Easy Access Rules for Unmanned Aircraft Systems

Principle description

Additional information

#1

Annex E provides assessment criteria for the integrity (i.e. safety gain) and assurance (i.e. method of proof) of the OSOs proposed by an applicant.

The identification of OSOs for a given operation is the responsibility of the UAS operator.

The relationship between the SAIL and the low/medium/high level of robustness of an OSO can be found in Step #9, see Section S.4.9 of this AMC (SORA Main Body).

#2

Annex E does not cover the LoI of the competent authority. The Lol is based on the competent authority’s assessment of the applicant’s ability to perform the given operation.

#3

When more than one criterion exists for a given level of integrity/assurance in an OSO, all the criteria need to be met at the required integrity/assurance level to satisfy the given OSO.

#4

‘Not required (NR)’ cases defined in Section S.4.9.3 of this AMC (SORA Main Body) Table 14 do not need to be defined in terms of integrity and assurance levels in Annex E.

UAS operators are encouraged to consider also the OSOs classified as ‘NR’, at least with ‘low’ level of integrity and assurance.

#5

When the criteria to assess the level of integrity or assurance of an OSO rely on ‘standards’ that are not yet available, the OSO needs to be developed in a manner acceptable to the competent authority.

#6

Annex E intentionally uses non-prescriptive terms (e.g. suitable, reasonably practicable) to provide flexibility to both the applicant and the competent authorities. This does not constrain the applicant from proposing mitigations, nor the competent authority from evaluating what is needed on a case-by-case basis.

#7

This annex in its entirety also applies to singleperson organisations.

#8

Some of the OSOs refer to the functional-test-based (FTB) approach which is described in detail in Section E.3.

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL II)

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #01

Ensure that the UAS operator is competent and/or proven organisation

Criterion

The UAS operator is knowledgeable of the UAS1 being used and as a minimum has the following relevant operational procedures2:

(a)checklists,

(b)maintenance,

(c)training,

responsibilities, and associated duties.

Same as ‘low’. In addition, the UAS operator has set up an organisation appropriate3 for the UAS operation, with at least the following in place:

(a)a method to continuously evaluate whether the operator is operating according to the terms of the operational authorisation and check whether the mitigations proposed as part of the operational authorisation are still appropriate;

(b)occurrence analysis procedures and reporting to the UAS designer in case of design-related in-service events.

The UAS operator has an adequate organisational management system.

Comments

1 Including monitoring of any related airworthiness directives or recommendations issued by national aviation authorities and UAS designer recommendations (service bulletins, service information letters, etc.).

2 Operational procedures (checklists, maintenance, training, etc.) can be justified in the context of other applicable OSOs.

3 For the purpose of this assessment, ‘appropriate’ should be interpreted as commensurate with/proportionate to the size of the organisation and the complexity of the operation.

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL II)

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #01

Ensure that the UAS operator is a competent and/or proven organisation

Criterion

The elements delineated in the level of integrity are available and addressed in the operations manual.

Prior to the first operation, the competent authority of the Member State or an entity that is designated by the competent authority performs an audit of the organisation.

The UAS operator holds a light UAS operator certificate (LUC) according to PART C of Implementing Regulation (EU) 2019/947 or an air operator certificate (AOC) according to Regulation (EU) No 965/2012 or equivalent or, if the applicant is a design or production organisation, holds an approval according to Subpart J or P of Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments

N/A

Audits should be adapted to the size and scope of the organisation and focus on items that can be connected to the applicable OSOs and their robustness depending on the SAIL of the operation. Audits can take the form of desk reviews, if deemed appropriate.

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #02

UAS designed and produced by a competent and/or proven organisation

Criterion for design

As a minimum, design documentation covers:

(a)the specification of the materials;

(b)the suitability and durability of the materials used; and

(c)configuration control.

Same as ‘low’.

In addition, design documentation also covers identification and traceability.

The UAS designer complies with Subpart J of Annex I (Part 21) to Regulation (EU) No 748/2012.

Criterion for production

As a minimum,production procedures cover:

(a)the configuration control.

(b)the processes necessary to allow for repeatability in manufacturing; and

(c)conformity within acceptable tolerances.

Same as ‘low’. In addition, production procedures also cover:

(a)the verification of incoming products, parts, materials, and equipment;

(b)identification and traceability;

(c)in-process and final inspections and testing;

(d)the control and calibration of tools;

(e)handling and storage; and

(f)the control of non-conforming items.

The production organisation complies with the organisational requirements that are defined in Subpart F or G of Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments

N/A

N/A

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #02

UAS designed and produced by a competent and/or proven organisation

Criterion for design

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #021 using the form attached to the MoC.

The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

The UAS operator should operate a UAS designed by an organisation approved by EASA according to Subpart J of Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer

Comments

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

Note: EASA is in the process of developing the means of compliance for all OSOs. Once developed, they will be made available at the link above.

Criterion for production

The declared production procedures are developed to a standard that is considered adequate by the competent authority that issues the operational authorisation and/or in accordance with means of compliance acceptable to the competent authority.

Same as ‘low’ In addition, evidence is available that the UAS has been produced in conformity with its design.

Same as ‘medium’. In addition, the competent authority of the Member State or an entity that is designated by the competent authority validates compliance with the production organisation requirements that are defined in Subpart F or G of Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS production organisation.

Comments

N/A

N/A

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #03

Maintenance of UAS

Criterion #1 (Design)

The UAS designer’s maintenance instructions and requirements to ensure a safe operation are defined.

Same as ‘low’.

In addition, the UAS designer’s scheduled maintenance requirements are defined.

Criterion #2

(Procedure)

(a)The UAS operator’s1 maintenance instructions2 and requirements3 are defined, covering the applicable UAS designer’s instructions and requirements4,5, and are adhered to.

(b)The maintenance staff is competent and has received an authorisation by the UAS operator to carry out UAS maintenance.

Same as ‘low’. In addition:

(a)Preventive/scheduled maintenance/inspection of each UAS is organised in accordance with the UAS operator’s maintenance programme, established on the basis of the UAS designer’s scheduled maintenance requirements4 and adapted to the specificities of the intended UAS operations.

(b)Upon completion, the maintenance log system is used to record all the maintenance conducted on the UAS, including releases. A maintenance release can only be accomplished by a staff member that has received by the UAS operator a maintenance release authorisation for a particular UAS model/family.

Same as ‘medium’. In addition, the maintenance staff work in accordance with a maintenance procedure manual that provides information and procedures relevant to the maintenance facility, records, maintenance instructions, release, tools, materials, components, defect deferral, etc.

The UAS operator complies with Delegated Regulation (EU) 2024/1107.

