Study on Certification-Driven Fault Detection Threshold Optimization for eVTOL Dual-Motor-Driven Rotor

Abstract

Advances in motor technology and the application of distributed electric propulsion systems have greatly promoted the development of electric vertical take-off and landing aircraft. As a critical safety component of eVTOL aircraft, the motor system design must satisfy both performance requirements and stringent airworthiness standards. This paper studies the lift–thrust unit drive motor system of an eVTOL aircraft and proposes an architecture that utilizes analytical redundancy to enhance system-level reliability. This paper focuses on threshold optimization in analytical redundancy systems. Through simulations and reliability analyses, the performance of the analytical redundancy system is quantified, with false alarm and missed detection probabilities evaluated, fault detection thresholds optimized, and overall system reliability enhanced analytical redundancy systems is improved. Simulation and calculation results demonstrate that the proposed fault detection method can effectively meet the requirements for rapid detection and achieve optimal reliability at the given optimal threshold.

1. Introduction

Electric vertical take-off and landing (eVTOL) aircraft, as a key enabler of advanced air transportation [1], rely on the high reliability of their thrust/lift units for their distributed propulsion systems. Brushless DC (BLDC) motors, with their high efficiency, high torque, and fast response, are core drive components. However, complex flight environments and prolonged operation expose these motors to multiple failure risks, including electronic component failure, thermal overload, and mechanical wear [2]. To ensure flight safety, traditional hardware redundancy solutions employ physical backups to achieve fail-safe characteristics. However, these solutions present challenges such as structural complexity, high weight and volume, and high cost. Furthermore, identical hardware designs can lead to common cause failures. The analytical redundancy method offers an innovative solution, replacing hardware redundancy with software-level fault detection. This method has been successfully implemented in aircraft such as the Airbus A350 and A380. For example, in the electrical flight control system (EFCS), this method effectively detects oscillation failure faults (OFCs) by comparing the actual deflection of control surfaces with the ideal model output. This method has passed airworthiness review and achieved complete fault detection coverage [3]. Fault detection (FD), as an important means of analytical redundancy, is mainly divided into two categories: model-based methods and data-driven methods. For motors, extensive research has been carried out based on these two fault detection methods at home and abroad. Mekki et al. [4] proposed a fault diagnosis method based on sliding mode observer to estimate phase current. Moseler et al. [5] proposed a model-based brushless DC motor fault detection method using parameter estimation, such as bearing damage or fracture may increase friction. Zhang et al. [6] designed an interval sliding mode observer for the initial inter-turn short circuit fault of the stator winding to deal with the uncertainty caused by sensor measurement error. Data-driven fault detection is a method that utilizes monitoring data collected during system operation to identify and locate faults. Hosseini et al. [7] introduced a supervised data-based approach for detecting and classifying faults in BLDC motors, including stator inter-turn faults, rotor dynamic unbalance, rotor static unbalance, and various combinations of these faults. For electric aircraft motor systems, to enhance system reliability, Hoenicke et al. [8] developed a novel power management control module. This module ensures high safety and reliability through redundant design and multiple safety measures. Lewis et al. [9] proposed a fault-tolerant motor design that combines an ironless Halbach permanent magnet array axial flux unit with a permanent magnet-free hybrid excitation radial flux unit. This dual-unit design effectively improves the motor’s fault tolerance and operational efficiency, making it suitable for the specific operational scenarios of electric propulsion aircraft.

Civil aircraft design must meet both performance requirements and airworthiness safety standards. EASA SC-VTOL.2510 explicitly states: “The design and installation of equipment must ensure that catastrophic failures are extremely unlikely and cannot result from a single fault” [10]. This clause ensures the overall aircraft safety meets requirements by establishing stringent safety metrics. Therefore, to meet airworthiness safety requirements, critical eVTOL safety systems must establish redundant mechanisms to prevent single-point catastrophic failures, with the probability of failure meeting the extremely unlikely requirement.

Based on the above discussion, it can be seen that software-based fault detection methods can enhance safety design. However, meeting top-level safety indicators presents a challenge for airworthiness safety compliance. This paper, taking this research perspective, optimizes detection thresholds for the eVTOL lift/thrust unit drive motor system, focusing on overall motor system reliability. By introducing a model-based fault detection approach into the architecture, we conduct threshold optimization research targeting system safety indicators.

