Rule2024-00549
Airworthiness Criteria: Special Class Airworthiness Criteria for the Wing Aviation LLC; Hummingbird Unmanned Aircraft
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
January 12, 2024
Effective
February 12, 2024
Issuing agencies
Transportation DepartmentFederal Aviation Administration
Abstract
The FAA announces the special class airworthiness criteria for the Wing Aviation LLC (Wing) Hummingbird unmanned aircraft (UA). This document sets forth the airworthiness criteria that the FAA finds to be appropriate and applicable for the UA design.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 9 (Friday, January 12, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 9 (Friday, January 12, 2024)]
[Rules and Regulations]
[Pages 2118-2125]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-00549]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 21
[Docket No. FAA-2022-1763]
Airworthiness Criteria: Special Class Airworthiness Criteria for
the Wing Aviation LLC; Hummingbird Unmanned Aircraft
AGENCY: Federal Aviation Administration (FAA), Department of
Transportation (DOT).
ACTION: Issuance of final airworthiness criteria.
-----------------------------------------------------------------------
SUMMARY: The FAA announces the special class airworthiness criteria for
the Wing Aviation LLC (Wing) Hummingbird unmanned aircraft (UA). This
document sets forth the airworthiness criteria that the FAA finds to be
appropriate and applicable for the UA design.
DATES: These airworthiness criteria are effective February 12, 2024.
FOR FURTHER INFORMATION CONTACT: Mack A. Martinez, Product Policy
Management--Emerging Aircraft Section, AIR-62B, Technical Policy
Branch, Policy and Standards Division, Aircraft Certification Service,
Federal Aviation Administration, 2300 East Devon Avenue, Room 335/339,
Des Plaines, IL 60018, telephone (847) 294-7481.
SUPPLEMENTARY INFORMATION:
Background
Wing Aviation LLC (Wing) applied to the FAA on September 19, 2018,
for a special class type certificate (TC) under 14 CFR 21.17(b) for the
Model Hummingbird UA.
The Model Hummingbird consists of a fixed-wing airplane UA and its
associated elements (AE) including communication links and components
that control the UA. The Model Hummingbird UA has a maximum gross
takeoff weight of approximately 15 pounds. It is approximately 3.4 feet
in width, 4.2 feet in length, and 9.4 inches in height. The Model
Hummingbird UA is battery powered using electric motors for vertical
takeoff, landing, and forward flight. The unmanned aircraft system
(UAS) operations would rely on high levels of automation and may
include multiple UA operated by a single pilot, up to a ratio of 20 UA
to 1 pilot. Wing intends for the Model Hummingbird to be used to
deliver packages. The proposed concept of operations (CONOPS) for the
Model Hummingbird includes a maximum operating altitude of 400 feet
above ground level, a maximum cruise speed of 68 knots, operations
beyond visual line of sight (BVLOS), and operations over people (OOP).
Wing has not requested approval for flight into known icing for the
Model Hummingbird UA.
Under Sec. 21.17(c), an application for type certification is
effective for 3 years. Section 21.17(d) provides that where a TC has
not been issued within that 3-year time limit, the applicant may file
for an extension and update the designated applicable regulations in
the type certification basis. The effective date of the applicable
airworthiness requirements for the updated type certification basis
must not be earlier than 3 years before the date of issue of the TC.
Since the project was not certificated within 3 years after the
application date above, the FAA approved the applicant's request to
extend the application for type certification. As a result, the date of
the updated type certification basis is September 26, 2022.
The FAA issued a notice of proposed airworthiness criteria for the
Wing Model Hummingbird UA, which published in the Federal Register on
February 8, 2023 (88 FR 8333).
Discussion of Comments
The FAA received responses from 5 commenters. The comments came
from industry organizations such as the Air Line Pilots Association
(ALPA), the Association for Uncrewed Vehicle Systems International
(AUVSI), the Small Unmanned Aerial Vehicles (UAV) Coalition, the
Commercial Drone Alliance, and Wing Aviation LLC.
Specific Issues Raised Within the Scope of the Notice
D&R.100 UA Signal Monitoring and Transmission: The FAA proposed
criteria on the minimum types of information the FAA finds are
necessary for the UA to transmit to the AE for continued safe flight
and operation.
Comment Summary: ALPA is concerned with the possibility of cyber
security breaches that could allow unauthorized individuals to take
control of a UA, potentially leading to safety issues. As such, it is
important to address these concerns and establish an acceptable
envelope of tolerance for UA operation that ensures the security of the
signal monitoring and transmission systems.
FAA Response: These comments are outside the scope for D&R.100. The
comments by ALPA on cyber security, D&R.115, are addressed in the
following paragraph.
[[Page 2119]]
D&R.115 Cyber Security: The FAA proposed a requirement to address
the risks to the UA associated with intentional unauthorized electronic
interactions that may result in an adverse effect on the security or
airworthiness of the UA.
Comment Summary: ALPA is concerned with the safety and security of
the Command and Control (C2) link and potential unauthorized intrusions
that could result in the loss of full control over the aircraft. ALPA
recommends that every UA model requesting operations in the National
Airspace System (NAS) undergo testing and validation during the
aircraft certification process to ensure the security of the C2 link is
impenetrable and cannot be hacked. ALPA states that reports have shown
that the loss of the C2 link and the inability to regain it has led to
an uncontained flyaway. ALPA focuses on the most critical aspects of
safe UA operations and recommends specific requirements to ensure the
safe discontinuation of a flight after a failure of a critical part or
system and/or unauthorized intrusion of the C2 link. Other
recommendations include the ability of the pilot to re-route the UA
safely and dynamically, the ability for the UA control station to allow
the pilot to intervene in the management of the flight, an established
parameter requirement for geo-fencing specifications, and a requirement
for the UA to possess the capability to detect and avoid other aircraft
and hazards that are human made/manufactured and natural.
