Airworthiness Criteria: Special Class Airworthiness Criteria for the Amazon Logistics, Inc. MK27-2 Unmanned Aircraft, 4128-4140 [2022-01556]

Agencies

• Federal Aviation Administration
• DEPARTMENT OF TRANSPORTATION

[Federal Register Volume 87, Number 18 (Thursday, January 27, 2022)]
[Rules and Regulations]
[Pages 4128-4140]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-01556]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 21

[Docket No. FAA-2020-1086]


Airworthiness Criteria: Special Class Airworthiness Criteria for 
the Amazon Logistics, Inc. MK27-2 Unmanned Aircraft

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Issuance of final airworthiness criteria.

-----------------------------------------------------------------------

SUMMARY: The FAA announces the special class airworthiness criteria for 
the Amazon Logistics, Inc. Model MK27-2 unmanned aircraft. This 
document sets forth the airworthiness criteria the FAA finds to be 
appropriate and applicable for the unmanned aircraft design.

DATES: These airworthiness criteria are effective February 28, 2022.

FOR FURTHER INFORMATION CONTACT: Christopher J. Richards, Emerging 
Aircraft Strategic Policy Section, AIR-618, Strategic Policy Management 
Branch, Policy and Innovation Division, Aircraft Certification Service, 
Federal Aviation Administration, 6020 28th Avenue South, Room 103, 
Minneapolis, MN 55450, telephone (612) 253-4559.

SUPPLEMENTARY INFORMATION:

Background

    Amazon Logistics, Inc., (Amazon) applied to the FAA on October 13, 
2017, for a special class type certificate under Title 14, Code of 
Federal Regulations (14 CFR) 21.17(b) for the Amazon Model MK27-2 \1\ 
unmanned aircraft system (UAS).
---------------------------------------------------------------------------

    \1\ Amazon's original application identified its model as the 
MK27. On December 20, 2021, Amazon amended its application to change 
the aircraft model designation from MK27 to MK27-2.
---------------------------------------------------------------------------

    The Model MK27-2 consists of a powered lift unmanned aircraft (UA) 
and its associated elements (AE) including communication links and 
components that control the UA. The Model MK27-2 UA has a maximum gross 
takeoff weight of 89 pounds. It is approximately 78 inches in width, 65 
inches in length, and 46 inches in height. The Model MK27-2 UA uses 
battery-powered electric motors for vertical takeoff, landing, and 
forward flight. The UAS operations would rely on high levels of 
automation and may include multiple UA operated by a single pilot, up 
to a ratio of 20 UA to 1 pilot. Amazon anticipates operators will use 
the Model MK27-2 for delivering packages. The proposed concept of 
operations (CONOPS) for the Model MK27-2 identifies a maximum operating 
altitude of 400 feet above ground level (AGL), a maximum cruise speed 
of 60 knots, operations beyond visual line of sight (BVLOS) of the 
pilot, and operations over human beings. Amazon has not requested type 
certification for flight into known icing conditions for the Model 
MK27-2.
    The FAA issued a notice of proposed airworthiness criteria for the 
Amazon MK27 UAS, which published in the Federal Register on November 
20, 2020 (85 FR 74271).

Summary of Changes From the Proposed Airworthiness Criteria

    Based on the comments received, these final airworthiness criteria 
reflect the following changes, as explained in more detail under 
Discussion of Comments: A new section containing

[[Page 4129]]

definitions; revisions to the CONOPS requirement; changing the term 
``critical part'' to ``flight essential part'' in D&R.135; changing the 
basis of the durability and reliability testing from population density 
to limitations prescribed for the operating environment identified in 
the applicant's CONOPS per D&R.001; and, for the demonstration of 
certain required capabilities and functions as required by D&R.310.
    Additionally, the FAA re-evaluated its approach to type 
certification of low-risk UA using durability and reliability testing. 
Safe UAS operations depend and rely on both the UA and the AE. As 
explained in FAA Memorandum AIR600-21-AIR-600-PM01, dated July 13, 
2021, the FAA has revised the airworthiness criteria to define a 
boundary between the UA type certification and subsequent operational 
evaluations and approval processes for the UAS (i.e., waivers, 
exemptions, and/or operating certificates).
    To reflect that these airworthiness criteria rely on durability and 
reliability (D&R) testing for certification, the FAA changed the prefix 
of each section from ``UAS'' to ``D&R.''
    Lastly, the FAA revised D&R.001(g) to clarify that the operational 
parameters listed in that paragraph are examples and not an all-
inclusive list.

Discussion of Comments

    The FAA received responses from 27 commenters. The majority of the 
commenters were individuals. Other commenters included the European 
Union Aviation Safety Agency (EASA), unmanned aircraft manufacturers, a 
helicopter operator, Embry-Riddle Aeronautical University, and 
organizations such as the Air Line Pilots Association (ALPA), the 
Association for Unmanned Vehicle Systems International (AUVSI), 
Droneport Texas, LLC, the National Agricultural Aviation Association 
(NAAA), Northeast UAS Airspace Integration Research Alliance, Inc. 
(NUAIR), and the Small UAV Coalition.

Support

    Comment Summary: ALPA, AUVSI, NUAIR, and the Small UAV Coalition 
expressed support for type certification as a special class of aircraft 
and establishing airworthiness criteria under Sec.  21.17(b). AUVSI and 
the Small UAV Coalition also supported the FAA's proposed use of 
performance-based standards.

Terminology: Loss of Flight

    Comment Summary: An individual commenter requested the FAA define 
the term ``loss of flight'' and clarify how it is different from ``loss 
of control.'' The commenter questioned whether loss of flight meant the 
UA could not continue its intended flight plan but could safely land or 
terminate the flight.
    FAA Response: The FAA has added a new section, D&R.005, to define 
the terms ``loss of flight'' and ``loss of control'' for the purposes 
of these airworthiness criteria. ``Loss of flight'' refers to a UA's 
inability to complete its flight as planned, up to and through its 
originally planned landing. ``Loss of flight'' includes scenarios where 
the UA experiences controlled flight into terrain or obstacles, or any 
other collision, or a loss of altitude that is severe or non-
recoverable. ``Loss of flight'' includes deploying a parachute or 
ballistic recovery system that leads to an unplanned landing outside 
the operator's designated recovery zone.
    ``Loss of control'' means an unintended departure of an aircraft 
from controlled flight. It includes control reversal or an undue loss 
of longitudinal, lateral, and directional stability and control. It 
also includes an upset or entry into an unscheduled or uncommanded 
attitude with high potential for uncontrolled impact with terrain. 
``Loss of control'' means a spin, loss of control authority, loss of 
aerodynamic stability, divergent flight characteristic, or similar 
occurrence, which could generally lead to a crash.

Terminology: Skill and Alertness of Pilot

    Comment Summary: Two commenters requested the FAA clarify 
terminology with respect to piloting skill and alertness. Droneport 
Texas LLC stated that the average pilot skill and alertness is 
currently undefined, as remote pilots do not undergo oral or practical 
examinations to obtain certification. NUAIR noted that, despite the 
definition of ``exceptional piloting skill and alertness'' in Advisory 
Circular (AC) 23-8C, Flight Test Guide for Certification of Part 23 
Airplanes, there is a significant difference between the average skill 
and alertness of a remote pilot certified under 14 CFR part 107 and a 
pilot certified under 14 CFR part 61. The commenter requested the FAA 
clarify the minimum qualifications and ratings to perform as a remote 
pilot of a UAS with a type certificate.
    FAA Response: These airworthiness criteria do not require 
exceptional piloting skill and alertness for testing. The FAA included 
this as a requirement to ensure the applicant passes testing by using 
pilots of average skill who have been certificated under part 61, as 
opposed to highly trained pilots with thousands of hours of flight 
experience. Because the Amazon MK27-2 has a maximum weight above 55 
pounds, the remote pilot provision of part 107 does not apply.

Concept of Operations

    The FAA proposed a requirement for the applicant to submit a CONOPS 
describing the UAS and identifying the intended operational concepts. 
The FAA explained in the preamble of the notice of proposed 
airworthiness criteria that the information in the CONOPS would 
determine parameters for testing and flight manual operating 
limitations.
    Comment Summary: One commenter stated that the airworthiness 
criteria are generic and requested the FAA add language to proposed 
UAS.001 to clarify that some of the criteria may not be relevant or 
necessary.
    FAA Response: Including the language requested by the commenter 
would be inappropriate, as these airworthiness criteria are project-
specific. Thus, in this case, each element of these airworthiness 
criteria is a requirement specific to the type certification of 
Amazon's proposed UA design.
    Comment Summary: ALPA requested the criteria specify that the 
applicant's CONOPS contain sufficient detail to determine the 
parameters and extent of testing, as well as operating limitations 
placed on the UAS for its operational uses.
    FAA Response: The FAA agrees and has updated D&R.001 to clarify 
that the information required for inclusion in the CONOPS proposal 
(D&R.001(a) through (g)), must be described in sufficient detail to 
determine the parameters and extent of testing and operating 
limitations.
    Comment Summary: ALPA requested the CONOPS include a description of 
a means to ensure separation from other aircraft and perform collision 
avoidance maneuvers. ALPA stated that its requested addition to the 
CONOPS is critical to the safety of other airspace users, as manned 
aircraft do not easily see most UAs.
    FAA Response: The FAA agrees and has updated D&R.001 to require 
that the applicant identify collision avoidance equipment (whether 
onboard the UA or part of the AE), if the applicant requests to include 
that equipment.
    Comment Summary: ALPA requested the FAA add security-related (other 
than cyber-security) requirements to the CONOPS criteria, including 
mandatory reporting of security occurrences, security training and 
awareness programs for all personnel involved in UAS operations, and 
security standards

[[Page 4130]]

for the transportation of goods, similar to those for manned aviation.
    FAA Response: The type certificate only establishes the approved 
design of the UA. Operations and operational requirements, including 
those regarding security occurrences, security training, and package 
delivery security standards (other than cybersecurity airworthiness 
design requirements) are beyond the scope of the airworthiness criteria 
established by this document and are not required for type 
certification.
    Comment Summary: UAS.001(c) proposed to require that the 
applicant's CONOPS include a description of meteorological conditions. 
ALPA requested the FAA change UAS.001(c) to require a description of 
meteorological and environmental conditions and their operational 
limits. ALPA stated the CONOPS should include maximum wind speeds, 
maximum or minimum temperatures, maximum density altitudes, and other 
relevant phenomena that will limit operations or cause operations to 
terminate.
    FAA Response: D&R.001(c) and D&R.125 address meteorological 
conditions, while D&R.001(g) addresses environmental considerations. 
The FAA determined that these criteria are sufficient to cover the 
weather phenomena mentioned by the commenter without specifically 
requiring identification of related operational limits.

