Guidelines
on
Design verification for UAS operated in
the ‘specific’ category
Issue 3
26 09 2023
Page 1 of 12
Table of contents
1. List of acronyms .................................................................................................................... 3
2. Background and applicability ................................................................................................ 4
3. Provision of a design verification service in the specific category – medium risk ..................... 5
Application phase ..................................................................................................................... 5
Design verification process....................................................................................................... 7
Issuance of a Design Verification Report .................................................................................. 9
4. Fees and Charges .................................................................................................................. 9
5. References............................................................................................................................ 9
EU Regulations.......................................................................................................................... 9
EASA ED Decisions/ Special conditions/DOARI ...................................................................... 10
Annex 1 – Guidance for developing means of compliance ........................................................... 11
1. List of acronyms
AMC Acceptable Means of Compliance
COTS Commercial Off-The-Shelf
ConOps Concept of Operations
DOARI Design Organisation Approval Review Item
DV Design Verification
DVP Design Verification Programme
DVR Design Verification Report
EASA European Union Aviation Safety Agency
FTS Flight Termination System
GM Guidance Material
MoC Means of Compliance
NAA National Aviation Authority (of an EASA Member State)
OSO Operational Safety Objective
SAIL Specific Assurance and Integrity Level
SC Special Condition
SORA Specific Operation Risk Assessment
TC Type Certificate
UAS Unmanned Aircraft System
VTOL Vertical Take-Off and Landing
Page 3 of 12
2. Background and applicability
Background
In 2018, a new Basic Regulation (Regulation (EU) 2018/1139) was adopted, followed by the new
European Commission Implementing Regulation (EU) 2019/947 (applicable as of 31 December 2020)
and Delegated Regulation (EU) 2019/945 (applicable as of 1 July 2019). These documents set the new
UAS regulatory framework, which is a proportional risk-based approach to UAS. Its pillar is the
identification of three categories of operation: ‘open’, ‘specific’ and ‘certified’.
While the ‘open’ category includes strict operational limitations, the ‘specific’ category has the
potential to capture a wide range of UAS operations. The detailed provisions for the ‘certified’
category of operations have not yet been adopted at the issuance date of these Guidelines.
For operations in the ‘specific’ category, an operational authorisation issued by the competent
authority of registration is required, unless the operation is covered by a standard scenario. This
operational authorisation will be based on the outcome of the risk assessment conducted in
accordance with Article 11 of Regulation 2019/947. As an acceptable methodology for such risk
assessments, EASA published the specific operation risk assessment (SORA) as AMC to Article 11.
The SORA consolidates the ground and air risk analyses within the specific assurance and integrity
level (SAIL), which drives the required activities. The SAIL is a figure from I to VI, leading to the
identification of operational safety objectives (OSOs) to be met with a certain level of robustness (i.e.,
integrity and assurance), which tend to increase with an increasing SAIL.
Applicability of these guidelines
An EASA DVR is required for the following cases:
- If an operation is classified as SAIL IV, and/or
- Mitigation means linked with design when claimed at high robustness, and/or
- For the verification of the ‘enhanced containment’ as currently defined by SORA1 when no
declarative MoC can be applied
These guidelines are applicable for any design verification project.
Note:
Even if not required, manufacturers of UAS used for SAIL IV operations, may voluntarily apply for a
Type Certificate (TC) or a Restricted Type Certificate (RTC) according to Regulation (EU) 748/2012 (Part
21). In such cases, EASA will apply the certification process defined in Part 21, complemented by the
content of DOARI 2020-012 for the initial investigation of the design organisation.
Who can apply for a DVR
Any natural or legal person having access to the relevant design and technical data to be able to
demonstrate compliance with the applicable technical requirements is eligible as an applicant for a
DVR.
1 SORA is currently under review. Version 2.5 is planned to be adopted by EASA after JARUS disposition of comments from public
consultation.
2
https://www.easa.europa.eu/sites/default/files/dfu/doari_2020-01_consultation_paper.pdf
Page 4 of 12
3. Provision of a design verification service in the specific category – medium
risk
EASA provides detailed information about the DVR on its website3. In case of remaining questions that
are not addressed in this set, please contact the EASA under the following email address:
[email protected]
A pre-application meeting of maximum duration of one hour can be arranged to clarify specific aspects
of the DVR application and subsequent project.
