FprEN 4709-006

SLOVENSKI STANDARD
01-november-2023
Aeronavtika - Letalski sistemi brez posadke - 006. del: Sredstva za prekinitev leta,
zahteve in preverjanje
Aerospace series - Unmanned Aircraft Systems - Part 006: Means to terminate flight,
requirements, and verification
Luft- und Raumfahrt - Unbemannte Luftfahrzeugsysteme - Teil 006: Mittel zum
Flugabbruch, Anforderungen und Prüfverfahren
Série aérospatiale - Aéronefs télépilotés - Partie 006 : Moyens pour interrompre le vol,
exigences et vérification
Ta slovenski standard je istoveten z: prEN 4709-006
ICS:
03.220.50 Zračni transport Air transport
49.020 Letala in vesoljska vozila na Aircraft and space vehicles in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
EUROPEAN STANDARD
prEN 4709-006
NORME EUROPÉENNE
EUROPÄISCHE NORM
August 2023
ICS
English Version
Aerospace series - Unmanned Aircraft Systems - Part 006:
Means to terminate flight, requirements, and verification
Série aérospatiale - Aéronefs télépilotés - Partie 006 : Luft- und Raumfahrt - Unbemannte
Moyens pour interrompre le vol, exigences et Luftfahrzeugsysteme - Teil 006: Mittel zum
vérification Flugabbruch, Anforderungen und Prüfverfahren
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/TC 471.
If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations
which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.

EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2023 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 4709-006:2023 E
worldwide for CEN national Members.

prEN 4709-006:2023 (E)
Contents Page
European foreword . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 6
4 Product requirements and compliance of means to terminate the flight for Class 5
UAS . 9
4.1 Reliability, predictability, and independence . 9
4.1.1 Performance requirements . 9
4.1.2 Verification method . 9
4.1.3 Pass criteria . 15
4.2 Descent performance . 16
4.2.1 Performance requirements . 16
4.2.2 Verification methods . 16
4.2.3 Pass criteria . 23
4.3 Means to reduce the effect of UA impact dynamics . 23
4.3.1 Performance requirements . 23
4.3.2 Verification method . 24
4.3.3 Pass criteria . 24
4.4 Manufacturer’s instructions . 24
5 Product requirements and compliance of means to terminate the flight for class 6
UAS . 25
5.1 Reliability, predictability, and independence . 25
5.2 Descent performance . 25
5.2.1 General. 25
5.2.2 Performance requirements . 25
5.2.3 Verification methods . 25
5.2.4 Pass criteria . 25
5.3 Manufacturer’s instructions . 25
5.3.1 Requirements . 25
5.3.2 Verification method – Part H: flight termination . 26
5.3.3 Pass criteria . 27
Annex A (informative) Example design patterns for the representation of independent
means to terminate flight (flight termination system) implementation . 28
A.1 Example design patterns . 28
A.2 Recommendations for the presentation of the UAS architecture . 31
A.3 Abbreviations . 31
Annex B (informative) Generic safety assessment . 32
B.1 General. 32
B.2 Approach . 32
prEN 4709-006:2023 (E)
B.3 Checklist . 32
Annex C (informative) Automation . 35
Annex D (informative) Methods to perform descent and limit the effects of impact
dynamics (semantic model) . 37
D.1 Overview of typical methods to bring the UA to ground . 37
D.2 Initiation . 37
D.3 Descent . 38
D.3.1 Controlled descent, if possible . 38
D.3.2 Uncontrolled descent . 38
D.3.3 Descent by parachute . 39
D.4 Alight . 39
D.5 Post-landing/post-impact . 39
Annex ZA (informative) Relationship between this document and the essential
requirements of Delegated regulation (EU) 2019/945 of 12th March 2019 on
unmanned aircraft systems and on third-country operators of unmanned aircraft
systems aimed to be covered. 40
Bibliography . 41

prEN 4709-006:2023 (E)
European foreword
This document (prEN 4709-006:2023) has been prepared by the Aerospace and Defence Industries
Association of Europe — Standardization (ASD-STAN) and have been finalized by CEN/TC 471
“Aviation and aeronautics”, the secretariat of which is held by BNAE.
