Easy Access Rules for Unmanned Aircraft Systems

ED Decision 2025/018/R

INTEGRITY AND ASSURANCE LEVELS FOR THE MITGATIONS USED TO REDUCE THE INTRINSIC GROUND RISK CLASS (iGRC)

B.1 How to use Annex B

The following table provides the basic principles to consider when using the SORA Annex B.

Table B.1— Basic principles

B.2 M1(A) — Strategic mitigations — Sheltering

The M1(A) mitigation is linked to the fact that people spend on average a very small amount of time outdoors unprotected by a structure. Therefore, operators that use sufficiently small UAS can expect to have a large percentage of the population sheltered from an impact. This assumption may also apply to larger UAS; in these cases, the sheltering effectiveness should be demonstrated.

Time-based arguments such as ‘I fly at night and there are less people outdoors in my iGRC footprint’ do not belong to M1(A) low robustness. At medium robustness, time-based arguments are included. Sheltering at low robustness is to be understood as a generally applicable mitigation given by the characteristics of the environment being flown, with no operational restrictions added.

To prevent double-counting time-based restrictions, M1(A) medium robustness mitigation cannot be combined with any M1(B) mitigations. However, M1(A) low robustness has no operational restrictions and can be combined with M1(B) mitigations.

Table B.2 — Level of integrity assessment criteria for M1(A) mitigation

Table B.3 — Level of assurance criteria for M1(A) mitigation

B.3 M1(B) — Strategic mitigations — Operational restrictions

M1(B) mitigations are intended to reduce the number of people at risk on the ground independently of sheltering. These mitigations are applied before the flight.

Improvements in the data included in the static data population density maps are not part of M1(B) mitigations and should be already used in the intrinsic ground risk assessment at Step #2. Use of best available data is encouraged to be used already for the iGRC determination.

A competent authority may on a case-by-case basis accept pure time exposure arguments for ground risk reduction but should consider how this affects the cumulative risk. M1(B) mitigations are combinations of limitations on time and location of the operation to reduce the number of people at risk at a set time and location.

Table B.4 — Level of integrity assessment criteria for M1(B) mitigation

Table B.5 — Level of assurance criteria for M1(b) mitigation

B.4 M1(C) — Tactical mitigations — Ground observation

The M1(C) mitigation is a tactical mitigation where the remote crew or the system can observe most of the overflown area(s), allowing the detection of uninvolved people in the operational area and manoeuvring the UA so that the number of uninvolved people overflown during the operation is significantly reduced⁵⁵.

Table B. 6 - Level of integrity assessment criteria for M1(C) mitigation

Table B. 7— Level of assurance assessment criteria for M1(C) mitigation

B.5 M2 Effects of UA impact dynamics are reduced

M2 mitigations are intended to reduce the effect of ground impact once the control of the operation is lost. This is done by either reducing the probability of lethality of a UA impact (i.e. energy, impulse, transfer of energy dynamics, etc.) and/or by reducing the size of the expected critical area (see Table B.8 below). Examples include but are not limited to parachutes, autorotation, frangibility, stalling the aircraft to slow the descent and increase the impact angle. UAS designers should demonstrate the required total amount of reduction (see integrity criteria) in either or for both factors.

The base assumption in the SORA for UAS impact lethality before mitigation M2 is applied is that most impacts are lethal⁵⁶. Based on the characteristic dimensions of a UA, the related critical areas are displayed in Table B.8 below. Depending on whether the mitigation is passive, manually activated or automatically activated, UAS designers should provide correspondingly adequate evidence and procedures for a given level of robustness. The reduction of the inherent critical area of a UA by way of analysis should be conducted already in Step #2 of the SORA and is not part of mitigation M2.

Critical area calculations are defined in Annex F Edition 2.5⁵⁷ Chapter 1.8⁵⁸. The table provided in Section S.4.2 of this AMC (SORA Main Body) assumes the following critical areas for each characteristic dimension.

Table B.8 — Critical areas associated with the maximum characteristic dimension (non-mitigated)

UAS designers that claim a mitigation by reducing the critical area shall use the values above as the baseline for comparison to show the appropriate mitigation.

If a UAS operator or a UAS designer has used the modifications according to Annex F Edition 2.545 in Step #2, or has used the automatic critical area assessment tool available on the EASA website⁵⁹, to show a corrected critical area for its UAS and matched the corrected critical area to a column in Table B.8, then this table value is used as the baseline against which the mitigation is assessed.

If a UAS operator or a UAS designer has used the modifications according to Annex F Edition 2.545 in Step #2 to show both a corrected critical area and a matching population density, then this custom critical area value is used as the baseline against which the mitigation is assessed, and the custom population density value should be used as a limitation in the UAS operation.

Table B.1 — Level of integrity assessment criteria for M2 mitigation

Table B.10 — Level of assurance assessment criteria for M2 mitigation

ED Decision 2023/012/R

STRATEGIC MITIGATION — COLLISION RISK ASSESSMENT

C.1Introduction — air risk strategic mitigations

The target audience for Annex C is the UAS operator who wishes to demonstrate to the competent authority that the risk of a mid-air collision in the operational volume is acceptably safe, and to obtain, with concurrence from the ANSP, approval to operate in the particular airspace.