FAA Response: The proposed recommendations are too specific for
this general airworthiness criteria language; the language already
covers the general issues that ALPA's specific recommendations seek to
address. D&R.115 states that the UA equipment, systems, and networks
must be assessed to identify and mitigate protections as necessary. The
level of detail regarding the assessment of failures and the required
protection level of equipment, systems, and networks will be addressed
in the means of compliance (MOC) to these airworthiness criteria. The
C2 link is addressed in the airworthiness criteria under D&R.120
Contingency Planning for a C2 lost link or degradation of a C2 link, as
well as performance requirements. The C2 link is considered part of the
UA and will be assessed for cyber security under D&R.115 as part of
equipment and systems.
D&R.120 Contingency Planning: The FAA proposed a requirement to
address the risks associated with loss of communication C2 link between
the pilot and the UA. The proposed criteria requires that the UA be
designed to automatically execute a predetermined action and include
the predetermined action in the UA Flight Manual. The UA Flight Manual
must also include the minimum performance requirements for the C2 data
link defining when the C2 link is degraded to a level where active
control is no longer ensured. Takeoff when the C2 link is degraded
below minimum performance requirements must be prevented by design or
by an operating limitation to be included in the UA Flight Manual.
Comment Summary: ALPA expressed several areas of concern related to
UA contingency planning that the FAA should consider during the
aircraft certification process. These concerns include addressing the
risks associated with loss of communication, defining detailed
preprogrammed algorithmic deliverables and corrective actions for each
situation, and ensuring that the UA can automatically execute a safe
predetermined flight, loiter landing, or termination in the event of
any critical parts or systems failures. ALPA has several
recommendations including to have the applicant ``Develop a detailed
narrative that outlines every possible action that the UA will execute
when guidance/intrusion challenges arise after the first preterminal
action is initiated with the flight of the aircraft until all
maneuvering actions have been exhausted and no further options exist.''
ALPA also recommends a test and validation of the effectiveness of the
pre-determined executable actions to ensure proper design and
definition of UA as intended.
FAA Response: The FAA shares ALPA's concerns and has determined
that the current airworthiness criteria appropriately address these
concerns. The airworthiness criteria within D&R.120(a) propose the
automatic and immediate execution of a safe predetermined action, in
the event of a loss of communications, be part of the UA design.
Furthermore, D&R.120(b) proposes that established predetermined actions
are included in the UA Flight Manual, thus ensuring the applicant
outlines these predetermined maneuvering actions within their
contingency planning. Test and validation methods, of the effectiveness
of such pre-determined actions as part of mitigation planning by which
the UA will meet these criteria are addressed by D&R.310(a) and will be
outlined in the MOC.
D&R.125 Lightning: The FAA proposed criteria to address the risks
that would result from a lightning strike, accounting for the size and
physical limitations of a UAS that could preclude traditional lightning
protection features. The FAA further proposed that without lightning
protection for the UA, the flight manual must include an operating
limitation to prohibit flight into weather conditions with potential
lightning.
Comment Summary: ALPA commented that lightning can cause
significant damage to aircraft and pose a safety risk to people and
property on the ground if that aircraft were to lose control and crash.
ALPA suggests 10 specific recommendations for the FAA such as
developing lightning protection standards and procedures; establishing
a certification process for UA lightning protection and requiring all
UA to comply with those standards; requiring regular inspections to
identify damage caused by lightning strikes; and developing training
programs for UA operators and maintenance personnel on lightning
safety.
FAA Response: The proposed recommendations are too specific for
this general airworthiness criteria language. The UA, if designed with
lightning mitigation features per D&R.125(a), would need to demonstrate
protection of the UA from loss of flight or control due to lightning
within the MOC. Otherwise, the operational limitations per D&R.125(b)
would prohibit flight into weather conditions conducive to lightning
activity.
D&R.130 Adverse Weather Conditions: The FAA proposed criteria
either requiring that design characteristics protect the UAS from
adverse weather conditions or prohibiting flight into known adverse
weather conditions. The criteria proposed to define adverse weather
conditions as rain, snow, and icing.
Comment Summary: ALPA recommends that the FAA develop and implement
a policy that covers scenarios beyond ``known conditions'' when UAs
inadvertently experience adverse weather conditions. ALPA suggests 30
specific recommendations including establishing training requirements
for UA pilots and crew members on managing adverse weather conditions;
requiring that UA operators have access to accurate and up-to-date
weather information; requiring continuous monitoring of adverse weather
conditions during flight operations; establishing strict icing
requirements and tolerances to prevent the operation of the UA in icing
conditions; establishing strict wind limitations and protocols; and
that UA operators adapt air carrier icing standards or use them as a
baseline to ensure safe operations.
[[Page 2120]]
FAA Response: Scenarios beyond ``known conditions'' would be an
anomalous situation that is beyond the scope of D&R.130. For adverse
weather conditions for which the UA is not approved to operate, D&R.130
already contains requirements to detect adverse weather and minimize
the likelihood of operating in those conditions. Testing of operations
in these conditions is beyond the level of rigor needed for these
aircraft. In addition, the effect of wind is addressed in
D&R.300(b)(9), even though it is not included in D&R.130. D&R testing
MOCs and test plans will ensure the UA is tested for adverse wind
conditions. Design requirements related to operation in icing as a
result of adverse weather are addressed in the CONOPS as stated within
D&R.130(b).