This document is currently submitted to the CEN Enquiry.
This document has been prepared under a Standardization Request given to CEN by the European
Commission and the European Free Trade Association and supports essential requirements of EU
Directive(s)/Regulation(s).
For relationship with EU Directive(s)/Regulation(s), see informative Annex ZA, which is an integral part
of this document.
prEN 4709-006:2023 (E)
1 Scope
This document provides technical specification and verification methods to support compliance with
Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and
on third-country operators of unmanned aircraft systems.
This part provides requirements, test methods and pass criteria for the means to terminate flight (flight
termination) for unmanned aircraft systems, in particular addressing:
— safety related aspects of the architecture;
— descent performance;
— means to reduce the effects of impact on ground; and
— manufacturer’s instructions.
Even if security, including IT security, may be useful from an operational point of view, it falls outside
the scope of this document.
An activation of the means to terminate the flight by a visual observer is also outside the scope of this
document.
This document provides voluntary means of demonstrating compliance with the requirements laid out
in Regulation (EU) 2019/945.
Additional hazards that occur from the characteristics of the payload are excluded and are, conversely,
under the responsibility of the UAS manufacturer and UAS operator.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
EN 4709-001:—, Aerospace series — Unmanned Aircraft Systems — Part 001: Product requirements and
verification
EN 4709-005:—, Aerospace series — Unmanned Aircraft Systems — Part 005: Verification Method for
the Geocaging Function
EN 62368-1:2014, Audio/video, information and communication technology equipment - Part 1: Safety
requirements (IEC 62368-1:2014, modified)

Under preparation. Stage at the time of publication: prEN 4709-001:2023.
Under preparation. Stage at the time of publication: prEN 4709-005:2023.
prEN 4709-006:2023 (E)
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp/
— IEC Electropedia: available at https://www.electropedia.org/
3.1
automatic flight control and guidance system
aggregation of items where the automatic flight control and guidance functions are allocated to
Note 1 to entry: for the assessment of independence and reliability, the automatic flight control and guidance
system includes associated power supplies and protections (e.g. fuses, bridges).
3.2
configuration
basic design arrangement of the UA: fixed-wing, rotary wing, or multicopter
3.3
debris area
critical area from inert (non-explosive) debris defined as the sum of all areas on the ground where a
person standing would be expected to be impacted by the UA during or after a loss of control event, and
thus the area where a fatality is expected to occur if a person were within it
3.4
equipment to control unmanned aircraft remotely
any instrument, equipment, mechanism, apparatus, appurtenance, software, or accessory that is
necessary for the safe operation of a UA, other than a part, and which is not carried on board that UA
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (2)]
3.5
failure recognition time
time for the flight termination function to detect the issue
3.6
reaction time
time required to act
Note 1 to entry: For manual recovery, pilot reaction time includes the time for the remote pilot to detect the issue
and to take appropriate action.
Note 2 to entry: Typically, failure recognition time and pilot reaction time together typically are 3 s.
prEN 4709-006:2023 (E)
3.7
flight termination (FT, means to terminate flight) (function)
allows the remote pilot to prevent the UA from exiting the controlled ground area by forcing the descent
of the UA and preventing it from continuing its horizontal trajectory (e.g. by cutting the propulsion
power)
Note 1 to entry: When an emergency situation is perceived as likely to lead to the UA outside the operational
volume, the remote pilot is obliged to ensure that the flight termination function is triggered before the unmanned
aircraft reaches the limits of the operational volume.
Note 2 to entry: Means for the remote pilot to terminate the flight of the UA can be provided by means for the
remote pilot to manually terminate the flight of the UA or by programming an automatic activation of the flight
termination function.
