System-Level Reliability Assessment of Short Duty Electric Drives for Aerospace

The reliability performance of electrical machines (EMs) and power electronics converters (PECs) is generally verified separately even if the two components are meant to be part of the same electric drive. Depending on the application, however, it might be necessary that the whole drive fulfills a certain reliability target, which is predefined by the application itself. An appropriate design approach should involve joint efforts between machine and converter designers so that the final product is as optimized as possible while still satisfying reliability constraints. In this work, a system-level reliability study for short duty electric drives is proposed and implemented using an aerospace electromechanical actuator as a case study. Concepts of statistical postprocessing for the lifetime prediction of power modules are discussed throughout. In addition, accelerated lifetime tests on EM windings are performed for predicting the motor insulation’s time to failure. For the short duty aerospace drive under investigation, i.e., case study, it is finally verified that the PEC represents the reliability bottleneck.

examples can be found in the transport and medical fields. In other areas, such as industrial applications, failure and breakdown are also always to be avoided as this might cause extensive economic loss. It is therefore clear that the push toward ever-more reliable drives is critical for all industries.
The reliability assessment of PECs has been an important research topic within the scientific and industrial communities for some decades, particularly in the aerospace and military sectors. Historically, reliability analyses for electrical systems in aircraft were carried out based on guidelines provided in military handbooks [1] and/or based on the rule of thumbs founded on data deriving from (often outdated) surveys. This approach, which has been the common practice for the last few decades, usually assumes that systems and components have a constant failure rate [1]. This is highly inappropriate for the analysis of modern converters [2], where it usually results in unacceptable discrepancies between the real and the predicted lifetime figures. These failure-rates data sets are nowadays completely outdated, as they refer to devices and manufacturing technologies belonging to the last century.
A relatively modern and effective strategy for studying the reliability of PECs consists in exploiting the physics-offailure (PoF) philosophy [3], [4]. Essentially, the lifetime of a component (e.g., power modules, diodes, and capacitors) is assessed by investigating the "real physics" behind each failure mechanism, as well as the impact of manufacturing technologies, materials, stress profiles, and all the factors that might have an influence on the market-ready product's lifetime. Manufacturers of PECs' components very often provide reliability data, which, combined with PoF-based models, allow the user to have an accurate reliability assessment [5]- [7].
From an EM perspective, the situation is somehow similar, although in this case, it is necessary to make a clear distinction between failures of mechanical and electrical nature (i.e., the two principal failure causes). The former mostly refer to the bearings, whereas the latter to electrical insulation issues. In large power generators and industrial induction motors, bearings are identified by various surveys as the main cause of failure [8], [9]. On the other hand, regular maintenance (e.g., lubrication) scheduling can considerably extend the bearings' lifetime. In addition, if the EM operating cycle and the shaft mechanical loadings are known, then the time to failure can be 2332-7782 © 2021 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
predicted with a discrete accuracy [10]- [12]. On the contrary, the EM's winding insulation is a weak and complex system [13]. Its lifetime depends upon thermal, electrical, mechanical, and ambient stresses, which can act as stand-alone as well as in a combined manner [14]. It is thus clear that the reliability evaluation and design of the insulation system are not a trivial task. The sheer number of phenomena at play, ergo the multiphysics nature of the "problem," makes it truly complex. This process can, however, be somehow simplified if a single stress aging model is assumed. Insulation systems are usually subjected to thermal, thermomechanical, electrical, and ambient stresses. If, for any particular situation, any one of these stresses is dominant, then one can safely assume the use of a single-stress model to be appropriately representative of the whole aging mechanism. Assuming the insulation as the main reliability bottleneck, then, similar to PECs, a PoF-based design strategy can significantly improve the lifetime/reliability levels in EMs [15]- [17]. For PoF-based analyses, an important requirement is the knowledge of certain parameters that are critical for the methodology. Manufacturers of the power modules for PECs publish such data quite freely. However, most magnet wire (i.e., enameled wire for EM winding) and insulation providers, today, only provide the thermal class of the insulating material. In other words, the "lifetime" and "degradation" data sets available today are not sufficient for performing a PoFbased reliability assessment of insulation systems. Indeed, with reference to the winding insulation, as clearly stated by technical standards [18] and proved by practical experience [19], the magnet wire insulation lifetime can largely differ from the one of the EM in which it is installed. Thus, the reliability assessment of an EM needs to be necessarily based on data deriving from accelerated lifetime testing (ALT) [20].
All the above mainly addresses and gives considerations for reliability assessments at component level, i.e., primarily focusing on either PEC or EM. Various other works [21]- [24] propose and develop methodologies for similar objectives, but always at component level. Nonetheless, the combination (in reliability terms) between PEC and EM should be investigated for achieving a comprehensive lifetime assessment.
