Step 7 of the SORA methodology: Final specific assurance and integrity level (SAIL) and operational safety objectives (OSO) assignment

Each step of the SORA process builds on the safety of the operation an organisation wishes to perform. For the seventh step of the SORA process, an organisation will determine their safety assurance and integrity level (SAIL) and give them a set of operational safety objectives (OSOs), which they need to comply with. Each operational safety objective will be assigned a robustness level that corresponds to the complexity and risk of the operation an organisation seeks to perform. 

In this article, we’ll cover each aspect of step 7 in the SORA process, what safety assurance and integrity levels mean in Annexe E of the JARUS SORA methodology and go through each OSO* by explaining how to read them and what this might mean in practice when it comes to creating your SORA documentation.

*In case you were wondering, the abbreviation OSO is pronounced “oh-so”

Finding the safety assurance and integrity level (SAIL) of your operation

In SORA steps 4, 5 and 6, we defined our air risk class, and in SORA steps 2 and 3, we defined our ground risk class. In step 7 of the SORA methodology, we now have to go to the table in the JARUS SORA documentation to cross the two to find out the safety assurance and integrity level (SAIL) of our operation:

An example would be if an organisation has an airborne operation with a residual ARC of b and a final GRC of 3, they would cross these two findings to determine that they have a SAIL II operation.

For each SAIL, an organisation will need to find their list of operational safety objectives (OSOs) in table 6. 

Please note that this is a reproduction of the original JARUS SORA material, which can be found on their website. 

What do the integrity and assurance levels stand for?

Not only are each set of OSOs grouped into their relevant categories like technical issues, human error and operational procedures, among others, but they always have compliance requirements for integrity and assurance levels that list how an organisation can achieve these operational safety objectives. Each level of robustness required (low, medium or high) have corresponding requirements in the tables found in Annexe E.

I chose an easy definition to help clients understand how the integrity and assurance levels can be understood: “integrity represents the safety gain provided by each mitigation. And, assurance is proof that the claimed safety gain has been achieved.” 

While this doesn’t make this an official definition, it can help people understand how the two terms are related in a short and understandable way.

For example, in Annexe E, under level of Integrity, there is a clear description of the requirements for the required low, medium and high levels of robustness required for an operation, which tells you what operational procedures are appropriate for the proposed operation. Assurance, which is always after the level of integrity, will also have the same corresponding low, medium and high levels of robustness that match the required integrity level. 

As you might have noticed, each SAIL has the entire set of 24 OSOs, but the requirements for each range from optional to high. So, the higher risk an operation has, the higher the integrity and assurance levels an organisation needs to achieve. 

It’s important to note that although some OSOs are listed as optional, they are not to be disregarded. When an aviation authority is looking through the SORA documentation given to them by an organisation, if that organisation still complies with low levels of robustness for  integrity and assurance, it means the organisation values safe operations, which can lead to a better relationship with the relevant aviation authority in the future. 

The general idea is that a low-level OSO only requires an organisation to declare they have met these requirements (although an aviation authority can check if there is any doubt), a medium-level OSO will require an organisation to list the standard they’re following and a high-level OSO will require third party validation or proof.

SAIL I OSOs: Mostly optional and low-level robustness requirements

Optional level of robustness for the safety assurance and integrity level for SAIL I operational safety objectives: 1, 2, 4, 5, 6, 18, 19, 20 and 24.

Although these OSOs are optional, it’s recommended that every operation, regardless of the risk, still complies with the low-level robustness requirements associated with the points listed above, even if it’s not required to be included in the SORA documentation.

Low level of robustness for the safety assurance and integrity level for SAIL I operational safety objectives: 3, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 21, 22 and 23.

What is required to meet low-level robustness requirements for the safety assurance and integrity level will be summarised in the following section for each OSO.

SAIL II OSOs: Some optional and medium-level requirements with mostly low-level robustness requirements

Optional level of robustness for the safety assurance and integrity level for SAIL II operational safety objectives: 4, 5, 18, 19 and 24.

Although these OSOs are optional, it’s recommended that every operation, regardless of the risk, still complies with the low-level robustness requirements associated with the points listed above, even if it’s not required to be included in the SORA documentation.