2. Mathematical Modeling

2.1. BLDC Motor Mathematical Model Test Method

The structure of the motor driving the lift/thrust unit studied herein is presented in Figure 1. The system consists of key components such as power supply, BLDC motor, pulse width modulation (PWM) input and electronic speed control (ESC) [11]. The PWM signal controls the voltage and frequency of the motor by adjusting the pulse width of the current, thereby achieving precise regulation of the motor speed and torque. The ESC monitors the operating status of the motor and adjusts the current supplied to the stator winding to ensure that the motor can operate efficiently and stably under various load conditions.

Assuming that the stator self-inductance varies with the rotor position and the mutual inductance between the stator windings is negligible, the electrical dynamics of the BLDC motor can be initially described [12]. However, for system-level analysis and control design, a further simplified, lumped-parameter equivalent circuit model is adopted. This model abstracts the typical three-phase BLDC motor as a DC motor represented by a single winding, under the core assumption of symmetrical stator windings. Consequently, the equivalent resistance and inductance in the model represent the average values per phase and are utilized as unified parameter values for all windings in simulations [11]:

$$L_a{\displaystyle \frac{d{i}_a}{dt}}=-R_a{i}_a-e_b+V_a$$

(1)

$$e_b=K_{e}r\Omega$$

(2)

where $i_a$ the motor armature current, $L_a$ is the equivalent circuit armature inductance, $R_a$ is the equivalent resistance, $e_b$ is the motor back EMF, $K_e$ is the back EMF constant, $r$ is the drive system gear ratio, $V_a$ is the voltage applied to the armature.

The coupled rotor-motor mechanical equation of motion can be written as:

$$(I_r+J{r}^2)\dot{\Omega }=K_{m}r{i}_a+Q_A-B{r}^2\Omega$$

(3)

where $\Omega$ is the rotor speed, $I_r$ is the rotor moment of inertia, $J$ is the inertia of the high-speed drive components (motor and coupled transmission components), $J$, $K_m$ is the motor torque constant, $K_m$, $Q_A$ is the rotor aerodynamic torque with the drive system, $B$ is the linear representation of the mechanical friction or viscous losses in the drive system. The motor torque constant $K_m$ can be related to the back EMF constant $K_e$ through the relationship $K_m=c{K}_e$.

For current state-of-the-art BLDC motors, expected inductance values are on the order of a few micro Henry and result in extremely low time constants of the current dynamics [12]. Based on this physical property, it is reasonable to assume that the current response is instantaneous when modeling the system. The engineering equivalent of this assumption is to replace the circuit’s equivalent inductance $L_a\approx 0$. This yields the expression of $R_a{i}_a=K_{e}r\Omega -V_a$ in Equations (1) and (2) which then substituted in (3) provides the fundamental dynamic response of the coupled rotor-motor direct drive system as [13]:

$$(I_r+J{r}^2)\dot{\Omega }=\left(-{\displaystyle \frac{c{K}_e^2{r}^2}{R_a}}\Omega +Q_A-B{r}^2\Omega +{\displaystyle \frac{c{K}_{e}r}{R_a}}{V}_a\right)$$

(4)

The above formula can be rewritten as:

$${\tau }_m\dot{\Omega }+\Omega =\left(Q_A+{\displaystyle \frac{c{K}_{e}r}{R_a}}{V}_a\right){\displaystyle \frac{1}{\frac{c{K}_e^2{r}^2}{R_a}+B{r}^2}}$$

(5)

The motor’s time constant is given by: ${\tau }_m={\displaystyle \frac{I_r+J{r}^2}{\frac{c{K}_e^2{r}^2}{R_a}+B{r}^2}}$.

The above formula is linearized at the equilibrium point. Combined with the average effect of torque on speed [14], the system is locally linearized using the first-order Taylor expansion method, and the transfer function expression of the input-output relationship of the system is derived as follows, The corresponding parameter values are provided in

Table A1. BLDC motor parameters [21].