This work thus represents a first attempt in performing a system-level reliability analysis of VSDs. PoF-based lifetime prediction models for both PEC and EM are built and then combined. In this article, it is shown how this strategy, by providing an overall overview of the drive's reliability, can help in coordinating the design choices at the component level. The studies are all done for VSDs working with short duty applications, where the main dominant aging factor is the power (thermal) cycling. Thus, a single stress aging model is considered for both the PEC and EM. These short duty VSDs represent a large portion of electric drives installed in the socalled "more electric aircraft" [25]- [27], as they are employed in, e.g., primary and secondary flight control surfaces [28], landing gear mechanisms [29], electric taxiing systems [30], and so on.
The main contributions of this article are: 1) the derivation of the Weibull distribution of failure times for power modules; 2) the experimental calibration of the Arrhenius-Miner lifetime prediction model and the extraction of the Weibull reliability function for EMs' windings operating with nonconstant temperature profiles; and 3) the system-level reliability assessment for a study-case aerospace drive, presented through a cumulative failure probability matrix, which allows to clearly identify the reliability bottleneck for several stress levels. With specific reference to 1), what differentiates the presented approach from the common practice is that the parameters of the Weibull distribution (i.e., scale and shape factor), for a study-case IGBT module, are obtained from a power cycling capability curve. This allows to evaluate the module's cycles to failure at any desired failure probability (based on the application's reliability requirements) and/or perform any kind of reliability assessments, including the computation of the cumulative failure probability. What proposed here can be thus extremely useful to PEC designers, as module manufactures publish and/or provide these lifetime data sets quite openly. The demand of aircraft manufacturers for system-level reliability evaluation is met through the introduced methodology, which combines PoF lifetime models and statistical considerations providing an approach not fully explored in the existing literature.
After a theoretical introduction regarding the life modeling for short duty drives (Section II), the analysis is initially carried out at component level in Sections III and IV for PEC and EM, respectively. The obtained results are then combined in Section V, where the reliability of a study-case short duty aerospace drive is assessed. This article concludes by describing the applicability and limits of the proposed methodologies (Section VI).

II. LIFETIME MODELING OF SHORT DUTY DRIVES
This work is focused on VSDs developed for short dutycycle, aerospace applications. The two main components in such a system are the inverter and the EM. In fact, in a "more electric aircraft," VSDs are fed from the dc side of the grid (i.e., generally, the rectifier is not part of the drive) [31].
The VSD operating cycle is defined according to the EM's duty. In a short duty EM, a single mission lasts for a fraction of its thermal time constant (i.e., the time necessary for the winding to reach 63.3% of its steady-state temperature). Important examples are electromechanical actuators (EMAs) for aeronautic applications, e.g., for primary and secondary flight control surfaces actuation, landing gear extension/retraction mechanisms, and so on. In these drives, the EM is required to deliver a high level of torque in a relatively short amount of time, which is generally below 1 min [28]. Typically, EMs for aerospace EMAs are naturally air-cooled (i.e., passive cooling) for avoiding the reliance on complex cooling infrastructures and for enhancing the overall reliability [32]. A number of EMAs, particularly those actuating flight control surfaces, are installed in unpressurised sections of an aircraft. If the VSD is properly designed for avoiding partial discharges (PDs) inception [33], then the variation in environmental condition throughout a flight does not represent an issue in terms of reliability (the low temperature at high altitude is actually beneficial for cooling purposes). In addition, the external temperature-time gradient experienced by a climbing aircraft is generally mild (i.e., <0.06 • C/s for a commercial mid-sized aircraft, e.g., Boeing 737).

A. Power Cycling in PECs
The semiconductors switching devices together with the capacitors are the two "reliability-critical" components in a PEC [4], [34]. Insulated-gate bipolar transistors (IGBT) modules are largely employed as switching devices in PECs, for applications ranging from fractional-kW motor drives up to multimegawatt wind power converters. The typical layout/cross section of a power module is shown in Fig. 1 [35]. Power cycles, with relatively short duration (i.e., from few seconds up to 1 min [6], [7]) and high power demand, are a major source of stress on the aluminum bond wire. These cycles cause a large variation of the junction temperature θ j in a short time, which can degenerate in the module's failure caused by junction fatigue [36], [37]. In fact, because of the mismatch in thermal expansion coefficients between silicon and aluminum, a strong plastic strain is induced on the bond wire as a result of temperature swing. If one neglects the elastic strain, then the junction's plastic strain can be calculated as in (1), where L typ is the typical length of the joint, CTE is the difference in thermal expansion coefficients between aluminum and silicon, and θ j is the junction temperature swing [37] ε ≈ CTE ·L typ · θ j . (1) The number of cycles to failure n can be then related to the plastic strain through an empirical inverse power law described by where k 2 is a positive coefficient. Thus, by replacing (1) in (2), one obtains the standard form of the Coffin-Manson model, as in (3), where k 1 and k 2 are two empiric coefficients, which are either extracted by ALT or from life data provided by power modules manufacturers The only input of the Coffin-Manson equation is the junction temperature swing (i.e., variation) [38], [39]. This model does not account for the effect of the absolute (average) junction temperature, which can also have an influence on the number of cycles to failure. This means that (3) should only be employed when the peak of the junction temperature swing does not exceed 120 • C [37], [38]. To note that various, more complex lifetime models have been proposed in the literature for analyzing the lifetime of IGBT modules subject to power cycling [38], [40], [41], but, for the sake of computational simplicity, these are not considered here.
