Jonathan Liscouët
email: jonathan.liscouet@concordia.ca

Félix Pollet

Joël Jézégou

Marc Budinger

Scott Delbecq

Jean-Marc Moschetta

A methodology to integrate reliability into the conceptual design of safety-critical multirotor unmanned aerial vehicles

Keywords:

This article introduces a new conceptual design methodology to evaluate and explore underactuated electric multirotor unmanned aerial vehicle (UAV) designs for safety-critical applications. A case study focusing on medical transport in an urban environment demonstrates the methodology's effectiveness. The current state of the art does not provide conceptual design methodologies that integrate reliability considerations for multirotor UAVs. The proposed methodology addresses this gap by developing systematic reliability calculation and introducing sizing based on failure cases. For this purpose, controllability and reliability analysis methods are developed and linked to an analytical sizing methodology. The controllability analysis is based on the available control authority index adapted for failure case assessment and reliability analysis. The link between the controllability analysis and the sizing methodology is achieved by introducing failure case sizing factors. The sizing relies on a modern analytical database-free methodology with multidisciplinary design optimization for design customization and computational efficiency. This methodology is developed with new design models to cover failure cases in forward flights. When applied to the case study, the methodology efficiently evaluates and compares five concepts and indicates that only two comply with both the safety and reliability requirements and mission specifications (payload and range). More specifically, the methodology shows the major impact of reliability considerations on the case study with sizing factors that almost double or triple the required rotor thrusts depending on the design. This methodology is applicable to challenging future multirotor UAV applications that require to demonstrate high safety levels and redundancies, such as urban air taxis, flying ambulances, and search and rescue and medical equipment transport.

Introduction

For the past two decades, multirotor unmanned aerial vehicles (UAVs), also known as drones, have been intensively developed. These vehicles, which operate without the involvement of human operators, can accomplish preassigned tasks that have the potential to change people's daily lives, such as functioning as urban air taxis, flying ambulances, and search and rescue and medical equipment transports. Such operations, which are beyond visual line of sight (BVLOS) and usually over densely populated areas, are safety critical. Technical failure resulting in an uncontrollable UAV could be catastrophic if the vehicle collides with humans, aircraft, helicopters, or infrastructure, and the damage caused by accidents increases with the size, weight, and speed of the vehicle. Therefore, the design of such vehicles must be driven by safety considerations. Here, safety refers to flight control reliability because the safety of a UAV largely depends on this control in the event of failure.

Another primary challenge is energy efficiency, which is mainly driven by weight, specifically the maximum takeoff mass (MTOM). The weight challenge is highlighted for electric UAVs due to the low energy density of the batteries compared to conventional fossil fuel solutions. Hence, the emergence of multirotor UAVs for demanding safety-critical applications depends on the designers' ability to optimize designs for energy efficiency while also considering reliability.

Maximum value

Accordingly, our objective is to develop a new conceptual design methodology with which to evaluate and explore designs for safety-critical applications. We focus on design evaluation and exploration to ascertain whether an aircraft can be built that meets performance and safety requirements [START_REF] Raymer | Aircraft Design: a Conceptual Approach[END_REF]. It is essential to identify, evaluate, explore, and compare solutions to find the optimal concept for transition to the preliminary design, where no major design changes should occur [START_REF] Raymer | Aircraft Design: a Conceptual Approach[END_REF]. The article's scope is the design of fully electric underactuated multirotor UAVs with fixed rotor thrust directions (i.e., no vectoring control or articulated rotor system). Nevertheless, the proposed methodology provides a framework for further adaptations to other classes of UAVs, such as fully actuated multirotors, fixed-wing and hybrid configurations, and alternate propulsion system technologies.

A core activity of the conceptual design is sizing, which aims to optimally size and specify the main components of the design to achieve the performance objectives. The published literature provides many empirical methodologies for sizing fixed-wing [START_REF] Gundlach | Designing Unmanned Aircraft Systems -a Comprehensive Approach[END_REF] and multirotor UAVs [START_REF] Gatti | Complete preliminary design methodology for electric multirotor[END_REF], [START_REF] Ong | Design methodology for heavy-lift unmanned aerial vehicles with coaxial rotors[END_REF]. These methods are derived from established fixed-wing aircraft and rotorcraft design methods [START_REF] Raymer | Aircraft Design: a Conceptual Approach[END_REF], [START_REF] Tischler | Practical Methods for Aircraft and Rotorcraft Flight Control Design: An Optimization-Based Approach[END_REF]. Alternative methods adopt an analytical approach to allow for greater customization of the designs being evaluated. Many of the analytical methods are built on component databases combined with an optimization problem [START_REF] Lundström | Micro aerial vehicle design optimization using mixed discrete and continuous variables[END_REF][START_REF] Magnussen | Multicopter UAV design optimization[END_REF][START_REF] Magnussen | Multicopter design optimization and validation[END_REF][START_REF] Ng | Design of small-scale quadrotor unmanned air vehicles using genetic algorithms[END_REF][START_REF] Biczyski | Multirotor sizing methodology with flight time estimation[END_REF][START_REF] Oh | The solution development for performance analysis and optimal design of multicopter-type small drones[END_REF][START_REF] Arellano-Quintana | Multirotor design optimization using a genetic algorithm[END_REF]. The online tool flyeval [START_REF] Shi | A practical performance evaluation method for electric multicopters[END_REF][START_REF] Dai | An analytical design optimization method for electric propulsion systems of multicopter UAVs with desired hovering endurance[END_REF][START_REF] Dai | Design automation and optimization methodology for electric multicopter UAVs[END_REF][START_REF]Flight evaluation[END_REF] proposes a method for finding the optimal propulsion system using product data provided by the manufacturers. However, this method is limited by its focus on optimizing the component selection locally rather than optimizing this selection at the UAV level. Other authors address the optimization problem at the system scale with either an exhaustive search [START_REF] Biczyski | Multirotor sizing methodology with flight time estimation[END_REF] or gradient-free algorithms [START_REF] Lundström | Micro aerial vehicle design optimization using mixed discrete and continuous variables[END_REF], [START_REF] Magnussen | Multicopter design optimization and validation[END_REF], [START_REF] Ng | Design of small-scale quadrotor unmanned air vehicles using genetic algorithms[END_REF], [START_REF] Oh | The solution development for performance analysis and optimal design of multicopter-type small drones[END_REF], [START_REF] Arellano-Quintana | Multirotor design optimization using a genetic algorithm[END_REF]. In both cases, the process is time consuming. Alternatively, database-free methodologies introduce component estimation models [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF][START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF][START_REF] Bershadsky | Electric multirotor UAV propulsion system sizing for performance prediction and design optimization[END_REF][START_REF] Budinger | Estimation models for the preliminary design of electromechanical actuators[END_REF][START_REF] Leng | An analytical model for propeller aerodynamic efforts at high incidence[END_REF] to streamline the sizing process for computation efficiency. However, none of these design methodologies integrate reliability considerations. Research on high reliability multirotor UAVs has focused on proposing specific fault-tolerant designs and control strategies [START_REF] Yu | Autonomous Safety Control of Flight Vehicles[END_REF][START_REF] Lu | Active fault-tolerant control for quadrotors subjected to a complete rotor failure[END_REF][START_REF] Nguyen | Actuator fault detection and faulttolerant control for hexacopter[END_REF][START_REF] Lippiello | Emergency landing for a quadrotor in case of a propeller failure: a backstepping approach[END_REF][START_REF] Lee | Fail-safe flight of a fully-actuated quadrotor in a single motor failure[END_REF] by evaluating the fault tolerance of given configurations [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF], [START_REF] Shi | Reliability analysis of multicopter configurations based on controllability theory[END_REF] or optimizing control to maximize operational reliability [START_REF] Chamseddine | Control allocation for a modified quadrotor helicopter based on reliability analysis[END_REF]. Hence, the current state of the art lacks effective conceptual design methodologies for multirotor UAVs that take reliability into account.

