[Federal Register Volume 87, Number 18 (Thursday, January 27, 2022)]
[Rules and Regulations]
[Pages 4128-4140]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-01556]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 21
[Docket No. FAA-2020-1086]
Airworthiness Criteria: Special Class Airworthiness Criteria for
the Amazon Logistics, Inc. MK27-2 Unmanned Aircraft
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Issuance of final airworthiness criteria.
-----------------------------------------------------------------------
SUMMARY: The FAA announces the special class airworthiness criteria for
the Amazon Logistics, Inc. Model MK27-2 unmanned aircraft. This
document sets forth the airworthiness criteria the FAA finds to be
appropriate and applicable for the unmanned aircraft design.
DATES: These airworthiness criteria are effective February 28, 2022.
FOR FURTHER INFORMATION CONTACT: Christopher J. Richards, Emerging
Aircraft Strategic Policy Section, AIR-618, Strategic Policy Management
Branch, Policy and Innovation Division, Aircraft Certification Service,
Federal Aviation Administration, 6020 28th Avenue South, Room 103,
Minneapolis, MN 55450, telephone (612) 253-4559.
SUPPLEMENTARY INFORMATION:
Background
Amazon Logistics, Inc., (Amazon) applied to the FAA on October 13,
2017, for a special class type certificate under Title 14, Code of
Federal Regulations (14 CFR) 21.17(b) for the Amazon Model MK27-2 \1\
unmanned aircraft system (UAS).
---------------------------------------------------------------------------
\1\ Amazon's original application identified its model as the
MK27. On December 20, 2021, Amazon amended its application to change
the aircraft model designation from MK27 to MK27-2.
---------------------------------------------------------------------------
The Model MK27-2 consists of a powered lift unmanned aircraft (UA)
and its associated elements (AE) including communication links and
components that control the UA. The Model MK27-2 UA has a maximum gross
takeoff weight of 89 pounds. It is approximately 78 inches in width, 65
inches in length, and 46 inches in height. The Model MK27-2 UA uses
battery-powered electric motors for vertical takeoff, landing, and
forward flight. The UAS operations would rely on high levels of
automation and may include multiple UA operated by a single pilot, up
to a ratio of 20 UA to 1 pilot. Amazon anticipates operators will use
the Model MK27-2 for delivering packages. The proposed concept of
operations (CONOPS) for the Model MK27-2 identifies a maximum operating
altitude of 400 feet above ground level (AGL), a maximum cruise speed
of 60 knots, operations beyond visual line of sight (BVLOS) of the
pilot, and operations over human beings. Amazon has not requested type
certification for flight into known icing conditions for the Model
MK27-2.
The FAA issued a notice of proposed airworthiness criteria for the
Amazon MK27 UAS, which published in the Federal Register on November
20, 2020 (85 FR 74271).
Summary of Changes From the Proposed Airworthiness Criteria
Based on the comments received, these final airworthiness criteria
reflect the following changes, as explained in more detail under
Discussion of Comments: A new section containing
[[Page 4129]]
definitions; revisions to the CONOPS requirement; changing the term
``critical part'' to ``flight essential part'' in D&R.135; changing the
basis of the durability and reliability testing from population density
to limitations prescribed for the operating environment identified in
the applicant's CONOPS per D&R.001; and, for the demonstration of
certain required capabilities and functions as required by D&R.310.
Additionally, the FAA re-evaluated its approach to type
certification of low-risk UA using durability and reliability testing.
Safe UAS operations depend and rely on both the UA and the AE. As
explained in FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13,
2021, the FAA has revised the airworthiness criteria to define a
boundary between the UA type certification and subsequent operational
evaluations and approval processes for the UAS (i.e., waivers,
exemptions, and/or operating certificates).
To reflect that these airworthiness criteria rely on durability and
reliability (D&R) testing for certification, the FAA changed the prefix
of each section from ``UAS'' to ``D&R.''
Lastly, the FAA revised D&R.001(g) to clarify that the operational
parameters listed in that paragraph are examples and not an all-
inclusive list.
Discussion of Comments
The FAA received responses from 27 commenters. The majority of the
commenters were individuals. Other commenters included the European
Union Aviation Safety Agency (EASA), unmanned aircraft manufacturers, a
helicopter operator, Embry-Riddle Aeronautical University, and
organizations such as the Air Line Pilots Association (ALPA), the
Association for Unmanned Vehicle Systems International (AUVSI),
Droneport Texas, LLC, the National Agricultural Aviation Association
(NAAA), Northeast UAS Airspace Integration Research Alliance, Inc.
(NUAIR), and the Small UAV Coalition.
Support
Comment Summary: ALPA, AUVSI, NUAIR, and the Small UAV Coalition
expressed support for type certification as a special class of aircraft
and establishing airworthiness criteria under Sec. 21.17(b). AUVSI and
the Small UAV Coalition also supported the FAA's proposed use of
performance-based standards.
Terminology: Loss of Flight
Comment Summary: An individual commenter requested the FAA define
the term ``loss of flight'' and clarify how it is different from ``loss
of control.'' The commenter questioned whether loss of flight meant the
UA could not continue its intended flight plan but could safely land or
terminate the flight.
FAA Response: The FAA has added a new section, D&R.005, to define
the terms ``loss of flight'' and ``loss of control'' for the purposes
of these airworthiness criteria. ``Loss of flight'' refers to a UA's
inability to complete its flight as planned, up to and through its
originally planned landing. ``Loss of flight'' includes scenarios where
the UA experiences controlled flight into terrain or obstacles, or any
other collision, or a loss of altitude that is severe or non-
recoverable. ``Loss of flight'' includes deploying a parachute or
ballistic recovery system that leads to an unplanned landing outside
the operator's designated recovery zone.
``Loss of control'' means an unintended departure of an aircraft
from controlled flight. It includes control reversal or an undue loss
of longitudinal, lateral, and directional stability and control. It
also includes an upset or entry into an unscheduled or uncommanded
attitude with high potential for uncontrolled impact with terrain.
``Loss of control'' means a spin, loss of control authority, loss of
aerodynamic stability, divergent flight characteristic, or similar
occurrence, which could generally lead to a crash.
Terminology: Skill and Alertness of Pilot
Comment Summary: Two commenters requested the FAA clarify
terminology with respect to piloting skill and alertness. Droneport
Texas LLC stated that the average pilot skill and alertness is
currently undefined, as remote pilots do not undergo oral or practical
examinations to obtain certification. NUAIR noted that, despite the
definition of ``exceptional piloting skill and alertness'' in Advisory
Circular (AC) 23-8C, Flight Test Guide for Certification of Part 23
Airplanes, there is a significant difference between the average skill
and alertness of a remote pilot certified under 14 CFR part 107 and a
pilot certified under 14 CFR part 61. The commenter requested the FAA
clarify the minimum qualifications and ratings to perform as a remote
pilot of a UAS with a type certificate.
FAA Response: These airworthiness criteria do not require
exceptional piloting skill and alertness for testing. The FAA included
this as a requirement to ensure the applicant passes testing by using
pilots of average skill who have been certificated under part 61, as
opposed to highly trained pilots with thousands of hours of flight
experience. Because the Amazon MK27-2 has a maximum weight above 55
pounds, the remote pilot provision of part 107 does not apply.
Concept of Operations
The FAA proposed a requirement for the applicant to submit a CONOPS
describing the UAS and identifying the intended operational concepts.
The FAA explained in the preamble of the notice of proposed
airworthiness criteria that the information in the CONOPS would
determine parameters for testing and flight manual operating
limitations.
Comment Summary: One commenter stated that the airworthiness
criteria are generic and requested the FAA add language to proposed
UAS.001 to clarify that some of the criteria may not be relevant or
necessary.
FAA Response: Including the language requested by the commenter
would be inappropriate, as these airworthiness criteria are project-
specific. Thus, in this case, each element of these airworthiness
criteria is a requirement specific to the type certification of
Amazon's proposed UA design.
Comment Summary: ALPA requested the criteria specify that the
applicant's CONOPS contain sufficient detail to determine the
parameters and extent of testing, as well as operating limitations
placed on the UAS for its operational uses.
FAA Response: The FAA agrees and has updated D&R.001 to clarify
that the information required for inclusion in the CONOPS proposal
(D&R.001(a) through (g)), must be described in sufficient detail to
determine the parameters and extent of testing and operating
limitations.
Comment Summary: ALPA requested the CONOPS include a description of
a means to ensure separation from other aircraft and perform collision
avoidance maneuvers. ALPA stated that its requested addition to the
CONOPS is critical to the safety of other airspace users, as manned
aircraft do not easily see most UAs.
FAA Response: The FAA agrees and has updated D&R.001 to require
that the applicant identify collision avoidance equipment (whether
onboard the UA or part of the AE), if the applicant requests to include
that equipment.
Comment Summary: ALPA requested the FAA add security-related (other
than cyber-security) requirements to the CONOPS criteria, including
mandatory reporting of security occurrences, security training and
awareness programs for all personnel involved in UAS operations, and
security standards
[[Page 4130]]
for the transportation of goods, similar to those for manned aviation.
