Doc. No.

: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

SUBJECT : C3 characteristics are appropriate for the operation

REQUIREMENTS incl. Amdt. : Annex E to AMC to Article 11 of Regulation 2019/947

ASSOCIATED IM/MoC : Yes☐ / No ☒

ADVISORY MATERIAL : N/A

List of acronyms
MoC means of compliance
OA Operational Authorization
SAIL specific assurance and integrity level
HW/SW hardware / software
CMU control and monitoring unit
LTE Long Term Evolution
SATCOM satellite communication

Table of contents
1. The C3 link function .......................................................................................................... 2
2. General Means of Compliance for C2 Link .................................................................... 2
2.1 Describe the C2 system........................................................................................................ 3
2.2 Determine that the C2 performance is adequate to safely carry out the intended
operation. ........................................................................................................................................... 3
2.3 Provide evidence that the remote pilot has means to continuously monitor the C2
performance and ensure that minimum performances continue to be achieved .................... 9
2.4 Pre-Flight Checks ............................................................................................................ 10
2.5 Case of significant obstructions of the Fresnel radius .............................................. 10
2.6 Utilization of external services ...................................................................................... 10
2.7 Communications ............................................................................................................. 11
3. Example of application...................................................................................................... 11

1
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

1. The C3 link function

The C3 system provides the UAS command, control & communications functions.

This MoC covers in particular C2 command & control. Only general guidance for communication
functions is provided, for the case in which such communication has to support information
exchange between the UAS and ATC (ref. chapter 5). This MoC does not cover spectrum usage
and, where applicable, spectrum authorization where non-aeronautical-protected frequencies
are utilized. These should be dealt with the NAA in the frame of the operational authorization.

C2 includes the HW and SW elements utilized to establish the connection and the exchange of
data between the control and monitoring unit (CMU) and the UA and perform specific functions
to support data transmission (uplink) and reception (downlink)1.

The UAS is defined as the UA and the CMU utilized to control it, thus any installed C2 Link
element, antennas included2, is either part of the CMU configuration or part of the UA
configuration.

The C2 Link function can be limited to radio line of sight (RLOS) or be established beyond radio
line of sight (BRLOS). Mobile networks or satellite communications services may be used to
provide C2 Link functions. Such technologies can be used to provide redundant link channels or
to establish the link under BRLOS conditions. At SORA level such external services are
addressed by dedicated OSOs not listed among those linked to the UAS design. While the
hardware and software integrated in the UAS and necessary to support these services are part
of the UAS configuration, under responsibility of the UAS designer and covered by this MoC, the
infrastructure provided as external service and the performance level offered by this
infrastructure is not.
System elements like repeaters, provided by the UAS manufacturer as part of the UAS
architecture, can be used to extend the C2 function beyond RLOS. Such elements should be
considered part of the UAS configuration and subject to the provisions of this MoC.

2. General Means of Compliance for C2 Link

C2 link compliance should be based on supporting evidence for two fundamental claims:

1 For example The OSI layer model indicates the full set of layers and associated functions, such as synchronization, rate control,
transmission mode, framing, addressing, error control, flow control, …; a C2 link system performs a specific subset of these
functions.
2 Even when those antennas, or other elements pertaining to the C2 Link, are installed or erected away from the CMU but
connected thereto and not provided as external services but as part of the UAS configuration.

2
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

(a) The C2 link performance are adequate to safely conduct the intended operation considering
the applicable environmental conditions
(b) The remote pilot has the means to continuously monitor the C2 performance and ensure that
it meets the operational requirements
Applicants need to declare that they achieve both claims and base the declarations on
evidence, which is documentation of appropriate testing, analysis, simulation, inspection, design
review or operational experience. Delivery of such evidence to the authority may not be required
in the frame of a declaration of compliance to OSO#6, however, declaring compliance,
applicants are responsible to determine, collect, record such evidence and make it available in
case the authority should so require.

Guidance on how to comply can be found in the sections below.

2.1 Describe the C2 system3.

2.1.1 Describe the functions of the C2 system and its high-level system architecture. Include
drawings, images, graphs; distinguish between on-board and ground segment of the C2
link. (e.g.: ground antenna and its connections with the CMU).
2.1.2 Describe the system architecture, physical components, interfaces, exchanged data; how
C2 is operated, which external systems if any could be interfaced with the C2 and which
is exactly the boundary of the C2 subject to approval under OSO#6
2.1.3 Describe the installation of the C2 on-board the UA and with the CMU
2.1.4 If applicable document the required operational procedures for the utilization and
maintenance of the C2 system.
2.1.5 If applicable supplement the recommended training instructions including a training
syllabus supplement for the operation of the C2 link. The operator should be able to
provide competency-based, theoretical and practical training based on the supplement.

