Unmanned Aircraft Systems Risk Assessment Based on SORA for First Responders and Disaster Management

: Worldwide, there is a signiﬁcant increase in the use of unmanned aerial vehicles (UAVs) by emergency services. They offer a lot of possibilities during rescue operations. Such a wide application for various purposes and environments causes many threats related to their use. To minimize the risks associated with conducting air operations with UAVs, the application of the SORA (Speciﬁc Operations Risk Assessment) methodology will be important. Due to its level of detail, it is a methodology adapted to civilian use. In this article, the authors’ team will try to develop guidelines and directions for adapting SORA to the requirements of the operational work of emergency services. Thus, the following article aims to present the most important risks related to conducting operations with the use of UAVs by ﬁrst responders (FRs), and to show the sample risk analysis performed for this type of operation on the example of the ASSISTANCE project. The paper describes, on the one hand, possibilities offered by UAVs in crisis or disaster management and step-by-step Speciﬁc Operations Risk Assessment (SORA), and on the other hand, presents possible threats, consequences and methods of their mitigation during FR missions.


Introduction
Unmanned aerial vehicles offer more and more possibilities for rescuers and services. Therefore, their further development should be expected by increasing key parameters (such as flight time, lifting capacity, range, better sensors/cameras) and their increasingly common use during rescue operations. However, attention should be paid to the fact that UAVs are currently unable to perform some activities which are characteristic of manned aviation used by various types of services (e.g. transport of the injured, water discharge during a fire, etc.). Performing risk analysis allows, on the one hand, to improve the safety of the operation, enabling quick response in the event of an error or failure and cooperation with manned aviation, and on the other hand to reduce the risk of failure or an operator's error. The following article will present the methodology for developing a risk analysis for unmanned aerial vehicles used by first responders and disaster management based on SORA documents. At present, risk analysis is necessary to carry out operations that go beyond the standard European scenarios, which in most cases are insufficient for the needs of the FR services. Although the SORA is intended for civilian use, the team of authors decided to check if it could be used by the Fire Department or other uniformed services. Besides, the authors decided to try to identify limitations and gaps, and propose supplementing them to adapt the SORA methodology to the specificity of the work of the FR. The team of authors sees the potential of the SORA methodology, which may constitute the basis for further analysis and adaptation.
Application of UAV or UAS in disaster management and fire protection is widely described in the literature [1][2][3][4][5][6][7] as well as directions of further development these platforms and autonomous technology are pointed broadly -like a swarm [8], early forest fire detection and monitoring [9][10][11][12] extinguishing [13], flying ad-hoc network [14,15], or as cargo delivery and humanitarian aid [16]. Nevertheless, there are only a few studies about risk assessment of UAS flights performed by first responders (FR), fire brigades, emergency services during fires, local events, disasters. Similarly, there have been and still are many research projects regarding the use of automated vehicles in search and rescue operations, their integration with the ground and underwater vehicles, other systems and sensors (RESPONDRONE [17], RESPOND-A [18], FASTER [19], CURSOR [20], Search & Rescue [21], INGENIOUS [22], DRIVER+ [23], CLOSE SEARCH [24], ICARUS [25], DA-RIUS [26]). Almost none of them do focus on risk assessment for UAS operations as itself. In the RESPONDRONE project, the Holistic Risk Model was proposed to evaluate the inherent risk of operations in crisis scenarios involving both FRs and UAS [27]. The risk model takes into account risks stemming from the ground as well as the air and includes risks affecting both the ground and the air. It should be noted that risks associated with flights performed by first responders are other than those in civil flights. In the case of emergencies, for instance: wildfire, flood, collapsing buildings, leakage, they generate specific risks [28], that pilot must take into account and which affect flight safety, as well as, the requirement to use appropriate mitigations.
The case of the ASSISTANCE project [29] emphasizes the need to help and protect a different kind of FR organizations that work together during the mitigation of large disasters (natural or man-made) and to enhance their capabilities and skills for facing complex situations related to different types of incidents. This naturally determines the need to assess the risk of specialized flights to support FR in their work and -at the same time -increase the effectiveness of rescue operations while ensuring the maximum level of safety of rescuers, bystanders, infrastructure and property, and other airspace users.
