Federl Office of Civil Avition FOCA Directorte Affirs nd Services Innovtion Mngement SORA Risk Assessment for unmnned irborne Mobility, Mnger Innovtion nd Advnced Technologies Workshop Intelligent nd Autonomous Technologies in Aeronutics Winterthur, 12. September 2017
Content Development in Switzerlnd Sfety in Avition New Approch for new emerging Chllenges Risk bsed Approch Chnge in Culture Tool for Risk Assessment ed irbor e Mobility 2
History, 24. April 2010 ed irbor e Mobility 3
Mrch 2017 ed irbor e Mobility 4
Sfety Risk in Avition Any ircrft is normlly not dnger by itself. It is the opertion in which the ircrft tkes prt, which cn crete risk. Risk for pssenger nd crew on bord the ircrft Risk for people on ground or in other ircrfts in cse collision Risk for criticl infrstructure A crsh cn be cceptble s long no people re on bord ed irbor e Mobility 5
Bsics - Sfety of n Opertion in Avition Opertion Airspce Opertor Aircrft Crew ed irbor e Mobility 6
Trditionl Sfety in mnned Avition An Opertion is sufficiently sfe to ccept the risk when: The Orgnistion behind the Opertion is pproved to ccepted stndrds They use crew, which is pproved to ccepted stndrds They use ircrfts which design, production & mintennce s well s the orgnistions behind re pproved to ccepted stndrds The Opertion is not sufficiently sfe nd therefore to prohibit ed irbor e Mobility 7
Sfety in non-trditionl Avition 1. Opertion is sufficiently sfe to ccept the risk. All is pproved to ccepted stndrds Within legl frmework which provides sufficient sfety 2. Opertion is not sufficiently sfe nd therefore to prohibit 3. Opertion is not sufficiently sfe nd dditionl sfety brriers re required to ccept the risk. ed irbor e Mobility 8
Trditionl Risk Assessment Opertionl Risk Assessment Airspce Sfety Assessment Technicl Hzrd nd Risk Assessment ed irbor e Mobility 9
Where we re? ed irbor e Mobility 10
And where we go? Opertion Airspce Opertor Aircrft PATS Personl Airborn Trnsporttion System Crew ed irbor e Mobility 11
Trditionlly open Questions Which re the rules to fly? And where to fly? Wht re the rules for the design? Wht bout the production? Design, Production, Mintennce people? License? Certifiction? Certifictes? ed irbor e Mobility 12
New Approch Drones/PATS ed irbor e Mobility 13
Ctegories of hrm likelihood estimtion ed irbor e Mobility 14
Responsibility? ed irbor e Mobility 15
Who to protect? Protection of the people on ground is included in the protection of the people on-bord the ircrft. Protection of the people on-bord the PATS is included in the protection of 3d prties on ground nd in the ir. ed irbor e Mobility 16
One size fits ll? ed irbor e Mobility 17
Individul Assessment Joint RiskRisk Assessment Applicnt Opertion Crew Airspce Joint Risk Assessmen Applicnt Aircrft Applicnt Applicnt Opertor Applicnt ed irbor e Mobility 18
Holistic Risk Model (HRM) UAS Opertion out of Control THREAT BARRIER 1 THREAT 1 THREAT BARRIER 2 WG-6 - Specific opertion THREAT BARRIER 1 THREAT 2 THREAT BARRIER 3 HARM BARRIER 2 HARM BARRIER 1 HARM 1 HAZARD THREAT 4 THREAT BARRIER 1 10-6 = THREAT 3 THREAT BARRIER 4 THREAT BARRIER 4 THREAT BARRIER 5 Likelihood of hving UAS opertion out-ofcontrol HARM 2 X Likelihood of person struck by the UAS X Likelihood tht, if struck, person is killed ed irbor e Mobility 19
Hrm Brriers Principles Reduce the likelihood of ftlities or injuries Reduce the effects of the impct Reduction of the number of persons exposed to the risk ed irbor e Mobility 20
