
Article 1 
This Regulation sets out the common European risk classification scheme (ERCS) for the determination of the safety risk of an occurrence.
Article 2 
For the purposes of this Regulation, the following definitions shall apply:

((1)) ‘European risk classification scheme’ or ‘ERCS’ means the methodology applied for the assessment of the risk posed by an occurrence to civil aviation in the form of a safety risk score;
((2)) ‘ERCS matrix’ means a grid made up of the variables described in Article 3(3) which serves for the illustrative representation of the safety risk score;
((3)) ‘safety risk score’ means the result of the risk classification of an occurrence by combining the values of the variables described in Article 3(3);
((4)) ‘high-risk area’ means an area where an aircraft impact would cause numerous injuries, result in a high number of fatalities, or both because of the nature of the activities in that area, such as nuclear or chemical plants;
((5)) ‘populated area’ means an area with clustered or scattered buildings and a permanent human population, such as city, settlement, town, or village;
((6)) ‘life changing injury’ means an injury reducing the person’s quality of life in regard to reduced mobility or reduced cognitive or physical ability in daily life.
Article 3 

1. The ERCS is set out in the Annex.
2. The ERCS shall address the safety risk of an occurrence and not its actual outcome. The assessment of each occurrence shall determine the worst likely accident outcome that the occurrence might have led to, and how close to that accident outcome the occurrence was.
3. The ERCS shall be based on the ERCS matrix composed of the following two variables:
(a) severity: identification of the worst likely accident outcome that would have resulted if the occurrence under assessment had escalated into an accident;
(b) probability: identification of the likelihood of the occurrence under assessment to escalate into the worst likely accident outcome referred to in point (a).
Article 4 
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
It shall apply from 1 January 2021.
This Regulation shall be binding in its entirety and directly applicable in all Member States.Done at Brussels, 6 October 2020.
For the Commission
The President
Ursula VON DER LEYEN
ANNEX
The ERCS shall consist of the following two steps:

 STEP 1: Determination of the values of the two variables: severity and probability.
 STEP 2: Scoring of the safety risk within the ERCS matrix based on the two determined values of variables.
 1.  1.1. 
The identification of the severity of the potential accident outcome shall follow the following two steps:


((a)) a determination of the most likely type of accident that the occurrence under assessment could have escalated to (the so called key risk area);
((b)) a determination of the potential loss of life category based on aircraft size and proximity to populated or high-risk areas.

There are following key risk areas:


a.. airborne collision: a collision between aircraft while both aircraft are airborne; or between aircraft and other airborne objects (excluding birds and wildlife);
b.. aircraft upset: an undesired aircraft state characterised by unintentional divergences from parameters normally experienced during operations, which might ultimately lead to an uncontrolled impact with terrain;
c.. collision on runway: a collision between an aircraft and another object (other aircraft, vehicles, etc.) or person that occurs on a runway of an aerodrome or other predesignated landing area. It does not include collisions with birds or wildlife;
d.. excursion: an occurrence when an aircraft leaves the runway or movement area of an aerodrome or landing surface of any other predesignated landing area, without getting airborne. It includes high-impact vertical landings for rotorcraft or vertical take-off and landing aircraft and balloons or airships;
e.. fire, smoke and pressurisation: an occurrence involving cases of fire, smoke, fumes or pressurisation situations that may become incompatible with human life. This includes occurrences involving fire, smoke or fumes affecting any part of an aircraft, in flight or on the ground, which is not the result of impact or malicious acts;
f.. ground damage: damage to aircraft induced by operation of aircraft on ground on any other ground area than a runway or predesignated landing area, as well as damage during maintenance;
g.. obstacle collision in flight: collision between an airborne aircraft and obstacles rising from the surface of the earth. Obstacles include tall buildings, trees, power cables, telegraph wires and antennae as well as tethered objects;
h.. terrain collision: an occurrence where an airborne aircraft collides with terrain, without indication that the flight crew was unable to control the aircraft. It includes instances when the flight crew is affected by visual illusions or degraded visual environment;
i.. other injuries: an occurrence where fatal or non-fatal injuries have been inflicted, which cannot be attributed to any other key risk area;
j.. security: an act of unlawful interference against civil aviation. It includes all incidents and breaches related to surveillance and protection, access control, screening, implementation of security controls and any other acts intended to cause malicious or wanton destruction of aircraft and property, endangering or resulting in unlawful interference with civil aviation and its facilities. Includes both physical and cyber security events.