FAA Response: The type certificate only establishes the approved
design of the UA. Operations and operational requirements, including
those regarding security occurrences, security training, and package
delivery security standards (other than cybersecurity airworthiness
design requirements) are beyond the scope of the airworthiness criteria
established by this document and are not required for type
certification.
Comment Summary: UAS.001(c) proposed to require that the
applicant's CONOPS include a description of meteorological conditions.
ALPA requested the FAA change UAS.001(c) to require a description of
meteorological and environmental conditions and their operational
limits. ALPA stated the CONOPS should include maximum wind speeds,
maximum or minimum temperatures, maximum density altitudes, and other
relevant phenomena that will limit operations or cause operations to
terminate.
FAA Response: D&R.001(c) and D&R.125 address meteorological
conditions, while D&R.001(g) addresses environmental considerations.
The FAA determined that these criteria are sufficient to cover the
weather phenomena mentioned by the commenter without specifically
requiring identification of related operational limits.
Control Station
To address the risks associated with loss of control of the UA, the
FAA proposed that the applicant design the control station to provide
the pilot with all information necessary for continued safe flight and
operation.
Comment Summary: ALPA, Embry-Riddle Aeronautical University, and
two individual commenters requested the FAA revise the proposed
criteria to add requirements for the control station. Specifically,
these commenters requested the FAA include the display of data and
alert conditions to the pilot, physical security requirements for both
the control station and the UAS storage area, design requirements that
minimize negative impact of extended periods of low pilot workload,
transfer of control between pilots, and human factors/human machine
interface considerations for handheld controls. NUAIR requested the FAA
designate the control station as a flight critical component for
operations.
EASA and an individual commenter requested the FAA consider
flexibility in some of the proposed criteria. EASA stated that the list
of information in proposed UAS.100 is too prescriptive and contains
information that may not be relevant for highly automated systems. The
individual commenter requested that the FAA allow part-time or non-
continuous displays of required information that do not influence the
safety of the flight.
FAA Response: Although the scope of the proposed airworthiness
criteria applied to the entire UAS, the FAA has re-evaluated its
approach to type certification of low-risk unmanned aircraft using
durability and reliability testing. A UA is an aircraft that is
operated without the possibility of direct human intervention from
within or on the aircraft.\2\ A UAS is defined as a UA and its AE,
including communication links and the components that control the UA,
that are required to operate the UAS safely and efficiently in the
national airspace system.\3\ As explained in FAA Memorandum AIR600-21-
AIR-600-PM01, dated July 13, 2021, the FAA determined it will apply the
regulations for type design approval, production approval, conformity,
certificates of airworthiness, and maintenance to only the UA and not
to the AE. However, because safe UAS operations depend and rely on both
the UA and the AE, the FAA will consider the AE in assessing whether
the UA meets the airworthiness criteria that comprise the certification
basis.
---------------------------------------------------------------------------
\2\ See 49 U.S.C. 44801(11).
\3\ See 49 U.S.C. 44801(12).
---------------------------------------------------------------------------
While the AE items themselves will be outside the scope of the UA
type design, the applicant will provide sufficient specifications for
any aspect of the AE, including the control station, which could affect
airworthiness. The FAA will approve either the specific AE or minimum
specifications for the AE, as identified by the applicant, as part of
the type certificate by including them as an operating limitation in
the type certificate data sheet and flight manual. The FAA may impose
additional operating limitations specific to the AE through conditions
and limitations for inclusion in the operational approval (i.e.,
waivers, exemptions, or a combination of these). In accordance with
this approach, the FAA will consider the entirety of the UAS for
operational approval and oversight.
Accordingly, the FAA has revised the criteria by replacing proposed
section UAS.100, applicable to the control station design, with
D&R.100, UA Signal Monitoring and Transmission, with substantively
similar criteria that apply to the UA design. The FAA has also added a
new section, D&R.105, UAS AE Required for Safe UA Operations, which
requires the applicant to provide information concerning the
specifications of the AE. The FAA has moved the alert function
requirement proposed in UAS.100(a) to new section D&R.105(a)(1)(i). As
part of the clarification of the testing of the interaction between the
UA and AE, the FAA has added a requirement to D&R.300(h) for D&R
testing to use minimum specification AE. This addition requires the
applicant to demonstrate that the limits proposed for those AE will
allow the UA to operate as expected throughout its service life.
Finally, the FAA has revised references throughout the airworthiness
criteria from ``UAS'' to ``UA,'' as appropriate, to reflect the FAA
determination that the regulations for type design approval, production
approval, conformity, certificates of airworthiness, and maintenance
apply to only the UA.
Software
The FAA proposed criteria on verification, configuration
management, and problem reporting to minimize the existence of errors
associated with UAS software.
Comment Summary: ALPA requested the FAA add language to the
proposed criteria to ensure that some level of software engineering
principles are used without being too prescriptive.
FAA Response: By combining the software-testing requirement of
D&R.110(a) with successful completion of the requirements in the entire
``Testing'' subpart, the acceptable level of software assurance will be
identified and demonstrated. The configuration management system
required by D&R.110(b) will ensure that the software is adequately
documented and traceable both during and after the initial type
certification activities.
Comment Summary: EASA suggested the criteria require that the
applicant establish and correctly implement system requirements or a
structured software development process for critical software.
FAA Response: Direct and specific evaluation of the software
development process is more detailed than what the FAA intended with
the proposed criteria, which use D&R testing to evaluate the UAS as a
whole system, rather than evaluating individual components within the
UA. Successful completion of the testing requirements provides
confidence that the components that make up the UA provide an
acceptable level of safety, commensurate to the low-risk nature of this
aircraft. The FAA finds no change to the airworthiness criteria is
needed.
[[Page 4131]]
Comment Summary: Two individual commenters requested the FAA
require the manned aircraft software certification methodology in RTCA
DO-178C, Software Considerations in Airborne Systems and Equipment
Certification, for critical UA software.
FAA Response: Under these airworthiness criteria, only software
that may affect the safe operation of the UA must be verified by test.
To verify by test, the applicant will need to provide an assessment
showing that other software is not subject to testing because it has no
impact on the safe operation of the UA. For software that is subject to
testing, the FAA may accept multiple options for software
qualification, including DO-178C. Further, specifying that applicants
must comply with DO-178 would be inconsistent with the FAA's intent to
issue performance-based airworthiness criteria.
Comment Summary: NAAA stated that an overreliance of software in
aircraft has been and continues to be a source of accidents and
requested the FAA include criteria to prevent a midair collision.
FAA Response: The proper functioning of software is an important
element of type certification, particularly with respect to flight
controls and navigation. The airworthiness criteria in D&R.110 are
meant to provide an acceptable level of safety commensurate with the
risk posed by this UA. Additionally, the airworthiness criteria require
contingency planning per D&R.120 and the demonstration of the UA's
ability to detect and avoid other aircraft in D&R.310, if requested by
the applicant. The risk of a midair collision will be minimized by the
operating limitations that result from testing based on the operational
parameters identified by the applicant in its CONOPS (such as
geographic operating boundaries, airspace classes, and congestion of
the proposed operating area), rather than by specific mitigations built
into the aircraft design itself. These criteria are sufficient due to
the low-risk nature of the Model MK27-2.
Cybersecurity
Because the UA requires a continuous wireless connection, the FAA
proposed criteria to address the risks to the UAS from cybersecurity
threats.
Comment Summary: ALPA and an individual commenter requested adding
a requirement for cybersecurity protection, including protection from
hacking, for navigation and position reporting systems such as Global
Navigation Satellite System (GNSS). ALPA further requested the FAA
include criteria to address specific cybersecurity vulnerabilities,
such as jamming (denial of signal) and spoofing (false position data is
inserted). ALPA stated that, for navigation, UAS primarily use GNSS--an
unencrypted, open-source, low power transmission that can be jammed,
spoofed, or otherwise manipulated.
FAA Response: The FAA will assess elements directly influencing the
UA for cybersecurity under D&R.115 and will assess the AE as part of
any operational approvals an operator may seek. D&R.115 (proposed as
UAS.115), addresses intentional unauthorized electronic interactions,
which includes, but is not limited to, hacking, jamming, and spoofing.
These airworthiness criteria require the high-level outcome the UA must
meet, rather than discretely identifying every aspect of cybersecurity
the applicant will address.
Contingency Planning
The FAA proposed criteria requiring that the UAS be designed to
automatically execute a predetermined action in the event of a loss of
communication between the pilot and the UA. The FAA further proposed
that the predetermined action be identified in the Flight Manual and
that the UA be precluded from taking off when the quality of service is
inadequate.
