Transcript
Slide 1
Hello and welcome to the RPAS operational risk assessment, that's Remotely Piloted Aircraft Systems, Operational Risk Assessment webinar. This is based on Transport Canada Advisory Circular 903-001 Issue 02, which was published in June of 2024, and this recording took place in August of 2024.
Slide 2
So, on our agenda for today, we're going to cover a little bit of the background of this operational risk assessment process, where it comes from and why we use it. We're gonna go through the process itself and describe what steps you need to take as you carry out an operational risk assessment and then we're going to spend a bit of additional time at the end of the presentation to discuss a few specific topics, detect and avoid or DAA, the standard scenarios that we've put together to streamline applications for certain types of operations, and population density assessment, which is a new concept in this issue 02 of the advisory circular. So quick note before we move on that there are some green boxes and/or highlights on some of the slides as we work our way through. These are to indicate places where content is new or has been changed compared to the original issue of the advisory circular.
Slide 3
So, moving on to the background, this RPAS operational risk assessment has been in use in Canada since 2019. So, we started out with it as a draft and used it to support special flight operations certificates, SFOC issuance until it was officially published in 2021, as issue 01, which was based on the JARUS SORA version 2.0. I've provided a link on the slide there for the JARUS content and we made some adaptations to make this process work a little bit better for the Canadian context. Using this process to support special flight operations certificates helped us generate the experience to create regulations that are now being proposed and we're going to continue doing this with the advisory circular Issue 02, which will help us continue to look at new and novel operations and develop our understanding so that we can continue our regulatory path. So, as another note, before we continue moving forward, this process specifically is still only used to support higher risk operations under SFOC. So, there's a link to the Special Flight Operations website from the Transport Canada page. There's a list on that page that describes the specific operations that call for an ORA to be done in support of an SFOC application.
Slide 4
So, moving on to the process itself, in general, what we are looking for out of this process is a description of what it is that you would like to do with your operation. You then feed that through this operational risk assessment process, which helps us understand and you understand how much potential risk there is to the public associated with this operation. And then finally, that leads us to an output that describes the information that you need to provide to TC to help us understand that you can do this operation in a safe way. So, there's a bunch of words on that slide of what happens at each of those steps. We're going to go through all of those as we work through the process itself.
Slide 5
Moving on to the steps of the process, these are in the order as presented by the JARUS SORA version 2.0, which is what this advisory circular was originally based on. On the following slide, I'll show that they've been reordered slightly in the advisory circular itself to support smoother collection of information, but essentially the process consists of understanding your concept of operations, working your way through ground and air risk, and then figuring out the various performance and robustness levels. All the information that you need to show again that you can do this operation safely. Worth noting as well that if you reach the end of the process, there are a few places where you can conclude that you cannot do this operation safely. There is always an opportunity to go back to the initial stage of the process and change the concept of your operations in a way that makes it overall safer and that can result in a different answer at the end of the process where you are able to conduct the operation safely.
Slide 6
Moving on, just quickly to show the reorganization of the steps for AC 903-001 in particular, it's down in steps 6 through 9 where some of the items have been reordered. Again, just to simplify the organization of these pieces.
Slide 7
So, moving on into the process itself, the first step is the CONOPS or concept of operations, and the idea at this stage is it's on the operator the applicant for the SFOC to collect and provide us enough information about what it is that you would like to do and what drone you would like to use so that we can understand the intent of this operation. So, the key information is again, what do you want to do? What's the RPA? Where do you want to do it and that where is covered using a concept that we call the operational volume. So, we'll move on to that.
Slide 8
So, the operational volume includes 3 pieces, what we call the flight geography, the contingency volume, and a ground risk buffer. So, the ground risk buffer is typically one to one, and what that means is based on your planned maximum altitude above ground, you provide the same distance horizontally as the ground risk buffer. So, if you're flying at 400 feet AGL, you need 400 feet along the ground as your ground risk buffer. So the other two pieces, the flight geography includes all of the sources of error that could lead to you flying not exactly where it is that you plan to fly, so things like errors associated with defining your path through space, errors associated with the navigation system on your aircraft, in particular, altimetry systems can be a challenge with certain types of drones, so dealing with an altitude above ground level if the ground has some variation, the terrain has some variation can cause some challenges. All of that needs to be accounted for in the flight geography. The contingency volume then applies contingency procedures where you're out of normal operating situation, but not in an emergency state. So, things like automatic land in place or return to home, things like loss of command and control or C2 or a loss of GPS or other positioning information, those need to be addressed in the contingency volume to say this is the worst case of where I could end up in any of these situations. There's additional information on all of these things in the advisory circular itself.
