Annex F SORA Ground Risk Class Justification

By: Quantitative Methods Group in WG 6 Table of Contents 1 Introduction 3

1.1 Scope 3 1.2 Basis for Ground Risk Assessment in the SORA 4 1.3 Critical Area and the iGRC 8 1.4 Finalised iGRC Table 9

2 Intrinsic Ground Risk 11 2.1 Overview of iGRC Design 11 2.2 iGRC and Critical Area Calculations 12

2.2.1 Intrinsic Ground Risk Calculations 12 2.2.2 Critical Area Calculations 17

2.3 Key Considerations for Population Density Area in iGRC Table 20 2.3.1 Determination of Population Density 20 2.3.2 Non-uniform population density 21

3 Mitigations 22 3.1 Overview of Available Mitigations 22

3.1.1 The effect of system reliability on the capability of a mitigation 23 3.1.2 List of Common Mitigation Arguments 23

3.1.2.1 Time Spent Outside - Exposed Population 24 3.1.2.2 Visual Line of Sight (VLOS) 24

3.3 M1 - Reduction of the Number of People at Risk \label{Sect:M1} 25 3.3.1 Criterion 1 - Definition of the Ground Risk Buffer 25 3.3.2 Criterion 2 - Evaluation of People at Risk 26

3.4 M2 - Effects of ground impact are reduced 26 3.4.1 Criterion 1 - Technical Design 27 3.4.2 Criterion 2 - Procedures (if applicable) 27 3.4.3 Criterion 3 - Training (if applicable) 27

3.5 M3 - Emergency Response Plan 28 3.6 Summary of Mitigation Reductions 28

3.7 Additional Mitigation Opportunities using JARUS Model 29 3.7.1 Optional JARUS Model Trade-offs 29 3.7.2 HALE Operations 29

4 Demonstration of SAIL Objectives 30

Appendix A - Critical Area to Wingspan and Speed Calculations \label{Append_A) 31 A.1 Addition of Velocity Constraints in the Column Headers 32 A.2 Determining appropriate values for the iGRC table 32

A.2.1 Impact angle and speed 32 A.2.2 Descent Scenarios 33

A.3 Critical Area Model Parameters 34 A.3.2 Ratio of Glide to Cruise Speed 34 A.3.3 Coefficient of Restitution 35 A.3.4 Coefficient of Friction 35 A.3.5 Ballistic Descent Calculations \label{sec:ballistic_descent} 36

A.4 Mapping Impact Speed and Impact Angle \label{sec:mapping_speed_angle} 38 A.4.1 Speed and angle relation for fixed critical area 38 A.4.2 iGRC Cruise Speed Limit Calculations 39

A.5 Special Cases 39 A.5.1 The First iGRC column (UAS characteristic dimension <1m) 39 A.5.2 Obstacles stopping an aircraft 41

A.5.2.1 Density of obstacles \label{App_A.Obstacles} 41 A.6. Creating the Final iGRC Table 43

A.6.1 Introduction 43 A.6.1 Expanded iGRC Table Development 43

Appendix C: Impact models \label{app:models} 50

Appendix D - CasEx Package \label{app:casex} 61

1 Introduction

1.1 Scope

Annex F supports the Joint Authorities for Rulemaking of Unmanned Systems (JARUS), Specific Operations Risk Assessment (SORA). Specifically, Annex F provides the principles, calculations and assumptions used in the SORA ground assessment process (i.e. Steps #2 and #3). The assessment of ground risk model is to provide authorities and applicants with appropriate information to assess risk to third parties on the ground. The intent of this annex is to substantiate that the ground risk is mitigated to an acceptable level of safety, commensurate with manned aviation.

The ground risk assessment process has two parts; the determination of the initial risk and the associated intrinsic ground risk class, and second the assessment of the applied mitigations to the initial risk to arrive at a final ground risk class. The intrinsic ground risk class (IGRC) (i.e. part 1) is designed to be a conservative first estimate for most UAS systems and operations assuming likely failure cases, the consequence of which is reasonably plausible. In the second part the applicant may choose to reduce the intrinsic risk class through the use of mitigations that demonstrate to the competent authority that the operation should be granted a reduction in risk categorization. The proposed mitigations need to either change the likelihood of the ground risk event, or the consequence of that event, or a combination thereof, of a ground impact compared to the intrinsic ground risk class assigned.

Given the above SORA ground risk process, this document supports that process by providing the details and mechanisms that support a deterministic ground risk assessment. The objective of SORA Annex F is to provide the competent authorities and operators:

● A mechanism to establish whether the actual risk of the operation is aligned with the nominal iGRC classification, by providing a more detailed analytical basis. In addition it provides a logical basis for lowering or increasing the classification in the event of misalignment.

● Quantitative traceability between the SORA Specific Assurance and Integrity Levels (SAIL) embedded within the Operational Safety Objectives (OSO) and how the technical characteristics of a platform and its associated CONOPS effect system failure probabilities, the associated risk of a ground collision.

● A quantitative framework that supports the assessment of the effect of population and platform characteristics on risk, and whether the proposed mitigations can realistically reduce it.

● A quantitative framework that supports the assessment of the effect of population and platform characteristics on risk, and whether the proposed mitigations can realistically reduce it.

This annex is broken into 5 sections that outline the analytic and quantitative approach behind the Ground Risk Assessment process and a set of justification supplements that support the calculations used within this Annex. The following provides the structure that leads to a more transparent substantiation of Ground risk detailed in the SORA Main body, and its linkages through to SAILs outlined in Annex B, and E.

● Section 1 - Provides the quantitative basis behind the SORA Ground Risk process with the intent to substantiate and validate the premises used within that process.

● Section 2 – Furthers section 1 by detailing the underlying principles of the iGRC, how it is calculated, and why the intrinsic ground risk matrix, fundamental to the main body of the SORA, is correct.

● Section 3 – Provides the theory behind the 3 ground risk mitigations found in the SORA. ● Section 4 – Outlines the expectations of the SAIL validation through demonstration of

reliability

● Appendix A - Justifies the addition of instantaneous velocity at impact to the iGRC table, providing better accuracy in the prediction of critical area

● Appendix B - Provides a mathematical basis and hence justification for the expected casualty calculation.

● Appendix C\ref{app:models} - Describes for mathematical basis used in the critical area models fundamental to the critical area calculation.

● Appendix D\ref{app:casex} - Description of the online casualty expectation calculator

All relevant assumptions and constraints are identified in the relevant sections throughout this annex.

1.2 Basis for Ground Risk Assessment in the SORA To quantitatively determine if an unmanned operation is acceptable, an acceptable level of safety needs to be defined. As described in Scoping Paper to AMC RPAS 1309 Issue 2 , the 1

Target Level of Safety (TLOS) for UAS ground risk need not exceed 10-6 fatalities per flight hour (or 1 fatality every 1 million flight hours). This is equivalent to the risk posed by general aviation to third parties on the ground and is calculated in the Scoping Paper using operational GA data of approximately 10-4 accidents per flight hour and 10-2 ground fatalities per GA accident for a total of 10-6 ground fatalities per flight hour. The GA risk number above is the risk to third parties on the ground and therefore does not take into account the risk to people on board the aircraft as they are not third parties on the ground.

1http://jarus-rpas.org/sites/jarus-rpas.org/files/jar_04_doc_2_scoping_papers_to_amc_rpas_1309_issue_2_0.pdf

Although the RPAS TLOS is consistent with manned aircraft ground risk, the assessment of risks/events that could compromise the TLOS may not be identical. As with all valid safety processes, after the TLOS is substantiated, the events and associated risks that could undermine that TLOS must be identified, quantified and sufficiently mitigated.

The SORA Ground Risk Target Level of Safety (TLOS) is calculated using the expected number of fatalities on the ground during per flight hour given the UAS operation. Where the contributing event is the UAS loss of control. The equation for the Expected number of fatalities is as follows:

xpected Number of Fatalities P (failure) ollisions(failure) (fatality|collision, failure) (Eqn. 1)E = × C × P Where:

● is the probability that the UAS fails into a loss of control state per flight hour.(failure)P ● is the expected number of people the UAS collides with during a lossollisions(failure)C

of control event ● is the conditional likelihood of the UAS causing a fatality with(fatality|collision, failure)P

an impacted person, on the condition that the aircraft has failed and has collided with an individual.

The derivation for this is expanded upon in Appendix B, using principles for expected casualty rate used in rocketry range risk analyses. It is emphasised that there is an implicit assumption that P(fatality|collision, failure) = 1 until demonstrated otherwise. This is considered conservative, as the SORA assessment assumes the severity of all injuries is such that it results in fatality. Accordingly, the term fatality is utilised here. We further decompose

to produce Equation 2 (See Appendix B for more detail) in the determinationollisions(failure)C of expected fatality rate per flight hour :)(EC

(failure) (fatality|collision, failure)EC = P × Dpop × F exp × AC × P Eqn. 2)(

Where:

● is the assumed population density within the ground risk footprint (see 2.1.1.1).Dpop ● is the fraction of exposed populationF exp ● is the critical area of the aircraft in a loss of control stateAC

As detailed in the JARUS Guidelines on SORA, specifically step #2, the ground risk process starts with an intrinsic Ground Risk Class assessment (iGRC) supported by the use of an iGRC matrix. Here, the operator establishes their iGRC value by finding the cell that corresponds with the intersection for the maximum population density they plan to overfly and a doublet of aircraft parameters: wingspan and cruise velocity.

