Kiri

AltMoC Triggers for Enhanced Containment

Version 1.0 Date 6 september 2024 Status Document number

Final ILT-2024/3888

Page 2 van 25

AltMoC Triggers for Enhanced Containment

● Contents

● Introduction—3

1 List of abbreviations and terms—4 1.1 Terms and conditions—4 1.2 Legal references—4

2 Proposed Target Level Of Safety TLS for the AltMoC—5 2.1 Ground risk TLS—5 2.2 Air risk TLS—5

3 Understanding of unmanned aircraft fly-away probability—6 3.1 Potential failure types that could lead to a fly-away:—6 3.2 “Basic containment” - SORA 2.5.3(b)—7 3.2.1 “Enhanced containment” – SORA 2.5.3(c)—7

4 SORA 2.5 Updated containment levels and triggers—9 4.1 Adjacent Airspace Containment Requirements Background—9 4.2 Adjacent Airspace Containment Requirements Assessment—10 4.2.1 General Assumptions:—10 4.2.2 General Framework:—11 4.3 Airspace Containment Scenarios – Worst Case—11 4.3.1 Case 1—12 4.3.2 Case 2—13 4.4 Airspace Containment Conclusion—15

5 SORA 2.5 Adjacent Area Ground Risk Assumptions—16 5.1 Adjacent Area Size—16 5.2 Evaluating Gathering of People in the Adjacent Areas—16 5.2.1 Example #1—16 5.2.2 Example #2—17 5.2.3 Example #3—18 5.3 Expected Ground Risk Casualty Rate Model in the Adjacent Area—19 5.3.1 Containment Objectives Based Upon the Risk of the Adjacent Area—20

6 Changes to AMC1 to Article 11 paragraph 2.5.3 on enhanced containment triggers—21

6.1 Procedure to determinate the level of containment requirements—21 6.1.1 Definitions—21 6.1.2 Procedure—22 6.2 Tables to determine the level of containment—23

Page 3 van 25

AltMoC Triggers for Enhanced Containment

● Introduction

AltMoCs issued by ILT have basically the same legal status and effect as AMCs (Acceptable Means of Compliance). Except that the author of AltMoCs is not EASA but ILT. AltMoCs are not evaluated by EASA in advance but are reviewed within a short time after their publication by ILT. Therefore, once released by ILT, AltMoCs become immediately applicable to all parties under Dutch jurisdiction. However, AltMoCs do not have cross-border effect: an operator under foreign jurisdiction has no legal claim to his competent authority to allow use of an AltMoC issued by ILT. And ILT will not automatically accept in its jurisdiction the use of an AltMoC issued by foreign competent authorities. This Alternative Means of Compliance (AltMoC) is intended to change the triggers for enhanced containment requirements as currently found in chapter 2.5.3 Step 9 of AMC1 to Article 11 of (EU) 2019/947 (issue 1, amendment 3). Currently all Unmanned Aircraft Systems (UAS) used in the specific category must adhere to the points 2.5.3(a)&(b) of the requirements. This is seen as proportional by ILT. On the other hand, point 2.5.3(c) requires enhanced containment performance when certain conditions are met. However, by the latest understanding of ILT, enhanced containment is triggered in situations where the actual risk of the operation does not justify its applicability and the containment requirements of points (a)&(b) would be sufficient. This AltMoC focuses on changing the assessment triggers in point 2.5.3(c) which mandate enhanced containment from certain UAS operations. No change in the technical implementation requirements of the containment systems is proposed. The resulting mechanism for determining the level of containment is in line with SORA 2.5 published by JARUS on May 13th, 2024, with the exemption that the levels of containment remain ‘basic’ and ‘enhanced’ rather than ‘low, medium and high’. Sections 1 through 5 of this AltMoC are for introduction, explanation, and substantiation. Refer to chapter 6 for the actual change to AMC1 to article 11.

Page 4 van 25

AltMoC Triggers for Enhanced Containment

1 List of abbreviations and terms

Abbreviation Meaning

AGL Above Ground Level

AltMoC Alternative Means of Compliance

AMC Acceptable Means of Compliance

AMSL Above Mean Sea Level

ANSP Air Navigation Service Provider

ARC Air Risk Class

ATC Air Traffic Control

CAT Commercial Air Transport

COTS Commercial Off The Shelf

EASA European Union Aviation Safety Agency

FAA Federal Aviation Authority (USA)

GA General Aviation

GPS Global Positioning System

JARUS Joint Authorities for Rulemaking on Unmanned Systems

MAC Mid-Air Collision

NMAC Near Mid-Air Collision

SAIL Specific Assurance and Integrity Level

SORA Specific Operations Risk Assessment

TLS Target Level of Safety

UA Unmanned Aircraft

UAS Unmanned Aircraft System

1.1 Terms and conditions The use of the male gender should be understood to include male and female persons. The most frequent abbreviations used by the EASA are listed here: easa.europa.eu/abbreviations. When used throughout the AltMoC the terms such as «shall, must, will, may, should, could, etc.» shall have the meaning as defined in the English Style Guide of the European Commission.