Control Station

    To address the risks associated with loss of control of the UA, the 
FAA proposed that the applicant design the control station to provide 
the pilot with all information necessary for continued safe flight and 
operation.
    Comment Summary: ALPA, Embry-Riddle Aeronautical University, and 
two individual commenters requested the FAA revise the proposed 
criteria to add requirements for the control station. Specifically, 
these commenters requested the FAA include the display of data and 
alert conditions to the pilot, physical security requirements for both 
the control station and the UAS storage area, design requirements that 
minimize negative impact of extended periods of low pilot workload, 
transfer of control between pilots, and human factors/human machine 
interface considerations for handheld controls. NUAIR requested the FAA 
designate the control station as a flight critical component for 
operations.
    EASA and an individual commenter requested the FAA consider 
flexibility in some of the proposed criteria. EASA stated that the list 
of information in proposed UAS.100 is too prescriptive and contains 
information that may not be relevant for highly automated systems. The 
individual commenter requested that the FAA allow part-time or non-
continuous displays of required information that do not influence the 
safety of the flight.
    FAA Response: Although the scope of the proposed airworthiness 
criteria applied to the entire UAS, the FAA has re-evaluated its 
approach to type certification of low-risk unmanned aircraft using 
durability and reliability testing. A UA is an aircraft that is 
operated without the possibility of direct human intervention from 
within or on the aircraft.\2\ A UAS is defined as a UA and its AE, 
including communication links and the components that control the UA, 
that are required to operate the UAS safely and efficiently in the 
national airspace system.\3\ As explained in FAA Memorandum AIR600-21-
AIR-600-PM01, dated July 13, 2021, the FAA determined it will apply the 
regulations for type design approval, production approval, conformity, 
certificates of airworthiness, and maintenance to only the UA and not 
to the AE. However, because safe UAS operations depend and rely on both 
the UA and the AE, the FAA will consider the AE in assessing whether 
the UA meets the airworthiness criteria that comprise the certification 
basis.
---------------------------------------------------------------------------

    \2\ See 49 U.S.C. 44801(11).
    \3\ See 49 U.S.C. 44801(12).
---------------------------------------------------------------------------

    While the AE items themselves will be outside the scope of the UA 
type design, the applicant will provide sufficient specifications for 
any aspect of the AE, including the control station, which could affect 
airworthiness. The FAA will approve either the specific AE or minimum 
specifications for the AE, as identified by the applicant, as part of 
the type certificate by including them as an operating limitation in 
the type certificate data sheet and flight manual. The FAA may impose 
additional operating limitations specific to the AE through conditions 
and limitations for inclusion in the operational approval (i.e., 
waivers, exemptions, or a combination of these). In accordance with 
this approach, the FAA will consider the entirety of the UAS for 
operational approval and oversight.
    Accordingly, the FAA has revised the criteria by replacing proposed 
section UAS.100, applicable to the control station design, with 
D&R.100, UA Signal Monitoring and Transmission, with substantively 
similar criteria that apply to the UA design. The FAA has also added a 
new section, D&R.105, UAS AE Required for Safe UA Operations, which 
requires the applicant to provide information concerning the 
specifications of the AE. The FAA has moved the alert function 
requirement proposed in UAS.100(a) to new section D&R.105(a)(1)(i). As 
part of the clarification of the testing of the interaction between the 
UA and AE, the FAA has added a requirement to D&R.300(h) for D&R 
testing to use minimum specification AE. This addition requires the 
applicant to demonstrate that the limits proposed for those AE will 
allow the UA to operate as expected throughout its service life. 
Finally, the FAA has revised references throughout the airworthiness 
criteria from ``UAS'' to ``UA,'' as appropriate, to reflect the FAA 
determination that the regulations for type design approval, production 
approval, conformity, certificates of airworthiness, and maintenance 
apply to only the UA.

Software

    The FAA proposed criteria on verification, configuration 
management, and problem reporting to minimize the existence of errors 
associated with UAS software.
    Comment Summary: ALPA requested the FAA add language to the 
proposed criteria to ensure that some level of software engineering 
principles are used without being too prescriptive.
    FAA Response: By combining the software-testing requirement of 
D&R.110(a) with successful completion of the requirements in the entire 
``Testing'' subpart, the acceptable level of software assurance will be 
identified and demonstrated. The configuration management system 
required by D&R.110(b) will ensure that the software is adequately 
documented and traceable both during and after the initial type 
certification activities.
    Comment Summary: EASA suggested the criteria require that the 
applicant establish and correctly implement system requirements or a 
structured software development process for critical software.
    FAA Response: Direct and specific evaluation of the software 
development process is more detailed than what the FAA intended with 
the proposed criteria, which use D&R testing to evaluate the UAS as a 
whole system, rather than evaluating individual components within the 
UA. Successful completion of the testing requirements provides 
confidence that the components that make up the UA provide an 
acceptable level of safety, commensurate to the low-risk nature of this 
aircraft. The FAA finds no change to the airworthiness criteria is 
needed.

[[Page 4131]]

    Comment Summary: Two individual commenters requested the FAA 
require the manned aircraft software certification methodology in RTCA 
DO-178C, Software Considerations in Airborne Systems and Equipment 
Certification, for critical UA software.
    FAA Response: Under these airworthiness criteria, only software 
that may affect the safe operation of the UA must be verified by test. 
To verify by test, the applicant will need to provide an assessment 
showing that other software is not subject to testing because it has no 
impact on the safe operation of the UA. For software that is subject to 
testing, the FAA may accept multiple options for software 
qualification, including DO-178C. Further, specifying that applicants 
must comply with DO-178 would be inconsistent with the FAA's intent to 
issue performance-based airworthiness criteria.
    Comment Summary: NAAA stated that an overreliance of software in 
aircraft has been and continues to be a source of accidents and 
requested the FAA include criteria to prevent a midair collision.
    FAA Response: The proper functioning of software is an important 
element of type certification, particularly with respect to flight 
controls and navigation. The airworthiness criteria in D&R.110 are 
meant to provide an acceptable level of safety commensurate with the 
risk posed by this UA. Additionally, the airworthiness criteria require 
contingency planning per D&R.120 and the demonstration of the UA's 
ability to detect and avoid other aircraft in D&R.310, if requested by 
the applicant. The risk of a midair collision will be minimized by the 
operating limitations that result from testing based on the operational 
parameters identified by the applicant in its CONOPS (such as 
geographic operating boundaries, airspace classes, and congestion of 
the proposed operating area), rather than by specific mitigations built 
into the aircraft design itself. These criteria are sufficient due to 
the low-risk nature of the Model MK27-2.

Cybersecurity

    Because the UA requires a continuous wireless connection, the FAA 
proposed criteria to address the risks to the UAS from cybersecurity 
threats.
    Comment Summary: ALPA and an individual commenter requested adding 
a requirement for cybersecurity protection, including protection from 
hacking, for navigation and position reporting systems such as Global 
Navigation Satellite System (GNSS). ALPA further requested the FAA 
include criteria to address specific cybersecurity vulnerabilities, 
such as jamming (denial of signal) and spoofing (false position data is 
inserted). ALPA stated that, for navigation, UAS primarily use GNSS--an 
unencrypted, open-source, low power transmission that can be jammed, 
spoofed, or otherwise manipulated.
    FAA Response: The FAA will assess elements directly influencing the 
UA for cybersecurity under D&R.115 and will assess the AE as part of 
any operational approvals an operator may seek. D&R.115 (proposed as 
UAS.115), addresses intentional unauthorized electronic interactions, 
which includes, but is not limited to, hacking, jamming, and spoofing. 
These airworthiness criteria require the high-level outcome the UA must 
meet, rather than discretely identifying every aspect of cybersecurity 
the applicant will address.

