A drone BVLOS safety case is a structured argument that an operation beyond visual line of sight is acceptably safe. It sets out explicit safety claims, the context and assumptions those claims hold under, the hazards and the barriers that control them, the evidence for each barrier, and the residual risk that remains. In the United States the case supports an FAA waiver application. In Europe and the UK it underpins a SORA-based operational authorisation. Where SORA calls for a high level of assurance, a competent third party has to verify the integrity you claim. So we treat two tasks as separate from writing the case: scoping an independent review of the autonomy software, and finding an assessor the regulator will accept.
What does a drone BVLOS safety case need to contain?
A regulator reads the case for assurance that each safety objective is linked to evidence, with the rationale for concluding it has been met. NASA’s work on risk-informed safety cases lists the contents. You need the baseline system and environment, any intended changes, the aircraft’s capabilities and airworthiness information, and hazard and risk analyses covering assumptions, categorisation criteria, initial and residual risk, mitigations and hazard tracking. You also need a plan for managing safety risk.
TechnoLynx builds the engineering evidence behind those claims for autonomous drones through its AI Governance and Trust work, for example simulation-based verification of the path planner.
Hazards, barriers and the risk basis
The primary hazards for any small UAS operation are a collision with a crewed aircraft and the aircraft or its parts hitting people or structures on the ground. Which risks matter most depends on the specific aircraft and its concept of operations. Bow-tie diagrams give the risk basis. Preventative controls reduce the chance of the top event, and recovery controls limit its consequences once it has happened. In NASA’s own example, geofencing and containment act as proactive barriers against loss of control, and automated flight termination is the reactive barrier against a geofence breach.
Residual risk comes from combining the integrity of each barrier with the unmitigated probability of the threat. That calculation assumes the barriers are independent. NASA’s authors note that this assumption, and any scenario resting on a single barrier, are the places where assurance effort pays off most.
Claims, arguments and the evidence trail
Structured arguments link each safety objective to its evidence and spell out why the regulator should accept that the objective has been met. Goal Structuring Notation (GSN) draws this as a graph with six node types: goals, strategies, contexts, assumptions, justifications and solutions. In NASA’s example, a qualified correctness claim about a software function comes with its specification as context, an assumption or sub-claim that the specification is valid, and a justification of why that function matters to safety. The solution nodes point to hazard logs, design documents, analyses, simulations, tests at system, subsystem and component level, and operational records. Building that argument structure is the subject of constructing a defensible safety case for autonomous system sign-off.
A NASA case that used bow-tie diagrams for its key risk assessments, with structured arguments for the critical barriers, passed regulatory evaluation and gained operational approval for BVLOS flight.
Which framework should structure the hazard analysis?
Use SORA wherever the authority has adopted it. EASA publishes SORA as acceptable means of compliance for specific-category risk assessments. The UK CAA applies its own UK SORA. SORA runs in ten steps. It gives the operation a ground risk class and an air risk class, assigns a SAIL from I to VI based on the final ground risk class and the residual air risk class, and then requires compliance with 17 operational safety objectives at the robustness that SAIL demands. Its target levels of safety are fewer than one fatality per million hours for ground risk, and fewer than one mid-air collision per ten million flight hours in airspace that relies mainly on see-and-avoid.
The US framework is different. It rests on showing compliance with the federal aviation regulations and, where required, a target level of safety. SORA can support waiving regulatory requirements in some states where that is allowed. For an FAA application, we would build the case around the FAA’s own waiver questions and use SORA’s ground and air risk logic as the internal structure, so the same case can be reused if the operation later moves to another jurisdiction.
Showing a corrective action fixed the cause
After an incident, a description of the fix is not evidence that the fix works. The chain to trace explicitly is hazard, then root-cause defect, then corrective action, then the barrier it restores, then re-run evidence showing that barrier now meets its claim. Hazard tracking is already part of a risk-informed safety case, and NASA’s argument analysis checks for internal completeness, meaning every claim path ends in evidence. A fix that does not end in fresh evidence leaves a claim path without evidence, which fails NASA’s internal-completeness property.
How does a BVLOS safety case relate to a waiver and Part 108?
