2024-00549. Airworthiness Criteria: Special Class Airworthiness Criteria for the Wing Aviation LLC; Hummingbird Unmanned Aircraft

AGENCY:

Federal Aviation Administration (FAA), Department of Transportation (DOT).

ACTION:

Issuance of final airworthiness criteria.

SUMMARY:

The FAA announces the special class airworthiness criteria for the Wing Aviation LLC (Wing) Hummingbird unmanned aircraft (UA). This document sets forth the airworthiness criteria that the FAA finds to be appropriate and applicable for the UA design.

DATES:

These airworthiness criteria are effective February 12, 2024.

FOR FURTHER INFORMATION CONTACT:

Mack A. Martinez, Product Policy Management—Emerging Aircraft Section, AIR–62B, Technical Policy Branch, Policy and Standards Division, Aircraft Certification Service, Federal Aviation Administration, 2300 East Devon Avenue, Room 335/339, Des Plaines, IL 60018, telephone [phone].

SUPPLEMENTARY INFORMATION:

Background

Wing Aviation LLC (Wing) applied to the FAA on September 19, 2018, for a special class type certificate (TC) under 14 CFR 21.17(b) for the Model Hummingbird UA.

The Model Hummingbird consists of a fixed-wing airplane UA and its associated elements (AE) including communication links and components that control the UA. The Model Hummingbird UA has a maximum gross takeoff weight of approximately 15 pounds. It is approximately 3.4 feet in width, 4.2 feet in length, and 9.4 inches in height. The Model Hummingbird UA is battery powered using electric motors for vertical takeoff, landing, and forward flight. The unmanned aircraft system (UAS) operations would rely on high levels of automation and may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot. Wing intends for the Model Hummingbird to be used to deliver packages. The proposed concept of operations (CONOPS) for the Model Hummingbird includes a maximum operating altitude of 400 feet above ground level, a maximum cruise speed of 68 knots, operations beyond visual line of sight (BVLOS), and operations over people (OOP). Wing has not requested approval for flight into known icing for the Model Hummingbird UA.

Under § 21.17(c), an application for type certification is effective for 3 years. Section 21.17(d) provides that where a TC has not been issued within that 3-year time limit, the applicant may file for an extension and update the designated applicable regulations in the type certification basis. The effective date of the applicable airworthiness requirements for the updated type certification basis must not be earlier than 3 years before the date of issue of the TC. Since the project was not certificated within 3 years after the application date above, the FAA approved the applicant's request to extend the application for type certification. As a result, the date of the updated type certification basis is September 26, 2022.

The FAA issued a notice of proposed airworthiness criteria for the Wing Model Hummingbird UA, which published in the Federal Register on February 8, 2023 (88 FR 8333).

Discussion of Comments

The FAA received responses from 5 commenters. The comments came from industry organizations such as the Air Line Pilots Association (ALPA), the Association for Uncrewed Vehicle Systems International (AUVSI), the Small Unmanned Aerial Vehicles (UAV) Coalition, the Commercial Drone Alliance, and Wing Aviation LLC.

Specific Issues Raised Within the Scope of the Notice

D&R.100 UA Signal Monitoring and Transmission: The FAA proposed criteria on the minimum types of information the FAA finds are necessary for the UA to transmit to the AE for continued safe flight and operation.

Comment Summary: ALPA is concerned with the possibility of cyber security breaches that could allow unauthorized individuals to take control of a UA, potentially leading to safety issues. As such, it is important to address these concerns and establish an acceptable envelope of tolerance for UA operation that ensures the security of the signal monitoring and transmission systems.

FAA Response: These comments are outside the scope for D&R.100. The comments by ALPA on cyber security, D&R.115, are addressed in the following paragraph.

D&R.115 Cyber Security: The FAA proposed a requirement to address the risks to the UA associated with intentional unauthorized electronic interactions that may result in an adverse effect on the security or airworthiness of the UA.

Comment Summary: ALPA is concerned with the safety and security of the Command and Control (C2) link and potential unauthorized intrusions that could result in the loss of full control over the aircraft. ALPA recommends that every UA model requesting operations in the National Airspace System (NAS) undergo testing and validation during the aircraft certification process to ensure the security of the C2 link is impenetrable and cannot be hacked. ALPA states that reports have shown that the loss of the C2 link and the inability to regain it has led to an uncontained flyaway. ALPA focuses on the most critical aspects of safe UA operations and recommends specific requirements to ensure the safe discontinuation of a flight after a failure of a critical part or system and/or unauthorized intrusion of the C2 link. Other recommendations include the ability of the pilot to re-route the UA safely and dynamically, the ability for the UA control station to allow the pilot to intervene in the management of the flight, an established parameter requirement for geo-fencing specifications, and a requirement for the UA to possess the capability to detect and avoid other aircraft and hazards that are human made/manufactured and natural.

FAA Response: The proposed recommendations are too specific for this general airworthiness criteria language; the language already covers the general issues that ALPA's specific recommendations seek to address. D&R.115 states that the UA equipment, systems, and networks must be assessed to identify and mitigate protections as necessary. The level of detail regarding the assessment of failures and the required protection level of equipment, systems, and networks will be addressed in the means of compliance (MOC) to these airworthiness criteria. The C2 link is addressed in the airworthiness criteria under D&R.120 Contingency Planning for a C2 lost link or degradation of a C2 link, as well as performance requirements. The C2 link is considered part of the UA and will be assessed for cyber security under D&R.115 as part of equipment and systems.