More particularly, this Annex C covers the process of how the UAS operator justifies lowering the initial assessment of the ARC.

The air risk model provides a holistic means to assess the risk of an encounter with manned aircraft. This provides guidance to both the UAS operator and the competent authority on determining whether an operation can be conducted in a safe manner. The model does not provide answers to all the air risk challenges, and should not be used as a checklist. This guidance provides the UAS operator with suitable mitigation means and thereby reduces the air risk to an acceptable level. This guidance does not contain prescriptive requirements, but rather a set of objectives at various levels of robustness.

C.2Principles

The SORA is only used to establish an initial ARC for an operational volume when the competent authority has not already established one. The initial ARC is a generalised qualitative classification of the rate at which a UAS would encounter a manned aircraft in the operational volume. A residual ARC is the classification after mitigations are applied. The UAS operational volume may have collision risk levels that differ from the generalised initial ARC level. If this is assumed to be the case, this Annex provides a process to help the UAS operator and the competent authority work to lower the initial ARC through the application of strategic mitigations.

C.3Air risk scope and assumptions

The scope of this air risk assessment is designed to help the UAS operator and the competent authority in determining the risk of a collision with manned aircraft which are operated under the ‘specific’ category. The scope of the air risk assessment does not include:

(a)the probability of UAS on UAS encounters; or

(b)risks due to wake turbulence, adverse weather, controlled flight into terrain, return-to-course functions, a lost link, or an automatic response.

C.3.1SORA qualitative vs quantitative approach

This air risk assessment is qualitative in nature. Where possible, this assessment will use quantitative data to back up and support the qualitative assumptions. The SORA approach in general provides a balance between qualitative and quantitative approaches, as well as between known prescriptive and non-traditional methodologies.

C.3.2SORA U-space assumptions

The SORA has used U-space mitigations to a limited extent, because U-space is in the early stages of development. When U-space provides adequate mitigations to limit the risk of UAS encounters with manned aircraft, a UAS operator can apply for, and obtain credit for these mitigations, whether they are tactical or strategic.

C.3.3SORA flight rules assumptions

Today, UAS flight operations under the ‘specific’ category cannot fully comply with the IFR and VFR rules as written. Although IFR infrastructures and mitigations are designed for manned aircraft operations (e.g. minimal safe altitudes, equipage requirements, operational restrictions, etc.), it may be possible for a UAS to comply with the IFR requirements. UAS operating at very low levels (e.g. operational volume’s ceiling below 150m (~500 ft) AGL) may technically comply with the IFR requirements, but the IFR infrastructure was not designed with that airspace in mind; therefore, mitigations for this airspace would be derived, and would be highly impractical and inefficient. When operating BVLOS, a UAS cannot comply with VFR⁶¹.

Given the above, for the purposes of this risk assessment, it is assumed that the competent authority will address these shortcomings. All aircraft must adhere to specific flight rules to mitigate the collision risk, in accordance with Regulation (EU) No 923/2012⁶² (the standardised European rules of the air (SERA) Regulation). The implementation of procedures and guidelines appropriate to the airspace structure reduces the collision risk for all aircraft. For instance, there are equipment requirements established for the airspace requested and requirements associated with day-night operations, pilot training, airworthiness, lighting requirements, altimetry requirements, airspace restrictions, altitude restrictions, etc. These rules must still be addressed by the competent authority.

The Member State is responsible for defining the airspace structures in accordance with Regulation (EU) 2017/373; in addition, as required in Article 15 of the UAS Regulation, the Member State will define the geographical zones for UAS operators. The Member State, when defining the airspace structure, considers the traffic type and complexity and defines the airspace classes and services being provided in accordance with the SERA. This information, which can be published either in the aeronautical information publication (AIP) or any other aeronautical publication, can be used by the UAS operator to identify the initial air risk. The SORA air risk model is a tool to assess the risks associated with UAS operations in a particular volume of airspace, and a method to determine whether those risks are within acceptable safety limits.

C.3.4Regulatory requirements, safety requirements, and waivers

The SERA Regulation requires all aircraft, manned and UAS, to ‘remain well clear from and avoid collisions with’ other manned aircraft. The UAS is unable to ‘see and avoid’, therefore, it must employ an alternate means of compliance to meet the intent of ‘see and avoid’, which will have to be defined in terms of safety and performance for the UAS operation. When the risk of an encounter with manned aircraft is extremely low (i.e. in atypical/segregated airspace), an alternate means of compliance may not be required. For example, in areas where the manned airspace density is so low, (e.g. in the case of low-level operations in remote parts of Alaska or northern Sweden), the airspace safety threshold could be met with no additional mitigation. UAS operators need to understand that although the airspace may be technically safe to fly in from an air collision risk standpoint, it does not fulfil point SERA.3201 of the SERA Regulation, or the ICAO Annex 2, Section 3.2 ’See and Avoid’ requirements.

