SORA risk assessment

If operations are not The operator must conduct a SORA risk assessment for the operation if the operation cannot be adapted to Open category rules or conditions of a predefined risk assessment or a Standard Scenario (STS)

Commission Implementing Regulation (EU) 2019/947 article 11 deals with the specific category risk assessment procedure and is described in more detail in the Easy Access Rules document published by European Union Aviation Safety Agency EASA. 

The basis of the SORA procedure is to guarantee the same level of safety for the operation as in manned aviation. The SORA procedure consists of 10 different steps, which are described below.

1. Concept of Operations (CONOPS)

The first step of the SORA requires the applicant to collect and provide the relevant technical, operational and system information needed to assess the risk associated with the intended operation of the UAS. Annex A of EASA Easy Access Rules document provides a detailed framework for data collection and presentation. The ConOps description is the foundation for all other activities, and it should be as accurate and detailed as possible. The ConOps should not only describe the operation, but also provide insight into the UAS operator’s operational safety culture. It should also include how and when to interact with the Air Navigation Service Provider (ANSP). Therefore, when defining the ConOps, the UAS operator should give due consideration to all the steps, mitigations and Operational Safety Objectives (OSO). 

Developing the ConOps can be an iterative process and therefore, as the SORA process is applied, additional mitigations and limitations may be identified, requiring additional associated technical details, procedures, and other information to be provided or updated in the ConOps. This should culminate in a comprehensive ConOps that fully and accurately describes the proposed operation as envisioned.

The ConOps description can also be part of the UAS operator's Operations Manual (OM). Instructions for drawing up an Operations Manual can be found here .

2. Determination of the intrinsic UAS ground risk class (GRC)

The intrinsic UAS ground risk relates to the risk of a person being struck by the UAS (e.g. in the case of a loss of UAS control). To establish the intrinsic GRC, the applicant needs the maximum UA characteristic dimension (e.g. the wingspan for a fixed-wing UAS, the blade diameter for rotorcraft, the maximum dimension for multi-copters, etc.) and the knowledge of the intended operational scenario. The applicant needs to have defined the area at risk when conducting the operation (also called the ‘area of operation’) including:

1. the operational volume, which is composed of the flight geography and the contingency volume. To determine the operational volume, the applicant should consider the position-keeping capabilities of the UAS in 4D space (latitude, longitude, height and time). In particular, the accuracy of the navigation solution, the flight technical error of the UAS and the path definition error (e.g. map errors), and latencies should be considered and addressed in this determination 
2. whether or not the area is a controlled ground area and 
3. the associated ground risk buffer with at least a 1:1 rule, or for rotary wing UA, defined using a ballistic methodology approach acceptable to the competent authority.

Table below illustrates how to determine the intrinsic ground risk class (GRC). The intrinsic GRC is found at the intersection of the applicable operational scenario and the maximum UA characteristic dimension that drives the UAS lethal area:

The operational scenarios describe an attempt to provide discrete categorisations of operations with increasing numbers of people at risk. 

Extended Visual Line of Sight (EVLOS) operations are to be considered to be BVLOS for the intrinsic GRC determination. Controlled ground area is a way to strategically mitigate the risk on ground. It means that the UAS operator should ensure, through appropriate procedures, that no uninvolved person is in the area of operation

An operation occurring in a populated environment cannot be intrinsically classified as being in a sparsely populated environment, even in cases where the footprint of the operation is completely within special risk areas (e.g. rivers, railways, and industrial estates). The applicant can make the claim for a lower density and/or shelter with Step #3 of the SORA process.

Operations that do not have a corresponding intrinsic GRC on the table are not supported by the SORA methodology and can not be conducted in the 'specific' category.

When evaluating the typical kinetic energy expected for a given operation, the applicant should generally use the airspeed, in particular cruise speed for fixed wing aircraft and the terminal velocity for rotorcraft.

3. Final Ground Risk Class (GRC) determination

In case of a loss of control of the operation, the intrinsic risk of a person being struck by the UAS can be controlled and reduced by means of mitigation. The mitigations used to modify the intrinsic GRC have a direct effect on the safety objectives associated with a particular operation, and therefore it is important to ensure their robustness. The final GRC determination is based on the availability of these mitigations to the operation. The mitigations are divided into three types according to the table below, which provides a list of potential mitigations and the associated relative correction factor. A positive number denotes an increase in the GRC, while a negative number results in a decrease in the GRC. All the mitigations should be applied in numeric sequence to perform the assessment.

