Annex D to AMC1 to Article 11

• ED Decision 2019/021/R found in: Unmanned Aircraft Systems (2019/947 and 2019/945) Part-UAS (Jul 2024)

Annex D to AMC1 to Article 11 ED Decision 2019/021/R TACTICAL MITIGATION COLLISION RISK ASSESSMENT D.1 Introduction-tactical mitigation The target audience for Annex D is the UAS operator who wishes to apply TMPR, robustness, integrity, and assurance levels for their operation. Annex D provides the tactical mitigation(s) used to reduce the risk of a mid-air collision. The TMPR is driven by the residual collision risk of the airspace. Some of these tactical mitigations may also provide means of compliance with point SERA.3201 of the SERA Regulation, and the additional requirements of various states. The air-risk model has been developed to provide a holistic method to assess the risk of an air encounter, and to mitigate the risk that an encounter develops into a mid-air collision. The SORA air-risk model guides the UAS operator, the competent authority, and/or ANSP in determining whether an operation can be conducted in a safe manner. This Annex is not intended to be used as a checklist, nor does it provide answers to all the challenges of DAA. The guidance allows a UAS operator to determine and apply a suitable means of mitigation to reduce the risk of a mid-air collision to an acceptable level. This guidance does not contain prescriptive requirements, but rather objectives to be met at various levels of robustness. D.2 Principles The mitigation of the risk that an encounter develops into a mid-air collision is a highly dynamic, variable, and complicated process. To simplify the process, the air-risk model takes a more qualitative approach to arrive at an initial aggregated airspace risk assessment. After an assessment of the initial, unmitigated risk of an encounter, and optional application of strategic mitigations, this Annex assigns a performance requirement on the UAS operation to mitigate the remaining collision hazard (i.e. the residual airspace risk). D.3 Scope, assumptions and definitions See Annex C for the scope and assumptions D.4 Knowledge of terms and definitions To understand this section, the following SORA definitions need to be understood: (a) atypical/segregated vs other airspace; (b) AEC (see Annex C); (c) initial ARC (see Annex C); (d) residual ARC (see Annex C); (e) ICAO conflict management (see ICAO Doc 9854, Section 2.7); (f) strategic mitigation (see Annex C); (g) tactical mitigations and feedback loops; and (h) VLOS and BVLOS. D.5 TMPR assignment A tactical mitigation is a mitigation applied after take-off, and for the air risk model, it takes the form of a ‘mitigating feedback loop’. This feedback loop is dynamic in that it reduces the rate of collision by modifying the geometry and dynamics of the aircraft in conflict, based on real-time aircraft conflict information. SORA tactical mitigations are applied to cover the gap between the residual risk of an encounter (the residual ARC) and the airspace safety objectives. The residual risk is the remaining collision risk after all strategic mitigations are applied. D.5.1 Two classifications of tactical mitigation There are two classifications of tactical mitigations within the SORA, namely: (a) VLOS, whereby a pilot and/or observer uses (use) human vision to detect aircraft and take action to remain well clear from and avoid collisions with other aircraft. (b) BVLOS, whereby an alternate means of mitigation to human vision, as in machine or machine assistance[[47]](#_ftn48), is applied to remain well clear from and avoid collisions with other aircraft (e.g. ATC separation services, TCAS, DAA, U-space, etc.). D.5.2 TMPR using VLOS Originally the regulations for ‘see and avoid’ and ‘avoid collisions’, defined in point SERA.3201 of the SERA Regulation, assumed that a pilot was on board the aircraft. With UA, this assumption is no longer valid, as the aircraft is piloted remotely. Under VLOS, the pilot/UAS operator accomplishes ‘see and avoid’ by keeping the UAS within their VLOS. The UAS remains close enough to the remote pilot/observer to allow them to see and avoid another aircraft with human vision unaided by any device other than, perhaps, corrective lenses. VLOS is generally considered an acceptable means of compliance with the ‘remain well clear from’ and ‘avoiding collisions’ requirements of point SERA.3201 of the SERA Regulation. VLOS generally provides sufficient mitigation for cases where the requirements for tactical mitigations are low, medium, and high. Different states may have other rules and restrictions for VLOS operations (e.g. altitudes, horizontal distances, times for relaying critical flight information, UAS operator/observer training, etc.). In some situations, the competent authority may decide that VLOS does not provide sufficient