The temperature swing can be predicted using electrothermal models or tools provided by modules manufacturers, and however, the latter are usually designed to consider worst case scenarios and thus excessively overestimate the temperature [35]. The electrothermal model is built according to the converter layout and heat sink arrangement. It receives as input the current profile and provides the junction temperature swing according to the module's conduction and switching losses.
The sole knowledge of n is not sufficient for carrying out a comprehensive and detailed reliability assessment. In fact, the number of cycles to failure (i.e., n) generally refers to a single probability of failure, and thus, it does not allow to compute any comprehensive evaluation of the cumulative failure probability. Such limitation is addressed via a statistical postprocessing analysis, which is discussed and performed in Section III.

B. Thermal Cycling in Low-Voltage EMs
Thermal cycling can have a different impact on EMs' insulation lifetime, depending on whether they are rated for high (>1 kV) or low voltage applications. High-voltage EMs are commonly employed in high-power applications (in the megawatt power range) and can have very large physical sizes. For this reason, and because of their winding layout (i.e., form wound), they can show relevant phenomena of thermal expansion mismatches among various materials (e.g., copper and ground-wall insulation). These are then superimposed to the detrimental influence of the absolute temperature. Thus, their lifetime needs to be modeled through a multistress model, which includes both thermal stresses and thermally induced mechanical stresses, also known as thermomechanical stresses. Very importantly, it must also be considered that insulation for high-voltage EMs is usually very prone to be exposed to PD activity [42], and therefore, a truly comprehensive lifetime prediction model should also incorporate the effect of extrinsic electrical stress. On the other hand, low-voltage EMs are conventionally manufactured by adopting organic insulation. These are therefore only operated in a PD-free regime throughout their whole lifetime [43].
The thermally activated chemical reactions involved in the aging process are related to the insulation's absolute temperature through the Arrhenius law. The latter links the chemical reaction rate coefficient R with the reactants' temperature, and it can be seen as an indicator of the "reaction's speed." The reaction rate coefficient is calculated according to the following equation [44]: where A is the defined frequency factor, E a is the activation energy of the dominant chemical reaction, θ is the absolute temperature, and k B is the Boltzmann constant. The insulating material lifetime L is inversely proportional to R through a constant C [45], and it is determined according to the Dakin equation [46], expressed as in the following equation: where A is the preexponential term (i.e., the ratio C/A ) and B is the ratio E a /k B . Therefore, if the lifetime L is plotted against the absolute temperature in a logarithmic chart, it will result in a straight line with slope equal to B. Such a thermal endurance plot allows predicting the insulation's time to failure, for a fixed end-of-life criterion and any selected temperature (within the model's limits). The parameters A and B of (5) need to be experimentally identified through accelerated thermal aging tests. The experimental evaluation requires that (at least) two sets of samples are thermally aged and their time to failure is recorded. Then, relying on a suitable curve fitting procedure, A and B are determined [47].
The standard Arrhenius-Dakin model [see (5)] is not directly applicable to time-varying temperature profiles, but it needs to be modified as discussed in the following. Given a generic temperature profile, as shown in Fig. 2, the entire time pattern can be divided into infinitesimal time intervals, ranging from a generic time t i to a time t i + dt. Within the infinitesimal time interval dt, the temperature is assumed to be constant and equal to θ w (t i ). Thus, the loss of life fraction in the infinitesimal time interval dt can be calculated as in (6) Therefore, the loss of life fraction for a generic temperature profile, whose time duration is tcycle (see Fig. 2), can be calculated by integrating dLF over the entire time pattern, as reported in the following equation: The number of cycles to failure can then be derived relying on the cumulative damage law (i.e., Miner's rule) [48], which states that the insulation reaches its end of life once the sum of damage fractions (i.e., LF cycle ) equals one. A simplifying assumption can be made if one considers the EM operating with a fixed temperature profile throughout its lifetime. In such a case, the number of cycles that leads to the interturn insulation failure can be determined as in the following equation: To note here that if one wants to convert the cycles to failure to the time to failure, in unit measure of time (e.g., seconds, minutes, or hours), then it is simply necessary to multiply n coil by tcycle . Therefore, the EM lifetime assessment can be done by knowing: 1) the winding temperature profile corresponding to a single mission and 2) the parameters A and B of the Arrhenius model. Point 1) can be easily fulfilled by using the lumped parameter thermal network of the EM, as reported in [49] and [50] or any other thermal modeling tool, whereas, for satisfying point 2), it is necessary to perform ALT. This latter aspect will be discussed in Section IV.

