Compare and highlight differences

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

Annex B to AMC1 to Article 11

Available versions for ERULES-1963177438-15556

ED Decision 2023/012/R found in: Unmanned Aircraft Systems (No 2019/947 and 2019/945) Part-UAS (Jul 2024)

Version Text

Annex B to AMC1 to Article 11

ED Decision 2023/012/R

INTEGRITY AND ASSURANCE LEVELS FOR THE MITIGATIONS USED TO REDUCE THE INTRINSIC GROUND RISK CLASS (GRC)

B.1 How to use Annex B

The following Table B-1 provides the basic principles to consider when using SORA Annex B.

<table border="1" cellpadding="0" cellspacing="0" width="607"><tr><td valign="top" width="32"></td><td valign="top" width="348">Principle description</td><td valign="top" width="227">Additional information</td></tr><tr><td valign="top" width="32">#1</td><td valign="top" width="348">Annex B provides assessment criteria for the integrity (i.e. safety gain) and assurance (i.e. method of proof) of the applicant’s proposed mitigations. The proposed mitigations are intended to reduce the intrinsic ground risk class (GRC) associated with a given operation.</td><td valign="top" width="227">The identification of mitigations is the responsibility of the applicant.</td></tr><tr><td valign="top" width="32">#2</td><td valign="top" width="348">Annex B does not cover the LoI of the competent authority. The Lol is based on the competent authority’s assessment of the applicant’s ability to perform the given operation. </td><td valign="top" width="227"></td></tr><tr><td valign="top" width="32">#3</td><td valign="top" width="348">A proposed mitigation may or may not have a positive effect in reducing the ground risk associated with a given operation.In the case where a mitigation is available but does not reduce the risk on the ground, its level of integrity should be considered equivalent to ‘None’.</td><td valign="top" width="227"></td></tr><tr><td valign="top" width="32">#4</td><td valign="top" width="348">To achieve a given level of integrity/assurance, when more than one criterion exists for that level of integrity/assurance, all the applicable criteria need to be met.</td><td valign="top" width="227"></td></tr><tr><td valign="top" width="32">#5</td><td valign="top" width="348">Annex B intentionally uses non-prescriptive terms (e.g. suitable, reasonably practicable) to provide flexibility to both the applicant and the competent authorities. This does not constrain the applicant in proposing mitigations, nor the competent authority in evaluating what is needed on a case-by-case basis.</td><td valign="top" width="227"></td></tr><tr><td valign="top" width="32">#6</td><td valign="top" width="348">This annex in its entirety also applies to single-person organisations.</td><td valign="top" width="227"></td></tr></table>

Table B.1 – Basic principles

B.2 M1 — Strategic mitigations for ground risk

M1 mitigations are ‘strategic mitigations’ intended to reduce the number of people at risk on the ground. To assess the integrity levels of M1 mitigations, the following need to be considered:

(a) the definition of the ground risk buffer and the resulting ground footprint; and

(b) the evaluation of the people at risk.

With the exception of the specific case of a ‘tether’ provided in the following paragraph (2), the generic criteria to assess the level of integrity (Table B.2) and level of assurance (Table B.3) of the M1 type ground risk mitigations are provided in following paragraph (1).

