[1]Florian Jäger

1]DLR Institute of Flight Systems, German Aerospace Center, Lilienthalplatz 7,
Braunschweig, 38108, Germany

# Battery-Electric Powertrain System Design for the HorizonUAM Multirotor Air
Taxi Concept

/0009-0002-9452-2792<EMAIL_ADDRESS>Oliver Bertram
/0000-0002-7732-9280 Sascha M. Lübbe  Alexander H. Bismark  Jan Rosenberg
Lukas Bartscht  [

###### Abstract

The work presented herein has been conducted within the DLR internal research
project HorizonUAM, which encompasses research within numerous areas related
to urban air mobility. One of the project goals was to develop a safe and
certifiable onboard system concept. This paper aims to present the conceptual
propulsion system architecture design for an all-electric battery-powered
multirotor electric Vertical Takeoff and Landing (eVTOL)vehicle. Therefore, a
conceptual design method was developed that provides a structured approach for
designing the safe multirotor propulsion architecture. Based on the concept of
operation the powertrain system was initially predefined, iteratively refined
based on the safety assessment and validated through component sizing and
simulations. The analysis was conducted within three system groups that were
developed in parallel: the drivetrain, the energy supply and the thermal
management system. The design process indicated that a pure quadcopter
propulsion system can merely be designed reasonably for meeting the European
Union Aviation Safety Agency (EASA)reliability specifications. By adding two
push propellers and implementing numerous safety as well as passivation
measures the reliability specifications defined by EASA could finally be
fulfilled. The subsequent system simulations also verified that the system
architecture is capable of meeting the requirements of the vehicle concept of
operations. However, further work is required to extend the safety analysis to
additional system components as the thermal management system or the battery
management system and to reduce propulsion system weight.

###### keywords:

Urban Air Mobility, Conceptual Aircraft Design, Model-Based Safety Assessment,
Propulsion System, Multirotor, eVTOL

## Glossary

## Acronyms

ARP

    Aerospace Recommended Practice
EASA

    European Union Aviation Safety Agency
EASA SC E-19

    Special Condition for Electric / Hybrid Propulsion System
EASA SC-VTOL

    Special Condition for Vertical Takeoff and Landing Vehicle defined by the EASA
eVTOL

    electric Vertical Takeoff and Landing
FCC

    Flight Control Computer
FDAL

    Function Development Assurance Level
FHA

    Functional Hazard Analysis
FTA

    Fault Tree Analysis
NPRD

    Nonelectronic Parts Reliability Data
PASA

    Preliminary Aircraft Safety Assessment
PMSM

    Permanent Magnet Synchronous Motor
PSSA

    Preliminary System Safety Assessment
UAM

    Urban Air Mobility
UAS

    Unmanned Aerial System
VTOL

    Vertical Takeoff and Landing

##  1 Introduction

As the majority - over $54\;\%$ (4.5 billion people) - of the world population
is already living in urban areas and this trend is projected to continue up to
$68\;\%$ (6.68 billion people) by 2050, new, efficient and zero-emission
transportation methods will play a major role in organizing the future
mobility needs [1]. Already today, people within the biggest cities experience
traffic delays of more than 100 h per person within a year [2]. Since the
ongoing urbanization will most probably lead to further congestion while the
road infrastructure cannot be increased unlimited, new alternatives to
existing travel methods need to be established. The vision of Vertical Takeoff
and Landing (VTOL)vehicle operation is to relocate some of the travel from the
road up into the air and, thereby, contribute in reducing traffic jams,
improving the mobility and reducing the personal travel time [3, 4] for a
portion of today’s travel demand. Another major challenge in the ongoing trend
of urbanization is that today $45\;\%$ of all CO2 emissions from global
transportation is produced by the road traffic [5]. Using electrified
propulsion systems for VTOL vehicle may contribute in providing low-emission
transportation means especially when using renewable energy sources [3, 6].
Lastly and more importantly, concepts for electrified VTOL vehicle can pave
the way towards electric powered aircraft as they may be one of the first
suitable use cases so far. $30.6\;\%$ of all flights within Europe cover a
flight distance of less than 500 km [7]. Those flights may offer the chance to
be conducted by electric aircraft [8, 9].

Due to these challenges in transportation and the potentials for VTOL vehicles
several hundred vehicle concepts have been unveiled and are worked on by
aircraft manufacturers, start-ups, automotive manufacturers as well as
research facilities [10]. The first certified operation with passengers on
board is expected to take place already in the mid-2020s [11]. One of the main
challenges preventing VTOL vehicle with passengers on board being operated
today is the unproven safety and reliability of those concepts as well as
missing certification standards. Within the last four years the European Union
Aviation Safety Agency (EASA)has established rules, named the Special
Condition for VTOL vehicle (EASA SC-VTOL), as well as corresponding means of
compliance [12]. The safety objectives stated therein for the category
enhanced aircraft111Vehicles that are transporting passengers over congested
areas fall into the category enhanced of the EASA SC-VTOL [12]. set high
standards similar to commercial aviation. For example, the vehicle must be
able for a continued safe flight and landing even if any single system failure
or a combination of failures that are not classified as catastrophic occur.
Additionally, a catastrophic failure condition must have a failure rate of
less than $10^{-9}$ failures per flight hour and must not result from a single
failure. As a reliable propulsion system is crucial for a safe VTOL operation,
the design of the vehicle’s propulsion system takes over an important role. So
far, there has only been little research focus on analyzing the propulsion
system reliability and its effects on the safe vehicle operation. However, the
research that has already been conducted, indicates that the EASA safety
objectives are especially difficult to meet for wingless multirotor concept
vehicles [13, 14, 15]. This work, therefore, addresses these challenges and
aims to present the conceptual design process of developing a safe propulsion
system for multirotor electric Vertical Takeoff and Landing (eVTOL)vehicles as
well as its implications when being applied to an exemplary use case. The goal
is to provide further insights into the conceptual design to facilitate the
development of the propulsion system architecture and its certification for
similar eVTOL vehicle. The research presented herein has been conducted by the
Safety-Critical Systems and Systems Engineering department of the DLR
Institute of Flight Systems within the DLR internal project HorizonUAM.

###  1.1 Research questions and methodological approach

In contribution to the aim of this work, the following research questions will
be covered:

  1. 1.

How should the conceptual design process of the propulsion system be carried
out for an all-electric multirotor VTOL vehicle that is transporting
passengers over congested areas so that the safety goals of EASA SC-VTOL can
be met?

  2. 2.

What is the impact of the EASA SC-VTOL reliability requirements on the
conceptual design of a multirotor propulsion system?

  3. 3.

Which implications does an all-electric battery-powered eVTOL have on the
propulsion system architecture besides the safety requirements?

  4. 4.

Which requirements must be met by a thermal management system of the developed
all-electric multirotor propulsion system?

To address these research questions, chapter 2 describes the methodological
approach for the conceptual design of a safe propulsion system for a
quadcopter eVTOL vehicle. In chapter 3, the methodological approach is applied
using an exemplary eVTOL use case of the HorizonUAM project. Up to section
3.2, an initial propulsion system concept is developed, which is further
detailed and refined within section 3.3 based on the safety design process.
For the derived propulsion system architecture, the power and drive system,
the thermal management system (TMS) and the electrical system, are then sized
and simulated and final architecture adjustments deducted within sections
3.4.1, 3.4.2 and 3.4.3. The chapter 3.5 presents the final propulsion
architecture. Within chapter 4 the main findings are summarized and the
initial research questions answered. The paper is completed by deriving
current limitations of the applied methodology and giving an outlook for
further research within chapter 5.

###  1.2 State of the Art

At first, a literature research was conducted to identify the current state of
the art regarding conceptual design methodologies for developing the
propulsion system for multirotor vehicles, that also take safety requirements
into account. Only little literature could be found that addresses this
research area so far.

Conceptual design methods for the multirotor propulsion systems
In 2021, Bertram et al. [16] developed a sizing loop which supports the
initial multirotor vehicle sizing process based on flight mission requirements
and the propulsion technology to be used. However, this method does not
provide any detailed information about the propulsion system architecture
design and its reliability or failure probabilities. In the work of Liscouët
et al. [15] from 2022, a method for the conceptual design of multirotors is
presented which includes a controllability analysis, a sizing optimization as
well as a safety assessment. However, the controllability analysis does not
take flight phase transitions and handling quality aspects into account and so
far, the applicability of the safety assessment was only shown based on the
Unmanned Aerial System (UAS)regulations. The applicability of this approach
for manned eVTOL vehicles therefore is still due.

Currently achieved failure rates of multirotor eVTOL vehicle architectures
In 2019, Darmstadt et al. [13] conducted several safety analyses for the
propulsion systems of in total four VTOL configurations, including a tilt-
wing, quadcopter, lateral-twin and lift & cruise configuration. For all
developed propulsion system architectures a failure rate in the magnitude of
$10^{-4}$ per flight hour was identified, with the quadcopter configuration
having the highest failure rate of $7.97\cdot 10^{-4}$ per hour. The major
challenges for multirotors in meeting the EASA SC-VTOL are that “a single
failure must not have a catastrophic effect upon the aircraft” (VTOL.2550) and
that a catastrophic event must not happen more often than once every $10^{9}$
flight hours [12]. The work of Liscouët et al. [15] also came to the
conclusion that their unmanned quadcopter failure rate lies in the magnitude
of $1.44\cdot 10^{-4}$ per hour and can effectively be reduced by adding more
rotors. By using at least eight rotors – which implies a coaxial quadcopter or
octocopter configuration - the EASA SC-VTOL could be fulfilled according to
their studies.

In 2021, Darmstadt et al. [14] renewed the propulsion architectures from 2019
focusing on the challenging multirotor configurations to improve their
reliability and additionally expanded their safety assessment. The failure
probability for the quadcopter configuration experiencing catastrophic events
could be improved to $1.78\cdot 10^{-9}$ per hour when using cross-shafts that
connect all four main rotor drives. Without using a cross-shaft solution the
highest failure probability increases up to $1.75\cdot 10^{-5}$ per hour. Only
by adding numerous redundancies the failure probability could be reduced to
$1.06\cdot 10^{-9}$ per hour which may be a suitable solution. Therein, the
thermal management system was identified as a critical supplementary system,
which needed to be dual redundant. However, the consequences of adding these
redundancies on vehicle mass, complexity and feasibility of the design haven’t
been further analysed. The difficulty of meeting the EASA SC-VTOL reliability
goals shows that a new approach is needed that integrates the safety and
reliability assessment into the conceptual design. Additionally, the
implications of a safe multirotor propulsion architecture on the vehicle
design, mass, the feasibility and complexity need to be readily analysed
within the approach to show whether or not the system architecture should be
pursued.

The rules and regulations that must be considered within the design process
are the already mentioned EASA SC-VTOL, the SC E-19 that define the special
condition for electric or hybrid propulsion systems intended for VTOL
aircraft, the Aerospace Recommended Practice (ARP)4754A and ARP 4761 that
define certification considerations and safety assessment guidelines [12, 17,
18, 19].222For completeness it is noted, that the CS-P define the
certification specifications for the propellers and should also be taken into
consideration during the propulsion architecture design [20]. However, they
are out of scope of this work.

Therefore, this work will at first present a methodological approach which was
applied for the conceptual design of an all-electric propulsion system for a
quadcopter that aims at fulfilling EASA SC-VTOL, takes into consideration ARP
4761 as well as the Special Condition for Electric / Hybrid Propulsion System
(EASA SC E-19)[19] and further analyses its consequences on critical vehicle
and flight mission parameters.

##  2 Method

Figure 1: Applied methodological approach for the conceptual propulsion system
design

The applied methodological approach for designing a propulsion system consists
of following steps as indicated in Fig. 1:

  1. 1.