D&R.135 Flight Essential Parts: The FAA proposed criteria for
critical parts that were substantively similar to those in the existing
standards for normal category rotorcraft under 14 CFR 27.602, with
changes to reflect UAS terminology and failure conditions. The criteria
proposed to define a critical part as a part, the failure of which
could result in a loss of flight or unrecoverable loss of control of
the aircraft.
Comment Summary: ALPA proposed several recommendations related to
design and testing of the UA to consider the failure rates of
associated systems and parts. ALPA recommends that a failure-rate
threshold should be determined for critical components that are flight
essential. ALPA recommends that the FAA establish stringent standards
and guidelines for UA certification to ensure public safety.
FAA Response: The specific numerical reliability of any specific
part is more specific than would appear in airworthiness D&R criteria.
D&R.135(b) already requires the applicant to define maintenance
instructions or life limits on any essential parts. Life limits are
determined based on the number of failure-free hours flown on the
highest time conformed aircraft and the life limits are listed in the
instructions for continued airworthiness (ICA).
D&R.300 Durability and Reliability: The FAA proposed durability and
reliability testing that would require the applicant to demonstrate
safe flight of the UAS across the entire operational envelope and up to
all operational limitations, for all phases of flight and all aircraft
configurations described in the applicant's CONOPS, with no failures
that result in a loss of flight, loss of control, loss of containment,
or emergency landing outside the operator's recovery area. The FAA
further proposed that UA would only be certificated for operations
within the limitations, and for flight over areas no greater than the
maximum population density, as described in the applicant's CONOPS and
demonstrated by test.
Comment Summary: ALPA commented that it is crucial that UA
operators understand the limitations and requirements for operating in
visual line of sight (VLOS) and BVLOS environments, including recovery
zone limitations. Additionally, proper maintenance and testing must be
conducted to ensure the UA's airworthiness certificate is valid and
reliable for operation. ALPA suggests 10 specific recommendations
including requiring scheduled maintenance per 14 CFR part 43; specific
minimum testing; and requiring regular system checks before each flight
to ensure the aircraft is in proper working condition.
FAA Response: The D&R airworthiness criteria contain requirements
related to the airworthiness of the aircraft itself, relying heavily on
both flight testing and on maintenance in accordance with defined
maintenance procedures. The comments on the operational environments
are separate requirements or limitations and not part of the criteria
for the aircraft itself. ALPA's specific maintenance recommendations
are already encompassed by the general language of D&R.300.
Comment Summary: The Small UAV Coalition commented on the proposed
D&R.300 requirement that no failures occur ``that result in loss of
flight, loss of control, loss of containment, or emergency landing
outside the operator's recovery area.'' The Coalition recommends that a
single failure during testing should not automatically restart counting
the number of flight test operations set for a particular population
density. Rather, if the applicant can identify the failure through root
cause and fault tree analysis and provide a validated mitigation to
prevent its recurrence, the number of consecutive failure-free
operations and overall flight test hours allocation should be adjusted
to be proportionate to the particular risk of that failure.
The Small UAV Coalition also states, ``some UAS design elements
could include an onboard health system that initiates a landing to
lessen the potential of a loss of control event. In those cases, if the
landings could be demonstrated to occur in safer locations that should
not count as a failure.'' The Coalition seeks confirmation that the
text ``operator's recovery area'' includes that sort of landing. Absent
correction or clarification from the FAA on this language in D&R.300,
the Coalition believes these requirements would present unnecessary and
overly burdensome compliance challenges for the applicant to address.
FAA Response: The intent of the testing criteria is for the
applicant to demonstrate the aircraft's durability and reliability
through a successful accumulation of flight testing. The FAA does not
expect analytical evaluation to be part of this process. It should be
noted that D&R.300 is intended to demonstrate the reliability of the
system and not the consequence of failure, which is addressed in
D&R.305. Systems designed to allow for unscheduled landings at
potentially safer sites which are not controlled by the operator may
provide a safety benefit, but D&R.300 is evaluating the overall system
reliability and any landing outside those sites predetermined and
accepted by the FAA in the flight test plan will be considered a test
point failure. Failures during flight testing may or may not require
additional test hours, up to and including resetting of the accumulated
flight hours to zero. This determination will be made by the FAA based
on the extent of redesign necessary to minimize the likelihood the
incident will recur. However, the applicant will comply with these
testing criteria using an MOC, accepted by the FAA, through the issue
paper process. The MOC will depend on the reliability level the
applicant has proposed to meet.
D&R.305 Probable Failures: The FAA proposed criteria to evaluate
how the UAS functions after probable failures, including failures
related to propulsion systems, C2 link, global positioning system
(GPS), critical flight control components with a single point of
failure, control station, and any other equipment identified by the
applicant.
Comment Summary: ALPA provided 10 recommendations to ensure that
the testing criteria effectively address probable failures and that any
additional critical failures are also considered. Some of the
recommendations include the FAA specifying which ``certain failures''
that UAs will be expected to demonstrate to prove that they can remain
under control and contained; the UA should be tested to ensure it can
safely return to a predetermined location or land safely in the event
of a loss of power or propulsion system failure; and the applicant
should test the UA's ability to detect and avoid potential obstacles,
such as other aircraft, buildings, or terrain, to ensure safe
operations in all types of environments.
FAA Response: ``Probable failures'' are addressed in D&R.305 and
``capabilities'' are addressed within
[[Page 2121]]
D&R.310. The intent of the testing criteria is for the applicant to
demonstrate the aircraft's durability and reliability through a
successful accumulation of flight testing. The FAA does not expect
analytical evaluation to be part of this process. However, the
applicant will comply with these testing criteria using test plans
developed to an MOC, accepted by the FAA through the issue paper
process. The MOC will address each element of these airworthiness
criteria and will be dependent on the reliability level the applicant
has proposed to meet.