Note 3 to entry: The automatic flight termination, where implemented, would reflect the relevant part of the
Geocaging standard to ensure coherence between the automatic means to terminate flight and the Geocaging
function
Note 4 to entry: The flight termination function will be triggered:
— manually by the remote pilot and/or
— automatically in response to an imminent or actual loss of containment in coherence with EN 4709-
3.8
hazard
any condition or object with the potential to cause injuries, damage, loss of material or a reduction of
the ability to perform a prescribed function
3.9
independence
concept that minimizes the likelihood of common mode errors and cascade failures between
aircraft/system functions or items
Note 1 to entry: in the context of this standard – relates to the means to terminate the flight: a characteristic of
the UAS architecture implemented to avoid having a failure outside or in common with the means to terminate the
flight that would require flight termination as a mitigation but that inhibits proper execution of the flight
termination function.
3.10
major impact damage
any damage resulting from impact dynamics that cannot be repaired and requires the replacement of
the UA
3.11
maximum operational distance
in the context of this standard, the maximum range permitted by the standard scenario for which
compliance is declared to, or the maximum range declared by the manufacturer, whichever is less
3.12
means for the remote pilot to terminate the flight of the UA (means to terminate flight)
technical means as part of a UAS that provide a flight termination function
prEN 4709-006:2023 (E)
3.13
means to reduce the effect of the UA impact dynamics
technical means as part of a UAS that prevent major impact damage to mitigate the risk that the remote
pilot does not activate the means to terminate the flight in time, fearing the damage and the potential
destruction of the UA
Note 1 to entry: Experience with this type of UAS operations has shown that human factors (e.g. fear of losing the
UA) may play a role in reducing the effectiveness of the means to terminate the flight.
[SOURCE: European Union Aviation Safety Agency, Opinion No. 05/2019, Standard scenarios for UAS
operations in the ‘specific’ category, section 2.3.1.9, page 12]
3.14
operational volume
volume of airspace, defined in space and time, to which the operation of the UA is restricted
3.15
payload
means instrument, mechanism, equipment, part, apparatus, appurtenance, or accessory, including
communications equipment, that is installed in or attached to the aircraft and is not used or intended to
be used in operating or controlling an aircraft in flight, and is not part of an airframe, engine, or
propeller
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (29)]
3.16
predictability
in the context of this document, the assurance that the UAS performs the procedures as described in the
manufacturer's instructions
3.17
reliability
in the context of this document, the probability of proper execution of flight termination; relates to safe
operation and does not take spurious/inadvertent activation into account
3.18
remote pilot
natural person responsible for safely conducting the flight of a UA by operating its flight controls, either
manually or, when the UA flies automatically, by programming and monitoring its course, and
remaining able to intervene and change its course at any time
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (27)]
3.19
unmanned aircraft
UA
aircraft operating or designed to operate autonomously or to be piloted remotely without a pilot on
board
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (1)]
prEN 4709-006:2023 (E)
3.20
unmanned aircraft system
UAS
unmanned aircraft and the equipment to control it remotely
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (3)]
3.21
tether
in the sense of this standard, a mechanical device for the purpose of effectively restraining the UA
within the range permitted by the length of the tether as its primary function
3.22
untethered UA
UA that is not mechanically restraint in its movement by a tether
Note 1 to entry: not all cables linking the UA to the ground are considered as tether in the sense of this document
e.g. an electric cable powering the UA, even if it was the only source of power and a loss of connection would
inevitably lead to a loss of flight is not considered as a tether. Nonetheless, a tether may be used to transmit
electrical power to the UA as its secondary function.
4 Product requirements and compliance of means to terminate the flight for
Class 5 UAS
4.1 Reliability, predictability, and independence
4.1.1 Performance requirements
The UAS shall provide means for the remote pilot to terminate the flight of the UA, which shall:
(1) demonstrate that the probability of a failure to correctly activate the operation of the flight
termination system is acceptable (reliability);
(2) ensure that the UAS performs the procedures as described in the manufacturer's instructions
(predictability); and
(3) avoid having a failure in the automatic flight control and guidance function, the geocaging function
or the flight termination function which by itself inhibits proper execution of the flight termination
function when mitigation of that failure depends on flight termination (independence).
4.1.2 Verification method
4.1.2.1 Requirement (1) – Reliability
4.1.2.1.1 General
Reliability shall be shown by application of both methods provided in the following subclauses.
