Compare and highlight differences

Compare / EASA/ Incorporated Amendments/ Compare & Highlight Differences

Annex E to AMC1 to Article 11

Available versions for ERULES-1963177438-24088

ED Decision 2025/018/R found in: Unmanned Aircraft Systems (Jun 2026)

Version

Show details Hide details

##### Annex E to AMC1 to Article 11

*ED Decision 2025/018/R*

**INTEGRITY
AND ASSURANCE LEVELS FOR THE OPERATIONAL SAFETY OBJECTIVES (OSOs)**

**E.1 How
to use SORA Annex E**

The following Table E.1 provides the basic principles to consider
when using SORA Annex E.

<table bgcolor="#d9d9d9" cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<tr valign="top">
<td bgcolor="#808080">
 

</td>
<td bgcolor="#808080">
Principle
			description
</td>
<td bgcolor="#808080">
Additional
			information
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#1
</td>
<td bgcolor="#d9d9d9">
Annex
			E provides assessment criteria for the integrity (i.e. safety
			gain) and assurance (i.e. method of proof) of the OSOs proposed by
			an applicant.
</td>
<td bgcolor="#d9d9d9">
The
			identification of OSOs for a given operation is the responsibility
			of the UAS operator.
The
			relationship between the SAIL and the low/medium/high level of
			robustness of an OSO can be found in Step #9, see Section S.4.9 of
			this AMC (SORA Main Body).
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#2
</td>
<td bgcolor="#d9d9d9">
Annex
			E does not cover the LoI of the competent authority. The Lol is
			based on the competent authority’s assessment of the applicant’s
			ability to perform the given operation.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#3
</td>
<td bgcolor="#d9d9d9">
When
			more than one criterion exists for a given level of
			integrity/assurance in an OSO, all the criteria need to be met at
			the required integrity/assurance level to satisfy the given OSO.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#4
</td>
<td bgcolor="#d9d9d9">
			‘Not
			required (NR)’ cases defined in Section S.4.9.3 of this AMC
			(SORA Main Body) Table 14 do not need to
			be defined in terms of integrity and assurance levels in Annex E.
</td>
<td bgcolor="#d9d9d9">
UAS
			operators are encouraged to consider also the OSOs classified as
			‘NR’, at least with ‘low’ level of integrity and
			assurance.
</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#5
</td>
<td bgcolor="#d9d9d9">
When
			the criteria to assess the level of integrity or assurance of an
			OSO rely on ‘standards’ that are not yet available, the OSO
			needs to be developed in a manner acceptable to the competent
			authority.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#6
</td>
<td bgcolor="#d9d9d9">
Annex
			E intentionally uses non-prescriptive terms (e.g. suitable,
			reasonably practicable) to provide flexibility to both the
			applicant and the competent authorities. This does not constrain
			the applicant from proposing mitigations, nor the competent
			authority from evaluating what is needed on a case-by-case basis.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#7
</td>
<td bgcolor="#d9d9d9">
This
			annex in its entirety also applies to single‑person
			organisations.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
<tr valign="top">
<td bgcolor="#808080">
#8
</td>
<td bgcolor="#d9d9d9">
Some
			of the OSOs refer to the functional-test-based (FTB) approach
			which is described in detail in Section E.3.
</td>
<td bgcolor="#d9d9d9">
 

</td>
</tr>
</table>

***Table
E.1 – Basic principles to consider when using SORA Annex E***

**E.2 Operational
safety objectives (OSOs)**

OSO #01 — Ensure that the UAS operator is a competent and/or proven
organisation

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				IV to VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#01
Ensure
				that the UAS operator is competent and/or proven organisation
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator is knowledgeable of the UAS1 being used
				and as a minimum has the following relevant operational
				procedures2:

(a)
				checklists, 


(b)
				maintenance,

(c)
				training, 

responsibilities,
				and associated duties.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’. In addition, the UAS operator has set up an
				organisation appropriate3 for the UAS operation, with
				at least the following in place:

 


(a)	a
				method to continuously evaluate whether the operator is operating
				according to the terms of the operational authorisation and check
				whether the mitigations proposed as part of the operational
				authorisation are still appropriate;
(b)	occurrence
				analysis procedures and reporting to the UAS designer in case of
				design-related in-service events.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator has an adequate organisational management system.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1
Including monitoring of any related airworthiness directives
				or recommendations issued by national aviation authorities and
				UAS designer recommendations (service bulletins, service
				information letters, etc.).
2
Operational procedures (checklists, maintenance, training,
				etc.) can be justified in the context of other applicable OSOs.
</td>
<td>
3 For the purpose of this assessment, ‘appropriate’ should be
				interpreted as commensurate with/proportionate to the size of the
				organisation and the complexity of the operation.
</td>
<td>
N/A
</td>
</tr>
</table>

OSO #02 — UAS designed and produced by a competent and/or proven
organisation

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low

(SAIL
				III)
</td>
<td bgcolor="#c3d69b">
Medium

(SAIL
				IV)
</td>
<td bgcolor="#c3d69b">
High

(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fabf8f" rowspan="4">
OSO
				#02
UAS
				designed and produced by a competent and/or proven organisation
</td>
<td bgcolor="#bfbfbf">
Criterion
				for design
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should use a UAS for which the UAS designer has
				issued a statement of compliance with MoC to OSO #021
				using the form attached to the MoC.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should use a UAS for which EASA has verified the
				claimed integrity through a design verification report (DVR)
				issued following an application from the UAS designer.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should operate a UAS designed by an organisation
				approved by EASA according to Subpart J of Annex I (Part 21) to
				Regulation (EU) No 748/2012 following an application from the UAS
				designer
</td>
</tr>
<tr>
<td valign="top">
Comments
</td>
<td valign="top">
1
				<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a>

Note:
				EASA is in the process of developing the means of compliance for
				all OSOs. Once developed, they will be made available at the link
				above.
</td>
<td>
 

</td>
<td>
 

</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
				for production
</td>
<td bgcolor="#bfbfbf">
The
				declared production procedures are developed to a standard that
				is considered adequate by the competent authority that issues the
				operational authorisation and/or in accordance with means of
				compliance acceptable to the competent authority.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’ In addition, evidence is available that the UAS has
				been produced in conformity with its design.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition, the competent authority of the
				Member State or an entity that is designated by the competent
				authority validates compliance with the production organisation
				requirements that are defined in Subpart F or G of Annex I
				(Part 21) to Regulation (EU) No 748/2012 following an
				application from the UAS production organisation.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td valign="top">
N/A
</td>
<td valign="top">
N/A
</td>
<td valign="top">
N/A
</td>
</tr>
</table>

OSO #03 — Maintenance of UAS

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tbody>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
					ISSUE WITH THE UAS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
					of ASSURANCE
</td>
</tr>
</tbody>
<tbody>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
					I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
					III &amp; IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
					V &amp; VI)
</td>
</tr>
</tbody>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="6">
OSO
					#03
Maintenance
					of UAS
</td>
<td bgcolor="#bfbfbf">
Criterion
					#1
(Design)
</td>
<td bgcolor="#bfbfbf">
The
					UAS designer’s maintenance
					instructions and requirements to ensure a safe
					operation are documented.
</td>
<td bgcolor="#bfbfbf" colspan="2" valign="top">
Same
					as ‘low’. 


In
					addition, the UAS designer’s scheduled maintenance
					requirements are developed and documented in accordance with
					standards considered adequate by the competent authority of the
					Member State and/or in accordance with means of compliance
					acceptable to that authority.

 


If
					the operation is classified as SAIL III, the UAS operator should
					use a UAS for which the UAS designer has issued a statement of
					compliance with MoC to OSO #03 and Light-UAS.26251
					using the form attached to the MoC.

 


If
					the operation is classified as SAIL IV, the UAS operator should
					use a UAS for which EASA has issued a design verification report
					(DVR) issued following an application from the UAS designer.

 

If
					the operation is classified as SAIL V and VI, the UAS operator
					should use a UAS for which EASA has issued a type certificate or
					a restricted type certificate in accordance with Annex I (Part
					21) to Regulation (EU) No 748/2012, following an application
					from the UAS designer.
</td>
</tr>
</tbody>
<tbody>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td bgcolor="#ffffff" valign="top">
N/A
</td>
<td bgcolor="#ffffff" colspan="2" valign="top">
1
<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a>

</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#2
(Procedure)
</td>
<td bgcolor="#bfbfbf">
(a)	The
					UAS operator’s maintenance instructions are documented1.

(b)	The
					maintenance carried out on the UAS is recorded in a maintenance
					log system2,3.
(c)	A
					list of the maintenance staff authorised to carry out
					maintenance is established and kept up to date.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’. 


In
					addition:

(a)	The
					UAS operator’s maintenance programme covers the UAS designer’s
					scheduled maintenance requirements and is developed in
					accordance with standards considered adequate by the competent
					authority of the Member State and/or in accordance with a means
					of compliance acceptable to that authority. 

(b)	A
					list of the maintenance staff with maintenance release
					authorisation is established and kept up to date.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘medium’. 


In
					addition, the maintenance programme and the maintenance
					procedures manual are validated by the competent authority of
					the Member State or by an entity that is designated by the
					competent authority.
The
					UAS operator complies with Delegated Regulation (EU) 2024/1107.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1 The UAS operator may just reuse the UAS designer’s
					instructions and requirements for maintenance.

2 The objective is to record all the maintenance performed on the
					UA, and why it is performed (rectification of defects or
					malfunctions, modifications, scheduled maintenance, etc.).
3 The maintenance log may be requested for inspection/audit by the
					approving authority or an authorised representative.
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#3
(Training)
</td>
<td bgcolor="#bfbfbf">
A
					record of all the relevant qualifications, experience and/or
					training completed by the maintenance staff is established and
					kept up to date.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’. 


In
					addition:

(a)	The
					initial training syllabus and training standard,
					including theoretical/practical elements, duration, etc., is
					defined and is commensurate with the authorisation held by the
					maintenance staff. 


(b)	For
					staff that hold a maintenance release authorisation, the initial
					training is specific to a particular UAS model/family.
(c)	All
					maintenance staff have undergone initial training.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘medium’. In addition:

(a)	a
					programme for the recurrent training of staff holding a
					maintenance release authorisation is established; and 


(b)	that
					programme is validated by the competent authority of the Member
					State or by an entity that is designated by the competent
					authority.
The
					UAS operator complies with Delegated Regulation (EU) 2024/1107.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
N/A
					

</td>
<td>
N/A
</td>
</tr>
</tbody>
</table>

OSO #04 — UAS components essential to safe operations are designed
to an airworthiness design standard

(a) Within the scope of OSO #4, UAS components essential to safe
operations are those whose failure would significantly impair the
capability of the operator to meet the required target level of
safety in terms of loss of control of the operation. The term
‘component’ is meant as including any element of the UAS.