D&R.310 Capabilities and Functions: The FAA proposed criteria to
require the applicant to demonstrate, by test, the minimum capabilities
and functions necessary for the design. UAS.310(a) proposed to require
the applicant to demonstrate, by test, the capability of the UAS to
regain command and control of the UA after a C2 link is lost, the
sufficiency of the electrical system to carry all anticipated loads,
and the ability of the pilot to override any pre-programming in order
to resolve a potential unsafe operating condition in any phase of
flight. UAS.310(b) proposed to require the applicant to demonstrate, by
test, certain features if the applicant requests approval of those
features (geo-fencing, external cargo, detect and avoid, etc.).
UAS.310(c) proposed to require the design of the UAS to safeguard
against an unintended discontinuation of flight or release of cargo,
whether by human action or malfunction.
Comment Summary: ALPA comments on assuring the security of the C2
link through testing and validation during the aircraft certification
process for every UA model requesting operations in the NAS. An
acceptable percentage for cyber intrusions and the ability to regain
command and control of the UA after the C2 link is lost must be
defined. ALPA also provided several recommendations on capabilities and
functions required by D&R.310(a) or optional D&R.310(b), if requested
for approval.
FAA Response: D&R.120(a) requires contingency planning for C2 lost
link and D&R.115 requires protections from cyber intrusions. Specific
contingency plans and protections will be addressed in the MOC for
those airworthiness criteria. D&R.310's general airworthiness criteria
language already covers the other issues ALPA's specific
recommendations seek to address.
Comment Summary: The proposed airworthiness criteria discussion of
D&R.310 ``Capabilities and Functions'' includes the sentence, ``[i]n
order to show that the UA does not create a hazard when landing, the UA
must show by test that it has the ability to detect and avoid any
potential hazards on the ground by demonstrating any such landing
always stays well clear of all people and other obstacles.''
Wing, AUVSI, The Commercial Drone Alliance and The Small UAV
Coalition object to the FAA's use of absolute terms such as ``any'' and
``always'' against undefined and/or ambiguous terms (such as ``well
clear'' in the context of ground obstacles) outlined in the preamble
discussion of the proposed airworthiness criteria. Absent correction or
clarification by the FAA, the commenters state that this language sets
an impossibly high standard beyond the capabilities of either human or
machine. Such absolute and prescriptive MOC is inappropriate in the
context of airworthiness criteria. Wing is concerned that this standard
precludes the ability of Wing or other manufacturers to demonstrate
compliance at any practical level of test or validation. The commenters
note that this standard is not called for in the actual proposed text
of D&R.310 itself. In finalizing the airworthiness criteria, the FAA
should correct or clarify its preamble language to avoid any possible
confusion.
Wing is concerned that the absolute terms ``any'' and ``always''
create a bar that demonstration by test or other means cannot meet. In
addition, the use of terms such as ``potential'' and ``well clear''
similarly creates substantial challenges to compliance demonstration by
test or other means. Wing states that it would be exceptionally
challenging to meet this standard and that it exceeds the expectations
for crewed aircraft as written. Wing requests that the FAA allow for
alternative means of demonstrating that the UA does ``not create a
hazard when landing'' in accordance with D&R.310(a)(6) by prefacing
this paragraph with the phrase ``for example;'' remove the absolute
terms ``any,'' ``all,'' and ``always'' to allow for the use of
reasonable and achievable test methods; and remove the undefined and
ambiguous terms ``well clear,'' ``other obstacles,'' and ``potential''
when outlining test or demonstration criteria.
FAA Response: The FAA's use of absolute terms referenced in the
comment summary above are of concern to Wing and others as in their
view, ``the language sets an impossibly high standard beyond the
capabilities of either human or machine.'' The subject language is
based on the increased level of automation of Wing's system, which
relies on onboard automated decision-making rather than pilot action.
To accept such a system, the UAS must exhibit highly automated features
and functions to enhance the safety of UAS operations by replacing
direct manual control of the UA with automation. The UAS's automated
flight envelope and path protection systems must be designed for
controllability and maneuverability needed to detect and to maintain
safe separation from hazards or obstacles on or near the ground while
in normal, abnormal, and emergency operations. Some examples of
abnormal or emergency scenarios include collision avoidance, aborted
missions, power system failures, and forced landings. The UAS must also
be equipped with capabilities and necessary features that will
automatically contain or control the aircraft in the case of a loss of
external services used in communicating, controlling, or providing
system inputs to the UA. All foreseeable loss, degradation or non-
availability of external services, systems, or signals must not put the
UA in an uncontrolled, uncontained, or unsafe condition.
D&R.310 is a testing requirement and sets the criteria which must
be demonstrated by flight test as part of the type certification
program. The language referenced by the commenters as preamble language
does not appear in the final rule but is given in the discussion
section of the NPRM as a tool for understanding why the requirement was
drafted as it was and provides additional insight into the means by
which the applicant will be able to show compliance with the testing
requirements in D&R.310. The intent of the use of this language within
the NPRM discussion is for the applicant to show compliance by
demonstrating landings that do not adversely impact people or
obstacles. Therefore, the FAA finds that an acceptable flight test
outcome is one that would not result in an unsafe condition. Within the
context of the certification testing performed under D&R.310, the FAA's
use of absolute terms such as ``any'' and ``always'' only serve to
emphasize acceptable examples of test boundaries which will be
addressed in more detail in the MOC and test plans. Likewise, terms
like ``well clear'' will be defined based on the appropriate near mid-
air collision (NMAC) volume determined to be acceptable to the FAA for
the D&R flight test campaign.