The iGRC is an idealised metric providing a conservative starting point for the unmitigated ground risk that an operation poses to persons situated within the operational volume and ground risk buffer, on the condition that a failure has occurred (i.e. we assume that has occurred). It is assumed that all humans in any areas defined by a population density are uniformly distributed within that area and fully exposed to the risk (i.e. , P(failure) can occurF exposed = 1 2

equally anywhere in the ground risk footprint) and any contact between the aircraft and a person is fatal (i.e. ), unless otherwise stated (for example in section(fatality|collision, failure)P = 1 A.5.1, slide risk for < 1m platforms). Given these assumptions, the expected casualty equation in the event of a loss of control event reduces to :

(unmitigated ground risk) DEC = pop × AC Eqn. 3)(

The unmitigated EC value describes the number of people expected to be fatally injured by an aircraft given a loss of control state has occurred. It is calculated using the product of critical area, , and the population density, . This produces the iGRC value included in each cellAC Dpop of the iGRC matrix. With no further action, the iGRC becomes the final Ground Risk Class (GRC) and would be assigned a Specific Assurance and Integrity Level (SAIL), which relates to the maximum allowable probability of loss of control for an operation, or probability per flight hour that the operation will enter a failure or loss of control state, for that operation to still meet the TLOS. The higher the SAIL score, the less likely a loss of control event is expected to occur.

SAIL level I II III IV V VI

Expected Probability of loss of control PFH 10-1 10-2 10-3 10-4 10-5 10-6

Table 1 \label{tab:SAIL_risk}

Table 1 \ref{tab:SAIL_risk} details the mapping between different SAIL levels and the expected probability of a loss of control event .(failure)P

NOTE: The SAIL level is defined by taking the larger contributor of both the air and ground risk, however for the purposes of this Annex, only ground risk is considered. A higher SAIL level may be required due to a higher relevance of the air risk component.

2 For a discussion on methods to appropriately measure population density, please refer to section 2.3

While the SAIL objective is quantitative, each SAIL score corresponds with Operational Safety Objectives (OSO’s) which presently, are qualitative based on regulator and industry expertise. In essence, a higher SAIL score drives OSO’s detailing increased operational, organizational and system integrity and more expansive assurance. Currently, the SORA identifies three possibilities for reducing the iGRC score via ground risk mitigations. These are outlined in Step #3 of the SORA process, and include:

● M1: reducing the number of people at risk on the ground ● M2: reducing the effect of the ground impact ● M3: reducing the secondary effects of the ground impact via an emergency response

plan. Unless the applicant presents suitable evidence to the competent authority substantiating one or more of the three mitigations, the default classification remains the iGRC value. This conservatively ensures the TLOS (1 10-6 fatalities per flight hour) is maintained. Otherwise the× iGRC value is mediated by the mitigations and the result is the “final” ground risk class (GRC). Figure 1\ref{fig:TLOS_to_lethality} illustrates how the different aspects of the SORA Ground Risk process apply to the expected number of fatalities (Eqn. 1).

Figure 1

\label{fig:TLOS_to_lethality}

Since it may be impractical for many operations to determine the actual probability of failure, , with system level testing or operational data, the qualitative Specific Assurance and(failure)P

Integrity Level (SAIL) system has been developed by JARUS to superimpose increasingly more rigorous Operational Safety Objectives (OSOs) commensurate with increasing risk, as a means of ensuring levels of design, maintenance and operational procedures are appropriate for the risk posed by the operation. It is assumed that as the SAIL level increases, the expected probability of failure decreases due to the increased robustness of the OSO’s. Section 4 describes guidelines for gathering testing data to support calculations.(failure)P

1.3 Critical Area and the iGRC The iGRC value is a continuous function that exists for all positive population densities and critical area combinations. From the framework linking TLOS, system failure rates and SAIL scores, it is shown in 2.2.1 that a “raw” iGRC score can be calculated according to the following relationships:

raw" iGRC 1 " = − 1og10 ( 1×10−6

Dpop×AC ) Eqn. 4)(

Figure 2 3

3 It's important to note that the units for the area in the population density and critical area should be the same. In order for there to be consistent objectives for manufacturers and operators to design around and regulators to enforce, only integer iGRC values are employed. This is achieved by rounding the “raw” iGRC up to the nearest integer value.

\label{fig:CA_vs_pop_dens}

The result of the combined application of Equation 4 and the rounding process is depicted in Figure 2:\ref{fig:CA_vs_pop_dens} . In principle, the iGRC table could be extended to encompass larger critical areas or more populous areas. However these combinations are likely to produce iGRC values that are too high to reasonably warrant that platform or operation being conducted under the auspices of the specific category. It is expected that operations associated with this level of iGRC would require certification of the aircraft system, people and organisations due to the extremely low maximum allowable required to meet the(failure)P target level of safety.

1.4 Finalised iGRC Table

Intrinsic Ground Class Value

Maximum UAS Characteristic Dimension 1 m 3 m 8 m 20 m > 20 m

Max cruise speed 25 m/s 35 m/s 75 m/s 150 m/s 200 m/s

Max population density (ppl/km2)

Controlled 1 2 3 4 5

<10 3 4 5 6 7

< 100 4 5 6 7 8

< 1,500 5 6 7 8 9

<15,000 6 7 8 9 10

<100,000 7 8 9 10 11

≥ 100,000 7* 4 Not part of SORA

Table 2 \label{tab:iGRC_finale}

4In Table 2, 7* is associated with an unmitigated $E_C$ value of 10 fatalities. The original iGRC value was 8. However, when aircraft size and speed were determined, it was deemed unrealistic that a UAS with a Wingspan < 1m and maximum cruise velocity < 25 m/s could cause this many casualties. It is reasonable to assume that an aircraft with those characteristics would no longer be lethal after the first impact with a person, thus the expected number of fatalities was reduced back down to 1, which reduced the iGRC value from an 8 to a 7, equivalent to the row above it.

Table 2 \ref{tab:iGRC_finale} is the finalised iGRC table for V2.X of SORA Main Body and Annex F. A substantial body of work has been undertaken to produce the updated matrix, with the detail to be expanded upon in the remainder of the document. The key features and changes embedded within the table include:

1. Supplementing UAS Wingspan with Cruise velocity, 2. Replacing the qualitative descriptors for population densities with quantitative bands, 3. The removal of VLOS operations from the table, but where operators can claim a minus

1 for VLOS operations as the VLOS mitigation 4. Significantly more detailed guidance is provided on available mitigations to reduce the

iGRC scores in Table 2. To explain these changes, Section 2 provides a high level summary of the role $A_C$ and population density played in motivating these changes, before expanding on the key dependencies between TLOS, SAIL scores and OSOs on system failure rates, population density and Critical Area ($A_C$). Section 3 subsequently elaborates on the available mitigations with more support information for their determination.

2 Intrinsic Ground Risk

2.1 Overview of iGRC Design A key design aspiration for the iGRC design was simplicity without compromising safety and this principle pervades many of the decisions made to arrive at the iGRC table. This is immediately challenged by $A_C$, because there are a number of performance and dimensional characteristics for any particular UAS impact including: speed, wingspan, impact dynamics, friction of the surface at impact, the impact angle and even potential obstacles. The contribution each of these variables and their potentially complex interdependencies make to the ultimate $A_C$ value difficult to compute, so in the interest of simplicity, details involved with $A_C$ calculation are deferred to Appendix A. To further support our design intent, recognition is required that data for many of the identified parameters required in $A_C$ is not consistently available for many drone systems. This means that exhaustive validation of the mathematical calculations outlined in Appendix A was not always possible or practical and judgements were made. Given this, and to maximise simplicity and support the standardization of process for operators and regulatory authorities, easily measurable aircraft parameters were selected to act as a proxy for $A_C$. Intuitively, the parameter/s selected to act as a proxy for $A_C$ should deliver the highest classification accuracy in predicting the real value for $A_C$, ultimately as assurance that a poor predictor doesn’t allow grossly unsafe operations to proceed. In SORA V 2.0 the chosen proxy was wingspan, with guidance also given for Kinetic Energy ranges. However, SORA V 2.0 did not explicitly employ $A_C$ in determining SAIL values, nor link it to maintaining a comparative TLOS with manned platforms. And importantly, wingspan alone was not always the most accurate predictor for $A_C$. The need for improved assurance over the predictive capabilities of the metrics used to predict $A_C$ motivated the Quantitative Method (QM) team to isolate the sensitivity of $A_C$ to each of the key variables required for its calculations. That effort included a selection of contemporary pattern classification techniques to isolate which individual parameters or parameter combinations delivered the best performance in predicting $A_C$. This effort ultimately identified a need to include both wingspan and cruise velocity, instead of kinetic energy, as proxies for $A_C$ and inclusion in the final iGRC table. The addition of velocity to more accurately predict the correct $A_C$ provides two key benefits. First, operators are less likely to be placed in an inappropriate risk class, reducing unwarranted compliance costs when this placement is higher than it should be, and reducing the safety implications when it was lower.

Scrutiny of Table \ref{\label{tab:iGRC_finale} highlights that the table does not indicate what $A_C$ values were used in each of the columns. For the 1, 3, 8, 20 and >20 metre Wingspan categories, nominal categories of 20, 200, 2,000, 20,000 and 200,000 m2 were used respectively. This starting point was arrived at after analysing common platform wingspan/velocity combinations and attempting to ensure the iGRC table represented the largest portion of aircraft possible using basic critical area calculations. It is recognised by the working group that these critical area values are high, and calculated using conservative values. For example, it is assumed that nothing impedes the progress of the platform during its glide and skid prior to impact with humans. Compounding this conservatism is a low value for the dynamic coefficient of friction (0.5) leading to a model that effectively treats the overflown area as an infinite flat plane with no imperfections (a poor reflection of reality). As detailed in Appendix A.6, whenever the difference between the raw iGRC score and the lower iGRC integer value was 0.3 or less, the score was rounded down. Otherwise it was rounded up. An applicant or competent authority dealing with an M2 argument should revert to the full equations for the derivation of the critical area, to ensure consistency with the true iGRC score. Our research efforts revealed that in particular, at population densities > 1500 people per square km, obstacles in the form of trees, light-posts, fences, and houses act to significantly reduce the critical area. Accordingly, the finalised table also incorporates compensation for obstacles, with Appendix A providing further details. Finally, the iGRC table no longer includes rows associated with VLOS operations. This change acknowledges the fact that there is no inherent difference between unmitigated VLOS and BVLOS operations. However, it is recognized that most of the time there are aspects of VLOS operations that act as mitigations and serve to reduce the likelihood of fatalities. Accordingly, VLOS operations are classified as a mitigation option, with Section 3.4 providing detail on the criteria to gain credit for this mitigation.

