eVTOL Safety Analysis

Which propulsion architecture is safest? A fault tree comparison of electric Vertical Takeoff and Landing (eVTOL) aircraft with 6, 8, and 12 electric propulsion units.

How many electric propulsion units should an eVTOL aircraft have? We compared five common architectures, with 6, 8, or 12 Electric Propulsion Units (EPUs), using a fault tree analysis of the loss of vertical thrust.

Key findings

  • 8 propulsion units with 4 battery packs is the optimum architecture from a safety, cost, and Size, Weight, and Power (SWaP) perspective.
  • More propulsion units do not make an aircraft safer. The probability of losing 2 opposing pairs rises from 100% at 6 units to 500% at 12, relative to 6 units.
  • Fewer propulsion units must each be larger. After a failure, each remaining unit must deliver 150% of its nominal power with 6 units, but only 120% with 12.
  • Of the 6-unit architectures, only the 4-battery version is certifiable, and only with independent power electronics, motor controllers, and motor windings in each propulsion unit.

Ranking

The ranking weighs the probability of losing vertical thrust against the power each propulsion unit must deliver after a failure, and against certifiability. It therefore does not follow the probabilities alone.

RankArchitectureLoss of vertical thrust
18 EPUs, 4 battery packs6.2E-9
212 EPUs, 6 battery packs1.6E-8
36 EPUs, 4 battery packs, 2 windings per EPU1.1E-8
46 EPUs, 3 battery packs3.1E-9
56 EPUs, 2 battery packs, 1 winding per EPUNot quantified
64 vertical EPUs with Individual Blade Control (IBC)Not quantified
74 vertical EPUs without IBCNot quantified

Why 8 propulsion units is optimum

Relative power (% of nominal)Relative probability (% of 6 EPU)6 EPUs (number): Relative power (% of nominal) 150%150%8 EPUs (number): Relative power (% of nominal) 133%133%10 EPUs (number): Relative power (% of nominal) 125%125%12 EPUs (number): Relative power (% of nominal) 120%120%6 EPUs (number): Relative probability (% of 6 EPU) 100%100%8 EPUs (number): Relative probability (% of 6 EPU) 200%200%10 EPUs (number): Relative probability (% of 6 EPU) 333%333%12 EPUs (number): Relative probability (% of 6 EPU) 500%500%
Show the chart data
EPUsRelative power (% of nominal)Relative probability (% of 6 EPU)
6150%100%
8133%200%
10125%333%
12120%500%

Increasing the number of propulsion units increases, rather than decreases, the probability of a failure, because there are more units that can fail. However, as the number of propulsion units decreases, the power each must generate after certain failures increases, which raises their SWaP. 8 propulsion units balances the two.

Loss of 50% of thrust is assumed to be catastrophic during vertical takeoff and landing. Therefore, of the 6-unit architectures, the 4-battery architecture, as opposed to the 2-battery architecture, is the only one that is certifiable. This depends on independent power electronics, motor controllers, and motor windings at the propulsion unit level.

Assumptions

  • Relative power is the power required after the failure of an opposing pair or triplet.
  • Relative probability is the probability of a failure of 2 separate opposing pairs or triplets, relative to 6 EPUs.
  • Propulsion units are sized to tolerate the first failure. The second failure is assumed to prevent continued safe flight and landing.
  • The first and second failures affect separate opposing pairs or triplets.
  • The results are valid for tilting propulsion and for separate vertical and horizontal propulsion, assuming the tilt mechanism is relatively reliable. They may not hold for a tilt wing, although a tilt wing can generate lift throughout its actuation.
  • System and sub-system failure rates are normalized across the architectures, which are assumed to be equally derated.

The architectures

Each architecture is drawn in plan view, with the propulsion units numbered, an arrow showing which way each rotor spins, the battery packs as squares, and a cross at the center of the aircraft. In the fault trees, each basic event takes the color of its component: winding, power stage, motor controller, or battery.

