Redundancy Design in Multirotor eVTOL Distributed Electric Propulsion

Introduction to Distributed Electric Propulsion Redundancy#

Multirotor eVTOL aircraft rely on distributed electric propulsion (DEP) to achieve the safety and controllability required for urban air mobility. Unlike conventional helicopters with a single main rotor and tail rotor, a DEP architecture spreads thrust generation across multiple independent motor-propeller units. This distribution is not merely a performance choice; it is the foundation of the vehicle's redundancy strategy. When one propulsion unit fails, the remaining units must collectively preserve attitude control and enable a safe landing.

The redundancy logic begins at the system architecture level. Designers typically separate propulsion units into independent power channels, each with its own battery pack, bus, inverter, and motor controller. Physical and electrical isolation ensures that a single fault, whether a short circuit, thermal event, or controller failure, cannot propagate to healthy channels. The goal is to guarantee that no single failure leads to loss of control, and that the aircraft can either continue the mission or execute a controlled descent.

This guide examines the redundancy design logic, the fault-tolerant control algorithms used after a single-motor failure, and the principles for matching high power density motors with their reducers. These three elements are tightly coupled: the control law determines the transient torque demands, which in turn define the motor and reducer selection envelope.

Redundancy Architecture and Failure Modes#

A robust DEP redundancy architecture is built around redundancy at multiple levels: propulsion unit redundancy, power source redundancy, and communication redundancy. For a hexacopter or octocopter configuration, the loss of one motor still leaves sufficient control authority to maintain trim and execute a stable descent. The critical design question is how much thrust margin must be reserved so that the remaining motors can compensate for the lost unit without saturating.

Failure modes must be enumerated systematically. These include motor winding short or open circuit, inverter switch failure, propeller loss, controller lockup, and sensor faults. Each failure mode produces a distinct signature in the current, voltage, and speed measurements. The redundancy logic uses these signatures to detect and isolate the fault within milliseconds, then reconfigures the control allocation to exclude the failed unit and redistribute thrust among healthy units.

Power source redundancy deserves equal attention. If a single battery pack feeds all propulsion units, a pack failure becomes a catastrophic single point of failure. Segregated packs with cross-tie contactors allow the healthy pack to support essential loads after isolation. The redundancy design must also account for the reduced endurance after failure, ensuring the remaining energy is sufficient to reach a safe landing site.

Fault-Tolerant Control After Single-Motor Failure#

The fault-tolerant control algorithm operates in three stages: fault detection, fault isolation, and control reallocation. Detection typically combines model-based observers with threshold logic on residuals between measured and estimated states. A sudden drop in motor speed or a spike in current beyond the expected envelope triggers the detection stage. Isolation then identifies which unit has failed, using the known geometry of the thrust and torque distribution matrix.

Control reallocation is the core of the fault-tolerant algorithm. The baseline controller uses a control allocation matrix that maps desired roll, pitch, yaw, and thrust commands to individual motor commands. After a failure, the column corresponding to the failed motor is removed, and the remaining columns are used to solve for a new set of motor commands. Because the system becomes over-actuated or under-actuated depending on the configuration, a weighted pseudo-inverse or optimization-based allocation is used to minimize control effort while respecting thrust limits.

During the transient after failure, the controller must also manage the yaw imbalance created by the asymmetric thrust. A feedforward compensation term is added to the yaw channel, and the attitude controller gains are scheduled to account for the reduced control authority. Simulation and hardware-in-the-loop testing are essential to validate that the aircraft remains within safe attitude and altitude bounds throughout the reallocation transient.

Matching High Power Density Motors and Reducers#

High power density motors are central to eVTOL performance, but their selection cannot be separated from the reducer design. The matching principle starts with the required thrust and tip speed at the propeller, which define the propeller speed and torque. The motor's rated speed and torque must then be matched through an appropriate gear ratio so that the motor operates near its peak efficiency region during cruise while retaining enough torque margin for hover and failure compensation.

Key selection criteria include specific power in kilowatts per kilogram, efficiency maps across the operating envelope, thermal capability under sustained hover loads, and fault tolerance in the winding design. Motors with concentrated windings and high pole counts offer high torque density but require careful thermal management. The reducer must provide high efficiency, low backlash, and sufficient stiffness to avoid excitation of drivetrain resonances. Planetary or coaxial planetary reducers are common choices because they offer compact high-ratio reduction with balanced load sharing.

The matching process should also consider the transient torque demanded during fault-tolerant reallocation. After a single-motor failure, the healthy motors may be commanded to briefly exceed nominal thrust, so the motor and reducer must tolerate short-term overload without demagnetization or gear tooth distress. A design margin of at least 1.5 times the nominal hover torque is a practical starting point, validated through thermal and structural analysis.

Verification, Testing, and Conclusion#

Verification of the redundancy design requires a combination of analysis, simulation, and physical testing. Monte Carlo simulations of failure scenarios validate the control reallocation logic across the flight envelope. Iron bird test rigs allow single-motor failure injection under load, measuring the transient response and confirming that the remaining units stay within thermal and structural limits. Finally, flight testing with deliberate fault injection provides the ultimate confirmation of the safety case.

In conclusion, the redundancy logic of multirotor eVTOL distributed electric propulsion is a system-level discipline. It requires independent power channels, systematic failure enumeration, a fast and robust fault-tolerant control algorithm, and careful matching of high power density motors with their reducers. When these elements are designed together, the aircraft can survive a single-motor failure and land safely, meeting the safety expectations of commercial urban air mobility.