D&R.120 Contingency Planning: The FAA proposed a requirement to address the risks associated with loss of communication C2 link between the pilot and the UA. The proposed criteria requires that the UA be designed to automatically execute a predetermined action and include the predetermined action in the UA Flight Manual. The UA Flight Manual must also include the minimum performance requirements for the C2 data link defining when the C2 link is degraded to a level where active control is no longer ensured. Takeoff when the C2 link is degraded below minimum performance requirements must be prevented by design or by an operating limitation to be included in the UA Flight Manual.

Comment Summary: ALPA expressed several areas of concern related to UA contingency planning that the FAA should consider during the aircraft certification process. These concerns include addressing the risks associated with loss of communication, defining detailed preprogrammed algorithmic deliverables and corrective actions for each situation, and ensuring that the UA can automatically execute a safe predetermined flight, loiter landing, or termination in the event of any critical parts or systems failures. ALPA has several recommendations including to have the applicant “Develop a detailed narrative that outlines every possible action that the UA will execute when guidance/intrusion challenges arise after the first preterminal action is initiated with the flight of the aircraft until all maneuvering actions have been exhausted and no further options exist.” ALPA also recommends a test and validation of the effectiveness of the pre-determined executable actions to ensure proper design and definition of UA as intended.

FAA Response: The FAA shares ALPA's concerns and has determined that the current airworthiness criteria appropriately address these concerns. The airworthiness criteria within D&R.120(a) propose the automatic and immediate execution of a safe predetermined action, in the event of a loss of communications, be part of the UA design. Furthermore, D&R.120(b) proposes that established predetermined actions are included in the UA Flight Manual, thus ensuring the applicant outlines these predetermined maneuvering actions within their contingency planning. Test and validation methods, of the effectiveness of such pre-determined actions as part of mitigation planning by which the UA will meet these criteria are addressed by D&R.310(a) and will be outlined in the MOC.

D&R.125 Lightning: The FAA proposed criteria to address the risks that would result from a lightning strike, accounting for the size and physical limitations of a UAS that could preclude traditional lightning protection features. The FAA further proposed that without lightning protection for the UA, the flight manual must include an operating limitation to prohibit flight into weather conditions with potential lightning.

Comment Summary: ALPA commented that lightning can cause significant damage to aircraft and pose a safety risk to people and property on the ground if that aircraft were to lose control and crash. ALPA suggests 10 specific recommendations for the FAA such as developing lightning protection standards and procedures; establishing a certification process for UA lightning protection and requiring all UA to comply with those standards; requiring regular inspections to identify damage caused by lightning strikes; and developing training programs for UA operators and maintenance personnel on lightning safety.

FAA Response: The proposed recommendations are too specific for this general airworthiness criteria language. The UA, if designed with lightning mitigation features per D&R.125(a), would need to demonstrate protection of the UA from loss of flight or control due to lightning within the MOC. Otherwise, the operational limitations per D&R.125(b) would prohibit flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions: The FAA proposed criteria either requiring that design characteristics protect the UAS from adverse weather conditions or prohibiting flight into known adverse weather conditions. The criteria proposed to define adverse weather conditions as rain, snow, and icing.

Comment Summary: ALPA recommends that the FAA develop and implement a policy that covers scenarios beyond “known conditions” when UAs inadvertently experience adverse weather conditions. ALPA suggests 30 specific recommendations including establishing training requirements for UA pilots and crew members on managing adverse weather conditions; requiring that UA operators have access to accurate and up-to-date weather information; requiring continuous monitoring of adverse weather conditions during flight operations; establishing strict icing requirements and tolerances to prevent the operation of the UA in icing conditions; establishing strict wind limitations and protocols; and that UA operators adapt air carrier icing standards or use them as a baseline to ensure safe operations.

FAA Response: Scenarios beyond “known conditions” would be an anomalous situation that is beyond the scope of D&R.130. For adverse weather conditions for which the UA is not approved to operate, D&R.130 already contains requirements to detect adverse weather and minimize the likelihood of operating in those conditions. Testing of operations in these conditions is beyond the level of rigor needed for these aircraft. In addition, the effect of wind is addressed in D&R.300(b)(9), even though it is not included in D&R.130. D&R testing MOCs and test plans will ensure the UA is tested for adverse wind conditions. Design requirements related to operation in icing as a result of adverse weather are addressed in the CONOPS as stated within D&R.130(b).

D&R.135 Flight Essential Parts: The FAA proposed criteria for critical parts that were substantively similar to those in the existing standards for normal category rotorcraft under 14 CFR 27.602, with changes to reflect UAS terminology and failure conditions. The criteria proposed to define a critical part as a part, the failure of which could result in a loss of flight or unrecoverable loss of control of the aircraft.

Comment Summary: ALPA proposed several recommendations related to design and testing of the UA to consider the failure rates of associated systems and parts. ALPA recommends that a failure-rate threshold should be determined for critical components that are flight essential. ALPA recommends that the FAA establish stringent standards and guidelines for UA certification to ensure public safety.

