Concept illustration
Read diagram notes
- Source A: First proposed battery path; observation alone does not prove continuity.
- Source B: Second proposed battery path; its independent contribution remains to be established.
- Shared distribution dependency: Both paths may share connectors, regulation, enclosure or routing.
- Required consumer function: Continuity depends on the assessed failure and complete path, not source count.
A proposed large fixed-wing inspection aircraft has two batteries, and its preliminary design calls the power system redundant. In this hypothetical review, both batteries appear to feed one distribution assembly. The useful question is not how many source icons appear on the drawing. It is which required functions remain supported under each assessed failure and which dependencies both paths still share. This article organizes that review without claiming a reliability figure or certified architecture.
Separate sources versus shared interfaces
Trace each proposed source to the consumers it is intended to support. Mark shared connectors, distribution assemblies, protection devices and physical routing. The review should distinguish genuinely separate components from duplicated labels on a shared connection. An interface may be necessary and well designed, but its role must be explicit before anyone describes the architecture as independent. Counting batteries cannot answer that question.
ArduPilot’s Pixhawk power documentation illustrates particular primary and backup paths and describes automatic switching in its example hardware.[1] That reference is useful for seeing how a backup claim depends on a defined architecture. It is not evidence that the hypothetical aircraft, another controller board or an arbitrary pair of power modules has the same behavior or level of fault tolerance.
Regulation and distribution dependencies
For the fixed-wing example, ask whether each supposed backup depends on the same regulator, upstream source or distribution enclosure. Include necessary signal and monitoring dependencies in the drawing, rather than reviewing only thick power lines. If the evidence leaves a shared item unidentified, record both the item and the claim that cannot yet be closed. An incomplete dependency map should not be replaced by optimistic terminology.
Also identify the physical configuration associated with the analysis. Two electrically distinct paths may still have unresolved installation dependencies; conversely, the existence of a shared item does not by itself determine the final engineering disposition. The task is to expose the dependency for assessment by the responsible team, not declare every shared bracket or compartment unacceptable from a generic article.
Monitoring and switchover assumptions
Separate evidence that a source is observed from evidence that a load can continue to receive power. Ask which device makes a selection, what the defined transition behavior is and what measurements support the stated result. A displayed second battery value does not document a second supply path. Likewise, a switching feature described in software does not identify the physical circuit that carries the load.
For this hypothetical large fixed-wing aircraft, the evidence request should identify which consumer continuity claims are made and under what documented conditions. Do not prescribe a live disconnection test or an improvised combining circuit. The Pixhawk example’s switching descriptions remain confined to that example.[1] Actual verification methods and acceptance criteria must come from the applicable hardware documentation and responsible aircraft-level assessment.
Aircraft-level failure assessment
AC 20-184A addresses rechargeable lithium battery installation and electrical-system evaluation, including the information associated with an installed battery system.[2] Its regulatory context is not automatic approval for a UAV. It supports asking for an integrated installation argument; it does not turn two batteries into certified redundancy or supply the missing common-cause analysis for this fixed-wing proposal.
A useful deliverable is a failure-to-function matrix linked to the controlled architecture drawing. For every claimed retained function, identify supporting evidence, shared dependencies and unresolved questions. That makes the term backup precise enough to review. The outcome may preserve a limited continuity claim while withholding a broader redundancy claim. Such a qualified conclusion is more informative than assigning a system-wide label that the available documentation cannot substantiate.
Related reading
- Avionics Power Is Not the Same Question as Propulsion Power
- A Composite Airframe Supplier Evidence Pack