2.2 Determine that the C2 performance is adequate to safely carry out the intended
operation.

2.2.1 Determine which are the minimum C2 link required performances for safe operation.

2.2.1.1 Coverage

3 Extend to communication systems if included.

3
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

The C2 Link system should ensure coverage in the full operating range under the expected
operating conditions. Applicants should know, or determine, which is the maximum range at
which, during the operation, they should be able to control the UA4. Should multiple repeaters
be utilized, the applicant is expected to at least check that multiple relaying among those
repeaters operates properly and that the added latency is still such to allow proper UAS
operation.

Should an FTS be utilized, its range of actuation should be shown to be compatible with the C2
Link range coverage, unless where limitations will be specified.

2.2.1.2 Latency

An aspect to be considered is the contribution of the C2 Link to the overall latency of the
command-and-control loop. Applicants should determine the maximum overall latency of this
loop commensurate with the need to control the UA, including meeting the SORA TMPR
requirements for the command loop5.

2.2.1.3 Integrity

The rate of undetected errors during data transfer should be sufficiently low not to jeopardize
the safety of the operation. Unless demonstrated otherwise, such rate should not exceed 0.001
%6

2.2.1.4 Functional performance

The systems and equipment (HW and SW) providing the C2 Link function should comply with
OSO#5and OSO#24 as applicable7 (refer to MoCs of such OSOs to establish compliance. This
MoC will not further address this aspect).

2.2.1.5 C2 Link protection

4 Such range can anyway be derived from the information utilized to perform the SORA steps.
 As per SORA TMPR table, the latency of the command loop should not exceed 5 seconds for 99% of the time, for a SAIL III
operation.
6 This objective is derived from ASTM F3002-14a Standard specification for design of the command-and-control system for

small unmanned aircraft systems, having considered integrity as per JARUS publication “RPAS Required C2 Performance (RLP
concept)”.
7 Under SC Light UAS, Subpart H, dedicated to C2 Link, refers in fact to Subpart F, which captures OSO5, OSO10/12 and OSO24,

4
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

The C2 Link should be adequately protected against unauthorized interference and access to the
C2 Link functions.

Note that the MoC does not address a minimum required C2 Link continuity or availability; instead with
a pragmatic approach considered adequate for SAIL III, it focuses on checking (as in the following, first
by analysis and then by test) that the C2 link covers the required range in the specified conditions. This
check, coupled with the necessary compliance of C2 Link equipment in the frame of OSO#5 (safety
assessment) and OSO#24 (design adequate to limit the effect of the expected environmental conditions)
is assumed to provide sufficient confidence, for SAIL III, of acceptable continuity and availability.

2.2.2 Demonstrate that these minimum C2 link performances are achieved.

2.2.2.1 Coverage

The transmission equation links the power available at the receiving antenna output terminals to
the power fed to the transmitting antenna input terminals, the frequency, the distance between
the antennas, and the respective antenna gains:

Under optimal operating conditions, an unobstructed RLOS can simplify coverage verification.
The height of the transmitting and receiving antennas may be used to estimate the maximum
achievable distance8 based on free space path loss assumptions. Obstructions in the Fresnel
radius, if any, should be sufficiently limited to not cause a significant decrease of C2 Link
performances. Potential antenna obscuration should be considered as it relates to aircraft
attitude and direction changes that could alter the geometry with respect to the ground antenna.
Antenna shadowing may be avoided with appropriate antenna installation and/or by installing
multiple antennas.

8 Due to the curvature of the hearth and / or the presence of landscape obstacles (hills, …)

5
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

Fig.1: Example of partial obstruction of the Fresnel radius

By means of the equation above, transmitted power, frequency used, antenna gain and
operational range will determine the power received at the output of the receiving antenna
based on link budget calculation.

To have a working C2 link between air and ground, the receivers shall have a sensitivity
adequate to detect the received power and to support the required bandwidth with a margin
which compensates losses due to lines, adaptation mismatches, antenna de-pointing, filtering,
depolarization, terrain masking effects, etc,.