Slide 9
The other interesting piece about this operational volume concept is that you can use it sort of in reverse to help you create operational limitations that allow for a more flexible SFOC at the end of the day. So, if you instead of saying I want to fly in this specific location on this specific date or time or time of day, you can say I know that my operation can operate up to a certain level of risk, which is what's going to get assessed within this operational volume. And you can understand how big each of those pieces are, and that can tell you how far away you need to be from areas that are higher risk than what you're comfortable with. Although noting that higher risk ground areas and airspaces outside of the operational volume also do need to be considered when we get to containment requirements. We'll talk about that a little bit later. And this is because although we know that flyaway incidents are fairly low probability, they can be very high consequence if you are adjacent to things that are of high risk, so higher risk airspace or a large number of people on the ground if you're close to that, a flyaway can be very problematic, so we have additional requirements to address it.
Slide 10
Moving on to Step 2, the intrinsic ground risk class, so the ground risk class concept itself is not new, but all of the way that we're figuring it out on this slide is new for Issue 02 of AC 903. So, we've changed the sizing determination of your RPA it now is based on an operating weight which is the weight of the RPAS at any point during the flight, and instead of using a generic operational description, we're using population densities to drive what the ground risk category is. So, once you've figured out your operational volume, you go into this table and you say, I know the weight of my RPA sets the column that I go down and then the worst-case population density in my operational volume drives which row I need to read off. And then you'll read off your number between one and 10 to get your intrinsic ground risk class. It's also worth noting that both for this ground risk class and for the air risk class that we'll get to later, you can divide up a flight into phases and have different ground risk or air risk levels throughout the phases of flight, and you can address the different levels of risk throughout a flight using different approaches just depending on what makes sense for your operation.
Slide 11
So, moving on to the final ground risk class. There is a step here where you have an opportunity to use what's called strategic mitigations to reduce that intrinsic ground risk class of the operation. So, the key thing about these mitigations is that you need to demonstrate that the actual operational environment is less risky than what you would expect based on the intrinsic ground risk class. So, there are a few different ways that you can do this. An example that we've used is VLOS operations, so the table presented on the previous slide assumes beyond visual line of sight or BVLOS operation. If you're operating within visual line of sight or VLOS using visual surveillance of the ground area, so either the pilot or visual observers who can maintain observation of the area that you're flying over to make sure that you're flying your RPA away from people who are not involved in the operation. That gets you an automatic one-point reduction on your ground risk class, since again, that intrinsic GRC assumes BVLOS. That's one way of doing it. There are other mitigations that you can propose. There's some content in the JARUS SORA documentation about how to go about proposing strategic mitigations. We don't have a firm stance on any of them at this point. They're considered on a case-by-case basis and they may or may not result in credit being given in the form of GRC reduction. So, if you want to propose that best to come and talk to Transport Canada directly and we'll help you understand where we can go with that. Having said all of that, there is a decision point here where if your final ground risk class is above 7, the RPAS ORA does not apply. We don't have guidance to address that type of operation using this assessment process. So again, you need to come and talk to Transport Canada directly to help figure out how to get an approval for that type of an operation.
Slide 12
Moving on to the initial air risk class, a similar process to the ground risk, although in this case we have a decision flow chart here. You can use this chart, or we also have a graphical format on the next slide that we'll get to. And I also have some definitions, but effectively you go through this chart, and you answer yes or no questions about: “Are you in atypical airspace? Are you above flight level 600?” And so on, until you get to an air risk class from A to D where A is the least risky and D is the most risky.
Slide 13
Again, the same thing in graphical format. These are both in the advisory circular as well, so you can follow them with a higher quality image in the advisory circular and for both of these slides there's some things to point out where we've made some adjustments to the definitions. So, the atypical airspace one we'll get to that on the next slide where I have some specific definitions to talk to. The other piece is the ARC-c that you can see towards the bottom center of the slide in uncontrolled airspace. That definition used to include when you were flying below any controlled airspace that started at 1500 AGL or lower. That has now been reduced to only underneath transition areas or terminal control areas that start at 1500 AGL or below. So, better understanding of the airspace structure and what was driving that requirement led us to scale it back a little bit to provide a little bit more operational flexibility in other cases.