The proposed methodology addresses this gap by developing systematic reliability calculation and introducing sizing based on failure cases. For this purpose, controllability and reliability analysis methods are developed and linked to an analytical sizing methodology. The controllability analysis is based on the authority control index (ACAI) adapted for failure case assessment and reliability analysis. The link between the controllability analysis and the sizing methodology is achieved by introducing failure case sizing factors. The sizing relies on a modern analytical database-free methodology with multidisciplinary design optimization (MDO) for design customization and computational efficiency. This methodology, previously introduced by the authors [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF], [START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF], [START_REF] Pollet | Design optimization of multirotor drones in forward flight[END_REF], is further advanced to include the failure cases in the sizing process and ensure that the UAV will have sufficient control authority. In particular, the sizing optimization problems presented [START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF], [START_REF] Pollet | Design optimization of multirotor drones in forward flight[END_REF] are reformulated to address non-nominal flight regimes, and the design models introduced in [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF] are further advanced to include new design parameters to explore the effects of technological innovations on UAV performance. The effectiveness of the new methodology is validated and demonstrated with a case study on a new multirotor UAV for medical transport (e.g., organ transplants) in an urban environment.

Section 2 introduces the overall methodology. Section 3 describes how the control analysis provides a controllability assessment and sizing factors for reliability analysis, which includes failure cases in the sizing. Section 4 focuses on the sizing. It introduces the new design models and describes the optimization problem with the sizing. Section 5 describes how generalized reliability calculations process the controllability assessment to systematically evaluate the reliability. Section 6 introduces the case study and discusses the design exploration, sizing, and reliability results. Finally, Section 7 concludes the article.

Proposed methodology

Fig. 1 represents the proposed methodology in the form of an adapted eXtended Design Structure Matrix (XDSM) diagram [START_REF] Lambe | Extensions to the design structure matrix for the description of multidisciplinary design, analysis, and optimization processes[END_REF], [32]. The diagram shows a methodology divided into five main steps: analysis of the regulatory framework, concept definition, control analysis, sizing optimization, and reliability analysis. This paper focuses on control analysis, sizing optimization, and reliability analysis.

A concept of operation (1) describes the operational employment, environment, and attributes of a proposed system from the user's viewpoint [START_REF]AIAA, Guide to the Preparation of Operational Concept Documents[END_REF]. An example of information contained in a concept of operation that is essential for the proposed design methodology is provided in the case presented in Section 6.1. As shown in Fig. 1, the regulatory framework analysis (2) of the concept of operation identifies the safety and reliability requirements (3) that apply to the design. The concept definition (4) provides candidate designs. The outputs of the regulatory framework analysis and concept definition are illustrated in the case study in sections 6.2 and 6.3. The concept configuration (5) initiates the control analysis (6) based on controllability and control allocation analyses. The control analysis is developed in Section 3. The proposed methodology introduces sizing factors [START_REF] Magnussen | Multicopter UAV design optimization[END_REF], which are factors applied to the rotor thrust specification to include the failure cases in the sizing process and thus ensure consistency between the controllability assessment and operational performance. Together with the sizing factors, the mission and concept specifications [START_REF] Magnussen | Multicopter design optimization and validation[END_REF] are used to converge to an optimal sizing (9) for the mission, thus, minimizing weight or maximizing range and ensuring that the operation is within each component's technological constraints. The sizing methodology developed in Section 4 is highly multidisciplinary. The system architecture [START_REF] Biczyski | Multirotor sizing methodology with flight time estimation[END_REF] from the concept definition, the controllability assessment [START_REF] Oh | The solution development for performance analysis and optimal design of multicopter-type small drones[END_REF] from the control analysis, and the flight time [START_REF] Arellano-Quintana | Multirotor design optimization using a genetic algorithm[END_REF] from the sizing optimization then permit a reliability analysis [START_REF] Shi | A practical performance evaluation method for electric multicopters[END_REF] of the concept. The reliability analysis is developed in Section 5. Finally, the results of the sizing optimization [START_REF] Dai | An analytical design optimization method for electric propulsion systems of multicopter UAVs with desired hovering endurance[END_REF] and reliability analysis [START_REF] Dai | Design automation and optimization methodology for electric multicopter UAVs[END_REF] can be used to explore and compare different concepts or technologies, negotiate performance with mission specifications, and provide valuable insights into the design to select the optimal one. This final step is illustrated with the case study in Section 6.

Control analysis

The safety and reliability assessment aims to automatically evaluate the safety and reliability of the specified design concepts. The safety of operation depends primarily on the capability of the flight control system to ensure controllability under adverse conditions, such as in cases of a rotor failure. Therefore, a methodology is presented that formalizes and systematizes the association of a modern controllability assessment approach with reliability calculations and control allocation. The methodology is applied to assess each concept's safety and reliability and provide sizing factors for the controllable failure cases to be used in the sizing process for a consistent design.

Controllability analysis

The controllability analysis aims to differentiate the potentially controllable from the uncontrollable failure cases. The first challenge results from the difficulty of applying classical controllability theory to the multirotors, while the second challenge results from the lack of design information inherent to the conceptual design phase.

Some studies of fault-tolerant control of quadcopters have proposed emergency landing procedures to avoid a catastrophic condition from a single rotor failure [START_REF] Lu | Active fault-tolerant control for quadrotors subjected to a complete rotor failure[END_REF][START_REF] Nguyen | Actuator fault detection and faulttolerant control for hexacopter[END_REF][START_REF] Lippiello | Emergency landing for a quadrotor in case of a propeller failure: a backstepping approach[END_REF], [START_REF] Lanzon | Flight control of a quadrotor vehicle subsequent to a rotor failure[END_REF], [START_REF] Yu | Emergency control of a quadrocopter in case of failure of two symmetric propellers[END_REF]. The incorporation of such a procedure would represent a significant improvement in the reliability of quadcopters. However, these procedures do not maintain the yaw control. Here, similar to the case study discussed by Saad and Liscouët [START_REF] Nazarudeen | State-of-the-Art and Directions for the Conceptual Design of Safety-Critical Unmanned and Autonomous Aerial Vehicles[END_REF], a failure can occur in cruise flight, and the control scheme must completely stop the speeding vehicle and engage a hover mode before performing a controlled descent. This procedure requires sufficient control of all control axes. For this reason, the present analysis assumes that catastrophic failure can be avoided only if the UAV maintains full or degraded control over all control axes.

Underactuated multirotor dynamics model

The underactuated multirotor UAVs with fixed rotor thrust directions are approximated with the following dynamics model linearized for a hover flight condition for simplicity [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF], [START_REF] Ducard | Discussion and Practical Aspects on Control Allocation for a Multi-rotor Helicopter[END_REF][START_REF] Schneider | Fault-tolerant Control Allocation for Multirotor Helicopters Using Parametric Programming[END_REF][START_REF] Quan | Introduction to Multicopter Design and Control[END_REF]: For simplicity, the vehicle's center of gravity is assumed to be fixed and aligned with the vehicle's geometrical center. This hypothesis reduces the external disturbance vector to the vehicle's weight [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF]:

ẋ = Ax + B u f -G , (3.1) where x = [h φ θ ψ v h p q r] T ∈ R
G = m a g 0 0 0 T ∈ R 4 , ( 3.2)
where m a is the vehicle mass [kg], and g is the gravity acceleration [m/s 2 ].

Available control authority index

In the classical controllability theory introduced by Kalman, assessing the controllability of a control system involves the wellknown rank test of the controllability matrix. However, as noted in previous work [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF], [START_REF] Quan | Introduction to Multicopter Design and Control[END_REF]Ch. 10], [START_REF] Brammer | Controllability in linear autonomous systems with positive controllers[END_REF], the classical theory requires the origin point to be an interior point of the achievable control constraint set, which is not always the case with rotor failures. In the same way, the classical controllability analysis method requires the control allocation to be defined [START_REF] Quan | Introduction to Multicopter Design and Control[END_REF]Sec. 10.4.2], which can be an issue under rotor failures since, by definition, an operational control allocation cannot be defined for uncontrollable cases. Therefore, as an alternative, the ACAI introduced by Du et al. [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF] is used in this study to evaluate the minimum control authority remaining after a failure. This subsection synthesizes the calculation of the ACAI before adapting it to failure cases in Section 3.1.3.

The main component of the control authority is the previously defined system's total thrust/torque u f , which results from the rotor thrust vector f as follows [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF]:

u f = B f f , (3.3)
where B f ∈ R 4×m is the control effectiveness matrix reflecting the configuration and geometry of the vehicle's design, and f ∈ R m is the rotor thrust vector with m as the number of rotors.

Each rotor provides a purely positive and limited thrust, leading to the following rotor thrust vector constraint set:

F = f | f = [ f 1 , • • • , f m ] T , 0 ≤ f i ≤ f max,i , (3.4)
where f i is the thrust of i-th rotor and f max,i is the maximum thrust [N] of the i-th rotor.