1.2 Legal references Commission Regulation (EU) No 947/2019:

• Article 11 • AMC1 Article 11 (issue 1, amendment 3)

Page 5 van 25

AltMoC Triggers for Enhanced Containment

2 Proposed Target Level Of Safety TLS for the AltMoC

The general qualitative target level of safety (TLS) in Article 11(3) of (EU) 2019/947 is set to be equivalent to that of manned aviation. “The assessment shall propose a target level of safety, which shall be equivalent to the safety level in manned aviation, in view of the specific characteristics of UAS operation.” Keeping in mind the goal of achieving this equivalency, the considered TLS for ground and air risk are further detailed in the following sections.

2.1 Ground risk TLS For risks to third parties on the ground the equivalent risk is assessed in JARUS AMC RPAS.1309 issue 2 as 1.0 * 10―6 deaths / flight hour for manned aviation.

2.2 Air risk TLS The TLS per UAS flight hour for air risk in this AltMoC is 1.0 * 10―7 Mid Air Collisions (MAC) with General Aviation (GA) aircraft per flight hour and 1.0 * 10―9 MAC with Commercial Air Transport (CAT) aircraft per flight hour. These values are commonly accepted as TLS Lin, Xun & Fulton, Neale & Westcott, Mark. (2009). Target Level of Safety Measures in Air Transportation – Review, Validation and Recommendations. With conservative assumptions of every collision being catastrophic and 500 passengers for each CAT aircraft and 5 passengers for each GA aircraft the fatalities per UAS flight hour would be: ● 500 ∗ 10―9 / = 5 ∗ 10―7 / ● 5 ∗ 10―7 / = 5 ∗ 10―7 / Measured in deaths per UAS flight hour, the targets are the same for both encounter types, less than the ground risk TLS and equal to the safety level in manned aviation.

Page 6 van 25

AltMoC Triggers for Enhanced Containment

3 Understanding of unmanned aircraft fly-away probability

For an unmanned aircraft to fly-away out of the assessed operational area the following sequence of events must happen: 1. The control of the operation/drone is lost. Probability of this happening is

directly linked to the SAIL1 of an operation. For example, a SAIL II operation is assumed to lose control less than once in a hundred flight hours. (Probability of loss of control of an operation rate equals 10-SAIL);

2. The loss of control does not lead to a crash inside the operational volume or ground risk buffer;

3. The containment mitigations applied to the operation fail, including the basic

containment, since it is applicable to all UAS subject to a SORA; 4. The aircraft flies outside of the ground risk buffer. The number of different failures or combinations of failures that could lead to this chain of events and a fly-away can be estimated. UAS are complex systems that can have many different types of failures, but some generalizations can be made to assess what failures may lead to a fly-away.

3.1 Potential failure types that could lead to a fly-away: Failure type Potential failure effect 1 GPS failure total loss, inaccuracy 2 Internal Navigation System total loss, inaccuracy, drifting 3 Flight Control last input stays, full power, power

off, control surface actuation, etc.

4 Pilot error incorrect input, incorrect navigation, flight planning failure

5 Environment (Wind, Electromagnetic interference, Temperature)

drifting out of area, battery drained early

6 Data Link fly straight, hover, return to home, gain altitude

7 Other potential failure These failure types need to be mitigated by containment requirements.

1 Specific Assurance and Integrity Level SAIL models the reliability of an unmanned aircraft operation and the assumed total loss of control rate for the operation

SAIL I II III IV V VI Probability of loss of control per flight hour 10-1 10-2 10-3 10-4 10-5 10-6

Page 7 van 25

AltMoC Triggers for Enhanced Containment

The assumption taken is that there could be up to 10 different failure types in an unmanned aircraft operation that can lead to a fly-away either individually or in combination. This AltMoC proposes no changes in the technical implementation requirements of the containment systems, but addressed only the trigger criteria. The following presents an analysis of the estimated containment performance to determine whether the current targets are adequate and proportional to the overall risk to the system.

3.2 “Basic containment” - SORA 2.5.3(b) “No probable failure of the UAS or any external system supporting the operation shall lead to operation outside of the operational volume.”

Basic containment is required for all UAS operations in the specific category and sets the minimum level of containment performance. This requirement sets a total allowed probability of single failures that may lead to a fly-away. Single failures leading to fly-away are still allowed to occur, but their probability should be “no probable”, meaning Remote2.

• “Probable” failure means occurrence every 10-3 / flight hours • “Remote” failure means occurrence every 10-4 / flight hours

In combination with the assumption of up to 10 potential Remote failure conditions in UAS operation that can lead to a fly-away, the basic containment requirement would set a fly-away rate outside of the operational volume of less than 10-3 / flight hour. However, every operation is planned with a ground risk buffer that is meant to capture the most likely crash area of an operation in a loss of control event. The ground risk buffer can be estimated to contain 90% of all loss of control situations and subsequent crashes inside it due to gravity and the attempts of the remote pilot to end the flight. Therefore, Basic containment is estimated to reach a containment performance of 10-4 /flight hour for flyaway events outside of the ground risk buffer.