C. Additional Considerations
In a typical VSD, in addition to bond wire liftoff and thermal aging of the EM's insulation system, another important failure mode is that represented by the dc-link capacitor. A main critical stressor in a properly designed dc-link capacitor is the absolute temperature [51]. Accordingly, its lifetime (at a chosen probability) is conservatively modeled through (9) (valid for both electrolytic and film capacitors), where θ C is the operating temperature and LC 0 is the lifetime corresponding to the test temperature θ C 0 [52] A standard lifetime figure (at 10% probability) for an aerospace grade capacitor is 5000 h for a test temperature θ C 0 of 125 • C [53]. Therefore, because of the limited time duration of a single mission in a short duty VSD (i.e., <1 min), the expected number of missions to failure results extremely large (e.g., for θ C = 40 • C and a mission of 20 s, the expected number of missions to failure would be 3.26 × 10 8 ).
Due to the above consideration, the failure mode affecting the dc-link capacitor is not included in this work, which focuses exclusively on short duty VSDs. Furthermore, the various components within the PEC (e.g., IGBTs and capacitors) can have cross-effects in terms of reliability [40]. Thus, focusing on a single component represents the "standard practice" [40], as it simplifies considerably the reliability assessment.

III. STATISTICAL ANALYSIS OF POWER MODULES LIFETIME DATA
After having identified suitable lifetime prediction models for EM winding insulation and IGBT modules, in this section, a procedure for deriving the failure probability of IGBT modules will be proposed.
The Weibull distribution is a powerful tool for reliability analysis, and it is largely adopted in electrical engineering [20]. A major advantage of this statistical distribution, particularly suitable for power modules life analysis, is the ability to model either increasing, decreasing, or constant failure rates. It is also a very elegant and efficient methodology in terms of processing and presenting data. The Weibull cumulative distribution function (CDF) (or unreliability function) is described by (10), where β is the shape factor and α is the scale factor, representing the 63.2th percentile of failure time (i.e., the time by which 63.2% of analyzed objects/specimens will reach their end of life) [54] The CDF essentially provides the probability of failure (or unreliability) of a device/system at any time instant t > 0. When analyzing module failures, caused by power cycling, the time in (10) can be conveniently replaced by the number of cycles. Determining the power module CDF is an essential prerequisite for carrying out an accurate reliability study, as will be shown in the remainder of the discussion. Very often, power modules manufacturers provide the power cycling capability curve, relative to B x of lifetime [5], namely the number of cycles by which x% of modules of a population will fail. The power cycling capability curve relative to a family IGBT modules from a well-known manufacturer is shown in Fig. 3 [6]. In this case, "FT = 1%" indicates that the reported capability curves are relative to B 1 of failure time.
Therefore, such a power cycling curve is not enough for extrapolating the Weibull CDF of a power module. However, some mathematical processing can be implemented to address the shortcoming as follows. Given a generic B x of failure time (or cycles to failure), the equality given in (11) must be satisfied By applying the natural logarithm to both sides of (11) and rearranging, the scale factor can be calculated as in the following equation: Equation (12) can be rewritten as in (13), where α( θ j ) is the time to failure at 63.2% probability for a known stress θ j (i.e., junction temperature swing) and B x ( θ j ) is the corresponding time to failure for the xth percentile, which can be identified on the power cycling capability curve When the manufacturer provides β of the Weibull distribution [55], which is an indicator of the failure mode [20], (13) can be easily solved, and thus, the CDF can be computed. Conversely, if the shape parameter is not available, then there are two options depending on whether or not the power cycling curves are available for at least two different percentiles.
In the first case, i.e., when the power cycling curve is provided for two percentiles x 1 and x 2 , as reported in [5] and [39], then the shape parameter β can be calculated by applying twice the natural logarithm to (10) and rearranging the equation as in the following equation: By introducing the auxiliary variable y(t) defined in (15), (14) can be then rewritten as detailed in (16), which represents the standard equation of a straight line It is worthy to point out that for a generic percentile of failure time x, the CDF F(t) is equal to x/100 by definition. Since the power cycling curve is available for two different percentiles of failure times x 1 and x 2 , whose corresponding number of cycles to failure (i.e., ordinate of the power cycling curve) at a chosen stress level θ j is t 1 = B x1 ( θ j ) and t 2 = B x2 ( θ j ), respectively, then the system of equations reported in (17) can be obtained Therefore, the Weibull shape factor β can be easily determined by subtracting the second equation in (17) from the first one and rearranging as shown in the following equation: The last option, when the power cycling curve is only available for a single percentile of failure time, consists in selecting a β value consistent with the considered failure mode (in this case the bond wire liftoff) since a given failure mode, generally, will result in a similar β, even for different IGBT modules [40]. This approach is called Weibull-Bayesian or "Weibayes," and it is largely employed when one or both parameters of a Weibull distribution are unknown [56]- [58]. The Weibull-Bayesian approach can deliver excellent accuracy because the physics behind the analyzed failure mode is established/acknowledged through prior experience [20], [59]. Alternatively, Monte Carlo simulations can be used to quantify the parameters of the Weibull distribution, as discussed in, e.g., [60], but this methodology is not addressed here. Table I reports typical β values corresponding to the bond wire liftoff failure mode for various IGBT power modules, obtained from existing literature and manufacturers' datasheets. From Table I, it can be observed that β relative to the bond wire liftoff in IGBT modules is greater than one, indicating an increasing failure rate (i.e., hazard function). This confirms that assuming an exponential distribution of failure times (i.e., constant failure rate), as done in [1], is an erroneous procedure. Independently of the adopted computation method, once the Weibull shape parameter is available, the module's CDF (and thus its probability of failure) relative to the bond wire liftoff can be extracted through (10) for any applied stress θ j .