Eq. (3.3) and (3.4) provide the system's total thrust/torque constraint set [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF]:

= u f | u f = B f f , f ∈ F (3.5)
The ACAI is a measure of the maximum control thrust/torque that can be produced in all directions (T , L, M, and N) after considering the effect of external disturbance. More specifically, it is the radius of the largest enclosed four-dimensional sphere centered at G in the attainable total thrust/torque constraint set [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF]:

ρ (G, ∂ ) min G -u f : G ∈ , u f ∈ ∂ -min G -u f : G ∈ c , u f ∈ ∂ , (3.6)
where ∂ is the boundary of and c is the complementary set of . Detailed information on the computation of the ACAI is provided by Du et al. [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF].

As demonstrated by Du et al. [START_REF] Du | Controllability analysis for multirotor helicopter rotor degradation and failure[END_REF], a configuration is potentially controllable in all directions only if rank C (A, B) = 8 and ρ (G, ∂ ) > 0, (3.7) where C (A, B) is the system controllability matrix, and the previ- ous condition verifies that it is full rank.

Available control authority index for failure cases

The proposed methodology is based on assessing the controllability of each possible failure case. Each failure case whose ACAI is verified (3.6) will be considered potentially controllable. Accordingly, this subsection introduces a new approach to calculating the ACAI for failure cases. The first step is to define the full set of failure cases to be considered with a systematic combination of one to k rotor failure(s). Limiting the number of failed rotors to a maximum value k is a practical design rule to prevent overdesigning for cases that are extremely improbable. It assumes that the UAV flight control system will not adapt or reconfigure for more than k rotor failures. Hence, any combination of more than k rotor failures will lead to loss of control. The total number of failure cases to be assessed, j, is given by

j = k i=1 m! i! (m -i)! , ( 3.8)
where m is the total number of rotors and k ∈

[1, • • • , m -1]
is the maximum number of simultaneous rotor failures to be considered in the design. The second step is to define a failure matrix for each possible failure case as follows:

H j = diag (η 1 , • • • , η m ) , (3.9)
where H j is the failure matrix of the j-th failure case and the

parameters η i ∈ {0, 1}, i = 1, • • • , m represent available (η i = 1) and failed (η i = 0) rotors.
The third step is to define the control effectiveness matrix from the failure matrix for each failure case:

B f , j = B f H j , (3.10)
where B f , j is the control effectiveness matrix reflecting the effect of the j-th failure case.

Then, the fourth step is to define the system total thrust/torque constraint set for each failure case as follows:

j = u f , j | u f , j = B f , j f , f ∈ F , (3.11)
where j is the remaining system total thrust/torque constraint in the j-th failure case.

Finally, the ACAI can be calculated for each failure case as the following:

ρ j G, ∂ ⎧ ⎨ ⎩ min G -u f , j : G ∈ j , u f , j ∈ ∂ j -min G -u f , j : G ∈ c j , u f , j ∈ ∂ j , ( 3.12)
where ρ j G, ∂

is the ACAI for the j-th failure case, ∂ j is the boundary of j , and c j is the complementary set of j . The result of the controllability analysis represents the controllability assessment of all the failure cases and the counts of controllable cases for each failure case of multiplicity i, C i . For no-failure i = 0 (and C 0 = 1), single failures i = 1, double failures i = 2, and so on, with i = [0, • • • , k]. This result enables the reliability calculation developed in Section 5. Additionally, the identification of each controllable case enables the assessment of sizing factors for the failure cases as per Section 3.2.

Lack of design information

A major challenge of the proposed approach based on the ACAI stems from the inherent lack of design information in the conceptual design phase. The proposed controllability analysis requires a wholly defined aircraft dynamics model in Eq. (3.1). Defining the design configuration and geometry, meaning the number of rotors and their orientations and positions relative to the geometrical center, is not sufficient to complete the aircraft dynamics model. Further design information is required, such as the vehicle mass and inertia matrix, maximum rotor thrusts, and the reactive torque-to-thrust coefficient of the rotors.

At the conceptual design level, the thrusts and torques required to transition from one flight phase to another are neglected to focus on the thrusts and torques required to maintain controllability in a stabilized phase. In addition, prior to sizing, the design hypothesis related to sizing should not restrict performance or affect the controllability assessment. Therefore, non-restrictive generic design values are defined according to these hypotheses to compensate for the missing design information. Alternatively, empirical data can be used. For example, the thrust-to-weight and reactive torque-to-thrust ratios can be based on off-the-shelf design data trends.

Failure case sizing factor

The failure case sizing aims to include the failure cases in the sizing process to ensure that the UAV will have sufficient control authority following any failure assessed as controllable. To this end, this section introduces failure case sizing factors linking the controllability assessment to the sizing process.

The sizing methodology presented in Section 4 requires an estimate of the power demand for each rotor in each failure case. Accordingly, the failure case sizing factor is defined as the rotor thrust vector ratio of a failure case to the normal operation. In this way, the power demand of each rotor in a failure case can be directly scaled from the power demand in the normal operation. The failure case sizing factors are calculated as follows:

K j = f j ∅ f , K j ∈ R m , (3.13)
where K j is the failure case sizing factor vector of the j-th failure case, f j is the rotor thrust vector of the j-th failure case, f is the rotor thrust vector of the normal operation, and ∅ represents the Hadamard or element-wise division.

The rotor thrust vector results from the system total thrust/ torque using the control allocation matrix for both the normal and failure cases, and the control allocation matrix is defined using the pseudoinverse approach as follows:

⎧ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎩ f = P u f , with P = B T f B f B T f -1
∈ R m×4 for normal operation

f j = P j u f , j , with P j = B T f , j B f , j B T f , j -1 ∈ R m×4 for the j -th failure case, (3.14)
where u f is the system total thrust/torque of the sizing maneuver in normal operation, and u f , j is the required system total thrust/torque of the j-th failure case. Eq. (3.13) and (3.14) lead to the following failure sizing factor calculation for each failure case:

K j = P j u f ∅ P u f (3.15)
The required system total thrust/torque can generally be alleviated in cases of failure depending on the probability of occurrence. However, it is assumed here that the control authority must be fully preserved in all directions (T, L, M and N) for all the failure cases assessed as controllable; hence, u f = u f . The maximum sizing factors obtained for each rotor for all the failure cases provide the maximum sizing factor vector, K max :

K max = max k 1,1 , • • • , k 1, j , • • • , max k m,1 , • • • , k m, j ∈ R m , (3.16)
where k i,l is the l-th component of the i-th sizing factor vector K i .

Applying K max to the maximum rotor thrusts resulting from the calculation of the normal operation performance covers the failure cases in the sizing process (cf. Section 4).

In some cases, the control allocation can include negative values for the rotor thrust. A rotor thrust is unidirectional, and a negative allocation must be avoided. In these cases, reallocation is automatically performed after deactivating the negatively allocated motor. This simple method permits negative values resulting from the pseudoinverse reallocation to be avoided. Future work should incorporate more advanced control allocation methods to avoid the need for this reallocation procedure.

Sizing

This section focuses on the sizing of the selected concepts and their performance evaluation using MDO. Low-order models optimizing the computation time accurately represent flight physics and estimate the characteristics of the main UAV components.

Sizing methodology

The sizing of a multirotor is essentially an inverse process within the conceptual design. The goal is to deduce the characteristics of the components from UAV performance specifications using design models. These models are combined to produce a sizing process, which is implemented into an optimization problem framework. The effect of key design drivers on performance is assessed with a design of experiments approach. Many specialized fields are involved in this process, including aerodynamics, flight physics, propulsion, and weights, due to the multidisciplinary nature of the flying vehicles.

The proposed sizing methodology is based on the database-free methodology introduced by the authors in [START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF], [START_REF] Pollet | Design optimization of multirotor drones in forward flight[END_REF]. The novelty of this methodology lies in the use of low-order estimation models based on scaling laws, similarity laws, or regressions to scale reference components with their operational constraints [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF]. This approach provides a computationally efficient solution to sizing. In this study, additional design models are implemented to account for the failures that occur in forward flight. The optimization problem is reformulated to ensure that the optimally sized design remains controllable after the loss of one or two rotors.

