2022-03864. Airworthiness Criteria: Special Class Airworthiness Criteria for the Zipline International Inc. Zip UAS Sparrow Unmanned Aircraft

AGENCY:

Federal Aviation Administration (FAA), DOT

ACTION:

Issuance of final airworthiness criteria.

SUMMARY:

The FAA announces the special class airworthiness criteria for the Zipline International Inc. Model Zip UAS Sparrow unmanned aircraft (UA). This document sets forth the airworthiness criteria the FAA finds to be appropriate and applicable for the UA design.

DATES:

These airworthiness criteria are effective March 28, 2022.

FOR FURTHER INFORMATION CONTACT:

Christopher J. Richards, Emerging Aircraft Strategic Policy Section, AIR-618, Strategic Policy Management Branch, Policy and Innovation Division, Aircraft Certification Service, Federal Aviation Administration, 6020 28th Avenue South, Room 103, Minneapolis, MN 55450, telephone [phone].

SUPPLEMENTARY INFORMATION:

Background

Zipline International Inc. (Zipline) applied to the FAA on March 25, 2019, for a special class type certificate under Title 14, Code of Federal Regulations (14 CFR) 21.17(b) for the Model Zip UAS Sparrow (Zip) unmanned aircraft system (UAS).

The Model Zip consists of an airplane UA and its associated elements (AE) including communication links and components that control the UA. The Model Zip UA has a maximum gross takeoff weight of 50 pounds. It has a wingspan of approximately 11 feet, is approximately 6 feet in length, and 2 feet in height. The Model Zip UA uses battery-powered electric motors for takeoff, landing, and forward flight. The UAS operations would rely on high levels of automation and may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. Zipline anticipates operators will use the Model Zip for transporting medical materials. The proposed concept of operations (CONOPS) for the Model Zip identifies a maximum operating altitude of 400 feet above ground level (AGL), a maximum cruise speed of 56 knots, operations beyond visual line of sight (BVLOS) of the pilot, and operations over human beings. Zipline has not requested type certification for flight into known icing for the Model Zip.

The FAA issued a notice of proposed airworthiness criteria for the Zipline Model Zip, which published in the Federal Register on November 20, 2020 (85 FR 74285).

Summary of Changes From the Proposed Airworthiness Criteria

Based on the comments received, these final airworthiness criteria reflect the following changes, as explained in more detail under Discussion of Comments: A new section containing definitions; revisions to the CONOPS requirement; changing the term “critical part” to “flight essential part” in D&R.135; changing the basis of the durability and reliability testing from population density to limitations prescribed for the operating environment identified in the applicant's CONOPS per D&R.001; and, for the demonstration of certain required capabilities and functions as required by D&R.310.

Additionally, the FAA re-evaluated its approach to type certification of low-risk UA using durability and reliability testing. Safe UAS operations depend and rely on both the UA and the AE. As explained in FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13, 2021, the FAA has revised the airworthiness criteria to define a boundary between the UA type certification and subsequent operational evaluations and approval processes for the UAS ( i.e., waivers, exemptions, and/or operating certificates).

To reflect that these airworthiness criteria rely on durability and reliability (D&R) testing for certification, the FAA changed the prefix of each section from “UAS” to “D&R.”

Lastly, the FAA revised D&R.001(g) to clarify that the operational parameters listed in that paragraph are examples and not an all-inclusive list.

Discussion of Comments

The FAA received responses from 19 commenters. The majority of commenters were individuals. In addition to the individuals' comments, the FAA also received comments from the European Union Aviation Safety Agency (EASA), unmanned aircraft manufacturers, a helicopter operator, and organizations such as the Air Line Pilots Association (ALPA), the Commercial Drone Alliance (CDA), Droneport Texas, LLC, the National Agricultural Aviation Association (NAAA), Northeast UAS Airspace Integration Research Alliance, Inc. (NUAIR), and the Small UAV Coalition.

Support

Comment Summary: ALPA, CDA, Novant Health, NUAIR, and the Small UAV Coalition expressed support for type certification as a special class of aircraft and establishing airworthiness criteria under § 21.17(b). The Small UAV Coalition also supported the FAA's proposed use of performance-based standards.

Terminology: Loss of flight

Comment Summary: An individual commenter requested the FAA define the term “loss of flight” and clarify how it is different from “loss of control.” The commenter questioned whether loss of flight meant the UA could not continue its intended flight plan but could safely land or terminate the flight.

FAA Response: The FAA has added a new section, D&R.005, to define the terms “loss of flight” and “loss of control” for the purposes of these airworthiness criteria. “Loss of flight” refers to a UA's inability to complete its flight as planned, up to and through its originally planned landing. “Loss of flight” includes scenarios where the UA experiences controlled flight into terrain or obstacles, or any other collision, or a loss of altitude that is severe or non-recoverable. “Loss of flight” includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator's designated recovery zone.

“Loss of control” means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. “Loss of control” means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristic, or similar occurrence, which could generally lead to a crash.

Terminology: Skill and Alertness of Pilot

Comment Summary: Two commenters requested the FAA clarify terminology with respect to piloting skill and alertness. Droneport Texas LLC stated that the average pilot skill and alertness is currently undefined, as remote pilots do not undergo oral or practical examinations to obtain certification. NUAIR noted that, despite the definition of “exceptional piloting skill and alertness” in Advisory Circular (AC) 23-8C, Flight Test Guide for Certification of Part 23 Airplanes, there is a significant difference between the average skill and alertness of a remote pilot certified under 14 CFR part 107 and a pilot certified under 14 CFR part 61. The commenter requested the FAA clarify the minimum qualifications and ratings to perform as a remote pilot of a UAS with a type certificate.

FAA Response: These airworthiness criteria do not require exceptional piloting skill and alertness for testing. The FAA included this as a requirement to ensure the applicant passes testing by using pilots of average skill who have been certificated under part 61, as opposed to highly trained pilots with thousands of hours of flight experience.

Concept of Operations

The FAA proposed a requirement for the applicant to submit a CONOPS describing the UAS and identifying the intended operational concepts. The FAA explained in the preamble of the notice of proposed airworthiness criteria that the information in the CONOPS would determine parameters for testing and flight manual operating limitations.

Comment Summary: One commenter stated that the airworthiness criteria are generic and requested the FAA add language to proposed UAS.001 to clarify that some of the criteria may not be relevant or necessary.

FAA Response: Including the language requested by the commenter would be inappropriate, as these airworthiness criteria are project-specific. Thus, in this case, each element of these airworthiness criteria is a requirement specific to the type certification of Zipline's proposed UA design.

Comment Summary: ALPA requested the criteria specify that the applicant's CONOPS contain sufficient detail to determine the parameters and extent of testing, as well as operating limitations placed on the UAS for its operational uses.

FAA Response: The FAA agrees and has updated D&R.001 to clarify that the information required for inclusion in the CONOPS proposal (D&R.001(a) through (g)) must be described in sufficient detail to determine the parameters and extent of testing and operating limitations.

Comment Summary: ALPA requested the CONOPS include a description of a means to ensure separation from other aircraft and perform collision avoidance maneuvers. ALPA stated that its requested addition to the CONOPS is critical to the safety of other airspace users, as manned aircraft do not easily see most UAs.

FAA Response: The FAA agrees and has updated D&R.001 to require that the applicant identify collision avoidance equipment (whether onboard the UA or part of the AE), if the applicant requests to include that equipment.

Comment Summary: ALPA requested the FAA add security-related (other than cyber-security) requirements to the CONOPS criteria, including mandatory reporting of security occurrences, security training and awareness programs for all personnel involved in UAS operations, and security standards for the transportation of goods, similar to those for manned aviation.

FAA Response: The type certificate only establishes the approved design of the UA. Operations and operational requirements, including those regarding security occurrences, security training, and package delivery security standards (other than cybersecurity airworthiness design requirements) are beyond the scope of the airworthiness criteria established by this document and are not required for type certification.

