AEP-4671 unmanned aircraft systems airworthiness requirements

What it is

AEP-4671 is the NATO Allied Engineering Publication that sets out the Unmanned Aircraft Systems Airworthiness Requirements, referred to throughout the document as USAR. It is Edition B Version 1, promulgated April 2019, and it is the publication STANAG 4671 exists to put into force: the STANAG is nations' ratification agreement, and USAR is where the actual technical requirements live. USAR is "intended primarily for the airworthiness certification of fixed-wing military Unmanned Aircraft Systems (UAS) with a maximum take-off weight (MTOW) between 150 and 20,000 kg" (clause 1.1), though a Certifying Authority may apply it outside that band "where considered applicable."

Built from civil airworthiness codes, tailored for UAS

USAR does not start from a blank page. Its own introduction states "it is the intention of this document to correspond as closely as practicable to a comparable minimum level of airworthiness for fixed-wing aircraft as embodied in documents such as EASA CS-23" (clause 1.2.1), and most of its requirements are based on CS-23, tailored to unmanned systems, with USAR's own paragraph numbering following CS-23's structure. An Applicant may instead propose tailoring from CS-VLA or the larger-aircraft CS-25, subject to the Certifying Authority's acceptance. USAR is also explicit about the boundary this creates: "military aircraft are not specifically required to comply with civil airworthiness regulations as agreed in the ICAO Convention on International Civil Aviation" (clause 1.2.1) - USAR borrows the civil codes' structure and rigour without importing civil aviation law's authority over military aircraft.

The type certification process

USAR addresses two parties directly: the Applicant, who designs the UAS and assembles the compliance evidence, and the Certifying Authority, a National Military Certifying Authority that reviews that evidence and issues the Type Certificate. USAR defines the term broadly: "throughout this document, the term 'Type Certificate' refers to any document issued by a National Military Certifying Authority that within the regulatory framework of that Nation certifies compliance" (clause 1.1) - in practice this covers a Release To Service, a Military Aircraft Type Qualification Certificate, or a Flight Permit, whatever a nation's own military airworthiness process calls it.

Before the detailed requirements can be applied, the Applicant and the Certifying Authority agree a Type Certification Basis, and establish a Design Usage Spectrum and any Special Conditions at the beginning of the certification process. The certificate is granted to the design, not to the company that produced it: engines and propellers each need their own Type Certificate or an accepted qualification, separate from the overall UAS certificate, and a modification or a new intended mission can require the UAS to be re-certified for it.

How the requirements are organised

Book 1 carries the requirements themselves, arranged in subparts that follow the CS-23 pattern: General (Subpart A); UA Flight, covering proof of compliance, weight and load-distribution limits, performance and flight characteristics (Subpart B); UA Structure, covering general and flight loads, ground loads, and fatigue evaluation (Subpart C); UA Design and Construction, covering materials, control systems, landing gear, fire protection and parachute design (Subpart D); UA Powerplant, covering engine, propeller and fuel, oil and cooling systems (Subpart E); Equipment, covering navigation architecture, environmental control, HIRF protection and the system safety assessment (Subpart F); Operating Limitations and Information, including the UAS Flight Manual (Subpart G); the Command and Control Data Link, covering architecture, latency and link-loss strategy (Subpart H); and the UA Control Station, covering the crew workplace, minimum crew and recorders (Subpart I). A set of appendices supports specific requirements: landing-condition load cases, a self-extinguishing-materials test procedure, the format for Instructions for Continued Airworthiness, and HIRF test environments among them.

Every USAR paragraph in Book 1 has a matching Book 2 paragraph, the Acceptable Means of Compliance, spelling out one accepted route to satisfying it - a reference document, a test method, an analysis approach - without being the only route the Certifying Authority may accept.

How compliance is demonstrated

USAR lets an Applicant show compliance by analysis, test, simulation, inspection or similarity to an already-certificated design, largely as the Applicant proposes and the Certifying Authority agrees. The central compliance mechanism for equipment, systems and installations is the system safety assessment required by USAR.1309: "the UAS must be designed to reduce the risk to people including UAS crew, ground staff and third parties to a level acceptable to the Certifying Authority" (USAR.1309(a)), through a functional hazard assessment that classifies failure conditions by severity, from No Safety Effect through Catastrophic. Book 2 names SAE ARP 4761, or alternatively MIL-STD-882, as the accepted methodologies, and compliance with the resulting requirements "may be shown by analysis and, where necessary, by appropriate ground, flight, or simulator test" (USAR.1309(c)(4)). Software normally has its safety aspects demonstrated against DO-178C/ED-12C, and complex hardware against DO-254/ED-80, each with an alternative route open where the Certifying Authority agrees one.

One requirement worth naming because it runs against an assumption a reader might bring to unmanned systems: USAR requires the UAS to integrate an emergency recovery capability, and explicitly rules out explosive in-flight destruction of the aircraft as an acceptable way of providing it.

What USAR does not cover

USAR's introduction states plainly that cybersecurity and sense-and-avoid sit outside its scope, alongside other areas it deliberately excludes - worth knowing, since both are commonly assumed to sit inside "UAS airworthiness." A compliance programme built around USAR needs a separate basis for those.

Where it sits alongside other standards

USAR cites STANAG 4671 with mandatory force for structural strength: "the UA must meet the strength requirements of STANAG 4671" (AMC.U304 2(b)(2)) - the same STANAG whose ratification is what makes USAR a national certification basis in the first place. Elsewhere it points to NATO material as background rather than a requirement: AEP-29, printed in the document as "AEP-29 (NATO STANAG 3856)," for guidance on precipitation-static effects; STANAG 3634 for runway friction and braking conditions; and STANAG 4586 for the design of the UAS communications system. Outside the NATO catalogue, Book 2 cites civil aviation material, including EASA CS documents, FAA Advisory Circulars, and standards such as DO-160, DO-178C and the SAE ARP series, consistently as material an Applicant "may" cite or base evidence on, not as binding requirements in their own right.

Standards it references

• STANAG 4370Background
• AECTP-250Background
• STANAG 4670Background
• AEP-29Background
• STANAG 3856Background
• STANAG 3634Background
• STANAG 4586Background