Design models

The sizing methodology involves three categories of design models [START_REF] Budinger | Optimal preliminary design of electromechanical actuators[END_REF]: estimation, simulation, and evaluation models. The estimation models return the characteristics of the sized components. The simulation and evaluation models calculate the quantities driving the sizing of components and their performance. This subsection introduces low-order design models to enable sizing UAVs for missions with multiple flight regimes. Specifically, we introduce flight dynamics models to simulate the flight regimes and estimation models for the power transmission components of the propulsion system and airframe.

Vehicle simulation model -In the context of inverse simulation for sizing, the vehicle simulation model outputs the individual propeller's thrusts and mechanical powers from the specified flight regimes, taking the relevant aerodynamic effects into account. The flight regimes include takeoff, climb, hover, forward flight (i.e., cruise), and descent. In addition, this study considers the failures that occur in forward flight, as discussed in Section 3. Typically, the failure cases determine the maximum propeller thrusts and energy required to complete the mission.

In hovering, the control thrust T hov [N] generated by the propulsion must equal the weight of the UAV. In the absence of relative wind, there is no additional force acting on the drone, and the control thrust is expressed as

T hov = m a g (4.1)
An additional aerodynamic force resulting from the airframe drag D f [N] must be accounted for in axial flight (i.e., climb) as follows: The control thrust must maintain both vertical and horizontal equilibriums when the multirotor is in steady forward flight (i.e., cruise). For simplicity, it is assumed that the center of gravity is fixed and aligned with the geometrical center of the UAV, which avoids external pitch, roll, or yaw torques in this flight phase. Additionally, the normal force of the propellers resulting from asymmetric conditions is omitted according to Y. Leng [START_REF] Leng | An analytical model for propeller aerodynamic efforts at high incidence[END_REF], who showed that this force is of a second order of magnitude compared to the axial force.

T cl = m a g + D f = m a g + 1 2 ρ air C d S top v 2 h ,
α = θ FP + tan -1 D f cos θ FP -L f sin θ FP m a g + D f sin θ FP + L f cos θ FP (4.3) T fwd = m a g + D f sin θ FP + L f cos θ FP 2 + D f cos θ FP -L f sin θ FP 2 (4.4)
Transient and non-nominal flight regimes can be expressed relative to the regular scenarios presented above. A thrust-to-weight ratio k thrust [-] is introduced to express the takeoff thrust T to [N] as follows:

T to = k thrust m a g (4.5)
The individual propulsive forces of the m propellers are obtained by distributing the control thrust equally for each regime except for the failure case in forward flight, as in the following:

f = T m K max ∈ R m + , ( 4.6)
where K max is a unity vector for the nominal hover, climb, forward, and takeoff regimes and is defined as per Section 3.2 for the failure cases.

Propeller simulation model -The propeller simulation model provides the aerodynamic efforts for each flight regime, taking into account the propeller geometry. The propulsive force f [N] and mechanical power p [W] of a propeller are expressed as a function of its thrust and power coefficients, C T [-] and C P [-], respectively:

f = C T ρ air n 2 pro D 4 pro (4.7) p = C P ρ air n 3 pro D 5 pro , (4.8)
where n pro is the rotational frequency of the propeller [Hz] and D pro is its diameter [m].

In [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF], Budinger et al. applied dimensional analysis and Buckingham's theorem [START_REF] Holmes | Dimensional analysis[END_REF], [START_REF] Van Groesen | Continuum Modeling in the Physical Sciences[END_REF] to derive an expression of the power and thrust coefficients in axial flight (i.e., α = π 2 ) as a function of the propeller's pitch-diameter ratio β [-] and axial advance ratio J axial [-]. A third-order polynomial regression was then applied to off-the-shelf propeller datasheets from APC [44] to express the power and thrust coefficients in axial flight as follows: This regression model, which is only valid in axial flight, can be extended to nonaxisymmetric conditions using an analytical correction term, as proposed by Y. Leng [START_REF] Leng | An analytical model for propeller aerodynamic efforts at high incidence[END_REF]. For a given blade geometry (i.e., a fixed pitch-diameter ratio β), the extended regression model is [START_REF] Pollet | Design optimization of multirotor drones in forward flight[END_REF] C T ,P (α, J ) = η T ,P (α) C T ,Paxial ( J axial )

C T axial (β, J axial ) = 0.
(4.11) with η T ,P (α) = 1 + ( J cos α) 2 2(π r ) 2 1 -J sin α J 0T ,P δ (α) , (4.12)
where

J = v ∞ n pro D pro is the advance ratio [-], J axial = v ∞ n pro D pro
sin α is the axial advance ratio [-], and J 0T and J 0P represent two axial advance ratios when the thrust and power coefficients reach 0. These ratios are obtained from Eq. (4.9), (4.10). In Eq. (4.12), r is the position of the representative section of the blade expressed as a percentage of the radius. Here, r is assumed to be equal to 75%. Additionally, δ(α) is a corrective factor for consistency within helicopter analysis.

Fuselage aerodynamics simulation model -The aerodynamic efforts acting on a multirotor are not restricted to propeller forces. The fuselage aerodynamic simulation model outputs the aerodynamic loads on the fuselage from the specified flight regimes. When in motion, the airframe and the payload are subject to drag force and lift force proportional to the square of the relative airspeeds:

D f = 1 2 C d ρ air v 2 ∞ S ref (4.13) L f = 1 2 C l ρ air v 2 ∞ S ref , ( 4.14)
where the effective area S ref [m 2 ] is the projected surface facing the relative airflow. The drag coefficient C d [-] and lift coefficient C l [-] depend on many parameters such as the body shape, airflow direction, and surface aspect. Baker et al. [START_REF] Baker | Loading from blast waves[END_REF] provide the following typical drag coefficients for a Reynolds number of 10 4 : 1.05 for a cube shape, 0.47 for a sphere, and 0.04 for a streamlined body.

In addition, the lift of a multirotor acts mostly as a downward force, as depicted in Fig. 2. This force is due to the necessary inclination of the drone in forward flight. However, the fairing of a multirotor can be optimized to minimize drag and provide positive lift in forward flight, as in the Endurance quadcopter by Hitec [START_REF] Ventura Diaz | High-fidelity computational aerodynamics of multirotor unmanned aerial vehicles[END_REF], [START_REF] Hitec | SUI endurance, available: hitecnology.com /drones /sui[END_REF]. Due to the high-level uncertainty involved in determining the multirotor's positive lift in the conceptual phase and utilizing a conservative approach, this lift is ignored in this study. A fixed value C d = 0.5 for the drag coefficient is adopted, which is equivalent to approximating the fuselage as an ideal rounded cylinder.

Estimation models for the power transmission of the propulsion system -The functional parameters and characteristics of the key components of the electric propulsion system are estimated with similarity models developed by Budinger et al. [START_REF] Budinger | Scaling laws and similarity models for the preliminary design of multirotor drones[END_REF]. Specifically, we reuse the motor, electronic speed controller (ESC), and battery estimation models. Unlike the previous propeller simulation model, these estimation models are based on scaling laws rather than data regressions. The scaling laws are obtained using dimensional analysis and Buckingham's theorem and have the advantage of requiring only one reference per component for scaling.

Airframe estimation model -The airframe estimation model provides the UAV space envelope and airframe mass and ensures geometrical and structural integrity. The arms of the geometry model consider the rotor diameter and the number of arms as inputs. Their length L arm (m) is calculated so that the propellers do not collide with each other while minimizing their volume:

L arm = D pro 2 sin π N arms , ( 4.15)
where N arms is the number of arms [-] of the multirotor and D pro is the propeller diameter [m].

The inner diameter D in [m] and outer diameter D out [m] of the rods are then estimated using a stress calculation based on the maximum applied load provided by the vehicle simulation model. The airframe body is considered rigid in comparison to the arms, hence, the problem has to be reduced to cantilever beams. Consequently, the Euler-Bernoulli beam theory applied to a circular hollow section gives the following expression for the outer diameter:

D out = 3 32 f max L arm πσ max 1 -k 4 frame , (4.16)
where f max [N] is the maximum load applied at the arms' extremities and σ max [N/m 2 ] is the maximum allowable stress of the arm material. The standardized coefficient k frame , inner to outer diameter ratio [-], is defined as a design variable to avoid an underconstrained equation.