Comments

1 The maintenance may be carried out by an organisation other than the UAS operator (e.g. use of a third party).

2 The UAS operator’s maintenance instructions are the information establishing how to carry out the required maintenance/repairs. These instructions are used by maintenance staff while performing maintenance.

3 The UAS operator’s maintenance requirements are the needs for maintenance of the UAS (e.g. inspection after hard landing, regular check of lighting system). The UAS operator ensures these requirements are covered in the UAS maintenance instructions.

4 The UAS operator may just reuse the UAS designer’s instructions and requirements for maintenance.

5 The UAS designer’s instructions and requirements for maintenance are sometimes referred to as ‘ICAs’ (Instructions for Continuing Airworthiness).

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #03

Maintenance of UAS

Criterion #1

(Design)

The UAS designer’s maintenance instructions and requirements to ensure a safe operation are documented.

Same as ‘low’.

In addition, the UAS designer’s scheduled maintenance requirements are developed and documented in accordance with standards considered adequate by the competent authority of the Member State and/or in accordance with means of compliance acceptable to that authority.

If the operation is classified as SAIL III, the UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #03 and Light-UAS.26251 using the form attached to the MoC.

If the operation is classified as SAIL IV, the UAS operator should use a UAS for which EASA has issued a design verification report (DVR) issued following an application from the UAS designer.

If the operation is classified as SAIL V and VI, the UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012, following an application from the UAS designer.

Comments

N/A

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

Criterion #2

(Procedure)

(a)The UAS operator’s maintenance instructions are documented1.

(b)The maintenance carried out on the UAS is recorded in a maintenance log system2,3.

(c)A list of the maintenance staff authorised to carry out maintenance is established and kept up to date.

Same as ‘low’.

In addition:

(a)The UAS operator’s maintenance programme covers the UAS designer’s scheduled maintenance requirements and is developed in accordance with standards considered adequate by the competent authority of the Member State and/or in accordance with a means of compliance acceptable to that authority.

(b)A list of the maintenance staff with maintenance release authorisation is established and kept up to date.

Same as ‘medium’.

In addition, the maintenance programme and the maintenance procedures manual are validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

The UAS operator complies with Delegated Regulation (EU) 2024/1107.

Comments

1 The UAS operator may just reuse the UAS designer’s instructions and requirements for maintenance.

2 The objective is to record all the maintenance performed on the UA, and why it is performed (rectification of defects or malfunctions, modifications, scheduled maintenance, etc.).

3 The maintenance log may be requested for inspection/audit by the approving authority or an authorised representative.

N/A

N/A

Criterion #3

(Training)

A record of all the relevant qualifications, experience and/or training completed by the maintenance staff is established and kept up to date.

Same as ‘low’.

In addition:

(a)The initial training syllabus and training standard, including theoretical/practical elements, duration, etc., is defined and is commensurate with the authorisation held by the maintenance staff.

(b)For staff that hold a maintenance release authorisation, the initial training is specific to a particular UAS model/family.

(c)All maintenance staff have undergone initial training.

Same as ‘medium’. In addition:

(a)a programme for the recurrent training of staff holding a maintenance release authorisation is established; and

(b)that programme is validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

The UAS operator complies with Delegated Regulation (EU) 2024/1107.

Comments

N/A

N/A

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Medium

High

(SAIL IV)

(SAIL V)

(SAIL VI)

OSO #04

components essential to safe operations are designed to an airworthiness design standard

Criterion

The UAS components that are essential to safe operations are designed to an airworthiness design standard1 considered adequate by EASA and/or in accordance with a means of compliance acceptable to EASA to contribute to the overall safety objective of 10–4/FH for the loss of control of the operation.

The UAS components that are essential to safe operations are designed to an airworthiness design standard1 considered adequate by the EASA and/or in accordance with a means of compliance acceptable to EASA to contribute to the overall safety objective of 10–5/FH for the loss of control of the operation.

The UAS components that are essential to safe operations are designed to an airworthiness design standard1 considered adequate by EASA and/or in accordance with a means of compliance acceptable to EASA to contribute to the overall safety objective of 10–6/FH for the loss of control of the operation.

Comments

In case of experimental flights that investigate new technical solutions, the competent authority may accept that recognised standards are not met.

1 EASA Special Condition Light-UAS is the recommended airworthiness design standard.

When aspects of an airworthiness design standard are covered by an OSO (for instance, OSO #05), the OSO requirement takes precedence.

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #04

UAS components essential to safe operations are designed to an airworthiness design standard

Criterion

The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012, following an application from the UAS designer.

Comment

In case the UAS designer decides to apply OSO #4 for UAS operated in SAIL I to III,

MoC Light UAS.FTB may be used

(https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-special-condition-light).

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #05

The UAS is designed considering system safety and reliability

Criterion

The equipment, systems and installations are designed to minimise1 hazards2 in the event of a probable3 failure of the UAS or of any external system supporting the operation.

Same as ‘low’.

In addition, the strategy for detection, alerting and management of any failure, which would lead to a hazard, is available.

(a)Major failure conditions are not more frequent than remote;

(b)Hazardous failure conditions are not more frequent than extremely remote;

(c)Catastrophic failure conditions are not more frequent than extremely improbable;

(d)No single failure can lead to a catastrophic failure condition; and

(e)SW and AEH whose development error(s) may cause or contribute to hazardous or catastrophic failure conditions are developed to an industry standard or a methodology considered adequate by EASA and/or in accordance with means of compliance acceptable to EASA.

Comments

1 The minimisation of the hazard criterion correlates to the contribution of the UAS, and of any external system supporting the operation, to the loss of control of the operation rate, thus the SAIL of the operation. As an example, at SAIL III, the contribution of the UAS, and of any external system supporting the operation, to the loss of control of the operation rate could be 10–4/FH assuming a traditional 10 % contribution of the technical aspects to the safety of an operation.

2 For the purpose of this assessment, the term ‘hazard’ should be interpreted as a failure condition that relates to major and hazardous, (the term ‘catastrophic’ is intentionally not included since the TLOS is considered met for SAIL I to IV operations with the provision of Note 1 above and, if applicable, M2 requirements in Annex B).

3 For the purpose of this assessment, the term ‘probable’ should be interpreted in a qualitative way as ‘anticipated to occur one or more times during the entire system/operational life of a UAS’.

UAS designers may achieve compliance by using MoC Light UAS.2510

(https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sai).

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #05

The UAS is designed considering system safety and reliability

Criterion

A functional hazard assessment1,2 and a design and installation3 appraisal that show that hazards are minimised are available.

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #054 using the form attached to the MoC.