3.2.1 “Enhanced containment” – SORA 2.5.3(c) “The probability of leaving the operational volume shall be less than 10-

4/FH. No single failure of the UAS or any external system supporting the operation shall lead to operation outside of the ground risk buffer. Software (SW) and Airborne Electronic Hardware (AEH) whose development error(s) could directly lead to operations outside of the ground risk buffer shall be developed to an industry standard or methodology recognized as adequate by the competent authority.”

Enhanced containment requirements require that two independent failures happening at the same time are only allowed to lead to a fly-away. The requirements are also setting a quantitative operational volume containment

2 Definitions from JARUS AMC RPAS.1309

Page 8 van 25

AltMoC Triggers for Enhanced Containment

requirement. The fact that no single failure is allowed to lead to fly-away means that there should at least be an independent Commercial Off The Shelf (COTS) level (10-

2 failure rate) back-up system to end the flight within the ground risk buffer. In combination these two requirements are assumed to combine into a fly-away probability outside of the ground risk buffer of less than 10-6 /flight hour. Pfly out from operational volume x Pfly out from ground risk buffer > 10-4 * 10-2 = 10-6/FLH probability of fly-away The point 2.5.3(c) also includes the triggers for applying Enhanced containment, which based on ILT’s experience and analysis are not proportional to the actual risk posed by most UAS operations. This AltMoC changes these triggers, which currently are: Enhanced containment applies to operations conducted:

1. either where the adjacent areas:

i. contain assemblies of people unless the UAS is already approved for operations over assemblies of people; or

ii. are ARC-d unless the residual ARC of the airspace area intended to be flown within the operational volume is already ARC-d;

2. Or, where the operational volume is in a populated area where:

i. M1 mitigation has been applied to lower the GRC; or ii. operating in a controlled ground area.

Page 9 van 25

AltMoC Triggers for Enhanced Containment

4 SORA 2.5 Updated containment levels and triggers

With SORA 2.5 there are three options for containment:

i. low robustness containment, very common, most operations will require this (in SORA 2.0 this was corresponding to ‘basic containment’ and it was mandatory for all operations), in densely populated parts of the world like East Asian or European countries, it can be expected that due to airspace and population distribution this will be the required minimum.

ii. medium robustness containment, common in large cities and close to gatherings of people. This is a new intermediate robustness level that sits between the mandatory basic containment and the enhanced containment of SORA 2.0

iii. high robustness containment, only needed in rare case for SAIL I & II. In SORA 2.0 this was called enhanced containment.

Low and high robustness containment are based on SORA 2.0 and are largely backwards and forwards compatible. Medium robustness containment is not yet recognized in this AltMoC. In the tables of the AltMoC for determining level of containment ‘medium’ is replaced by ‘enhanced’. SORA 2.5 introduces considerable change to the containment logic. Two of the main changes are:

i. Remodeling the adjacent area ground risk triggers for containment, leading to a more risk proportionate approach.

ii. Removing the considerations for adjacent airspace, as the driving factor for containment is primarily ground risk.

4.1 Adjacent Airspace Containment Requirements Background To assess the adjacent airspace containment requirements, the JARUS workgroup evaluated several worst-case flyaway scenarios. The scenarios were selected based on the availability of traffic count and/or historical surveillance data, as well as the complexity of the aerodrome layout and airspace. The workgroup then considered more general flyaway scenarios involving mixed air risk profiles and consideration of multiple flyaway paths and their likelihood. Details of these evaluations are presented in the following sections. The JARUS workgroup determined that low-robustness containment, which is the minimum requirement for any adjacent ground risk area, also satisfies every worst- case airspace flyaway scenario at both TLOS values established in SORA (10-7 and 10-9) – even for on-field operations where a flyaway could result in crossing several other runways. While these findings seem initially counterintuitive, the exposure time in which a UAS would be transiting across another active runway is only a few seconds. This, along with several other factors described in the following sections, substantially reduces the probability of midair collision in the event of a flyaway. Ultimately, there is no need to identify a higher containment requirement for certain airspace or aerodrome situations so there is thus no need to calculate and apply an adjacent airspace definition to the containment requirements. Put simply, low-

Page 10 van 25

AltMoC Triggers for Enhanced Containment

robustness containment provides a sufficient safety margin for adjacent airspace collision risk, regardless of SAIL level or proximity to an airport.

4.2 Adjacent Airspace Containment Requirements Assessment Loss of containment into adjacent airspace in some cases increases the likelihood of encounter, near midair collision (NMAC, as commonly defined, when two aircraft are within 500 feet laterally and +/- 100 feet vertically) or midair collision (MAC) with manned aircraft. It is improbable that flight into adjacent airspace would guarantee a MAC with manned aircraft. As such, the following general assumptions and analytical framework regarding loss of containment events is applied for assessment purposes.

