# A Method for Modeling and Testing Near-Real-Time System Scenarios
## 3 Certification of UAV Operational Scenarios
### Linking Scenarios with Functions Affecting Flight Safety  
By combining the general use cases presented in Section 3.2, the system designers are able to design any mission that can be performed by a system using unmanned platforms (see Figure 2). The proposed approach significantly simplifies the description of scenarios for certification purposes. Since each system use case describes the behavior of the system regarding UAV control, sensor management, and handling of dangerous situations in flight, the system use cases decomposed in this way should be assigned to the corresponding requirements in the STANAG 4730, EMACC, or STANAG 4671 (depending on system class) and functions affecting flight safety listed in the FHA. Each of the FHA functions has been assigned corresponding identified emergency states. Each of the states can be uniquely assigned to one or more use cases of the system. The safety of the system and the correctness of the prepared solution will be checked by verifying the assignment of each of the emergency states to the appropriate special situation that may occur in a given case of system use, which is presented in Figure 2. This way of combining scenarios with system security requirements is a very important element that is described in the article. The presented  
Figure 2: System scenarios for UAV missions in the context of certification requirements and functional threat analysis. The oval figures represent groups of functions performed by the UAV at a specific stage of the mission. The figure presents two missions, one of which ends with an emergency return and parachute landing. approach allows for an efficient method of conducting airworthiness testing of an air platform with minimal effort on the part of external auditors. Table 1 shows the functions related to safety in the flight of the platform and dangerous situations concerning the indicated flight modes. The impact of emergencies on the environment is also described. The method of verifying the occurrence of emergencies is indicated. The role of the system designer is to indicate each of the identified hazardous situations. In addition, the system designer is also responsible for the following actions:  
* naming the hazardous situation;
* assigning the hazardous situation to one of the predefined groups;
* describing the hazardous situation unambiguously, not allowing for different interpretations;
* defining the expected effects on UAVs, humans, missions, and other systems;
* assigning a priority to the hazardous situation;
* presenting the methods of preventing the occurrence of hazardous situations;
* presenting the method of detecting the occurrence of a given situation;
* describing how the system reacts to the operation of the pilot or the operation of UAV systems (when there is no communication with the GCS). When describing risky situations that may be caused by various conditions (including, for example, weather conditions or UAV propulsion system failures), it is extremely important to describe how to react after such a situation occurs during the flight. A correct description of the reaction to a problem occurring during a UAV flight must contain an indication of how to remove or bypass the problem with reference to places in the system where appropriate automatic procedures will be implemented. For example, one can imagine a failure of the propulsion system or avionics components, which will cause such instability in the UAV flight that it will be impossible to maintain communication with the GCS. In this case, pilot procedures do not apply. The unmanned platform must react in autonomous mode (without contact with the GCS). Therefore, it requires the design and implementation of appropriate procedures during the system design phase. Failure to define the main use cases of the system will result in unreliable tests of system functionality. In practice, the designer of the unmanned system can implement the automatic procedure of returning to the landing zone in each case of loss of communication between the UAV and the GCS.