Comment Summary: UAS.001(c) proposed to require that the applicant's CONOPS include a description of meteorological conditions. ALPA requested the FAA change UAS.001(c) to require a description of meteorological and environmental conditions and their operational limits. ALPA stated the CONOPS should include maximum wind speeds, maximum or minimum temperatures, maximum density altitudes, and other relevant phenomena that will limit operations or cause operations to terminate.

FAA Response: D&R.001(c) and D&R.125 address meteorological conditions, while D&R.001(g) addresses environmental considerations. The FAA determined that these criteria are sufficient to cover the weather phenomena mentioned by the commenter without specifically requiring identification of related operational limits.

Control Station

To address the risks associated with loss of control of the UA, the FAA proposed that the applicant design the control station to provide the pilot with all information necessary for continued safe flight and operation.

Comment Summary: ALPA and two individual commenters requested the FAA revise the proposed criteria to add requirements for the control station. Specifically, these commenters requested the FAA include the display of data and alert conditions to the pilot, physical security requirements for both the control station and the UAS storage area, design requirements that minimize negative impact of extended periods of low pilot workload, transfer of control between pilots, and human factors/human machine interface considerations for handheld controls. NUAIR requested the FAA designate the control station as a flight critical component for operations.

EASA and an individual commenter requested the FAA consider flexibility in some of the proposed criteria. EASA stated that the list of information in proposed UAS.100 is too prescriptive and contains information that may not be relevant for highly automated systems. The individual commenter requested that the FAA allow part-time or non-continuous displays of required information that do not influence the safety of the flight.

FAA Response: Although the scope of the proposed airworthiness criteria applied to the entire UAS, the FAA has re-evaluated its approach to type certification of low-risk unmanned aircraft using durability and reliability testing. A UA is an aircraft that is operated without the possibility of direct human intervention from within or on the aircraft.^[1] A UAS is defined as a UA and its AE, including communication links and the components that control the UA, that are required to operate the UAS safely and efficiently in the national airspace system.^[2] As explained in FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13, 2021, the FAA determined it will apply the regulations for type design approval, production approval, conformity, certificates of airworthiness, and maintenance to only the UA and not to the AE. However, because safe UAS operations depend and rely on both the UA and the AE, the FAA will consider the AE in assessing whether the UA meets the airworthiness criteria that comprise the certification basis.

While the AE items themselves will be outside the scope of the UA type design, the applicant will provide sufficient specifications for any aspect of the AE, including the control station, which could affect airworthiness. The FAA will approve either the specific AE or minimum specifications for the AE, as identified by the applicant, as part of the type certificate by including them as an operating limitation in the type certificate data sheet and flight manual. The FAA may impose additional operating limitations specific to the AE through conditions and limitations for inclusion in the operational approval ( i.e., waivers, exemptions, or a combination of these). In accordance with this approach, the FAA will consider the entirety of the UAS for operational approval and oversight.

Accordingly, the FAA has revised the criteria by replacing proposed section UAS.100, applicable to the control station design, with D&R.100, UA Signal Monitoring and Transmission, with substantively similar criteria that apply to the UA design. The FAA has also added a new section, D&R.105, UAS AE Required for Safe UA Operations, which requires the applicant to provide information concerning the specifications of the AE. The FAA has moved the alert function requirement proposed in UAS.100(a) to new section D&R.105(a)(1)(i). As part of the clarification of the testing of the interaction between the UA and AE, the FAA has added a requirement to D&R.300(h) for D&R testing to use minimum specification AE. This addition requires the applicant to demonstrate that the limits proposed for those AE will allow the UA to operate as expected throughout its service life. Finally, the FAA has revised references throughout the airworthiness criteria from “UAS” to “UA,” as appropriate, to reflect the FAA determination that the regulations for type design approval, production approval, conformity, certificates of airworthiness, and maintenance apply to only the UA.

Software

The FAA proposed criteria on verification, configuration management, and problem reporting to minimize the existence of errors associated with UAS software.

Comment Summary: ALPA requested the FAA add language to the proposed criteria to ensure that some level of software engineering principles are used without being too prescriptive.

FAA Response: By combining the software testing requirement of D&R.110(a) with successful completion of the requirements in the entire “Testing” subpart, the acceptable level of software assurance will be identified and demonstrated. The configuration management system required by D&R.110(b) will ensure that the software is adequately documented and traceable both during and after the initial type certification activities.

Comment Summary: EASA suggested the criteria require that the applicant establish and correctly implement system requirements or a structured software development process for critical software.

FAA Response: Direct and specific evaluation of the software development process is more detailed than what the FAA intended with the proposed criteria, which use D&R testing to evaluate the UAS as a whole system, rather than evaluating individual components within the UA. Successful completion of the testing requirements provides confidence that the components that make up the UA provide an acceptable level of safety, commensurate to the low-risk nature of this aircraft. The FAA finds no change to the airworthiness criteria is needed.

Comment Summary: Two individual commenters requested the FAA require the manned aircraft software certification methodology in RTCA DO-178C, Software Considerations in Airborne Systems and Equipment Certification, for critical UA software.

FAA Response: Under these airworthiness criteria, only software that may affect the safe operation of the UA must be verified by test. To verify by test, the applicant will need to provide an assessment showing that other software is not subject to testing because it has no impact on the safe operation of the UA. For software that is subject to testing, the FAA may accept multiple options for software qualification, including DO-178C. Further, specifying that applicants must comply with DO-178 would be inconsistent with the FAA's intent to issue performance-based airworthiness criteria.

Comment Summary: NAAA stated that an overreliance of software in aircraft has been and continues to be a source of accidents and requested the FAA include criteria to prevent a midair collision.

FAA Response: The proper functioning of software is an important element of type certification, particularly with respect to flight controls and navigation. The airworthiness criteria in D&R.110 are meant to provide an acceptable level of safety commensurate with the risk posed by this UA. Additionally, the airworthiness criteria require contingency planning per D&R.120 and the demonstration of the UA's ability to detect and avoid other aircraft in D&R.310, if requested by the applicant. The risk of a midair collision will be minimized by the operating limitations that result from testing based on the operational parameters identified by the applicant in its CONOPS (such as geographic operating boundaries, airspace classes, and congestion of the proposed operating area), rather than by specific mitigations built into the aircraft design itself. These criteria are sufficient due to the low-risk nature of the Model Zip.

Cybersecurity

Because the UA requires a continuous wireless connection, the FAA proposed criteria to address the risks to the UAS from cybersecurity threats.

Comment Summary: ALPA requested adding a requirement for cybersecurity protection for navigation and position reporting systems such as Global Navigation Satellite System (GNSS). ALPA further requested the FAA include criteria to address specific cybersecurity vulnerabilities, such as jamming (denial of signal) and spoofing (false position data is inserted). ALPA stated that, for navigation, UAS primarily use GNSS—an unencrypted, open-source, low power transmission that can be jammed, spoofed, or otherwise manipulated.

FAA Response: The FAA will assess elements directly influencing the UA for cybersecurity under D&R.115 and will assess the AE as part of any operational approvals an operator may seek. D&R.115 (proposed as UAS.115) addresses intentional unauthorized electronic interactions, which includes, but is not limited to, hacking, jamming, and spoofing. These airworthiness criteria require the high-level outcome the UA must meet, rather than discretely identifying every aspect of cybersecurity the applicant will address.

Contingency Planning

The FAA proposed criteria requiring that the UAS be designed to automatically execute a predetermined action in the event of a loss of communication between the pilot and the UA. The FAA further proposed that the predetermined action be identified in the Flight Manual and that the UA be precluded from taking off when the quality of service is inadequate.

Comment Summary: ALPA requested the criteria encompass more than loss or degradation of the command and control (C2) link, as numerous types of critical part or systems failures can occur that include degraded capabilities, whether intermittent or sustained. ALPA requested the FAA add language to the proposed criteria to address specific failures such as loss of a primary navigation sensor, degradation or loss of navigation capability, and simultaneous impact of C2 and navigation links.

