EN 4709-006:2026
(Main)Aerospace series - Unmanned Aircraft Systems - Part 006: Means to terminate flight, requirements, and verification
- Abstract
This document provides technical specification and verification methods to support compliance with Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems.
This part provides requirements, test methods and pass criteria for the means to terminate flight (flight termination) for unmanned aircraft systems, in particular addressing:
— safety related aspects of the architecture;
— descent performance;
— means to reduce the effects of impact on ground; and
— manufacturer’s instructions.
Even if security, including IT security, may be useful from an operational point of view, it falls outside the scope of this document.
An activation of the means to terminate the flight by a visual observer is also outside the scope of this document.
This document provides voluntary means of demonstrating compliance with the requirements laid out in Regulation (EU) 2019/945.
Additional hazards that occur from the characteristics of the payload are excluded and are, conversely, under the responsibility of the UAS manufacturer and UAS operator.
- Status
- Published
- Publication Date
- 06-Oct-2026
- Technical Committee
- CEN/TC 471 - Aviation and aeronautics
- Drafting Committee
- CEN/TC 471/WG 1 - Unmanned Aircraft Systems
- Current Stage
- 6060 - Definitive text made available (DAV) - Publishing
- Start Date
- 07-Oct-2026
- Completion Date
- 07-Oct-2026
EN 4709-006:2026 is a CEN standard in the Aerospace series for unmanned aircraft systems (UAS). It specifies requirements, test methods and pass criteria for the means to terminate flight, so manufacturers, test laboratories and assessors can show compliance with Commission Delegated Regulation (EU) 2019/945.
The document focuses on how a UAS should end flight safely: how the flight termination function is designed, how it is triggered, how it descends, and what the manufacturer must explain in the instructions. In practice, it is about proving that the aircraft can be forced down in a controlled way and that the same function still works when the system is tested.
What does EN 4709-006:2026 specify?
EN 4709-006:2026 specifies technical requirements and verification methods for the means to terminate flight of a UAS. Clause 1 frames it as a voluntary means of demonstrating compliance with Regulation (EU) 2019/945, with separate requirements for Class 5 and Class 6 UAS.
The scope is narrow and practical. It covers safety-related architecture, descent performance, means to reduce the effect of impact on the ground, and manufacturer’s instructions. It also makes clear that security, including IT security, is outside scope, as is activation by a visual observer. Hazards from the payload are left to the UAS manufacturer and operator.
The document is organized into:
- Clause 1 - Scope
- Clause 2 - Normative references
- Clause 3 - Terms and definitions
- Clause 4 - Product requirements and compliance for Class 5 UAS
- Clause 5 - Product requirements and compliance for Class 6 UAS
- Informative Annexes A to D and ZA
| Annex | What it covers |
|---|---|
| Annex A | Example design patterns for independent means to terminate flight and guidance for showing the UAS architecture |
| Annex B | Generic safety assessment and checklist for independence analysis |
| Annex C | Automation, including manual, automatic and combined activation patterns |
| Annex D | Typical methods to bring the UA to ground and limit impact dynamics |
| Annex ZA | Relationship with Delegated Regulation (EU) 2019/945 |
What are the key requirements of EN 4709-006:2026?
Reliability, predictability and independence
EN 4709-006:2026 requires the means to terminate flight to be reliable, predictable and independent. Clause 4.1 and Clause 5.1 are the core design requirements, and they matter because the function must still work when it is needed as a mitigation.
For reliability, the document asks for both ground tests and flight tests. In practice, the manufacturer must show that activation works on the installed system and that the UAS stops continuing powered horizontal movement. For predictability, the observed sequence of events must match the manufacturer’s instructions. That means the written procedure and the real behavior must agree.
Independence is a key architectural requirement. The flight termination function must be segregated from flight control and geocaging so that a single failure that creates the need for flight termination does not block it. If the architecture is too complex for checklist review alone, the standard allows complementary fault injection tests using single-fault conditions.
Descent performance
Clause 4.2 and Clause 5.2 require the flight termination function to actually stop continuation of flight, to automate the descent sequence, and to inhibit horizontal thrust. In plain terms, once the function is triggered, the pilot should not have to do anything else to bring the aircraft down.
The verification is based on drop tests and recorded flight data. The test evidence must show the trigger event, the descent, and touchdown, together with the aircraft’s speed, height and position. For Class 5 UAS, the horizontal distance travelled after activation must be compatible with the minimum ground risk buffer and the table of maximum distances in Clause 4.2.2.4. For Class 6 UAS, the distance travelled must be compatible with the manufacturer-defined minimum ground risk buffer.