Comment Summary: ALPA and an individual commenter requested the
criteria encompass more than loss or degradation of the command and
control (C2) link, as numerous types of critical part or systems
failures can occur that include degraded capabilities, whether
intermittent or sustained. ALPA requested the FAA add language to the
proposed criteria to address specific failures such as loss of a
primary navigation sensor, degradation or loss of navigation
capability, and simultaneous impact of C2 and navigation links. The
individual commenter requested the FAA revise the proposed criteria to
only require execution of the predetermined action in the event the
loss of the C2 link exceeds 60 seconds, and suggested that the criteria
as proposed would result in suitable drones aborting flights or being
constantly redirected by the operator because of a brief C2
interruption.
FAA Response: The airworthiness criteria address the issues raised
by commenters. Specifically, D&R.120(a) addresses actions the UA will
automatically and immediately take when the operator no longer has
control of the UA. Should the specific failures identified by ALPA
result in the operator's loss of control, then the criteria require the
UA to execute a predetermined action. Degraded navigation performance
does not raise the same level of concern as a degraded or lost C2 link.
For example, a UA may experience interference with a GPS signal on the
ground, but then find acceptable signal strength when above a tree line
or other obstruction. The airworthiness criteria require that neither
degradation nor complete loss of GPS or C2, as either condition would
be a failure of that system, result in unsafe loss of control or
containment. The applicant must demonstrate this by test to meet the
requirements of D&R.305(a)(3).
Under the airworthiness criteria, the minimum performance
requirements for the C2 link, defining when the link is degraded to an
unacceptable level, may vary among different UAS designs. The level of
degradation that triggers a loss is dependent upon the specific UA
characteristics; this level will be defined by the applicant and
demonstrated to be acceptable by testing as required by D&R.305(a)(2)
and D&R.310(a)(1).
Comment Summary: An individual commenter requested the FAA use
distinct terminology for ``communication'' used for communications with
air traffic control, and ``C2 link'' used for command and control
between the remote pilot station and UA. The commenter questioned
whether, in the proposed criteria, the FAA stated ``loss of
communication between the pilot and the UA'' when it intended to state
``loss of C2 link.''
FAA Response: Communication extends beyond the C2 link and specific
control inputs. This is why D&R.001 requires the applicant's CONOPS to
include a description of the command, control, and communications
functions. As long as the UA operates safely and predictably per its
lost link contingency programming logic, a C2 interruption does not
constitute a loss of control.
Lightning
The FAA proposed criteria to address the risks that would result
from a lightning strike, accounting for the size and physical
limitations of a UAS that could preclude traditional lightning
protection features. The FAA further proposed that without lightning
protection for the UA, the Flight Manual must include an operating
limitation to prohibit flight into weather conditions with potential
lightning.
Comment Summary: An individual requested the FAA revise the
criteria to include a similar design mitigation or operating limitation
for High Intensity Radiated Fields (HIRF). The commenter noted that
HIRF is included in proposed UAS.300(e) as part of the expected
[[Page 4132]]
environmental conditions that must be replicated in testing.
FAA Response: The airworthiness criteria, which are adopted as
proposed, address the issue raised by the commenter. The applicant must
identify tested HIRF exposure capabilities, if any, in the Flight
Manual to comply with the criteria in D&R.200(a)(5). Information
regarding HIRF capabilities is necessary for safe operation because
proper communication and software execution may be impeded by HIRF-
generated interference, which could result in loss of control of the
UA. It is not feasible to measure HIRF at every potential location
where the UA will operate; thus, requiring operating limitations for
HIRF as requested by the commenter would be impractical.
Adverse Weather Conditions
The FAA proposed criteria either requiring that design
characteristics protect the UAS from adverse weather conditions or
prohibiting flight into known adverse weather conditions. The criteria
proposed to define adverse weather conditions as rain, snow, and icing.
Comment Summary: ALPA and three individual commenters requested the
FAA expand the proposed definition of adverse weather conditions. These
commenters noted that because of the size and physical limitations of
the Model MK27-2, adverse weather should also include wind, downdraft,
low-level wind shear (LLWS), microburst, and extreme mechanical
turbulence.
FAA Response: No additional language needs to be added to the
airworthiness criteria to address wind effects. The wind conditions
specified by the commenters are part of normal UA flight operations.
The applicant must demonstrate by flight test that the UA can withstand
wind without failure to meet the requirements of D&R.300(b)(9). The FAA
developed the criteria in D&R.130 to address adverse weather conditions
(rain, snow, and icing) that would require additional design
characteristics for safe operation. Any operating limitations necessary
for operation in adverse weather or wind conditions will be included in
the Flight Manual as required by D&R.200.
Comment Summary: One commenter questioned whether the criteria
proposed in UAS.130(c)(2), requiring a means to detect adverse weather
conditions for which the UAS is not certificated to operate, is a
prescriptive requirement to install an onboard detection system. The
commenter requested, if that was the case, that the FAA allow
alternative procedures to avoid flying in adverse weather conditions.
FAA Response: The language referred to by the commenter is not a
prescriptive design requirement for an onboard detection system. The
applicant may use any acceptable source to monitor weather in the area,
whether onboard the UA or from an external source.
Comment Summary: One commenter stated that flying in adverse
weather would create significant problems when delivering cargo because
wind, rain, and gust fronts can divert a drone from its intended path.
The commenter further stated that the size of the Amazon Model MK27-2
(78 inches in width) can be dangerous to buildings, animals, vehicles,
and people.
FAA Response: Operators will need an air carrier certificate to
conduct cargo delivery operations. As part of the approval for the air
carrier certificate, as well as any other operational approval the
operator may seek (i.e., waivers, exemptions), the FAA will impose any
additional appropriate limitations.
Critical Parts
The FAA proposed criteria for critical parts that were
substantively the same as those in the existing standards for normal
category rotorcraft under Sec. 27.602, with changes to reflect UAS
terminology and failure conditions. The criteria proposed to define a
critical part as a part, the failure of which could result in a loss of
flight or unrecoverable loss of control of the aircraft.
Comment Summary: EASA requested the FAA avoid using the term
``critical part,'' as it is a well-established term for complex manned
aircraft categories and may create incorrect expectations on the
oversight process for parts.
FAA Response: For purposes of the airworthiness criteria
established for the Amazon Model MK27-2, the FAA has changed the term
``critical part'' to ``flight essential part.''
Comment Summary: An individual commenter requested the FAA revise
the proposed criteria such that a failure of a flight essential part
would only occur if there is risk to third parties.
FAA Response: The definition of ``flight essential'' does not
change regardless of whether on-board systems are capable of safely
landing the UA when it is unable to continue its flight plan. Tying the
definition of a flight essential part to the risk to third parties
would result in different definitions for the part depending on where
and how the UA is operated. These criteria for the Model MK27-2 UA
apply the same approach as for manned aircraft.
Flight Manual
The FAA proposed criteria for the Flight Manual that were
substantively the same as the existing standards for normal category
airplanes, with minor changes to reflect UAS terminology.
Comment Summary: ALPA requested the FAA revise the criteria to
include normal, abnormal, and emergency operating procedures along with
their respective checklist. ALPA further requested the checklist be
contained in a quick reference handbook (QRH).
FAA Response: The FAA did not intend for the airworthiness criteria
to exclude abnormal procedures from the flight manual. In these final
airworthiness criteria, the FAA has changed ``normal and emergency
operating procedures'' to ``operating procedures'' to encompass all
operating conditions and align with 14 CFR 23.2620, which includes the
airplane flight manual requirements for normal category airplanes. The
FAA has not made any changes to add language that would require the
checklists to be included in a QRH. FAA regulations do not require
manned aircraft to have a QRH for type certification. Therefore, it
would be inconsistent for the FAA to require a QRH for the Amazon Model
MK27-2 UA.
Comment Summary: ALPA requested the FAA revise the airworthiness
criteria to require that the Flight Manual and QRH be readily available
to the pilot at the control station.
FAA Response: ALPA's request regarding the Flight manual addresses
an operational requirement, similar to 14 CFR 91.9 and is therefore not
appropriate for type certification airworthiness criteria. Also, as
previously discussed, FAA regulations do not require a QRH. Therefore,
it would be inappropriate to require it to be readily available to the
pilot at the control station.
Comment Summary: Droneport Texas LLC requested the FAA revise the
airworthiness criteria to add required Flight Manual sections for
routine maintenance and mission-specific equipment and procedures. The
commenter stated that the remote pilot or personnel on the remote
pilot-in-command's flight team accomplish most routine maintenance, and
that the flight team usually does UA rigging with mission equipment.
FAA Response: The requested change is appropriate for a maintenance
document rather than a flight manual because it addresses maintenance
procedures rather than the piloting functions. The FAA also notes that,
similar to the criteria for certain manned
[[Page 4133]]
aircraft, the airworthiness criteria require that the applicant prepare
instructions for continued airworthiness (ICA) in accordance with
Appendix A to Part 23. As the applicant must provide any maintenance
instructions and mission-specific information necessary for safe
operation and continued operational safety of the UA, in accordance
with D&R.205, no changes to the airworthiness criteria are necessary.
Comment Summary: An individual commenter requested the FAA revise
the criteria in proposed UAS.200(b) to require that ``other
information'' referred to in proposed UAS.200(a)(5) be approved by the
FAA. The commenter noted that, as proposed, only the information listed
in UAS.200(a)(1) through (4) must be FAA approved.
