# Designing a Reliable UAV Architecture Operating in a Real Environment
## 1 Introduction
Based on pre-defined scenarios of platform operation (scenarios can be provided by the system contracting authority), a function decomposition called Functional Hazard Analysis [2] is prepared in the literature. It concerns the fulfilment of functional requirements in the context of ensuring an appropriate safety level, denoted in the ARP4754 methodology as Design Assurance Level (DAL) [3]. Each primary process (scenarios) is decomposed into a set of component subprocesses (scenarios) up to the point where atomic functions are defined (functions that are not worth decomposing because they describe a specific single operation of the system assigned to one of the components). The Software Level, also known as the Design Assurance Level (DAL) as defined in ARP4754, is determined from the safety assessment process and hazard analysis by examining the effects of a failure condition in the system. The failure conditions are categorized by their effects on the aircraft, crew, and passengers. 1. Catastrophic--Failure may cause deaths, usually also includes the destruction of the airplane. 2. Hazardous--Failure has a sizeable negative impact on safety. It may reduce the ability of the crew to operate the aircraft due to physical distress or causes serious or fatal injuries among the passengers. 3. Major--Failure significantly reduces the safety margin. It may increase crew workload. * Minor--Failure slightly reduces the safety margin or slightly increases crew workload. Examples might include causing passengers inconvenience or a routine flight plan change. * No Effect--Failure has no impact on safety, aircraft operation, or crew workload. In practice, instead of specifying the DAL values directly, it is enough to define the most critical failure states that may occur during the execution of this function for each of the decomposed functions. In such a case, proving that the system is resistant to the occurrences of these emergency states means that its reliability level can be considered sufficient to perform specific tasks. It should be remembered that the DAL also depends on the hardware architecture, which significantly affects this parameter. The preparation of a reliable and safe system requires designing following Model-Based System Engineering (MBSE) standards [4; 5]. In the case of air platforms, it is required to introduce additional mechanisms to the design process, allowing for the preparation of a design that is easy to expand, maintain and verify. In recent years, the use of UAV functionalities based on the System Modeling Language (SysML) [6] and Unified Modeling Language (UML) [7] models have become widely used. UML also uses the Object Constraint Language (OCL), which allows for additional detailing of the system's functionality and defining constraints that must always be met. The OCL is a declarative language describing rules applying to UML. The Object Constraint Language provides a constraint on the metamodel that cannot otherwise be expressed by diagrammatic notation. OCL provides expressions that have neither the ambiguities of natural language nor the inherent difficulties of using complex mathematics. However, formal system description languages such as SysML or UML alone do not guarantee the development of a secure aircraft platform architecture integrated with the Ground Control Station (GCS). For this purpose, dedicated metamodels should be developed to transform user requirements and the requirements of safety standards into technical models. In practice, this means the manufacturer needs to develop such systems. The set of metamodels describes the mapping of user requirements to system use cases. Use cases can be mapped to system state machines or, in simpler cases, directly to activity sequences (system function calls). Due to the nature of the system, which is a close-to-real-time system, UML models primarily describe the transition from Use Case models to State Machines, the most commonly used system dynamics modeling mechanisms with multiple concurrent processes.