Motor friction and viscous losses coefficient B (N m sec)	0.15
Voltage constant Ke (V rad/s)	1.2
Torque SI unit conversion constant c (lb − ft Nm)	0.7374
Armature resistance Ra (Ohms)	0.6187
Inertia of the high speed drive components drive system gear ratio r squared Jr2 (slug ft2)	30
Armature inductance La (millihenry mH)	≈0
Rotor rotational moment of inertia Ir (slug ft2)	101.968

of Appendix A.

$${\displaystyle \frac{\Omega (s)}{V_a(s)}}={\displaystyle \frac{\frac{c{K}_{e}r}{R_a}}{(I_r+J{r}^2)s+\frac{c{K}_e^2{r}^2}{R_a}+B{r}^2-\frac{\partial Q_A}{\partial \Omega }}}$$

(6)

2.2. Speed PI Closed-Loop Control

The BLDC motor control system utilizes a PI controller to ensure rapid dynamic response and accurate steady-state speed tracking. The proportional term enhances agility, while the integral action eliminates steady-state error, maintaining consistent performance under load variations. As shown in Figure 2, d denotes an external disturbance, and f represents a fault input applied to simulate abnormal operating conditions of the motor.

For the system in the figure above, the relationship between the given speed and the actual speed can be derived as follows:

$${\displaystyle \frac{\Omega (s)}{{\Omega }_{cmd}(s)}}={\displaystyle \frac{\frac{c{K}_{e}r}{R_a}{K}_{p}s+\frac{c{K}_{e}r}{R_a}{K}_i}{(I_r+J{r}^2)s^2+\left(\frac{c{K}_e^2{r}^2}{R_a}+B{r}^2-\frac{\mathsf{\partial }{Q}_A}{\mathsf{\partial }\Omega }+\frac{c{K}_{e}r}{R_a}{K}_p\right)s+\frac{c{K}_{e}r}{R_a}{K}_i}}$$

(7)

Changed to state space form as follows, where $x=\left[\begin{array}{c}{x}_1\\ x_2\end{array}\right]=\left[\begin{array}{c}\int ({\Omega }_{cmd}-\Omega )dt\\ \Omega \end{array}\right]$, $x_1$ represents the integral of the error between the speed command and the actual speed, $x_2$ directly represents the actual motor speed.

$$A=\left[\begin{array}{cc}0& -1\\ {\displaystyle \frac{\frac{c{K}_{e}r}{R_a}{K}_i}{I_r+J{r}^2}}& -{\displaystyle \frac{\frac{c{K}_e^2{r}^2}{R_a}+B{r}^2-\frac{\mathsf{\partial }{Q}_A}{\mathsf{\partial }{R}_1}+\frac{c{K}_{e}r}{R_a}{K}_p}{I_r+J{r}^2}}\end{array}\right],B=\left[\begin{array}{c}1\\ {\displaystyle \frac{\frac{c{K}_{e}r}{R_a}{K}_p}{I_r+J{r}^2}}\end{array}\right],C=\left[\begin{array}{cc}0& 1\end{array}\right]$$

(8)

Given a ramp command with a target speed of 100 rad/s, as shown in Figure 3, the actual speed tracks and reaches the target command within 0.08 s, with the linearized model showing excellent agreement with the actual system in both transient and steady-state responses while maintaining modeling accuracy.

3. Redundancy Architecture Design

3.1. System Architecture

The dual-motor architecture (Figure 4) provides critical redundancy for eVTOL lift/thrust units, enabling continued operation during a single motor failure—unlike single-motor systems [15]. This redundant design ensures continuous thrust even with reduced available power.

Based on the architecture shown above, this paper employs a Kalman filter and robust observer for fault detection, ensuring system adaptability and robustness while improving the reliability of detection results. By comparing different detection methods, the robustness of the fault detection system can be effectively enhanced, ensuring accurate fault identification and diagnosis in complex and changing flight environments, thereby ensuring flight safety.

As shown in Figure 5, the fault detection module uses two independent fault detection methods for analysis, each yielding a fault diagnosis result, and a final fault determination is reached through logical voting. If a motor system fault is detected, the speed command driver switches to the backup motor system. This redundant fault detection method ensures high reliability and safety of the motor system.