FAA Response: The change requested by the commenter would be
inconsistent with the FAA's airworthiness standards for flight manuals
for manned aircraft. Sections 23.2620(b), 25.1581(b), 27.1581(b), and
29.1581(b)) include requirements for flight manuals to include
operating limitations, operating procedures, performance information,
loading information, and other information that is necessary safe
operation because of design, operating, or handling characteristics,
but limit FAA approval to operating limitations, operating procedures,
performance information, and loading information.
Under Sec. 23.2620(b)(1), for low-speed level 1 and level 2
airplanes, the FAA only approves the operating limitations. In applying
a risk-based approach, the FAA has determined it would not be
appropriate to hold the lowest risk UA to a higher standard than what
is required for low speed level 1 and level 2 manned aircraft.
Accordingly, the FAA has revised the airworthiness criteria to only
require FAA approval of the operating limitations.
Comment Summary: NUAIR requested the FAA recognize that Sec.
23.2620 is only applicable to the aircraft and does not address off-
aircraft components such as the control station, control and non-
payload communications (CNPC) data link, and launch and recovery
equipment. The commenter noted that this is also true of industry
consensus-based standards designed to comply with Sec. 23.2620.
FAA Response: As explained in more detail in the Control Station
section of this document, the FAA has revised the airworthiness
criteria for the AE. The FAA will approve AE or minimum specifications
for the AE that could affect airworthiness as an operating limitation
in the UA flight manual. The FAA will establish the approved AE or
minimum specifications as operating limitations and include them in the
UA type certificate data sheet and Flight Manual in accordance with
D&R.105(c). The establishment of requirements for, and the approval of
AE will be in accordance with FAA Memorandum AIR600-21-AIR-600-PM01,
dated July 13, 2021.
Instructions for Continued Airworthiness (ICA)
The FAA proposed criteria for ICA that were substantively the same
as those in the existing standards for normal category airplanes, with
minor changes to reflect UA terminology instead of airplane
terminology.
Comment Summary: One individual commenter requested the
airworthiness criteria contain maintenance, repair, and overhaul
standards for the continued safe operation of the UAS after type
certification. Specifically, the commenter suggested a maintenance
program, maintenance record, maintenance manual, minimum equipment
list, illustrated parts catalog, service bulletin, parts manufacturer
approval, technical standard order, airworthiness directive, and
technician qualification approval systems for each type of commercial
UAS. Another individual commenter requested information on the expected
lifespan of the Model MK27-2 and any continued airworthiness checks it
will undergo, expecting a higher level of safety than for UA flown
under part 107. A third individual commenter requested information on
the type of pre-flight and post-flight inspections that will be
performed and questioned the number of pilots and technicians needed.
FAA Response: The airworthiness criteria pertaining to ICA
(D&R.205), which are adopted as proposed, require that the applicant
prepare ICA in accordance with Appendix A to Part 23, similar to manned
aircraft. Appendix A to Part 23 requires maintenance servicing
information, instructions, inspection and overhaul periods, and other
continued airworthiness information, such as that suggested by the
commenters. The FAA will not provide the expected lifespan of the Model
MK27-2 or the specific inspections required, as this information is
proprietary to the applicant.
Durability and Reliability
The FAA proposed durability and reliability testing that would
require the applicant to demonstrate safe flight of the UAS across the
entire operational envelope and up to all operational limitations, for
all phases of flight and all aircraft configurations described in the
applicant's CONOPS, with no failures that result in a loss of flight,
loss of control, loss of containment, or emergency landing outside the
operator's recovery area. The FAA further proposed that the unmanned
aircraft would only be certificated for operations within the
limitations, and for flight over areas no greater than the maximum
population density, as described in the applicant's CONOPS and
demonstrated by test.
Comment Summary: ALPA requested that the proposed certification
criteria require all flights during testing be completed in both normal
and non-normal or off-nominal scenarios with no failures that result in
a loss of flight, loss of control, loss of containment, or emergency
landing outside of the operator's recovery zone. Specifically, ALPA
stated that testing must not require exceptional piloting skill or
alertness and include, at a minimum: All phases of the flight envelope,
including the highest UA to pilot ratios; the most adverse combinations
of the conditions and configuration; the environmental conditions
identified in the CONOPS; the different flight profiles and routes
identified in the CONOPS; and exposure to EMI and HIRF.
FAA Response: No change is necessary because the introductory text
and paragraphs (b)(7), (b)(9), (b)(10), (b)(13), (c), (d), (e), and (f)
of D&R.300, which are adopted as proposed, contain the specific testing
requirements requested by ALPA.
Comment Summary: Droneport Texas LLC requested the FAA revise the
testing criteria to include, for operation at night, testing both with
and without night vision aids. The commenter stated that because small
UAS operation at night is waivable under 14 CFR part 107, manufacturers
will likely make assumptions concerning a pilot's familiarity with
night vision device-aided and unaided operations.
FAA Response: Under D&R.300(b)(11), the applicant must demonstrate
by flight test that the UA can operate at night without failure using
whatever equipment is onboard the UA itself. The pilot's familiarity,
or lack thereof, with night vision equipment does not impact whether
the UA is reliable and durable to complete testing without any
failures. The FAA further notes that part 107 does not apply to this
aircraft because it has a maximum gross takeoff weight of 89 pounds.
Comment Summary: EASA requested the FAA clarify how testing
durability and reliability commensurate to the maximum population
density, as proposed, aligns with the Specific
[[Page 4134]]
Operations Risk Assessment (SORA) approach that is open to operational
mitigation, reducing the initial ground risk. An individual commenter
requested the FAA provide more details about the correlation between
the number of flight hours tested and the CONOPS environment (e.g.,
population density). The commenter stated that this is one of the most
fundamental requirements, and the FAA should ensure equal treatment to
all current and future applicants.
FAA Response: In developing these testing criteria, the FAA sought
to align the risk of UAS operations with the appropriate level of
protection for human beings on the ground. The FAA proposed
establishing the maximum population density demonstrated by durability
and reliability testing as an operating limitation on the type
certificate. However, the FAA has re-evaluated its approach and
determined it to be more appropriate to connect the durability and
reliability demonstrated during certification testing with the
operating environment defined in the CONOPS.
Basing testing on maximum population density may result in
limitations not commensurate with many actual operations. As population
density broadly refers to the number of people living in a given area
per square mile, it does not allow for evaluating variation in a local
operating environment. For example, an operator may have a route in an
urban environment with the actual flight path along a greenway; the
number of human beings exposed to risk from the UA operating overhead
would be significantly lower than the population density for the area.
Conversely, an operator may have a route over an industrial area where
few people live, but where, during business hours, there may be highly
dense groups of people. Specific performance characteristics such as
altitude and airspeed also factor into defining the boundaries for safe
operation of the UA.
Accordingly, the FAA has revised D&R.300 to require the UA design
to be durable and reliable when operated under the limitations
prescribed for its operating environment. The information in the
applicant's CONOPS will determine the operating environment for
testing. For example, the minimum hours of reliability testing will be
less for a UA conducting agricultural operations in a rural environment
than if the same aircraft will be conducting package deliveries in an
urban environment. The FAA will include the limitations that result
from testing as operating limitations on the type certificate data
sheet and in the UA Flight Manual. The FAA intends for this process to
be similar to the process for establishing limitations prescribed for
special purpose operations for restricted category aircraft. This
allows for added flexibility in determining appropriate operating
limitations, which will more closely reflect the operating environment.
Finally, a comparison of these criteria with EASA's SORA approach
is beyond the scope of this document because the SORA is intended to
result in an operational approval rather than a type certificate.
Comment Summary: EASA requested the FAA clarify how reliability at
the aircraft level to ensure high-level safety objectives would enable
validation of products under applicable bilateral agreements.
FAA Response: As the FAA and international aviation authorities are
still developing general airworthiness standards for UA, it would be
speculative for the FAA to comment on the validation process for any
specific UA.
Comment Summary: EASA requested the FAA revise the testing criteria
to include a compliance demonstration related to adverse combinations
of the conditions and configurations and with respect to weather
conditions and average pilot qualification.
FAA Response: No change is necessary because D&R.300(b)(7), (b)(9),
(b)(10), (c), and (f), which are adopted as proposed, contain the
specific testing requirements requested by EASA.
Comment Summary: EASA noted that, under the proposed criteria,
testing involving a large number of flight hours will limit changes to
the configuration.
FAA Response: Like manned aircraft, the requirements of 14 CFR part
21, subpart D, apply to UA for changes to type certificates. The FAA is
developing procedures for processing type design changes for UA type
certificated using durability and reliability testing.
Comment Summary: EASA requested the FAA clarify whether the
proposed testing criteria would require the applicant to demonstrate
aspects that do not occur during a successful flight, such as the
deployment of emergency recovery systems and fire protection/post-crash
fire. EASA asked if these aspects are addressed by other means and what
would be the applicable airworthiness criteria.