Hrm & Hrm Brriers Contingency procedures re defined, vlidted nd dhered to Crew trining is dequte to cope with the sitution Effects of ground impct re reduced (e.g. Emergency Prchute) Continment in plce nd effective (tether, geo-fencing, etc.) Ftl injuries to third prties on the ground JARUS WG-6 - UAS opertion UAS opertion is out of control Contingency procedures re defined, vlidted nd dhered to Crew trining is dequte to cope with the sitution Contingency procedures re defined, vlidted nd dhered to Crew trining is dequte to cope with the sitution UAS design fetures mitigte the severity of mid-ir collision (e.g. frngible, very light) UAS equipped with obstcle voidnce cpbility UAS is equipped with cpbility to void collisions Effects of ground impct re reduced The UAS is equipped with design fetures tht id visul cquisition nd/or detection by other A/C Continment in plce nd effective (tether, geo-fencing, etc.) Specific opertion profile designed with considertion to criticl infrstructure Dmge to criticl infrstructure Ftl injuries to third prties in the ir (Mid ir collision with mnned ircrft) ed irbor e Mobility 21
Ground Risk Assessment ed irbor e Mobility 22
Hrm brriers out of SORA ed irbor e Mobility 23
Specific Assurnce nd Integrity Levels (SAIL) SAIL UAS Ground Risk Clss Lethlity 7 6 5 4 3 2 1 HIGH VI VI V IV III II I AVERAGE VI V IV III II I 0 LOW V IV III II I 0 0 ed irbor e Mobility 24
Thret & Thret Brriers T echnicl issue with the UAS The opertor is competent nd/or proven (e.g. ROC) UAS mnufctured by competent nd/or proven entity Humn Error UAS mintined by competent nd/or proven entity Opertionl procedures re defined, vlidted nd dhered to UAS developed to uthority recognized design stndrds Remote crew trined nd current nd ble to control the bnorml sitution UAS is designed considering system sfety nd relibility Multi crew coordintion Aircrft on collision course Adverse operting conditions Dtlink deteriortion T he UAS is designed to utomticlly mnge dtlink deteriortion situtions Dtlink performnce estblished nd verified (e.g. dtlink budget) Inspection of the UAS (product inspection) Adequte resting times re defined nd followed Opertionl procedures re defined, vlidted nd dhered to Automtic protection of criticl flight functions (e.g. envelope protection) Opertionl procedures re defined, vlidted nd dhered to Remote crew trined nd current nd ble to control the bnorml sitution Opertionl procedures re defined, vlidted nd dhered to T he remote crew is trined to identify criticl environmentl conditions nd to void them Procedures nd limittions re in-plce nd dhered to Dtlink systems nd infrstructure is mnufctured to dequte stndrds pproprite to the opertion Deteriortion of externl systems supporting UAS opertion beyond the control of the UAS opertor (e.g. GPS, ILS). Remote crew trined nd current nd ble to control the bnorml sitution Sfe recovery from technicl Issue Sfe recovery from Humn Error A Humn Fctors evlution hs been performed nd the HMI found pproprite for the mission T he UAS is detectble by other irspce users UAS is equipped with functionlity to mintin sfe seprtion Environmentl conditions for sfe opertions defined, mesurble nd dhered to Dtlink systems nd infrstructure is designed to dequte stndrds pproprite to the opertion Procedures re in-plce to hndle the deteriortion of externl systems supporting RPAS opertion UAS designed nd qulified for dverse environmentl conditions (e.g. dequte sensors, DO-160 qulifiction) JARUS WG-6 - UAS opertion UAS opertion is out of control Dtlink systems nd infrstructure is instlled nd mintined to dequte stndrds pproprite to the opertion T he UAS is designed to mnge the deteriortion of externl systems supporting RPAS opertion ed irbor e Mobility 25
Thret brriers out of SORA ed irbor e Mobility 26
Holistic Risc Model (HRM) Level of Robustness Level of Robustness Wht hppens if? Technicl issue with the UAS Humn Error JARUS WG-6 - UAS opertion Ftl injuries to third prties on the ground Aircrft on collision course UAS opertion is out of control Ftl injuries to third prties in the ir (Mid ir collision with mnned ircrft) Adverse operting conditions Dmge to criticl infrstructure Dtlink deteriortion Why this hppens? Deteriortion of externl systems supporting UAS opertion beyond the control of the UAS opertor (e.g. GPS, ILS). ed irbor e Mobility 27