In fault detection logic design, various voting strategies can be employed to implement fault determination and comparative analysis. For example, a fault detection mechanism based on the combination of a Kalman filter and a robust observer can be monitored using either AND logic (both alarm simultaneously) or OR logic (either alarm). In the AND logic mode, the system determines that a fault has occurred only when both the Kalman filter and the robust observer generate alarm signals, significantly reducing the false alarm rate and improving detection accuracy and system fault tolerance. In the OR logic mode, the system triggers a fault alarm when either detector is triggered. This helps enhance the sensitivity and response speed of fault detection, ensuring that potential problems are identified and addressed promptly.

3.2. Fault Detection Design

• Kalman filter

The Kalman filter is used for state estimation. The optimal estimation of the system state is made through the two processes of prediction and update. In the prediction phase, the next state and error covariance matrix of the system are calculated. In the update phase, the state estimate and error covariance matrix are updated by the actual measurement values [16]. The two important parameters of the Kalman filter are Q and R, where Q is the process noise covariance matrix, which is related to the inaccuracy of system modeling, and R is the observation noise covariance matrix, which is related to the uncertainty in the observation equation.

The following is the basic model of the Kalman filter:

$$\begin{array}{l}{\widehat{x}}_{k\mid k-1}=A{\widehat{x}}_{k-1\mid k-1}+B{u}_k\\ P_{k\mid k-1}=A{P}_{k-1\mid k-1}{A}^T+Q\\ K_k=P_{k\mid k-1}{H}^T{\left(H{P}_{k\mid k-1}{H}^T+R\right)}^{-1}\\ {\widehat{x}}_{k\mid k}={\widehat{x}}_{k\mid k-1}+K_k\left(Z_k-H{\widehat{x}}_{k\mid k-1}\right)\\ P_{k\mid k}=\left(I-K_{k}H\right)P_{k\mid k-1}\end{array}$$

(9)

The system representation used in the diagnostic algorithm is directly derived from the linearized motor model equations described in Section 2.2. The matrices A, B, and H are obtained from this model, where A represents the state transition dynamics determined by electrical and mechanical coupling, B characterizes the effect of the control input on the state variables, and H defines the mapping from the internal states to the measurable motor speed.

Within the Kalman filter framework, $x=\left[\begin{array}{c}{x}_1\\ x_2\end{array}\right]=\left[\begin{array}{c}\int ({\Omega }_{cmd}-\Omega )dt\\ \Omega \end{array}\right]$, ${\widehat{x}}_{k\mid k-1}$ is the prior estimate of the state at time $k-1$ for time $k$, ${\widehat{x}}_{k-1\mid k-1}$ is the optimal estimate of the state at time $k-1$, $P_{k|k-1}$ is the prior estimate of the covariance matrix at time $k-1$ for time $k$, and ${\mathrm{P}}_{\mathrm{k}-1|\mathrm{k}-1}$ is the optimal estimate of the covariance matrix at time $k-1$. $K_k$ is the Kalman gain, which represents the ratio of model prediction error to measurement error. $Z_k$ is the actual observation value.

2.

Robust Observer

A robust observer is an estimator designed within the framework of robust control theory. Specifically, it utilizes H-infinity synthesis for state estimation. It functions as a fault detection and isolation (FDI) mechanism by estimating faults in the presence of external disturbances and model uncertainties [17]. The observer calculates optimal feedback gains to stabilize the closed-loop control system while minimizing the H-infinity norm of the transfer function from the disturbance to the estimation error. Throughout the state estimation process, the observer gain matrix is continuously optimized to ensure stable and reliable operation in the presence of uncertainties and disturbances.

The robust control block diagram of the observer is shown in Figure 6.

The input and output relationship of the above control model can be expressed as:

$$\begin{gathered} \left[\begin{array}{l}z\hfill \\ y\hfill \end{array}\right]=P\left[\begin{array}{l}w\hfill \\ u\hfill \end{array}\right] \\ u=Ky\hspace{1em}\hspace{1em} \end{gathered}$$

(10)

In the robust observer framework considered in this study, $u$ is defined as the control signal, namely the speed command (${\Omega }_{cmd}$); $y$ is defined as the observation, namely the actual motor speed ($\Omega$); $w$ is defined as the external disturbance, including measurement noise (as illustrated by d in Figure 2); $z$ is defined as the control variable, namely the detection error, which is the difference between the estimated speed and the actual speed; $K(s)$ is robust observer, whose elements are determined by H-infinity synthesis to minimize the effect of disturbances on the detection error, and $P(s)$ represents the augmented plant that incorporates both the motor dynamics and the external disturbances.