2.2 iGRC and Critical Area Calculations

2.2.1 Intrinsic Ground Risk Calculations The framework provided in Section 1, briefly outlined the variables to be considered in maintaining the TLOS at 1 10-6 fatalities per flight hour, highlighting linkages between SAIL× scores, OSO’s and system failure rates, and their dependency on knowledge of population density and $A_C$. This section provides expanded detail on those linkages, specifically demonstrating how the Target Level of Safety for SORA operations is maintained, and embedded within the structure of the iGRC table. To support that intent, Tables 3-6 provide step by step guidance on how the doublet of population density and $A_C$ is ultimately mapped to iGRC and SAIL scores. It is emphasised that these tables are idealised models only, provided to demonstrate the linkage between the

Target Level of Safety, the Operational Safety Objectives, the SAIL and the iGRC from first principles. The first step in that process commences with Table 3 \ref{tab:unmitigated_casex}, which illustrates the unmitigated casualty expectation per event, as a function of critical area and population density, using the nominal $A_C$ values alluded to in Section 2.2 (20,200,2000, 20000, 200000).

Unmitigated Casualty Expectation (persons killed per loss of control event)

Max critical area [m^2]

20 200 2,000 20,000 200,000

Max population density

(ppl/km2)

< 0.05 0.000001 0.00001 0.0001 0.001 0.01

< 0.5 0.00001 0.0001 0.001 0.01 0.1

< 5 0.0001 0.001 0.01 0.1 1

< 50 0.001 0.01 0.1 1 10

< 500 0.01 0.1 1 10 100

< 5,000 0.1 1 10 100 1,000

< 50,000 1 10 100 1,000 10,000

< 500,000 10 Not part of SORA

Table 3 \label{tab:unmitigated_casex}

It is highlighted that the inclusion of the row with a population density of 0.05 people per square kilometer (rather than zero) is to minimize computational errors associated with division by zero. The term “controlled” ground area will be substituted for this value in subsequent tables. The cell values associated with each population and $A_C$ permutation represent the number of expected casualties per failure event (given the assumptions provided earlier). It can be seen that there are cell values (highlighted in red) where one or more persons are expected to be killed given a failure event has occurred. To derive a maximum allowable probability of total system failure, , or loss of control(failure)P event (per flight hour), the following relationships are used:

LOS P (failure)×T ≤ Dpop × AC Eqn. 5)( \label{Eqn-TLOS-Pop-AC}

P (failure) ≤ TLOS

D ×Apop C Eqn. 6)(

Given the defined expectation for a TLOS of less than 1 10-6 fatalities per flight hour,×

is given by:(failure)P P (failure) ≤ 1×10−6

D ×Apop CEqn. 7)(

This can be used to populate Table \ref{tab:max_allowed_p_failure} below with (failure)Pvalues given population and critical area.

Maximum allowable P(failure) per flight hour

Max critical area [m^2]

20 200 2,000 20,000 200,000

Max population density

(ppl/km2)

< 0.05 100 10−1 10−2 10−3 10−4

< 0.5 10−1 10−2 10−3 10−4 10−5

< 5 10−2 10−3 10−4 10−5 10−6

< 50 10−3 10−4 10−5 10−6 10−7

< 500 10−4 10−5 10−6 10−7 10−8

< 5,000 10−5 10−6 10−7 10−8 10−9

< 50,000 10−6 10−7 10−8 10−9 10−10

< 500,000 10−7 Not part of SORA

Table 4 \label{tab:max_allowed_p_failure}

By taking advantage of the mapping between P(Failure) and SAIL provided in Table {tab:SAIL_risk}, the values the probability for a loss of control in Table 4 \ref{tab:max_allowed_p_failure}, can subsequently be mapped to the SAIL level detailed Table 5\ref{tab:SAIL_risk}

SAIL Value

Max critical area [m^2]

20 200 2,000 20,000 200,000

Max population density

(ppl/km2)

< 0.05 0* 5 I II III IV

< 0.5 I II III IV V

< 5 II III IV V VI

< 50 III IV V VI VII**

< 500 IV V VI VII** VIII**

< 5,000 V VI VII** VIII** IX**

< 50,000 VI VII ** 6 VIII** IX** X**

< 500,000 VII** Not part of SORA

Table 5 \label{tab:iGRC_SAIL_value}

An iGRC class score is then created using the following metric:

ntrinsic Ground Risk Class (iGRC) AILI = S + 1 Eqn. 8)( 7

We can combine equations 7, 4 and Table 1 and solve for the “raw” (i.e. non integer) iGRC (equation 4):

raw" iGRC 1 " = − 1og10 ( 1×10−6

Dpop×AC )

Substituting in the iGRC values and labelling the controlled ground area, Table 6 \ref{tab:iGRC_raw} depicts a nominal iGRC table which could be deployed for use in Step #2 of the SORA.

5 * There is no SAIL level less than SAIL I, this is representative only. 6 ** There is no SAIL level greater than SAIL VI, this is representative only 7 The SAIL value used in \eqref{Eqn7} and depicted in Figure \label{tab:iGRC_SAIL_value} is prior to the application of any mitigation, and before considering the air risk. It is only intended to show the relation between ground risk and the concept discussed in Section \ref{sec:SAIL_level} and shown in Table \ref\label{tab:SAIL_risk}.

Intrinsic Ground Class Value

Max critical area [m^2]

20 200 2,000 20,000 200,000

Max population density

(ppl/km2)

Controlled 1 2 3 4 5

< 0.5 2 3 4 5 6

< 5 3 4 5 6 7

< 50 4 5 6 7 8

< 500 5 6 7 8 9

< 5,000 6 7 8 9 10

< 50,000 7 8 9 10 11

< 500,000 8 Not part of SORA

Table 6 \label{tab:iGRC_raw}

It is important to note that the actual iGRC incorporated in the Main Body of the SORA, is that detailed in Table 2 \ref{tab:iGRC_finale} which is replicated below for convenience in Table 7 \ref{\label{tab:iGRC_finale_duplicate}. The differences between Table 6 and 7 arise because further refinements to Table 6 are necessary to cater for:

● 1m platforms are expected to have insufficient size, kinetic energy and momentum to be lethal to more than one person in the critical area

● Higher population areas coincide with more obstacles, which are expected to impede the path of small and mid-sized aircraft. Our modelling established that even a conservative number of obstacles produced smaller average critical areas then those shown in Table 3-6 (20, 200, 2000 etc)l

○ No decrease in critical area was assumed for the > 20m column as the aircraft are as large or larger than many of the expected obstacles. For consistency in the population bands across the table, the critical area of this column was reduced from 200,000 to 66,000 m^2, requiring a decrease of maximum speed.

● It is not practical to measure population density for some of the lower bands (0.5, 5, 50) ● To avoid decimal iGRC scores, given the conservatiness of many of the assumptions,

which compound on each other, any iGRC score which was above the current score by 0.3 or less was rounded down. The rest were rounded up.

Intrinsic Ground Class Value

Maximum UAS Characteristic

Dimension 1 m 8 3 m 8 m 20 m > 20 m

Max cruise speed 25 m/s 35 m/s 75 m/s 150 m/s 200 m/s

Max population

density (ppl/km2)

Controlled 1 2 3 4 5

<10 3 4 5 6 7

< 100 4 5 6 7 8

< 1,500 5 6 7 8 9

<15,000 6 7 8 9 10

<100,000 7 8 9 10 11

≥ 100,000 7* Not part of SORA

Table 7 \label{tab:iGRC_finale_duplicate}

Appendix A.6 expands on the adjustments made between Table 6 and Tables 2 and 7. It should be noted that VLOS operations may result in a -1 credit on the iGRC score shown below as discussed in Section 3.1.2.2.

2.2.2 Critical Area Calculations The Critical Area (AC) is defined as the sum of all areas on the ground where a person standing would be expected to be impacted by the aircraft when it crashes, and thus the area in SORA where a fatality is expected to occur if a person were within it. The total critical area AC,total consists of two components:

AC, total = AC, inert + AC, explosion Eqn. 9)( Where:

● is the critical area from inert (non-explosive) debris.AC, inert ● is the critical area due to either explosion (shock wave) or deflagrationAC, explosion

(thermal radiation).

8 * In the final matrix, it is assumed that a sUAS with limited velocity in column 1 will not have enough energy to fatally harm more than 1 individual and so this gets adjusted down

This high level decomposition has high consensus across the diverse array of studies considered including:

● RCC model [5, p. D-4] \cite[p.\ D-4]{RangeCommandersCouncil1999} ● RTI model [3, pp. 3-11, 53] \cite[p.\ 3-11, 53]{Montgomery1995} ● FAA model [2, pp. 99-103]\cite[p.\ 99-103]{FAA2011} ● NAWCAD model [7, pp. 11-47]\cite[p.\ 11-47]{Ball2012} ● Deflagration model [8, pp. 84-89] \cite[p.\ 84--89]{Hardwicke2009}

The relevant merits of each of the models considered in the literature review were used to inform the development of the JARUS Critical Area model, which was in turn used in the calculations for the iGRC table. In essence, the JARUS model is a combination of components from the RTI \cite{Montgomery1995} and the NAWCAD\cite{Ball2012} models. It uses the basic glide and slide areas as well as the coefficient of restitution from the RTI model, and employs the concept of reduced slide distance from the NAWCAD model. Figure 3 \ref{fig:glide_and_slide} consolidates many of these concepts, illustrating how they contribute to the overall AC. A summary of the key variables/concepts contributing to AC is provided to support understanding:

● The glide critical area is the area covered by the path of the aircraft at an altitude equal to or below the height of an average standing person (1.8m), but before it contacts the ground. For a steep dive, such as the end of a ballistic descent, this area can be very small, while for a shallow glide this area may have significant size.

● The slide occurs right after impact, until the aircraft is at rest. The slide may be short for a near ballistic descent and long for a shallow impact on a slippery surface (such as wet grass). The slide distance depends on the horizontal speed of the aircraft after impact and the friction between the aircraft and the ground. Slide does not include tumbling, bouncing, and break-up of the aircraft. It is represented by the long blue arrow as well as the dotted blue box of the same length as the arrow.