4.2.1 General Assumptions: (a) A fly-away scenario occurs when the UAS leaves the operational volume and the

mechanism to end the flight malfunctions such that the UAS continues its flight without the ability for the operator to intervene or regain control. It is assumed using low robustness containment:

• There is a 10-3 chance (0.1%) that the aircraft leaves the operational volume (Pc = 0.001).

• There is a 10-1 chance (10%) the flight termination system fails (Pe = 0.1).

• There is a 10-1 x 10-3 = 10-4 likelihood or rate of prolonged, continued flight into the adjacent airspace (Pec = 0.0001). This is equal to the likelihood of exiting the ground risk buffer.

• These assumptions pertain to SAIL I and II. Higher SAIL’s have lower Pc values. This constitutes a worst-case scenario with respect to adjacent air risk analysis.

(b) A fly-away scenario can originate from any location on the operational volume

perimeter and the fly-away path can adopt any heading from that location such that the UAS does not re-enter the operational volume. It is assumed that a fly- away trajectory:

• Follows a linear (fixed heading) flat (fixed altitude) path from the operational volume perimeter if flight termination does not occur. Eventually the UAS adopts a downward profile (due energy/fuel limits), resulting in a level then downward sloping trajectory.

• Follows a linear (fixed heading) diagonal (downward) path from the operational volume perimeter if flight termination occurs. Immediately, the UAS adopts a downward profile resulting in a downward sloping trajectory (e.g. ground impact occurs within 1 minute for flights below 500 feet AGL).

For assumed paths (i) or (ii) above, there will be limited exposure time to any single region or specific location within the adjacent airspace (i.e. no loitering is assumed). There will be greater airspace exposure for assumed path (i) compared to (ii).

(c) The adjacent airspace size is equivalent to the adjacent ground risk size (see Annex F, 5.1). This means that adjacent airspace can extend up to 35km from the operational volume.

(d) Strategic and tactical air risk mitigations are not applicable in the adjacent area. Containment measures help to reduce the amount of adjacent airspace

Page 11 van 25

AltMoC Triggers for Enhanced Containment

traversed, but they do not change the air risk in the adjacent airspace.

(e) The charted boundaries of controlled airspace are assumed to include a nominal buffer to protect against blunders of any aircraft (not just UA) into that airspace. Therefore, a SORA-defined air risk buffer would be redundant and thus no air risk buffer is required. This is true regardless of the ARC class for the operational volume.

4.2.2 General Framework: Consider the following expression linking adjacent airspace risk to the target level of safety (TLOS) such that:

Where:

• is the prolonged fly-aways per flight hour into the adjacent airspace. It is the product of the failure rate (or probability) and containment system failure probability (or rate). For low robustness containment =−×−=− .

• TExposure is the exposure time in hours for each flight path or airspace region crossed.

• ARC is airspace density measured as the well-clear violations per flight hour (WCV/FLH) where the well-clear volume is a cylinder centered on each aircraft with radius of 2000 feet and height +/- 250 feet. The ARC values are based on the worst cases identified during airspace classification studies as follows: ARC-a: 10-4 ARC-b: 10-2 ARC-c: 1 ARC-d: 10

• p(ARC) is the probability of being in the adjacent airspace defined by ARC (see

above). This depends on the assumed or allowed flyaway paths.

• p(NMAC|WCV) is the conditional probability of near midair collision (NMAC) given a well-clear violation, and is assumed to be 0.1.

• p(MAC|NMAC) is the conditional probability of midair collision given an NMAC, and is assumed to be 0.01 (for UAS <= 3m size ).

• p(F|MAC) is the conditional probability of fatality given a MAC, and is assumed to be 0.1.

• TLOS is the adjacent airspace TLOS measures as MAC per flight hour. It is 10-7 in ARC-a, ARC-b and ARC-c airspace, and 10-9 in ARC-d airspace.

4.3 Airspace Containment Scenarios – Worst Case A variety of worst-case scenarios were considered by the JARUS working group to test whether containment requirements more stringent than low robustness containment would ever be required. These cases concern operations directly in or very near aerodromes. Two such cases are included in this substantiation. Other scenarios are available in the SORA 2.5 JARUS release.

TLOS = p(F|MAC) x p(MAC|NMAC) x p(NMAC|WCV) x p(ARC) x ARC x TExposure x

Page 12 van 25

AltMoC Triggers for Enhanced Containment

4.3.1 Case 1 An extreme scenario considering aerodrome traffic occurs for an operation in Atlanta airport (KATL), which is intended to be confined to the northern-most 08L/26R runway (see Fig. 1, small green box). The next closest runway is 08R/26L at 850’ between edge strips. Another pair of runways are located adjacent to the ramp area followed by a single runway located further south. The greatest risk occurs with a loss of containment that proceeds from the northern 08L/26R runway south/south- east and crossing 4 parallel runways (yellow arrows).

