Early Design Stage Evaluation of All Electric Aircraft Power Systems Focusing on Long-Term Behavior

Abstract

In the aircraft industry, there is a shift towards more and all-electric power systems resulting in great research efforts on single components like batteries. At the same time there is an increasing need to investigate and evaluate the long-term behavior of the whole electric power system to ensure safe and sustainable aircraft operation. Focusing on this challenge, the objective of this article is to propose a framework for electric power system assessment in the early design stages. In particular, the focus is on identifying and handling uncertainties regarding failure behavior and degradation, both on the component and system level. The evaluation of different power system topologies is based on the integration of Model-Based Systems Engineering and robust design methods. In this context, another central aspect is the definition of system and component requirements derived from the flight mission profile. SysML diagrams are used to define use cases and possible system topologies. Sensitivity of degradation effects are evaluated using robust design methods. The application of the framework and these methods is illustrated using a short-range aircraft with an all-electric power system. The results highlight the applicability of the framework to cope with the uncertainties that occur in the early design stages and point out fields of further research.

1. Introduction

The engineering of mobility systems such as aircraft must meet sustainability requirements. To reduce CO₂ and other greenhouse gas emissions within the operation phase, more and all-electric power systems (PSs) are coming into focus. Especially in the aircraft industry, there is a high potential to decarbonize the operation of aircraft. PSs are therefore undergoing remarkable changes driven by international research programs, e.g., [1,2]. Especially, it is feasible to switch short-range all-electric aircraft (AEA) to electric power systems. At the same time, these new PSs must fulfil safety and reliability requirements. To contribute to the current challenges, this paper focusses on the early design stages of AEA PS engineering, focusing on reliability and long-term behavior. The objective is to support engineers in evaluating the long-term behavior of different PS topologies, taking into account the uncertainties resulting from the novelty of the components, as well as the architectures.

1.1. Challenges and Trends in Electric Power System Engineering

To reduce the emissions of aircraft, there is an increasing shift towards more and all-electric aircraft and efficient PSs, e.g., [3,4]. This transformation has fundamental effects on PS architecture, since new technologies for storage systems or energy distribution have to be integrated, e.g., [5]. The basic functions of the PS include energy storage, energy distribution and energy conversion, as well as thermal management. Thus, it contains cables, energy converters, switchgears and protection components, as well as connectors, bus bars and control systems. Changes on the subsystem and overall system level challenge existing approaches and knowledge in the conceptual design of PSs and result in extensive uncertainties [6] within the early design phases. Uncertainties occur on the system level, as well as subsystem and component levels. Substantial uncertainties are induced by the following aspects:

• Limited knowledge about component behavior caused by changing working principles or operating conditions [6,7];
• Limited knowledge about interactions between components and impacts of degradations or failures in new PS architectures [8];
• Increasing interdisciplinary challenges and the need to involve different engineering disciplines and knowledge [9,10].

These uncertainties, as illustrated in Figure 1, in particular, impede the assessment of the long-term behavior and thus the safety and reliability of the PS. To cope with these uncertainties in the early design stages, different approaches are proposed in the literature, including a sensitivity evaluation based on model-based assessment, the use of comparable products and the known behavior, as well as expert assessments [11]. In order to develop safe and reliable PSs, these uncertainties have to be anticipated early within the design phase [12]. Thus, different engineering domains have to be involved to point out and manage the uncertainties resulting from less engineering experience (system level) and changed operating conditions (component level).

Most of the current approaches to power system engineering focus on performance criteria, e.g., [3,4], or seek to limit the risk posed by any failure condition by ensuring that the probability of this failure is less than its probability objective using severity [13]. Approaches to handling the uncertainties for sound prediction in the early design stages do not focus on the impact of new technologies and changing operating conditions [7,8,9] or different climate conditions inside an aircraft. At the same time, there is an increasing need to identify the most relevant degradation drivers and long-term behavior, in order to take effective measures for safe and reliable PSs in the early design phases.

1.2. Focus and Objectives of Research

To address the challenges associated with the evaluation of the long-term behavior of a PS, there is a need to provide methodical support in order to (1) evaluate the failure modes of single components, (2) assess the impact of component failures on the overall PS and (3) evaluate different PS topologies with regard to essential system properties like weight, reliability and performance in the early design stages. Therefore, this paper focusses on the evaluation of PS reliability in the early design stages, considering the impacts and uncertainties of new or changed technologies. The main objective is to enable the assessment of long-term behavior in the early design stages when comparing different PS architectures. This results in the following research question:

Which architecture and operation information are required to allow an initial assessment of the reliability of PSs and how can the assessment be performed, taking into account the essential system properties of PSs in the early design stages?

To answer this research question, a novel approach is proposed for the early design stage evaluation of the long-term behavior of AEA PS, to provide an in-depth review of the challenges and approaches in the conceptual design of electric PSs, apply Model-Based Systems Engineering to support PS engineering and consider the fundamentals of battery-based electric PSs. Moreover, we introduce criteria for the long-term behavior evaluation of PSs and methods for reliability analysis in the early design stages. Based on the insights from this analysis, we introduce a framework for a model-based evaluation, integrating system models in the SysML and domain-specific models from electrical engineering. This framework addresses the impact of new operating and environmental conditions on the degradation mechanisms of components, as well as the impact of changed system architectures and the corresponding uncertainties in engineering. Therefore, the focus of this contribution is on the identification and representation of critical failure modes for the functionality of individual components, as well as of the overall system. The proposed methodology is applied to the evaluation of electric PSs in the early design stages using the example of a short-haul AEA.

2. Systems Engineering for EA Power System Design

The engineering of power systems both for mobile and stationary applications is characterized by a high degree of interaction of components and safety and reliability requirements, as well as uncertainties. In this section essential challenges in the engineering of power systems for all-electric aircraft (AEA) are introduced. Moreover, the understanding and state-of-the-art methods of Model-Based Systems Engineering (MBSE) and their application in power system engineering are described. The uncertainties that occur in the process of designing EAs may affect the top-level requirements and conceptual design. Especially for those cases, the requirements and concept design need to be analyzed and defined in detail.

2.1. Battery-Based Electric Propulsion Systems

Different topologies for electric aircraft propulsion systems are presented in the literature including all-, turbo- and hybrid electric systems, e.g., Sain, [5,14,15]. In battery-based electric propulsion systems, high-capacity battery cells serve as the energy storage on board the aircraft. Aside from the storage system, the basic system architecture includes a distribution system, electrical conversion systems and the mechanical conversion system, see Figure 2 [16]. The thermal management systems are outside of the scope of this article, but affect the efficiency, safety, weight and lifetime of the overall propulsion system. In general, the propulsion system is classified as a critical aircraft equipment and thus has to fulfil safety requirements at the highest possible efficiency and lowest achievable weight. To fulfil safety and certification requirements, design principles of redundancy and fail-safe characteristics are applied when designing the propulsion system. As a consequence, fault response equipment like circuit breakers and clutches have to be integrated. Sain et al. [15] highlight that battery-based propulsion systems currently face challenges in terms of propulsion efficiency, safety and costs. The available state-of-the-art technology for all-electric propulsion systems is presented in multiple research works, including assumptions for future development, e.g., [17,18]. The battery system is pointed out as the most challenging subsystem due to its high share of system weight and cost, and the limited volumetric and gravimetric energy density of current technologies. Basic requirements and technology information are provided in the following paragraph.