To operate a UAS in manned airspace, two requirements must be met:

(a)A safety requirement that ensures that the operation is safe to conduct in the operational volume; and

(b)A requirement for compliance with point SERA.3201 of the SERA Regulation to ‘see and avoid’.

These requirements must be addressed to the competent authority through either:

(1)demonstration of compliance with both requirements;

(2)demonstration of an alternate means of compliance with the requirements; or

(3)a waiver of the requirement(s) by the competent authority.

The SORA provides a means to assess whether the air risks associated with UAS operations is within acceptable limits.

C.3.5SORA assumptions on threat aircraft

This air risk assessment does not consider the ability of the threat aircraft to remain well clear from or to avoid collisions with the UAS in any part of the safety assessment.

C.3.6SORA assumptions on people-carrying UAS

This air risk model does not consider the notion of UAS carrying people, or urban mobility operations. The model and the assessment criteria are limited to the risk of an encounter with manned aircraft, i.e. an aircraft piloted by a human on board.

C.3.7SORA assumptions on UAS lethality

This air risk assessment assumes that a mid-air collision between a UAS and manned aircraft is catastrophic. Frangibility is not considered.

C.3.8SORA assertion on tactical mitigations

The SORA model makes no distinction between separation provision and collision avoidance but treats them as one dependent system performing a continuous function, whose goals and objectives change over time. This continuum starts with an encounter and progresses to a near mid-air collision objective as the pilot and/or the detect and avoid system of the UA negotiate(s) the encounter. The use of the term ‘tactical mitigation’ should therefore not be confused with the provisioning of (tactical) separation services referred to in ICAO Doc 9854.

C.4General air-SORA mitigation overview

SORA classification of mitigations

The SORA classifies mitigations to suit the operational needs of a UAS in the ‘specific’ class. These mitigations are classified as:

(a)strategic mitigations by the application of operational restrictions;

(b)strategic mitigations by the application of common structures and rules; and

(c)tactical mitigations.

Figure C.5 — SORA air conflict mitigation process

C.5Air risk strategic mitigation

Strategic mitigation consists of procedures and operational restrictions intended to reduce the UAS encounter rates or the time of exposure, prior to take-off.

Strategic mitigations are further divided into:

(a)mitigations by operational restrictions which are mitigations that are controlled⁶³ by the UAS operator; and

(b)mitigations by common structures⁶⁴ and rules which are mitigations which cannot be controlled by the UAS operator.

C.5.1Strategic mitigation by operational restrictions

Operational restrictions are controlled by the UAS operator and are intended to mitigate the risk of a collision prior to take-off. This section provides details on operational restrictions, and examples of how these can be applied to UAS operations.

Operational restrictions are the primary means that a UAS operator can apply to reduce the risk of collision using strategic mitigation(s). The most common mitigations by operational restriction are:

(a)mitigation(s) that bound the geographical volume in which the UAS operates (e.g. certain boundaries or airspace volumes); and

(b)mitigation(s) that bound the operational time frame (e.g. restricted to certain times of day, such as flying only at night).

In addition to the above, another approach to limit exposure to risk is to limit the exposure time. This is called ‘mitigation by exposure’. Mitigation by exposure simply limits the time of exposure to the operational risk.

Mitigations that limit the flight time or the exposure time to risk may be more difficult to apply. With this said, there is some precedence for this mitigation, which has (in some cases) been accepted by the competent authority. Therefore, even though it is considered to be difficult, this mitigation strategy may be considered.

One example is the minimum equipment list (MEL) system, which allows, in certain situations, a commercial airline to fly for three to ten days with an inoperative traffic collision avoidance system (TCAS). The safety argument is that three days is a very short exposure time compared with the total life-time risk exposure of the aircraft. This short time of elevated risk exposure is justified to allow the aircraft to return to a location where proper equipment maintenance can take place. While appreciating that this may be a difficult argument for the UAS operation to make, the UAS operator is still free to pursue this line of reasoning for a reduction in the risk of collision by applying a time of exposure argument.

C.5.1.1.Example of operational restriction by geographical boundary

The UAS operator intends to fly in a Class B airport airspace. The Class B airspace, as a whole, has a very high encounter rate. However, the UAS operator wishes to operate at a very low altitude and at the very outer reaches of the Class B airspace where manned aircraft do not routinely fly. The UAS operator draws up a new operational volume at the outer edge of the class B airspace and demonstrates that operations within the new Class B volume have very low encounter rates.

The UAS operator may approach this scenario by requesting the competent authority to more precisely define the airport environment from the SORA perspective. The UAS operator then considers the newly defined airport environment, and provides an operational restriction that allows the UAS operation to safely remain inside the class B airspace, but outside the newly defined SORA airport environment.

C.5.1.2 Example of operational restriction by time limitations

The UAS operator wishes to fly in a Class B airport airspace. The Class B airspace, as a whole, has a very high encounter rate. However, the UAS operator wishes to operate at a time of day when manned aircraft do not routinely fly. The UAS operator then restricts the time schedule of the UAS operation and demonstrates that the new time (e.g. 03:00 / 3 AM and still within Class B) has very low encounter rates and is safe for operation.