D&R.320 Verification of Limits: The FAA proposed to require a
demonstration of the UA's performance, maneuverability, stability, and
control with a factor of safety (5% over maximum gross weight with no
loss of control or loss of flight).
[[Page 2122]]
Comment Summary: ALPA is concerned that the safety factor of 5% is
too low. The Model Hummingbird UA weighs approximately 15 lbs., which
means that 5% is approximately 0.75 lbs. ALPA recommends increasing
this number to a minimum of a double-digit percentage for current and
future aircraft certification standards.
FAA Response: The FAA determined that based on historical data, 5%
is a minimum acceptable margin.
Additional Airworthiness Criteria Identified by Commenters
UA to Pilot Ratio: The Wing Model Hummingbird UAS operations would
rely on high levels of automation and may include multiple UA operated
by a single pilot, up to a ratio of 20 UA to 1 pilot.
Comment Summary: ALPA is concerned with the safe operation of
multiple UAs operated by a single pilot as described within the
proposed airworthiness criteria notice. ALPA recommends that the FAA
research and better assess multiple UA operations by a single pilot to
establish a baseline understanding of the feasibility of a single UA
pilot flying multiple UAs before developing airworthiness certification
criteria. The proposed 20 to 1 UA to pilot ratio presents significant
challenges to ensuring the safe operation of UAs and other NAS users,
and the FAA should implement additional certification requirements for
pilots operating multiple UAs, including specialized training and
qualification standards. Additionally, the FAA should establish
guidelines for the maximum number of UAs that a single pilot can
operate to ensure safe and effective operations in the NAS.
Furthermore, there should always be a backup failsafe and tertiary
means of control for built-in redundancy where another human operator
can intervene out of necessity for safety. The FAA should base its
decision on facts and data and should clarify what qualitative and
quantitative scientific instruments were utilized to assess the
potential risks of the aircraft.
FAA Response: These airworthiness criteria require the applicant to
demonstrate the durability and reliability of the UA design by flight
test, at the highest aircraft-to-pilot ratio, without exceptional
piloting skill or alertness. In addition, D&R.305(c) requires the
applicant to demonstrate probable failures by test at the highest
aircraft-to-pilot ratio. The durability and reliability-based type
certification process was developed for UAS that meet certain design
criteria to include a maximum operating limitation of 20:1 aircraft to
pilot ratio. Any deviation from this limitation will require additional
coordination and will add to the project timeline.
Level of Automation: The Wing Model Hummingbird UA operations would
rely on high levels of automation.
Comment Summary: ALPA is concerned about the specificity of the
Model Hummingbird UA's automation level. ALPA states that the FAA
should clarify the degree and level of automation in which the UA will
operate. This includes defining whether the operation of the Model
Hummingbird UA will be fully automated autonomous, partially automated
autonomous, preprogrammed, or a combination of any of these options.
Additionally, the FAA should determine the required minimal involvement
or participation from the remote pilot(s) to assure flight safety. ALPA
suggests that the FAA establish guidelines for aircraft onboard
(organic) and/or offboard (inorganic) intelligence system(s) to
deconflict other known and unknown (birds, floating objects/flying
debris) air traffic and associated hazards. The FAA should ensure that
these systems are tested, designed, and manufactured to a certain
failure rate, such as a 10<SUP>-9</SUP> failure rate per flight hours
or something less.
FAA Response: D&R.100 requires UA specifications within the CONOPS.
Data within the CONOPS are proprietary to the applicant. The D&R
methodology is used as a framework to allow for an adequate balance of
certification rigor with safety related outcomes. The FAA considered
the size of aircraft, its maximum airspeed and altitude, and
operational limitations to address the number of UA per operator
(maximum of 20:1 aircraft to pilot ratio) and to address operations in
which the aircraft would operate BVLOS of the pilot to assess the
potential risk the aircraft could pose to other aircraft and to human
beings on the ground. Using these parameters, the FAA developed
proposed airworthiness criteria to address those potential risks to
ensure the aircraft remains reliable, controllable, safe, and airworthy
without the need for requiring a prescriptive failure rate.
Hazardous Cargo Carriage Over Populated Areas
Comment Summary: ALPA is concerned that the carriage of HAZMAT by
UAs over populated areas poses a significant safety concern requiring
the FAA's action. The guidelines and regulations for the carriage of
HAZMAT by UAs should consider the associated risks to public safety. UA
operators should be required to provide information about the HAZMAT
they are carrying. The FAA should also establish a system for
monitoring and enforcing compliance, ensure that emergency responders
are informed, properly trained, and equipped to handle nonconventional
operational factors involving UA HAZMAT incidents, and require UA
manufacturers to incorporate safeguards and emergency response
mechanisms. By taking these and other recommended steps, the FAA can
help ensure the safe operation of UAs in the NAS.
FAA Response: The FAA acknowledges the concern by ALPA. However,
the comment is not within the scope of the aircraft type certification
for which this airworthiness criteria was developed. The carriage of
HAZMAT is an operational function and if applicable to Wing's operation
for this aircraft, would be provided in the CONOPS. The CONOPS, if
approved for HAZMAT, will contain operational limitations in the
operating approval, as necessary. The CONOPS are proprietary to the
applicant.
BVLOS and OOP
Comment Summary: ALPA is concerned that as the use of UAs for BVLOS
operations and over people become increasingly common, it raises
significant safety concerns that must be addressed in the certification
process. ALPA is concerned about the potential risks associated with
this type of operation involving the Model Hummingbird UA or any
similar operator. In order to ensure safety, ALPA recommends that
operators explain how they plan to mitigate their aerial footprint
around and away from people and property, with detailed evasion and
emergency set-down plans, processes, and parameters. Additionally, ALPA
urges the FAA to consider the possibility of an aircraft performing
BVLOS losing propulsion and being unable to maintain flight, requiring
a recovery or crash mitigation strategy and emergency vertical
arrestment system to prevent harm to persons or property.