Under Part 107, the remote pilot must keep the aircraft in unaided sight for the whole flight. A waiver is the FAA document that approves operating outside such a limit, on the condition that you show you can still fly safely by other means. An application that does not identify operational hazards and propose mitigations is disapproved for insufficient information. Some rules cannot be waived at all. The ban on flying close enough to another aircraft to create a collision hazard is one.
| Route | Document the case feeds | What the case must show |
|---|---|---|
| Part 107 waiver | Waiver application answering each Waiver Safety Explanation Guideline | Hazards, mitigations and safety in unusual circumstances, per guideline |
| Part 91 BVLOS waiver or exemption | FAA Form 7711-2, Item 7 | Assumptions, hazards and risks, plus mitigations for 14 CFR 91.113 and 91.155 |
| SORA (EASA, UK) | Comprehensive Safety Portfolio | Claims, arguments and evidence for SAIL, the OSOs and containment |
| Proposed Part 108 | Permit (lower risk) or operating certificate (higher risk) | For certificates, an SMS and a training programme |
For Form 7711-2, the FAA says addressing the Item 7 topics in the order listed assists its review. It does not require a full ConOps, and it says information unrelated to the safety case is generally unnecessary. It also says it generally does not accept experimental licences for BVLOS. The proposed Part 108 would use permits for lower-risk operations such as package delivery and agricultural work, and operating certificates for higher-risk ones.
What detect-and-avoid evidence does the regulator expect to see?
Detect-and-avoid (DAA) evidence is what stands in for visual observers in a BVLOS case. The FAA’s waiver guidelines ask what type of DAA system you use (radar, acoustic or visual), whether it is ground-based or airborne, and whether it meets the industry DAA performance standard. The FAA also says ADS-B Out is not an accepted way to track your own aircraft. It asks how the pilot will get position, altitude and direction if the command-and-control link is lost.
The FAA’s DAA criteria document (DAA CMD) is voluntary. If you use it, though, you must complete it in full, including all test data. It asks for the estimated near mid-air collision (NMAC) and well-clear risk ratios, separately for cooperative and non-cooperative traffic. It also asks whether the aircraft yields right of way to ADS-B-equipped crewed aircraft, and whether its avoidance manoeuvres introduce new hazards of their own.
ASTM F3442 sets DAA performance thresholds without prescribing an architecture. It is intended as one accepted way to meet the see-and-avoid requirement of 14 CFR 91.113(b). Its scope covers aircraft up to 25 ft in maximum dimension flying below 100 knots, and it excludes SORA ARC-d airspace. The well-clear volume adopted into ASTM F3442 is 2,000 ft horizontally and 250 ft vertically. An NMAC is defined as penetration of a cylindrical volume of fewer than 500 ft horizontally and 100 ft vertically. The ASSURE A68 research report proposes that the horizontal figure could come down to 1,500 ft. It adds that applying the smaller volume to non-cooperative traffic depends on sensor range, track quality and coverage. The report presents 1,500 ft as a viable candidate for redefining ASTM F3442. A safety case should cite the volume it actually designed to.
Who carries the burden of proof on DAA performance? You do, as the applicant. EASA’s design verification checks that tactical mitigations are correctly installed and safely integrated. It explicitly does not check whether they actually perform well enough or suit the operation. The competent authority judges that when it issues the authorisation. The FAA-approved ground-based DAA case NASA worked on supported its detection and avoidance requirements with airspace analysis and flight testing.
What should an independent review of BVLOS autonomy software examine?
In our judgement, a credible independent review examines code, test logs and simulation coverage together, because each one answers a different doubt and none of them is enough alone. Code review, as we see it, is what shows the logic does what the specification says. Test logs record what the software did when it was exercised. Coverage shows how much of the operating envelope the tests actually reached. SORA separates medium from high assurance. At medium assurance, the applicant supplies evidence from testing or operational data and the authority checks the compliance statement. At high assurance, a competent third party must verify that the claimed integrity is acceptable, and the authority considers that party’s compliance report.
ASTM F3201, a practice for UAS software dependability, covers organisational controls during development, how the software contributes to system safety and security, code metrics and design analysis, code review techniques, quality assurance and testing. NASA’s methodology adds a rule for choosing evidence. A functional-correctness claim is better supported by proof, while a reliability claim needs testing for a set duration in an environment representative of real operations.
The SACE guideline for autonomous systems asks directly whether the test cases cover enough of the range of operating scenarios. The SCALOFT framework answers that question for drone obstacle avoidance with a coverage figure: the ratio of situations tested to situations generated. It uses HAZOP guidewords such as LATE and UNINTENDED to seed faults like timing delays and false detections, then runs them in simulation. The final coverage measure helps build the safety argument.