Same as low.

In addition:

(a)The safety assessment is conducted in line with standards considered adequate by EASA and/or in accordance with a means of compliance acceptable to EASA.

(b)A strategy for the detection of single failures of concern includes pre-flight checks.

The UAS operator should use a UAS for which EASA has validated the claimed integrity through design verification report (DVR) issued following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

1 The severity of failure conditions (no safety effect, minor, major, hazardous and catastrophic) should be determined according to the definitions provided in JARUS AMC RPAS.1309 Issue 2.

2 EUROCAE ED-280 ‘Guidelines for UAS safety analysis for the specific category (low and medium levels of robustness)’ may be considered to support compliance with this criterion (through a functional hazard analysis (FHA)).

3 A simple written justification from the UAS designer including functional diagrams and a description of how the system works explaining why the integrity claim is met is an acceptable means of compliance.

4 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

EUROCAE ED-280 ‘Guidelines for UAS safety analysis for the specific category (low and medium levels of robustness)’ may be considered acceptable to support compliance with this criterion.

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL II & III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #06

C3 link characteristics (e.g. performance, spectrum use) are appropriate for the UAS operation

Criterion #1 (Operator)

The UAS operator:

(a)determines that the performance, RF spectrum use1 and environmental conditions for C3 links, as identified in the UAS flight manual2 are adequate to safely conduct the UAS operation.

(b)has procedures for the remote pilot to continuously monitor the C3 link performance and ensures that the performance continues to meet the operational requirements3.

Same as ‘low’4.

Same as ‘low’.

In addition, the use of licensed5 frequency bands for C2 links is required.

Comments

1 For a low level of integrity, unlicensed frequency bands may be acceptable under certain conditions, e.g. the use of mechanisms to protect against interference (e.g. frequency deconfliction by procedure).

2 The UAS designer may provide technical information also in other documentation.

3 The remote pilot has continuous and timely access to the relevant C3 links information that could affect the safety of flight. For operations requesting only a low level of integrity for this OSO, this could be achieved by monitoring the C2 link signal strength and receiving an alert from the UAS HMI if the signal strength becomes too low.

4 Depending on the operation, the use of licensed frequency bands may be necessary. In some cases, the use of nonaeronautical bands (e.g. licensed bands for cellular network) may be acceptable.

5 This ensures a minimum level of performance and is not limited to aeronautical licensed frequency bands (e.g. licensed bands for cellular network). Nevertheless, some operations may require the use of bands allocated to the aeronautical mobile service for the use of a C2 link (e.g. 5030 – 5091 MHz).

In any case, the use of licensed frequency bands requires authorisation.

Criterion #2 (Designer)

The UAS designer determines:

(a)the performance and the RF spectrum use1 for C3 links and specifies them in the UAS flight manual;

(b)that the means to continuously monitor the C3 link performance are available and are defined in the UAS flight manual2.

Same as ‘low’3.

Same as ‘low’.

In addition, the use of licensed4 frequency bands for C2 links is required.

Comments

1 For a low level of integrity, unlicensed frequency bands may be acceptable under certain conditions, e.g.:

(a)the UAS designer demonstrates compliance with other RF spectrum use requirements (e.g. Directive 2014/53/EU) by showing that the UAS equipment is compliant with these requirements; and

(b)the use of mechanisms to protect against interference (e.g. FHSS).

2 The remote pilot has continuous and timely access to the relevant C3 link information that could affect the safety of flight. For operations requesting only a low level of integrity for this OSO, this could be achieved by monitoring the C2 link signal strength and receiving an alert from the UAS HMI if the signal strength becomes too low.

3 Depending on the operation, the use of licensed frequency bands might be necessary. In some cases, the use of non-aeronautical bands (e.g. licensed bands for cellular network) may be acceptable.

4 This ensures a minimum level of performance and is not limited to aeronautical licensed frequency bands (e.g. licensed bands for cellular network). Nevertheless, some operations may require the use of bands allocated to the aeronautical mobile service for the use of C2 link (e.g. 5030–5091 MHz).

In any case, the use of licensed frequency bands needs authorisation.

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL II & III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #06

C3 link characteristics (e.g. performance, spectrum use) are appropriate for the UAS operation

Criterion #1 (Operator)

The UAS operator declares that the required level of integrity has been achieved.

The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

N/A

N/A

N/A

Criterion #2 (Designer)

The UAS designer declares that the required level of integrity has been achieved.

If the operation is classified as SAIL III, the UAS operator should use a UAS for which the UAS designer has issued a statement of declared with the MoC to OSO #061 using the form attached to the MoC.2

The UAS designer should obtain a design verification report (DVR) issued by EASA.

The UAS designer should obtain a type certificate or a restricted type certificate issued by EASA in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012.

Comments

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

2 For UAS operations classified in SAIL II, the UAS operator may still use an UAS for which the UAS designer issued a statement of compliance with the MoC to OSO #6. However, the UAS designer should be allowed to experiment new solutions. In this case a statement of compliance not referring to a published MoC might be acceptable.

N/A

N/A

TECHNICAL ISSUE WITH THE UAS

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #07

Conformity check of the UAS configuration

Criterion

The operator has UAS conformity check procedures in place ensuring periodically that:

(a)the UAS intended to be used for the operation is in a condition for safe operation; and

(b)the UAS configuration conforms to the information contained in the UAS flight manual and to the authorised configuration1.

Comments

1 The allowed UAS configuration should be defined by the UAS designer according to the configuration control criteria as per OSO #2.

TECHNICAL ISSUE WITH THE UAS

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #07

Conformity check of the UAS configuration

Criterion #1

(Procedures)

The UAS operator declares it has UAS conformity check procedures in place which take into consideration the UAS designer’s recommendations, if available.

Same as ‘low’. In addition, the UAS conformity checks are documented using checklists.

Same as ‘medium’. In addition, the product inspection procedures are validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

Comments

N/A

N/A

N/A

Criterion #2

(Training)

The UAS operator declares that the remote crew is trained to perform the UAS conformity check (with evidence available).

(a)A training syllabus, including a UAS conformity check procedure, is available.

(b)The UAS operator provides evidence of the theoretical and practical training.

The competent authority of the Member State or an entity that is designated by the competent authority:

(a)validates the training syllabus; and

(b)verifies the remote crew competencies.

Comments

N/A

N/A

N/A

OPERATIONAL PROCEDURES

LEVEL of INTEGRITY

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

OSO #08 Operational procedures are defined, validated and adhered to

Criterion #1 (UAS flight manual)

The UAS designer develops a UAS flight manual, including the relevant information (e.g. limitations).