Means to reduce the effect of impact dynamics
Clause 4.3 requires means to reduce the effect of UA impact dynamics where needed so that major impact damage is unlikely. This matters for systems that use parachutes, energy-absorbing landing behavior, or other methods to reduce damage if descent is not enough on its own.
These means must be triggered automatically as part of flight termination. If they need inspection, cleaning or replacement after activation, the manufacturer must provide instructions for that maintenance. Annex D gives examples such as parachute recovery, stabilized descent, post-stall landing, glide landing and motor shutdown.
Manufacturer’s instructions and pre-flight checks
Clause 4.4 and Clause 5.3 put a strong emphasis on instructions. The manufacturer must describe the flight termination function, the command, the sequence of events, the equipment needed, the limits of operation, the warnings and the behavior after degradation or loss of the link.
The instructions must also include pre-flight verification or test methods. For Class 6, the manufacturer must provide the distance travelled after activation so the operator can define the ground risk buffer. This is important because the operational buffer is not guessed - it is based on the tested behavior of the UAS.
What terms does EN 4709-006:2026 define?
- Flight termination (FT) - the function that forces the UA to descend and stops it continuing horizontal flight.
- Means to terminate flight - the technical means on the UAS that provide the flight termination function.
- Unmanned aircraft system (UAS) - the unmanned aircraft and the equipment used to control it remotely.
- Operational volume - the airspace, defined in space and time, within which the UA operation is restricted.
- Independence - an architecture principle that reduces common-mode failures and cascade failures between functions.
- Reliability - the probability that flight termination is executed properly, excluding unintended activations.
- Predictability - assurance that the UAS performs the procedure as described in the manufacturer’s instructions.
- Debris area - the ground area where inert debris may strike a person after a loss of control event.
Who uses EN 4709-006:2026?
EN 4709-006:2026 is used by UAS manufacturers, system integrators, and engineering teams designing flight termination systems. It is also used by test houses, conformity assessment bodies and safety engineers who need to verify reliability, descent behavior and architecture independence.
Buyers, quality managers and operators use it to check whether a UAS has the right flight termination documentation and test evidence for a given class. Remote pilots and operators use the manufacturer’s instructions for pre-flight testing, activation limits and buffer planning.
Which standards are used with EN 4709-006:2026?
EN 4709-006:2026 references three normative documents:
- EN 4709-001 - provides UAS product requirements and verification, and is used when failure conditions are hard to reproduce and for link-loss mitigations.
- EN 4709-005 - provides verification for the geocaging function, which is relevant where flight termination is linked to containment behavior.
- EN 62368-1:2014 - provides the safety basis for single-fault testing and is used in the complementary fault injection method.
Annex B also points to related safety-analysis methods such as EN IEC 60812, ISO 26262-11, and SAE ARP 4761 in the bibliography for guidance.
What does the EN 4709-006:2026 document contain?
The document contains detailed verification procedures for ground tests, flight tests and drop tests. It also includes the recorded data to capture during testing, such as speed, height, position, motor current, trigger time and touchdown time.
Annex A gives example architecture diagrams for independent flight termination implementations and shows what should be described in a UAS architecture view. Annex B provides a structured safety assessment approach, including functional breakdown and common-mode analysis. Annex C compares manual, automatic and combined activation approaches. Annex D describes typical descent and landing methods by UAS configuration, and Annex ZA maps the clauses to Regulation (EU) 2019/945 for conformity purposes.
Relations
- Effective Date
- 21-Oct-2026
- Effective Date
- 21-Oct-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
EN 4709-006:2026 is a standard published by the European Committee for Standardization (CEN). Its full title is "Aerospace series - Unmanned Aircraft Systems - Part 006: Means to terminate flight, requirements, and verification". This standard covers: This document provides technical specification and verification methods to support compliance with Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems. This part provides requirements, test methods and pass criteria for the means to terminate flight (flight termination) for unmanned aircraft systems, in particular addressing: — safety related aspects of the architecture; — descent performance; — means to reduce the effects of impact on ground; and — manufacturer’s instructions. Even if security, including IT security, may be useful from an operational point of view, it falls outside the scope of this document. An activation of the means to terminate the flight by a visual observer is also outside the scope of this document. This document provides voluntary means of demonstrating compliance with the requirements laid out in Regulation (EU) 2019/945. Additional hazards that occur from the characteristics of the payload are excluded and are, conversely, under the responsibility of the UAS manufacturer and UAS operator.
