doi.org/10.2514/6.2022-0260
  9. Nancy G. Leveson (2012), 'Engineering a Safer World: Systems Thinking Applied to Safety', The MIT Press, DOI: 10.7551/mitpress/8179.001.0001, https://doi.org/10.7551/mitpress/8179.001.0001
  10. Halima El Badaoui (2025), 'A Structured Framework for Prioritizing Unsafe Control Actions in STPA: Case Study on eVTOL Operations', arXiv:2508.10446, DOI: 10.48550/arXiv.2508.10446, https://arxiv.org/abs/2508.10446