Figure 1 - Atlanta airport adjacent airspace containment example for on-field operations (green box) with potential flyaway crossing multiple runways (yellow arrow region)

Using the following assumptions: (a) Low robustness containment is applied since the operation is in, and adjacent

to, ARC-d airspace ( = 10-4).

(b) In the event of a loss of containment, there is a 24% chance (p(ARC) = 0.24) that the UAS flies in the direction of an intersecting flight path of the next closest runway. This value (i.e. angle) decreases for airports with multiple runways (e.g. the clockwise from south-east to south, yellow arrows)

(c) The loss of containment trajectory is linear, and the UAS crosses four flight paths, for a total exposure time of 16 (15.8) seconds (TExposure = 4 x 0.0011 = 0.0044 hours) assuming a 200 ft crossing path (of the runway) at 30kts.

(d) ARC value = 10.

Page 13 van 25

AltMoC Triggers for Enhanced Containment

(e) p(NMAC|WCV) = 0.1.

(f) p(MAC|NMAC) = 0.01.

(g) p(F|MAC) = 0.5.

(h) Therefore, probability of fatality according to (1) is (0.5)(0.01)(0.1)(0.24)(10)(0.0011)(10-4) = 1.32 x 10-10 for a single runway crossing and (0.5)(0.01)(0.1)(0.24)(10)(0.0044)(10-4) = 5.28 x 10-10 for four runway crossings. The risk for 1 - 4 runway crossings is between these values compared with the TLOS = 10-9 for the airspace. Noting (b) above, these estimates are thus conservative.

Result: A low robustness containment is shown to achieve the required TLS for mid-air collisions (MAC) even operating in extremely dense airspace within aerodrome environments. Busiest airport in The Netherlands is Amsterdam Schiphol Airport (EHAM). Due to its lower number of passengers and flights per year (nearly half compared to Atlanta), and due to the less vulnerable runway configuration, using the same methodology, the probability of a fatality occurring at this airport would even be lower.

4.3.2 Case 2 An extreme scenario considering aerodrome and general aviation traffic occurs for an operation north of the Las Vegas airport (KLAS) which is intended to be confined to a small region (see Fig. 2, small red circle). The large red circle shows an approximately 5km adjacent airspace region. The heatmap background shows annual flight tracks from official FAA surveillance systems between SFC and 1000 feet AGL. Traffic within this Class B surface area is highly proceduralised and concentrated in specific locations: arrivals to runways 19R/19L, departures from runways 1R/1L, a helipad (red dot near center) and a defined VFR helicopter tour route above the Las Vegas Strip (diagonal and slightly curved paths from left edge to top-center). The greatest risk occurs with a loss of containment that proceeds from the operational area in any direction towards the airport landing paths from southeast, clockwise to southwest (yellow arrows). This case can be seen in other major aerodromes such as San Francisco (KSFO).

Page 14 van 25

AltMoC Triggers for Enhanced Containment

Figure 2 - Las Vegas airport adjacent airspace containment example for near field operations (red circle) with potential flyaway path toward parallel runways (yellow arrow region) or nearby helicopter routes (white arrow region)

Using the following assumptions: (a) Low robustness containment is applied since the operation is in, and adjacent

to, ARC-d airspace ( = 10-4)

(b) In the event of a loss of containment, there is a 25% chance (p(ARC) = 0.25) that the UAS flies in the direction of an intersecting flight path (clockwise from southeast to southwest, yellow arrows) and a 48% chance (p(ARC) = 0.48) of flying towards the helicopter routes (white arrows).

(c) The loss of containment trajectory is linear, and the UAS crosses two flight paths, for a total exposure time of 40 (39.5) seconds (TExposure = 0.011 hours) assuming a 1000 ft crossing path (of the runway) at 30kts.

(d) ARC for airport =10 and ARC for helicopter routes = 1.

(e) p(NMAC|WVC) = 0.1.

(f) p(MAC|NMAC) = 0.01.

(g) p(F|MAC) = 0.1.

Page 15 van 25

AltMoC Triggers for Enhanced Containment

(h) Therefore, probability of fatality according to (1) is (0.1)(0.01)(0.1)(0.25)(10)(0.011)(10-4) = 2.75 x 10-10 for CAT traffic, compared with the TLOS for the airspace of 10-9 and (0.1)(0.01)(0.1)(0.48)(1)(0.011)(10-4) = 5.28 x 10-11 for GA traffic, compared with the TLOS = 10-9 for the airspace. The combined risk is the sum of these risk elements (as only one can occur) resulting in 3.28 x 10-10.

Result: A low robustness containment is shown to achieve the required TLS for mid-air collisions (MAC) even in proximity to extremely dense airspace with mixed traffic types. Las Vegas McCarran International Airport (LAS) is a significantly busier airport compared to Rotterdam The Hague Airport, Lelystad Airport, Groningen Eelde Airport and Eindhoven Airport.