There are many different risk assessment tools and techniques. The IEC/ISO 31010: 2019 standard lists 41 of them [30]. There are also related standards for risk management processes in civil protection and crisis management [31][32][33][34][35]. To this number should be added various related methods and techniques from the aviation industry, for example [36] Human Factors Analysis and Classification System (HFACS), Generic Error Modelling System (GEMS), Pre-Defined Risk Assessments (PDRA), External Events Analysis (EEA), and last but not least -Specific Operations Risk Assessment (SORA).
Because European regulations [37] recommend the use of SORA for operations beyond the standard scenarios (STS), the authors of this article decided that it would be scientifically interesting to verify the usefulness of this method for flights performed by first responders and disaster management.

Materials and Methods
SORA is the methodology for the risk assessment to support an application for authorization to operate a UAS within the specific category. It was created and developed by JARUS (Joint Authorities for Rulemaking on Unmanned Systems). SORA aims to help for safely creation, evaluation and conduction of a UAS operation and to provide a sufficient level of confidence that a specific operation can be conducted safely [38]. As noted by the authors of SORA, this method is not intended as a one-stop-shop for full integration of all type of drones in all classes of airspace.
Like risk analysis methods, there are many different ways to reduce the risk. Their choice should depend on the type of UAV operation performed and its place. The methods of risk mitigation themselves can be classified differently. SORA, distinguishing operational safety objectives (OSO), groups them as follows: Another model, which is used in aviation risk management and incident investigation is the SHELL model [40]. It is focused on the relation between the human factor and other workplace components, which have an impact on it. The model consists of: As can be seen, these two different methods have lots of similarities and, differ in the level of generality classification of factors. One of the similarities between the two methods is their relationship with the UAV operator. It is a very key element of an unmanned aerial vehicle operation. He is responsible for the performance of activities such as The neglect of the above activities can lead to, accidents and unsafe situations involving unmanned aerial vehicles. One often overlooked operational element is the checklista list of elements that should be checked before commencing an air operation. Such a list may be more or less detailed and adapted to a specific unmanned vehicle, but in the case of use in emergency services, the authors' team recommends that it should be as detailed as possible. This is because emergency services often use different unmanned vehicles from different manufacturers. Such a situation may result in taking incomplete or incompatible equipment for the mission, which in turn may make it impossible to perform the mission during the rescue operation. This behaviour can occur due to miss judgment operators knowledge about UAV. An exemplary checklist that contains many useful questions for UAVs is shown in this article in table 1 below. Operator and pilots are competent and/or proven (licenses, drone logbook,) 2.
Ensure the operator and pilots has appropriate authorization and approvals 3.
Pilots are fit to operate (use the I'M SAFE Checklist: illness, medication, stress, alcohol, fatigue, and emotion) 4.
The division of duties and competences, roles are known Machine 5.
Software in Ground Control Station and UAV is updated 7.
Thermal camera works (if used) 9.
Battery is charged 13.
SC card is empty and in place 14.
Checking the power supply and operation of additional equipment (laptop, additional display, walkie-talkies) Mission 15.
Mission is planned, a goal is known 16.
Path planning is done 17.
Establish a geocaching 18.
Set the Failsafe 19.
Take-off site is safe and marked Management 20.
The ways of communication between pilots and visual observers are fixed 21.
The An above mentioned checklist is an example based on own experience, guidance materials and legal basis. The elements required to be checked take into account the aspects required in OSO.
Another element that the above methods pay attention to is hardware, which directly occurs in the SHELL method, and in the 5M method it means "Machine". Before commencing air operations with the use of UAVs, it is necessary to check the technical condition before take-off. First of all, check the completeness of the system, the condition of the mechanical and electrical connections, and check for any damage to the ship with particular checking of the propellers. The next step is to check the battery charge and the technical condition of the propellers together with information on whether they have been correctly installed. Apart from the above, aircraft often have additional devices and systems that increase the safety and awareness of the operator. The most common ones include: obstacle detection and avoidance systems.
