Safety Risk Modelling and Assessment of Civil Unmanned Aircraft System Operations: A Comprehensive Review

Abstract

Safety concerns are progressively emerging regarding the adoption of Unmanned Aircraft Systems (UASs) in diverse civil applications, particularly within the booming air transportation system, such as in Advanced Air Mobility. The outcomes of risk assessment determine operation authorization and mitigation strategies. However, civil UAS operations bring novel safety issues distinct from traditional aviation, like ground impact risk, etc. Existing studies vary in their risk definitions, modelling mechanisms, and objectives. There remains an incomplete gap of challenges, opportunities, and future efforts needed to collaboratively address diverse safety risks. This paper undertakes a comprehensive review of the literature in the domain, providing a summative understanding of the risk assessment of civil UAS operations. Specifically, four basic modelling approaches utilized commonly are identified comprising the safety risk management process, causal model, collision risk model, and ground risk model. Then, this paper reviews the state of the art in each category and explores the practical applications they contribute to, the support offered to participants from multiple stakeholders, and the primary technical challenges encountered. Moreover, potential directions for future work are outlined based on the high-level common problems. We believe that this review from a holistic perspective contributes towards better implementation of risk assessment in civil UAS operations, thus facilitating safe integration into the airspace system.

1. Introduction

1.1. Background

Unmanned Aircraft Systems (UASs), also known as Unmanned Air Vehicles (UAVs), or drones have been recognized as the emerging sector of the aviation industry for several years [1,2]. Coupled with the technological development in automation, electricity storage, and transportation, UAVs are utilized in a myriad of civil applications, such as inspection, monitoring, logistics, contingent security, etc. [3]. In recent years, apart from the benefits of economy and efficiency, such disruptive technology has spurred great interest in unlocking the potential of low-altitude airspace [4]. The global UAS market size for civil applications was valued at USD 7.2 billion in 2022 and is predicted to more than triple to USD 19.8 billion by 2031 [5]. For instance, many countries, like the US, the UK, Singapore, China, and others, utilized UASs in the door-to-door delivery of essential supplies in the pandemic period [6]. Companies such as Amazon, which claims that 86% of cargo meets the carrying capacity of UASs, obtained FAA approval to expand Prime Air drone deliveries for online orders in May 2024 [7]. According to the market report by Future Business Insight, UASs serve a main role in emerging transportation systems such as Urban Air Mobility (UAM) to alleviate traffic congestion and carbon emissions [8].

In commercial aviation, safety stands as the foremost requirement and objective in operations, design, and regulations enforced by authorities [9]. However, the emergence of UAS operations inevitably poses novel challenges to the current aviation ecosystem, such as threats to the National Airspace System (NAS), which have been recognized since the early 21st century [10]. Over the span of almost two decades, the risk to people and property on the ground has been primarily addressed through the formulation of airworthiness regulations [11]. The International Civil Aviation Organization (ICAO) has released model regulations for UASs, accompanied by advisory circulars to aid in their interpretation [12]. Deviating from the off-the-shelf approach used in traditional aviation, several foundational principles have been proposed by the risk-based approach to attain the objective, including safety targets, airworthiness certification, and operational authorizations [13]. Of utmost importance, the concept of ‘Equivalent Level of Safety’ (ELoS) serves as the cornerstone guiding almost all regulations among relevant authorities worldwide, stipulating that UAS operations must not compromise the current safety level of the NAS [14]. However, there remains ongoing debate regarding whether the delineation is overly conservative, given the substantial differences between UASs and Conventional Piloted Aircraft (CPA). The imperative for tailored approaches to UAS risk assessment has been widely acknowledged [15].

Furthermore, safety challenges in the mixed heterogeneous concept of operations will be one of the major challenges. The Federal Aviation Administration (FAA) NextGen Office updated the concept of operations (ConOps) for UAS Traffic Management (UTM) in 2022, where public safety is considered as the main operational constraint [16]. Similarly, the terms ‘safety first’ and ‘socially acceptable’ could also be seen in the Concept of Operations for European UTM System (CORUS) [17]. Along with the integration process into the NAS, new operational scenarios describe more complex operations in airspace, like high-density, beyond visual lines of sight (BVLOS) operations in controlled airspace. Thereby, more specific restrictions will be induced by the increasing complexity among conceptual, technical, and management aspects. As depicted in Figure 1, the tailored risk assessment of civil UAS operations entails considerable complexity, summarized as follows:

• Multi-dimensional. The escalating complexity imposes heightened requirements on technological capacity. Aiming at the evaluation from See and Avoid in uncontrolled airspace to support BVLOS operations in mature UTM, there are elevated demands on the capabilities of Detect and Avoid (DAA) for UASs that are stipulated by specified requirements [18,19]. In terms of operational risk sources, UAVs, while characterized by operational convenience and high degrees of freedom, are susceptible to influences, like weather, navigation, and managerial proficiency [20]. Additionally, the low-altitude airspace exhibits intricacy of geographical conditions which poses challenges for collision avoidance, along with impediments to data transmission [21].
• Interdisciplinary. The technologies involved primarily encompass the safety risk management process (SRMP), reliability engineering, air transport research, etc. The different fields have distinct research objectives and scopes, resulting in diverse definitions, methodologies, and outcomes. From the perspective of the SRMP, research efforts concentrate on the identification of risk sources and hazards, as well as the formulation of mitigation measures [22]. System safety and reliability analysis focuses more on the safety assessment of operational systems and subsystems [23]. Lastly, studies center on Mid-Air Collisions (MACs) and Third-Party Risk (TPR) in air transport [24]. The consistency among the diversities of models brings new barriers in addressing inherent safety risks and associated approval for operations by regulatory bodies.

Figure 1. Multi-dimensional space of risk assessment and safety management for civil UAVs [25].

Figure 1. Multi-dimensional space of risk assessment and safety management for civil UAVs [25].

In conclusion, with the distinct variance in operational concepts and increasing complexity, there remains an incomplete gap of challenges, opportunities, and future efforts needed to collaboratively address diverse safety risks from a holistic perspective.

1.2. Motivation and Contributions

We conducted a preliminary survey of publications on ‘UAV’, ‘UAV risk assessment’, and relevant topics on the Web of Science on 16 January 2024 (see Figure 2). The time range was set to between 2013 and 2023. As expected, the growth of interest in risk performs in line with the technology iteration. The emergence of the ‘risk-based approach’ and ‘ConOps’ facilitated research endeavors after 2015, while risk assessment is indispensable but still lacks a systematic summarization.

It becomes apparent that meticulous risk assessment covering every detail that involves cross-cutting technologies and multiple stakeholders is a monumental challenge. Given that safety is significant throughout the whole lifecycle of UAS operations, recent research has investigated the current methodologies partially from the perspective of reviews, summarized in

Table 1. Relevant reviews on UAS risk assessment.

Literature	Focus	Categorization Method	Content Type	Quantitative
Clothier et al. [22]	High-level introduction of the normative workflow of SRMP	Sub-process of SRMP	Theoretical	🗴
Sanz et al. [34] *	Global assessment approach of SRMP with integral rationales	Origin-oriented or relation-oriented analytical perspective	Theoretical and analytical	🗴
Washington et al. [15]	UAS ground risk modelling and supports for regulations	Sub-models based on ground risk propagation	Theoretical and analytical	✓
Allouch et al. [27] *	Combination of SRMP and quantitative causal model (Bayesian network)	Qualitative and quantitative risk metrics	Theoretical and empirical	✓
Guan et al. [26]	UAS air risk modelling for separation and conflict management	Modelling approaches of collision probability	Analytical	✓

* Research paper.

. An excellent review of ground risk models was presented in 2017 with the propagation chain of TPR, while the air aspect is also a great concern currently [15]. Guan points out that air risk normally refers to the collision probability estimation applied to collision avoidance strategies [26]. Meanwhile, whether the outcome is qualitative or quantitative is another mainstream classification [25,27]. The previous is often derived from the SRMP (a normative workflow) [28], while the latter is determined by causal models [29] or operational ones facing air and ground scenarios [30,31]. However, as discussed before, the risk assessment of UAS operations has adequate complexity involving crossing technologies conducted by multi-stakeholders. Notice that the same modelling approach is even extended to differential scenarios or components although all of them could be indexed by the same keywords, such as ‘UAS risk assessment’ [32,33]. Hence, the current ambiguity also motivates the intense need for a comprehensive framework for UAS risk assessment that contains explicit risk definitions, focuses, and applications for optimal operations.