When applying mitigation M1, the GRC cannot be reduced to a value lower than the lowest value in the applicable column in table above. This is because it is not possible to reduce the number of people at risk below that of a controlled area.

If the final GRC is greater than 7, the operation is not supported by the SORA process and shall be conducted in the 'certified' category.

In general, a quantitative approach to mitigation means allows to reduce the intrinsic GRC by 1 point if the mitigation means reduce the risk of the operation by a factor of approximately 10 (90 % reduction) compared to the risk that is assessed before the mitigation means are applied. More information can be found on EASA Easy Access Rules Annex B to AMC1 to Article 11 (External link).

The air risk process overview

The SORA uses the operational airspace defined in the ConOps as the baseline to evaluate the intrinsic risk of a mid-air collision, and by determining the air risk category (ARC). The ARC may be modified/lowered by applying strategic and tactical mitigation means. The application of strategic mitigations may lower the ARC level. An example of strategic mitigations to reduce the risk of a collision may be by operating during certain time periods or within certain boundaries. After applying the strategic mitigations, any residual risk of a mid-air collision is addressed by means of tactical mitigations.

Tactical mitigations take the form of detect and avoid (DAA) systems or alternate means, such as ADS-B, FLARM, U-space services or operational procedures. Depending on the residual risk of a mid-air collision, the tactical mitigation performance requirements (TMPR) may vary.

As part of the SORA process, the UAS operator should cooperate with the relevant service provider for the airspace (e.g. the ANSP or U-space service provider (USSP)) and obtain the necessary authorisations. Additionally, generic local authorisations or local procedures allowing access to a certain portion of controlled airspace may be used if available.

Irrespective of the results of the risk assessment, the UAS operator should pay particular attention to all the features that may increase the detectability of the UA in the airspace. Therefore, technical solutions that improve the electronic conspicuousness or detectability of the UAS are recommended.

4. Determination of the initial air risk class (ARC)

The competent authority (in Finland Traficom), ANSP, or U-space service provider, may elect to directly map the airspace collision risks using airspace characterisation studies. These maps would directly show the initial ARC for a particular volume of airspace. If the competent authority, ANSP, or U-space service provides an air collision risk map (static or dynamic), the applicant should use that service to determine the initial ARC, and  go directly to step #5 ‘Application of strategic mitigations’ to reduce the initial ARC.

The ARC flowchart below can be used to determine the initial air risk class

The ARC is a qualitative classification of the rate at which a UAS would encounter a manned aircraft in typical generalised civil airspace. The ARC is an initial assignment of the aggregated collision risk for the airspace, before mitigations are applied. The actual collision risk of a specific local operational volume could be much different, and can be addressed with the application of strategic mitigations to reduce the ARC (this step is optional).

Although the static generalised risk put forward by the ARC is conservative, there may be situations where that conservative assessment may not suffice. It is important for both the competent authority and the UAS operator to take great care to understand the operational volume and under which circumstances the definitions in the ARC flowchart picture above could be invalidated. In some situations, the competent authority may raise the operational volume ARC to a level which is greater than that advocated by the ARC flowchart picture. The ANSP should be consulted to ensure that the assumptions related to the operational volume are accurate.

• ARC-a is generally defined as airspace where the risk of a collision between a UAS and a manned aircraft is acceptable without the addition of any tactical mitigation.
• ARC-b, ARC-c, ARC-d generally define volumes of airspace with increasing risk of a collision between a UAS and a manned aircraft.

During the UAS operation, the operational volume may span many different airspace environments. The applicant needs to perform an air risk assessment for the entire range of the operational volume.

5. Application of strategic mitigations to determine the residual ARC (optional)

As stated before, the ARC is a generalised qualitative classification of the rate at which a UAS would encounter a manned aircraft in the specific airspace environment. However, it is recognised that the UAS operational volume may have a different collision risk from the one that the generalised initial ARC assigned. If an applicant considers that the generalised initial ARC assigned is too high for the condition in the local operational volume, then they should refer to Annex C of the EASA Easy Access Rules AMC to Article 11 (External link) for the ARC reduction process. If the applicant considers that the generalised initial ARC assignment is correct for the condition in the local operational volume, then that ARC becomes the residual ARC.