ConOps Definition

  2. 2.

Vehicle Requirement Analysis

  3. 3.

Vehicle System Concept Definition

  4. 4.

Safety Analysis

  5. 5.

Vehicle Sizing & Simulation

In the first step, the concept of operations (ConOps), the flight mission as
well as the payload requirements are defined. Based on this information the
best suitable type of vehicle is preselected. Thereafter, the propulsion
technology for the selected vehicle is defined.

In the second step, further design requirements for the propulsion system and
its components are derived. Several topics should be included herein, among
them controllability, handling quality and noise aspects, as they may heavily
influence the propulsion system design.

The ConOps definition and the requirement analysis are the basis for step
three, the propulsion system design loop. Within this step, an initial system
concept consisting of the propulsion system as well as the other vehicle
systems is defined. Thereby, the propulsion system is specified in terms of
the power system, electrical system and the thermal management system. Based
on the initial vehicle system architecture concept a first vehicle sizing loop
is performed to derive vehicle parameters as, for example, the required
vehicle propulsion power, the required energy, vehicle empty weight and rotor
size.

In the fourth step, a safety and reliability analysis is conducted for the
initial vehicle system architecture, in order to fulfil the EASA SC-VTOL
safety goals. Any architecture changes are then passed back to the vehicle
system concept.

Within the last step, the safe vehicle architecture is modelled and simulated
to validate the suitability of the derived vehicle architecture based on the
ConOps definition and vehicle requirement analysis.

As this paper focuses on the propulsion system architecture concept, emphasis
is put on presenting steps three, four and five primarily for the propulsion
system. The steps one and two are only briefly described in order to provide
the context for the propulsion system design.

###  2.1 ConOps Definition

When detailing the ConOps, the type of eVTOL vehicle needs to be selected
based on the intended use case and payload requirements. As shown by Ratei
[21] different vehicle concepts may be suitable for different operating areas.
For example, a rotary-wing concept like a multirotor, or fixed-wing concepts
like the lift & cruise, or vectored thrust configurations with tilted wing,
tilted rotors or tilted ducts may be suitable.

As soon as the flight mission is defined and the eVTOL vehicle is chosen, the
propulsion technology to be used should be evaluated. Propulsion systems like
a full-electric battery-powered or hydrogen powered system or even serial or
parallel hybrid electric solutions may be suitable.333A comparative overview
of the characteristics of different propulsion technologies used for a
multirotor and their impact on the application areas are presented within [16,
22].

###  2.2 Vehicle Requirement Analysis

Figure 2: Overview of some selected parameters influencing controllability,
handling quality and noise. The parameters may be dependent on each other and
the list is not exclusive.

Within step two, several further design requirements, primarily for the
propulsion system design are collected. As the flight control functions are
primarily taken over by the propulsion system within eVTOL vehicles,
controllability and handling quality requirements have a significant impact on
the propulsion system design and should therefore already be considered at an
early design stage. The controllability analysis aims at ensuring, that the
vehicle is controllable around all axes. This requires that the Newton’s law
for translation and rotation need to be fulfilled. As described within
Liscouët et al. [15], it is essentially not only to analyse the
controllability during normal operating conditions, but also for any failure
cases. The difficulty during this step is that the failure cases are not known
in the beginning. Therefore, the controllability for failure cases needs to be
analysed again when having identified the failure cases within step four, the
safety analysis. In general, the controllability depends on whether rotor
speed control or pitch control is used and is influenced by the vehicle moment
of inertia, the number of rotors, the rotor arrangement, additional rotor
parameters (e.g. rotor inertia) and the thrust coefficient of the
corresponding rotors [23]. In addition to the controllability aspects, the
handling qualities should be considered. According to Pavel [23] the handling
qualities of a multicopter are influenced not only by the aircraft response to
a control input (controllability) but also to the coupled rotor-motor
dynamics. The dynamic response of a coupled rotor-motor drive system, is
beneficially influenced by a low rotor inertia, low inertia of the drive
components (motor and gearbox), a drive system gear ratio which is optimized
for high motor efficiency, balanced motor performance444Which is expressed in
terms of the ratio $\frac{K_{e}^{2}}{R_{a}}$ consisting of the motor back-
electromotive force constant ${K_{e}^{2}}$ and the equivalent resistance
${R_{a}}$., a low motor equivalent resistance and low friction losses within
the drive system which are influenced by the rotational speed and the gear
ratio [23]. All influencing parameters combined result in good handling
qualities when the dynamic response around all axes is characterised by low
rise-time, high bandwidth, low overshoot and high stability in terms of phase
and gain margin [23]. According to the analysis of Bahr et al. [24] and
Niemiec et al. [25] for rotor speed-controlled quadcopters, the weight of the
electric motors that are only sized based on the maximum required power demand
for performing the flight mission, is insufficient for meeting handling
quality requirements. As a high motor torque capability is required for
achieving a low motor time constant and therefore good handling qualities, the
motor becomes twice as heavy as initially sized. The sum of all electric
motors might reach $15-16\;\%$ of the total vehicle weight in case a direct
drive is used. Therefore, the factors influencing the handling qualities
should already be considered within the conceptual design phase to minimize
the design adjustments at a later design phase.555For more information about
analysing the handling qualities of multicopter eVTOL vehicles it is referred
to [26], [27] and [28].

When designing the propulsion architecture the noise level as well as the
effect of noise annoyance should be taken into account in order ensure public
acceptance [29]. The eVTOL architecture parameters type of rotor control,
maximum rotor tip speed, number of rotors, rotor arrangement, disc loading and
the propulsion system architecture should be carefully chosen, as they mainly
influence the emitted noise according to Brown and Harris [30], Smith et al.
[31] and Smith et al. [32].

An overview of the different parameters and their optimum values is given
within Fig. 2.

###  2.3 Propulsion System Concept Definition

Taking all the aspects of the ConOps definition and the vehicle requirements
analysis into consideration a first propulsion concept is established. In this
step all systems are identified that are required within the eVTOL propulsion
system. At this point it is important to differentiate between the different
nomenclature that is used to describe the propulsion systems. Herein the
nomenclature offered by Herrmann and Rothfuss [33] is followed in which the
propulsion system encompasses a group of systems that contribute to provide
lift and power the eVTOL. The propulsion concept was developed by conducting
the following steps:

  1. 1.

At first, the propulsion system context is defined, which identifies external
elements interacting with the propulsion system. The type of interaction is
defined by the interfaces.

  2. 2.

Then the use cases for the propulsion system are established and the tasks of
each system context element for each use case are defined. This allows to
identify all tasks and functions that need to be fulfilled by the propulsion
system.

  3. 3.

For each derived function an activity diagram is developed to describe the
activities that are taking place within the propulsion system itself.

  4. 4.

With this information an initial system concept is derived by grouping the
identified activities and allocating them to a specific system. In accordance
with Darmstadt et al. [14] the propulsion system architecture is generally
composed of the following system groups:

     * •

Flight control system

     * •

Power and drive system

     * •

Electrical system

     * •

Thermal management system (TMS)

The flight control system encompasses all sensors and systems that collect air
data, receive and process control commands and calculate the corresponding
motor control inputs for each motor controller for speed-controlled rotors or
inputs for the actuation system of collective pitch-controlled rotors. The
power and drive system (also called powertrain and drivetrain) is responsible
for converting the electrical power, which is supplied by the electrical
system, into mechanical rotational power in accordance with the inputs
received from the flight control system. The drivetrain is a system group
within the powertrain and does only include the systems that transmit the
mechanical power of the engine into thrust at the rotors. The electrical
system takes over the function to store and distribute the electrical energy.
The thermal management system shall ensure to keep all system components
within their operating temperature range. These system groups can provide an
initial guidance during the architecture developing process.

  5. 5.

In the last step the propulsion concept is integrated into the complete
vehicle system architecture concept and an initial sizing loop is conducted to
size the eVTOL vehicle as well as the propulsion system, estimate the required
power and energy and calculate the estimated weight proportions using the
method presented by Bertram et al. [16]).

###  2.4 Safety and Reliability Analysis

The basis for the safety analysis are the safety and reliability requirements
of EASA SC-VTOL [12] and the EASA SC E-19 [19]. With the initial understanding
about the intended propulsion system components from the previous section, the
safety analysis helps to identify weak points of the propulsion system and to
define the type and amount of required safety measures. Thereby, system
requirements for each propulsion system component can be derived which may
significantly impact the propulsion system design compared to the initial
design. Consequently, a more precise prediction about the required system
components and their specifications can be generated.

Generally, the safety analysis for the propulsion system design is conducted
using the methods described in SAE ARP 4754A [18] and ARP 4761 [17]. In Fig. 3
an extract of the safety assessment process is shown.

Figure 3: Extract of the ARP4754A [18] and illustration of the safety
assessment steps covered within this work (marked in green)

The green parts mark the steps of the safety assessment that are covered
within this work. In order to conduct the aircraft level Functional Hazard
Analysis (FHA)the system concept from the previous section as well as a
functional breakdown analysis on the aircraft level are required, which are
assigned to the system development process within the ARP 4754A. However, as
this aircraft level functional analysis has yet not been addressed, it is
herein conducted under the topic of the safety analysis. Thereafter, the
aircraft level Fault Tree Analysis (FTA), the system level Functional Hazard
Analysis (FHA)and FTA are conducted while iteratively gathering the
information for the Preliminary System Safety Assessment (PSSA)and Preliminary
Aircraft Safety Assessment (PASA)during the system design adjustments. During
each iteration of the design process, the granularity of the considered
systems within the safety analysis can be increased. Initially, a functional
breakdown is being conducted to identify the main aircraft functions. In this
context, especially those functions that are taken over by the propulsion
system are of special interest. In the next step an FHA is being conducted on
the aircraft level which identifies the failure cases of the previous
functions and their effects on, for example, the aircraft, the passengers, the
vehicle and the environment. As proposed in Schäfer et al. [34] the failure
cases total loss of function, partial loss of function, unannunciated loss of
function, incorrect operation of function, inadvertent operation of function
and unable to stop the function should be analysed and their failure effects
on the aircraft be described.

The failure effect of a functional failure is the basis for the following
process of developing a safe system architecture as indicated in Fig. 4.

Figure 4: Schematic depiction of the interconnection between Aircraft Level
FTA and System Level FTA

Based on the failure effect and the required Function Development Assurance
Level (FDAL)as defined within the EASA SC-VTOL an allowable failure
probability is assigned to each functional failure case (label 1). For each
identified functional failure case a subsequent fault tree is created within
the FTA on aircraft level to identify the causes (base events) that contribute
to each functional failure case, the so-called top event (label 2). Based on
the allowable failure probability for each failure case an allowable failure
probability can be assigned to each failure cause (label 3).

Up to this point the analysis has been conducted based on the aircraft
functions. In the next step the system level is analysed by identifying the
systems that contribute in fulfilling a specific aircraft function. The
initial system architecture from section 2.3 is the basis for this analysis
and needs to be crosschecked against all safety requirements that were derived
from the aforementioned process (label 1-3). The crosscheck is done by
developing a system level FTA, in which the top event of the system level FTA
is the base event of the previously created aircraft level FTA. Within this
system level FTA the component failure causes leading towards the top event
are collected (label 4) and their failure probabilities defined by using
historical data as provided by e.g. the Nonelectronic Parts Reliability Data
(NPRD)Dataset [35] (label 5). With this information the actual failure
probability of a system function is calculated bottom-up (label 6) and
gathered within the PASA. As long as the allowable system reliability cannot
be assured by the designed propulsion system architecture, the architecture
needs to be adjusted and the process starts again. Finally, the results are
collected within the PSSA, which indicates if the requirements of the aircraft
level FHA can be fulfilled.