Slide 14
Moving on to the definitions, so atypical airspace. I've circled - points one and two here have not changed since the original issue of the AC - points three and four have so three is what we call the infrastructure masking provision. The wording here has been adjusted to clarify what the intent was behind this definition of atypical. So, within 100 feet above and 200 feet horizontally, those numbers should be familiar from Part IX, from any building or structure which stands out vertically beyond the adjacent surface of surrounding terrain, so the intent here is it needs to be something built by humans. That's big enough and stands out enough that a traditional aircraft, a pilot of a traditional aircraft, would notice it and know that they need to avoid it as an obstacle, and that leads to ensuring that you have some separation from those traditional aircraft. If you're flying a drone close to that stuff, so that definition intentionally doesn't include things like terrain or trees. But if you are doing an operation where you think the terrain or the trees or other similar things should give you a similar sort of safety margin, you can come talk to us about using that as a strategic mitigation even though you can't use this definition directly. The other one that is worth noting that's been added in this new version of the AC is the legal night. So, point four within the hours of legal night, provided you're in uncontrolled airspace and outside of an aerodrome environment. And no higher than 400 feet AGL, that is now considered atypical airspace as well. So that should open up a fair amount of possibility to allow operations that would have otherwise been difficult to do prior to this definition being added. And just to close out on that topic, the aerodrome environment definition is mostly the same as it was before, with the exception of the circled in green text, which now restricts that definition to only applying at or below 3000 feet AGL from that aerodrome. So, if you're above 3000 feet AGL, you aren't in atypical airspace anymore for sure, but you're also not necessarily in that airport or aerodrome environment.
Slide 15
Moving on again to the next step, so similarly to the ground risk class, you can use strategic mitigations in some cases to reduce the air risk class of an operation. Again, the same sort of caveats apply. These mitigations have to demonstrate that the actual operational environment causes there to be a lower risk to the other users of the airspace than what you would expect based on the intrinsic air risk class. So, the example we've given that has been applied in certain cases is if you're operating within 5 nautical miles of a seasonal aerodrome. So, within that aerodrome environment definition, you may be able to get an ARC-b instead of an ARC-c, if the operation takes place when that aerodrome is closed for the offseason. This doesn't necessarily always apply. Some aerodromes are partially closed or switched to ski or similar winter operation instead of being fully closed. But if a seasonal aerodrome is fully closed in winter months, it is possible to have that assessed as an ARC-b instead of an ARC-c. Again, same as for ground risk class, other mitigations will be considered on a case-by-case basis, come and talk to us about it, but they may or may not result in credit being given in the form of ARC reductions.
Slide 16
Now moving on to step 6, the SAIL - Specific Assurance Integrity Level. So, once you have figured out your ground risk and air risk class. Essentially, you just take those and you go into the table shown on the right-hand side of this page. The ARC gives you a column, the ground risk class gives you the row and that leads you to a SAIL between one and six using the Roman numerals there, and the SAIL is linked to operational safety objectives and determines the levels of robustness, which we'll describe a little bit later in Step 9. And effectively the SAIL describes the overall risk level of the operation and how confident we need to be that you're able to maintain safety.
Slide 17
The next piece, as we've alluded to earlier, is dealing with adjacent areas and airspaces. So, containment is the requirements that we apply, but it's helping to understand if you are operating close to, but your operational volume does not include higher risk airspaces or ground areas, that can lead to additional requirements being placed on you in the form of containment objectives. So, some definitions to work through to understand how that works. Adjacent area and airspace we say is any ground area or airspace that is reachable from the border of the operational volume in TERP, which is the emergency response plan time, and we have the definition of that on the next page, at the maximum performance capability of the RPA. So, you need to account for worst case ground speed at your maximum RPA speed and worst case wind and the worst case climb rate. Those two don't necessarily have to both be considered together if they can't happen together. If your climb rate requires you to be at a slower ground speed, then you don't have to do both. But you have to consider each one individually. The performance capability needs to include again as I just said, ground speed, worst case combination of wind and air speed and the climb rate.
Slide 18
So, moving on to the remainder of the definitions. So again, TERP is the emergency response procedure time. So if you do have a flyaway, this is how long does it take you to realize that a flyaway has happened, complete your checklists, whatever actions it is that you're going to take in response to that flyaway and allow appropriate time for mitigations, especially if that includes contacting other users of the airspace or ground users to warn them of this flyaway situation. So the thing that's been added to this definition in our latest version of the Advisory Circular, and this is to align with the new version of JARUS' SORA, is if you do not have a tested value for your emergency response plan time, it is acceptable to use a value of three minutes as a default for the purposes of this calculation.