Finally, the arms' mass is computed through the geometry and material density, and the body's mass is derived from the arms' mass using a scaling law as follows:

m body = m body,ref

Sizing optimization

As a result of the high number of disciplines involved in the sizing, we adopt an MDO approach. The resolution of an MDO problem can be computationally expensive due to the high number of variables involved. This study applies the efficient sizing methodology for multirotors proposed by Delbecq et al. [START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF] to reduce the complexity and computation time of the problem. This methodology is described in the following:

1. Define a system of algebraic equations based on design models subject to inequality constraints. Design models are discussed in Section 4.1.1. 2. Reduce the number of inequality constraints with a monotonicity analysis. The first monotonicity principle introduced by Papalambros and Wilde in [START_REF] Papalambros | Principles of Optimal Design: Modeling and Computation[END_REF] enables the identification of the set of inequalities that can be turned into equalities by studying the variations of the objective and constraint functions for each design variable. The reduction of inequality constraints reduces the complexity and computational cost of a problem. 3. Apply a monolithic normalized variable hybrid (NVH) architecture [START_REF] Delbecq | Benchmarking of monolithic MDO formulations and derivative computation techniques using OpenMDAO[END_REF] to the MDO problem. Here, the architecture defines the formulation of the optimization problem and how the different models are coupled [START_REF] Martins | Multidisciplinary design optimization: a survey of architectures[END_REF]. The NVH architecture introduces standardized coefficients to replace the initial design variables and consistency constraints to preserve consistency between the coupling variable inputs and outputs at the optimal solution. This approach solves any multidisciplinary couplings and singularities such as algebraic loops and under-and over-constrained sets of equations. 4. Sequence the sizing equations and expressions explicitly for integration into an optimal sizing code.

The resulting optimization problem is formulated as follows:

minimize x f (x) subject to g j (x) ≤ 0, j = 1, . . . , p x ∈ X ⊆ R n X = (x i ) ∈ R n : 0 ≤ x i ≤ ∞ , where • f (x)
is the objective function. For UAV, mass minimization and range maximization are among the most common objectives [START_REF] Magnussen | Multicopter design optimization and validation[END_REF], [START_REF] Oh | The solution development for performance analysis and optimal design of multicopter-type small drones[END_REF], [START_REF] Arellano-Quintana | Multirotor design optimization using a genetic algorithm[END_REF], [START_REF] Delbecq | Efficient sizing and optimization of multirotor drones based on scaling laws and similarity models[END_REF], [START_REF] Zhang | Multidisciplinary design optimization of an electric propulsion system of a hybrid UAV considering wind disturbance re-jection capability in the quadrotor mode[END_REF].

• x is the design variable vector that represents a design alternative. Design variables can be continuous (e.g., propeller pitch to diameter ratio), discrete (e.g., number of arms), or Boolean (e.g., deciding whether or not to implement a gear-train). In this study, only continuous design variables are considered. In particular, normalized sizing coefficients k mass , k pro , k mot , k esc , k bat , and k frame are introduced as per the NVH architecture.

• g j j is the set of inequality constraints ensuring the solution's feasibility. Requirement constraints ensure compliance with the performance requirements. Compatibility constraints ensure compatible components are combined. For example, they ensure electrical compatibility between the ESCs, motors, and battery packs that are essential for a valid design. A constraint on the motor torque (i.e., the sizing factor) ensures the sizing of the propulsion system for the failure cases. A consistency constraint on the MTOM ensures that the estimated MTOM for the vehicle simulation model converges with the actual MTOM calculated from the mass of the components.

The optimization parameters are summarized in Table 1. Fig. 3 provides a visual summary of the resulting MDO architecture for the optimal multirotor design problem with an XDSM diagram [START_REF] Lambe | Extensions to the design structure matrix for the description of multidisciplinary design, analysis, and optimization processes[END_REF]. The variables C j on the left-hand side represent the constraints. An optimizer iterates over a sizing procedure to converge on the best feasible solution. The sizing procedure consists of a feed-forward computational sequence to derive the characteristics of the drone given a set of design variables and specifications. The thin black arrows in Fig. 3 represent the process connections.

The concept is sized with a sequential and inverse approach that begins with the required UAV performance requirements, followed by the sizing of each component, before the verification of the resulting design performance and finally an iteration. More specifically, the flight dynamics model translates the UAV performance into a propeller performance requirement based on an initial MTOM guess. The propeller estimation model sizes the propeller and returns its specification from the performance requirements. The specification parameterizes the inverse simulation model of the propeller, which transforms the propeller performance requirement into the electric motor performance requirement. This cycle is repeated until all the components are sized as per the sizing wave process introduced by Liscouët et al. in [START_REF] Liscouët | Modelling approach for the simulation-based preliminary design of power transmissions[END_REF]. The actual mass of the UAV can then be computed and compared to the initial guess for consistency. The battery specifications are used to compute the actual range as a function of the flight velocity. These computations of the mass and range provide objective functions for optimization.

The sizing optimization was implemented into FAST-OAD, which is a framework for rapid overall aircraft design [START_REF] David | From FAST to FAST-OAD: an open source framework for rapid Overall Aircraft Design[END_REF]. It takes advantage of the OpenMDAO environment to offer efficient analysis and optimization capabilities [START_REF] Gray | OpenMDAO: an open-source framework for multidisciplinary design, analysis, and optimization[END_REF]. The gradient-based optimization algorithm SLSQP [START_REF] Kraft | A software package for sequential quadratic programming[END_REF] was chosen as the solver.

Reliability analysis

The reliability analysis formalizes and systematizes the link between the controllability and reliability evaluations. For a systematic approach to architecting, the design is divided into the propulsor configuration and the power and control subsystem. The propulsor configuration is characterized by the number of propulsors and their geometrical arrangement, including rotation direction. In this study, we define a propulsor subsystem as the assembly of an ESC, electric motor, and propeller. The power and control subsystem includes the batteries, autopilot, and inertial measurement units (IMUs).

Reliability analysis hypothesis

The reliability analysis evaluates the reliability of the following function: the provision of full or degraded control of all control axes. The computation is based on independent and random failures, leading to constant failure rates and the convenient exponential distribution. The probability of failure is expressed as follows: (5.1) where λ is the failure rate [h -1 ] and t is the exposure time [h].

F (t) = 1 -e -λt ,
The exposure time corresponds to the maximum flight time between two charges and is enforced by the assumption of a built-in test procedure confirming the functionality of each component at power-up. The flight time is a design optimization variable and results from the sizing described in Section 4.

The failure rates summarized in Table 2 are in the orders of magnitude of modern high-end transport category aircraft equipment. This assumption is likely to be overly optimistic for several applications. Therefore, it will be interesting to evaluate the impact of derating these failure rates. Accordingly, Table 8 shows the reliability of conventional and redundant design for failure rates ranging from the toy industry (x1,000 derating) to high-end transport category aircrafts (no derating).

Power and control subsystem reliability

The reliability calculation for the generic propulsion system architectures is based on the classical reliability block diagram (RBD) methodology [START_REF] Hecht | Systems Reliability and Failure Prevention[END_REF]. The reliability of components in series and parallel is obtained as follows [START_REF] Hecht | Systems Reliability and Failure Prevention[END_REF]: (5.3) where R i (t) is the reliability of the i-th component.

For n components in series, R s (t) = n i=1 R i (t) (5.2) For n components in parallel, R p (t) = 1 - n i=1 (1 -R i (t)) ,
Information technologies can rely on more sophisticated redundancies, such as a majority voting redundancy [START_REF] Hecht | Systems Reliability and Failure Prevention[END_REF]. For example, a flight control computer receiving air data from three independent flight sensor sources can protect against a flight sensor failure by comparing the data from the three sources and isolating the divergent one. In this case, the reliability is obtained using a k-out-of-n redundancy calculation as follows [START_REF] Hecht | Systems Reliability and Failure Prevention[END_REF]:

R k r /n r (t) = n r i=k r n r ! i! (n r -i)! R i (1 -R) n r -i , ( 5.4)
where R k r /n r (t) is the reliability of a k r -out-of-n r redundancy, R(t)

is the reliability of the identical components of the redundancy, n r is the total number of components, and k r is the minimum number of components necessary for the function.

Propulsor configuration subsystem reliability

A reliability calculation for a propulsor configuration based on controllability analysis and Boolean algebra was previously presented in [START_REF] Shi | Reliability analysis of multicopter configurations based on controllability theory[END_REF], [START_REF] Nazarudeen | State-of-the-Art and Directions for the Conceptual Design of Safety-Critical Unmanned and Autonomous Aerial Vehicles[END_REF]. In this study, this approach is formalized and systematized toward automatization.

