2022-21571. Airworthiness Criteria: Special Class Airworthiness Criteria for the Insitu Inc. ScanEagle3 Unmanned Aircraft

AGENCY:

Federal Aviation Administration (FAA), Department of Transportation (DOT).

ACTION:

Notice of proposed airworthiness criteria.

SUMMARY:

The FAA announces the availability of and requests comments on proposed airworthiness criteria for the Insitu Inc. Model ScanEagle3 unmanned aircraft (UA). This document proposes the airworthiness criteria that the FAA finds to be appropriate and applicable for the UA design.

DATES:

Send comments on or before November 4, 2022.

ADDRESSES:

Send comments identified by docket number FAA-2022-0533 using any of the following methods:

• Federal eRulemaking Portal: Go to http://www.regulations.gov and follow the online instructions for sending your comments electronically.

• Mail: Send comments to Docket Operations, M-30, U.S. Department of Transportation, 1200 New Jersey Avenue SE, Room W12-140, West Building Ground Floor, Washington, DC 20590-0001.

• Hand Delivery or Courier: Take comments to Docket Operations in Room W12-140 of the West Building Ground Floor at 1200 New Jersey Avenue SE, Washington, DC 20590-0001, between 9 a.m., and 5 p.m., Monday through Friday, except Federal holidays.

• Fax: Fax comments to Docket Operations at [phone].

Privacy: The FAA will post all comments it receives, without change, to https://www.regulations.gov/​, including any personal information the commenter provides. Using the search function of the docket website, anyone can find and read the electronic form of all comments received into any FAA docket, including the name of the individual sending the comment (or signing the comment for an association, business, labor union, etc.). DOT's complete Privacy Act Statement can be found in the Federal Register published on April 11, 2000 (65 FR 19477-19478), as well as at https://www.dot.gov/​privacy.

Docket: Background documents or comments received may be read at https://www.regulations.gov at any time. Follow the online instructions for accessing the docket or go to Docket Operations in Room W12-140 of the West Building Ground Floor at 1200 New Jersey Avenue SE, Washington, DC, between 9 a.m., and 5 p.m., Monday through Friday, except Federal holidays.

FOR FURTHER INFORMATION CONTACT:

Christopher J. Richards, Emerging Aircraft Strategic Policy Section, AIR-618, Strategic Policy Management Branch, Policy and Innovation Division, Aircraft Certification Service, Federal Aviation Administration, 6020 28th Avenue South, Room 103, Minneapolis, MN 55450, telephone [phone].

SUPPLEMENTARY INFORMATION:

Comments Invited

The FAA invites interested people to take part in the development of these airworthiness criteria by sending written comments, data, or views. The most helpful comments reference a specific portion of the airworthiness criteria, explain the reason for any recommended change, and include supporting data. Comments on operational, pilot certification, and maintenance requirements would address issues that are beyond the scope of this document.

Except for Confidential Business Information as described in the following paragraph, and other information as described in title 14, Code of Federal Regulations (14 CFR) 11.35, the FAA will file in the docket all comments received, as well as a report summarizing each substantive public contact with FAA personnel concerning these proposed airworthiness criteria. Before acting on this proposal, the FAA will consider all comments received on or before the closing date for comments. The FAA will consider comments filed late if it is possible to do so without incurring delay. The FAA may change these airworthiness criteria based on received comments.

Confidential Business Information

Confidential Business Information (CBI) is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to these proposed airworthiness criteria contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to these proposed airworthiness criteria, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and the indicated comments will not be placed in the public docket of these proposed airworthiness criteria. Send submissions containing CBI to the individual listed under FOR FURTHER INFORMATION CONTACT . Comments the FAA receives, which are not specifically designated as CBI, will be placed in the public docket for these proposed airworthiness criteria.

Background

Insitu Inc. (Insitu) applied to the FAA on November 10, 2017, for a special class type certificate under 14 CFR 21.17(b) for the Model ScanEagle3 UA.