Contingency Planning

    The FAA proposed criteria requiring that the UAS be designed to 
automatically execute a predetermined action in the event of a loss of 
communication between the pilot and the UA. The FAA further proposed 
that the predetermined action be identified in the Flight Manual and 
that the UA be precluded from taking off when the quality of service is 
inadequate.
    Comment Summary: ALPA and an individual commenter requested the 
criteria encompass more than loss or degradation of the command and 
control (C2) link, as numerous types of critical part or systems 
failures can occur that include degraded capabilities, whether 
intermittent or sustained. ALPA requested the FAA add language to the 
proposed criteria to address specific failures such as loss of a 
primary navigation sensor, degradation or loss of navigation 
capability, and simultaneous impact of C2 and navigation links. The 
individual commenter requested the FAA revise the proposed criteria to 
only require execution of the predetermined action in the event the 
loss of the C2 link exceeds 60 seconds, and suggested that the criteria 
as proposed would result in suitable drones aborting flights or being 
constantly redirected by the operator because of a brief C2 
interruption.
    FAA Response: The airworthiness criteria address the issues raised 
by commenters. Specifically, D&R.120(a) addresses actions the UA will 
automatically and immediately take when the operator no longer has 
control of the UA. Should the specific failures identified by ALPA 
result in the operator's loss of control, then the criteria require the 
UA to execute a predetermined action. Degraded navigation performance 
does not raise the same level of concern as a degraded or lost C2 link. 
For example, a UA may experience interference with a GPS signal on the 
ground, but then find acceptable signal strength when above a tree line 
or other obstruction. The airworthiness criteria require that neither 
degradation nor complete loss of GPS or C2, as either condition would 
be a failure of that system, result in unsafe loss of control or 
containment. The applicant must demonstrate this by test to meet the 
requirements of D&R.305(a)(3).
    Under the airworthiness criteria, the minimum performance 
requirements for the C2 link, defining when the link is degraded to an 
unacceptable level, may vary among different UAS designs. The level of 
degradation that triggers a loss is dependent upon the specific UA 
characteristics; this level will be defined by the applicant and 
demonstrated to be acceptable by testing as required by D&R.305(a)(2) 
and D&R.310(a)(1).
    Comment Summary: An individual commenter requested the FAA use 
distinct terminology for ``communication'' used for communications with 
air traffic control, and ``C2 link'' used for command and control 
between the remote pilot station and UA. The commenter questioned 
whether, in the proposed criteria, the FAA stated ``loss of 
communication between the pilot and the UA'' when it intended to state 
``loss of C2 link.''
    FAA Response: Communication extends beyond the C2 link and specific 
control inputs. This is why D&R.001 requires the applicant's CONOPS to 
include a description of the command, control, and communications 
functions. As long as the UA operates safely and predictably per its 
lost link contingency programming logic, a C2 interruption does not 
constitute a loss of control.

Lightning

    The FAA proposed criteria to address the risks that would result 
from a lightning strike, accounting for the size and physical 
limitations of a UAS that could preclude traditional lightning 
protection features. The FAA further proposed that without lightning 
protection for the UA, the Flight Manual must include an operating 
limitation to prohibit flight into weather conditions with potential 
lightning.
    Comment Summary: An individual requested the FAA revise the 
criteria to include a similar design mitigation or operating limitation 
for High Intensity Radiated Fields (HIRF). The commenter noted that 
HIRF is included in proposed UAS.300(e) as part of the expected

[[Page 4132]]

environmental conditions that must be replicated in testing.
    FAA Response: The airworthiness criteria, which are adopted as 
proposed, address the issue raised by the commenter. The applicant must 
identify tested HIRF exposure capabilities, if any, in the Flight 
Manual to comply with the criteria in D&R.200(a)(5). Information 
regarding HIRF capabilities is necessary for safe operation because 
proper communication and software execution may be impeded by HIRF-
generated interference, which could result in loss of control of the 
UA. It is not feasible to measure HIRF at every potential location 
where the UA will operate; thus, requiring operating limitations for 
HIRF as requested by the commenter would be impractical.

Adverse Weather Conditions

    The FAA proposed criteria either requiring that design 
characteristics protect the UAS from adverse weather conditions or 
prohibiting flight into known adverse weather conditions. The criteria 
proposed to define adverse weather conditions as rain, snow, and icing.
    Comment Summary: ALPA and three individual commenters requested the 
FAA expand the proposed definition of adverse weather conditions. These 
commenters noted that because of the size and physical limitations of 
the Model MK27-2, adverse weather should also include wind, downdraft, 
low-level wind shear (LLWS), microburst, and extreme mechanical 
turbulence.
    FAA Response: No additional language needs to be added to the 
airworthiness criteria to address wind effects. The wind conditions 
specified by the commenters are part of normal UA flight operations. 
The applicant must demonstrate by flight test that the UA can withstand 
wind without failure to meet the requirements of D&R.300(b)(9). The FAA 
developed the criteria in D&R.130 to address adverse weather conditions 
(rain, snow, and icing) that would require additional design 
characteristics for safe operation. Any operating limitations necessary 
for operation in adverse weather or wind conditions will be included in 
the Flight Manual as required by D&R.200.
    Comment Summary: One commenter questioned whether the criteria 
proposed in UAS.130(c)(2), requiring a means to detect adverse weather 
conditions for which the UAS is not certificated to operate, is a 
prescriptive requirement to install an onboard detection system. The 
commenter requested, if that was the case, that the FAA allow 
alternative procedures to avoid flying in adverse weather conditions.
    FAA Response: The language referred to by the commenter is not a 
prescriptive design requirement for an onboard detection system. The 
applicant may use any acceptable source to monitor weather in the area, 
whether onboard the UA or from an external source.
    Comment Summary: One commenter stated that flying in adverse 
weather would create significant problems when delivering cargo because 
wind, rain, and gust fronts can divert a drone from its intended path. 
The commenter further stated that the size of the Amazon Model MK27-2 
(78 inches in width) can be dangerous to buildings, animals, vehicles, 
and people.
    FAA Response: Operators will need an air carrier certificate to 
conduct cargo delivery operations. As part of the approval for the air 
carrier certificate, as well as any other operational approval the 
operator may seek (i.e., waivers, exemptions), the FAA will impose any 
additional appropriate limitations.

Critical Parts

    The FAA proposed criteria for critical parts that were 
substantively the same as those in the existing standards for normal 
category rotorcraft under Sec.  27.602, with changes to reflect UAS 
terminology and failure conditions. The criteria proposed to define a 
critical part as a part, the failure of which could result in a loss of 
flight or unrecoverable loss of control of the aircraft.
    Comment Summary: EASA requested the FAA avoid using the term 
``critical part,'' as it is a well-established term for complex manned 
aircraft categories and may create incorrect expectations on the 
oversight process for parts.
    FAA Response: For purposes of the airworthiness criteria 
established for the Amazon Model MK27-2, the FAA has changed the term 
``critical part'' to ``flight essential part.''
    Comment Summary: An individual commenter requested the FAA revise 
the proposed criteria such that a failure of a flight essential part 
would only occur if there is risk to third parties.
    FAA Response: The definition of ``flight essential'' does not 
change regardless of whether on-board systems are capable of safely 
landing the UA when it is unable to continue its flight plan. Tying the 
definition of a flight essential part to the risk to third parties 
would result in different definitions for the part depending on where 
and how the UA is operated. These criteria for the Model MK27-2 UA 
apply the same approach as for manned aircraft.

Flight Manual

    The FAA proposed criteria for the Flight Manual that were 
substantively the same as the existing standards for normal category 
airplanes, with minor changes to reflect UAS terminology.
    Comment Summary: ALPA requested the FAA revise the criteria to 
include normal, abnormal, and emergency operating procedures along with 
their respective checklist. ALPA further requested the checklist be 
contained in a quick reference handbook (QRH).
    FAA Response: The FAA did not intend for the airworthiness criteria 
to exclude abnormal procedures from the flight manual. In these final 
airworthiness criteria, the FAA has changed ``normal and emergency 
operating procedures'' to ``operating procedures'' to encompass all 
operating conditions and align with 14 CFR 23.2620, which includes the 
airplane flight manual requirements for normal category airplanes. The 
FAA has not made any changes to add language that would require the 
checklists to be included in a QRH. FAA regulations do not require 
manned aircraft to have a QRH for type certification. Therefore, it 
would be inconsistent for the FAA to require a QRH for the Amazon Model 
MK27-2 UA.
    Comment Summary: ALPA requested the FAA revise the airworthiness 
criteria to require that the Flight Manual and QRH be readily available 
to the pilot at the control station.
    FAA Response: ALPA's request regarding the Flight manual addresses 
an operational requirement, similar to 14 CFR 91.9 and is therefore not 
appropriate for type certification airworthiness criteria. Also, as 
previously discussed, FAA regulations do not require a QRH. Therefore, 
it would be inappropriate to require it to be readily available to the 
pilot at the control station.
    Comment Summary: Droneport Texas LLC requested the FAA revise the 
airworthiness criteria to add required Flight Manual sections for 
routine maintenance and mission-specific equipment and procedures. The 
commenter stated that the remote pilot or personnel on the remote 
pilot-in-command's flight team accomplish most routine maintenance, and 
that the flight team usually does UA rigging with mission equipment.
    FAA Response: The requested change is appropriate for a maintenance 
document rather than a flight manual because it addresses maintenance 
procedures rather than the piloting functions. The FAA also notes that, 
similar to the criteria for certain manned