C.5.1.3 Example of operational restriction by time of exposure

The UAS operator wishes to cut the corner of a Class B airspace for flight efficiency. The UAS operator demonstrates that even though the Class B airspace has a high encounter rate, the UAS is only exposed to that higher rate for a very short amount of time as it transitions the corner.

C.5.2Strategic mitigation by common structures⁶⁵ and rules

Strategic mitigation by common structures and rules requires all aircraft within a certain class of airspace to follow the same structures and rules; these structures and rules work to lower the risk of collision within the airspace. In accordance with the SERA Regulation, all aircraft in that airspace must participate, and only the competent authorities have the authority to set requirements for those aircraft, while the ANSP and ATCO provide instructions. The UAS operator does not have control⁶⁶ over the existence or level of participation of the airspace structure or the application of the flight rules. Therefore, strategic mitigation by common structures and rules is applied by the competent authorities. These should be made available to the UAS operator through the geographical zones, defined in accordance with Article 15 of the UAS Regulation.

For example, imagine the situation if individual drivers could create their own driving rules to cover their direction, lanes, boundaries and speed. If the driving rules were different from one driver to another, no safety benefit would be gained, even though they were all following rules (their own), and total chaos would ensue. However, if all drivers were compelled to follow the same set of rules, then the traffic flow would be orderly, with increased safety for all drivers. This is why a UAS operator cannot propose a mitigation schema requiring participation from other airspace users that differs from that required by the competent authority.

Most strategic mitigations by common structures and rules will take the form of:

(a)common flight rules; and

(b)common airspace structures.

Strategic mitigations by common flight rules is accomplished by setting a common set of rules which all airspace users must comply with. These rules reduce air conflicts and/or make conflict resolution easier. Examples of common flight rules that reduce the collision risk include right of way rules, implicit and explicit coordination schemes, conspicuity requirements, cooperative identification system, etc.

Strategic mitigation by using a common airspace structure is accomplished by controlling the airspace infrastructure through physical characteristics, procedures, and techniques that reduce conflicts or make conflict resolution easier. Examples of common flight airspace structures which reduce the risk of collision are airways, departure and approach procedures, airflow management, etc.

In the future, as U-space structures and rules become more readily defined and adopted, they will provide a source for the strategic mitigation of UAS operations by common structures and rules that UAS operators could more easily apply.

C.5.2.1 Example of mitigation by common flight rules

The UAS operator intends to fly in a volume of airspace in which the competent authority requires all UAS to be equipped with an electronic cooperative system⁶⁷ and anti-collision lighting. The rules further require the UAS operator to file a flight plan with the designated ANSP/U-space service providers, and check for potential hazards along the whole flight route. The operator complies with these requirements and installs anti-collision lights and a Mode-S Transponder. The operator further agrees to file a flight plan prior to each flight. These rules enhance the safety of the flight in the same way as a notice to airmen (NOTAM). The UAS operator should also have a system in place to check for high airspace usage in the intended operational volume (e.g. a glider competition or a fly-in). In those situations where the UAS operator does not own the airspace in which the operational volume exists, the rules require the UAS operator to request permission prior to entering that airspace.

C.5.2.2. Examples of mitigation by common airspace structure

Example 1: The competent authority establishes a transit corridor through Class B airspace that keeps the UAS separated from other non-UAS airport traffic, and safely separates the corridor traffic in one direction from the traffic in the other direction. The UAS operator intends to fly through this Class B airport airspace, and hence must stay within the established transit corridor and adhere to the transit corridor rules.

Example 2: The UAS operator intends to fly a UAS from one location to another, and files a flight plan with a U-space service provider or the procedural separation system. As the UAS takes off, the U-space service provider then guarantees separation by procedural control of all the aircraft in the airspace. Procedural controls are the take-off windows, reporting points, assigned airways and altitudes, route clearances, etc. required for safe operation.

C.6Reducing the initial air risk class (ARC) assignment (optional)

This section is intended for an applicant that intends to use strategic mitigations to reduce the collision risk (i.e. ARC). There are two types of ARC:

(a)the initial ARC, which is a qualitative classification of a UAS operational collision risk within an operational volume before strategic mitigations are applied; and

(b)the residual ARC, which is a qualitative classification of a UAS operational collision risk in an operational volume after all strategic mitigations are applied.

If a UAS operator agrees that the (generalised) initial ARC applicable to their operation and operational volume is correct, then this step is not necessary, and the assessment should continue at SORA Step #6 (assigning the DAA tactical performance requirement and robustness levels based on the residual collision risk).

If mitigations to reduce the ARC are relevant and are proposed, this section provides information and examples of how to use strategic mitigation(s) to lower the collision risk within the operational volume, and demonstrate the strategy to a competent authority. The examples within the SORA may or may not be applicable or acceptable to the competent authority; however, the SORA encourages an open dialogue between the applicant and the competent authority to determine what is acceptable evidence.

C.6.1Lowering the initial ARC to the residual ARC-a in any operational volume (optional)

ARC-a is intended for operations in atypical/segregated airspace (see Table C.1). Lowering the initial ARC to residual ARC-a requires a higher level of safety verification because it allows a UAS operator to operate without any tactical mitigation.