To evaluate the sensitivity of the propulsion system architecture to critical
system components, minimal cut sets are generated based on Reliability Block
Diagrams (RBDs) and fed back into the system design.

As the propulsion system is a safety-critical system, whose failure may cause
human injury or even loss of life, the system shall only have two states:
operational or failed-safe [36]. A fail-unsafe condition shall be prevented by
all means. Therefore, either the design principle of a safe life or fault-
tolerant design must be applied for developing the propulsion system. While a
safe life design is characterized by oversizing and prematurely replacing
components before failure, a fault tolerant design requires to incorporate
hardware, information, time or software redundancy [36]. The following
strategies are promoted herein to ensure a safe system design depending on the
analysed aircraft functional failure case:

  * •

Total loss or partial loss of function:
Implement additional system components with the same functionality (for
example: passive, active or hybrid hardware redundancy).

  * •

Unannunciated loss of function:
Make use of software redundancy by implementing fault detection and fault
indication mechanisms.

  * •

Incorrect operation, inadvertent operation, unable to stop a function:
Implement options for masking a faulty system component.

###  2.5 Propulsion System Component Sizing and Validation

The last step within the applied propulsion system design methodology aims at
further specifying the propulsion system components and validating the system
architecture by sizing and simulating each component based on off-the-shelf
components. The sizing is conducted using common sizing methods.666For
detailed information about the sizing process of a multicopter propulsion
system it is referred to Bertram et al. [37]. The simulation of the propulsion
system helps to validate if the derived vehicle architecture can suitably
fulfil the initial ConOps definition and requirements. If necessary,
additional architecture adjustments and requirements are derived based on the
sizing and simulation results.

##  3 Case Study

Within this section, the previously described conceptual design method is
applied to a case study to derive a conceptual propulsion architecture for a
battery-powered multirotor eVTOL vehicle that is operated by a pilot.

###  3.1 ConOps Definition & Vehicle Requirement Analysis

Figure 5: Flight mission profile of the analysed use case consisting of three
consecutive flights with the flight segments 1: Taxi out, 2: Vertical climb to
50ft AGL, 3: Transition to cruise, 4: Cruise climb to cruise altitude, 5:
Cruise until destination, 6: Cruise descent, 7: Re-transition to hover, 8:
Vertical descent to ground, 9: Diversion to alternate, 10: Taxi in. [16]

The general requirements of the ConOps are summarized in Table 1 and define
the flight mission, payload, type of eVTOL vehicle and the powertrain
technology.

Table 1: General requirements of the ConOps definition Parameter | Value
---|---
Flight Mission | Three Flights + 20 min Loiter
Design Range | 50 km
Payload | 360 kg (4 Passengers incl. Pilot)
MTOM |  $<3175$ kg
Vehicle configuration | Multirotor
Powertrain technology | All-electric
Energy source | Battery
|

For this case study the vehicle under investigation shall be operating within
the intracity use case. The total flight mission, as indicated in Fig. 5,
consists of in total 50 km, which are separated in three flights to allow for
passenger embarkation and disembarkation in between plus additional 20 minutes
reserve time at minimum drag speed. The eVTOL vehicle shall be able to
transport at least in total 4 passengers with 90 kg each, which results in a
payload capability of 360 kg.

Figure 6: Quadcopter rotor cross-configuration

As up to date the quadcopter is the most critical vehicle configuration in
terms of safety as described within section 1.2 as well as energy consumption,
the quadcopter vehicle configuration shall be selected for fulfilling this
mission. Thereby, a cross-configuration of the rotors is selected, in which
they are evenly and symmetrically distributed along the x- and y-axis to
provide good controllability and handling quality as shown in Fig. 6. The
rotors shall be fixed-pitch and speed-controlled as they promise less system
complexity, even though the pitch rotor control would be beneficial in terms
of controllability, achieving quick vehicle response times and low noise. The
powertrain shall be all-electric and powered by batteries, since it could be
shown in Bertram et al. [16] that a battery full electric powertrain is
competitive compared to other powertrain technologies for up to 50 km design
range, based on the current state of the art.

The controllability analysis, handling quality and noise aspects presented
within section 2.2 have been taken into consideration in parallel to any
system design adjustments. As they are not in focus of this paper, they are
not further elaborated on herein.

###  3.2 Propulsion System Concept Definition

Figure 7: System context definition for the propulsion system

With the information about the ConOps and the vehicle requirements an initial
propulsion system concept is defined within step three of the applied
conceptual design method. To develop the propulsion system concept, the CAMEO
Systems Modeler was used. As described in section 2.3, initially the system
context for the system of interest is defined as shown in Fig. 7.

The system context indicates that the propulsion system of the multirotor
receives control commands from the cockpit crew. These control commands are
merged with data from the air data sensors in order to lift and control the
aircraft for passenger transport. In order to provide a closed control loop
for the unit controlling the vehicle, currently a cockpit crew, status
information is fed back to the cockpit indication systems. During the
transformation of the input signals into lift and thrust, air, thermal energy
and noise are interchanged between the environment and the propulsion system.
As the propulsion system components will suffer of degradation during daily
operation, the means for maintenance actions are included within the system
context.

By analysing the use cases of the propulsion system, numerous main functions
could be identified that need to be fulfilled by the propulsion system and the
adjacent aircraft systems. The activity diagrams for each identified main
function enabled to identify the sub-functions for the propulsion system. Fig.
24 gives an overview of all identified functions.

When grouping similar functions together they can be allocated to respective
system groups as shown in Fig. 25. It becomes apparent that the four generic
system groups, namely the flight control, the power and drive, the electrical
and the thermal management system group, as described in section 2.3, can be
identified here as well. In addition to that, the functional analysis requires
the integration of an information system group into the propulsion system as
it is essential to feed back the information from all participating propulsion
system groups back to the cockpit and an optional in-service monitoring unit
for health monitoring and improving maintenance schedules. Besides the
identification of the main system groups, this graphical representation allows
to identify the item flow between the different system groups. Within the next
step of the architecture development each functional block is assigned to a
specific system component as shown in Fig. 26 and, thereby, an initial logical
propulsion system architecture is developed. Within this architecture the
flight control system group is composed of at least a Flight Control Computer
(FCC)and an air data computer gathering and distributing air sensor data
including GPS data. Using the control inputs from the cockpit and the air
data, the FCC calculates and controls the required power setting for the
electric motor and, thereby, regulates also the corresponding setting of the
thermal management system. The power and drive system group consists of motor
controllers, motors, optionally gearboxes and the rotor. The energy for the
power and drive system group is provided by electrical system group which
consists of the battery system, a power distribution system and battery
control units. The information system group consists of data concentrator
units which gather and distribute status information. The thermal management
system is not further specified, as its system requirements are unknown so
far. However, based on the sizing and simulation of the power and electrical
system group within section 3.4.1, some specifications for an thermal
management system are collected in section 3.4.3. Merging this logical
architecture with the other vehicle systems as described within section 2.3 an
initial sizing loop for the whole vehicle system is conducted. However, as
this is not part of this paper, it is referred to [16].

Within the subsequent safety analysis, the propulsion architecture is further
modified to fulfil the safety requirements of EASA SC-VTOL [12] of the
enhanced777As soon as the vehicle is expected to transport passengers over
congested areas it falls into the certification category enhanced of EASA SC-
VTOL with the highest required safety levels. vehicle category. The considered
systems within the safety analysis are indicated in Fig. 26. However, for
simplification reasons, the thermal management system and the information
system group are initially excluded from the safety assessment and will be
integrated in the future.

###  3.3 Safety and Reliability Analysis

The safety and reliability analysis as presented in section 2.4 has been
conducted using the SysML Modelling Language within the CAMEO Systems Modeler
together with the SysML Profile Risk Analysis and Assessment Modelling
Language (RAAML) [38] and the FHA profile [34] which facilitate conducting a
model-based safety assessment. The safety analysis loop has been run through
several times during the design process to account for the system changes that
were required to reach the reliability guidelines and to account for the
results of the sizing process. Therefore, the following section presents the
main results of each step of the safety analysis based on the final propulsion
system architecture as presented in section 3.5.

Functional Breakdown Analysis

Figure 8: Functional Breakdown analysis with the aircraft functions that are
connected to the propulsion system

Within the functional breakdown analysis the main aircraft level functions
were identified, that are taken over by the propulsion system as shown in Fig.
8:

  1. 1.

provide lift for safe flight,

  2. 2.

provide differential thrust for yaw,

  3. 3.

provide differential thrust for pitch,

  4. 4.

provide differential thrust for roll and

  5. 5.

provide forward thrust.

Functional Hazard Analysis During the initial safety analysis loop it became
quickly apparent that a quadcopter with a non-redundant propulsion system as
presented in previous section888During the first iteration a quadcopter
vehicle configuration is assumed in which each rotor is powered by a pure
series connection of the system components FCC, battery, motor controller and
electric motor as described in the previous section 3.2. will require so many
additional redundancies that the design will most probably not be reasonable
in terms of total weight and system complexity. The difficulty of the
quadcopter configuration is that a partial loss of providing lift may be
caused, for example, by a single rotor failure which exhibits a failure
probability of $2.83\cdot 10^{-4}$ per hour999This failure rate results when
using the component failure rates presented later on in Table 3.. The partial
loss of providing lift caused by a single rotor failure within a quadcopter
configuration must be expected to be a catastrophic event [13] which shall not
happen more often than $1.0\cdot 10^{-9}$ per hour as it is categorized as a
FDAL A event within EASA SC-VTOL [12]. Therefore, a main vehicle design
adjustment was conducted by adding two push propellers to the rear of the
vehicle as shown in Fig. 9.

Figure 9: Visualization of the quadcopter with two push propellers [27]

This measure assumes, that the resulting yaw moment of one rotor loss can be
counteracted and the failure effect of a partial loss of providing lift caused
by one single main rotor loss attenuates from a catastrophic event to a
hazardous event with an allowable failure probability of $1.0\cdot 10^{-7}$
per flight hour and less redundancies can be expected to be required.

Table 2: FHA failure effect classification for each identified aircraft level function Function failure |  Provide lift |  Provide diff. thrust for pitch |  Provide diff. thrust for roll |  Provide diff. thrust for yaw |  Forward thrust
---|---|---|---|---|---
Total loss |  catastrophic |  catastrophic |  catastrophic |  hazardous |  major
Partial loss |  hazardous |  hazardous |  hazardous |  n.a |  n.a
Incorrect ops. |  catastrophic |  catastrophic |  catastrophic |  hazardous |  catastrophic
Inadvertent ops. |  catastrophic |  catastrophic |  catastrophic |  hazardous |  catastrophic
Unable to stop |  catastrophic |  catastrophic |  catastrophic |  hazardous |  catastrophic
Unsym. partial loss |  n.a. |  n.a. |  n.a. |  minor |  minor
Degradation |  major |  major |  minor |  minor |  minor
|  |  |  |  |

An aggregated overview of the FHA results based on this quadcopter
configuration with two push propellers is given in Table 2. Especially the
failure cases total loss or partial loss of a function as well as the
inadvertent, incorrect operation including the unable to stop functional
failure are critical for the system design since they exhibit catastrophic or
hazardous events. For all functions that have at least a catastrophic and
hazardous failure effect the corresponding Aircraft FTA is being conducted.

Aircraft Level FTA Results The aircraft FTA for the catastrophic event
incorrect operation of the function $<$provide lift$>$ is presented
exemplarily in Fig. 10.

