Propulsion Unit Safety Analysis
Fault tree analysis of seven electric propulsion unit architectures for eVTOL aircraft and electric and hybrid-electric powertrains, from a single motor controller to two fully independent lanes.
The following analysis compares seven generic architectures for an Electric Propulsion Unit (EPU) with two motor windings, for electric Vertical Takeoff and Landing (eVTOL) aircraft and for aircraft with electric or hybrid-electric powertrains. For each architecture, a fault tree analysis quantifies two failure conditions:
- Loss of thrust: a total loss of thrust from both windings.
- Uncommanded thrust: thrust from either winding when it is not required.
Results
| Failure condition | Ex. 1 | Ex. 2 | Ex. 3 | Ex. 4 | Ex. 5 | Ex. 6 | Ex. 7 |
|---|---|---|---|---|---|---|---|
| Loss of thrust | 1.0101E-04 | 1.0001E-04 | 1.0201E-04 | 2.2801E-08 | 2.0225E-06 | 2.3104E-08 | 9.1204E-08 |
| Uncommanded thrust | 1E-06 | 2E-06 | 2.874E-09 | 2E-06 | 2.874E-09 | 5.749E-09 | 5.749E-09 |
- Shared cooling dominates loss of thrust in Examples 1 to 3. A single cooler failure stops both windings, so adding a second motor controller or a monitor makes almost no difference.
- Independent lanes reduce loss of thrust by more than three orders of magnitude. Examples 4, 6, and 7 give each winding its own motor controller, inverter, and cooler. Example 5 is limited by its single motor controller and monitor.
- A monitor with a shutdown path reduces uncommanded thrust from about 1E-06 to about 3E-09, because a motor controller failure must then coincide with a latent failure of its protection.
- Examples 6 and 7 are the only architectures better than 1E-07 for both failure conditions. The additional sensors in Example 7 add failures that can cause a spurious shutdown, so its probability of loss of thrust is about four times that of Example 6.
The analysis uses failure rates of 5E-05 per hour for inverters, windings, coolers, and sensors, and 1E-06 per hour for motor controllers and monitors, with a 1-hour exposure time. Latent failures of motor controller protection have a 5,760-hour exposure time.
Corrected November 2026: the loss of thrust fault trees for Examples 1 to 5 now combine every failure in one lane with every failure in the other, in the same way as Examples 6 and 7. Previously they combined only like components, such as Inverter 1 with Inverter 2. The correction is negligible where shared cooling dominates, but roughly triples the probability for Example 4.
The architectures
Each architecture is drawn with its motor controllers, inverters, windings, and coolers. In the fault trees, each basic event takes the color of its component: winding, inverter (power stage), or motor controller. Coolers and sensors are shown in outline.
Example 1
One motor controller drives two inverters, each driving one winding. One cooler serves both inverters and another serves both windings.
- Loss of thrust from both windings: 1.0101E-04.
- Uncommanded thrust: 1E-06.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 2
Each inverter has its own motor controller. The coolers are still shared, one for both inverters and one for both windings.
- Loss of thrust from both windings: 1.0001E-04.
- Uncommanded thrust: 2E-06.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 3
As Example 1, with a motor controller monitor that can shut down the motor controller.
- Loss of thrust from both windings: 1.0201E-04.
- Uncommanded thrust: 2.874E-09.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 4
Two independent lanes. Each has its own motor controller, inverter, winding, and cooler.
- Loss of thrust from both windings: 2.2801E-08.
- Uncommanded thrust: 2E-06.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 5
A motor controller monitor and one motor controller, with independent cooling for each lane.
- Loss of thrust from both windings: 2.0225E-06.
- Uncommanded thrust: 2.874E-09.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 6
Two independent lanes, each with its own motor controller monitor, motor controller, inverter, winding, and cooler.
- Loss of thrust from both windings: 2.3104E-08.
- Uncommanded thrust: 5.749E-09.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Example 7
As Example 6, with redundant temperature sensors on each inverter and winding, and redundant vibration sensors on each winding, reporting to the monitor.
- Loss of thrust from both windings: 9.1204E-08.
- Uncommanded thrust: 5.749E-09.
Show the fault trees
Loss of thrust from both windings:
Uncommanded thrust from either winding:
Single fault ratings and AIR7130
Single Fault Ratings (SFRs) can be combined with the fault tree analyses of Examples 1 to 7. Examples 6 and 7 are designed for a 50% Emergency Continuous Duration Power (ECDP) and a 50%+ Emergency Short Duration Power (ESDP) degraded mode of operation. SAE AIR7130 and the EASA paper Single Fault Tolerance and LOPC in Electric Engines describe this approach to demonstrating compliance with CS/FAR 23.2410.
An engine operating at an SFR, such as ESDP or ECDP, allows the aircraft to perform a continued safe flight and landing, and so demonstrates compliance with CS/FAR 23.2410. The architectures of Examples 6 and 7 also provide the essentially single fault tolerance of the engine control system to electrical and electronic failures leading to a Loss of Power Control (LOPC) or Loss of Thrust Control (LOTC) that has historically been applied to turbine engines.
For the aircraft-level consequences of the number of propulsion units, see our eVTOL safety analysis.