ALPA states that many manufacturers within the UA/drone and urban
air mobility (UAM) and advanced air mobility (AAM) industry do not
include an emergency vertical arrestment system to prevent loss of life
and property in the event of an aircraft losing its engine or engines
then becoming a falling object which is increasingly alarming if that
aircraft has minimal to a zero-glide aspect ratio. ALPA recommends
continuous collaboration between industry experts and the regulator to
[[Page 2123]]
develop safer aircraft design and certification standards for the best
interests of the end-users, the flying public, and those affected by
flight operations of UA/drone or UAM/AAM aircraft. When these types of
aircraft operate in the same airspace as commercial aircraft, ALPA
recommends that pilots have the ability to see them on the flightdeck
or pilot display and air traffic controllers can view them on their
displays to separate air traffic safely. These aircraft must also have
active collision-avoidance technology, and ALPA opposes any integration
that does not include aircraft collision-avoidance systems (ACAS) that
are interoperable with commercial collision-avoidance systems. ALPA
further opposes any proposed changes to 14 CFR 91.113 to enable BVLOS
operational safety case(s) to transfer the responsibility of ``see and
avoid'' to crewed aircraft under certain conditions. The responsibility
of ``see and avoid'' must remain with the remote pilot, and any changes
to this would be detrimental to the safe integration of UAs into the
NAS.
FAA Response: Discussion on proposed changes to general operating
flight rule Sec. 91.113 is not within the scope of this airworthiness
criteria as it does not pertain to the type certification of the
aircraft itself. Operational approval will be granted based on the
maximum cumulative risk posed by the proposed operations, taking into
account mitigating features, e.g., vertical arresting systems such as
parachutes, if they are proposed as part of the design. However, the
airworthiness criteria are developed to be high level and performance
based, rather than relying on specific designs which may limit
introduction of other novel safety enhancing features.
Battery Standards
Comment Summary: ALPA states that the use of batteries as an energy
source for aircraft propulsion in the NAS is a substantial shift from
traditional propulsion methods on which current safety margins are
based and requires more regulator exploration to determine best safety
practices. ALPA states that the FAA will need to analyze, qualify, and
quantify the aircraft performance and operational environments to
determine whether the safety baseline of this technological
functionality can be performed reliably and repeatedly to an equivalent
level of safety. ALPA recommends that the FAA and industry mutually
agree upon the scientific data to confer consensus regarding acceptable
safety margins.
ALPA provided 20 specific recommendations regarding battery safety.
Some of the recommendations are to develop standards; establish
certification procedures for aircraft batteries; develop regulations
for transporting lithium-ion batteries; define policies and procedures
for flightcrews to promptly act with an abnormal battery anomaly; and
several more recommendations on best-practices for battery safety.
FAA Response: The recommendations on battery standards by the
commenter are noted as either being too specific or out of scope for
this D&R airworthiness criteria. The overly specific recommendations
address issues already encompassed by the general airworthiness
criteria. D&R testing per D&R.300 should demonstrate reliability of the
UAS as a whole and thus each system or component within the UAS has met
a minimum acceptable reliability standard. Demonstration of the safe
carriage of batteries and mitigations for known risks are addressed via
flight test within D&R.305(a)(1) ``Propulsion systems.''
Out of Scope Comments
The FAA received and reviewed several comments that were general,
stated the commenter's viewpoint or opposition without a suggestion
specific to the proposed criteria, or did not make a request the FAA
can act on. These comments are noted as beyond the scope of this
document.
Applicability
These airworthiness criteria, established under the provisions of
Sec. 21.17(b), are applicable to the Model Hummingbird UA. Should Wing
Aviation LLC apply at a later date for a change to the TC to include
another model, these airworthiness criteria would apply to that model
as well, provided the FAA finds them appropriate in accordance with the
requirements of subpart D to part 21.
Conclusion
This action affects only the airworthiness criteria for one model
UA. It is not a standard of general applicability.
Authority Citation
The authority citation for these airworthiness criteria is as
follows:
Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.
Airworthiness Criteria
Pursuant to the authority delegated to me by the Administrator, the
following airworthiness criteria are issued as part of the type
certification basis for the Wing Aviation LLC Model Hummingbird UA. The
FAA finds that compliance with the following would mitigate the risks
associated with the proposed design and CONOPS appropriately and would
provide an equivalent level of safety to existing rules.
General
D&R.001 Concept of Operations
The applicant must define and submit to the FAA a concept of
operations (CONOPS) proposal describing the UAS operation in the
National Airspace System for which UA type certification is requested.
The CONOPS proposal must include, at a minimum, a description of the
following information in sufficient detail to determine the parameters
and extent of testing and operating limitations:
(a) The intended type of operations;
(b) UA specifications;
(c) Meteorological conditions;
(d) Operators, pilots, and personnel responsibilities;
(e) Control station, support equipment, and other associated
elements (AE) necessary to meet the airworthiness criteria;
(f) Command, control, and communication functions;
(g) Operational parameters (such as population density, geographic
operating boundaries, airspace classes, launch and recovery area,
congestion of proposed operating area, communications with air traffic
control, line of sight, and aircraft separation); and
(h) Collision avoidance equipment, whether onboard the UA or part
of the AE, if requested.
D&R.005 Definitions
For purposes of these airworthiness criteria, the following
definitions apply.