This document provides technical specification and verification methods to support compliance with Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and on third-country operators of unmanned aircraft systems. This part provides requirements, test methods and pass criteria for the means to terminate flight (flight termination) for unmanned aircraft systems, in particular addressing: — safety related aspects of the architecture; — descent performance; — means to reduce the effects of impact on ground; and — manufacturer’s instructions. Even if security, including IT security, may be useful from an operational point of view, it falls outside the scope of this document. An activation of the means to terminate the flight by a visual observer is also outside the scope of this document. This document provides voluntary means of demonstrating compliance with the requirements laid out in Regulation (EU) 2019/945. Additional hazards that occur from the characteristics of the payload are excluded and are, conversely, under the responsibility of the UAS manufacturer and UAS operator.
EN 4709-006:2026 is classified under the following ICS (International Classification for Standards) categories: 03.220.50 - Air transport; 49.020 - Aircraft and space vehicles in general. The ICS classification helps identify the subject area and facilitates finding related standards.
EN 4709-006:2026 has the following relationships with other standards: It is inter standard links to EN 4709-001:2026, EN 4709-005:2026. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
EN 4709-006:2026 is associated with the following European legislation: EU Directives/Regulations: 2019/945; Standardization Mandates: M/567. When a standard is cited in the Official Journal of the European Union, products manufactured in conformity with it benefit from a presumption of conformity with the essential requirements of the corresponding EU directive or regulation.
EN 4709-006:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-december-2026
Aeronavtika - Letalski sistemi brez posadke - 006. del: Sredstva za prekinitev leta,
zahteve in preverjanje
Aerospace series - Unmanned Aircraft Systems - Part 006: Means to terminate flight,
requirements, and verification
Luft- und Raumfahrt - Unbemannte Luftfahrzeugsysteme - Teil 006: Mittel zum
Flugabbruch, Anforderungen und Prüfverfahren
Série aérospatiale - Aéronefs télépilotés - Partie 006 : Moyens pour interrompre le vol,
exigences et vérification
Ta slovenski standard je istoveten z: EN 4709-006:2026
ICS:
03.220.50 Zračni transport Air transport
49.020 Letala in vesoljska vozila na Aircraft and space vehicles in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EN 4709-006
EUROPEAN STANDARD
NORME EUROPÉENNE
October 2026
EUROPÄISCHE NORM
ICS 03.220.50; 49.020
English Version
Aerospace series - Unmanned Aircraft Systems - Part 006:
Means to terminate flight, requirements, and verification
Série aérospatiale - Aéronefs télépilotés - Partie 006 : Luft- und Raumfahrt - Unbemannte
Moyens pour interrompre le vol, exigences et Luftfahrzeugsysteme - Teil 006: Verfahren zum
vérification Flugabbruch, Anforderungen und Verifizierung
This European Standard was approved by CEN on 29 June 2026.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2026 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN 4709-006:2026 E
worldwide for CEN national Members.
Contents Page
European foreword . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 6
4 Product requirements and compliance of means to terminate the flight . 9
4.1 Reliability . 9
4.1.1 Performance requirements . 9
4.1.2 Verification method . 9
4.1.3 Pass criteria . 16
4.2 Predictability . 16
4.2.1 Performance requirements . 16
4.2.2 Verification method . 16
4.2.3 Pass criteria . 16
4.3 Independence from the automatic flight control and guidance function . 16
4.3.1 Performance requirements . 16
4.3.2 Verification method . 17
4.3.3 Pass criteria . 18
4.4 Independence from the geocaging function . 18
4.4.1 Performance requirements . 18
4.4.2 Verification method . 18
4.4.3 Pass criteria . 19
4.5 Descent performance . 19
4.5.1 Performance requirements . 19
4.5.2 Verification methods . 19
4.5.3 Pass criteria . 24
4.6 Flight termination sequence . 24
4.6.1 Performance requirements . 24
4.6.2 Verification methods . 24
4.6.3 Pass criteria . 24
4.7 Manufacturer’s instructions – Flight termination description . 25
4.7.1 Requirements . 25
4.7.2 Verification method . 25
4.7.3 Pass criteria . 25
4.8 Manufacturer’s instructions – Pre-flight test . 26
4.8.1 Requirements . 26
4.8.2 Verification method . 26
4.8.3 Pass criteria . 26
4.9 Distance travelled . 26
4.9.1 Requirements . 26
4.9.2 Verification methods . 26
4.9.3 Pass criteria . 27
4.10 Programming of the Operational Volume (automatic activation) . 27
4.10.1 General. 27
4.10.2 Performance requirements . 27
4.10.3 Verification method . 28
4.10.4 Pass criteria . 29
5 Abbreviations . 29
Annex A (informative) Example design patterns for the representation of independent means to
terminate flight (flight termination system) implementation . 30
Annex B (informative) Generic safety assessment . 35
Annex C (informative) Explanations . 38
Annex D (informative) Means to reduce the effect of the UA impact dynamics . 42
Annex E (informative) Use of this document for other purposes . 44
Annex ZA (informative) Relationship between this document and the essential requirements of
Delegated regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems
and on third-country operators of unmanned aircraft systems aimed to be covered . 45
Bibliography . 46
European foreword
This document (EN 4709-006:2026) has been prepared by CEN/TC 471 “Unmanned aircraft
systems”, the secretariat of which is held by BNAE.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by April 2027, and conflicting national standards
shall be withdrawn at the latest by April 2027.
