Technical Articles

Simplifying your future

The Design Engineer’s Guide to Power Conversion in eVTOLs: Why Reliability is Critical and How Modular Architectures Can Help

Abstract:

Electric Vertical Take-Off and Land (eVTOL) vehicles are set to proliferate in the coming few years. As in other aerospace applications, safety is paramount, normally requiring multiple layers of hardware redundancy. eVTOL craft however must be as lightweight as possible, so a trade-off has to be made between acceptable reliability and hardware complexity. This e-guide considers the situation, particularly with regards to power conversion electronics.

E-guide

In this e-guide, we take a look at the upcoming market for electric Vertical Take-Off and Land (eVTOL) aircraft and how power conversion and distribution are key factors in achieving the necessary safety, reliability and efficiency levels to make this transport mode viable.

eVTOL has arrived

Electric aircraft have become a reality, with many practical designs demonstrating their feasibility as cargo and passenger carriers. Regulatory barriers are also being addressed, for example, in April 2023 the FAA [1] released an updated blueprint for airspace and procedural changes to accommodate air taxis and other Advanced Air Mobility (AAM) operations. The document outlines a step-by-step approach to integration of small aircraft into the urban environment with due regard to safety, environmental impact and necessary infrastructure such as ‘vertiports’ – designated terminals for take-off and landings. 

The eVTOL industry is ‘lifting-off’ in a big way – analysts ‘Markets and Markets’ put the market size at USD 1.2 Billion in 2023, set to grow at a CAGR of 52% to 2030 [2]. One estimate states that there could be 10 million eVTOL aircraft in use by 2035, with market drivers being aviation emissions reduction, congestion relief of alternative transport and even economy, with air-taxi costs quoted by some as potentially only a few dollars per mile [3].

The eVTOL regulatory framework

As with all aircraft, regulations apply before an eVTOL design can be operated commercially. Type approval must be obtained for a particular design to show its airworthiness; production certification must be obtained to show that the manufacture of the aircraft complies with the approved design and practical authorizations to operate in a particular airspace must be obtained, along with any Air Carrier Certificate that might have additional safety and operational requirements.

However, there are fundamental differences between traditional aircraft and eVTOL types, particularly that autonomous operation is one of the goals, presenting the same regulatory challenges seen with Unmanned Aircraft Systems (UAS) or drones. The European Union Aviation Safety Agency (EASA) has established special conditions for eVTOL certification (SC)-VTOL, and in the US, the FAA has published proposed criteria for an example aircraft, the Joby Aviation JAS4-1. The indication is that certification will vary on a case-by-case basis reflecting the wide variety of possible types and scales of eVTOL designs. For example, although an eVTOL aircraft with rotating nacelles like the Joby design can hover like a helicopter, the FAA has said that it needs enhanced resistance to bird strikes compared with a traditional helicopter due to its high 200 mph forward speed capability.

‘eVTOL aircraft should have minimum billion-hour MTBF’

To make an eVTOL aircraft commercially viable, it must be as safe, efficient and lightweight as possible to get the maximum range from a battery charge. At the same time, control is complex with multiple electric motors to drive with apportioned power to maintain stability in hover and forward mode, and critically, in the transition between the two. These considerations push designs towards ‘fly-by-wire’ to automate control and avoid heavy and inefficient mechanical actuators and linkages, replaced by computers, cabling, electrical actuators and motors. Fly-by-wire requires utmost reliability from electronics and this is achieved in part by redundant hardware so that catastrophic system failure does not occur after one component or subsystem failure. To put a scale on the reliability demanded, EASA requires the aircraft failure rate to be less than 10-9 per flying hour. This equates to an MTBF for a single aircraft of a billion flying hours, or more realistically, for a fleet of say 10,000 aircraft, more than eleven continuous years of flying for each craft without total failure of any, with a probability of 0.37, which is beyond the expected lifetime of the vehicle. Note that failure rates are calculated at a specified ‘normal’ temperature and in a particular environment.