(a) Loss of control: Loss of control means an unintended departure
of an aircraft from controlled flight. It includes control reversal or
an undue loss of longitudinal, lateral, and directional stability and
control. It also includes an upset or entry into an unscheduled or
uncommanded attitude with high potential for uncontrolled impact with
terrain. A loss of control means a spin, loss of control authority,
loss of aerodynamic stability, divergent flight characteristics, or
similar occurrence, which could generally lead to a crash.
(b) Loss of flight: Loss of flight means a UA's inability to
complete its flight as planned, up to and through its originally
planned landing. It includes
[[Page 2124]]
scenarios where the UA experiences controlled flight into terrain,
obstacles, or any other collision, or a loss of altitude that is severe
or non-reversible. Loss of flight also includes deploying a parachute
or ballistic recovery system that leads to an unplanned landing outside
the operator's designated recovery zone.
Design and Construction
D&R.100 UA Signal Monitoring and Transmission
The UA must be designed to monitor and transmit to the AE all
information required for continued safe flight and operation. This
information includes, at a minimum, the following:
(a) Status of all critical parameters for all energy storage
systems;
(b) Status of all critical parameters for all propulsion systems;
(c) Flight and navigation information as appropriate, such as
airspeed, heading, altitude, and location; and
(d) Communication and navigation signal strength and quality,
including contingency information or status.
D&R.105 UAS AE Required for Safe UA Operations
(a) The applicant must identify and submit to the FAA all AE and
interface conditions of the UAS that affect the airworthiness of the UA
or are otherwise necessary for the UA to meet these airworthiness
criteria. As part of this requirement--
(1) The applicant may identify either specific AE or minimum
specifications for the AE.
(i) If minimum specifications are identified, they must include the
critical requirements of the AE, including performance, compatibility,
function, reliability, interface, operator alerting, cyber security,
and environmental requirements.
(ii) Critical requirements are those that if not met would impact
the ability to operate the UA safely and efficiently.
(2) The applicant may use an interface control drawing, a
requirements document, or other reference, titled so that it is clearly
designated as AE interfaces to the UA.
(b) The applicant must show the FAA that the AE or minimum
specifications identified in paragraph (a) of this section meet the
following:
(1) The AE provide the functionality, performance, reliability, and
information to assure UA airworthiness in conjunction with the rest of
the design;
(2) The AE are compatible with the UA capabilities and interfaces;
(3) The AE must monitor and transmit to the operator all
information required for safe flight and operation, including but not
limited to those identified in D&R.100; and
(4) The minimum specifications, if identified, are correct,
complete, consistent, and verifiable to assure UA airworthiness.
(c) The FAA will establish the approved AE or minimum
specifications as operating limitations and include them in the UA type
certificate data sheet and UA Flight Manual.
(d) The applicant must develop any maintenance instructions
necessary to address implications from the AE on the airworthiness of
the UA. Those instructions will be included in the instructions for
continued airworthiness (ICA) required by D&R.205.
D&R.110 Software
To minimize the existence of software errors, the applicant must:
(a) Verify by test all software that may impact the safe operation
of the UA;
(b) Utilize a configuration management system that tracks,
controls, and preserves changes made to software throughout the entire
life cycle; and
(c) Implement a problem reporting system that captures and records
defects and modifications to the software.
D&R.115 Cyber Security
(a) UA equipment, systems, and networks, addressed separately and
in relation to other systems, must be protected from intentional
unauthorized electronic interactions that may result in an adverse
effect on the security or airworthiness of the UA. Protection must be
ensured by showing that the security risks have been identified,
assessed, and mitigated as necessary.
(b) When required by paragraph (a) of this section, procedures and
instructions to ensure security protections are maintained must be
included in the ICA.
D&R.120 Contingency Planning
(a) The UA must be designed so that, in the event of a loss of the
command and control (C2) link, the UA will automatically and
immediately execute a safe predetermined flight, loiter, landing, or
termination.
(b) The applicant must establish the predetermined action in the
event of a loss of the C2 link and include it in the UA Flight Manual.
(c) The UA Flight Manual must include the minimum performance
requirements for the C2 data link, defining when the C2 link is
degraded to a level where remote active control of the UA is no longer
ensured. Takeoff when the C2 link is degraded below the minimum link
performance requirements must be prevented by design or prohibited by
an operating limitation in the UA Flight Manual.
D&R.125 Lightning
(a) Except as provided in paragraph (b) of this section, the UA
must have design characteristics that will protect the UA from loss of
flight or loss of control due to lightning.
(b) If the UA has not been shown to protect against lightning, the
UA Flight Manual must include an operating limitation to prohibit
flight into weather conditions conducive to lightning activity.
D&R.130 Adverse Weather Conditions
(a) For purposes of this section, ``adverse weather conditions''
means rain, snow, and icing.
(b) Except as provided in paragraph (c) of this section, the UA
must have design characteristics that will allow the UA to operate
within the adverse weather conditions specified in the CONOPS without
loss of flight or loss of control.
(c) For adverse weather conditions for which the UA is not approved
to operate, the applicant must develop operating limitations to
prohibit flight into known adverse weather conditions and either:
(1) Develop operating limitations to prevent inadvertent flight
into adverse weather conditions; or
(2) Provide a means to detect any adverse weather conditions for
which the UA is not certificated to operate and show the UA's ability
to avoid or exit those conditions.
D&R.135 Flight Essential Parts
(a) A flight essential part is a part, the failure of which could
result in a loss of flight or unrecoverable loss of UA control.
(b) If the type design includes flight essential parts, the
applicant must establish a flight essential parts list. The applicant
must develop and define mandatory maintenance instructions or life
limits, or a combination of both, to prevent failures of flight
essential parts. Each of these mandatory actions must be included in
the airworthiness limitations section of the ICA.