The potential loss of life shall be categorised in the following way:


((a)) more than 100 possible fatalities – where the occurrence under assessment involves at least any of the following:

— one large certified aircraft with more than 100 potential passengers on board;
— an equivalent size aircraft for cargo;
— one aircraft of any type in a heavily populated area or in a high-risk area or both;
— any situation involving any type of aircraft where more than 100 fatalities may be possible;
((b)) between 20 to 100 possible fatalities – where the occurrence under assessment involves at least any of the following:

— one medium certified aircraft with 20 to100 potential passengers on board or equivalent size for cargo aircraft;
— any situation where 20 to 100 fatalities may be possible;
((c)) between 2 to 19 possible fatalities where the occurrence under assessment involves at least any of the following:

— one small certified aircraft with up to 19 potential passengers on board;
— an equivalent size for cargo aircraft;
— any situation where 2 to 19 fatalities may be possible;
((d)) 1 possible fatality – where the occurrence under assessment involves at least any of the following:

— one uncertified aircraft, that is aircraft not subject to European Union Aviation Safety Agency certification requirements;
— any situation where a single fatality may be possible;
((e)) 0 possible fatalities – where the occurrence under assessment involves personal injuries only, regardless of the number of minor and serious injuries as long as there are no fatalities.
 1.2. 
The severity of the accident shall result in one of the following severity scores:


— ‘A’ which stands for no likelihood of an accident;
— ‘E’ which stands for an accident involving minor and serious injury (not life changing) or minor aircraft damage;
— ‘I’ which stands for an accident involving a single fatality, life changing injury or substantial damage accident;
— ‘M’ which stands for a major accident with limited amount of fatalities, life changing injuries or destruction of the aircraft;
— ‘S’ which stands for a significant accident with potential for fatalities and injuries;
— ‘X’ which stands for an extreme catastrophic accident with the potential for significant number of fatalities.

The severity score shall be calculated by combining the key risk area and the potential loss of life as laid down in the following table:


KEY RISK AREA CATEGORY SEVERITY SCORE
Airborne collision More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
Aircraft upset More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
Collision on runway More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
0 possible fatalities E
Excursions Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
0 possible fatalities E
Fire, smoke and pressurisation More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
Ground damage Between 2 to 19 possible fatalities M
1 possible fatality I
0 possible fatalities E
Obstacle collision in flight More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
Terrain collision More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
Other injuries Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
0 possible fatalities E
Security More than 100 possible fatalities X
Between 20 to 100 possible fatalities S
Between 2 to 19 possible fatalities M
1 possible fatality I
0 possible fatalities E
 2. 
The probability of the worst likely accident outcome shall be obtained by using the ERCS barrier model defined in Section 2.1.
 2.1. 
The purpose of the ERCS barrier model is to assess the effectiveness (that is the number and the strength) of the barriers in the safety system laid down in the Table in Section 2.1.1 which were remaining between the actual occurrence and the worst likely accident outcome. Ultimately, the ERCS barrier model shall determine how close the occurrence under assessment has been to the potential accident.
 2.1.1. 
The ERCS barrier model consists of 8 barriers, ordered in a logical sequence and weighted as per the following table:


Barrier number Barrier Barrier weight
1 ‘Aircraft, equipment and infrastructure design’, includes maintenance and correction, operation support, the prevention of problems related to technical factors that could lead to an accident. 5
2 ‘Tactical planning’, includes organisational and individual planning prior to the flight or other operational activity that supports the reduction of the causes and contributors to accidents. 2
3 ‘Regulations, procedures, processes’, includes effective, understandable and available regulations, procedures and processes that are complied with (with the exclusion of the use of procedures for recovery barriers). 3
4 ‘Situational awareness and action’, includes human vigilance for operational threats which ensures identification of operational hazards and effective action to prevent an accident. 2
5 ‘Warning systems operation and action’ that could prevent an accident and which are fit for purpose, functioning, operational and are complied with. 3
6 ‘Late recovery from a potential accident situation’ 1
7 ‘Protections’, when an event has occurred, the level of the outcome is mitigated or prevents the escalation of the occurrence by intangible barriers or providence 1
8 ‘Low energy occurrence’ scores the same as ‘Protections’, but for low-energy key risk areas only (ground damage, excursions, injuries).‘Not applicable’ for all other key risk areas. 1
 2.1.2. 
The effectiveness of each barrier shall be classified as follows:


— ‘Stopped’ if the barrier prevented the accident from occurring;
— ‘Remaining Known’: if it is known whether the barrier remained between the occurrence under assessment and the potential accident outcome;
— ‘Remaining Assumed’: if it is assumed that the barrier remained between the occurrence under assessment and the potential accident outcome;
— ‘Failed Known’: if it is known that the barrier has failed;
— ‘Failed Assumed’: if it is assumed that the barrier have failed even if insufficient or no information is available to determine this;
— ‘Not Applicable’: if the barrier is not relevant to the occurrence under assessment.
 2.1.3. 
The barriers shall be assessed in two steps:

Step 1: To identify which of the barriers defined in the table in section 2.1.1. (1-8) stopped the occurrence from escalating into the potential accident outcome (referred to as the ‘stopping barrier’).

Step 2: To identify in accordance with section 2.1.2 the effectiveness of the remaining barriers. The remaining barriers are those barriers listed in the table in section 2.1.1 which are placed between the stopping barrier and the potential accident outcome. The barriers listed in the table in section 2.1.1 which are placed before the stopping barrier shall not be considered to have contributed to the prevention of the accident outcome and consequently those barriers shall not be scored as ‘Stopped’ or ‘Remaining’.
 2.2. 
The probability of the potential accident outcome is the numerical value resulting of the following steps:

Step 1: A sum of all the barrier weights (1 to 5) laid down in the table in section 2.1.1 of all the assessed barriers that were scored either ‘Stopped’, ‘Remaining known’ or ‘Remaining assumed’. The ‘Failed’ and ‘Not Applicable’ barriers shall not be counted for the final score, as those barriers could not have prevented the accident. The resulting barrier weight sum is a numerical value between 0 and 18.

Step 2: The barrier weight sum corresponds to a barrier score between 0 and 9 as per the following table, covering the full range between strong and weak remaining barriers.


Barrier weight sum Corresponding barrier score
0 No barriers left. Worst likely accident outcome realised. 0
1-2 1
3-4 2
5-6 3
7-8 4
9-10 5
11-12 6
13-14 7
15-16 8
17-18 9

The safety risk score is a two-digit value where the first digit corresponds to the alphabetic value resulting from the calculation of the severity of the occurrence (severity score A to X) and the second digit represents the numerical value from the calculation of the corresponding score of the occurrence (0 to 9).

The safety risk score shall be put into the ERCS matrix.

For each given safety risk score there is also a numerical equivalent score for aggregation and analysis purposes which is explained below under ‘Numerical equivalent score’.

The ERCS matrix reflects the safety risk score and the numerical associated figures of an occurrence as follows:



In addition to the safety risk score and to facilitate the determination of the urgency of the recommended action to be taken about the occurrence, the following three colours could be used in the ERCS matrix:


Colour ERCS score Meaning
RED X0, X1, X2, S0, S1, S2, M0, M1, I0 High risk. Occurrences with the highest risk.
YELLOW X3, X4, S3, S4, M2, M3, I1, I2, E0, E1 Elevated risk. Occurrences with intermediate risk
GREEN X5 to X9, S5 to S9, M4 to M9, I3 to I9, E2 to E9. Low risk occurrences

The green area of the matrix contains lower risk values. They provide data for in-depth analysis on safety related occurrences that could, either in isolation or in conjunction with other events, increase the risk values of such occurrences.

Numerical equivalent score

Each ERCS score is assigned a corresponding numerical value of risk magnitude to facilitate the aggregation and numerical analysis of multiple occurrences with an ERCS score:


ERCS Score X9 X8 X7 X6 X5 X4 X3 X2 X1 X0
Corresponding numerical value 0,001 0,01 0,1 1 10 100 1000 10000 100000 1000000
ERCS Score S9 S8 S7 S6 S5 S4 S3 S2 S1 S0
Corresponding numerical value 0,0005 0,005 0,05 0,5 5 50 500 5000 50000 500000
ERCS Score M9 M8 M7 M6 M5 M4 M3 M2 M1 M0
Corresponding numerical value 0,0001 0,001 0,01 0,1 1 10 100 1000 10000 100000
ERCS Score I9 I8 I7 I6 I5 I4 I3 I2 I1 I0
Corresponding numerical value 0,00001 0,0001 0,001 0,01 0,1 1 10 100 1000 10000
ERCS Score E9 E8 E7 E6 E5 E4 E3 E2 E1 E0
Corresponding numerical value 0,000001 0,00001 0,0001 0,001 0,01 0,1 1 10 100 1000

Both column 10 and the row A in the matrix bear the value 0 as the corresponding numerical value.