FAA Response: The specific numerical reliability of any specific part is more specific than would appear in airworthiness D&R criteria. D&R.135(b) already requires the applicant to define maintenance instructions or life limits on any essential parts. Life limits are determined based on the number of failure-free hours flown on the highest time conformed aircraft and the life limits are listed in the instructions for continued airworthiness (ICA).

D&R.300 Durability and Reliability: The FAA proposed durability and reliability testing that would require the applicant to demonstrate safe flight of the UAS across the entire operational envelope and up to all operational limitations, for all phases of flight and all aircraft configurations described in the applicant's CONOPS, with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area. The FAA further proposed that UA would only be certificated for operations within the limitations, and for flight over areas no greater than the maximum population density, as described in the applicant's CONOPS and demonstrated by test.

Comment Summary: ALPA commented that it is crucial that UA operators understand the limitations and requirements for operating in visual line of sight (VLOS) and BVLOS environments, including recovery zone limitations. Additionally, proper maintenance and testing must be conducted to ensure the UA's airworthiness certificate is valid and reliable for operation. ALPA suggests 10 specific recommendations including requiring scheduled maintenance per 14 CFR part 43; specific minimum testing; and requiring regular system checks before each flight to ensure the aircraft is in proper working condition.

FAA Response: The D&R airworthiness criteria contain requirements related to the airworthiness of the aircraft itself, relying heavily on both flight testing and on maintenance in accordance with defined maintenance procedures. The comments on the operational environments are separate requirements or limitations and not part of the criteria for the aircraft itself. ALPA's specific maintenance recommendations are already encompassed by the general language of D&R.300.

Comment Summary: The Small UAV Coalition commented on the proposed D&R.300 requirement that no failures occur “that result in loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area.” The Coalition recommends that a single failure during testing should not automatically restart counting the number of flight test operations set for a particular population density. Rather, if the applicant can identify the failure through root cause and fault tree analysis and provide a validated mitigation to prevent its recurrence, the number of consecutive failure-free operations and overall flight test hours allocation should be adjusted to be proportionate to the particular risk of that failure.

The Small UAV Coalition also states, “some UAS design elements could include an onboard health system that initiates a landing to lessen the potential of a loss of control event. In those cases, if the landings could be demonstrated to occur in safer locations that should not count as a failure.” The Coalition seeks confirmation that the text “operator's recovery area” includes that sort of landing. Absent correction or clarification from the FAA on this language in D&R.300, the Coalition believes these requirements would present unnecessary and overly burdensome compliance challenges for the applicant to address.

FAA Response: The intent of the testing criteria is for the applicant to demonstrate the aircraft's durability and reliability through a successful accumulation of flight testing. The FAA does not expect analytical evaluation to be part of this process. It should be noted that D&R.300 is intended to demonstrate the reliability of the system and not the consequence of failure, which is addressed in D&R.305. Systems designed to allow for unscheduled landings at potentially safer sites which are not controlled by the operator may provide a safety benefit, but D&R.300 is evaluating the overall system reliability and any landing outside those sites predetermined and accepted by the FAA in the flight test plan will be considered a test point failure. Failures during flight testing may or may not require additional test hours, up to and including resetting of the accumulated flight hours to zero. This determination will be made by the FAA based on the extent of redesign necessary to minimize the likelihood the incident will recur. However, the applicant will comply with these testing criteria using an MOC, accepted by the FAA, through the issue paper process. The MOC will depend on the reliability level the applicant has proposed to meet.

D&R.305 Probable Failures: The FAA proposed criteria to evaluate how the UAS functions after probable failures, including failures related to propulsion systems, C2 link, global positioning system (GPS), critical flight control components with a single point of failure, control station, and any other equipment identified by the applicant.

Comment Summary: ALPA provided 10 recommendations to ensure that the testing criteria effectively address probable failures and that any additional critical failures are also considered. Some of the recommendations include the FAA specifying which “certain failures” that UAs will be expected to demonstrate to prove that they can remain under control and contained; the UA should be tested to ensure it can safely return to a predetermined location or land safely in the event of a loss of power or propulsion system failure; and the applicant should test the UA's ability to detect and avoid potential obstacles, such as other aircraft, buildings, or terrain, to ensure safe operations in all types of environments.

FAA Response: “Probable failures” are addressed in D&R.305 and “capabilities” are addressed within D&R.310. The intent of the testing criteria is for the applicant to demonstrate the aircraft's durability and reliability through a successful accumulation of flight testing. The FAA does not expect analytical evaluation to be part of this process. However, the applicant will comply with these testing criteria using test plans developed to an MOC, accepted by the FAA through the issue paper process. The MOC will address each element of these airworthiness criteria and will be dependent on the reliability level the applicant has proposed to meet.

D&R.310 Capabilities and Functions: The FAA proposed criteria to require the applicant to demonstrate, by test, the minimum capabilities and functions necessary for the design. UAS.310(a) proposed to require the applicant to demonstrate, by test, the capability of the UAS to regain command and control of the UA after a C2 link is lost, the sufficiency of the electrical system to carry all anticipated loads, and the ability of the pilot to override any pre-programming in order to resolve a potential unsafe operating condition in any phase of flight. UAS.310(b) proposed to require the applicant to demonstrate, by test, certain features if the applicant requests approval of those features (geo-fencing, external cargo, detect and avoid, etc.). UAS.310(c) proposed to require the design of the UAS to safeguard against an unintended discontinuation of flight or release of cargo, whether by human action or malfunction.