The Model ScanEagle3 consists of a fixed-wing airplane UA and its associated elements (AE) including communication links and components that control the UA. The Model ScanEagle3 UA has a maximum gross takeoff weight of 85 pounds. It has a wingspan of approximately 13 feet and is approximately 6.5 feet in length. The Model ScanEagle3 UA is powered by a single internal combustion engine. The unmanned aircraft system (UAS) operations would rely on high levels of automation and include a single UA operated by a single pilot. Insitu anticipates operators will use the Model ScanEagle3 for surveillance of linear infrastructure (gas/oil pipelines, electric transmission lines, railroad tracks, etc.), area assessments (forest fires, natural disasters, ship channels, etc.), and maritime operations (ice floe movement, marine mammal tracking, etc.). The proposed concept of operations for the Model ScanEagle3 identifies a maximum operating altitude of 3,500 feet above ground level, a maximum airspeed of 80 knots, operations beyond visual line of sight of the pilot, and operations over human beings. Insitu has not requested type certification for flight into known icing for the Model ScanEagle3.

Under 14 CFR 21.17(c), an application for type certification is effective for 3 years. Section 21.17(d) provides that where a type certificate has not been issued within that 3-year time limit, the applicant may file for an extension and update the designated applicable regulations in the type certification basis. The effective date of the applicable airworthiness requirements for the updated type certification basis must not be earlier than 3 years before the date of issue of the type certificate. Since the project was not certificated within 3 years after the application date above, the FAA approved the applicant's request to extend the project. The date of the updated type certification basis is June 1, 2020, based upon the applicant's proposed type certificate issuance date of June 1, 2023.

Discussion

The FAA establishes airworthiness criteria to ensure the safe operation of aircraft in accordance with 49 U.S.C. 44701(a) and 44704. UA are type certificated by the FAA as special class aircraft for which airworthiness standards have not been established by regulation. Under the provisions of 14 CFR 21.17(b), the airworthiness standards for special class aircraft are those the FAA finds to be appropriate and applicable to the specific type design.

The applicant has proposed a design with constraints upon its operations and an unusual design characteristic: the pilot is remotely located. The FAA developed existing airworthiness standards to establish an appropriate level of safety for each product and its intended use. The FAA's existing airworthiness standards did not envision aircraft with no pilot in the flight deck and the technologies associated with that capability.

The FAA has reviewed the proposed design and assessed the potential risk to the National Airspace System. The FAA considered the size of the proposed aircraft, its maximum airspeed and altitude, and operational limitations to address the number of unmanned aircraft per operator and to address operations in which the aircraft would operate beyond the visual line of sight of the pilot. These factors allowed the FAA to assess the potential risk the aircraft could pose to other aircraft and to human beings on the ground. Using these parameters, the FAA developed airworthiness criteria to address those potential risks to ensure the aircraft remains reliable, controllable, safe, and airworthy.

The proposed criteria focus on mitigating hazards by establishing safety outcomes that must be achieved, rather than by establishing prescriptive requirements that must be met. This is in contrast to many current airworthiness standards, used to certificate traditional aircraft systems, which prescribe specific indicators and instruments for a pilot in a flight deck that would be inappropriate for UA. The FAA finds that the proposed criteria are appropriate and applicable for the UA design, based on the intended operational concepts for the UA as identified by the applicant.

The FAA selected the particular airworthiness criteria proposed by this notice for the following reasons:

General: In order to determine appropriate and applicable airworthiness standards for UA as a special class of aircraft, the FAA determined that the applicant must provide information describing the characteristics and capabilities of the UA and how it will be used.

D&R.001 Concept of Operations: To assist the FAA in identifying and analyzing the risks and impacts associated with integrating the proposed UA design into the National Airspace System, the applicant would be required to submit a Concept of Operations (CONOPS). The proposed criteria would require the applicant's CONOPS to identify the intended operational concepts for the UA and describe the UAS and its operation. The applicant would be required to describe the information in the CONOPS in sufficient detail to determine parameters and extent of testing, as well as operating limitations that will be placed in the UA Flight Manual. If the applicant requests to include collision avoidance equipment, the proposed criteria would require the applicant to identify such equipment in the CONOPS.

D&R.005 Definitions: The proposed criteria include a definitions section, distinguishing the term “loss of flight” from “loss of control.”

Design and Construction: The FAA selected the design and construction criteria in this section to address airworthiness requirements where the flight testing demonstration alone may not be sufficient to demonstrate an appropriate level of safety.