FAA Response: Equipment not required for normal operation of the UA
do not require an evaluation for their specific functionality. D&R
testing will show that the inclusion of any such equipment does not
prevent normal operation. Therefore, the airworthiness criteria would
not require functional testing of the systems described by EASA.
Comment Summary: An individual commenter requested the FAA specify
the acceptable percentage of failures in the testing that would result
in a ``loss of flight.'' The Small UAV Coalition requested the FAA
clarify what constitutes an emergency landing outside an operator's
landing area, as some UAS designs could include an onboard health
system that initiates a landing to lessen the potential of a loss of
control event. The commenter suggested that, in those cases, a landing
in a safe location should not invalidate the test.
FAA Response: The airworthiness criteria require that all test
points and flight hours occur with no failures result in a loss of
flight, control, containment, or emergency landing outside the
operator's recovery zone. The FAA has determined that there is no
acceptable percentage of failures in testing. In addition, while the
recovery zone may differ for each UAS design, an emergency or unplanned
landing outside of a designated landing area would result in a test
failure.
Comment Summary: The Small UAV Coalition requested that a single
failure during testing not automatically restart counting the number of
flight test operations set for a particular population density; rather,
the applicant should have the option to identify the failure through
root-cause and fault-tree analysis and provide a validated mitigation
to ensure it will not recur. An individual commenter requested the FAA
to clarify whether the purpose of the tests is to show compliance with
a quantitative safety objective. The commenter further requested the
FAA allow the applicant to reduce the number of flight testing hours if
the applicant can present a predicted safety and reliability analysis.
FAA Response: The intent of the testing criteria is for the
applicant to demonstrate the aircraft's durability and reliability
through a successful accumulation of flight testing hours. The FAA does
not intend to require analytical evaluation to be part of this process.
However, the applicant will comply with these testing criteria using a
means of compliance, accepted by the FAA, through the issue paper
process. The means of compliance will be dependent on the CONOPS the
applicant has proposed to meet.
Probable Failures
The FAA proposed criteria to evaluate how the UAS functions after
probable
[[Page 4135]]
failures, including failures related to propulsion systems, C2 link,
GPS, critical flight control components with a single point of failure,
control station, and any other equipment identified by the applicant.
Comment Summary: Droneport Texas LLC requested the FAA add a bird
strike to the list of probable failures. The commenter stated that
despite sense and avoid technologies, flocks of birds can overcome the
maneuver capabilities of a UA and result in multiple, unintended
failures.
FAA Response: Unlike manned aircraft, where aircraft size, design,
and construct are critical to safe control of the aircraft after
encountering a bird strike, the FAA determined testing for bird strike
capabilities is not necessary for the Model MK27-2 UA. The FAA has
determined that a bird strike requirement is not necessary because the
smaller size and lower operational speed of the MK27-2 reduce the
likelihood of a bird strike, combined with the reduced consequences of
failure due to no persons onboard. Instead, the FAA is using a risk-
based approach to tailor airworthiness requirements commensurate to the
low-risk nature of the Model MK27-2 UA.
Comment Summary: ALPA requested the FAA require that all probable
failure tests occur at the critical phase and mode of flight and at the
highest aircraft-to-pilot ratio. ALPA stated the proposed criteria are
critically important for systems that rely on a single source to
perform multi-label functions, such as GNSS, because failure or
interruption of GNSS will lead to loss of positioning, navigation, and
timing (PNT) and functions solely dependent on PNT, such as geo-fencing
and contingency planning.
FAA Response: No change is necessary because D&R.300(c) requires
that the testing occur at the critical phase and mode of flight and at
the highest UA-to-pilot ratio.
Comment Summary: Droneport Texas LLC requested the FAA add recovery
from vortex ring state (VRS) to the list of probable failures. The
commenter stated the UA uses multiple rotors for lift and is therefore
susceptible to VRS. The commenter further stated that because recovery
from settling with power is beyond a pilot's average skill for purposes
of airworthiness testing, the aircraft must be able to sense and
recover from this condition without pilot assistance.
FAA Response: D&R.305 addresses probable failures related to
specific components of the UAS. VRS is an aerodynamic condition a UA
may encounter during flight testing; it is not a component subject to
failure.
Comment Summary: Droneport Texas LLC also requested the FAA add a
response to the Air Traffic Control-Zero (ATC-Zero) command to the list
of probable failures. The commenter stated, based on lessons learned
after the attacks on September 11, 2001, aircraft that can fly BVLOS
should be able to respond to an ATC-Zero condition.
FAA Response: The commenter's request is more appropriate for the
capabilities and functions testing criteria in D&R.310 than probable
failures testing in D&R.305. D&R.310(a)(3) requires the applicant to
demonstrate by test that the pilot has the ability to safely
discontinue a flight. A pilot may discontinue a flight for a wide
variety of reasons, including responding to an ATC-zero command.
Comment Summary: EASA stated the proposed language seems to require
an additional analysis and safety assessment, which would be
appropriate for the objective requirement of ensuring a probable
failure does not result in a loss of containment or control. EASA
further stated that an applicant's basic understanding of the systems
architecture and effects of failures is essential.
FAA Response: The FAA agrees with the expectation that applicants
understand the system architecture and effects of failures of a
proposed design, which is why the criteria include a requirement for
the applicant to test the specific equipment identified in D&R.305 and
identify any other equipment that is not specifically identified in
D&R.305 for testing. As the intent of the criteria is for the applicant
to demonstrate compliance through testing, some analysis may be
necessary to properly identify the appropriate equipment to be
evaluated for probable failures.
Comment Summary: An individual requested that probable failure
testing apply not only to critical flight control components with a
single point of failure, but also to any critical part with a single
point of failure.
FAA Response: The purpose of probable failure testing in D&R.305 is
to demonstrate that if certain equipment fails, it will fail safely.
Adding probable failure testing for critical (now flight essential)
parts would not add value to testing. If a part is essential for
flight, its failure by definition in D&R.135(a) could result in a loss
of flight or unrecoverable loss of control. For example, on a
traditional airplane design, failure of a wing spar in flight would
lead to loss of the aircraft. Because there is no way to show that a
wing spar can fail safely, the applicant must provide its mandatory
replacement time if applicable, structural inspection interval, and
related structural inspection procedure in the Airworthiness
Limitations section of the ICA. Similarly, under these airworthiness
criteria, parts whose failure would inherently result in loss of flight
or unrecoverable loss of control are not subjected to probable failure
testing. Instead, they must be identified as flight essential
components and included in the ICA.
To avoid confusion pertaining to probable failure testing, the FAA
has removed the word ``critical'' from D&R.305(a)(5). In the final
airworthiness criteria, probable failure testing required by
D&R.305(a)(5) applies to ``Flight control components with a single
point of failure.''
Capabilities and Functions
The FAA proposed criteria to require the applicant to demonstrate
by test the minimum capabilities and functions necessary for the
design. UAS.310(a) proposed to require the applicant to demonstrate by
test, the capability of the UAS to regain command and control of the UA
after a C2 link loss, the sufficiency of the electrical system to carry
all anticipated loads, and the ability of the pilot to override any
pre-programming in order to resolve a potential unsafe operating
condition in any phase of flight. UAS.310(b) proposed to require the
applicant to demonstrate by test certain features if the applicant
requests approval of those features (geo-fencing, external cargo,
etc.). UAS.310(c) proposed to require the design of the UAS to
safeguard against an unintended discontinuation of flight or release of
cargo, whether by human action or malfunction.
Comment Summary: ALPA stated the pilot-in-command must always have
the capability to input control changes to the UA and override any pre-
programming without delay as needed for the safe management of the
flight. The commenter requested that the FAA retain the proposed
criteria that would allow the pilot to command to: regain command and
control of the UA after loss of the C2 link; safely discontinue the
flight; and dynamically re-route the UA. In support, ALPA stated the
ability of the pilot to continually command (re-route) the UA,
including termination of the flight if necessary, is critical for safe
operations and should always be available to the pilot.
Honeywell requested the FAA revise paragraphs (a)(3) and (a)(4) of
the
[[Page 4136]]
criteria (UAS.310) to allow for either the pilot or an augmenting
system to safely discontinue the flight and re-route the UA. The
commenter stated that a system comprised of detect and avoid, onboard
autonomy, and ground system can be used for these functions. Therefore,
the criteria should not require that only the pilot can do them.
An individual commenter requested the FAA remove UAS.310(a)(4) of
the proposed criteria because requiring the ability for the pilot to
dynamically re-route the UA is too prescriptive and redundant with the
proposed requirement in UAS.310(a)(3), the ability of the pilot to
discontinue the flight safely.
FAA Response: Because the pilot in command is directly responsible
for the operation of the UA, the pilot must have the capability to
command actions necessary for continued safety. This includes
commanding a change to the flight path or, when appropriate, safely
terminating a flight. The FAA notes that the ability for the pilot to
safely discontinue a flight means the pilot has the means to terminate
the flight and immediately and safely return the UA to the ground. This
is different from the pilot having the means to dynamically re-route
the UA, without terminating the flight, to avoid a conflict.
