Redundancy Design for Multi-Rotor eVTOL Distributed Electric Propulsion

Introduction

Multi-rotor eVTOL aircraft rely on distributed electric propulsion (DEP) to achieve vertical lift and cruise efficiency. Unlike conventional helicopters with a single large rotor, DEP spreads thrust across multiple motor-rotor units, enabling graceful degradation when an individual unit fails. The core of this resilience is a layered redundancy architecture that combines hardware margins, intelligent power distribution, and real-time control algorithms.

This guide examines two critical aspects: the fault-tolerant control logic that keeps the aircraft stable after a single motor loss, and the engineering trade-offs in selecting high-power-density motors and reducer gearboxes. Understanding these principles is essential for designing a certifiable, safe eVTOL powertrain.

Redundancy Architecture Basics

The first redundancy layer is geometric: each rotor provides thrust at a different moment arm from the center of gravity. In a conventional quad configuration, losing one motor creates an unbalanced yaw moment. For this reason, most eVTOL designs use six or eight rotors, ensuring that after any single unit fails, the remaining rotors can still produce enough total thrust to hover with adequate control authority.

The second layer is electrical. Each motor is typically fed by its own inverter, with a smart power management system capable of isolating a failed unit within milliseconds. This prevents a short circuit or overcurrent event from pulling down the entire DC bus. Additionally, the battery system is often split into multiple independent packs, each servicing a subset of motors, so a single pack failure does not starve all rotors.

Fault-Tolerant Control Algorithm

When one motor fails, the flight controller must redistribute the required thrust and torque among the remaining rotors. The standard approach is control allocation based on a virtual control vector, derived from the desired roll, pitch, yaw, and vertical acceleration. The controller solves a weighted least-squares problem to find the thrust commands that minimize error while respecting each rotor's physical limits.

A practical algorithm for single-motor failure uses a modal decomposition: the failed rotor's contribution to yaw torque and lateral thrust is treated as a known disturbance, and the remaining rotors compensate by adjusting their differential speeds. For example, in a hexacopter, the two rotors adjacent to the failed unit increase thrust, while the opposite rotor reduces collective thrust to reduce the induced roll moment, effectively creating a new pseudo-plant with relaxed performance limits.

The key is to avoid over-demanding the remaining motors. If one rotor out of six fails, the total thrust capacity drops by 16.7%, but the required thrust in each remaining rotor may rise by a factor of 1.2 to 1.4. Therefore, the nominal design must include a thrust margin of at least 20-30%. Modern controllers also use incremental nonlinear dynamic inversion (INDI) to handle the rapid change in thrust after failure, allowing adaptation to the new configuration.

For yaw control, the algorithm typically sacrifices some yaw authority near hover, instead using differential collective and cyclic-like speed variations across the remaining rotors. The controller should prioritize maintaining altitude and attitude stability over precise heading, especially during the first second after the fault is detected.

High-Power-Density Motor and Reducer Matching

High power density is achieved by increasing motor speed and using advanced magnetic materials. However, propellers are most efficient at relatively low rotational speeds (typically 1,500-4,000 rpm for multi-rotor eVTOL). This mismatch demands a reduction gearbox. The reducer transforms high-speed, low-torque motor output into low-speed, high-torque propeller input, enabling the motor to operate at its optimal efficiency and power density.

The design principle for matching is straightforward: the motor should be selected such that its maximum continuous torque at rated speed is about 30-40% above the maximum required torque at the propeller shaft, divided by the gear ratio and efficiency. For example, if the propeller requires a maximum torque of 80 N·m at 2,500 rpm, and the gear ratio is 3:1 with an efficiency of 97%, the motor must deliver 80 / (3 × 0.97) ≈ 27.5 N·m at 7,500 rpm. The rated motor torque should be approximately 1.3 times that, i.e., 36 N·m, to accommodate transients and failure conditions.

The gear ratio influences the motor's base speed and the inverter's modulation depth. A higher ratio reduces required motor torque but increases motor and bearing speed, which can lead to higher losses in the high-speed rotor and potential gear wear. Conversely, a lower ratio requires a larger, heavier motor, negating the benefit of high power density. The optimization target is to minimize the combined mass of motor, gearbox, and inverter while meeting the thermal and life requirements.

Practical selection criteria include: motor efficiency above 93% in the 60-80% load range, reducer efficiency above 97%, and a service life of at least 10,000 hours at rated load. For crash safety, the gearbox should be designed with a weak point that fails before the motor shaft, protecting the airframe from catastrophic seizure. Also, consider a planetary gearbox with a fixed ring gear, as it offers the best power-to-weight ratio and coaxial input-output configuration.

Thermal and Inverter Considerations

High power density generates heat, especially during failure-handling transients where the remaining motors operate at 140% of rated power for 30-60 seconds. The motor's thermal time constant must be large enough to absorb this surge without exceeding the winding temperature class (typically 180°C for class H). This means the motor's thermal mass and cooling arrangement are as important as its electromagnetic design.

The inverter should be rated for continuous operation at 120% of the motor's rated current, with a peak current capability of 150% for at least 1 minute. Additionally, the inverter must detect a motor terminal short within 100 microseconds and isolate it, either by active gate drive control or a fast-acting fuse. Coordinate the inverter's overcurrent limit with the motor's demagnetization threshold to prevent permanent magnet damage under fault conditions.

Conclusion

Redundancy in a multi-rotor eVTOL is not just about adding more rotors; it requires a tightly integrated design that balances thrust margins, fault-tolerant control, and component selection. The control algorithm must instantly re-allocate thrust and torque, while the motor-reducer pair must provide both high power density and sufficient thermal and mechanical margin to sustain the post-failure overload. By following the principles described above, engineers can build a DEP system that safely handles a single motor failure—a mandatory step toward certifying eVTOL for urban air mobility.