Comment Summary: ALPA comments on assuring the security of the C2 link through testing and validation during the aircraft certification process for every UA model requesting operations in the NAS. An acceptable percentage for cyber intrusions and the ability to regain command and control of the UA after the C2 link is lost must be defined. ALPA also provided several recommendations on capabilities and functions required by D&R.310(a) or optional D&R.310(b), if requested for approval.

FAA Response: D&R.120(a) requires contingency planning for C2 lost link and D&R.115 requires protections from cyber intrusions. Specific contingency plans and protections will be addressed in the MOC for those airworthiness criteria. D&R.310's general airworthiness criteria language already covers the other issues ALPA's specific recommendations seek to address.

Comment Summary: The proposed airworthiness criteria discussion of D&R.310 “Capabilities and Functions” includes the sentence, “[i]n order to show that the UA does not create a hazard when landing, the UA must show by test that it has the ability to detect and avoid any potential hazards on the ground by demonstrating any such landing always stays well clear of all people and other obstacles.”

Wing, AUVSI, The Commercial Drone Alliance and The Small UAV Coalition object to the FAA's use of absolute terms such as “any” and “always” against undefined and/or ambiguous terms (such as “well clear” in the context of ground obstacles) outlined in the preamble discussion of the proposed airworthiness criteria. Absent correction or clarification by the FAA, the commenters state that this language sets an impossibly high standard beyond the capabilities of either human or machine. Such absolute and prescriptive MOC is inappropriate in the context of airworthiness criteria. Wing is concerned that this standard precludes the ability of Wing or other manufacturers to demonstrate compliance at any practical level of test or validation. The commenters note that this standard is not called for in the actual proposed text of D&R.310 itself. In finalizing the airworthiness criteria, the FAA should correct or clarify its preamble language to avoid any possible confusion.

Wing is concerned that the absolute terms “any” and “always” create a bar that demonstration by test or other means cannot meet. In addition, the use of terms such as “potential” and “well clear” similarly creates substantial challenges to compliance demonstration by test or other means. Wing states that it would be exceptionally challenging to meet this standard and that it exceeds the expectations for crewed aircraft as written. Wing requests that the FAA allow for alternative means of demonstrating that the UA does “not create a hazard when landing” in accordance with D&R.310(a)(6) by prefacing this paragraph with the phrase “for example;” remove the absolute terms “any,” “all,” and “always” to allow for the use of reasonable and achievable test methods; and remove the undefined and ambiguous terms “well clear,” “other obstacles,” and “potential” when outlining test or demonstration criteria.

FAA Response: The FAA's use of absolute terms referenced in the comment summary above are of concern to Wing and others as in their view, “the language sets an impossibly high standard beyond the capabilities of either human or machine.” The subject language is based on the increased level of automation of Wing's system, which relies on onboard automated decision-making rather than pilot action. To accept such a system, the UAS must exhibit highly automated features and functions to enhance the safety of UAS operations by replacing direct manual control of the UA with automation. The UAS's automated flight envelope and path protection systems must be designed for controllability and maneuverability needed to detect and to maintain safe separation from hazards or obstacles on or near the ground while in normal, abnormal, and emergency operations. Some examples of abnormal or emergency scenarios include collision avoidance, aborted missions, power system failures, and forced landings. The UAS must also be equipped with capabilities and necessary features that will automatically contain or control the aircraft in the case of a loss of external services used in communicating, controlling, or providing system inputs to the UA. All foreseeable loss, degradation or non-availability of external services, systems, or signals must not put the UA in an uncontrolled, uncontained, or unsafe condition.

D&R.310 is a testing requirement and sets the criteria which must be demonstrated by flight test as part of the type certification program. The language referenced by the commenters as preamble language does not appear in the final rule but is given in the discussion section of the NPRM as a tool for understanding why the requirement was drafted as it was and provides additional insight into the means by which the applicant will be able to show compliance with the testing requirements in D&R.310. The intent of the use of this language within the NPRM discussion is for the applicant to show compliance by demonstrating landings that do not adversely impact people or obstacles. Therefore, the FAA finds that an acceptable flight test outcome is one that would not result in an unsafe condition. Within the context of the certification testing performed under D&R.310, the FAA's use of absolute terms such as “any” and “always” only serve to emphasize acceptable examples of test boundaries which will be addressed in more detail in the MOC and test plans. Likewise, terms like “well clear” will be defined based on the appropriate near mid-air collision (NMAC) volume determined to be acceptable to the FAA for the D&R flight test campaign.

D&R.320 Verification of Limits: The FAA proposed to require a demonstration of the UA's performance, maneuverability, stability, and control with a factor of safety (5% over maximum gross weight with no loss of control or loss of flight).

Comment Summary: ALPA is concerned that the safety factor of 5% is too low. The Model Hummingbird UA weighs approximately 15 lbs., which means that 5% is approximately 0.75 lbs. ALPA recommends increasing this number to a minimum of a double-digit percentage for current and future aircraft certification standards.