(b) Starting at SAIL IV, it is considered that the safety objective
associated to the SAIL of an operation (e.g. probability of loss of
control of the operation below 10-–4/FH for a SAIL IV
operation) should be achieved with a UAS designed to be compliant
with SC Light UAS verified by EASA.

The list of airworthiness design standards (ADSs) to be complied with
through OSO #04 is not intended to duplicate the requirements already
covered by other design-related OSOs. While OSO #04 aims at ensuring
that the UAS as a whole is designed according to an ADS (for example,
the design and construction, structure, and flight performance is
part of the ADS, but not of other OSOs), other design-related OSOs
focus on particular systems/functionalities of the UAS and or
technical disciplines (e.g. safety):

—
OSO #05 (system safety related),

—
OSO #06 (C3 link),

—
OSO #07 (conformity check),

—
OSO #13 (external services),

—
OSO #18 (automatic protection of envelope),

—
OSO #20 (HMI),

—
OSO #23/#24 (adverse environmental conditions).

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="3">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Medium
</td>
<td bgcolor="#b8cce4" colspan="2">
High
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
(SAIL
				IV)
</td>
<td bgcolor="#b8cce4">
(SAIL
				V)
</td>
<td bgcolor="#b8cce4">
(SAIL
				VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#04
components
				essential to safe operations are designed to an airworthiness
				design standard
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				UAS components that are essential to safe operations are designed
				to an airworthiness design standard1 considered
				adequate by EASA and/or in accordance with a means of compliance
				acceptable to EASA to contribute to the overall safety objective
				of 10–4/FH for the loss of control of the operation.
</td>
<td bgcolor="#bfbfbf">
The
				UAS components that are essential to safe operations are designed
				to an airworthiness design standard1 considered
				adequate by the EASA and/or in accordance with a means of
				compliance acceptable to EASA to contribute to the overall safety
				objective of 10–5/FH for the loss of control of the
				operation.
</td>
<td bgcolor="#bfbfbf">
The
				UAS components that are essential to safe operations are designed
				to an airworthiness design standard1 considered
				adequate by EASA and/or in accordance with a means of compliance
				acceptable to EASA to contribute to the overall safety objective
				of 10–6/FH for the loss of control of the operation.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3">
In
				case of experimental flights that investigate new technical
				solutions, the competent authority may accept that recognised
				standards are not met.

1 EASA Special Condition Light-UAS is the recommended airworthiness
				design standard.
When
				aspects of an airworthiness design standard are covered by an OSO
				(for instance, OSO #05), the OSO requirement takes precedence.
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#c3d69b" colspan="2">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Medium
(SAIL
				IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090">
OSO
				#04
UAS
				components essential to safe operations are designed to an
				airworthiness design standard
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf" valign="top">
The
				UAS operator should use a UAS for which EASA has verified the
				claimed integrity through a design verification report (DVR)
				issued following an application from the UAS designer.
</td>
<td bgcolor="#bfbfbf" valign="top">
The
				UAS operator should use a UAS for which EASA has issued a type
				certificate or restricted type certificate in accordance with
				Annex I (Part 21) to Regulation (EU) No 748/2012, following an
				application from the UAS designer.
</td>
</tr>
<tr>
<td bgcolor="#fac090">
 

</td>
<td>
Comment
</td>
<td>
In
				case the UAS designer decides to apply OSO #4 for UAS operated in
				SAIL I to III, 


MoC
				Light UAS.FTB may be used
(<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-special-condition-light">https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-special-condition-light</a>).
</td>
<td>
N/A
</td>
</tr>
</table>

OSO #05 — The UAS is designed considering system safety and
reliability

(a) OSO #05 ensures that the contribution of the UAS, or of any
external system supporting the operation, to the loss of control of
the operation inside the operational volume is commensurate with the
acceptable level of risk associated with each SAIL. The OSO #05
safety objectives are to be considered in conjunction with the
containment safety requirements (Step #8 and Section 4 of this Annex)
and, when applicable, the ground risk mitigation requirements (Annex
B, in particular M2 Criterion #1 requirements). In combination, these
three sets of safety objectives ensure that whatever the SAIL of the
operation, the target level of safety is met and no single failure is
expected to lead to a catastrophic event.

(b) Note on SAIL II operations: some UAS designs may employ novel or
complex features with which the UAS designer has very limited
operational experience. If such features are identified by the
competent authority or the UAS designer, the UAS designer should
assure that the equipment, systems and installations are designed to
minimise hazards in the event of a probable failure of the UAS or of
any external system supporting the operation. This should be done
through a statement of compliance with a simple written justification
from the UAS designer including functional diagrams and a description
of how the system functions.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				III)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#05
The
				UAS is designed considering system safety and reliability
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				equipment, systems and installations are designed to minimise1
				hazards2 in the event of a probable3
				failure of the UAS or of any external system supporting the
				operation.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’. 

In
				addition, the strategy for detection, alerting and management of
				any failure, which would lead to a hazard, is available.
</td>
<td bgcolor="#bfbfbf">
(a)	Major
				failure conditions are not more frequent than remote;

(b)	Hazardous
				failure conditions are not more frequent than extremely remote;

(c)	Catastrophic
				failure conditions are not more frequent than extremely
				improbable; 


(d)	No
				single failure can lead to a catastrophic failure condition; and
(e)	SW
				and AEH whose development error(s) may cause or contribute to
				hazardous or catastrophic failure conditions are developed to an
				industry standard or a methodology considered adequate by EASA
				and/or in accordance with means of compliance acceptable to EASA.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1 The minimisation of the hazard criterion correlates to the
				contribution of the UAS, and of any external system supporting
				the operation, to the loss of control of the operation rate, thus
				the SAIL of the operation. As an example, at SAIL III, the
				contribution of the UAS, and of any external system supporting
				the operation, to the loss of control of the operation rate could
				be 10–4/FH assuming a traditional 10 % contribution of the
				technical aspects to the safety of an operation.

2 For the purpose of this assessment, the term ‘hazard’ should
				be interpreted as a failure condition that relates to major and
				hazardous, (the term ‘catastrophic’ is intentionally
				not included since the TLOS is considered met for SAIL I to IV
				operations with the provision of Note 1 above and, if applicable,
				M2 requirements in Annex B).
3
				For the purpose of this assessment, the term
				‘probable’ should be interpreted in a qualitative way as
				‘anticipated to occur one or more times during the entire
				system/operational life of a UAS’.
</td>
<td>
UAS
				designers may achieve compliance by using MoC Light UAS.2510
(<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sai">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sai</a>).
</td>
<td>
 

 

</td>
</tr>
</table>

OSO #06 — C3 link characteristics (e.g. performance, spectrum use)
are appropriate for the UAS operation

(a) For the purpose of the SORA and this specific OSO, the term ‘C3
link’ encompasses:

(1) the C2 link; and

(2) any communication link required for the safety of the flight.

(b) To correctly assess the integrity of this OSO, the UAS operator
or the UAS designer, as described in the table below, should identify
the following:

(1) The performance requirements for the C3 links necessary for the
UAS operation.

(2) All the C3 links, together with their actual performance and RF
spectrum use.

Note 1: The specification of the performance and the RF
spectrum for a C2 link is typically documented by the UAS designer in
the UAS flight manual.

Note 2: The main parameters associated with the performance of
a C2 link (RLP) and the performance parameters for other
communication links (e.g. RCP for communication with ATC) include but
are not limited to the following:

(i) the transaction expiration time;

(ii) the availability;

(iii) the continuity; and

(iv) the integrity.

Refer to the ICAO references for definitions.

(3) The RF spectrum usage requirements for the UAS operation
(including the need for authorisation if required).

Note: Usually, countries publish the allocation of RF spectrum
bands applicable in their territories. This allocation stems mostly
from the International Communication Union (ITU) Radio Regulations.
However, the UAS operator should check the local requirements and
request authorisation when needed since there may be national
differences and specific allocations (e.g. national subdivisions of
ITU allocations). Some aeronautical bands (e.g. AM(R)S, AMS(R)S
5030-5091 MHz) were allocated for potential use in UAS
operations within the ICAO scope for UAS operations classified as
category ‘certified’, but their use may be authorised for
operations in the ‘specific’ category. It is expected that the
use of other licensed bands (e.g. those allocated to mobile networks)
may also be authorised in the ‘specific’ category. Some
unlicensed bands (e.g. industrial, scientific and medical (ISM) or
short-range devices (SRDs)) may also be acceptable in the ‘specific’
category; for instance, for operations with lower integrity
requirements.

(4) Environmental conditions that may affect the performance of C3
links.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
					ISSUE WITH THE UAS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
					of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
					II &amp; III)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
					IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
					V &amp; VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
					#06
C3
					link characteristics (e.g. performance, spectrum use) are
					appropriate for the UAS operation
</td>
<td bgcolor="#bfbfbf">
Criterion
					#1 (Operator)
</td>
<td bgcolor="#bfbfbf">
The
					UAS operator:

(a)	determines
					that the performance, RF spectrum use1 and
					environmental conditions for C3 links, as identified in the UAS
					flight manual2 are adequate to safely conduct the UAS
					operation.
(b)	has
					procedures for the remote pilot to continuously monitor the C3
					link performance and ensures that the performance continues to
					meet the operational requirements3. 

</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’4. 

</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’. 

In
					addition, the use of licensed5 frequency bands for C2
					links is required. 

</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1 For a low level of integrity, unlicensed frequency bands may be
					acceptable under certain conditions, e.g. the use of mechanisms
					to protect against interference (e.g. frequency deconfliction by
					procedure).

2 The UAS designer may provide technical information also in other
					documentation.
3 The remote pilot has continuous and timely access to the
					relevant C3 links information that could affect the safety of
					flight. For operations requesting only a low level of integrity
					for this OSO, this could be achieved by monitoring the C2 link
					signal strength and receiving an alert from the UAS HMI if the
					signal strength becomes too low.
</td>
<td>
4 Depending on the operation, the use of licensed frequency bands
					may be necessary. In some cases, the use of non‑aeronautical
					bands (e.g. licensed bands for cellular network) may be
					acceptable. 