D&R.100 UA Signal Monitoring and Transmission: To address the risks associated with loss of control of the UA, the applicant would be required to design the UA to monitor and transmit to the AE all information necessary for continued safe flight and operation. Some of the AE are located separately from the UA, and therefore are a unique feature to UAS. As a result, no regulatory airworthiness standards exist that directly apply to this part of the system. The FAA based some of the proposed criteria on existing regulations that address the information that must be provided to a pilot in the flight deck of a manned aircraft, and modified them as appropriate to the UAS. These proposed criteria list the specific minimum types of information the FAA finds are necessary for the UA to transmit for continued safe flight and operation; however, the applicant must determine whether additional parameters are necessary.

D&R.105 UAS AE Required for Safe UA Operations: Because safe UAS operations depend and rely on both the UA and the AE, the FAA considers the AE in assessing whether the UA meets the criteria that comprise the certification basis. While the AE items themselves will be outside the scope of the UA type design, the applicant must provide sufficient specifications for any aspect of the AE, including the control station, which could affect airworthiness. The proposed criteria would require a complete and unambiguous identification of the AE and their interface with the UA, so that their availability or use is readily apparent.

As explained in FAA Policy Memorandum AIR600-21-AIR-600-PM01, dated July 13, 2021, the FAA will approve either the specific AE or minimum specifications for the AE, as identified by the applicant, as part of the type certificate by including them as an operating limitation in the type certificate data sheet and flight manual. The FAA may impose additional operating limitations specific to the AE through conditions and limitations for inclusion in the operational approval ( i.e., waivers, exemptions, operating certificates, or a combination of these). In this way, the FAA will consider the entirety of the UAS for operational approval and oversight.

D&R.110 Software: Software for manned aircraft is certified under the regulations applicable to systems, equipment, and installations ( e.g., §§ 23.2510, 25.1309, 27.1309, or 29.1309). There are two regulations that specifically prescribe airworthiness standards for software: Engine airworthiness standards (§ 33.28) and propeller airworthiness standards (§ 35.23). The proposed UA software criteria are based on these regulations and tailored for the risks posed by UA software.

D&R.115 Cyber Security: The location of the pilot separate from the UA requires a continuous wireless connection (command and control link) with the UA for the pilot to monitor and control it. Because the purpose of this link is to control the aircraft, this makes the UA susceptible to cyber security threats in a unique way.

The current regulations for the certification of systems, equipment, and installations ( e.g., §§ 23.2510, 25.1309, 27.1309, and 29.1309) do not adequately address potential security vulnerabilities that could be exploited by unauthorized access to aircraft systems, data buses, and services. For manned aircraft, the FAA therefore issues special conditions for particular designs with network security vulnerabilities.

To address the risks to the UA associated with intentional unauthorized electronic interactions, the applicant would be required to design the UAS's systems and networks to protect against intentional unauthorized electronic interactions and mitigate potential adverse effects. The FAA based the language for the proposed criteria on recommendations in the final report dated August 22, 2016, from the Aircraft System Information Security/Protection (ASISP) working group, under the FAA's Aviation Rulemaking Advisory Committee. Although the recommendations pertained to manned aircraft, the FAA has reviewed the report and determined the recommendations are also appropriate for UA. The wireless connections used by UA make these aircraft susceptible to the same cyber security risks, and therefore require similar criteria as manned aircraft.

D&R.120 Contingency Planning: The location of the pilot and the controls for the UAS, separate from the UA, is a unique feature to UAS. As a result, no regulatory airworthiness standards exist that directly apply to this feature of the system.

To address the risks associated with loss of communication between the pilot and the UA, and thus the pilot's inability to control the UA, the proposed criteria would require that the UA be designed to automatically execute a predetermined action. Because the pilot needs to be aware of the particular predetermined action the UA will take when there is a loss of communication between the pilot and the UA, the proposed criteria would require that the applicant identify the predetermined action in the UA Flight Manual. The proposed criteria would also include requirements for preventing takeoff when quality of service is inadequate.

D&R.125 Lightning: Because of the size and physical limitations of this UA, it would be unlikely that this UA would incorporate traditional lightning protection features. To address the risks that would result from a lightning strike, the proposed criteria would require an operating limitation in the UA Flight Manual that prohibits flight into weather conditions conducive to lightning. The proposed criteria would also allow design characteristics to protect the UA from lightning as an alternative to the prohibition.