FAA Response: The FAA determined that based on historical data, 5% is a minimum acceptable margin.

Additional Airworthiness Criteria Identified by Commenters

UA to Pilot Ratio: The Wing Model Hummingbird UAS operations would rely on high levels of automation and may include multiple UA operated by a single pilot, up to a ratio of 20 UA to 1 pilot.

Comment Summary: ALPA is concerned with the safe operation of multiple UAs operated by a single pilot as described within the proposed airworthiness criteria notice. ALPA recommends that the FAA research and better assess multiple UA operations by a single pilot to establish a baseline understanding of the feasibility of a single UA pilot flying multiple UAs before developing airworthiness certification criteria. The proposed 20 to 1 UA to pilot ratio presents significant challenges to ensuring the safe operation of UAs and other NAS users, and the FAA should implement additional certification requirements for pilots operating multiple UAs, including specialized training and qualification standards. Additionally, the FAA should establish guidelines for the maximum number of UAs that a single pilot can operate to ensure safe and effective operations in the NAS. Furthermore, there should always be a backup failsafe and tertiary means of control for built-in redundancy where another human operator can intervene out of necessity for safety. The FAA should base its decision on facts and data and should clarify what qualitative and quantitative scientific instruments were utilized to assess the potential risks of the aircraft.

FAA Response: These airworthiness criteria require the applicant to demonstrate the durability and reliability of the UA design by flight test, at the highest aircraft-to-pilot ratio, without exceptional piloting skill or alertness. In addition, D&R.305(c) requires the applicant to demonstrate probable failures by test at the highest aircraft-to-pilot ratio. The durability and reliability-based type certification process was developed for UAS that meet certain design criteria to include a maximum operating limitation of 20:1 aircraft to pilot ratio. Any deviation from this limitation will require additional coordination and will add to the project timeline.

Level of Automation: The Wing Model Hummingbird UA operations would rely on high levels of automation.

Comment Summary: ALPA is concerned about the specificity of the Model Hummingbird UA's automation level. ALPA states that the FAA should clarify the degree and level of automation in which the UA will operate. This includes defining whether the operation of the Model Hummingbird UA will be fully automated autonomous, partially automated autonomous, preprogrammed, or a combination of any of these options. Additionally, the FAA should determine the required minimal involvement or participation from the remote pilot(s) to assure flight safety. ALPA suggests that the FAA establish guidelines for aircraft onboard (organic) and/or offboard (inorganic) intelligence system(s) to deconflict other known and unknown (birds, floating objects/flying debris) air traffic and associated hazards. The FAA should ensure that these systems are tested, designed, and manufactured to a certain failure rate, such as a 10⁻⁹ failure rate per flight hours or something less.

FAA Response: D&R.100 requires UA specifications within the CONOPS. Data within the CONOPS are proprietary to the applicant. The D&R methodology is used as a framework to allow for an adequate balance of certification rigor with safety related outcomes. The FAA considered the size of aircraft, its maximum airspeed and altitude, and operational limitations to address the number of UA per operator (maximum of 20:1 aircraft to pilot ratio) and to address operations in which the aircraft would operate BVLOS of the pilot to assess the potential risk the aircraft could pose to other aircraft and to human beings on the ground. Using these parameters, the FAA developed proposed airworthiness criteria to address those potential risks to ensure the aircraft remains reliable, controllable, safe, and airworthy without the need for requiring a prescriptive failure rate.

Hazardous Cargo Carriage Over Populated Areas

Comment Summary: ALPA is concerned that the carriage of HAZMAT by UAs over populated areas poses a significant safety concern requiring the FAA's action. The guidelines and regulations for the carriage of HAZMAT by UAs should consider the associated risks to public safety. UA operators should be required to provide information about the HAZMAT they are carrying. The FAA should also establish a system for monitoring and enforcing compliance, ensure that emergency responders are informed, properly trained, and equipped to handle nonconventional operational factors involving UA HAZMAT incidents, and require UA manufacturers to incorporate safeguards and emergency response mechanisms. By taking these and other recommended steps, the FAA can help ensure the safe operation of UAs in the NAS.

FAA Response: The FAA acknowledges the concern by ALPA. However, the comment is not within the scope of the aircraft type certification for which this airworthiness criteria was developed. The carriage of HAZMAT is an operational function and if applicable to Wing's operation for this aircraft, would be provided in the CONOPS. The CONOPS, if approved for HAZMAT, will contain operational limitations in the operating approval, as necessary. The CONOPS are proprietary to the applicant.

BVLOS and OOP

Comment Summary: ALPA is concerned that as the use of UAs for BVLOS operations and over people become increasingly common, it raises significant safety concerns that must be addressed in the certification process. ALPA is concerned about the potential risks associated with this type of operation involving the Model Hummingbird UA or any similar operator. In order to ensure safety, ALPA recommends that operators explain how they plan to mitigate their aerial footprint around and away from people and property, with detailed evasion and emergency set-down plans, processes, and parameters. Additionally, ALPA urges the FAA to consider the possibility of an aircraft performing BVLOS losing propulsion and being unable to maintain flight, requiring a recovery or crash mitigation strategy and emergency vertical arrestment system to prevent harm to persons or property.