The CDFs corresponding to the power cycling curve shown in Fig. 3 are plotted in Fig. 4 for two different stress levels (i.e., θ j equals 30 • C and 40 • C). In this case, the Weibull shape factor is fixed to 4.5, according to Table I. From the CDF, the failure probability after any number of cycles can be extrapolated. As an example, for the analyzed IGBT modules, after 10 8 cycles with a θ j = 30 • C, there is a probability of failure higher than 10% (i.e., the "popular" B 10 of failure time). It is worth remarking that the derived CDF is valid only for very short duty cycles, leading to the bond wire liftoff being the predominant failure mode.
For the sake of clarity, Fig. 5 shows a flowchart that summarizes the proposed procedures for computing the module's Weibull CDF. Once the CDF is known, the module's cumulative probability of failure (i.e., one reliability) after any number of cycles can be predicted and any B x of failure time (e.g., B 1 and B 10 ) can be estimated. Based on the "standard" procedure, the power cycling capability curve (see Fig. 3) would have only allowed to predict the number of cycles to failure at a fixed probability (i.e., 1% or "B 1 "). On the contrary, the proposed procedures allow obtaining a CDF of failure times, from which the module's cumulative probability of failure (i.e., one reliability) after any number of cycles can be predicted and any B x of failure time (e.g., B 1 and B 10 ) can be estimated.

IV. AGING TESTS FOR THE EM LIFETIME EVALUATION
On the EM side, the situation is slightly different. The only data available from insulation systems manufacturers are the thermal endurance plot of the insulating material. However, this is not sufficient for predicting the thermal lifetime of the complete EM [18], [61]. Therefore, in this case, ALT performed on suitable specimens is necessary for the lifetime prediction. Once the parameters of the Arrhenius model [i.e., A and B of (5)] are identified for the considered insulation subsystem, one can eventually conduct a comprehensive reliability assessment.
An elegant and precise method for predicting the failure probability of an electrical insulation exposed to thermal stress is commonly defined as "graphical data analysis" [20]. This name reflects the importance that such graphical methodologies "enjoyed" in the recent past. With the availability of modern computational software, this procedure can be developed in a much more accurate fashion.
As a first step, it is necessary to plot the experimentally recorded failure times, relative to (at least) three aging temperatures on a single Weibull probability graph. Then, the three groups of failure times (i.e., one for every temperature) are fitted through as many regression lines. The slope of the three regression lines should be identical and equal to the one that  better fits the experimental data (i.e., the vertical deviations between the line and the plotted points should be as small as possible [20]). A common regression slope indicates a single failure mode among the specimens, independently of the stressing temperature. This, in turn, validates the suitability of the Arrhenius model (4), which is based on a dominant chemical reaction involved in the thermal aging process.
Recent work [19] has proved that the lifetime data coming from ALT are strongly influenced by the specimen's layout adopted during the testing campaign. With the aim of tuning the Arrhenius model for the interturn insulation subsystem of low-voltage EMs, thermal ALT on class 220, 0.4 mm diameter, and grade 2 random wound coils was performed, as shown in Fig. 6. This specimen layout delivers the most conservative lifetime results for thermal aging [19]. This specific choice allows to partially compensate for having overlooked other insulation stress/aging factors, such as mechanical vibrations and humidity.
Three sets of 12 specimens each are thermally aged in a ventilated oven at three constant temperatures above the wire's insulation thermal class until the interturn insulation failurethat is the dielectric breakdown-is detected. The ALT failure times, for the three temperatures, are reported in a probability plot, as shown in Fig. 7. These experimental data points are fitted through three Weibull probability distributions, whose common shape factor is equal to 3. Table II lists the obtained ALT results, which were collected throughout several hundreds of hours of testing. Although this might seem a relatively long time span, the collection of "on-field" data would have lasted several orders of magnitude longer than the performed campaign, leading to an extensive economical effort. The thermal endurance plot (i.e., Arrhenius curve) of the winding specimens is easily obtained by regression of the ALT data, as shown in Fig. 8. It can be clearly observed that, independently of the percentile of failure time, the endurance curve slope is constant, indicating that B in (5) does not change with the percentile, and it is equal to 16 746 K. This result is expected since B is directly proportional to the activation energy of the main chemical reaction involved in the thermal degradation process, and thus, it does not depend on the considered percentile of failure time. On the other hand, it is possible to note a shift along the y-axis for the three endurance curves. This indicates that the parameter A in (5) is related to the percentile of failure time. In this case, A for the 63.2th percentile of failure time (i.e., α of the Weibull distribution) is equal to 8.65 × 10 −12 h.