Therefore, the final airworthiness criteria includes D&R.310(a) as
proposed (UAS.310(a)).
Comment Summary: ALPA requested the FAA revise the criteria to
require that all equipment, systems, and installations conform, at a
minimum, to the standards of Sec. 25.1309.
FAA Response: The FAA determined that traditional methodologies for
manned aircraft, including the system safety analysis required by
Sec. Sec. 23.2510, 25.1309, 27.1309, or 29.1309, would be
inappropriate to require for the Amazon Model MK27-2 due to its smaller
size and reduced level of complexity. Instead, the FAA finds that
system reliability through testing will ensure the safety of this
design.
Comment Summary: ALPA requested the FAA revise the criteria to add
a requirement to demonstrate the ability of the UA and pilot to perform
all of the contingency plans identified in proposed UAS.120.
FAA Response: No change is necessary because D&R.120 and
D&R.305(a)(2), together, require what ALPA requests in its comment.
Under D&R.120, the applicant must design the UA to execute a
predetermined action in the event of a loss of the C2 link.
D&R.305(a)(2) requires the applicant to demonstrate by test that a lost
C2 link will not result in a loss of containment or control of the UA.
Thus, if the applicant does not demonstrate the predetermined
contingency plan resulting from a loss of the C2 link when conducting
D&R.305 testing, the test would be a failure due to loss of
containment.
Comment Summary: ALPA and an individual commenter requested the FAA
revise the criteria so that geo-fencing is a required feature and not
optional due to the safety concerns that could result from a UA exiting
its operating area.
FAA Response: To ensure safe flight, the applicant must test the
proposed safety functions, such as geo-fencing, that are part of the
type design of the Model MK27-2 UA. The FAA determined that geo-fencing
is an optional feature because it is one way, but not the only way, to
ensure a safely contained operation.
Comment Summary: ALPA requested the FAA revise the criteria so that
capability to detect and avoid other aircraft and obstacles is a
required feature and not optional.
FAA Response: D&R.310(a)(4) requires the applicant demonstrate the
ability for the pilot to safely re-route the UA in flight to avoid a
dynamic hazard. The FAA did not prescribe specific design features such
as a collision avoidance system to meet D&R.310(a)(4) because there are
multiple means to minimize the risk of collision.
Comment Summary: McMahon Helicopter Services requested that the
airworthiness criteria require a demonstration of sense-and-avoid
technology that will automatically steer the UA away from manned
aircraft, regardless of whether the manned aircraft has a transponder.
NAAA and an individual commenter requested that the FAA require ADS-B
in/out and traffic avoidance software on all UAS. The Small UAV
Coalition requested the FAA establish standards for collision avoidance
technology, as the proposed criteria are not sufficient for compliance
with the operational requirement to see and avoid other aircraft (Sec.
91.113). The commenters stated that these technologies are necessary to
avoid a mid-air collision between UA and manned aircraft.
FAA Response: D&R.310(a)(4) requires the applicant demonstrate the
ability for the UA to be safely re-routed in flight to avoid a dynamic
hazard. The FAA did not prescribe specific design features, such as the
technologies suggested by the commenters, to meet D&R.310(a)(4) because
they are not the only means for complying with the operational
requirement to see and avoid other aircraft. If an applicant chooses to
equip their UA with onboard collision avoidance technology, those
capabilities and functions must be demonstrated by test per
D&R.310(b)(5).
Verification of Limits
The FAA proposed to require an evaluation of the UA's performance,
maneuverability, stability, and control with a factor of safety.
Comment Summary: EASA requested that the FAA revise its approach to
require a similar compliance demonstration as EASA's for ``light UAS.''
EASA stated the FAA's proposed criteria for verification of limits,
combined with the proposed Flight Manual requirements, seem to replace
a traditional Subpart Flight.\4\ EASA further stated the FAA's approach
in the proposed airworthiness criteria might necessitate more guidance
and means of compliance than the traditional structure.
---------------------------------------------------------------------------
\4\ In the FAA's aircraft airworthiness standards (parts 23, 25,
27 and 29), subpart B of each is titled Flight.
---------------------------------------------------------------------------
FAA Response: The FAA's airworthiness criteria will vary from
EASA's light UAS certification requirements, resulting in associated
differences in compliance demonstrations. At this time, comment on
means of compliance and related guidance material, which are still
under development with the FAA and with EASA, would be speculative.
Propulsion
Comment Summary: ALPA requested the FAA conduct an analysis to
determine battery reliability and safety, taking into account wind and
weather conditions and their effect on battery life. ALPA expressed
concern with batteries as the only source of power for an aircraft in
the NAS. ALPA further requested the FAA not grant exemptions for
battery reserve requirements.
FAA Response: Because batteries are a flight essential part, the
applicant must establish mandatory instructions or life limits for
batteries under the requirements of D&R.135. In addition, when the
applicant conducts its D&R testing, D&R.300(i) prevents the applicant
from exceeding the maintenance intervals or life limits for those
batteries. To the extent the commenter's request addresses fuel
reserves, that is an operational requirement, not a certification
requirement, and therefore beyond the scope of this document.
Comment Summary: Sabrewing Aircraft Company requested the FAA
clarify whether the proposed airworthiness criteria address the
[[Page 4137]]
propulsion system or whether that will be covered in a different
process. The commenter noted that the proposed airworthiness criteria
did not mention aircraft engines, propellers, or other components of an
electric power propulsion system.
FAA Response: Under these airworthiness criteria, the UA type
certificate will include the propulsion system. The FAA will evaluate
the UA at the aircraft level, without differentiating requirements for
each subsystem of the UA, such as powerplant and propulsion elements.
Under D&R.305(a)(1), the applicant must demonstrate that loss of a
propulsion unit will not result in a loss of containment or control of
the UA.
Additional Airworthiness Criteria Identified by Commenters
Comment Summary: McMahon Helicopter Services requested that the
criteria require anti-collision and navigation lighting certified to
existing FAA standards for brightness and size. The commenter stated
that these standards were based on human factors for nighttime and
daytime recognition and are not simply a lighting requirement. An
individual commenter requested that the criteria include a requirement
for position lighting and anti-collision beacons meeting TSO-30c Level
III. NAAA requested the criteria require a strobe light and high
visibility paint scheme to aid in visual detection of the UA by other
aircraft.
FAA Response: The FAA determined it is unnecessary for these
airworthiness criteria to prescribe specific design features for anti-
collision or navigation lighting. The FAA will address anti-collision
lighting as part of any operational approval, similar to the rules in
14 CFR 107.29(a)(2) and (b) for small UAS.
Comment Summary: ALPA requested the FAA add a new section with
minimum standards for Global Navigation Satellite System (GNSS), as the
UAS will likely rely heavily upon GNSS for navigation and to ensure
that the UA does not stray outside of its approved airspace. ALPA
stated that technological advances have made such devices available at
an appropriate size, weight, and power for UAs.
FAA Response: The airworthiness criteria in D&R.100 (UA Signal
Monitoring and Transmission), D&R.110 (Software), D&R.115
(Cybersecurity), and D&R.305(a)(3) (probable failures related to GPS)
sufficiently address design requirements and testing of navigation
systems. Even if the applicant uses a TSO-approved GNSS, these
airworthiness criteria require a demonstration that the UA operates
successfully without loss of containment. Successful completion of
these tests demonstrates that the navigation subsystems are acceptable.
Comment Summary: ALPA requested the FAA revise the criteria to add
a new section requiring equipage to comply with the FAA's new rules on
Remote Identification of Unmanned Aircraft (86 FR 4390, Jan. 15, 2021).
An individual commenter questioned the need for public tracking and
identification of drones in the event of a crash or violation of FAA
flight rules.
FAA Response: The FAA issued the final rule, Remote Identification
of Unmanned Aircraft, after providing an opportunity for public notice
and comment. The final rule is codified at 14 CFR part 89. Part 89
contains the remote identification requirements for unmanned aircraft
certificated and produced under part 21 after September 16, 2022.
Pilot Ratio
Comment Summary: ALPA and four individuals questioned the safety of
multiple Model MK27-2 UA operated by a single pilot, up to a ratio of
20 UA to 1 pilot. ALPA stated that even with high levels of automation,
the pilot must still manage the safe operation and maintain situational
awareness of multiple aircraft in their flight path, aircraft systems,
integration with traffic, obstacles, and other hazards during normal,
abnormal, and emergency conditions. As a result, ALPA recommended the
FAA conduct additional studies to better understand the feasibility of
a single pilot operating multiple UA before developing airworthiness
criteria. The Small UAV Coalition requested the FAA provide criteria
for an aircraft-to-pilot ratio higher than 20:1.