</td>
<td>
5 This ensures a minimum level of performance and is not limited
					to aeronautical licensed frequency bands (e.g. licensed bands
					for cellular network). Nevertheless, some operations may require
					the use of bands allocated to the aeronautical mobile service
					for the use of a C2 link (e.g. 5030 – 5091 MHz).
In
					any case, the use of licensed frequency bands requires
					authorisation.
</td>
</tr>
<tr>
<td bgcolor="#fac090">
 

</td>
<td bgcolor="#bfbfbf">
Criterion
					#2 (Designer)
</td>
<td bgcolor="#bfbfbf">
The
					UAS designer determines:

(a)	the
					performance and the RF spectrum use1 for C3 links and
					specifies them in the UAS flight manual;
(b)	that
					the means to continuously monitor the C3 link performance are
					available and are defined in the UAS flight manual2.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’3.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘low’. 

In
					addition, the use of licensed4 frequency bands for C2
					links is required.
</td>
</tr>
<tr>
<td bgcolor="#fac090">
 

</td>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1
For a low level of integrity, unlicensed frequency bands may
					be acceptable under certain conditions, e.g.:

(a) the
					UAS designer demonstrates compliance with other RF spectrum use
					requirements (e.g. Directive 2014/53/EU) by showing that the UAS
					equipment is compliant with these requirements; and 


(b) the
					use of mechanisms to protect against interference (e.g. FHSS).

 

2 The remote pilot has continuous and timely access to the
					relevant C3 link information that could affect the safety of
					flight. For operations requesting only a low level of integrity
					for this OSO, this could be achieved by monitoring the C2 link
					signal strength and receiving an alert from the UAS HMI if the
					signal strength becomes too low.
</td>
<td>
3
					Depending on the operation, the use of licensed
					frequency bands might be necessary. In some cases, the use of
					non-aeronautical bands (e.g. licensed bands for cellular
					network) may be acceptable.
</td>
<td>
4
					This ensures a minimum level of performance and is not
					limited to aeronautical licensed frequency bands (e.g. licensed
					bands for cellular network). Nevertheless, some operations may
					require the use of bands allocated to the aeronautical mobile
					service for the use of C2 link (e.g. 5030–5091 MHz).
In
					any case, the use of licensed frequency bands needs
					authorisation.
</td>
</tr>
</tbody>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
TECHNICAL
				ISSUE WITH THE UAS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				II &amp; III)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="4">
OSO
				#06
C3
				link characteristics (e.g. performance, spectrum use) are
				appropriate for the UAS operation
</td>
<td bgcolor="#bfbfbf">
Criterion
				#1 (Operator)
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator declares that the required level of integrity has
				been achieved.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should use a UAS for which EASA has verified the
				claimed integrity through a design verification report (DVR)
				issued following an application from the UAS designer.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should use a UAS for which EASA has issued a type
				certificate or restricted type certificate in accordance with
				Annex I (Part 21) to Regulation (EU) No 748/2012 following an
				application from the UAS designer.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
N/A
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#a6a6a6">
Criterion
				#2 (Designer)
</td>
<td bgcolor="#a6a6a6">
The
				UAS designer declares that the required level of integrity has
				been achieved.

 

If
				the operation is classified as SAIL III, the UAS operator should
				use a UAS for which the UAS designer has issued a statement of
				declared with the MoC to OSO #061 using the form
				attached to the MoC.2
</td>
<td bgcolor="#a6a6a6">
The
				UAS designer should obtain a design verification report (DVR)
				issued by EASA.
</td>
<td bgcolor="#a6a6a6">
The
				UAS designer should obtain a type certificate or a restricted
				type certificate issued by EASA in accordance with Annex I (Part
				21) to Regulation (EU) No 748/2012.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
1 <a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a> 

2 For UAS operations classified in SAIL II, the UAS operator may
				still use an UAS for which the UAS designer issued a statement of
				compliance with the MoC to OSO #6. However, the UAS designer
				should be allowed to experiment new solutions. In this case a
				statement of compliance not referring to a published MoC might be
				acceptable.
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
</table>

OSO #07 — Conformity check of the UAS configuration

(a) The intent of this OSO is that the UAS operator assure that the
UAS used for the operation conforms to the UAS data used to support
the approval/authorisation of the UAS operation.

(b) This OSO does not describe a pre- or post-flight inspection as
part of normal operations; these are covered under OSO #8.

OSO #08 — Operational procedures are defined, validated and adhered
to

(a) Operational procedures address normal, abnormal and emergency
situations potentially resulting from technical issues with the UAS
or from external systems supporting the UAS operation, human error or
adverse environmental conditions.

(b) Standard operational procedures are a set of instructions
covering policies, procedures and responsibilities set out by the UAS
operator that support operational personnel in ground and flight
operations of the UA safely and consistently during normal
situations.

(c) Contingency procedures are designed to potentially prevent a
significant future event (e.g. loss of control of the operation) that
has an increased likelihood to occur due to the current abnormal
state of the operation. These procedures should return the operation
to a normal state and enable the return to using standard operational
procedures or allow the safe cessation of the flight.

(d) Emergency procedures are intended to mitigate the effect of
failures that could cause or could lead to an emergency situation.

(e) The emergency response plan (ERP) deals with the potential
hazardous secondary or escalating effects following a loss of control
of the operation (e.g. in the case of ground impact, mid-air
collision or fly-away) and is decoupled from the emergency procedures
as it does not deal with the control of the UA during operation.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
OPERATIONAL
					PROCEDURES
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
					of INTEGRITY
</td>
</tr>
</thead>
<thead>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
					I)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
					II)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
					III to VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="6">
OSO
					#08 Operational procedures are defined, validated and adhered to
</td>
<td bgcolor="#bfbfbf">
Criterion
					#1 (UAS flight manual)
</td>
<td bgcolor="#bfbfbf" colspan="3">
The
					UAS designer develops a UAS flight manual, including the
					relevant information (e.g. limitations).
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td bgcolor="#ffffff" colspan="3">
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#2 (Procedure definition)
</td>
<td bgcolor="#bfbfbf" colspan="3">
(a)	The
					UAS operator develops operational procedures1
					appropriate for the proposed operation, taking into account the
					relevant information (e.g. limitations) listed in the UAS flight
					manual and, as a minimum, cover the following elements:

(1)	Flight
					planning;

(2)	Pre-
					and post-flight inspections;

(3)	Procedures
					to evaluate the environmental conditions before and during the
					flight (i.e. real-time evaluation), including the assessment of
					meteorological conditions (METAR, TAF, etc.) with a simple
					recording system; 


(4)	Procedures
					to cope with unexpected adverse operating conditions (e.g. when
					ice is encountered during an operation that is not approved for
					icing conditions);

(5)	Normal
					procedures;

(6)	Contingency
					procedures (to cope with abnormal situations);

(7)	Emergency
					procedures (to cope with emergency situations), including an
					ERP; 


(8)	Pre-flight
					procedures, including briefing of any involved persons about the
					potential risks and actions to take in case the UA misbehaves; 


(9)	Occurrence-reporting
					procedures; and
(b)	The
					limitations of the external systems supporting the UAS
					operation2 are defined in the OM.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td bgcolor="#ffffff" colspan="3">
1 Operational procedures cover the deterioration of the UAS itself
					and of any external system supporting the UAS operation. Please,
					refer to Part B of the OM example for UAS operations published
					on the EASA website at
					<a href="https://www.easa.europa.eu/en/downloads/139674/en">https://www.easa.europa.eu/en/downloads/139674/en</a>.

To
					properly address the deterioration of external systems required
					for the operation, it is recommended to:

(a)	identify
					these ‘external systems’;

(b)	identify
					the modes of deterioration of the ‘external systems’ (e.g.
					complete loss of GNSS, GDOP/PDOP, latency issues, etc.) which
					would lead to a loss of control of the operation;

(c)	describe
					the means to detect these modes of deterioration of the external
					systems ; and

(d)	describe
					the procedure(s) to be used when deterioration is detected (e.g.
					activation of the emergency recovery capability, switch to
					manual control, etc.).

2 In the scope of this assessment, external systems supporting the
					UAS operation are defined as systems that are not already part
					of the UAS but are used to:

(a)	launch
					/ take off the UA;

(b)	make
					pre-flight checks; or

(c)	keep
					the UA within its operational volume (e.g. GNSS, satellite
					systems, air traffic management, U-space).
External
					systems activated/used after a loss of control of the operation
					are excluded from this definition.
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#3
(Consideration
					of potential human error)
</td>
<td bgcolor="#bfbfbf">
As
					a minimum, operational procedures<a href="#_ftn75" name="_ftnref75">[75]</a>:

(a)	include
					a clear distribution and assignment of tasks, and
(b)	rely
					on checklists to ensure staff are adequately performing their
					assigned tasks.
</td>
<td bgcolor="#bfbfbf">
Operational
					procedures take human error into consideration.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘medium’. In addition, the remote crew3
					receives crew resource management (CRM)4 training.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1 Please, refer to Part B of the OM example published on the EASA
					website at
<a href="https://www.easa.europa.eu/en/downloads/139674/en">https://www.easa.europa.eu/en/downloads/139674/en</a>.
</td>
<td>
N/A
</td>
<td>
3 In the context of SORA, the term ‘remote crew’ refers to any
					person involved in the operation.
4 CRM training focuses on the effective use of all the remote crew
					to ensure safe and efficient operation, reducing error, avoiding
					stress and increasing efficiency. Elements of the CRM training
					may be found in the AMC and GM to point ORO.FC.115 to Regulation
					(EU) No 965/2012.
</td>
</tr>
<tr>
<td bgcolor="#fac090">
 

</td>
<td bgcolor="#a6a6a6">
Criterion
					#4
(Emergency
					response plan (ERP)
</td>
<td bgcolor="#a6a6a6" colspan="3">
The
					ERP:

(a)	is
					suitable for a given situation6;

(b)	effectively
					mitigates all anticipated hazardous secondary effects after the
					initial crash;

(c)	clearly
					delineates the duties of the remote crew member(s);

(d)	is
					practical to use and for training purposes, so that the remote
					crew can execute the procedures effectively under stress.