[[Page 4133]]

aircraft, the airworthiness criteria require that the applicant prepare 
instructions for continued airworthiness (ICA) in accordance with 
Appendix A to Part 23. As the applicant must provide any maintenance 
instructions and mission-specific information necessary for safe 
operation and continued operational safety of the UA, in accordance 
with D&R.205, no changes to the airworthiness criteria are necessary.
    Comment Summary: An individual commenter requested the FAA revise 
the criteria in proposed UAS.200(b) to require that ``other 
information'' referred to in proposed UAS.200(a)(5) be approved by the 
FAA. The commenter noted that, as proposed, only the information listed 
in UAS.200(a)(1) through (4) must be FAA approved.
    FAA Response: The change requested by the commenter would be 
inconsistent with the FAA's airworthiness standards for flight manuals 
for manned aircraft. Sections 23.2620(b), 25.1581(b), 27.1581(b), and 
29.1581(b)) include requirements for flight manuals to include 
operating limitations, operating procedures, performance information, 
loading information, and other information that is necessary safe 
operation because of design, operating, or handling characteristics, 
but limit FAA approval to operating limitations, operating procedures, 
performance information, and loading information.
    Under Sec.  23.2620(b)(1), for low-speed level 1 and level 2 
airplanes, the FAA only approves the operating limitations. In applying 
a risk-based approach, the FAA has determined it would not be 
appropriate to hold the lowest risk UA to a higher standard than what 
is required for low speed level 1 and level 2 manned aircraft. 
Accordingly, the FAA has revised the airworthiness criteria to only 
require FAA approval of the operating limitations.
    Comment Summary: NUAIR requested the FAA recognize that Sec.  
23.2620 is only applicable to the aircraft and does not address off-
aircraft components such as the control station, control and non-
payload communications (CNPC) data link, and launch and recovery 
equipment. The commenter noted that this is also true of industry 
consensus-based standards designed to comply with Sec.  23.2620.
    FAA Response: As explained in more detail in the Control Station 
section of this document, the FAA has revised the airworthiness 
criteria for the AE. The FAA will approve AE or minimum specifications 
for the AE that could affect airworthiness as an operating limitation 
in the UA flight manual. The FAA will establish the approved AE or 
minimum specifications as operating limitations and include them in the 
UA type certificate data sheet and Flight Manual in accordance with 
D&R.105(c). The establishment of requirements for, and the approval of 
AE will be in accordance with FAA Memorandum AIR600-21-AIR-600-PM01, 
dated July 13, 2021.

Instructions for Continued Airworthiness (ICA)

    The FAA proposed criteria for ICA that were substantively the same 
as those in the existing standards for normal category airplanes, with 
minor changes to reflect UA terminology instead of airplane 
terminology.
    Comment Summary: One individual commenter requested the 
airworthiness criteria contain maintenance, repair, and overhaul 
standards for the continued safe operation of the UAS after type 
certification. Specifically, the commenter suggested a maintenance 
program, maintenance record, maintenance manual, minimum equipment 
list, illustrated parts catalog, service bulletin, parts manufacturer 
approval, technical standard order, airworthiness directive, and 
technician qualification approval systems for each type of commercial 
UAS. Another individual commenter requested information on the expected 
lifespan of the Model MK27-2 and any continued airworthiness checks it 
will undergo, expecting a higher level of safety than for UA flown 
under part 107. A third individual commenter requested information on 
the type of pre-flight and post-flight inspections that will be 
performed and questioned the number of pilots and technicians needed.
    FAA Response: The airworthiness criteria pertaining to ICA 
(D&R.205), which are adopted as proposed, require that the applicant 
prepare ICA in accordance with Appendix A to Part 23, similar to manned 
aircraft. Appendix A to Part 23 requires maintenance servicing 
information, instructions, inspection and overhaul periods, and other 
continued airworthiness information, such as that suggested by the 
commenters. The FAA will not provide the expected lifespan of the Model 
MK27-2 or the specific inspections required, as this information is 
proprietary to the applicant.

Durability and Reliability

    The FAA proposed durability and reliability testing that would 
require the applicant to demonstrate safe flight of the UAS across the 
entire operational envelope and up to all operational limitations, for 
all phases of flight and all aircraft configurations described in the 
applicant's CONOPS, with no failures that result in a loss of flight, 
loss of control, loss of containment, or emergency landing outside the 
operator's recovery area. The FAA further proposed that the unmanned 
aircraft would only be certificated for operations within the 
limitations, and for flight over areas no greater than the maximum 
population density, as described in the applicant's CONOPS and 
demonstrated by test.
    Comment Summary: ALPA requested that the proposed certification 
criteria require all flights during testing be completed in both normal 
and non-normal or off-nominal scenarios with no failures that result in 
a loss of flight, loss of control, loss of containment, or emergency 
landing outside of the operator's recovery zone. Specifically, ALPA 
stated that testing must not require exceptional piloting skill or 
alertness and include, at a minimum: All phases of the flight envelope, 
including the highest UA to pilot ratios; the most adverse combinations 
of the conditions and configuration; the environmental conditions 
identified in the CONOPS; the different flight profiles and routes 
identified in the CONOPS; and exposure to EMI and HIRF.
    FAA Response: No change is necessary because the introductory text 
and paragraphs (b)(7), (b)(9), (b)(10), (b)(13), (c), (d), (e), and (f) 
of D&R.300, which are adopted as proposed, contain the specific testing 
requirements requested by ALPA.
    Comment Summary: Droneport Texas LLC requested the FAA revise the 
testing criteria to include, for operation at night, testing both with 
and without night vision aids. The commenter stated that because small 
UAS operation at night is waivable under 14 CFR part 107, manufacturers 
will likely make assumptions concerning a pilot's familiarity with 
night vision device-aided and unaided operations.
    FAA Response: Under D&R.300(b)(11), the applicant must demonstrate 
by flight test that the UA can operate at night without failure using 
whatever equipment is onboard the UA itself. The pilot's familiarity, 
or lack thereof, with night vision equipment does not impact whether 
the UA is reliable and durable to complete testing without any 
failures. The FAA further notes that part 107 does not apply to this 
aircraft because it has a maximum gross takeoff weight of 89 pounds.
    Comment Summary: EASA requested the FAA clarify how testing 
durability and reliability commensurate to the maximum population 
density, as proposed, aligns with the Specific

[[Page 4134]]

Operations Risk Assessment (SORA) approach that is open to operational 
mitigation, reducing the initial ground risk. An individual commenter 
requested the FAA provide more details about the correlation between 
the number of flight hours tested and the CONOPS environment (e.g., 
population density). The commenter stated that this is one of the most 
fundamental requirements, and the FAA should ensure equal treatment to 
all current and future applicants.
    FAA Response: In developing these testing criteria, the FAA sought 
to align the risk of UAS operations with the appropriate level of 
protection for human beings on the ground. The FAA proposed 
establishing the maximum population density demonstrated by durability 
and reliability testing as an operating limitation on the type 
certificate. However, the FAA has re-evaluated its approach and 
determined it to be more appropriate to connect the durability and 
reliability demonstrated during certification testing with the 
operating environment defined in the CONOPS.
    Basing testing on maximum population density may result in 
limitations not commensurate with many actual operations. As population 
density broadly refers to the number of people living in a given area 
per square mile, it does not allow for evaluating variation in a local 
operating environment. For example, an operator may have a route in an 
urban environment with the actual flight path along a greenway; the 
number of human beings exposed to risk from the UA operating overhead 
would be significantly lower than the population density for the area. 
Conversely, an operator may have a route over an industrial area where 
few people live, but where, during business hours, there may be highly 
dense groups of people. Specific performance characteristics such as 
altitude and airspeed also factor into defining the boundaries for safe 
operation of the UA.
    Accordingly, the FAA has revised D&R.300 to require the UA design 
to be durable and reliable when operated under the limitations 
prescribed for its operating environment. The information in the 
applicant's CONOPS will determine the operating environment for 
testing. For example, the minimum hours of reliability testing will be 
less for a UA conducting agricultural operations in a rural environment 
than if the same aircraft will be conducting package deliveries in an 
urban environment. The FAA will include the limitations that result 
from testing as operating limitations on the type certificate data 
sheet and in the UA Flight Manual. The FAA intends for this process to 
be similar to the process for establishing limitations prescribed for 
special purpose operations for restricted category aircraft. This 
allows for added flexibility in determining appropriate operating 
limitations, which will more closely reflect the operating environment.
    Finally, a comparison of these criteria with EASA's SORA approach 
is beyond the scope of this document because the SORA is intended to 
result in an operational approval rather than a type certificate.
    Comment Summary: EASA requested the FAA clarify how reliability at 
the aircraft level to ensure high-level safety objectives would enable 
validation of products under applicable bilateral agreements.
    FAA Response: As the FAA and international aviation authorities are 
still developing general airworthiness standards for UA, it would be 
speculative for the FAA to comment on the validation process for any 
specific UA.
    Comment Summary: EASA requested the FAA revise the testing criteria 
to include a compliance demonstration related to adverse combinations 
of the conditions and configurations and with respect to weather 
conditions and average pilot qualification.
    FAA Response: No change is necessary because D&R.300(b)(7), (b)(9), 
(b)(10), (c), and (f), which are adopted as proposed, contain the 
specific testing requirements requested by EASA.
    Comment Summary: EASA noted that, under the proposed criteria, 
testing involving a large number of flight hours will limit changes to 
the configuration.
    FAA Response: Like manned aircraft, the requirements of 14 CFR part 
21, subpart D, apply to UA for changes to type certificates. The FAA is 
developing procedures for processing type design changes for UA type 
certificated using durability and reliability testing.
    Comment Summary: EASA requested the FAA clarify whether the 
proposed testing criteria would require the applicant to demonstrate 
aspects that do not occur during a successful flight, such as the 
deployment of emergency recovery systems and fire protection/post-crash 
fire. EASA asked if these aspects are addressed by other means and what 
would be the applicable airworthiness criteria.
    FAA Response: Equipment not required for normal operation of the UA 
do not require an evaluation for their specific functionality. D&R 
testing will show that the inclusion of any such equipment does not 
prevent normal operation. Therefore, the airworthiness criteria would 
not require functional testing of the systems described by EASA.
    Comment Summary: An individual commenter requested the FAA specify 
the acceptable percentage of failures in the testing that would result 
in a ``loss of flight.'' The Small UAV Coalition requested the FAA 
clarify what constitutes an emergency landing outside an operator's 
landing area, as some UAS designs could include an onboard health 
system that initiates a landing to lessen the potential of a loss of 
control event. The commenter suggested that, in those cases, a landing 
in a safe location should not invalidate the test.
    FAA Response: The airworthiness criteria require that all test 
points and flight hours occur with no failures result in a loss of 
flight, control, containment, or emergency landing outside the 
operator's recovery zone. The FAA has determined that there is no 
acceptable percentage of failures in testing. In addition, while the 
recovery zone may differ for each UAS design, an emergency or unplanned 
landing outside of a designated landing area would result in a test 
failure.
    Comment Summary: The Small UAV Coalition requested that a single 
failure during testing not automatically restart counting the number of 
flight test operations set for a particular population density; rather, 
the applicant should have the option to identify the failure through 
root-cause and fault-tree analysis and provide a validated mitigation 
to ensure it will not recur. An individual commenter requested the FAA 
to clarify whether the purpose of the tests is to show compliance with 
a quantitative safety objective. The commenter further requested the 
FAA allow the applicant to reduce the number of flight testing hours if 
the applicant can present a predicted safety and reliability analysis.
    FAA Response: The intent of the testing criteria is for the 
applicant to demonstrate the aircraft's durability and reliability 
through a successful accumulation of flight testing hours. The FAA does 
not intend to require analytical evaluation to be part of this process. 
However, the applicant will comply with these testing criteria using a 
means of compliance, accepted by the FAA, through the issue paper 
process. The means of compliance will be dependent on the CONOPS the 
applicant has proposed to meet.