FAA Response: The airworthiness criteria address the issues raised by the commenter. Specifically, D&R.120(a) addresses actions the UA will automatically and immediately take when the operator no longer has control of the UA. Should the specific failures identified by ALPA result in the operator's loss of control, then the criteria require the UA to execute a predetermined action. Degraded navigation performance does not raise the same level of concern as a degraded or lost C2 link. For example, a UA may experience interference with a GPS signal on the ground, but then find acceptable signal strength when above a tree line or other obstruction. The airworthiness criteria require that neither degradation nor complete loss of GPS or C2, as either condition would be a failure of that system, result in unsafe loss of control or containment. The applicant must demonstrate this by test to meet the requirements of D&R.305(a)(3).

Under the airworthiness criteria, the minimum performance requirements for the C2 link, defining when the link is degraded to an unacceptable level, may vary among different UAS designs. The level of degradation that triggers a loss is dependent upon the specific UA characteristics; this level will be defined by the applicant and demonstrated to be acceptable by testing as required by D&R.305(a)(2) and D&R.310(a)(1).

Comment Summary: An individual commenter requested the FAA use distinct terminology for “communication,” used for communications with air traffic control, and “C2 link,” used for command and control between the remote pilot station and UA. The commenter questioned whether, in the proposed criteria, the FAA stated “loss of communication between the pilot and the UA” when it intended to state “loss of C2 link.”

FAA Response: Communication extends beyond the C2 link and specific control inputs. This is why D&R.001 requires the applicant's CONOPS to include a description of the command, control, and communications functions. As long as the UA operates safely and predictably per its lost link contingency programming logic, a C2 interruption does not constitute a loss of control.

Lightning

The FAA proposed criteria to address the risks that would result from a lightning strike, accounting for the size and physical limitations of a UAS that could preclude traditional lightning protection features. The FAA further proposed that without lightning protection for the UA, the Flight Manual must include an operating limitation to prohibit flight into weather conditions with potential lightning.

Comment Summary: An individual requested the FAA revise the criteria to include a similar design mitigation or operating limitation for High Intensity Radiated Fields (HIRF). The commenter noted that HIRF is included in proposed UAS.300(e) as part of the expected environmental conditions that must be replicated in testing.

FAA Response: The airworthiness criteria, which are adopted as proposed, address the issue raised by the commenter. The applicant must identify tested HIRF exposure capabilities, if any, in the Flight Manual to comply with the criteria in D&R.200(a)(5). Information regarding HIRF capabilities is necessary for safe operation because proper communication and software execution may be impeded by HIRF-generated interference, which could result in loss of control of the UA. It is not feasible to measure HIRF at every potential location where the UA will operate; thus, requiring operating limitations for HIRF as requested by the commenter would be impractical.

Adverse Weather Conditions

The FAA proposed criteria either requiring that design characteristics protect the UAS from adverse weather conditions or prohibiting flight into known adverse weather conditions. The criteria proposed to define adverse weather conditions as rain, snow, and icing.

Comment Summary: ALPA and two individual commenters requested the FAA expand the proposed definition of adverse weather conditions. These commenters noted that because of the size and physical limitations of the Model Zip, adverse weather should also include wind, downdraft, low-level wind shear (LLWS), microburst, and extreme mechanical turbulence.

FAA Response: No additional language needs to be added to the airworthiness criteria to address wind effects. The wind conditions specified by the commenters are part of normal UA flight operations. The applicant must demonstrate by flight test that the UA can withstand wind without failure to meet the requirements of D&R.300(b)(9). The FAA developed the criteria in D&R.130 to address adverse weather conditions (rain, snow, and icing) that would require additional design characteristics for safe operation. Any operating limitations necessary for operation in adverse weather or wind conditions will be included in the Flight Manual as required by D&R.200.

Comment Summary: One commenter questioned whether the criteria proposed in UAS.130(c)(2), requiring a means to detect adverse weather conditions for which the UAS is not certificated to operate, is a prescriptive requirement to install an onboard detection system. The commenter requested, if that was the case, that the FAA allow alternative procedures to avoid flying in adverse weather conditions.

FAA Response: The language referred to by the commenter is not a prescriptive design requirement for an onboard detection system. The applicant may use any acceptable source to monitor weather in the area, whether onboard the UA or from an external source.

Critical Parts

The FAA proposed criteria for critical parts that were substantively the same as those in the existing standards for normal category rotorcraft under § 27.602, with changes to reflect UAS terminology and failure conditions. The criteria proposed to define a critical part as a part, the failure of which could result in a loss of flight or unrecoverable loss of control of the aircraft.

Comment Summary: EASA requested the FAA avoid using the term “critical part,” as it is a well-established term for complex manned aircraft categories and may create incorrect expectations on the oversight process for parts.

FAA Response: For purposes of the airworthiness criteria established for the Zipline Model Zip, the FAA has changed the term “critical part” to “flight essential part.”

Comment Summary: An individual commenter requested the FAA revise the proposed criteria such that a failure of a flight essential part would only occur if there is risk to third parties.

FAA Response: The definition of “flight essential” does not change regardless of whether on-board systems are capable of safely landing the UA when it is unable to continue its flight plan. Tying the definition of a flight essential part to the risk to third parties would result in different definitions for the part depending on where and how the UA is operated. These criteria for the Model Zip UA apply the same approach as for manned aircraft.

Comment Summary: An individual commenter requested the FAA add a requirement to D&R.135 (proposed as UAS.135) for the applicant to define all elements of type design, including the vehicle, control station, C2 link, and launch and recovery equipment. The commenter stated that an approved type design will be necessary for inspection and conformity by the FAA, as well as for continued airworthiness.

FAA Response: These airworthiness criteria do not change the requirements under part 21 for the information an applicant must include in its application for a type certificate. As the FAA explained in the notice of proposed airworthiness criteria, the FAA has developed these criteria to establish safety outcomes that must be achieved, rather than prescriptive design requirements that must be met. The type certificate will include any necessary operating limitations, such as those prohibiting conditions under which the UA is not approved to operate ( e.g., lightning, adverse weather). Similarly, while the AE items (such as the control station, C2 link, and launch and recovery equipment) will be outside the scope of the UA type design, the AE will be included as an operating limitation in the type certificate data sheet and flight manual, and therefore approved as part of the type certificate. Responsibilities for continued operational safety will apply to the UA as provided in 14 CFR part 21.

Flight Manual

The FAA proposed criteria for the Flight Manual that were substantively the same as the existing standards for normal category airplanes, with minor changes to reflect UAS terminology.

Comment Summary: ALPA requested the FAA revise the criteria to include normal, abnormal, and emergency operating procedures along with their respective checklist. ALPA further requested the checklist be contained in a quick reference handbook (QRH).

FAA Response: The FAA did not intend for the airworthiness criteria to exclude abnormal procedures from the flight manual. In these final airworthiness criteria, the FAA has changed “normal and emergency operating procedures” to “operating procedures” to encompass all operating conditions and align with 14 CFR 23.2620, which includes the airplane flight manual requirements for normal category airplanes. The FAA has not made any changes to add language that would require the checklists to be included in a QRH. FAA regulations do not require manned aircraft to have a QRH for type certification. Therefore, it would be inconsistent for the FAA to require a QRH for the Zipline Model Zip UA.

Comment Summary: ALPA requested the FAA revise the airworthiness criteria to require that the Flight Manual and QRH be readily available to the pilot at the control station.

FAA Response: ALPA's request regarding the Flight manual addresses an operational requirement, similar to 14 CFR 91.9 and is therefore not appropriate for type certification airworthiness criteria. Also, as previously discussed, FAA regulations do not require a QRH. Therefore, it would be inappropriate to require it to be readily available to the pilot at the control station.

Comment Summary: Droneport Texas LLC requested the FAA revise the airworthiness criteria to add required Flight Manual sections for routine maintenance and mission-specific equipment and procedures. The commenter stated that the remote pilot or personnel on the remote pilot-in-command's flight team accomplish most routine maintenance, and that the flight team usually does UA rigging with mission equipment.