— Verify by ground tests as per 4.1.2.1.2 that the flight termination system as installed on the UAS can
be activated properly and that the ability of the UA to continue powered horizontal displacement is
inhibited.
— Verify by flight tests as per 4.1.2.1.3 that the flight termination system is able to reliably perform
flight termination.
prEN 4709-006:2023 (E)
4.1.2.1.2 Ground tests
Ground tests may be conducted with the UAS used for flight tests as per 4.1.2.1.3 and can be performed
along with the flight tests as pre-flight activities, or as flight tests.
Ground tests shall be conducted as end-to-end tests without any substitution as opposed to flight tests.
Where activated manually, the ground tests shall be performed at the maximum operational distance of
the UA from the antenna(s) transmitting the flight termination command. The ground segment of the
flight termination unit(s) should be connected to its antenna(s) as in the real operational case.
Alternatively, in order to emulate the effects of distance, attenuation device(s) or a shielded
environment equivalent to conditions whilst operating at maximum operational distance may be used.
Where activated automatically, correct activation of the termination signal shall be tested providing as
input to the flight termination system those conditions which would cause its triggering in flight. In this
case, the activation should be checked for a set of conditions covering uniformly the whole activation
envelope, while limiting the granularity of such checks.
A single ground test is considered passed when upon activation the characteristics of the system
indicate successful execution of flight termination:
a. for any configuration that performs flight termination in conjunction with deploying a parachute:
the electrical current (amperage) of all motors is zero (off) and the parachute deployed; the
opening of a parachute bay door is sufficient to indicate the successful deployment of a parachute
where the parachute itself is deployed into the airstream;
b. for any configuration that performs flight termination by shutting off all motors: the electrical
current (amperage) of all motors is zero (off) or negative (recuperating);
c. for any configuration that performs flight termination by moving actuators into a pre-defined
position: the actuators are in the pre-defined position;
d. for any configuration that performs flight termination by powering off actuators: the electrical
power (voltage) at the actuators is zero (off) or the actuator is in a mode where it does not draw
current (amperage) and moves freely.
The test specimen shall be instrumented as required to show the characteristics of the system
indicating successful execution of flight termination.
The UAS may be fitted with special firmware to trigger or simulate automatic activation conditions in
order to enable compliance testing. Unless provided as dedicated software or firmware specific for the
test, it shall be verified by review of the manufacturer's design that any means to trigger or simulate
automatic activation conditions are not easily available and protected from unintended engagement by
safeguards.
10 activations shall be performed consecutively.
Where the flight termination function can be activated both manually and automatically, the number of
activations shall be evenly distributed across the entire ensemble but does not need to exceed the total
number of activations specified above.
Ground tests are considered passed when the full set of tests is passed.
prEN 4709-006:2023 (E)
4.1.2.1.3 Flight Test
Flight tests may be combined with drop tests as per 4.2.2.
A total of 20 flight tests is required to demonstrate proper activation of the on-board segment of the
flight termination system.
A representative non-destructive configuration may be arranged as a substitute if it can be ensured that
the indicators used to monitor activation of the flight termination function are representative for the
actual activation.
This may be accomplished by digital recording of the flight termination system signal, which would
normally interrupt power connection to engines when flight termination system is actuated, avoiding
that such signal actually commands power interruption during tests.
It shall be demonstrated that each manual activation from ground would result in flight termination.
In the following the terms 'maximum speed' and 'minimum speed' refer to the maximum and minimum
speed as defined in the manufacturer's instructions, and in the same way 'minimum height' and
'maximum height' to minimum and maximum height as defined in the manufacturer's instructions.