Low level of robustness for the safety assurance and integrity level for SAIL II operational safety objectives: 1, 3, 6, 7, 9, 10, 12, 13, 15, 16, 17 and 24.

Medium level of robustness for the safety assurance and integrity level for SAIL II operational safety objectives: 8, 11 and 14.  

High level of robustness for the safety assurance and integrity level for SAIL III operational safety objectives: 8, 11, 14 and 21.  

The following section for each OSO will address what is required to meet each level of robustness for the safety assurance and integrity level.

SAIL III OSOs: Few optional and high requirements with low- and medium-level robustness requirements

Optional level of robustness for the safety assurance and integrity level for SAIL III operational safety objectives: 4.

Low level of robustness for the safety assurance and integrity level for SAIL III operational safety objectives: 5, 6, 18, 19 and 20.

Medium level of robustness for the safety assurance and integrity level for SAIL III operational safety objectives: 1, 7, 9, 10, 12, 13, 15, 16, 17, 22, 23 and 24.  

High level of robustness for the safety assurance and integrity level for SAIL III operational safety objectives: 8, 11, 14 and 21.  

The following section for each OSO will address what is required to meet each level of robustness for the safety assurance and integrity level.

SAIL IV OSOs: One low-level of robustness requirement, with the rest falling under medium and high

Low level of robustness for the safety assurance and integrity level for SAIL IV operational safety objectives: 4.

Medium level of robustness for the safety assurance and integrity level for SAIL IV operational safety objectives: 2, 3, 5, 6, 7, 9, 10, 12, 15, 16, 17, 18, 19, 20, 22 and 23.  

High level of robustness for the safety assurance and integrity level for SAIL IV operational safety objectives: 1, 8, 11, 13, 14, 21 and 24. 

The following section for each OSO will address what is required to meet each level of robustness for the safety assurance and integrity level.

SAIL IV OSOs: Almost all OSOs require a high level of robustness, with a few falling under a medium level

Medium level of robustness for the safety assurance and integrity level for SAIL V operational safety objectives: 4, 19, 20 and 22.  

High level of robustness for the safety assurance and integrity level for SAIL V operational safety objectives: 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 21, 23 and 24.

The following section for each OSO will address what is required to meet each level of robustness for the safety assurance and integrity level.

SAIL VI OSOs: All OSOs require a high level of robustness 

All operational safety objectives require a high level of robustness for safety assurance and integrity level. The following section for each OSO will address what is required to meet a high level of robustness for the safety assurance and integrity level.

JARUS SORA Annexe E for OSO requirements

After finding the SAIL of your operation and the associated operational safety objectives (OSOs), each organisation will need to look at Annexe E from JARUS to understand how to meet each of these requirements. Below, we’ve provided brief summaries from the original JARUS table for each OSO. Still, please note that these are only brief summaries and cannot encompass all of the required information. 

All credit for this information goes to the Joint Authorities for Rulemaking on Unmanned Systems, and any update to this information can be found on their website directly. Additionally, when compiling your SORA documentation, we recommend using their guidance materials directly, as this article is only meant to be an overview to understand the process associated with these steps before beginning. 

Want to skip to a section further ahead? Click the links below:

Skip to the expected changes in SORA 2.5

OSO #1: Ensure the operator is competent and/or proven 

The first operational safety objective focuses on ensuring a competent and proven operator. Low integrity requires understanding the UAS and having relevant procedures in place. Medium integrity includes low integrity criteria, an appropriate organisation (defined in Annexe E) and a risk management method for flight operations. High integrity builds on medium integrity criteria.

For assurance levels, low assurance involves addressing integrity elements in the ConOps. Medium assurance requires a third-party audit before the first operation. High assurance demands an Organisational Operating Certificate or recognition as a flight test organisation, with ongoing third-party verification of operator competencies.

OSO #2: UAS manufactured by a competent and/or proven entity

Operational safety objective #2 ensures a competent and proven UAS manufacturer. Low integrity requires basic manufacturing procedures. Medium integrity expands on low integrity criteria and includes additional procedures to cover expected gaps. High integrity adds to manufacturing processes, personnel competence and supplier control.

For assurance levels, low assurance follows standards set by competent authorities. Medium assurance confirms UAS design conformance. High assurance involves recurrent third-party audits to verify manufacturing procedures and UAS design conformity. 

