Ground Risk Assessment for Unmanned Aircraft Focusing on Multiple Risk Sources in Urban Environments

Abstract

This paper investigates the risk quantification for Unmanned Aircraft (UA) in urban environments, focusing on the safety of ground people. An assessment methodology is proposed to quantify the flying risk, which indicates the ground fatalities resulted from different potential risk sources. With the knowledge of UA’s specifications and ground environments, the flying risk of the target UA flying in the target area could be evaluated from the combination of results from independent assessment procedures focusing on multiple potential risk sources with specific safety metrics. A study case to assess the flying risk of the Talon and the DJI Inspire 2 flying in one piece of the region in Chengdu is presented. From the assessment result, the airspace management strategies for both Talon and DJI Inspires 2 could be easily developed to guarantee the safety of ground people, therefore, this risk quantification method could be a general tool to support decision-making in safety work.

1. Introduction

The UA is widely used especially in aerial photography [1], surveillance, and information gathering [2] because of UA’s characteristics of feasibility and practicability [3]. Moreover, with the proposal of the smart city equipped with UA [4,5], the use of UA in urban environments will continue to increase for the foreseeable future [6], especially in delivery applications.

With the ever-growing number of UA operations conducted worldwide, carrying with it an increase in the number of safety-related incidents and occurrences [7], the requirements of the safety field are on call [8]. In the work on safety, ground areas are in high priority because ground areas are in complicated environments, especially in most urban areas, which are occupied by dense distributions of population and shelter buildings. With a potential UA failure in the air, the ground people will be exposed to hazards with different risk sources. To protect the safety of ground people, it is necessary and mandatory to adopt robust regulations [9,10,11,12] to mitigate risk [13,14]. Therefore, an accurate and efficient assessment [15,16,17] of the ground risk is highly required to develop airspace management strategies supporting risk mitigation. This paper proposes an effective and general tool responding to the requirements. Works in this field are presented in the related work.

In this paper, an assessment methodology is proposed to quantify the risk of UA’s flying in a target area to ground people. The schematic is presented in Figure 1. This methodology requires prior knowledge of UA specifications and ground environments. Three sub-layers indicating ground risk from three different risk sources are generated by independent assessment procedures based on the causal chain model. The safety level map is defined by combining three sub-layers and shows the risk distribution for specific UA. A study case to assess the risk of two target UA flying in one piece of the target area is presented.

The main contribution of our work is that multiple hazardous events causing fatalities resulting from different potential risk sources of UA are involved with independent assessment procedures. In similar works [18,19,20], the assessment work is studied with the fatalities from the UA’s ballistic descent causing a direct collision between UA and ground people. Although the reason and process for this hazardous event are complicated, ballistic descents are only defined as one kind of risk source in this paper’s point of view. In our work, the obstacle collision and the secondary damage are also defined as risk sources. They are involved in risk assessment work with independent assessment procedures proposed in our paper because the fatalities also could be caused by these risk sources. Some hazard areas corresponding to these risk sources may be assessed as safety areas and ignored in other methods. However, they could be identified in ours. Thus, the assessment result of our method is comprehensive with more risk knowledge.

This paper is organized as follows. In Section 2, the related work is reported. In Section 3, the assessment methodology is presented. The assessment procedure is illustrated with the evaluation tool and the generation of safety level maps. In Section 4, the study case is reported. The required prior knowledge of UA specifications and ground environments is provided. The assessment results for two UA flying in one target area are also presented. In Section 5, the conclusions are drawn.

2. Related Work

Safety work is widely studied by relevant agencies in each country [21,22]. These agencies are contributing to building a wide but safe application of Visual Line-Of-Sight (VLOS) flight, Extended Visual Line-Of-Sight flight, and Beyond Visual Line-Of-Sight (BVLOS) flight. The FAA evaluates UA security to craft new rules in airspace with the Integration Pilot Program (IPP) [23]. The EASA has proposed an amendment to regulate the operations of drones [24,25]. The proposal is inspired by the methodology [26,27,28] developed by the Joint Authorities for rulemaking on Unmanned Systems (JARUS).