The
					ERP contains as a minimum:

(a)	the
					list of anticipated emergency situations with secondary effects;

(b)	the
					procedures for each of the identified anticipated emergency
					situations (including criteria to identify each of these
					situations);
(c)	the
					list of relevant contacts to reach (e.g. ATC, police, fire
					brigade, first responders).
</td>
</tr>
<tr>
<td bgcolor="#fac090">
 

</td>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3" valign="top">
6
The ERP should be proportional to the potential secondary
					effects of a ground impact, i.e. those effects that may occur
					after the initial ground impact (e.g. fire, release of poisonous
					gas). AMC3 UAS.SPEC.030(3)(e) provides additional information.
					The ERP chapter of the OM published on the EASA website
					(<a href="https://www.easa.europa.eu/en/domains/drones-air-mobility/operating-drone/specific-category-civil-drones#group-easa-downloads">https://www.easa.europa.eu/en/domains/drones-air-mobility/operating-drone/specific-category-civil-drones#group-easa-downloads</a>)
					may be considered as a reference.

</td>
</tr>
</tbody>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
OPERATIONAL
				PROCEDURES
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				I)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				II)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				III to VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="6">
OSO
				#08, Operational procedures are defined, validated and adhered to
</td>
<td bgcolor="#d0cece">
Criterion
				#1
</td>
<td bgcolor="#d0cece" colspan="2">
The
				UAS operator should use a UAS for which the UAS designer has
				issued a statement of compliance with MoC to OSO #081
				using the form attached to the MoC.
</td>
<td bgcolor="#d0cece">
SAIL
				III same as SAIL I and II.

 


SAIL
				IV: EASA has verified the claimed integrity through a design
				verification report (DVR) issued following an application from
				the UAS designer.

 

SAIL
				V and VI: EASA has verified the claimed integrity through the
				issuance of a type certificate according with Annex I (Part 21)
				to Regulation (EU) No 748/2012 issued following an application
				from the UAS designer.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="2">
<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a> 

</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#d0cece">
Criteria#2,
				#3 and #4 

</td>
<td bgcolor="#d0cece">
The
				UAS operator declares the adequacy of the operational procedures
				and the ERP. As a minimum, the emergency procedures are tested.
</td>
<td bgcolor="#d0cece">
(a)	Operational
				procedures and the ERP are developed according to <a href="#_DxCrossRefBm1295819089">AMC2
				UAS.SPEC.030(3)(e)</a> and <a href="#_DxCrossRefBm1295819097">AMC3
				UAS.SPEC.030(3)(e)</a> respectively.

(b)	The
				adequacy of the contingency and emergency procedures is proven
				through:

(1)	dedicated
				flight tests; or

(2)	simulation,
				provided that the representativeness of the simulation means is
				proven valid for the intended purpose with positive results; or
(3)	any
				ot+her means acceptable to the competent authority.
</td>
<td bgcolor="#d0cece">
Same
				as ‘medium’. 


In
				addition:

(a)	Flight
				tests performed to validate the operational procedures and the
				checklists cover the complete flight envelope or are proven to be
				conservative.

(b)	The
				operational procedures, checklists, flight tests and simulations
				are validated by the competent authority of the Member State or
				by an entity that is designated by the competent authority.
(c)
				The representativeness of the tabletop exercise1 of
				the ERP is validated by the competent authority of the Member
				State or by an entity that is designated by the competent
				authority.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
Operational
				procedures do not require validation against either a standard or
				a means of compliance that is considered adequate by the
				competent authority.
</td>
<td colspan="2">
1 The tabletop exercise may involve the third parties identified in
				the ERP.
</td>
</tr>
<tr>
<td>
Alternative
				criteria #2, #3 and #4 taking credit for functional-test-based
				(FTB) methods
</td>
<td colspan="3">
FUNCTIONAL-TEST-BASED
				(FTB) METHODS (for SAILs up to and including IV)

 


If
				the UAS operator has evidence of the FTB flight hours
				proportionate to the risk/SAIL of the UAS operation meeting
				either set of conditions described either in Section E.3(c) or in
				Section E.3(d) and executed:

(a)	within
				the full operational scope/envelope intended by the UAS operator;
				and

(b)	following
				the operational procedures included in the operation manual,
then
				the assurance that the operational procedures are adequate is
				fulfilled at the level corresponding to the SAIL being
				demonstrated by the FTB approach2.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="3">
2
				As an example, if the number of test cycles
				supporting the FTB flight hours is proportionate to the risk of a
				SAIL III operation (i.e. 3 000 FH), the assurance level for OSO
				#08 is fulfilled at ‘high’ level.
</td>
</tr>
</table>

**E.4 OSOs
related to remote crew training**

OSO #09 — Remote crew trained and current

(a) The UAS operator needs to propose a theoretical and practical
training that:

(1) is appropriate for the operation to be approved allowing the
remote crew to control the normal, abnormal and emergency situations
potentially resulting from technical issues with the UAS or from
external systems supporting the UAS operation, human errors or
adverse environmental conditions; and

(2) includes proficiency requirements and recurrent training.

(b) The entire remote crew (i.e. any person involved in the
operation) should receive theoretical and practical training specific
to their duties (e.g. pre-flight inspection, ground equipment
handling, evaluation of the meteorological conditions, etc.).

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
REMOTE
				CREW COMPETENCIES
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#09, Remote crew trained and current
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf" colspan="3">
The
				theoretical and practical training:

 


(a)	ensures
				knowledge of:

(1)	the
				UAS Regulations;

(2)	airspace
				operating principles;

(3)	airmanship
				and aviation safety;

(4)	human
				performance limitations;

(5)	meteorology
				and assessment of meteorological conditions;

(6)	navigation/charts;

(7)	the
				UAS; 


(8)	operational
				procedures and the ERP; and

(9)	the
				use of external services, including service limitations and
				system recovery, if any1;

 


(b)	is
				adequate for the UAS operation, i.e. allows the remote crew to
				control the normal, abnormal and emergency situations potentially
				resulting from technical issues with the UAS or from external
				systems supporting the UAS operation, human errors or adverse
				environmental conditions2,3;
(c)	specifies
				proficiency requirements and training recurrence.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3">
1
If external services are used, the UAS operator is responsible
				for using the services in the intended manner (e.g. as defined in
				a service level agreement) and ensuring that the remote crew is
				trained to use the services as intended.
<a name="_Hlk213842280"></a>
2
The details of the areas to be covered for the different
				subjects listed above are provided in <a href="#_DxCrossRefBm1295819096">AMC1
				UAS.SPEC.050(1)(d)</a> ‘Theoretical knowledge
				subjects for the training of the remote pilot and all personnel
				in charge of duties essential to the UAS operation in the
				“specific” category’, in <a href="#_DxCrossRefBm1295819095">AMC2
				UAS.SPEC.050(1)(d)</a> ‘Practical-skill
				training of the remote pilot and all personnel in charge of
				duties essential to the UAS operation in the “specific”
				category’ and in <a href="#_DxCrossRefBm1295819094">AMC3
				UAS.SPEC.050(1)(d)</a> ‘UAS
				operation-specific endorsement modules’.
3 The distinction between a low, a medium and a high level of
				robustness for this criterion is achieved through the level of
				assurance (see table below).
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
REMOTE
					CREW COMPETENCIES
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
					of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
					I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
					III &amp; IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
					V &amp; VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
					#09, Remote crew trained and current
</td>
<td bgcolor="#d0cece">
Criterion
</td>
<td bgcolor="#d0cece">
Training
					is self-declared (with evidence available).
</td>
<td bgcolor="#d0cece">
(a)	The
					training syllabus is available and kept up to date.
(b)	Evidence
					of the theoretical and practical training is available.
</td>
<td bgcolor="#d0cece">
The
					competent authority of the Member State or an entity that is
					designated by the competent authority:

(a)	validates
					the training syllabus; and
(b)	verifies
					the remote crew competencies.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
N/A
</td>
<td>
N/A
					

</td>
<td>
N/A
</td>
</tr>
</tbody>
</table>

OSO #13 — External services supporting UAS operations are adequate
for the UAS operation

For the purpose of the SORA and this specific OSO, the term ‘external
services supporting UAS operations’ encompasses any service
providers necessary for the safety of the flight1, such
as:

— communication service providers;

— navigation service providers (e.g. GNSS);

— U-space service providers;

— externally provided electrical power (e.g. in the case where no
emergency backup generator is available and the safety of the flight
is dependent on continuous power supply).

The interface between the UAS operator and the external service
provider(s) may take the form of a service level agreement (SLA) or a
similar document.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
DETERIORATION
					OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
					of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
					I &amp; II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
					III)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
					IV to VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="3">
OSO
					#13
External
					services supporting UAS operations are adequate for the UAS
					operation
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf" colspan="3">
The
					UAS operator ensures that the level of performance for any
					externally provided service necessary for the safety of the
					flight1 is adequate for the UAS operation.

If
					the externally provided service requires communication between
					the UAS operator and the service provider, the UAS operator
					ensures there is effective communication to support the service
					provision.
Roles
					and responsibilities between the UAS operator and the external
					service provider are defined.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3">
1 A service whose loss would directly lead to a loss of control of
					the operation as identified per OSO #05.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
N/A
</td>
<td>
Requirements
					for contracting services with the service provider(s) may be
					derived from ICAO Standards and Recommended Practices (SARPs)
					that are currently under development.
</td>
</tr>
</tbody>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="3" rowspan="2">
DETERIORATION
				OF EXTERNAL SYSTEMS SUPPORTING UAS OPERATIONS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				III)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				IV to VI)
</td>
</tr>
<tr>
<td bgcolor="#f7caac" rowspan="2">
OSO
				#13
External
				services supporting UAS operations are adequate for the UAS
				operation
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf" colspan="2">
The
				UAS operator declares1 that the requested level of
				performance for any externally provided service necessary for the
				safety of the flight is achieved.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator has supporting evidence that the required level of
				performance for any externally provided service required for the
				safety of the flight can be achieved for the full duration of the
				operation.

This
				may take the form of a service-level agreement (SLA) or any
				official commitment that prevails between a service provider and
				the UAS operator on the relevant aspects of the service
				(including quality, availability, and responsibilities).
The
				UAS operator has a means to monitor externally provided services
				which affect flight-critical systems and takes appropriate
				actions if real-time performance could lead to the loss of
				control of the operation.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition:

(a)	the
				evidence of the performance of an externally provided service is
				achieved through demonstrations; and
(b)	the
				competent authority of the Member State or an entity that is
				designated by the competent authority validates the claimed level
				of integrity. 