NASA estimates a required pack-level battery energy density of 300 Wh/kg for a 30-passenger aircraft and flight range of 483 km. For a regional aircraft with 50 to 70 passengers, a 600 Wh/kg specific energy density is required at the cell level. State-of-the-art Li-ion pouch cells provide a capacity of 2 Ah and a cell-level specific energy density of 350 Wh/kg, achieving 430 charge cycles with an 80% capacity retention [19]. Higher energy densities are provided by Lithium–sulfur batteries with 471 Wh/kg at the cell level, while having a Technology Readiness Level 4 in 2021 [20]. However, energy density at the system level is significantly lower because of the additional components needed for the thermal management and packing of the battery cells. According to Misra [19], the specific energy density is reduced by 30% to 40% from cell to pack level. The energy conversion subsystem comprises DC/DC converters that are necessary to boost the voltage for energy distribution to the energy user, control output voltage and ensure safe operation of the battery in case of dynamic energy demands [20]. Moreover, losses in the distribution system are reduced. DC/AC inverters are needed to provide the required frequency and voltage for the electrical machines. Furthermore, converters for the different load types are necessary, like DC/DC converters for DC loads with lower voltages and DC/AC converters for fixed frequencies like 50 Hz or 400 Hz. The energy distribution system has the largest possible design space within the PS. The distribution is managed via the wiring harness and the return path. The design of the wiring harness is determined by the needs of the aircraft’s electrical loads and aviation regulations. Redundancies and power management can be implemented by different topologies integrating fixed and switchable connections. The cables that are used to distribute energy within the aircraft should be as light as possible, while complying with certain maximum voltage drops and specified safety margins. To protect the single components of the propulsion system in case of failures, different topologies, including switches to cut off the energy flow, are proposed in the literature, e.g., [16,21]. The main energy consumption within an AEA is caused by the electric machines that are needed for the propulsion of the aircraft. Anti-icing, actuators, etc., are further consumers with a high power demand. Within this publication, it is assumed that the instruments needed for flight control are not within the high-power PS due to safety reasons.

2.2. Model-Based Systems Engineering for Power Systems

Systems Engineering (SE) is an interdisciplinary approach to develop complex systems considering different design levels. These design levels range from a high-level conceptual design to the system level to the very detailed component level. Model-Based Systems Engineering (MBSE) is based on the principles of Systems Engineering and focusses on the application of formalized modeling to support system requirements, design, analysis, verification and validation activities [22]. The major aim is to increase the consistency, continuity and traceability of the information generated and needed by different stakeholders within the design process. To represent and link information about the requirements, behaviors and functions, as well as the components and modules, of the emerging product within one system model, different methods, languages and tools have been established [22,23]. A widely used modeling language is the System Modeling Language (SysML) [24]. SysML is a standardized general purpose graphical modeling language for capturing complex system descriptions in terms of their structure, behavior, properties and requirements, c.f. Figure 3. In order to support the concretization from black-box to white-box modeling, as well as the decomposition of requirements, systems and functions in the design process, different diagrams are provided in SysML, c.f. Figure 3.

The growing interest in SysML in practical use and science to support the design and validation of systems is reported by [25]. Focusing on power systems, research shows an increasing interest in applying MBSE methodologies and SysML within different design stages. The advantages of using SysML for PS design were identified in [11]. These include the possibility to model systems of systems, to consider the system context and system interactions. In addition, diagrams and model elements like requirements or system blocks can be connected in different ways to represent different kinds of relations and improve the overall system understanding and verification. Moreover, systems can be modeled and simulated from multiple viewpoints with SysML. Focusing on electric aircraft engineering, there are upcoming research works that apply MBSE and SysML for design and validation. To manage design complexity and validate conformance to safety requirements, SysML is applied for the design and validation of a flight control system in an MEA [13]. Based on the successful application of MBSE for the development of the flight control system considering safety as a main design driver, the overall PS for an EA is developed and presented in this chapter as part of an early design stage evaluation. In [14], an aircraft electric power system is modeled in SysML including different component models such as the control system, generator control unit, engine, AC bus, DC bus, DC breaker, auxiliary power and the battery. Considering the large differences in the PS between a conventional combustion engine aircraft and an EA, the findings from [14] can be included in this paper as well for the development of a suitable framework.

2.3. Conceptual Design of Battery-Based Electric Aircraft Propulsion Systems

Partial requirements analysis is the initial stage of the early design phases in general, and in particular for the design process for AEA, in which only a subset of the total requirements is analyzed. The goal is to identify key requirements essential to the design process without getting bogged down in unnecessary detail. The most important requirement categories, together with test cases and impacting factors for the AEA early design phase, are illustrated in Figure 4 below.

Failure rate, uncertainty and redundant design are closely related to the reliability and safety of the system, so they are often listed as requirements. Requirements related to operation and system characteristics focus primarily on the operational performance and inherent characteristics of the system, such as efficiency, power distribution (mission profile), weight and volume. The promulgated specifications and standards from authorities are commonly used as certification criteria. From a verification perspective, these specifications and standards serve as test cases for the design. These requirements, which serve as the basis for performance analysis and the sizing process, will be further refined during the conceptual design based on the project’s use cases.

Within established aircraft design processes, there is a distinction between the performance analysis and sizing process. The performance analysis focusses on the wing and power loading in the case of propeller aircraft or thrust load in the case of jet aircraft. As a subsystem of the aircraft, the conceptual design of the power systems is mainly driven by thrust requirements that are defined by the overall aircraft design, as well as the mission profile [16,20,21]. In contrast to conventional aircraft, weight can be assumed to be constant when using batteries for energy storage, since there is no fuel burned. Preliminary sizing algorithms for battery-based electric propulsion systems are frequently based on iterative component sizing and system performance analysis, since the required battery capacity depends on the overall efficiency of the propulsion system. Inputs for the sizing of the propulsion system are the basic specifications of the aircraft, e.g., lift to drag ratio (L/D), number of passengers and mission requirements (required aircraft thrust over time), and assumptions for the system components, including the specific power and efficiency of the single components. Based on first flight specifications and propulsion system data, the resulting thrust of the propulsion system is calculated. Anker and Noland propose a more detailed sizing algorithm based on Breguet’s range equation [20]; see simplified algorithm in Figure 5.

Design optimization is increasingly important in advanced conceptual aircraft design. Brelje and Martins [26] discussed it with a focus on electric fixed-wing aircraft. The need for integrated modeling and simulation capabilities to perform an effective optimization is emphasized. In the meantime, existing modeling approaches, by discipline and project, are introduced. The modeling efforts include considerations of aerodynamics, structure, propulsion, thermal constraints and cost modeling. Various NASA studies are mentioned, each focusing on different aspects of modeling, simulation and optimization [13].