Another aspect touched upon by the SHELL methodologies is the environment, which is also hidden, in a broader view, in the 5M method as "Medium". This aspect is more than just the weather. Environmental aspects also include a forecast for the next few hours, a list of high altitude features and features that may pose a threat to operations or landmarks. Additionally, in this aspect, the presence of bystanders and animals is considered.
The next aspect raised in the 5M procedure is "Mission". In the SHELL model, it is included under Software . In this aspect, the methods focus on the mission, its conditions and goals to be achieved by the operator using the UAV. This stage largely allows you to re-check the mission assumptions, e.g. the route, the height of return home, the starting point and what have to be done.
The last M in the 5M method relates to "management". This aspect is also partially addressed in the software part of the SHELL method. This stage allows you to check procedures, airspace availability and other organizational aspects such as necessary permits.

Results
As part of the ASSISTANCE project financed under the Horizon 2020 programme, it is planned to conduct 3 pilots in which new technologies, including drones, will be launched and tested. The UAV usage locations and assumptions for each scenario are shown in the table 2 below [41]. This article will consider the terrorist attack scenario and risk with the use of UAVs by uniform services.

Scenario III -Terrorist attack
The first step necessary to perform a risk analysis of a UAV operation is the definition of the concept of operation (ConOps). According to the scenario [42], a tragedy occurs during Seville Fair (the popular Spanish event) at the bullfighting ring arena, known as Plaza de Toros de la Real Maestranza de Caballería de Sevilla, located 2 km from the fair area ( Fig. 1.). Truck crashed in the west part of bullring and a big explosion occurred. People responsible for the security of the event additionally reported the sighting of two unknown UAVs. Recognition through the RBG camera. It is planned to use DJI Matrice 600, whose characteristic dimension (the largest distance between the rotors) is approximately 2255mm. To determine the risk of an operation, the first element is to determine the value of the kinetic energy that the drone may have. According to the formula below and with the manufacturer's data, kinetic energy is approximately 1.5kJ. Based on these data, the intrinsic UAS Ground Risk Class (GRC) can be determined. Due to the holiday, the flight conducted during the actual occurrence would have to be qualified as "VLOS over an assembly of people". Unfortunately, SORA does not cover this type of operation, the risk of which would be too high, therefore the authors' team assumed that the considered type of operation would be VLOS over a populated area. The GRC for this flight type is 5 on the current 10 point scale.
The next step is the final determination of the ground risk (Final GRC determination). For this purpose, is needed to analyze mitigations sequences of ground risk and give them an appropriate level of robustness (low / none, medium, high). Mitigations are divided into 3 levels: M1-Strategic mitigations for ground risk, M2 -Effects of ground impact are reduced, M3 -An Emergency Response Plan which is in place, validated by operator and effective.
At first, we limit the number of people who may suffer from a breakdown or a UAV error. To this end, use should be made of the criteria for strategically identifying M1 risk. Its elements are the level of integrity and the level of assurance. The first risk mitigation criteria for the overall level is the application of a basic risk buffer with at least a 1 to 1 rule, i.e. if the UAV is flying at a height of 50 m, the horizontal distance from any bystanders, should be at least 50 m.
Application of this method for rescue operations envisaged in this scenario is almost impossible due to a large number of people. Since the Low method cannot be used in this case, attention should be focused on the more complex level methods of the medium. They are concerned with mitigation methods that would lead to an operation outside of the operational volume, they mainly cover: • meteorological conditions (e.g. wind), • UAS delays (e.g. Delays that affect the ability of the UAS to manoeuvre at the right time), • the behaviour of the UAV during the activation of the technical security measure, • the UAV's performance.
For this risk analysis, optimal weather conditions prevailing over the site of UAV's operations are assumed, and delays do not affect the UAS's maneuverability, and emergency systems such as RTH have been checked. This allows to assume an average level of -2 for the level of integrity.