Slide 19
So once you have figured out those numbers and figured out your distances that you can fly - this is described in text in the advisory circular, we've provided it in a graphical format here on the slide - you need to consider the maximum ground risk class in the adjacent area, so you do the same assessment of that adjacent area in terms of population density and the size of your aircraft, and come up with what ground risk class that adjacent area would be. And if it is greater than what is in your operational volume, depending on how much greater it is, you will get either low or high robustness containment objectives assigned to you. So, this approach is new for issue 02 of the advisory circular. We hope it's simplified a little bit compared to the previous version and specifically worth noting here that this is maximum ground risk class in the adjacent area, not average. JARUS has used average in their latest version and that is not a path that we've decided to go down.
Slide 20
And once you figured that out for ground risk, you do the same thing for air risk. So again, in this case you look at your operational volume and the adjacent airspace and if the adjacent airspace is enough higher risk than your operational volume, you can get assigned either low or high robustness containment objectives as per the graph on the page.
Slide 21
And then finally, to complete the containment piece, the final level of containment required is the greater of the two. So, if you got a high level of containment required for ground risk and a low level for air risk, you have to meet the high level, and the same thing vice versa. So, it's the highest level that you need to meet. And also worth noting, similar to the operational volume, you can use containment objectives sort of in reverse to help you understand how to get a more flexible SFOC. So if you understand that you only want to meet the low robustness containment objectives, then that tells you that things that are going to drive to a high robustness containment objectives, so enough higher risk in that adjacent area, you need to be far enough away from those that allow you to stay at a low robustness level of containment or you can choose to meet high robustness containment objectives and then you're covered for any situation, for whatever is beyond your operational volume.
Slide 22
We'll now go over step eight, which relates to detect and avoid performance objectives. To start with, there are no changes to this section for Issue 02 of the advisory circular. Detect and avoid provides the performance expectations for the RPAS to avoid traditional aviation and is driven by the air risk class for the defined operational volume. The more congested and challenging your airspace is, such as ARC-d and -c, requiring greater performance and robustness. One of the main performance parameters you'll see is the risk ratio. This ratio indicates the ability of the detect and avoid function to mitigate a near mid-air collision, or NMAC, which is an intruder aircraft getting within 500 feet laterally or 100 feet vertically of the RPAS. The lower the risk ratio, the better. So, taking ARC-d as an example, 0.1 means 90% of the potential NMACs will be mitigated. It's important to emphasize the DAA being assessed as an end-to-end function, which includes the detection of the intruder aircraft, deciding it's a potential NMAC, commanding the RPAS to maneuver, the RPAS executing the maneuver, and the operator getting feedback that it was performed. We'll discuss DAA again later in the presentation.
Slide 23
We'll now talk about OSOs or operational safety objectives. There are a total of 24 operational and technical safety objectives (sometimes the OSO is a mix of both) that must be met for an operation. These will cover things ranging from the reliability of an RPAS and standards used in its design to crew operational procedures in normal and emergency situations, as well as supporting services and infrastructure used in the operation. The OSOs are driven by the SAIL of the operation, which in turn drives the robustness needed. Higher SAILs requiring more robustness. The robustness level in turn determines the integrity required, which describes the safety related performance level and the assurance required, which is the proof TC is looking for to demonstrate the integrity is achieved. The particulars of the assurance you'll need to submit to TC will vary between the different OSOs and robustness levels. At lower robustness levels, these can be a straightforward declaration by the operator or RPAS manufacturer. At higher robustness levels, these could be detailed analysis or test results.
Slide 24
There is a considerable amount of detail in the OSOs, so we'll just highlight some of the robustness changes for the OSOs in Issue 02 in the next two slides. But before that, just some background, the detailed updates to the OSOs were driven by a number of factors, including operational experience and feedback, the lower risk BVLOS draft regulations that TC provided in CG I, as well as developments and discussions with other regulators and standards organizations. The key on the slide is orange highlights show an increase from AC 903 Issue 01 and green highlights show a decrease from Issue 01. So, to start with, for OSO 4, which relates to the use of design standards, while it looks like there has been an overall increase in the robustness, it's primarily dropping the low category and aligning the two other levels medium and high. So now at SAIL III and IV, it is still a manufacturers declaration, but we are looking for more details on the means of compliance used, similar to the proposed low-risk BVLOS.
Slide 25
For OSO 18 and 24, we've similarly aligned the expectations for SAIL III and IV levels. For OSO 18, this is now optional at SAIL II. For SAIL III it's now aligned with SAIL IV. This is still a self-evaluation as previously required, but we ask you do this to HFE best practices, and we point to available industry standards and guidance within the advisory circular. And also, have the demonstration evidence available should TC ask for it. For OSO 24, SAIL III and IV have been aligned. This is still a manufacturer self-declaration, but TC will want to see more details on what environmental testing was conducted. As always, we may ask for supporting evidence, including test reports, et cetera.