</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="2">
1
				Supporting evidence for this declaration may still be
				requested by the competent authority. 


 


Supporting
				evidence may take the form of a service level agreement (SLA) or
				any official commitment that prevails between a service provider
				and the UAS operator on relevant aspects of the service
				(including quality, availability and responsibilities).

 

As
				an example, if a UAS operator uses an external surveillance
				service, it should have evidence available supporting the claim
				that the service meets the performance requirements of <a href="#_DxCrossRefBm1295819075">Annex
				D</a> to this AMC.
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
</table>

OSO #16 — Multi-crew coordination

This OSO applies only to those personnel directly involved in the
flight operation.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
MULTI-CREW
				COORDINATION
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="6">
OSO
				#16 Multi-crew coordination
</td>
<td bgcolor="#bfbfbf">
Criterion
				#1
(Procedures)
</td>
<td bgcolor="#bfbfbf" colspan="3">
The
				UAS operator develops procedures to ensure coordination between
				the crew members, and robust and effective communication channels
				are available and as a minimum cover:

(a)	assignment
				of tasks to the crew; and
(b)	establishment
				of step-by-step communications, including the establishment and
				use of proper phraseology between the remote crew members
				involved in the aerial part of the operation.1
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3">
1 The distinction between a low, a medium and a high level of
				robustness for this criterion is achieved through the level of
				assurance (see the table below).
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
				#2
(Training)
</td>
<td bgcolor="#bfbfbf">
Remote
				crew training covers multi-crew coordination
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’. In addition, the remote crew2 receives
				CRM3 training.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. 

</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
2 In line with definition I.110 ‘Remote pilot (in command)’
				provided in <a href="#_DxCrossRefBm1295819074">Annex
				I</a> to this AMC, the term ‘remote crew’
				refers to any person that performs duties essential to the safety
				of flight (e.g. AOs, UA observers).
3 CRM training focuses on the effective use of all the remote crew
				to assure a safe and efficient operation, reducing error,
				avoiding stress and increasing efficiency.
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
				#3
(Communication
				devices)
</td>
<td bgcolor="#bfbfbf">
N/A
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator determines that the performance of communication
				devices is adequate to safely conduct the UAS operation.

 

The
				remote crew has the means to check the performance of the
				communication devices at intervals deemed appropriate to ensure
				the performance continues to meet the operational requirements
				throughout the operation.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition, communication devices are
				redundant4 and comply with standards considered
				adequate by the competent authority and/or in accordance with a
				means of compliance acceptable to that authority.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
N/A
</td>
<td>
4 This implies the provision of an extra device to cope with the
				failure of the first device.
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
HUMAN
					ERROR
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
					of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
					I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
					III &amp; IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
					V &amp; VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="8">
OSO
					#16 Multi-crew coordination
</td>
<td bgcolor="#bfbfbf">
Criterion
					#1
(Procedures)
</td>
<td bgcolor="#bfbfbf">
(a)	Procedures
					do not require validation against either a standard or a means
					of compliance considered adequate by the competent authority of
					the Member State.
(b)	The
					adequacy of the procedures and checklists is declared.
</td>
<td bgcolor="#bfbfbf">
(a)	Procedures
					are validated against standards considered adequate by the
					competent authority of the Member State and/or in accordance
					with means of compliance acceptable to that authority1.

(b)	The
					adequacy of the procedures is proven through:

(1)	dedicated
					flight tests; or 


(2)	simulation,
					provided that the representativeness of the simulation means is
					proven valid for the intended purpose with positive results; or 

(3)	any
					other means acceptable to the competent authority.
</td>
<td bgcolor="#bfbfbf">
Same
					as ‘medium’. In addition:

(a)	flight
					tests performed to validate the procedures cover the complete
					flight envelope or are proven to be conservative; and
(b)	the
					procedures, flight tests and simulations are validated by the
					competent authority of the Member State or an entity designated
					by the competent authority.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
1 AMC2 UAS.SPEC.030(3)(e) (‘Operational procedures for
					medium and high levels of robustness’) is considered an
					acceptable means of compliance.
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Alternative
					criterion #1 taking credit for functional-test-based (FTB)
					methods
</td>
<td bgcolor="#bfbfbf" colspan="2">
FUNCTIONAL-TEST-BASED
					(FTB) METHODS (for SAILs up to and including IV):

 


If
					the UAS operator has evidence of the FTB flight hours
					proportionate to the risk/SAIL of the operation meeting either
					set of conditions described either in Section 3(c) or in Section
					3(d) and executed:

					—	within
					the full operational scope/envelope intended by the UAS
					operator; and

					—	following
					the operational procedures referred to in the operational
					authorisation,
then
					the assurance that the operational procedures are adequate is
					fulfilled at the level corresponding to the SAIL being
					demonstrated by the FTB approach2. 

</td>
<td bgcolor="#bfbfbf">
N/A3
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="2">
2
As an example, if the number of test cycles supporting the
					FTB flight hours is proportionate to the risk of a SAIL III
					operation (i.e. 3 000 FH), the assurance level for OSO #16
					Criterion #1 is fulfilled at ‘medium’ level.
</td>
<td>
3
FTB methods are not considered feasible for operations with a
					SAIL V or VI.
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#2
(Training)
</td>
<td bgcolor="#bfbfbf">
Training
					is self-declared (with evidence available).
</td>
<td bgcolor="#bfbfbf">
(a)	Training
					syllabus is available.
(b)	Evidence
					of the theoretical and practical training is available.
</td>
<td bgcolor="#bfbfbf">
The
					competent authority of the Member State or an entity that is
					designated by the competent authority:

(a)	validates
					the training syllabus; and
(b)	verifies
					the remote crew competencies.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Criterion
					#3
(Communication
					devices)
</td>
<td bgcolor="#bfbfbf">
N/A
</td>
<td bgcolor="#bfbfbf" valign="top">
The
					UAS operator has supporting evidence that the required level of
					integrity is achieved. This is typically done by testing,
					analysis, simulation1, inspection, design review or through
					operational experience.
</td>
<td bgcolor="#bfbfbf" valign="top">
Unless
					the communication device is included in the UAS type design, the
					competent authority or an entity that is designated by the
					competent authority validates the claimed level of integrity.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
1 When simulation is performed, the validity of the targeted
					environment that is used in the simulation needs to be
					justified.
</td>
<td>
N/A
</td>
</tr>
</tbody>
</table>

OSO #17 — Remote crew is fit to operate

(a) For the purpose of SORA, the expression ‘fit to operate’
should be interpreted as physically and mentally fit to perform their
duties and safely discharge their responsibilities.

(b) Fatigue and stress are contributing factors to human error.
Therefore, to ensure that vigilance is maintained at a satisfactory
level of safety, consideration may be given to the following:

(1) remote crew workload and duty times;

(2) regular breaks;

(3) rest periods;

(4) personal protective equipment (PPE)[[76]](#_ftn76);

(5) workplace environment, including ergonomics of the workstation[[77]](#_ftn77),
and

(6) handover/takeover procedures.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
HUMAN
				ERROR
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2"><a name="_Hlk213066876"></a>
OSO
				#17
Remote
				crew is fit to operate
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator has a policy defining the criteria1 and
				the means on how the remote crew can declare themselves fit to
				operate before starting their duty, and on how to report
				themselves unfit, if required, during their shift.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’. In addition:

				—	Duty,
				flight duty and resting times for the remote crew are defined by
				the UAS operator and are adequate for the operation.
—	The
				UAS operator defines requirements appropriate for the remote crew
				to operate the UAS.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition:

				—	The
				remote crew is medically fit.
—	A
				fatigue risk management system (FRMS) is in place to manage any
				escalation in duty/flight duty times. 

</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1 Criteria should take into account national legislation and may
				cover drugs (including prescriptions) and alcohol consumption.
</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#fac090" colspan="2" rowspan="2">
HUMAN
				ERROR
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#17
Remote
				crew is fit to operate 

</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				policy defining the criteria and the means for the remote crew to
				declare themselves fit to operate before starting their duty and
				to report themselves unfit, if required, during their shift is
				documented.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’. In addition:

(a)
				Remote crew duty, flight duty and the resting time policy are
				documented.

(b)
				Remote crew duty cycles are logged and cover as a minimum:

(1)
				when the remote crew members’ duty day commences;

(2)
				when the remote crew members are free from duties; and

(3)
				resting times within the duty cycle.
 

</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition:

(a)
				Medical standards considered adequate by the competent authority
				and/or the means of compliance acceptable to that authority are
				established and the competent authority of the Member State or an
				entity that is designated by the competent authority verifies
				that the remote crew is medically fit.

(b)
				The competent authority of the Member State or an entity that is
				designated by the competent authority validates the duty/flight
				duty times.
The
				FRMS is validated by the competent authority of the Member State
				or by an entity that is designated by the competent authority and
				internally monitored by the UAS operator.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
N/A
</td>
<td>
N/A
				

</td>
<td>
N/A
</td>
</tr>
</table>

OSO #18 — Automatic protection of the flight envelope from human
errors

(a) Each UA is designed with a flight envelope that describes its
safe performance limits with regard to relevant flight parameters
such as minimum and maximum operating speeds, and its operating
structural strength.

(b) Automatic protection of the flight envelope is intended to
prevent the remote pilot from operating the UA outside its flight
envelope. If the UAS operator demonstrates that the remote pilot is
not in the loop, this OSO is not applicable.

(c) A UAS implementing such an automatic protection function will
ensure that the UA is operated within an acceptable flight envelope
margin even in the case of incorrect remote-pilot control inputs
(human errors).

(d) UAS without automatic protection functions are susceptible to
incorrect remote-pilot control inputs (human errors), which can
result in the loss of the UA if the designed performance limits of
the UA are exceeded.

(e) Failures or development errors of the flight envelope protection
are addressed in OSO #5.

OSO #19 — Safe recovery from human error

(a) This OSO addresses the risk of human errors which may affect the
safety of the operation if not prevented or detected and recovered in
a timely fashion.

(i) Errors can be made by anyone involved in the operation.

(ii) An example could be a human error leading to the incorrect
loading of the payload, with the risk of it falling off the UA during
the operation.

(iii) Another example could be a human error not to extend the
antenna mast, thus reducing the C2 link coverage.

Note: The flight envelope protection is excluded from
this OSO since it is specifically covered by OSO #18.