A single non-redundant electronics system will not practically meet these reliability requirements, so two or more systems are installed with their outputs, such as throttle control, electronically ‘voted on’ to determine a consensus. If one system fails, the other(s) provide an alternative with reduced confidence in the accuracy of the output value. Redundancy provides a dramatic improvement in system reliability. If failures are repaired and the duplicated systems are both actively on-line with equal failure rates, the overall failure rate λT is given by:

Equation 1.
This for n systems each with λ failure rate (per hour) with a repair rate of µ (per hour) and with k systems minimum required to fly the craft.

To achieve a failure rate λT of 10-9 per flying hour, with 2 redundant systems such that only one is needed, with a repair time of three hours (µ=1/3), λ calculates to 1.3 x 10-5 failures/hr or an MTBF of 77kHrs, which is a realistic figure for a system.

Redundancy is only valid if you know the state of the system

Redundancy is effective only if you know that it is available, and rectify any fault promptly, so monitoring is vital to ensure that systems are working and that they have valid inputs and outputs before and after a failure. For example, ‘voting’ on two parallel redundant signals should generate an alarm if there is a specified difference between the levels – it is not possible to know which is the most accurate if there are only two, and after a failure, the remaining signal may be the faulty one and cause an immediate catastrophe. For this reason, complex applications can have three of more identical systems voting between each other – for example, the original space shuttle had four, and a fifth as backup, with cross- checking ‘votes’ taken every 2 milliseconds.

Similarly, care must be taken that there is no single failure that can affect more than one element of a redundant system – common power rails and communication interfaces providing the ‘voting’ function are possible areas of concern. Techniques such as using multiple power supplies and providing isolation in signals that pass between redundant systems are typically used.

Redundant power rails and motor drives are a necessity due to the relatively high failure rate of power components, which naturally operate at high thermal and electrical stress levels. However, these power stages and their connecting buses are major contributors to weight, space and cost in aircraft electrical systems. Because of this, paralleling multiple units for redundancy tends to work against the commercial viability of the aircraft and the result is a practical trade-off between reliability and the critical ‘SWaP’ metric for power conversion electronics – size, weight and power (dissipated). A paper by NASA [4] identifies that for an example six-passenger quadrotor eVTOL aircraft, a redundant power system satisfying the maximum 10-9 failures per flying hour criterion adds up to 54% more mass than a non- redundant arrangement, with a direct correlation between weight penalty and overall system failure rate (Figure 1). The orange line is the ‘pareto front’ on which lie redundancy solutions that are non-dominant i.e. combinations of weight penalty and failure rate, one of which cannot be altered without degrading the other. For example, the dominant solutions shown by a ‘plus’ sign represent non-optimal combinations of weight penalty and reliability where either could be independently improved within the system reliability target. The non-dominant solutions marked with a cross represent combinations of weight penalty and reliability where one cannot be improved without adversely affecting the other. A non-dominant solution closest to the reliability target with lowest weight is therefore ideal. NASA considered different combinations of redundant systems and conclude that an optimum for the particular situation they consider would be three batteries, any two of which would be sufficient and four separate drives and motors for each rotor, any two of which would be able to maintain safe flight – a significant hardware overhead.

Figure 1 : Trade-off combinations between equipment weight and failure rate

Auxiliary power must also include redundancy

The aircraft electronics systems also require auxiliary power rails and these are provided by DC-DC converters off the main battery supplies in one or more stages. The converters must also include redundancy to meet the system failure rate target, one at least for each of the redundant flight control systems. The converters could be cross-coupled through OR-ing diodes so that if one fails, its corresponding load is fed from the other converters (Figure 2). This maintains the maximum flight control capability but implies that in normal operation the converters should share the load equally and be oversized to be capable of each powering the total load. This is a cost, size and weight overhead that may not be tolerable. Additionally, cross-coupling of signals to monitor operation and force current sharing are potential single points of failure.

Figure 2: Auxiliary DC-DC converters can be individually connected for minimum overhead or gated as shown for maximum flight control availability

It is a judgement whether some system elements need to be replicated. For example, separate functions such as motor, flight control and navigation may need different DC-DC converter power supplies with redundancy as appropriate, but if they have the same power rail as an input, perhaps the necessary input transient suppressor network could be common if sufficiently reliable. This would save the weight, cost and space occupied by multiple filters, facilitated by procuring the DC-DCs and filter from the same supplier, who could enable a more ‘holistic’ approach to system power architecture design.