3. Assessing Long-Term Behavior of AEA Power Systems

Multiple designs of power supply systems are possible, following different design philosophies. For the selection of the most suitable conceptual power supply system design, a thorough system analysis and evaluation is needed. For such an evaluation, it is important to define assessment criteria that reflect the overall system design, as well as the specific topics that are important for further application. Assessment criteria can all be equally important or very diverse. This depends on the system type and its application, and it can be implemented by utilizing criteria weights. Design alternatives are in the next step, compared with each other for all criteria according to the Promethee assessment analysis. The next step is then to compare the design alternatives for all criteria to find the most suitable design according to the defined criteria. In particular, long-term behavior plays a major role in the system reliability and is therefore also considered in this assessment [27,28]. In this section, the basic assessment criteria and the selection of criteria weights are introduced. Among them, reliability is an important factor. At the end, the state-of-the-art methods and approaches for the reliability analysis of the AEA power system are introduced.

3.1. Assessment Criteria for Long-Term Behavior Evaluation

The initial, and a very important, step for the actual evaluation is the definition of criteria and the associated criteria weights, which define the most important aspects for the evaluation. For this study, weight, safety and maturity were selected as the most important factors, as defined in

Table 1. Evaluation criteria with criteria weights.

Evaluation Criteria	Criteria Weight
Weight	0.25
Safety/Fault tolerance (redundancy) on system level	0.5
TRL/Maturity (component level)	0.25

.

Reliability is a major parameter that needs to be considered to develop a safe and long-lasting PS in general and specifically for EAs. In addition, the overall weight of an AEA is crucial, as it defines the feasibility of a design and needs therefore also to be considered as an assessment criterion. This section provides explanations of the utilized parameters.

Weight is a very important aspect in aircraft in general, independent of the PS technology (electric or conventional kerosene-based). As the focus of this paper is the evaluation of PSs of short-range AEA, the weight is also a key aspect and will be analyzed in the following chapters of this paper considering the components that are a part of the PS, e.g., batteries, cables, converters and switches.

Reliability is utilized as a criterion for the evaluation of multiple PS topologies, which are introduced in Section 5.3. In this context, reliability is divided into maturity and fault tolerance, with the following meanings:

Maturity/TRL: Maturity, on a system level, considers the PS as a system and explains how much experience is already available with the connection of various components in a specific configuration. The difference to the component level maturity is that the focus is on the knowledge of interdependencies between components in the system and the operational experience of the specific network, Therefore, it could be the case that well-understood components are utilized in a new system design, e.g., connection on the DC side compared to an AC connection. Even though the components are mature (high TRL), the system might have a much lower TRL. Consequently, the topology influences the system maturity, and it is important to consider the maturity both on the component and system level. Different Technology Readiness Levels are defined in standards, which allows the precise identification of the right TRL, which is important for the assessment of each topology. These levels and their meaning are defined in the TRA/TMP Guide as shown in

Table 2. TRL levels and their meaning.

TRL Scale	Deifnition	Description
TRL 1	Basic principles observed and reported	Scientific research translated into applied research and development, for example, the properties of materials
TRL 2	Technology concept and/or application formulated	Practical applications identified
TRL 3	Analytical and experimental critical function and/or characteristic proof of concept	Analytial studies/predictions (for example, of the temperature, pressure, etc.) conducted and the feasibility physically tested in laboratory conditions
TRL 4	Component and/or breadboard validation in laboratory environment	Individual component and/or breadboard tested in laboratory
TRL 5	Component and/or breadboard validation in relevant environment	Basic elements integrated and tested in consideration of a realistic application
TRL 6	System/subsystem model or prototype demonstration in a relevant environment (ground or space)	Representative model or prototype system tested
TRL 7	System prototype demonstration in an air environment	(Critical and relatively high risk) technologies and/or subsystem application tested in air environment
TRL 8	Actual system completed and “flight qualified” through test and demonstration (ground or air)	All applied technologies tested in actual system
TRL 9	Actual system “flight proven” through successful mission operations	All technologies applied in actual system

.

Fault tolerance/safety: The fault tolerance, on a system level, considers the connection of various components in a system, including the connections and their characteristics, e.g., the availability of redundant components or the possibility of reconfiguring the system configuration in case of component failure. Thereby, the fault tolerance on a component, as well as on a system, level is important to evaluate the safety, as well as the reliability, of a topology. The system-level safety of the electric power system is the ability of the system to meet the functional requirements (e.g., available power) in different use cases (e.g., takeoff or cruise). A high system safety is given when all use cases can be realized with minimum risk (maximum acceptable failure probability). The required system safety of the propulsion system can be defined by the climb gradient requirement (14 CFR §23.2120(a)(1)) and is affected by the system topology.

The design of PS architectures is based on a set of system requirements, including power and reliability requirements. To determine a PS architecture’s fulfilment of load requirements for all operation conditions, e.g., flight or drive conditions, predetermined faults have to be handled and solved by the system architecture. To guide the design and evaluation process, aside from load and power requirements, safety and reliability requirements have to be specified. Safety specifications are defined to constrain the way each bus has to be powered in order to avoid loss of essential functions, as well as the maximum time interval accepted for power shortages. Safety is also defined by the effect of a failure on the performance of the system (fault tolerance). These safety requirements can be transferred into topology requirements like multiple batteries, and detailed requirements on the operation of single components, like flight-critical actuators having a minimum unpowered time.

Reliability requirements are used to define the acceptable failure probability for different parts of the PS. Each component therefore is characterized by a failure rate (lambda) indicating that a failure occurs, on average, every 1/lambda hours. The failure rates are translated into a failure probability based on a specific operation/mission profile that allows one to express system reliability specifications in terms of the failure probability of components. This specification would, for instance, require that the failure probability of an essential load is smaller than 10⁻⁹ per operation/flight hour. The failure probability for single components of a PS is, for instance, defined in [13]. The procedure to determine reliability requirements highlights that there is a need to identify the critical loads specification and to describe the long-term behavior of components of the PS considering different degradation mechanisms [13,29]. In most approaches, the required failure rate data are taken from databases and standards like MIL-HDBK-217, IEC 618709 or IEEE Standard 493-2007. Here, basic application conditions (e.g., stationary and mobile applications) are considered, and thus require knowledge about the component’s stress (voltage and temperature). At the same time, the underlying stresses and degradation mechanisms are limited to well-known operating conditions [10].

3.2. Early Design Stage Reliability Analysis

Different approaches for the incorporation of a reliability analysis in the early system design stage are available. Reliability has been identified as a fundamental design principle and requirement. Considering a reliability analysis early in the design phase is important to ensure a robust system design. To analyze the reliability of a system during system design, the failure rate and the failure mode need to be investigated for system components. Part of the reliability analysis are cause-to-effect analysis and reliability design guidelines [30]. One big challenge about considering reliability already in the early design stages is that only limited information about the system design and its components is available at the conceptual design level. A publication has presented and utilized new methodologies that consider component, time and distribution parameter dependence. With such methods, it is possible to support the decision making. Another challenge is that the available information has many different formats [31].

The need and first efforts to move reliability assessments to the early design stages are addressed in different papers. In [32], existing reliability evaluation methods are reviewed, focusing on their suitability for concept design. In addition, an approach as to how to increase concept reliability is presented [32]. In [6], failure rate data were created with a function–component matrix (FCM) and the Heaviside function. These data were then used for decision making in the design phase and for the determination of system reliability [6]. Another paper [33] introduces the so-called concept comparison method that has the objective of validating concepts in an early design stage and identifying the one that should be developed further. This methodology is based on system requirements and failure functions that are determined after the concept and systems are defined. Part of the approach is to collect the information needed for a failure mode and effects analysis (FMEA) [33].