Consequently, risk assessment is intrinsically a supporting tool for the safe conduct of operations. Meanwhile, it also helps to seek out the optimal balance between safety, efficiency, and economy by revealing the risk mechanism. Several reviews are dedicated to illustrating the topic but ramp up to application level. Concurrently, the review of ground risk from 7 years ago may be outdated in several key aspects [15]. To our best knowledge, few previous works have conducted systematical investigations to encapsulate the state of the art holistically containing the topics above. The absence of these efforts will bring ambiguity to researchers in future works and restrict the followers in understanding the main dimensions. Consequently, having investigated a large amount of the literature in the field from major databases (Web of Science Core Collection) and citations, over 120 publications are selected in this paper to fill the gap. Concretely, the main contributions are summarized as follows:

• From the macroscopic perspective, we categorize the research by modelling approaches and mechanisms, i.e., the SRMP, causal model, collision risk model, and ground risk model. The current research framework with explicit categories is presented, and the theoretical distinctions are illustrated with explicit definitions of risk, objectives, and stages focused on.
• From the microscopic perspective, we summarize the detailed applications of the risk outcomes in each category and explore the corresponding support to the stakeholders involved. The main pursuits of the latest advancements and technological challenges are also distilled from the decomposition of model features.
• The future directions of studies are proposed based on the common restrictions among the models. Furthermore, aiming at a tailored methodology for UAS risk assessment, an envisioned workflow through the lifecycle of a UAS is proposed, along with high-level suggestions on the development of relevant regulations for the risk assessment of UAS operations.

The remainder of this paper is organized as follows. Section 2 presents an overview of the risk assessment of UAS operations. Section 3, Section 4, Section 5 and Section 6 are dedicated to the summarization of categorical research with the main findings. Section 7 provides a general discussion on the topic with future directions. Concluding remarks are presented in Section 8. Additionally, the abbreviations utilized in this paper are given in Appendix A. In Appendix B, the process of literature searching is presented with the bibliometric illustration. The comparison analysis of the literature is summarized by tables in Appendix C.

2. Overview of Risk Assessment of Civil UAS Operations

In this section, the basic concepts in risk assessment are provided including ‘risk’, ‘risk assessment’, and ‘hazard’. Then, risk-based management is introduced to reveal how risk assessment supports the safety risk management of UASs under current regulations. Finally, the summative research framework is proposed based on the bibliometric analysis to conduct the literature review and present the inner relationship of models.

2.1. Definitions

The concept of risk, along with its associated notions, finds extensive application across diverse assumptions and underlying models in civil UAS operations [15,22,35]. Regular domain-specific measures or indicators include the qualitative risk rank, probability of accident per operation, probability of fatal accidents per operation, and probability of MAC per operation, where operation refers to each flight or flight hour. Thereafter, the safety risk assessment is the process of answering the safety-critical questions, i.e., identifying the potential hazards, evaluating the probability and severity, and comparing against the predefined criteria [36]. Furthermore, the operational risk of UASs is required to be controlled below the acceptable level. Therefore, the safety criteria act as the benchmark for decision-making on whether the current stage is adequately safe or new requirements are needed to mitigate repercussions [9,37]. The workflow is depicted in Figure 3.

Hence, the probability and severity are commonly measured in terms of the well-developed safety risk indicators [38]. Thus, the risk $R$ could be represented uniformly as follows:

$$R={\displaystyle \sum _{h}P\left\{h\right\}}\cdot R_h$$

(1)

where $P\left\{h\right\}$ is the probability of hazard type $h$, and $R_h$ is the conditional risk of the given hazard. An elaborate summarization can be found in previous research [22].

As for UAS operations, the consequences from risk assessment are associated with two main hazards (recall Table 1): MACs with UASs and other aircraft and the ground impact of UASs or sub-components with a third party [15]. By the extension of risk in safety definitions, several studies develop the Third-Party Risk to topics such as noise, privacy, cyber security, etc. To be more specific, the operation-oriented research has established different variants of risk assessment models under the guidance of the SRMP above. However, apart from the results computed by these methods, what is more important is how the main hazards develop from the initial risk sources like weather, pilot error, GPS loss, etc. Thereby, we introduce the concept of the event chain, which aims to describe the risk propagation through the event nodes. As presented in Figure 4, the upper casual factors may have their logic mechanism in risk propagation, summarized from internal and external aspects, which will directly or indirectly induce the occurrences of two main hazards. Note that the other risks have gradually raised the concerns of relevant studies [39,40].

2.2. Regulation Framework of UAS Safety Management

Regulators have adopted a hierarchical UAS regulation framework by introducing the different risk categories of UASs. As for the EASA and JARUS, the regulatory concept contains Open, Specific, and Certified UAS operations. For the FAA, the categories are defined as Recreational, Under Part 107 rule, and Advanced [41].

There are different technical limitations, operation ranges, and authorization requirements in each category. For instance, the Open category is not allowed to conduct BVLOS operations, with a maximum take-off weight of less than 25 kg and no transportation of goods, etc. Thus, there is no risk assessment requirement for such operations. When mentioning the certified category, which has no requirement on airframe size or weight, it is mandated to conduct a risk assessment by AMC RPAS.1309 [42]. We summarized the formalized UAS safety management framework that contains the risk assessment requirements in

Table 2. Summarization of risk-based UAS categories for safety management.

	Low Risk	Medium Risk	High Risk
EASA/JARUS	Open (not required)	Specific (SORA) [43]	Certified (AMC RPAS.1309) [42]
FAA	Recreational (not required)	Work/business (advisory circular 107-2) [44]	Advanced (Order 8040.4B, 8040.6, ATO SMS manual) [28,36,45]

. With an increased risk level, the requirements tend to be stricter.

As a representative approach for the Specific category, the specific operations risk assessment (SORA) was issued by JARUS to support operation authorization with given scenarios. The method is qualitative with a decision workflow based on expert opinions to determine the risk level [43]. As for the high-risk category, the tailored airworthiness framework for UASs has been recommended [46] since the nascent stage. The ICAO has provided the guiding principles and the mandate for member organizations to establish the State Safety Program and use the System Management System [9]. Except for the aforementioned regulators, risk-based management has been widely acknowledged across the world, like in China, Singapore, New Zealand, Australia, etc. [47]. However, safety judgments on flight rules have less formalized classification schemes in several countries. The consideration of risk control could also be revealed by the regulated flight conditions [48]. For example, limitations like the maximum take-off weight and the minimum distance to people on the ground directly reflect the consensus in the current stage. Detailed information on UAS regulations can be found in previous work [11].

By distilling the basic concept of UAS safety management, the risk assessment is essentially the basic foundation for regulating the operations, which exist from the design, manufacture (airworthiness), and registration to the operations of UASs [14]. In other words, the main purpose of related regulations is to set a level of safety acceptable to society and offer enough flexibility for the new industry [17]. As ‘one size does not fit all’, the outcomes of risk assessment are transformed into safety cases or control variables for the regulatory process, e.g., applicability, operational limitations, technical requirements, or administrative procedures [11]. In addition, the requirements on high-risk operations could also be extended to the low-risk and medium-risk categories since this ensures a stricter safety grade [42,45]. Consequently, the explicit analysis of models for risk assessment and the holistic framework for the specific outcome transformation are highly required to support the further development of regulations.

2.3. Summative Research Framework

In Table 1, several methods for the classification of research have been discussed, like qualitative and quantitative or air risk and ground risk. To figure out the inherent relationship among the main research focuses, the bibliometric analysis of the topic ‘risk assessment of civil UAS operations’ is conducted to present the hotspots. In this paper, a standardized workflow is adopted to select the literature. To ensure replicability, detailed information can be found in Appendix B.

Briefly, the search with the union of topics in Figure 2 obtained 610 results. Then, the literature was refined using the filter function (UAV, DAA, reliability, situation awareness, etc.), publication year (2013–2024), and full-text examination. Meanwhile, the citing and cited lists were also reviewed for the supplement. Finally, the process obtained 126 results which were reviewed to ensure correlation. The clusters of keywords are presented in Figure 5.

It is apparent that three categories (SRMP, air risk, and ground risk) are revealed by the keyword topology, which is aligned with the previous summarization in Table 1. However, based on the preliminary review of the literature, many studies fall into the analysis of the causal chain while the research targets are classified as the two main hazards (MAC, TPR). Different from the operation-specific models for UASs, the casual models are common in the safety domain to grasp the inner relationship between event nodes [15,32]. We are also motivated by the supporting tools recommended by commercial aviation [49] that give insight into the cause–effect relationship in event sequences. Coupling with Figure 3, Figure 4 and Figure 5, the summative research framework is proposed under the high-level guidance of the SRMP, shown in Figure 6.