FAA Response: The requested change is appropriate for a maintenance document rather than a flight manual because it addresses maintenance procedures rather than the piloting functions. The FAA also notes that, similar to the criteria for certain manned aircraft, the airworthiness criteria require that the applicant prepare instructions for continued airworthiness (ICA) in accordance with Appendix A to Part 23. As the applicant must provide any maintenance instructions and mission-specific information necessary for safe operation and continued operational safety of the UA, in accordance with D&R.205, no changes to the airworthiness criteria are necessary.

Comment Summary: An individual commenter requested the FAA revise the criteria in proposed UAS.200(b) to require that “other information” referred to in proposed UAS.200(a)(5) be approved by the FAA. The commenter noted that, as proposed, only the information listed in UAS.200(a)(1) through (4) must be FAA approved.

FAA Response: The change requested by the commenter would be inconsistent with the FAA's airworthiness standards for flight manuals for manned aircraft. Sections 23.2620(b), 25.1581(b), 27.1581(b), and 29.1581(b) include requirements for flight manuals to include operating limitations, operating procedures, performance information, loading information, and other information that is necessary safe operation because of design, operating, or handling characteristics, but limit FAA approval to operating limitations, operating procedures, performance information, and loading information.

Under § 23.2620(b)(1), for low-speed level 1 and level 2 airplanes, the FAA only approves the operating limitations. In applying a risk-based approach, the FAA has determined it would not be appropriate to hold the lowest risk UA to a higher standard than what is required for low speed level 1 and level 2 manned aircraft. Accordingly, the FAA has revised the airworthiness criteria to only require FAA approval of the operating limitations.

Comment Summary: NUAIR requested the FAA recognize that § 23.2620 is only applicable to the aircraft and does not address off-aircraft components such as the control station, control and non-payload communications (CNPC) data link, and launch and recovery equipment. The commenter noted that this is also true of industry consensus-based standards designed to comply with § 23.2620.

FAA Response: As explained in more detail in the Control Station section of this document, the FAA has revised the airworthiness criteria for the AE. The FAA will approve AE or minimum specifications for the AE that could affect airworthiness as an operating limitation in the UA flight manual. The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and Flight Manual in accordance with D&R.105(c). The establishment of requirements for, and the approval of AE will be in accordance with FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13, 2021.

Durability and Reliability

The FAA proposed durability and reliability testing that would require the applicant to demonstrate safe flight of the UAS across the entire operational envelope and up to all operational limitations, for all phases of flight and all aircraft configurations described in the applicant's CONOPS, with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area. The FAA further proposed that the unmanned aircraft would only be certificated for operations within the limitations, and for flight over areas no greater than the maximum population density, as described in the applicant's CONOPS and demonstrated by test.

Comment Summary: ALPA requested that the proposed certification criteria require all flights during testing be completed in both normal and non-normal or off-nominal scenarios with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside of the operator's recovery zone. Specifically, ALPA stated that testing must not require exceptional piloting skill or alertness and include, at a minimum: All phases of the flight envelope, including the highest UA to pilot ratios; the most adverse combinations of the conditions and configuration; the environmental conditions identified in the CONOPS; the different flight profiles and routes identified in the CONOPS; and exposure to EMI and HIRF.

FAA Response: No change is necessary because the introductory text and paragraphs (b)(7), (b)(9), (b)(10), (b)(13), (c), (d), (e), and (f) of D&R.300, which are adopted as proposed, contain the specific testing requirements requested by ALPA.

Comment Summary: Droneport Texas LLC requested the FAA revise the testing criteria to include, for operation at night, testing both with and without night vision aids. The commenter stated that because small UAS operation at night is waivable under 14 CFR part 107, manufacturers will likely make assumptions concerning a pilot's familiarity with night vision device-aided and unaided operations.

FAA Response: Under D&R.300(b)(11), the applicant must demonstrate by flight test that the UA can operate at night without failure using whatever equipment is onboard the UA itself. The pilot's familiarity, or lack thereof, with night vision equipment does not impact whether the UA is reliable and durable to complete testing without any failures.

Comment Summary: EASA requested the FAA clarify how testing durability and reliability commensurate to the maximum population density, as proposed, aligns with the Specific Operations Risk Assessment (SORA) approach that is open to operational mitigation, reducing the initial ground risk. An individual commenter requested the FAA provide more details about the correlation between the number of flight hours tested and the CONOPS environment ( e.g., population density). The commenter stated that this is one of the most fundamental requirements, and the FAA should ensure equal treatment to all current and future applicants.

FAA Response: In developing these testing criteria, the FAA sought to align the risk of UAS operations with the appropriate level of protection for human beings on the ground. The FAA proposed establishing the maximum population density demonstrated by durability and reliability testing as an operating limitation on the type certificate. However, the FAA has re-evaluated its approach and determined it to be more appropriate to connect the durability and reliability demonstrated during certification testing with the operating environment defined in the CONOPS.

Basing testing on maximum population density may result in limitations not commensurate with many actual operations. As population density broadly refers to the number of people living in a given area per square mile, it does not allow for evaluating variation in a local operating environment. For example, an operator may have a route in an urban environment with the actual flight path along a greenway; the number of human beings exposed to risk from the UA operating overhead would be significantly lower than the population density for the area. Conversely, an operator may have a route over an industrial area where few people live, but where, during business hours, there may be highly dense groups of people. Specific performance characteristics such as altitude and airspeed also factor into defining the boundaries for safe operation of the UA.

Accordingly, the FAA has revised D&R.300 to require the UA design to be durable and reliable when operated under the limitations prescribed for its operating environment. The information in the applicant's CONOPS will determine the operating environment for testing. For example, the minimum hours of reliability testing will be less for a UA conducting agricultural operations in a rural environment than if the same aircraft will be conducting package deliveries in an urban environment. The FAA will include the limitations that result from testing as operating limitations on the type certificate data sheet and in the UA Flight Manual. The FAA intends for this process to be similar to the process for establishing limitations prescribed for special purpose operations for restricted category aircraft. This allows for added flexibility in determining appropriate operating limitations, which will more closely reflect the operating environment.

Finally, a comparison of these criteria with EASA's SORA approach is beyond the scope of this document because the SORA is intended to result in an operational approval rather than a type certificate.

Comment Summary: EASA requested the FAA clarify how reliability at the aircraft level to ensure high-level safety objectives would enable validation of products under applicable bilateral agreements.

FAA Response: As the FAA and international aviation authorities are still developing general airworthiness standards for UA, it would be speculative for the FAA to comment on the validation process for any specific UA.

Comment Summary: EASA requested the FAA revise the testing criteria to include a compliance demonstration related to adverse combinations of the conditions and configurations and with respect to weather conditions and average pilot qualification.

FAA Response: No change is necessary because D&R.300(b)(7), (b)(9), (b)(10), (c), and (f), which are adopted as proposed, contain the specific testing requirements requested by EASA.

Comment Summary: EASA noted that, under the proposed criteria, testing involving a large number of flight hours will limit changes to the configuration.

FAA Response: Like manned aircraft, the requirements of 14 CFR part 21, subpart D, apply to UA for changes to type certificates. The FAA is developing procedures for processing type design changes for UA type certificated using durability and reliability testing.

Comment Summary: EASA requested the FAA clarify whether the proposed testing criteria would require the applicant to demonstrate aspects that do not occur during a successful flight, such as the deployment of emergency recovery systems and fire protection/post-crash fire. EASA asked if these aspects are addressed by other means and what would be the applicable airworthiness criteria.

FAA Response: Equipment not required for normal operation of the UA do not require an evaluation for their specific functionality. D&R testing will show that the inclusion of any such equipment does not prevent normal operation. Therefore, the airworthiness criteria would not require functional testing of the systems described by EASA.

Comment Summary: An individual commenter requested the FAA specify the acceptable percentage of failures in the testing that would result in a “loss of flight.” The Small UAV Coalition requested the FAA clarify what constitutes an emergency landing outside an operator's landing area, as some UAS designs could include an onboard health system that initiates a landing to lessen the potential of a loss of control event. The commenter suggested that, in those cases, a landing in a safe location should not invalidate the test.