National Aviation Authorities (NAAs) determine the adequate standards, which will be updated in SORA Annex E based on their feedback.

OSO #3: UAS maintained by competent and/or proven entity

Operational safety objective #3 ensures competent UAS maintenance. Low integrity requires defined maintenance instructions and competent, authorised staff. Medium integrity includes scheduled maintenance, a maintenance log system and release authorisation.

For assurance levels, low assurance involves documentation, records, and up-to-date staff authorisation lists. Medium assurance requires maintenance programmes in line with competent authority standards and updated staff authorisation lists. High assurance mandates third-party validation of maintenance programmes and procedures manuals.

For training, low assurance requires up-to-date records of staff qualifications. Medium assurance demands initial training for staff holding release authorisation. High assurance includes a third-party validated recurrent training programme. 

OSO #4: UAS developed to authority-recognised design standards

Operational safety objective #4 emphasises that the UAS is developed according to authority-recognised design standards.

Low integrity requires the UAS to be designed according to standards considered adequate by the competent authority for the intended operation. Medium integrity builds on low integrity criteria, with standards suitable for a medium level of integrity and the intended operation. High integrity incorporates the same criteria but applies to a high level of integrity and the intended operation.

OSO #5: UAS is designed considering system safety and reliability

Operational safety objective #5 stresses that the UAS is designed with system safety and reliability in mind.

For low integrity, equipment, systems, and installations must be designed to minimise hazards in the event of a probable malfunction or failure. Medium integrity builds on low integrity, requiring a strategy for detecting, alerting and managing malfunctions or failures that could lead to hazards. High integrity includes medium integrity criteria and specifies failure conditions' frequency: major failure conditions are not more frequent than remote, hazardous failure conditions are not more frequent than extremely remote, and catastrophic failure conditions are not more frequent than extremely improbable. Software and Airborne Electronic Hardware must be developed to industry standards or methodologies considered adequate by the competent authority.

Low assurance requires a functional hazard assessment and a design and installation appraisal to demonstrate minimised hazards for assurance levels. Medium assurance builds on low assurance, conducting safety analyses in line with adequate standards and implementing a strategy for detecting single failures of concern, including preflight checks. High assurance includes medium assurance criteria and validation of safety analyses and development assurance activities by a competent third party.

OSO #6: C3 link characteristics (e.g. performance, spectrum use) are appropriate for the operation  

Operational safety objective #6 aims to ensure appropriate C3 link characteristics, such as performance and spectrum use, are suitable for the intended operation.

Low integrity requires the determination of adequate C3 link performance, RF spectrum usage, and environmental conditions. The remote pilot must consistently monitor the C3 performance. Medium integrity builds upon the low integrity requirements. High integrity necessitates using licensed frequency bands for the C2 link, in addition to meeting low integrity criteria.

Low assurance takes into account the criteria defined in section 9. Medium assurance demonstrates C3 link performance according to approved standards by the competent authority. High assurance involves third-party validation on top of medium assurance criteria.

OSO #7:  Inspection of the UAS (product inspection) to ensure consistency to the ConOps 

Operational safety objective #7 focuses on inspecting the UAS to ensure consistency with the approved Concept of Operations (ConOps). 

For low integrity, the remote crew must ensure the UAS is in a safe condition for operation and adheres to the approved ConOps. 

Low assurance involves documenting the product inspection and considering the manufacturer's recommendations when available for criteria relating to the procedures. Medium assurance builds on low assurance, requiring checklists during the documentation process. High assurance includes medium assurance criteria, as well as third-party validation.

For criteria relating to the training, low assurance requires self-declared remote crew training in performing the product inspection, with supporting evidence available. Medium assurance necessitates an available training syllabus that includes product inspection procedures, and the operator must provide competency-based, theoretical and practical training. High assurance requires validating the training syllabus and verifying remote crew competencies by a competent third party.

OSOs #8, 11, 14 and 21: Operational procedures

Operational safety objectives (OSOs) related to operational procedures include OSOs 8, 11, 14 and 21. These objectives address technical issues with the UAS, external system deterioration, human errors and adverse operating conditions. 