JARUS is a group expert on UA safety work and is recognized widely. It proposed an assessment method called Specific Operations Risk Assessment (SORA) [29], which is a step-by-step process to break down the complicated task of conducting a risk assessment and a basement for the risk assessment work of most studies. This method creates, evaluates, and conducts an Unmanned Aircraft System operation [30]. It focuses on both the ground risk class and the air risk class. They form the basis to determine the specific assurance and integrity level, which is used to support establishing a sufficient level of safety. Over 60 countries are part of JARUS and most of them, such as EASA, adopt this process for assessing more complex operations [31].

However, some generalization is required for this ten-step method [32]. To simplify these procedures into an easier-to-grasp approach, a high-fidelity risk model is proposed for assessment work [19]. With adequate resolution and details, this method is able to reliably predict the risk in quantitative for a given flight scenario. The work compares the SORA to the proposed method and shows that there is reasonable agreement between the two different methods. This method is adopted as a basement framework to quantify risk in many studies and improved as a casual chain model to be a base tool in our work.

The studies based on this model are reported as follows. In paper [33], the ground risk assessment is studied to identify the risk fatalities quantitatively with a power line inspection task in Europe. A study on the uncontrolled descent of a UA is presented to evaluate the potential fatalities in quantification, and the risk for a long-distance flight is assessed [33]. With a long-range inspection mission, the risk evaluation is presented in the case with and without the potential risk mitigation procedure [34]. The assessment works are also studied with a similar method in other specific scenarios [35,36,37]. In paper [18], the high-fidelity approach is used to quantify the ground risk and generate a risk map. The 6DOF dynamic model of UA is also involved to evaluate risk [38] based on the work of another author [39]. A study on risk assessment for remotely piloted aircraft is presented focusing on the buffer area [40].

Several works are studied to support the assessment work with this high-fidelity risk model. Dalamagkidis presents a series of safety metrics in the paper [41,42]. The author collects and studies fatality rates of manned aircraft. That knowledge contributes greatly to the risk assessment of UA and has been widely used for several years, especially in quantitative methods. Additionally, a set of high-level safety criteria is developed, including safety metrics, hazard metrics, and risk metrics in the paper [10]. In paper [43], the author presents a study on the UA’s mass to classify harmless drones and assign safety categories. A descent model to simulate the UA’s falling trajectory is studied in the paper [44]. An improved crash model is proposed to estimate the exposed area of ground people in the paper [45] and a risk-aware path-planning strategy [46] supported by their risk assessment work is presented in the paper [47]. Another risk-aware path-planning strategy [48] for medical deliveries is also presented with safety assessment work [49].

The above works are mostly related to popular quantitative assessment methods. Another quantitative method, the Bayesian method, is also used in assessments. This method focuses on the detailed process of failure. It involves the latent and active factors of the whole system in the assessment work based on the Bayesian theory [50,51,52,53]. In [50], the Bayesian method is presented to be applied to the regulatory compliance process. In [15], a real-time assessment framework is presented to evaluate the risk metrics by Bayesian Belief Networks. Additionally, qualitative methods [54] are also used in this field. These methods mostly focus on conceptual analysis and subsequent decision-making activities. In paper [54], an improved BBTM (Barrier Bow Tie Model) is presented to provide an over-arching framework. These works all contribute a lot to this field. More works in the safety field could be reviewed in this paper [55].

Compared to single hazard events in quantitative methods, multiple hazard events are involved in the assessment method proposed in this paper. Thus, more risk sources are defined in our method. More hazard areas, such as areas with obstacle elements and special elements, could be identified by our method. The comparison procedures are presented with several state-of-the-art methods in

Table 1. Comparison procedures.

Method	Hazard Event	Risk Source			Hazard Area
		Ballistic Descent	Obstacle Collision	Secondary Damage	Area with Dense Population	Area with Sparse Shelter	Area with Obstacle Elements	Area with Special Elements
In [20]	Single	✓	✗	✗	✓	✗	✗	✗
In [45]	Single	✓	✗	✗	✓	✓	✗	✗
In [18]	Single	✓	✗	✗	✓	✓	✗	✗
In [34]	Single	✓	✗	✗	✓	✓	✗	✗
Our method	Multiple	✓	✓	✓	✓	✓	✓	✓

.

3. Methodology

When UA fly in urban environments, ground people’s safety is highly prioritized in the safety work. In this paper, a methodology is proposed to quantify the flying risk to ground people. Three different risk sources resulting in ground fatalities from UA are focused on by our method. Each risk source corresponds to one kind of potential hazard event, which is separately assessed by an independent procedure with prior knowledge of UA specifications and ground environments. The risk distribution for the target UA flying in the target area could be quantified from the safety level map generated from the combination of independent assessment results for three potential hazard events.