Application phase
The applicant should accomplish the following steps:
1. Establish the typical operation the UAS is intended to be used for, the operational
assumptions and relevant limitations, including for which environmental and operational
conditions the UAS is designed to be operated (e.g., night operations, weather
conditions), which buffers/corridors dimensions are envisioned, if credit is requested
based on the use of ground or air risk mitigation means, if enhanced containment would
be required
2. Develop a representative SORA for the typical operation.
3. Submit to EASA an application for a design verification using the application form
“Application for UAS design verification”4.
4. Provide at least the following minimum set of data, following the completion instructions
of the application form:
- A detailed description of the design (including main characterisation drawings and system
architecture) as well as configurations to be verified.
- A risk assessment according to SORA and the description of the typical operations the UAS
is expected to conduct that will include as applicable:
a. the proposed operating characteristics and limitations.
b. the intended use of the product and the kind of operations for which the design
verification is requested.
c. the relevant parts of the typical operations that drive design aspects.
d. the characterisation of the operational volume and ground risk buffers in terms of
both the ground and air risks.
e. the identified final ground risk class, residual air risk class and SAIL; and
f. any applicable restrictions, limitations, or assumptions about adjacent areas and
design-related mitigation means which may influence the applicable specification or
the MoCs.
- The design verification basis, identifying those paragraphs that are applicable to the UAS
for which the verification is required.
3 https://www.easa.europa.eu/en/domains/civil-drones-rpas/specific-category-civil-drones
4
https://www.easa.europa.eu/en/document-library/application-forms/focserv00198-001
Page 5 of 12
- A design verification programme (DVP) for the demonstration of compliance, including the
proposal for the list of MoC intended to be used and the related compliance documents.
- A project schedule, including the major milestones.
Note: In case of the first-ever application the applicant will be requested to register on the EASA
website.
Note: EASA will not approve neither the SORA nor the operation(s). This information will be used to
define in the DVR the limitations that the UAS operator should use when applying to the NAA for an
operational authorisation.
The scope of a design verification can cover one or more of the following points:
- The full design of the UAS for its compliance with design related OSOs defined in the SORA
process, to meet the required level of robustness for the applicable SAIL.
- The mitigation means linked with the design.
- The enhanced containment function.
- Parts installed on a UAS contributing to the safety performance5.
With this service, EASA provides a no-technical-objection (NTO) for the verified domains and does not
certify or approve the unmanned aircraft, the command unit or the operation.
The purpose of the service is to provide the applicant with an independent assessment of the design
related OSOs, mitigation means and/or enhanced containment based on which the NAA could rely
when issuing operational authorisations.
The applicant remains responsible for those aspects of the design which fall within the scope of the
design verification application, as detailed above.
In case of a reduced scope of the design verification to particular functions/features, the verification
will be limited to the elements needed for demonstrating compliance to specific paragraphs (i.e.,
Light-UAS.2511 for enhanced containment and Light-UAS.2512 for mitigation means). For example, if
the objective of the design verification is to show compliance to the enhanced containment
requirements and the UAS has a separate “stand-alone” flight termination system (FTS), the DVR
might be limited to that system. Otherwise, if the containment function is deeply integrated in the
UAS architecture, the investigation could be extended to other UAS functions and equipment needed
to ensure the correct operation of the containment function. In both cases, the DVR would be relative
to the specific UAS configuration and installation. The same applies to DV projects focused on
mitigation means linked with the design.
Only after a full UAS DVR is issued, EASA is open to evaluate the possibility of issuing DVRs for specific
UAS components (e.g., engines, autopilot, FTS…) once the limitations and the interfaces between the
sub-system and the UAS are clarified.
5Parts installed on the UAS will initially be evaluated only within the frame of a full design verification project. EASA is open to evaluate a
stand-alone DVR for those parts only after the interfaces between the part and the UAS are clarified within a full DV project.