We can break $P(s)$ into blocks corresponding to the dimensions of the input signal $w, u$, i.e.,

$$P(s)=\left[\begin{array}{ll}{P}_{11}(s)\hfill & P_{12}(s)\hfill \\ P_{21}(s)\hfill & P_{22}(s)\hfill \end{array}\right]$$

(11)

The relationship between the system perturbation signal $w$ and the system performance evaluation signal $\mathrm{z}$ is:

$$z=[P_{11}+P_{12}K{\left(\begin{array}{c}I-P_{22}K\end{array}\right)}^{-1}{P}_{21}]w$$

(12)

The expression of the transfer function $T_{zw}$ is:

$$T_{zw}(s)=\left[P_{11}+P_{12}K{\left(I-P_{22}K\right)}^{-1}{P}_{21}\right]$$

(13)

Based on the transfer function formulation, the controller K(s) is synthesized using the H-infinity method by minimizing the H-infinity norm of the influence of disturbances on the detection error: min $\parallel T_{wz}(s){\parallel }_{\infty }$.

This optimization process ensures that the system maintains excellent fault detection performance even in the presence of measurement noise.

3.3. Comparison of Detection Methods

In fault detection, Kalman filters and robust observers are used to estimate system states, improving the accuracy and reliability of diagnostic results. Kalman filters are suitable for scenarios with small disturbances and low Gaussian noise, providing highly accurate state estimates. Robust observers, on the other hand, are more effective when model errors are large or external interference is strong, maintaining the stability of system estimates. When used together, these two methods can detect a variety of fault types, improving system performance and reliability.

Mean Squared Error (MSE) is an important metric for measuring model accuracy. It is defined as the average of the squared errors between the predicted and true values and quantifies how closely the model approximates the real system. A low MSE indicates a high model fit accuracy and a strong ability to capture system characteristics, while a high MSE reflects poor model robustness to error and noise. MSE is often used as a standard metric for evaluating model accuracy.

As shown in Figure 7, when noise is low and the system model is accurate, the Kalman filter-based fault detection model exhibits lower mean squared error and is more accurate than the robust observer model.

As shown in Figure 8, when the system model is uncertain or the disturbance is large, the mean squared error of the Kalman filter-based fault detection model is significantly higher than that of the robust observer model. This indicates that the robust observer has higher detection accuracy and robustness under conditions of model inaccuracy.

4. Threshold Optimization Approach

4.1. Optimization Goal

• Rapidity: This refers to the ability of the system to quickly and accurately identify faults under ideal dynamic conditions during the switching process between the primary and standby systems. In simulation, the rapidity of fault detection results can be evaluated by monitoring the changes in parameters such as the actual speed, estimated speed, and residual of the motor system.
• Reliability: A confusion matrix is used to evaluate the false positive and missed detection rates of the model’s detection results, calculating the probability of occurrence of different failure modes to verify system stability. This method can quantitatively analyze the accuracy and robustness of the detection model under various operating conditions.

4.2. Detection Model Evaluation

The confusion matrix, as shown in

Table 1. Confusion Matrix.

		True States
		Nominal	Faulty
FDI Logic	Nominal	True Negative	Missed Detection
	Faulty	False Alarm	True Positive

, is used to evaluate the reliability of the fault detection method by quantifying the false alarm and missed detection rates.

The state-space model, essential for probabilistic false alarm analysis under fault-free conditions, is derived through a systematic, data-driven system identification process that integrates the analysis of fault-free residual data. This process begins by calculating the residual sequence r(k) from actual flight data, representing the difference between the measured sensor values and the model-predicted outputs. These fault-free residuals are then subjected to time series analysis techniques, including examination of their autocorrelation function (ACF) and partial autocorrelation function (PACF), to preliminarily determine the appropriate order of an ARMA model that best captures their dynamic characteristics. Based on this initial assessment, parameter estimation algorithms, are employed to fit the precise parameters of the ARMA model to the residual data. The final, determined ARMA model is then converted into an equivalent state-space realization, yielding the matrices $A_{res}$, $B_{res}$, $C_{res}$, $D_{res}$ for the system [18]:

$$\left\{\begin{array}{c}x(k+1)=A_{res}x(k)+B_{res}n(k)\\ r(k)=C_{res}x(k)+D_{res}n(k)\end{array}\right.$$

(14)

where $A_{res}$ represents the state transition dynamics determined by the autoregressive part, $B_{res}$ corresponds to the influence of the moving average component on the states, $C_{res}$ defines the mapping from the state variables to the residual output, $D_{res}$ describes the direct effect of external disturbances on the residuals, $n(k)$ is the overall external interference vector, and $r(k)$ is the residual vector.