Firstly, high-level guidance which reflects on the modelling scope, objective, etc., is provided by the normative workflow of the SRMP (Section 3) for the following risk models. Then, we divide the two major groups, i.e., relationship-oriented (casual model) and operation-oriented (collision risk model and ground risk model). From the causal perspective, the classification is based on the off-the-shelf models utilized in the literature [29]. For system-level utilization, we also take the FMECA and STPA into account since the system reliability has a chain effect on operation safety. Meanwhile, the causal models are employed in the analysis of failures which may cause air collision [52] and ground impact [15]. Thus, this paper dedicates a section to investigating how causal models work in UAS operation risk assessment (Section 4). As for collision risk models, the classification depends on the modelling mechanism in the mathematical core, which also reflects on their operation concept or types (Section 5). Finally, the ground risk models are divided by the components in the general description of harm (Section 6).

In addition, the outcomes of the risk models provide the supporting information for UAS safety risk management. Furthermore, it will be transformed into safety cases or control variables in the regulatory process, as more targeted measures could be obtained.

3. Safety Risk Management Process

The SRMP serves as a part of the organizational risk framework developed by a fundamental set of risk principles (see Figure 3). It exists along with the three other components of SMS, i.e., safety policy, safety assurance, and safety promotion [9,37]. In general, the SRMP is a normative workflow that could be applied to any functional component in aviation [9]. In this section, the basic structure of the SRMP is introduced with relevant conceptions and specific modifications by relevant works in the UAS domain.

3.1. Review of the Workflow

The SRMP could be divided into five basic steps: system analysis, hazard identification, risk analysis, estimation, and mitigation [53]. The main purpose of this is to comprehensively characterize the safety risks associated with UAS operations and formulate strategies to mitigate the intolerable risks based on the information [22]. The steps are as follows:

(1) System analysis. Thorough system analysis is the foundation for the following steps, also called the system description [28] or ConOps description [43]. Specifically, the system analysis provides information containing the scope of the risk assessment, desired safety target, stakeholders, methodologies, referred standards, etc. The risk perception from different perspectives also leads to distinct risk approaches in terms of treatments. For instance, the safety acceptance by public sectors emphasized the physical health concerns that hope for stricter restrictions on kinetic energy, propellers, or drone packages [54]. A preliminary risk assessment for small UASs is presented by limiting the scope to vehicle scale; thus, the following searching space for hazard identification is narrowed to the variations in configuration and weight [25]. Operational limitations like air geofencing and performance such as ‘Sense and Avoid’ are emphasized by the SORA and FAA [36,43].

(2) Hazard identification. Hazards are several kinds of conditions for potential accidents or mishaps. This step aims to identify and document all reasonably possible sources and determine the interconnections and causes [27]. Completeness and accuracy are the cores of the search conducted with previous incident and accident reports, which could be time-consuming and costly. Current research or guidelines in commercial aviation have recommended support techniques to help achieve comprehensive results [10]. Meanwhile, proactive methodologies are also preferred to predict the emerging hazards posed by novel UAS operations, rather than relying upon mandatory reports [37].

(3) Risk analysis and estimation. The risk matrix or table is often given to evaluate the consequence of a risk [36,46]. Concretely, the result representing the possible outcome of the hazard is mapped with the determination of likelihood and severity [55], exampled in Figure 7.

Similarly, the grading matrix recommended by the ICAO utilizes an opposite rating sequence from frequent (grade 5) to extremely improbable (grade 1) [9]. Moreover, both the likelihood and severity are assessed by the ordinal scale since the previous is relatively convenient for quantitative metrics from statistics. Thereafter, the risk evaluated will be compared against the Target Level of Safety (TLS) to determine whether further mitigation is needed. A famous framework is utilized which is called ‘As Low as Reasonably Practicable’ (ALARP). Under such a framework, the different grading or colors are transformed from quantitative safety metrics to determine the specific risk region [56]. Additionally, as the SORA mainly aims for operation authorizations, it utilizes the more practical and operational matrices to determine the risk rank, e.g., kinetic energy, risk buffer, and airspace classes [43].

(4) Risk mitigation. The safety analyst or team assesses the need for additional controls to reduce the operation risk to an acceptable level. Generally, the risk management response is the mix of ‘4Ts’ (treat, transfer, terminate, and tolerate). Given the resource implications for managerial actions, risk mitigation is linked to the first three. Meanwhile, since the risk perception is determined by the focuses and stakeholders involved, it may lead to different approaches in risk mitigation. Thus, specific treatments are limited to the technological or managerial operability and cost–benefit requirements. In the aviation domain, the ‘ALARP’ has been utilized to support decision-making in the evaluation of residual risk and help achieve a cost–efficiency balance [22]. However, the practical difficulties and systematic differences among the states led to the qualitative measurements to ensure continuity. Lin developed the quantified risk criteria within the ALARP framework from both operational-based and populational-based metrics [56].

3.2. Key Findings of Research

The SRMP exhibits its wide versatility and scalability as not unique to UAS operations, also involving participants from multi-stakeholders. Meanwhile, the steps are documented by the regulatory department to ensure confidence in regulation and procedure formulation [42,45]. The standard process tends to be qualitative by textual description or measured by risk ranks. Thus, the main feature of it is to achieve harmonization that represents a trade-off concerning the practicality of implementation and standardization, from technical and operational to economic and social [46]. It also, in turn, provides flexible spaces for modification or extension in particular operation scenarios.

Before further illustration, it is understandable that the regulations are the managerial embodiment of the outcomes of the risk management process [57]. Specifically, the results of the SRMP could determine whether the operation will be authorized or delayed until further treatments are satisfied. As a result, there exists a dilemma between scalability and accuracy when conducting risk assessment. With the shortage of data resources like incident and accident reports, the main challenge is revealed by its immature operation situation which highly depends on expert knowledge. Meanwhile, the effectiveness and reliability of the political treatments are still pending evaluation.

Thereby, to help break the limitation, an exploratory paradigm like the SORA has been proposed and updated continuously [43]. One of the main purposes of it is to support the tailored risk approach and provide more safety cases to achieve repeatability. The heterogeneous safety metrics in the ground risk model like population density, kinetic energy, and airspace classes are collaborated here to determine a more rigorous risk level. Regarding the summative research framework in Figure 6, the experiences from the SORA have raised more consideration of the support information from the operation-oriented models. For instance, it is hard to quantify how the probability of a hazard could accurately decrease by the measures among the wide range, e.g., flight crew licensing in regulations. On the other hand, the consistency of risk assessment of different probability magnitudes is also questioned by previous work [58]. Such a problem could be solved by the mathematical formation from the statistics in the collision risk model (e.g., position accuracy), which helps to quantify the capacity of the operator [59].

Furthermore, as also emphasized in the research framework, the risk does not exist or engage only in the specific segments but could have chain reactions in safety control, which is the focus of causal models. A typical instance is that the airworthiness standards of manufacturing and design should be considered in the process of operation authorization, as the failure of sub-components may cause catastrophic accidents. This is also revealed by the SORA, as the methodology not only supports the operation applications but also determines associated airworthiness requirements [43]. Ultimately, more safety cases are needed to provide templates for iterations in the future. The rigorous quantitative methods are still preferred to address the uncertainties, while flexibility needs to be retained. As a result, the synergy of a collaborative framework is essential to explore the feasible space of risk management by more explicit references.

4. Causal Models

Causal models focus on the event chain modelling and reasoning analysis of the hazards since accidents tend to result from a combination of multiple causal factors like functional error, component failures, and management interferences [29]. We summarize the current models used in relevant works and their key factors:

• Definitions and metrics of risk, e.g., rate of casualties.
• Focus and application scope, e.g., UAS platforms and Detect and Avoid (DAA) function.
• Assumptions and data substantiation.

The sequence below is aligned with the model list presented by safety analysis techniques recommended by NASA [60].

4.1. Review of the Models

The main characteristic of causal models is to form sequential event graphs with both qualitative and quantitative analysis. From the previous one, existing models usually establish a hierarchical graphical diagram to illustrate the inherent relationship [13]. From another, explicit outcomes are calculated by simulations with several assumptions, particularly in the probability estimation of top events [29,49]. The models are as follows:

(1) Fault Tree Analysis (FTA). FTA was developed based on Boolean logic, which starts with the immediate cause of a hazard or serious consequence. The top–down path of the event chain could support the determination of the minimal cut sets, i.e., critical causes [32]. Then, the probability of occurrence is the product of the probabilities of occurrence of its basic events [28]. FTA has been utilized in the safety analysis of UAV platforms [23], components of UAS operations [32], and functions of systems [61], summarized in

Table A2. Summary of FTA.