D&R.130 Adverse Weather Conditions: Because of the size and physical limitations of this UA, adverse weather such as rain, snow, and icing pose a greater hazard to the UA than to manned aircraft. For the same reason, it would be unlikely that this UA would incorporate traditional protection features from icing. The FAA based the proposed criteria on the icing requirements in 14 CFR 23.2165(b) and (c) and applied them to all of these adverse weather conditions. The proposed criteria would allow design characteristics to protect the UA from adverse weather conditions. As an alternative, the proposed criteria would require an operating limitation in the UA Flight Manual that prohibits flight into known adverse weather conditions, and either also prevent inadvertent flight into adverse weather or provide a means to detect and to avoid or exit adverse weather conditions.

D&R.135 Flight Essential Parts: The proposed criteria for flight essential parts are substantively the standards for normal category rotorcraft critical parts in § 27.602, with changes to reflect UA terminology and failure conditions. Because part criticality is dependent on safety risk to those onboard the aircraft, the term “flight essential” is used for those components of an unmanned aircraft whose failure may result in loss of flight or unrecoverable loss of UA control.

D&R.140 Reciprocating Engine and Fuel Carriage: Proper storage and movement of fuel onboard the UA is necessary for safe operation. This includes fire prevention and protection, fuel venting and draining, prevention of fuel contamination, and fuel system crashworthiness.

The proposed criteria would require that fluid lines be designed to prevent fires due to high temperature environments. Fuel auto-ignition typically occurs with temperatures in the 450 °F-550 °F range, depending on the fuel type, and oil begins to coke at 300 °F. The proposed criteria would require that fuel lines are fire resistant, as defined in 14 CFR 1.1, at these temperatures to ensure adequate margin between ambient temperatures or hot surfaces and the relevant fluid degradation or ignition temperatures.

The proposed criteria would also require that components be shielded or separated from ignition sources to minimize the possibility of leaking flammable fluids contacting ignition sources and igniting. Ignition sources include hot surfaces with temperatures at or above the typical auto-ignition temperature for aviation fuels, oils, and hydraulic fluids, or any component that produces an electrical discharge. Compliance with the proposed criteria may be shown by installation of drainage shrouds around flammable fluid lines or fittings, installation of spray shields to deflect leaking fuel away from ignition sources, or general component location on the engine that minimizes the possibility of starting and supporting a fire. The applicant's overall substantiation should show that leaked flammable fluid would not likely impinge on an ignition source to the extent of starting and supporting a fire.

The proposed criteria would require adequate and effective ventilation and drainage to prevent the accumulation of fuel or fumes from minor leakage of fuel tanks or lines and minimize the possibility of fire or explosion in these spaces. Component malfunctions that result in a fuel, flammable fluid, or vapor leak should be safely drained or vented overboard to ensure that a fire hazard is not created during either normal or emergency service. Each part of the UA powerplant installation and any other designated fire zone utilizing flammable fluid or vapor carrying components should have the capability for complete, rapid drainage and ventilation. At a minimum, the routing, drainage, and ventilation system should accomplish the following:

(1) It should be effective under normal and emergency operating conditions.

(2) It should be designed and arranged so that no discharged fluid or vapor will create a fire hazard under normal and emergency operating conditions.

(3) It should prevent accumulation of hazardous fluids and vapors in engine compartments and other designated fire zones.

The primary concern with fuel contamination is the introduction of more than trace amounts of water and debris. Rather than requiring specific design features such as sumps, drains, vents, and filters, the proposed criteria require that the UA be designed to prevent hazardous amounts of contamination from reaching the engine. Compliance with this requirement will mitigate the risk of engine failure by addressing fuel contamination before the fuel reaches the engine.

When assessing risk posed by UA, the presence of flammable fluids provides an additional source of potential hazard in the event of an accident due to the possibility of fire, which could spread beyond the immediate impact site of the aircraft. While traditional aircraft considerations with fuel system crashworthiness focuses on occupant protection, the intent of the fuel system crashworthiness for this UA is to ensure crash site containment and prevent the risk of injury or fatality to persons outside the immediate crash site.

The durability and reliability of the engine itself will be demonstrated through the testing required by D&R.300.