Size, weight and efficiency of DC-DCs are crucial parameters

It is clearly vital that the size and weight of auxiliary DC-DC converters in the application are minimized. It would be good for reliability for each DC-DC to have a power rating higher than any possible continuous or peak load, but system designers will often take advantage of any surge load capability of smaller converters for cost, weight and space savings, relying on internal over-temperature shutdown if the peak load duration is too long. These economies are valuable but could result in excessive temperatures and stress under fault conditions, so secure temperature monitoring, shutdown and fault signalling are important. DC-DCs in the application will typically be base-plate cooled types to take advantage of ‘cold walls’ with Insulated Metal Substrate (IMS) construction to minimize thermal resistance from internal components to the cold wall. The DC-DCs will normally be encapsulated for internal heat-spreading and for environmental sealing – an important consideration for the eVTOL application. An example of this construction is the 250W MDM-250 DC-DC converter from Gaia Converter (Figure 3).

Figure 3: 250W 1/4 brick isolated DC-DC converter (Gaia Converter MDM-250)

High DC-DC conversion efficiency is an enabler for lower temperatures and consequent higher reliability in a minimum package size. Lower losses in auxiliary supplies also help to extend primary battery run-time and operating range while contributing in a small way to avoidance of overall system temperature rises and risk of battery thermal runaway.

Example power architecture for eVTOL applications

It can be expected that the power architecture for an eVTOL application will be similar to other avionics with an intermediate bus, perhaps at 24 or 28VDC, feeding isolated DC-DC converters with regulated lower voltage outputs. These could be followed by non-isolated ‘point-of-load’ converters which provide the precise voltage required by the aircraft electronics. Standards that apply could be MIL-STD-704F and MIL-STD-1275 for power quality, MIL-STD-461 for EMC and DO-160 for environmental conditions. If this is the case, bus surges, transients, brown-outs and drop-outs are defined, requiring filters and more complex conditioning functions such as input pre-regulation and extended hold-up. Products are available from suppliers such as Gaia Converter [5] who have long experience in the avionics and general hi-rel market.

The LHUG series [6] for example (Figure 4), is designed specifically for compliance with MIL-STD-1275 and DO-160 and handles loads up to 150W at nominal voltages between 9-60VDC. The pre-conditioner provides over-voltage transient protection to 100V/100ms and input undervoltage down to 11V for 1 second. Reverse polarity protection, inrush control and soft start are also included, along with output power limitation and a function that provides long hold-up times after a power interruption. Energy is provided from an external capacitor, charged to a high voltage via a built-in boost converter. All of this is in a compact, 32.4 x 42.7 x 8.2mm encapsulated package size.

Figure 4 : The Gaia-Converter LHUG series power pre-conditioner module for avionics applications

A pre-conditioning module may be followed by an isolated converter such as from the encapsulated Gaia Converter MGDM-xx series which provide various outputs from 4W to 500W rating. The 500W part for example, shown in Figure 5, is in a half-brick format and operates without derating to a maximum base plate temperature of 105°C allowing for high surge loads under all conditions. The converter has remote sense, voltage trim, an ON-OFF function and secure protection features include output over-voltage and over-current, over-temperature and input under-voltage. Synchronization of switching to an external clock or a second converter is possible, to minimize noise or avoid sensitive system frequencies. Isolation is 1500VDC.

Figure 5: 500W 1/2 brick isolated DC-DC converter (Gaia Converter MGDM-500)

Figure 6 shows a system using the Gaia Converter LHUG pre-conditioner and MGDD series isolated DC- DCs rated at 80, 40, 20 and 8W, providing five typical system voltages. As shown, the preconditioner can synchronize the following four converters in two anti-phases, PH0 and PH1 to minimize noise generated. An EMI filter from the Gaia Converter FGDS series is also shown so that the system complies with military EMC and power quality standards.

Figure 6: A typical system complying with common avionics standards can be assembled from Gaia Converter modules
Conclusion

The architecture of eVTOL power systems is not well defined yet and with the wide variety of possible end uses from autonomous drone-like platforms to multi-seater passenger craft, there is unlikely to be a standard arrangement. Modular systems and power converters that can be scaled for the application therefore could be an advantage and parts that already have a track record and certifications in avionics applications such as from Gaia Converter give a guarantee of safe and reliable performance.