— Where activated purely manually, the following scenarios shall be tested:
1. UA flying straight and level towards or away from the antenna(s) transmitting the flight
termination signal, at the minimum and maximum height (excluding climb and descent
segments). 10 activations shall be triggered:
a. 5 at minimum height for maximum speed, 2 of which testing the maximum operational
distance at that height, the other 3 within minimum and maximum speed (see NOTE 1 and
NOTE 2) as shown in Figure 1,
b. 5 at maximum height, 2 of which testing the maximum operational distance at that height,
the other 3 within minimum and maximum speed (see NOTE 1 and NOTE 2) as given
in 1.a.;
2. UA flying straight and level in a direction perpendicular to the one of the tests given in 1., same
heights, same distribution. 10 activations shall be triggered:
a. 5 at minimum height for maximum speed, 2 of which testing the maximum operational
distance at that height, the other 3 within minimum and maximum speed (see NOTE 1 and
NOTE 2) as shown in Figure 1,
b. 5 at maximum height, 2 of which testing the maximum operational distance at that height,
the other 3 within minimum and maximum speed (see NOTE 1 and NOTE 2) as given in
2.a.
prEN 4709-006:2023 (E)
Figure 1 — Flight test sequence [Source: European Union Aviation Safety Agency, MOC Light-
UAS.2511-01, “Means of Compliance with Light-UAS.2511 Containment”, Issue 1, May 2022,
section 2.2.3]
— Where activated purely automatically, the following scenarios shall be tested:
1. UA flying straight and level, at the minimum and maximum height (excluding climb and descent
segments). 20 activations shall be triggered:
a. 10 at minimum height within minimum and maximum speed (see NOTE 1, NOTE 2),
b. 10 at maximum height within minimum and maximum speed (see NOTE 1, NOTE 2).
— Where activated both manually and automatically, the following scenarios shall be tested:
1. UA flying straight and level towards or away from the antenna(s) transmitting the flight
termination signal, at the minimum and maximum height (excluding climb and descent
segments). 6 manual activations shall be triggered:
a. 3 at minimum height for maximum speed, 1 of which testing the maximum operational
distance at that height, the other 2 at minimum and maximum speed (see NOTE 1) as
shown in Figure 1,
b. 3 at maximum height, 1 of which testing the maximum operational distance at that height,
the other 2 at minimum and maximum speed (see NOTE 1) as given in 1.a.;
2. UA flying straight and level in a direction perpendicular to the one of the tests given in 1., same
heights, same distribution. 6 manual activations shall be triggered:
a. 3 at minimum height for maximum speed, 1 of which testing the maximum operational
distance at that height, the other 2 at minimum and maximum speed (see NOTE 1) as
shown in Figure 1,
b. 3 at maximum height, 1 of which testing the maximum operational distance at that height,
the other 2 at minimum and maximum speed (see NOTE 1) as given in 2.a.;
prEN 4709-006:2023 (E)
3. UA flying straight and level, at the minimum and maximum height (excluding climb and descent
segments). 8 automatic activations shall be triggered:
a. 4 at minimum height within minimum and maximum speed (see NOTE 1 and NOTE 2),
b. 4 at maximum height within minimum and maximum speed (see NOTE 1 and NOTE 2).
For hover-capable configurations, minimum speed is hover (zero); for the demonstration of manual
activation at minimum speed, the UA should be flown to the trigger locations at an arbitrary speed and
shall be brought to standstill before triggering the termination of flight.
The third speed may be any speed between minimum and maximum speed. If the manufacturer
recommends a certain speed for operation (such as for best endurance or best payload data quality) in
the manufacturer's instructions, then this value has to be chosen. If the manufacturer recommends
more than one speed for operation in the manufacturer's instructions (such as best endurance, best
range speed, payload data quality), then samples of these values shall be selected.
A single test is considered as passed if the means to terminate flight have successfully inhibited the
continuation of flight, or equivalent when substituted. Reference can be made to the characteristics of
the system indicating successful execution of flight termination as given in 4.1.2.1.2 and the drop tests
given in 4.2.2.
More than one test specimen of the same configuration may be used for testing. In addition to that,
damaged test specimens may be replaced by test specimen of the same configuration.
4.1.2.2 Requirement (2) – Predictability
— Review the manufacturer’s instructions to identify the possible flight termination procedures.
— Determine by test(s) as per 4.2.2.1, that the sequence of events executed by the UAS is as described
by the manufacturer.
The assessment shall be executed once per flight termination procedure.
4.1.2.3 Requirement (3) – Independence
4.1.2.3.1 Compliance checklist
Independence shall primarily be shown by checking the architectural design against the items on the
compliance checklist given below. The design shall be analysed based on the technical documentation
provided by the manufacturer. See Annexes A and B for guidance.