Operating Limitations and Information: Similar to manned aircraft, the FAA determined that the UA applicant must provide airworthiness instructions, operating limitations, and flight and performance information necessary for the safe operation and continued operational safety of the UA.

D&R.200 Flight Manual: The proposed criteria for the UA Flight Manual are substantively the same as those in § 23.2620, with minor changes to reflect UA terminology.

D&R.205 Instructions for Continued Airworthiness: The proposed criteria for the Instructions for Continued Airworthiness (ICA) are substantively the same as those in § 23.1529, with minor changes to reflect UA terminology.

Testing: Traditional certification methodologies for manned aircraft are based on design requirements verified at the component level by inspection, analysis, demonstration, or test. Due to the difference in size and complexity, the FAA determined testing methodologies that demonstrate reliability at the aircraft (UA) level, in addition to the design and construction criteria identified in this proposal, will achieve the same safety objective. The proposed testing criteria in sections D&R.300 through D&R.320 utilize these methodologies.

D&R.300 Durability and Reliability: The FAA intends the proposed testing criteria in this section to cover key design aspects and prevent unsafe features at an appropriate level tailored for this UA. The proposed durability and reliability testing would require the applicant to demonstrate safe flight of the UA across the entire operational envelope and up to all operational limitations, for all phases of flight and all aircraft configurations. The UA would only be certificated for operations within the limitations prescribed for its operating environment, as defined in the applicant's proposed CONOPS and demonstrated by test. The FAA intends for this process to be similar to the process for establishing limitations prescribed for special purpose operations for restricted category aircraft. The proposed criteria would require that all flights during the testing be completed with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside of the operator's recovery zone.

For some aircraft design requirements imposed by existing airworthiness standards ( e.g., §§ 23.2135, 23.2600, 25.105, 25.125, 27.141, 27.173, 29.51, 29.177), the aircraft must not require exceptional piloting skill or alertness. These rules recognize that pilots have varying levels of ability and attention. In a similar manner, the proposed criteria would require that the durability and reliability flight testing be performed by a pilot with average skill and alertness.

Flight testing will be used to determine the aircraft's ability to withstand flight loads across the range of operating limits and the flight envelope. Because of the size of this UA, it may be subjected to significant ground loads when handled, lifted, carried, loaded, maintained, and transported physically by hand; therefore, the proposed criteria would require that the aircraft used for testing endure the same worst-case ground loads as those the UA will experience in operation after type certification.

D&R.305 Probable Failures: The FAA intends the proposed testing criteria to evaluate how the UA functions after failures that are probable to occur. The applicant will test the UA by inducing certain failures and demonstrating that the failure will not result in a loss of containment or control of the UA. The proposed criteria contain the minimum types of failures the FAA finds are probable; however, the applicant must determine the probable failures related to any other equipment that will be addressed for this requirement.

D&R.310 Capabilities and Functions: The proposed criteria for this section address the minimum capabilities and functions the FAA finds are necessary in the design of the UA and would require the applicant to demonstrate these capabilities and functions by test. Due to the location of the pilot and the controls for UAS, separate from the UA, communication between the pilot and the UA is significant to the design. Thus, the proposed criteria would require the applicant to demonstrate the capability of the UAS to regain command and control after a loss. As with manned aircraft, the electrical system of the UA must have a capacity sufficient for all anticipated loads; the proposed criteria would require the applicant to demonstrate this by test.

The proposed criteria contain functions that would allow the pilot to command the UA to deviate from its flight plan or from its pre-programmed flight path. For example, in the event the pilot needs to deconflict the airspace, the UA must be able to respond to pilot inputs that override any pre-programming.

In the event an applicant requests approval for certain features, such as geo-fencing or external cargo, the proposed criteria contain requirements to address the associated risks. The proposed criteria in this section would also require design of the UA to safeguard against an unintended discontinuation of flight or release of cargo, whether by human action or malfunction.

D&R.315 Fatigue: The FAA intends the proposed criteria in this section to address the risks from reduced structural integrity and structural failure due to fatigue. The proposed criteria would require the applicant to establish an airframe life limit and demonstrate that loss of flight or loss of control due to structural failure will be avoided throughout the operational life of the UA. These proposed criteria would require the applicant to demonstrate this by test, while maintaining the UA in accordance with the ICA.