Probable Failures

    The FAA proposed criteria to evaluate how the UAS functions after 
probable

[[Page 4135]]

failures, including failures related to propulsion systems, C2 link, 
GPS, critical flight control components with a single point of failure, 
control station, and any other equipment identified by the applicant.
    Comment Summary: Droneport Texas LLC requested the FAA add a bird 
strike to the list of probable failures. The commenter stated that 
despite sense and avoid technologies, flocks of birds can overcome the 
maneuver capabilities of a UA and result in multiple, unintended 
failures.
    FAA Response: Unlike manned aircraft, where aircraft size, design, 
and construct are critical to safe control of the aircraft after 
encountering a bird strike, the FAA determined testing for bird strike 
capabilities is not necessary for the Model MK27-2 UA. The FAA has 
determined that a bird strike requirement is not necessary because the 
smaller size and lower operational speed of the MK27-2 reduce the 
likelihood of a bird strike, combined with the reduced consequences of 
failure due to no persons onboard. Instead, the FAA is using a risk-
based approach to tailor airworthiness requirements commensurate to the 
low-risk nature of the Model MK27-2 UA.
    Comment Summary: ALPA requested the FAA require that all probable 
failure tests occur at the critical phase and mode of flight and at the 
highest aircraft-to-pilot ratio. ALPA stated the proposed criteria are 
critically important for systems that rely on a single source to 
perform multi-label functions, such as GNSS, because failure or 
interruption of GNSS will lead to loss of positioning, navigation, and 
timing (PNT) and functions solely dependent on PNT, such as geo-fencing 
and contingency planning.
    FAA Response: No change is necessary because D&R.300(c) requires 
that the testing occur at the critical phase and mode of flight and at 
the highest UA-to-pilot ratio.
    Comment Summary: Droneport Texas LLC requested the FAA add recovery 
from vortex ring state (VRS) to the list of probable failures. The 
commenter stated the UA uses multiple rotors for lift and is therefore 
susceptible to VRS. The commenter further stated that because recovery 
from settling with power is beyond a pilot's average skill for purposes 
of airworthiness testing, the aircraft must be able to sense and 
recover from this condition without pilot assistance.
    FAA Response: D&R.305 addresses probable failures related to 
specific components of the UAS. VRS is an aerodynamic condition a UA 
may encounter during flight testing; it is not a component subject to 
failure.
    Comment Summary: Droneport Texas LLC also requested the FAA add a 
response to the Air Traffic Control-Zero (ATC-Zero) command to the list 
of probable failures. The commenter stated, based on lessons learned 
after the attacks on September 11, 2001, aircraft that can fly BVLOS 
should be able to respond to an ATC-Zero condition.
    FAA Response: The commenter's request is more appropriate for the 
capabilities and functions testing criteria in D&R.310 than probable 
failures testing in D&R.305. D&R.310(a)(3) requires the applicant to 
demonstrate by test that the pilot has the ability to safely 
discontinue a flight. A pilot may discontinue a flight for a wide 
variety of reasons, including responding to an ATC-zero command.
    Comment Summary: EASA stated the proposed language seems to require 
an additional analysis and safety assessment, which would be 
appropriate for the objective requirement of ensuring a probable 
failure does not result in a loss of containment or control. EASA 
further stated that an applicant's basic understanding of the systems 
architecture and effects of failures is essential.
    FAA Response: The FAA agrees with the expectation that applicants 
understand the system architecture and effects of failures of a 
proposed design, which is why the criteria include a requirement for 
the applicant to test the specific equipment identified in D&R.305 and 
identify any other equipment that is not specifically identified in 
D&R.305 for testing. As the intent of the criteria is for the applicant 
to demonstrate compliance through testing, some analysis may be 
necessary to properly identify the appropriate equipment to be 
evaluated for probable failures.
    Comment Summary: An individual requested that probable failure 
testing apply not only to critical flight control components with a 
single point of failure, but also to any critical part with a single 
point of failure.
    FAA Response: The purpose of probable failure testing in D&R.305 is 
to demonstrate that if certain equipment fails, it will fail safely. 
Adding probable failure testing for critical (now flight essential) 
parts would not add value to testing. If a part is essential for 
flight, its failure by definition in D&R.135(a) could result in a loss 
of flight or unrecoverable loss of control. For example, on a 
traditional airplane design, failure of a wing spar in flight would 
lead to loss of the aircraft. Because there is no way to show that a 
wing spar can fail safely, the applicant must provide its mandatory 
replacement time if applicable, structural inspection interval, and 
related structural inspection procedure in the Airworthiness 
Limitations section of the ICA. Similarly, under these airworthiness 
criteria, parts whose failure would inherently result in loss of flight 
or unrecoverable loss of control are not subjected to probable failure 
testing. Instead, they must be identified as flight essential 
components and included in the ICA.
    To avoid confusion pertaining to probable failure testing, the FAA 
has removed the word ``critical'' from D&R.305(a)(5). In the final 
airworthiness criteria, probable failure testing required by 
D&R.305(a)(5) applies to ``Flight control components with a single 
point of failure.''

Capabilities and Functions

    The FAA proposed criteria to require the applicant to demonstrate 
by test the minimum capabilities and functions necessary for the 
design. UAS.310(a) proposed to require the applicant to demonstrate by 
test, the capability of the UAS to regain command and control of the UA 
after a C2 link loss, the sufficiency of the electrical system to carry 
all anticipated loads, and the ability of the pilot to override any 
pre-programming in order to resolve a potential unsafe operating 
condition in any phase of flight. UAS.310(b) proposed to require the 
applicant to demonstrate by test certain features if the applicant 
requests approval of those features (geo-fencing, external cargo, 
etc.). UAS.310(c) proposed to require the design of the UAS to 
safeguard against an unintended discontinuation of flight or release of 
cargo, whether by human action or malfunction.
    Comment Summary: ALPA stated the pilot-in-command must always have 
the capability to input control changes to the UA and override any pre-
programming without delay as needed for the safe management of the 
flight. The commenter requested that the FAA retain the proposed 
criteria that would allow the pilot to command to: regain command and 
control of the UA after loss of the C2 link; safely discontinue the 
flight; and dynamically re-route the UA. In support, ALPA stated the 
ability of the pilot to continually command (re-route) the UA, 
including termination of the flight if necessary, is critical for safe 
operations and should always be available to the pilot.
    Honeywell requested the FAA revise paragraphs (a)(3) and (a)(4) of 
the