The reliability is calculated from the union of the probabilities of each controllable case, including the failure-free case. Finally, the controllable cases are expressed as mutually exclusive so that the reliability is a systematic sum of their probabilities as formalized below:

R PC (t) = k i=0 C i • R pr (t) m-i • 1 -R pr (t) i , (5.5)
where R PC (t) is the reliability of the propulsor configuration, R pr (t) is the reliability of a propulsor, and C i is the number of controllable cases of the failure cases of multiplicity i. The C i are provided by the control analysis as per Section 3.1.3. The reliability of a propulsor is the product of the speed controller, motor, and propeller reliabilities. Finally, the overall reliability R sys (t) is obtained by combining the power and control subsystem and propulsor configuration reliabilities as two sub-assemblies in series using Eq. (5.2). The overall reliability is normalized by the flight duration, t, for comparison with the regulation requirements provided as average probabilities per flight hours (cf. Section 6.2):

R sys (t) = R EC (t) • R PC (t) t , (5.6)
where R EC (t) is the reliability of the power and control subsystem.

Case study

This section presents a case study that illustrates the application of the developed methodology and tool. The choice of application and mission profile emphasizes the sizing and safety challenges, while the analysis of the applicable regulation provides the safety and reliability requirements. The selected concepts represent different levels of safety to illustrate the impact of safety considerations on the design and performance.

Concept of operation and context

The case study targets a safety-critical application with a demanding operation performance (payload and range) to emphasize the challenge of performing conceptual design sizing while also considering safety and reliability.

The transportation of organs for transplant by drones within large cities is the selected case study. As illustrated in Fig. 4, transporting organs involves a significant payload of up to 20 kg, including an organ in an icebox (15 kg) and the fuselage around it (5 kg), over a considerable distance of 25 km. An emergency diversion site is assumed to exist midway along the route. The descent and landing phases are estimated to take 30 seconds. In addition, flying BVLOS over densely populated areas involves major safety and reliability concerns. This type of safety-critical application represents a promising use for drone technology, which could reduce the time and cost associated with an essential health service and thus make it more accessible.

Regulatory framework analysis

The safety and reliability requirements are based on an analysis of the unmanned aerial system (UAS) regulations. The European Union Aviation Safety Agency (EASA) UAS regulatory framework is considered to provide certification specific to UASs owing to its comprehensive approach. We consider Regulation (EU) 2019/947 [START_REF]European Union, Commission Implementing Regulation[END_REF] and Regulation (EU) 2019/945 [START_REF]European Union, Commission Implementing Regulation[END_REF] and the proposed means for compliance with the Special Condition "Light-UAS.2510-Equipment, Systems, and Installation (High Risk)" [START_REF] Easa | Proposed special condition light unmanned aircraft systems -medium risk[END_REF], which define the applicable safety requirements for the operation, design, and manufacturing of UASs. These regulations detail the high-level safety objectives established in EASA basic regulation (EU) 2018/1139 [START_REF]European Union, Commission Implementing Regulation[END_REF].

Determining the safety objectives is based upon the following key characteristics of the case study's concept of operation: BVLOS operation of a light multirotor UAV over a densely populated urban area or over assemblies of people as per the EASA definition; a class D airspace; no passenger transport but cargo containing a human organ; and an altitude equal to or less than 120 m. These characteristics generate the following safety and reliability requirements:

1) The equipment and systems, including lift-thrust units and their command, must be designed such that a catastrophic failure condition does not result from a single failure.

2) The design must ensure compliance with the relationship between failure conditions and probabilities as provided in Table 3.

3) The failure to respect the following UAV design constraints would lead to more stringent allowable probabilities than provided in Table 3: the maximum dimension shall be below 3 m, and MTOM shall be below 200 kg (corresponding to a 400 m 2 worst crash area).

Concept definition

The case study focuses on a underactuated multirotor UAV with idealized configurations and identical, evenly distributed, coplanar, and perfectly aligned rotors for simplicity.

The concepts shown in Fig. 5 represent different fault tolerance levels to illustrate the impact of reliability considerations on the conceptual design. For design consistency, three generic power and control subsystem architectures were established and matched to the propulsor configurations based on the fault tolerance level. The hexacopter RBD in Fig. 6 illustrates the generic fault-intolerant power and control system architecture, which does not incorporate redundancy. The coaxial quadcopter RBD in Fig. 7 illustrates the single fault-tolerant architecture, which incorporates battery redundancy and majority voting based on three pairs of IMUs and flight controllers to survive single failures. The coaxial hexacopter RBD in Fig. 8 illustrates the double fault-tolerant architecture, which incorporates triple battery redundancy and majority voting based on four pairs of IMUs and flight controllers to survive double failures.

Control analysis results

The controllability analysis (cf. Section 3.1) indicates that the quadcopter and hexacopter configurations cannot maintain control of all the control axes after any single failure. As shown in Table 4, the coaxial quadcopter can ensure control of all the control axes for any single failure but loses control for some double failure cases. The coaxial hexacopter and octocopter can maintain control of all the control axes after all single and double failures. The controllability analysis does not extend to triple failures (i.e., k = 2) because the probability of combining more than two failures is too remote for sound design consideration. Note: R i represents the failure of the i-th rotor; R i &R l represent the simultaneous failures of the i-th and l-th rotors. 12,500 (cruise distance / 2) * Similar to the DJI Agras T20 max thrust-weight ratio of 1.7 [START_REF] Dji | [END_REF].

Table 5 presents the maximum failure sizing factors obtained for the fault-tolerant configurations as per Section 3.2, which are all driven by double failure cases. Here, the scaling factors are reduced to single scalars applicable to all the rotors owing to the symmetry of the idealized case study designs.

In some octocopter double failures, the control allocation strategy automatically disables a third rotor to avoid negative control allocation, as per Section 3.2, thereby explaining the compelling failure sizing factor of the octocopter's double failures. Further work on implementing a more advanced control allocation method should evaluate whether this impact can be reduced.

Design exploration

The design exploration studies the different fault-tolerant configurations presented in Section 6.4. The coaxial quadcopter, coaxial hexacopter, and simple octocopter concepts are optimized for the baseline mission described in Section 6.1. Emphasis is placed on evaluating the effect of the failure cases on the sizing. The baseline mission specifications are summarized in Table 6. The objective of the optimization problem is to minimize the MTOM.

The design exploration focuses on the variation in the components' characteristics as a function of mission requirements to understand how the specifications affect the design. For this purpose, we investigate the variations of the MTOM as a function of the specified range and payload, with all the other mission specifications remaining constant. Technological innovations such as new battery technologies provide an opportunity to further improve UAV performance. For this reason, it is pertinent to study the impact of a variation in the battery energy density and specific power on the UAV performance. For this purpose, three different cell types are used as references for the scaling laws of the battery estimation model as summarized in Table 7.

6.6. Sizing results

Concept comparison for the baseline mission

The mass breakdowns obtained for the coaxial quadcopter, coaxial hexacopter, and simple octocopter concepts are presented in Fig. 9. A high-power, high-energy li-ion battery is used for the comparison (i.e., Battery 1 in Table 7).

No feasible solution was found for the octocopter with the baseline mission. A downgraded mission with an emergency rerouting of 2.5 km instead of 12.5 km was applied to this concept for comparison. Still, the octocopter design did not converge with failure case sizing. Remarkably, the octocopter sized without failure case considerations is much heavier than its competitors.

The coaxial quadcopter and coaxial hexacopter exhibit comparable weights; the main difference lies in the structural mass supporting the rotors. The consideration of failure cases in the sizing mainly induced an increase in the motor mass, such as a 73% increase for the coaxial hexacopter. The other components were barely impacted.

Based on these results and the controllability analysis presented in Section 6.4, the coaxial hexacopter appears to be the most appropriate concept for the safety-critical application. Consequently, the following sensitivity studies focus on the coaxial hexacopter.

Effect of payload requirement

As shown in Fig. 10, the UAV mass increases exponentially with the payload. An increase in the payload mass implies more propulsive power and more energy being required to complete a mission, thus, resulting in an exponential increase in the total weight. In this regard, the battery cell type has a significant impact on the performance. A higher energy density reduces the battery weight for the benefit of the payload. However, this gain is constrained by the electrical power that the selected battery can provide, which explains why the potential of the ultra-high-energy battery (Battery 3 in Table 7) is limited despite a higher energy density. Indeed, this cell type has low specific power.