The state covariance matrix ${\Sigma }_x$ is obtained by solving the Lyapunov formula:

$${\Sigma }_x=A_{res}{\Sigma }_x{A_{res}}^T+B_{res}\Sigma {B_{res}}^T$$

(15)

Obtain the residual covariance matrix ${\Sigma }_N$ through the Toeplitz matrix:

$${\Sigma }_N=\left\{\begin{array}{cc}{C}_{res}{\Sigma }_x{C_{res}}^T+D_{res}\Sigma {D_{res}}^T& \mathrm{if} i=j\\ C_{res}{A_{res}}^{|i-j|}{\Sigma }_x{C_{res}}^T+D_{res}{A_{res}}^{|i-j|-1}{B}_{res}\Sigma {D_{res}}^T& \mathrm{else}\end{array}\right.$$

(16)

The probability density function $f_N\left(R_N\right)$ of the residual is obtained as:

$$f_N\left(R_N\right)={\displaystyle \frac{1}{\sqrt{{(2\pi )}^N\left|{\Sigma }_N\right|}}}{e}^{-{\displaystyle \frac{1}{2}}{R}_N^T{\Sigma }_N^{-1}{R}_N}$$

(17)

where $R_N={\left[\begin{array}{ccccc}r(1)& r(2)& r(3)& \dots & r(N)\end{array}\right]}^T$ is the residual vector of $N$ time steps.

The false alarm probability $P_{FA}$ can be regarded as the probability that the residual is greater than the threshold; that is [18]:

$$P_{FA}(N)=1-P\left[{\displaystyle \underset{k=1}{\overset{N}{\cap }}\{|r(}k)|\le T\}\right]=1-{\displaystyle {\int }_{-T}^T{f}_N}\left(R_N\right)d{R}_N$$

(18)

When calculating the missed detection rate, a fixed threshold is set, the minimum fault level that can be detected under the threshold is estimated, and the probability of a fault below the threshold is calculated, which is the missed detection probability. Assume that the probability of motor failure $F_{SA}$ is uniformly distributed:

$$F_{SA}=U\left(-5 \mathrm{rad}/\mathrm{s} , 5 \mathrm{rad}/\mathrm{s}\right)$$

(19)

The missed detection probability is equal to the probability that the fault magnitude f is less than the threshold, which can be calculated as [19]:

$$P_{MD}=P(F\in (-f,f)|F)={\displaystyle \frac{f}{2}}$$

(20)

where $f$ is minimum detectable fault magnitude.

4.3. Detection Logic Analysis

The reliability calculations for different detection logics are different. This article mainly analyzes and compares the reliability of four different detection mechanisms.

• The reliability calculation for fault detection based on a single Kalman filter is as follows, and the corresponding reliability diagram of false positives and false negatives is shown in Figure 9

$$\begin{array}{l}{P}_{FA}=P_{FA}(KF)\\ P_{MD}=P_{MD}(KF)\end{array}$$

(21)

• The reliability calculation for fault detection based on a single robust observer is as follows, and the corresponding reliability diagram of false positives and false negatives is shown in Figure 10.

$$\begin{array}{l}{P}_{FA}=P_{FA}(RO)\\ P_{MD}=P_{MD}(RO)\end{array}$$

(22)

• Based on the combination of the Kalman filter and robust observer, the reliability calculation of the alarm detection mechanism (OR voting) is as follows, and the corresponding reliability diagram of false positives and false negatives is shown in Figure 11.

$$\begin{array}{l}{P}_{FA}=P_{FA}(KF)+P_{FA}(RO)\\ P_{MD}=P_{MD}(KF)+P_{MD}(RO)\end{array}$$

(23)