The application of the second criterion (Evaluation of people at risk) for the low level assumes the transfer of flights to a different time, when due to the schedule of the day, the density of people may be smaller (e.g. at night, when there are no employees in the buildings). The nature of rescue operations make it impossible to fully apply this criterion. It is possible to partially meet these requirements, because of the evacuation of victims and the presence of only a FR who are aware of drone operations and involved in the operation. What is more, at the medium level, there is compliance because the flight will be a UAV weighing less than 25 kg and flying at a speed slower than 89.5 m/s. When it comes to the level of assurance, the medium level is reached. The evidence which supports this claim in criterion 1 is this article and analyses which includes. To strengthen the evidence, it is additionally recommended to perform some simulations and inspections before flights. In the case of criterion 2, density data has been taken from a reliable source [43] and the path of flight will be performed in conjunction with other authorities (e.g. city police, office of civil protection, crisis response team).
Summing up, we obtain within robustness: level of integrity (medium) and level of assurance (medium). So we can subtract -2 from the ground risk level.
Then we move on to M2 -this is the part relating to the limitation of the effects of the UAV accident. The UAV envisaged in the scenario meets the medium level of integrity, because, in the event of damage to one of the six driving elements, it can enter autorotation (hexacopter). This allows for resignation from other methods of risk mitigation, such as the use of a parachute. Additionally, it is assumed that the operator will be familiar with how to deal with an emergency -autorotation through adequate training real exercises and proper performing the emergency procedures on a simulator. In the case of assurance level, also Medium level is reached through testing and simulations. Procedures cannot be validated against standards, because adequate standards do not exist. The operator also has a training syllabus and pilots perform periodical theoretical and practical training.
Then we establish the M3, which relates to the Emergency Response Plan. For the level of integrity and level of assurance, a medium level is reached. M3 determines the crisis management plan for the UAV. Final GRC determined according to the formula below: = + 1 + 2 = 5 + (−2) + (−1) = 2 in the case under consideration GRC equals 2.
In the fourth phase, the initial risk of using the shared air space is determined. In the case of the scenario implementation site (Sevilla), it is located in the airport zone (CTR SEVILLA). Therefore, the development team in such a case would recommend contacting TWR Sevilla to repair manned traffic in this area and maintaining constant and direct communication with ATC and FIS. This would make it possible to minimize the risk of a UAV collision with other airspace users. Thanks to such a procedure, the AIR RISK CLASS would be ARC -a.
The next, optional step in the SORA methodology is to further mitigate airspace risks. Due to the type of event and a large number of people, it should be assumed that other UAVs, including those of outsiders, e.g. journalists, may soon appear. To reduce this risk it is proposed: Establishing a UAV flight coordinator in the area of operations. The next, sixth step in the methodology is the definition of TMPR and robustness levels. It is based on the analysis and application of tactical risk mitigation measures, which were described earlier in the article. Because: 1. During the scenario UAV will be used in VLOS operation and 2. The designated residual ARC is of the class and didn't require a TMPR and TMPR level of robustness. The next step assumes the Final Specific Assurance and Integrity Levels (SAIL). This is a SAIL level determination that depends on the final GRC and residual ARC. SAIL values are in the range I-VI and are determined by the table [44]. In the considered case for final GRC = 2 and residual ARC-a, the SAIL level is I. This makes the operational safety requirement minimal or optional.
The penultimate step in determining the risk of UAV operations using the SORA methodology is the analysis of the space near the UAV operation. At this stage, the effects of the uncontrolled flight of the drone to another adjacent air zone, which it may violate, are analysed. The analysis consists of identifying possible problems based on the pilot's experience and taking appropriate risk mitigation measures. Most often, such problems are caused by, but not limited to: • Loss of the operator's radio signal due to too much distance, interference from external sources (tactical command and communication vehicles, BTS, antennas, etc.), • The GPS signal interference, • The GPS receiver failure, • A badly planned mission (flying over an obstacle blocking the signal), • The GCS failure, • The perception error or loss of orientation by the operator.
The above examples can be easily limited by using various methods. One of the simplest is the use of the so-called Geofencing. It allows maintaining the UAV at the space and range specified by the operator. However, this is a method that depends heavily on the GPS signal and may be affected by increased solar activity. Therefore, UAV operations should not be performed with a solar activity factor KPI> 4. Another reason for the loss of control that may result in exiting the zone is the loss of the radio link between the UAV and the operator. This problem can be reduced by using more powerful transmitters and receivers and by appropriately designing the flight path in such a way as to avoid blocking the radio signal by obstacles. To further increase safety and reliability, it is reasonable to use several modules ensuring the positioning of the UAV in space (doubling or even tripling). Additional security in operations may be the use of observers who will supervise the position of the UAV in space from a perspective other than the operator. In this case, the operator and the observers must have continuous two-way communication.