For criteria relating to the procedure definition, operational procedures must be defined for the proposed operation, covering elements such as flight planning, pre and post-flight inspections, evaluation of environmental conditions, coping with unintended adverse conditions, normal and contingency procedures, emergency procedures, and occurrence reporting procedures. These procedures must be compiled in an Operation Manual that includes limitations of external systems supporting the UAS operation.

For criteria relating to the procedure complexity, low integrity requires complex operational procedures that may raise the remote crew's workload, while medium integrity requires simpler procedures.

For criteria relating to potential human error, operational procedures must provide a clear distribution of tasks and an internal checklist at a minimum. Medium integrity requires considering human error, while high integrity adds Crew Resource Management (CRM) training for the remote crew.

Low assurance does not require validation against a standard or means of compliance. Medium assurance requires validation against standards considered adequate by the competent authority and/or following a means of compliance acceptable to that authority. High assurance builds on medium assurance, with the addition of validation by a competent third party.

OSO #9, #15 and #22: Remote crew training

Operational safety objectives (OSOs) related to remote crew training include OSO #09, OSO #15, and OSO #22. These objectives address technical issues with the UAS, human errors, and the remote crew's ability to identify and avoid critical environmental conditions. Integrity levels are categorised as low, medium, and high.

The applicant must propose competency-based, theoretical, and practical training appropriate for the operation to be approved and includes proficiency requirements and training recurrences. The entire remote crew should undergo competency-based, theoretical and practical training specific to their duties.

For remote crew competencies, the competency-based, theoretical and practical training should cover:

a) UAS regulation

b) UAS airspace operating principles

c) Airmanship and aviation safety

d) Human performance limitations

e) Meteorology

f) Navigation/Charts

g) UA knowledge

h) Operating procedures

At the low level of assurance, training is self-declared with the evidence available, and the operator provides competency-based, theoretical and practical training. A training syllabus should be available. At medium and high levels of assurance, a competent third party validates the training syllabus and verifies the remote crew's competencies.

OSO #10 and #12: Safe design 

Operational safety objectives (OSOs) related to safe design include OSO #10 and OSO #12, which focus on mitigating the risk of fatalities while operating Uncrewed Aircraft Systems (UAS) over populated areas or gatherings of people. These objectives aim to address safe recovery from technical issues and manage deteriorating external systems supporting UAS operations.

Low Integrity ensures that fatalities will not occur from any probable failure of the UAS or external systems failure. Medium Integrity prevents fatalities from any single failure and requires software and airborne electronic hardware to be developed to an adequate standard. High integrity shares the same criteria as medium integrity.

Low assurance requires a design and installation appraisal, demonstrating that design features satisfy the low integrity criterion. Medium assurance builds upon low assurance by substantiating the level of integrity claimed through analysis and/or test data. High assurance, in addition to medium assurance criteria, requires the level of integrity claimed to be validated by a competent third party.

OSO #13: External services supporting UAS operations are adequate to the operation 

The 13th operational safety objective (OSO) addresses the adequacy of external services supporting Uncrewed Aircraft Systems (UAS) operations, including communication service providers and UTM service providers.

This is one of the most important OSOs because it requires that companies determine or list all external services that are a part of their operations. This tends to be an overwhelmingly large number, but it’s still required for the safety portfolio, so expect to spend some time on this OSO.

For all integrity levels, the applicant must ensure that the level of performance for any externally provided service necessary for the safety of the flight is adequate for the intended operation. Effective communication and defined roles and responsibilities between the applicant and the external service provider must also be established.

Low assurance requires the applicant to declare that the requested level of performance for any externally provided service necessary for the safety of the flight is achieved. Medium assurance builds upon low assurance by requiring supporting evidence, such as a Service-Level Agreement (SLA) or an official commitment between the service provider and the applicant. The applicant must also have the means to monitor externally provided services and take appropriate actions if real-time performance could lead to the loss of control of the operation. High assurance and medium assurance criteria require evidence of externally provided service performance through demonstrations and validation by a competent third party.

OSO #16: Multi-crew coordination

Operational safety objective (OSO) #16 addresses multi-crew coordination, focusing on procedures, training and communication devices to mitigate human errors in UAS operations. 

Criteria for the procedures require procedures to ensure coordination between crew members, including task assignment and step-by-step communications. The criteria for training necessitate remote crew training covering multi-crew coordination. Medium and high levels require Crew Resource Management (CRM) training. The criteria for communication devices are not applicable for low integrity levels, while medium and high levels require compliance with competent authority standards and redundant communication devices.