4.4 Airspace Containment Conclusion Based on these results, it was determined by the JARUS working group that low robustness containment provides a sufficient degree of protection for all SAIL in all fly-away events, regardless of complexity of the airspace or proximity of the UA to dense airspace regions including aerodromes. Therefore, there is no need for Medium or High containment solely because of adjacent airspace; such a requirement would be driven by adjacent ground area.

Page 16 van 25

AltMoC Triggers for Enhanced Containment

5 SORA 2.5 Adjacent Area Ground Risk Assumptions

5.1 Adjacent Area Size The reasonably probable flyaway area for an unmanned aircraft will be different for each aircraft design, so a single easy-to-define size is not expected to accurately model each system. A 3 minutes of maximum speed was selected with a minimum of 5 km and a maximum of 35 km. For detailed justification see JARUS SORA 2.5 release, Annex F.

5.2 Evaluating Gathering of People in the Adjacent Areas The purpose of the proposed 1 km distance from the outer edge of the operational volume is to assess if gatherings of people are adjacent. This means that any gatherings further than 1km distance would not be considered by the Competent Authority as adjacent to the operation and can be ignored in the analysis made by the UAS operator. Furthermore, the maximum dimensions of gatherings of people are rarely multiple kilometers in size, so as to not present a probable target further away than 1km distance. The following worst-case ground risk containment scenarios show examples of using a proposed 1km distance to evaluate quantitatively surrounding gatherings of people and populated areas.

5.2.1 Example #1 The street parade in Zürich is an annual event drawing people from multiple countries and causing major road closures and changes to public transport routes. This type of an event is very easy to predict and detect by a UAS operator. The Street parade example shows that there is a minimum increase in population density of factor 10 or a factor 100 measured within 1km of the operational volume from the average base population density. The difference could also be much more if the operational area is a controlled ground area. The triggers in this example are the gatherings of people in the normal shopping center area and the larger gathering of people in the street parade. So, in this case the more limiting gathering of people around 400,000 people would require the UAS operator to choose >50,000 ppl/km2 as the average population density used for picking the adjacent area GRC.

Page 17 van 25

AltMoC Triggers for Enhanced Containment

Figure 3 - Street Parade in Zurich with around 200,000 people

5.2.2 Example #2 The OpenAir Frauenfeld example also shows that there is a minimum increase in population density of factor 10 or a factor 100 measured within 1km of the operational volume from the average base population density. The difference could also be much more if the operational area is a controlled ground area. The trigger in this example is the gatherings of people in the festival. The competent authority has to estimate in this case if the 150,000 people is closer to 400,000 than 40,000 and which corresponding density to choose for the assessment. In this casec the conservative estimate would be the 400,000 people, but it is also conceivable that if only a small part of the gathering would be within the 1km adjacent area the smaller density value may also be argued for. However, in this case the density of >50,000 is used for the adjacent area GRC evaluation.

Page 18 van 25

AltMoC Triggers for Enhanced Containment

Figure 4 - Open Air Event in Frauenfeld with around 150,000 people

5.2.3 Example #3 The Stadium example shows that a 30,000 ppl gathering inside an already densely populated area does not significantly increase the population density measured within 1km of the operational volume. However, as with the previous examples the difference could also be much more if the operational area is a controlled ground area. The trigger in this example is the gatherings of people in the sports event at the stadium. The gathering is around 30,000 people and so the competent authority must decide whether this is closer to the 400,000 or 40,000 definition of gatherings of people. Arguably the 40,000 people definition is much closer and so the selected population density for the adjacent area GRC evaluation is <50,000.

Page 19 van 25

AltMoC Triggers for Enhanced Containment

Figure 5 - Stadium Letzigrund with Around 30,000 people

5.3 Expected Ground Risk Casualty Rate Model in the Adjacent Area We describe the risk to persons on the ground in the adjacent area using a similar concept for the risk to persons in the operational volume and buffers, the Expected Casualty Rate. The following events must occur for a UAS that begins operation within the operational volume to fatally injure a person in the adjacent area: • the aircraft must exit the operational volume (at this point, a loss of control of

the operation event has occurred), and

• then the aircraft must pass outside the ground risk buffer into the adjacent area, and

• then the aircraft needs to have an event that causes it to impact the ground in the adjacent area, and

• during this ground impact event, the aircraft must then impact and fatally injure a person (we will assume that an impact with a person will cause a fatality to simplify - ground Risk Mitigation M1 and M2 are only effective at reducing the number of people at risk and critical area/probability of fatality, if they are still functioning in the adjacent area)

Page 20 van 25

AltMoC Triggers for Enhanced Containment

This can be written in a probabilistic form:

Where: • EC,adj is the expected casualty rate in the adjacent area.

• Dpopavg,adj is the average population density in the adjacent area.

• AC,unmit is the critical area absent any effect of Mitigation 2.

• M1,adj is effect of M1 mitigation in the adjacent area.

• M2,adj is the effect of M2 mitigation in the adjacent area.