Another challenge for system design is that failures are, with traditional methods, only realized late in the design process, which makes the correction of the design expensive. To account for this challenge, research was, for example, carried out on a mechatronic system, for which it was possible to identify critical weak points so that countermeasures could be taken [34]. A method called the “Early Design Reliability Prediction Method” was developed to support the decision-making process at early design stages by using quantitative reliability values. This method is based on function and component failure rates and was developed and demonstrated with an electric power system case study [35].

In [36], a method for the automated generation of failure modes and effects analyses (FMEAs) based on SysML models comprising block definition diagrams, internal block diagrams, state transition machines and activity diagrams is proposed. David et al. [37] describe a method for the reliability analysis of complex systems during their design. Here, functional models expressed in the widely used languages of OMG (Object Management Group) are reused and improvements for reliability studies are highlighted. Based on a functional model, the failure mode propagation is deducted, focusing on flows. To cope with the complexity of the safety analysis of mechatronic systems caused by interdisciplinary design, Mhenni et al. propose a safety profile [38] that is integrated directly with the modeling elements of the system via SysML. Failure modes of each function and component, their causes, their effects, as well as their severity, are modeled via stereotypes or tag definitions that extend the existing UML (Unified Modeling Language) elements. The application of the modeling approach is illustrated using an electromechanical actuator as an example.

Helle [39] proposed a methodology that deals with the integration of Model-Based Safety Analysis (MBSA) in the MBSE process. A SysML extension is created to include information about safety in the system model, which gives an opportunity to the systems expert to make some decisions without the assistance of the safety expert. As outputs of the developed program, a group of minimal cut sets is given for all system failure modes. To ensure consistency between the system design and safety artifacts, Baklouti et al. [40] introduce the Improved SafeSysE method. This method supports the automated generation of FMEAs from a SysML model. Based on the FMEA analysis, recommendations are given to enhance the system design and make it comply with safety requirements.

4. Proposed Approach for Early Design Stage Power System Development and Model-Based Evaluation of Long-Term Behavior

The focus of this contribution is the design process of mobile electrical power systems for AEA. When designing an electric power system, different criteria need to be met. In particular, two important system evaluation criteria are safety and efficiency. Safety plays a major role in the system design. It is a common approach to strengthen safety by improving reliability, availability and maintainability. This can be realized, e.g., with redundant components and regular system and component checks. However, the design should also be efficient and cost-effective, which means that losses, recharge time and costs should be low. These two objectives, safety and efficiency, are the major system design drivers. To create a safe and efficient electric power system, component behavior needs to be integrated into the system model. The design needs to be safe and efficient from the first operation of the system and throughout the complete system life cycle, until the decommissioning of the system. To ensure this, parameters that have an influence on the safety and efficiency of the components and the whole system are identified. Among them, operating hours have a great influence on component behavior and therefore, also on the overall system safety and efficiency. For these reasons, one of the objectives of this research is to analyze aging effects in different flight environments for components and include this knowledge in the system design.

4.1. Structure of the Framework

As explained in the previous chapters, the development of power supply systems for mobile applications such as in AEA involves many design alternatives and multiple criteria for the assessment, as well as uncertainty. This uncertainty is especially evident in AEA, as the components of the power supply system operate in different flight environments and with different load distributions compared to well-known operational conditions, e.g., in EVs [41].

MBSE, with its discipline-independent SysML modeling, offers a structured approach for the development of complex systems and is therefore well suited for the design of AEA power supply systems. The system modeling language SysML allows the creation of a model that makes in-depth power system analysis and development possible. Especially for the early design stages when high uncertainties are present, SysML allows the clear definition of unknown factors and the development of the different alternatives that are possible and that need to be evaluated (see Section 5.4). At the same time, results from discipline-specific models such as the electrical network simulation software PSCAD (Power Systems Computer-Aided Design) can be included in the overall SysML framework at a later stage, when a detailed system analysis or component sizing is required. The overall framework, with the individual steps, is represented in Figure 6.

4.2. Requirements

The first step of the proposed framework is the identification of relevant stakeholders. Next, the “use cases” are defined, which serve as an explanation of the expected functionality and behavior of the AEA system. Section 5.1 provides more details on use cases, and their role in the degradation analysis is explained. Together with the specifications for the power supply system and the foreseen mission profile, a basis for the definition of requirements is created. These requirements serve as the foundation for both the system development and, subsequently, for the verification.

In the first step, use cases and the basic structure of the system under development must be defined. These are common tasks in MBSE [42], providing insights on recurring applications and basic requirements within the utilization phase of the system. Aside from describing the basic functions to be fulfilled by the system, use cases are also utilized to specify the system environment that provides uncertainty, especially in such early design stages, as well as to derive requirements. For instance, for an AEA, use cases are the charging of a traction battery, overland travel or a city tour. For each use case, basic requirements like required power, peak performance or maximum/average duration can be determined. Thus, the use cases and linked requirements provide insights into different load profiles. In addition to use cases, an initial system architecture is needed to draw conclusions regarding the functionality of individual components in the different use cases. For example, in the use case of traction battery charging, the electric motor of the power system is not involved and thus will not be affected by degradation.

4.3. Development of Topologies

The evaluation of newly developed systems such as power systems for MEA or AEA is difficult because of a lack of relevant failure and degradation data. However, such data are essential for early design stage development. Therefore, an approach for the evaluation of the uncertainty of degradation models is developed (Figure 7). The core of the proposed method is the modification of an existing and well-understood degradation model. Each deviation of the modified model compared to the original model is evaluated.

4.4. Identification of Reference Applications and Existing Degradation Models

In the second step, similar products, components and applications are identified based on the defined use cases and system architectures. The essential criteria to select reference applications are based on the similarities in the basic system architecture and in the use cases, as well as the comparability of the technologies used for individual components. A system perspective is appropriate when identifying reference applications, since on this level use cases can be compared effectively. In addition to comparable products, existing degradation models (DMs) need to be identified. To enable an informative evaluation of the DM, a physical DM in most cases is appropriate, since this indicates the effect of a single influencing factor on the deterioration or degradation of a physical system over time. At the same time, these models have to be tailored for the specific application by determining the model parameters. Since this information does not exist in the early design stages, knowledge about the specific degradation has to be derived from the reference application. For most components and applications, there are tailored DMs available that can be used to estimate the expected lifetime and failure rate.

4.5. Identification of Changed Influencing Factors and Sensitivity Evaluation of DM

This evaluation is performed for changes in operation as well as for changes of the environment. The modifications of the degradation model can have a negative impact on the overall component degradation [43]. The overall effect of the modifications is depicted in Figure 7.