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document has been prepared under a standardization request addressed to CEN by the
European Commission. The Standing Committee of the EFTA States subsequently approves these
requests for its Member States.
For the relationship with EU Legislation, see informative Annex ZA, which is an integral part of this
document.
Any feedback and questions on this document should be directed to the users’ national standards
body. A complete listing of these bodies can be found on the CEN website.
According to the CEN-CENELEC Internal Regulations, the national standards organisations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary,
Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland,
Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Türkiye and the United Kingdom.
1 Scope
This document specifies technical requirements and verification methods to support compliance with
Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft systems and
on third-country operators of unmanned aircraft systems.
This part provides requirements, test methods and pass criteria for the means to terminate flight (flight
termination) for unmanned aircraft systems, in particular addressing:
— safety related aspects of the architecture;
— descent performance; and
— manufacturer’s instructions.
Even if security, including IT security, can be useful from an operational point of view, it falls outside
the scope of this document.
An activation of the means to terminate the flight by a visual observer is also outside the scope of
this document.
This document provides voluntary means of demonstrating compliance with the requirements laid out
in Regulation (EU) 2019/945.
Additional hazards that occur from the characteristics of the payload are excluded and are, instead,
under the responsibility of the UAS manufacturer and UAS operator.
Tests in 4.1.2.3 are aligned with EN 4709-005:2026, 5.4.2.3, 5.4.2.4 and 5.4.2.5, same identification, with
modifications.
Subclause 4.10 is aligned with EN 4709-005:2026, 5.2 as far as pertaining to the Operational Volume.
See the note in 4.4.2 and C.2.
This document provides on informative basis in the Annex D, the means of demonstrating equipment to
reduce the effects of impacts on ground.
This document can be applied to other UAS; Annex E provides guidance for this.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
EN 4709-001:2026, Aerospace series — Unmanned Aircraft Systems — Part 001: Product requirements
and verification
EN 4709-005:2026, Aerospace series — Unmanned Aircraft Systems — Part 005: Verification method for
the Geocaging function
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp/
— IEC Electropedia: available at https://www.electropedia.org/
3.1
automatic flight control and guidance system
aggregation of items where the automatic flight control and guidance functions are allocated to
Note 1 to entry: The automatic flight control and guidance system includes all sensors and actuators required to
perform its functions.
Note 2 to entry: For the assessment of independence and reliability, the automatic flight control and guidance
system includes associated power supplies and protections.
3.2
configuration
basic design arrangement of the UA: fixed-wing, rotary wing, or multicopter
3.3
debris area
critical area from inert (non-explosive) debris defined as the sum of all areas on the ground where a
person standing would be expected to be impacted by the UA during or after a loss of control event, and
thus the area where a fatality is expected to occur if a person were within it
3.4
distance travelled
distance travelled by the UA after triggering the means to terminate flight measured from the point of
triggering projected on the ground to the point of impact on the ground plus the largest extent of the
debris area measured from the point of impact
3.5
equipment to control unmanned aircraft remotely
instrument, equipment, mechanism, apparatus, appurtenance, software, or accessory that is necessary
for the safe operation of a UA, other than a part, and which is not carried on board that UA
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (2)]
3.6
failure recognition time
time for the flight termination function to detect the issue
3.7
reaction time
time required to act
Note 1 to entry: For manual flight termination, pilot reaction time includes the time for the remote pilot to detect
the issue and to take appropriate action.
Note 2 to entry: Typically, failure recognition time and pilot reaction time together are 3 s.
3.8
flight termination function
emergency function triggered by the pilot or automatically to terminate the UA flight in a way that the
UA is maintained within the ground risk buffer if triggered when the UA breaches the Operational
Volume
3.9
hazard
condition or object with the potential to cause injuries, damage, loss of material or a reduction of the
ability to perform a prescribed function
3.10
independence
concept that minimizes the likelihood of common mode errors and cascade failures between
aircraft/system functions or items
Note 1 to entry: In the context of this document – relates to the means to terminate the flight: a characteristic of
the UAS architecture implemented such that there is no failure in common between the automatic flight control
and guidance system, the geocaging system and the flight termination system such that, if this failure occurs,
control over the UA and/or its trajectory could be lost, while at the same time and because of the same failure, the
flight termination system may not work.