Figure 10: Aircraft FTA for the functional hazard ”Incorrect operation of the
function: provide lift”

As the permanent incorrect operation of the function to provide lift is
classified as a catastrophic event with an allowable failure probability of
$1.0\cdot 10^{-9}$ per hour it can be concluded that the permanent incorrect
operation of one rotor is allowed to happen with a probability lower than
$2.5\cdot 10^{-10}$ per flight hour. With this information the system
architecture that propels each rotor is designed in the next step using the
system level FTA. By developing all FTA s for the catastrophic failure effects
of the aircraft functions, it becomes apparent that, according to the herein
used definition, the inadvertent operation or unable to stop functional
failures are subsets of the incorrect operation. Therefore, three main basic
events remain that need to be further analysed within the system level FTA:

  * •

Total loss of one rotor lift

  * •

Incorrect ops. of one rotor providing lift

  * •

Incorrect or inadvertent ops. of one propeller providing thrust

System Level FTA Results

Table 3: Failure rate probability for each propulsion system component

| Component | Failure condition | Applied Failure Rate111Indicates whether destination can be reached in case of emergency operation starting within the third flight segment.
---|---|---|---
BAT | Battery | Failure |  $9.31\cdot 10^{-5}$ [35]
MC | Motor Controller | Failure |  $4.75\cdot 10^{-5}$ [13]
M | Electric Motor | Failure |  $9.24\cdot 10^{-5}$ [13]
GB | Gearbox | Failure |  $5.00\cdot 10^{-6}$ [13]
FCC | Flight Control Computer | Failure, Malfunction |  $1.57\cdot 10^{-5}$ [35]
REL | Disconnect Power Relay | Unintended opening, Failure to operate |  $4.60\cdot 10^{-5}$ [35]
DISC | Disconnect Clutch | Unintended opening, Failure to operate |  $4.70\cdot 10^{-5}$ [35]
|  |  |

  * 1

Due to lack of data it is assumed that the applied failure rate is the same
for the different cases of failure condition.

On the system level, the rotor drive system architecture is revised until the
total loss and the incorrect ops of one rotor fulfils the failure probability
goals defined within the aircraft level FTA s of $<2.5\cdot 10^{-8}$ and
$<2.5\cdot 10^{-10}$ respectively. Using a single drive unit without any
redundancies and assuming the failure probabilities as listed in Table 3 the
total loss of one rotor must be expected to occur with a probability of
$2.8\cdot 10^{-4}$. Therefore, as a first countermeasure the rotor drive is
designed as a dual active drive system composed of two drive units. As the
dual active drive system would still exhibit a failure rate for a total loss
of one rotor of $5.6\cdot 10^{-8}$ each motor controller unit shall be powered
by at least two separate battery packs and a dual active / passive channel
motor controller shall be used. The passive channel continuously monitors the
main motor controller and shall be able to take over its function (hot standby
redundant system).

For meeting the maximum allowable failure rate for the incorrect operation of
one rotor, it is essential to reduce the probability that an erroneous FCC
signal, motor controller output or motor output propagates up to the rotor.
Firstly, the probability of an erroneous motor controller output is already
reduced by the usage of a dual channel motor controller. Secondly, it must be
prevented that any malfunction within the electric motor is passed to the
rotor. Therefore, two masking strategies must be in place: once by
disconnecting the power from the electric motor using an emergency power
disconnect relay and secondly using a mechanical disconnect clutch that
separates the motor output from the rotor shaft. Thirdly, the probability of
an erroneous or missing valid FCC command is reduced by implementing a triple
modular redundant FCC setup which enables determination of the correct output
by majority voting. Each FCC is then required to exhibit a malfunction or
failure probability of less than $1.58\cdot 10^{-5}$ per hour.101010Based on
the NPRD, this requirements is expected to be realistic as control board
failure probabilities in average exhibit a failure rate of $1.2\cdot 10^{-6}$
per hour [35], which therefore still allows for considering a deduction factor
of 10 due to stresses that are caused by environmental influences and the
operation. By implementing these strategies both the probability for an
erroneous power output of the driving units and the FCC group is reduced below
$10^{-10}$ per flight hour which reduces the incorrect operation of one rotor
to $2.46\cdot 10^{-10}$ and therefore fulfils the allowable failure
probability. The system FTA with the identified system components of the final
propulsion system architecture contributing to a permanent incorrect operation
is shown in Fig. 27. The incorrect or inadvertent operation of the rear push
propellers can be mitigated by the use of triple redundant FCC signals, a dual
channel motor controller and a single disconnect option, like a disconnect
relay.

Table 4: Extract of the PSSA results showing the expected system failure rates for the most limiting system level FTA top events Functional Hazard |  Max. allowable failure rate |  Expected failure rate
---|---|---
Loss of one rotor lift |  $<2.5E-8$ |  $1,06\cdot 10^{-8}$
Inadvertent ops. of one rotor |  $<1.0E-9$ |  $2.37~{}10^{-20}$
Incorrect ops. of one rotor |  $<2.5E-10$ |  $2.46\cdot 10^{-10}$
Inadvertent ops. of one propeller |  $<5.0E-10$ |  $2.76\cdot 10^{-15}$
|  |
Table 5: PASA results: expected failure rates for each identified catastrophic aircraft level function Function failure |  Provide lift |  Provide diff. thrust for pitch |  Provide diff. thrust for roll |  Provide diff. thrust for yaw |  Forward thrust
---|---|---|---|---|---
Total loss |  $4.49\cdot 10^{-16}$ |  $4.49\cdot 10^{-16}$ |  $4.49\cdot 10^{-16}$ |  hazardous |  major
Partial loss |  $4.24\cdot 10^{-8}$ |  $4.24\cdot 10^{-8}$ |  $4.24\cdot 10^{-8}$ |  n.a |  n.a
Incorrect ops. |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  hazardous |  $5.52\cdot 10^{-15}$
Inadvertent ops. |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  hazardous |  $5.52\cdot 10^{-15}$
Unable to stop |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  $9.86\cdot 10^{-10}$ |  hazardous |  $5.52\cdot 10^{-15}$
Unsym. partial loss |  n.a. |  n.a. |  n.a. |  minor |  minor
Degradation |  major |  major |  minor |  minor |  minor
|  |  |  |  |

To also identify common causes of error, minimal cut sets were calculated and
analysed within a reliability block diagram analysis. All derived requirements
from the system level FTA and the minimal cut sets are listed below.
Implementing these requirements for the overall system architecture ensures
that the maximum allowable failure rates for the four system level FTA top
events or respectively the basic events of the aircraft level FTA as shown in
Table 4 can be complied with.

  1. 1.

Each rotor requires a dual active redundant drive train. When a geared
propulsion is chosen each drive train must also be equipped with a separate
gearbox.

  2. 2.

Each rotor unit must be able to produce $\geq 50\;\%$ of the total vehicle
thrust required for hover for a prolonged time.

  3. 3.

For a short time interval, each rotor unit must be able to produce more than
$50\;\%$ of the total hover thrust (ideal would be to provide $\geq 50\;\%$ of
the total vertical climb thrust) in order to break any vertical descent during
landing.

  4. 4.

Each motor unit must be able to be passivated and therefore be equipped with
at least two means of decoupling, preferably a mechanical and electrical
decoupling device.

  5. 5.

Any internal fault of the motor control units must not lead to an unrecognized
malfunction that propagates to the electric motor. Therefore, the motor
control units should be designed as dual channel active passive units.

  6. 6.

The passive channel of the motor control unit acts as a fail-safe-backup-mode
that activates in case of any loss of input signal from the FCC s or in case
of a motor control unit malfunction. In this state the motor control unit
should command a constant motor rotational speed which corresponds to the
hover state in normal flight.

  7. 7.

Each motor control unit must be connected to at least two batteries or power
supply busses to achieve a dual modular redundant power source. To prevent any
common cause failures in total at least 4 battery packs are required for the
four main rotors and one additional separate battery pack is required for the
rear push power train.

  8. 8.

One independent stand-alone battery source must be used to power both push-
propeller units together.

  9. 9.

Both rear propellers in combination must be able to create a vehicle yaw
moment bigger than the resulting yaw moment of two shutdown concordant
rotating main rotors.

  10. 10.

The FCC setup must be triple modular redundant using majority voting. Each FCC
must exhibit a failure rate of $\leq 1.58\cdot 10^{-5}$ per hour

It becomes apparent that the loss of one rotor lift and the incorrect
operation of one rotor providing lift are the most critical system design
drivers for the propulsion system of the main rotors. As soon as the failure
rate requirements are fulfilled for those events, the other functional hazards
will be fulfilled as well. The push-propeller architecture however, is mainly
driven by the functional hazard of an inadvertent operation of each propeller.

The resulting achievable failure rates for the top events of the aircraft
level FTA, which were identified within the FHA, are summarized in Table 5. It
is important to note that the architecture design and its failure
probabilities are based on the following assumptions:

  1. 1.

The loss of one main rotor does not lead to a catastrophic event as the
opposite main rotor will be shut down to achieve equilibrium in pitch and
roll. The resulting yaw moment is counteracted by the push propellers at the
rear. The quadcopter therefore remains controllable and is able to continue
safe flight and landing.

  2. 2.

Each motor can be passivated by an own electric disconnect relay as well as a
mechanical declutch mechanism. Thereby, it is assumed that for passivating the
electric motor it is sufficient if either the mechanical declutch or the
electric disconnect relay is activated. However, the control logic will only
allow recovery of the electric motor drive to power the rotor if both the
mechanical and electrical switches are closed. This is required in order to
prevent a passivated malfunctioning electric motor drive to become operative
due to an inadvertently closed electrical switch or mechanical clutch.

###  3.4 Propulsion System Component Sizing and Validation

Within this section the main system groups of the propulsion system are sized,
compared with off-the-shelf components and additionally simulated. At first
the power and drive system is specified. Based on these results on the one
hand the electrical system group with a primary focus on the batteries and on
the other hand the thermal management system for the propulsion system are
developed and analysed. The simulation for each system group was carried out
using the open modelling language Modelica within the Dymola environment by
Dassault Systèmes.

####  3.4.1 Sizing & Simulation Power System

As the power and drive system group consists of the motor controller, the
electric motor, the gearbox and the rotor (see Fig. 26), this section presents
the specifications of these components for the main rotor and the rear push
propeller drive system. The results are based on the following assumptions:

  1. 1.

The main rotor drive is designed for a maximum rotor tip speed of
$Ma_{tip}=0.45$ during normal operation and two rotor blades to ensure a quiet
operation. The disc loading of 200 $N/m^{2}$ is chosen to aim for an energy
efficient flight and minimise rotor losses.

  2. 2.

The rear push propeller is designed for a cruise tip speed of $Ma_{tip}=0.5$,
using a propeller with two blades and a propeller radius of 0.54 m to provide
a cruise speed of 110 km/h at 3120 RPM.

  3. 3.

A system voltage for the power and drive system components is defined with 600
V.

Based on the safety assessment a total power of at least $200\;\%$ compared to
the highest continuous required flight power needs to be provided by the four
main rotor drives. For the quadcopter configuration this amounts to at least
450 kW that needs to be provided by eight electric motors.

During the sizing process a direct drive architecture was compared to a geared
drive for the main rotor propulsion architecture. The comparison of a direct
drive and a geared drive architecture assuming commercial off-the-shelf
permanent magnet synchronous electric motors (PMSM) and planetary
gearboxes111111Based on an internal market study, suitable commercial off-the-
shelf products were selected for this comparison. clearly indicates the
disadvantages of a direct drive. The currently available electric PMSM s
cannot be operated in their optimal efficiency range due to the low rotating
speeds and high torque values that are required for the quadcopter main rotor
propulsion. The efficiency of the direct drive lies between $85\;\%-92\;\%$ as
indicated in Fig. 11 whereas the geared drive is able to operate between
$92\;\%-96\;\%$ as indicated in Fig.12. Therefore, high thermal heat losses
must be suspected using a direct drive.121212Further information about the
thermal management system are provided in the chapter 3.4.3.