Receivers need, therefore, to feature a sensitivity such to detect a power expected to be lower /
significantly lower than the calculated received power, because of losses factors above

6
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

described. To establish the adequate margin, it should be considered that the accessible
bandwidth is directly linked to transmission quality. Insufficient margin leads to risk of package
loss and such risk increases with the bandwidth, leading to bandwidth degradation and,
eventually, loss of connection. This should be considered in establishing the needed margin9.

Applicants should evaluate their link budget to ensure that their C2 link system considers the
aforementioned factors. This can be achieved, for example, by utilizing the transmission
equation above illustrated. This should be done before conducting the tests described in chapter
2.2.2.6 to ensure that the minimum coverage is attained.
The estimation serves as a basis to be supported by practical tests (see chapter 2.2.3). If
required, adjust the parameters of the link budget calculation using actual measured values and
maintain an appropriate margin from the maximum determined range.

2.2.2.2 Latency

The elements of the command-and-control system contribute to the overall latency. The latency
must be evaluated taking the entire command and control loop into account. If the evaluation
results in a positive outcome, the latency contribution of the C2 connection will be deemed
acceptable within the overall balance.

The latency introduced by the various elements of the chain should be pre-determined by
design, available technical information of COTS elements, or estimated by comparison with
similar components, with dedicated lab tests on the single component, or with conservative
assumptions. An estimation of the overall latency could be obtained by summing up all the
latency contributions.

As substantiation, overall command and control loop latency acceptability will be validated by
tests (see chapter 2.2.2.6)

2.2.2.3 Integrity

The system should utilize CRC and similar methods to ensure robustness against data
corruption10.

Furthermore integrity should be validated by test (see chapter 2.2.2.6).

9 for example refer to data sheet for transceivers and cables and to the transmission equation for the free space loss.

10 Depending on the CRC and its complexity it is possible to establish its robustness in terms of probability of error detection.

7
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

2.2.2.4 Functional performance

N/A (as explained it is covered by other OSOs)

2.2.2.5 C2 Link protection

This requirement can be complied applying chapter 6.7.2 ‘C2 Link protection’ of ASD-STAN
PrEN 4709-000111 or EUROCAE Guidance Document for SC Light UAS Volume 1 (ED-325 Vol.
1), subpart H, chapters 9.4 and 9.512

2.2.2.6 Tests to check C2 link performances

This chapter provides final substantiation by test that minimum performances are achieved.

The test set-up should include all relevant elements of the C2 Link. The distance between the
antennas does not need to be the operating one, when propagation losses can be simulated in
the test set-up. The test should require transmitting and receiving an amount of data typically
exchanged during the duration of a typical operation or 30 minutes, reaching the maximum data
rate and bandwidth in uplink and downlink for a substantial percentage of the time. To
demonstrate integrity the transmission should include a substantial number13 of on-purpose
corrupted command messages in uplink, including errors of various nature, and demonstrate
that corrupted messages never result in undetected error at the receiver and that the UA never
react erroneously the protocol utilized).

The tests should demonstrate with appropriate data recording and comparison that the
minimum required performance as identified in the relevant chapters is met. To this aim:
- the tests should be carried out utilizing the whole chain of command-and-control
elements of the UAS (to take into account the whole control loop) in uplink and downlink.
- different antenna aspect angles should be tested, thus replicating different aircraft
attitudes and possible antenna masking effects.
- propagation losses should be included in the test set-up (simulated / injected with
appropriate elements)
The tests should provide sufficient confidence of appropriate functioning of the C2 Link in the
identified environmental conditions for the operation. The applicant is responsible for identifying

11 These prescriptions for the open category UAS are considered proportional for SAIL III and have already undergone public
consultation in the frame of the process establishing harmonized European standards.
12 Currently under consultation, comments can be provide to EUROCAE until end of January 2024.
13 Statistically, applying the rule of three and considering the safety objective of 0.001% which means probability of 10 -5 per

corrupted message, the transmission of 300.000 corrupted messages would be necessary to obtain a 95% statistical confidence
in the objective. This prescription does not need to be applied strictly, unless the applicant is not able to estimate such
robustness analytically based on chapter 2.2.2.3

8
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

the appropriate test set-up, location, kind of tests (in flight, ground, lab tests) to establish such
confidence. This may include, but not be limited to, precipitations and HIRF possibly affecting
the operational volume14. The applicant may establish the best mix of flight/ground/lab tests and
distribute the transmission of the required dataset among test set-ups as appropriate.

During the tests no degraded performances should be experienced and no errors injected on-
purpose in the data stream should be undetected.

