AMC2 UAS.SPEC.030(3)(e) Application for an operational authorisation

OPERATIONAL PROCEDURES WITH ‘MEDIUM’ AND ‘HIGH’ LEVEL OF ROBUSTNESS

1.      Scope of this AMC

1.1     This AMC addresses the criteria for the medium and high level of robustness of the operational procedures that are required under the following OSOs:

(a)     OSO #08: Technical issue with the UAS — Operational procedures are defined, validated and adhered to;

(b)     OSO #11: Deterioration of the external systems that support the UAS operations — Procedures are in place to handle the deterioration of the external systems that support the UAS operations;

(c)      OSO #14: Human error — Operational procedures are defined, validated and adhered to; and

(d)     OSO #21: Adverse operating conditions — Operational procedures are defined, validated and adhered to.

These criteria may be used to also address the criteria for the medium and high levels of robustness of the operational procedures required under the mitigation means, which are defined in Annex B to AMC1 Article 11

2.      Criteria for the level of integrity

2.1.    Criterion #1: Procedure definition

2.1.1. Annex E to AMC1 Article 11 provides the minimum elements that the operational procedures need to appropriately cover for the intended operations.

2.1.2. AMC1 UAS.SPEC.030(3)(e) on the OM template[96] for the operational authorisation of UAS operations in the ‘specific’ category and the corresponding guidance in GM1 UAS.SPEC.030(3)(e) should be followed to define the procedures, as they provide more details on the elements that are referred to in point 2.1.1.

2.2.    Criterion #2: Procedure complexity

2.2.1. Based on the SORA criterion of ‘procedure complexity’ for a low level of integrity, procedures with a higher level of integrity should not be complex. This implies that the workload and/or the interactions with other entities (e.g. air traffic management (ATM), etc.) of remote pilots and/or other personnel in charge of duties essential to the UAS operation should be limited to a level that may not jeopardise their ability to adequately follow the procedures.

2.2.2. Procedures should be validated in accordance with point 3.5.

2.3.    Criterion #3: Consideration of potential human error

Operational procedures should be developed to minimise human errors:

(a)     each of the tasks and the complete sequence of the tasks of a procedure should be intuitive, unambiguous, and clearly defined;

(b)     the tasks should be clearly assigned to the relevant roles and persons, ensuring a balanced workload (see point 2.2); and

(c)      the procedures should adequately address fatigue and stress, considering, among other aspects, the following: duty times, regular breaks, rest periods, the applicable health and safety requirements in the operational environment, handover/takeover procedures, responsibilities, and workload.

3.      Criteria for the level of assurance

3.1.    The purpose of the validation process described in this AMC is to confirm whether the proposed operational procedures are complete and adequate to ensure the safe conduct of the intended UAS operations.

3.2.    The validation process should include the following:

(a)     a review of the completeness of the procedures to ensure that:

(1)     all elements that are indicated in points 2.1.1 and 2.1.2 have been addressed; and

(2)     all relevant references have been considered, including but not limited to:

(i)      the applicable regulations;

(ii)      the requirements from the competent authority and/or other relevant authorities or entities;

(iii)     the local requirements and conditions;

(iv)     the available recommended practices for the intended type of UAS operations;

(v)      the instructions from the UAS manufacturer and of any other UAS equipment manufacturer, if applicable;

(vi)     the instructions and requirements from externally provided services that support the UAS operations, if applicable;

(vii)    the results from previous experience, including tests and/or simulations as those indicated in point (c) and (d); and

(viii)   consensus-based voluntary industry standards;

(b)     an expert judgement to assess the adequacy of the procedures based on:

(1)     the objective(s) of each procedure;

(2)     relevant key performance parameters/indicators and/or benchmarking of options, if applicable;

(3)     an assessment of the procedures’ complexity in accordance with point 2.2; and

(4)     an assessment of the effect of human factors on procedures in accordance with point 2.3;