8 EPUs and 4 battery packs

Propulsion unit 1, spinning anticlockwise1Propulsion unit 2, spinning clockwise2Propulsion unit 3, spinning anticlockwise3Propulsion unit 4, spinning clockwise4Propulsion unit 5, spinning clockwise5Propulsion unit 6, spinning anticlockwise6Propulsion unit 7, spinning clockwise7Propulsion unit 8, spinning anticlockwise8Battery pack 11Battery pack 22Battery pack 33Battery pack 44Centre of the aircraft
  • Propulsion units 1 and 8 form opposing pair A, 2 and 7 form B, 3 and 6 form C, and 4 and 5 form D.
  • Batteries 1 to 4 each power one opposing pair, A to D.
  • Probability of loss of vertical thrust: 6.2E-9.
Show the fault tree

The fault tree represents a loss of vertical thrust from 2 separate opposing pairs:

Vote gate: 2 or more inputs 2Loss of vertical thrustLoss of verticalthrust8:LOVT, Q = 6.221E-098:LOVTQ = 6.221E-09Loss of vertical thrustLoss of verticalthrust8:LOVT1, Q = 3.22E-058:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust8:LOVT2, Q = 3.22E-058:LOVT2Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust8:LOVT3, Q = 3.22E-058:LOVT3Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust8:LOVT4, Q = 3.22E-058:LOVT4Q = 3.22E-05

The following branch is 1 of 4, and represents opposing pair A:

OR gate OR gate OR gate Loss of vertical thrustLoss of verticalthrust8:LOVT1, Q = 3.22E-058:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust8:LOVT1.1, Q = 2.11E-058:LOVT1.1Q = 2.11E-05Winding 1: no thrust when required. Basic event 8:W1:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 1: no thrustwhen required8:W1:NTWR:VFR 1E-06 · T 1Power stage 1: no thrust when required. Basic event 8:PS1:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 1: no thrustwhen required8:PS1:NTWR:VFR 1E-05 · T 1Motor controller 1: no thrust when required. Basic event 8:MC1:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 1: nothrust when required8:MC1:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 8:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required8:B1:NEPWR:VFR 1E-05 · T 1Loss of vertical thrustLoss of verticalthrust8:LOVT1.2, Q = 2.11E-058:LOVT1.2Q = 2.11E-05Winding 8: no thrust when required. Basic event 8:W8:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 8: no thrustwhen required8:W8:NTWR:VFR 1E-06 · T 1Power stage 8: no thrust when required. Basic event 8:PS8:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 8: no thrustwhen required8:PS8:NTWR:VFR 1E-05 · T 1Motor controller 8: no thrust when required. Basic event 8:MC8:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 8: nothrust when required8:MC8:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 8:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required8:B1:NEPWR:VFR 1E-05 · T 1

12 EPUs and 6 battery packs

Propulsion unit 1, spinning anticlockwise1Propulsion unit 2, spinning anticlockwise2Propulsion unit 3, spinning clockwise3Propulsion unit 4, spinning anticlockwise4Propulsion unit 5, spinning clockwise5Propulsion unit 6, spinning clockwise6Propulsion unit 7, spinning clockwise7Propulsion unit 8, spinning clockwise8Propulsion unit 9, spinning anticlockwise9Propulsion unit 10, spinning clockwise10Propulsion unit 11, spinning anticlockwise11Propulsion unit 12, spinning anticlockwise12Battery pack 11Battery pack 22Battery pack 33Battery pack 44Battery pack 55Battery pack 66Centre of the aircraft
  • Propulsion units 1 and 12 form opposing pair A, 2 and 11 form B, 3 and 10 form C, 4 and 9 form D, 5 and 8 form E, and 6 and 7 form F.
  • Batteries 1 to 6 each power one opposing pair, A to F.
  • Probability of loss of vertical thrust: 1.6E-8.
Show the fault tree

The fault tree represents a loss of vertical thrust from 2 separate opposing pairs:

Vote gate: 2 or more inputs 2Loss of vertical thrustLoss of verticalthrust12:LOVT, Q = 1.555E-0812:LOVTQ = 1.555E-08Loss of vertical thrustLoss of verticalthrust12:LOVT1, Q = 3.22E-0512:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT2, Q = 3.22E-0512:LOVT2Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT3, Q = 3.22E-0512:LOVT3Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT4, Q = 3.22E-0512:LOVT4Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT5, Q = 3.22E-0512:LOVT5Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT6, Q = 3.22E-0512:LOVT6Q = 3.22E-05

The following branch is 1 of 6, and represents opposing pair A:

OR gate OR gate OR gate Loss of vertical thrustLoss of verticalthrust12:LOVT1, Q = 3.22E-0512:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust12:LOVT1.1, Q = 2.11E-0512:LOVT1.1Q = 2.11E-05Winding 1: no thrust when required. Basic event 12:W1:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 1: no thrustwhen required12:W1:NTWR:VFR 1E-06 · T 1Power stage 1: no thrust when required. Basic event 12:PS1:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 1: no thrustwhen required12:PS1:NTWR:VFR 1E-05 · T 1Motor controller 1: no thrust when required. Basic event 12:MC1:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 1: nothrust when required12:MC1:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 12:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required12:B1:NEPWR:VFR 1E-05 · T 1Loss of vertical thrustLoss of verticalthrust12:LOVT1.2, Q = 2.11E-0512:LOVT1.2Q = 2.11E-05Winding 12: no thrust when required. Basic event 12:W12:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 12: no thrustwhen required12:W12:NTWR:VFR 1E-06 · T 1Power stage 12: no thrust when required. Basic event 12:PS12:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 12: nothrust when required12:PS12:NTWR:VFR 1E-05 · T 1Motor controller 12: no thrust when required. Basic event 12:MC12:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 12: nothrust when required12:MC12:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 12:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required12:B1:NEPWR:VFR 1E-05 · T 1

6 EPUs and 4 battery packs

Equal spacing between the propulsion unitsPropulsion unit 1, spinning anticlockwise1Propulsion unit 2, spinning anticlockwise2Propulsion unit 3, spinning clockwise3Propulsion unit 4, spinning clockwise4Propulsion unit 5, spinning anticlockwise5Propulsion unit 6, spinning clockwise6Battery pack 11Battery pack 22Battery pack 33Battery pack 44Centre of the aircraft
  • Propulsion units 2, 4, and 5 form triplet A, and 1, 3, and 6 form triplet B.
  • Battery 1 powers half triplet A-1, battery 2 powers half triplet A-2, battery 3 powers half triplet B-1, and battery 4 powers half triplet B-2.
  • Each propulsion unit has 2 windings, giving pseudo-redundancy at the propulsion unit level.
  • Probability of loss of vertical thrust: 1.1E-8.
Show the fault tree

The fault tree represents a loss of vertical thrust from 2 separate half triplets:

Vote gate: 2 or more inputs 2Loss of vertical thrustLoss of verticalthrust6A:LOVT, Q = 1.125E-086A:LOVTQ = 1.125E-08Loss of vertical thrustLoss of verticalthrust6A:LOVT1, Q = 4.33E-056A:LOVT1Q = 4.33E-05Loss of vertical thrustLoss of verticalthrust6A:LOVT2, Q = 4.33E-056A:LOVT2Q = 4.33E-05Loss of vertical thrustLoss of verticalthrust6A:LOVT3, Q = 4.33E-056A:LOVT3Q = 4.33E-05Loss of vertical thrustLoss of verticalthrust6A:LOVT4, Q = 4.33E-056A:LOVT4Q = 4.33E-05

The following branch is 1 of 4, and represents half triplet A-1:

OR gate OR gate OR gate OR gate Loss of vertical thrustLoss of verticalthrust6A:LOVT1, Q = 4.33E-056A:LOVT1Q = 4.33E-05Loss of vertical thrustLoss of verticalthrust6a:LOVT1.1, Q = 2.11E-056a:LOVT1.1Q = 2.11E-05Winding 1A: no thrust when required. Basic event 6a:W1A:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 1A: no thrustwhen required6a:W1A:NTWR:VFR 1E-06 · T 1Power stage 1A: no thrust when required. Basic event 6a:PS1A:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 1A: nothrust when required6a:PS1A:NTWR:VFR 1E-05 · T 1Motor controller 1A: no thrust when required. Basic event 6a:MC1A:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 1A: nothrust when required6a:MC1A:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 6a:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required6a:B1:NEPWR:VFR 1E-05 · T 1Loss of vertical thrustLoss of verticalthrust6a:LOVT1.2, Q = 2.11E-056a:LOVT1.2Q = 2.11E-05Winding 3A: no thrust when required. Basic event 6a:W3A:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 3A: no thrustwhen required6a:W3A:NTWR:VFR 1E-06 · T 1Power stage 3A: no thrust when required. Basic event 6a:PS3A:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 3A: nothrust when required6a:PS3A:NTWR:VFR 1E-05 · T 1Motor controller 3A: no thrust when required. Basic event 6a:MC3A:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 3A: nothrust when required6a:MC3A:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 6a:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required6a:B1:NEPWR:VFR 1E-05 · T 1Loss of vertical thrustLoss of verticalthrust6a:LOVT1.3, Q = 2.11E-056a:LOVT1.3Q = 2.11E-05Winding 6A: no thrust when required. Basic event 6a:W6A:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 6A: no thrustwhen required6a:W6A:NTWR:VFR 1E-06 · T 1Power stage 6A: no thrust when required. Basic event 6a:PS6A:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 6A: nothrust when required6a:PS6A:NTWR:VFR 1E-05 · T 1Motor controller 6A: no thrust when required. Basic event 6a:MC6A:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 6A: nothrust when required6a:MC6A:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 6a:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required6a:B1:NEPWR:VFR 1E-05 · T 1