(1) Generic criteria

<table border="0" cellpadding="0" cellspacing="0" width="605"><thead><tr><td colspan="3" width="447">Level of integrity </td></tr><tr><td width="122">Low</td><td width="239">Medium</td><td width="86">High</td></tr></thead><tr><td rowspan="4" width="77">M1 — Strategic mitigations for ground risk</td><td width="81">Criterion #1 (Definition of the ground risk buffer)</td><td width="122">A ground risk buffer with at least a 1:1 rule1 or for rotary wing UA defined using a ballistic methodology approach acceptable to the competent authority.</td><td valign="top" width="239">The ground risk buffer takes into consideration:(a) improbable2 single malfunctions or failures (including the projection of high energy parts such as rotors and propellers) which would lead to an operation outside the operational volume;(b) meteorological conditions (e.g. wind);(c) UAS latencies (e.g. latencies that affect the timely manoeuvrability of the UA);(d) UA behaviour when activating a technical containment measure; and(e) UA performance.</td><td valign="top" width="86">Same as medium3</td></tr><tr><td width="81">Comments</td><td width="122">1 If the UA is planned to operate at an altitude of 150 m, the ground risk buffer should be a minimum of 150 m.</td><td colspan="2" width="325">2 For the purpose of this assessment, the term ‘improbable’ should be interpreted in a qualitative way as ‘Unlikely to occur in each UAS during its total life, but which may occur several times when considering the total operational life of a number of UAS of this type’.3 The distinction between a medium and a high level of robustness for this criterion is achieved through the level of assurance (Table 3 below).</td></tr><tr><td width="81">Criterion #2 (Evaluation of people at risk) </td><td width="122">The applicant evaluates the area of operations by means of on-site inspections or appropriate appraisals to justify lowering the density of the people at risk (e.g. a residential area during daytime when some people may not be present or an industrial area at night time for the same reason).</td><td width="239">The applicant evaluates the area of operations by use of authoritative density data (e.g. data from the U‑space data service provider) relevant for the proposed area and time of operation to substantiate a lower density of people at risk.If the applicant claims a reduction, due to a sheltered operational environment, the applicant: (a) uses a UA of less than 25 kg and not flying above 174 knots4, and(b) demonstrates that although the operation is conducted in a populated environment, it is reasonable to consider that most of the non-involved persons will be located within a building5. </td><td width="86">Same as medium. </td></tr><tr><td width="81">Comments</td><td width="122">N/A</td><td width="239">4 as per MITRE presentation given during the UAS Technical Analysis and Applications Center (TAAC) conference in 2016 titled ‘UAS EXCOM Science and Research Panel (SARP) 2016 TAAC Update’ - PR 16‑39795 The consideration of this mitigation may vary based on the local conditions.</td><td width="86">N/A</td></tr></table>

Table B.2 — Level of integrity assessment criteria for ground risk of non-tethered M1 mitigations

<table border="1" cellpadding="0" cellspacing="0" width="604"><thead><tr><td colspan="3" width="427">Level of assurance</td></tr><tr><td width="94">Low</td><td width="217">Medium</td><td width="115">High</td></tr></thead><tr><td rowspan="4" width="83">M1 — Strategic mitigations for ground risk</td><td width="95">Criterion #1 (Definition of the ground risk buffer)</td><td valign="top" width="94">The applicant declares that the required level of integrity is achieved1.</td><td valign="top" width="217">The applicant has supporting evidence to claim that the required level of integrity has been achieved. This is typically done by means of testing, analysis, simulation2, inspection, design review or through operational experience.</td><td valign="top" width="115">The claimed level of integrity is validated by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="95">Comments</td><td width="94">1 Supporting evidence may or may not be available.</td><td width="217">2 When simulation is used, the validity of the targeted environment used in the simulation needs to be justified.</td><td width="115">N/A</td></tr><tr><td width="95">Criterion #2 (Evaluation of people at risk)</td><td valign="top" width="94">The applicant declares that the required level of integrity has been achieved3.</td><td valign="top" width="217">The density data used for the claim of risk reduction is an average density map for the date/time of the operation from a static sourcing (e.g. census data for night time ops).In addition, for localised operations (e.g. intra-city delivery or infrastructure inspection), the applicant submits the proposed route/area of operation to the applicable authority (e.g. city police, office of civil protection, infrastructure owner etc.) to verify the claim of a reduced number of people at risk.</td><td valign="top" width="115">Same as medium; however, the density data used for the claim of risk reduction is a near-real time density map from a dynamic sourcing (e.g. cellular user data) and applicable for the date/time of the operation.</td></tr><tr><td width="95">Comments</td><td width="94">3 Supporting evidence may or may not be available</td><td width="217">N/A</td><td width="115">N/A</td></tr></table>

Table B.3 — Level of assurance assessment criteria for ground risk of non-tethered M1 mitigations

(2) Specific criteria in case of use of a tether to reduce people at risk

When an applicant wants to take credit for a tether to justify a reduction in the number of people at risk:

(a) the tether needs to be considered part of the UAS and assessed based on the criteria below, and

(b) potential hazards created by the tether itself should be addressed through the OSOs defined in Annex E.

The level of integrity criteria for a tethered mitigation is found in Table B.4. The level of assurance for a tethered mitigation is found in Table B.5.