● Bounce or Ricochet - Aircraft becomes ballistically airborne again after impact. ● Splatter or Crating - Aircraft experiences structural disintegration on impact and transfers

its energy into ground deformation. ● Secondary Effects - Debris from the initial impact spreading over an area. ● Blade Throw - Rotor blades leaving a rotorcraft when rotor is spinning. ● Explosion and deflagration - The rapid combustion of fuel and its effects. The fuel

onboard the aircraft may ignite and cause an explosion. The explosion may occur at any location along the slide path, but is depicted here at the end for figure clarity.

● Each concept has dependencies on other concepts, it is not expected an aircraft will be able to do each of the above actions to their maximum extent in the same incident as there is only a set amount of initial energy to convert into each action.

Figure 3

\label{fig:glide_and_slide}

It is highlighted that: ● The width of the dashed box is equal to the wing span of the aircraft, while the length is

computed in various ways depending on the applied model (see below). ● Typically, a buffer is added all around the glide plus slide area that represents the size of

a person as seen from above, resulting in the solid blue box. ● Aircraft impacting the ground do not typically conserve all of their impact energy, and so

the subsequent slide/bounce/splatter has a reduced velocity component. This is captured via the Coefficient of Restitution, which has a value between 0 and 1.

● Note that while figure \ref{fig:glide_and_slide} depicts a fixed wing aircraft, the same model approach applies to other types of aircraft, including rotorcraft.

Expanded detail including equations for the JARUS model is provided in Appendix C \ref{sec:JARUS_models}, whilst an implementation of the models is available through the CasEx software packages (in both matlab and python) as described in Appendix \ref{app:casex}. In considering whether to incorporate weighted combinations of slide, bounce, and splatter to calculate AC, we note that in \cite{Ball2012} it was determined that choosing a single element was roughly equivalent, so slide, with the greater body of evidence was selected. While Appendix C contains details on the following, they have also been excluded from the JARUS model:

● Bounce and Splatter/Cratering ● Explosions ● Deflagration ● Blade Throw ● Secondary effects of ground collision such as debris scattering

If an operator or regulator believes that a different approach is warranted, the appropriate literature and models may be applied.

2.3 Key Considerations for Population Density Area in iGRC Table Given the availability of quantitative population density data as well as the different definitions used by different regulatory authorities, the iGRC table employs population density values rather than qualitative descriptors (i.e sparsely populated, populated, etc). Regulatory authorities have the discretion to link qualitative population density descriptions if desired. For the derivations in this annex, it is assumed that the aircraft has a uniform failure probability over the entire ground area inside the operational volume (flight geography, and containment volume) and ground risk buffer. It is also assumed that this volume has a uniform population density.

2.3.1 Determination of Population Density The generic requirement for any determination of overflown population density is that the estimate is derived with sufficient resolution for the risk posed and any mitigations applied. Given the imperfect nature of data, it is recommended that applicants and competent authorities adopt a conservative, yet credible approach, to ensure errors in the data do not result in a significant underestimate of the population density. Most universal data sources available to nations are municipality wide statistics of inhabitants combined with satellite image analysis estimation of built up areas. Examples of such data sources are Oak Ridge National Laboratories LandScan surveys [ ], European Commission's 9

Global Human Settlement Layer survey [ ] and ESRI World Population Density Estimate 2016 [10

]. Some countries have much more accurate grid census data of workplaces and inhabitants 11

up to even 100x100m resolution. Using these sources it should be possible to create quantitative population density maps of most countries in the world. However, the data sources limit national implementation accuracy where only satellite based estimation is available.

9 (https://landscan.ornl.gov/) 10 (https://ghsl.jrc.ec.europa.eu/) 11 (https://datascience.codata.org/articles/10.5334/dsj-2018-020/).

It should be noted that data sources missing information on the number of workplaces will be under estimating areas where workplaces outnumber inhabitants. This is common around city shopping streets, business parks and shopping malls.

2.3.2 Non-uniform population density If the population density varies within the operational volume or the ground risk buffer, the default assumption is to be conservative and use the upper limit, which is the highest population density in the ground area. Alternatively, the operator may seek to pursue a more refined approach using mitigation M1 and demonstrate to the competent authority that the descent scenarios for that particular aircraft can be controlled to ensure the impact location is at a lower population area, when a failure occurs. In the event this method is adopted, the robustness of the method must be commensurate with the higher risk level. Flight altitude and operational volume size also affect the reasonable size of area used to measure population density. For example a small area might be marked as 1,500 people/km^2 inside an operational volume where a UAS will spend 2 hours flying mostly above areas with less than 150 people/km^2 density, but shortly for 10 seconds fly over the 1,500 people/km^2 area. In these cases an authority should clearly set the limits to how and when an operator can use this weighted average argument to conclude that the area is still within the limits of an authorisation. Any cumulative risk (i.e. exposure time) based analysis should take into account the total cumulative risk. For example, say an applicant’s proposed flight profile results in 0.1 percent of the time operating over a densely populated environment, and 99.9 percent of the time operating over a controlled ground area. On face value this seems to imply that it would be appropriate for the competent authority to accept the small percentage of flight over the populated environment. However if the total, cumulative time the operation occurs over is 1 million hours, this means that the total time spent over a populated environment is 0.001✕1,000,000=1,000 hours. Any operation spending 1000 hours over a populated environment should have this particular flight stage separately assessed as an operation over a populated environment, and not ignored as a small percentage of the overall operation. Similarly, competent authorities may provide for concessions when the population density of the ground risk buffer exceeds that within the operational volume, provided if it can be demonstrated that the probability of impact into these areas is substantially less than other areas of the ground risk buffer (i.e. a population centre at the outer edge of a glide ratio buffer).

3 Mitigations

3.1 Overview of Available Mitigations Equation 2 for expected fatalities derived in Section 1.2 is provided for convenience below:

(failure) (fatality|collision, failure)EC = P × Dpop × F exp × AC × P \label{eq:E_C_expanded1}

As described previously, the intrinsic ground risk process makes assumptions such that \eqref{eq:E_C_expanded1} acts as a conservative starting point for the assessment of UAS operations. In particular the following conservative assumptions are made:

1. The percentage of exposed people is 100% (i.e. )F exposed = 1 2. Contact between the unmanned aircraft at any point and a person is fatal (i.e.

)*(fatality|collision, failure)P = 1 3. The critical area (AC) is based on generic, conservative assumptions related to an inert

aircraft gliding and sliding with no credit given to the design of the aircraft to reduce the impact speed or energy or increase the impact angle.

* NOTE: As will be detailed in Appendix A, an aircraft within the first column of the iGRC table is assumed to have no slide component of critical area, and does not follow the 2nd assumption stated above. An applicant cannot take advantage of a reduction in slide distance (using Mitigation 2) for this column, as this has already been assumed. The mitigation process in Step #3 of the SORA specifically targets the above assumptions of the intrinsic ground risk model and allows an applicant to demonstrate why these assumptions are not applicable to their aircraft or operation.The mitigations work by decreasing the iGRC value to a final GRC value. Each change of 1 in the GRC represents approximately an order of magnitude change in casualty expectation. For example, a decrease from an GRC score of 5 to 4 corresponds to a decrease in expected casualties on the ground by a factor of 10, or an order of magnitude (in this specific case, from 0.01 to 0.001). In reality many things do not come in neat multiples of 10 and the competent authority may determine that two orders of magnitude be granted to an applicant given a demonstrated 95% reduction in risk (as an example). The competent authority must understand the potential risk accepted by treating a partial order of magnitude as a full order of magnitude change in risk.

The iGRC can be reduced with three different types of mitigations. These mitigations are:

● M1: Reducing the number of people at risk on the ground with flight planning, analysis or inspection of the ground footprint’s true population at risk.

● M2: Reducing the effect of ground impact such that it can be shown to be less lethal and/or reduce the impact area.

● M3: Showing that an emergency response plan is able to significantly reduce escalating effects that would otherwise be fatal.

Mitigations have requirements for integrity and assurance which are jointly intended to achieve the required robustness to ensure that the mitigations can deliver the claimed reduction in risk. Integrity is the intended effectiveness of a mitigation and should provide matching strength to the different levels from Low to High and the GRC reduction value associated with it. It is understood that claiming the higher integrity level is lucrative to applicants, but the higher integrity level must be proven with more data and potentially competent third party approval (in high robustness cases) to validate the effectiveness of a ground risk mitigation.

3.1.1 The effect of system reliability on the capability of a mitigation When an applicant relies upon a system that is required to function correctly in order for a mitigation to be effective, the reliability of the system should be taken into consideration when determining the overall reduction in intrinsic ground risk. The expected value of all possible outcomes should be used to gauge the effectiveness of the Mitigation. Assuming that all identified outcomes are mutually exclusive and independent (i.e. if outcome i occurs, no other outcome can occur), we can write this mathematically as:

[O] (O ) (Eqn. 10)E = ∑

∀iP i × Oi

Where:

● is the expected value over all sets of possible outcomes[O]E ● is the probability that outcome i occurs(O )P i ● is the ith outcome. In the case of gauging the safety outcome, this would be theOi

relative to the mitigation being considered (i.e. for M2, this would be critical area and probability of fatality on impact for each outcome).

3.1.2 List of Common Mitigation Arguments These mitigation arguments are made so often that they are included in this section to minimize the effort of operators using the SORA method.

3.1.2.1 Time Spent Outside - Exposed Population A meta study of time-activity pattern studies shows that people generally spend less than 10% 12

of their time outside. This can be used as a M1 mitigation, resulting in a -1 reduction for UAS that are not able to penetrate buildings in an impact that are flying over populations that are expected to behave this way (for example, it would not be reasonable to assume this mitigation applied to flying over a beach during a hot summer day).