Comments

N/A

Criterion #2 (Procedure definition)

(a)The UAS operator develops operational procedures1 appropriate for the proposed operation, taking into account the relevant information (e.g. limitations) listed in the UAS flight manual and, as a minimum, cover the following elements:

(1)Flight planning;

(2)Pre- and post-flight inspections;

(3)Procedures to evaluate the environmental conditions before and during the flight (i.e. real-time evaluation), including the assessment of meteorological conditions (METAR, TAF, etc.) with a simple recording system;

(4)Procedures to cope with unexpected adverse operating conditions (e.g. when ice is encountered during an operation that is not approved for icing conditions);

(5)Normal procedures;

(6)Contingency procedures (to cope with abnormal situations);

(7)Emergency procedures (to cope with emergency situations), including an ERP;

(8)Pre-flight procedures, including briefing of any involved persons about the potential risks and actions to take in case the UA misbehaves;

(9)Occurrence-reporting procedures; and

(b)The limitations of the external systems supporting the UAS operation2 are defined in the OM.

Comments

1 Operational procedures cover the deterioration of the UAS itself and of any external system supporting the UAS operation. Please, refer to Part B of the OM example for UAS operations published on the EASA website at https://www.easa.europa.eu/en/downloads/139674/en.

To properly address the deterioration of external systems required for the operation, it is recommended to:

(a)identify these ‘external systems’;

(b)identify the modes of deterioration of the ‘external systems’ (e.g. complete loss of GNSS, GDOP/PDOP, latency issues, etc.) which would lead to a loss of control of the operation;

(c)describe the means to detect these modes of deterioration of the external systems ; and

(d)describe the procedure(s) to be used when deterioration is detected (e.g. activation of the emergency recovery capability, switch to manual control, etc.).

2 In the scope of this assessment, external systems supporting the UAS operation are defined as systems that are not already part of the UAS but are used to:

(a)launch / take off the UA;

(b)make pre-flight checks; or

(c)keep the UA within its operational volume (e.g. GNSS, satellite systems, air traffic management, U-space).

External systems activated/used after a loss of control of the operation are excluded from this definition.

Criterion #3

(Consideration of potential human error)

As a minimum, operational procedures⁷⁶:

(a)include a clear distribution and assignment of tasks, and

(b)rely on checklists to ensure staff are adequately performing their assigned tasks.

Operational procedures take human error into consideration.

Same as ‘medium’. In addition, the remote crew3 receives crew resource management (CRM)4 training.

Comments

1 Please, refer to Part B of the OM example published on the EASA website at

https://www.easa.europa.eu/en/downloads/139674/en.

N/A

3 In the context of SORA, the term ‘remote crew’ refers to any person involved in the operation.

4 CRM training focuses on the effective use of all the remote crew to ensure safe and efficient operation, reducing error, avoiding stress and increasing efficiency. Elements of the CRM training may be found in the AMC and GM to point ORO.FC.115 to Regulation (EU) No 965/2012.

Criterion #4

(Emergency response plan (ERP)

The ERP:

(a)is suitable for a given situation6;

(b)effectively mitigates all anticipated hazardous secondary effects after the initial crash;

(c)clearly delineates the duties of the remote crew member(s);

(d)is practical to use and for training purposes, so that the remote crew can execute the procedures effectively under stress.

The ERP contains as a minimum:

(a)the list of anticipated emergency situations with secondary effects;

(b)the procedures for each of the identified anticipated emergency situations (including criteria to identify each of these situations);

(c)the list of relevant contacts to reach (e.g. ATC, police, fire brigade, first responders).

Comments

6 The ERP should be proportional to the potential secondary effects of a ground impact, i.e. those effects that may occur after the initial ground impact (e.g. fire, release of poisonous gas). AMC3 UAS.SPEC.030(3)(e) provides additional information. The ERP chapter of the OM published on the EASA website (https://www.easa.europa.eu/en/domains/drones-air-mobility/operating-drone/specific-category-civil-drones#group-easa-downloads) may be considered as a reference.

OPERATIONAL PROCEDURES

LEVEL of ASSURANCE

Low

(SAIL I)

Medium

(SAIL II)

High

(SAIL III to VI)

OSO #08, Operational procedures are defined, validated and adhered to

Criterion #1

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #081 using the form attached to the MoC.

SAIL III same as SAIL I and II.

SAIL IV: EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

SAIL V and VI: EASA has verified the claimed integrity through the issuance of a type certificate according with Annex I (Part 21) to Regulation (EU) No 748/2012 issued following an application from the UAS designer.

Comments

https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

N/A

Criteria#2, #3 and #4

The UAS operator declares the adequacy of the operational procedures and the ERP. As a minimum, the emergency procedures are tested.

(a)Operational procedures and the ERP are developed according to AMC2 UAS.SPEC.030(3)(e) and AMC3 UAS.SPEC.030(3)(e) respectively.

(b)The adequacy of the contingency and emergency procedures is proven through:

(1)dedicated flight tests; or

(2)simulation, provided that the representativeness of the simulation means is proven valid for the intended purpose with positive results; or

(3)any ot+her means acceptable to the competent authority.

Same as ‘medium’.

In addition:

(a)Flight tests performed to validate the operational procedures and the checklists cover the complete flight envelope or are proven to be conservative.

(b)The operational procedures, checklists, flight tests and simulations are validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

(c) The representativeness of the tabletop exercise1 of the ERP is validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

Comments

Operational procedures do not require validation against either a standard or a means of compliance that is considered adequate by the competent authority.

1 The tabletop exercise may involve the third parties identified in the ERP.

Alternative criteria #2, #3 and #4 taking credit for functional-test-based (FTB) methods

FUNCTIONAL-TEST-BASED (FTB) METHODS (for SAILs up to and including IV)

If the UAS operator has evidence of the FTB flight hours proportionate to the risk/SAIL of the UAS operation meeting either set of conditions described either in Section E.3(c) or in Section E.3(d) and executed:

(a)within the full operational scope/envelope intended by the UAS operator; and

(b)following the operational procedures included in the operation manual,

then the assurance that the operational procedures are adequate is fulfilled at the level corresponding to the SAIL being demonstrated by the FTB approach2.

Comments

2 As an example, if the number of test cycles supporting the FTB flight hours is proportionate to the risk of a SAIL III operation (i.e. 3 000 FH), the assurance level for OSO #08 is fulfilled at ‘high’ level.