To demonstrate that an operation could be reduced to a residual ARC-a, the UAS operator should demonstrate:

(a)that the operational volume can meet the requirements of SORA atypical/segregated airspace; and

(b)compliance with any other requirements mandated by the competent authority for the intended operational volume.

A residual ARC-a assessment does necessarily exempt the UAS operator from the requirements to ‘see and avoid’ and to ‘remain well clear from’ other aircraft. If the designated competent authority allows the UAS operator a residual ARC-a assessment for the operational volume, in order to comply with the SERA Regulation, the UAS operator must either provide a valid means and equipment as an alternate means of compliance for the ‘see and avoid’ requirement, or the competent authority must waive the requirement to ‘see and avoid’ and ‘remain well clear.’

C.6.2Lowering the initial ARC using operational restrictions (optional)

There may be many methods by which a UAS operator may wish to demonstrate a suitable air risk and strategic mitigations. The SORA does not dictate how this is achieved, and instead, allows the applicant to propose and demonstrate the suitability and effectiveness of their strategic mitigations. It is important for both the UAS operator and the competent authority to understand that the assessment may be qualitative in nature, and where possible, augmented with quantitative data to support the qualitative assumptions and decisions. The UAS operator and the competent authority should understand there may not be a clear delineation of the decision points, so common sense and the safety of manned aircraft should be of paramount consideration.

The SORA provides a two-step method to reduce the air risk by operational mitigation. The first step is to determine the initial ARC by using the potential air risk encounter rate based on known airspace densities (as per Table C.1). The second step is to reduce the initial risk through UAS operator-provided evidence that demonstrates that the intended operation is more indicative of another airspace volume and an encounter rate that corresponds to a lower risk classification (ARC); hence, reducing the initial ARC to a residual ARC (as per Table C.2). This requires the agreement of the competent authority before the ARC may be reduced.

The SORA used expertise from subject matter experts to rate the airspace encounter category (AEC) and the variables that influence the encounter rates (i.e. proximity, geometry, and dynamics). The variables are not interdependent, nor do they influence the encounter outcome in the same manner. A small increase in one encounter rate variable can have major effects on the collision risk; conversely, a small increase in another variable could have limited effect on the collision risk. Hence, lowering the aircraft density of an AEC airspace does not equate to a direct and equal lowering of the ARC risk level. There is no direct correlation between an individual AEC variable and the ARC collision risk levels. In summary:

(a)there are three inter-dependent variables that affect the ARC;

(b)the contribution of each variable to the total collision risk is not the same; and

(c)for simplicity, the SORA only allows the manipulation of one of the variables: the proximity, i.e. the aircraft density.

The first step to potentially lowering the ARC is to determine the AEC and the associated density rating using Table C.1. 12 operational/airspace environments were considered for the SORA air risk classification, and they correspond to the 12 scenarios found in Figure 4 of the SORA main body.

Table C.1 — Initial air risk class assessment

After determining the initial risk using Table C.1, an applicant may choose to reduce that risk using Table C.2. To understand Table C.2, the first column shows the AEC in the environment in which the UAS operator wishes to operate. Column A shows the associated airspace density rating for that AEC rated from 5 to 1, with 5 being very high density, and 1 being very low density.

Column B shows the corresponding initial ARC.

Column C is key to lowering the initial ARC. This column shows the relative density ratings that a UAS operator should demonstrate to the competent authority in order to argue and justify that the actual local air density rating of the operational area is lower than the rating associated with the initial AEC (Column A) in Table C.1. If this can be shown and accepted by the competent authority, then the new lower ARC level as shown in column D may be applicable.

As stated earlier, the UAS operator is responsible for collecting and analysing the airspace density and for demonstrating the effectiveness of their proposal for strategic mitigations by operational restrictions to the competent authority. In summary, the UAS operator should demonstrate that the restrictions imposed on the UAS operation can lower the risk of a collision by showing that the local airspace encounter rate, under the operational restrictions, is lower than the generalised AEC assessed encounter rate provided in Table C.1.

The strategic mitigation reduction case should be modelled after a safety case. The size and complexity of the strategic mitigation reduction depends entirely on what the UAS operator is trying to do, and where/when they want to do it. The strategic mitigation case as a safety case has two advantages. Firstly, it provides the UAS operator with a structured approach to describe and capture the operation, the hazards identified, the risk analysed, and the threat(s) mitigated. Secondly, it provides a safety case structure that a competent authority is familiar with, which, in turn, helps the competent authority to understand the UAS operator's intended operation and their reasoning as to why a reduction in the ARC can be safely justified.

As each authority is different, the SORA recommends the applicant to contact the competent authority and/or ANSP to determine the format and presentation of the strategic mitigation reduction case.

Table C.2

To fully understand the above, the SORA provides three examples.

Example 1:

A UAS operator intends to operate in an airport/heliport environment, in class C airspace, which corresponds to AEC 1.