mitigation for the airspace risk, and may require compliance with additional rules and/or requirements. It is the UAS operators’ responsibility to comply with these rules and requirements. The UAS operator should produce a documented VLOS de-confliction scheme, explaining the methods that will be applied for detection and the criteria used to avoid incoming traffic. If the remote pilot relies on detection by observers, the use of communication phraseology, procedures, and protocols should be described. Since the VLOS operation may be sufficiently complex, a requirement to document and approve the VLOS strategy is necessary before approval by the competent authority. The use of VLOS as a mitigation does not exempt the UAS operator from performing the full SORA risk analysis. D.5.3 TMPR using BVLOS Since VLOS has operational limitations, there was a concerted effort to find an alternate means of compliance with the human ‘see and avoid’ requirements. This alternate means of mitigation is loosely described as ‘detect and avoid (DAA)’. DAA can be achieved in several ways, e.g. through ground-based DAA systems, air-based DAA systems, or some combination of the two. DAA may incorporate the use of various sensors, architectures, and even involve many different systems, a human in the loop, on the loop, or no human involvement at all. TMPR provides tactical mitigations to assist the pilot in detecting and avoiding traffic under BVLOS conditions. The TMPR is the amount of tactical mitigation required to further mitigate the risks that could not be mitigated through strategic mitigation (the residual risk). The amount of residual risk is dependent on the ARC. Hence, the higher the ARC, the greater the residual risk, and the greater the TMPR. Since the TMPR is the total performance required by all tactical mitigation means, tactical mitigations may be combined. When combining multiple tactical mitigations, it is important to recognise that the mitigation means may interact with each other, depending on the level of interdependency. This may negatively affect the effectiveness of the overall mitigation. Care should be exercised not to underestimate the negative effects of interactions between mitigation systems. Regardless of whether mitigations or systems are dependent or independent, when they act on the same event, unintended consequences may occur. D.5.3.1 TMPR assignment risk ratio The SORA TMPR is based on the findings of several studies. These studies provide performance guidance using risk ratios. Table shows the SORA TMPR risk ratio requirements derived from those studies. <table border="0" cellpadding="0" cellspacing="0" width="603"><tr><td width="94"><p>Air-Risk Class </p></td><td width="142"><p>TMPR</p></td><td width="368"><p>TMPR system risk ratio objectives</p></td></tr><tr><td width="94"><p><b>ARC-d</b></p></td><td width="142"><p><b>high performance</b></p></td><td width="368"><p><b>system risk ratio ≤ 0.1 </b></p></td></tr><tr><td width="94"><p>ARC-c</p></td><td width="142"><p>medium performance</p></td><td nowrap="" width="368"><p>system risk ratio ≤ 0.33</p></td></tr><tr><td width="94"><p>ARC-b</p></td><td width="142"><p>low performance</p></td><td nowrap="" width="368"><p>system risk ratio ≤ 0.66</p></td></tr><tr><td width="94"><p>ARC-a</p></td><td width="142"><p>No performance requirement</p></td><td width="368"><p>No system risk ratio guidance; although the UAS operator/applicant may still need to show some form of mitigation as deemed necessary by the competent authority</p></td></tr></table> Table D.1 — TMPR risk ration requirements table Table provides TMPR qualitative criteria as a qualitative means of compliance to help UAS operators translate the risk ratio quantitative values found in Table D.1 into system qualitative functional requirements. Table D.3 provides guidance for the TMPR integrity and assurance objectives for compliance with the objectives of Table C.1. For the purpose of this assessment, the objectives of Table D.1 take precedence over the guidance provided in Tables D.2 and D.3. D.5.3.2 TMPR qualitative criterion table Table D.2, below, shows more qualitative criteria for the different functions and levels of the TMPR. The qualitative criteria are divided into five sub-functions of DAA, namely: detect, decide, command, execute, and the feedback loop. Where reference is made to the detection of a percentage of all aircraft, this should be read as a detection rate of the overall mix of aircraft anticipated to be encountered in the detection volume, and not limited to the detection of just the subset of aircraft in the mix.      