With the availability of the Arrhenius equation parameters, the winding insulation lifetime assessment can be carried out for any applied stress, i.e., temperature or temperature swing. What differentiates the presented approach from the standard practice is that the latter would have only allowed to compute the insulation's time to failure at a fixed probability (e.g., mean time to failure), while through the proposed approach, one can  compute the failure time (or cycles to failure) at any desired probability by exploiting the Weibull CDF. Section V will report an application example of the proposed approach.

V. SYSTEM-LEVEL RELIABILITY: AEROSPACE STUDY CASE
This section aims at outlining the implementation of the proposed lifetime prediction procedures. The reliability assessment is carried out on a real electric drive study case. The final objective is to evaluate the system-level reliability under various thermal stress magnitudes, thus determining where the drive's "reliability bottleneck" actually is.

A. Drive Description
The analyzed application is an aerospace EMA used for the landing gear extension/retraction mechanism in a modern rotorcraft. For the purpose of this work, the drive is configured to operate as a standard three-phase system (i.e., the EM is fed by a conventional three-phase inverter), although the original drive can also operate as a dual three-phase system. The drive's design parameters are listed in Table III. The EM is a 12-slot 10-poles permanent magnet synchronous machine (PMSM), as shown in Fig. 9, while the PEC employs commercial IGBT modules, whose power cycling capability curve is the one reported in Fig. 3. Considering the dc-link voltage level and the low-altitude operation, then the EM's insulation system can be safely assumed to be free from PD inception [43]. This justifies the adoption of a single stress aging model for the insulation system.
The EMA is activated for a short time during each mission, namely 20 s, which is the time necessary for the extension/retraction of the landing gear. During the activation time, it is assumed that the winding is (continuously) fed by the EM's rated current (i.e., constant torque operation).

B. System-Level Reliability Assessment
The reliability assessment for the EM interturn insulation will be carried out for various temperature swings θ w , by fixing θ w−m = 70 • C and T cycle = 40 s (see Fig. 2).
The number of cycles to failure, for a single coil, during an activation cycle is calculated by (7) and (8), using the A and B parameters given in Table II. The obtained results are summarized in Table IV. Since the EM winding comprises a total of six coils (see Fig. 9), its number of cycles to failure is obviously lower than that relative to a single coil. In fact, a reliability series structure is at most as reliable as the least reliable of its component [54]. Therefore, from the reliability point of view, the EM winding can be considered as a series system with six statistically independent components (i.e., coils) characterized by the same Weibull life distribution [20]. The EM Weibull distribution will have a shape factor β equal to the coil's one (i.e., β = 3), while its scale factor (i.e., number of cycles by which 63.2% of EMs in a population will fail) can be determined as in the following equation: For each of the assumed stress levels θ w , a Weibull CDF can be determined by replacing β = 3 and α = n EM in (10). For the considered study case, a probability of failure of 10 −9 is imposed as a design target, given its safety-critical nature [62]. This failure probability should be computed at the end of the useful EMA life. Assuming that the PMSM needs to operate for 20 000 cycles (i.e., 10 000 flights considering a retraction and an extension per flight) before being replaced/serviced, its probability of failure can be derived by the Weibull CDF (10) rearranged as in the following equation: where β = 3. Regarding the PEC, each IGBT (single transistor) is characterized by the lifetime curve shown in Fig. 3 (curve relative to θ j min = 25 • C). Because of the relatively short activation time, it can be safely stated that the prevailing failure mode is the bond wire liftoff. Thus, a Weibull shape parameter equal to 4.5 is fixed (see Table I). On the other hand, the scale parameter will depend on the applied stress θ j and can be calculated using (13). Since the three-phase inverter features a total of six IGBTs (i.e., transistors), similar to the EM, it can be (conservatively) considered as a series system  V   SINGLE IGBT AND THREE-PHASE INVERTER CYCLES TO FAILURE FOR  VARIOUS STRESS LEVELS (63.2TH FAILURE PERCENTILE) formed by six statistically independent components. Thus, the inverter's Weibull scale factor, for any temperature swing, can be determined using (19). The number of cycles to failure versus applied stress, corresponding to the 63.2th percentile of failure time, is listed in Table V for both the single IGBT and the three-phase inverter.