<table border="1" cellpadding="0" cellspacing="0" width="604"><thead><tr><td colspan="3" width="452">Level of integrity</td></tr><tr><td width="111">Low</td><td width="236">Medium</td><td width="104">High</td></tr></thead><tr><td rowspan="4" width="69">M1 — Tethered operation</td><td width="84">Criterion #1(Technical design)</td><td valign="top" width="111">Does not meet the ‘medium’ level criteria</td><td valign="top" width="236">(a) The length of the line is adequate to contain the UA in the operational volume and reduce the number of people at risk.(b) The strength of the line is compatible with the ultimate loads1 expected during the operation.(c) The strength of the attachment points is compatible with the ultimate loads1 expected during the operation.(d) The tether cannot be cut by the rotating propellers.</td><td valign="top" width="104">Same as medium2</td></tr><tr><td width="84">Comments</td><td width="111">N/A</td><td colspan="2" width="340">1 Ultimate loads are identified as the maximum loads to be expected in service, including all the possible nominal and failure scenarios multiplied by a 1.5 safety factor.2 The distinction between a medium and a high level of robustness for this criterion is achieved through the level of assurance (Table B.5 below).</td></tr><tr><td width="84">Criterion #2(Procedures)</td><td valign="top" width="111">Does not meet the ‘medium’ level criteria</td><td valign="top" width="236">The applicant has procedures to install and periodically inspect the condition of the tether.</td><td valign="top" width="104">Same as medium3</td></tr><tr><td width="84">Comments</td><td width="111">N/A</td><td colspan="2" width="340">3 The distinction between a medium and a high level of robustness for this criterion is achieved through the level of assurance (Table B.5 below).</td></tr></table>

Table B.4 — Level of integrity assessment criteria for ground risk tethered M1 mitigations

<table border="1" cellpadding="0" cellspacing="0" width="606"><tr><td colspan="2" rowspan="2" width="154"></td><td colspan="3" width="452">Level of assurance</td></tr><tr><td width="116">Low</td><td width="202">Medium</td><td width="134">High</td></tr><tr><td rowspan="4" width="69">M1 — Tethered operation</td><td width="85">Criterion #1(Technical design)</td><td valign="top" width="116">Does not meet the ‘medium’ level criteria</td><td valign="top" width="202">The applicant has supporting evidence (including the specifications of the tether material) to claim that the required level of integrity is achieved.(a) This is typically achieved through testing or operational experience.(b) Tests can be based on simulations; however, the validity of the target environment used in the simulation needs to be justified.</td><td valign="top" width="134">The claimed level of integrity is validated by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="85">Comments</td><td width="116">N/A</td><td width="202">N/A</td><td width="134">N/A</td></tr><tr><td width="85">Criterion #2(Procedures)</td><td width="116">(a) Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority of the MS.(b) The adequacy of the procedures and checklists is declared.</td><td width="202">(a) Procedures are validated against standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1.(b) The adequacy of the procedures is proven through:(1) dedicated flight tests; or(2) simulation, provided that the representativeness of the simulation means is proven to be valid for the intended purpose with positive results; or(3) any other means acceptable to the competent authority of the MS.</td><td width="134">Same as medium. In addition:(a) Flight tests performed to validate the procedures cover the complete flight envelope or are proven to be conservative.(b) The procedures, flight tests and simulations are validated by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="85">Comments</td><td width="116">N/A</td><td width="202">1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.</td><td width="134">N/A</td></tr></table>

Table B.5 — Level of assurance assessment criteria for ground risk tethered M1 mitigations

B.3 M2 — Effects of ground impact are reduced

M2 mitigations are intended to reduce the effect of ground impact once the control of the operation is lost. This is done by reducing the effect of the UA impact dynamics (i.e. the area, energy, impulse, transfer energy, etc.). One example would be the use of a parachute.