Reference	Risk Definition	UAV Type	Focus	Notes and Supplement Data	Main Conclusion
Kuchar et al. [61]	Collision probability	Fixed-wing (Global Hawk)	Collision avoidance system	MC simulation	Performance of TCAS is essential, and data generation with human-in-loop simulation is required.
Abdallah et al. [33]	Failure probability	Unspecified	Communication of UAV fleet	NPRD database	Air crashes are the major cause of communication failure.
Wang et al. [23]	Failure probability	Rotary UAV	UAV platform	MC simulation	Identification of critical units in UAV platform.
Ferreira et al. [122]	Collision and ground impact rate	Unspecified	Incidents and accidents	MC simulation	Special treatments are required to support the integration into NAS.
Xiao et al. [32]	Incident probability	Unspecified	Incidents and accidents	Records of accidents and incidents in China	Supervision issues are important including responsibility, laws and regulations, etc.

. The analytical range reflects on the choices of the top events. The model performs well in identifying the causal factors. However, owing to the limitations on the perception of interactions [33], Xiao transformed the architecture of the event graph into a Bayesian network which helped to achieve more reliable results [32].

(2) Event Tree Analysis (ETA). This method models the sequence of events that results from a single hazard or the initiating event [62]. Different from FTA, ETA is designed to present the compact and intuitive consequences of the top event, while it is also a top–down method with event branches. The relationship between hazards and possible consequences is helpful to the quantitative assessment and treatment formulations. Over 20 event trees have been established to provide insight into the hazards of ground impact accidents [63]. Then, the quantitative safety target can be derived by the predefined TLS. ETA is weak in the modelling of dynamic systems and can become time-consuming when several time-ordered system interactions are involved (see

Table A3. Summary of ETA.

Reference	Risk Definition	UAV Type	Focus	Notes and Supplement Data	Main Conclusion
Weibel et al. [123]	Full definition in SRMP	Fixed-wing	Risk mitigation approach	Non-specific data	A systematic examination of effectiveness of mitigation measures.
Clothier et al. [79]	Casualty rate	Fixed-wing (Global Hawk)	Ground impact risk over inhabited areas	Constant failure rate and census data	A framework for identification of the hotspots in the given scenario.
Ozuncer et al. [63]	Rate of hazard occurrence	UAVs in category CS-25	Ground impact risk by hazards	Failure by human error is set to 1	Safety requirements are derived with root causes and mitigation directions.
Melnyk et al. [62]	Casualty rate	UAVs with weight of 4.4 pounds	Ground impact risk over different areas	Failure rate from [124] and census data	Failure rate standards for UAS certification based on size and operations.
Melnyk et al. [19]	Casualty rate	Fixed-wing	Performance standards for SAA	MC simulation	Safety requirements are required to be determined by weight and wingspan.
Zhang et al. [125]	Casualty rate	Six typical UAVs	Ground impact risk of different tasks	Constant failure rate and uniform distribution of population	The requirements of graded management of UAV operations.
Dai et al. [21]	Collision probability	Multi-rotor	Collision risk caused by tracking system failure	MC simulation	The air risk management could achieve benefits from traffic management and route design.

). In this way, a state-space method, such as Petri net, is utilized to modify the dynamic characteristics of UAVs [64].

(3) Barrier Bow-Tie Model (BBTM). The BBTM is considered as the combination of FTA and ETA which connects the initial events, hazards, and consequences [65]. The model performs well in risk treatments as it focuses the analysis on the practical activities that can be undertaken in the progression of the accident [57]. The proactive and reactive barriers are investigated with ALARP to provide strategies for each state of risk development. Nowadays, the BBTM is mainly used for the suggestions of operation requirements and limitations while several safety assessment cases are provided to reveal the pivotal factors in UAS risk, e.g., operation over populous areas [13]. Additionally, the SORA is implicitly based on the concept of harm barrier in the risk mitigation process. The final risk of the SORA is calculated by the original rating minus the harm barrier index [43,58].

(4) Bayesian Brief Network (BBN). The BBN is a kind of directed acyclic graph which is based on the probability theory [25]. Compared with FTA and ETA, the BBN is intended to capture the wide range of failures of aircraft systems both qualitatively and quantitatively. Meanwhile, it is more flexible when adjusted to non-nominal and random conditions. It also performs well in analyzing probabilistic events where the probability distribution or empirical data are required [27,32]. Therefore, current research also applies it to the real-time assessment of the UAV operation risk by propagating the conditional probabilities of failure indicators [66]. And, Han used the BBN as a decision-support tool to calculate the effect of the specific changes in the system [67], summarized in

Table A4. Summary of BBN.

Reference	Risk Definition	UAV Type	Focus	Notes and Supplement Data	Main Conclusion
Luxhøj et al. [126]	Failure probability	UAVs for agriculture	Collision risk with CPA	Failure rate from general aviation.	Air geofencing is effective in mitigating collision risk between UASs and CPA.
Tyagi et al. [127]	Collision probability	Fixed-wing	Causal factors	MC simulation	A safety tool is proposed by combining collision risk model and BBN.
Barr et al. [25]	Rate of mishap occurrence	UAVs weighing 55 lb or below	Four typical mishaps caused by UAVs	MC simulation	UAS platform could not possess the same level of reliability as their manned counterparts.
Ancel et al. [66]	Probability of mishap occurrence	Multi-rotor	Ground impact risk	GIS information on population distribution	A real-time assessment framework is proposed by mishap probability, impact area prediction, and casualty estimation.
Allouch et al. [27]	Risk metrics	Unspecified	External and internal causality	Review of the previous research and databases	Real-time safety monitoring is required.
Han et al. [67]	Casualty rate	Multi-rotor (Antwork TR7S)	Ground impact risk in urban area	Statistics of the operation data and previous research [15]	Power shortage, partial rotor failure, and battery failure are the main causes.

.

(5) Failure Mode Effect and Criticality Analysis (FMECA). This model is one of the evaluation technologies for product design and manufacture. It has been summarized as a failure model by previous reviews [15]. But the failure rate and criticality are significant in the following process of operations as it focuses on the hardware of the UAS (see

Table A5. Summary of FMECA.

Reference	Risk Definition	UAV Type	Focus	Notes and Supplement Data	Main Conclusion
Freeman et al. [69]	Risk rating of component failure	Ibis with an Ultrastick 120 airframe	Elevator surface and servo actuator	Expert opinions and NASA categories of severity	Operational envelope is provided for the elevator failures.
Osmic et al. [70]		Multi-rotor UAVs with moving mass system	Design of heavy payload UAV	Expert opinions and historical data	The critical failure modes are identified from the RPN, Risk Priority Number.
Zhang et al. [68]		Unspecified	Power system	Fuzzy assessment method	Fuzzy assessment could overcome the irrationality and uncertainty of FMEA

), e.g., power system [68] and actuation system [69]. Potential failures and effects are frequently assigned a qualitative severity ranking according to their damage potential and probability of occurrence. This is commonly referred to as the System Safety Performance Requirement (SSPR). Then, the critical components of the system are identified by the simulation and flight experiments [70]. Nevertheless, the model ignores human incorporation and utilizes the qualitative rating of severity [28].

(6) System-Theoretic Process Analysis (STPA). STPA is a hazard analysis tool based on an extended model of accident causation, the System-Theoretic Accident Model and Processes. By transforming the system safety problem into a control problem, the model considers not only the failures but also the interactions between the components. Thereby, it is a nonlinear analytical method different from the previous methods [71]. Although it decreases the subjective dependency on hazard analysis by the control loop, it is still a qualitative method. In addition to reliability analysis [72], the research has extended the model to UAS operations [73], summarized in

Table A6. Summary of STPA.

Reference	Risk Definition	UAV Type	Focus	Notes and Supplement Data	Main Conclusion
Chen et al. [72]	Accidents in take-off stage	Subscale flying-wing	Operators and automation	Expert opinions with standardized workflow	STPA could discover additional scenarios involving component interactions.
Chatzimichailidou et al. [73]	Injuries and damage	Light rotary	Authority, manufacturer, operators, and automation		STPA could provide a regulatory framework for UAV operations.
Zhang et al. [71]	Accidents in conflict resolution	Unspecified	Operators and automation		The mathematical basis of control feedback is required.
Stádník et al. [128]	Accidents in operation	Specific category	Authority, manufacturer, operators, and service supplier		The system requirements of STPA could be utilized to modify the SORA.

. STPA reduces the need for human intervention in the recognition of unsafe factors. However, the static character makes it impossible to accurately describe the impact of the causes which could be overcome by the Causal-Loop Diagram [74].