REMOTE CREW COMPETENCIES

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #09, Remote crew trained and current

Criterion

The theoretical and practical training:

(a)ensures knowledge of:

(1)the UAS Regulations;

(2)airspace operating principles;

(3)airmanship and aviation safety;

(4)human performance limitations;

(5)meteorology and assessment of meteorological conditions;

(6)navigation/charts;

(7)the UAS;

(8)operational procedures and the ERP; and

(9)the use of external services, including service limitations and system recovery, if any1;

(b)is adequate for the UAS operation, i.e. allows the remote crew to control the normal, abnormal and emergency situations potentially resulting from technical issues with the UAS or from external systems supporting the UAS operation, human errors or adverse environmental conditions2,3;

(c)specifies proficiency requirements and training recurrence.

Comments

1 If external services are used, the UAS operator is responsible for using the services in the intended manner (e.g. as defined in a service level agreement) and ensuring that the remote crew is trained to use the services as intended.

2 The details of the areas to be covered for the different subjects listed above are provided in AMC1 UAS.SPEC.050(1)(d) ‘Theoretical knowledge subjects for the training of the remote pilot and all personnel in charge of duties essential to the UAS operation in the “specific” category’, in AMC2 UAS.SPEC.050(1)(d) ‘Practical-skill training of the remote pilot and all personnel in charge of duties essential to the UAS operation in the “specific” category’ and in AMC3 UAS.SPEC.050(1)(d) ‘UAS operation-specific endorsement modules’.

3 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

REMOTE CREW COMPETENCIES

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #09, Remote crew trained and current

Criterion

Training is self-declared (with evidence available).

(a)The training syllabus is available and kept up to date.

(b)Evidence of the theoretical and practical training is available.

The competent authority of the Member State or an entity that is designated by the competent authority:

(a)validates the training syllabus; and

(b)verifies the remote crew competencies.

Comments

N/A

N/A

N/A

DETERIORATION OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #13

External services supporting UAS operations are adequate for the UAS operation

Criterion

The UAS operator ensures that the level of performance for any externally provided service necessary for the safety of the flight1 is adequate for the UAS operation.

If the externally provided service requires communication between the UAS operator and the service provider, the UAS operator ensures there is effective communication to support the service provision.

Roles and responsibilities between the UAS operator and the external service provider are defined.

Comments

1 A service whose loss would directly lead to a loss of control of the operation as identified per OSO #05.

Comments

N/A

N/A

Requirements for contracting services with the service provider(s) may be derived from ICAO Standards and Recommended Practices (SARPs) that are currently under development.

DETERIORATION OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #13

External services supporting UAS operations are adequate for the UAS operation

Criterion

The UAS operator declares1 that the requested level of performance for any externally provided service necessary for the safety of the flight is achieved.

The UAS operator has supporting evidence that the required level of performance for any externally provided service required for the safety of the flight can be achieved for the full duration of the operation.

This may take the form of a service-level agreement (SLA) or any official commitment that prevails between a service provider and the UAS operator on the relevant aspects of the service (including quality, availability, and responsibilities).

The UAS operator has a means to monitor externally provided services which affect flight-critical systems and takes appropriate actions if real-time performance could lead to the loss of control of the operation.

Same as ‘medium’. In addition:

(a)the evidence of the performance of an externally provided service is achieved through demonstrations; and

(b)the competent authority of the Member State or an entity that is designated by the competent authority validates the claimed level of integrity.

Comments

1 Supporting evidence for this declaration may still be requested by the competent authority.

Supporting evidence may take the form of a service level agreement (SLA) or any official commitment that prevails between a service provider and the UAS operator on relevant aspects of the service (including quality, availability and responsibilities).

As an example, if a UAS operator uses an external surveillance service, it should have evidence available supporting the claim that the service meets the performance requirements of Annex D to this AMC.

N/A

N/A

MULTI-CREW COORDINATION

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #16 Multi-crew coordination

Criterion #1

(Procedures)

The UAS operator develops procedures to ensure coordination between the crew members, and robust and effective communication channels are available and as a minimum cover:

(a)assignment of tasks to the crew; and

(b)establishment of step-by-step communications, including the establishment and use of proper phraseology between the remote crew members involved in the aerial part of the operation.1

Comments

1 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see the table below).

Criterion #2

(Training)

Remote crew training covers multi-crew coordination

Same as ‘low’. In addition, the remote crew2 receives CRM3 training.

Same as ‘medium’.

Comments

N/A

2 In line with definition I.110 ‘Remote pilot (in command)’ provided in Annex I to this AMC, the term ‘remote crew’ refers to any person that performs duties essential to the safety of flight (e.g. AOs, UA observers).

3 CRM training focuses on the effective use of all the remote crew to assure a safe and efficient operation, reducing error, avoiding stress and increasing efficiency.

N/A

Criterion #3

(Communication devices)

N/A

The UAS operator determines that the performance of communication devices is adequate to safely conduct the UAS operation.

The remote crew has the means to check the performance of the communication devices at intervals deemed appropriate to ensure the performance continues to meet the operational requirements throughout the operation.

Same as ‘medium’. In addition, communication devices are redundant4 and comply with standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority.

Comments

N/A

N/A

4 This implies the provision of an extra device to cope with the failure of the first device.

HUMAN ERROR

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #16 Multi-crew coordination

Criterion #1

(Procedures)

(a)Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority of the Member State.

(b)The adequacy of the procedures and checklists is declared.

(a)Procedures are validated against standards considered adequate by the competent authority of the Member State and/or in accordance with means of compliance acceptable to that authority1.

(b)The adequacy of the procedures is proven through:

(1)dedicated flight tests; or

(2)simulation, provided that the representativeness of the simulation means is proven valid for the intended purpose with positive results; or

(3)any other means acceptable to the competent authority.

Same as ‘medium’. In addition:

(a)flight tests performed to validate the procedures cover the complete flight envelope or are proven to be conservative; and

(b)the procedures, flight tests and simulations are validated by the competent authority of the Member State or an entity designated by the competent authority.

Comments

N/A

1 AMC2 UAS.SPEC.030(3)(e) (‘Operational procedures for medium and high levels of robustness’) is considered an acceptable means of compliance.

N/A

Alternative criterion #1 taking credit for functional-test-based (FTB) methods

FUNCTIONAL-TEST-BASED (FTB) METHODS (for SAILs up to and including IV):

If the UAS operator has evidence of the FTB flight hours proportionate to the risk/SAIL of the operation meeting either set of conditions described either in Section 3(c) or in Section 3(d) and executed:

—within the full operational scope/envelope intended by the UAS operator; and

—following the operational procedures referred to in the operational authorisation,

then the assurance that the operational procedures are adequate is fulfilled at the level corresponding to the SAIL being demonstrated by the FTB approach2.