D&R.320 Verification of Limits: This section would evaluate structural safety and address the risks associated with inadequate structural design. While the proposed criteria in D&R.300 address testing to demonstrate that the UA structure adequately supports expected loads throughout the flight and operational envelopes, the proposed criteria in this section would require an evaluation of the performance, maneuverability, stability, and control of the UA with a factor of safety.

Applicability

These proposed airworthiness criteria, established under the provisions of § 21.17(b), are applicable to the Model ScanEagle3 UA. Should Insitu Inc. apply at a later date for a change to the type certificate to include another model, these airworthiness criteria would apply to that model as well, provided the FAA finds them appropriate in accordance with the requirements of subpart D to part 21.

Conclusion

This action affects only the airworthiness criteria for one model UA. It is not a standard of general applicability.

Authority Citation

The authority citation for these airworthiness criteria is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

Proposed Airworthiness Criteria

The FAA proposes to establish the following airworthiness criteria for type certification of the Insitu Inc. Model ScanEagle3 UA. The FAA proposes that compliance with the following would mitigate the risks associated with the proposed design and Concept of Operations appropriately and would provide an equivalent level of safety to existing rules:

General

D&R.001 Concept of Operations

The applicant must define and submit to the FAA a concept of operations (CONOPS) proposal describing the unmanned aircraft system (UAS) operation in the National Airspace System for which unmanned aircraft (UA) type certification is requested. The CONOPS proposal must include, at a minimum, a description of the following information in sufficient detail to determine the parameters and extent of testing and operating limitations:

(a) The intended type of operations;

(b) UA specifications;

(c) Meteorological conditions;

(d) Operators, pilots, and personnel responsibilities;

(e) Control station, support equipment, and other associated elements (AE) necessary to meet the airworthiness criteria;

(f) Command, control, and communication functions;

(g) Operational parameters (such as population density, geographic operating boundaries, airspace classes, launch and recovery area, congestion of proposed operating area, communications with air traffic control, line of sight, and aircraft separation); and

(h) Collision avoidance equipment, whether onboard the UA or part of the AE, if requested.

D&R.005 Definitions

For purposes of these airworthiness criteria, the following definitions apply.

(a) Loss of control: Loss of control means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. A loss of control means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristics, or similar occurrence, which could generally lead to crash.

(b) Loss of flight: Loss of flight means a UA's inability to complete its flight as planned, up to and through its originally planned landing. It includes scenarios where the UA experiences controlled flight into terrain, obstacles, or any other collision, or a loss of altitude that is severe or non-reversible. Loss of flight also includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator's designated recovery zone.

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

The UA must be designed to monitor and transmit to the AE all information required for continued safe flight and operation. This information includes, at a minimum, the following:

(a) Status of all critical parameters for all fuel and energy storage systems;

(b) Status of all critical parameters for all propulsion systems;

(c) Flight and navigation information as appropriate, such as airspeed, heading, altitude, and location; and

(d) Communication and navigation signal strength and quality, including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

(a) The applicant must identify and submit to the FAA all AE and interface conditions of the UAS that affect the airworthiness of the UA or are otherwise necessary for the UA to meet these airworthiness criteria. As part of this requirement—

(1) The applicant may identify either specific AE or minimum specifications for the AE.

(i) If minimum specifications are identified, they must include the critical requirements of the AE, including performance, compatibility, function, reliability, interface, operator alerting, and environmental requirements.

(ii) Critical requirements are those that if not met would impact the ability to operate the UA safely and efficiently.

(2) The applicant may use an interface control drawing, a requirements document, or other reference, titled so that it is clearly designated as AE interfaces to the UA.

(b) The applicant must show the FAA that the AE or minimum specifications identified in paragraph (a) of this section meet the following:

(1) The AE provide the functionality, performance, reliability, and information to assure UA airworthiness in conjunction with the rest of the design;

(2) The AE are compatible with the UA capabilities and interfaces;

(3) The AE must monitor and transmit to the operator all information required for safe flight and operation, including but not limited to those identified in D&R.100; and

(4) The minimum specifications, if identified, are correct, complete, consistent, and verifiable to assure UA airworthiness.

(c) The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and Flight Manual.