Where a design is too complex to show compliance to the items on the compliance checklist with
reference to an architectural representation, the checklist item can be replaced by a complementary
fault injection test as per 4.1.2.3.2.
— Verify by review of the manufacturer’s design in the technical documentation that:
1. the flight termination function on-board of the UA is segregated from the flight control function
and the geocaging function (where fitted), such that no single failure causing the need to
activate the means to terminate flight as a mitigation hampers the successful activation and
employment of the means to terminate flight (NOTE 3);
2. no failure of the flight control function and the geocaging function (where fitted) negatively
affects any inputs and outputs needed for the successfully activation and employment of the
flight termination function (NOTE 5);
prEN 4709-006:2023 (E)
3. a loss of the flight termination function does not automatically trigger flight termination as a
mitigation;
4. where applicable, the flight termination function relies on external services other than the ones
required by flight control function and the geocaging function (where fitted) (NOTE 2);
5. where the flight termination function relies on the provision of electric power, the means to
terminate flight are powered with adequate segregation from the flight control function and
the Geocaging function (where fitted) such that a single failed item does not negatively impact
the execution of the flight termination function;
6. where the flight termination function relies only on manual activation:
a. the unit(s) utilized to trigger the flight termination function on ground are segregated from
the equipment to control the unmanned aircraft remotely during UAS operation within the
operational volume, the trigger is properly marked in accordance with the manufacturer's
instruction and protected against unintended use by safeguard,
b. the radio transmitter of the flight termination command signal on ground is independent
from the radio transmitter utilized for command and control (C2) (NOTE 1),
c. the radio frequency band of the radio frequencies used for the transmission of the flight
termination command signal is separated from the radio frequency band utilized for UAS
command and control (C2) (NOTE 1), and
d. the radio receiver of the flight termination command signal installed onboard the UA is
independent from the radio receiver utilized for command and control (C2) (NOTE 1);
7. where the flight termination function is implemented as a combination of manual and
automatic activation no failure that would require flight termination as a mitigation does
inhibit proper execution of the flight termination function (outside or in common with the
means to terminate flight) (see NOTE 6);
8. where applicable, flight control function and automatic flight termination function rely on
different external systems (see NOTE 4) and external services (see NOTE 2).
NOTE 1 If the UAS is using separate redundant radio links including redundant radio-transmitters and
redundant radio receivers to transmit commands for flight control and flight termination then transmitting both
commands on both links is considered as equivalent to independent.
NOTE 2 Within this standard cellular network (mobile communication) and U-Space services are considered as
external services.
NOTE 3 The flight termination function may be triggered automatically by the geocaging function as per
EN 4709-005 , 6.6, given that – if geocaging fails to trigger – there is another activation means that is independent
from normal and contingency control. There are two viable alternative actions when geocaging fails:
a. manual activation of flight termination where there is a link; or
b. another implementation of the geocaging function automatically activating flight termination when
breaching the limits of the operational volume.
NOTE 4 There may be other methods than GNSS to fix the position such as radio navigation or optical
localization. Position fixing depends on external systems (GNSS satellites, radio beacons, optical trackers) and
prEN 4709-006:2023 (E)
internal systems (transponders, receivers). Dead reckoning and inertial navigation are not considered as position
fixing.
Where GNSS is required for activation of the flight termination function:
a. within this standard GNSS navigation is considered as an external system. Using more than one
constellation is considered adequate;
b. within this standard the GNSS receiver is considered as an internal system. See also Note 5.
Where dead reckoning or inertial navigation is used as a temporary mitigation for the failure or non-
availability of external or internal systems for position fixing, such methods are acceptable for position
determination, if the manufacturer demonstrates that:
c. over a period of time t specified in the manufacturer’s instructions the 2-s growth of uncertainty is
k
less than the contingency volume; and
d. automatic activation is deactivated after tk has timed out unless position fixing has been fully
restored by then.