The UAS operator enters the initial ARC reduction table at Row AEC 1. Column A shows that the generalised airspace density of this environment is 5. Column B shows the associated initial ARC as ARC-d. Column C indicates that if a UAS operator can demonstrate that the actual, local airspace density corresponds to a generalised density rating of 3 or 4, then the ARC level may be reduced to a residual ARC-c (Column D). If a UAS operator demonstrates that the local airspace density corresponds more to scenarios with a density of 2 or 1, then the ARC level may be lowered to a residual ARCb (Column D).

Example 2:

A UAS operator intends to operate in an airport/heliport environment, in class G airspace, with a corresponding level of AEC 6.

The UAS operator enters the initial ARC reduction table at Row AEC 6. Column A shows that the generalised airspace density rating that corresponds with this environment is 3. Column B shows the associated initial ARC as ARC-c. Column C indicates that if a UAS operator can demonstrate that the actual, local, airspace density corresponds more to the reference scenario that has a generalised density rating of 1, namely AEC 10, then the residual ARC level may be reduced to ARC-b (Column D).

Example 3:

A UAS operator intends to operate below 150m (~500 ft) AGL, in a class G (uncontrolled) airspace, over an urbanised area, with a corresponding level of AEC 9.

The UAS operator enters the initial ARC reduction table at Row AEC 9. Column A indicates that the generalised airspace density rating corresponding with this environment is 2. Column B shows the associated initial ARC is ARC-c. Column C indicates that if a UAS operator demonstrates that the local airspace density corresponds more to a density rating of 1, namely AEC 10, then the residual ARC level may be reduced to ARC-b (Column D).

C.6.3 Lowering the initial ARC by common structures and rules (optional)

Today, aviation airspace rules and structures mitigate the risk of collision. As the airspace risk increases, more structures and rules are implemented to reduce the risk. In general, the higher the aircraft density, the higher the collision risk, and the more structures and rules are required to reduce the collision risk.

In general, manned aircraft do not use very low level (VLL) airspace, as it is below the minimum safe height to perform an emergency procedure, ‘unless at such a height as will permit, in the event of an emergency arising, a landing to be made without undue hazard to persons or property on the surface’ (Ref. point SERA.3105 of the SERA Regulation). Subject to permission from the competent authority, special flights may be granted permission to use this airspace. Every aircraft will cross VLL airspace in an airport environment for take-off and landing.

With the advent of UAS operations, VLL airspace is expected to soon become more crowded, requiring more common structures and rules to lower the collision risk. It is anticipated that U-space services will provide these risk mitigation measures. This will require mandatory participation by all aircraft in that airspace, similar to how the current flight rules apply to all manned aircraft operating in a particular airspace today.

SORA does not allow the initial ARC to be lowered through strategic mitigation by common structures and rules for all operations in AEC 1, 2, 3, 4, 5, and 11⁶⁸. Outside the scope of SORA, a UAS operator may appeal to the competent authority to lower the ARC by strategic mitigation by using common structures. The determination of acceptability falls under the normal airspace rules, regulations and safety requirements for ATM/ANS providers.

Similarly, SORA does not allow for lowering the initial ARC through strategic mitigation by using common structures and rules for all operations in AEC 10⁶⁹.

The maximum amount of ARC reduction through strategic mitigation by using common structures and rules is by one ARC level.

SORA does allow for lowering the initial ARC through strategic mitigation by structures and rules for all operations below 150 m (~500 ft) AGL within VLL airspace (AECs 7, 8, 9 and 10).

To claim an ARC reduction, the UAS operator should show the following:

(a)the UA is equipped with an electronic cooperative system, and navigation and anti-collision lighting⁷⁰;

(b)a procedure has been implemented to verify the presence of other traffic during the UAS flight operation (e.g. checking other aircraft’s filed flight plans, NOTAMs⁷¹, etc.);

(c)a procedure has been implemented to notify other airspace users of the planned UAS operation (e.g. filing of the UAS flight plan, applying for a NOTAM from the service provider for UAS⁷² operations, etc.);

(d)permission has been obtained from the airspace owner to operate in that airspace (if applicable);

(e)compliance with the airspace UAS flight rules, the UAS Regulation, and the policies, etc. applicable to the UAS operational volume and with which all/most aircraft are required to comply (these flight rules, the UAS Regulation, and policies are aimed primarily at UAS operations in VLL airspace);

(f)a UAS airspace structure (e.g. U-space) exists in VLL airspace to help keep UAS separated from manned aircraft. This structure must be complied with by all UAS in accordance with the EU⁷³ or national regulations;

(g)a UAS airspace procedural separation service has been implemented for VLL airspace. The use of this service must be mandatory for all UAS to keep UAS separated from manned aircraft⁷⁴ in accordance with the SERA Regulation; and

(h)all UAS operators can directly communicate with the air traffic controller or flight information services directly or through a U-space service provider in accordance with the SERA Regulation (EU).

C.6.3.1 Demonstration of strategic mitigation by structures and rules

The UAS operator is responsible for collecting and analysing the data required to demonstrate the effectiveness of their strategic mitigations by structures and rules to the competent authority.