ALPA states that many manufacturers within the UA/drone and urban air mobility (UAM) and advanced air mobility (AAM) industry do not include an emergency vertical arrestment system to prevent loss of life and property in the event of an aircraft losing its engine or engines then becoming a falling object which is increasingly alarming if that aircraft has minimal to a zero-glide aspect ratio. ALPA recommends continuous collaboration between industry experts and the regulator to develop safer aircraft design and certification standards for the best interests of the end-users, the flying public, and those affected by flight operations of UA/drone or UAM/AAM aircraft. When these types of aircraft operate in the same airspace as commercial aircraft, ALPA recommends that pilots have the ability to see them on the flightdeck or pilot display and air traffic controllers can view them on their displays to separate air traffic safely. These aircraft must also have active collision-avoidance technology, and ALPA opposes any integration that does not include aircraft collision-avoidance systems (ACAS) that are interoperable with commercial collision-avoidance systems. ALPA further opposes any proposed changes to 14 CFR 91.113 to enable BVLOS operational safety case(s) to transfer the responsibility of “see and avoid” to crewed aircraft under certain conditions. The responsibility of “see and avoid” must remain with the remote pilot, and any changes to this would be detrimental to the safe integration of UAs into the NAS.

FAA Response: Discussion on proposed changes to general operating flight rule § 91.113 is not within the scope of this airworthiness criteria as it does not pertain to the type certification of the aircraft itself. Operational approval will be granted based on the maximum cumulative risk posed by the proposed operations, taking into account mitigating features, e.g., vertical arresting systems such as parachutes, if they are proposed as part of the design. However, the airworthiness criteria are developed to be high level and performance based, rather than relying on specific designs which may limit introduction of other novel safety enhancing features.

Battery Standards

Comment Summary: ALPA states that the use of batteries as an energy source for aircraft propulsion in the NAS is a substantial shift from traditional propulsion methods on which current safety margins are based and requires more regulator exploration to determine best safety practices. ALPA states that the FAA will need to analyze, qualify, and quantify the aircraft performance and operational environments to determine whether the safety baseline of this technological functionality can be performed reliably and repeatedly to an equivalent level of safety. ALPA recommends that the FAA and industry mutually agree upon the scientific data to confer consensus regarding acceptable safety margins.

ALPA provided 20 specific recommendations regarding battery safety. Some of the recommendations are to develop standards; establish certification procedures for aircraft batteries; develop regulations for transporting lithium-ion batteries; define policies and procedures for flightcrews to promptly act with an abnormal battery anomaly; and several more recommendations on best-practices for battery safety.

FAA Response: The recommendations on battery standards by the commenter are noted as either being too specific or out of scope for this D&R airworthiness criteria. The overly specific recommendations address issues already encompassed by the general airworthiness criteria. D&R testing per D&R.300 should demonstrate reliability of the UAS as a whole and thus each system or component within the UAS has met a minimum acceptable reliability standard. Demonstration of the safe carriage of batteries and mitigations for known risks are addressed via flight test within D&R.305(a)(1) “Propulsion systems.”

Out of Scope Comments

The FAA received and reviewed several comments that were general, stated the commenter's viewpoint or opposition without a suggestion specific to the proposed criteria, or did not make a request the FAA can act on. These comments are noted as beyond the scope of this document.

Applicability

These airworthiness criteria, established under the provisions of § 21.17(b), are applicable to the Model Hummingbird UA. Should Wing Aviation LLC apply at a later date for a change to the TC to include another model, these airworthiness criteria would apply to that model as well, provided the FAA finds them appropriate in accordance with the requirements of subpart D to part 21.

Conclusion

This action affects only the airworthiness criteria for one model UA. It is not a standard of general applicability.

Authority Citation

The authority citation for these airworthiness criteria is as follows:

Authority: 49 U.S.C. 106(g), 40113, 44701, 44702, 44704.

Airworthiness Criteria

Pursuant to the authority delegated to me by the Administrator, the following airworthiness criteria are issued as part of the type certification basis for the Wing Aviation LLC Model Hummingbird UA. The FAA finds that compliance with the following would mitigate the risks associated with the proposed design and CONOPS appropriately and would provide an equivalent level of safety to existing rules.

General

D&R.001 Concept of Operations

The applicant must define and submit to the FAA a concept of operations (CONOPS) proposal describing the UAS operation in the National Airspace System for which UA type certification is requested. The CONOPS proposal must include, at a minimum, a description of the following information in sufficient detail to determine the parameters and extent of testing and operating limitations:

(a) The intended type of operations;

(b) UA specifications;

(c) Meteorological conditions;

(d) Operators, pilots, and personnel responsibilities;

(e) Control station, support equipment, and other associated elements (AE) necessary to meet the airworthiness criteria;

(f) Command, control, and communication functions;

(g) Operational parameters (such as population density, geographic operating boundaries, airspace classes, launch and recovery area, congestion of proposed operating area, communications with air traffic control, line of sight, and aircraft separation); and

(h) Collision avoidance equipment, whether onboard the UA or part of the AE, if requested.

D&R.005 Definitions

For purposes of these airworthiness criteria, the following definitions apply.