Where a common sensor (e.g. a common GNSS receiver, barometer, INS) is used, the output of the
sensor shall be made available to other recipients (geocaging and/or autopilot) in such a way that
failure of other recipients does not affect the intended flight termination function.
In this case the timing performance to be taken into account (failure recognition time, reaction time)
shall be the most conservative.
4.1.2.3.2 Complementary fault injection test – Alternative
Single fault tests according to EN 62368-1:2014, Annex B.4, Simulated single fault conditions, shall be
performed for each item of the compliance checklist that is replaced by a test.
Single fault conditions to be considered are:
a. component disconnection; and
b. component erroneous behaviour leading to a short cut.
— Conduct one single fault test for each single fault condition for each physical element where the
assessment by checklist is replaced by a fault injection test.
— Verify that injected faults do not:
1. cause the UA to leave the outer limits of the ground risk buffer, and
2. inhibit the proper execution of the flight termination function if the failure would lead to
the UA leaving the operational volume and activating flight termination is needed to stay
within ground risk buffer.
NOTE If as a result of the injected fault the UA is unable to remain airborne then the test is considered as
failed.
4.1.3 Pass criteria
(1) Verify that the tests to show compliance with the reliability criteria have all passed.
prEN 4709-006:2023 (E)
(2) Verify that the sequence of events demonstrated by the test is in accordance with the
manufacturer's instructions; ensure that that the documented behaviour matches with the actual
behaviour.
(3) Verify that the design is compliant with the independence criteria.
4.2 Descent performance
4.2.1 Performance requirements
(1) The flight termination function shall effectively prevent the continuation of flight.
(2) Once activated, the execution of the flight termination sequence shall be automated and not involve
any action by the remote pilot.
(3) When activated, the flight termination function shall inhibit the generation of horizontal thrust.
(4) The distance travelled by the UA after the activation of the flight termination function shall be
compatible with the minimum ground risk buffer distance.
4.2.2 Verification methods
NOTE See Annex D for guidance.
4.2.2.1 Requirement (1) – Means
4.2.2.1.1 General
— Determine the possible modes of flight termination by review of the manufacturer’s instructions.
— Verify successful execution of the flight termination sequence by performing any one of the
methods described in 4.2.2.1.1 to 4.2.2.1.3 below for each possible mode of flight termination.
NOTE If a mode of flight termination is subject to certain failure conditions, such as degradation or loss of
GNSS, that cannot be easily replicated, then the provisions given in EN 4709-001 , 6.3.2.2 apply.
This test is derived from EN 4709-001 , 4.5.2.3 and 5.1.1.2.1.1 and complements EN 62368-1:2014.
Reference may be taken there.
Drop tests may be combined with flight tests as per 4.1.2.1.3.
The test shall be performed according to EN 62368-1:2014, 4.8.4.4, M.4.4, along with T.7, with the drop
height given below. The test may be combined with other drop tests.
The basic setup is illustrated in Figure 2.
In the following the terms 'maximum speed' and 'minimum speed' refer to the maximum and minimum
speed as defined in the manufacturer's instructions, and in the same way 'minimum height' and
'maximum height' to minimum and maximum height above ground as defined in the manufacturer's
instructions.
If the UA is a hover capable configuration, the UA may be suspended from a line in order to avoid
unnecessary damage to the test specimen.
The drop height shall be sufficient to ensure that the UA with the means to reduce the effects of impact
dynamics employed reaches a stabilized vertical speed. The drop height H is 120 m AGL unless the
drop
prEN 4709-006:2023 (E)
UAS is limited to lower values. When the UA reaches its stabilized vertical speed from a lesser height
than H then the lesser height is sufficient.
drop
The test shall be conducted with MTOM.
The drop condition shall be representative for all possible operational parameters, flight modes and
flight manoeuvres that may occur during use including maximum and minimum speed as well as
maximum and minimum height. If more than one drop condition is possible, then the most critical shall
be selected. If the results cannot be combined in a single test case, then individual tests for each test
case shall be conducted.
The UA may be pulled out of the descent to avoid ground impact, if the vertical speed has stabilized by
then.
The test specimen does not need to be newly manufactured and may be repaired pro
...