6. Tactical Mitigation Performance Requirements (TMPR) and robustness levels

Tactical mitigations are applied to mitigate any residual risk of a mid-air collision that is needed to achieve the applicable airspace safety objective. Tactical mitigations will take the form of either ‘see and avoid’ (i.e. operations under VLOS), or they may require a system which provides an alternate means of achieving the applicable airspace safety objective (operation using a DAA, or multiple DAA systems). Annex D of the EASA Easy Access Rules AMC to Article 11 (External link) provides the method for applying tactical mitigations.

Operations under VLOS/EVLOS

VLOS is considered to be an acceptable tactical mitigation for collision risk for all ARC levels. Notwithstanding the above, the UAS operator is advised to consider additional means to increase the situational awareness with regard to air traffic operating in the vicinity of the operational volume.

Operational UAS flights under VLOS do not need to meet the TMPR, nor the TMPR robustness requirements. In the case of multiple segments of the flight, those segments conducted under VLOS do not have to meet the TMPR, nor the TMPR robustness requirements, whereas those conducted under BVLOS do need to meet the TMPR and the TMPR robustness requirements.

In general, all VLOS requirements are applicable to EVLOS. EVLOS may have additional requirements over and above those of VLOS. The EVLOS verification and communication latency between the remote pilot and the observers should be less than 15 seconds.

Notwithstanding the above, the applicant should have a documented VLOS de-confliction scheme, in which the applicant explains which methods will be used for detection, and defines the associated criteria applied for the decision to avoid incoming traffic. If the remote pilot relies on detection by observers, the use of phraseology will have to be described as well.

For VLOS operations, it is assumed that an observer is not able to detect traffic beyond 2 NM. However, the 2 NM range is not a fixed value and it may largely depend on the atmospheric conditions, aircraft size, geometry, closing rate, etc.. Therefore, the UAS operator may have to adjust the operation and/or the procedures accordingly.

Operations under a DAA system — TMPR

For operations other than VLOS, the applicant will use the residual ARC and the table below to determine the TMPR.

High TMPR (ARC-d): This is airspace where either the manned aircraft encounter rate is high, and/or the available strategic mitigations are low. Therefore, the resulting residual collision risk is high, and the TMPR is also high. In this airspace, the UAS may be operating in integrated airspace and will have to comply with the operating rules and procedures applicable to that airspace, without reducing the existing capacity, decreasing safety, negatively impacting current operations with manned aircraft, or increasing the risk to airspace users or persons and property on the ground. This is no different from the requirements for the integration of comparable new and novel technologies in manned aviation. The performance levels of those tactical mitigations and/or the required variety of tactical mitigations are generally higher than for the other ARCs. If operations in this airspace are conducted more routinely, the competent authority is expected to require the UAS operator to comply with the recognised DAA system standards (e.g. those developed by RTCA SC-228).

Medium TMPR  (ARC-c): A medium TMPR will be required for operations in airspace where the chance of encountering manned aircraft is reasonable, and/or the strategic mitigations available are medium. Operations with a medium TMPR will likely be supported by the systems currently used in aviation to aid the remote pilot in the detection of other manned aircraft, or by systems designed to support aviation that are built to a corresponding level of robustness. Traffic avoidance manoeuvres could be more advanced than for a low TMPR.

Low TMPR (ARC-b): A low TMPR will be required for operations in airspace where the probability of encountering another manned aircraft is low, but not negligible, and/or where strategic mitigations address most of the risk, and the resulting residual collision risk is low. Operations with a low TMPR are supported by technology that is designed to aid the remote pilot in detecting other traffic, but which may be built to lower standards. For example, for operations below 120 m, the traffic avoidance manoeuvres are expected to mostly be based on a rapid descent to an altitude where manned aircraft are not expected to ever operate.

The traffic detection requirement for low TMPR is to detect at least 50% of all aircraft in the detection volume, e.g. by relying on one or more of the following:

• Use of web-based real time aircraft tracking services
• Use Low Cost ADS-B In or FLARM aircraft trackers
• Monitoring aeronautical radio communications

No TMPR requirement (ARC-a):This is airspace where the manned aircraft encounter rate is expected to be extremely low, and therefore there is no requirement for a TMPR. It is generally defined as airspace where the risk of a collision between a UAS and a manned aircraft is acceptable without the addition of any tactical mitigation. Operations in segregated airspace (D/R area) are also considered as ARC-a operations. 

Annex D of the EASA Easy Access Rules AMC to Article 11 (External link) provides more detailed description of the Tactical Mitigation Performance Requirements.

Consideration of additional airspace/operational requirements

Modifications to the initial and subsequent approvals may be required by the competent authority or the ANSP as safety and operational issues arise.