FAA Response: The airworthiness criteria require that all test points and flight hours occur with no failures result in a loss of flight, control, containment, or emergency landing outside the operator's recovery zone. The FAA has determined that there is no acceptable percentage of failures in testing. In addition, while the recovery zone may differ for each UAS design, an emergency or unplanned landing outside of a designated landing area would result in a test failure.

Comment Summary: The Small UAV Coalition requested that a single failure during testing not automatically restart counting the number of flight test operations set for a particular population density; rather, the applicant should have the option to identify the failure through root-cause and fault-tree analysis and provide a validated mitigation to ensure it will not recur. An individual commenter requested the FAA to clarify whether the purpose of the tests is to show compliance with a quantitative safety objective. The commenter further requested the FAA allow the applicant to reduce the number of flight testing hours if the applicant can present a predicted safety and reliability analysis.

FAA Response: The intent of the testing criteria is for the applicant to demonstrate the aircraft's durability and reliability through a successful accumulation of flight testing hours. The FAA does not intend to require analytical evaluation to be part of this process. However, the applicant will comply with these testing criteria using a means of compliance, accepted by the FAA, through the issue paper process. The means of compliance will be dependent on the CONOPS the applicant has proposed to meet.

Probable Failures

The FAA proposed criteria to evaluate how the UAS functions after probable failures, including failures related to propulsion systems, C2 link, GPS, critical flight control components with a single point of failure, control station, and any other equipment identified by the applicant.

Comment Summary: Droneport Texas LLC requested the FAA add a bird strike to the list of probable failures. The commenter stated that despite sense and avoid technologies, flocks of birds can overcome the maneuver capabilities of a UA and result in multiple, unintended failures.

FAA Response: Unlike manned aircraft, where aircraft size, design, and construct are critical to safe control of the aircraft after encountering a bird strike, the FAA determined testing for bird strike capabilities is not necessary for the Model Zip UA. The FAA has determined that a bird strike requirement is not necessary because the smaller size and lower operational speed of the Zip reduce the likelihood of a bird strike, combined with the reduced consequences of failure due to no persons onboard. Instead, the FAA is using a risk-based approach to tailor airworthiness requirements commensurate to the low-risk nature of the Model Zip UA.

Comment Summary: ALPA requested the FAA require that all probable failure tests occur at the critical phase and mode of flight and at the highest aircraft-to-pilot ratio. ALPA stated the proposed criteria are critically important for systems that rely on a single source to perform multi-label functions, such as GNSS, because failure or interruption of GNSS will lead to loss of positioning, navigation, and timing (PNT) and functions solely dependent on PNT, such as geo-fencing and contingency planning.

FAA Response: No change is necessary because D&R.300(c) requires that the testing occur at the critical phase and mode of flight and at the highest UA-to-pilot ratio.

Comment Summary: Droneport Texas LLC requested the FAA add recovery from vortex ring state (VRS) to the list of probable failures. The commenter stated the UA uses multiple rotors for lift and is therefore susceptible to VRS. The commenter further stated that because recovery from settling with power is beyond a pilot's average skill for purposes of airworthiness testing, the aircraft must be able to sense and recover from this condition without pilot assistance.

FAA Response: D&R.305 addresses probable failures related to specific components of the UAS. VRS is an aerodynamic condition a UA may encounter during flight testing; it is not a component subject to failure.

Comment Summary: Droneport Texas LLC also requested the FAA add a response to the Air Traffic Control-Zero (ATC-Zero) command to the list of probable failures. The commenter stated, based on lessons learned after the attacks on September 11, 2001, aircraft that can fly BVLOS should be able to respond to an ATC-Zero condition.

FAA Response: The commenter's request is more appropriate for the capabilities and functions testing criteria in D&R.310 than probable failures testing in D&R.305. D&R.310(a)(3) requires the applicant to demonstrate by test that the pilot has the ability to safely discontinue a flight. A pilot may discontinue a flight for a wide variety of reasons, including responding to an ATC-zero command.

Comment Summary: EASA stated the proposed language seems to require an additional analysis and safety assessment, which would be appropriate for the objective requirement of ensuring a probable failure does not result in a loss of containment or control. EASA further stated that an applicant's basic understanding of the systems architecture and effects of failures is essential.

FAA Response: The FAA agrees with the expectation that applicants understand the system architecture and effects of failures of a proposed design, which is why the criteria include a requirement for the applicant to test the specific equipment identified in D&R.305 and identify any other equipment that is not specifically identified in D&R.305 for testing. As the intent of the criteria is for the applicant to demonstrate compliance through testing, some analysis may be necessary to properly identify the appropriate equipment to be evaluated for probable failures.

Comment Summary: An individual requested that probable failure testing apply not only to critical flight control components with a single point of failure, but also to any critical part with a single point of failure.

FAA Response: The purpose of probable failure testing in D&R.305 is to demonstrate that if certain equipment fails, it will fail safely. Adding probable failure testing for critical (now flight essential) parts would not add value to testing. If a part is essential for flight, its failure by definition in D&R.135(a) could result in a loss of flight or unrecoverable loss of control. For example, on a traditional airplane design, failure of a wing spar in flight would lead to loss of the aircraft. Because there is no way to show that a wing spar can fail safely, the applicant must provide its mandatory replacement time if applicable, structural inspection interval, and related structural inspection procedure in the Airworthiness Limitations section of the ICA. Similarly, under these airworthiness criteria, parts whose failure would inherently result in loss of flight or unrecoverable loss of control are not subjected to probable failure testing. Instead, they must be identified as flight essential components and included in the ICA.

To avoid confusion pertaining to probable failure testing, the FAA has removed the word “critical” from D&R.305(a)(5). In the final airworthiness criteria, probable failure testing required by D&R.305(a)(5) applies to “Flight control components with a single point of failure.”

Capabilities and Functions

The FAA proposed criteria to require the applicant to demonstrate by test the minimum capabilities and functions necessary for the design. UAS.310(a) proposed to require the applicant to demonstrate, by test, the capability of the UAS to regain command and control of the UA after a C2 link loss, the sufficiency of the electrical system to carry all anticipated loads, and the ability of the pilot to override any pre-programming in order to resolve a potential unsafe operating condition in any phase of flight. UAS.310(b) proposed to require the applicant to demonstrate by test certain features if the applicant requests approval of those features (geo-fencing, external cargo, etc.). UAS.310(c) proposed to require the design of the UAS to safeguard against an unintended discontinuation of flight or release of cargo, whether by human action or malfunction.

Comment Summary: ALPA stated the pilot-in-command must always have the capability to input control changes to the UA and override any pre-programming without delay as needed for the safe management of the flight. The commenter requested that the FAA retain the proposed criteria that would allow the pilot to command to: Regain command and control of the UA after loss of the C2 link; safely discontinue the flight; and dynamically re-route the UA. In support, ALPA stated the ability of the pilot to continually command (re-route) the UA, including termination of the flight if necessary, is critical for safe operations and should always be available to the pilot.

Honeywell requested the FAA revise paragraphs (a)(3) and (a)(4) of the criteria (UAS.310) to allow for either the pilot or an augmenting system to safely discontinue the flight and re-route the UA. The commenter stated that a system comprised of detect and avoid, onboard autonomy, and ground system can be used for these functions. Therefore, the criteria should not require that only the pilot can do them.

An individual commenter requested the FAA remove UAS.310(a)(4) of the proposed criteria because requiring the ability for the pilot to dynamically re-route the UA is too prescriptive and redundant with the proposed requirement in UAS.310(a)(3), the ability of the pilot to discontinue the flight safely.

FAA Response: Because the pilot in command is directly responsible for the operation of the UA, the pilot must have the capability to command actions necessary for continued safety. This includes commanding a change to the flight path or, when appropriate, safely terminating a flight. The FAA notes that the ability for the pilot to safely discontinue a flight means the pilot has the means to terminate the flight and immediately and safely return the UA to the ground. This is different from the pilot having the means to dynamically re-route the UA, without terminating the flight, to avoid a conflict.