Figure 11: Representation of the electric motor operating points for a direct drive architecture (blue: hover, vertical climb, cruise climb, cruise, loiter, vertical descent; red: emergency hover and vertical climb) fitted within the efficiency map of a commercial off-the-shelf motor [39] that is providing up to 1000 Nm torque Figure 12: Representation of the electric motor operating points for a geared drive architecture with a 5:1 gear reduction ratio (blue: hover, vertical climb, cruise climb, cruise, loiter, vertical descent; red: emergency hover and vertical climb) fitted within the efficiency map of a commercial off-the-shelf motor [40] that is providing up to $230\;Nm$ torque Table 6: Recommended specifications for the power system components of the main rotor Component |  Specification
---|---
Specifications of the main rotor power and drive system:
Electric Motor |  • Highest efficiency at 500-550 RPM (without gearbox) or 2650-2800 RPM (gearbox 5:1) with 100 Nm torque (hover & vertical climb operating point)
|  • Continuous torque capability of $\geq$ 120 Nm and $\geq$ 145 Nm maximum
peak torque
|  • Continuous power capability of 29 kW and a maximum peak power of 58 kW
|  • Max RPM at $\geq$ 780 RPM (without gearbox) or 3905 RPM (with gearbox
5:1)
Gearbox |  • Reduction gear ratio of 5:1
|  • Input rotating speed range of 330-2770 RPM (normal ops), up to 3905 RPM
in irregular operation
|  • Output rotating speed range 66-554 RPM (normal ops), up to 781 RPM in
irregular operation
|  • Equivalent output torque of $\geq$ 455 Nm
|  • Maximum peak output torque of $\geq$ 700 Nm
Motor Controller |  • Continuous power of $\geq$ 30 kW
|  • Maximum peak power of $\geq$61 kW
Specifications of the push propeller power and drive system:
Electric Motor |  • Highest efficiency at 3120 RPM with 99 Nm torque (cruise operating point)
|  • Continuous torque capability of 99 Nm and a maximum peak torque of 125 Nm
|  • Continuous power capability of 32 kW and a maximum power of 60 kW
|  • Max RPM of $\geq$ 4576 RPM
Motor Controller |  • Continuous power of $\geq$ 34 kW and maximum peak power of $\geq$ 63 kW
|  • Continuous motor current $\geq$ 90 A and maximum motor current $\geq$ 108
A
|
Figure 13: Weight comparison of a direct drive and geared propulsion system
for the main rotor

In terms of the main propulsion system weight (consisting of the electric
motor, motor controller and gearbox) the geared propulsion architecture
exhibits a weight of 374 kg compared to 400 kg for the direct drive. As it can
be seen in Fig. 13 the weight of the direct drive powertrain is mainly driven
by the electric motor. While the electric motor for the geared powertrain is
approximately $70\;\%$ lighter, heavy gearboxes are required to provide
sufficient torque capability. Still, a weight saving of almost $7\;\%$ is
estimated using the geared drive.

This comparison of the motor efficiency and the expected propulsion system
weight shows that the usage of a geared drive is advisable to save weight and
thermal losses. The gearbox as an additional component of the powertrain
therefore needs to be considered in the safety and reliability analysis.

The propulsion system for the rear push propulsors is sized to provide the
highest efficiency during the cruise flight. This requires an electric motor
to provide the highest efficiency at 3120 RPM and 99 Nm torque. In total the
electric motors for the rear push drive are expected to weigh 42 kg and amount
to $58\;\%$ of the rear propulsion weight. As the rear drive system does not
require a gearbox, the motor controllers make up for the remaining $42\;\%$.

The specifications for each component of the main rotor and rear propeller
power and drive system are listed in Table 6.

The simulation of the power and drive system has shown that the powertrain
components with the above-mentioned specifications are suitably sized for
powering the main rotors as well as the push propellers. Also, in failure
conditions the main rotors can still be accelerated to the required rotational
speeds. The preliminary dynamic simulation of the rotor rotational speed
following control signals shows rise times in the magnitude of tenth of
seconds, depending on the step size. However, whether or not this rise time of
the rotor is sufficient to achieve quick response times of the total vehicle
and therefore to achieve good handling qualities is still under further
analysis131313For further information concerning the controllability and
handling quality of RPM controlled rotors within a quadcopter it is referred
to [27]..

Based on these analyses the following implications can be drawn for the
propulsion system architecture:

  * •

Using a gearbox is recommended for the main rotor drive system.

####  3.4.2 Sizing & Simulation Electrical System

Based on the functional propulsion architecture of Fig. 25 and the
correspondingly derived logical architecture of Fig. 26 a battery storage
system is required to power the propulsion system. As described by the
requirement no. 7 of the system and reliability analysis of section 3.3 in
total four identical batteries are required for powering the main rotors and
one common battery pack is required for the rear push-propeller drive trains.
Within this section an initial sizing of the energy storage system is
conducted. This includes an analysis of the required energy, the battery pack
size and weight by considering failure conditions of the propulsion system
during flight.

Looking into the electrical power distribution of the main rotors, each motor
controller needs to be able to receive power from an alternate battery source
in case its main battery source is unavailable, in order to fulfil the
requirement of section 3.3. Therefore, an allocation as shown in Table 7 is
chosen. The Table indicates that for the rotor drive number 1 the motor
controller 1.1. receives mainly power from battery 1 but can be switched to
battery 3, whereas motor controller 1.2 is powered by battery 2 and 4. Based
on this allocation each battery continuously powers two motor controllers,
with each motor controller consuming a maximum of 30 kW during normal
operations.

Table 7: Allocation of the four main battery packs to the motor controllers of each main rotor drive system | Rotor 1 | Rotor 2 | Rotor 3 | Rotor 4
---|---|---|---|---
MC x.1 | BAT 1 | BAT 1 | BAT 3 | BAT 2
MC x.1 ALT | BAT 3 | BAT 2 | BAT 2 | BAT 3
MC x.2 | BAT 2 | BAT 3 | BAT 4 | BAT 4
MC x.2 ALT | BAT 4 | BAT 4 | BAT 1 | BAT 1
|  |  |  |

Fig. 14 shows the power allocation of the main rotor battery packs during
normal operation.

Figure 14: Power allocation of the main rotor battery packs during normal
operation. Above or below each motor symbol the maximum required power of each
electric motor is indicated for the shown operating state. The required motor
controller power is shown next to the corresponding power lines of the motor
symbol. On top of each battery pack the maximum available power of each
battery pack is listed.

Based on the allocation, the sizing of the battery packs can be conducted
which is influenced by the following requirements:

  1. 1.

The batteries must provide the total energy required for fulfilling the flight
mission during normal ops.

  2. 2.

The capacity of each battery pack must be sufficient to provide sufficient
power for the connected motor controllers during normal ops.

  3. 3.

The battery packs must provide enough energy and power for enabling a
continued safe flight and landing during any failure condition

Each requirement is now analysed separately. As a basis the Panasonic 18650
battery cells are used [41]. Since a system voltage $U_{sys}$ of 600 V is
chosen, each battery pack should provide 600 V which requires 167 cells
connected in series.

Battery sizing based on the required total energy and power for normal
operation:
Based on the energy requirement of 19.7 kWh141414The energy requirement was
derived from the initial sizing process and validated with the developed
simulation model for powering two drive units during normal operation for the
total flight mission $E_{BS}$, the required battery pack capacity $C_{BP,E}$
amounts to 32.8 Ah.

$C_{BP,E}=\frac{E_{BP}}{U_{sys}}=\frac{19.7\;kWh}{600\;V}=32.8\;Ah$

The battery capacity based on the two supplied drive units with a required
maximum power $P_{max}$ of 30 kW each for normal operations amounts to 29.3
Ah.

$C_{BP,P}=\frac{P_{max}}{\xi\cdot U_{sys}}=\frac{2\cdot\
30\;kW}{3.448\frac{1}{h}\cdot 600\;V}=29.3\;Ah$

using the cell discharge rate $\xi$ that is composed of the Panasonic rated
battery cell current $i_{Batt}$ and rated capacitance $c_{Nenn}$

$\xi=\frac{i_{Batt}}{c_{Nenn}}=\frac{10\;A}{2.9\;Ah}=3.448\frac{1}{h}.$

Sizing the battery with the higher of both capacity requirements of 32.8 Ah
results in a battery pack that is able to provide 68 kW discharge power.

$\displaystyle P_{available}$ $\displaystyle=C_{BP}\cdot\xi\cdot U_{Sys}$
$\displaystyle=32.8\;Ah\cdot 3.448\frac{1}{h}\cdot\;600V$
$\displaystyle=68\;kW.$

Battery sizing based on the energy and power requirement during failure
conditions.
The three most restrictive failure conditions are analysed and their effects
on the power distribution of the battery packs shown in figure 15:

  * •

Failure of one rotor drive unit due to motor or motor controller unit failure

  * •

Failure of one rotor unit

  * •

Failure of one battery pack

(a) Failure case: single rotor drive unit loss caused by a motor or motor
controller failure (not optimized)

(b) Failure case: complete main rotor drive loss

(c) Failure case: single battery pack loss

Figure 15: Power distribution of the main rotor battery packs for different
failure cases

Power requirement: During a single motor unit loss or a failure of one battery
pack at least one of the remaining battery packs is required to supply at
least 90 kW power as indicated in Fig. 15(a) and 15(c). In order to provide 90
kW battery pack power, a pack capacity of 43.5 Ah is required.

$C_{BS,P}=\frac{P_{min}}{\xi\cdot U_{sys}}=\frac{90\;kW}{3.448\frac{1}{h}\cdot
600\;V}=43.5\;Ah$

During a single rotor loss, however, the available 68 kW pack power are
sufficient to cope with this failure.

Energy requirement: Whether or not the battery capacity is sufficient for
reaching a suitable airfield even during failure conditions depends on the
type of failure condition, the time at which the failure occurs and the
intended emergency flight procedure. Herein the most unfavourable conditions
are assumed:

  * •

Based on the previous failure analysis the type of failure condition is
assumed to draw 90 kW power of a single battery pack for the remainder of the
flight.

  * •

The failure condition occurs on the third flight of the total flight mission
at the equal time point (ETP)151515The ETP defines the point within each
flight, where the time to reach the next suitable airfield equals the time to
return to last overflown or departed airfield.. The ETP for the defined flight
is reached 5.7 min after start of the third flight segment. Up to this point
approximately 12.2 kWh are already consumed, which includes the energy for
flight one and two and the energy up to the ETP. 161616Assuming the flights
one and two were carried out as planned and no contingency energy has been
used.

  * •

There is no other closer landing site available than the intended destination.
Therefore, the flight is continued to the destination.

With these assumptions another 8.5 kWh are required, which is the equivalent
energy to reach the destination airfield within 5.7 minutes. Therefore, a
battery capacity of at least 34.3 Ah or 20.6 kWh are required. All battery
pack capacity requirements of the normal and failure condition operation are
summed up in Table 8.