<table border="1" cellpadding="0" cellspacing="0" width="608"><tr><td colspan="3" width="449">Level of integrity</td></tr><tr><td width="74">Low/None</td><td width="211">Medium</td><td width="164">High</td></tr><tr><td rowspan="6" width="75">M2 — Effects of UA impact dynamics are reduced (e.g. parachute)</td><td width="84">Criterion #1(Technical design)</td><td width="74">Does not meet the ‘medium’ level criterion</td><td valign="top" width="211">(a) Effects of impact dynamics and post impact hazards1 are significantly reduced although it can be assumed that a fatality may still occur. (b) When applicable, in case of malfunctions, failures or any combinations thereof that may lead to a crash, the UAS contains all the elements required for the activation of the mitigation.(c) When applicable, any failure or malfunction of the proposed mitigation itself (e.g. inadvertent activation) does not adversely affect the safety of the operation.</td><td valign="top" width="164">Same as medium. In addition:(a) When applicable, the activation of the mitigation is automated2.(b) The effects of impact dynamics and post impact hazards are reduced to a level where it can be reasonably assumed that a fatality will not occur3.</td></tr><tr><td width="84">Comments</td><td width="74">N/A </td><td width="211">1 Examples of post impact hazards include fires and the release of high-energy parts.</td><td width="164">2 The applicant retains the discretion to implement an additional manual activation function.3 Emerging research and upcoming industry standards will help applicants to substantiate compliance with this integrity criterion.</td></tr><tr><td width="84">Criterion #2(Procedures, if applicable)</td><td colspan="3" width="449">Any equipment used to reduce the effect of the UA impact dynamics is installed and maintained in accordance with the manufacturer’s instructions.4 </td></tr><tr><td width="84">Comments / Notes</td><td colspan="3" width="449">4 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (Table B.7 below).</td></tr><tr><td width="84">Criterion #3(Training, if applicable)</td><td colspan="3" width="449">Personnel responsible for the installation and maintenance of the measures proposed to reduce the effect of the UA impact dynamics are identified and trained by the applicant.5</td></tr><tr><td width="84">Comments / Notes</td><td colspan="3" width="449">5 The distinction between a low, a medium and a high level of robustness for this criterion is achieved through the level of assurance (Table B.7 below).</td></tr></table>

Table B.6 — Level of integrity assessment criteria for M2 mitigations

<table border="1" cellpadding="0" cellspacing="0" width="607"><tr><td rowspan="8" width="74">M2 — Effects of UA impact dynamics are reduced (e.g. parachute)</td><td rowspan="2" width="85"></td><td colspan="3" width="448">Level of assurance</td></tr><tr><td width="115">Low/None</td><td width="185">Medium</td><td width="148">High</td></tr><tr><td width="85">Criterion #1(Technical design)</td><td valign="top" width="115">The applicant declares that the required level of integrity has been achieved1.</td><td valign="top" width="185">The applicant has supporting evidence to claim that the required level of integrity is achieved. This is typically2 done by means of testing, analysis, simulation3, inspection, design review or through operational experience.The applicant may declare compliance with MoC to Light-UAS.25124 providing the supporting evidence defined in it.</td><td valign="top" width="148">The competent authority should request the applicant to use a UAS for which EASA has verified the claimed integrity through a DVR.</td></tr><tr><td width="85">Comments</td><td width="115">1 Supporting evidence may or may not be available.</td><td width="185">2 The use of industry standards is encouraged when developing mitigations used to reduce the effect of ground impact. 3 When simulation is used, the validity of the targeted environment used in the simulation needs to be justified.4<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-mitigation-means-m2-ref-amc">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-mitigation-means-m2-ref-amc</a></td><td width="148"></td></tr><tr><td width="85">Criterion #2(Procedures, if applicable)</td><td width="115">(a) Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority of the MS.(b) The adequacy of the procedures and checklists is declared.</td><td width="185">(a) Procedures are validated against standards considered adequate by the competent authority of the MS and/or in accordance with the means of compliance acceptable to that authority1.(b) The adequacy of the procedures is proven through:(1) dedicated flight tests; or(2) simulation, provided that the representativeness of the simulation means is proven to be valid for the intended purpose with positive results; or(3) any other means acceptable to the competent authority of the MS</td><td width="148">Same as medium. In addition:(a) Flight tests performed to validate the procedures cover the complete flight envelope or are proven to be conservative.(b) The procedures, flight tests and simulations are validated by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="85">Comments</td><td width="115">N/A</td><td width="185">1 AMC2 UAS.SPEC.030(3)(e) (Operational procedures for medium and high levels of robustness) is considered an acceptable means of compliance.</td><td width="148">N/A</td></tr><tr><td width="85">Criterion #3(Training, if applicable)</td><td width="115">Training is self-declared (with evidence available)</td><td width="185">(a) Training syllabus is available.(b) The UAS operator provides competency‑based, theoretical and practical training.</td><td width="148">(a) Training syllabus is validated by the competent authority of the MS or by an entity that is designated by the competent authority.(b) Remote crew competencies are verified by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="85">Comments</td><td width="115">N/A</td><td width="185">N/A</td><td width="148">N/A</td></tr></table>