3.1. Casual Chain Model

The casual chain model improved from the high-fidelity risk model is an evaluation tool to support the analysis in the independent assessment procedures. The hazard event causing ground fatalities could be simulated in quantification by this tool. One potential hazardous event could be decomposed into a succession of four phases [34]: the event phase, descent phase, collision phase, and fatality phase. The casual chain model could be formulated as

$$R={\displaystyle {\iint }_{\left(x,y\right)\subset A}{P}_{event}\cdot P_{descent}\cdot P_{collision}\cdot P_{fatality}\hspace{1em}dxdy}$$

(1)

where $R$ is the risk value to quantify the potential fatality rate. The lower the risk value, the safer the ground people under the flight. $A$ is the piece of the potential ground impact area, $x$ and $y$ are the geographical coordinates of the ground impact point, and $P$ is the conditional probability in each phase. The conditional probability is modeled as follows.

3.1.1. Event Phase

An emergency causes the flying UA to start the descent phase without motion power in the air. This event could be due to a critical failure onboard the UA, an air collision, an obstacle collision, or other reasons. It is hard to build an accurate mathematical model to describe this random process caused by many potential reasons [34,41]. When the risk source resulting in a hazard event is determined, a specific model will be built to describe the fault rate $P_{event}$.

3.1.2. Descent Phase

In the descent phase, UA is in a state of descent motion until it impacts the ground. To solve the probability density function [44] (PDF) of the ground impact area, a descent model is proposed to model the falling trajectory. The motion of the UA is subjected to the constraints of aerodynamic and wind motion. Thus, the model contains two sub-models separated for aerodynamics and wind.

In the aerodynamics sub-model, the UA’s motion is determined by the gravity force, drag force, and lift force. The UA’s motion is modeled as

$$m{\ddot{\mathit{x}}}_a=mg-c_z{\left|{\dot{x}}_{\mathit{a}}\right|}^2\mathbf{\tau }+c_l{\left|{\dot{x}}_a\right|}^{2}n$$

(2)

where $m$ is the UA’s mass, ${\mathit{x}}_{\mathit{a}}$ is UA’s displacement subjected to the aerodynamics, $c_z$ is the drag coefficient, and $c_l$ is the lift coefficient [44]. $\mathbf{\tau }$ is the unit vector in the velocity direction, and $\mathbf{n}$ is the unit normal vector in the velocity direction.

In the wind sub-model, the UA’s motion is only determined by wind force [44]. The UA’s motion could be modeled as

$$x_w={\displaystyle {\int }_0^{t_d}{v}_w}dt$$

(3)

where ${\mathit{x}}_{\mathit{w}}$ is the UA’s displacement subjected to the wind force, $v_w$ is the velocity of wind, and $t_d$ is the descent time.

When the UA is falling, motions subjected to aerodynamics and wind both exist. The actual motion state is the combination of them. Based on this assumption, it could be modeled as

$$x_d=x_a+x_w$$

(4)

where $x_d$ is the actual displacement of the UA in the descent phase. The descent probability $P_{descent}$ could be modeled with a two-dimensional PDF [44] of $x_d$.

3.1.3. Collision Phase

In the collision phase, the UA collides with at least one ground person. This process could be modeled with a mapping method as

$$P_{collision}=\frac{N{A}_{exp}}{A_{grid}}$$

(5)

where $A_{grid}$ is a small piece of the ground region, $N$ is the total quantity of population in that region, and $A_{exp}$ is a piece of exposed area in a capsule shape where one person is exposed to the crash. This capsule region also known as the lethal area [56] is modeled as

$$A_{exp}=2\left(r_p+r_{ua}\right)\frac{h_p}{tan\theta }+\pi {\left(r_p+r_{ua}\right)}^2$$

(6)

where $r_p$ is the average radius of one adult, $r_p$ is the average height of one adult, $r_{ua}$ is the radius of the UA, and $\theta$ is the crash angle which is determined by the falling trajectory.