Table 8: Summarized capacity requirements for each main rotor battery pack based on the energy and power requirements Capacity Requirement | Battery capacity | Destination
---|---|---
based on |  | reachable?111Indicates whether destination can be reached in case of emergency operation starting within the third flight segment.
Energy required | 32.8 Ah | no
(normal ops) |  |
Energy required | 34.3 Ah | yes222Defines the absolute minimum
(emergency ops) |  |
Power required | 29.3 Ah | no
(normal ops) |  |
Power required | 43.5 Ah | yes
(emergency ops) |  |
|  |

It becomes apparent that a main rotor battery pack capacity of 43.5 Ah is
required and driven by the maximum power requirement during the failure
condition caused by a single rotor drive unit loss or a battery pack loss.
Under normal operating conditions a pack with this capacity will be discharged
down to $25\;\%$ after having completed the flight mission and used 20 min
reserve flight time and will have 9.2 min of flight time available at the
occurrence of a failure condition at the ETP during the third flight. A
battery with these specifications can be composed of 15 of the Panasonic cells
connected in parallel and 167 in series, so that in total 2505 cells171717The
effect of battery degradation has so far not been in the scope of this
research. are used. Each battery pack then weighs 120 kg.

Battery sizing for the rear push propulsion system:
The same assessment is conducted for the push propeller propulsion battery
pack, which must be able to provide at least 68 kW power during normal
operation and 126 kW power during an emergency condition at which a main rotor
has failed. The results are summarized in Table 9.

Table 9: Summarized capacity requirements for the push propulsion battery pack based on the energy and power requirements Capacity Requirement | Battery capacity | Destination
---|---|---
based on |  | reachable?111Indicates whether destination can be reached in case of emergency operation starting within the third flight segment.
Energy required | 70.0 Ah | no
(normal ops) |  |
Energy required | 88.8 Ah | yes 222Defines the absolute minimum
(emergency ops) |  |
Power required | 32.6 Ah | no
(normal ops) |  |
Power required | 61.1 Ah | no
(emergency ops) |  |
|  |

The battery pack capacity in this case is mainly driven by the energy
requirement during the failure condition at the most unfavourable point of
time. Therefore, the battery is sized with a capacity of at least 88.8
Ah181818As the battery sizing based on the normal operation results in more
than $20\;\%$ less required capacity than based on the highest failure case
capacity requirement, no additional reserve of $20\;\%$ for the battery
capacity is included respectively 54.1 kWh, which results in having 31
parallel cells and 167 cells connected in series. In total 5177 cells are
required, which results in a capacity of 90 Ah, with 186 kW available power.
During normal operation the battery pack is discharged down to $37\;\%$ in
case the 20 minutes loiter time had been utilized during flight. At the ETP
the battery provides enough energy to power the push propulsion system for
another 6 minutes in case of emergency operations, which is sufficient to
reach the landing site.

Further optimization of the battery pack size could be gained by an
intelligent battery management system that allows an interconnection between
all battery packs and, thereby, allocates energy and power requirements
smartly between all battery packs.

The simulation of the battery packs in combination with the previous power and
drive system has indicated that the battery is sufficiently sized to provide
energy for the whole flight mission. The heat development within each battery
pack is analysed within the next section and the requirements for a cooling
system are derived,

Summary of the derived specifications for the propulsion architecture:

  * •

Each main rotor battery pack requires a battery capacity of at least 43.5 Ah
and should be able to provide at least 90 kW power.

  * •

The push-propeller battery pack requires a battery capacity of at least 88.8
Ah and should be able to provide at least 68 kW power.

####  3.4.3 Sizing & Simulation Thermal Management System

Within this section the results of the heat development simulation within the
power and drive system components are presented and initial system
requirements for a thermal management system derived. As a result from
previous section, this analysis is based on the propulsion design which
incorporates a geared drive propulsion system. Whereas the gearbox, as an
encapsulated system, can be expected to be self-cooling and lubricating, the
electric motor and motor controller are expected to be combinable within a
cooling system due to their similar requirements. For the battery packs,
however, a separate thermal management system is expected to be required,
which allows for heating at low temperatures and cooling during operation at
high operating temperatures, due to the narrow optimal battery operating
temperature range of 20-40 °C. When assuming VTOL operation at the warmest
areas within Europe, ambient temperatures of up to 42.7 °C191919The highest
measured temperature of the European city Madrid within the years 2017 and
2022 [42]. are taken into account during the design process of the propulsion
and cooling system.

Initially the thermal management system requirements for the motor and motor
controller of one rotor drive system are evaluated. Analysing the amount of
generated heat within the electric motor and motor controller gives the
following results. During the phase of the highest power requirement, the
vertical climb phase, the motor controller and the electric motor are expected
to produce up to 1.1 kW and 1.4 kW heat respectively under normal operating
conditions as shown in Fig. 16 and Fig. 17. During emergency conditions, in
which only one electric motor is left driving a main rotor, the heat output
amounts to 1.8 kW and 2.9 kW respectively.

Figure 16: Heat generation of the electric motor during normal and emergency
operation which is assumed to start at the end of the vertical flight phase of
the third flight. Figure 17: Heat generation of the motor controller during
normal and emergency operation which is assumed to start at the end of the
vertical flight phase of the third flight. Figure 18: Temperature development
within the electric motor copper windings using only air flow cooling (AF) or
a combined cooling (CC) compared to the temperature development of the motor
controller using liquid cooling.

As the intended electric motor provides means for airflow cooling, its effect
on the heat development within the electric motor components is initially
analysed. With an ambient air flow that is based on the flight mission, the
flight speeds, the vehicle rotor configuration and the cooling tubes geometry,
the temperature within the copper windings of the electric motor will still
rise over 120 °C during the transition of hover to cruise climb of the third
flight within the flight mission after 2088 seconds and reach a maximum of 136
°C as shown in Fig. 18. Thus, the temperatures within the electric motor
cannot be kept below 120°C during normal operation using only the ambient air
flow. Operating in the emergency rating, in which one electric motor must
provide the full power for a single rotor, the temperatures within the
electric motor would even rise over 200 °C during the third flight of the
mission (see Fig. 18). Consequently, the electric motor cooling system must be
complemented by an additional liquid cooling system. As the analysed motor
controller also requires liquid cooling according to the manufacturer’s data
sheet in order to keep its temperature below 85 °C, the motor controllers and
corresponding electric motors of one rotor drive unit are combined within the
same liquid cooling system. As the four rotor drive units will be located
below each rotor and therefore be located distant to each other, a separate
cooling system for each rotor drive unit is recommended.

As a conclusion the following requirements must be fulfilled by a combined
ambient air flow and liquid cooling system for the off-the-shelf analysed
electric motor and motor controllers.

  1. 1.

The electric motor operating temperature must be kept below 120 °C also during
emergency conditions while the motor is operating in emergency rating.

  2. 2.

The motor controller operating temperature must be kept below 85 °C during all
operating conditions (normal and emergency rating).

  3. 3.

As the motor controller can be operated with a liquid cooling temperature of a
maximum of 65 °C and the electric motor requires liquid cooling temperatures
below 50 °C, the thermal management system needs to keep the cooling liquid
temperature below 65 °C when passing the motor controller and 50 °C when
passing the electric motors.

  4. 4.

The maximum volume flow of cooling liquid for the motor controller is 6-12
l/min whereas the electric motor can only withstand 6-8 l/min.

  5. 5.

The maximum input pressure of the liquid cooling shall not exceed 2 bar when
entering each electric motor.

One exemplary cooling topology that is able to fulfil these requirements
consists of the motor controllers and electric motors of each rotor being
connected in series as shown in Fig. 19. As the motor controllers can
withstand higher liquid input pressures and emit less heat they are placed at
the beginning of the cooling flow. The electric motors can then be placed
downstream.202020A possible alternative would be to place the electric motors
in parallel downstream.

Figure 19: Schematic view of the combined cooling system for the electric
motor and motor controller consisting of a liquid cooling cycle and airflow
cooling.

The combined cooling system (CC) consisting of airflow cooling (AF) and liquid
cooling (LC) is designed with the following specifications:

  * •

Cooling fluid: Glysantin G40

  * •

Cooling liquid flow: 0.14 kg/s

  * •

Cooling air flow: dependent on flight phase - maximum available 2.3 $m^{3}/kg$

  * •

Heat exchanger size: $0.3\cdot 0.3\cdot 0.3$ m

  * •

Heat exchanger weight: 3.8 kg

The temperature development within the electric motor using this cooling
topology of combined cooling for the electric motor and liquid cooling for the
motor controller are shown in Fig. 18. It can be seen, that the temperature
within the electric motor stays below 120 °C during all operating conditions,
even in emergency conditions at the most unfavourable situation during the
flight mission when using a combined liquid and air-cooling system. Fig. 21
indicates how the generated heat within the electric motor is absorbed by the
ambient air flow and the liquid flow. As not all of the generated heat within
the first flight can be dissipated, the temperature within the electric motor
components rises during the flight mission. The inlet liquid cooling
temperature for the electric motor as shown in Fig. 18, however, almost
reaches the maximum manufacturer’s recommendation of 50 °C during normal
operation. Operating in emergency rating the inlet temperature even rises up
to 54 °C and therefore exceeds the manufacturer’s limit of 50 °C.

The temperature within the motor controller stays well below its limit of 85
°C as shown in Fig. 18. All of the heat is absorbed by the liquid cooling
flow. During the whole flight mission, the maximum inlet temperature of the
liquid fluid for the second downstream motor controller (MC2) reaches a
maximum of 60 °C (during emergency ops) and therefore stays below the required
65 °C.

To prevent an excessive heat build-up during the ground phases of the flight
mission, in which the vehicle is not moving and therefore receives no cooling
air flow, it is essential to keep up the liquid cooling flow as well as the
cooling air flow. Therefore, the liquid cooling pump needs to be operative.
Additionally, a ground fan, should be installed to facilitate the heat
transfer within the heat exchanger. Using no ground cooling the temperature of
all components within the cooling system would heat up to over 65 °C during
the five minutes ground phase. The same effect can be observed after
termination of the flight mission, where a temperature of 77 °C can be
observed across all components after 30 minutes. By increasing the ground
cooling time up to 30 minutes the overall temperature can be kept below 50 °C.

Figure 20: Temperature development within each battery pack at different
ambient temperatures with and without cooling during normal operation

In the following, the thermal management system requirements for the battery
packs are evaluated. Fig. 20 compares the temperature development within each
battery pack during normal operation with and without any cooling system. It
becomes clearly visible that the batteries cannot be operated without a
cooling system as the battery pack temperature will exceed the 40 °C
temperatures limit even at 20 °C ambient temperatures. Using a liquid cooling
circuit with a glycol-water mixture of 20:80 that is channelled along each
battery cell, the temperatures of each battery pack can be kept below 40 °C
during normal operation if the ambient temperature does not rise above 37 °C.
However, under emergency operation, in which one battery pack has failed
during the transition to cruise on the third flight segment, the battery pack
temperature of two battery packs (refer to Fig. 15(c)) will even increase up
to 40.6 °C at ambient temperatures of 37 °C. The ambient temperature has to
stay below 36.2 °C in order to ensure a battery pack temperature below 40 °C
during emergency conditions using a liquid cooling circuit. The liquid cooling
circuit used within this simulation has the following properties:

  * •

Outer cooling circuit - ambient air volume flow: 0.3 $m^{3}/s$

  * •

Inner cooling circuit - liquid volume flow: $6.8\cdot 10^{-5}\;m^{3}/s$

  * •

Inner cooling fluid: glycol-water mixture 20:80

For higher ambient temperatures a refrigeration cycle is required which is
part of future research.

A summarizing overview about the expected behaviour of the electric motors,
motor controllers and main rotor battery packs as well as their thermal
management systems during normal and emergency operation is given in Fig. 21.
Besides the expected heat flow also the amount of heat absorption of each used
cooling method is shown. Additionally, the temperature development of each
component is indicated for a typical hot summer day with 30 °C ambient
temperature.