6 EPUs and 3 battery packs

Propulsion unit 1, spinning anticlockwise1Propulsion unit 2, spinning clockwise2Propulsion unit 3, spinning anticlockwise3Propulsion unit 4, spinning clockwise4Propulsion unit 5, spinning anticlockwise5Propulsion unit 6, spinning clockwise6Battery pack 11Battery pack 22Battery pack 33Centre of the aircraft
  • Propulsion units 1 and 6 form opposing pair A, 2 and 5 form B, and 3 and 4 form C.
  • Batteries 1 to 3 each power one opposing pair, A to C.
  • Probability of loss of vertical thrust: 3.1E-9.
Show the fault tree

The fault tree represents a loss of vertical thrust from 2 separate opposing pairs:

Vote gate: 2 or more inputs 2Loss of vertical thrustLoss of verticalthrust6B:LOVT, Q = 3.11E-096B:LOVTQ = 3.11E-09Loss of vertical thrustLoss of verticalthrust6B:LOVT1, Q = 3.22E-056B:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust6B:LOVT2, Q = 3.22E-056B:LOVT2Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust6B:LOVT3, Q = 3.22E-056B:LOVT3Q = 3.22E-05

The following branch is 1 of 3, and represents opposing pair A:

OR gate OR gate OR gate Loss of vertical thrustLoss of verticalthrust6B:LOVT1, Q = 3.22E-056B:LOVT1Q = 3.22E-05Loss of vertical thrustLoss of verticalthrust6b:LOVT1.1, Q = 2.11E-056b:LOVT1.1Q = 2.11E-05Winding 1: no thrust when required. Basic event 6b:W1:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 1: no thrustwhen required6b:W1:NTWR:VFR 1E-06 · T 1Power stage 1: no thrust when required. Basic event 6b:PS1:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 1: no thrustwhen required6b:PS1:NTWR:VFR 1E-05 · T 1Motor controller 1: no thrust when required. Basic event 6b:MC1:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 1: nothrust when required6b:MC1:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 6b:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required6b:B1:NEPWR:VFR 1E-05 · T 1Loss of vertical thrustLoss of verticalthrust6b:LOVT1.2, Q = 2.11E-056b:LOVT1.2Q = 2.11E-05Winding 6: no thrust when required. Basic event 6b:W6:NTWR:V, failure rate 1E-06 per hour, exposure time 1 hoursWinding 6: no thrustwhen required6b:W6:NTWR:VFR 1E-06 · T 1Power stage 6: no thrust when required. Basic event 6b:PS6:NTWR:V, failure rate 1E-05 per hour, exposure time 1 hoursPower stage 6: no thrustwhen required6b:PS6:NTWR:VFR 1E-05 · T 1Motor controller 6: no thrust when required. Basic event 6b:MC6:NTWR:V, failure rate 1E-07 per hour, exposure time 1 hoursMotor controller 6: nothrust when required6b:MC6:NTWR:VFR 1E-07 · T 1Battery 1: no electrical power when required. Basic event 6b:B1:NEPWR:V, failure rate 1E-05 per hour, exposure time 1 hoursBattery 1: no electricalpower when required6b:B1:NEPWR:VFR 1E-05 · T 1

6 EPUs and 2 battery packs

Equal spacing between the propulsion unitsPropulsion unit 1, spinning anticlockwise1Propulsion unit 2, spinning anticlockwise2Propulsion unit 3, spinning clockwise3Propulsion unit 4, spinning clockwise4Propulsion unit 5, spinning anticlockwise5Propulsion unit 6, spinning clockwise6Battery pack 11Battery pack 22Centre of the aircraft
  • Propulsion units 2, 4, and 5 form triplet A, and 1, 3, and 6 form triplet B.
  • Battery 1 powers triplet A, and battery 2 powers triplet B.
  • Each propulsion unit has 1 winding, so there is no pseudo-redundancy at the propulsion unit level. Losing a battery loses half the thrust.

Designing a certifiable aircraft?

Summarize your requirements, including SWaP budget and certifiable aircraft type. Our engineering team will contact you shortly.

Talk to our engineers