(b) This OSO covers the UAS design, i.e. systems detecting and/or
recovering from human errors (e.g. safety pins, use of acknowledgment
features, fuel or energy consumption monitoring functions, etc.).

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
HUMAN
					ERROR
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
					of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
					III)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
					IV &amp; V)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
					VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
					#19
Safe
					recovery from human error
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
					UAS designer declares that the required level of integrity has
					been achieved.
The
					UAS operator should use a UAS for which the UAS designer has
					issued a statement of compliance with MoC to OSO #19/#201
					using the form attached to the MoC.
</td>
<td bgcolor="#bfbfbf">
The
					UAS designer has supporting evidence that the required level of
					integrity is achieved. That evidence is provided through
					testing, analysis, simulation2, inspection, design
					review or operational experience.

If
					the operation is classified as SAIL IV, the UAS operator should
					use a UAS for which EASA has verified the claimed integrity
					through a design verification report (DVR) issued following an
					application from the UAS designer.
If
					the operation is classified as SAIL V, the UAS operator should
					use a UAS for which EASA has issued a type certificate or a
					restricted type certificate in accordance with Annex I
					(Part 21) to Regulation (EU) No 748/2012 following an
					application from the UAS designer.
</td>
<td bgcolor="#bfbfbf">
The
					UAS operator should use a UAS for which EASA has issued a type
					certificate or a restricted type certificate in accordance with
					Annex I (Part 21) to Regulation (EU) No 748/2012
					following an application from the UAS designer.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td>
1
					<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a> 

</td>
<td>
2 When simulation is performed, the validity of the targeted
					environment that is used in the simulation needs to be
					justified.
</td>
<td>
N/A
</td>
</tr>
</tbody>
</table>

OSO #20 — A human factors evaluation has been performed and the HMI
has been found appropriate for the intended UAS operation

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
HUMAN
				ERROR
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				II &amp; III)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				IV &amp; V)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				VI)
</td>
</tr>
<tr>
<td bgcolor="#f7caac" rowspan="2">
OSO
				#20
A
				human factors evaluation has been performed and the HMI has been
				found appropriate for the intended UAS operation
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
The
				UAS designer conducts a human factors evaluation of the UAS to
				determine whether the HMI is appropriate for the intended UAS
				operation. The HMI evaluation is based on inspection or analyses.

The
				adequacy of the result of the HMI evaluation is declared.
The
				UAS operator should use a UAS for which the UAS designer has
				issued a statement of compliance with MoC to OSO #19/#201
				using the form attached to the MoC.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘low’ but the HMI evaluation is based on demonstration or
				simulations.1

For
				operations classified in SAIL IV, the UAS operator should use a
				UAS for which EASA has issued a design verification report (DVR)
				following an application from the UAS designer.
For
				operations classified in SAIL V, the UAS operator should use a
				UAS for which EASA has issued a type certificate or a restricted
				type certificate in accordance with Annex I (Part 21) to
				Regulation (EU) No 748/2012 following an application from the UAS
				designer.
</td>
<td bgcolor="#bfbfbf">
Same
				as ‘medium’. In addition, the UAS operator should use a UAS
				for which EASA has issued a type certificate or a restricted type
				certificate in accordance with Annex I (Part 21) to Regulation
				(EU) No 748/2012 following an application from the UAS designer.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
1 <a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/mean">https://www.easa.europa.eu/en/document-library/product-certification-consultations/mean</a>
</td>
<td>
1 When simulation is performed, the validity of the targeted
				environment that is used in the simulation needs to be justified.
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#f7caac">
 

</td>
<td bgcolor="#bfbfbf">
Alternative
				criterion for taking credit for functional-test-based (FTB)
				methods
</td>
<td bgcolor="#bfbfbf">
If
				the UAS designer has evidence of the FTB flight hours
				proportionate to the risk/SAIL of the operation meeting either
				set of conditions described either in Section 3(c) or in Section
				3(d) and executed:

(a)	within
				the full operational scope/envelope intended by the UAS operator;
				and

(b)	following
				the operational procedures and the remote crew training referred
				to in the operational authorisation,
then
				the assurance that the operational procedures are adequate is
				fulfilled at the level corresponding to the SAIL being
				demonstrated by the FTB approach2.
</td>
<td bgcolor="#bfbfbf" colspan="2">
N/A
</td>
</tr>
<tr>
<td bgcolor="#f7caac">
 

</td>
<td>
Comments
</td>
<td>
2
As an example, if the number of test cycles supporting the FTB
				flying hours is proportionate to the risk of a SAIL III operation
				(i.e. 3 000 FH), the assurance level for OSO #20 is fulfilled at
				‘low’ level.
</td>
<td colspan="2">
N/A
</td>
</tr>
</table>

OSO #23 — Environmental conditions for safe operations are defined,
measurable and adhered to

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
ADVERSE
				OPERATING CONDITIONS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#23
Environmental
				conditions for safe operations are defined, measurable and
				adhered to
</td>
<td bgcolor="#bfbfbf">
Criterion
				

 

</td>
<td bgcolor="#bfbfbf" colspan="3">
The
				environmental conditions for safe operations are defined and
				reflected in the UAS flight manual or equivalent document1.
</td>
</tr>
<tr>
<td bgcolor="#ffffff">
Comments
</td>
<td colspan="3">
1 The distinction between a low, a medium and a high level of
				robustness for this criterion is achieved through the level of
				assurance (see table below). For SAL III, compliance with the
				EASA MoC to OSO #24 already determines compliance with OSO #23.
				Refer to OSO #24.
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
ADVERSE
				OPERATING CONDITIONS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
(SAIL
				I &amp; II)
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
				III &amp; IV)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
				V &amp; VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#23
Environmental
				conditions for safe operations are defined, measurable and
				adhered to
</td>
<td bgcolor="#bfbfbf">
Criterion
				#1
(Definition)
</td>
<td bgcolor="#bfbfbf">
The
				UAS designer declares that the required level of integrity has
				been achieved.
</td>
<td bgcolor="#bfbfbf">
The
				UAS designer has supporting evidence that the required level of
				integrity is achieved. This is typically done by testing,
				analysis, simulation, inspection, design review or through
				operational experience.
If
				the operation is classified as SAIL IV, the UAS operator should
				use a UAS for which EASA has issued a design verification report
				(DVR) following an application from the UAS designer.
</td>
<td bgcolor="#bfbfbf">
The
				UAS operator should use a UAS for which EASA has issued a type
				certificate or a restricted type certificate in accordance with
				Annex I (Part 21) to Regulation (EU) No 748/2012 following an
				application from the UAS designer. 

</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="3">
N/A
</td>
</tr>
</table>

OSO #24 — The UAS is designed and qualified to operate in adverse
environmental conditions (e.g. UA controllability and performance,
adequate sensors, DO-160 qualification)

(a) To assess the integrity of this OSO, the UAS designer determines:

(1) whether credit can be taken for the equipment environmental
qualification tests / declarations, e.g. by answering the following
questions:

(i) Is there a Declaration of Design and Performance (DDP) available
to the UAS designer stating the environmental qualification levels to
which the equipment was tested?

(ii) Did the environmental qualification tests follow a standard
considered adequate by the competent authority (e.g. DO-160)?

(iii) Are the environmental qualification tests appropriate and
sufficient to cover all the environmental conditions related to the
ConOps?

(iv) If the tests were not performed following a recognised standard,
were the tests performed by an organisation/entity that is qualified
or that has experience in performing DO-160-like tests?

(2) Can the suitability of the equipment for the intended/expected
UAS environmental conditions be determined from either in-service
experience or relevant test results?

(3) Any environmental limitations which, if exceeded, would
compromise the suitability of the equipment or the operability or
controllability of the UA (e.g. maximum cross wind).

(b) The lowest integrity level should be considered for those cases
where a UAS equipment has only a partial environmental qualification
and/or a partial demonstration by similarity and/or parts with no
qualification at all.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
ADVERSE
				ENVIRONMENTAL CONDITIONS
</td>
<td bgcolor="#b8cce4" colspan="3">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
N/A
</td>
<td bgcolor="#b8cce4">
Medium
(SAIL
				III)
</td>
<td bgcolor="#b8cce4">
High
(SAIL
				IV to VI)
</td>
</tr>
<tr>
<td bgcolor="#fac090" rowspan="2">
OSO
				#24
The
				UAS is designed and qualified to operate in adverse environmental
				conditions
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
N/A
</td>
<td bgcolor="#bfbfbf">
The
				UAS is designed to limit the effect of the environmental
				conditions defined and reflected in the UAS flight manual.
</td>
<td bgcolor="#bfbfbf">
The
				UAS is designed according to environmental standards considered
				adequate by the competent authority and/or in accordance with a
				means of compliance acceptable to EASA.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
N/A
</td>
<td>
As
				an example, if a UAS is proposed to be operated in raining
				conditions, it is not necessary to comply with DO-160G waterproof
				conditions; the rain threshold may be limited as long as it is
				representative of the envisaged environmental conditions.
</td>
<td>
N/A
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<thead>
<tr>
<td bgcolor="#f79646" colspan="2" rowspan="2">
ADVERSE
					OPERATING CONDITIONS
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
					of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
N/A
</td>
<td bgcolor="#c3d69b">
Medium
(SAIL
					III)
</td>
<td bgcolor="#c3d69b">
High
(SAIL
					IV to VI)
</td>
</tr>
</thead>
<tbody>
<tr>
<td bgcolor="#f7caac" rowspan="4">
OSO
					#24
The
					UAS is designed and qualified to operate in adverse
					environmental conditions
</td>
<td bgcolor="#bfbfbf">
Criterion
</td>
<td bgcolor="#bfbfbf">
N/A
</td>
<td bgcolor="#bfbfbf">
The
					UAS designer has supporting evidence that the required level of
					integrity has been achieved. This is typically done by testing,
					analysis, simulation1, inspection, design review or
					through operational experience.

 

The
					UAS operator should use a UAS for which the UAS designer has
					issued a statement of compliance with the MoC to OSO #242
					using the form attached to the MoC.
</td>
<td bgcolor="#bfbfbf">
If
					the operation is classified as SAIL IV, the UAS operator should
					use a UAS for which EASA has issued a design verification report
					(DVR) following an application from the UAS designer.
If
					the operation is classified as SAIL V or VI, the UAS operator
					should use a UAS for which EASA has issued a type certificate or
					a restricted type certificate in accordance with Annex I (Part
					21) to Regulation (EU) No 748/2012 following an application from
					the UAS designer. 