Table D.2 — TMPR qualitative criteria table D.5.3.3 Effects of aircraft equipment on tactical system performance The performance of a tactical mitigation is affected by the equipment of both the UAS and threat aircraft, on an encounter-by-encounter basis. A tactical mitigation mitigates the encounter risk by using a set of sub-functions of the DAA routine, namely see/detect, decide, command, execute, and feedback loop. Equipment that aids these sub-functions increases the overall performance of the tactical mitigation system. The following example illustrates how the equipment of both the UAS and threat aircraft affects the overall tactical performance. Given a threat aircraft equipped with a transponder, it is easier for other aircraft to detect and track the threat aircraft. In this case, the UAS can be equipped with a system that is able to detect and track transponders. However, a UAS that mitigates the risk by locating the threat aircraft by detecting their transponder (e.g. through ACAS-II V. 7.1) cannot use the same approach to mitigate the risks posed by an aircraft without a transponder. Tactical mitigation equipment is not homogeneous within the airspace. Different classes of airspace have different mixes of equipment. General aviation aircraft tend to be less well-equipped than commercial aircraft. There will be differences in the mix of general aviation/commercial aircraft from one location/airspace to another. Based on the aircraft equipment, a specific tactical system (e.g. FLARM, ACAS, etc.) could mitigate the risk of a collision in some classes of airspace and not in others. Therefore, the UAS operator needs to understand the effectiveness of their tactical mitigation systems within the context of the airspace in which they intend to operate, and select systems used for tactical mitigation accordingly. A TCAS II 7.1/ACAS-II equipped UAS will not mitigate all the encounter risks in an area where sailplanes equipped with FLARM are known to operate. D.5.4. TMPR robustness (integrity and assurance) assignment Table D.3, below, lists the recommended requirements to comply with the TMPR integrity and assurance assignment. Table D.3 — TMPR integrity and assurance objectives D.6 Maintenance and continued airworthiness The DAA maintenance and continued airworthiness requirements are addressed in the SAIL requirements; please refer to Annex E. --- [[47]](#_ftnref48) For the purposes of this dissection, systems like ATC separation services would be considered to be machine assisted. ##### Annex D to AMC1 to Article 11 *ED Decision 2019/021/R* **TACTICAL MITIGATION COLLISION RISK ASSESSMENT** **D.1 Introduction-tactical mitigation** The target audience for Annex D is the UAS operator who wishes to apply TMPR, robustness, integrity, and assurance levels for their operation. Annex D provides the tactical mitigation(s) used to reduce the risk of a mid-air collision. The TMPR is driven by the residual collision risk of the airspace. Some of these tactical mitigations may also provide means of compliance with point SERA.3201 of the SERA Regulation, and the additional requirements of various states. The air-risk model has been developed to provide a holistic method to assess the risk of an air encounter, and to mitigate the risk that an encounter develops into a mid-air collision. The SORA air-risk model guides the UAS operator, the competent authority, and/or ANSP in determining whether an operation can be conducted in a safe manner. This Annex is not intended to be used as a checklist, nor does it provide answers to all the challenges of DAA. The guidance allows a UAS operator to determine and apply a suitable means of mitigation to reduce the risk of a mid-air collision to an acceptable level. This guidance does not contain prescriptive requirements, but rather objectives to be met at various levels of robustness. **D.2 Principles** The mitigation of the risk that an encounter develops into a mid-air collision is a highly dynamic, variable, and complicated process. To simplify the process, the air-risk model takes a more qualitative approach to arrive at an initial aggregated airspace risk assessment. After an assessment of the initial, unmitigated risk of an encounter, and optional application of strategic mitigations, this Annex assigns a performance requirement on the UAS operation to mitigate the remaining collision hazard (i.e. the residual airspace risk). **D.3 Scope, assumptions and definitions** See Annex C for the scope and assumptions **D.4 Knowledge of terms and definitions** To understand this section, the following SORA definitions need to be understood: (a) atypical/segregated vs other airspace; (b) AEC (see Annex C); (c) initial ARC (see Annex C); (d) residual ARC (see Annex C); (e) ICAO conflict management (see ICAO Doc 9854, Section 2.7); (f) strategic mitigation (see Annex C); (g) tactical mitigations and feedback loops; and (h) VLOS and BVLOS. **D.5 TMPR assignment** A tactical mitigation is a mitigation applied after take-off, and for the air risk model, it