3.1.4. Fatality Phase

The fatality phase is defined as the process in that fatalities are caused by the UA’s collision. The kinetic energy from the UA causes damage to the human body, but ground shelters protect them [18]. Focusing on kinetic energy and ground shelter, the model [41] is adopted in this paper and could be formulated as

$$P_{fatality}=\frac{1}{1+\sqrt{\frac{\alpha }{\beta }}{\left(\frac{\beta }{E_c}\right)}^{\frac{1}{4S_f}}}$$

(7)

where $S_f$ is the shelter factor [57] in the range of 0 to 1. $\alpha$ and $\beta$ are two constants. $\alpha$ is a threshold value of impact energy that leads the fatality probability to be 50% when $S_f=0.5$ and $\beta$ is another threshold value of impact energy that could lead to a cause of fatality when $S_f$ approaches zero. $E_c$ is the kinetic energy when UA impacts ground people.

3.2. Safety Level Map

The safety level map is a two-dimensional rasterization map that quantifies the flying risk in each grid. Each grid in the map corresponds to one piece of the geographical square area. The safety level is marked within each grid of the map to quantify the flying risk of a UA flying through this square area.

It is a multilayer framework for the safety level map, which is generated by combining 3 sub-layers. The 3 sub-layers all are rasterization maps with the same characteristics as the safety level map. The 3 sub-layers are independently modeled and focus on 3 potential risk sources resulting in different hazard events, which are illustrated in Figure 2.

Thus, the sub-layers are defined as follows:

• Risk layer: The risk source is the UA’s ballistic descent. The hazard event is that UA falls and impacts ground people directly.
• Obstacle layer: The risk source is the obstacle collision. The hazard event is that UA collides with obstacles, followed by a fall and impact with ground people.
• Special-area layer: The risk source is secondary damage. The hazard event is that the ground collision between the UA and special ground elements causes secondary damage to ground people.

The procedure of generating a safety level map by layer combination is presented in Figure 3. On the sub-layers, each grid corresponds to one piece of a geographic area. The signal marked in the grid is the safety level index. The lower the number in the footnote of SL (Safety Level), the safer for UA flying in the square area. The rule of layer combination is that the grid with a larger footnote number could cover the grid with a smaller footnote number. This rule indicates that the safety level in one grid area is defined as the highest level of 3 sub-layers. The 3 sub-layers are generated in advance with independent procedures because the risk sources are independent and hazardous events from them may result in fatalities. The independent procedures for each layer are illustrated in this section.

3.2.1. Risk Layer

The risk layer is defined with safety levels rated by risk value. In the analysis of the risk layer, the hazard event is rated as the UA falls and impacts ground people directly. The reason in the event phase is assumed as onboard failures from the UA. The average failure rate [34] is assigned as the probability of the event phase, which is $P_{event}={10}^{-3}$. Thus, the casual chain model to calculate the fatalities caused by this risk source is built. The risk value for each grid could be evaluated by the model. The safety level in the grid is rated by the risk value with the safety metrics inspired by Dalamagkidis [41,42]. The lower the risk value, the lower the safety level, and the safer the ground people under the flight. The metrics are illustrated in

Table 2. Safety level classification.

Risk Value	Safety Level
0–10−6	$s{l}_0$/Safe
10−6–10−5	$s{l}_1$/Low risk
10−5–10−4	$s{l}_2$/Mid risk
10−4–1	$s{l}_3$/High risk

.

3.2.2. Obstacle Layer

The obstacle layer is defined by obstacle height. The risk source is obstacles impacted by the UA. On the obstacle layer, the safety level marked in each grid is determined by the heights of ground elements in the geographical square area.

The obstacle is defined as ground elements at a tall height. These elements are too high to obstruct UA’s normal flight. The hazard event is that the UA collides with obstacles, then falls and impacts ground people. Thus, the reason for the event phase could be assigned as the UA colliding with obstacles in the air. In the descent phase, the UA falls vertically without motion power. Following this, the ground people are impacted by the UA.

The height of ground elements in one geographic square area is assumed as a constant value. The UA’s flying altitude is subjected to the normal distribution. The probability of the UA colliding with ground elements could be modeled, which is formulated as

$$P_{UCO}={\displaystyle {\int }_0^H\frac{1}{\sqrt{2\pi }\sigma }}exp\left(-\frac{{\left(h-\mu \right)}^2}{2{\sigma }^2}\right)dh$$

(8)

where $P_{UCO}$ is the collision probability, $H$ is the height of the ground element in that geographic square, $\mu$ is the mean of the distribution of UA’s flying altitude, and $\sigma$ is the standard deviation of the distribution of UA’s altitude.