Lastly, human interactions also remain in manual flights, situation monitoring, staff training, etc. [75]. Models like the Human Factor Analysis and Classification System (HFACS) provide explicit categories of the human factors [76]. By analyzing the data between September 2001 and July 2016, the proportion of UAS incidents and accidents directly related to flight crew/pilot error was found to be approximately 48% [77]. Human factors have strong subjectivity and uncertainty, while the workload of drone operators varies significantly in complex environmental conditions [78].

4.2. Key Findings of Research

The causal models elucidate the inner relationship of events through both qualitative and quantitative approaches. Building upon the summary, the workflow encompasses inputs such as potential failures, contributing conditions, and ultimate losses. The outputs vary across model choices, encompassing probabilistic measures [62] and textual descriptions of loss (low or high risk levels) [27]. These results significantly contribute to the following:

• Reliability assessment of the system and sub-components, e.g., the SSPR.
• Identification of critical factors within the interplay of operational settings.
• Quantitative delineation of failure objectives at both operational and equipment levels.

Consequently, the primary focuses of the studies dictate the model’s applicational range. General models such as ETA are found to decompose logic for various purposes while adhering to the same risk definition [19,62,79]. Additionally, researchers have devised analytical methods by combining them, effectively leveraging their respective advantages. For instance, the SRMP facilitates comprehensive hazard identification and condition relevance, while the BBN aids in architecture establishment and probabilistic calculations [25].

Most previous studies have recognized the limitations of data acquisition (see Appendix C) [13,15,21,27,32,66], relying on sources such as accident/incident reports, historical failure data, and health monitoring data. The challenge is predominantly addressed through data sourced from traditional aviation and experiments conducted via Monte Carlo simulations. While expert opinions are employed to achieve conservative results in line with current safety targets, such reliance may impose impractical constraints. Another noteworthy trend is the shift towards the agent-based modelling of operational risk rather than static analysis. The complexity of operations prompts the consideration of potential losses stemming from unsafe interactions or external uncertainties, although these aspects have not been fully elucidated [74].

Nevertheless, the evolving operational uncertainties of the concept of operations (e.g., BVLOS) bring novel risk issues that cannot be identified directly from the previous datasets or simulations. Ignoring tailored modelling, it is too conservative to indiscriminately imitate the risk target like the equivalent safety level from traditional aviation. Considering the low-risk UASs in the regulatory framework for which risk assessment was not mandated before, the cooperative operation with multiple UAVs will certainly require specific management measures.

To help deal with the increasing uncertainties, one possible way is to fully understand the composition of the operational system and determine the airworthiness capacity of UASs in edge conditions [21]. From a regulatory standpoint, the results inform technical airworthiness and certification processes for UASs and related equipment [46]. Furthermore, the effort should be extended into the comprehensive reasoning of possible failures by probabilistic inference, which could be considered as performance-based management.

Additionally, many causal analyses primarily focus on post-assessment. An avenue for potential extension involves the real-time adoption of models to assist in operational execution, particularly in anomaly detection and recovery prediction [80]. To sum up, quantitative reliability requirements form the foundations for operational extension by supporting the rigor of UAS design, manufacture, maintenance, and component installation [15,81]. Simultaneously, textual descriptions of risk control barriers aid in the qualitative requirements of operator training and skill acquisitions [13].

5. Collision Risk Models

The consensus remains that the improper management of UASs will pose hazards to other aircraft, especially during the integration of UASs into the National Airspace System [82]. Currently, the research also seeks solutions for cooperative operations with the novel operational concept of high-density and collaborative flights. However, there exist noticeable differences between CPA and UASs, like the airframe size and maneuverability. Several models have been partially adopted from traditional aviation which aim to estimate the rate or the probability of collision. As summarized in [83], collision risk models mostly have prominent mathematical foundations but various assumptions, aims, and applications. The research could be summarized as follows:

• Trajectory estimation and state propagation, e.g., random motion without intention or kinematical models.
• Position error or uncertainty formulation, e.g., Gaussian distribution.
• Determination of collision or conflict, e.g., Near Mid-Air Collision (NMAC).

Note that collision risk models largely serve for conflict detection and resolution in aviation, where the risk is modelled as the metric for the approach degrees in both strategic and tactical stages.

5.1. Review of the Models

Motivated by [83], collision risk models are reviewed by the mathematical foundation of risk. The mainstream research efforts for UASs could be classified into the generalized Reich model, the geometric conflict model, and Monte Carlo simulation:

(1) Generalized Reich model. This well-known model aims to estimate the rate of collisions between one aircraft and others (i.e., collision accident per flight hour). It is undertaken in a strategic timeframe to drive air route design [84]. The basic computational formula is as follows:

$${\phi }^{ij}\left(t\right)={\displaystyle {\sum }_{d=1}^3\left[4\frac{{\lambda }_1{\lambda }_2{\lambda }_3}{{\lambda }_d}{p}_{s_{1,t}^{ij}}\left(0\right)p_{s_{2,t}^{ij}}\left(0\right)p_{s_{3,t}^{ij}}\left(0\right)\mathbb{E}\left[\left|v_{d,t}^{ij}\right|\right]\right]}$$

(2)

where ${\phi }^{ij}\left(t\right)$ denotes the collision rate at time $t$, and ${\lambda }_d$ denotes the cuboid aircraft shape in each dimension. ${\mathit{v}}_{d,t}^{ij}$ represents the relative speed, and $P_{S_{d,t}^{ij}}$ represents the overlap probability which is obtained by subsequent surveillance data of the trajectory during time interval $\left[0,T\right]$.

By extracting the spatial–temporal distribution of CPA, the data-driven model was proposed, which calculates the vertical overlap probability between CPA and UASs near airdromes [85,86]. Additionally, the trajectory deviation of UASs typically adheres to various probability density functions due to the scarcity of trajectory data available (refer to

Table A7. Summary of generalized Reich model.

Reference	Encounter Objects	Focus	Position Uncertainty	Main Conclusions
McFadyen et al. [82]	Unspecified UAS/CPA	Region around airports	Surveillance data of CPA and four typical distributions.	Navigational error should be considered in collision risk assessment.
Zhang et al. [87]	Small UAS/CPA	Region around airports	Surveillance data in ZUCK	The dynamic air geofencing is proposed.
Kim et al. [88]	UAS	UAS-specific air corridor	Double exponential distribution with 95% accuracy	A risk-based evaluation method is proposed for airspace capacity.

). Another application exists in the aerodrome design for UASs which also emphasizes the importance of estimating the trajectory distribution conservatively [87]. However, the long-term timeframe will cause a computational burden without the flexible consideration of encounters. Kim extends the concept of the Reich model to the capacity assessment of air corridors in low-altitude airspace where the vertical position error yields the double exponential distribution [88].

(2) Geometric conflict model. This model calculates the minimal distance and the time to the closest point of approach initially. Then, based on the predetermined way of uncertainty propagation, the collision probability could be obtained by the integration of cumulative probability [89]:

$$P_o^{ij}\left(t_{closest}\right)={\displaystyle \underset{s\in V}{\iiint }{p}_{s_{t_{closest}}^{ij}}\left(.\right)}ds$$

(3)

where $P_O^{ij}\left(t_{closest}\right)$ denotes the collision probability, $V$ denotes the spatial volume of integration space determined by the initial collision zone, and $p_{{\mathit{S}}_{tclosest}^{ij}}$ denotes the probability density of position uncertainty.

This method is considered as a tactical conflict detection model which provides the basis for necessary interventions [90]. And the unified framework has fewer restrictions when extended to UAS-only encounters [91]. Most of the research models the position uncertainty as the Gaussian distribution since the assumption is verified in conventional aviation [30,50,92,93,94]. Currently, the stochastic kinematic model has been adopted to describe the motion of UASs instead of instant settings. The modifications for UASs are conducted from the shape of collision zones to explore the balance between efficiency and safety, e.g., ellipsoid [30]. In addition, the high maneuverability induces the modelling of 3-D position uncertainty that may be more sensitive to the change in distances [50], summarized in

Table A8. Summary of geometric conflict model.

Reference	Encounter Objects	Focus	Position Uncertainty	Shapes	Trajectory Estimation
Maki et al. [129]	UAS/CPA	Non-restricted area	Gaussian	Cylinder (NMAC, 500 ft, 100 ft)	Sample UAS trajectory data with spatial–temporal offset
Kim et al. [92]	UAS/UAS	Structured routes	Gaussian	Cylinder (Well-Clear, 4000 ft, 450 ft)	Constant direction and speed
Zhang et al. [94]	UAS/CPA	Region around airports	3-D Gaussian	Cylinder based on realistic size	Stochastic kinematic model
Zou et al. [30]	UAS	Region in urban area	3-D Gaussian	Cylinder, cuboid, sphere, and ellipsoid	Constant direction and speed
Bijjahalli et al. [91]	UAS	All airspace classes	3-D Gaussian	Cylinder based on CNS inflation	Kinematic model

.