Low assurance for procedures involves self-declared adequacy of procedures. Medium Assurance requires validation against competent authority standards, while high assurance adds validation by a competent third party, covering the complete flight envelope. For training criteria, low assurance implies self-declared training with the evidence available, while medium and high assurance levels require validation and verification by a competent third party. 

OSO #17: Remote crew is fit to operate 

Operational Safety Objective (OSO) #17 focuses on ensuring the remote crew is fit to operate. This involves addressing physical and mental fitness, fatigue, and stress.

The first criteria require the applicant to have a policy for remote crew self-declaration of fitness to operate for all integrity levels. Medium and high levels also require defined duties, flight responsibilities and rest times and appropriate requirements for remote crew UAS operation. High integrity levels also necessitate medical fitness and a Fatigue Risk Management System (FRMS).

Low assurance requires the remote crew fitness declaration policy documentation. Medium assurance involves documented remote crew duty, flight duty and resting times policies, with duty cycles logged. Evidence of remote crew fitness for UAS operation is also required. High assurance requires medical standards, duty/flight duty times validation and FRMS validation and monitoring by a competent third party.

OSO #18: Automatic protection of the flight envelope from human errors 

Operational safety objective (OSO) #18 focuses on the automatic protection of the flight envelope from human errors. This involves preventing remote pilots from operating the Unmanned Aircraft (UA) outside its safe performance limits, even when the incorrect control input is made. An example of this would be geofencing, where a virtual barrier is created around a specified area using position location technologies like GPS, RFID and WiFi. This creates notifications to warn or restrict entry into a designated zone. The main use of geofencing is to contain operations within defined limits. For drones, geofencing is also used to prevent drones from entering specific areas like airports or prisons. 

This OSO requires the UAS flight control system to incorporate automatic flight envelope protection for low and medium integrity levels. Low integrity levels prevent the remote pilot from making any single input that would cause the UA to exceed its flight envelope or hinder timely recovery. Medium integrity levels ensure the UA remains within or recovers to the designed operational flight envelope following remote pilot errors.

Low assurance states that the automatic protection of the flight envelope is developed without needing to follow specific standards. Medium assurance requires development according to standards considered adequate by the competent authority or in compliance with their accepted means. High assurance involves the validation of evidence by a competent third party in addition to medium assurance requirements.

OSO #19: Safe recovery from human error 

Operational safety objective (OSO) #19 addresses the safe recovery from human errors that may affect the safety of the operation if not prevented or detected and recovered promptly. This OSO considers procedures, checklists, training, and UAS design to detect and/or recover from human errors.

For procedures and checklist criteria, all integrity levels require defined procedures and checklists to mitigate the risk of human errors from anyone involved in the mission. Training criteria require the remote crew to be trained in procedures, checklists, and Crew Resource Management (CRM) for all integrity levels. UAS design criteria vary by integrity level: low integrity levels require systems detecting and/or recovering from human errors to be developed according to industry best practices.

In contrast, medium and high levels require development according to standards considered adequate by the competent authority or in compliance with their accepted means.

Procedures and checklist criteria vary by assurance level: low assurance levels do not require validation against a standard or means of compliance; medium assurance levels require validation against standards considered adequate by the competent authority or in compliance with their accepted means, with adequacy proven through dedicated flight tests or simulation; high assurance levels include validation by a competent third party in addition to the medium assurance requirements. 

Training criteria refer to the criteria defined for the level of assurance of generic remote crew training OSO (i.e. OSO #09, OSO #15, and OSO #22) corresponding to the SAIL of the operation. 

OSO #20: A Human Factors evaluation has been performed and the Human-Machine Interface (HMI) found appropriate for the mission 

Operational safety objective (OSO) #20 addresses the importance of conducting a human factors evaluation to ensure that the Human-Machine Interface (HMI) is appropriate for the mission. The HMI should not confuse, cause unreasonable fatigue or contribute to remote crew error that could adversely affect the safety of the operation.

The UAS information and control interfaces must be clearly and succinctly presented for all integrity levels. If an electronic means is used to support potential Visual Observers, the HMI should allow them to determine the position of the unmanned aircraft (UA) during operation and not degrade their ability to scan the airspace visually or maintain effective communication with the remote pilot.