Therefore, the final airworthiness criteria include D&R.310(a) as proposed (UAS.310(a)).

Comment Summary: ALPA requested the FAA revise the criteria to require that all equipment, systems, and installations conform, at a minimum, to the standards of § 25.1309.

FAA Response: The FAA determined that traditional methodologies for manned aircraft, including the system safety analysis required by §§ 23.2510, 25.1309, 27.1309, or 29.1309, would be inappropriate to require for the Zipline Model Zip due to its smaller size and reduced level of complexity. Instead, the FAA finds that system reliability through testing will ensure the safety of this design.

Comment Summary: ALPA requested the FAA revise the criteria to add a requirement to demonstrate the ability of the UA and pilot to perform all of the contingency plans identified in proposed UAS.120.

FAA Response: No change is necessary because D&R.120 and D&R.305(a)(2), together, require what ALPA requests in its comment. Under D&R.120, the applicant must design the UA to execute a predetermined action in the event of a loss of the C2 link. D&R.305(a)(2) requires the applicant to demonstrate by test that a lost C2 link will not result in a loss of containment or control of the UA. Thus, if the applicant does not demonstrate the predetermined contingency plan resulting from a loss of the C2 link when conducting D&R.305 testing, the test would be a failure due to loss of containment.

Comment Summary: ALPA and an individual commenter requested the FAA revise the criteria so that geo-fencing is a required feature and not optional due to the safety concerns that could result from a UA exiting its operating area.

FAA Response: To ensure safe flight, the applicant must test the proposed safety functions, such as geo-fencing, that are part of the type design of the Model Zip UA. The FAA determined that geo-fencing is an optional feature because it is one way, but not the only way, to ensure a safely contained operation.

Comment Summary: ALPA requested the FAA revise the criteria so that capability to detect and avoid other aircraft and obstacles is a required feature and not optional.

FAA Response: D&R.310(a)(4) requires the applicant demonstrate the ability for the pilot to safely re-route the UA in flight to avoid a dynamic hazard. The FAA did not prescribe specific design features such as a collision avoidance system to meet D&R.310(a)(4) because there are multiple means to minimize the risk of collision.

Comment Summary: McMahon Helicopter Services requested that the airworthiness criteria require a demonstration of sense-and-avoid technology that will automatically steer the UA away from manned aircraft, regardless of whether the manned aircraft has a transponder. NAAA and an individual commenter requested that the FAA require ADS-B in/out and traffic avoidance software on all UAS. The Small UAV Coalition requested the FAA establish standards for collision avoidance technology, as the proposed criteria are not sufficient for compliance with the operational requirement to see and avoid other aircraft (§ 91.113). The commenters stated that these technologies are necessary to avoid a mid-air collision between UA and manned aircraft.

FAA Response: D&R.310(a)(4) requires the applicant demonstrate the ability for the UA to be safely re-routed in flight to avoid a dynamic hazard. The FAA did not prescribe specific design features, such as the technologies suggested by the commenters, to meet D&R.310(a)(4) because they are not the only means for complying with the operational requirement to see and avoid other aircraft. If an applicant chooses to equip their UA with onboard collision avoidance technology, those capabilities and functions must be demonstrated by test per D&R.310(b)(5).

Verification of Limits

The FAA proposed to require an evaluation of the UA's performance, maneuverability, stability, and control with a factor of safety.

Comment Summary: EASA requested that the FAA revise its approach to require a similar compliance demonstration as EASA's for “light UAS.” EASA stated the FAA's proposed criteria for verification of limits, combined with the proposed Flight Manual requirements, seem to replace a traditional Subpart Flight.^[3] EASA further stated the FAA's approach in the proposed airworthiness criteria might necessitate more guidance and means of compliance than the traditional structure.

FAA Response: The FAA's airworthiness criteria will vary from EASA's light UAS certification requirements, resulting in associated differences in compliance demonstrations. At this time, comment on means of compliance and related guidance material, which are still under development with the FAA and with EASA, would be speculative.

Propulsion

Comment Summary: ALPA requested the FAA conduct an analysis to determine battery reliability and safety, taking into account wind and weather conditions and their effect on battery life. ALPA expressed concern with batteries as the only source of power for an aircraft in the NAS. ALPA further requested the FAA not grant exemptions for battery reserve requirements.

FAA Response: Because batteries are a flight essential part, the applicant must establish mandatory instructions or life limits for batteries under the requirements of D&R.135. In addition, when the applicant conducts its D&R testing, D&R.300(i) prevents the applicant from exceeding the maintenance intervals or life limits for those batteries. To the extent the commenter's request addresses fuel reserves, that is an operational requirement, not a certification requirement, and therefore beyond the scope of this document.

Additional Airworthiness Criteria Identified by Commenters

Comment Summary: McMahon Helicopter Services requested that the criteria require anti-collision and navigation lighting certified to existing FAA standards for brightness and size. The commenter stated that these standards were based on human factors for nighttime and daytime recognition and are not simply a lighting requirement. An individual commenter requested that the criteria include a requirement for position lighting and anti-collision beacons meeting TSO-30c Level III. NAAA requested the criteria require a strobe light and high visibility paint scheme to aid in visual detection of the UA by other aircraft.

FAA Response: The FAA determined it is unnecessary for these airworthiness criteria to prescribe specific design features for anti-collision or navigation lighting. The FAA will address anti-collision lighting as part of any operational approval, similar to the rules in 14 CFR 107.29(a)(2) and (b) for small UAS.

Comment Summary: ALPA requested the FAA add a new section with minimum standards for Global Navigation Satellite System (GNSS), as the UAS will likely rely heavily upon GNSS for navigation and to ensure that the UA does not stray outside of its approved airspace. ALPA stated that technological advances have made such devices available at an appropriate size, weight, and power for UAs.

FAA Response: The airworthiness criteria in D&R.100 (UA Signal Monitoring and Transmission), D&R.110 (Software), D&R.115 (Cybersecurity), and D&R.305(a)(3) (probable failures related to GPS) sufficiently address design requirements and testing of navigation systems. Even if the applicant uses a TSO-approved GNSS, these airworthiness criteria require a demonstration that the UA operates successfully without loss of containment. Successful completion of these tests demonstrates that the navigation subsystems are acceptable.

Comment Summary: ALPA requested the FAA revise the criteria to add a new section requiring equipage to comply with the FAA's new rules on Remote Identification of Unmanned Aircraft (86 FR 4390, Jan. 15, 2021). An individual commenter questioned the need for public tracking and identification of drones in the event of a crash or violation of FAA flight rules.

FAA Response: The FAA issued the final rule, Remote Identification of Unmanned Aircraft, after providing an opportunity for public notice and comment. The final rule is codified at 14 CFR part 89. Part 89 contains the remote identification requirements for unmanned aircraft certificated and produced under part 21 after September 16, 2022.

Pilot Ratio

Comment Summary: ALPA and one individual questioned the safety of multiple Model Zip UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. ALPA stated that even with high levels of automation, the pilot must still manage the safe operation and maintain situational awareness of multiple aircraft in their flight path, aircraft systems, integration with traffic, obstacles, and other hazards during normal, abnormal, and emergency conditions. As a result, ALPA recommended the FAA conduct additional studies to better understand the feasibility of a single pilot operating multiple UA before developing airworthiness criteria. The Small UAV Coalition requested the FAA provide criteria for an aircraft-to-pilot ratio higher than 20:1.

FAA Response: These airworthiness criteria are specific to the Model Zip UA and, as discussed previously in this preamble, operations of the Model Zip UA may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. Additionally, these airworthiness criteria require the applicant to demonstrate the durability and reliability of the UA design by flight test, at the highest aircraft-to-pilot ratio, without exceptional piloting skill or alertness. In addition, D&R.305(c) requires the applicant to demonstrate probable failures by test at the highest aircraft-to-pilot ratio. Should the pilot ratio cause a loss of containment or control of the UA, then the applicant will fail this testing.