The Matrice 600 drone will be used in the considered scenario. It has a geofencing function and is additionally equipped with three GNSS modules and three IMUs. No additional observers are foreseen in the scenario due to short-range VLOS flights.
The last step in the risk analysis using the SORA method is the "Comprehensive Safety Portfolio". It summarizes the entire risk analysis and provides evidence that there is an adequate level of assurance that the operation will be performed safely. In civil UAV applications, such a section should be presented to the relevant offices and institutions for approval to operate, if it goes beyond the standard scenario. At this stage, other aspects and factors that are not included in the SORA should be analyzed. These are, for example, security environmental protection. In the case of security, the scenario includes seeing unknown UAVs. Therefore, the team of authors believes that additional procedures should be developed in the event of an unauthorized intrusion by an unidentified UAV so that each of the FR services knows how to proceed and what is their responsibility in such a situation.
This scenario also assumes the use of UAVs to cover the area with a Wifi network. A swarm of drones is to be used for this purpose. As the current version of SORA methodology is not adapted to the analysis of the risk of collisions between drones, the authors' team assumed that the first flight would be made with the use of the DJI Matrice 600, and then a swarm would be used. Risk analysis of a drone swarm operation is beyond the scope of this article.

Discussion
Risk analysis using the SORA method is an effective method of determining the risk of an operation and its mitigation. However, it is intended for civilian applications and it is necessary to adapt this method to the needs of rescuers using unmanned aerial vehicles. One of the biggest problems with this method is its time-consuming nature, as it takes many steps to complete it correctly. Another aspect that is very important for flight safety, which is not addressed by the SORA methodology, is the hazards characteristic of rescue operations, not occurring in civil applications. Examples of such threats include among others: • Manned Aviation -air medical assistance, water discharge planes, etc. • Environmental conditions during the action -dynamic physicochemical phenomena occurring during a fire, e.g. convective movements of hot air, fire gases and smoke, high temperature, humidity, etc. • Flight in difficult conditions (operator's stress) and changing weather conditions • Civil and commercial flights are planned and usually take place in good weather, and FR flights are not planned and take place when necessary • The methodology does not take into account safety-related aspects, e.g. intrusion of another unidentified UAV into the area of operation • Also, the SORA methodology does not take into account the use of a swarm of drones -a relatively new possibility of simultaneous use of several UAVs at the same time, which cooperate. Such an application is also envisaged in the ASSISTANCE project, and the authors' team believes that such solutions will appear more and more often and more widely among various FR. The above additional threats, occurring during the mitigation of catastrophes with the use of UAVs, indicate how important it is to use reliable UAV equipment by a qualified and experienced pilot.

Conclusions
Taking into account the aspects included in the chapter "Conclusions", the authors' team believes that the methodology for determining the risk level of UAV operations proposed by SORA is not fully suitable for use by rescuers during the operation, without its prior adaptation. Therefore, it is necessary to adapt it or develop such a methodology that would take into account the threats specific to rescue operations with unmanned aerial vehicles. Also, the method of determining the risk of operations for rescue applications should be automated, because one of the key elements in the course of action is the speed of taking action. This could be done through dedicated applications, computer programs or websites. The methods of determining the level of risk of using UAVs in a rescue operation should take into account the use of new technologies such as cooperation in a UAV swarm.
Another very important aspect in terms of rescue is the time and place of flight and the weather. As it stands, the SORA methodology is not suitable for use by rescuers. This is because the SORA assumes the place and time of the flight and the expected weather in advance, while during the operation of the First Responders we do not know these factors (we do not know when and where the disaster will happen).
For drones to be safe and reliable, the methodology for determining and mitigating risk is not enough. UAVs should be tested in the certification and admission processes. Only then will UAVs be able to be safely used by various uniformed services.