(d) The applicant must develop any maintenance instructions necessary to address implications from the AE on the airworthiness of the UA. Those instructions will be included in the Instructions for Continued Airworthiness (ICA) required by D&R.205.

D&R.110 Software

To minimize the existence of software errors, the applicant must:

(a) Verify by test all software that may impact the safe operation of the UA;

(b) Utilize a configuration management system that tracks, controls, and preserves changes made to software throughout the entire life cycle; and

(c) Implement a problem reporting system that captures and records defects and modifications to the software.

D&R.115 Cybersecurity

(a) UA equipment, systems, and networks, addressed separately and in relation to other systems, must be protected from intentional unauthorized electronic interactions that may result in an adverse effect on the security or airworthiness of the UA. Protection must be ensured by showing that the security risks have been identified, assessed, and mitigated as necessary.

(b) When required by paragraph (a) of this section, procedures and instructions to ensure security protections are maintained must be included in the ICA.

D&R.120 Contingency Planning

(a) The UA must be designed so that, in the event of a loss of the command and control (C2) link, the UA will automatically and immediately execute a safe predetermined flight, loiter, landing, or termination.

(b) The applicant must establish the predetermined action in the event of a loss of the C2 link and include it in the UA Flight Manual.

(c) The UA Flight Manual must include the minimum performance requirements for the C2 data link, defining when the C2 link is degraded to a level where remote active control of the UA is no longer ensured. Takeoff when the C2 link is degraded below the minimum link performance requirements must be prevented by design or prohibited by an operating limitation in the UA Flight Manual.

D&R.125 Lightning

(a) Except as provided in paragraph (b) of this section, the UA must have design characteristics that will protect the UA from loss of flight or loss of control due to lightning.

(b) If the UA has not been shown to protect against lightning, the UA Flight Manual must include an operating limitation to prohibit flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

(a) For purposes of this section, “adverse weather conditions” means rain, snow, and icing.

(b) Except as provided in paragraph (c) of this section, the UA must have design characteristics that will allow the UA to operate within the adverse weather conditions specified in the CONOPS without loss of flight or loss of control.

(c) For adverse weather conditions for which the UA is not approved to operate, the applicant must develop operating limitations to prohibit flight into known adverse weather conditions and either:

(1) Develop operating limitations to prevent inadvertent flight into adverse weather conditions; or

(2) Provide a means to detect any adverse weather conditions for which the UA is not certificated to operate and show the UA's ability to avoid or exit those conditions.

D&R.135 Flight Essential Parts

(a) A flight essential part is a part, the failure of which could result in a loss of flight or unrecoverable loss of UA control.

(b) If the type design includes flight essential parts, the applicant must establish a flight essential parts list. The applicant must develop and define mandatory maintenance instructions or life limits, or a combination of both, to prevent failures of flight essential parts. Each of these mandatory actions must be included in the Airworthiness Limitations section of the ICA.

D&R.140 Reciprocating Engine and Fuel Carriage

The applicant must show that the engine meets the following requirements.

(a) Lines containing or conveying flammable fluids subject to high temperatures must be fire resistant.

(b) Components must be shielded or located to safeguard against the ignition of leaking flammable fluid.

(c) Compartments, including fuel tanks, where flammable fluid or vapor may exist must have adequate and effective ventilation and drainage.

(d) The powerplant installation must be designed to prevent hazardous amounts of contamination of the fuel supplied to the engine.

(e) The fuel system must protect the UA from damage that could result in spillage of enough fuel to constitute a fire hazard as a result of a reasonably foreseeable UA accident, based on the operating environment documented in the CONOPS.

Operating Limitations and Information

D&R.200 Flight Manual

The applicant must provide a Flight Manual with each UA.

(a) The UA Flight Manual must contain the following information:

(1) UA operating limitations;

(2) UA operating procedures;

(3) Performance information;

(4) Loading information; and

(5) Other information that is necessary for safe operation because of design, operating, or handling characteristics.

(b) Those portions of the UA Flight Manual containing the information specified in paragraph (a)(1) of this section must be approved by the FAA.

D&R.205 Instructions for Continued Airworthiness

The applicant must prepare the ICA for the UA in accordance with Appendix A to Part 23, as appropriate, that are acceptable to the FAA. The ICA may be incomplete at type certification if a program exists to ensure their completion prior to delivery of the first UA or issuance of a standard airworthiness certificate, whichever occurs later.