(3) Monte Carlo (MC) simulation. To overcome the nonlinearities and non-Gaussian noise in trajectory propagation, MC simulation estimates the probability of conflicts between aircraft $i$ and $j$ in given duration time $\left[0,T\right]$ as follows:

$$P\left(\exists {\tau }_k^{ij}\in \left[0,T\right],k\ge 1\right)={\displaystyle \frac{{\displaystyle {\sum }_{r=1}^R{1}_{{\tau }_k^{ij,r}\in \left[0,T\right]}}}{R}}$$

(4)

whether the conflict happens is deterministic in each encounter, where ${\tau }_k^{ij,r}$ represents the moment of $k_{th}$ conflict between $i$ and $j$ in the simulation round $r$ [83]. Thus, the probability distribution of the output will be achieved by randomized input, specifically in non-cooperative operations [52]. The visible computational complexity determines it as a strategic or offline assessment methodology.

MC simulation for collision risk assessment is typically carried out by aircraft dynamics and randomizing navigational error in the state-update process (see

Table A9. Summary of MC simulation (collision risk).

Reference	Encounter Objects	Focus	Collision Determination	Trajectory Estimation
Weibel et al. [130]	UAS	Well-Clear separation requirements	Cylinder (NMAC, 500 ft, 100 ft)	MIT Lincoln Laboratory (MIT LL) uncorrelated encounter model
Belkhouche et al. [131]	UAS	Operation with free flights	Geometric determination by conditional variables	Stochastic kinematic model
Wang et al. [52]	UAS/CPA	Region around airports	Alert zone around CPA	Dynamic model with trust input (acceleration)
Weinert et al. [18]	UAS	sNMAC candidates for small UAS	Realistic size	MIT LL uncorrelated encounter model

). Based on the threshold, the 2-D collision alert zone is provided for encounters between CPA and UASs near airports [52]. Meanwhile, it is more flexible in determining whether the collision will happen by statistical results, particularly in irregular collision shapes [95]. Furthermore, MC simulation has been extensively utilized in the design and evaluation of the Traffic Alert and Collision Avoidance System (TCAS) [96]. These works largely focus on the selection of the design target or measuring metrics, well known as NMAC (500 ft horizontally and 100 ft vertically) and Well-Clear adopted by RTCA SC-147 [97]. Nowadays, both time-based and distance-based metrics are specified for fixed-wing UASs, extended to the rotary UASs in UTM recently [18].

Lastly, general models like the Gas model have been applied to encounters between general aircraft and UASs [98], but the oversimplifications are impractical for cooperative operations in UTM. Meanwhile, the wide utilization of agent-based models such as Traffic Organization and Perturbation AnalyZer (TOPAZ) has not been seen [91].

5.2. Key Findings of Research

Collision risk models for UASs predominantly rely on traditional methods albeit with a slow pace of essential evolution. In general, probabilistic collision risk metrics are the crucial benchmarks in this regard and support the following:

• Separation requirement for flight schedules and air geofences.
• Design and evaluation process of DAA functions and algorithms of conflict detection and resolution.
• Requirements of standards for infrastructures such as Communication, Navigation, and Surveillance (CNS).

From this review, it becomes apparent that the operational concept (level of interaction) plays a significant function in the establishment of models. To be more specific, the motion of small UASs (normally rotary-wing) in non-cooperative traffic is modelled as unintentional when computing the risk with crewed aircraft, especially in the regions around airports [52,94]. With the operational setting fully cooperative and autonomous, the UAS is recognized as the main body in the collaborative operations, instead of the intruder to other aircraft. In this case, the motions are envisioned with a certain direction and speed which are controlled by the centralized terminal [50]. As depicted in Figure 8, safe operations pertain to the safety of the transportation system by multiple layers of separation assurance which correspond to the concept of operation v2.0 by the FAA [16].

Apart from the mathematical formations, such distinctions in operational concepts directly affect the preferences of models, e.g., MC simulation is more suitable for stochastic motions [18], while the others fit cooperative operations with structured trajectories. Another summative result that should be noticed is the size of the UAS which also determines the modelling process, as a small rotary-wing UAS may encounter more position uncertainties. Both of them are reflected in the modelling of trajectory uncertainties [94].

The biggest challenge of collision risk models is the synergy of infrastructure and operation strategies [21]. Current investigations question whether the adoption of traditional collision risk models is practicable with extrinsic modifications. The envisaged UTM has divided the development into four phases aligned with the automation level (e.g., VLOS to BVLOS) [16]. The evolution is evident not only in the update rate or latency for position reports of the equipment but also in the concept of management, emphasizing highly cooperative communication protocols. As for the micro-scale, position uncertainty, known as track conformance with a pre-set trajectory, has initiated intense research in flight experiments on tracking systems [59,99].

Simultaneously, the concept of Performance-Based Navigation (PBN) is being explored for the generation of CNS instead of individual technology. Thereby, the position accuracy limits of UASs are defined explicitly to ensure compliance with the desired trajectory [99], rather than relying solely on empirical settings. Various quantitative recommendations for capabilities of tracking have been proposed, which could serve as references for the design of operational procedures by regulatory authorities [21]. Regarding the DAA function, studies utilize Monte Carlo simulation in randomized encounter scenarios without specifying the type of aircraft. The iteration of separation candidates should consider the aforementioned safety assurances [50]. In essence, the establishment of more explicit multi-layer separations for UASs necessitates cooperation among infrastructure, airspace structure, operational strategies, and other factors. As a consequence, the collision risk model should be chosen as the operation-specific methodology to support the design of UASs and UTM. Meanwhile, the modelling mechanism of position uncertainty throughout the whole process should be considered in the safety risk management of UAS operations. As has been explained by [21], there is also an opportunity for quantitative safety metrics on the performance of CNS, position accuracy limits, etc.

6. Ground Risk Models

The ground risk models (GRMs) largely focus on the modelling of the TPR posed to people on the ground. Based on the elicitation from a previous comprehensive review [15], the decomposition of sub-models provides the direction of the summary. To avoid redundancy, this review of GRMs is limited to between 2017 and 2024 which helps to illustrate the current trends and improvements after Washington’s work. The generic equation is adopted [62]:

$$E_{\mathrm{C}}={\lambda }_{\mathrm{system}}\times {\rho }_{\mathrm{Population}}\times p\left(\mathrm{Fatality}|\mathrm{Impact}\right)\times A_{\mathrm{Impact}}\times SF$$

(5)

where $E_c$ denotes the TPR by casualty rate per flight hour, ${\lambda }_{system}$ is the failure rate of the system which may cause off-nominal behaviors to ground impact, ${\rho }_{Population}$ represents the density of population distribution, $p\left(Fatality|Impact\right)$ is the fatality probability by impact, $A_{Impact}$ is the size of the area affected, and $SF$ represents the mitigation factors by shelter.

Failure models that determine the probability of accidents have been included in the causal models above. Hence, the recent research on GRMs could be summarized as follows:

• Impact model: what is the location and the size of the area impacted by a given failure?
• Exposure model: how many people or property could be affected in the area?
• Harm model: what is the fatality probability of the people affected with the various stress conditions ($SF$)?

It is worth noting that sub-models do not exist independently but are integrated into the assessment process, undergoing significant modifications in various directions elaborated below.

6.1. Review of the Models

The following models are reviewed:

(1) Impact models. These models were previously classified as geometrical and empirical: while the former one uses aerodynamic models, the latter is based on data from aircraft crashes [62]. The uncertainty of impact trajectory is substantially dominated by the initial motion conditions, failure modes, type of UAS, mission setting, mitigation devices, and environmental factors. Previous works have pointed out the insufficiency of explicit determination, but the empirical choices for fixed-wing configurations have catastrophic failure conditions [15]. Cour-Harbo provided a targeted classification method for descent events such as ballistic descent, uncontrolled glide, parachute descent, and flyaway [31,100]. The impact probability density has a direct correlation with the descent mode which combines the motion transition from dynamic models. The extended influences will act on impact kinetic (stress) and falling attitude and support operational decision-making processes [101,102,103], summarized in

Table A10. Summary of impact model.