3.1.2.2 Visual Line of Sight (VLOS) Although there is no inherent difference in the ground risk between VLOS and BVLOS operations, it is recognized that the operator can take advantage of his direct sight of the aircraft, its immediate operating area and people in proximity, and take necessary action to better control the aircraft trajectory in a manner that reduces the number of people exposed prior to, during and after a failure situation. As with other mitigations, the aim is to reduce the probability of impacting people with approximately a factor 10. There are many ways this can be implemented, with the weight of each approach difficult to quantify. Here only a M1 mitigation of -1 is possible due to the low assurance level. Below are some examples of mitigations the operator may implement to obtain the minus 1 (-1):

● The aircraft has appropriate controllability in the event of a failure scenario and the operator has procedures to safely identify less populated areas and land the aircraft in these areas and/or increase the aircraft’s impact angle and/or reduce the impact speed. This is expected to reduce the critical area (for example, in the event of a motor failure, the operator could hard over the control surfaces and spin or stall the aircraft).

● The operator has the ability to identify less populated areas and can command the aircraft to fly over these areas.

● The operator has the ability to diagnosis failure conditions and can alert or notify people near the aircraft to exit the area before the aircraft were to impact the area

● The operator has clear sight of a majority of the flight area where the aircraft might crash in the event of a failure.

12 Diffey, B. (2010). An overview analysis of the time people spend outdoors. The British journal of dermatology. 164. 848-54. 10.1111/j.1365-2133.2010.10165.x.

3.3 M1 - Reduction of the Number of People at Risk \label{Sect:M1}

M1 mitigations are strategic mitigations (i.e. they are applied before an operation commences) that work by reducing the number of people at risk on the ground by demonstrating either that a reduced number of people are present in the ground footprint or that a sufficient amount of people in the area are sheltered, which has the effect of reducing the number of people at risk. Reduction of the intrinsic GRC requires fulfilling two criteria; criterion 1, definition of the ground risk buffer, and criterion 2, evaluation of people at risk. An applicant must comply with the robustness requirements from Annex B for both criteria to obtain the commensurate robustness for Mitigation 1. It is important to note that each reduction in risk is equivalent to showing that the number of people at risk has been reduced by approximately an order of magnitude because this is equal to the GRC reduction being claimed. That is, claiming a -1 should reduce the number of people at risk by approximately a factor 10, which is equivalent to a reduction by 90%. Similarly, -2 represents a reduction by approximately a factor 100, which is equivalent to a reduction by 99%. In the extreme case M1 can be understood to be a controlled ground area where no people can enter without the knowledge of the operator. Examples of controlled ground areas would be rocket launch facilities and test ranges with fences, cameras and guards to ensure no-one enters the area.

3.3.1 Criterion 1 - Definition of the Ground Risk Buffer

As the robustness of M1 increases, so should the confidence of the applicant and competent authority that the aircraft will not experience a loss of control event that results in a crash outside the buffer. This requires increasingly rigourous substantiation that the flight termination system is effective, and/or increasing certainty in the distance potentially covered by the aircraft in a flight termination state.

For a low integrity claim, the SORA requires the applicant to define a ground risk buffer of 1:1 (for an operational altitude of X meters, the ground risk buffer is required to be at least X meters). This means that in the event of a critical failure leading to loss of control it can reasonably be assumed that the UA will most likely crash inside the ground risk buffer or within the operational volume. This is to ensure that the intrinsic ground risk can be evaluated correctly

and adjacent areas, potentially with higher iGRC values, are not overlooked. If an operator wants to claim a reduction of Medium or High they will need to provide more rigorous substantiation that the proposed ground risk buffer is appropriate, taking into account identified improbable single failures that would result in a loss of control event, including the effects of meteorological conditions, UAS behaviour and latencies to make sure that the UA will most likely crash within the defined risk buffer.

Step #9 of SORA requires consideration for population density of ground areas, which are adjacent to the ground risk buffer. In the event these areas have population density exceeding the density of the operating area, for example, a gathering of people, this situation will necessitate UA operators demonstrating a higher level of robustness to maintain containment and remain within the buffer.

3.3.2 Criterion 2 - Evaluation of People at Risk

In order to achieve a reduction for the number of overflown people at risk, the applicant must provide an accurate representation of the population density within the ground risk footprint, and delineate who is, and is not at risk. If an applicant identifies regions of higher population density within the ground risk footprint, submissions asserting particular flight paths will not be conducted, thereby reducing the likelihood of overflight, may be eligible for credit, however it may require additional evidence on the containment capabilities of the platform.

Identifying the actual people at risk can be done via population density data with higher accuracy, on-site inspection and/or by proving that sufficient proportion of people in the area are adequately sheltered from an aircraft impact. Any argument for reductions must coincide with an approximate order of magnitude reduction. Typically an applicant would plan to operate over areas that can be shown to have a less exposed population than the basic assumption of the surrounding area. Examples could include flying over a local body of water or operating a small UAS over buildings during business hours when the majority of people are expected to be indoors and protected.

3.4 M2 - Effects of ground impact are reduced

M2 is meant to be a general category where an applicant can show a method of reducing the effects of an impact by limiting energy transfer dynamics and/or reducing the critical impact area. Reduction of the energy transfer dynamics could be done for example with a parachute or frangible design. Alternatively, reducing the critical area can also be achieved via a parachute or

by stalling the aircraft to reduce the speed and increase the impact angle. A simple control mechanism in case of a failure which reduces speed and/or the critical area can also be shown to reduce risk significantly. An M2 mitigation should not induce new potential failures which would affect system safety adversely, otherwise the M2 mitigation must include appropriate demonstration that the overall safety has not deteriorated as a consequence of these new potential failures. For example, whilst a parachute certainly reduces impact energy, if it activates inadvertently ten times more often than the aircraft would fail, it may actually increase risk. An applicant can only claim a benefit from M2 if they fulfil medium or high robustness and have technical evidence and, if required, the procedures and training available to demonstrate the effectiveness of the mitigation.

3.4.1 Criterion 1 - Technical Design The mitigation should be designed in such a way as to limit the impact energy, and/or critical area by approximately an order of magnitude for the Medium level of integrity. If an applicant wants to claim the high level of integrity, which is approximately 2 orders of magnitude of reduction of risk, to effectively reduce human error, they must have an automated activation method if applicable and prove that an impact can reasonably be expected to not result in a fatality. A passive mitigation, such as a frangible design, may not need activation in order to function. The applicant can argue that the mitigation also reduces the impacted area and thus the number of people in danger. For example a parachute will bring the aircraft down in a manner which will both decrease the impact dynamics and most likely remove the possibility for a lethal slide across a large critical area (dependent on aircraft size). When evaluating the credibility of an M2 application the total effect of the mitigation needs to approximately fulfil the corresponding order of magnitude reduction.

3.4.2 Criterion 2 - Procedures (if applicable) To maximize the chances of proper deployment of the M2 mitigation and for the applicant to get credit, where applicable, they must provide evidence that any installation and maintenance procedures are done in accordance with manufacturer's instructions.

3.4.3 Criterion 3 - Training (if applicable) For the applicant to get credit for M2, where applicable, they must provide evidence that any installation and maintenance procedures are identified and trained by the applicant so that they will be done in accordance with manufacturer's instructions.

3.5 M3 - Emergency Response Plan The M3 mitigation is designed to reduce escalating effects of an impact by having an adequate emergency response plan (ERP). M3 is the only mitigation which will increase the GRC if an ERP is not available or where that ERP does not fulfil the criteria at the medium or high level. The ERP should identify emergency situations and detail procedures to respond to these emergencies. A procedure outlining when ATM is alerted is deemed to be the minimum. As for any mitigation, claiming a -1 means that the applicant is able to reduce the expected fatalities by approximately a factor of 10. Accordingly, a claim for a high level of integrity for a small UA is in most cases implausible, since the overall risk level is typically low from the onset, and reducing this by two orders of magnitude via an ERP is difficult. Operations of large fleets of small aircraft could potentially claim this reduction if the ERP can be shown to limit the effects of a fleet wide failure condition. Finally, the ERP should be proportional to the operation’s potential secondary effects. An all encompassing plan for an operation in the middle of a desert will not necessarily provide a reduction corresponding to high level.

3.6 Summary of Mitigation Reductions Table 8 \ref{Tab: Table of Mitigation Reduction Scores} details the reductions to the iGRC which are available for M1, M2 and M3 mitigations, with the two common mitigation arguments also listed.

iGRC Reduction Methods None Low Medium High

VLOS No: 0 Yes*: -1

Mitigations for Ground Risk

M1 - Strategic mitigations for ground risk 0 -1 -2 -3

M2 - Effects of ground impact are reduced 0 0 -1 -2

M3 - Emergency Response Plan is in place, operator validated and effective

1 1 0 -1

Table 8 \label{Tab: Table of Mitigation Reduction Scores}

Note(*-1) Because common mitigation arguments are constructed of the basic ground risk mitigations, these have to be understood as a combination with other overlapping mitigations. Therefore, more than a total of -3 from the common mitigation arguments and M1 mitigation jointly is the maximal amount.

3.7 Additional Mitigation Opportunities using JARUS Model

3.7.1 Optional JARUS Model Trade-offs Section 2 highlighted that a conservative set of critical areas has been assumed, and because of the implicit dependencies in Equation 4 \ref{\label{Eqn-TLOS-Pop-AC}}, this impacts on the maximum velocity and population bands. Some measures have already been incorporated to reduce the iGRC values to more realistic values. This includes acknowledging that 1 m platforms have limited kinetic energy and size on slide, and that obstacles in urban areas can reduce the average critical area. However, there is latitude for further tradeoffs between variables in the critical area calculation if the operator can satisfactorily make use of the JARUS model, and exploit the dependencies in Equation 2 and knowledge of the parameters that contribute to $A_C$ in Equation 12. Given the linear and quadratic nature of some of the relationships, an operator can decrease one parameter and thus increase another to achieve the same critical area and thus TLOS. Here are a few examples that apply to all classes for ease of use:

Operation Reduction Operation Gain

Reduce maximum population density overflown [by a factor of 2] to one half

Increase maximum allowable cruise velocity by 50%

Reduce aircraft maximum dimension [by a factor of 2] to one half

Increase maximum population density overflown by a factor 2 OR Increase maximum cruise velocity by 40%

Table 9 \label{Tab: Table of Optional Trad-Offs}

3.7.2 HALE Operations High Altitude, Long Endurance operations are generally conducted by aircraft that have large wingspans, but relatively low cruise speed. This combination inappropriately places many HALE platforms in cells within the iGRC table that misrepresent their true critical area. For these instances, it is recommended that the applicant first use the iGRC table, and then demonstrate using data specific to their platform that a large M2 reduction may be viable considering the extremely slow cruise speeds attained by these aircraft. For instance, a 30m wingspan HALE aircraft may be able to demonstrate that in the worst case, the critical area to be expected is

500m^2. This is over 2 orders of magnitude change in critical area (compared to and would result in a -1 through M2.