Operating Limitations and Information
D&R.200 UA Flight Manual
The applicant must provide a UA Flight Manual with each UA.
(a) The UA Flight Manual must contain the following information:
(1) UA operating limitations;
(2) UA operating procedures;
(3) Performance information;
[[Page 2125]]
(4) Loading information; and
(5) Other information that is necessary for safe operation because
of design, operating, or handling characteristics.
(b) Those portions of the UA Flight Manual containing the
information specified in paragraph (a)(1) of this section must be
approved by the FAA.
D&R.205 ICA
The applicant must prepare the ICA for the UA in accordance with
appendix A to 14 CFR part 23, as appropriate, that are acceptable to
the FAA. The ICA may be incomplete at type certification if a program
exists to ensure their completion prior to delivery of the first UA or
issuance of a standard airworthiness certificate, whichever occurs
later.
Testing
D&R.300 Durability and Reliability
The UA must be designed to be durable and reliable when operated
under the limitations prescribed for its operating environment, as
documented in its CONOPS, and included as operating limitations on the
type certificate data sheet and in the UA Flight Manual. The durability
and reliability must be demonstrated by flight test in accordance with
the requirements of this section and completed with no failures that
result in a loss of flight, loss of control, loss of containment, or
emergency landing outside the operator's recovery area.
(a) Once a UA has begun testing to show compliance with this
section, all flights for that UA must be included in the flight test
report.
(b) Tests must include an evaluation of the entire flight envelope
across all phases of operation and must address, at a minimum, the
following:
(1) Flight distances;
(2) Flight durations;
(3) Route complexity;
(4) Weight;
(5) Center of gravity;
(6) Density altitude;
(7) Outside air temperature;
(8) Airspeed;
(9) Wind;
(10) Weather;
(11) Operation at night, if requested;
(12) Energy storage system capacity; and
(13) Aircraft to pilot ratio.
(c) Tests must include the most adverse combinations of the
conditions and configurations in paragraph (b) of this section.
(d) Tests must show a distribution of the different flight profiles
and routes representative of the type of operations identified in the
CONOPS.
(e) Tests must be conducted in conditions consistent with the
expected environmental conditions identified in the CONOPS, including
electromagnetic interference (EMI) and high intensity radiated fields
(HIRF).
(f) Tests must not require exceptional piloting skill or alertness.
(g) Any UAS used for testing must be subject to the same worst-case
ground handling, shipping, and transportation loads as those allowed in
service.
(h) Any UA used for testing must use AE that meet, but do not
exceed, the minimum specifications identified under D&R.105. If
multiple AE are identified, the applicant must demonstrate each
configuration.
(i) Any UAS used for testing must be maintained and operated in
accordance with the ICA and UA Flight Manual. No maintenance beyond the
intervals established in the ICA will be allowed to show compliance
with this section.
(j) If cargo operations or external-load operations are requested,
tests must show, throughout the flight envelope and with the cargo or
the external load at the most critical combinations of weight and
center of gravity, that--
(1) The UA is safely controllable and maneuverable; and
(2) The cargo or the external load is retainable and transportable.
D&R.305 Probable Failures
The UA must be designed such that a probable failure will not
result in a loss of containment or control of the UA. This must be
demonstrated by test.
(a) Probable failures related to the following equipment, at a
minimum, must be addressed:
(1) Propulsion systems;
(2) C2 link;
(3) Global positioning system (GPS);
(4) Flight control components with a single point of failure;
(5) Control station; and
(6) Any other AE identified by the applicant.
(b) Any UA used for testing must be operated in accordance with the
UA Flight Manual.
(c) Each test must occur at the critical phase and mode of flight,
and at the highest aircraft-to-pilot ratio.
D&R.310 Capabilities and Functions
(a) All of the following required UAS capabilities and functions
must be demonstrated by test:
(1) Capability to regain command and control of the UA after the C2
link has been lost.
(2) Capability of the electrical system to power all UA systems and
payloads.
(3) Ability for the pilot to safely discontinue the flight.
(4) Capability of the UA to maintain its preplanned flight path
within acceptable navigation accuracy.
(5) Ability to safely abort a takeoff.
(6) Ability to safely abort a landing and initiate a go-around
unless the UA is shown not to create a hazard when landing.
(b) The following UAS capabilities and functions, if requested for
approval, must be demonstrated by test:
(1) Continued flight after degradation of the propulsion system.
(2) Geo-fencing that contains the UA within a designated area, in
all operating conditions.
(3) Positive transfer of the UA between control stations that
ensures only one control station can control the UA at a time.
(4) Capability to release an external cargo load to prevent loss of
control of the UA.
(5) Capability to detect and avoid other aircraft and obstacles.
(c) The UA must be designed to safeguard against inadvertent
discontinuation of the flight and inadvertent release of cargo or
external load.
D&R.315 Fatigue
The structure of the UA must be shown to withstand the repeated
loads expected during its service life without failure. A life limit
for the airframe must be established, demonstrated by test, and
included in the ICA.
D&R.320 Verification of Limits
The performance, maneuverability, stability, and control of the UA
within the flight envelope described in the UA Flight Manual must be
demonstrated at a minimum of 5% over maximum gross weight with no loss
of control or loss of flight.
Issued in Washington, DC, on January 8, 2024.
Ian Lucas,
Manager, Certification Coordination Section, Policy and Standards
Division, Aircraft Certification Service.
[FR Doc. 2024-00549 Filed 1-11-24; 8:45 am]
BILLING CODE 4910-13-P
</pre></body>
</html>Indexed from Federal Register on January 12, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.