• Based on the combination of the Kalman filter and robust observer, the reliability calculation of the simultaneous alarm detection mechanism (AND voting) is as follows, and the corresponding reliability diagram of false positives and false negatives is shown in Figure 12.

$$\begin{array}{l}{P}_{FA}=P_{FA}(KF)\cdot P_{FA}(RO)\\ P_{MD}=P_{MD}(KF)\cdot P_{MD}(RO)\end{array}$$

(24)

4.4. System Reliability Analysis

The system reliability block diagram is presented in Figure 13. Simultaneous failure of the main motor and backup motor, undetected failure of the main motor (missed detection), and the FD’s erroneous determination of a main motor failure (false detection) when the backup motor is actually faulty can all lead to failure of the aircraft’s lift/thrust unit. The failure probability must meet the safety probability indicator for the lift/thrust unit allocation.

5. Simulation Analysis

When a motor experiences a fault, common abnormal speed manifestations primarily include abnormal speed fluctuations, speed reduction, and speed interruption [20], as well as speed response delay. Among these, this paper focuses on analyzing abnormal speed fluctuations. This paper simulates the fault by superimposing a sinusoidal signal with an amplitude of 10 on the speed signal to represent abnormal speed fluctuations. Abnormal speed fluctuations are typically caused by factors such as mechanical vibration, electromagnetic imbalance, or control system dynamic instability, e.g., dynamic eccentricity, mechanical unbalance, winding short circuits, or control algorithm oscillations. By analyzing abnormal modes through simulation, theoretical basis can be provided for optimizing relevant fault detection thresholds, thereby enhancing the reliability and safety of motor operation.

5.1. Fault Detection Based on Kalman Filter

The estimated output from the Kalman filter, the actual system output, and the reference command are compared following fault injection, as illustrated in Figure 14.

To optimize fault detection, a threshold range of [0.2, 0.3] is set. The lower limit of 0.2 is based on the maximum residual error when there is no fault, ensuring rapid detection; the upper limit of 0.3 improves interference resistance. Experiments show that this range can effectively identify faults within 0.01–0.05 s.

As shown in Figure 15, a threshold that is too low (such as 0.2) increases the false alarm rate, while a threshold that is too high may miss minor faults. Therefore, it is necessary to select an optimal value within the range to balance the risk of false alarms and missed detections and ensure the robustness of the detection.

As shown in Figure 16, the false alarm rate decreases rapidly as the threshold increases. When the threshold approaches zero, the false alarm rate approaches 100%, indicating that the residual is highly likely to cross the low threshold due to interference. When the threshold is higher, the residual is highly unlikely to cross the threshold, and the false alarm rate is essentially zero. Figure 17 shows the maximum residual values when injecting different fault amplitudes. The maximum residual can be considered the threshold, which shows the relationship between a given threshold and the minimum detectable fault. When the threshold is set too high, the minimum detectable fault also increases, resulting in an increased missed detection rate.

5.2. Fault Detection Based on Robust Observer

Following fault injection, Figure 18 presents a comparison between the robust observer’s estimated output, the actual system output, and the reference command. Figure 19 illustrates the relationship between the residuals and the corresponding threshold range after fault injection.

As shown in Figure 20 and Figure 21, compared with the Kalman detection model, when the same threshold is set, the false alarm rate of the robust observer model detection results is lower; at the same time, the magnitude of the detected faults is smaller; that is, the missed detection rate is smaller.

5.3. Analysis of Threshold Optimization

The missed detection and false alarm rates of fault detection are calculated using (13)–(19), with results presented in Figure 22 and Figure 23.

ROC curve analysis shows that the choice of threshold directly affects the balance between the system’s false alarm rate and missed detection rate. A threshold that is too low significantly increases the risk of false alarms, leading to unnecessary system switching. On the other hand, a threshold that is too high reduces the system’s sensitivity to faults and increases the probability of missed detection. The optimal operating point determined by ROC curve analysis is located closest to the origin of the curve, achieving the best balance between false alarm rate and missed detection rate. Specifically, the optimal threshold for the Kalman filter model is 0.287, and the optimal threshold for the robust observer model is 0.284. The corresponding performance indicators are shown in

Table 2. Optimal threshold and corresponding probability.