It is worth remarking that the 63.2th percentile is necessary for computing the Weibull CDF from which any other percentiles (i.e., B x ) of failure time can be derived, according to the application's reliability requirements. Equation (20) can be readapted by substituting n EM with n inv and β = 4.5 and thus calculating the inverter's cumulative failure probability after 20 000 missions, which is imposed as lifetime target for the study-case electric drive.
The results reported in Tables IV and V can be eventually combined and the system-level reliability assessment can be carried out. The drive's probability of failure for various stress combinations can be verified. Indeed, the system reliability is the product between the EM and PEC reliabilities since they are considered as two statistically independent series components. Thus, their combined probability of failure can be calculated by the following equation: where F EM (t) and F PEC (t) are the machine and converter CDFs, respectively. Equation (21), therefore, intrinsically accounts for the probability of failure variation of the two components (i.e., EM and PEC) throughout their lifetimes. Being the two components in series (in reliability terms), the VSD represents the weakest link system because the failure of one component (i.e., EM or PEC) will result in the VSD failure. Clearly, if the thermal networks/models for both machine and converter are built, the lifetime evaluation can be implemented by assuming the actual stress(es) arising during a real mission, according to the scheme reported in Fig. 10.
Aiming at being as general as possible, no information on the thermal management and modeling of the drive's components is provided in this work, which only focuses on the reliability assessment (i.e., green blocks in Fig. 10). Thus, a failure probability matrix, deriving from the combination of EM and PEC failure probabilities [i.e., calculated according to (16)] is determined. For representation clarity, the latter is reported in a visual manner as a 3-D plot, which is shown in Fig. 11. From this figure, a number of insightful considerations can be made, as reported in Section V-C.

C. Discussion
First of all, it can be noted that for low stresses on the converter, that is, θ j ≤ 20 • C, the drive's probability of failure is only governed by the EM winding failure, caused by temperature swing. The failure probability rises dramatically as the winding stress θ w increases. However, even for the largest considered stress on the EM side, namely θ w = 70 • C, the system's probability of failure is well below the critical level of 10 −9 . This clearly indicates that in this condition, the drive is overengineered, as its reliability is way above the application's lifetime target.
For junction temperature swings above 20 • C but below 40 • C, various behaviors can be noted. Namely, for low stress on the machine winding ( θ w ≤ 40 • C), the drive reliability essentially corresponds to the converter's one. On the other hand, if the EM winding temperature swing is raised above 40 • C, it starts to have an impact on the drive's probability of failure (i.e., the failure probability increases with θ w ). Even, in this case, there is a wide safety margin before hitting the critical failure probability level of 10 −9 . Hence, the stress on both EM and PEC can be thus enhanced by reducing weight and cost of the cooling system(s).
Interestingly, for any θ j above 40 • C, the system-level reliability is not influenced at all by the stress on the EM side. In other words, the PEC is the sole component defining the reliability of the entire drive, independently of the EM winding temperature. This result might at first glance indicate that the EM is overengineered, and its winding could eventually operate at higher temperature. This is partially true, as the winding insulation is declared by the manufacturer as class 220 • C, while the maximum considered hot-spot temperature is 140 • C (i.e., 70 • C temperature swing starting from a temperature of 70 • C).
Nevertheless, it is important to remark that the activation time for the study-case drive is only 20 s, and thus, in the worst case scenario, the winding experiences a temperature gradient of 3.5 • C/s. Any value larger than this would be highly improbable given the EM's core thermal inertia [63]. On the contrary, the IGBT junction could theoretically experience a larger rate of temperature variation. Table VI tabulates these considerations and visually shows the impact of the components on the system-level reliability for various stress ranges. In Table VI, the "small" letters represent low impact, whereas the "larger" letters represent high impact.  The obtained results suggest that for the considered case study, the reliability bottleneck is very likely to be the PEC. As the IGBT junction temperature swing rises, the EM winding deterioration plays an ever-decreasing role on the drive's probability of failure-becoming practically negligible when the junction temperature swing goes above 40 • C. At first glance, one might then assume that, based on the above, the EM lifetime modeling could be neglected in the systemlevel assessment for short duty drives. However, it must be pointed out that the obtained results are strictly valid for the considered study case. If the machine were to be designed by adopting lower class insulation, then its impact on the drive's reliability would be more marked. Thus, it is always suggested, when possible, to include also the machine in the reliability assessment.

VI. APPLICABILITY AND LIMITS
The presented investigation represents a first attempt in modeling the lifetime of a complete electric drive. In principle, in order to fully validate the proposed methodologies, "onfield" data would be required. However, their availability is subordinate to practical and economic challenges, such as several thousands of (identical) VSDs should be installed on as many operating aircrafts, these aircrafts should operate for thousands of hours, and the VSDs' failure times need to be recorded and made public. It is clear that in the short term, this approach for reliability assessment is difficult to implement and its adoption might be premature, due to the limited number of VSDs currently installed on aircraft. Therefore, the presented work strongly argues for a PoF-based design methodology. Namely, if the physics behind a failure mode for a given system is well understood, then the system can be stressed at a higher level in laboratory environment for obtaining life data in a relatively short time and limiting the economic effort [64]. Hence, the "on-field" lifetime/reliability can be precisely predicted through well-known and widely recognized physical and empirical laws (in the case of this article, the Arrhenius and the Coffin-Manson models that are both largely employed in industry and academia).
