AEP-80 rotary wing UAV airworthiness requirements

What it is

AEP-80 is the NATO Allied Engineering Publication that sets the technical airworthiness requirements for rotary-wing military unmanned aircraft systems, a code that calls itself USAR-RW: UAV Systems Airworthiness Requirements, Rotary Wing. It covers rotorcraft with a maximum take-off weight between 150 kg and 3,175 kg intended to operate in non-segregated airspace, and it is not a stand-alone invention: it is built by tailoring EASA CS-27 amendment 2, the civil certification specification for small rotorcraft, and supplementing it with elements of STANAG 4671 Edition 2, the airworthiness code for fixed-wing military UAV Systems. Edition B Version 1, dated November 2016, was "approved by the nations in the NNAG" (the NATO Naval Armaments Group) and supersedes Edition A.

Who has to care, and how the code gets its force

AEP-80 does not bind a manufacturer directly, and it does not bind by simply existing. The document says it "is intended for application by Certifying Authorities within each country's relevant national regulatory framework" - meaning a national government body, not NATO and not any accredited third party, decides whether and how to use it. That national choice traces back to a NATO Standardization Agreement: "the recommendation of nations to use this publication is recorded in STANAG 4702," and a STANAG is ratified by each nation individually, sometimes with reservations recorded against it. AEP-80 reaches a manufacturer only at one remove further still, once a specific national type-certification programme for a rotary-wing military UAS adopts USAR-RW as part of its own Type Certification Basis, a document the code defines as "elaborated by the Applicant with the Certifying Authority" based on the airworthiness code.

Two subparts a civil code does not need

Subparts A to G of the Airworthiness Code (Book 1) are carried across from EASA CS-27 amendment 2 almost paragraph for paragraph, covering the same ground a civil rotorcraft code covers: flight performance, structure, design and construction, powerplant, equipment, and operating limitations. Subparts H and I have no civil equivalent, because a UAV has no pilot on board. Subpart H, the command and control data link and communication system, requires an architecture with "no single failure that could lead to a Hazardous or more serious event," continuous monitoring of uplink and downlink integrity, a link-loss strategy that "shall include an autonomous reacquisition process," and a safe "switchover" procedure whenever control passes between data-link channels or control stations. Subpart I, the UAV control station, sets requirements for the ground station itself: crew workload, mandatory voice and data recorders, which flight and system data must be shown full-time versus on request, "safety critical controls" that need dedicated and hard-to-confuse actuation, and handover procedures between two control stations that "must not lead to unsafe conditions." The document is explicit that these two Subparts are "unique to STANAG 4671 and USAR-RW."

The safety-assessment backbone

USAR-RW.1309, in Book 1's Equipment Subpart, sets the principle that runs through the whole code: "the occurrence of any Catastrophic failure condition of the rotorcraft UAV must be extremely improbable" and "the occurrence of any Hazardous failure condition of the rotorcraft UAV must be extremely remote." Book 2's Acceptable Means of Compliance (AMC) turns that into a working risk matrix: a Catastrophic failure condition is "Unacceptable" at every probability band except Extremely Improbable (10⁻⁶ per flight hour or rarer), loosening one band at a time for Hazardous, Major and Minor conditions, and a matching Design Assurance Level table runs from DAL B for software whose failure would be Catastrophic down to DAL E for software with no safety effect. The same framework covers structural fatigue (a documented fail-safe, replacement-time or fatigue-tolerance evaluation for any part "the failure of which could be catastrophic"), HIRF protection, icing qualification and fire protection, each with its own appendix or AMC test method.

Type certification, not product certification

Where the code discusses evaluation, it names a specific national mechanism, not a certification mark AEP-80 itself awards. A "Type Certificate" is "any document issued by a National Certifying Authority that, within the regulatory framework of that Nation, certifies compliance as determined by the National Certifying Authority with USAR-RW," and the Certifying Authority may instead issue "an alternative document to a Type Certificate (such as a Release To Service, Military Aircraft Type Qualification Certificate or Flight Permit, which may include items outside the scope of USAR-RW)." Nothing in AEP-80 describes a NATO-level scheme, an accredited body, or a self-declaration route: the assessment is a national government function, exercised entirely within that nation's own airworthiness framework, against the Type Certification Basis agreed for that specific aircraft type. Even that agreement is not permanent - "Modification and/or addition of missions may require the rotorcraft UAV to be re-certified for these missions."

What AEP-80 does not cover

The scope clause rules out a long list of areas by name: control-station security, protecting the data link "from willful interference," airspace integration and sense-and-avoid, crew competence, training and licensing, approval of operating, maintenance and design organisations, frequency spectrum allocation, noise and environmental certification, and the carriage or release of weapons. All of these are left to "other forms of approval by Certifying Authority" outside USAR-RW altogether.

Standards it references

• STANAG 4671Background
• STANAG 3856Background
• IEC 61508Background
• STANAG 4586Background