• P(ADJ) is the probability that the aircraft ends up in the adjacent area due to any

means.

• P(GI|ADJ) is the probability of a ground impact event occurring within the adjacent area, resulting in an impact with the ground. As a conservative assumption, it is assumed that the aircraft will impact the ground in the adjacent area at some point (i.e. P(GI|ADJ)).

5.3.1 Containment Objectives Based Upon the Risk of the Adjacent Area Using the methodology that is further substantiated in Annex F of the SORA 2.5 JARUS release, is becomes possible to tabularise across various combinations of final GRC in the adjacent area and the SAIL in the Operational Volume and Ground Risk Buffers.

EC,adj = P(ADJ) × P(GI|ADJ) × Dpopavg,adj × AC,unmit × 10M1,adj+M2,adj

Page 21 van 25

AltMoC Triggers for Enhanced Containment

6 Changes to AMC1 to Article 11 paragraph 2.5.3 on enhanced containment triggers

Supported by the considerations described in the chapters above, the changes from this AltMoC can be summarised as follows: The requirements for basic containment and enhanced containment remain unchanged. Also the trigger for basic containment will remain unchanged. The current text in point 2.5.3(c): (c) The enhanced containment applies to operations conducted:

(1) either where the adjacent areas: (i) contain assemblies of people unless the UAS is already approved for

operations over assemblies of people; or (ii) are ARC-d unless the residual ARC of the airspace area intended to be

flown within the operational volume is already ARC-d; (2) Or where the operational volume is in a populated area where:

(i) M1 mitigation has been applied to lower the GRC; or (ii) operating in a controlled ground area.

is to be replaced by the following procedure to determine the level of containment.

6.1 Procedure to determinate the level of containment requirements

6.1.1 Definitions Characteristic dimensions of the UA (in metres). The width of the UA in the direction transversal to the direction of flight.

• for fixed wing UA including hybrid configurations, the UA characteristic dimension is the wingspan;

• for conventional or coaxial helicopters UA, the UA characteristic dimension is the diameter of the main rotor;

• for multirotor (e.g. hexacopter) UA, the UA characteristic dimension is defined by the maximum distance (i.e. the diagonal distance) between blade tips.

• Maximum speed of the UA The maximum speed is conservatively defined as the maximum possible commanded airspeed of the UA, as defined by the designer, This is not the mission specific maximum commanded airspeed of the UA as reducing the mission airspeed may not necessarily reduce the impact area. MTOM (Maximum Take of Mass) The maximum UA mass, including payload and fuel, as defined by the manufacturer design organisation or the builder, at which the UA can be operated. Sheltering Expected protection of people from the UA in case of crash into a building or structure. If the operator claims a sheltered operational environment, the operator:

(a) uses a UA of less than 25 kg and maximum speed less than 35 m/s, and

Page 22 van 25

AltMoC Triggers for Enhanced Containment

(b) must verify that although the operation is conducted in a populated environment, it is reasonable to consider that most of the non-involved persons will be located within a building.

Average population density The average population density per km2 Unless it is plausible that the actual number of people per square kilometre is more than the government's stated population density based on inhabitants, the population density based on inhabitants may be used to determine the average population density. The Statistics Netherlands (CBS) provides this information. For this purpose, the publicly available PDOK viewer (https://app.pdok.nl/viewer) with the most recent CBS square statistics (CBS vierkantstatistiek) may be used. The PDOK viewer presents the inhabitants per block of 500x500m. These blocks can be used to calculate the inhabitants per square kilometer. Outdoor assembly of people An area where people are unable quickly to move away in case of a potential UAS crash, due to the density of the people present.

6.1.2 Procedure The level of containment for an intended operation depends on the UA and SAIL and on the number of people in the adjacent area. The size of the adjacent area also depends on the UA. This procedure describes how to determine the level of containment. The definitions of terms used in this procedure are explained after the tables. a) If the MTOM of the UA is less than 250g apply Basic containment with no

required operational limits for the population in the adjacent area. Otherwise:

b) Calculate the size of the adjacent area for the operation. The lateral outer limit

of the adjacent area is calculated from the operational volume as the distance flown in 3 minutes at maximum speed of the UA: 1. If the distance is less than 5 km, use 5 km, (case 1.1) 2. If the distance is between 5 km and 35 km, use the distance calculated,

(case 1.2) 3. If the distance is more than 35 km, use 35 km. (case 1.3)

c) Determine the population characteristics of the adjacent area:

1. Calculate the average population density between the outer limit of the ground risk buffer and the outer limit of the adjacent area.

Page 23 van 25

AltMoC Triggers for Enhanced Containment

2. Assess the presence of outdoor assemblies of people within 1 km of the outer limit of the operational volume and calculate the number of people within that assembly.

d) Select the applicable table (table 1 – 6) based on the characteristic dimension

and maximum speed of the UA to be used in the intended operation.

e) Use the SAIL of the intended operation to select the applicable row in the table.

f) Determine level of containment in the applicable table based on the population characteristics. 1. Average population density (row 3): select the column that meets the

calculated average of people density and determine the required level of containment for the intended SAIL.