Verification methods from ASD-STAN PrEN 4709-001 Para 6.7.2 on C2 link protection of from
EUROCAE ED-325 Vol. 1 chapter 9.4 and 9.5 should be further applied (with dedicated tests or
integrated as part of other tests) and positively passed. The effectiveness of the alert system
needs to be also compliant with prescriptions of the SAIL III MOC to OSO 19 and 20.

2.2.3 Determine and record the operational and environmental limitations

Applicants should determine the operational and environmental limitations associated with the
safe operation of the C2 link, as resulting from the analysis and tests prescribed by this MoC,
should record them appropriately and add such information in the flight manual supplement.

2.3 Provide evidence that the remote pilot has means to continuously monitor the C2
performance and ensure that minimum performances continue to be achieved

List the probable malfunctions that may cause loss or degraded performances of the C2 Link and
show that any such degradation or loss is conveyed with clarity to the remote pilot with aural and
visual alerts. The degradation of performance should be conveyed to the remote pilot at least in
terms of signal strength. When a certain level of degraded conditions of the C2 Link, to be defined
by the applicant, is reached, the C2 Link should be declared lost. The operator should have
procedures in place to manage the loss of C2 Link so that impact on safety of the operation is
minimized.
Applicants may substantiate compliance with these requirements applying point 6.7.1 “loss of
C2 link” of ASD-STAN PrEN 4709-0001.
All test evidence should be recorded in a dedicated report with the final objective of showing that
the remote pilot is provided with adequate information on the loss or degraded performances and
that in presence of such loss or degradation the safety of the operation is preserved.

14 Ideally the applicant should ensure that the operation is carried out sufficiently far away from power lines, phone towers and
large antennas. When this is not possible (e.g., powerline inspection) it should be excluded by tests that the C2 Link is
significantly disturbed by such emitters, or that the aircraft has means to safely overcome the interference.

9
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

Additional Guidance on tests

Failures or improper system behaviour during tests should be analysed and the root cause
identified. Failed tests shall not be repeated without having performed an appropriate analysis of
the causes and, where necessary, before appropriate design changes have been made.
In case of malfunction during testing, the applicant should continue correcting identified root
causes and testing until all the issues have been solved and all tests are passed in the final
configuration. Record the root cause analysis in appropriate report and a description of the
design changes performed to correct the issue.
Depending on the technology and architecture there may be systems where more tests might be
appropriate. The evidence to be assembled should include at least one complete successful set
of tests.
Operational experience may be used in support of testing and/or to reduce the number of tests.
For example, if the C2 functioned as expected during several operations, with the same
configuration, operational scenario (e.g., obstructions of Fresnel radius) and environmental
conditions as the ones for which the declaration of compliance is meant to be done, and a
technical report or analysis of the occurrences exists, such technical report may be used to
reduce the number of tests under applicants’ responsibility.

2.4 Pre-Flight Checks

Pre-flight check dedicated to C2 link should be carried out before each operation. The system
might be affected by degraded performance because of issues related with connectors or
antennas (improper contacts, misalignments, etc..) that can be hardly identified visually. A
simple transmission test could show if nominal performances are achieved and, if not, the
operation should not begin and the system checked. To efficiently perform such tests, the
transmitted power could be appropriately decreased to simulate the real operational conditions.

2.5 Case of significant obstructions of the Fresnel radius

All the above criteria apply, furthermore:

• As far as possible the potential additional losses should be assessed by analysis.
• Dedicated tests, whose nature is to be established by the applicant, should replicate or
simulate the expected obstruction and show that the C2 Link still performs appropriately.

2.6 Utilization of external services

This would be the case, for example, of an UA controlled by means of mobile network, or
satellite communication system. Such services are part of other operational safety objectives.

10
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

Still the HW and SW integrated in the CMU and in the UA which interface the external service,
and integrate the service in the control loop, should be validated15.

For latency compliance applicants should refer to the latency of the overall chain and consider,
for design assessment, the contribution of the service16. Applicants should then perform the
same tests defined in chapter 2.2.2, this time with the service in the loop, and check that the
minimum required performance is achieved.

It is important to consider that the above guidance does not intend to suggest how to provide
evidence of compliance for the external service, which is final responsibility of the operator by
means of establishment of appropriate service level agreement with the service provider. This
guidance is meant only to assess that, once the service is included in the chain, the C2 link
subsystem which is part of the UAS design is adequate to support / interface the external
service and performs appropriately. Compliance of the external service is established by a
different OSO (OSO#13).

