OSO-06 — C2 Link
Summary
Compliance route for OSO#06 at SAIL III, focused on the Command and Control (C2) link between CMU and UA (the broader "C3" also covers any other communication link required for safety of flight). The applicant must substantiate two claims: (a) the C2 link performance is adequate for the intended operation under applicable environmental conditions, and (b) the remote pilot has continuous means to monitor C2 performance. Spectrum authorisation, ATC communications standards, and integrated U-space services are out of scope.
Operation Safety Objective
OSO#06 — C3 characteristics are appropriate for the operation. Performance, RF spectrum usage, and environmental conditions must be adequate; remote pilot must continuously monitor and ensure performance continues to meet operational requirements.
Means of Compliance — Two Fundamental Claims
- (a) C2 Link performance adequate to safely conduct intended operation given environmental conditions.
- (b) Remote pilot has means to continuously monitor C2 performance and ensure minimum performance is maintained.
Compliance Steps
1. Describe the C2 Link system (§3.1)
Functions, high-level architecture, on-board vs ground segment, physical/logical components, interfaces, exchanged data, nominal/degraded modes, transitions, recovery/reacquisition, directional vs omnidirectional; physical installation; operational procedures; training-syllabus supplement; flight-manual configuration parameters; minimum network requirements for SLA with external service providers.
2. Determine minimum required performances (§3.2.1)
Across full operational range under expected operating conditions:
| Dimension | Requirement |
|---|---|
| Coverage | Operational range as "design envelope"; max range first assessed by analysis (§3.2.2.1) and then confirmed by tests (§3.2.2.6). Multi-repeater relaying must operate in declared range. FTS/M2 actuation via C2 must be range-compatible. |
| Latency | Maximum acceptable latency of overall command-and-control loop, accounting for automation level, contingency-action timing, and SORA Low (final ARC-b) TMPR latency. |
| Integrity | Undetected-error rate sufficiently low not to jeopardise safety. CRC32 with Ethernet polynomial 0x04C11DB7 or equivalent unless lower acceptable demonstrated. |
| Functional performance | C2 Link HW/SW must comply with OSO#05 and OSO#24 (refer to those MoCs). |
| Continuity & Availability | SAIL III: no explicit min — adequately achieved by complying with §3.2.2.1 and §3.2.2.6. |
| Protection | Comply with ASD-STAN prEN 4709-001 ("C2 Link protection", §6.7.2 in prEN at MoC publication date) or EUROCAE ED-325 Vol. 1 subpart H (Light-UAS.2730 "C2 Link security"). |
3. Demonstrate min performances (§3.2.2)
- Coverage: free-space-loss equation
Pr/Pt = Gt·Gr·(λ/4πd)²; full link budget in dBm:P_RX = P_TX + G_TX − L_TX − L_FS − L_M + G_RX − L_RX. Account for cables, connectors, polarisation, antenna shadowing, terrain masking, Fresnel-radius obstruction. - Tests (§3.2.2.6): ≥30 minutes typical/representative operation; full uplink/downlink at max data rate and bandwidth; deliberately corrupt critical command messages — show no undetected errors and no UA erroneous reaction; full chain in the loop; multiple aircraft attitudes & antenna aspect angles (geometries from MoC Light-UAS.2511 §2.2.3 "Flight Tests"); propagation losses simulated/injected or tested in full operational envelope; HIRF & precipitation possibly affecting operational volume.
- Iterate on root causes; do not retest without analysis. No degraded performance during tests; constant safe UA control from CMU.
- Cyber tests per ASD-STAN prEN 4709-001 or ED-325 Vol. 1 subpart H.
- Warnings/emergencies must comply with SAIL III MoCs to OSO#19 and #20.
4. Operational and environmental limitations (§3.2.3)
Recorded in flight manual.
5. Continuous monitoring by remote pilot (§3.3)
- List probable malfunctions causing degraded uplink/downlink.
- Convey degradation via visual + aural and/or haptic alerts (HF criteria from SAIL III MoC OSO#19/#20).
- Convey at minimum signal-strength terms.
- When applicant-defined degradation threshold reached → declare C2 Link lost.
- Apply ASD-STAN prEN 4709-001 §6.7.1.1.2 + 6.7.1.2.2 (loss recovery) and §6.7.1.1.3 + 6.7.1.2.3 (auto reacquisition).
- If C2 cannot be reacquired, UAS must auto-initiate pre-established contingency/emergency procedures listed in flight manual.
6. Pre-flight checks (§3.4)
At least once per operational day before first flight; transmission test detecting connector/antenna degradation; ability to manually decrease transmit power recommended to simulate operational conditions.
7. Fresnel-radius obstruction (§3.5)
Applicant may declare design robustness vs. obstruction; quantify max obstruction in flight manual; analyse and test additional losses.
8. External services — LTE/SATCOM (§3.6)
- Identify type of external service.
- Substantiate evidence with service in the loop, define operational envelope and limitations.
- Identify minimum network requirements (latency, bit rate, bandwidth, max losses, power, sensitivity) so operator can establish SLA.
- Alternative: demonstrate UAS robustness to external-service failure (e.g. dual LTE providers, LTE+SATCOM redundancy with switching) — then OSO#13 SLA not strictly required.
- Specify all the above in flight manual.
9. Communications (§3.7)
ATC over VHF: latency must allow effective comms or impose range limits. Equipment integration at CMU/UA level checked. U-space comm performance defined per individual U-space airspace risk assessment (ARA); not assessed here.
Worked Example — SAIL III industrial linear-infrastructure surveillance (§4)
Op: gas-network linear inspection, RLOS to 60 km, <120 m AGL uncontrolled airspace (Arc-b), max 100 km/h, no/light precipitation, no HIRF. UAS: automatic flight throughout; pre-uploaded contingency/emergency trajectories; cooperative DAA with auto evasion; dual transmitter/receiver on UA & CMU; HD video downlink; auto return-to-home on C2 loss. Link budget: TX power 20 dBm, TX gain 18 dB, RX gain 10 dB, distance 60 km, 2400 MHz → received power ≈ −88 dBm. Tests per §3.2.2.6 confirm. Applicant determines C2 transaction time <0.5 s, more demanding than SORA TMPR Low ARC-b (5 s), but TMPR met by UA's automatic reaction (cooperative DAA), so C2 latency loop is independent of TMPR — checked outside C2 MoC scope.
Assumptions & Limitations
- Spectrum usage / authorisation for non-aeronautical-protected frequencies handled with NAA in operational authorisation, not here.
- ATC, U-space, and other communication services not addressed.
- For external services (LTE/SATCOM), service infrastructure is not part of UAS design — operator's responsibility under OSO#13 unless redundancy demonstrated.
- HW/SW elements installed in CMU/UA (incl. antennas) are part of UAS configuration/type design.
References
- ASD-STAN prEN 4709-001 §6.7.1 / §6.7.2
- EUROCAE ED-325 Vol. 1 subpart H — SC Light UAS, Light-UAS.2730 "C2 Link security"
- MoC Light-UAS.2511 §2.2.3 — Flight Tests (geometries, antenna aspects)
- IEC 61508 — guidance on integrity (CRC etc.)
- ITU recommendations — Fresnel-radius obstruction
- OSI 7-layer model
Related
- MoC Index
- OSO-05 — System Safety and Reliability — C2 Link HW/SW safety
- OSO-18 — Automatic Protection of Flight Envelope from Human Errors — auto contingency on link loss
- OSO-19-20 — Safe Recovery from Human Error & HMI — alerting / monitoring HF
- OSO-24 — Environmental Conditions — C2 Link environmental qualification