2. Outdoor assembly (row 4): select the column that meets the assessed maximum number of people in the outdoor assembly and determine the required level of containment for the intended SAIL.

3. If a required level of containment (f.1 or f.2) is ‘out of scope’ the operation is not allowed.

4. If both required levels of containment (f.1 and f.2) are Basic the Basic containment may be use, if not the Enhanced containment is mandatory.

6.2 Tables to determine the level of containment The table to be used depends on the characteristic dimension and maximum speed of the UA.

< 1m UA (< 25 m/s)

Sheltering assumed applicable for the UA in the adjacent area

Average Population density allowed No Upper Limit < 50,000 ppl/km2

Outdoor Assemblies allowed within 1km of the OPS volume > 400k Assemblies of 40k

to 400k Assemblies < 40k

SAIL

I & II Enhanced Enhanced Basic

III Enhanced Basic Basic

IV - VI Basic Basic Basic

V-VI Basic Basic Basic

Table 1 - Containment requirements 1 m UA

Page 24 van 25

AltMoC Triggers for Enhanced Containment

< 3m UA (< 35 m/s)

Shelter applicable for the UA in the adjacent area

Average Population density allowed No Upper Limit < 50,000

ppl/km2 < 5,000 ppl/km2

Outdoor Assemblies allowed within 1km of the OPS volume > 400k Assemblies of

40k to 400k Assemblies < 40k people

SAIL

I & II Out of scope Enhanced Enhanced Basic

III Out of scope Enhanced Basic Basic

IV Enhanced Basic Basic Basic

V & VI Basic Basic Basic Basic

Table 2 - Containment requirements 3 m UA with shelter assumption

< 3m UA (< 35 m/s)

Shelter not applicable for the UA in the adjacent area

Population density allowed No Upper Limit < 50,000 ppl/km2 < 5,000

ppl/km2 < 500 ppl/km2

Outdoor Assemblies allowed within 1km of the OPS volume > 400k Assemblies of

40k to 400k Assemblies < 40k people

SAIL

I & II Out of scope Enhanced Enhanced Basic

III Out of scope Enhanced Basic Basic

IV Enhanced Basic Basic Basic

V & VI Basic Basic Basic Basic

Table 3 - Containment requirements 3 m UA without shelter assumption

< 8m UA (< 75 m/s)

Sheltering assumed not applicable for the UA in the adjacent area Average Population density

allowed No Upper

Limit < 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor Assemblies allowed within 1km of the OPS volume > 400k Assemblies of

40k to 400k Assemblies < 40k

SAIL

I & II Out of scope Out of scope Enhanced Enhanced Basic III Out of scope Out of scope Enhanced Basic Basic IV Out of scope Enhanced Basic Basic Basic V Enhanced Basic Basic Basic Basic VI Basic Basic Basic Basic Basic

Table 4 - Containment requirements 8 m UA

Page 25 van 25

AltMoC Triggers for Enhanced Containment

< 20m UA (< 125 m/s)

Sheltering assumed not applicable for the UA in the adjacent area Average Population

density allowed No Upper Limit < 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor Assemblies allowed within 1km of the

OPS volume > 400k Assemblies of

40k to 400k Assemblies < 40k

SAIL

I & II Out of scope Out of scope Out of scope Enhanced Enhanced III Out of scope Out of scope Out of scope Enhanced Basic IV Out of scope Out of scope Enhanced Basic Basic V Out of scope Enhanced Basic Basic Basic VI Enhanced Basic Basic Basic Basic

Table 5 - Containment requirements 20 m UA

< 40m UA (< 200 m/s)

Sheltering assumed not applicable for the UA in the adjacent area Average Population density

allowed No Upper

Limit < 50,000 ppl/km2

< 5,000 ppl/km2

< 500 ppl/km2

< 50 ppl/km2

Outdoor Assemblies allowed within 1km of the OPS volume > 400k Assemblies of

40k to 400k Assemblies < 40k

SAIL

I & II Out of scope Out of scope Out of

scope Out of scope Enhanced

III Out of scope Out of scope Out of

scope Out of scope Enhanced

IV Out of scope Out of scope Out of

scope Enhanced Basic

V Out of scope Out of scope Enhanced Basic Basic

VI Out of scope Enhanced Basic Basic Basic

Table 6 - Containment requirements 40 m UA

Example For an UAS < 1m UA and max speed of 25 m/s enhanced containment is needed • For a SAIL I & II operation if the adjacent area

o has an average people density of > 50,000 ppl/km2 or o has an outdoor assembly of 40k to 400k ppl within 1km of the OPS

volume • For a SAIL III operation if the adjacent area

o has an average people density of > 50,000 ppl/km2 or o has an outdoor assembly of more than 400k ppl within 1km of the OPS

volume