To evaluate the expected degradation behavior of the system under development, in the second step the influencing factors must be identified, and their impacts on the degradation have to be evaluated. The influencing factors can be derived when comparing the use cases of the reference product and the system under development. The identified DM and the included influencing factors serve as a basis for this evaluation. Proposed by [26], the influencing factors are, for example, disturbance and environment. Correspondingly, the disturbance-based robustness ratio (I_d) as well as the environment-dependent robustness ratio (I_e), are used for robust design analysis and can be represented by the following formula:

$$I_d={\displaystyle \frac{1}{1+\sum Y_n}}$$

(1)

$$I_e={\displaystyle \frac{1}{1+\sum Y_n·E_n}}$$

(2)

$Y_n$ represents the impact of an influencing factor on the design, with 0 indicating no effect and 1 indicating an effect. Similarly, $E_n$ denotes the presence of a specific influencing factor in the operational environment, with 0 indicating its absence and 1 indicating its presence. To indicate the effects of the individual factors, it is necessary to show both conclusions (has an influence/has no influence) and trend (increased/decreased). In addition to the effect of individual influencing factors, the sensitivity of the DM to the expected change has to be indicated. Therefore, the sensitivity-dependent robustness ratio (I_s) proposed by [43] is used. This ratio can be calculated by the following formula:

$$I_s={\displaystyle \frac{1}{1+\sum Y_n·E_n·F_n}}$$

(3)

where $F_n$ is the sensitivity of the DM to each changed influencing factor from 0 (insensitive) to 1 (sensitive). In case a high sensitivity is stated, I_s becomes <1 and the informational value of the existing DM for the new application context is limited. To assess the sensitivity of the DM for each changed influencing factor, on the one hand the given DM can be used and on the other hand conclusions can be drawn from different applications, e.g., load profiles, of the reference product.

Based on all three robustness ratios, different effects can be evaluated for the DM. Further on, those effects can be considered for new applications that are developed. For instance, batteries, serving as the power source for on-board electrical systems, are based on electrochemical reactions and are subject to influences from factors such as temperature, pressure, humidity and radiation. Considering these four factors as an example, the disturbance-based robustness ratio equals 1/(1 + 4) = 0.2. Given the importance of maintaining the internal pressure of the battery to ensure its safe operation, batteries are typically housed in pressurized areas within aircraft. Consequently, when conducting analyses of the environment-dependent robustness ratio, the potential impact of pressure is disregarded. In this case, the environment-dependent robustness ratio equals 1/(1 + 3) = 0.25. Among the remaining three factors, temperature is generally considered to have a substantial impact on battery performance, with a weighting of 0.8. Humidity and radiation are considered to have a relatively lower impact, each assigned a weighting of 0.3. In this case, the sensitivity-dependent robustness ratio equals 1/(1 + 1 × 0.8 + 1 × 0.3 + 1 × 0.3) = 0.42. The same analysis process can be applied to other power supply components, such as jet fuel, which are based on combustion reactions. Reference applications can be selected based on those three ratios between battery and jet fuel. Another example is the influence of high-altitude radiation on power electronic components such as converters and the failure-in-time-rate, which has been investigated in [44,45]. It is important to note that the comparisons discussed herein primarily focus on the potential influence of external environmental factors on the system, without taking into account the potential impact of emissions generated by the system on the environment during its operation. When conducting an analysis, it is essential to consider multiple aspects comprehensively.

4.6. Candidate Topology

Usually, many different topologies are possible and can be created. For a structured approach that ensures the consideration of possible topologies, the BDD provides a valuable information basis. The blocks that are part of the power system define what subsystems need to be included in the overall topology. Some blocks might be optional, and for others many different designs are possible. In addition, a topology can include a different number of components and connections, leading to a certain redundancy and therefore also safety levels. Taking these details into account leads to the development of many possible topologies.

4.7. Topology Verification

Based on safety, reliability and weight criteria, the most suitable topology candidate is selected and verified in the next step. This verification is based on the prior defined requirements in the SysML model and a detailed analysis of operation and failure cases. SysML allows the detailed definition of the system design including a detailed component specification, which can then be linked with the requirements. This combination between the system structure and the requirements, including the defined test cases, allows an overall system verification on a component and system level. Based on the outcome of the verification, the topology might need to be corrected and verified again. When a topology is verified, lessons learned on the overall procedure. as well as for the definition of requirements, are documented to allow a continuous improvement of the power system development framework.

4.8. Topology Improvements and Lessons Learned

In case a requirement could not be verified during the topology verification stage, the system design needs to be adjusted based on the verification result. Because one change in the system can have an influence on multiple components, it is important to know what parts of the power system are affected and need to be modified as well. This information is available from the SysML model, and thereby the efficient modification of a topology is possible. The following step is then to perform the topology modeling in PSCAD, the FMEA and the assessment again to find the most suitable topology, which is then verified once again. This process continues until a suitable topology is identified and verified.

The utilization of SysML allows the direct implementation of lessons learned either from the system design phase or the operational phase of the AEA. The structure of the power system topology and the definition of each component are based on current knowledge and assumptions because no extensive experience with AEA is available in the industry at this stage. However, having a SysML model of the aircraft with component specifications allows the integration of, e.g., updated failure modes and degradation schemes for each component, as well as negative interactions that were identified in the power system. Therefore, the initially developed SysML model forms the basis for AEA power system design for present and future developments.

5. Case Study for Early Design Evaluation of Complex Power Supply Systems

The approach developed as part of this research and explained in the previous chapter was applied to the development of the power system of an AEA. Each stage of the proposed development methodology is described below, so that a verified power system for an AEA, considering especially safety and reliability, is the result.

5.1. Use Cases and System Requirements for the AEA

Two main use cases are identified, namely the generation of propulsion and the preparation of the flight, as illustrated in Figure 8.

For this paper, a short-range AEA is considered, and the focus is on the power system of the aircraft, consisting mainly of the drive train. Other secondary systems, such as the power supply for the communication equipment or the onboard kitchen, are not considered. The mission profile for a short-range aircraft (see Figure 9), which forms the basis for this paper, defines in a first step the flight altitudes over the flight time. Different phases of the flight are identified, such as the take-off, climb, cruise, descend and diversion phase with another small climb, and cruise and descend phase before landing and taxiing. In the middle graph, the required power levels for each stage in the mission profile are defined, providing an important input for the use case description and thereby also for the requirement definition. These parameters are important to derive how much power and energy needs to be made available by the AEA power system to realize the mission. All components of the power system need to be designed to fulfil the mission. For example, the motor(s) have to be able to provide the thrust defined in the bottom graph for each phase of the mission profile (Figure 9).

From the mission profile and the available literature, the following assumptions are defined for this case study:

• Aircraft type: All-electric short-range aircraft;
• Voltage level: 3 kV (+/− 1.5 kV) DC (based on [17]);
• Maximum battery power and power needed for take-off: P_max = P_Takeoff = 4500 kW (based on mission profile, see Figure 9);
• Total energy required includes mission profile phases 1 to 13 (Figure 9). Considering all safety reserves, the total energy that is needed equals E_el,total = 11,530 kWh;
• Current per string: I_string = 750 A

Not only are the flight characteristics as defined in the mission profile important but also the flight preparation use case for which the batteries need to be charged and the system tests that have to be completed to ensure a safe flight. The charging environment needs to be defined accordingly but is not the focus of this paper. The service provider and the environment are additional stakeholders relevant for the detailed definition of the flight preparation use case. The developed use cases (see Figure 8) form the basis for further power system topology development.