2.7 Communications

Where communication with ATC or air traffic participants is performed by the remote crew
utilizing aviation radio frequencies, the use of ETSO’ed systems is considered acceptable E.g.,
ETSO-2C169a for VHF radio communications in terms of Latency, Integrity, and Protection.
However, the applicant must present a reasonable coverage/ range.

Communication with ATC, if performed through VHF radio, needs to take into account total
latency time. If such latency exceeds practical limits which prevent an effective communication
with ATC, limitations in range or other means need to be put in place to ensure effective
operation safety as appropriate.

Proper integration at CMU and/or UA level will be verified as part of this MoC. In relation to U-
space environment the communication performance to be achieved are the ones that are going
to be established as output of ARA for the individual U-space implementation. Availability,
integrity, and latency of that communication will be defined in this context. ATC, U-Space
services, and others are not considered.

3. Example of application

15 For example, control by mobile network would still imply the integration in the UA and in the CMU of components and
circuitry to connect with the mobile communication service, in the same way as smartphones include such components and
circuitry. These components should be considered part of the UAS configuration to be validated.
16 For this MoC, it could be assumed, estimated or pre-agreed with the service provider. In any case, it will be under

responsibility of the operator to ensure it with appropriate service level agreement.

11
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

A SAIL III example could be an operation for industrial surveillance of linear infrastructures,
such as gas network. Typical flights consist in flying along the linear infrastructure to acquire
high-definition video data for later analysis. This analysis could be developed as in the following.

Relevant Operational conditions:

- RLOS with operational range of maximum 60 km, operation with unobstructed view in
the Fresnel radius
- Very low level (<120m) in uncontrolled airspace => Arc-b
- Maximum Cruise speed during operation: 100 km/h
- No or very light precipitation
- No HIRF emission in the vicinity of the operation such to affect the C2 Link performance

UAS main features:

- The system is designed to fly in automatic mode in normal, contingency and emergency
conditions, from take-off to landing phase
- Normal flight plan and contingency/emergency trajectories are uploaded in the system
before flight
- The UA is fitted with a cooperative DAA system and is designed to initiate evasive
manoeuvres in automatic mode.

C2 Link:
- The Radio System is composed of
o Transmitter/receiver and other equipment installed on the UA and the CMU
o Antennas installed onboard the UA and at the CMU

Payload operation:
- High-definition video data livestreamed to the CMU during flight

Remote pilot duties:

- The remote pilot is supervising the flight and can remotely activate specific flight modes
and/or upload a new flight plan using the CMU
- in case of C2 Link loss the mission is automatically interrupted through the activation of
a “return to home” mode.17

Applying the transmission equation with:

• Emitted power 20 dB
• Tx gain: 18 dB
• Rx gain: 10 dB
• Distance 60 Km

17return home with no pilot monitoring needs to be shared before the mission(s) with all other actors involved and properly
planned in order to preserve safety of the operation.

12
 Doc. No.: MOC to OSO#6-01
SAIL III Means of Compliance with OSO#6 Issue : 1
Date : 18 December 2023
“C2 Link”
Proposed ☒ Final ☐

• Frequency: 2400 MHz

It can be seen that the receiver would be expected to manage a received power of about -88
dB. However, this assumes no losses due to cables, connectors, polarization misalignments,
terrain effects and partial obstructions. The same equation can be utilized to consider losses,
inject them, recalculating the received power and checking that such received power can be
managed by the receivers. This would provide an analytical confirmation that the system is
properly designed. Carrying out the tests as defined in chapter 2.2.3 would finally provide
confirmation that the minimum required performances are achieved.

The applicant might determine that the operation requires a C2 transaction time of less than 0.5
seconds to preserve adequate handling qualities. This would overcome by far the SORA TMPR
requirement. As “the UA is fitted with a cooperative DAA system and is designed to initiate
evasive manoeuvres in automatic mode”, the control loop applicable for TMPR does not involve
in principle a loop through the CMU and is therefore independent from the C2 Link latency. The
5 second latency need to be met by the automatic reaction itself of the UA to the unexpected
event. This latency would need to be checked, but not in the scope of a C2 link MoC18.

18As far as product design is concerned, performance of the tactical mitigation means itself is not assessed by design MoCs as it
strongly depends on the characteristics of the specific airspace. If, for example, the cooperative DAA would be based on the
integration of an ADS-B on the UAS, MoCs on SAIL III design should be limited to check that the 5 seconds latency of reaction is
not overcome and that aircraft performances are also as prescribed by the SORA TMPR tables.

13