Risk Management Model for Unmanned Aerial Vehicles during Flight Operations

Risk management and uncertainty models are practised in all branches of transport. Although unmanned aerial vehicles (UAVs) constitute a branch of the industry rather than transport as a whole, their development is oriented toward increasingly more serious applications involving the transport of goods and people. The constantly growing number of operations employing UAVs requires not only identification of hazard sources or risk assessment recommended by the applicable regulations, but also comprehensive risk management. In order to develop a systematic approach to risk management for air operations of UAVs, the classic risk management method can be used. This work proposes a novel multi-criteria risk model that may serve as the basis for further activities aimed at developing a risk management method for this domain. The model was based on six criteria and validated using a virtual route to risk assessment and valuation.


Introduction
Due to their characteristics, the use of UAVs is increasingly common in industry, agriculture, construction, photography, and many other areas of human activity [1][2][3][4][5]. The use of UAVs in the energy production industry is also becoming more and more common. UAVs can be used, for example, to measure the amount of coal extracted in opencast mines, to study the composition of smoke emitted by power plants, and to monitor the technical condition of electricity transmission lines. In this context, the UAV is a platform for transporting the measuring device. Such a device can be an RGB camera, LIDAR, or an air quality measuring device.
An example environment that includes selected threads during use of UAVs is shown in Figure 1.

Introduction
Due to their characteristics, the use of UAVs is increasingly common in industry, agriculture, construction, photography, and many other areas of human activity [1][2][3][4][5]. The use of UAVs in the energy production industry is also becoming more and more common. UAVs can be used, for example, to measure the amount of coal extracted in opencast mines, to study the composition of smoke emitted by power plants, and to monitor the technical condition of electricity transmission lines. In this context, the UAV is a platform for transporting the measuring device. Such a device can be an RGB camera, LIDAR, or an air quality measuring device.
An example environment that includes selected threads during use of UAVs is shown in Figure 1.   Every transport system functions in conditions of uncertainty that threaten the accomplishment of its objectives related to infrastructure and transport organisation. Risk management is aimed at identifying events that may affect the accomplishment process [5]. Risk management has been practised in an unofficial manner for a very long time; events such as transportation, industrial, and economic disasters contributed to its systematisation, and then risks started to be dealt with in an organised and consistent manner in different areas of human activity [6]. This has led to the development and application of various methods, techniques, procedures, and tools classified under a common name: 'risk management' [7]. Many studies have examined risk management in chemical plants, nuclear power plants, and transport systems; this reflects that these areas generate a considerable number of hazards [7]. Generating hazards in various systems is one of the reasons why safety and risk management procedures were developed by entities involved in process execution in transport systems. Risk management models in transport systems can be found in studies [6][7][8][9][10][11][12][13][14][15][16][17], among others. Risk management should be treated as one of the tools of safety management systems [16]. Every entity managing elements of a transport system should also provide traffic safety management, ensuring observation and assessment of the number of accidents, casualties, and persons injured in accidents. Moreover, such entities should provide the possibility of completing a transport operation with the lowest risk possible. The path to such a state of safety leads to the development and skilful application of risk management methods [18][19][20]. Unmanned aerial vehicles (UAVs), i.e., multirotors, planes, and helicopters, are devices that-due to their functional characteristics-are used on an increasingly wide scale in different areas of human activity. Potential uses of UVAs were presented in [21][22][23].
The growing number of air operations that use UAVs entails a growing number of adverse events involving such vehicles. For this reason, work is underway to increase safety levels whilst operating UVAs. In study [24], the authors suggested a methodology for computing the probability of impact on 3D infrastructures, such as buildings, in the event of a UAV failure during flight. The generation of impact probability maps on the infrastructures is based on Monte Carlo simulations involving a dynamic model of a fixedwing UAV. In another study, we find an integrated risk assessment method that considers probability and severity models of a UAV impacting people and vehicles on the ground. By introducing the gravity model, density of population and traffic are estimated on a finer scale, which enables more accurate risk assessment. The 3D risk-based path planning problem is first formulated as a special minimum-cost flow problem [25]. Study [26] proposes a framework for computing the risk of collision with an obstacle based on a UAV's predicted trajectory, proximity to static and dynamic obstacles, sub-system state-of-health, and external wind conditions. The problem of safety in UAV operation was described in works [27][28][29][30], among others. In addition to scientific studies, there are also legal provisions that apply to UAVs, which are presented below.
The purpose of the article is to present a component of risk management for UAV flights, multi-criteria proposal, and a risk model developed based on a generalised risk model in the context of the applicable regulations.