Reference	Failure Modes	Type	Point or Area	Descent Model	Assumptions and Notes
la Cour-Harbo et al. [100]	Unpremeditated descent scenario (UDS), loss of control (LOC), and controlled flight into terrain (CFIT)	Fixed-wing	Aera (100 cm2, 25 cm2)	Ballistic descent, uncontrolled glide, and flyaway under control (particle dynamics)	Failure happens in the inspection path, and glide radio follows normal distribution.
Levasseur et al. [105]	LOC after engine failure	Fixed-wing	Point	6DOF dynamics model with MC simulation	Uncertainties are driven by turning rate, flight path angle, control surface deflection, and wind.
Rudnick-Cohen et al. [107]	LOC after engine failure	Fixed-wing	Point	6DOF dynamics model with MC simulation	Drag coefficients caused by angular velocities are ignored.
Primatesta et al. [104]	UDS, LOC, and CFIT	Fixed-wing and rotary-wing	Aera	Same as [100] with parachute descent	Flight directions are assumed to be distributed uniformly.
Lin et al. [106]	LOC	Fixed-wing and rotary-wing	Point	6DOF dynamic model with MC	Drag coefficients are calculated by the constant frontal area.
Che Man et al. [103,132]	Different power propulsion failure modes	Rotary-wing	Point	6DOF dynamic with system simulation	Crash point estimation should consider the more realistic reliability of UAV parts.
Liu et al. [133]	LOC	Fixed-wing and rotary-wing	Area	Same as [100]	Debris impact is considered by possible circle area.

.

The second-order drag model proposed before is essentially a particle dynamic model without consideration of control feedback [31,104], which is limited to point mass and conservative failure cases. The current trend is to establish a six-degree-of-freedom (6DOF) model to obtain the accurate impact location [101,105,106]. Then, the uncertainties are captured from different input dimensions by MC simulation. Methods of supervised learning are also adopted for fast trajectory prediction based on random experiments [101,107]. Che Man conducted a detailed co-simulation of quad-rotor sUASs to achieve high-fidelity crash trajectories under different failure modes of the propulsion system [103].

(2) Exposure models. The exposure models characterize the uncertainty in the presence of affected entities such as property and people [13]. The models highly depend on the resolutions of data for population density distribution, e.g., census data, geographic data, and expert opinions [15]. Uniform exposure models are static and fail to capture the potential peak in resulting risk since the population presents remarkable spatial and temporal characteristics, particularly in urban areas [35]. Thus, research works attempt to utilize data-digging technologies to explore the spatial–temporal correlations and improve the accuracy of density prediction [108,109]. For instance, the regional characteristics of infrastructure or functional areas could directly affect population density. Detailed information can be found in

Table A11. Summary of exposure model.

Reference	Entity of Risk	Model	Substantiation Data	Assumptions and Notes
Yao et al. [110]	Third-party	Empirical building–population gravity model	Multi-sources of census data	The population decreases with the distances from centroids of residential buildings.
Awan et al. [109]	Traffic vehicles	Hybrid deep learning with LSTM and CNN	GPS data of taxis and rent bikes	Weather is used as the character for prediction.
Pilko et al. [134]	Third-party	Comprehensive distribution model	Census data	Spatiotemporal distribution is determined by categories of regions.
Sivakumar et al. [111]	Third-party	Diffusive model simulation	Public transportation data	Random walk is used to illustrate the behavior of the population.
Jiao et al. [108]	Third-party	Hybrid deep learning with LSTM and CNN	Census data	The uncovered observation points are calculated by the resampling of data randomly.
Pang et al. [40]	Third-party	Same as [110]	Census and public transportation data	The input of population density in public transportation stations is obtained by random forest regression.

.

The gravity model was established in 2017 [110] and employed to mimic population and vehicle distributions in urban environments with limited geographic information [40]. Meanwhile, diffusive model simulations with random walk [111] and advanced deep learning methods were also used to develop the prediction model for population behaviors and embedded into assessment to improve the robustness for more universal scenarios [108,109].

(3) Harm models. Harm models focus on the consequence estimation for a given level of stress absorption and exposure entities [38,62]. Due to the distinctions of harm mechanisms determined by UAS properties or types, several well-known models have been proposed, such as the standard curve of fatality probability by Range Commanders Council (RCC) and the Blunt Criterion (BC) model by the US Department of Defense [15]. Both of them are essentially energy-based. The former one was modified by a shelter factor in 2008 and has been widely deployed in UAS operation risk assessment [40,104]. Other severity indicators contain the Abbreviated Injury Scale (AIS) and Head Injury Criterion (HIC) which are standardized by the statistical injury data in accidents and impactor studies.

The safety threats of UASs to persons are assessed by the combination of drop impact simulations and experiments [112]. Most research employs comparable impact analysis on different parts of human bodies with dummies [113]. From the experimental results, Koh provided recommendations on the weight threshold of UASs, while the choice of platform material is another key to mitigating impact injury [51]. The finite element analysis of quadrotor sUAS impact shows that the BC model seems to underestimate the fatality probability when impacts happen to the head, thorax, and abdomen since the RCC model performs oppositely [114]. Lastly, there are still few works so far focusing on the second effect of debris released or the combined harm mechanisms, as summarized in

Table A12. Summary of harm model.

Reference	Type	Stress Characteristic	Mechanism of Harm	Harm Measure	Assumptions and Notes
Koh et al. [51]	Quadrotor UAV	Kinetic energy	Blunt trauma	AIS-3	Practical tests by finite elements model.
Rattanagraikanakorn et al. [114]	Quadrotor UAV			HIC and Viscous Criterion (VC)	Relationship between VC and HIC is derived from previous data.
Zhang et al. [135]	Small rotary UAV			Damage on platform	High-precision model based on dynamic and finite element models.
Svatý et al. [113]	Quadrotor, fixed-wing UAV			Pure energy, HIC, and AIS (Nij)	Comparison and effectiveness analysis of current safety criterion.

.

6.2. Key Findings of Research

The ground impact process involves system modelling based on aerodynamics and spatial–temporal variabilities. Currently, methods are trending towards developing more accurate and realistic representations of the impact progression, tailored to specific environmental conditions, UASs, and populated areas [112]. These works reveal the basic mechanism and are largely adopted by risk mitigation methods:

• Modelling the ground risk map and assessing the risk for a given UAS trajectory;
• Risk-minimal trajectory planning by transforming into a resolution-based airspace structure;
• Design and evaluation of UAS component materials and external devices like parachutes.

The risk maps where obstacles and high-risk regions are represented by attributes of grids are commonly constructed to reveal the distribution of entities (see Figure 9) [31,105,115]. To minimize the operational risk to the third party, recent studies have employed path-finding algorithms like heuristic and swam-based searching [108]. However, the attribute of risk in each airspace unit is entirely subject to the accuracy of data such as the population distribution. Without the correct modification, the dynamic and uncertain features of the parameters of ground impact will cause infeasible solutions, particularly in urban areas. Although the default position of risk assessment is conservative when facing uncertainties, the rigorous analysis of ground impact is still induced by intelligent management needs. For instance, advanced AI technologies make the accurate or near-accurate prediction of impact position possible with a quick response [109]. To capture the spatial–temporal density of people, meanwhile, deep learning is built to satisfy pre-active needs under different uncertain conditions [108].

Nevertheless, current studies still lack comprehensive considerations of precise failure modes in UASs and how they will affect future motions (e.g., UAS type, concept of operations). Meanwhile, with the evident information on the dynamic environment, the methodologies have been extended to in-flight decision-making such as beforehand avoidance of potential regions of high risks [115]. Considering the targets of risk assessment, the problem, then, still falls into the discussion of the choice between precision and cost since the simplification in risk modelling could still maintain the desired safety level at a lower cost. The dilemma of cost precision should be considered intimately because the impact tests and software needed in finite element simulations are costly but still necessary in production and manufacturing.

Furthermore, there is also a need to assess the TPR from the population-based perspective which calculates the accumulated TPR of a given population [24], as most studies concentrate on the assessment of the operations. Imagining the regular operations over populated areas as daily logistics in metropolitan areas, the following should be emphasized in the risk metrics: ‘how many third-party fatalities are there in a given area due to UAS flight accidents during a given time period (e.g., annum)’. From the review and the summarization in Ref. [38], few methods focus on the accumulated risk metrics. Thus, the future direction should grasp the particularity in the given area and develop the localized safety metrics owing to the distinctions between different regions.

Ultimately, the causal mechanism is seen in ground impact research owing to its event chain in Equation (5). Operational tests could bring more options for regulations in quantitative control variables, e.g., UAS types, weight, kinetic energy, population distribution, and requirements on component hardness [114]. Thus, high-precision models for simulations along with the generalization of possible datasets are required to overcome time-demanding and costly modelling in proper validation. In addition, the concept of operations, like the density of operation, level of cooperation, and type of task, is required to be compressed into the safety control process toward a more refined set of control variables and metrics in the SRMP.