3.11
major impact damage
damage resulting from impact dynamics that cannot be repaired and requires the replacement of the
UA
3.12
maximum operational distance
in the context of this document, the maximum range permitted by the standard scenario for which
compliance is declared to, or the maximum range declared by the manufacturer, whichever is less
3.13
means for the remote pilot to terminate the flight of the UA
means to terminate the flight
flight termination system
FTS
technical means as part of a UAS that provide a flight termination function
3.14
Operational Volume
OV
volume of airspace, defined in space and time, to which the operation of the UA is restricted
3.15
payload
means instrument, mechanism, equipment, part, apparatus, appurtenance, or accessory, including
communications equipment, that is installed in or attached to the aircraft and is not used or intended to
be used in operating or controlling an aircraft in flight, and is not part of an airframe, engine, or
propeller
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (29)]
3.16
predictability
assurance that the UAS performs the procedures as described in the manufacturer's instructions
3.17
reliability
probability of proper execution of flight termination
Note 1 to entry: Relates to safe operation and does not take spurious/inadvertent activation into account.
3.18
remote pilot
natural person responsible for safely conducting the flight of a UA by operating its flight controls, either
manually or, when the UA flies automatically, by programming and monitoring its course, and
remaining able to intervene and change its course at any time
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (27), modified]
3.19
unmanned aircraft
UA
aircraft operating or designed to operate autonomously or to be piloted remotely without a pilot on
board
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (1)]
3.20
unmanned aircraft system
UAS
unmanned aircraft and the equipment to control it remotely
[SOURCE: Commission Delegated Regulation (EU) 2019/945 of 12 March 2019 on unmanned aircraft
systems and on third-country operators of unmanned aircraft systems, Article 3, No. (3)]
3.21
tether
mechanical device for the purpose of effectively restraining the UA within the range permitted by the
length of the tether as its primary function
3.22
tethered UA
UA that is mechanically restrained in its movement by a tether
Note 1 to entry: Not all cables linking the UA to the ground are considered as tether in the sense of this document
e.g. an electric cable powering the UA, even if it was the only source of power and a loss of connection would
inevitably lead to a loss of flight is not considered as a tether. Nonetheless, a tether may be used to transmit
electrical power to the UA as its secondary function.
4 Product requirements and compliance of means to terminate the flight
4.1 Reliability
4.1.1 Performance requirements
Unless the UA is tethered, the UAS shall provide means for the remote pilot to terminate the flight of the
UA, which shall:
(1) demonstrate that the flight termination function terminates the flight with acceptable reliability.
a. Termination shall be activated by any one of the following:
i. automatically only;
ii. both manually and automatically;
iii. manually only.
b. Where termination is activated automatically: demonstrate that the termination occurs
automatically once breaching the limits of the Operational Volume.
4.1.2 Verification method
4.1.2.1 General
Reliability shall be shown by application of both methods provided in the following subclauses:
— verify by ground tests according to 4.1.2.2 that the flight termination system as installed on the UAS
can be activated properly and that the ability of the UA to continue powered horizontal
displacement is inhibited;
— verify by flight tests according to 4.1.2.3 that the flight termination system is able to reliably
perform flight termination.
In order to ensure that adequate conclusions are drawn from a test when a geocaging function is
implemented on the UA (in particular for class C6 Unmanned aircraft system), it is necessary to ensure
that the activation of the flight termination function will not be triggered by the geocaging function
during the test. This can be achieved by programming adequately the geocaging limits to avoid the
triggering of the flight termination function by the geocaging function during the test.
4.1.2.2 Ground tests
Ground tests serve as to demonstrate the ability to activate the flight termination function and the
assurance of correct indications thereof as opposed to flight tests that demonstrate the performance of
the flight termination function to inhibit the continuation of flight.
Ground tests shall be conducted with the UAS using the equipment to activate and execute flight
termination as foreseen by the manufacturer, without the modifications to arrange a non-destructive
configuration indicated as possible for flight tests.
Ground tests can be conducted with the UAS used for flight tests according to 4.1.2.3.
The test specimen shall be instrumented as required to show the characteristics of the system
indicating successful execution of flight termination.
Where activated manually, the ground tests shall be performed at the maximum operational distance of
the UA from the antenna(s) transmitting the flight termination command. The ground segment of the
flight termination system should be connected to its antenna(s) as in the real operational case.
Alternatively, in order to emulate the effects of distance, attenuation device(s) or a shielded
environment equivalent to conditions whilst operating at maximum operational distance can be used.