The presented study has twofold applicability. This is summarized as follows.
1) In a postdesign scenario (i.e., if the drive configuration is already given), applying the proposed methodologies allows predicting which component represents the "reliability bottleneck" and thus schedule its maintenance accordingly. 2) At the design stage, the proposed methodologies can enable the optimization of both machine and converter for fulfilling the reliability target without reliance on overengineering measures. Indeed, materials, cooling arrangement, and control strategy can be properly selected for satisfying the torque/speed requirement as well as the reliability target.
For illustration purposes and for proving the strength of the proposed methodologies, the case-study's cumulative failure probability for θ w = 60 • C and θ j = 25 • C is computed through (21) and plotted in Fig. 12. From this plot, important information can be extrapolated. Indeed, for any number of missions, it can be verified if the systems' reliability satisfies the application's reliability target and which component represents the reliability bottleneck and thus improve its design or schedule a more frequent maintenance. In particular, it can be noted that up to 8 × 10 6 activations, it is actually the machine that has a higher failure probability than the converter. Thus, it is not obvious that the converter is always the bottleneck, but this needs to be actually verified case by case, by adopting the approach presented in this work. Despite this study being based on well-assessed physical and empirical laws/models, it should, however, be applied with cautions, being careful to not exceed some applicability limitations. For the EM, it has been assumed that the time to failure is directly related to that of the winding interturn insulation, caused by thermal aging. It is of critical importance that there is no inception of PD throughout the whole EM useful lifetime. In this case, the predominant failure mode would be the interturn insulation breakdown triggered by the extrinsic (i.e., "unwanted") electric stress. The latter would also prevail on the IGBT bond wire liftoff failure mode since organic insulations subject to PD activity can fail within few hours.
The Coffin-Manson model has been used for predicting the IGBT life. As well known, this model neglects the effect of the average junction temperature on the lifetime. However, if applied for maximum junction temperatures below 120 • C, it can potentially deliver fair estimations [37], [38].
In this article, extreme care has been taken to not exceed this limit for the presented data (the considered maximum junction temperature is 95 • C). Overall, in this work, it has been assumed that the converter can fail only because of its IGBTs. Nonetheless, a comprehensive lifetime evaluation should also at least include the dc-link capacitor and the PCB. Assuming zero probability of failure for the two aforementioned components, in this work, it was still proved that the PEC is more likely to fail than the EM, for the analyzed study case. Thus, the choice of focusing only on the bond wire liftoff failure mode represents a fair compromise between computational effort and accuracy. An additional simplifying assumption has been made when considering the electric drive operating under the same level of stress throughout its whole lifetime. In other words, for each point in the matrix reported in Fig. 11, the probability of failure is provided by assuming that the EM is subject to a fixed temperature swing during every mission, and the same happens for the PEC. It is very important to note that this kind of operation is actually not at all far from reality for the considered application (i.e., landing gear). Here, the actuator requires the same amount of force/torque in each and every mission. Furthermore, EMs for safety-critical aerospace applications are generally sized both thermally and electromagnetically assuming the worst case operating condition, namely the highest expected torque/force level as well as the highest ambient temperature [28], [50]. However, for applications with highly variable loads, a differ-ent lifetime modeling approach is required. This can be, e.g., the adoption of the rainflow cycling method, which is widely addressed in the literature [21], [40], [65].

VII. CONCLUSION
The fulfillment of reliability targets is one of the main challenges that electric drives designers face, particularly when working on modern safety-critical applications. The machine and the converter, constituting an electric drive, are generally assessed from the reliability point of view as being two standalone devices rather than a single system. This work proposes a strategy where the PoF of both EMs and converters is combined for performing a system-level reliability evaluation. Thorough statistical methods, aiming at determining the CDFs of failure times, are used for fulfilling such task. An aerospace study case is introduced and analyzed for facilitating the implementation of the proposed techniques. Interestingly, it is found that for the considered electric drive, the main reliability bottleneck is represented by the PEC. When junction temperature swings beyond 40 • C are experienced, then the impact of the machine on the drive's reliability is almost negligible.
For an optimized design, without reliance on overengineering, it would be required that the machine's probability of failure matches the converter's one and both combined (as a series system) can satisfy the application's reliability target. The methodologies and procedures presented in this work, if properly readapted according to the desired application, can represent a powerful tool for the design of high powerdense and reliable electric drives. Future work will focus on analyzing the reliability of drives operating under continuous duty, where additional failure modes are going to be included in the reliability assessment.