</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
N/A
</td>
<td>
1 When simulation is performed, the validity of the targeted
					environment that is used in the simulation needs to be
					justified.
2
					<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail">https://www.easa.europa.eu/en/document-library/product-certification-consultations/means-compliance-moc-design-uas-operated-sail</a>

</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#bfbfbf">
Alternative
					criterion
</td>
<td bgcolor="#bfbfbf">
N/A
</td>
<td bgcolor="#bfbfbf">
FUNCTIONAL-TEST-BASED
					(FTB) METHODS:

If
					the UAS designer has evidence of the FTB flight hours
					proportionate to the SAIL of the operation meeting either set of
					conditions described either in Section E.3(c) or in Section
					E.3(d) and executed

(a)	within
					the full operational scope/envelope intended by the UAS
					operator; and

(b)	following
					the maintenance instructions, the operational procedures and the
					remote crew training referred to in the operational
					authorisation,
then
					the assurance that the operational procedures are adequate is
					fulfilled at the level corresponding to the SAIL being
					demonstrated by the FTB approach1. 

</td>
<td bgcolor="#bfbfbf">
N/A
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
N/A
</td>
<td>
1
As an example, if the number of test cycles supporting the
					FTB flight hours is proportionate to the risk of a SAIL III
					operation (i.e. 3 000 FH), the assurance level for OSO #24 is
					fulfilled at ‘medium’ level.

</td>
<td><a name="_Toc303157228_1"></a>
N/A
</td>
</tr>
</tbody>
</table>

**E.3
Functional-test-based (FTB) approach**

(a) The objective of this section is to give some insight into the
FTB approach referenced throughout Annex E to this AMC. This is
articulated around three different but complementary perspectives:

(1) FTB as a means of compliance (MoC) to support **UAS
designers** in demonstrating UAS operational
reliability for the purpose of obtaining an FTB design appraisal;

(2) FTB design appraisal performed by UAS designers supporting **UAS
operators** when showing compliance with some of the
OSOs of Annex E to this AMC;

(3) FTB as a means for **UAS
operators** to take credit for safe and successful
operations over time to expand their operational authorisation (based
on the concept of ‘reliability growth model’).

These three approaches are detailed in the following points (b), (c)
and (d).

(b) For FTB as a MoC to support **UAS
designers** in demonstrating UAS operational
reliability, please refer to the EASA MoC SC Light-UAS FTB[[78]](#_ftn78).

(c) FTB design appraisal performed by UAS designers supporting **UAS
operators** when showing compliance with some of the
OSOs of Annex E to this AMC:

(1) An FTB design appraisal obtained by a UAS designer presents
several benefits both for the UAS operator going through the
operational authorisation process and the competent authority issuing
such operational authorisation, in particular when the UAS operator
does not have a strong cooperation with the UAS designer or does not
have all the design details.

(2) In order for a UAS operator to take credit for an FTB design
appraisal obtained by a UAS designer, the following conditions as a
minimum should be met:

(i) The functional tests supporting the FTB design appraisal obtained
by the UAS designer have been performed within the full operational
scope/envelope intended by the UAS operator; this means that the test
cycles are fully representative of the UAS operator’s operations
with test points to verify safe operation at the operational limits
and corners of the UA envelope.

(ii) The functional tests supporting the FTB design appraisal
obtained by the UAS designer have been performed following the
operational procedures and the remote crew training referred to in
the operational authorisation (and meeting the integrity assurance of
the associated OSOs).

(iii) The UAS operator’s maintenance instructions are established
based on the UAS designer’s instructions and requirements which
were used for maintenance, repair or replacement of the UAS
subsystems during the functional tests supporting the FTB design
appraisal obtained by the UAS designer.

(iv) Any UAS configuration differences compared to the initial
configuration used by the UAS designer to obtain the FTB design
appraisal are confirmed by the UAS designer in order not to impair
the validity of the FTB design appraisal.

(v) The minimum number of test cycles are proportionate to the risk
of the UAS operation, with at least:

—
30 hours for SAIL I;

—
300 hours for SAIL II; and

—
3 000 hours for SAIL III

in order to achieve a 95 % confidence (assuming a binomial/Poisson
distribution for the operational level hazard rate and no failures
during the test)[[79]](#_ftn79).

Note that FTB methods are not considered feasible for UAS operations
with a SAIL above or equal to IV.

(vi) The functional tests supporting the FTB design appraisal
obtained by the UAS designer have been performed by the UAS designer
according to the principles/standards considered adequate by the
competent authority in charge of granting the operational
authorisation, including as a minimum the following principles:

—
The functional tests supporting the FTB design appraisal obtained by
the UAS designer have been performed using an acceptable sample size
of the UA.

—
Safe life limits for UAS subsystems sensitive to wear-out conditions
based on the maximum cycles and hours demonstrated by one or more
fleet leader UAS (i.e. the UAS with the longest time and/or cycles
compared to other UAS used during the FTB testing) have been derived
by the UAS designer and captured in the FTB design appraisal
limitations.

(3) Additionally, induced-failure tests may help demonstrate
compliance with the following OSOs and Step #8:

(i) OSO #05 and Step #8: safety and reliability/safe design (e.g.
induced-failure tests with no loss of control or containment as
pass–fail criteria);

(ii) OSO #06: C3 link performance appropriate for the UAS operation
(e.g. if the distance from a C2 radio transmitter/receiver is a
critical factor, then the demonstration of the maximum allowable
range from the transmitter/receiver in the most likely worst-case
conditions is required);

(iii) OSO #18: Automatic protection of the flight envelope from human
error.

However, induced-failure testing is not addressed in this version
of Annex E to this AMC since competent authorities are still in the
process of defining the modalities of test-based approaches. In
the meantime, credit for induced-failure testing may be proposed on a
case-by-case basis by a UAS operator depending on the scope of the
FTB design appraisal obtained by the UAS designer.

(d) FTB as a means for **UAS
operators** to take credit for safe and successful
operations over time to expand their operational authorisation (based
on the concept of ‘reliability growth model’):

(1) An FTB approach should also allow UAS operators to take credit
for safe and successful operations over time to expand their
operational authorisation based on the concept of ‘reliability
growth’, while still meeting the conditions of point E.3(c).

(2) UAS operators should be able to operate with a low SAIL approval
and then, through operational experience, gather sufficient
operational data to justify an increase in the SAIL, based upon the
increase in operational reliability demonstrated by UAS operators.
This approach would only be valid under
representative operating conditions, not requiring additional
strategic or tactical mitigations.

Note 1: The competent authority may accept accumulation of FTB hours
between operators if the UAS configuration, operational procedures,
training, etc., are demonstrated to be equivalent.

Note 2: This option does not cover expanded operating conditions
which would require additional testing and/or analysis to be
performed by the UAS designer. As an example, a UAS operator may
start with a SAIL II operational authorisation to fly over population
density up to 500 people/km2 and, if they demonstrate 3 000 hours
with no loss of control, they could be allowed to fly a SAIL III
operation under the exact same operating conditions, except for an
increase of the maximum population density allowed (5 000
people/km2).

(3) To be relevant, the UAS operator would need to show that:

(i) the next population band does not introduce new or unique
hazards, or if it does, these new or unique hazards are shown to be
properly mitigated through test or analysis;

(ii) the reliability demonstrated through operational testing
demonstrates the required operational reliability at the higher SAIL
level desired;

(iii) any UAS configuration differences compared to the initial
configuration do not impair the validity of the argument.

**E.4
Containment requirements**

(a) Section S.4.8 of this AMC (SORA Main Body, Step #8)
‘Determination of the containment requirements’ addresses the
risk posed by an operational loss of control that could infringe on
areas adjacent to the operational volume and buffers. The ground risk
(in the adjacent ground area) determines the level of safety
requirements to be met by containment design features and operational
procedures.

(b) The following section provides the generic containment
requirements for the following three levels of containment: low,
medium and high.

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" rowspan="2">
Containment
				of untethered UA
</td>
<td bgcolor="#b8cce4" colspan="4">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low
</td>
<td bgcolor="#b8cce4" colspan="2">
Medium
</td>
<td bgcolor="#b8cce4">
High
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#1
(Operational
				volume containment)
</td>
<td bgcolor="#d9d9d9" colspan="3">
UAS
				should be designed such that: 


				—	(qualitative)
				no probable1
				single failure of the UAS or of any external system supporting
				the operation could lead to operation outside the operation
				volume;

 


OR

 

—	
				(quantitative) the probability of the failure condition ‘UA
				leaving the operational volume’ should be less than 10–3/FH.
</td>
<td bgcolor="#d9d9d9">
The
				UAS should be designed such that: 


 


				—	(qualitative)
				no remote single failure3 of the UAS or of any
				external system supporting the operation could lead to operation
				outside the operational volume;

 


OR

 

—	(quantitative)
				the probability of the failure condition ‘UA leaving the
				operational volume’ should be less than 10–4/FH4.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="3">
1 Failures anticipated to occur one or more times during the entire
				operational life of an item.
</td>
<td>
2 This may be achieved by a tether that prevents the UA from
				exiting the operational volume (see containment of tethered UA
				below).

3 ‘failure’ needs to be understood as an occurrence that
				affects the operation of a component, part or element such that
				it can no longer function as intended. Errors may cause failures
				but are not considered failures. Some structural or mechanical
				failures may be excluded from the criterion if it can be shown
				that such structural or mechanical parts were designed according
				to aviation industry best practices.

3 Failures unlikely to occur with each UA during its operational
				life but that may occur several times when considering the total
				operational life of a number of UA of a particular type.
4 This means a reduction by a factor of 10 of the likelihood of
				exiting the operational volume compared to the ‘low’ and
				‘medium’ integrity containment.
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#2
(End
				of flight upon exit of the operational volume)
</td>
<td bgcolor="#d9d9d9" colspan="4">
When
				the UA leaves the operational volume, the immediate termination
				of the flight should be initiated through a combination of
				procedures/processes and/or available technical means.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="4">
Such
				criteria may be satisfied by the operational procedures developed
				by the UAS operator that may rely (fully or partially, depending
				on the level of automation of the UAS) on technical means
				developed by the UAS designer and documented in the UAS flight
				manual.
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#3
(Definition
				of the final ground risk buffer)
</td>
<td bgcolor="#d9d9d9" colspan="2">
The
				UAS operator defines the size of the ground risk buffer. In
				principle, the ground risk buffer should at least adhere to the
				1:1 principle5. Alternatively, as the 1:1 rule may not
				be suitable for some UA configurations (e.g. fixed-wing or
				parachute-equipped UA), the competent authority may require
				defining the ground risk buffer based on a ballistic methodology
				approach, a glide trajectory6, representative flight
				tests and/or a combination of these.