5.2. Devlopment of Topologies

The following step is the development of basic aircraft power supply system topologies that fulfil the defined use cases. First, the basic systems that are required for the realization of the power system are identified. These systems are the storage system, distribution and protection system, electric conversion system and the mechanical conversion system (Figure 10). Second, each system consists of multiple components as depicted in the block definition diagram (BDD) in Figure 10.

All the blocks of the BDD are required to develop power supply system topologies for the AEA. These topologies are studied based on a failure mode and effects analysis (FMEA). At a later stage, the evaluation of operational behavior, as well as the lifetime estimation, is performed for the different components and the overall topology, which is required for the reliability assessment. The overall system model in SysML allows a detailed reliability, degradation and weight analysis for the individual topologies that are assessed in the following stage.

5.3. Development of Topologies

Multiple topologies have been identified for the realization of the use cases with the blocks defined in the BDD (Figure 10). Each configuration consists of two strings, with batteries on the left-hand side that are then connected via converters and cables to the motor shown on the right-hand side. The difference between the alternatives originates mainly from the number of batteries, switches and the cable connections between the individual power strings, realizing either a higher reliability or a lower weight. In total, five topologies as presented in Figure 11 below have been investigated in detail in this paper.

In total, the energy that is required for the defined mission profile (Figure 9) is approximately 11,530 kWh, and the energy per battery in case of two strings with three batteries each is approximately 1922 kWh.

The basis for the evaluation of the different topologies involving a failure mode and effects analysis is the failure probability for each component. Motor failure is not considered, as the actual motors are assumed to be the same for all the topologies that are investigated. The component specific failure probabilities are determined based on data from reference applications. Since there is a wide spread of failure rates caused by the different environmental and operation conditions for each component, the highest failure probability is considered. The given values are valid for an operating time of one million hours. In

Table 3. Component-specific failure rates of reference applications and resulting failure probability.

Component	Failure Rate per Million Hours in Reference Application	Component-Specific Failure Probability
Battery System	9.3 failures (Li-ion batteries [13])	63.9%
Bus Bar	>0.25 failures (power bus [13])	1.7%
Cable	>0.25 failures (power bus [13])	1.7%
Converter	4.75 failures (Inverter [13])	32.6%

, the assumptions are summarized. Here, the specified failure probability indicates the probability of failure of the component compared to the other components of the PS. Thus, the converter is assumed to have the highest failure probability. The data are based on the research reported in [13]. As there are different strategies to reduce the effects of these critical components, like redundancy, which have been considered in the topology development, in the following the resulting risk impact for the different topologies is investigated.

5.3.1. Topology 1: Basic Configuration

The basic topology (Figure 11a) shows a weight-optimized configuration with a minimum number of components and no connection between both strings. A certain redundancy is also available in this alternative, with multiple batteries connected via switches to the main power supply string. However, as the FMEA illustrates (

Table 4. Failure mode and effect analysis—Topology 1.

Mode	Effect	Active Power Loss	Risk Impact
Battery failure	Reduced capacity 2/3 + 3/3 (reduced flight range)	16%	0.10
Bus failure	-	50%	0.01
Cable failure	Failure drive A/B	50%	0.01
Converter failure	Failure drive A/B	50%	0.16
Overall failure impact	0.28

), there is no redundancy available in case a motor, cable or converter fails. The only redundancy that is available comes from the two individual power supply strings with a motor connected to each one. For the batteries, a redundancy is available, leading to a reduced storage capacity and therefore to a reduced flight range in case battery damage occurs.

5.3.2. Topology 2: Basic Topology with Connector between Strings

The second topology (Figure 11b) aims to increase the overall power system redundancy with an interconnector cable between both power strings, as visualized in Figure 11b. The consequence of this additional connection is that a switch needs to be realized in the connector cable to allow normal operation, where each motor is supplied with power from one battery pack and power string. Another switch is required on the battery and converter side of the bus bar to which the interconnector cable is connected. These three additional switches allow reconfiguration from the normal operation configuration to failure mode operation in case a battery, a converter or a cable fails. However, with more components, the weight of the power supply system increases. The FMEA shows at the same time that no immediate failure of the whole power system is expected when one failure at a time occurs (

Table 5. Failure mode and effect analysis—Topology 2.

Mode	Effect	Active Power Loss	Risk Impact
Battery failure	Reduced capacity 2.5/3 + 2.5/3 (reduced flight range)	16%	0.10
Bus failure	Failure drive A/B	50%	0.01
Cable failure	Failure drive A/B	50%	0.01
Converter failure	Reduced capacity 1.5/3 + 1.5/3 (reduced flight range)	50%	0.16
Overall failure impact	0.28

).

5.3.3. Topology 3: Basic Topology with Connector and Additional Bus Bar Switch

To further increase the overall system redundancy, additional switches are included into the system design on the motor side of the bus bar (Figure 11c). These switches allow the isolation of the cable between the bus bar and motor on each string, to allow a continuous operation of the AEA with one string. This means that all six batteries can be connected to one motor to increase the remaining flight distance, as illustrated in

Table 6. Failure mode and effect analysis—Topology 3.

Mode	Effect	Active Power Loss	Risk Impact
Battery failure	Reduced capacity 2.5/3 + 2.5/3 (reduced flight range)	16%	0.10
Bus failure	Failure drive A/B	50%	0.01
Cable failure	Failure drive A/B, no change in battery capacity 6/6 but only one drive	50%	0.01
Converter failure	Reduced capacity 1.5/3 + 1.5/3 (reduced flight range)	50%	0.16
Overall failure impact	0.28

. The assumed pre-condition is that a safe flight operation is possible with only one motor. However, additional cost and weight is added to the aircraft with two additional switches.

5.3.4. Topology 4: Basic Topology with Individual Battery Converters

The previously introduced topologies consist of one converter that connects three batteries to one string, as well as the bus bar, and then to the motors. To improve the safety of the AEA system during operation, each battery is connected via an individual converter to one string, as illustrated in Figure 11d. Hereby, the flight range can be increased in case one converter fails. Contrarily, the number of switches on the battery side and the number of battery converters increase from two to six, which increases the weight and the investment cost further. Furthermore, the maintenance cost increases slightly because of more components, and at the same time, the topology complexity increases. A higher complexity could then lead to a higher chance that a component or a subsystem fails. However, the impact of a failure could be compensated for with the other components being available.

Table 7. Failure mode and effect analysis—Topology 4.

Mode	Effect	Active Power Loss	Risk Impact
Battery failure	Reduced capacity 2.5/3 + 2.5/3 (reduced flight range)	16%	0.10
Bus failure	Failure drive A/B	50%	0.01
Cable failure	Failure drive A/B, no change in battery capacity 6/6 but only one drive	50%	0.01
Converter failure	Reduced capacity 2.5/3 + 2.5/3 (reduced flight range)	16%	0.05
Overall failure impact	0.17

provides details in regards to the overall FMEA analysis of Topology 4.