	Kalman Filter	Robust Observer
Optimal threshold	0.287	0.284
False alarm rate	0.015%	0.012%
Missed detection rate	0.018%	0.013%

.

Depending on the model requirements, the ROC curve threshold selection strategy can be optimized as follows: for systems sensitive to false alarms, the threshold can be increased to reduce the false alarm rate; for systems sensitive to missed detections, the threshold can be lowered to reduce missed detections. By dynamically adjusting the threshold, the system’s reliability and sensitivity can be effectively balanced.

5.4. Failure Probability Calculation

Assuming a main drive motor failure probability of 10⁻⁴ and backup drive motor failure probabilities of 10⁻⁴ and 10⁻³, respectively, Figure 12 analyzes the motor system failure probability under four different detection logics, and the corresponding numerical values are summarized in

Table 3. Motor system failure probability.

Detection Logic\Failure Probability	Failure Probability 1	Failure Probability 2
Kalman Filter-Based Fault Detection	4.25 × 10−8	1.90 × 10−7
Robust Observer-Based Fault Detection	3.45 × 10−8	1.55 × 10−7
One-Way Alarm Detection Mechanism	1.85 × 10−8	1.85 × 10−7
Simultaneous Alarm Detection Mechanism	1.50 × 10−8	1.05 × 10−7

.

Since the entire system is highly sensitive to the detection model’s false alarm rate when the backup motor failure probability is 10⁻⁴, a weighting coefficient α is introduced to comprehensively balance the false alarm rate and missed detection rate, enabling dynamic threshold adjustment through rate-adaptive optimization.

Analysis of the motor system failure probability under different detection mechanisms shows that when two independent detection units trigger an alarm simultaneously, the system failure probability is significantly reduced. This indicates that setting up multiple detection units for simultaneous detection can effectively enhance system reliability. Selecting appropriate thresholds can also improve system reliability. For example, when a threshold of 0.265 is selected in the Kalman filter detection module and a threshold of 0.269 is selected in the robust observer model, the system failure probabilities when two independent detection units trigger an alarm simultaneously are 5.85 × 10⁻⁸ and 4.05 × 10⁻⁸, respectively, significantly lower than the optimal results in the table.

Compared to traditional triple-redundant hardware designs, this hybrid redundancy design only requires two drive motors to achieve redundancy, significantly reducing the weight of the additional redundant hardware. Furthermore, by introducing a functional overlap mechanism within the detection units and combining it with a threshold optimization strategy, its reliability approaches that of traditional triple-redundant hardware designs.

6. Conclusions

The eVTOL motor system utilizes an architecture based on analytical redundancy. By optimizing fault detection thresholds, it improves detection performance while effectively reducing false alarm and missed detection rates. The core advantage of this solution lies in its heterogeneous redundancy design. As shown in

Table 4. Comparison of various redundant systems.

Comparison Dimension	Traditional Hardware Redundancy	Single Algorithm FDI	Resolving Redundancy
Redundancy mechanism	Multiple hardware parallel	Single algorithm software	Multi-algorithm parallel voting logic
SWaP requirements	High (Weight/power consumption/large size)	Very low	Low (increases computational load only)
Fault detection capabilities	High (depends on hardware diversity)	Limited by algorithm design	Heterogeneous complementarity reduces common cause failures
Reliability level	Very high	Lower	high

, while maintaining a low SWaP requirement (only increasing the computational load), the complementary nature of multiple algorithms significantly enhances fault detection capabilities and effectively reduces common-cause failures. Compared to the high SWaP requirements and performance limitations of single-algorithm FDI solutions of traditional hardware redundancy solutions, this solution demonstrates significant comprehensive advantages.

The enhanced detection module enables rapid fault identification and backup motor activation. The parallel operation of multiple heterogeneous observers embodies the core redundancy strategy of “multi-algorithm parallelism and voting logic” described in the table, further improving detection accuracy and system reliability.

However, the system’s performance is still affected by model accuracy, especially as system complexity increases. Future work will focus on developing more detailed motor models and advanced fault detection algorithms that are robust to model uncertainties. Comprehensive failure mode analysis and experimental validation will be conducted to ensure that the proposed approach provides more accurate and reliable results under realistic operating conditions. These improvements are expected to further enhance system performance, reliability, robustness, and cost-effectiveness through continued design optimization.