Table B.7 — Level of assurance assessment criteria for M2 mitigations

B.4 M3 — An ERP is in place, UAS operator validated and effective

An ERP should be defined by the applicant in the event of a loss of control of the operation (\*). These are emergency situations where the operation is in an unrecoverable state and in which:

(a) the outcome of the situation relies highly on providence; or

(b) it could not be handled by a contingency procedure; or

The ERP proposed by an applicant is different from the emergency procedures. The ERP is expected to cover:

(1) a plan to limit the escalating effect of a crash (e.g. to notify first responders), and

(2) the conditions to alert ATM.

(\*) Refer to the SORA semantic model (Figure 1) in the main body.

<table border="1" cellpadding="0" cellspacing="0" width="610"><thead><tr><td colspan="2" rowspan="2" width="141"></td><td colspan="3" width="469">Level of integrity</td></tr><tr><td width="119">Low/None</td><td width="184">Medium</td><td width="167">High</td></tr></thead><tr><td rowspan="2" width="67">M3 — An ERP is in place, UAS operator validated and effective</td><td width="74">Criteria</td><td width="119">No ERP is available, or the ERP does not cover the elements identified to meet a ‘medium’ or ‘high’ level of integrity</td><td width="184">The ERP:(a) is suitable for the situation;(b) limits the escalating effects;(c) defines criteria to identify an emergency situation;(d) is practical to use;(e) clearly delineates the duties of remote crew member(s).</td><td width="167">Same as medium. In addition, in case of a loss of control of the operation, the ERP is shown to significantly reduce the number of people at risk, although it can be assumed that a fatality may still occur.</td></tr><tr><td width="74">Comments</td><td width="119">N/A</td><td width="184">N/A</td><td width="167">N/A</td></tr></table>

Table B.8 — Level of integrity assessment criteria for M3 mitigations

<table border="0" cellpadding="0" cellspacing="0" width="609"><thead><tr><td colspan="3" width="459">Level of assurance</td></tr><tr><td width="110">Low/None</td><td width="170">Medium</td><td width="179">High</td></tr></thead><tr><td rowspan="4" width="66">M3 — An ERP is in place, UAS operator validated and effective</td><td width="84">Criterion #1 (Procedures)</td><td width="110">(a) Procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority of the MS.(b) The adequacy of the procedures and checklists is declared.</td><td width="170">(a) The ERP is developed to standards considered adequate by the competent authority of the MS and/or in accordance with means of compliance acceptable to that authority1.(b) The ERP is validated through a representative tabletop exercise2 consistent with the ERP training syllabus.</td><td width="179">Same as medium. In addition:(a) The ERP and the effectiveness of the plan with respect to limiting the number of people at risk are validated by the competent authority of the MS or by an entity that is designated by the competent authority.(b) The applicant has coordinated and agreed the ERP with all third parties identified in the plan.(c) The representativeness of the tabletop exercise is validated by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="84">Comments</td><td width="110">N/A</td><td width="170">1 AMC3 UAS.SPEC.030(3)(e) (ERP for medium and high level of robustness) is considered an acceptable means of compliance.2 The tabletop exercise may or may not involve all third parties identified in the ERP. </td><td width="179">N/A</td></tr><tr><td width="84">Criterion #2 (Training)</td><td width="110">Does not meet the ‘medium’ level criterion</td><td width="170">(a) An ERP training syllabus is available.(b) A record of the ERP training completed by the relevant staff is established and kept up to date.</td><td width="179">Same as medium. In addition, the competencies of the relevant staff are verified by the competent authority of the MS or by an entity that is designated by the competent authority.</td></tr><tr><td width="84">Comments</td><td width="110">N/A</td><td width="170">N/A</td><td width="179">N/A</td></tr></table>

Table B.9 — Level of assurance assessment criteria for M3 mitigations