Battery & Electrification Technology - November/December 2024 - 5

for each craft in a fleet of 10,000 with a
defined confidence level.
This is not practically achievable with a
single system, so back up through equipment
redundancy is required in case of
failure. Particularly when the electronics is
used for flight control, partial failure must
also be allowed for - if a command to a
throttle or surface is inaccurate because of
a component degrading, this can be as
dangerous as total failure, so a common
practice is to have on-line redundancy,
where system outputs are cross-checked
or 'voted' against each other at various
stages. For the highest reliability, at least
three redundant systems might be used
because with only two, if a discrepancy is
registered, it can't necessarily be known
which system is the inaccurate one to be
ignored. For example, the original space
shuttle had four identical, redundant online
flight control systems with a fifth as
a further back up.
Power Distribution Must Also
be Redundant
Redundant arrangements must not
have any component or connection failure
mode that could affect all systems
together and an obvious cause of concern
is the power supply and distribution network.
A paper by NASA calculates that for
a theoretical six-passenger quadrotor
craft, a minimum of three batteries would
be needed to meet the 10-9 per hour
failure rate, any two of which should be
sufficient for safe flight. Four separate
drives and motors for each rotor would
also be necessary, with the ability to operate
safely with any two failed.
Battery & Electrification Technology, November/December 2024
It can be expected that power distributed
in an eVTOL craft will all be at DC,
with main batteries at relatively high voltage,
with high-power DC-DC converters
generating lower voltage buses at perhaps
24 or 28V, or a voltage for specific equipment
such as lights. Further board level
DC-DCs would provide end voltages for the
electronics. In the power distribution and
DC-DC conversion architecture there are
choices in the arrangement; redundant
systems could be completely isolated to
ensure no common failure mode, but this
has the disadvantage that a single power
rail failure takes down a complete system,
forcing an immediate, precautionary, emergency
touchdown in case a second failure
occurs in any part of the remaining system.
Alternatively, power can be 'diode-gated'
at different points so that if one path fails,
5
Battery & Electrification Technology - November/December 2024

Table of Contents for the Digital Edition of Battery & Electrification Technology - November/December 2024