Where activated automatically, correct activation of the termination signal shall be tested providing as
input to the flight termination system those termination conditions which would cause its triggering in
flight. This can be accomplished by mounting the UA on a movable platform and move the UA on the
ground towards and beyond the limits of the Operational Volume. Before testing, the Operational
Volume shall be defined such that:
— if the manufacturer’s instructions allow to define circles, then at least one test shall be conducted
with the Operational Volume defined as a circle;
— if the manufacturer’s instructions allow to define polygons, then at least one test shall be conducted
with the Operational Volume defined as a polygon with the minimum number of vertices, and with
the maximum number of vertices;
— if the manufacturer’s instructions allow to define concave shaped polygons, then at least one test
shall be conducted with the Operational Volume defined as a concave shaped polygon with the
sharpest concave angle using segments much longer than the UA size.
10 activations shall be performed consecutively.
Where the flight termination function can be activated both manually and automatically, 5 activations
shall be manual and 5 shall be automatic.
A single ground test is considered passed when upon activation the characteristics of the system
indicate successful execution of flight termination:
a. for any configuration that performs flight termination in conjunction with deploying a parachute:
the electrical current (amperage) of all motors is zero (off) and the parachute deployed; the
opening of a parachute bay door is sufficient to indicate the successful deployment of a parachute
where the parachute itself is deployed into the airstream;
b. for any configuration that performs flight termination by shutting off all motors: the electrical
current (amperage) of all motors is zero (off) or negative (recuperating);
c. for any configuration that performs flight termination by moving actuators into a pre-defined
position: the actuators are in the pre-defined position;
d. for any configuration that performs flight termination by powering off actuators: the electrical
power (voltage) at the actuators is zero (off) or the actuator is in a mode where it does not draw
current (amperage) and moves freely.
Ground tests are considered passed when the full set of tests is passed.
4.1.2.3 Flight tests
4.1.2.3.1 General
Flight tests serve as to demonstrate the performance of the flight termination function to inhibit the
continuation of flight, as opposed to drop tests that demonstrate the performance of the flight
termination function to bring the UA to ground thereafter.
Flight tests shall be conducted with the UAS using the equipment to activate and execute flight
termination as foreseen by the manufacturer.
A representative non-destructive configuration can be arranged as a substitute if it is ensured by
ground testing that the indicators used to monitor activation of the flight termination function are
representative for the actual activation. This can be accomplished by digital recording of the flight
termination system signal, which would normally interrupt power connection to engines when the
flight termination function is actuated, avoiding that such signal actually commands power interruption
during tests.
Flight tests can be combined with drop tests according to 4.5.2.
A total of 20 flight tests is required to demonstrate proper activation of the on-board segment of the
flight termination system.
In the following the terms 'minimum height' and 'maximum height' refer to minimum and maximum
height above ground as specified in the manufacturer's instructions.
The following 4.1.2.3.2 shall be applied if the manufacturer has implemented manual activation alone,
4.1.2.3.3 if the manufacturer has implemented automatic activation alone, and 4.1.2.3.4 if the
manufacturer has implemented both manual and automatic activation.
A single test is considered as passed if the means to terminate flight have successfully inhibited the
continuation of flight, or equivalent when substituted, within the reaction time specified by the
manufacturer after breaching the Operational Volume. Reference can be made to the characteristics of
the system indicating successful execution of flight termination as given in 4.1.2.2 and the drop tests
given in 4.5.2.
More than one test specimen of the same configuration can be used for testing. In addition to that,
damaged test specimens can be replaced by test specimen of the same configuration.
4.1.2.3.2 Manual activation
It shall be demonstrated that each manual activation from ground would result in flight termination.
The following scenarios shall be tested:
1. UA flying straight and level towards or away from the antenna(s) transmitting the flight
termination signal, at the minimum and maximum height (excluding climb and descent segments).
10 activations shall be triggered as shown in Figure 1:
a. 5 at minimum height, 2 of which testing the maximum operational distance at that height,
b. 5 at maximum height, 2 of which testing the maximum operational distance at that height.
2. 2. UA flying straight and level in a direction perpendicular to the tests given in No. 1 above. 10
activations shall be triggered:
a. 5 at minimum height, 2 of which testing the maximum operational distance at that height,
b. 5 at maximum height, 2 of which testing the maximum operational distance at that height.
Figure 1 — Flight test sequence
4.1.2.3.3 Automatic activation
It shall be demonstrated that each automatic activation would result in flight termination.
1. Before testing, the Operational Volume shall be defined such that:
— if the manufacturer’s instructions allow to define circles, then at least one test shall be
conducted with the Operational Volume defined as a circle;
— if the manufacturer’s instructions allow to define polygons, then at least one test shall be
conducted with the Operational Volume defined as a polygon with the minimum number of
vertices, and one with the maximum number of vertices;
— if the manufacturer’s instructions allow to define concave shaped polygons, then at least one
test shall be conducted with the Operational Volume defined as a concave shaped polygon with
the sharpest concave angle using segments much longer than the UA size;
— the flight test ensemble shall cover the Tests #1a, #1b, #1c, #2a, #2b, #3a and #3b below.