Slide 26
Overall, we have tried to put more detail within the OSOs than previously existed as both TC and operators have gained more experience of these objectives and TC has firmed up where we think the medium and high robustness levels need to be. There are a lot more details within Appendix C of the Advisory Circular, which we will not be able to cover completely here.
Slide 27
In summary, the submission to TC should be a comprehensive safety portfolio, including a description of the operational volume, how the GRC / ARC / SAIL were determined, and how the objectives, be they DAA performance or OSOs are met. Per the last section of the slide, we encourage the use of existing documentation. Just ensure the references to documentation are clear and specific to your operation.
Slide 28
Now some additional discussion on DAA and points TC would like to emphasize. The DAA function can be achieved using technology, visual observers, or both. Additionally, as this topic has come up often before, the risk ratio and detection capability apply equally to cooperative traffic such as aircraft with ADS-B and non-cooperative traffic that can only be detected by sensors or visual observers. The point to emphasize here is DAA solutions based around cooperative sensors such as ADS-B are not sufficient unless it can be shown that all traffic in the operational volume is using, say, ADS-B. Finally, technology based DAA questions can sometimes get very complicated given the variety of technologies and implementations. So, if the contents of the AC don't answer your questions, we advise you reach out to TC using the email above.
Slide 29
We've also added additional guidance on visual observer DAA within the AC. Of note here, there are similarities between the extended VLOS operation proposed in the lower risk BVLOS regulation package. However, the extended VLOS is slightly more restrictive than VO DAA described in the AC. For example, shorter distances from the pilots allowed. We're not intending to align the AC with the extended VLOS so SFOCs will continue to be more flexible.
Slide 30
Now we will talk about standard scenarios. These have been around in draft form, but we've now incorporated them into the advisory circular. Note that the draft versions no longer apply since they have been superseded by the versions in the AC. TC has seen a number of operations that fell into specific categories. Photography, agricultural spraying, et cetera. And we had developed a common approach for them. Based on this operational experience, TC then looked to define specific bounded operations with an eye to streamlining the ORA process required for them. The benefit is the ORA process is simplified for applicants. However, the operator must stay within the defined boundaries of the standard scenarios they have obtained approval for.
Slide 31
This slide provides a summary of the standard scenarios currently available. We won't go through them in detail here. Suffice to say, while these scenarios can be used for a variety of operations, from filming, AG spraying, commercial, recreational, et cetera, TC isn't specifying use. Just satisfying the streamlined ORA and staying within the defined limitations when operating.
Slide 32
Finally, we have a few additional words about population density assessment. As alluded to before, this assessment is a new feature of AC 903 Issue 02. Guidance is provided in the AC in Appendix G. In general, the expectations for population density assessment consist of three steps, so we expect to see some form of virtual site survey. So, this is looking at your operational volume and adjacent areas using data sources that are available online, such as StatsCan, in particular with the Statistics Canada data, we point to dissemination areas. In general, you want to use the lowest level of granularity that is reasonable for your operational volume. So, for Statistics Canada, that's dissemination areas, you can also use sources such as Google Maps or Bing Maps or any other satellite imagery provider to help augment the Statistics Canada data, which does have some limitations from the way that data has been collected. Just to note on this topic, in terms of virtual site survey, we are investigating whether this is an information source that can be added to the NRC drone site selection tool, more to come on that at some point in the future. It's still under investigation. Following your virtual site survey to determine the population density and get that initial ground risk assessment done, we expect this to be followed up by an in-person site survey. This both satisfies your requirements under Part IX for a site survey and serves as a confirmation of your virtual site survey and helps you assess whether there are any particular local risks. So, anything that may have changed since the data that was collected to inform your virtual site survey. So, if a new development has been built since that data was collected, the risk may be higher than what the virtual site survey would indicate. And likewise, if the virtual site survey indicates that the area is of a higher population density and your in-person site survey shows that your specific operational volume doesn't actually contain any population, it's possible to argue in the other direction. And then finally operational monitoring. So, this is during an actual operation we expect, in the same manner that you would for traditional aviation, you have some means to continue assessing any potential new risks and have plans and procedures in place for mitigation. So, if suddenly on the day of your flight, there is a festival in a field that you were intending to fly over. We expect to see a plan to mitigate that when you go flying.
Slide 33
That covers the content that we intended to address in this presentation, if there are any questions, they can be submitted to the RPAS Task Force at the email presented on this slide. Thank you for your attention.