Comment Summary: ALPA stated that to allow a UAS-pilot ratio of up to 20:1 safely, the possibility that the pilot will need to intervene with multiple UA simultaneously must be “extremely remote.” ALPA questioned whether this is feasible given the threat of GNSS interference or unanticipated wind gusts exceeding operational limits.

FAA Response: The FAA's guidance in AC 23.1309-1E, System Safety Analysis and Assessment for Part 23 Airplanes defines “extremely remote failure conditions” as failure conditions not anticipated to occur during the total life of an airplane, but which may occur a few times when considering the total operational life of all airplanes of the same type. When assessing the likelihood of a pilot needing to intervene with multiple UA simultaneously, the minimum reliability requirements will be determined based on the applicant's proposed CONOPS.

Noise

Comment Summary: An individual commenter expressed concern about noise pollution.

FAA Response: The Model Zip will need to comply with FAA noise certification standards. If the FAA determines that 14 CFR part 36 does not contain adequate standards for this design, the agency will propose and seek public comment on a rule of particular applicability for noise requirements under a separate rulemaking docket.

Operating Altitude

Comment Summary: ALPA, McMahon Helicopter Services, and NAAA commented on the operation of UAS at or below 400 feet AGL. ALPA, McMahon Helicopter Services, and NAAA requested the airworthiness criteria contain measures for safe operation at low altitudes so that UAS are not a hazard to manned aircraft, especially operations involving helicopters; air tours; agricultural applications; emergency medical services; air tanker firefighting; power line and pipeline patrol and maintenance; fish and wildlife service; animal control; military and law enforcement; seismic operations; ranching and livestock relocation; and mapping.

FAA Response: The type certificate only establishes the approved design of the UA. These airworthiness criteria require the applicant show compliance for the UA altitude sought for type certification. While this may result in operating limitations in the flight manual, the type certificate is not an approval for operations. Operations and operational requirements are beyond the scope of this document.

Guidance Material

Comment Summary: NUAIR requested the FAA complete and publish its draft AC 21.17-XX, Type Certification Basis for Unmanned Aircraft Systems (UAS), to provide additional guidance, including templates, to those who seek a type design approval for UAS. NUAIR also requested the FAA recognize the industry consensus-based standards applicable to UAS, as Transport Canada has by publishing its AC 922-001, Remotely Piloted Aircraft Systems Safety Assurance.

FAA Response: The FAA will continue to develop policy and guidance for UA type certification and will publish guidance as soon as practicable. The FAA encourages consensus standards bodies to develop means of compliance and submit them to the FAA for acceptance. Regarding Transport Canada AC 922-001, that AC addresses operational approval rather than type certification.

Safety Management

Comment Summary: ALPA requested the FAA ensure that operations, including UA integrity, fall under the safety management system. ALPA further requested the FAA convene a Safety Risk Management Panel before allowing operators to commence operations and that the FAA require operators to have an active safety management system, including a non-punitive safety culture, where incident and continuing airworthiness issues can be reported.

FAA Response: The type certificate only establishes the approved design of the UA, including the Flight Manual and ICA. Operations and operational requirements, including safety management and oversight of operations and maintenance, are beyond the scope of this document.

Process

Comment Summary: ALPA supported the FAA's type certification of UAS as a “special class” of aircraft under § 21.17(b) but requested that it be temporary.

FAA Response: As the FAA stated in its notice of policy issued August 11, 2020 (85 FR 58251, September 18, 2020), the FAA will use the type certification process under § 21.17(b) for some unmanned aircraft with no occupants onboard. The FAA further stated in its policy that it may also issue type certificates under § 21.17(a) for airplane and rotorcraft UAS designs where the airworthiness standards in part 23, 25, 27, or 29, respectively, are appropriate. The FAA, in the future, may consider establishing appropriate generally applicable airworthiness standards for UA that are not certificated under the existing standards in parts 23, 25, 27, or 29.

Out of Scope Comments

The FAA received and reviewed several comments that were general, stated the commenter's viewpoint or opposition without a suggestion specific to the proposed criteria, or did not make a request the FAA can act on. These comments are beyond the scope of this document.

Applicability

These airworthiness criteria, established under the provisions of § 21.17(b), are applicable to the Zipline Model Zip UA. Should Zipline wish to apply these airworthiness criteria to other UA models, it must submit a new type certification application.

Conclusion

This action affects only certain airworthiness criteria for the Zipline Model Zip UA. It is not a standard of general applicability.

Authority Citation

The authority citation for these airworthiness criteria is as follows:

Authority: 49 U.S.C. 106(g), 40113, and 44701-44702, 44704.

Airworthiness Criteria

Pursuant to the authority delegated to me by the Administrator, the following airworthiness criteria are issued as part of the type certification basis for the Zipline Model Zip unmanned aircraft. The FAA finds that compliance with these criteria appropriately mitigates the risks associated with the design and concept of operations and provides an equivalent level of safety to existing rules.

General

D&R.001 Concept of Operations

The applicant must define and submit to the FAA a concept of operations (CONOPS) proposal describing the unmanned aircraft system (UAS) operation in the national airspace system for which unmanned aircraft (UA) type certification is requested. The CONOPS proposal must include, at a minimum, a description of the following information in sufficient detail to determine the parameters and extent of testing and operating limitations:

(a) The intended type of operations;

(b) UA specifications;

(c) Meteorological conditions;

(d) Operators, pilots, and personnel responsibilities;

(e) Control station, support equipment, and other associated elements (AE) necessary to meet the airworthiness criteria;

(f) Command, control, and communication functions;

(g) Operational parameters (such as population density, geographic operating boundaries, airspace classes, launch and recovery area, congestion of proposed operating area, communications with air traffic control, line of sight, and aircraft separation); and

(h) Collision avoidance equipment, whether onboard the UA or part of the AE, if requested.

D&R.005 Definitions

For purposes of these airworthiness criteria, the following definitions apply.

(a) Loss of Control: Loss of control means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. A loss of control means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristics, or similar occurrence, which could generally lead to crash.

(b) Loss of Flight: Loss of flight means a UA's inability to complete its flight as planned, up to and through its originally planned landing. It includes scenarios where the UA experiences controlled flight into terrain, obstacles, or any other collision, or a loss of altitude that is severe or non-reversible. Loss of flight also includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator's designated recovery zone.

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

The UA must be designed to monitor and transmit to the AE all information required for continued safe flight and operation. This information includes, at a minimum, the following:

(a) Status of all critical parameters for all energy storage systems;

(b) Status of all critical parameters for all propulsion systems;

(c) Flight and navigation information as appropriate, such as airspeed, heading, altitude, and location; and

(d) Communication and navigation signal strength and quality, including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

(a) The applicant must identify and submit to the FAA all AE and interface conditions of the UAS that affect the airworthiness of the UA or are otherwise necessary for the UA to meet these airworthiness criteria. As part of this requirement—

(1) The applicant may identify either specific AE or minimum specifications for the AE.

(i) If minimum specifications are identified, they must include the critical requirements of the AE, including performance, compatibility, function, reliability, interface, pilot alerting, and environmental requirements.

(ii) Critical requirements are those that if not met would impact the ability to operate the UA safely and efficiently.

(2) The applicant may use an interface control drawing, a requirements document, or other reference, titled so that it is clearly designated as AE interfaces to the UA.

(b) The applicant must show the FAA the AE or minimum specifications identified in paragraph (a) of this section meet the following:

(1) The AE provide the functionality, performance, reliability, and information to assure UA airworthiness in conjunction with the rest of the design;

(2) The AE are compatible with the UA capabilities and interfaces;

(3) The AE must monitor and transmit to the pilot all information required for safe flight and operation, including but not limited to those identified in D&R.100; and

(4) The minimum specifications, if identified, are correct, complete, consistent, and verifiable to assure UA airworthiness.

(c) The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and Flight Manual.