 UAS-operaattorin ja viranomaisen on tiedostettava, että ARC:t ovat törmäsyriskin yleinen laadullinen luokitus. The UAS operator and the competent authority need to be cognisant that the ARCs are a generalised qualitative classification of the collision risk. Local circumstances could invalidate the aircraft density assumptions of the SORA, for example, due to special events.

Operations in controlled airspace, an airport/heliport environment or a Mode-C Veil/transponder mandatory zone (TMZ) will likely require prior approval from the ANSP. 

7. Final assignment of specific assurance and integrity level (SAIL) and Perational Safety Objectives (OSO)

The SAIL parameter consolidates the ground and air risk analyses, and drives the required activities. The SAIL represents the level of confidence that the UAS operation will remain under control. After determining the final GRC and the residual ARC, it is then possible to derive the SAIL associated with the proposed ConOps.

The SAIL is not quantitative, but instead corresponds to:

• the OSO to be complied with
• the description of the activities that might support compliance with those OSO's
• the evidence that indicates that the objectives have been satisfied.

 The SAIL assigned to a particular ConOps is determined using the table below:

8. Identification of the operational safety objectives (OSO)

The last step of the SORA process is to use the SAIL to evaluate the defences within the operation in the form of OSOs, and to determine the associated level of robustness. The table below provides a qualitative methodology to make this determination. In this table, O is optional, L is recommended with low robustness, M is recommended with medium robustness, and H is recommended with high robustness. The various OSOs are grouped based on the threat they help to mitigate; hence, some OSOs may be repeated in the table.

9. Adjacent area and airspace considerations

The objective of this section is to address the risk posed by a loss of control of the operation, resulting in an infringement of the adjacent areas on the ground and/or adjacent airspace. These areas may vary with different flight phases.

Safety requirements for containment are:

No probable failure of the UAS or any external system supporting the operation should lead to operation outside the operational volume.

• Compliance with the requirement above shall be substantiated by a design and installation appraisal and shall include at least:

1. the design and installation features (independence, separation and redundancy)
2. any relevant particular risk (e.g. hail, ice, snow, electro-magnetic interference, etc.) associated with the ConOps).

The enhanced containment, which consists in the following three safety requirements, applies to operations conducted:

• where the adjacent areas contain assemblies of people unless the UAS is already approved for operations over assemblies of people; or
• where the adjacent areas are ARC-d unless the residual ARC of the airspace area intended to be flown within the operational volume is already ARC-d
• where the operational volume is in a populated area where M1 mitigation has been applied to lower the GRC; or
• where the operational volume is in a populated area where operating in a controlled ground area

The UAS is designed to standards that are considered adequate by the competent authority and/or in accordance with a means of compliance that is acceptable to that authority such that:

• the probability of the UA leaving the operational volume should be less than 10^-4 per flight hour; and
• no single failure of the UAS or any external system supporting the operation should lead to its operation outside the ground risk buffer
• Compliance with the requirements above should be substantiated by analysis and/or test data with supporting evidence.

Software (SW) and airborne electronic hardware (AEH) whose development errors could directly lead to operations outside the ground risk buffer should be developed to an industry standard or methodology that is recognised as being adequate by the competent authority.

As it is not possible to anticipate all local situations, the UAS operator, the competent authority and the ANSP should use sound judgement with regard to the definition of the ‘adjacent airspace’ as well as the ‘adjacent areas’. 

10. Comprehensive safety portfolio

The SORA process provides the applicant, the competent authority and the ANSP with a methodology which includes a series of mitigations and safety objectives to be considered to ensure an adequate level of confidence that the operation can be safely conducted. These are:

1. mitigations used to modify the intrinsic GRC
2. strategic mitigations for the initial ARC
3. tactical mitigations for the residual ARC
4. adjacent area/airspace considerations
5. Operational Safety Objectives (OSO)

The satisfactory substantiation of the mitigations and objectives required by the SORA process provides a sufficient level of confidence that the proposed operation can be safely conducted.

The UAS operator should be sure to address any additional requirements that were not identified by the SORA process (e.g. for security, environmental protection, etc.) and identify the relevant stakeholders (e.g. environmental protection agencies, national security bodies, etc.). The activities performed within the SORA process will likely address those additional needs, but they may not be considered to be sufficient at all times.

The UAS operator should ensure the consistency between the SORA safety case and the actual operational conditions (i.e. at the time of the flight)