N/A3

Comments

2 As an example, if the number of test cycles supporting the FTB flight hours is proportionate to the risk of a SAIL III operation (i.e. 3 000 FH), the assurance level for OSO #16 Criterion #1 is fulfilled at ‘medium’ level.

3 FTB methods are not considered feasible for operations with a SAIL V or VI.

Criterion #2

(Training)

Training is self-declared (with evidence available).

(a)Training syllabus is available.

(b)Evidence of the theoretical and practical training is available.

The competent authority of the Member State or an entity that is designated by the competent authority:

(a)validates the training syllabus; and

(b)verifies the remote crew competencies.

Comments

N/A

N/A

N/A

Criterion #3

(Communication devices)

N/A

The UAS operator has supporting evidence that the required level of integrity is achieved. This is typically done by testing, analysis, simulation1, inspection, design review or through operational experience.

Unless the communication device is included in the UAS type design, the competent authority or an entity that is designated by the competent authority validates the claimed level of integrity.

Comments

N/A

1 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

HUMAN ERROR

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #17

Remote crew is fit to operate

Criterion

The UAS operator has a policy defining the criteria1 and the means on how the remote crew can declare themselves fit to operate before starting their duty, and on how to report themselves unfit, if required, during their shift.

Same as ‘low’. In addition:

—Duty, flight duty and resting times for the remote crew are defined by the UAS operator and are adequate for the operation.

—The UAS operator defines requirements appropriate for the remote crew to operate the UAS.

Same as ‘medium’. In addition:

—The remote crew is medically fit.

—A fatigue risk management system (FRMS) is in place to manage any escalation in duty/flight duty times.

Comments

1 Criteria should take into account national legislation and may cover drugs (including prescriptions) and alcohol consumption.

N/A

N/A

HUMAN ERROR

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #17

Remote crew is fit to operate

Criterion

The policy defining the criteria and the means for the remote crew to declare themselves fit to operate before starting their duty and to report themselves unfit, if required, during their shift is documented.

Same as ‘low’. In addition:

(a)Remote crew duty, flight duty and the resting time policy are documented.

(b)Remote crew duty cycles are logged and cover as a minimum:

(1) when the remote crew members’ duty day commences;

(2) when the remote crew members are free from duties; and

(3) resting times within the duty cycle.

Same as ‘medium’. In addition:

(a)Medical standards considered adequate by the competent authority and/or the means of compliance acceptable to that authority are established and the competent authority of the Member State or an entity that is designated by the competent authority verifies that the remote crew is medically fit.

(b)The competent authority of the Member State or an entity that is designated by the competent authority validates the duty/flight duty times.

The FRMS is validated by the competent authority of the Member State or by an entity that is designated by the competent authority and internally monitored by the UAS operator.

Comments

N/A

N/A

N/A

HUMAN ERROR

LEVEL of INTEGRITY

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #18

Automatic protection of the flight envelope from human errors

Criterion

The UAS flight control system incorporates automatic protection of the flight envelope to prevent the remote pilot from making any single input under normal operating conditions that would cause the UA to exceed its flight envelope or prevent it from recovering in a timely fashion.

The UAS flight control system incorporates automatic protection of the flight envelope to ensure the UA remains within the flight envelope or ensures a timely recovery to the designed operational flight envelope following remote-pilot error(s).1,2

Comments

N/A

1 The distinction between a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below).

2 Compared to the low level of robustness, medium and high levels need to address any operating conditions (normal, abnormal and emergency) and the potential for multiple errors.

HUMAN ERROR

LEVEL of ASSURANCE

Low

(SAIL III)

Medium

(SAIL IV)

High

(SAIL V & VI)

OSO #18

Automatic protection of the flight envelope from human errors

Criterion

The UAS designer develops the automatic protection of the flight envelope in-house or out of the box (e.g. using commercial offtheshelf elements), without following specific standards.

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with the MoC to OSO #181 using the form attached to the MoC.

The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

N/A

N/A

HUMAN ERROR

LEVEL of INTEGRITY

Low

(SAIL III)

Medium

(SAIL IV & V)

High

(SAIL VI)

OSO #19

Safe recovery from human error

Criterion

Systems detecting and/or recovering from human errors are developed according to industry best practices.

Systems detecting and/or recovering from human errors are developed to standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority.

Same as ‘medium’.

Comments

N/A

N/A

N/A

HUMAN ERROR

LEVEL of ASSURANCE

Low

(SAIL III)

Medium

(SAIL IV & V)

High

(SAIL VI)

OSO #19

Safe recovery from human error

Criterion

The UAS designer declares that the required level of integrity has been achieved.

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #19/#201 using the form attached to the MoC.

The UAS designer has supporting evidence that the required level of integrity is achieved. That evidence is provided through testing, analysis, simulation2, inspection, design review or operational experience.

If the operation is classified as SAIL IV, the UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report (DVR) issued following an application from the UAS designer.

If the operation is classified as SAIL V, the UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

2 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

HUMAN ERROR

LEVEL of INTEGRITY

Low

(SAIL II & III)

Medium

(SAIL IV & V)

High

(SAIL VI)

OSO #20

A human factors evaluation has been performed and the HMI has been found appropriate for the intended UAS operation

Criterion

The UAS information and control interfaces are clearly and succinctly presented and do not confuse, cause unreasonable fatigue, or contribute to remote crew errors that could adversely affect the safety of the operation.

Same as ‘medium’. In addition, the human factors evaluation is expected to cover:

(a)an appraisal to check that the remote crew workload remains acceptable in both normal and emergency situations;

(b)an appraisal of the efficiency of the emergency procedures (efficacy of the actions, expected potential latencies);

(c)analyses to check if prioritisation of alarms and emergency procedures should be put in place to organise emergency procedures in such a way that they remain adapted to the criticality of the situation.

Comments

If an electronic means is used to support the remote crew members in their role to maintain awareness of the position of the unmanned aircraft, its HMI:

—is sufficient to allow the remote crew members to determine the position of the UA during operation; and

—does not degrade the remote crew members’ ability to:

—scan the airspace visually where the unmanned aircraft is operating for any potential collision hazard; and

—maintain effective communication with the remote pilot at all times.

HUMAN ERROR

LEVEL of ASSURANCE

Low

(SAIL II & III)

Medium

(SAIL IV & V)

High

(SAIL VI)

OSO #20

A human factors evaluation has been performed and the HMI has been found appropriate for the intended UAS operation

Criterion

The UAS designer conducts a human factors evaluation of the UAS to determine whether the HMI is appropriate for the intended UAS operation. The HMI evaluation is based on inspection or analyses.

The adequacy of the result of the HMI evaluation is declared.