takes the form of a ‘mitigating feedback loop’. This feedback loop is dynamic in that it reduces the rate of collision by modifying the geometry and dynamics of the aircraft in conflict, based on real-time aircraft conflict information. SORA tactical mitigations are applied to cover the gap between the residual risk of an encounter (the residual ARC) and the airspace safety objectives. The residual risk is the remaining collision risk after all strategic mitigations are applied. **D.5.1 Two classifications of tactical mitigation** There are two classifications of tactical mitigations within the SORA, namely: (a) VLOS, whereby a pilot and/or observer uses (use) human vision to detect aircraft and take action to remain well clear from and avoid collisions with other aircraft. (b) BVLOS, whereby an alternate means of mitigation to human vision, as in machine or machine assistance[[115]](#_ftn116), is applied to remain well clear from and avoid collisions with other aircraft (e.g. ATC separation services, TCAS, DAA, U-space, etc.). **D.5.2 TMPR using VLOS** Originally the regulations for ‘see and avoid’ and ‘avoid collisions’, defined in point SERA.3201 of the SERA Regulation, assumed that a pilot was on board the aircraft. With UA, this assumption is no longer valid, as the aircraft is piloted remotely. Under VLOS, the pilot/UAS operator accomplishes ‘see and avoid’ by keeping the UAS within their VLOS. The UAS remains close enough to the remote pilot/observer to allow them to see and avoid another aircraft with human vision unaided by any device other than, perhaps, corrective lenses. VLOS is generally considered an acceptable means of compliance with the ‘remain well clear from’ and ‘avoiding collisions’ requirements of point SERA.3201 of the SERA Regulation. VLOS generally provides sufficient mitigation for cases where the requirements for tactical mitigations are low, medium, and high. Different states may have other rules and restrictions for VLOS operations (e.g. altitudes, horizontal distances, times for relaying critical flight information, UAS operator/observer training, etc.). In some situations, the competent authority may decide that VLOS does not provide sufficient mitigation for the airspace risk, and may require compliance with additional rules and/or requirements. It is the UAS operators’ responsibility to comply with these rules and requirements. The UAS operator should produce a documented VLOS de-confliction scheme, explaining the methods that will be applied for detection and the criteria used to avoid incoming traffic. If the remote pilot relies on detection by observers, the use of communication phraseology, procedures, and protocols should be described. Since the VLOS operation may be sufficiently complex, a requirement to document and approve the VLOS strategy is necessary before approval by the competent authority. The use of VLOS as a mitigation does not exempt the UAS operator from performing the full SORA risk analysis. **D.5.3 TMPR using BVLOS** Since VLOS has operational limitations, there was a concerted effort to find an alternate means of compliance with the human ‘see and avoid’ requirements. This alternate means of mitigation is loosely described as ‘detect and avoid (DAA)’. DAA can be achieved in several ways, e.g. through ground-based DAA systems, air-based DAA systems, or some combination of the two. DAA may incorporate the use of various sensors, architectures, and even involve many different systems, a human in the loop, on the loop, or no human involvement at all. TMPR provides tactical mitigations to assist the pilot in detecting and avoiding traffic under BVLOS conditions. The TMPR is the amount of tactical mitigation required to further mitigate the risks that could not be mitigated through strategic mitigation (the residual risk). The amount of residual risk is dependent on the ARC. Hence, the higher the ARC, the greater the residual risk, and the greater the TMPR. Since the TMPR is the total performance required by all tactical mitigation means, tactical mitigations may be combined. When combining multiple tactical mitigations, it is important to recognise that the mitigation means may interact with each other, depending on the level of interdependency. This may negatively affect the effectiveness of the overall mitigation. Care should be exercised not to underestimate the negative effects of interactions between mitigation systems. Regardless of whether mitigations or systems are dependent or independent, when they act on the same event, unintended consequences may occur. **D.5.3.1 TMPR assignment risk ratio** The SORA TMPR is based on the findings of several studies. These studies provide performance guidance using risk ratios. Table shows the SORA TMPR risk ratio requirements derived from those studies. <table