Testing

D&R.300 Durability and Reliability

The UA must be designed to be durable and reliable when operated under the limitations prescribed for its operating environment, as documented in its CONOPS and included as operating limitations on the type certificate data sheet and in the UA Flight Manual. The durability and reliability must be demonstrated by flight test in accordance with the requirements of this section and completed with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area.

(a) Once a UA has begun testing to show compliance with this section, all flights for that UA must be included in the flight test report.

(b) Tests must include an evaluation of the entire flight envelope across all phases of operation and must address, at a minimum, the following:

(1) Flight distances;

(2) Flight durations;

(3) Route complexity;

(4) Weight;

(5) Center of gravity;

(6) Density altitude;

(7) Outside air temperature;

(8) Airspeed;

(9) Wind;

(10) Weather;

(11) Operation at night, if requested;

(12) Fuel and energy storage system capacity; and

(13) Aircraft to pilot ratio.

(c) Tests must include the most adverse combinations of the conditions and configurations in paragraph (b) of this section.

(d) Tests must show a distribution of the different flight profiles and routes representative of the type of operations identified in the CONOPS.

(e) Tests must be conducted in conditions consistent with the expected environmental conditions identified in the CONOPS, including electromagnetic interference (EMI) and high intensity radiated fields (HIRF).

(f) Tests must not require exceptional piloting skill or alertness.

(g) Any UAS used for testing must be subject to the same worst-case ground handling, shipping, and transportation loads as those allowed in service.

(h) Any UA used for testing must use AE that meet, but do not exceed, the minimum specifications identified under D&R.105. If multiple AE are identified, the applicant must demonstrate each configuration.

(i) Any UAS used for testing must be maintained and operated in accordance with the ICA and UA Flight Manual. No maintenance beyond the intervals established in the ICA will be allowed to show compliance with this section.

(j) If cargo operations or external-load operations are requested, tests must show, throughout the flight envelope and with the cargo or the external load at the most critical combinations of weight and center of gravity, that—

(1) The UA is safely controllable and maneuverable; and

(2) The cargo or the external load is retainable and transportable.

D&R.305 Probable Failures

The UA must be designed such that a probable failure will not result in a loss of containment or control of the UA. This must be demonstrated by test.

(a) Probable failures related to the following equipment, at a minimum, must be addressed:

(1) Propulsion systems;

(2) C2 link;

(3) Global Positioning System (GPS);

(4) Flight control components with a single point of failure;

(5) Control station; and

(6) Any other AE identified by the applicant.

(b) Any UA used for testing must be operated in accordance with the UA Flight Manual.

(c) Each test must occur at the critical phase and mode of flight, and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

(a) All of the following required UAS capabilities and functions must be demonstrated by test:

(1) Capability to regain command and control of the UA after the C2 link has been lost.

(2) Capability of the electrical system to power all UA systems and payloads.

(3) Ability for the pilot to safely discontinue the flight.

(4) Ability for the pilot to dynamically re-route the UA.

(5) Ability to safely abort a takeoff.

(6) Ability to safely abort a landing and initiate a go-around.

(b) The following UAS capabilities and functions, if requested for approval, must be demonstrated by test:

(1) Continued flight after degradation of the propulsion system.

(2) Geo-fencing that contains the UA within a designated area, in all operating conditions.

(3) Positive transfer of the UA between control stations that ensures only one control station can control the UA at a time.

(4) Capability to release an external cargo load to prevent loss of control of the UA.

(5) Capability to detect and avoid other aircraft and obstacles.

(c) The UA must be designed to safeguard against inadvertent discontinuation of the flight and inadvertent release of cargo or external load.

D&R.315 Fatigue

The structure of the UA must be shown to withstand the repeated loads expected during its service life without failure. A life limit for the airframe must be established, demonstrated by test, and included in the ICA.

D&R.320 Verification of Limits

The performance, maneuverability, stability, and control of the UA within the flight envelope described in the UA Flight Manual must be demonstrated at a minimum of 5% over maximum gross weight with no loss of control or loss of flight.

Issued in Washington, DC, on September 29, 2022.

Ian Lucas,

Manager, Policy Implementation Section, Policy and Innovation Division, Aircraft Certification Service.