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with MoC to OSO #19/#201 using the form attached to the MoC.

Same as ‘low’ but the HMI evaluation is based on demonstration or simulations.1

For operations classified in SAIL IV, the UAS operator should use a UAS for which EASA has issued a design verification report (DVR) following an application from the UAS designer.

For operations classified in SAIL V, the UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Same as ‘medium’. In addition, the UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

1 https://www.easa.europa.eu/en/document-library/product-certification-consultations/mean

1 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

N/A

Alternative criterion for taking credit for functional-test-based (FTB) methods

If the UAS designer has evidence of the FTB flight hours proportionate to the risk/SAIL of the operation meeting either set of conditions described either in Section 3(c) or in Section 3(d) and executed:

(a)within the full operational scope/envelope intended by the UAS operator; and

(b)following the operational procedures and the remote crew training referred to in the operational authorisation,

then the assurance that the operational procedures are adequate is fulfilled at the level corresponding to the SAIL being demonstrated by the FTB approach2.

N/A

Comments

2 As an example, if the number of test cycles supporting the FTB flying hours is proportionate to the risk of a SAIL III operation (i.e. 3 000 FH), the assurance level for OSO #20 is fulfilled at ‘low’ level.

N/A

ADVERSE OPERATING CONDITIONS

LEVEL of INTEGRITY

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #23

Environmental conditions for safe operations are defined, measurable and adhered to

Criterion

The environmental conditions for safe operations are defined and reflected in the UAS flight manual or equivalent document1.

Comments

1 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (see table below). For SAL III, compliance with the EASA MoC to OSO #24 already determines compliance with OSO #23. Refer to OSO #24.

ADVERSE OPERATING CONDITIONS

LEVEL of ASSURANCE

Low

(SAIL I & II)

Medium

(SAIL III & IV)

High

(SAIL V & VI)

OSO #23

Environmental conditions for safe operations are defined, measurable and adhered to

Criterion #1

(Definition)

The UAS designer declares that the required level of integrity has been achieved.

The UAS designer has supporting evidence that the required level of integrity is achieved. This is typically done by testing, analysis, simulation, inspection, design review or through operational experience.

If the operation is classified as SAIL IV, the UAS operator should use a UAS for which EASA has issued a design verification report (DVR) following an application from the UAS designer.

The UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

N/A

ADVERSE ENVIRONMENTAL CONDITIONS

LEVEL of INTEGRITY

N/A

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #24

The UAS is designed and qualified to operate in adverse environmental conditions

Criterion

N/A

The UAS is designed to limit the effect of the environmental conditions defined and reflected in the UAS flight manual.

The UAS is designed according to environmental standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to EASA.

Comments

N/A

As an example, if a UAS is proposed to be operated in raining conditions, it is not necessary to comply with DO-160G waterproof conditions; the rain threshold may be limited as long as it is representative of the envisaged environmental conditions.

N/A

ADVERSE OPERATING CONDITIONS

LEVEL of ASSURANCE

N/A

Medium

(SAIL III)

High

(SAIL IV to VI)

OSO #24

The UAS is designed and qualified to operate in adverse environmental conditions

Criterion

N/A

The UAS designer has supporting evidence that the required level of integrity has been achieved. This is typically done by testing, analysis, simulation1, inspection, design review or through operational experience.

The UAS operator should use a UAS for which the UAS designer has issued a statement of compliance with the MoC to OSO #242 using the form attached to the MoC.

If the operation is classified as SAIL IV, the UAS operator should use a UAS for which EASA has issued a design verification report (DVR) following an application from the UAS designer.

If the operation is classified as SAIL V or VI, the UAS operator should use a UAS for which EASA has issued a type certificate or a restricted type certificate in accordance with Annex I (Part 21) to Regulation (EU) No 748/2012 following an application from the UAS designer.

Comments

N/A

1 When simulation is performed, the validity of the targeted environment that is used in the simulation needs to be justified.

2 https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail

N/A

Alternative criterion

N/A

FUNCTIONAL-TEST-BASED (FTB) METHODS:

If the UAS designer has evidence of the FTB flight hours proportionate to the SAIL of the operation meeting either set of conditions described either in Section E.3(c) or in Section E.3(d) and executed

(a)within the full operational scope/envelope intended by the UAS operator; and

(b)following the maintenance instructions, the operational procedures and the remote crew training referred to in the operational authorisation,

then the assurance that the operational procedures are adequate is fulfilled at the level corresponding to the SAIL being demonstrated by the FTB approach1.

N/A

Comments

N/A

1 As an example, if the number of test cycles supporting the FTB flight hours is proportionate to the risk of a SAIL III operation (i.e. 3 000 FH), the assurance level for OSO #24 is fulfilled at ‘medium’ level.

N/A

Containment of untethered UA

LEVEL of INTEGRITY

Low

Medium

High

Criterion #1

(Operational volume containment)

UAS should be designed such that:

—(qualitative) no probable1 single failure of the UAS or of any external system supporting the operation could lead to operation outside the operation volume;

OR

— (quantitative) the probability of the failure condition ‘UA leaving the operational volume’ should be less than 10–3/FH.

The UAS should be designed such that:

—(qualitative) no remote single failure3 of the UAS or of any external system supporting the operation could lead to operation outside the operational volume;

OR

—(quantitative) the probability of the failure condition ‘UA leaving the operational volume’ should be less than 10–4/FH4.

Comments

1 Failures anticipated to occur one or more times during the entire operational life of an item.

2 This may be achieved by a tether that prevents the UA from exiting the operational volume (see containment of tethered UA below).

3 ‘failure’ needs to be understood as an occurrence that affects the operation of a component, part or element such that it can no longer function as intended. Errors may cause failures but are not considered failures. Some structural or mechanical failures may be excluded from the criterion if it can be shown that such structural or mechanical parts were designed according to aviation industry best practices.

3 Failures unlikely to occur with each UA during its operational life but that may occur several times when considering the total operational life of a number of UA of a particular type.

4 This means a reduction by a factor of 10 of the likelihood of exiting the operational volume compared to the ‘low’ and ‘medium’ integrity containment.

Criterion #2

(End of flight upon exit of the operational volume)

When the UA leaves the operational volume, the immediate termination of the flight should be initiated through a combination of procedures/processes and/or available technical means.

Comments

Such criteria may be satisfied by the operational procedures developed by the UAS operator that may rely (fully or partially, depending on the level of automation of the UAS) on technical means developed by the UAS designer and documented in the UAS flight manual.