[[Page 4136]]

criteria (UAS.310) to allow for either the pilot or an augmenting 
system to safely discontinue the flight and re-route the UA. The 
commenter stated that a system comprised of detect and avoid, onboard 
autonomy, and ground system can be used for these functions. Therefore, 
the criteria should not require that only the pilot can do them.
    An individual commenter requested the FAA remove UAS.310(a)(4) of 
the proposed criteria because requiring the ability for the pilot to 
dynamically re-route the UA is too prescriptive and redundant with the 
proposed requirement in UAS.310(a)(3), the ability of the pilot to 
discontinue the flight safely.
    FAA Response: Because the pilot in command is directly responsible 
for the operation of the UA, the pilot must have the capability to 
command actions necessary for continued safety. This includes 
commanding a change to the flight path or, when appropriate, safely 
terminating a flight. The FAA notes that the ability for the pilot to 
safely discontinue a flight means the pilot has the means to terminate 
the flight and immediately and safely return the UA to the ground. This 
is different from the pilot having the means to dynamically re-route 
the UA, without terminating the flight, to avoid a conflict.
    Therefore, the final airworthiness criteria includes D&R.310(a) as 
proposed (UAS.310(a)).
    Comment Summary: ALPA requested the FAA revise the criteria to 
require that all equipment, systems, and installations conform, at a 
minimum, to the standards of Sec.  25.1309.
    FAA Response: The FAA determined that traditional methodologies for 
manned aircraft, including the system safety analysis required by 
Sec. Sec.  23.2510, 25.1309, 27.1309, or 29.1309, would be 
inappropriate to require for the Amazon Model MK27-2 due to its smaller 
size and reduced level of complexity. Instead, the FAA finds that 
system reliability through testing will ensure the safety of this 
design.
    Comment Summary: ALPA requested the FAA revise the criteria to add 
a requirement to demonstrate the ability of the UA and pilot to perform 
all of the contingency plans identified in proposed UAS.120.
    FAA Response: No change is necessary because D&R.120 and 
D&R.305(a)(2), together, require what ALPA requests in its comment. 
Under D&R.120, the applicant must design the UA to execute a 
predetermined action in the event of a loss of the C2 link. 
D&R.305(a)(2) requires the applicant to demonstrate by test that a lost 
C2 link will not result in a loss of containment or control of the UA. 
Thus, if the applicant does not demonstrate the predetermined 
contingency plan resulting from a loss of the C2 link when conducting 
D&R.305 testing, the test would be a failure due to loss of 
containment.
    Comment Summary: ALPA and an individual commenter requested the FAA 
revise the criteria so that geo-fencing is a required feature and not 
optional due to the safety concerns that could result from a UA exiting 
its operating area.
    FAA Response: To ensure safe flight, the applicant must test the 
proposed safety functions, such as geo-fencing, that are part of the 
type design of the Model MK27-2 UA. The FAA determined that geo-fencing 
is an optional feature because it is one way, but not the only way, to 
ensure a safely contained operation.
    Comment Summary: ALPA requested the FAA revise the criteria so that 
capability to detect and avoid other aircraft and obstacles is a 
required feature and not optional.
    FAA Response: D&R.310(a)(4) requires the applicant demonstrate the 
ability for the pilot to safely re-route the UA in flight to avoid a 
dynamic hazard. The FAA did not prescribe specific design features such 
as a collision avoidance system to meet D&R.310(a)(4) because there are 
multiple means to minimize the risk of collision.
    Comment Summary: McMahon Helicopter Services requested that the 
airworthiness criteria require a demonstration of sense-and-avoid 
technology that will automatically steer the UA away from manned 
aircraft, regardless of whether the manned aircraft has a transponder. 
NAAA and an individual commenter requested that the FAA require ADS-B 
in/out and traffic avoidance software on all UAS. The Small UAV 
Coalition requested the FAA establish standards for collision avoidance 
technology, as the proposed criteria are not sufficient for compliance 
with the operational requirement to see and avoid other aircraft (Sec.  
91.113). The commenters stated that these technologies are necessary to 
avoid a mid-air collision between UA and manned aircraft.
    FAA Response: D&R.310(a)(4) requires the applicant demonstrate the 
ability for the UA to be safely re-routed in flight to avoid a dynamic 
hazard. The FAA did not prescribe specific design features, such as the 
technologies suggested by the commenters, to meet D&R.310(a)(4) because 
they are not the only means for complying with the operational 
requirement to see and avoid other aircraft. If an applicant chooses to 
equip their UA with onboard collision avoidance technology, those 
capabilities and functions must be demonstrated by test per 
D&R.310(b)(5).

Verification of Limits

    The FAA proposed to require an evaluation of the UA's performance, 
maneuverability, stability, and control with a factor of safety.
    Comment Summary: EASA requested that the FAA revise its approach to 
require a similar compliance demonstration as EASA's for ``light UAS.'' 
EASA stated the FAA's proposed criteria for verification of limits, 
combined with the proposed Flight Manual requirements, seem to replace 
a traditional Subpart Flight.\4\ EASA further stated the FAA's approach 
in the proposed airworthiness criteria might necessitate more guidance 
and means of compliance than the traditional structure.
---------------------------------------------------------------------------

    \4\ In the FAA's aircraft airworthiness standards (parts 23, 25, 
27 and 29), subpart B of each is titled Flight.
---------------------------------------------------------------------------

    FAA Response: The FAA's airworthiness criteria will vary from 
EASA's light UAS certification requirements, resulting in associated 
differences in compliance demonstrations. At this time, comment on 
means of compliance and related guidance material, which are still 
under development with the FAA and with EASA, would be speculative.

Propulsion

    Comment Summary: ALPA requested the FAA conduct an analysis to 
determine battery reliability and safety, taking into account wind and 
weather conditions and their effect on battery life. ALPA expressed 
concern with batteries as the only source of power for an aircraft in 
the NAS. ALPA further requested the FAA not grant exemptions for 
battery reserve requirements.
    FAA Response: Because batteries are a flight essential part, the 
applicant must establish mandatory instructions or life limits for 
batteries under the requirements of D&R.135. In addition, when the 
applicant conducts its D&R testing, D&R.300(i) prevents the applicant 
from exceeding the maintenance intervals or life limits for those 
batteries. To the extent the commenter's request addresses fuel 
reserves, that is an operational requirement, not a certification 
requirement, and therefore beyond the scope of this document.
    Comment Summary: Sabrewing Aircraft Company requested the FAA 
clarify whether the proposed airworthiness criteria address the

[[Page 4137]]

propulsion system or whether that will be covered in a different 
process. The commenter noted that the proposed airworthiness criteria 
did not mention aircraft engines, propellers, or other components of an 
electric power propulsion system.
    FAA Response: Under these airworthiness criteria, the UA type 
certificate will include the propulsion system. The FAA will evaluate 
the UA at the aircraft level, without differentiating requirements for 
each subsystem of the UA, such as powerplant and propulsion elements. 
Under D&R.305(a)(1), the applicant must demonstrate that loss of a 
propulsion unit will not result in a loss of containment or control of 
the UA.

Additional Airworthiness Criteria Identified by Commenters

    Comment Summary: McMahon Helicopter Services requested that the 
criteria require anti-collision and navigation lighting certified to 
existing FAA standards for brightness and size. The commenter stated 
that these standards were based on human factors for nighttime and 
daytime recognition and are not simply a lighting requirement. An 
individual commenter requested that the criteria include a requirement 
for position lighting and anti-collision beacons meeting TSO-30c Level 
III. NAAA requested the criteria require a strobe light and high 
visibility paint scheme to aid in visual detection of the UA by other 
aircraft.
    FAA Response: The FAA determined it is unnecessary for these 
airworthiness criteria to prescribe specific design features for anti-
collision or navigation lighting. The FAA will address anti-collision 
lighting as part of any operational approval, similar to the rules in 
14 CFR 107.29(a)(2) and (b) for small UAS.
    Comment Summary: ALPA requested the FAA add a new section with 
minimum standards for Global Navigation Satellite System (GNSS), as the 
UAS will likely rely heavily upon GNSS for navigation and to ensure 
that the UA does not stray outside of its approved airspace. ALPA 
stated that technological advances have made such devices available at 
an appropriate size, weight, and power for UAs.
    FAA Response: The airworthiness criteria in D&R.100 (UA Signal 
Monitoring and Transmission), D&R.110 (Software), D&R.115 
(Cybersecurity), and D&R.305(a)(3) (probable failures related to GPS) 
sufficiently address design requirements and testing of navigation 
systems. Even if the applicant uses a TSO-approved GNSS, these 
airworthiness criteria require a demonstration that the UA operates 
successfully without loss of containment. Successful completion of 
these tests demonstrates that the navigation subsystems are acceptable.
    Comment Summary: ALPA requested the FAA revise the criteria to add 
a new section requiring equipage to comply with the FAA's new rules on 
Remote Identification of Unmanned Aircraft (86 FR 4390, Jan. 15, 2021). 
An individual commenter questioned the need for public tracking and 
identification of drones in the event of a crash or violation of FAA 
flight rules.
    FAA Response: The FAA issued the final rule, Remote Identification 
of Unmanned Aircraft, after providing an opportunity for public notice 
and comment. The final rule is codified at 14 CFR part 89. Part 89 
contains the remote identification requirements for unmanned aircraft 
certificated and produced under part 21 after September 16, 2022.