5.3.5. Topology 5: Basic Topology with Ten Batteries

Another possible configuration (Figure 11e) would be to increase the number of batteries, which increases the redundancy and thereby also the safety aspect, but at the same time increases the weight of the overall AEA. Additionally, safety is only slightly increased by having more batteries but at the same time having only one battery converter per PS string, as shown also in

Table 8. Failure mode and effect analysis—Topology 5.

Mode	Effect	Active Power Loss	Risk Impact
Battery failure	Reduced capacity 4.5/5 + 4.5/5 (reduced flight range)	10%	0.06
Bus failure	Failure drive A/B	50%	0.01
Cable failure	Failure drive A/B, no change in battery capacity 6/6 but only one drive	50%	0.01
Converter failure	Reduced capacity 2.5/3 + 2.5/3 (reduced flight range)	50%	0.16
Overall failure impact	0.22

. Theoretically, it would be possible to have a separate converter per battery, but this would increase the overall weight of the PS and increase the control system development of the multi-terminal DC system, so that the safety would even decrease due to the lower TRL Therefore, such a concept is not considered in this study.

5.3.6. Summary of Topology Development

The redundancy and thereby also the availability of a system depends on the number of redundant systems and components. However, the weight of the power system needs to be considered as well, and the breakeven point where considerably low additional availability is added by more components. The topology with the most redundancy that was studied includes five batteries per string (Figure 11e). Having more redundancy than presented in Figure 11b was found not to increase the safety noticeably, considering the failure rates of each component and the overall system. Having many small batteries increases the flight duration in case one fails. However, having an individual converter for each battery would increase the power system weight and space requirements significantly, taken into account also the distances between the components that need to be available for cooling purposes. Therefore, the system of having one converter per battery was not developed further over having one battery converter per string (Figure 11e).

System reliability and safety plays a significant role, which is analyzed based on the failure modes and effects analysis (FMEA) developed earlier. The results of the FMEA are an integral part of the overall system assessment that leads to the most suitable topology on the initially introduced criteria. Another criterion that is considered for an overall evaluation is the weight of the power system, which directly influences the operational behavior as well as the whole aircraft design. Having more components increases the redundancy but at the same time also the weight, which leads to a higher power demand and as a consequence to even more or larger equipment. Another important aspect that is related to the FMEA is the degradation of each component, which creates the requirement of a repair or replacement during the lifetime of the aircraft. Additionally, a maintenance strategy needs to be developed based on the FMEA and is therefore part of the power system design, considering the whole system life cycle.

5.4. Candidate Topology

A Multi-Criteria Decision Aid (MCDA) analysis allows the evaluation of the developed system topologies based on the identified criteria safety, reliability and weight and the distribution of criteria weights (

Table 9. Evaluation criteria.

Evaluation Criteria	Criteria Weight
Weight	0.25
Safety/Fault tolerance (redundancy) on system level	0.5
TRL/Maturity (component level)	0.25

). For aircraft safety, maturity and weight are important criteria, which get assigned a relatively high weight to consider their importance in the evaluation and the design. Safety is considered to be the most important criterion and has, therefore, the highest criterion weight. The maturity and the weight of a system are seen as being equally important for the overall AEA PS design. The evaluation considers only the system level, because the component level is already indirectly included in the system-level criteria. For example, the weight of the individual components defines the overall system weight.

An in-depth literature review was the basis for the definition of assumptions that are the basis for the topology evaluation. These assumptions should be updated when more operational experience is available in the next years and decades. The assumed values and topology characteristics are summarized below in

Table 10. Assumptions and parameters.

Parameter	Value	Unit
DC voltage level	3 (+/−1.5)	kV
Maximum power	4.5	MW
Current per string	750	A
Weight motor-side switch (2.4 MW)	21	kg
Weight motor-side switch (0.8 MW)	13	kg
Weight motor-side switch (0.6 MW)	11	kg
Cable length battery to bus bar	1–6 (depending on topology)	m
Cable length bus bar to motor	7	m
Power cable	4.1	kg/m
Battery cable	2	kg/m
Converter (2.25 MW)	25	kW/kg
Battery (800 kW–600 kW)	700	Wh/kg
Total energy demand	11,530	MWh

.

For the evaluation, the topologies are broken down into main components, which makes, e.g., the calculation of the overall PS weight easier. The overview of the number of components for each topology can be derived from

Table 11. Quantities per topology.

Topology	Batteries	Battery Converters	String Coupler	Battery-Side Bus Bar Switch	Motor-Side Bus Bar Switch
1	6	2	0	0	0
2	6	2	1	2	0
3	6	2	1	2	2
4	6	6	1	6	2
5	10	2	1	2	2

.

The weight was calculated on the basis of the number and size of components and, for the cable, based on the aircraft size and the resulting cable lengths (see Figure 12). The results for the five presented topologies are summarized in

Table 12. Weight assessment.

Topology	Cable Length String Coupler	Cable Length Battery–Bus Bar	Cable Length Bus Bar–Motor	Total Weight (kg)
1	0	18	14	17,229
2	4	18	14	17,308
3	4	18	14	17,350
4	4	18	14	18,138
5	4	18	14	19,983

. It can be seen that the weight of the first three topologies is in a similar range but the fourth and especially the fifth topology are considerably heavier. The difference is based on the individual connection of the battery converters and the higher number of batteries leading to more individual cable connections. The following values were identified from the literature for one kilometer of aluminum cable [16]:

• Power Cable: 4.1 kg/m
• Battery cable: 2 kg/km

As explained in Section 3.1, safety depends highly on the redundancy that is available in each topology. A higher redundancy makes the whole system more resistant against faults and thereby safer to operate. This concept is also clearly visible from the evaluation table below (

Table 13. Safety assessment.

Topology	Availability and Safety Assessment Based on Failure Mode and Effect Analysis (see Table 3, Table 4, Table 5, Table 6 and Table 7)
1	0.25
2	0.25
3	0.25
4	0.17
5	0.22

). The topologies were developed on purpose from having the least number of components to having redundancy and multiple switching possibilities to go into emergency configurations. However, it needs also to be considered that with a certain redundancy level, only very little safety improvements are realized but a lot of weight and complexity is added. For this reason, the multi-criteria assessment that considers also the other two criteria, namely weight and maturity, are important.

The maturity is directly related to the Technology Readiness Level (TRL)ö, as this describes how much experience is available with a certain configuration. This factor is important and illustrates that the simplest topology is the easiest due to the point to point connection on the DC side, which is a well-proven configuration also in many other industries, e.g., in High-Voltage Direct Current connections or DC charging stations for EVs. However, connecting both power strings together imposes much more complexity on the configuration. The topology represents, then, a grid with multiple sources and loads, which increases mainly the control and protection system design. These characteristics are also presented in

Table 14. Maturity.

Topology	TRL (1 Lowest, 9 Highest)
1	4
2	2
3	2
4	2
5	2

.

Taking all individual topology assessments for each criteria and the defined criteria weights into account leads, with the MCDA method, to an overall evaluation, which is presented in

Table 15. Overall evaluation.

Topology	Weight	Availability	TRL	Overall Evaluation (Highest Value Is Best Score)
1	1.0	−0.5	1.0	0.25
2	0.5	−0.5	−0.25	−0.19
3	0.0	−0.5	−0.25	−0.31
4	−0.5	1.0	−0.25	0.31
5	−1.0	0.5	−0.25	−0.06

.