Flight Categories and Assumed Risk Level
Within the European Union, flights of each UAV type take place based on the following EU regulations: These regulations define UAV classes and stipulate the rules and procedures related to the operation of these aircraft. According to [31,32], we distinguish seven UAV classes (C0-C6), depending on their equipment, weight, and forward speed in level flight. The categories on which the manner of risk management depends are [ Air operations in the OPEN category may be conducted with an aircraft with maximum take-off mass (MTOM)-understood as the sum of the platform mass and the load mass-of less than 25 kg. The flight takes place within the visual line of sight (VLOS) and within 120 m from the closest point of the surface of the earth. The task of the remote pilot is to keep a safe distance from people [33].
The OPEN category is a non-significant or widely acceptable risk area that does not require risk-mitigating actions [33]. This is due to the low take-off mass, which does not exceed 250 g and 4 kg for subcategories A1 and A2, respectively. The low take-off mass generates low kinetic energy (e.g., for A1, E K = 1/2 mv 2 ) during an adverse event such as the UAV striking a person's head. Moreover, in subcategory A2, flights may take place at a distance of 30 m from uninvolved persons or, in the case of low-speed-mode flights, at a distance of 5 m from them. Subcategory A3, which is also part of the OPEN category, is characterised by high take-off mass, but the pilot must conduct air operations over an area where it can reasonably be expected that, under normal circumstances, no uninvolved persons will be endangered, and at a distance of at least 150 m from residential, commercial, industrial, or recreational areas. According to the applicable regulations, the operator is not required to perform a risk assessment in this category of flights [33].
In the case of the SPECIFIC category, the risk related to the performance of the flight is tolerable, i.e., the transport aircraft may be operated, but under certain conditions [33]. This means that an authorisation is required for the performance of such flights, which must take place in accordance with the restrictions included in the operational authorisation or in the standard scenario defined by the legislative body. Flights may take place in compliance with other rules, provided that the UAV holds a light UAS operator certificate (LUC) with appropriate privileges. Authorisation to execute a mission can be obtained from the competent aviation authority in the given country [31]. In Poland, this authority is the Civil Aviation Authority. There are three ways of obtaining an operational authorisation.
The first consists in the pilot making a declaration that they will conduct flights in compliance with the principles of conducting flights stipulated in the so-called standard scenarios. It is assumed that if the pilot conducts the flight in compliance with the principles defined in the standard scenario, the risk related to the performance of the flight is acceptable. Currently, two standard scenarios have been formulated within the European Union. Additionally, in Poland, so-called "national standard scenarios" apply, which are valid for flights conducted in VLOS and BVLOS (beyond visual line of sight), for aircraft masses of up to 4 kg and 25 kg, and for the following UAV types: multirotors, planes, or helicopters. The remote pilot has a total of eight scenarios, i.e., eight different variants of conducting the flight, at their disposal.
The second method of obtaining the operational authorisation is to obtain the appropriate certificate (in the case of the EU, an LUC). The certificate is granted to the operator-understood to be a natural or legal person operating an aircraft-after they pass an inspection by the competent aviation authority in the given country. The certificate authorises the operator to make independent decisions about conducting a flight based on risk assessment.
The third way of obtaining the authorisation, in the case of executing flight missions in a manner not described in the standard scenarios, is to submit a request to the competent aviation authority to issue the authorisation, along with the terms of conducting the flight based on a risk assessment performed independently by the operator. The currently recommended risk assessment method is that developed by the Joint Authorities for Rulemaking of Unmanned Systems (JARUS). The method is called the Specific Operations Risk Assessment (SORA) [34]. It is a very complex and time-consuming process that also requires access to a broad spectrum of technical information to which only the unmanned platform manufacturer has access.
The SORA method is a multi-stage method UAV flight risk assessment method. This assessment requires, inter alia: description of the concept of the operation (CONOPS), in which the drone operator, preparing for the mission, must describe all the details related to the flight, such as:

•
List of UAVs used for the planned operation, • Competences of the personnel involved in the operation, • List of names of pilots and support staff, • Procedures that will be applied in performing the mission, • Indication of health requirements, which must be met by the personnel performing the mission, • Declaration of the type of operation, including the purpose, method of performing the operation, restrictions due to environmental or legal conditions, scope of the operation (VLOS or BVLOS), indication of the area over which the operation will be performed together with the population density assessment, description of the so-called risk buffers, and description of the measures taken to ensure safety during the operation, The second step is to determine the intrinsic Ground Risk Class (GRC). This coefficient is determined on the basis of the assessment of the characteristic dimensions of the aircraft, such as its size, mass, and kinetic energy of potential collision with the ground. The next step is to define the so-called Final GRC of the impact hazard on the ground. In some cases, the GRC value, determined in step 2, may be so high that the resulting safety objectives to be achieved are too demanding for the operator. Therefore, to lower the GRC, one can either change the CONOPS or implement mitigation strategies. Consideration of measures, methods, and features of the system and mission that can positively affect the final GRC value can reduce the actual GRC value. For the reduction of GRC, for example, a parachute system can be used. The fourth step of the SORA assessment is the Determination of the Initial Air Risk Class (ARC). The airborne risk class depends on the determination of the chance of a collision with a manned aircraft. There are four classes, which can be distinguished from one with no risk of collision to one where the probability of collision is high. Another step in the SORA analysis is the application of measures at the strategic level and the definition of the end-risk ARC. Someone must use this step if the risk assessed in step 4th is too high. At this point, strategies, procedures, and constraints are applied to reduce the likelihood of a potential collision before the UAV takes off. The sixth step in the SORA analysis is the definition of the Tactical Mitigation Performance Requirement (TMPR) or the definition of Robustness Levels. In order to minimize the risk of an airborne collision with another aircraft, it is possible to apply tactical measures to reduce this risk. This stage defines the goals to be achieved at different levels of solidity so that a potential meeting in the air does not end in a collision. The seventh step is to organize the Final Specific Assurance and Integrity Levels (SAIL). The SAIL parameter consolidates the GRC risk with the ARC risk and allows to define the requirements for the operation. SAIL is a measure of the level of control over the security of a mission. SAIL is a requirement for a specific concept of operation. SAIL represents the level of confidence in the control of operations. The eighth step of the SORA assessment is the identification of safety objectives at the operational level; the so called Operational Safety Objectives (OSO). This step uses SAIL to assess the safety barriers and to determine their robustness. There are four grades of quality: optional, low robustness, medium robustness, and high robustness. The next step is to address the risk of losing control of the operation, resulting in the violation of adjacent areas on the ground and in the adjacent airspace. These areas may vary according to the different phases of flight. Accurately defining the adjacent area is the job of the operator. The adjacent area is assessed on the basis of whether the failure of the UAV could lead to the collapse of the UAV outside the operational area, assessment of the UAV systems in terms of their reliable maintenance of the UAV in the area of operation, or other threats, the activation of which may lead to the UAV's escape outside the operational area. Once the assessments have been made in accordance with the procedure outlined above, the analysis document must be reviewed by the aviation authority, who can authorize the air operation. Regardless of the fact that this method is recommended by the Polish airspace authorities, the described level of complication of the SORA method and the evaluation model proposed by the authors described in the paper clearly show that the method proposed in the work is easier, does not require the assessment of so many parameters, and is much less time-consuming, which in the case of frequent unmanned missions is extremely important for the operator of aviation.
Article 11 of Regulation 2019/947 presents the procedure for risk assessment and allows for the development of a new, different operational risk assessment model. That model must include the following elements [33]: Regardless of the flight category, the risk level should be monitored. Control of the assessment area reduces the likelihood of the occurrence of adverse events (events which may lead to losses), but also facilitates rapid response if such an event does indeed occur. This is why the authors propose a risk model that makes it possible to assess the risk level for each type of flight.
In just the same manner as any other user of a transport system, a UAV operator should assess their physical and mental state before each air operation, and should also check and identify obstacles as well as potential sources of radio signal interference. Moreover, they should ensure an adequate safety level at the take-off and landing sites, including a reserve landing site. Therefore, from the point of view of safety engineering, the operator is responsible for assessing the risk [35]. The principles of the integrated risk management method based on the classical approach integrate two phases:

•
Risk assessment, and, • Responding to risk.

A New Risk Assessment Model
The nature of the organization and the goal it wants to achieve are factors that determine the choice of a risk management method. Within the framework of the classic risk management method, which the authors modelled, their components can be distinguished. There are two components in the risk assessment phase: • Risk analysis, • Risk evaluation.
The first component-risk analysis-is the systematic use of all available information in the indicated area of analysis, in order to: • Identify threats-this is a process of systematic procedure to identify threats, which, as a result of their activation, may cause losses in the indicated area of analysis, • Estimate and prioritize the risks identified in the analysis area-defining the value of the risk measure and assigning it to one of the risk levels of the model used.
As part of the risk assessment phase, the UAV operator should analyse the risk by characterizing the area and identifying potential hazard sources [33]. Next, they should assess the level of risk for the air operation by selecting the appropriate model and measures. The choice of the risk models and measures depends on the degree of complexity, detail, and the amount of information required and used [35][36][37][38][39]. In transport systems, the selection of the method depends on a number of factors, the scope of the process to be executed (e.g., transportation, infrastructure management, and maintenance), the availability of information on possible adverse events, and the experience of the people performing the assessment. An air operation must be preceded by an analysis of potential hazards that could lead to an air accident. There are five sources of potential hazards that, if activated, may cause a loss of control over the UAV, which may result in a UAV striking a person or object on the ground, or even another flying an unmanned or manned aircraft [39]. The five categories of hazard sources, as well as their respective contributing factors, are: (1) Human error (i.e., human factors in aviation). This problem has been known and studied since the Second World War. Contributors to human error include: The radiation emitted towards the Earth is usually absorbed by the atmosphere. Therefore, this radiation does not pose a threat to the operation of electronic systems used on board aircraft. However, if an electromagnetic pulse is too intense to be absorbed by the atmosphere, it will reach the Earth and may disrupt the operation of electronic systems. The consequence would be the loss of the ability to read the position of the aircraft from the navigation system, which may lead to an air accident. Electronic systems' performance may also deteriorate as a result of flying in the vicinity of devices emitting electromagnetic radiation. Such devices include BTS stations used in mobile telephony and high-voltage lines.
The schematic diagram of the risk analysis and assessment using the developed model is presented in Figure 2.
tion of the aircraft from the navigation system, which may lead to an air accident. Electronic systems' performance may also deteriorate as a result of flying in the vicinity of devices emitting electromagnetic radiation. Such devices include BTS stations used in mobile telephony and high-voltage lines.
The schematic diagram of the risk analysis and assessment using the developed model is presented in Figure 2. In managing the risk of threats, there are detailed procedures, models, and risk measures dedicated to the areas of transport: road, rail, air, water, and urban. Currently, there is no model dedicated to the UAV transport system for risk assessment. Filling the research gap, an original risk assessment model for UVAs was proposed.
When developing the models and measures of hazard risks identified within the assessment areas, a generalised risk model presented in [36,37] may be adopted.
Based on the generalised model presented in [38], for the assessment area of UAV flights in built-up areas, authors have developed the model for assessing risk levels. For the model, the set of hazards has the form (for this model, hazards are marked as h1, h2…hn): The risk model for each hazard from set HUAV is a function of components ri (hk) (i = 1, 2,..., m, k = 1, 2,..., n). Decisions are made based on the assessment according to 6 criteria Ki (i = 1, 2, ..., 6) and the measures of significance ai (i = 1, 2,..., 6) of these risk assessment criteria comprising the following set: The importance measure for each criterion was defined with values from 1-6. In the risk model for UAV flights in a built-up area, 6 criteria with the following names and meanings were assumed: The safety level indicator is expressed as follows: In managing the risk of threats, there are detailed procedures, models, and risk measures dedicated to the areas of transport: road, rail, air, water, and urban. Currently, there is no model dedicated to the UAV transport system for risk assessment. Filling the research gap, an original risk assessment model for UVAs was proposed.
When developing the models and measures of hazard risks identified within the assessment areas, a generalised risk model presented in [36,37] may be adopted.
Based on the generalised model presented in [38], for the assessment area of UAV flights in built-up areas, authors have developed the model for assessing risk levels. For the model, the set of hazards has the form (for this model, hazards are marked as h 1 , h 2 . . . h n ): The risk model for each hazard from set H UAV is a function of components r i (h k ) (i = 1, 2,..., m, k = 1, 2,..., n). Decisions are made based on the assessment according to 6 criteria K i (i = 1, 2, ..., 6) and the measures of significance a i (i = 1, 2,..., 6) of these risk assessment criteria comprising the following set: The importance measure for each criterion was defined with values from 1-6. In the risk model for UAV flights in a built-up area, 6 criteria with the following names and meanings were assumed: K1: safety level criterion SL. The most important criterion a 1 = 6. The measure of risk component r 1 (h k ) according to this criterion is determined depending on the value of the safety level indicator (SL): The safety level indicator is expressed as follows: SL indicator were presented in Table 1. In the analysis, the assumed annual flying time logged was 2688 h. The values included in the table were proposed based on the experience gained during remote pilot training conducted at the Poznań University of Technology. K2: loss occurrence reach criterion. Criterion of importance measure a 2 = 5. The criterion takes into consideration the type of material losses that may be caused by hazard activation. The losses concern the following subareas: infrastructure (subarea 1), natural environment (subarea 2), and people (subarea 3). According to this criterion, the measure of risk component r 2 (h k ) is determined by the following principle:

•
Low when the losses occurred in only one of the subareas, • Medium when the losses occurred in two subareas, and, • High when the losses occurred in all subareas.
K3: material loss criterion for material losses resulting from incidents involving UAVs. According to this criterion, the measure of risk component r 3 (h k ) depends on the extent of material losses:

•
Low when the losses do not exceed USD 2500, • Medium when the material value of the losses exceeds USD 2500, but does not exceed USD 125,000, and, • High when the value of material losses exceeds USD 125,000.
The values provided are based on the subjective assessment of the authors of the model. Measure of importance for this criterion was assumed at the level of a 3 = 4.
K4: loss criterion based on the type of incident. Importance measure a 4 = 3. The measure of risk component r 4 (h k ) depends on the object with which the UAV collided: • Low when UAV collides with another unmanned or manned aerial vehicle during flight, • Medium when UAV collides with an obstacle on the ground, and, • High when UAV collides with a person on the ground.
K5: hazard activation history criterion. Criterion of importance measure (a 5 = 2). It is assumed that if a hazard was activated once, it is likely that it will be activated again. The measure of hazard activation r 5 (h k ) is determined depending on hazard activation within a year preceding the assessment:

•
Low when the event was recorded no more than 5 times, • Medium when the event occurred no more than 10 times, and, • High when the event occurred more than 10 times. The measure of risk component r 6 (z k ) is determined in accordance with the following principle:

•
Low when a maximum of one element of criterion K6 was rated as average, • Medium when a maximum of two elements of criterion K6 were rated as average, and, • High when more than one element of criterion K6 was rated as high.
Importance criterion a 6 = 1. The measures of risk component r i (h k ) for each of the six risk model criteria for UAV flights assume the levels from set: The elements of set Ω (Formula (4)) of the measures of risk components are assigned a set of risk measure values. Therefore, the result of risk calculation for each hazard from set Z UAV (Formula (1)), according to criterion K i (i = 1, 2..., 6) is the level of risk for component r i (z k ) from the set of risk measure values. The function enabling estimation of the total risk measure taking into consideration the results of risk calculation according to the six criteria and significance measures of risk assessment criteria assumes the following form: The risk measures were selected subjectively following the principle of a starting wetness more important than the probability of their occurrence.
The next step should be risk evaluation, i.e., checking (by evaluation and by comparison) to which risk category (class) the estimated risk belongs (i.e., acceptable, tolerable, or unacceptable) [16].
The values of risk measures were determined, assuming an equal division for the adopted maximum and minimum.
The proposed risk acceptability classification for UAV operations was developed on the basis of the data from Table 2: • Acceptable risk: no need to take actions to reduce the risk, but the control by the UAV operator should be below 49, • Tolerable risk: the occurrence of personal or economic losses is medium or unlikely (the level of risk should be monitored); risk level is in the range of 49-78, and, • Unacceptable risk: area where flight should not be allowed under any circumstances; risk level above 78.
The presented risk tolerability limits constitute only a proposal developed as a result of the work performed. Nevertheless, they can be shifted depending on the area in which BSP operations are performed and their nature.

Results
The possibilities of using the model for the analysis areas related to drone operations located within Poznań were indicated. In order to show an example of an analysis using the model described in the work, a route between real points located in the Polish city of Poznań was proposed (Figure 3). The task that has been programmed before take-off on the drone's computer is to take a photo at the locations indicated by the pilot. The purpose of taking pictures is to control the number of people in places popular among tourists. Such a control may be performed by the police, who need to know where to send patrols to maintain law and order. The flight occurs in conditions where there is no terrorist threat and in a situation where the state is not involved in an armed conflict. The drone does not carry any dangerous cargo, and the only useful cargo that has been mounted on the platform is a camera. The UAV will return to the place of take-off and land after completing the task. The UAV's task will be to take photos in the places indicated by the pilot.

8.
Lowering the flight over the Cathedral in order to take a photo. 9.
Flight from the Cathedral to the place of the drone take-off and landing. Distance 1.5 km.
The flight takes place at an altitude of 90 m above ground level. Lowering the altitude to take a photo means flight at an altitude of 20 m above ground level.
Risk assessments of threats identified on the flight route in Poznań have been achieved by following the principles of the risk model for UVAs, good engineering practice, and the knowledge of the authors. Table 3 shows risk assessment results for two selected threats. Source: Authors' own elaboration.

Conclusions
The risk model indicates the algorithms and parameters of risk assessment and evaluation procedures. The original model is based on six criteria analysis with the possibility of taking into account the validity risk components obtained on the basis of each of the analysis criterion.
Meeting social expectations related to the operation of unmanned aerial vehicles largely depends on the effectiveness of risk management processes for hazards generated in this area of human activity. Currently, UAVs take off, fly up, and automatically cover their routes along the set flight paths. In order to operate without collisions, it is necessary not only to conduct a risk analysis, but also to introduce comprehensive risk management procedures-as in the case of all modes of transport-and the most important of these is to indicate the method or model of risk assessment.
Regulations recommend taking actions aimed at risk assessment. The methods developed for the purposes of such analysis for unmanned flights are far from sufficient.
The risk model presented in the paper is part of the risk management process. Risk estimation is preceded by the selection of the risk model and risk measurement model of threats identified in these analysed areas. The paper proposes a six-criteria risk model for unmanned aerial vehicles, which allows for the presentation of risk in a measurable manner. The criteria relate, inter alia, to the number of losses that may occur during the process being conducted in the human-technology-environment system, the probability of adverse events, and the history. Measures of criteria validity from 1-6 were adopted. For the criteria mentioned, qualitative measures of risk analysis were defined as low, medium, and high, which can be replaced by quantitative risk measures; for example, 1, 3, and 5 for this model. An exemplary UAV flight route in Poznań was developed and the risk for selected identified threats was estimated.