Figure 21: Heat power loss within the electric motor, motor controller and
battery pack and its dissipation via ambient air flow and / or liquid cooling
at an ambient temperature of 30 °C

Based on the analyses of this section the following implications can be drawn
for the propulsion system architecture:

  1. 1.

Each propulsor requires a separate cooling system

  2. 2.

For each electric motor, that was chosen and analysed herein, a combination of
liquid cooling and air cooling is required as only air cooling is not
sufficient to cool the electric motor sufficiently.

  3. 3.

Each motor controller requires a liquid cooling system

  4. 4.

The motor controller and electric motor can be cooled using the same liquid
cooling system.

  5. 5.

Each liquid cooling system consists of the components: pump, cooling fluid
reservoir, heat exchanger.

  6. 6.

The cooling system should stay operative after each flight on ground for up to
30 minutes to prevent the cooling liquid to exceed the motor inlet temperature
of 50 °C and to absorb the stored thermal energy within the electric motor and
motor controller.

  7. 7.

The battery needs an own thermal management system that is capable of cooling
and heating. If operating at ambient temperatures of 20 - 36.2 °C each battery
pack can be cooled using a liquid cooling cycle. For ambient temperatures
outside this range the thermal management system still needs to be analysed
and designed.

###  3.5 Final Architecture

Figure 22: Schematic representation of the overall quadcopter propulsion
architecture and its implemented safety measures, excluding the thermal
management system.

This section presents how the requirements of the previous sections were
implemented in the final propulsion system design. This architecture is
expected to fulfil the safety reliability requirements. A schematic
representation of the propulsion system architecture for the quadcopter is
shown in Fig. 22. On the left side the main propulsion systems are shown with
the four main rotor drives that are supplemented by two push drives. Each
drive unit is connected with the battery units. In total at least three FCC
are provided. On the right the propulsion architecture for each main rotor is
depicted in more detail. It shows that the main rotor propulsion architecture
is composed of two electric motors that drive the rotor through two separate
gearboxes. Each motor is driven by its own motor controller, while each motor
controller is backed up with a passive control board that takes over, in case
faulty signals are sent by the primary controller or even the connection is
lost. Each motor controller receives power from one of the four main batteries
and can be switched to an alternate battery source if necessary. Additionally,
each motor controller receives inputs from all three FCC and determines the
valid FCC input by majority voting. The main criticality of the propulsion
system of the push-propeller drive is the incorrect operation including the
inadvertent or unable to stop operation which are classified as a potentially
catastrophic event. To prevent the inadvertent operation, the motor controller
fail-safe operation as already introduced for the main rotor propulsion system
is implemented as well as an option for passivating a faulty motor output by
implementing a power disconnect switch. The integration of a thermal
management system and the information management system has been excluded so
far, but will be included in further research.

Based on the sizing of all components the total propulsion system weight for
the presented multirotor excluding the thermal management systems is expected
to reach 1144 kg as shown in Table 10. An overview about further vehicle
design parameters can be found within Table 11 of the appendix.

Table 10: Summary of the propulsion system weights

| Weight per Unit [kg] | Total Weight [kg]
---|---|---
Main rotor propulsion system 1 | 24.6 + 17 + 52 | 98.4 + 68 + 208
Push propulsion system 2 | 12.3 + 8.5 | 24.6 + 17
Battery packs 2 | 120 / 248 | 480 + 248
Total propulsion system |  | 1144
|  |

11footnotetext: Weights indicated for motor weight, motor controller weight
and gearbox weight22footnotetext: Main battery pack and push drive battery
pack

2020footnotetext: Power distribution system and cooling system currently
excluded from weight analysis.

##  4 Conclusion and final evaluation

Within this paper, initially a method was presented for the conceptual design
of an eVTOL propulsion system. This method was then applied to a multirotor
vehicle for a specific intracity use case, with a special focus on developing
a safe propulsion architecture, sizing each component and validating the
architecture by simulation. In the following the results are structured to
answer the initial research questions:

How should the conceptual design process of the propulsion system be carried
out for an all-electric multirotor VTOL vehicle that is transporting
passengers so that the safety goals of EASA SC-VTOL can be met?
The conceptual design method as presented within section 2 is divided in five
Steps. Within step one the concept of operation needs to be defined, which
includes defining the flight mission and payload requirements. Based on these
requirements the vehicle configuration has to be preselected and the
powertrain technology to be used is defined. Within step two several further
requirements are developed which are based on the required controllability,
the handling quality and allowed noise emission. Within the third step, the
propulsion system is defined which can be segregated into defining the flight
control system, the power and drive system, the electrical system and the
thermal management system considering the previously established requirements.
This propulsion system concept is then refined within the safety analysis and
sized as well as validated within the vehicle sizing and simulation step. The
system architecture refinement process is usually an iterative process between
the concept definition, the safety analysis and the succeeding sizing step and
is being conducted until the safety requirements of EASA SC-VTOL can be met.

What is the impact of the EASA SC-VTOL reliablity requirements on the
conceptual design of a multirotor propulsionsystem?
Based on the safety & reliability analysis it became apparent that the loss of
one rotor lift and the incorrect operation of one rotor providing lift are the
most critical system design drivers for the propulsion system of the main
rotor in terms of the reliability requirements. Additionally, it was
identified that, if the failure rate requirements can be fulfilled for those
events, the other functional hazards will be fulfilled as well. Therefore, the
focus of any system designer should be put on meeting the safety & reliability
requirement for the total and partial loss of one main rotor and for the
incorrect operation of one rotor. Within the analysed case study, the safe
propulsion system for the multirotor requires numerous redundancies. This
includes that each main rotor requires two separate drive trains, which can be
masked by two means in case of any malfunction within each drive train. One
option for passivating the drive train is using a disconnect clutch, the other
option is to cut the power to the electric motor by using a power disconnect
relay. Additionally, each of the two drive trains driving the rotor must be
designed for being capable to provide $200$ % of normal power in case of any
system malfunction. In case of a signal loss of the triple modular FCC system,
each motor controller must be designed as a dual active/passive module, which
is additionally equipped with a backup-mode. This backup mode shall be able to
set a constant rotor speed slightly below hover power for normal flight. Four
battery packs are advisable to be used for the four main rotor propulsion
system. Each motor controller should be connected to at least two batteries.
Additionally, two push propellers are required which counteract the torque
moment in case of one main rotor loss. The push-propeller architecture, is
mainly driven by preventing the inadvertent operation of each propulsor.
Consequently, the corresponding motor controllers should be connected to the
fifth stand-alone battery pack and also incorporate a fail-safe backup mode.
This time one disconnect relay is sufficient for passivating faulty drive
outputs. In terms of the cooling system for each main rotor drive system it
must be ensured, that not more than one cooling system fails simultaneously,
as the failure of the cooling system results in the loss of the corresponding
main rotor. For the cooling system design of the battery packs it must be
ensured that not more than one battery pack is influenced in case of a cooling
system failure. A complete loss of the cooling function may become a
catastrophic event.

Which implications does an all-electric battery-powered eVTOL have on the
propulsion system architecture besides the safety requirements?
Besides the safety analysis, the sizing and simulation process revealed the
following: The sizing of the power and drive system identified that a gearbox
is required for driving each main rotor of the quadcopter. Only by increasing
the number of rotors, the gearbox could become obsolete.

During the sizing of the battery it became apparent that it is essential not
only to check the energy and power requirement during normal operation, but
also during emergency operation. The case study of this paper has shown, that
the sizing of the main rotor battery packs for the presented architecture, is
not driven by the energy amount or power requirement during normal operation
but rather by the power requirement during emergency operation, in which two
of four packs need to deliver 1.5 times the power compared to normal
operation. The sizing of the push drive system battery pack is also driven by
the emergency operation energy requirement which is 1.27 times the energy
requirement for normal operation.

Which requirements must be met by a thermal management system of the developed
all-electric multirotor propulsion system?
A battery-electric multirotor propulsion system requires at least two cooling
circuits. The sizing of the thermal management system for the power and drive
components revealed that the electric motors and the motor controllers of each
drive unit can be cooled within the same liquid cooling system, whereas the
battery requires a separate cooling system due to the different operating
temperatures. For cooling the electric motor and motor controller it is not
sufficient to rely on the airstream. However, a combined cooling of airflow
cooling and liquid cooling should be preferred. The liquid cooling circuit can
cool the electric motor as well as the corresponding motor controllers of one
drive unit simultaneously, by connecting them, for example, in series. This
exemplary liquid cooling circuit requires at least 0.14 kg/s flow rate, using
Glysantin G40. This enables to keep the electric motor below 90 °C during
normal operation and just below 120 °C during emergency operations, even at
ambient temperatures up to 42.7 °C. Additionally, the heat exchanger and the
electric motors must be placed within the airstream to allow for additional
air cooling. The heat exchanger can be expected to weight around 4 kg with a
size of $0.3\cdot 0.3\cdot 0.3$ m. In order to cool down the heated components
after each flight it is necessary to keep the cooling system operative on
ground as well. This cool down can take up to 30 minutes depending on the
outside temperature. A secondary liquid cooling circuit is required in order
to keep the battery packs below 40 °C operating temperature, as without any
cooling circuit the batteries would heat up above 40 °C even at ambient
temperatures of 20 °C. A cooling circuit using a glycol water mixture of 20:80
with a mass flow of 0.0695 kg/s is expected to keep the operating temperature
of the battery pack within $T_{amb}+5\;^{\circ}C$ during normal operation and
in case of an emergency procedure within $T_{amb}+7\;^{\circ}C$. The liquid
cooling system however, can only be used up to ambient temperatures of 36.2
°C. Higher ambient temperatures require a refrigeration circuit. In order to
ensure a minimum battery operating temperature of 20 °C a heating circuit is
advisable as soon as the ambient temperature falls well below 20 °C.

Comparing the results to the literature identified within section 1.2,
specifically the research of Darmstadt et al. [14], this work presents an
alternative solution for a safe propulsion system design for a quadcopter. In
addition, the implications of such a propulsion system on the total propulsion
system mass and a validation of the system architecture based on current
technology is provided through simulation models.

##  5 Future perspective

Within this research a conceptual design process for achieving a safe
propulsion system for eVTOL multirotors was presented. As the focus was set
primarily on designing a reliable drive system, other system groups that are
linked to the propulsion system, like the information management system, the
electrical system, the thermal management system as well as safety systems
need further investigation. Firstly, the thermal management system as well as
the information system group need to be included in future safety analysis.
Secondly, the electrical system architecture, therein especially the power
distribution, should be analysed in further detail. As battery degradation has
so far not been considered, its effect on the sizing of the battery packs
should be analysed as well. Thirdly, the safety system requirements defined
within the EASA SC E-19 [19] have to be included within the propulsion
architecture design which includes e.g. means to prevent and cope with
uncontrolled fire within the battery system. Thirdly, the rotor, rotor shaft
connection as well as the junction between the two gearboxes and the rotor
shaft need to be designed from a mechanical perspective and investigated to
prevent single point of failures. Forth, the thermal management system of the
battery needs to be extended as the currently assumed liquid cooling circuit
is only able to provide sufficient cooling below ambient temperatures of 36.4
°C. Therefore, a lightweight and safe refrigeration circuit should be assessed
as an alternative. In order to ensure the correct battery operating
temperature even at low ambient temperatures, adding a heating possibility to
the battery pack thermal management system probably using the heat of the
motor and motor controllers should be considered. Additionally, a comparative
study for the liquid cooling circuit of the electric motors and motor
controllers should be conducted to assess the implications of a two-step
cooling instead of the currently evaluated one-step cooling system. Fifth, the
heat development within the power and drive system of the rear propulsion
needs to be investigated and the thermal management system adapted
accordingly. As the presented propulsion architecture is only valid, if the
vehicle can continue safe flight and landing even during a single rotor loss,
further investigation is required to establish corresponding means of
controlling such a flight state.