Pilot Ratio

    Comment Summary: ALPA and four individuals questioned the safety of 
multiple Model MK27-2 UA operated by a single pilot, up to a ratio of 
20 UA to 1 pilot. ALPA stated that even with high levels of automation, 
the pilot must still manage the safe operation and maintain situational 
awareness of multiple aircraft in their flight path, aircraft systems, 
integration with traffic, obstacles, and other hazards during normal, 
abnormal, and emergency conditions. As a result, ALPA recommended the 
FAA conduct additional studies to better understand the feasibility of 
a single pilot operating multiple UA before developing airworthiness 
criteria. The Small UAV Coalition requested the FAA provide criteria 
for an aircraft-to-pilot ratio higher than 20:1.
    FAA Response: These airworthiness criteria are specific to the 
Model MK27-2 UA and, as discussed previously in this preamble, 
operations of the Model MK27-2 UA may include multiple UA operated by a 
single pilot, up to a ratio of 20 UA to 1 pilot. Additionally, these 
airworthiness criteria require the applicant to demonstrate the 
durability and reliability of the UA design by flight test, at the 
highest aircraft-to-pilot ratio, without exceptional piloting skill or 
alertness. In addition, D&R.305(c) requires the applicant to 
demonstrate probable failures by test at the highest aircraft-to-pilot 
ratio. Should the pilot ratio cause a loss of containment or control of 
the UA, then the applicant will fail this testing.
    Comment Summary: ALPA stated that to allow a UAS-pilot ratio of up 
to 20:1 safely, the possibility that the pilot will need to intervene 
with multiple UA simultaneously must be ``extremely remote.'' ALPA 
questioned whether this is feasible given the threat of GNSS 
interference or unanticipated wind gusts exceeding operational limits.
    FAA Response: The FAA's guidance in AC 23.1309-1E, System Safety 
Analysis and Assessment for Part 23 Airplanes defines ``extremely 
remote failure conditions'' as failure conditions not anticipated to 
occur during the total life of an airplane, but which may occur a few 
times when considering the total operational life of all airplanes of 
the same type. When assessing the likelihood of a pilot needing to 
intervene with multiple UA simultaneously, the minimum reliability 
requirements will be determined based on the applicant's proposed 
CONOPS.

Noise

    Comment Summary: Several commenters expressed concern about noise 
pollution and noise levels.
    FAA Response: The Model MK27-2 will need to comply with FAA noise 
certification standards. If the FAA determines that 14 CFR part 36 does 
not contain adequate standards for this design, the agency will propose 
and seek public comment on a rule of particular applicability for noise 
requirements under a separate rulemaking docket.

Operating Altitude

    Comment Summary: ALPA, McMahon Helicopter Services, NAAA, and an 
individual commented on the operation of UAS at or below 400 feet AGL. 
ALPA, McMahon Helicopter Services, and NAAA requested the airworthiness 
criteria contain measures for safe operation at low altitudes so that 
UAS are not a hazard to manned aircraft, especially operations 
involving helicopters; air tours; agricultural applications; emergency 
medical services; air tanker firefighting; power line and pipeline 
patrol and maintenance; fish and wildlife service; animal control; 
military and law enforcement; seismic operations; ranching and 
livestock relocation; and mapping. An individual commenter opposed 
allowing Amazon to fly cargo UA at less than 400 feet altitude over 
people because a stall, power surge or interruption, weather, or signal 
interference will endanger people on the ground.
    An individual requested clarification concerning how Amazon's UAS 
can be exempt from the operational requirements in part 107, 
particularly when carrying property for

[[Page 4138]]

compensation or hire beyond visual line of sight. Another individual 
requested additional information about minimum altitudes and line of 
sight requirements.
    FAA Response: The type certificate only establishes the approved 
design of the UA. These airworthiness criteria require the applicant 
show compliance for the UA altitude sought for type certification. 
While this may result in operating limitations in the flight manual, 
the type certificate is not an approval for operations. Operations and 
operational requirements are beyond the scope of this document.

Guidance Material

    Comment Summary: NUAIR requested the FAA complete and publish its 
draft AC 21.17-XX, Type Certification Basis for Unmanned Aircraft 
Systems (UAS), to provide additional guidance, including templates, to 
those who seek a type design approval for UAS. NUAIR also requested the 
FAA recognize the industry consensus-based standards applicable to UAS, 
as Transport Canada has by publishing its AC 922-001, Remotely Piloted 
Aircraft Systems Safety Assurance.
    FAA Response: The FAA will continue to develop policy and guidance 
for UA type certification and will publish guidance as soon as 
practicable. The FAA encourages consensus standards bodies to develop 
means of compliance and submit them to the FAA for acceptance. 
Regarding Transport Canada AC 922-001, that AC addresses operational 
approval rather than type certification.

Safety Management

    Comment Summary: ALPA requested the FAA ensure that operations, 
including UA integrity, fall under the safety management system. ALPA 
further requested the FAA convene a Safety Risk Management Panel before 
allowing operators to commence operations and that the FAA require 
operators to have an active safety management system, including a non-
punitive safety culture, where incident and continuing airworthiness 
issues can be reported.
    FAA Response: The type certificate only establishes the approved 
design of the UA, including the Flight Manual and ICA. Operations and 
operational requirements, including safety management and oversight of 
operations and maintenance, are beyond the scope of this document.

Process

    Comment Summary: ALPA supported the FAA's type certification of UAS 
as a ``special class'' of aircraft under Sec.  21.17(b) but requested 
that it be temporary.
    FAA Response: As the FAA stated in its notice of policy issued 
August 11, 2020 (85 FR 58251, September 18, 2020), the FAA will use the 
type certification process under Sec.  21.17(b) for some unmanned 
aircraft with no occupants onboard. The FAA further stated in its 
policy that it may also issue type certificates under Sec.  21.17(a) 
for airplane and rotorcraft UAS designs where the airworthiness 
standards in part 23, 25, 27, or 29, respectively, are appropriate. The 
FAA, in the future, may consider establishing appropriate generally 
applicable airworthiness standards for UA that are not certificated 
under the existing standards in parts 23, 25, 27, or 29.

Out of Scope Comments

    The FAA received and reviewed several comments that were general, 
stated the commenter's viewpoint or opposition without a suggestion 
specific to the proposed criteria, or did not make a request the FAA 
can act on. These comments are beyond the scope of this document.

Applicability

    These airworthiness criteria, established under the provisions of 
Sec.  21.17(b), are applicable to the Amazon Model MK27-2 UA. Should 
Amazon wish to apply these airworthiness criteria to other UA models, 
it must submit a new type certification application.

Conclusion

    This action affects only certain airworthiness criteria for the 
Amazon Model MK27-2 UA. It is not a standard of general applicability.

Authority Citation

    The authority citation for these airworthiness criteria is as 
follows:

    Authority: 49 U.S.C. 106(g), 40113, and 44701-44702, 44704.

Airworthiness Criteria

    Pursuant to the authority delegated to me by the Administrator, the 
following airworthiness criteria are issued as part of the type 
certification basis for the Amazon Model MK27-2 unmanned aircraft. The 
FAA finds that compliance with these criteria appropriately mitigates 
the risks associated with the design and concept of operations and 
provides an equivalent level of safety to existing rules.

General

D&R.001 Concept of Operations

    The applicant must define and submit to the FAA a concept of 
operations (CONOPS) proposal describing the unmanned aircraft system 
(UAS) operation in the national airspace system for which unmanned 
aircraft (UA) type certification is requested. The CONOPS proposal must 
include, at a minimum, a description of the following information in 
sufficient detail to determine the parameters and extent of testing and 
operating limitations:
    (a) The intended type of operations;
    (b) UA specifications;
    (c) Meteorological conditions;
    (d) Operators, pilots, and personnel responsibilities;
    (e) Control station, support equipment, and other associated 
elements (AE) necessary to meet the airworthiness criteria;
    (f) Command, control, and communication functions;
    (g) Operational parameters (such as population density, geographic 
operating boundaries, airspace classes, launch and recovery area, 
congestion of proposed operating area, communications with air traffic 
control, line of sight, and aircraft separation); and
    (h) Collision avoidance equipment, whether onboard the UA or part 
of the AE, if requested.

D&R.005 Definitions

    For purposes of these airworthiness criteria, the following 
definitions apply.
    (a) Loss of Control: Loss of control means an unintended departure 
of an aircraft from controlled flight. It includes control reversal or 
an undue loss of longitudinal, lateral, and directional stability and 
control. It also includes an upset or entry into an unscheduled or 
uncommanded attitude with high potential for uncontrolled impact with 
terrain. A loss of control means a spin, loss of control authority, 
loss of aerodynamic stability, divergent flight characteristics, or 
similar occurrence, which could generally lead to crash.
    (b) Loss of Flight: Loss of flight means a UA's inability to 
complete its flight as planned, up to and through its originally 
planned landing. It includes scenarios where the UA experiences 
controlled flight into terrain, obstacles, or any other collision, or a 
loss of altitude that is severe or non-reversible. Loss of flight also 
includes deploying a parachute or ballistic recovery system that leads 
to an unplanned landing outside the operator's designated recovery 
zone.

[[Page 4139]]

Design and Construction

D&R.100 UA Signal Monitoring and Transmission

    The UA must be designed to monitor and transmit to the AE all 
information required for continued safe flight and operation. This 
information includes, at a minimum, the following:
    (a) Status of all critical parameters for all energy storage 
systems;
    (b) Status of all critical parameters for all propulsion systems;
    (c) Flight and navigation information as appropriate, such as 
airspeed, heading, altitude, and location; and
    (d) Communication and navigation signal strength and quality, 
including contingency information or status.