At the low assurance level, the applicant conducts a human factors evaluation of the UAS to determine if the HMI is appropriate for the mission based on inspection or analyses. The evaluation is based on demonstrations or simulations at the medium assurance level. At the high assurance level, a competent third party witnesses the HMI evaluation in addition to the medium assurance requirements. Note that when using simulations, the validity of the targeted environment used in the simulation needs to be justified.

OSO #23: Environmental conditions for safe operations defined, measurable and adhered to

Operational safety objective (OSO) #23 focuses on ensuring that environmental conditions are defined, measurable and adhered to under adverse operating conditions. This OSO covers three main criteria: definition, procedures, and training.

Environmental conditions for safe operations should be defined and reflected in the flight manual or equivalent document for all integrity levels. Procedures to evaluate environmental conditions before and during the mission, procedures to evaluate environmental conditions should be available and include an assessment of meteorological conditions with a simple recording system. Training should also cover the assessment of meteorological conditions.

At the low assurance level, procedures do not require validation against either a standard or a means of compliance considered adequate by the competent authority. At the medium assurance level, procedures are validated against standards considered adequate by the competent authority and/or following a means of compliance acceptable to that authority. At the high assurance level, flight tests and simulations are validated by a competent third party in addition to the medium assurance requirements.

Training is self-declared with the evidence available for the training criteria at the low assurance level. The operator provides competency-based, theoretical and practical training at the medium assurance level. At the high assurance level, a competent third party validates the training syllabus and verifies the remote crew competencies.

OSO #24: UAS designed and qualified for adverse environmental conditions (e.g. adequate sensors, DO-160 qualification)

Operational Safety Objective (OSO) #24 focuses on ensuring that the Uncrewed Aircraft System (UAS) is designed and qualified for adverse environmental conditions, including the use of adequate sensors and meeting qualifications such as DO-160. 

At the medium integrity level, the UAS is designed to limit the effect of environmental conditions. At the high integrity level, the UAS is designed using environmental standards considered adequate by the competent authority and/or in accordance with a means of compliance acceptable to that authority. National Aviation Authorities (NAAs) may define the standards and/or the means of compliance they consider adequate.

At the medium assurance level, the applicant has supporting evidence that the required level of integrity is achieved. This can be typically done by testing, analysis, simulation, inspection, design review, or through operational experience.

At the high assurance level, a competent third party validates the claimed level of integrity.

Note that the lowest integrity level should be considered for those cases where UAS equipment has only a partial environmental qualification and/or a partial demonstration by similarity and/or parts with no qualification at all.

Expected changes with SORA 2.5

Because the SORA is a living methodology, it means there are regular updates made to ensure that drone operations remain as safe as possible. Right now, we’ve introduced you to SORA 2.0, but SORA 2.5 will likely change quite a few things about this guide, so it’s good to anticipate some of these changes, even though they aren’t officially released yet. Let’s start with the things we think are most likely to stay the same: the number of OSOs, how you read your SAIL and the level of robustness you need to comply with. 

The difference with SORA 2.5 will most likely be with how the OSOs are grouped and numbered, in addition to the details in the tables. The document is currently being edited, so even though this isn’t something someone can say for sure will happen, there is a high likelihood that this will be the case. 

During the JARUS plenary meeting in Rome in April, there were many discussions regarding the following:

• Changing the structure of the SORA methodology and its annexes, so it’s likely that we’ll see continued evolution here in the future. 
• Ground and air risk mitigations are also very likely going to be redefined, which has a high likelihood of changing existing SORA processes depending on the adoption timelines of aviation authorities for SORA 2.5.
• The term concept of operations (ConOps) will be changed, but we currently don’t know what the new term will be called
• The target for SORA has been defined, which is harmonisation on a global level. This will involve defining how SORA-based approvals can be transferable from one country to another.

In any case, we can anticipate that much of the guide we’ve provided to you will be temporary and need editing when aviation authorities begin to adopt the SORA 2.5 documentation. 

Are you looking for consulting for SORA processes, or would like help creating your SORA documentation? How about preparing for SORA 2.5 with one of the authors? 

Check out the services at Murzilli Consulting to see our SORA packages!