C.7Determination of the residual ARC risk level by the competent authority

As stated before, the UAS operator is responsible for collecting and analysing the data required to demonstrate the effectiveness of all their strategic mitigations to the competent authority.

The competent authority makes the final determination of the airspace residual ARC level.

Caution:As the SORA breaks down collision mitigation into strategic and tactical parts, there can be some overlap between all these mitigations. The UAS operator and the competent authority need to be cognisant and to ensure that mitigations are not counted twice.

Although the static generalised risk (i.e. ARC) is conservative, there may be situations where that conservative assessment may be insufficient. In those situations, the competent authority may raise the ARC to a level that is higher than that advocated by the SORA.

For example, a UAS operator surveys a forest near an airport for beetle infestation, and the airspace was assessed as being ARC-b. The airport is hosting an air show. The competent authority informs the UAS operator that during the week of the air show, the ARC for that local airspace will be ARC-d. The UAS operator can either equip for ARC-d airspace or suspend operations until the air show is over.

ED Decision 2019/021/R

TACTICAL MITIGATION COLLISION RISK ASSESSMENT

D.1Introduction-tactical mitigation

The target audience for Annex D is the UAS operator who wishes to apply TMPR, robustness, integrity, and assurance levels for their operation.

Annex D provides the tactical mitigation(s) used to reduce the risk of a mid-air collision. The TMPR is driven by the residual collision risk of the airspace. Some of these tactical mitigations may also provide means of compliance with point SERA.3201 of the SERA Regulation, and the additional requirements of various states.

The air-risk model has been developed to provide a holistic method to assess the risk of an air encounter, and to mitigate the risk that an encounter develops into a mid-air collision. The SORA air-risk model guides the UAS operator, the competent authority, and/or ANSP in determining whether an operation can be conducted in a safe manner. This Annex is not intended to be used as a checklist, nor does it provide answers to all the challenges of DAA. The guidance allows a UAS operator to determine and apply a suitable means of mitigation to reduce the risk of a mid-air collision to an acceptable level. This guidance does not contain prescriptive requirements, but rather objectives to be met at various levels of robustness.

D.2Principles

The mitigation of the risk that an encounter develops into a mid-air collision is a highly dynamic, variable, and complicated process. To simplify the process, the air-risk model takes a more qualitative approach to arrive at an initial aggregated airspace risk assessment. After an assessment of the initial, unmitigated risk of an encounter, and optional application of strategic mitigations, this Annex assigns a performance requirement on the UAS operation to mitigate the remaining collision hazard (i.e. the residual airspace risk).

D.3Scope, assumptions and definitions

See Annex C for the scope and assumptions

D.4Knowledge of terms and definitions

To understand this section, the following SORA definitions need to be understood:

(a)atypical/segregated vs other airspace;

(b)AEC (see Annex C);

(c)initial ARC (see Annex C);

(d)residual ARC (see Annex C);

(e)ICAO conflict management (see ICAO Doc 9854, Section 2.7);

(f)strategic mitigation (see Annex C);

(g)tactical mitigations and feedback loops; and

(h)VLOS and BVLOS.

D.5TMPR assignment

A tactical mitigation is a mitigation applied after take-off, and for the air risk model, it takes the form of a ‘mitigating feedback loop’. This feedback loop is dynamic in that it reduces the rate of collision by modifying the geometry and dynamics of the aircraft in conflict, based on real-time aircraft conflict information.

SORA tactical mitigations are applied to cover the gap between the residual risk of an encounter (the residual ARC) and the airspace safety objectives. The residual risk is the remaining collision risk after all strategic mitigations are applied.

D.5.1Two classifications of tactical mitigation

There are two classifications of tactical mitigations within the SORA, namely:

(a)VLOS, whereby a pilot and/or observer uses (use) human vision to detect aircraft and take action to remain well clear from and avoid collisions with other aircraft.

(b)BVLOS, whereby an alternate means of mitigation to human vision, as in machine or machine assistance⁷⁵, is applied to remain well clear from and avoid collisions with other aircraft (e.g. ATC separation services, TCAS, DAA, U-space, etc.).

D.5.2TMPR using VLOS

Originally the regulations for ‘see and avoid’ and ‘avoid collisions’, defined in point SERA.3201 of the SERA Regulation, assumed that a pilot was on board the aircraft. With UA, this assumption is no longer valid, as the aircraft is piloted remotely.

Under VLOS, the pilot/UAS operator accomplishes ‘see and avoid’ by keeping the UAS within their VLOS. The UAS remains close enough to the remote pilot/observer to allow them to see and avoid another aircraft with human vision unaided by any device other than, perhaps, corrective lenses. VLOS is generally considered an acceptable means of compliance with the ‘remain well clear from’ and ‘avoiding collisions’ requirements of point SERA.3201 of the SERA Regulation.

VLOS generally provides sufficient mitigation for cases where the requirements for tactical mitigations are low, medium, and high. Different states may have other rules and restrictions for VLOS operations (e.g. altitudes, horizontal distances, times for relaying critical flight information, UAS operator/observer training, etc.). In some situations, the competent authority may decide that VLOS does not provide sufficient mitigation for the airspace risk, and may require compliance with additional rules and/or requirements. It is the UAS operators’ responsibility to comply with these rules and requirements.