(a) Loss of control: Loss of control means an unintended departure of an aircraft from controlled flight. It includes control reversal or an undue loss of longitudinal, lateral, and directional stability and control. It also includes an upset or entry into an unscheduled or uncommanded attitude with high potential for uncontrolled impact with terrain. A loss of control means a spin, loss of control authority, loss of aerodynamic stability, divergent flight characteristics, or similar occurrence, which could generally lead to a crash.

(b) Loss of flight: Loss of flight means a UA's inability to complete its flight as planned, up to and through its originally planned landing. It includes scenarios where the UA experiences controlled flight into terrain, obstacles, or any other collision, or a loss of altitude that is severe or non-reversible. Loss of flight also includes deploying a parachute or ballistic recovery system that leads to an unplanned landing outside the operator's designated recovery zone.

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

The UA must be designed to monitor and transmit to the AE all information required for continued safe flight and operation. This information includes, at a minimum, the following:

(a) Status of all critical parameters for all energy storage systems;

(b) Status of all critical parameters for all propulsion systems;

(c) Flight and navigation information as appropriate, such as airspeed, heading, altitude, and location; and

(d) Communication and navigation signal strength and quality, including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

(a) The applicant must identify and submit to the FAA all AE and interface conditions of the UAS that affect the airworthiness of the UA or are otherwise necessary for the UA to meet these airworthiness criteria. As part of this requirement—

(1) The applicant may identify either specific AE or minimum specifications for the AE.

(i) If minimum specifications are identified, they must include the critical requirements of the AE, including performance, compatibility, function, reliability, interface, operator alerting, cyber security, and environmental requirements.

(ii) Critical requirements are those that if not met would impact the ability to operate the UA safely and efficiently.

(2) The applicant may use an interface control drawing, a requirements document, or other reference, titled so that it is clearly designated as AE interfaces to the UA.

(b) The applicant must show the FAA that the AE or minimum specifications identified in paragraph (a) of this section meet the following:

(1) The AE provide the functionality, performance, reliability, and information to assure UA airworthiness in conjunction with the rest of the design;

(2) The AE are compatible with the UA capabilities and interfaces;

(3) The AE must monitor and transmit to the operator all information required for safe flight and operation, including but not limited to those identified in D&R.100; and

(4) The minimum specifications, if identified, are correct, complete, consistent, and verifiable to assure UA airworthiness.

(c) The FAA will establish the approved AE or minimum specifications as operating limitations and include them in the UA type certificate data sheet and UA Flight Manual.

(d) The applicant must develop any maintenance instructions necessary to address implications from the AE on the airworthiness of the UA. Those instructions will be included in the instructions for continued airworthiness (ICA) required by D&R.205.

D&R.110 Software

To minimize the existence of software errors, the applicant must:

(a) Verify by test all software that may impact the safe operation of the UA;

(b) Utilize a configuration management system that tracks, controls, and preserves changes made to software throughout the entire life cycle; and

(c) Implement a problem reporting system that captures and records defects and modifications to the software.

D&R.115 Cyber Security

(a) UA equipment, systems, and networks, addressed separately and in relation to other systems, must be protected from intentional unauthorized electronic interactions that may result in an adverse effect on the security or airworthiness of the UA. Protection must be ensured by showing that the security risks have been identified, assessed, and mitigated as necessary.

(b) When required by paragraph (a) of this section, procedures and instructions to ensure security protections are maintained must be included in the ICA.

D&R.120 Contingency Planning

(a) The UA must be designed so that, in the event of a loss of the command and control (C2) link, the UA will automatically and immediately execute a safe predetermined flight, loiter, landing, or termination.

(b) The applicant must establish the predetermined action in the event of a loss of the C2 link and include it in the UA Flight Manual.

(c) The UA Flight Manual must include the minimum performance requirements for the C2 data link, defining when the C2 link is degraded to a level where remote active control of the UA is no longer ensured. Takeoff when the C2 link is degraded below the minimum link performance requirements must be prevented by design or prohibited by an operating limitation in the UA Flight Manual.

D&R.125 Lightning

(a) Except as provided in paragraph (b) of this section, the UA must have design characteristics that will protect the UA from loss of flight or loss of control due to lightning.

(b) If the UA has not been shown to protect against lightning, the UA Flight Manual must include an operating limitation to prohibit flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

(a) For purposes of this section, “adverse weather conditions” means rain, snow, and icing.

(b) Except as provided in paragraph (c) of this section, the UA must have design characteristics that will allow the UA to operate within the adverse weather conditions specified in the CONOPS without loss of flight or loss of control.

(c) For adverse weather conditions for which the UA is not approved to operate, the applicant must develop operating limitations to prohibit flight into known adverse weather conditions and either:

(1) Develop operating limitations to prevent inadvertent flight into adverse weather conditions; or

(2) Provide a means to detect any adverse weather conditions for which the UA is not certificated to operate and show the UA's ability to avoid or exit those conditions.

D&R.135 Flight Essential Parts

(a) A flight essential part is a part, the failure of which could result in a loss of flight or unrecoverable loss of UA control.

(b) If the type design includes flight essential parts, the applicant must establish a flight essential parts list. The applicant must develop and define mandatory maintenance instructions or life limits, or a combination of both, to prevent failures of flight essential parts. Each of these mandatory actions must be included in the airworthiness limitations section of the ICA.