###  5.1 Contribution of this work towards minimizing costs and maximizing
benefits of a UAM system

Figure 23: Mapping the areas of the UAM overall system that are positively
impacted by the presented work.

In accordance with the leitmotif ”Opportunities and Challenges of Urban Air
Mobility” this section evaluates how this work contributes to advancements
within the Urban Air Mobility (UAM)system (see Fig. 23). The contribution in
making UAM become reality can be grouped in minimizing UAM costs or maximizing
UAM benefits. As this work presented a method for the conceptual safe design
of the propulsion system as well as its implications on the propulsion system
architecture for an exemplary UAM concept of operation, this paper primarily
adds value towards increasing the reliability of a vehicle design. By
providing means for a model-based systems engineering approach for the safe
vehicle design, the chance of a fast and successful certification process may
also be increased. Additionally, by taking safety aspects into account already
during the conceptual design phase, subsequent high vehicle development costs
due to late design adjustments can be prevented. On the other hand, the safe
propulsion design as presented for the multicopter may positively influence
the passenger’s acceptance towards these vehicles.

## Statements and Declarations

Author Contributions
Conceptualization: F.J.; Methodology: F.J., O.B.; Writing - original draft
preparation: F.J., O.B., S.M.L., A.H.B., J.R., L.B.; Writing - review and
editing: F.J.; Supervision: O.B.; project administration, O.B.; All authors
have read and agreed to the published version of the manuscript.

Acknowledgments
The paper presents results from the internal DLR project HorizonUAM.

Competing Interests
The authors have no competing interests to declare that are relevant to the
content of this article.

## References

  *   * Ritchie and Roser [2018] Ritchie, H., Roser, M.: Urbanization (2018). https://ourworldindata.org/grapher/urban-and-rural-population-2050 Accessed 2023-01-15
  * Pishue [2023] Pishue, B.: INRIX 2022 Global Traffic Scorecard (2023)
  * Goyal et al. [2018] Goyal, R., Reiche, C., Fernando, C., Serrao, J., Kimmel, S., Cohen, A., Shaheen, S.: Urban air mobility (UAM) market study (No. HQ-E-DAA-TN65181) (2018)
  * Rothfeld et al. [2021] Rothfeld, R., Fu, M., Balać, M., Antoniou, C.: Potential Urban Air Mobility Travel Time Savings: An Exploratory Analysis of Munich, Paris, and San Francisco. Sustainability 13(4), 2217 (2021) https://doi.org/10.3390/su13042217
  * Ritchie et al. [2022] Ritchie, H., Roser, M., Rosado, P.: Energy (2022). https://ourworldindata.org/transport#co2-emissions-by-mode-of-transport Accessed 2023-01-15
  * André and Hajek [2019] André, N., Hajek, M.: Robust environmental life cycle assessment of electric VTOL concepts for urban air mobility. In: AIAA Aviation 2019 Forum, p. 3473 (2019)
  * EUROCONTROL [2021] EUROCONTROL: EUROCONTROL Data Snapshot (2021)
  * Baumeister et al. [2020] Baumeister, S., Leung, A., Ryley, T.: The emission reduction potentials of first generation electric aircraft (FGEA) in Finland. Journal of Transport Geography 85, 102730 (2020)
  * Staack et al. [2021] Staack, I., Sobron, A., Krus, P.: The potential of full-electric aircraft for civil transportation: from the Breguet range equation to operational aspects. CEAS Aeronautical Journal 12(4), 803–819 (2021)
  * [10] Electric VTOL News: eVTOL Aircraft Directory. The Vertical Flight Society. https://evtol.news/aircraft Accessed 2023-02-28
  * Cohen et al. [2021] Cohen, A.P., Shaheen, S.A., Farrar, E.M.: Urban air mobility: History, Ecosystem, Market Potential, and Challenges. IEEE Transactions on Intelligent Transportation Systems 22(9), 6074–6087 (2021)
  * EASA [2019] EASA: Special Condition for small-category VTOL aircraft. EASA SC-VTOL-01 (1) (2019)
  * Darmstadt et al. [2019] Darmstadt, P.R., Catanese, R., Beiderman, A., Dones, F., Chen, E., Mistry, M.P., Babie, B., Beckman, M., Preator, R.: Hazards Analysis and Failure Modes and Effects Criticality Analysis (FMECA) of Four Concept Vehicle Propulsion Systems (No. NASA/CR-2019-220217) (2019)
  * Darmstadt et al. [2021] Darmstadt, P.R., Pathak, S., Chen, E., Mistry, M.P., Arkebauer, A., Beiderman, A., Dillard, C., Zierten, D., Beckman, M., Monroe, A.: Reliability and Safety Assessment of Urban Air Mobility Concept Vehicles (No. GTRI Document No. D9015A001R2) (2021)
  * Liscouët et al. [2022] Liscouët, J., Pollet, F., Jézégou, J., Budinger, M., Delbecq, S., Moschetta, J.-M.: A methodology to integrate reliability into the conceptual design of safety-critical multirotor unmanned aerial vehicles. Aerospace Science and Technology (127), 107681 (2022) https://doi.org/10.1016/j.ast.2022.107681.
  * Bertram et al. [2022] Bertram, O., Jäger, F., Voth, V., Rosenberg, J.: UAM Vehicle Design with Emphasis on Electric Powertrain Architectures (2022)
  * SAE International [1996] SAE International: Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment (ARP4761) (1996) https://doi.org/10.4271/ARP4761
  * SAE International [2010] SAE International: Guidelines for Development of Civil Aircraft and Systems (ARP4754A) (2010) https://doi.org/10.4271/ARP4754A
  * EASA [2021] EASA: Electric / Hybrid Propulsion System. SC E-19 (Issue 1) (2021)
  * EASA [2003] EASA: Certification Specifications for Propellers. CS-P (Issue 1) (2003)
  * Ratei [2021] Ratei, P.: Conceptual Aircraft Design and Comparison of different eVTOL Aircraft for Urban Air Mobility (2021)
  * Bertram et al. [2021] Bertram et al.: Impact of different Powertrain Architectures on UAM Vehicle Concepts (2021)
  * Pavel [2021] Pavel, M.D.: Understanding the control characteristics of electric vertical take-off and landing (eVTOL) aircraft for urban air mobility (2021)
  * Bahr et al. [2021] Bahr, M., McKay, M., Niemiec, R., Gandhi, F.: Handling qualities of fixed-pitch, variable-speed multicopters for urban air mobility. The Aeronautical Journal, 1–21 (2021)
  * Niemiec et al. [2020] Niemiec, R., Gandhi, F., Lopez, M., Tischler, M.: System Identification and Handling Qualities Predictions of an eVTOL Urban Air Mobility Aircraft Using Modern Flight Control Methods (2020)
  * Atci et al. [2021] Atci, K., Jones, M., Jusko, T.: Assessment of the Handling Qualities of Multirotor Configurations using Real Time Simulation (2021)
  * Atci et al. [2022a] Atci, K., Weiand, P., Guner, F.: Understanding the Fixed Pitch RPM-Controlled Rotor Modeling for the Conceptual Design of UAM Vehicles (2022)
  * Atci et al. [2022b] Atci, K., Jusko, T., Strbac, A., Guner, F.: Impact of Differential Torsional Rotor Cant on the Flight Characteristics of a Passenger-Grade Quadrotor (2022)
  * Gong et al. [2022] Gong, X., Fenech, B., Blackmore, C., Chen, Y., Rodgers, G., Gulliver, J., Hansell, A.L.: Association between Noise Annoyance and Mental Health Outcomes: A Systematic Review and Meta-Analysis. International journal of environmental research and public health 19(5), 2696 (2022)
  * Brown and Harris [2018] Brown, A., Harris, W.L.: A Vehicle Design and Optimization Model for On-Demand Aviation. In: 2018 AIAA/ASCE/AHS/ASC Structures, Structural Dynamics, and Materials Conference (2018)
  * Smith et al. [2020] Smith, B., Gandhi, F., Niemiec, R.: A comparison of Multicopter Noise Characteristics with Increasing Number of Rotors. In: 76th Annual Forum of the Vertical Flight Society, Virtual (2020)
  * Smith et al. [2021] Smith, B., Healy, R., Gandhi, F., Lyrintzis, A.: eVTOL Rotor Noise in Ground Effect. In: Vertical Flight Society’s 77th Annual Forum & Technology Display (2021)
  * Herrmann and Rothfuss [2015] Herrmann, F., Rothfuss, F.: Introduction to Hybrid electric vehicles, battery electric vehicles, and off-road electric vehicles. In: Scrosati, B., Garche, J., Tillmetz, W. (eds.) Advances in Battery Technologies for Electric Vehicles, pp. 3–16. Woodhead Publishing Series in Energy, ??? (2015). https://doi.org/10.1016/B978-1-78242-377-5.00001-7
  * Schäfer et al. [2023] Schäfer, M., Berres, A., Bertram, O.: Integrated model-based design and functional hazard assessment with SysML on the example of a shock control bump system. CEAS Aeronautical Journal 14(1), 187–200 (2023) https://doi.org/%****␣main.bbl␣Line␣475␣****10.1007/s13272-022-00631-0
  * Quanterion Solutions Incorporated [2016] Quanterion Solutions Incorporated: Nonelectronic Parts Reliability Data, (2016)
  * Dubrova [2013] Dubrova, E.: Fault-Tolerant Design. Springer (2013)
  * Bertram et al. [2022] Bertram, O., Jäger, F., Bismark, A., Lübbe, S.: Analyse von Bordsystemen für Lufttaxis (2022)
  * OMG [2020] OMG: Risk Analysis and Assessment Modeling Language (RAAML). https://www.omg.org/spec/RAAML Accessed 2023-03-06
  * EMRAX [05.03.2020a] EMRAX: EMRAX 348 Technical Data Table (05.03.2020). https://emrax.com/wp-content/uploads/2020/03/emrax_348_technical_data_table_graphs_5.4.pdf Accessed 2021-06-25
  * EMRAX [05.03.2020b] EMRAX: EMRAX 228 Technical Data Table (05.03.2020). https://emrax.com/wp-content/uploads/2022/11/EMRAX_228_datasheet_A00.pdf Accessed 2023-08-29
  * Energy Company of Panasonic Group [2013] Energy Company of Panasonic Group: Introduction of NCR18650PF (2013). https://www.akkuparts24.de/mediafiles/Datenblaetter/Panasonic/Panasonic%20NCR-18650PF.pdf Accessed 2023-05-31
  * [42] Meteostat: Wetterrückblick und Klimadaten. https://meteostat.net/de/ Accessed 2023-06-13

## Appendix A

Figure 24: Propulsion system function analysis Table 11: Summary of the HorizonUAM multirotor vehicle concept parameters | Multirotor concept vehicle
---|---
Propulsion Type | Battery-Electric
Control Scheme | Rotor Speed Control
Design Gross Weight | 1954 kg
Payload Capacity | 360 kg
Number of Rotors | 4
Rotor Radius | 2.64 m
Max Rotor Tip Speed | M.45
(Normal Ops) |
Max Rotor Tip Speed | M.65
(Emergency Ops) |
Number of forward | 2
facing propellers |
Propeller Radius | 0.54 m
Max Propeller Tip Speed | M.54
Battery Capacity | 263 Ah / 159 Wh
Design Range | 3x16.7 km + 20 min Loiter
|
Figure 25: Functional block diagram of the propulsion system Figure 26:
Logical Architecture of the Propulsion System Figure 27: System FTA for the
permanent incorrect operation of one rotor lift