4 Demonstration of SAIL Objectives As detailed previously, the OSO’s are mostly a qualitative means for the operator to meet expected overall system reliability targets. To supplement the OSO’s or as an alternative means of compliance, an operator may be able to provide representative system level testing to substantiate claims of reliability. In the first instance, the test regime must reflect how the platform would be operated including the intended configuration, operator roles and environmental conditions in addition to the procedural elements associated with operating and maintaining the system, and where operators and maintainers have representative qualifications and training. Only the operational limits demonstrated through this testing or by appropriate operational safety objective (OSO) evidence will be acceptable. Specific to the environmental elements, testing must encompass the extremes of the operational limits and corners of the flight envelope, including a reasonable distribution across the different aircraft configurations (payloads, UAS weights, center of gravity, etc), mission profiles/complexity (lengths, altitudes, airspeeds, turning radiuses, etc), and operating conditions (density altitudes, temperatures, winds, precipitation, weather, etc).

Appendix A - Critical Area to Wingspan and Speed Calculations \label{Append_A) The iGRC table derived in Section 2 initially uses critical area $A_C$ as the selection parameter for the choice of column as this parameter appears directly in the expected causality calculation. However, the calculation of critical areas is not necessarily straightforward for operators or regulatory authorities, containing a complex relay of variables, and where oftentimes the data is not available. Accordingly, the iGRC table in the SORA main document uses wingspan (or more generally characteristic dimension) and maximum cruise airspeed rather as proxies or predictors for critical area, rather than the full suite of parameters. This appendix describes how the wingspan and speed values in the iGRC table were defined using the JARUS model and the assumptions that were used to go from the critical areas in each column to the wingspan and speed. If an operator or regulatory authority deem the iGRC is non-representative for the aircraft operation under regulatory consideration, they can use the models described in Appendix C\ref{sec:models}, or any other model that more accurately reflects the operation, to determine a critical area that is more representative of the operation, and then allowable population density that can be overflown. Overview This appendix has the following structure.

● In A.1, we argue for the use of velocity instead of kinetic energy in the iGRC as limits on the aircraft size classes.

● In A.2, we discuss what parameters are important for determining the size of the critical area, and conclude that impact speed and angle are the two main free variables that need to be determined. We propose three different descent angles for determining appropriate speed limits.

● In A.3, we determine all the parameters that are needed in order to use the JARUS model on the scenario for relating speed and angle.

● In A.4, we then plot scenario outcomes, and determine the speed limits. ● In A.5, special cases are considered to ensure that the model better reflects realistic

impact scenarios ● In A.6, we combine all of the previous work to produce the final iGRC table.

A.1 Addition of Velocity Constraints in the Column Headers In the previous version of the SORA, kinetic energy was used as a column limit along with wingspan to move fast and/or heavy drones into higher iGRC categories. However, as is presented below, it can be shown that the speed of the aircraft at impact is in fact a fairly good descriptor of the critical area, and since cruise speed is commonly provided by drone manufacturers, it was determined that speed would replace kinetic energy in the iGRC Table. This has the added benefit of not relying on mass, which is a relatively poor predictor for the size of the critical area. In any case, the correlation between mass and the platform’s wingspan means that it is represented, albeit implicitly.

A.2 Determining appropriate values for the iGRC table In order to assess the appropriate coupling between critical area and the more easily determined wingspan and speed using the JARUS model, a number of parameters have to be determined. The model includes the following parameters:

● Impact speed ● Impact angle ● Ground friction (friction coefficient) ● Loss of energy at impact (coefficient of restitution) ● Height and width of a standard person ● Width or wingspan of the aircraft ● Lethal kinetic energy

The values used in the JARUS model are described below, the wingspan of the aircraft is given by the iGRC columns, and the lethal kinetic energy is conservatively set to zero, but can be mitigated by M2.

A.2.1 Impact angle and speed The descent angle plays a central role in all the models and it is important to determine a realistic range for the impact angle for the given type of aircraft used. Relatively shallow impact angles will result in larger critical areas due to longer glide as well as longer skidding across the terrain. Slightly higher angles of attack results in a shorter glide area. High angles of impact typically come from a ballistic, deep stall, or spiralling descent, and will typically have a higher impact velocity than for more shallow impacts. Impact velocity, along with impact angle, affect how long the slide after impact will be. Note that in all models the velocity used for the slide is the horizontal component of the impact velocity. Furthemore, the glide part of the critical area does not depend on the impact velocity. Finally. the failure mode prior to impact, including Controlled Flight into Terrain (CFIT), adopting best glide after engine failure, or a ballistic collision needs to be considered. Many permutations were

considered. Accordingly, we examined three different descent scenarios, as shown in the Figure \ref{fig:descent_scenarios}.

Figure A-1: Descent scenarios used for determining the speed limitations for the 4 iGRC

classes. \label{fig:descent_scenarios}

Note that this graphic is not to scale, and only serves to depict the concept of the descent scenarios. The glide angles, slide distances, aircraft type and size etc. will vary depending on the situation. Since the direction of travel of the aircraft is separately specified in the models, the velocity is sometimes referred to as speed in this document.

A.2.2 Descent Scenarios The three scenarios cover different expected types of descents for a loss of control event.

● Scenario 1 is a glide, which could result from an engine-out event with the aircraft still capable of actuating its control surfaces and coming in at glide speed. Glide speed is used for this scenario and the impact angle assumed is 9 degrees. Glide speed is approximated to be 0.7 time cruise speed

● Scenario 2 represents a complete system failure during cruise, such as a battery failure, which results in the aircraft impacting at cruise speed and at a steeper angle. Cruise speed is used for this scenario and the impact angle is 35 degrees

● Scenario 3 is a ballistic or near-ballistic descent, which can occur for rotorcraft in case of an engine-out resulting in stopped rotors, or for fixed wing in case of structural disintegration or stall. For the ballistic descent, the velocity and impact angle are computed specifically based on a second order drag equation. Section \ref{sec:ballistic_descent} expands on the calculation of ballistic descent.

A.3 Critical Area Model Parameters The JARUS model in section \ref{sec:JARUS_model} described in Appendix C is used to calculate the critical areas, with the parameters outlined in Table \ref{tab:A.X_Table_of_Key_Model_Param} employed.

Descent scenario parameters

Descent scenario 1 2 3 (section A.3.5)

Aircraft size All All 1 m 3 m 8 m 20 m 40 m*

Impact angle 9 35 72 62 58 55 62

Impact speed 0.7 * cruise speed

(section A.3.2)

Cruise speed

29 41 58 95 110

Height of person 1.8 m

Radius of person 0.3 m

Coefficient of friction (section A.3.4)

0.5

Coefficient of restitution (section A.3.3)

0.9 0.80 0.67 0.70 0.72 0.73 0.70

Table A-1. \label{tab:A.X_Table_of_Key_Model_Param}

* A 40m platform was used in the calculations for the > 20m column. Below is an explanation for the main values chosen above and an explanation on why they are expected to be slightly conservative. Operators and competent authorities can determine if these assumptions properly reflect the operation under consideration and can adjust as needed.

A.3.2 Ratio of Glide to Cruise Speed It is expected that for an aircraft to impact the ground at a 9 degree angle, in a non CFIT situation, that it would be gliding, thus glide speed is used. Looking at aircraft where cruise and

glide speed was available, the ratio of these speeds for most aircraft fell between 0.65 and 0.50. Given the lack of data in this area for drones, a value of 0.7 was conservatively used as that means the aircraft would be coming in at a faster speed, thus creating a larger slide area. It is expected that a larger glide speed ratio would come from higher wing loading and thus a steeper impact angle, potentially reducing the overall critical area. For the iGRC table, cruise speed is defined as the maximum speed the aircraft is capable of for normal operations.

A.3.3 Coefficient of Restitution The coefficient of restitution (CoR) expresses the reduction of velocity from before an impact to after an impact. For very stiff objects colliding, the velocity reduction is small, while for softer or breakable objects that may absorb energy during the impact, the velocity reduction is larger. In the modelling of ground impact, the two “objects” will be the unmanned aircraft and the ground. Unmanned aircraft tend to be somewhat stiff, but certainly not unbreakable, so some loss of kinetic is to be expected on impact. The ground may obviously vary from very stiff, such as concrete or asphalt to rather soft, such as grass, soil, sand, etc. The assumption in the JARUS model is that for any impact the aircraft is going to deform and not going to bounce back up and become airborne again. So the assumption is that any vertical velocity is lost to deformation of the aircraft and/or the ground. For the horizontal velocity, the JARUS model has the parameters $c$ that allows for choosing a CoR value smaller than 1 (see Appendix \ref{app:models}). The horizontal CoR in the calculations in Section \ref{sec:mapping_speed_angle} varies the CoR linearly from 0.9 to 0.6, as the impact angle varies from 9 to 90 degrees, which is expected to be conservative. In simple terms, smaller glide angles will have a relatively small reduction, while higher angles will have higher reductions.