Operating Limitations and Information

D&R.200 UA Flight Manual

The applicant must provide a UA Flight Manual with each UA.

(a) The UA Flight Manual must contain the following information:

(1) UA operating limitations;

(2) UA operating procedures;

(3) Performance information;

(4) Loading information; and

(5) Other information that is necessary for safe operation because of design, operating, or handling characteristics.

(b) Those portions of the UA Flight Manual containing the information specified in paragraph (a)(1) of this section must be approved by the FAA.

D&R.205 ICA

The applicant must prepare the ICA for the UA in accordance with appendix A to 14 CFR part 23, as appropriate, that are acceptable to the FAA. The ICA may be incomplete at type certification if a program exists to ensure their completion prior to delivery of the first UA or issuance of a standard airworthiness certificate, whichever occurs later.

Testing

D&R.300 Durability and Reliability

The UA must be designed to be durable and reliable when operated under the limitations prescribed for its operating environment, as documented in its CONOPS, and included as operating limitations on the type certificate data sheet and in the UA Flight Manual. The durability and reliability must be demonstrated by flight test in accordance with the requirements of this section and completed with no failures that result in a loss of flight, loss of control, loss of containment, or emergency landing outside the operator's recovery area.

(a) Once a UA has begun testing to show compliance with this section, all flights for that UA must be included in the flight test report.

(b) Tests must include an evaluation of the entire flight envelope across all phases of operation and must address, at a minimum, the following:

(1) Flight distances;

(2) Flight durations;

(3) Route complexity;

(4) Weight;

(5) Center of gravity;

(6) Density altitude;

(7) Outside air temperature;

(8) Airspeed;

(9) Wind;

(10) Weather;

(11) Operation at night, if requested;

(12) Energy storage system capacity; and

(13) Aircraft to pilot ratio.

(c) Tests must include the most adverse combinations of the conditions and configurations in paragraph (b) of this section.

(d) Tests must show a distribution of the different flight profiles and routes representative of the type of operations identified in the CONOPS.

(e) Tests must be conducted in conditions consistent with the expected environmental conditions identified in the CONOPS, including electromagnetic interference (EMI) and high intensity radiated fields (HIRF).

(f) Tests must not require exceptional piloting skill or alertness.

(g) Any UAS used for testing must be subject to the same worst-case ground handling, shipping, and transportation loads as those allowed in service.

(h) Any UA used for testing must use AE that meet, but do not exceed, the minimum specifications identified under D&R.105. If multiple AE are identified, the applicant must demonstrate each configuration.

(i) Any UAS used for testing must be maintained and operated in accordance with the ICA and UA Flight Manual. No maintenance beyond the intervals established in the ICA will be allowed to show compliance with this section.

(j) If cargo operations or external-load operations are requested, tests must show, throughout the flight envelope and with the cargo or the external load at the most critical combinations of weight and center of gravity, that—

(1) The UA is safely controllable and maneuverable; and

(2) The cargo or the external load is retainable and transportable.

D&R.305 Probable Failures

The UA must be designed such that a probable failure will not result in a loss of containment or control of the UA. This must be demonstrated by test.

(a) Probable failures related to the following equipment, at a minimum, must be addressed:

(1) Propulsion systems;

(2) C2 link;

(3) Global positioning system (GPS);

(4) Flight control components with a single point of failure;

(5) Control station; and

(6) Any other AE identified by the applicant.

(b) Any UA used for testing must be operated in accordance with the UA Flight Manual.

(c) Each test must occur at the critical phase and mode of flight, and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

(a) All of the following required UAS capabilities and functions must be demonstrated by test:

(1) Capability to regain command and control of the UA after the C2 link has been lost.

(2) Capability of the electrical system to power all UA systems and payloads.

(3) Ability for the pilot to safely discontinue the flight.

(4) Capability of the UA to maintain its preplanned flight path within acceptable navigation accuracy.

(5) Ability to safely abort a takeoff.

(6) Ability to safely abort a landing and initiate a go-around unless the UA is shown not to create a hazard when landing.

(b) The following UAS capabilities and functions, if requested for approval, must be demonstrated by test:

(1) Continued flight after degradation of the propulsion system.

(2) Geo-fencing that contains the UA within a designated area, in all operating conditions.

(3) Positive transfer of the UA between control stations that ensures only one control station can control the UA at a time.

(4) Capability to release an external cargo load to prevent loss of control of the UA.

(5) Capability to detect and avoid other aircraft and obstacles.

(c) The UA must be designed to safeguard against inadvertent discontinuation of the flight and inadvertent release of cargo or external load.

D&R.315 Fatigue

The structure of the UA must be shown to withstand the repeated loads expected during its service life without failure. A life limit for the airframe must be established, demonstrated by test, and included in the ICA.

D&R.320 Verification of Limits

The performance, maneuverability, stability, and control of the UA within the flight envelope described in the UA Flight Manual must be demonstrated at a minimum of 5% over maximum gross weight with no loss of control or loss of flight.

Issued in Washington, DC, on January 8, 2024.

Ian Lucas,

Manager, Certification Coordination Section, Policy and Standards Division, Aircraft Certification Service.