Criterion #3

(Definition of the final ground risk buffer)

The UAS operator defines the size of the ground risk buffer. In principle, the ground risk buffer should at least adhere to the 1:1 principle5. Alternatively, as the 1:1 rule may not be suitable for some UA configurations (e.g. fixed-wing or parachute-equipped UA), the competent authority may require defining the ground risk buffer based on a ballistic methodology approach, a glide trajectory6, representative flight tests and/or a combination of these.

A smaller ground risk buffer value may be proven by the UAS operator for a rotary-wing UA using a ballistic methodology approach acceptable to the competent authority.

If the UAS uses a parachute, the UAS operator should consider the effect of wind on the UAS when it is deployed.

In addition to ‘low’ robustness, the ground risk buffer should consider the following points:

(a)Probable7 single failures (including the projection of high-energy parts such as rotors and propellers) which would lead to an operation outside the operational volume;

(b)Meteorological conditions (e.g. maximum sustained wind);

(c)UAS latencies (e.g. latencies that affect the timely manoeuvrability of the UA);

(d)UA behaviour when activating a technical containment measure considering UA performance.

Comments

5 The 1:1 principle refers to applying a ground risk buffer that is as wide as the maximum height of the operational volume. For the evaluation of the size of the ground risk buffer based on the 1:1 principle, see Annex A Section A.5.2.4.

6 See Annex A Section A.5.2.4.

7 For the purpose of this assessment, the term ‘probable’ should be interpreted in a qualitative way as ‘anticipated to occur one or more times during the entire operational life of a UAS’.

Criterion #4

(Ground risk buffer containment)

N/A

The UAS should be designed such that no single failure8 of the UAS or of any external system supporting the operation could lead to operation outside the ground risk buffer.

Software (SW) and airborne electronic hardware (AEH) whose development error(s) could directly lead to operations outside the ground risk buffer should be developed to an industry standard or methodology recognised as adequate by the competent authority.

Comments

N/A

8 Example methods for achieving this may include:

—an independent flight termination system (FTS) that will initiate the end of the flight when the UA exits the operational volume; or

—a secondary independent emergency flight control system that ends the flight in a controlled manner without exceeding the ground risk buffer; or

—a tether that prevents the UA from exiting the ground risk buffer.

Containment of untethered UA

LEVEL of ASSURANCE

Low

Medium

High

For all criteria

The applicant declares1 that the required level of integrity has been achieved.

The UAS designer:

(a) for criterion #1, conducts a design and installation appraisal2 including as a minimum:

—design and installation features (e.g. independence, separation or redundancy claims);

—any relevant particular risk (e.g. hail, ice, snow, electromagnetic interference, etc.) associated with the UAS operation and how they are being addressed;

(b) for criterion #2, tests the technical means to safely end the flight and includes the procedures in the UAS flight manual.

The UAS operator:

—for criterion #2, tests the adequacy of the emergency procedures to terminate the flight.

The applicant has supporting evidence that the required level of integrity has been achieved. This is typically done by testing, analysis, simulation2, inspection and design review.

Among the supporting evidence:

(a)for criterion #1 and criterion #4: same as criterion #1, ‘low’;

(b)for criterion #2: the adequacy of the emergency procedures to terminate the flight is proven through:

—dedicated flight tests; or

—simulation provided the simulation is proven valid for the intended purpose with positive results.

Same as ‘medium’.

The UAS operator should use a UAS for which EASA has verified the claimed integrity through a design verification report ‘DVR’.

In addition, the competent authority of the Member State or the entity that is designated by the competent authority validates the claimed level of integrity for the non-design-related criteria.

Comments

1 Supporting evidence for this declaration may still be requested by the competent authority.

2 A simple, written justification from the UAS designer, including functional diagrams and a description of how the system works, explaining why the integrity claim (i.e. no (probable/remote) single failure criterion) is met is an acceptable means of compliance.

2 When simulation is used, the suitability of the targeted environment used in the simulation needs to be justified.

The UAS operator may use a UAS for which the UAS designer has issued a statement of compliance with the MoC to Light-UAS.2511 (https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-light-uas2511-moc-light) using the form attached to the MoC when the UAS meets the conditions defined in such MoC. For UAS configurations exceeding the applicability of such MoC, the competent authority may decide to still accept statements based on such MoC with evidence available, or to accept appropriate MoC proposed by the UAS designer. Otherwise, the competent authority may request the UAS operator to use a UAS for which EASA has verified the claimed integrity.

N/A

Containment of tethered UA

LEVEL of INTEGRITY

Low, Medium and High1

Criterion #1

(Technical design)

(a)The length of the line is adequate to contain the UA in the operational volume.

(b)The strength of the line is compatible with the ultimate loads2 expected during the operation.

(c)The strength of attachment points is compatible with the ultimate loads2 expected during the operation.

(d)The tether cannot be cut by rotating propellers.

Comments

UAS operators may purchase a UAS designed to be used with a tether or they may apply a tether. In this case, the UAS operator is required to comply with criterion #1.

Criterion #2

(Procedures)

The UAS operator has procedures to install and periodically inspect the condition of the tether.

Comments

1 The distinction between a ‘medium’ and a ‘high’ level of robustness for this criterion is achieved through the level of assurance provided below.

2 Ultimate loads are identified as the maximum loads to be expected in service, including all possible nominal and failure scenarios multiplied by a 1.5 factor of safety.

Containment of tethered UA

LEVEL of ASSURANCE

Low

Medium

High

Criterion #1

(Technical design)

The UAS designer or the UAS operator declares1 that the required level of integrity has been achieved.

The UAS designer or the UAS operator has supporting evidence (including the tether material specifications) to claim the required level of integrity has been achieved.

(a)This is typically achieved through testing or operational experience.

(b)Tests can be based on simulations; however, the validity of the target environment used in the simulation needs to be justified.

The claimed level of integrity is validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

Comments

1 Supporting evidence for this declaration may still be requested by the competent authority.

N/A

N/A

Criterion #2

(Procedures)

The UAS operator declares to have adequate procedures.

(a)Procedures are validated against standards considered adequate by the competent authority and/or in accordance with means of compliance acceptable to that authority.

(b)The adequacy of the procedures is proved through:

—dedicated flight tests; or

—simulation provided the simulation is proven valid for the intended purpose with positive results.

Same as ‘medium’. In addition:

(a)flight tests performed to validate the procedures cover the complete flight envelope or are proven to be conservative;

(b)the procedures, flight tests and simulations are validated by the competent authority of the Member State or by an entity that is designated by the competent authority.

Comments

1 Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority.

1 National aviation authorities (NAAs) may define the standards and/or the means of compliance they consider adequate. The SORA Annex B will be updated at a later point in time with a list of adequate standards based on the feedback provided by the NAAs.

N/A