Effect of range requirement

Fig. 11 shows the evolution of takeoff weight as a function of range. The weight of the battery and subsequently the mass of the other components increases as more energy is required to increase the achievable range. Consequently, a higher energy density for the batteries has a positive impact on performance. Remarkably, a higher threshold (∼45 kg) constrains the optimal mass of the UAV in the case of the ultra-high-energy, low-power battery (Battery 3 in Table 7). Thus, a decrease in the range requirement below 20 km does not allow further mass reduction. The critical constraint is no longer the quantity of energy required to conduct the mission but rather the power required for take off. The low specific power of the ultra-high-energy battery reaches its limits here. A similar trend can be observed for the other cell types but at a much lower threshold value (below 5 km).

Reliability analysis results

The reliability of the concepts shown in Fig. 5 is modeled with RBDs. Fig. 6 illustrates the RBD of the hexacopter. The simple quad- copter's RBD, which is not shown, differs from the hexacopter's RBD only in the number of propulsors. Fig. 7 shows the RBD of the coaxial quadcopter, and Fig. 8 illustrates the RBD of the coaxial hexacopter. The simple octocopter's RBD, which is not shown, differs from the latter only in the number of propulsors. The reliabilities are summarized in Table 8. For clarity, the probability of failure F (t) rather than the reliability R(t) is shown. The probabilities of failure and reliabilities are complementary, R(t) = 1-F (t). The results in Table 8 show that the simple quadcopter and hexacopter concepts fail to satisfy the reliability requirements defined in Section 6.2; specifically, a catastrophic failure condition must not result from a single failure and must be extremely im-probable (i.e., probability of occurrence less than 10 -7 per flight hour). The coaxial quadcopter is fault tolerant and thus complies with the single failure requirement, but, in the best case scenario, it only marginally passes the probability of occurrence requirement. Given the approximations of the reliability analysis in the conceptual phase, its marginality makes this solution a high risk in terms of development. The simple octocopter and the coaxial hexacopter are double fault tolerant and have promising reliabilities, but they require high-caliber equipment to achieve high reliability levels.

Table 8 also shows that increasing the number of propulsors and hence the redundancy tends to increase the fault tolerance Note: The designs that are potentially compliant with the safety and reliability requirements are highlighted in green. * Fault tolerance of 0 means that certain single failures can have a catastrophic effect; fault tolerance of 1 means that no single failure can have a catastrophic effect, but certain double failures can; and fault tolerance of 2 means that no double failure can have a catastrophic effect. * * No failure case sizing (i.e., K max is a unity vector) and a mission including a 2.5 km diversion instead of 12.5 km.

and reliability. However, adding more propulsors also decreases the reliability by increasing the part count (more parts means potentially more faults). For example, the simple hexacopter has more propulsors than the quadcopter but lower reliability because the additional propulsors do not provide fault tolerance and add to the total part count. In the same way, the simple octocopter has fewer propulsors but is more reliable than the coaxial hexacopter because both concepts are limited to double fault tolerance by design choice, but the simple octocopter has a lower part count.

Intermediate conclusion of the case study

The analysis of the EASA regulations has shown that the UAV must satisfy demanding reliability and safety requirements. The reliability analysis has shown that among the considered concepts, only the single octocopter, coaxial hexacopter, and coaxial quadcopter can satisfy these requirements. Still, these designs require high-caliber equipment equivalent to transport aircraft category products, and the significant oversizing factors from the failure cases impact the MTOM. The octocopter sizing does not converge for the baseline mission and requires the alleviation of the diversion requirement and no sizing for failure. All the other concepts are within the MTOM limits defined by the regulations for light UAVs, but they cannot carry a payload heavier than 38 kg for 25 km. Alternatively, in the most optimistic case, it is possible to reach a range of 39 km with a payload of 20 kg. In addition to the configuration, the type of battery cell appears to be a critical design decision impacting UAV performance. The coaxial hexacopter with ultra-high-energy low-power battery cells appears to be the best compromise with regard to mass and reliability. Future work should investigate the integration of battery cell specifications in terms of specific power and energy density in the sizing optimization and eventually consider combining different battery cell types to achieve higher performance.

Conclusion

This paper introduces a new design methodology for the conceptual design of multirotor UAVs. The novel contributions lie in including safety and reliability considerations and enabling the exploration of an effective design. The current state of the art does not provide conceptual design methodologies that integrate reliability considerations for multirotor UAVs. The proposed methodology addresses this gap by developing a systematic reliability calculation and introducing sizing based on failure cases. For this purpose, controllability and reliability analysis methods are developed and linked to an analytical sizing methodology. The controllability analysis is based on the ACAI adapted for failure case assessment and reliability analysis. The controllability analysis and the sizing methodology are linked by introducing failure case sizing factors. The sizing relies on a modern analytical database-free methodology with MDO for design customization and computational efficiency. This methodology is advanced with new design models to cover failure cases in forward flights. A case study, which focused on medical transport in an urban environment, demonstrated the methodology's effectiveness. The case study first analyzed new UAV standards and regulations to establish a framework for certification and define the safety and reliability requirements. This first step also provides a relevant example of how to apply such new regulations to safety-critical urban applications. The methodology then efficiently evaluated and compared five concepts and clearly indicated that only two comply with both the safety and reliability requirements and the mission specifications (payload and range). More specifically, the methodology showed the major impact of reliability considerations on the case study designs, with sizing factors ranging from 186% to 283% for the required rotor thrusts depending on the design concept. The methodology also provided valuable insights into the effect of critical design decisions, such as mission specifications and the choice of battery cell types. Hence, the new design methodology provides a novel means to effectively evaluate and explore underactuated multirotor design alternatives and also supports optimal decision making within the conceptual design.

Future work needs to address the current limitations of the proposed methodology. The controllability analysis focuses on the control authority remaining in a stabilized flight phase, such as forward flight. The analysis should be extended to include inertial effects in the oversizing factors to address flight phase transitions. Future work should also focus on integrating the propulsor configuration and control system reliability calculation to allow a systematic concept definition and design exploration. Finally, we profiled the methodology for underactuated multirotor concepts. Other concepts, such as fully actuated multirotor, fixed-wing, and hybrid multirotor fixed-wing concepts, are expected to be more adaptable for certain applications such as long-range missions. Therefore, new dynamics and design models should be developed to further adapt and advance the proposed methodology for these other concepts. In this way, UAV designers will have an effective way of evaluating and comparing a large variety of designs to select the optimal solution for reliability and energy efficiency in the conceptual design phase. Thus, the proposed methodology will contribute to the emergence of UAVs for challenging safety-critical applications.

θ 2 ψ

 2 Pitch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad θ FP Flight path angle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad λ Failure rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h -1 ρ air Air density . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . kg/m 3 σ max Maximum allowable stress . . . . . . . . . . . . . . . . . . . . . . N/m Yaw . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad φ Roll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Fig. 1 .

 1 Fig. 1. Adapted extended design structure matrix diagram of the proposed conceptual design methodology.

R

  8 is the state vector with h as the altitude [m]; ϕ, θ , and ψ are the roll [rad], pitch [rad], and yaw [rad] angles; v h is the vertical velocity [m/s]; and p, q, and r are the roll, pitch, and yaw rates [rad/s]. In addition, A = 8×4 represents the control matrix with J f as the vehicle's ma- trix of inertia; u f = T L M N T ∈ R 4 represents the system total thrust/torque with T as the lift force [N] and L, M, and N as the roll, pitch, and yaw moments [N•m]; and G ∈ R 4 represents the external disturbance vector.

Fig. 2 .

 2 Fig. 2. Side view of a quadcopter in climbing forward flight, adapted from [30].

( 4 . 2 )

 42 where C d is the airframe drag coefficient [-], ρ air is the air density [kg/m 3 ], S top is the top surface of the drone [m 2 ], and v h the vertical velocity [m/s].

Fig. 2

 2 illustrates the simplified model, where v ∞ is the free stream velocity [m/s], v h the vertical velocity [m/s], θ FP is the flight path angle of the drone [rad] equal to 0 in level flight, f i [N] is the thrust of the i-th propeller, and L f is the aerodynamic downward force [N]. The angle of attack α [rad] is considered identical for each rotor. Solving the equilibrium of forces for the angle of attack α [rad] and the total thrust T fwd [N] produces

  m arms m arms,ref(4.17

  )

Fig. 3 .

 3 Fig. 3. Extended design structure matrix diagram of the proposed multirotor UAV sizing optimization.

Fig. 4 .

 4 Fig. 4. Profile of the case study mission.

Table 3 7 Fig. 5 .Fig. 6 .