cellpadding="7" cellspacing="0"> <col/> <col/> <col/> <tr> <td><p align="left"> Air-Risk Class </p> </td> <td><p align="left"> TMPR</p> </td> <td><p align="left"> TMPR system risk ratio objectives</p> </td> </tr> <tr> <td bgcolor="#ff0000"><p align="left"> <b>ARC-d</b></p> </td> <td bgcolor="#ff0000"><p align="left"> <b>high performance</b></p> </td> <td bgcolor="#ff0000"><p align="left"> <b>system risk ratio ≤ 0.1 </b> </p> </td> </tr> <tr> <td bgcolor="#fca904"><p align="left"> ARC-c</p> </td> <td bgcolor="#fca904"><p align="left"> medium performance</p> </td> <td bgcolor="#fca904"><p align="left"> system risk ratio ≤ 0.33</p> </td> </tr> <tr> <td bgcolor="#ffff00"><p align="left"> ARC-b</p> </td> <td bgcolor="#ffff00"><p align="left"> low performance</p> </td> <td bgcolor="#ffff00"><p align="left"> system risk ratio ≤ 0.66</p> </td> </tr> <tr> <td bgcolor="#00b050"><p align="left"> ARC-a</p> </td> <td bgcolor="#00b050"><p align="left"> No performance requirement</p> </td> <td bgcolor="#00b050"><p align="left"> No system risk ratio guidance; although the UAS operator/applicant may still need to show some form of mitigation as deemed necessary by the competent authority</p> </td> </tr> </table> ***Table D.1 — TMPR risk ration requirements table*** Table provides TMPR qualitative criteria as a qualitative means of compliance to help UAS operators translate the risk ratio quantitative values found in Table D.1 into system qualitative functional requirements. Table D.3 provides guidance for the TMPR integrity and assurance objectives for compliance with the objectives of Table C.1. For the purpose of this assessment, the objectives of Table D.1 take precedence over the guidance provided in Tables D.2 and D.3. **D.5.3.2 TMPR qualitative criterion table** Table D.2, below, shows more qualitative criteria for the different functions and levels of the TMPR. The qualitative criteria are divided into five sub-functions of DAA, namely: detect, decide, command, execute, and the feedback loop. Where reference is made to the detection of a percentage of all aircraft, this should be read as a detection rate of the overall mix of aircraft anticipated to be encountered in the detection volume, and not limited to the detection of just the subset of aircraft in the mix.      ***Table D.2 — TMPR qualitative criteria table*** **D.5.3.3 Effects of aircraft equipment on tactical system performance** The performance of a tactical mitigation is affected by the equipment of both the UAS and threat aircraft, on an encounter-by-encounter basis. A tactical mitigation mitigates the encounter risk by using a set of sub-functions of the DAA routine, namely see/detect, decide, command, execute, and feedback loop. Equipment that aids these sub-functions increases the overall performance of the tactical mitigation system. The following example illustrates how the equipment of both the UAS and threat aircraft affects the overall tactical performance. Given a threat aircraft equipped with a transponder, it is easier for other aircraft to detect and track the threat aircraft. In this case, the UAS can be equipped with a system that is able to detect and track transponders. However, a UAS that mitigates the risk by locating the threat aircraft by detecting their transponder (e.g. through ACAS-II V. 7.1) cannot use the same approach to mitigate the risks posed by an aircraft without a transponder. Tactical mitigation equipment is not homogeneous within the airspace. Different classes of airspace have different mixes of equipment. General aviation aircraft tend to be less well-equipped than commercial aircraft. There will be differences in the mix of general aviation/commercial aircraft from one location/airspace to another. Based on the aircraft equipment, a specific tactical system (e.g. FLARM, ACAS, etc.) could mitigate the risk of a collision in some classes of airspace and not in others. Therefore, the UAS operator needs to understand the effectiveness of their tactical mitigation systems within the context of the airspace in which they intend to operate, and select systems used for tactical mitigation accordingly. A TCAS II 7.1/ACAS-II equipped UAS will not mitigate all the encounter risks in an area where sailplanes equipped with FLARM are known to operate. **D.5.4. TMPR robustness (integrity and assurance) assignment** Table D.3, below, lists the recommended requirements to comply with the TMPR integrity and assurance assignment.  ***Table D.3 — TMPR integrity and assurance objectives*** **D.6 Maintenance and continued airworthiness** The DAA maintenance and continued airworthiness requirements are addressed in the SAIL requirements; please refer to Annex E. --- [[115]](#_ftnref116) For the purposes of this dissection, systems like ATC separation services would be considered to be machine assisted.