Air Risk Model Air Risk Off-nominl (loss of control of opertion) Nominl Ambient risk Ambient risk Externl mitigtions Likelihood of mishp DAA Protection from mishp ed irbor e Mobility 28
Trget Level of Sfety Internl Mitigtions Residul Risk D P Externl Mitigtions Air-Risk Clss Airspce Thret ed irbor e Mobility 29
Qulittive Approch to Air Risk Risk Fctors Proximity Geometrics Dynmics X Opertionl Fctors Flight rules Altitude Airspce Type Underlying Popultion = Air-Risk Clss ed irbor e Mobility 30
Proximity, Geometry, Dynmics ed irbor e Mobility 31
Proximity, Geometry, Dynmics ed irbor e Mobility 32
Proximity, Geometry, Dynmics ed irbor e Mobility 33
Proximity, Geometry, Dynmics ed irbor e Mobility 34
Qulittive Approch to Air Risk 1. Proximity - The more ircrft in the irspce, the higher the rte of proximity, the greter the risk of collision. 2. Geometry - An irspce which sets or llows ircrft on collision courses increses risk of collision. 3. Dynmics - The fster the speed of the ircrft in the irspce the higher the rte of proximity, the greter the risk of collision. ed irbor e Mobility 35
Where to expect Aircrfts ed irbor e Mobility 36
Airspce Encounter Ctegories (AEC) Close to n Airport Within TMZ Over Urbn Ares Over Rurl Ares South pole / North pole Controlled Airspce Uncontrolled Airspce Above Minimum Flight Altitude Below Minimum Flight Altitude Strtosphere ed irbor e Mobility 37
Airspce Encounter Ctegories (AEC) Very High Risk for Mid Air Collision Close to n Airport Controlled Airspce Above Minimum Flight Altitude Below Minimum Flight Altitude Within TMZ Controlled Airspce Above Minimum Flight Altitude Non Airport Ares Controlled Airspce ed irbor e Mobility 38
Airspce Encounter Ctegories (AEC) High Risk for Mid Air Collision Over Urbn Popultion Controlled Airspce Above Minimum Flight Altitude Below Minimum Flight Altitude Over Rurl Popultion Controlled Airspce Above Minimum Flight Altitude Within TMZ Below Minimum Flight Altitude ed irbor e Mobility 39
Airspce Encounter Ctegories (AEC) Low Risk for Mid Air Collision Over Rurl Popultion Controlled Airspce Below Minimum Flight Altitude Strtosphere Very low Risk for Mid Air Collision South pole / North pole / Shr Dessert ed irbor e Mobility 40
Airspce Encounter Ctegories (AEC) Very High Risk for Mid Air Collision Risk Clss 4 High Risk for Mid Air Collision Risk Clss 3 Low Risk for Mid Air Collision Risk Clss 2 Very low Risk for Mid Air Collision Risk Clss 1 ed irbor e Mobility 41
Airspce Encounter Ctegories (AEC) nd Air Risk Clss (ARC) ed irbor e Mobility 43
Reson mitigtion model (Swiss Cheese) UAS Unmitigted Collision Risk Strtegic Conflict Mngement Externl Mitigtions Internl Mitigtions Providence Mitigtions Trget Level of Sfety ed irbor e Mobility 44
Air-Risk Clss nd strtegic mitigtions SEP Level 3 SEP Level 2 SEP Level 1 Risk Clss 1 Risk Clss 2 Risk Clss 2 Risk Clss 3 Risk Clss 4 ed irbor e Mobility 45
Specific Assurnce nd Integrity Levels (SAIL) ed irbor e Mobility 46
Specific Assurnce nd Integrity Levels (SAIL) ed irbor e Mobility 47
Air-Risk Clss nd tcticl mitigtions Tcticl Mitigtion Tcticl Mitigtion Tcticl Mitigtion Risk Clss 1 Risk Clss 2 Risk Clss 3 Risk Clss 4 ed irbor e Mobility 48
Tcticl Mitigtion, Performnce Levels ed irbor e Mobility 49
Robustness Levels ed irbor e Mobility 50
3 Pillrs of new Risk Assessment Risk Bsed Approch. Wht re the rel Risks of the Opertion New Culture. Holistic not Atomistic A Totl Hzrd nd Risk Assessment ed irbor e Mobility 51
QUESTIONS? ed irbor e Mobility 52