 3756 Fig. 5. Case study UAV configuration concepts. (For interpretation of the colors in the figure(s), the reader is referred to the web version of this article.)

Fig. 7 .

 7 Fig. 7. Coaxial quadcopter propulsion system reliability block diagram (single faulttolerant architecture).

Fig. 8 .

 8 Fig. 8. Coaxial hexacopter propulsion system reliability block diagram (double faulttolerant architecture).

Fig. 9 .

 9 Fig. 9. Mass breakdown results from the preliminary design.

Fig. 10 .

 10 Fig. 10. Payload effect on maximum takeoff mass for three different battery cell types and a fixed range.

Fig. 11 .

 11 Fig. 11. Range effect on maximum takeoff mass for three different battery cell types.

  Torque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N m Airframe drag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N D in , D out Inner and outer diameters of the arms. . . . . . . . . . . m D pro Propeller diameter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m E Energy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . J Multirotor total mass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . kg m arms Arm mass. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . kg m body Body mass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . kg N Yaw torque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Nm N arms Number of arms n pro Propeller rotational frequency . . . . . . . . . . . . . . . . . . . . . m/s n r Total number of components of a k-out-of-n redundancy P Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W p Roll rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad/s q Pitch rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad/s R Reliability r Yaw rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad/s S Airframe area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m 2 T Control thrust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N t Exposure time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . h U Voltage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . V u

	Nomenclature
	Latin Symbols
	A	State matrix
	B	Control matrix
	B f	Control effectiveness matrix
	C
	C i	Number of controllable failure cases of multiplicity i
	C P	Propeller power coefficient
	C T	Propeller thrust coefficient
	C d	Airframe drag coefficient
	C l	Airframe lift coefficient
	D f
	F	Probability of failure
	f	Rotor thrust vector
	G	External disturbance vector
	J	Advance ratio
	J 0P	Zero-Power Advance Ratio
	J 0T	Zero-Thrust Advance Ratio
	J axial	Axial advance ratio
	J f	Matrix of inertia
	K i	Failure case sizing factor vector
	K max	Max. failure sizing factor vector
	k	Max. number of simultaneous rotor failures considered
		in the design
	k M	Oversizing coefficient on the load mass
	k ND	Undersizing coefficient for the propeller speed
	k esc	Oversizing coefficient on the electronic speed con-
		troller power
	k frame	Ratio inner/outer diameter for the arms
	k mb	Sizing coefficient on the battery mass
	k mot	Oversizing coefficient on the motor torque
	k r	Number of necessary components of a k-out-of-n re-
		dundancy
	k speed mot Oversizing coefficient on the motor speed
	k thrust	Thrust-to-weight ratio
	k N m
	m	Number of rotors
	m a

https://doi.org/10.1016/j.ast.2022.107681 g Gravity acceleration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m/s 2 H Failure matrix h Altitude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m vb Oversizing coefficient for the battery voltage L Roll torque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N m L arm Arm length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m L f Airframe lift . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . N M Pitch torque . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . f Control vector v Vehicle velocity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m/s v ∞ Free stream velocity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . m/s x State vector Greek Symbols α Angle of attack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . rad β Propeller pitch-diameter ratio δ Incidence Thrust and Power correction factor

  02791 -0.06543 J axial + 0.11867 β+ 0.27334 β 2 -0.28852 β 3 + 0.02104 J 3 C P axial (β, J axial ) = 0.01813 -0.06218 β + 0.00343 J axial + 0.35712 β 2 -0.23774 β 3 + 0.07549 β J axial -0.1235 J 2

		axial
	-0.23504 J 2 axial + 0.18677 β J 2 axial	(4.9)

axial

(4.10)

Table 1

 1 Optimization parameters.

		Parameter	Description
	Design variables	k M	Oversizing coefficient on the load mass
		k mot	Oversizing coefficient on the motor torque
		k speed mot	Oversizing coefficient on the motor speed
		k vb	Oversizing coefficient for the battery voltage
		k ND	Undersizing coefficient for the propeller speed
		k frame	Ratio inner/outer diameter for the arms
		k mb	Sizing coefficient on the battery mass
		k esc	Oversizing coefficient on the ESC power
		β	Angle pitch/diameter for the propeller
		J j	Advance ratios
		v ∞	Cruise speed
	Constraints	C mot,max ≥ C mot, j	Motor torque constraints
		U bat ≥ U mot, j P bat,max ≥ m i=1 P mot,i, j	Battery voltage constraints Battery power constraints
		U esc ≥ U bat	ESC voltage constraint
		P esc,max ≥ P esc, j	ESC power constraints
		0 ≤ v j -J j n pro, j D pro ≤ 0.05	Propeller operational speeds constraints
		n pro,max D pro ≥ n pro, j D pro	Propeller maximum speed constraint
		E bat ≥ E mission	Mission energy constraint
	Objective	MTOM	Maximum takeoff mass
	functions	range	Maximum range

Note: Subscript j refers to the flight regimes introduced in Section 4.1.1.

Table 2

 2 Failure rates for high-end transport category aircraft quality.

	Component	Failure rate (per hour)
	Battery	10 -6
	Inertial measurement unit (IMU)	3 10 -6
	Flight controller	5 10 -5
	Electronic speed controller	1 10 -5
	Electric motor	10 -6
	Propeller	10 -8

Table 4

 4 Results of the controllability assessment of the coaxial quadcopter.

		Controllable cases	Uncontrollable cases
	Single rotor failures	R1, R2, R3, R4, R5, R6, R7, R8 (C 1 = 8)	None
	Double rotor failures	R1&R4, R1&R5, R1&R6, R1&R8, R2&R3, R2&R5,	R1&R2, R1&R3, R1&R7, R2&R4,
		R2&R6, R2&R7, R3&R5, R3&R7, R3&R8, R4&R6,	R2&R8, R3&R4, R3&R6, R4&R5,
		R4&R7, R4&R8, R5&R7, R6&R8 (C 2 = 16)	R5&R6, R5&R8, R6&R7, R7&R8

Table 5

 5

	Failure case sizing factors K max
	obtained for the fault-tolerant
	configurations.
	Configuration	K max
	Coaxial quadcopter	200%
	Coaxial hexacopter	186%
	Octocopter	283%

Table 6

 6 Baseline mission specifications.

	Parameters	Values
	Payload [kg] Max. thrust-to-weight ratio k thrust [-]	20 1.6 *
	Climb height [m]	122
	Climb speed [m/s]	3.0
	Cruise distance [m]	25,000
	Descent and hover duration [min]	0.5
	Emergency diversion [m]

Table 7

 7 Reference batteries for scaling laws.

		Battery 1 [62]	B a t t e r y 2 [ 63]	B a t t e r y 3 [ 64]
	Battery chemistry	Lithium-ion NCA	Lithium-ion Polymer	Lithium-ion NMC
	Cell type	High Energy/High Power	Low Energy/High Power	Ultra-High Energy/Low Power
		Molicel INR-21700-P42A	ProLite X TP3400-4SPX25	Kokam SLPB080085270
	Energy density [Wh/kg]	224	155	249
	Specific power [kW/kg]	2.4	3.9	0.5
	Nominal voltage [V]	43.2	14.8	3.7
	Capacity [Ah]	42.0	3.4	26.0
	Max current [A]	450	170	104
	Weight [kg]	8.100	0.326	0.387

Table 8

 8 Safety and reliability assessment results.

	Characteristics/concepts	Simple quadcopter	Simple hexacopter	Coaxial quadcopter	Simple Octocopter	Coaxial hexacopter
		(4 rotors)	(6 rotors)	(8 rotors)	(8 rotors)	(12 rotors)
	Fault tolerance * Flight time (min)	0 failures 19.9	0 failures 17.7	1 failure 22.3	2 failures 14.2 * *	2 failures 21.7
	Failure rate derating	Probability of failure per flight hour
	x1 (transport aircraft)	1.14 10 -4	1.44 10 -4	4.14 10 -9	4.36 10 -14	1.75 10 -13
	x10	1.14 10 -3	1.44 10 -3	4.14 10 -7	4.40 10 -11	1.75 10 -10
	x100	1.14 10 -2	1.44 10 -2	4.13 10 -5	4.38 10 -8	1.74 10 -7
	x1,000 (toy industry)	1.12 10 -1	1.41 10 -1	4.02 10 -3	4.28 10 -5	1.68 10 -4

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.