FAA Response: These airworthiness criteria are specific to the
Model MK27-2 UA and, as discussed previously in this preamble,
operations of the Model MK27-2 UA may include multiple UA operated by a
single pilot, up to a ratio of 20 UA to 1 pilot. Additionally, these
airworthiness criteria require the applicant to demonstrate the
durability and reliability of the UA design by flight test, at the
highest aircraft-to-pilot ratio, without exceptional piloting skill or
alertness. In addition, D&R.305(c) requires the applicant to
demonstrate probable failures by test at the highest aircraft-to-pilot
ratio. Should the pilot ratio cause a loss of containment or control of
the UA, then the applicant will fail this testing.
Comment Summary: ALPA stated that to allow a UAS-pilot ratio of up
to 20:1 safely, the possibility that the pilot will need to intervene
with multiple UA simultaneously must be ``extremely remote.'' ALPA
questioned whether this is feasible given the threat of GNSS
interference or unanticipated wind gusts exceeding operational limits.
FAA Response: The FAA's guidance in AC 23.1309-1E, System Safety
Analysis and Assessment for Part 23 Airplanes defines ``extremely
remote failure conditions'' as failure conditions not anticipated to
occur during the total life of an airplane, but which may occur a few
times when considering the total operational life of all airplanes of
the same type. When assessing the likelihood of a pilot needing to
intervene with multiple UA simultaneously, the minimum reliability
requirements will be determined based on the applicant's proposed
CONOPS.
Noise
Comment Summary: Several commenters expressed concern about noise
pollution and noise levels.
FAA Response: The Model MK27-2 will need to comply with FAA noise
certification standards. If the FAA determines that 14 CFR part 36 does
not contain adequate standards for this design, the agency will propose
and seek public comment on a rule of particular applicability for noise
requirements under a separate rulemaking docket.
Operating Altitude
Comment Summary: ALPA, McMahon Helicopter Services, NAAA, and an
individual commented on the operation of UAS at or below 400 feet AGL.
ALPA, McMahon Helicopter Services, and NAAA requested the airworthiness
criteria contain measures for safe operation at low altitudes so that
UAS are not a hazard to manned aircraft, especially operations
involving helicopters; air tours; agricultural applications; emergency
medical services; air tanker firefighting; power line and pipeline
patrol and maintenance; fish and wildlife service; animal control;
military and law enforcement; seismic operations; ranching and
livestock relocation; and mapping. An individual commenter opposed
allowing Amazon to fly cargo UA at less than 400 feet altitude over
people because a stall, power surge or interruption, weather, or signal
interference will endanger people on the ground.
An individual requested clarification concerning how Amazon's UAS
can be exempt from the operational requirements in part 107,
particularly when carrying property for
[[Page 4138]]
compensation or hire beyond visual line of sight. Another individual
requested additional information about minimum altitudes and line of
sight requirements.
FAA Response: The type certificate only establishes the approved
design of the UA. These airworthiness criteria require the applicant
show compliance for the UA altitude sought for type certification.
While this may result in operating limitations in the flight manual,
the type certificate is not an approval for operations. Operations and
operational requirements are beyond the scope of this document.
Guidance Material
Comment Summary: NUAIR requested the FAA complete and publish its
draft AC 21.17-XX, Type Certification Basis for Unmanned Aircraft
Systems (UAS), to provide additional guidance, including templates, to
those who seek a type design approval for UAS. NUAIR also requested the
FAA recognize the industry consensus-based standards applicable to UAS,
as Transport Canada has by publishing its AC 922-001, Remotely Piloted
Aircraft Systems Safety Assurance.
FAA Response: The FAA will continue to develop policy and guidance
for UA type certification and will publish guidance as soon as
practicable. The FAA encourages consensus standards bodies to develop
means of compliance and submit them to the FAA for acceptance.
Regarding Transport Canada AC 922-001, that AC addresses operational
approval rather than type certification.
Safety Management
Comment Summary: ALPA requested the FAA ensure that operations,
including UA integrity, fall under the safety management system. ALPA
further requested the FAA convene a Safety Risk Management Panel before
allowing operators to commence operations and that the FAA require
operators to have an active safety management system, including a non-
punitive safety culture, where incident and continuing airworthiness
issues can be reported.
FAA Response: The type certificate only establishes the approved
design of the UA, including the Flight Manual and ICA. Operations and
operational requirements, including safety management and oversight of
operations and maintenance, are beyond the scope of this document.
Process
Comment Summary: ALPA supported the FAA's type certification of UAS
as a ``special class'' of aircraft under Sec. 21.17(b) but requested
that it be temporary.
FAA Response: As the FAA stated in its notice of policy issued
August 11, 2020 (85 FR 58251, September 18, 2020), the FAA will use the
type certification process under Sec. 21.17(b) for some unmanned
aircraft with no occupants onboard. The FAA further stated in its
policy that it may also issue type certificates under Sec. 21.17(a)
for airplane and rotorcraft UAS designs where the airworthiness
standards in part 23, 25, 27, or 29, respectively, are appropriate. The
FAA, in the future, may consider establishing appropriate generally
applicable airworthiness standards for UA that are not certificated
under the existing standards in parts 23, 25, 27, or 29.
Out of Scope Comments
The FAA received and reviewed several comments that were general,
stated the commenter's viewpoint or opposition without a suggestion
specific to the proposed criteria, or did not make a request the FAA
can act on. These comments are beyond the scope of this document.
Applicability
These airworthiness criteria, established under the provisions of
Sec. 21.17(b), are applicable to the Amazon Model MK27-2 UA. Should
Amazon wish to apply these airworthiness criteria to other UA models,
it must submit a new type certification application.
Conclusion
This action affects only certain airworthiness criteria for the
Amazon Model MK27-2 UA. It is not a standard of general applicability.
Authority Citation
The authority citation for these airworthiness criteria is as
follows:
Authority: 49 U.S.C. 106(g), 40113, and 44701-44702, 44704.
Airworthiness Criteria
Pursuant to the authority delegated to me by the Administrator, the
following airworthiness criteria are issued as part of the type
certification basis for the Amazon Model MK27-2 unmanned aircraft. The
FAA finds that compliance with these criteria appropriately mitigates
the risks associated with the design and concept of operations and
provides an equivalent level of safety to existing rules.
General
D&R.001 Concept of Operations
The applicant must define and submit to the FAA a concept of
operations (CONOPS) proposal describing the unmanned aircraft system
(UAS) operation in the national airspace system for which unmanned
aircraft (UA) type certification is requested. The CONOPS proposal must
include, at a minimum, a description of the following information in
sufficient detail to determine the parameters and extent of testing and
operating limitations:
(a) The intended type of operations;
(b) UA specifications;
(c) Meteorological conditions;
(d) Operators, pilots, and personnel responsibilities;
(e) Control station, support equipment, and other associated
elements (AE) necessary to meet the airworthiness criteria;
(f) Command, control, and communication functions;
(g) Operational parameters (such as population density, geographic
operating boundaries, airspace classes, launch and recovery area,
congestion of proposed operating area, communications with air traffic
control, line of sight, and aircraft separation); and
(h) Collision avoidance equipment, whether onboard the UA or part
of the AE, if requested.
D&R.005 Definitions
For purposes of these airworthiness criteria, the following
definitions apply.
(a) Loss of Control: Loss of control means an unintended departure
of an aircraft from controlled flight. It includes control reversal or
an undue loss of longitudinal, lateral, and directional stability and
control. It also includes an upset or entry into an unscheduled or
uncommanded attitude with high potential for uncontrolled impact with
terrain. A loss of control means a spin, loss of control authority,
loss of aerodynamic stability, divergent flight characteristics, or
similar occurrence, which could generally lead to crash.
(b) Loss of Flight: Loss of flight means a UA's inability to
complete its flight as planned, up to and through its originally
planned landing. It includes scenarios where the UA experiences
controlled flight into terrain, obstacles, or any other collision, or a
loss of altitude that is severe or non-reversible. Loss of flight also
includes deploying a parachute or ballistic recovery system that leads
to an unplanned landing outside the operator's designated recovery
zone.
[[Page 4139]]
Design and Construction
D&R.100 UA Signal Monitoring and Transmission
The UA must be designed to monitor and transmit to the AE all
information required for continued safe flight and operation. This
information includes, at a minimum, the following:
(a) Status of all critical parameters for all energy storage
systems;
(b) Status of all critical parameters for all propulsion systems;
(c) Flight and navigation information as appropriate, such as
airspeed, heading, altitude, and location; and
(d) Communication and navigation signal strength and quality,
including contingency information or status.
D&R.105 UAS AE Required for Safe UA Operations
(a) The applicant must identify and submit to the FAA all AE and
interface conditions of the UAS that affect the airworthiness of the UA
or are otherwise necessary for the UA to meet these airworthiness
criteria. As part of this requirement--
(1) The applicant may identify either specific AE or minimum
specifications for the AE.
(i) If minimum specifications are identified, they must include the
critical requirements of the AE, including performance, compatibility,
function, reliability, interface, pilot alerting, and environmental
requirements.
(ii) Critical requirements are those that if not met would impact
the ability to operate the UA safely and efficiently.
(2) The applicant may use an interface control drawing, a
requirements document, or other reference, titled so that it is clearly
designated as AE interfaces to the UA.