2. The following scenarios shall be tested:
— UA flying straight and level, at the minimum and maximum height (excluding climb and
descent segments). 20 activations shall be triggered:
a. 10 at minimum height;
b. 10 at maximum height.
Test #1: Triggering of flight termination when the UA breaches the horizontal limit
— Test #1a (Figure 2): fly the UA perpendicular to a horizontal limit of the Operational Volume until
flight termination is activated.
— Test #1b (Figure 2): fly the UA towards the horizontal limit of the Operational Volume with an angle
between the direction of flight and the horizontal limit smaller than 30° until flight termination is
activated.
Figure 2 — Triggering of flight termination when the UA breaches the horizontal limit, tests #1a
and #1b illustration
— Test #1c (Figure 3): fly the UA perpendicular to the horizontal limit, towards the horizontal limit of
the Operational Volume until flight termination is activated.
NOTE Test #1c is carried out only if the horizontal shape of the Operational Volume can be defined as a convex
polygon.
Figure 3 — Triggering of flight termination when the UA breaches the horizontal limit,
test #1c illustration
Test #2: Triggering of flight termination when the UA breaches the vertical limit
— Test #2a (Figure 4): fly the UA with the largest angle of climb, perpendicular if possible, to the upper
vertical limit of the Operational Volume until flight termination is activated.
— Test #2b (Figure 4): fly the UA towards the upper vertical limit of the Operational Volume with an
angle between the direction of flight and the vertical limit smaller than 30° until flight termination
is activated.
Figure 4 — Triggering of flight termination when the UA breaches the vertical limit, tests #2a
and #2b illustration
Test #3: Triggering of flight termination when the UA breaches the horizontal limits with
sharpest angles
— Test #3a (Figure 5): fly the UA horizontally within the Operational Volume towards the sharpest
concave angle, using segments much longer than the drone size, until flight termination is activated.
NOTE Test #3a is carried out only if the horizontal shape of the Operational Volume can be defined as a concave
polygon.
Figure 5 — Triggering of flight termination when the UA breaches the horizontal limits with
sharpest angles, test #3a illustration
— Test #3b (Figure 6): fly the UA horizontally within the Operational Volume towards the sharpest
convex angle, using segments much longer than the drone size, until flight termination is activated.
NOTE Test #3b is carried out only if the horizontal shape of the Operational Volume can be defined as a polygon.
Figure 6 — Triggering of flight termination when the UA breaches the horizontal limits with
sharpest angles, test #3b illustration
4.1.2.3.4 Combination of manual and automatic activation
— Define the Operational Volume according to 4.1.2.3.2., No. 1.
— The following scenarios shall be tested:
1. UA flying straight and level towards or away from the antenna(s) transmitting the flight
termination signal, at the minimum and maximum height (excluding climb and descent
segments). 5 manual activations shall be triggered as shown in Figure 1:
a. 3 at minimum height, 1 of which testing the maximum operational distance at that height;
b. 2 at maximum height, 1 of which testing the maximum operational distance at that height.
2. UA flying straight and level in a direction perpendicular to the tests given in No. 1 above.
5 manual activations shall be triggered:
a. 2 at minimum height, 1 of which testing the maximum operational distance at that height;
b. 3 at maximum height, 1 of which testing the maximum operational distance at that height.
3. UA flying straight and level, at the minimum and maximum height (excluding climb and
descent segments). 10 automatic activations shall be triggered:
a. 5 at minimum height;
b. 5 at maximum height.
4.1.3 Pass criteria
(1) Verify that in all tests the flight termination function has been activated within the reaction time
specified by the manufacturer.
4.2 Predictability
4.2.1 Performance requirements
Unless the UA is tethered, the UAS shall provide means for the remote pilot to terminate the flight of the
UA, which shall:
(2) ensure that the UAS performs the procedures as described in the manufacturer's instructions
(predictability).
4.2.2 Verification method
— Review the manufacturer’s instructions to identify the possible flight termination procedures.
— Determine by test(s) according to 4.5.2, that the sequence of events executed by the UAS is as
described by the manufacturer.
The assessment shall be executed once per flight termination procedure.
4.2.3 Pass criteria
(2) Verify that the sequence of events demonstrated by the test is in accordance with the
manufacturer's instructions; ensure that the documented behaviour matches with the actual
behaviour.