Assign $P_{UCO}$ to describe the fault rate in the event phase, the $P_{event}$ in one grid is determined by the ground element’s height. Thus, the casual chain model could be built to calculate the risk value corresponding to the fatalities caused by obstacle collisions. The higher the obstacle elements, the higher the probability of ground elements being collided with by the UA and the higher the probability of fatalities. The safety level is rated by risk value. Thus, in the obstacle layer, the safety level could be rated by the height of ground elements in the geographic square area. The safety metrics are illustrated in

Table 3. Obstacle height classification.

Obstacle Height	Risk Value	Safety Level
0–$H_0$	0–10−6	$s{l}_0$/Safe
$H_0$–$H_1$	10−6–10−5	$s{l}_1$/Low risk
$H_1$–$H_2$	10−5–10−4	$s{l}_2$/Mid risk
$H_2$–∞	10−4–1	$s{l}_3$/High risk

.

$H_i$ is the obstacle height threshold of ground elements in the regions that could be assessed as the safety level $s{l}_i$. The height threshold could be evaluated from the casual chain model. It is formulated as

$$H={\Phi }^{-1}\left(\Phi \left(0\right)+\frac{R}{{\displaystyle {\iint }_{\left(x,y\right)\subset A}{P}_{descent}\cdot P_{collision}\cdot P_{fatality}dxdy}}\right)$$

(9)

where $H$ is the height threshold, $R$ is the risk value, $\Phi$ is the antiderivative of the probability density function, and ${\Phi }^{-1}$ is the inverse function of $\Phi$, which could be formulated as

$$\Phi \left(h\right)={\displaystyle \int \frac{1}{\sqrt{2\pi }\sigma }}exp\left(-\frac{{\left(h-\mu \right)}^2}{2{\sigma }^2}\right)dh$$

(10)

where the parameters are the same as Equation (8).

The obstacle layer is dynamic. The height thresholds H are not constant values. Even in the same grid, they are varied with the UA’s specifications, especially the UA’s flying height.

In similar works, a constant height threshold is applied in different flight scenarios to define obstacle elements. However, it is reasonable that the height threshold of obstacle elements should be higher, as more airspace is free when lighter UA fly higher. Compared to that method, the detailed flying scenarios are focused on by our method using the causal chain model. The appropriate height threshold could be calculated. The feasibility of each piece of airspace will be drawn appropriately. It will perform better in the support of safety work such as the safety airspace division.

3.2.3. Special-Area Layer

The special-area layer is defined with secondary damage. The risk source is secondary damage from the ground collision between the UA and special ground elements. On the special-area layer, the exposed areas of the special ground elements with potential secondary-damage risk are marked with specific safety levels.

In this hazard event, the UA impacts special ground elements, rather than impacting ground people directly. The subsequent secondary damage resulting from the collision causes fatalities. An example event is that the UA falls and impacts the gas station. The people in the gas station are in poor quantity and may not be impacted directly. However, the hazard gas storage may be impacted. This collision may cause a massive and persistent explosion, which involves exposed ground people around. Thus, the fatalities are also caused by the collision.

The exposed area of one ground element is defined as a circle ground area with the airspace where a potential ballistic descent could result in a ground collision with that element. It is illustrated in Figure 4. The center of the circular area is located by the ground element. The radius of the circle area is the glide range of the descent. The range could be evaluated from the falling trajectory modeled in the descent phase.

The safety level of exposed areas is determined by the ground elements in them. Normal elements are defined as elements without potential secondary damage. The special ground elements are defined as elements with potential secondary damage. They are mostly characteristics of fragile physical structure, hazard storages, or dense distribution of power systems. Inspired by Interim Regulations on Flight Administration of Unmanned Aircraft [58], a list of special ground elements exposed to potential risk is proposed. The safety levels are rated by the severity of secondary damage from the potential collision. The safety metrics are illustrated in

Table 4. Ground elements classification.

Ground Elements	Safety Level
Other normal elements	$s{l}_0$/Safe
None	$s{l}_1$/Low risk
Manned airport, large gas stations, medium stations, medium docks, medium ports, biochemical storage	$s{l}_2$/Mid risk
Power stations, substations, military areas, large stations, large docks, larger ports, flammable and explosive storage	$s{l}_3$/High risk

.