Page 6 of 12
Determination of the design verification basis
The design verification basis should be agreed early in the process. The applicant should consider the
Special Condition for Light UAS - Medium Risk6. If needed, adaptations may be considered.
Environmental protection
Applicants are strongly encouraged to carry out noise measurement according to appropriate
procedures, and to report the noise levels to EASA. EASA may decide on its participation to the
measurement campaign on a case-by-case basis.
EASA has issued the Guidelines on Noise Measurement of Unmanned Aircraft Systems Lighter than
600 kg Operating in the Specific Category (Low and Medium Risk)7 Those guidelines deliberately cover
a wide variety of designs. Additionally, they now encompass a template for a typical noise report, as
well as a calculation spreadsheet that facilitates the adjustments of measured noise levels according
to the recommended procedures. Applicants and declarants are strongly encouraged to make use of
these tools.
Applicants and declarants are also encouraged to provide the resulting noise levels to EASA, under the
form of a noise report for which a template is attached to the Guidelines. In the short term, this can
be done by sending an email to [email protected], until an online repository is available
(currently undergoing development).
As part of future rulemaking activities, EASA or a NAA may establish noise limits for UAS, in which case,
the applicant will need to declare compliance with those limits.
Design verification programme (DVP)
The DVP is a document that allows the applicant and EASA to manage and control the evolving UAS
design, as well as the process of compliance demonstration by the applicant.
The applicant will propose its DVP, including the MoCs. Once agreed with EASA, the applicant will
conduct the verification activities (appraisals, analyses, tests…) and document them accordingly.
Design verification process
EASA will assess the submitted application, and upon its acceptance, enter the design verification
phase. The DVR will be issued to the applicant who will be responsible of retaining all relevant design
information, drawings and test repots to ensure continued airworthiness of the product and the
continued validity of the DVR.
The applicant should demonstrate compliance with the design verification basis and the
environmental protection provisions, as applicable, and should propose the means (MoCs) by which
such compliance is planned to be demonstrated.
Since the SC Light-UAS is objective-based, these MoCs need to achieve the following:
- Describe/clarify how the SC Light UAS paragraph applies to the UAS configuration.
- Describe/specify concrete UAS design-related auditable or measurable specifications and,
6https://www.easa.europa.eu/sites/default/files/dfu/special_condition_sc_light-uas_medium_risk_01.pdf
7https://www.easa.europa.eu/en/document-library/product-certification-consultations/guidelines-noise-measurement-unmanned-
aircraft
Page 7 of 12
- Define how to demonstrate compliance with this data (e.g., design review,
calculation/analysis, laboratory tests, ground tests, flight tests etc.)
To achieve these targets, the applicant may:
- Make use of the MoCs published by EASA8
- Propose MoCs based on either published existing technical specifications or industry
standards and their relevant sections9
- Propose new MoCs if no MoC from the above two points is considered appropriate.
Proposed Means of Compliance (when not directly applying MoC published by EASA or other
published standards)
As stated above, the proposed DVP should include the MoCs. The applicant could present the detailed
MoCs in separate documents, when considered necessary.
The proposed MoCs should specify in each case at least:
- The design objective that is to be achieved.
- The activities to be carried out and their planning.
- The parameters which are considered relevant and their rationale.
- The references to industrial standards, airworthiness specifications or other GM/AMC (if any).
- The pass/fail criteria.
In practice, the MoCs should clarify the safety objective derived from the Design Verification Basis’
paragraph and should allow EASA Certification Experts to understand the adequateness of the
proposed MoC as well as how the applicant intends to show compliance to that paragraph.
EASA may accept MoCs based on extensive product tests complemented by further design criteria
substantiations, depending on the safety objectives and the operational risk. Such a methodology may
help in addressing the verification of products based on COTS with limited evidence of development
standards.
Please refer to Annex 1 for an example illustrating the development of means of compliance.
Qualitative and quantitative assessments
To ensure proportionality between risk and safety requirements, the low and medium risk of the
specific category (SAIL I through IV) mainly rely on qualitative requirements. Applicants are reminded
that a quantitative approach may not only be disproportionate, but it may be particularly challenging
for less experienced applicants and shift the focus away from the overall safety objective.