D&R.105 UAS AE Required for Safe UA Operations

    (a) The applicant must identify and submit to the FAA all AE and 
interface conditions of the UAS that affect the airworthiness of the UA 
or are otherwise necessary for the UA to meet these airworthiness 
criteria. As part of this requirement--
    (1) The applicant may identify either specific AE or minimum 
specifications for the AE.
    (i) If minimum specifications are identified, they must include the 
critical requirements of the AE, including performance, compatibility, 
function, reliability, interface, pilot alerting, and environmental 
requirements.
    (ii) Critical requirements are those that if not met would impact 
the ability to operate the UA safely and efficiently.
    (2) The applicant may use an interface control drawing, a 
requirements document, or other reference, titled so that it is clearly 
designated as AE interfaces to the UA.
    (b) The applicant must show the FAA the AE or minimum 
specifications identified in paragraph (a) of this section meet the 
following:
    (1) The AE provide the functionality, performance, reliability, and 
information to assure UA airworthiness in conjunction with the rest of 
the design;
    (2) The AE are compatible with the UA capabilities and interfaces;
    (3) The AE must monitor and transmit to the pilot all information 
required for safe flight and operation, including but not limited to 
those identified in D&R.100; and
    (4) The minimum specifications, if identified, are correct, 
complete, consistent, and verifiable to assure UA airworthiness.
    (c) The FAA will establish the approved AE or minimum 
specifications as operating limitations and include them in the UA type 
certificate data sheet and Flight Manual.
    (d) The applicant must develop any maintenance instructions 
necessary to address implications from the AE on the airworthiness of 
the UA. Those instructions will be included in the instructions for 
continued airworthiness (ICA) required by D&R.205.

D&R.110 Software

    To minimize the existence of software errors, the applicant must:
    (a) Verify by test all software that may impact the safe operation 
of the UA;
    (b) Utilize a configuration management system that tracks, 
controls, and preserves changes made to software throughout the entire 
life cycle; and
    (c) Implement a problem reporting system that captures and records 
defects and modifications to the software.

D&R.115 Cybersecurity

    (a) UA equipment, systems, and networks, addressed separately and 
in relation to other systems, must be protected from intentional 
unauthorized electronic interactions that may result in an adverse 
effect on the security or airworthiness of the UA. Protection must be 
ensured by showing that the security risks have been identified, 
assessed, and mitigated as necessary.
    (b) When required by paragraph (a) of this section, procedures and 
instructions to ensure security protections are maintained must be 
included in the ICA.

D&R.120 Contingency Planning

    (a) The UA must be designed so that, in the event of a loss of the 
command and control (C2) link, the UA will automatically and 
immediately execute a safe predetermined flight, loiter, landing, or 
termination.
    (b) The applicant must establish the predetermined action in the 
event of a loss of the C2 link and include it in the UA Flight Manual.
    (c) The UA Flight Manual must include the minimum performance 
requirements for the C2 data link defining when the C2 link is degraded 
to a level where remote active control of the UA is no longer ensured. 
Takeoff when the C2 link is degraded below the minimum link performance 
requirements must be prevented by design or prohibited by an operating 
limitation in the UA Flight Manual.

D&R.125 Lightning

    (a) Except as provided in paragraph (b) of this section, the UA 
must have design characteristics that will protect the UA from loss of 
flight or loss of control due to lightning.
    (b) If the UA has not been shown to protect against lightning, the 
UA Flight Manual must include an operating limitation to prohibit 
flight into weather conditions conducive to lightning activity.

D&R.130 Adverse Weather Conditions

    (a) For purposes of this section, ``adverse weather conditions'' 
means rain, snow, and icing.
    (b) Except as provided in paragraph (c) of this section, the UA 
must have design characteristics that will allow the UA to operate 
within the adverse weather conditions specified in the CONOPS without 
loss of flight or loss of control.
    (c) For adverse weather conditions for which the UA is not approved 
to operate, the applicant must develop operating limitations to 
prohibit flight into known adverse weather conditions and either:
    (1) Develop operating limitations to prevent inadvertent flight 
into adverse weather conditions; or
    (2) Provide a means to detect any adverse weather conditions for 
which the UA is not certificated to operate and show the UA's ability 
to avoid or exit those conditions.

D&R.135 Flight Essential Parts

    (a) A flight essential part is a part, the failure of which could 
result in a loss of flight or unrecoverable loss of UA control.
    (b) If the type design includes flight essential parts, the 
applicant must establish a flight essential parts list. The applicant 
must develop and define mandatory maintenance instructions or life 
limits, or a combination of both, to prevent failures of flight 
essential parts. Each of these mandatory actions must be included in 
the Airworthiness Limitations Section of the ICA.

Operating Limitations and Information

D&R.200 Flight Manual

    The applicant must provide a Flight Manual with each UA.
    (a) The UA Flight Manual must contain the following information:
    (1) UA operating limitations;
    (2) UA operating procedures;
    (3) Performance information;
    (4) Loading information; and
    (5) Other information that is necessary for safe operation because 
of design, operating, or handling characteristics.
    (b) Those portions of the UA Flight Manual containing the 
information specified in paragraph (a)(1) of this section must be 
approved by the FAA.

[[Page 4140]]

D&R.205 Instructions for Continued Airworthiness

    The applicant must prepare ICA for the UA in accordance with 
Appendix A to Part 23, as appropriate, that are acceptable to the FAA. 
The ICA may be incomplete at type certification if a program exists to 
ensure their completion prior to delivery of the first UA or issuance 
of a standard airworthiness certificate, whichever occurs later.

Testing

D&R.300 Durability and Reliability

    The UA must be designed to be durable and reliable when operated 
under the limitations prescribed for its operating environment, as 
documented in its CONOPS and included as operating limitations on the 
type certificate data sheet and in the UA Flight Manual. The durability 
and reliability must be demonstrated by flight test in accordance with 
the requirements of this section and completed with no failures that 
result in a loss of flight, loss of control, loss of containment, or 
emergency landing outside the operator's recovery area.
    (a) Once a UA has begun testing to show compliance with this 
section, all flights for that UA must be included in the flight test 
report.
    (b) Tests must include an evaluation of the entire flight envelope 
across all phases of operation and must address, at a minimum, the 
following:
    (1) Flight distances;
    (2) Flight durations;
    (3) Route complexity;
    (4) Weight;
    (5) Center of gravity;
    (6) Density altitude;
    (7) Outside air temperature;
    (8) Airspeed;
    (9) Wind;
    (10) Weather;
    (11) Operation at night, if requested;
    (12) Energy storage system capacity; and
    (13) Aircraft to pilot ratio.
    (c) Tests must include the most adverse combinations of the 
conditions and configurations in paragraph (b) of this section.
    (d) Tests must show a distribution of the different flight profiles 
and routes representative of the type of operations identified in the 
CONOPS.
    (e) Tests must be conducted in conditions consistent with the 
expected environmental conditions identified in the CONOPS, including 
electromagnetic interference (EMI) and high intensity radiated fields 
(HIRF).
    (f) Tests must not require exceptional piloting skill or alertness.
    (g) Any UAS used for testing must be subject to the same worst-case 
ground handling, shipping, and transportation loads as those allowed in 
service.
    (h) Any UA used for testing must use AE that meet, but do not 
exceed, the minimum specifications identified under D&R.105. If 
multiple AE are identified, the applicant must demonstrate each 
configuration.
    (i) Any UAS used for testing must be maintained and operated in 
accordance with the ICA and UA Flight Manual. No maintenance beyond the 
intervals established in the ICA will be allowed to show compliance 
with this section.
    (j) If cargo operations or external-load operations are requested, 
tests must show, throughout the flight envelope and with the cargo or 
external-load at the most critical combinations of weight and center of 
gravity, that--
    (1) The UA is safely controllable and maneuverable; and
    (2) The cargo or external-load are retainable and transportable.

D&R.305 Probable Failures

    The UA must be designed such that a probable failure will not 
result in a loss of containment or control of the UA. This must be 
demonstrated by test.
    (a) Probable failures related to the following equipment, at a 
minimum, must be addressed:
    (1) Propulsion systems;
    (2) C2 link;
    (3) Global Positioning System (GPS);
    (4) Flight control components with a single point of failure;
    (5) Control station; and
    (6) Any other AE identified by the applicant.
    (b) Any UA used for testing must be operated in accordance with the 
UA Flight Manual.
    (c) Each test must occur at the critical phase and mode of flight, 
and at the highest aircraft-to-pilot ratio.

D&R.310 Capabilities and Functions

    (a) All of the following required UAS capabilities and functions 
must be demonstrated by test:
    (1) Capability to regain command and control of the UA after the C2 
link has been lost.
    (2) Capability of the electrical system to power all UA systems and 
payloads.
    (3) Ability for the pilot to safely discontinue the flight.
    (4) Ability for the pilot to dynamically re-route the UA.
    (5) Ability to safely abort a takeoff.
    (6) Ability to safely abort a landing and initiate a go-around.
    (b) The following UAS capabilities and functions, if requested for 
approval, must be demonstrated by test:
    (1) Continued flight after degradation of the propulsion system.
    (2) Geo-fencing that contains the UA within a designated area, in 
all operating conditions.
    (3) Positive transfer of the UA between control stations that 
ensures only one control station can control the UA at a time.
    (4) Capability to release an external cargo load to prevent loss of 
control of the UA.
    (5) Capability to detect and avoid other aircraft and obstacles.
    (c) The UA must be designed to safeguard against inadvertent 
discontinuation of the flight and inadvertent release of cargo or 
external load.

D&R.315 Fatigue

    The structure of the UA must be shown to withstand the repeated 
loads expected during its service life without failure. A life limit 
for the airframe must be established, demonstrated by test, and 
included in the ICA.

D&R.320 Verification of Limits

    The performance, maneuverability, stability, and control of the UA 
within the flight envelope described in the UA Flight Manual must be 
demonstrated at a minimum of 5% over maximum gross weight with no loss 
of control or loss of flight.

    Issued in Washington, DC, on January 21, 2022.
Ian Lucas,
Manager, Policy Implementation Section, Policy and Innovation Division, 
Aircraft Certification Service.
[FR Doc. 2022-01556 Filed 1-26-22; 8:45 am]
BILLING CODE 4910-13-P