The special-area layer is also dynamic. However, it is determined by the properties of ground elements and the glide range of the UA. When the target area is defined, the knowledge of special ground elements could be reused in assessment work.

4. Results

The proposed methodology is a parameterized method. The models are presented to be used in numerical calculation. The required prior knowledge only focuses on UA specifications and ground environments. Thus, it could be repeated easily and used widely in different flying scenarios.

In this section, a study case is presented to illustrate the proposed method. Two kinds of target UA and one target area were selected. The target UA were two common civilian aircraft. The target area was one piece of the region in the Chengdu HI-TECH Industrial Development Zone. The prior knowledge and assessment results are presented as follows. The study environment for simulation experiments in this case was a personal computer with OS Windows 10, an Intel Core i5-9400F, and 16GB of RAM.

4.1. UA Specifications

The fixed-wing UA and the quadrotor UA are two common types of drones used widely, though their physical structures are different. A fixed-wing UA called Talon and a rotary-wing UA called DJI Inspire 2 were both adopted as target UA in this paper. These two drones are widely used in the studies of safety assessment work [18,33,44] and the physical parameters could be acquired easily. The specifications [18,59] including both the physical parameters and motion states are reported in

Table 5. Specifications of aircraft.

Specifications	Talon	DJI Inspire 2
Type	Fixed wing	Quadrotor
Mass (UA with load) (kg)	3.75	4.25
Radius (m)	0.88	0.4
Initial horizontal speed (m/s)	N(12, 2)	N(6, 2)
Initial vertical speed (m/s)	N(0, 1)	N(0, 1)
Drag coefficient	N(0.052, 0.015)	N(0.0182, 0.005)
Lift coefficient	N(0.282, 0.080)	0
Flight altitude (m)	N(120, 10)	N(120, 10)

. The parameter uncertainties are involved. The symbol $N\left(\mu ,\sigma \right)$ indicates a normal distribution with a mean of μ and a standard deviation of σ.

4.2. Ground Environments

The selected target area was one piece of the region in the Chengdu HI-TECH Industrial Development Zone. The diagonal geographic coordinates of the rectangular area were (104.0295°, 30.6244°) and (104.1174°, 30.4871°). This region is located in the center of Chengdu and is characterized by the dense distribution of population and buildings.

The knowledge of ground environments focused on the wind, population, and shelter. This knowledge determined several significant parameters of the models in the proposed method. Thus, the distributions of them could be modeled in advance with that knowledge, and the discretization resolution is adopted as 100 m × 100 m.

The wind distribution of Chengdu is modeled with historical data, which was collected from rp5 [60]. The distributions of speed and direction are illustrated in Figure 5.

The population distribution is modeled with population density data. Cooperating with China Unicom, the data are collected with telecom technology, which is to locate the person’s position by mobile [61,62]. The population distribution is illustrated in Figure 6. The white line is the border of the target area where the population data has been collected. Other areas are invalid without data collection.

The shelter distribution was modeled by the geographic knowledge collected from the OpenStreetMap [63]. The ratio of shelter area is calculated as the shelter factor in each grid. The shelter distribution is modeled and illustrated in Figure 7.

4.3. Sub-Layers

The target areas with collected population data are involved in risk assessment work. The invalid areas will not be involved. The above models and distributions were discretized in the resolution $100m\times 100m$. Three sub-layers were modeled as rasterization maps in the same resolution. They were illustrated as follows.

4.3.1. Risk Layer

In the analysis of the risk layer, the hazard event was that the UA impacts ground people directly. It was caused by failures onboard the UA. In the descent phase, the UA started a ballistic descent without motion power. The initial speed of the ballistic descent was assumed as the same as the flying speed of UA before it was in failure. Thus, the risk value could be calculated from the casual chain model. Following the safety metrics of the risk layer, the safety level in the risk layer could be rated. The risk layers are illustrated in Figure 8.