In case a safety analysis is proposed to show compliance to some requirements in the design
verification basis, the applicant should initially perform a qualitative assessment. If the qualitative
assessment is not conclusive then a quantitative assessment should be considered.
Electrical lift/thrust/power systems
8 For a list of MoC published by EASA, please consult Design verification report | EASA (europa.eu)
9
Some potentially applicable standards could be found within the publications of AW Drones under Home page - AW-Drones
Page 8 of 12
These systems will be verified as part of the UAS design, and therefore, the MoCs need to consider
their qualification and their integration. The SC for Light-UAS already indicates various pertinent
design objectives, with further considerations to be addressed in the MoC.
Tactical Mitigation Performance Requirements (TMPR)
In the frame of design verification projects, if applicable, EASA will investigate the correct installation
of the tactical mitigation means (in accordance with manufactures instructions), their safe system
integration as well as the pilot interface. EASA will ensure that those means are not detrimental for
the safe operation of the UAS and that the UAS will comply with the associated latencies command-
to-execution and maneuvering capabilities. Applicants should consider these elements when
preparing their DVP.
However, the design verification will not investigate the actual performance of the tactical mitigation
means, and it will not ensure that they would have an appropriate outcome or be adequate to the
operation.
When issuing the operational authorisation to a UAS operator using a UAS with a DVR, the competent
authority will evaluate the appropriateness of the TMPR to address the residual air risk for the volume
of airspace where the operation is carried out.
Issuance of a Design Verification Report
The outcome of the design verification process is an EASA document, referred to as Design Verification
Report, stating that EASA is satisfied with the verified compliance demonstration provided by the
applicant. The DVR includes limitations and any conditions or assumptions under which it holds its
validity. The conditions will be those linked with the type of operation, as described in the SORA
provided in support of the application and resulting from the UAS design verification.
4. Fees and Charges
Fees and charges applied by EASA are defined by Regulation (EU) 2019/2153, in which fees for UAS
are not yet included. EASA, therefore, charges an hourly rate considering the time spent on the project
by EASA staff. EASA charges the actual time spent on the evaluation of the project only, and additional
time spent to improve the regulatory framework is financed by other means.
Considering the variety of potential projects in this category, an estimate applicable to all cases cannot
be provided. EASA expects that the effort spent for the verification of the design of the subject UAS
should not exceed 180 working hours (WH) per year in case of typical complexity (10)
5. References
EU Regulations
- Commission Implementing Regulation (EU) 2019/947 of 24 May 2019 on the rules and
procedures for the operation of unmanned aircraft (OJ L 152, 11.6.2019, p. 45)
10 Simple projects or verification limited to mitigation means may require a limited effort while more complex projects may require a
larger number of hours to be spent by EASA staff. Elements like numbers of UAs controlled in parallel, or complexity of the design of the
single UA or the Command Unit would be taken into consideration.
Page 9 of 12
- Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems (OJ L 152, 11.6.2019,
p. 1)
- Commission Regulation (EU) No 748/2012 of 3 August 2012 laying down implementing rules
for the airworthiness and environmental certification of aircraft and related products, parts,
and appliances, as well as for the certification of design and production organisations (OJ L
224, 21.8.2012, p. 1)
- Commission Implementing Regulation (EU) 2019/2153 of 16 December 2019 on the fees and
charges levied by the European Union Aviation Safety Agency, and repealing Regulation (EU)
No 319/2014 (OJ L 327, 17.12.2019, p. 36–65)
EASA ED Decisions/ Special conditions/DOARI
- Executive Director Decision 2019/021/R of 9 October 2019 issuing Acceptable Means of
Compliance and Guidance Material to Commission Implementing Regulation (EU) No
2019/947 ‘Rules and procedures for the operation of unmanned aircraft’
- Special Condition for Light UAS - medium risk
- DOARI 2020-01
Page 10 of 12
ANNEX 1 – GUIDANCE FOR DEVELOPING MEANS OF COMPLIANCE
This guidance is intended to illustrate EASA’s expectations regarding the proposal of Means of
Compliance in the frame of a Design Verification Project. The example is not exhaustive, but it aims at
providing relevant information to be consider when developing an acceptable MoC.