7. Discussion and Future Directions

Despite the significant diversities which exist in the developed models, the inherent relationship between the categories above is proved by the analysis and modelling process. Previous sections have investigated the main focuses and the state of the art of recent research. Considering the rapid development under conceptions such as UTM, this section presents insights into the common problems at the high level and summarizes key areas towards future applications envisioned.

Within the UTM ecosystem, the risk assessment should be organized, coordinated, and conducted by the federated set of actors as well as the operations, presented in Figure 10. The illustration is in line with the ConOps 2.0 for UTM by the FAA, regarding the participants. Therefore, three major observation fields are distilled:

(1) Data acquisition and sharing. Data, concerning system and component failures, incidents, and accidents, provide valuable insight into how performance and operational capabilities/limitations contribute to hazards [60]. Most investigations pointed out the restriction. Hence, participants of UAS operations must establish a transparent, highly integrated, and standardized mechanism or platform for data acquisition, storage, and analysis. Although incident investigation authorities have published reports on incidents and accidents involving certain statistics [116], previous approaches expand traditional accident reporting and show more interest in the mishaps of mixed operations. The continuously maturing concept of operation, like integration into controlled airspace and UTM services, still lacks the explicit data required to fulfil the supports. Simultaneously, the problem could also be affected by the safety culture fearing mistakes, which may in some ways impede the proactive reports of accidents with no serious outcomes.

Therefore, national policy is also required to improve legal awareness, encourage self-reporting, and support building the specific system for UASs. Recommendations have been proposed to support the framework of data collection and usage by NASA which systematically summarizes the list of risk-related data and analytical methods [60]. As well as the mishap data referred to in this paper, there are still limited sources containing other information like system performance, communication, confidence, and even images [21,35]. Hence, the mechanism of interaction between those involved should be established with suggested, required, and mandated responsibilities. Recalling the findings in this paper, the risk assessment of operations might be able to have access to the UAS performance needs with support from manufacturers. Moreover, the risk-related data should be listed and collected through the lifecycle of each UAS required and then connected to a flight information management system operated by regulators. Although the external entities might not have access to the database, as the protection of privacy, the gateway could be developed for the registration of data exchange, i.e., scientific studies.

In addition, non-mishap data like flight trajectory, navigation performance, weather, etc., are also critical to developing proactive methodologies. The safety bounds of these operational constraints are supposed to be characterized before operations. One solution is to enhance the services of a supplement data system where participants could connect directly to record, store, and evaluate the safety level. In general, future works should be conducted for data shortage by under-regulated procedures from reports, automatic data recording, and high-fidelity simulations.

(2) Safety target decomposition. Given that it is impractical to utilize the single universal model to satisfy needs in risk assessment, high-level guidance on sub-models and associated safety targets is still required. Methods are presented that adjust to specific UAS types or operational concepts. However, safety indicators such as ‘ELoS’ have not been decomposed to build a consistent assessment process, such as sub-models, performance, and operational rules [26]. Safety target decomposition with quantitative indicators could become a wind vane in the future (see Figure 10).

Well-known metrics like ‘10⁻⁷ accidents per flight hour’ may raise doubts about confidence when they are extended to novel UTM. Consistent assessment has been emphasized in previous works, especially in ground risk models to reduce the over-simplification and mitigate the cascading effects on modelling [15]. The argument is also proved by studies on coupling the DAA system and air route design which represents hierarchical conflict management [16,50]. Although regulatory authorities move towards harmonized, widely applicable, and risk-informed regulations, more safety cases are required to provide references where safety targets are converted to entry criteria with elaborated standards. Specifically, two cascading questions are raised: ‘how does the functional failure support the safety level in operations’ and ‘how does the risk in each operation affect the target of safety risk management of UASs’. So, it is also valuable to construct the iterated workflow for the propagation of safety metrics, e.g., from qualitative to quantitative. For instance, the upcoming SORA 2.5 has improved the ground risk determination by population density maps [117] rather than textual descriptions as before. In other words, the development of risk assessment models may aid in formatting more practical and quantified guidance and, in turn, emphasize the trend toward more comprehensive and rigorous safety criteria.

(3) Cutting-edge methodologies. In the recent research, cutting-edge methodologies such as deep learning, reinforcement learning, and other hybrid models have contributed to handling variables in the stochastic risk environment. The attributes of risk could be converted to different data formats for subsequent processes in risk assessment. Artificial intelligence poses new opportunities to achieve a cost–efficiency balance for safety analysts. For instance, a recent study has proved that generative AI could excel in accident report classification tasks within the aviation context [118]. These applications could facilitate hazard identification based on necessary training while performing better than linear models such as the BBTM. Accordingly, future research could continue to explore the potential benefits so that tedious tasks which would take experts a few days previously could be finished in several minutes.

Studies on the machine–human interfaces and explanatory information of AI are also likely [81]. Coupled with AI roadmap 2.0 envisioned by the EASA, the applications in aviation move towards more explainable, reliable, and trustworthy [119]. Then, conformity assessment and AI-related regulations for safety are also required. Another hotspot for UAS risk management in the future that could be seen is digital twins (DTs) [120]. Integration with DTs or advanced simulation environments will greatly reduce the cost of real-world tests, especially in extreme cases needed in crash experiments. Meanwhile, the technology may also support the proactive assessment framework with tight budgets.

Consequently, since this paper focuses on the modelling approaches to risk in UAS operations, some limitations need to be clarified. Firstly, several terms cited by risk assessment are associated with the public perception of risk, privacy, and cybersecurity for attack and defense. The public acceptance of operation risk is largely affected by confidence in outcomes; in turn, it should be considered in safety management [121]. However, these valuable studies are out of the scope of this paper and have been summarized in corresponding reviews [39,54]. Second, other authors may utilize different keywords instead of those mentioned. Besides the systematic literature review, we have also searched the relevant research works from the citation lists of the literature and attempted to provide a comprehensive summarization.

8. Conclusions

This paper provides a comprehensive review of safety risk assessment for civil UAS operations. Beginning with the bibliometric analysis of the latest research efforts on the relevant topics, we categorize the risk assessment methods from modelling approaches and their objectives, i.e., the casual model, collision risk model, and ground risk model. Each of them provides the corresponding support to safety risk management, from casual analysis and hazard identification to potential harm estimation.

Subsequently, we detail the assessment mechanism of each category with risk definitions, types, and focuses. Since the general purpose of risk assessment is to ensure the safety target of the operational system, key findings are also proposed for each: the practical applications, the support they offer to participants, and the primary challenges encountered. The main conclusions are summarized as follows:

• The summative research framework is an effective method to distinguish the diversities in the developed models, not only revealing the specific risk that the model focused on but also reflecting the inherent relationship of the different categories in Figure 6. The concept of consistent assessment is suggested to establish the general guiding framework for following research.
• The emerging operation concepts and UAS types impose a higher requirement on the accuracy of the existing models. Whilst safety management should achieve the balance between safety and costs (described by conditions of an acceptable level), rigorous risk modelling and assessment could be achieved by the trend of intelligent methodologies and the highly cooperative architecture.
• Risk assessment models are increasingly developing toward the regulation formulation. To help support the decision-making process, the conservative assumptions in model uncertainties should be modified by more transparent, quantitative control variables. As well as the methodologies, more safety cases of UAS risk assessment are necessary to establish a traceable connection between explicit risk and managing points.

Consequently, this paper highlights the future directions of research based on the high-level technical problems: data acquisition and sharing, safety target decomposition, and cutting-edge methodologies. The data requirements are emphasized by the majority of studies, and the lack of them could bring overly conservative assumptions. The safety target contributes to consistent risk assessment toward a future integrated ecosystem. Cutting-edge methodologies like generative AI and digital twins will directly help to establish more intelligent, reliable, and rigorous methodologies.

Risk assessment serves as the fundamental safeguard for the safe operation of UASs, underpinned by requisite technical support. As mentioned above, a single model cannot encompass the entirety of the risk assessment space due to the diversity of the applications. However, the summative research framework is the plain reflection of current models with their focuses (relationship-oriented and operation-oriented). Owing to the scope of research, the sub-category in each section could be extended and revised by further works. For instance, the severity of air collisions might be modified by other metrics (e.g., resolution time) towards more flexible utilizations rather than the mathematical formation in this paper. Furthermore, the synergic modelling of air–ground risk could be another direction that exceeds the framework in this paper. Finally, we expect this work to provide a basic cognition of the topic for followers, inspire researchers to design more advanced models, and provide a reference for the development of regulations.