The left one is the risk layer for Talon and the right one is for DJI Inspire 2. It is reasonable that the patterns in the two layers are in a similar shape. Because of the hazard event corresponding to UA’s ballistic descent, the hazard areas were always regions with dense populations and sparse shelters, such as the center of the target area on the map. The safety areas were always regions with sparse populations and dense shelters, such as the bottom right corner of the target area. Compared with the risk layer for the Talon, the grids in the risk layer for DJI Inspire 2 are generally assessed with a lower safety level index. Because the DJI Inspire 2 flies at a lower speed and has a smaller radius, it results in lower kinetic energy and a smaller exposed area.

4.3.2. Obstacle Layer

In the analysis of the obstacle layer, the hazard event is that the UA collides with obstacles, falls, and impacts ground people. In the event phase, the UA collides with obstacles. In the descent phase, the UA falls vertically. The initial speed of descent is assumed to be the same as the vertical flying speed. In the collision phase, it is reasonable that the max value of population density was used to calculate the redundant exposed area. This was because most tall elements were residential buildings and office buildings, where people are usually crowded around. Thus, the models could be built to evaluate the height thresholds of ground elements. The knowledge is illustrated in

Table 6. Obstacle height classification for Talon and DJI Inspire 2.

Obstacle Height (m)		Risk Value	Safety Level
Talon	DJI Inspire 2
0–74.82	0–77.09	0–10−6	$s{l}_0$/Safe
74.82–79.97	77.09–82.51	10−6–10−5	$s{l}_1$/Low risk
79.97–85.80	82.51–88.75	10−5–10−4	$s{l}_2$/Mid risk
85.80–∞	88.75–∞	10−4–1	$s{l}_3$/High risk

.

The height of each ground element was compared with the height thresholds in Table 5 and the corresponding safety level was rated. Thus, the obstacle layers could be modeled and illustrated in Figure 9. The left one is for Talon, and the right one is for DJI Inspire 2.

Because the DJI Inspire 2 could tolerate a higher probability of obstacle collision, it is reasonable that the height thresholds for DJI Inspire 2 are lower than those for Talon. Thus, one building may be rated as corresponding to different safety levels for these two UA. In the target area, $7.96\times {10}^5{m}^2$ areas safe to DJI Inspire 2 are rated at risk for Talon. Thus, the airspace of these areas could be fully free to DJI Inspire 2 separately, from the risk in the obstacle layer view of the point. Additionally, in similar methods, these hazard areas with obstacle buildings may be assessed as safety areas and ignored. They were identified in the obstacle layer because the risk source of obstacle collisions was involved in our assessment procedures. Thus, the obstacle layer supplements safety knowledge corresponding to obstacle elements.

4.3.3. Special-Area Layer

In the special-area layer, the exposed areas of special ground elements were determined by the geographic coordinates of these elements and the glide ranges of UA. The geographic coordinates could be located with OpenStreetMap. The max glide ranges were calculated as 836.53 m for the Talon, and 43.44 m for the DJI Inspire 2. The safety levels of these exposed areas were rated by their ground elements. The special-area layer was modeled and illustrated in Figure 10. In these maps, more areas were at risk for the Talon compared to the DJI Inspire 2. Thus, there was more limitations for Talon’s flying in this area from the risk in the special-area layer point of view. Additionally, in similar methods, these hazard areas with special ground elements, such as power stations, may be assessed as safety areas and ignored. They were identified in the special-area layer because the risk source of secondary damage was involved in our assessment procedures. Thus, the special-area layer is a supplement of safety knowledge corresponding to special ground elements.

4.4. Safety Level Map

The safety level maps were generated by combining the three sub-layers. They are illustrated in Figure 11. The left one is for Talon and the right one is for DJI Inspire 2. The proportion of area in different safety levels could also be calculated, as illustrated in

Table 7. The proportion of areas in different safety levels.

UA	$s{l}_0$/Safe	$s{l}_1$/Low Risk	$s{l}_2$/Mid Risk	$s{l}_3$/High Risk
Talon	0.39%	6.06%	27.89%	65.66%
DJI Inspire 2	10.32%	33.49%	52.79%	3.39%

. The specific airspace management strategies and the analysis of the flying feasibility for these two UA could be developed from that knowledge.

For Talon, the border regions of the target area were mid-risk, and only one corner region was low risk. Other regions of the center were mostly high-risk. Thus, it is generally hazardous for the Talon to fly in this target area. To guarantee the safety of ground people, the Talon may be forbidden in this area, unless it takes risk mitigation procedures such as equipping with automatic ballistic parachutes (more details in Appendix A).