For the illustration, consider Special Condition Light-UAS.2235.
Light-UAS.2235 Structural strength and deformation
(a) The structure must be shown not to fail throughout the limit flight envelope with sufficient
margin to ensure the applicable safety objectives are met.
(b) The structure must be shown not to interfere with safe operation throughout the limit
flight envelope.
(c) The effects of the operating environment must be taken into account when complying with
sub paragraphs (a) and (b).
Objective(s) of the MoC
The requirements of the Special Condition Light-UAS are set in an objective based manner, rather than
prescribing detailed technical specifications. These objectives are technology-agnostic and could be
applied independently of the UAS configuration. Consequently, when proposing Means of
Compliance, the applicant should consider how these paragraphs apply to their design.
Light-UAS.2235(a) requires the flight envelope(s) to be defined, this is done in accordance with
Subpart B of the Special Condition. The definition of the flight envelope will depend on the UAS
configuration: it will be different for a fixed-wing, a rotary-wing, or a VTOL.
The same paragraph requires to show that the structure will not fail throughout the limit flight
envelope with sufficient margin to ensure the applicable safety objectives are met. Therefore, the
applicant should define the adequate margin (safety factor) between the loads of the limit envelope
and the loads at which the structure no longer performs its intended function. This could be either a
structural failure or an excessive deformation such that the UAS can no longer operate safely.
Compliance demonstration activities
Once the UAS safety objectives are identified, the applicant should define adequate activities to show
that these objectives are met, i.e., that the UAS’ design complies with that paragraph. following with
our example, an applicant may contemplate showing compliance to Light-UAS.2235(a) by means of
analysis and laboratory test(s).
The applicant may carry out a load analysis for the most critical points of the limit flight envelope (the
choice of those points should be justified). The way these loads will be estimated should be specified.
The estimated loads could then be multiplied by the proposed safety factor (i.e., sufficient margin) to
obtain the ultimate loads.
Once the loads are estimated, the applicant should show that the structure is able to resist these. This
may be achieved with a test. The applicant may apply the ultimate loads to a part or to the entire
structure and verify its integrity. The applicant may refer to an industry standard describing the test
procedure or propose its own.
Reference(s) to industrial standards or applicable GM/AMC (if applicable)
Page 11 of 12
Industrial standards, GM&AMC to the Certification Specification for lower-end products (small
aeroplanes, light rotorcrafts) or other Special Conditions issued by EASA may not keep into account
the specificities of UAS. Nevertheless, they may be well suited for many common aspects and could
be proposed as they are or in an adapted form.
Qualifications
If the applicant intends to take credit of some equipment’s qualification this should be stated. For
example, sometimes pressure vessels or fuel tanks could have been tested by the manufacturer. If
evidence of such qualification is available, the applicant may be able to claim credit for it.
Pass/fail criteria
The applicant should define the pass/fail criteria. In the example of Light-UAS.2235(a) the criterion is
no failure of the structure. In some cases, the failure could be evident, in some other case some post-
test assessment or inspection might be required.
Additional considerations
It may be noted that concurrently with the structure/part loading test the applicant may also show
compliance (at least in part) to Light-UAS.2235(b). For example, the deflection of the loaded wing may
interfere with the operation of the control surfaces of a fixed wing UA. This may interfere with the
safe operation of the UAS. Therefore, during the load tests the applicant may show that the control
surfaces can still operate safely. Depending on the UAS architecture, structural deformations may
cause other safety issues like (but not limited to) excessive pressure on energy storage systems or
blockage of energy distribution lines. The applicant should anticipate, to the extent possible, these
potential issues in advance.
Some materials are particularly sensible to the environment. For example, temperature and humidity
have an appreciable impact on composite materials’ properties. This could have an impact on the load
tests/analyses to be performed and the parameters to be recorded during these activities. Otherwise,
a conservative additional safety factor could be proposed for composite structures to address this
effect. In other cases, according to the CONOPS, the UAS may be expected to operate in particularly
hostile environments (very cold, very hot, corrosive…). This may have to be reflected in the Means of
Compliance to address Light-UAS.2235(c).
Page 12 of 12