A.3.4 Coefficient of Friction Friction is the force resisting the relative motion of two surfaces as they slide against each other. In this setup, the two surfaces will be the ground and the aircraft, and only the kinetic or sliding friction will be considered (i.e. not static friction). The force of sliding friction between two surfaces is the product of the coefficient of friction and the normal force, which under the assumption that the ground is level, is simply mass times gravity. Consequently, the friction force $F$, which will slow down the sliding aircraft, is given by

F = m * g * mu , Eqn. A )( − 1

where $\mu$ is the coefficient of friction. The value of $\mu$ depends on the type of ground and the materials of the aircraft. Values for the friction coefficient for combinations of materials can be found in literature for relatively flat surfaces parallel to each other, starting around 0.15 for wet grass against glass fiber, and increasing to 0.7-0.8 for soft rubber against asphalt. In addition, the movements of the aircraft may affect the friction, as bouncing and rolling will inevitably change the

interaction between the ground and the aircraft as well as the lack of uniformity between the two surfaces. In this document a conservative value of 0.5 has been chosen and used throughout. The CasEx package details CoF for a range of combinations of materials, which can be used in specific cases to get a more accurate friction (and thus critical area).

A.3.5 Ballistic Descent Calculations \label{sec:ballistic_descent} The ballistic descent is the case where the aircraft has no lift, and only gravity and drag affects the aircraft. It is assumed that the ballistic descent is governed by gravity acting vertically and the standard second order drag equation acting in the direction of travel:

Eqn. A )( − 2 [to be reformulated with correct vars in LaTeX]

The frontal area A is approximately equal to the smallest cross section of the aircraft (i.e. a conservative value). The drag coefficient can be very difficult to determine accurately, but can conservatively be set at 0.8. For a given initial altitude, horizontal speed, and vertical speed it is possible to determine both impact angle and speed. The CasEx package (see Appendix E) incorporates the necessary functionality for determining these values. The terminal velocity resulting from the drag equation is easy to determine, though, as F is set to gravity and the equation rearranged to:

Eqn. A )( − 3

where m is mass, g is gravity, ⍴ is air density, A is the frontal area facing in the direction of travel, and Cd is the drag coefficient. The latter value is typically higher than aircraft in a normal cruise configuration. Values between 0.5 and 1 are usually appropriate for a ballistically descending aircraft. To support an awareness of the impact of key variables, four descent scenarios, one for each (Wingspan/Velocity doublet), have been computed and are summarized in the table below. The first part of the table gives the parameter values used. The scenario velocities (cruise speeds) are also listed, and used as initial horizontal velocities. The initial vertical velocity is zero in all cases. Then the terminal velocities for the four scenarios are calculated. The kinetic energy at cruise speed is also listed for later comparison with the impact kinetic energy. The last part of the table then shows the result when applying gravity and second order drag, giving impact

speed and angle as well as horizontal distance traveled during descent, the time the descent takes, and finally the kinetic energy at impact. This last part of the table can be recreated using example 11 in CasEx.

Ballistic descent

Characteristic dimension 1 m 3 m 8 m 20 m 40 m

Parameters for ballistic descent

Frontal area [m^2] 0.1 0.5 2.5 12.5 20

Mass [kg] 4 50 400 5,000 10,000

Drag coefficient 0.8

Air density [kg/m^3] 1.225

Gravity [kg m/s^2] 9.82

Initial altitude [m] 75 100 200 500 1,000

V_cruise [m/s] (from iGRC table) 25 35 75 150 200

V_terminal [m/s] (infinite vertical drop) 30 48 61 96 107

Kinetic energy at V_cruise [kJ] 1.25 31 1,130 56,000 200,000

Ballistic descent starting at cruise speed

Ballistic impact velocity [m/s] 29 41 58 95 110* 13

Ballistic impact angle [deg] 72 62 58 55 62

Coefficient of restitution 0.67 0.70 0.72 0.73 0.70

Vertical distance traveled [m] 71 127 327 951 1559

Descent time [s] 4.4 4.8 7.0 11 16

Kinetic energy at ground impact [kJ]

2 42 677 22,390 60,750

Table A-2 * \label{Tab:A.X Table of Descent Scenarios}

\caption{The first part of the table is the parameters used for computing ballistic descent, and the second half are the resulting values. This has been computed using the example 11 in the

CasEx package (see Appendix D).

13● The impact speed is higher than the terminal velocity because the aircraft still has forward velocity as well.}

A.4 Mapping Impact Speed and Impact Angle \label{sec:mapping_speed_angle}

A.4.1 Speed and angle relation for fixed critical area Using the parameters described above, we can now examine the sensitivity of the critical area to each choice of impact speed and angle. In Figure \ref{Fig:Impact_Ang_Vs_Impact_Speed}}, isosurfaces for Critical Areas of 20, 200, 2000, and 20,000 m^2 are shown, for a platform with a 3 m wingspan. Figure \ref{Fig:Impact_Ang_Vs_Impact_Speed}} also incorporates information for impacts speeds pertaining to:

● A glide impact at 9 degrees, with a horizontal velocity component of 24.5 m/s (blue line) ● A cruise impact at 35 degrees, and horizontal velocity component of 35 m/s (green line) ● A ballistic impact at 62 degrees, and horizontal velocity component of 41 m/s (red line)

It is highlighted that all glide impact velocities were derived using the assumption that:

v_glide = 0.7 * v_cruise Eqn. A )( − 4

It can be observed that the Critical Area for the glide impact scenario (9 degrees) is approximately 200 m^2, which coincides with the values used to derive the iGRC table detailed in Tables 2-6 of Section 2. The Cruise impact (35 degrees) is also around 200 m^2, whilst the ballistic impact has a significantly smaller critical area.

Figure A-2

\label{Fig:Impact_Ang_Vs_Impact_Speed} Similar results were observed across the 1m, 3m, 8, 20m and 40m platforms. Given this, the glide impact scenario parameters were adopted for iGRC calculations.

A.4.2 iGRC Cruise Speed Limit Calculations To maximise alignment with the previous version of the SORA and the impact on aircraft manufacturers, this version of the SORA maintains the wingspan cutoffs at 1, 3 and 8 m respectively. The column previously associated with 8+ m has now been replaced with a representative value of 20m, and a new column added for 20m+ platforms, which for calculation purposes uses a value of 40m. The velocity limits for Critical Area/Wingspans doublets embedded in the iGRC are as follows

● 200 m^2 (3 m): This coincides with a cruise velocity of approximately 35 m/s, as illustrated in Figure \ref{Fig:Impact_Ang_Vs_Impact_Speed}.

● 2,000 m^2 (8 m): The coinciding velocity was approximately 75 m/s, ● 20,000 m^2 (20m): The coinciding velocity was approximately 150 m/s. For

computational purposes. ● 200,000 m^2 (20m+): Reduces to 66,000 m^2 to maintain consistency with the other

critical areas for the 1,500 people/km^2 case. The coinciding velocity was approximately 200 m/s. For computational purposes, the assumed wingspan is 40m.

A.5 Special Cases

A.5.1 The First iGRC column (UAS characteristic dimension <1m) Initially when applying the simplistic wingspan and velocity critical area calculations to this column, the results were implausible, and these small aircraft were travelling extreme distances. The group determined that a more appropriate and realistic case for aircraft of this size was to demonstrate that the slide portion of the impact was non-fatal. The following assumptions were made:

● The aircraft is travelling at cruise velocity ● The angle of impact is 35 degrees (corresponding to cruise velocity), as this category

contains a significant amount of multi rotors and these smaller aircraft would have higher wing loading and thus a steeper glide angle.

● During the glide phase of impact, the aircraft will fatality injure if the aircraft hits a person ● The coefficient of restitution when the aircraft hits the ground is 0.9 ● During the slide portion of the impact, the aircraft will only impact the lower limbs

● The energy absorbed by the lower limbs on impact during the slide is 0.5. This is a combination of an assumption of a non ideal impact (such as the two centre of masses of the objects not being aligned) and the coefficient of restitution on impact with a human. Additionally the energy thresholds in [9, Figure 4, p.1518] are derived from previous sources such as [10, Table 1, p.431] which deal with the results of impacts with piercing type injuries due to explosive debris (i.e. Feinstein calculates the energy required for a 10% chance to “fracture large bones” in the limbs causing “near lethality” from spherical bullets is approximately 213J). This is expected to be overly conservative.

● The slide will be ignored for aircraft where the energy value is less than that required to cause greater than 10% chance of fatality using the Janser Kinetic Energy Threshold for limbs (290J) [9].

It can be shown that the allowable cruise velocity before impact in order meet this requirement is:

Eqn. A )( − 5

Where:

● 90JKE10% lethal−limbs = 2 ● .5βKE transfer = 0 ● This is the 90th percentile mass based on statistical analysis of AUVSIkgm<1m 90%CI = 3

data for unmanned aircraft physical characteristics. The 90th percentile was chosen to ensure the majority of platforms were represented by this calculation.

● CoR = 0.9 ● Gamma = 35 degrees

In this case, the cruise velocity should remain below 25 m/s in order to ensure the slide is non-fatal. At 35 degrees, the glide critical area is 6.5 m^2.

Additionally, an aircraft of this mass and speed is unlikely to be able to penetrate a single person and then continue travelling such that a second person would be struck and killed. We can solve for the population density that coincides with the tightest grouping of people that results in 1 person every 6.5m. This converts to a population density of approximately 150,000 ppl/km^2.

[9] “Lethality of unprotected persons due to debris and fragments”, Janser, P. 1982 Twentieth Explosives Safety Seminar.

[10] “Fragment Hazard Criteria”, D. I. Feinstein, 13th Explosives Safety Seminar, Defence Documentation Explosives Safety Board, 1974.

A.5.2 Obstacles stopping an aircraft The JARUS model for computing the critical area is based on ground friction and dissipation of energy into deformation of the ground and the aircraft as the means to bring the aircraft to standstill after impact. The basic assumption is that the aircraft crashes in an area unimpeded by anything but people. However, in many operational areas, there will be numerous obstacles that will stop an aircraft that is either gliding close to the ground or sliding along the ground. This could be cars, trees, road signs, houses, and so on. And when such an obstacle stops the aircraft, the critical area will be reduced in size, and consequently, the probability that the aircraft will impact a person is also reduced. Although this could technically be used in any operational scenario, the group felt it best to be conservative and assume that in less populated environments, the aircraft does not encounter obstacles. An applicant could utilise the following models to justify a reduction in lethal area using M2 in these sparsely populated environments. This effect will reduce in Eqn (1). For the iGRC table, this value is assumed(Collisions|failure)p to be the density of people on the ground. But when introducing obstacles, this value can be reduced, since there is a certain probability that the aircraft will impact an obstacle, reducing the critical area.