4.3 Independence from the automatic flight control and guidance function
4.3.1 Performance requirements
Unless the UA is tethered, the UAS shall provide means for the remote pilot to terminate the flight of the
UA, which shall:
(3) avoid having a failure in the automatic flight control and guidance function outside or in common
with the means to terminate the flight such that when flight termination is required, its proper
activation is inhibited.
4.3.2 Verification method
Independence shall primarily be shown by checking the architectural design against the items on the
compliance checklist given below. The design shall be analysed based on the technical documentation
provided by the manufacturer. See Annexes A and B for guidance.
— Verify by review of the manufacturer’s design in the technical documentation that:
1. the flight termination function on-board of the UA is segregated from the automatic flight
control and guidance function, such that no single failure causing the need to activate the
means to terminate flight as a mitigation hampers the successful activation and employment of
the means to terminate flight;
2. a loss of the flight termination function does not automatically end the flight;
3. no failure that would require flight termination inhibits proper execution of the flight
termination function outside or in common with the means to terminate flight;
4. if the flight termination function relies on the provision of electric power, the means to
terminate flight are powered with adequate segregation from the automatic flight control and
guidance function such that a single failed item does not negatively impact the execution of the
flight termination function (cf. C.1);
5. if the flight termination function relies on automatic activation, automatic flight control and
guidance function and automatic flight termination function rely on different internal systems
for position fixing.
6. where the flight termination function relies on manual activation:
a. the equipment utilized to trigger the flight termination function on ground is segregated
from the equipment to control the unmanned aircraft remotely during UAS operation
within the Operational Volume, the trigger is properly marked in accordance with the
manufacturer's instruction and protected against unintended use by safeguard;
b. the radio transmitter of the flight termination command signal on ground is independent
from the radio transmitter utilized for command and control;
c. the radio frequency band of the radio frequencies used for the transmission of the flight
termination command signal is separated from the radio frequency band utilized for UAS
command and control; and
d. the radio receiver of the flight termination command signal installed onboard the UA is
independent from the radio receiver utilized for command and control.
Where the flight termination function relies on manual activation and the UAS is using separate
redundant radio communication links including redundant radio-transmitters and redundant radio
receivers to transmit commands for automatic flight control and guidance and flight termination then
transmitting both commands on both links is considered as equivalent to independent.
Cellular network (mobile communication) and U-Space services are considered as external services.
Where GNSS is required for activation of the flight termination function:
a. GNSS navigation systems (constellations) are considered as external systems; using more than one
GNSS navigation system (constellation) is considered adequate;
b. the GNSS receiver is considered as an internal system for position fixing in accordance with
requirement No. 5. above and therefore a second separate GNSS receiver is required.
4.3.3 Pass criteria
(3) Verify that the design is compliant with the independence from automatic flight control and
guidance criteria.
4.4 Independence from the geocaging function
4.4.1 Performance requirements
Unless the UA is tethered, the UAS shall provide means for the remote pilot to terminate the flight of the
UA, which shall:
(4) avoid having a failure in the geocaging function outside or in common with the means to terminate
the flight such that when flight termination is required, its proper activation is inhibited
(independence).
4.4.2 Verification method
Independence shall primarily be shown by checking the architectural design against the items on the
compliance checklist given below. The design shall be analysed based on the technical documentation
provided by the manufacturer. See Annexes A and B for guidance.
— Verify by review of the manufacturer’s design in the technical documentation that:
1. the flight termination function on-board of the UA is segregated from the geocaging function,
such that no single failure causing the need to activate the means to terminate flight as a
mitigation hampers the successful activation and employment of the means to terminate flight;
2. a loss of the flight termination function does not automatically end the flight;
3. no failure that would require flight termination inhibits proper execution of the flight
termination function outside or in common with the means to terminate flight;
4. if the flight termination function relies on automatic activation, geocaging function and
automatic flight termination function rely on different internal systems for position fixing.
5. where the flight termination function relies on the provision of electric power, the means to
terminate flight are powered with adequate segregation from the geocaging function such that
a single failed item does not negatively impact the execution of the flight termination function
(cf. C.1);
Where GNSS is required for activation of the flight termination function:
a. GNSS navigation is considered as an external system; using more than one constellation is
considered adequate;
b. the GNSS receiver is considered as an internal system for position fixing in accordance with
requirement No. 4. above and therefore a second separate GNSS receiver is required.
NOTE The triggering of the flight termination function referenced in EN 4709-005:2026, 5.5, does not comply
with the segregation requirement (cf. No’s 1 and 4 above). Consequently, when the UAS equipped with geocaging
is implemented as per EN 4709-005:2026 (in particular in the case of class C6 Unmanned aircraft system) and
when the FTS as specified in t
...