Onboard Functional Requirements for Specific Category UAS and Safe Operation Monitoring

Abstract

The new concept for operation of drones, published by EASA in 2015 enables new ways to influence and possibly reduce the necessary safety targets of certain software components without reducing the overall safety of the unmanned aircraft system (UAS). Based on a safety assessment, the so called specific category enables new aircraft system architectures and mission designs. In this context, this paper proposes runtime monitoring as a mitigation strategy for the operation getting out of control to formally assure predefined properties in flight and thus assure the safety of the operation in progress. One particular aspect of this safe operation monitoring is geofencing, the capability to assure containment of the UAS in a previously restricted area. In the regulatory framework of a specific operation risk assessment, such a geofence can be interpreted as a harm barrier. The functional requirements for this geofencing use case are discussed regarding their impact on the underlying specific operation risk assessment. To achieve this, we develop a taxonomy of geofencing characteristics. Consequently, the geofencing requirements are assessed regarding their robustness and applicability for certification purposes. As a result, by monitoring the integrity of the system at runtime, exemplified in this paper with the use case of geofencing, it is investigated if the requirements and thus costs of development and certification process for the remaining components can be reduced.