(b) The applicant must show the FAA the AE or minimum
specifications identified in paragraph (a) of this section meet the
following:
(1) The AE provide the functionality, performance, reliability, and
information to assure UA airworthiness in conjunction with the rest of
the design;
(2) The AE are compatible with the UA capabilities and interfaces;
(3) The AE must monitor and transmit to the pilot all information
required for safe flight and operation, including but not limited to
those identified in D&R.100; and
(4) The minimum specifications, if identified, are correct,
complete, consistent, and verifiable to assure UA airworthiness.
(c) The FAA will establish the approved AE or minimum
specifications as operating limitations and include them in the UA type
certificate data sheet and Flight Manual.
(d) The applicant must develop any maintenance instructions
necessary to address implications from the AE on the airworthiness of
the UA. Those instructions will be included in the instructions for
continued airworthiness (ICA) required by D&R.205.
D&R.110 Software
To minimize the existence of software errors, the applicant must:
(a) Verify by test all software that may impact the safe operation
of the UA;
(b) Utilize a configuration management system that tracks,
controls, and preserves changes made to software throughout the entire
life cycle; and
(c) Implement a problem reporting system that captures and records
defects and modifications to the software.
D&R.115 Cybersecurity
(a) UA equipment, systems, and networks, addressed separately and
in relation to other systems, must be protected from intentional
unauthorized electronic interactions that may result in an adverse
effect on the security or airworthiness of the UA. Protection must be
ensured by showing that the security risks have been identified,
assessed, and mitigated as necessary.
(b) When required by paragraph (a) of this section, procedures and
instructions to ensure security protections are maintained must be
included in the ICA.
D&R.120 Contingency Planning
(a) The UA must be designed so that, in the event of a loss of the
command and control (C2) link, the UA will automatically and
immediately execute a safe predetermined flight, loiter, landing, or
termination.
(b) The applicant must establish the predetermined action in the
event of a loss of the C2 link and include it in the UA Flight Manual.
(c) The UA Flight Manual must include the minimum performance
requirements for the C2 data link defining when the C2 link is degraded
to a level where remote active control of the UA is no longer ensured.
Takeoff when the C2 link is degraded below the minimum link performance
requirements must be prevented by design or prohibited by an operating
limitation in the UA Flight Manual.
D&R.125 Lightning
(a) Except as provided in paragraph (b) of this section, the UA
must have design characteristics that will protect the UA from loss of
flight or loss of control due to lightning.
(b) If the UA has not been shown to protect against lightning, the
UA Flight Manual must include an operating limitation to prohibit
flight into weather conditions conducive to lightning activity.
D&R.130 Adverse Weather Conditions
(a) For purposes of this section, ``adverse weather conditions''
means rain, snow, and icing.
(b) Except as provided in paragraph (c) of this section, the UA
must have design characteristics that will allow the UA to operate
within the adverse weather conditions specified in the CONOPS without
loss of flight or loss of control.
(c) For adverse weather conditions for which the UA is not approved
to operate, the applicant must develop operating limitations to
prohibit flight into known adverse weather conditions and either:
(1) Develop operating limitations to prevent inadvertent flight
into adverse weather conditions; or
(2) Provide a means to detect any adverse weather conditions for
which the UA is not certificated to operate and show the UA's ability
to avoid or exit those conditions.
D&R.135 Flight Essential Parts
(a) A flight essential part is a part, the failure of which could
result in a loss of flight or unrecoverable loss of UA control.
(b) If the type design includes flight essential parts, the
applicant must establish a flight essential parts list. The applicant
must develop and define mandatory maintenance instructions or life
limits, or a combination of both, to prevent failures of flight
essential parts. Each of these mandatory actions must be included in
the Airworthiness Limitations Section of the ICA.
Operating Limitations and Information
D&R.200 Flight Manual
The applicant must provide a Flight Manual with each UA.
(a) The UA Flight Manual must contain the following information:
(1) UA operating limitations;
(2) UA operating procedures;
(3) Performance information;
(4) Loading information; and
(5) Other information that is necessary for safe operation because
of design, operating, or handling characteristics.
(b) Those portions of the UA Flight Manual containing the
information specified in paragraph (a)(1) of this section must be
approved by the FAA.
[[Page 4140]]
D&R.205 Instructions for Continued Airworthiness
The applicant must prepare ICA for the UA in accordance with
Appendix A to Part 23, as appropriate, that are acceptable to the FAA.
The ICA may be incomplete at type certification if a program exists to
ensure their completion prior to delivery of the first UA or issuance
of a standard airworthiness certificate, whichever occurs later.
Testing
D&R.300 Durability and Reliability
The UA must be designed to be durable and reliable when operated
under the limitations prescribed for its operating environment, as
documented in its CONOPS and included as operating limitations on the
type certificate data sheet and in the UA Flight Manual. The durability
and reliability must be demonstrated by flight test in accordance with
the requirements of this section and completed with no failures that
result in a loss of flight, loss of control, loss of containment, or
emergency landing outside the operator's recovery area.
(a) Once a UA has begun testing to show compliance with this
section, all flights for that UA must be included in the flight test
report.
(b) Tests must include an evaluation of the entire flight envelope
across all phases of operation and must address, at a minimum, the
following:
(1) Flight distances;
(2) Flight durations;
(3) Route complexity;
(4) Weight;
(5) Center of gravity;
(6) Density altitude;
(7) Outside air temperature;
(8) Airspeed;
(9) Wind;
(10) Weather;
(11) Operation at night, if requested;
(12) Energy storage system capacity; and
(13) Aircraft to pilot ratio.
(c) Tests must include the most adverse combinations of the
conditions and configurations in paragraph (b) of this section.
(d) Tests must show a distribution of the different flight profiles
and routes representative of the type of operations identified in the
CONOPS.
(e) Tests must be conducted in conditions consistent with the
expected environmental conditions identified in the CONOPS, including
electromagnetic interference (EMI) and high intensity radiated fields
(HIRF).
(f) Tests must not require exceptional piloting skill or alertness.
(g) Any UAS used for testing must be subject to the same worst-case
ground handling, shipping, and transportation loads as those allowed in
service.
(h) Any UA used for testing must use AE that meet, but do not
exceed, the minimum specifications identified under D&R.105. If
multiple AE are identified, the applicant must demonstrate each
configuration.
(i) Any UAS used for testing must be maintained and operated in
accordance with the ICA and UA Flight Manual. No maintenance beyond the
intervals established in the ICA will be allowed to show compliance
with this section.
(j) If cargo operations or external-load operations are requested,
tests must show, throughout the flight envelope and with the cargo or
external-load at the most critical combinations of weight and center of
gravity, that--
(1) The UA is safely controllable and maneuverable; and
(2) The cargo or external-load are retainable and transportable.
D&R.305 Probable Failures
The UA must be designed such that a probable failure will not
result in a loss of containment or control of the UA. This must be
demonstrated by test.
(a) Probable failures related to the following equipment, at a
minimum, must be addressed:
(1) Propulsion systems;
(2) C2 link;
(3) Global Positioning System (GPS);
(4) Flight control components with a single point of failure;
(5) Control station; and
(6) Any other AE identified by the applicant.
(b) Any UA used for testing must be operated in accordance with the
UA Flight Manual.
(c) Each test must occur at the critical phase and mode of flight,
and at the highest aircraft-to-pilot ratio.
D&R.310 Capabilities and Functions
(a) All of the following required UAS capabilities and functions
must be demonstrated by test:
(1) Capability to regain command and control of the UA after the C2
link has been lost.
(2) Capability of the electrical system to power all UA systems and
payloads.
(3) Ability for the pilot to safely discontinue the flight.
(4) Ability for the pilot to dynamically re-route the UA.
(5) Ability to safely abort a takeoff.
(6) Ability to safely abort a landing and initiate a go-around.
(b) The following UAS capabilities and functions, if requested for
approval, must be demonstrated by test:
(1) Continued flight after degradation of the propulsion system.
(2) Geo-fencing that contains the UA within a designated area, in
all operating conditions.
(3) Positive transfer of the UA between control stations that
ensures only one control station can control the UA at a time.
(4) Capability to release an external cargo load to prevent loss of
control of the UA.
(5) Capability to detect and avoid other aircraft and obstacles.
(c) The UA must be designed to safeguard against inadvertent
discontinuation of the flight and inadvertent release of cargo or
external load.
D&R.315 Fatigue
The structure of the UA must be shown to withstand the repeated
loads expected during its service life without failure. A life limit
for the airframe must be established, demonstrated by test, and
included in the ICA.
D&R.320 Verification of Limits
The performance, maneuverability, stability, and control of the UA
within the flight envelope described in the UA Flight Manual must be
demonstrated at a minimum of 5% over maximum gross weight with no loss
of control or loss of flight.
Issued in Washington, DC, on January 21, 2022.
Ian Lucas,
Manager, Policy Implementation Section, Policy and Innovation Division,
Aircraft Certification Service.
[FR Doc. 2022-01556 Filed 1-26-22; 8:45 am]
BILLING CODE 4910-13-P