A.5.2.1 Density of obstacles \label{App_A.Obstacles} The key question is of course how much this value is reduced for a given density of obstacles. To determine this, consider a critical area for a crash, where there are a number of obstacles in the path of the aircraft. All considered obstacles have to be sufficiently sturdy to stop or significantly slow the aircraft in both glide and slide and will depend on the aircraft characteristics such as mass and speed (i.e. a bush may stop a 3m aircraft but not an 8 m aircraft).

Figure A-3

\label{Fig:Illustration of the influence obstacles have on Critical Area} A simple conservative model was developed where obstacles were distributed randomly and evenly (i.e. according to a uniform distribution) in the area the aircraft is flying over as point masses tall enough to stop the aircraft’s glide path. Thousands of crashes were simulated projected onto this area where the aircraft would stop when it came into contact with an obstacle and the critical areas determined and summarized. The results showed that as the population density increases, the average critical area will decrease as expected. For a population density of 1,500 people/km^2 , it was shown that 70% of all critical areas for a 3m wingspan aircraft was less than 120 m^2. For the 8m wingspan, it was shown that 90% of all critical areas are less than 700m^2. As this is applied at the lowest bound of the populated areas (>=1500 ppl/km^2), it is expected to be conservative, as this represents the lowest amount of obstacles to stop the aircraft.. The model will continue to be developed and further results will be shared in the next version of this document.

A.6. Creating the Final iGRC Table

A.6.1 Introduction Section 1 and 2 briefly worked through the development of the iGRC, detailing how the variables in Equation 1,2, and 3 were embedded in the finalised iGRC. However, in Section 3.7 we emphasised that there were optional model trade-offs beyond the standard mitigations of M1, M2, M3 and VLOS that were available to both competent authorities and operators. This will obviously be at the discretion of the authority. In any case, it is important that the trade space is well understood, and so this Section provides a step by step expansion on how the iGRC matrix was developed.

A.6.1 Expanded iGRC Table Development In Section 1.3, we introduced the conservative, idealized iGRC table, which is duplicated below in Table A-3 for convenience.

Intrinsic Ground Class Value

Max critical area [m^2]

20 200 2,000 20,000 200,000

Max population density

(ppl/km2)

Controlled 1 2 3 4 5

< 0.5 2 3 4 5 6

< 5 3 4 5 6 7

< 50 4 5 6 7 8

< 500 5 6 7 8 9

< 5,000 6 7 8 9 10

< 50,000 7 8 9 10 11

< 500,000 8 Not part of SORA

Table A-3 \label{tab:Progress Table 1-GRC}

Table A-4 then modifies the Critical area values in the first and last column (changes are highlighted in yellow). Modification of the first column incorporates the special case outlined in A.5.1 to cater for the lower kinetic energy characteristics of 1m platforms, reducing the value to 6.5m. To maintain consistency in iGRC scores when transitioning laterally across columns, it was necessary to reduce the CA in the last column to 66,000 m^2, but this was only achievable when the velocity was constrained to 200 m/s. It is emphasised that the influence of obstacles on the large wingspan platforms that sit in this column are not easily modelled, and so no modification to scores based on obstacles was done in this column.

Intrinsic Ground Class Value

Max critical area [m^2]

6.5 200 2,000 20,000 66,000

Max population density

(ppl/km2)

Controlled 1 2 3 4 5

< 0.5 2 3 4 5 6

< 5 3 4 5 6 7

< 50 4 5 6 7 8

< 500 5 6 7 8 9

< 5,000 6 7 8 9 10

< 50,000 7 8 9 10 11

< 500,000 8 Not part of SORA

Table A-4 The final iGRC does not include critical areas, so Table A-5 replaces those values in the column headers with appropriate wingspans (assuming the speeds assigned previously). Note that in later tables we also add in the maximum cruise velocity. To support the ongoing discussion of the matrix and understanding, we embed these critical areas in all of the matrix cells, commensurate with the column critical area.

Critical Area (m^2) as a Function of Wingspan and Populated Area without obstacles

Max critical area [m^2]

1 m 3 m 8 m 20 m > 20 m

Max population density

(ppl/km2)

Controlled 6.5 200 2,000 20,000 66,000

< 0.5 6.5 200 2,000 20,000 66,000

< 5 6.5 200 2,000 20,000 66,000

< 50 6.5 200 2,000 20,000 66,000

< 500 6.5 200 2,000 20,000 66,000

< 5,000 6.5 200 2,000 20,000 66,000

< 50,000 6.5 200 2,000 20,000 66,000

< 500,000 6.5 Not part of SORA

Table A-5

Critical Area (m^2) as a Function of Wingspan and Populated Area with obstacles

Max critical area [m^2]

1 m 3 m 8 m 20 m > 20 m

Max population density

(ppl/km2)

Controlled 6.5 200 2,000 20,000 66,000

< 0.5 6.5 200 2,000 20,000 66,000

< 5 6.5 200 2,000 20,000 66,000

<10 6.5 200 2,000 20,000 66,000

< 50 6.5 200 2,000 20,000 66,000

<100 6.5 200 2,000 20,000 66,000

< 500 6.5 200 2,000 20,000 66,000

<1500 6.5 120 700 7000 66,000

< 5,000 6.5 120 700 7000 66,000

15, 000 6.5 120 700 7000 66,000

< 50,000 6.5 120 700 7000 66,000

<100, 000 6.5 200 2,000 20,000 66,000

< 500,000 6.5 Not part of SORA

Table A-6

In Section A.5 we outlined the influence of obstacles in reducing the critical area. Our modelling established that once this is incorporated, the transition between integer iGRC scores occurred at population densities of 1,500, 15,000 and 100,000 people/km^2. Accordingly Table A-6 incorporates the following new features:

● 4 additional population density bands at 10, 100, 1,500, 15,000 and 100,000 ● Reductions in the critical areas between 1,500 and 100,000 population densities

according to the principles outlined in Section A.5. This saw the CA’s reduce from 200, 2,000 and 20,000 to 120, 700 and 7,000 for the 3, 8 and 20 m platform respectively.

● For population densities above 100,000, which coincide with gatherings, concerts, no changes to the nominal critical area is made because there are no obstacles expected at these events).

Using the process outlined in Section 2.2, is calculated and then is applied toP (failure) Log10 get the representative non-integer “SAIL” score, after which 1 is added to get a non-integer iGRC value. The result of applying this process to Table A-6 is provided in Table A-7.

Critical Area (m^2) as a Function of Wingspan and Populated Area with obstacles

Max critical area [m^2]

1 m 3 m 8 m 20 m > 20 m

Max population density

(ppl/km2)

Controlled 0.51 2.00 3.00 4.00 4.52

< 0.5 1.51 3.00 4.00 5.00 5.51

< 5 2.51 4.00 5.00 6.00 6.52

<10 2.81 4.3 5.30 6.30 6.82

< 50 3.50 5.00 6.00 7.00 7.52

<100 3.81 5.08 6.30 7.14 7.82

< 500 4.51 6.00 7.00 8.00 8.52

<1500 4.99 6.25 7.02 8.02 8.99

< 5,000 5.51 6.77 7.54 8.54 9.52

<15, 000 5.99 7.25 8.02 9.02 9.99

< 50,000 6.4 7.77 8.54 9.54 10.51

<100, 000 7.3 8.08 8.85 9.85 10.81

< 500,000 7.5 Not part of SORA

Table A-7 As detailed in earlier sections, any iGRC score which was above the current score by 0.3 or less was rounded down. The rest were rounded up. The result is shown in Table A-8.

Critical Area (m^2) as a Function of Wingspan and Populated Area with obstacles

Max critical area [m^2]

1 m 3 m 8 m 20 m > 20 m

Max population density

(ppl/km2)

Controlled 1 2 3 4 5

< 0.5 2 3 4 5 6

< 5 3 4 5 6 7

<10 3 4 5 6 7

< 50 4 5 6 7 8

<100 4 5 6 7 8

< 500 5 6 7 8 9

<1500 5 6 7 8 9

< 5,000 6 7 8 9 10

<15, 000 6 7 8 9 10

< 50,000 7 8 9 10 11

<100, 000 7 8 9 10 11

< 500,000 8 Not part of SORA

Table A-8 Scrutiny of Table A-8, column by column reveals natural transitions in the iGRC for population densities occurring at 10, 100, 1500, 15000, and 100, 000. Given this, Table A-9 streamlines Table A-8.

Critical Area (m^2) as a Function of Wingspan and Populated Area with obstacles

Max critical area [m^2]

1 m 3 m 8 m 20 m > 20 m

Max cruise speed 25 m/s 35 m/s 75 m/s 150 m/s 200 m/s

Max population density

(ppl/km2)

Controlled 1 2 3 4 5

<10 3 4 5 5 7

< 100 4 5 6 7 8

<1500 5 6 7 8 9

<15, 000 6 7 8 9 10

<100, 000 7 8 9 10 11

< 500,000 7* Not part of SORA

Table A-9 Notable other changes include:

● Measuring population densities with accurate resolution below 100 is difficult, so the rows associated with 0.5, 5 and 50 were removed. The row associated with 10 people per square kilometre was maintained to reflect its position as a natural iGRC transition

and to allow for situations where maps are used to identify houses and then extrapolate the number of people per square kilometre

● Whilst the iGRC for 1m platforms operating in population densities is an 8, its is considered improbable that a platform this big could fatally injure more than 2 people, so this score was maintained at 7 (see section A.4)

● Addition of maximum cruise speeds Table A-9 represents the final iGRC table provided in Section1.

Appendix C: Impact models \label{app:models}

Appendix D - CasEx Package \label{app:casex} Here will be a short description of the software package written in python and matlab and made publicly available at a JARUS determined location. This package implements all the models such that anyone relatively easily can do computation for their specific aircraft and circumstance. This will include reference to where the package can be downloaded. Note that it will require some proficiency in python/matlab to use the package!