For the DJI Inspire 2, half of the regions are low-risk or safe. Most of them are located in the bottom right corner of the target area. Thus, the corner area may be free for the DJI Inspire 2s. Two pieces of large areas in mid-risk are located in the center. A few high-risk regions with special ground elements are sparsely distributed in them. Thus, if the DJI Inspire 2 is allowed to fly, strong limitations should be required. The flying time should be limited. The path should be planned in advance to avoid the UA flights passing through the high-risk area [45,64]. The details of the flying task should be reported and approved by relevant agencies.

Comparing the safety levels in different regions for the same drones, it is clear that the regions with dense populations, spare shelter, high ground elements, and potential-risk ground elements are rated as hazardous areas. Thus, to guarantee the safety of ground people, it is suggested that the UA is planned to avoid flying through them.

Comparing the safety levels in the same regions for different drones, the safety level for the Talon is lower than the DJI Inspire 2. It is safer for the DJI Inspire 2 to fly in this target area, compared to the Talon. Although it is complicated to know the significance of each factor that contributed to the DJI Inspire 2′s safety, it is clear that the radius and speed are important. The smaller radius corresponds to a smaller exposed area. The lower speed of the DJI Inspire 2 corresponds to lower impact kinetic energy, but the mass seems not to be significant for this. Further research on these could also support the risk mitigation procedures in terms of UA’s specifications and will be studied in the future.

4.5. Comparison

Two recent methods with better performance are used in the comparison work. They are comparison method one from [34] and two from [18]. They perform better than other methods because they are improved by involving ground protection from shelters and presenting a more precise evaluation of ground impact positions. Two comparison methods are used to assess the ground risk in the same flying scenario as our study case.

However, their assessment results are risk value maps marked with only risk value rather than safety levels. Similar to the generation of the risk layer, the safety level maps are generated from the risk value maps corresponding to comparison methods. The safety level classification used in the comparison work is adopted from Table 2 to guarantee the assessment results in the same safety metrics as our results. The safety level maps corresponding to comparison methods are presented in Figure 12.

The safety level maps are in similar shapes to maps generated from our method, but the detailed safety levels are different in some areas. The proportion of areas in different safety levels was calculated and is presented in

Table 8. The proportion of areas in different safety levels.

Method	UA	$s{l}_0$/Safe	$s{l}_1$/Low Risk	$s{l}_2$/Mid Risk	$s{l}_3$/High Risk
Comparison method 1	Talon	0.52%	8.23%	35.96%	55.28%
	DJI Inspire 2	10.33%	33.65%	56.02%	0%
Comparison method 2	Talon	0.63%	8.88%	40.27%	50.23%
	DJI Inspire 2	12.70%	42.97%	44.33%	0%

.

Comparing the proportion of areas in Table 8 to Table 7, more high-risk areas were identified from our method than from comparative methods. A total of 10.38% more high-risk areas for Talon were identified by our methods than by comparative methods. A total of 3.39% more high-risk areas for DJI Inspire 2 were identified by our methods than by comparative methods. It is reasonable that these areas could be identified by our method because most of these areas are exposed to obstacle collisions and secondary damage, which are both assessed as risk sources involved in our assessment method. Thus, these hazard areas could be highly prioritized in the risk mitigation work.

5. Conclusions

The risk quantification for UA in urban environments has been investigated, focusing on the safety of ground people. An assessment methodology was proposed to quantify flying risk from multiple potential risk sources. In the study case, the flying risk for two target aircraft flying in one piece of the target area was evaluated. The safety level maps show that the Talon may be forbidden from flying in the target area, and the DJI Inspire 2 may be allowed to fly with limitations. Our method has improved on the ability to identify hazard areas. The results show that our method identifies 10.38% more high-risk areas for the Talon than comparative methods and 3.39% more high-risk areas for the DJI Inspire 2 than comparative methods. These hazardous areas are highly prioritized in risk mitigation. The whole method is parameterized and could quantify flying risk repeatedly with different target UA and areas. It could be a general tool to support decision-making in safety work, such as low-risk path planning and safety airspace division for UA. The safety of the ground people will be guaranteed with it.

There remains some future work. Other risk sources should be addressed, especially aerial risk. More potential-risk elements should be added to the special-area layer. More study cases will be illustrated. The risk mitigation procedures in safety work should also be studied.