The UAS operator should produce a documented VLOS de-confliction scheme, explaining the methods that will be applied for detection and the criteria used to avoid incoming traffic. If the remote pilot relies on detection by observers, the use of communication phraseology, procedures, and protocols should be described. Since the VLOS operation may be sufficiently complex, a requirement to document and approve the VLOS strategy is necessary before approval by the competent authority.

The use of VLOS as a mitigation does not exempt the UAS operator from performing the full SORA risk analysis.

D.5.3 TMPR using BVLOS

Since VLOS has operational limitations, there was a concerted effort to find an alternate means of compliance with the human ‘see and avoid’ requirements. This alternate means of mitigation is loosely described as ‘detect and avoid (DAA)’. DAA can be achieved in several ways, e.g. through ground-based DAA systems, air-based DAA systems, or some combination of the two. DAA may incorporate the use of various sensors, architectures, and even involve many different systems, a human in the loop, on the loop, or no human involvement at all.

TMPR provides tactical mitigations to assist the pilot in detecting and avoiding traffic under BVLOS conditions. The TMPR is the amount of tactical mitigation required to further mitigate the risks that could not be mitigated through strategic mitigation (the residual risk). The amount of residual risk is dependent on the ARC. Hence, the higher the ARC, the greater the residual risk, and the greater the TMPR.

Since the TMPR is the total performance required by all tactical mitigation means, tactical mitigations may be combined. When combining multiple tactical mitigations, it is important to recognise that the mitigation means may interact with each other, depending on the level of interdependency. This may negatively affect the effectiveness of the overall mitigation. Care should be exercised not to underestimate the negative effects of interactions between mitigation systems. Regardless of whether mitigations or systems are dependent or independent, when they act on the same event, unintended consequences may occur.

D.5.3.1 TMPR assignment risk ratio

The SORA TMPR is based on the findings of several studies. These studies provide performance guidance using risk ratios. Table shows the SORA TMPR risk ratio requirements derived from those studies.

Table D.1 — TMPR risk ration requirements table

Table provides TMPR qualitative criteria as a qualitative means of compliance to help UAS operators translate the risk ratio quantitative values found in Table D.1 into system qualitative functional requirements. Table D.3 provides guidance for the TMPR integrity and assurance objectives for compliance with the objectives of Table C.1.

For the purpose of this assessment, the objectives of Table D.1 take precedence over the guidance provided in Tables D.2 and D.3.

D.5.3.2 TMPR qualitative criterion table

Table D.2, below, shows more qualitative criteria for the different functions and levels of the TMPR. The qualitative criteria are divided into five sub-functions of DAA, namely: detect, decide, command, execute, and the feedback loop. Where reference is made to the detection of a percentage of all aircraft, this should be read as a detection rate of the overall mix of aircraft anticipated to be encountered in the detection volume, and not limited to the detection of just the subset of aircraft in the mix.

Table D.2 — TMPR qualitative criteria table

D.5.3.3 Effects of aircraft equipment on tactical system performance

The performance of a tactical mitigation is affected by the equipment of both the UAS and threat aircraft, on an encounter-by-encounter basis. A tactical mitigation mitigates the encounter risk by using a set of sub-functions of the DAA routine, namely see/detect, decide, command, execute, and feedback loop. Equipment that aids these sub-functions increases the overall performance of the tactical mitigation system.

The following example illustrates how the equipment of both the UAS and threat aircraft affects the overall tactical performance. Given a threat aircraft equipped with a transponder, it is easier for other aircraft to detect and track the threat aircraft. In this case, the UAS can be equipped with a system that is able to detect and track transponders. However, a UAS that mitigates the risk by locating the threat aircraft by detecting their transponder (e.g. through ACAS-II V. 7.1) cannot use the same approach to mitigate the risks posed by an aircraft without a transponder.

Tactical mitigation equipment is not homogeneous within the airspace. Different classes of airspace have different mixes of equipment. General aviation aircraft tend to be less well-equipped than commercial aircraft. There will be differences in the mix of general aviation/commercial aircraft from one location/airspace to another. Based on the aircraft equipment, a specific tactical system (e.g. FLARM, ACAS, etc.) could mitigate the risk of a collision in some classes of airspace and not in others.

Therefore, the UAS operator needs to understand the effectiveness of their tactical mitigation systems within the context of the airspace in which they intend to operate, and select systems used for tactical mitigation accordingly. A TCAS II 7.1/ACAS-II equipped UAS will not mitigate all the encounter risks in an area where sailplanes equipped with FLARM are known to operate.

D.5.4. TMPR robustness (integrity and assurance) assignment

Table D.3, below, lists the recommended requirements to comply with the TMPR integrity and assurance assignment.

Table D.3 — TMPR integrity and assurance objectives

D.6Maintenance and continued airworthiness

The DAA maintenance and continued airworthiness requirements are addressed in the SAIL requirements; please refer to Annex E.