(d) The applicant must develop any maintenance instructions necessary to address implications from the AE on the airworthiness of the UA. Those instructions will be included in the instructions for continued airworthiness (ICA) required by D&R.205.

D&R.110 Software

To minimize the existence of software errors, the applicant must:

(a) Verify by test all software that may impact the safe operation of the UA;

(b) Utilize a configuration management system that tracks, controls, and preserves changes made to software throughout the entire life cycle; and

(c) Implement a problem reporting system that captures and records defects and modifications to the software.

D&R.115 Cybersecurity

(a) UA equipment, systems, and networks, addressed separately and in relation to other systems, must be protected from intentional unauthorized electronic interactions that may result in an adverse effect on the security or airworthiness of the UA. Protection must be ensured by showing that the security risks have been identified, assessed, and mitigated as necessary.

(b) When required by paragraph (a) of this section, procedures and instructions to ensure security protections are maintained must be included in the ICA.

D&R.120 Contingency Planning

(a) The UA must be designed so that, in the event of a loss of the command and control (C2) link, the UA will automatically and immediately execute a safe predetermined flight, loiter, landing, or termination.

(b) The applicant must establish the predetermined action in the event of a loss of the C2 link and include it in the UA Flight Manual.

(c) The UA Flight Manual must include the minimum performance requirements for the C2 data link defining when the C2 link is degraded to a level where remote active control of the UA is no longer ensured. Takeoff when the C2 link is degraded below the minimum link performance requirements must be prevented by design or prohibited by an operating limitation in the UA Flight Manual.

D&R.125 Lightning

(a) Except as provided in paragraph (b) of this section, the UA must have design characteristics that will protect the UA from loss of flight or loss of control due to lightning.

(b) If the UA has not been shown to protect against lightning, the UA Flight Manual must include an operating limitation to prohibit flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

(a) For purposes of this section, “adverse weather conditions” means rain, snow, and icing.

(b) Except as provided in paragraph (c) of this section, the UA must have design characteristics that will allow the UA to operate within the adverse weather conditions specified in the CONOPS without loss of flight or loss of control.

(c) For adverse weather conditions for which the UA is not approved to operate, the applicant must develop operating limitations to prohibit flight into known adverse weather conditions and either:

(1) Develop operating limitations to prevent inadvertent flight into adverse weather conditions; or

(2) Provide a means to detect any adverse weather conditions for which the UA is not certificated to operate and show the UA's ability to avoid or exit those conditions.

D&R.135 Flight Essential Parts

(a) A flight essential part is a part, the failure of which could result in a loss of flight or unrecoverable loss of UA control.

(b) If the type design includes flight essential parts, the applicant must establish a flight essential parts list. The applicant must develop and define mandatory maintenance instructions or life limits, or a combination of both, to prevent failures of flight essential parts. Each of these mandatory actions must be included in the Airworthiness Limitations Section of the ICA.

Operating Limitations and Information

D&R.200 Flight Manual

The applicant must provide a Flight Manual with each UA.

(a) The UA Flight Manual must contain the following information:

(1) UA operating limitations;

(2) UA operating procedures;

(3) Performance information;

(4) Loading information; and

(5) Other information that is necessary for safe operation because of design, operating, or handling characteristics.

(b) Those portions of the UA Flight Manual containing the information specified in paragraph (a)(1) of this section must be approved by the FAA.

D&R.205 Instructions for Continued Airworthiness

The applicant must prepare ICA for the UA in accordance with Appendix A to Part 23, as appropriate, that are acceptable to the FAA. The ICA may be incomplete at type certification if a program exists to ensure their completion prior to delivery of the first UA or issuance of a standard airworthiness certificate, whichever occurs later.

Testing

D&R.300 Durability and Reliability

The UA must be designed to be durable and reliable when operated under the limitations prescribed for its operating environment, as documented in its CONOPS and included as operating limitations on the type certificate data sheet and in the UA Flight Manual. The durability and reliability must be demonstrated by flight test in accordance with the requirements of this section and completed with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area.

(a) Once a UA has begun testing to show compliance with this section, all flights for that UA must be included in the flight test report.

(b) Tests must include an evaluation of the entire flight envelope across all phases of operation and must address, at a minimum, the following:

(1) Flight distances;

(2) Flight durations;

(3) Route complexity;

(4) Weight;

(5) Center of gravity;

(6) Density altitude;

(7) Outside air temperature;

(8) Airspeed;

(9) Wind;

(10) Weather;

(11) Operation at night, if requested;

(12) Energy storage system capacity; and

(13) Aircraft to pilot ratio.

(c) Tests must include the most adverse combinations of the conditions and configurations in paragraph (b) of this section.

(d) Tests must show a distribution of the different flight profiles and routes representative of the type of operations identified in the CONOPS.

(e) Tests must be conducted in conditions consistent with the expected environmental conditions identified in the CONOPS, including electromagnetic interference (EMI) and high intensity radiated fields (HIRF).

(f) Tests must not require exceptional piloting skill or alertness.

(g) Any UAS used for testing must be subject to the same worst-case ground handling, shipping, and transportation loads as those allowed in service.

(h) Any UA used for testing must use AE that meet, but do not exceed, the minimum specifications identified under D&R.105. If multiple AE are identified, the applicant must demonstrate each configuration.

(i) Any UAS used for testing must be maintained and operated in accordance with the ICA and UA Flight Manual. No maintenance beyond the intervals established in the ICA will be allowed to show compliance with this section.

(j) If cargo operations or external-load operations are requested, tests must show, throughout the flight envelope and with the cargo or external-load at the most critical combinations of weight and center of gravity, that—

(1) The UA is safely controllable and maneuverable; and

(2) The cargo or external-load are retainable and transportable.

D&R.305 Probable Failures

The UA must be designed such that a probable failure will not result in a loss of containment or control of the UA. This must be demonstrated by test.

(a) Probable failures related to the following equipment, at a minimum, must be addressed:

(1) Propulsion systems;

(2) C2 link;

(3) Global Positioning System (GPS);

(4) Flight control components with a single point of failure;

(5) Control station; and

(6) Any other AE identified by the applicant.

(b) Any UA used for testing must be operated in accordance with the UA Flight Manual.

(c) Each test must occur at the critical phase and mode of flight, and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

(a) All of the following required UAS capabilities and functions must be demonstrated by test:

(1) Capability to regain command and control of the UA after the C2 link has been lost.

(2) Capability of the electrical system to power all UA systems and payloads.

(3) Ability for the pilot to safely discontinue the flight.

(4) Ability for the pilot to dynamically re-route the UA.

(5) Ability to safely abort a takeoff.

(6) Ability to safely abort a landing and initiate a go-around.

(b) The following UAS capabilities and functions, if requested for approval, must be demonstrated by test:

(1) Continued flight after degradation of the propulsion system.

(2) Geo-fencing that contains the UA within a designated area, in all operating conditions.

(3) Positive transfer of the UA between control stations that ensures only one control station can control the UA at a time.

(4) Capability to release an external cargo load to prevent loss of control of the UA.

(5) Capability to detect and avoid other aircraft and obstacles.

(c) The UA must be designed to safeguard against inadvertent discontinuation of the flight and inadvertent release of cargo or external load.

D&R.315 Fatigue

The structure of the UA must be shown to withstand the repeated loads expected during its service life without failure. A life limit for the airframe must be established, demonstrated by test, and included in the ICA.

D&R.320 Verification of Limits

The performance, maneuverability, stability, and control of the UA within the flight envelope described in the UA Flight Manual must be demonstrated at a minimum of 5% over maximum gross weight with no loss of control or loss of flight.

Issued in Washington, DC, on February 16, 2022.

Ian Lucas,

Manager, Policy Implementation Section, Policy and Innovation Division, Aircraft Certification Service.

Footnotes

1.  See 49 U.S.C. 44801(11).

2.  See 49 U.S.C. 44801(12).

3.  In the FAA's aircraft airworthiness standards (parts 23, 25, 27 and 29), subpart B of each is titled Flight.