The criteria weight definition has a large impact on the overall assessment and depends on the priority of the decision maker to be either more risk averse or more risk seeking. For this evaluation, a rather risk-averse approach was considered to represent the high safety standards in the aircraft industry, which are essential.

In conclusion, Topology 4 has the highest overall score in the evaluation, as it is characterized with a high redundancy and therefore, has the highest safety standard, but at the same time it has a reasonable weight and a maturity level that can be brought to a high level during the next development stages.

5.5. Topology Verification

The verification is an important step to ensure that all requirements are met and that all use cases can be realized. As introduced in Section 4.5, different models such as a PSCAD model or other discipline-specific models are valuable for the verification of requirements. A special focus of this paper is safety, including reliability and degradation measures. Therefore, this verification section focusses on these safety-related aspects to demonstrate verification activities.

One important safety feature is the ability of the aircraft to realize take-off, landing and taxi activities, which require a certain level of power and energy that are both supplied from the batteries. In addition, a specific level of energy reserve needs to be available all the time during the flight in case of unexpected events. This energy reserve is defined in the mission profile of a certain aircraft type, which for a short-range AEA is approx. 2700 kWh (see Figure 9).

In this context, the verification brings together the mission profile defined in the requirements section and the failure modes analyzed for each topology. The different failure modes and their impacts on the available power and energy are defined in Table 6.

From the failure mode and effect analysis of Topology 4, the following two failure scenarios can be identified and need to be analyzed in detail as part of the verification process:

• Failure case 1: Battery or battery converter failure. Leads to 16% less power and energy availability.
  Each battery has a maximum capacity of 1922 kWh, which is 16% of the total battery capacity available in the aircraft using the selected Topology 4. In the worst case scenario, which would be at the beginning of the flight when the most overall power would be lost in the case of a battery or battery converter failure, five batteries would still be able to provide 83.3% or 9608 kWh. This is enough for a safe landing, as this amount is greater than the reserve capacity of 2700 kWh that is required as a minimum.

• Failure case 2: Bus, motor or motor cable failure. Leads to 50% less power and energy available.
  For this scenario, the energy reserve needs to be available from one string for safety reasons, as one part of the onboard system can fail, so that only half of the batteries are available for a safe landing, for which the reserve of 2700 kWh is needed. The selected Topology 4 (Figure 11d) contains two strings with three batteries, each having a capacity of 1922 kWh.To now verify that the battery sizing is correct, the worst case scenario needs to be analyzed, which is that one string fails just before landing, when most of the battery capacity is already used. At that point in time, in total approx. 6175 kWh have been used already, which is equal to approx. 3088 kWh per string. As this remaining capacity is greater than the reserve of 2700 kWh needed for a safe landing, the selected topology is verified for its suitability for the pre-defined mission profile.

5.6. Topology Improvements and Lessons Learned

It is important to analyze the results from the verification section and if needed adjust either the requirements, if one has been found that is unachievable, or redesign the topology, if not all requirements can be met. For this case study, all requirements could be met as verified in the previous chapter, so that no modification of the selected topology is required.

However, future developments in the AEA sector could lead to further topology alternatives in addition to the ones presented in this paper. For example, a higher energy density for batteries could lead to a reduced component and system weight, which might change the topology evaluation. Also, a higher DC voltage level would lead to smaller currents and thereby also to reduced losses, which might make such a topology with a higher DC voltage level more favorable than the currently investigated ones. On this basis, further power system topologies might be possible in the future and should therefore be included in a future analysis, when sufficient information is available for a detailed investigation. For these possible future topologies also, the methodology presented in this research can be utilized.

6. Conclusions

To decrease the environmental impact of aircraft, the development of more electric aircraft (MEA) and all-electric aircraft (AEA) has been accelerated and prioritized recently. However, the design of the electric power system (PS) for AEA is very challenging, especially in the early design stages, when no or only very little experience is available due to new technologies and different operational as well as environmental conditions. A methodology to overcome this has been presented in this paper, which is based on a modification factor that is calculated and then used for the assessment of AEA topologies. To ensure the systematic and all-encompassing design of possible PS topologies, Model-Based Systems Engineering (MBSE) was utilized, which proved to be valuable for the development of valid topologies. More precisely, it was possible with SysML to create system models in a unified modeling language that is independent of one discipline but rather open for the understanding of all involved parties, supporting the overall system design process. The topologies introduced in this paper have been identified as the ones that fulfil the predefined requirements and use cases best.

For the selection of the most suitable topology, a multi-criteria decision aid approach was applied, with a strong focus on long-term system behavior and degradation, which are essential aspects to achieve a safe system design, this being the main goal in aircraft design. Safety was also considered in the topology evaluations, with the criteria of safety/fault tolerance on system level and TRL/maturity. Weight has also been considered another main criterion in the aircraft industry.

With the MBSE-based methodology presented in this paper, the identified PS topologies were assessed regarding different criteria that are critical for the safe and reliable realization of the mission profile of a short-range AEA. The result of this evaluation is that the topology with three batteries, each connected to an individual DC/DC converter, showed the highest overall performance regarding the defined criteria and is, therefore, the preferred solution under the given assumptions. Further characteristics of the identified system design include a connection between both strings with a switchgear that allows disconnection during normal operation and connection in case of a fault or damage to parts of the overall PS. Additionally, each battery and converter set is connected with a separate cable to the bus bar, where the connection is realized through a switchgear.

All in all, and to answer the research question posed at the beginning of this paper, it can be summarized that this paper demonstrates the importance of early design stage decisions for the safe and efficient operation of an AEA. It has been found that the mission profile is essential, as it provides important details on the foreseen operational conditions, which are specified in the use case diagram as part of the SysML model. This model, together with the reliability analysis, is the basis for the AEA PS design. Further, a methodology as to how component and system uncertainties (for example, due to the lack of data) can be overcome was presented on the basis of MBSE, which allowed the identification of the most suitable system design for the presented case study. This evaluation of topologies was performed based on the weight, safety and TRL criteria, and it identified Topology 4 as the best one for the given operational conditions and reliability considerations.

7. Future Work

The aim of this paper was the development of a methodology and its application in the development of an AEA system design for short-range mission profiles. While the identification of a suitable design could be achieved, different challenges and further optimization possibilities have been identified.

One of the main constraints that was identified is the unavailability of sufficient data and long-term experience with PS designs for AEA, caused mainly by new technologies and different operating conditions. The first approaches as to how this could be overcome have been presented in this paper; however, further research in this area is seen as one of the main enablers for the development of AEA.

Additionally, no efficiency rates have been considered, as DC technology provides in general low losses and thereby a high efficiency. However, to further increase the PS topology as well as the sizing of the different components, the efficiency needs to be analyzed and included in the next steps of the detailed system design.

As the focus of this study was on the early design stages, the focus was on concept definition and system development. However, as a next step, the developed design needs to be defined in more detail on the component level. In this context, the specific physical design, considering the location of different components in the aircraft, also needs to be developed.

Before continuing with the development of the aircraft design in more detail, different electrical studies are advised in, for example, EMTDC software solutions like PSCAD, to study in detail the failure cases that have been identified and their impact on the PS.