A
				smaller ground risk buffer value may be proven by the UAS
				operator for a rotary-wing UA using a ballistic methodology
				approach acceptable to the competent authority.
If
				the UAS uses a parachute, the UAS operator should consider the
				effect of wind on the UAS when it is deployed.
</td>
<td bgcolor="#d9d9d9" colspan="2">
In
				addition to ‘low’ robustness, the ground risk buffer should
				consider the following points:

 


(a)	Probable7
				single failures (including the projection of high-energy parts
				such as rotors and propellers) which would lead to an operation
				outside the operational volume;

(b)	Meteorological
				conditions (e.g. maximum sustained wind);

(c)	UAS
				latencies (e.g. latencies that affect the timely manoeuvrability
				of the UA);
(d)	UA
				behaviour when activating a technical containment measure
				considering UA performance.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="2">
5 The 1:1 principle refers to applying a ground risk buffer that is
				as wide as the maximum height of the operational volume. For the
				evaluation of the size of the ground risk buffer based on the 1:1
				principle, see <a href="#_DxCrossRefBm1295819070">Annex
				A</a> Section A.5.2.4.
6 See <a href="#_DxCrossRefBm1295819070">Annex
				A</a> Section A.5.2.4.
</td>
<td colspan="2">
7 For the purpose of this assessment, the term ‘probable’
				should be interpreted in a qualitative way as ‘anticipated to
				occur one or more times during the entire operational life of a
				UAS’.
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#4
(Ground
				risk buffer containment)
</td>
<td bgcolor="#d9d9d9" colspan="2">
N/A
</td>
<td bgcolor="#d9d9d9" colspan="2">
The
				UAS should be designed such that no
				single failure8 of the UAS or of any
				external system supporting the operation could lead to operation
				outside
				the ground risk buffer.

 

Software
				(SW) and airborne electronic hardware (AEH) whose development
				error(s) could directly
				lead to operations outside the ground risk buffer
				should be developed to an industry standard or methodology
				recognised as adequate by the competent authority.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td colspan="2">
N/A
</td>
<td colspan="2">
8 Example methods for achieving this may include:

				—	an
				independent flight termination system (FTS) that will initiate
				the end of the flight when the UA exits the operational volume;
				or

				—	a
				secondary independent emergency flight control system that ends
				the flight in a controlled manner without exceeding the ground
				risk buffer; or
—	a
				tether that prevents the UA from exiting the ground risk buffer.
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" rowspan="2">
Containment
				of untethered UA
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
</td>
<td bgcolor="#c3d69b">
Medium
 

</td>
<td bgcolor="#c3d69b">
High
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
For
				all criteria
</td>
<td bgcolor="#d9d9d9">
The
				applicant declares1 that the required level of
				integrity has been achieved.

 


The
				UAS designer: 


 


(a)
				for criterion #1,
				conducts a design and installation appraisal2 including as a
				minimum:

				—	design
				and installation features (e.g. independence, separation or
				redundancy claims); 


				—	any
				relevant particular risk (e.g. hail, ice, snow, electromagnetic
				interference, etc.) associated with the UAS operation and how
				they are being addressed; 


(b)
				for criterion #2,
				tests the technical means to safely end the flight and includes
				the procedures in the UAS flight manual.

 


The
				UAS operator: 

—	for
				criterion #2,
				tests the adequacy of the emergency procedures to terminate the
				flight.
</td>
<td bgcolor="#d9d9d9">
The
				applicant has supporting evidence that the required level of
				integrity has been achieved. This is typically done by testing,
				analysis, simulation2, inspection and design review.

 


Among
				the supporting evidence:

(a)	for
				criterion #1 and criterion
				#4: same as criterion #1, ‘low’;

(b)	for
				criterion #2: the
				adequacy of the emergency procedures to terminate the flight is
				proven through:

				—	dedicated
				flight tests; or
—	simulation
				provided the simulation is proven valid for the intended purpose
				with positive results.
</td>
<td bgcolor="#d9d9d9">
Same
				as ‘medium’.

 


The
				UAS operator should use a UAS for which EASA has verified the
				claimed integrity through a design verification report ‘DVR’.

 

In
				addition, the competent authority of the Member State or the
				entity that is designated by the competent authority validates
				the claimed level of integrity for the non-design-related
				criteria.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
1 Supporting evidence for this declaration may still be requested
				by the competent authority. 

2 A simple, written justification from the UAS designer, including
				functional diagrams and a description of how the system works,
				explaining why the integrity claim (i.e. no (probable/remote)
				single failure criterion) is met is an acceptable means of
				compliance.
</td>
<td>
2 When simulation is used, the suitability of the targeted
				environment used in the simulation needs to be justified. 

The
				UAS operator may use a UAS for which the UAS designer has issued
				a statement of compliance with the MoC to Light-UAS.2511
				(<a href="https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-light-uas2511-moc-light">https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-light-uas2511-moc-light</a>)
				using the form attached to the MoC when the UAS meets the
				conditions defined in such MoC. For UAS configurations exceeding
				the applicability of such MoC, the competent authority may decide
				to still accept statements based on such MoC with evidence
				available, or to accept appropriate MoC proposed by the UAS
				designer. Otherwise, the competent authority may request the UAS
				operator to use a UAS for which EASA has verified the claimed
				integrity.
</td>
<td>
N/A
</td>
</tr>
</table>

The following section is an alternative which should only be used in
the specific use of a tether:

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<tr>
<td bgcolor="#f79646" rowspan="2">
Containment
				of tethered UA
</td>
<td bgcolor="#b8cce4">
LEVEL
				of INTEGRITY
</td>
</tr>
<tr>
<td bgcolor="#b8cce4">
Low,
				Medium and High1
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#1
(Technical
				design)
</td>
<td bgcolor="#d9d9d9">
(a)	The
				length of the line is adequate to contain the UA in the
				operational volume. 


(b)	The
				strength of the line is compatible with the ultimate loads2
				expected during the operation.

(c)	The
				strength of attachment points is compatible with the ultimate
				loads2 expected during the operation.
(d)	The
				tether cannot be cut by rotating propellers.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
UAS
				operators may purchase a UAS designed to be used with a tether or
				they may apply a tether. In this case, the UAS operator is
				required to comply with criterion #1.
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#2
(Procedures)
</td>
<td bgcolor="#d9d9d9">
The
				UAS operator has procedures to install and periodically inspect
				the condition of the tether.
</td>
</tr>
<tr>
<td>
Comments
</td>
<td>
1 The distinction between a ‘medium’ and a ‘high’ level of
				robustness for this criterion is achieved through the level of
				assurance provided below.
2 Ultimate loads are identified as the maximum loads to be expected
				in service, including all possible nominal and failure scenarios
				multiplied by a 1.5 factor of safety.
</td>
</tr>
</table>

<table cellpadding="7" cellspacing="0">
<col/>
<col/>
<col/>
<col/>
<tr>
<td bgcolor="#f79646" rowspan="2">
Containment
				of tethered UA
</td>
<td bgcolor="#c3d69b" colspan="3">
LEVEL
				of ASSURANCE
</td>
</tr>
<tr>
<td bgcolor="#c3d69b">
Low
</td>
<td bgcolor="#c3d69b">
Medium
</td>
<td bgcolor="#c3d69b">
High
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#1
(Technical
				design)
</td>
<td bgcolor="#d9d9d9">
The
				UAS designer or the UAS operator declares1 that the required
				level of integrity has been achieved.
</td>
<td bgcolor="#d9d9d9">
The
				UAS designer or the UAS operator has supporting evidence
				(including the tether material specifications) to claim the
				required level of integrity has been achieved.

(a)	This
				is typically achieved through testing or operational experience.
(b)	Tests
				can be based on simulations; however, the validity of the target
				environment used in the simulation needs to be justified.
</td>
<td bgcolor="#d9d9d9">
The
				claimed level of integrity is validated by the competent
				authority of the Member State or by an entity that is designated
				by the competent authority.
</td>
</tr>
<tr valign="top">
<td>
Comments
</td>
<td>
1 Supporting evidence for this declaration may still be requested
				by the competent authority. 

</td>
<td>
N/A
</td>
<td>
N/A
</td>
</tr>
<tr>
<td bgcolor="#d9d9d9">
Criterion
				#2
(Procedures)
</td>
<td bgcolor="#d9d9d9">
The
				UAS operator declares to have adequate procedures.
</td>
<td bgcolor="#d9d9d9">
(a)	Procedures
				are validated against standards considered adequate by the
				competent authority and/or in accordance with means of compliance
				acceptable to that authority.

(b)	The
				adequacy of the procedures is proved through:

				—	dedicated
				flight tests; or

				—	simulation
				provided the simulation is proven valid for the intended purpose
				with positive results.
 

</td>
<td bgcolor="#d9d9d9">
Same
				as ‘medium’. In addition:

(a)	flight
				tests performed to validate the procedures cover the complete
				flight envelope or are proven to be conservative;
(b)	the
				procedures, flight tests and simulations are validated by the
				competent authority of the Member State or by an entity that is
				designated by the competent authority.
</td>
</tr>
<tr valign="top">
<td>
Comments
</td>
<td>
1 Procedures do not require validation against either a standard or
				a means of compliance considered adequate by the competent
				authority.
</td>
<td>
1 National aviation authorities (NAAs) may define the standards
				and/or the means of compliance they consider adequate. The SORA
				Annex B will be updated at a later point in time with a list of
				adequate standards based on the feedback provided by the NAAs.
</td>
<td>
N/A
</td>
</tr>
</table>

---

[[75]](#_ftnref75)

[[76]](#_ftnref76)
In accordance with national occupational safety and health
regulations.

[[77]](#_ftnref77)
In accordance with national occupational safety and health
regulations.

[[78]](#_ftnref78)
<https://www.easa.europa.eu/en/document-library/product-certification-consultations/final-means-compliance-special-condition-light>

[[79]](#_ftnref79)
See the Rule of Three at
[https://en.wikipedia.org/wiki/Rule\_of\_three\_(statistics)](https://en.wikipedia.org/wiki/Rule_of_three_%28statistics%29).