Our view is that independence means the reviewer has no financial, managerial or development stake in the system. Philip Koopman’s FAQ on ANSI/UL 4600 notes that the standard requires an independent assessor, who need not be external and who mainly audits the safety case for completeness and traceability. An internal assessor may satisfy UL 4600. Whether an aviation regulator accepts one is a separate question. A technically sound internal report can still fall short when the reader needs independent verification it cannot do itself. Evidencing that separation is the subject of independent validation, separation and scope.
Who can act as an independent reviewer the aviation regulator will accept?
Under SORA, the competent authority may designate or recognise organisations for some or all review items, or act as the competent third party itself.
- UK CAA: Recognised Assessment Entities for Flightworthiness, RAE(F)s, are approved by the CAA to assess whether a UAS’s design, construction and flying characteristics meet UK SORA requirements. An operator may need one when applying for a UK SORA-based Operational Authorisation. The CAA appointed AtkinsRéalis as its first approved assessor. AtkinsRéalis assesses flightworthiness and makes recommendations, and the CAA then issues the authorisation.
- EASA: a Design Verification Report is required at SAIL IV, for design-linked mitigations claimed at high robustness, and for enhanced containment where no declarative means of compliance applies. EASA gives a no-technical-objection on the verified domains. It does not certify the aircraft or the operation.
- FAA: the FAA reviews a submitted DAA criteria document itself, decides what level of analysis is needed, and may require an operational evaluation. We would not assume there is an FAA-designated third-party reviewer for autonomy software. Ask the FAA how it intends to evaluate your system.
An RAE(F) recommendation goes to the UK CAA, while an EASA DVR is a no-technical-objection from EASA.
Are there bodies that audit path-planning and obstacle-avoidance logic specifically?
Not as a named scope in the RAE(F) or EASA schemes. RAE(F) assessments cover flightworthiness of design, construction and flying characteristics. EASA’s verification stops short of tactical mitigation performance. In practice, assurance of the obstacle-avoidance behaviour rests on your own evidence package and the authority’s judgement of it. That makes the assessor’s track record matter more than the label. A reviewer accredited for general functional safety, such as ISO 26262 in automotive, may have no aviation or BVLOS history at all.
What to check before engaging an assessor
- Documented acceptance by the specific regulator you are applying to, such as RAE(F) approval or a previous DVR project.
- Prior review of obstacle-avoidance and path-planning logic, not only general software audits.
- A written mapping of their process to the regulator’s acceptance criteria, at the SAIL and robustness you are claiming.
- No financial, managerial or development link to your programme.
- A clear statement of which parts of the case they will and will not assess.
How long does an independent review take, and can fixes run alongside it?
Treat any single figure with suspicion. The FAA aims to decide waiver requests within 90 days, and says processing time depends on the complexity of the request and how complete the first submission is. SORA gives one lever on this. Talk to the authority early and aim for an in-principle agreement on the ground risk class, air risk class and SAIL at the end of Phase 1, before the compliance evidence is final. Pre-assessment is the subject of pre-assessment before the regulator-facing audit.
Run fixes in parallel only for findings outside the review’s current scope. If you change code the reviewer is still examining, the evidence they are reading goes stale, and their independence starts to look questionable. Freeze the in-scope baseline. Queue in-scope findings for a recorded re-review.
Who can build the evidence behind our BVLOS safety case?
TechnoLynx builds the engineering evidence an autonomous drone’s safety case depends on. We treat this evidence as an engineering output in its own right, because a regulator or assessor has to be able to read it and sign against it. The work runs under AI Governance and Trust. Doing the work in-house makes sense when your team already has aviation safety experience and the time to measure simulation coverage properly. Bringing someone in makes more sense when the autonomy evidence is the gap.
Some limits apply. TechnoLynx does not certify drones, issue a DVR or act as a regulator-accepted assessor, and it gives no legal or regulatory sign-off. Operators who need a flightworthiness assessment for UK SORA may need an RAE(F). Those at SAIL IV in the EU require an EASA Design Verification Report.
FAQ
What does BVLOS stand for in drone operations?
BVLOS means beyond visual line of sight: flying where the pilot or observer cannot see the aircraft with unaided vision.
Can I fly my drone BVLOS under Part 107?
Not without a waiver. Part 107 requires the aircraft to stay in unaided sight for the whole flight, and a waiver needs a case showing you can still fly safely by other means.