(c)      a proof of the adequacy of the procedures through tests or practical exercise for phases of the UAS operation other than the UA flight, which involve the UAS and/or any external system that supports the operation;

(d)     a proof of the adequacy of the contingency and emergency procedures through:

(1)     dedicated flight tests conducted in an area with reduced air and ground risk and/or representative subsystems tests; or

(2)     simulation, provided it is proven valid for the intended purpose with positive results; or

(3)     any other means acceptable to the competent authority that issues the authorisation;

(e)     if the option in point (d)(3) is selected, a substantiation of the suitability of those means for proving the adequacy of the procedures;

(f)      a record of proof of the adequacy of the procedures, including at least:

(1)     the UAS operator’s name and registration number;

(2)     the date(s) and place(s) of tests or simulations;

(3)     identification of the means used, e.g. for tests or simulations that use actual UASs: the type category, the name of the manufacturer, and the model and serial number of each UA used;

(4)     a description of tests or simulations conducted, including their purpose, the expected results (including key performance parameters/indicators, where relevant), how they were conducted, the results obtained, and conclusions; and

(5)     the signature of the person that is appointed by the UAS operator to conduct the tests or simulations;

(g)     for UAS operations that require a high level of assurance, the procedures and the dedicated flight tests, simulations, or other means acceptable to the competent authority, which are indicated in point 3.2, validated by the competent authority that issues the authorisation or by an entity that is recognised by that competent authority.

3.3.    The following conditions apply to the dedicated flight tests that are indicated in point 3.2(d)(1):

(a)     the configuration of the UAS hardware and software should be identified;

(b)     the UAS operator should conduct the dedicated flight tests;

(c)      if no simulations as the ones indicated in point 3.2(d)(2) are conducted, the dedicated flight tests should cover all the relevant aspects of the contingency and emergency procedures;

(d)     for UAS operations that require a high level of assurance, the dedicated flight tests that are performed to validate the procedures and checklists should cover the complete flight envelope or prove to be conservative;

(e)     the UAS operator should conduct as many flight tests as agreed with the competent authority to prove the adequacy of the proposed procedures;

(f)      the dedicated flight tests should be conducted in a safe environment (reducing the ground and air risks to the greatest extent possible), while ensuring the representativeness of the tests’ results for the intended UAS operations; and

(g)     the UAS operator should record the flight tests as part of the information to be recorded as per point UAS.SPEC.050(1)(g), e.g. in a logbook, as indicated in AMC1 UAS.SPEC.050(1)(g); such a record should include any potential issues identified.

3.4.    To ensure that the integrity criterion of point 2.2 is met, the complexity of the procedures should be validated.

3.4.1. This validation should include:

(a)     an expert judgement, as indicated in point 3.3(b); and

(b)     a proof of the adequacy of the procedures, as indicated in point 3.3(c) and (d).

3.4.2. The UAS operator should adopt a method for the evaluation of the complexity of the procedures by the relevant personnel, i.e. the remote pilot and/or other personnel in charge of duties essential to the UAS operation. That method should be adequate for the evaluation of the workload that is required by the task(s) of each procedure.

For example, a suitable method for evaluating the workload of the remote pilot and/or other personnel in charge of duties essential to the UAS operation may be the ‘Bedford Workload Scale’, which was conceived as a qualitative and relatively simple methodology for rating the pilots’ workload that is associated with the design of an aircraft’s human–machine interface (HMI). However, this methodology is deemed to be adequately generic to be also applicable to the tasks associated with the operational procedures to be conducted by remote pilots and/or other personnel in charge of duties essential to the UAS operation.

Figure 1 depicts the Bedford Workload Scale adapted to operational procedures for UAS operations: ‘pilot’ is replaced by ‘remote crew member’ (i.e. the remote pilot or other personnel in charge of duties essential to the UAS operation), and ‘pilot decision’ is replaced by ‘remote crew member performs a procedure task’. A procedure may include one or more tasks.

Figure 1 — Bedford Workload Scale adapted to operational procedures for UAS operations